SearcherTaxonomyManager leaks a taxonomy reader (an extra reference on the current one, or a whole newly opened reader with its open files) when the SearcherFactory throws during a refresh, and the NRT and Directory constructors leak theirs when it throws on the first searcher

Finding LFV-309Area: facet / taxonomy (SearcherTaxonomyManager.refreshIfNeeded and the NRT and Directory constructors: the taxonomy reader taken before an unguarded SearcherManager.getSearcher call)Priority: lowImpact: minorNovelty: known upstream

AI-assisted finding, confirmed by automated checks, not yet triaged by a human Lucene committer. This site files nothing upstream.

What it shows

You use SearcherTaxonomyManager with a SearcherFactory that does real work in newSearcher, such as warm-up queries, and that work throws during maybeRefresh(). You expect the failed refresh to release what it took, as SearcherManager.getSearcher does for the new index reader ('this decRefs incoming reader on throwing an exception') and as the same method has done since LUCENE-8244 when the taxonomy reopen itself fails. Instead the taxonomy reader that refreshIfNeeded took just before calling the factory is never released: with an unchanged taxonomy the manager's current taxonomy reader keeps an extra reference and is never closed, not even by mgr.close(); with a changed taxonomy the newly opened taxonomy reader and its files stay open for the life of the process; and the NRT and Directory constructors leak the taxonomy reader they open in the same way when the factory throws on the first searcher.

Expected vs actual

Expected: You expect the failed refresh to release what it took, as SearcherManager.getSearcher does for the new index reader ('this decRefs incoming reader on throwing an exception') and as the same method has done since LUCENE-8244 when the taxonomy reopen itself fails.
Actual: The taxonomy reader that refreshIfNeeded took just before calling the factory is never released: with an unchanged taxonomy the manager's current taxonomy reader keeps an extra reference and is never closed, not even by mgr.close(); with a changed taxonomy the newly opened taxonomy reader and its files stay open for the life of the process; and the NRT and Directory constructors leak the taxonomy reader they open in the same way when the factory throws on the first searcher.

Files

Run it

Tested on Lucene main e1faeba08bde (2026-11-02): still reproduces.
Tested on Lucene main ea57360912ed (2026-10-24): reproduced.
How to read the outcome: a failing test is the finding reproducing (the failure message states expected against actual).
Seeds: a rerun with the same seed replays the same random choices. Assertions off (-da -dsa -Dtests.asserts=false) is the production-like setting.

# Lucene checkout at the tested commit, built with: ./gradlew --no-daemon assemble   (JDK 25)
LUCENE=/path/to/lucene; V=12.0.0-SNAPSHOT
CP=$LUCENE/lucene/core/build/libs/lucene-core-$V.jar
CP=$CP:$LUCENE/lucene/codecs/build/libs/lucene-codecs-$V.jar
CP=$CP:$LUCENE/lucene/test-framework/build/libs/lucene-test-framework-$V.jar
CP=$CP:$LUCENE/lucene/facet/build/libs/lucene-facet-$V.jar
CP=$CP:randomizedtesting-runner-2.9.2.jar:junit-4.13.2.jar:hamcrest-3.0.jar   # test-framework dependencies (Maven Central)
CP=$CP:junit-platform-console-standalone-6.1.3.jar   # JUnit Platform console launcher (Maven Central)

javac -d classes-src -cp "$CP" $(find src -name '*.java')
javac -d classes-src2 -cp "$CP" $(find src2 -name '*.java')

# run 1: assertions on, seed DEADBEEF
java -ea -esa --add-modules jdk.incubator.vector --enable-native-access=ALL-UNNAMED -Dtests.seed=DEADBEEF \
     -cp "classes-src:$CP" org.junit.platform.console.ConsoleLauncher \
     execute --select-class org.apache.lucene.facet.taxonomy.TestSearcherTaxonomyManagerFactoryFailure
java -ea -esa --add-modules jdk.incubator.vector --enable-native-access=ALL-UNNAMED -Dtests.seed=DEADBEEF \
     -cp "classes-src2:$CP" org.junit.platform.console.ConsoleLauncher \
     execute --select-class org.apache.lucene.facet.taxonomy.TestSearcherTaxonomyManagerFactoryFailure

The module(s) facet also need their third-party runtime jars; ./gradlew -p lucene/<module> dependencies lists them.

Gradle alternative: copy the test into the matching module's src/test/ tree of the checkout and run ./gradlew -p lucene/<module> test --tests <class> -Ptests.seed=<seed> (add -Ptests.asserts=false for a run without assertions).

Formal models and scripts this finding's part of the hunt used: nrt-reference-managers

Feedback

Open an issue in lucene-ai-bug-hunt. Please do not open issues or pull requests in apache/lucene about this finding unless a Lucene committer agrees it should be filed.

Snapshot of 2026-11-04. AI-assisted; not yet triaged by a human Lucene committer. Feedback: open an issue in lucene-ai-bug-hunt.