Session collisions on rails 3.1rc4 (authlogic, omniauth, memcache store, passenger)

[Neil <neil.matatall@gmail.com>]

While it's entirely possible that this issue is caused by some other
factor, but we are getting session collisions as well as an issue
where one user is getting another user's session.  This is clearly
bad, but I cannot for the life of me figure out how this could even
happen in the first place.  The code looks thread safe to me, and a
quick discussion on #ruby-lang seems to support that.

Thoughts:
1.  Session IDs are being generated in the same sequence (uses
securerandom -> openssl which does not have a static seed)
2.  Threads.  Looks good to me.
3.  Maybe memcached is returning something other than "STORED/
NOT_STORED" for @pool.add(sid, session), but the operation still
succeeded?
4.  Gnomes.

Any input is GREATLY appreciated.  Please don't say "it's an RC, what
do you expect?" :)


From https://github.com/rack/rack/blob/master/lib/rack/session/memcache.rb
      def generate_sid
        loop do
          sid = super
          break sid unless @pool.get(sid, true)
        end
      end

      def get_session(env, sid)
        with_lock(env, [nil, {}]) do
          unless sid and session = @pool.get(sid)
            sid, session = generate_sid, {}
            unless /^STORED/ =~ @pool.add(sid, session)
              raise "Session collision on '#{sid.inspect}'"
            end
          end
          [sid, session]
        end
      end

      def set_session(env, session_id, new_session, options)
        expiry = options[:expire_after]
        expiry = expiry.nil? ? 0 : expiry + 1

        with_lock(env, false) do
          @pool.set session_id, new_session, expiry
          session_id
        end
      end