JarFile can cause memory issues when running on Java 11+

[alexey-anufriev]

Description

After upgrade from Spring Boot 2.2.6 to 2.2.7 application started consuming much more memory.
In particular Heap Dump shows significantly higher number of instances of type:
org.springframework.boot.loader.jar.JarFile.

Heap Dump (v2.2.6) is here.
It contains the following number of instances:

Heap Dump (v2.2.7) is here.
It contains the following number of instances:

The number of instances is significantly higher.

Reason

After checking the history of related changes there is a couple of commits that worth to be checked:

Create new JarFile instance for URL connections

Attempt to prevent JarFiles from being left open

Attempt to prevent JarFiles from being left open

Steps to reproduce

The following repository can be used:
https://github.com/alexey-anufriev/spring-boot-2.2.7-memory-leak#steps-to-reproduce

[philwebb]

Thanks for the sample application, it's been very helpful. My initial thoughts are that commit
c85918b may have caused the problem, and it's likely to only occur on Java 11.

From the profiler, it looks like java.util.zip.ZipFile.CleanableResource.FinalizableResource might be the thing keeping the reference. It appears that any JarFile implementation that override close() will end up with finalizer based cleanup.

I'm really not sure how we can fix this one and also keep the fix for #17796. The only idea I've had so far is to create a new JarFile implementation that doesn't override close().

We'll need to do some experiments.

[philwebb]

@alexey-anufriev I think I may have a fix for this, but I'm not 100% confident. If you get the chance, could you please try 2.2.10.BUILD-SNAPSHOT and let me know if you still see the issue?

[alexey-anufriev]

@philwebb, I have already tried the same app with 2.2.10.BUILD-SNAPSHOT and it looks much better. There is a number of wrappers in the heap, but I do not think it will cause problems.

In any case, thank you for the resolution, and I will keep you updated after I get this version live (but it will take me some time).