Threading issue using static Calendar with JDBC ResultSet.getTimestamp

[punktilious]

Describe the bug
Calendar is not thread-safe, so the following DAO call can lead to issues because UTC_CALENDAR is declared as static (and therefore shared by multiple threads):

    private static final Calendar UTC_CALENDAR = Calendar.getInstance(TimeZone.getTimeZone("UTC"));
...
    ps.setTimestamp(a++, Timestamp.from(this.fromLastUpdated), UTC_CALENDAR);

Similarly:

    Instant lastUpdated = rs.getTimestamp(2, UTC_CALENDAR).toInstant();

For Derby, we have seen the following error:

java.lang.ArrayIndexOutOfBoundsException: Array index out of range: -602
at java.base/sun.util.calendar.BaseCalendar.getCalendarDateFromFixedDate(BaseCalendar.java:453)
at java.base/java.util.GregorianCalendar.computeFields(GregorianCalendar.java:2394)
at java.base/java.util.GregorianCalendar.computeTime(GregorianCalendar.java:2815)
at java.base/java.util.Calendar.updateTime(Calendar.java:3428)
at java.base/java.util.Calendar.getTimeInMillis(Calendar.java:1812)
at org.apache.derby.iapi.types.SQLTimestamp.getTimestamp(Unknown Source)
at org.apache.derby.impl.jdbc.EmbedResultSet.getTimestamp(Unknown Source)
at com.ibm.ws.rsadapter.jdbc.WSJdbcResultSet.getTimestamp(WSJdbcResultSet.java:1914)

Environment
4.9.0.

To Reproduce
Steps to reproduce the behavior:

1. Perform persistence operations with a lot of threads.

Expected behavior
No exceptions and correct date-time

Additional context
We have seen this rarely and only with Derby during testing. But the safe use of the Calendar object depends on how the underlying driver works, so it needs to be fixed for everything. Lesson: don't trust an API to not mutate an object you pass in. Make it immutable.

[lmsurpre]

We ran some regression testing including a large reindex and havn't seen any issues.

[zachyf]

I can confirm I'm seeing the same issue.

[lmsurpre]

hi @zachyf this issue was marked as resolved in September of 2021. I suggest opening a new issue or providing more information about exactly what you're seeing... e.g. which version of FHIR Server