Memory Leak

// ── Pattern 1: Unbounded static collection ───────────────────────────
// LEAK: SessionCache grows without bound
public class SessionManager {
    // LEAK: entries added but never removed
    private static final Map<String, UserSession> SESSIONS =
        new HashMap<>();

    public void createSession(String token, UserSession session) {
        SESSIONS.put(token, session);  // grows forever
        // When sessions expire, they are still in the map!
    }
}

// FIX 1: Remove expired entries
public void invalidateSession(String token) {
    SESSIONS.remove(token);  // explicit removal
}

// FIX 2: Bounded LRU cache with automatic eviction
private static final Map<String, UserSession> SESSIONS =
    Collections.synchronizedMap(
        new LinkedHashMap<String, UserSession>(1000, 0.75f, true) {
            @Override
            protected boolean removeEldestEntry(
                    Map.Entry<String, UserSession> eldest) {
                return size() > 1000;  // evict when exceeding limit
            }
        });

// FIX 3: Use Caffeine or Guava Cache with expiry
private static final Cache<String, UserSession> SESSIONS =
    Caffeine.newBuilder()
        .maximumSize(10_000)
        .expireAfterAccess(30, TimeUnit.MINUTES)
        .build();

// ── Pattern 2: ThreadLocal leak in thread pools ───────────────────────
// LEAK: RequestContext set but not cleared — leaks to next request
public class RequestFilter implements Filter {

    static final ThreadLocal<RequestContext> CONTEXT =
        new ThreadLocal<>();

    @Override
    public void doFilter(ServletRequest req, ServletResponse res,
                         FilterChain chain) throws Exception {
        CONTEXT.set(new RequestContext(req));   // set for this request
        chain.doFilter(req, res);
        // LEAK: if exception thrown, CONTEXT is never cleared!
        // Thread returns to pool with stale context for next request
    }
}

// FIX: clear in finally
@Override
public void doFilter(ServletRequest req, ServletResponse res,
                     FilterChain chain) throws Exception {
    CONTEXT.set(new RequestContext(req));
    try {
        chain.doFilter(req, res);
    } finally {
        CONTEXT.remove();   // ALWAYS clear — even if exception thrown
    }
}

// ── Pattern 3: Listener not deregistered (lapsed listener) ──────────
public class LiveDataMonitor {

    // Long-lived: survives for the application lifetime
    private final MetricsCollector metricsCollector;

    // Short-lived: should be collected when this Monitor is closed
    private final AlertService alertService;

    public LiveDataMonitor(MetricsCollector collector,
                           AlertService alerts) {
        this.metricsCollector = collector;
        this.alertService     = alerts;

        // LEAK: anonymous class captures 'this' (LiveDataMonitor)
        // metricsCollector holds a reference to the lambda
        // lambda holds a reference to LiveDataMonitor via captured 'this'
        // LiveDataMonitor can never be collected while metricsCollector lives
        metricsCollector.addListener(metric -> {
            if (metric.value() > THRESHOLD) {
                alertService.alert(metric);  // captures 'this'
            }
        });
    }
}

// FIX: keep reference to listener and deregister on close
public class LiveDataMonitor implements AutoCloseable {

    private final MetricsCollector metricsCollector;
    private final Consumer<Metric> listener;   // hold a reference

    public LiveDataMonitor(MetricsCollector collector,
                           AlertService alerts) {
        this.metricsCollector = collector;
        this.listener = metric -> {
            if (metric.value() > THRESHOLD) {
                alerts.alert(metric);
            }
        };
        collector.addListener(this.listener);  // register
    }

    @Override
    public void close() {
        metricsCollector.removeListener(this.listener);  // deregister!
    }
}

// Usage with try-with-resources:
try (LiveDataMonitor monitor = new LiveDataMonitor(collector, alerts)) {
    // ... use monitor ...
}   // close() called → listener deregistered → monitor can be GC'd

// ── Pattern 4: Inner class holding outer reference ────────────────────
public class DataProcessor {

    private final byte[] largeBuffer = new byte[100_000_000];  // 100MB

    // LEAK: non-static inner class holds implicit reference to DataProcessor
    public Runnable createTask() {
        return new Runnable() {   // holds DataProcessor.this
            @Override
            public void run() {
                // even if largeBuffer is not used, DataProcessor is retained
                System.out.println("Task running");
            }
        };
    }

    // FIX: static nested class — no outer reference
    private static class StaticTask implements Runnable {
        @Override
        public void run() {
            System.out.println("Task running");  // no DataProcessor reference
        }
    }

    public Runnable createSafeTask() {
        return new StaticTask();  // DataProcessor can be GC'd
    }
}

// ── JVM flags for leak detection ─────────────────────────────────────
// java -XX:+HeapDumpOnOutOfMemoryError        automatically dump on OOM
// java -XX:HeapDumpPath=/var/dumps/heap.hprof path for heap dump
// java -XX:+FlightRecorder                    enable JFR
// java -Xlog:gc*                              GC logging for heap growth trend

// ── jstat — monitor heap over time ───────────────────────────────────
// jstat -gcutil <pid> 5000 60
// (Print every 5 seconds for 60 iterations)
//
// S0     S1     E      O      M     CCS    YGC   YGCT  FGC  FGCT    GCT
// 0.00  43.21  56.78  12.34  96.78  91.23  342   1.234   0   0.000  1.234
// 0.00  43.21  67.89  12.34  96.78  91.23  343   1.245   0   0.000  1.245
// 0.00  43.21  23.45  13.56  96.78  91.23  344   1.256   0   0.000  1.256
//                            ↑ O (Old gen) rising after each GC = LEAK
//
// Healthy: O stays roughly constant between major collections
// Leak: O drifts upward across many GC cycles

// ── jcmd for heap dump ────────────────────────────────────────────────
// jcmd <pid> GC.heap_dump /tmp/heap.hprof
// jcmd <pid> VM.native_memory      (see all memory regions)
// jcmd <pid> GC.heap_info          (quick heap summary)

// ── Eclipse MAT queries (OQL) ─────────────────────────────────────────
// Find all HashMap instances > 100MB:
// SELECT * FROM java.util.HashMap WHERE
//     totalSize(this) > 100 * 1024 * 1024

// Find instances of a specific type:
// SELECT * FROM com.myapp.UserSession

// Find path from a suspected leaker to GC root via MAT GUI:
// Heap Dump → Dominator Tree → Right-click → Path To GC Roots

// ── Systematic leak hunt process ─────────────────────────────────────
// 1. Observe heap growth over time with jstat or monitoring
// 2. Take heap dump when heap is large (not right after startup)
// 3. Open in Eclipse MAT: Leak Suspects Report → automated analysis
// 4. Look at Dominator Tree → largest objects retained by single path
// 5. "Path To GC Roots" on suspected objects → identify retaining path
// 6. The retaining path leads to: static field, ThreadLocal, listener, cache
// 7. Fix the retention by removing references when no longer needed
// 8. Re-run and verify heap stabilises

// ── Pattern 5: Cache without eviction ────────────────────────────────
// LEAK: cache grows without bound
public class ImageCache {
    private static final Map<String, BufferedImage> CACHE = new HashMap<>();

    public static BufferedImage get(String url) {
        return CACHE.computeIfAbsent(url, ImageCache::loadImage);
        // Every URL ever loaded is kept in memory FOREVER
    }
}

// FIX: use Caffeine with size and time limits
private static final Cache<String, BufferedImage> CACHE =
    Caffeine.newBuilder()
        .maximumSize(500)                          // max 500 images
        .expireAfterAccess(1, TimeUnit.HOURS)      // evict after 1h idle
        .softValues()                               // allow GC under pressure
        .recordStats()                             // monitor hit rate
        .build();

// ── Pattern 6: ClassLoader leak — JDBC driver not deregistered ────────
// Application registers driver on startup:
public class AppServletContextListener implements ServletContextListener {

    @Override
    public void contextInitialized(ServletContextEvent sce) {
        // JDBC driver registered in shared DriverManager
        // DriverManager holds reference to driver class
        // Driver class is loaded by app ClassLoader
        // DriverManager survives undeployment → app ClassLoader retained
    }

    @Override
    public void contextDestroyed(ServletContextEvent sce) {
        // FIX: deregister JDBC drivers on undeploy
        Enumeration<Driver> drivers = DriverManager.getDrivers();
        while (drivers.hasMoreElements()) {
            Driver driver = drivers.nextElement();
            // Only deregister drivers from OUR ClassLoader
            if (driver.getClass().getClassLoader()
                    == getClass().getClassLoader()) {
                try {
                    DriverManager.deregisterDriver(driver);
                } catch (SQLException e) {
                    log.warn("Failed to deregister JDBC driver", e);
                }
            }
        }

        // Also shutdown any connection pools
        if (dataSource instanceof HikariDataSource) {
            ((HikariDataSource) dataSource).close();
        }
    }
}

// ── Checking for ClassLoader leaks ────────────────────────────────────
// After undeployment, check if old ClassLoader was collected:
// jcmd <pid> VM.classloader_stats
// If you see multiple instances of your app ClassLoader after redeployment,
// you have a ClassLoader leak

// Heap dump analysis for ClassLoader leaks:
// Eclipse MAT → OQL:
// SELECT * FROM java.lang.ClassLoader WHERE
//     toString(this) LIKE "*WebappClassLoader*"
// If count > 1 per deployment, ClassLoaders are leaking