Spring Security SEC-2550: Classloader leak in Java 7 and 8 but not 6

Arlo O'Keeffe (Migrated from SEC-2550) said:

I have an integration test in my application that tests for classloader leaks and it fails since I introduced spring security. Therefore I tried reproducing the problem with the helloworld-jc sample and it also leaks.

To reproduce: - package the helloworld-jc application - start a tomcat with java 7 or 8 - deploy the application - stop the application - execute 'Find Leaks' - see that the application leaks

If you start the application with Java 6, everything works. Therefore this might actually be a java problem but I don't know where to report such a problem.

I also took a heap dump and looked for GC roots from the webappclassloader but could not find any.

Comment From: spring-projects-issues

Rob Winch said:

Thanks for the report. Do you have any additional details? Tomcat can report false positives at times so if there are no GC roots on the dump, then it is quite likely there is no leak.

Comment From: ArloL

I have not found any further issues. This can be closed.

Comment From: jgrandja

Thanks for getting back to us @ArloL.