Skip to content

Fix TraceStateBuilder.remove corrupting the builder when the same key is removed twice#8613

Merged
jack-berg merged 1 commit into
open-telemetry:mainfrom
thswlsqls:fix/trace-state-builder-double-remove
Jul 21, 2026
Merged

Fix TraceStateBuilder.remove corrupting the builder when the same key is removed twice#8613
jack-berg merged 1 commit into
open-telemetry:mainfrom
thswlsqls:fix/trace-state-builder-double-remove

Conversation

@thswlsqls

Copy link
Copy Markdown
Contributor

Fixes #8612

Description

  • ArrayBasedTraceStateBuilder.remove() decremented numEntries without checking whether the value was already null, so removing a key twice drove the counter below the real count.
  • build() trusts numEntries in three places, so the drift leaks a {a=null} entry, silently drops live entries, or throws ArrayIndexOutOfBoundsException.
  • Mirrors the sibling put() (same class, line 74-78), which already does this check; first removal is unchanged.
  • No in-repo caller, but TraceStateBuilder is stable public API for external instrumentation and vendor propagators. The silent data loss contradicts the no-op contract of the remove(String) Javadoc ("if it is present") and of removeNotPresent(), and is reachable via reuseBuilder().
  • Same defect shape as Fix PooledHashMap dropping live entries when an entry is removed during forEach #8499 (PooledHashMap dropping live entries).

Testing done

  • Added TraceStateTest#removeTwice, #removeTwice_KeepsRemainingEntry, #removeTwice_KeepsRemainingEntries for one, two, and three entries. All three fail without the fix; 41 pass with it.
  • ./gradlew :api:all:check — passed, 504 tests.
  • No signature change (package-private class): apidiff unchanged.
  • CHANGELOG.md ## Unreleased### API entry added.

@thswlsqls
thswlsqls force-pushed the fix/trace-state-builder-double-remove branch from 184a512 to 0b8dc2f Compare July 16, 2026 21:00
@codecov

codecov Bot commented Jul 16, 2026

Copy link
Copy Markdown

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 91.64%. Comparing base (09d6c17) to head (d24559d).

Additional details and impacted files
@@             Coverage Diff              @@
##               main    #8613      +/-   ##
============================================
- Coverage     91.64%   91.64%   -0.01%     
  Complexity    10348    10348              
============================================
  Files          1013     1013              
  Lines         27380    27381       +1     
  Branches       3218     3219       +1     
============================================
  Hits          25092    25092              
  Misses         1558     1558              
- Partials        730      731       +1     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

@thswlsqls
thswlsqls force-pushed the fix/trace-state-builder-double-remove branch from 0b8dc2f to d24559d Compare July 18, 2026 01:00
@thswlsqls
thswlsqls marked this pull request as ready for review July 18, 2026 01:03
@thswlsqls
thswlsqls requested a review from a team as a code owner July 18, 2026 01:03
@opentelemetry-pr-dashboard

opentelemetry-pr-dashboard Bot commented Jul 18, 2026

Copy link
Copy Markdown

Pull request dashboard status

Status last refreshed: 2026-07-21 20:50:25 UTC.

  • Status: Merged.

This automated status or its linked feedback items may be incorrect. If something looks wrong, report it with the result you expected.

@jack-berg
jack-berg merged commit 1ab326a into open-telemetry:main Jul 21, 2026
30 checks passed
@otelbot

otelbot Bot commented Jul 21, 2026

Copy link
Copy Markdown
Contributor

Thank you for your contribution @thswlsqls! 🎉 We would like to hear from you about your experience contributing to OpenTelemetry by taking a few minutes to fill out this survey.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

TraceStateBuilder.remove corrupts the builder when the same key is removed twice

2 participants