This relates to the OgnlRuntime.invokeMethod.

Version 2.6.11 introduced sychronization on the Method instance for any Class whose instances are being traversed. Method instances, like Class instances, are singletons within a classloader. Net result: no two threads can call method.invoke concurrently, even against two different target object instances. Scalability is completely hosed.

I saw that in the 2.6.10 there could be race conditions on the accessibility permissions of the methods, so it does make sense to synchronize here. But in most high concurrency applications, I'd trade the ability to access private methods for scalability any day.



   public static Object invokeMethod( Object target, Method method, Object[] argsArray ) throws InvocationTargetException, IllegalAccessException
   {
       Object result;
       boolean wasAccessible = true;

       if (securityManager != null) {
           try {
               securityManager.checkPermission(getPermission(method));
           } catch (SecurityException ex) {
               throw new IllegalAccessException("Method [" + method + "] cannot be accessed.");
           }
       }
       synchronized (method) {
           if (!Modifier.isPublic(method.getModifiers()) || !Modifier.isPublic(method.getDeclaringClass().getModifiers())) {
               if (!(wasAccessible = ((AccessibleObject)method).isAccessible())) {
                   ((AccessibleObject)method).setAccessible(true);
               }
           }
           result = method.invoke( target, argsArray );
           if (!wasAccessible) {
               ((AccessibleObject)method).setAccessible(false);
           }
       }
       return result;
   }