Lmichasz wrote:
First:
Cached object is updated, then its lock is evicted from cache and session is flushed and cleared. Then updated object is loaded from database and put into the cache (still all in the same transaction). Other transactions can now see this not committed object.
Yes, this would break isolation.
Lmichasz wrote:
Second:
Some cached object is inserted, then session.flush, and session.clear. Next I load this inserted not committed object from database. It is putted into cache and other transactions can see it.
Basically same case as the first.
I must say, I don't really consider either of the above cases as very important, nor do I think they are solveable. You shouldn't use session.clear() like this, I guess.
Lmichasz wrote:
Third:
Because inserted object is not locked there is a possibility that betwen commit and afterInsert this new inserted object can be deleted/updated by other transactions. When object/lock will be evicted from cache then old or non existent records can be put into cache.
You might be right here too, and I would consider this a bug. Would you please try to produce a runnable test case that demonstrates this problem and submit to JIRA. Thanks.