java.util.Collection.SynchronizedCollection uses a "mutex" Object field to track the object to synchronize on. For serialization, SynchronizedCollection.writeObject() also synchronizes on this "mutex".

SynchronizedRandomAccessList is a subclass of that base class, and to allow it to deserialize on pre-1.4 JDK, it has a writeReplace() method that replaces itself with a SynchronizedList for serialization.

Unfortunately, this SynchronizedRandomAccessList.writeReplace() method doesn't pass down the "mutex" field into the newly created SynchronizedList, so the mutex used for serializing this SynchronizedList is different from the current SynchronizedRandomAccessList. That can lead to race conditions of manipulating the SynchronizedRandomAccessList while in progress of synchronization.