Fix fastjson2 concurrent ref deserialization

dubbo-serialization/dubbo-serialization-fastjson2/src/main/java/org/apache/dubbo/common/serialize/fastjson2/FastJson2ObjectInput.java

@@ -46,7 +46,6 @@ public FastJson2ObjectInput(
         this.fastjson2SecurityManager = fastjson2SecurityManager;
         this.classLoader = Thread.currentThread().getContextClassLoader();
         this.is = in;
-        fastjson2CreatorManager.setCreator(classLoader);
     }
 
     @Override
@@ -117,27 +116,7 @@ public <T> T readObject(Class<T> cls) throws IOException {
                     "deserialize failed. expected read length: " + length + " but actual read: " + read);
         }
         Fastjson2SecurityManager.Handler securityFilter = fastjson2SecurityManager.getSecurityFilter();
-        T result;
-        if (securityFilter.isCheckSerializable()) {
-            result = JSONB.parseObject(
-                    bytes,
-                    cls,
-                    securityFilter,
-                    JSONReader.Feature.UseDefaultConstructorAsPossible,
-                    JSONReader.Feature.ErrorOnNoneSerializable,
-                    JSONReader.Feature.IgnoreAutoTypeNotMatch,
-                    JSONReader.Feature.UseNativeObject,
-                    JSONReader.Feature.FieldBased);
-        } else {
-            result = JSONB.parseObject(
-                    bytes,
-                    cls,
-                    securityFilter,
-                    JSONReader.Feature.UseDefaultConstructorAsPossible,
-                    JSONReader.Feature.UseNativeObject,
-                    JSONReader.Feature.IgnoreAutoTypeNotMatch,
-                    JSONReader.Feature.FieldBased);
-        }
+        T result = parseObject(bytes, cls, securityFilter);
         if (result != null && cls != null && !ClassUtils.isMatch(result.getClass(), cls)) {
             throw new IllegalArgumentException(
                     "deserialize failed. expected class: " + cls + " but actual class: " + result.getClass());
@@ -156,27 +135,7 @@ public <T> T readObject(Class<T> cls, Type type) throws IOException, ClassNotFou
                     "deserialize failed. expected read length: " + length + " but actual read: " + read);
         }
         Fastjson2SecurityManager.Handler securityFilter = fastjson2SecurityManager.getSecurityFilter();
-        T result;
-        if (securityFilter.isCheckSerializable()) {
-            result = JSONB.parseObject(
-                    bytes,
-                    cls,
-                    securityFilter,
-                    JSONReader.Feature.UseDefaultConstructorAsPossible,
-                    JSONReader.Feature.ErrorOnNoneSerializable,
-                    JSONReader.Feature.IgnoreAutoTypeNotMatch,
-                    JSONReader.Feature.UseNativeObject,
-                    JSONReader.Feature.FieldBased);
-        } else {
-            result = JSONB.parseObject(
-                    bytes,
-                    cls,
-                    securityFilter,
-                    JSONReader.Feature.UseDefaultConstructorAsPossible,
-                    JSONReader.Feature.UseNativeObject,
-                    JSONReader.Feature.IgnoreAutoTypeNotMatch,
-                    JSONReader.Feature.FieldBased);
-        }
+        T result = parseObject(bytes, cls, securityFilter);
         if (result != null && cls != null && !ClassUtils.isMatch(result.getClass(), cls)) {
             throw new IllegalArgumentException(
                     "deserialize failed. expected class: " + cls + " but actual class: " + result.getClass());
@@ -187,7 +146,6 @@ public <T> T readObject(Class<T> cls, Type type) throws IOException, ClassNotFou
     private void updateClassLoaderIfNeed() {
         ClassLoader currentClassLoader = Thread.currentThread().getContextClassLoader();
         if (currentClassLoader != classLoader) {
-            fastjson2CreatorManager.setCreator(currentClassLoader);
             classLoader = currentClassLoader;
         }
     }
@@ -205,4 +163,54 @@ private int readLength() throws IOException {
         }
         return value;
     }
+
+    private <T> T parseObject(byte[] bytes, Class<T> cls, Fastjson2SecurityManager.Handler securityFilter) {
+        Fastjson2CreatorManager.ParseWarmupState warmup = fastjson2CreatorManager.getReaderWarmup(cls);
+        if (!warmup.isWarmed()) {
+            warmup.addPending();
+            if (!warmup.isWarmed()) {
+                synchronized (fastjson2CreatorManager.getReaderWarmupLock()) {
+                    if (!warmup.isWarmed()) {
+                        try {
+                            fastjson2CreatorManager.setCreator(classLoader);
+                            T result = parseObjectWithoutWarmupLock(bytes, cls, securityFilter);
+                            if (warmup.removePending() == 0) {
+                                warmup.markWarmed();
+                            }
+                            return result;
+                        } catch (RuntimeException | Error exception) {
+                            warmup.removePending();
+                            throw exception;
+                        }
+                    }
+                }
+            }
+            warmup.removePending();
+        }
+        fastjson2CreatorManager.setCreator(classLoader);
+        return parseObjectWithoutWarmupLock(bytes, cls, securityFilter);
+    }
+
+    private <T> T parseObjectWithoutWarmupLock(
+            byte[] bytes, Class<T> cls, Fastjson2SecurityManager.Handler securityFilter) {
+        if (securityFilter.isCheckSerializable()) {
+            return JSONB.parseObject(
+                    bytes,
+                    cls,
+                    securityFilter,
+                    JSONReader.Feature.UseDefaultConstructorAsPossible,
+                    JSONReader.Feature.ErrorOnNoneSerializable,
+                    JSONReader.Feature.IgnoreAutoTypeNotMatch,
+                    JSONReader.Feature.UseNativeObject,
+                    JSONReader.Feature.FieldBased);
+        }
+        return JSONB.parseObject(
+                bytes,
+                cls,
+                securityFilter,
+                JSONReader.Feature.UseDefaultConstructorAsPossible,
+                JSONReader.Feature.UseNativeObject,
+                JSONReader.Feature.IgnoreAutoTypeNotMatch,
+                JSONReader.Feature.FieldBased);
+    }
 }

dubbo-serialization/dubbo-serialization-fastjson2/src/main/java/org/apache/dubbo/common/serialize/fastjson2/Fastjson2CreatorManager.java

@@ -22,6 +22,8 @@
 import org.apache.dubbo.rpc.model.ScopeClassLoaderListener;
 
 import java.util.concurrent.ConcurrentHashMap;
+import java.util.concurrent.atomic.AtomicBoolean;
+import java.util.concurrent.atomic.AtomicInteger;
 
 import com.alibaba.fastjson2.JSONFactory;
 import com.alibaba.fastjson2.reader.ObjectReaderCreator;
@@ -38,6 +40,31 @@ public class Fastjson2CreatorManager implements ScopeClassLoaderListener<Framewo
 
     private final ConcurrentHashMap<ClassLoader, ObjectReaderCreator> readerMap = new ConcurrentHashMap<>();
     private final ConcurrentHashMap<ClassLoader, ObjectWriterCreator> writerMap = new ConcurrentHashMap<>();
+    // Drain the initial burst of cold readers before switching that target type to the lock-free path.
+    private final Object readerWarmupLock = new Object();
+    private final ParseWarmupState nullReaderWarmup = new ParseWarmupState();
+    private final ConcurrentHashMap<Class<?>, ParseWarmupState> readerWarmups = new ConcurrentHashMap<>();
+
+    static final class ParseWarmupState {
+        private final AtomicBoolean warmed = new AtomicBoolean();
+        private final AtomicInteger pending = new AtomicInteger();
+
+        boolean isWarmed() {
+            return warmed.get();
+        }
+
+        void markWarmed() {
+            warmed.set(true);
+        }
+
+        void addPending() {
+            pending.incrementAndGet();
+        }
+
+        int removePending() {
+            return pending.decrementAndGet();
+        }
+    }
 
     public Fastjson2CreatorManager(FrameworkModel frameworkModel) {
         frameworkModel.addClassLoaderListener(this);
@@ -58,6 +85,14 @@ public void setCreator(ClassLoader classLoader) {
         }
     }
 
+    Object getReaderWarmupLock() {
+        return readerWarmupLock;
+    }
+
+    ParseWarmupState getReaderWarmup(Class<?> type) {
+        return type == null ? nullReaderWarmup : readerWarmups.computeIfAbsent(type, ignored -> new ParseWarmupState());
+    }
+
     @Override
     public void onAddClassLoader(FrameworkModel scopeModel, ClassLoader classLoader) {
         // nop
@@ -67,5 +102,6 @@ public void onAddClassLoader(FrameworkModel scopeModel, ClassLoader classLoader)
     public void onRemoveClassLoader(FrameworkModel scopeModel, ClassLoader classLoader) {
         readerMap.remove(classLoader);
         writerMap.remove(classLoader);
+        readerWarmups.keySet().removeIf(type -> type.getClassLoader() == classLoader);
     }
 }

dubbo-serialization/dubbo-serialization-fastjson2/src/test/java/org/apache/dubbo/common/serialize/fastjson2/ConcurrentRefInner.java

@@ -0,0 +1,46 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements.  See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to You under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.apache.dubbo.common.serialize.fastjson2;
+
+import java.io.Serializable;
+import java.util.List;
+
+/**
+ * Concurrent reference deserialization fixture.
+ *
+ * @date 2026/07/29
+ */
+public class ConcurrentRefInner implements Serializable {
+    private String name;
+    private List<Long> ids;
+
+    public String getName() {
+        return name;
+    }
+
+    public void setName(String name) {
+        this.name = name;
+    }
+
+    public List<Long> getIds() {
+        return ids;
+    }
+
+    public void setIds(List<Long> ids) {
+        this.ids = ids;
+    }
+}

dubbo-serialization/dubbo-serialization-fastjson2/src/test/java/org/apache/dubbo/common/serialize/fastjson2/ConcurrentRefOuter.java

@@ -0,0 +1,37 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements.  See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to You under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.apache.dubbo.common.serialize.fastjson2;
+
+import java.io.Serializable;
+import java.util.List;
+
+/**
+ * Concurrent reference deserialization fixture.
+ *
+ * @date 2026/07/29
+ */
+public class ConcurrentRefOuter implements Serializable {
+    private List<ConcurrentRefInner> items;
+
+    public List<ConcurrentRefInner> getItems() {
+        return items;
+    }
+
+    public void setItems(List<ConcurrentRefInner> items) {
+        this.items = items;
+    }
+}