[maven-4.0.x] MojoExecutor: cycle detection broken by object identity in forked executions

[elharo]

MojoExecutor: Cycle detection broken by object identity in forked executions

Found in: maven-4.0.x branch
File: impl/maven-core/src/main/java/org/apache/maven/lifecycle/internal/DefaultLifecycleExecutionPlanCalculator.java (line 333)
Severity: High

Description

The alreadyPlannedExecutions is a HashSet<MojoDescriptor>. MojoDescriptor instances loaded via pluginManager.getMojoDescriptor() at line 318 are new objects that won't match any existing entries in the set:

if (!alreadyPlannedExecutions.contains(forkedExecution.getMojoDescriptor())) {
    calculateForkedExecutions(forkedExecution, session, project, alreadyPlannedExecutions);
    ...
}

Since MojoDescriptor doesn't override equals()/hashCode() (or uses default Object identity), the cycle detection guard will never skip a forked mojo, allowing infinite recursion if a mojo forks a lifecycle that includes itself. This can cause a StackOverflowError during build plan calculation.