From ceed2dc7bc9865218d9bbfdf3f1ce591bee4d7ce Mon Sep 17 00:00:00 2001
From: Tatu Saloranta <tatu.saloranta@iki.fi>
Date: Tue, 15 Jan 2019 20:24:01 -0800
Subject: [PATCH] Fix #1408

---
 pom.xml                                         |  2 +-
 release-notes/CREDITS-2.x                       |  5 +++++
 release-notes/VERSION-2.x                       |  5 +++++
 .../jackson/databind/type/TypeFactory.java      | 17 +++++++++++++++--
 4 files changed, 26 insertions(+), 3 deletions(-)

diff --git a/pom.xml b/pom.xml
index 5466201b49..5e0c0afa53 100644
--- a/pom.xml
+++ b/pom.xml
@@ -5,7 +5,7 @@
   <parent>
     <groupId>com.fasterxml.jackson</groupId>
     <artifactId>jackson-base</artifactId>
-    <version>2.9.8</version>
+    <version>2.9.9-SNAPSHOT</version>
   </parent>
 
   <groupId>com.fasterxml.jackson.core</groupId>
diff --git a/release-notes/CREDITS-2.x b/release-notes/CREDITS-2.x
index b0728a9e2f..36ec432ae9 100644
--- a/release-notes/CREDITS-2.x
+++ b/release-notes/CREDITS-2.x
@@ -819,6 +819,11 @@ Pavel Nikitin (morj@github)
   * Requested #2181: Don't re-use dynamic serializers for property-updating copy constructors
    (2.9.8)
 
+Thomas Krieger (ThomasKrieger@github)
+  * Reported #1408: Call to `TypeVariable.getBounds()` without synchronization unsafe on
+    some platforms
+   (2.9.9)
+
 René Kschamer (flawi@github)
   * Reported #2197: Illegal reflective access operation warning when using `java.lang.Void`
    as value type
diff --git a/release-notes/VERSION-2.x b/release-notes/VERSION-2.x
index 1e2f15183b..634568e4c8 100644
--- a/release-notes/VERSION-2.x
+++ b/release-notes/VERSION-2.x
@@ -4,6 +4,11 @@ Project: jackson-databind
 === Releases === 
 ------------------------------------------------------------------------
 
+2.9.9 (not yet released)
+
+#1408: Call to `TypeVariable.getBounds()` without synchronization unsafe on some platforms
+ (reported by Thomas K)
+
 2.9.8 (15-Dec-2018)
 
 #1662: `ByteBuffer` serialization is broken if offset is not 0
diff --git a/src/main/java/com/fasterxml/jackson/databind/type/TypeFactory.java b/src/main/java/com/fasterxml/jackson/databind/type/TypeFactory.java
index e871c9f1d5..77279a78e5 100644
--- a/src/main/java/com/fasterxml/jackson/databind/type/TypeFactory.java
+++ b/src/main/java/com/fasterxml/jackson/databind/type/TypeFactory.java
@@ -1466,7 +1466,9 @@ protected JavaType _fromVariable(ClassStack context, TypeVariable<?> var, TypeBi
     {
         // ideally should find it via bindings:
         final String name = var.getName();
-if (bindings == null) throw new Error("No Bindings!");
+        if (bindings == null) {
+            throw new IllegalArgumentException("Null `bindings` passed (type variable \""+name+"\")");
+        }
         JavaType type = bindings.findBoundType(name);
         if (type != null) {
             return type;
@@ -1478,7 +1480,18 @@ protected JavaType _fromVariable(ClassStack context, TypeVariable<?> var, TypeBi
         }
         bindings = bindings.withUnboundVariable(name);
 
-        Type[] bounds = var.getBounds();
+        final Type[] bounds;
+
+        // 15-Jan-2019, tatu: As weird as this looks, apparently on some platforms (Arm CPU, mobile
+        //    devices), unsynchronized internal access can lead to issues, see:
+        //
+        //  https://vmlens.com/articles/java-lang-reflect-typevariable-getbounds-is-not-thread-safe/  
+        //
+        //    No good way to reproduce but since this should not be on critical path, let's add
+        //    syncing as it seems potentially necessary.
+        synchronized (var) {
+            bounds = var.getBounds();
+        }
         return _fromAny(context, bounds[0], bindings);
     }