Don't keep an old session to avoid a stable objects and a memory leak

ahus1 · web-flow · commit 6a4e4abf30bb · 2025-10-29T17:36:41.000-03:00
Closes #43761 Signed-off-by: Alexander Schwartz <alexander.schwartz@ibm.com>
diff --git a/services/src/main/java/org/keycloak/timer/basic/BasicTimerProvider.java b/services/src/main/java/org/keycloak/timer/basic/BasicTimerProvider.java
@@ -47,12 +47,7 @@ public BasicTimerProvider(KeycloakSession session, Timer timer, int transactionT
 
     @Override
     public void schedule(final Runnable runnable, final long intervalMillis, String taskName) {
-        TimerTask task = new TimerTask() {
-            @Override
-            public void run() {
-                runnable.run();
-            }
-        };
+        TimerTask task = new BasicTimerTask(runnable);
 
         TimerTaskContextImpl taskContext = new TimerTaskContextImpl(runnable, task, intervalMillis);
         TimerTaskContextImpl existingTask = factory.putTask(taskName, taskContext);
@@ -87,4 +82,20 @@ public void close() {
         // do nothing
     }
 
+    /**
+     * Using a private static class avoids keeping a reference to {@link BasicTimerProvider} which then fails to be garbage collected,
+     * including its reference to {@link KeycloakSession}.
+     */
+    private static class BasicTimerTask extends TimerTask {
+        private final Runnable runnable;
+
+        public BasicTimerTask(Runnable runnable) {
+            this.runnable = runnable;
+        }
+
+        @Override
+        public void run() {
+            runnable.run();
+        }
+    }
 }
