fix: return new BitList instance from emptyList() to prevent shared mutable state

dubbo-cluster/src/main/java/org/apache/dubbo/rpc/cluster/router/state/BitList.java

@@ -55,7 +55,6 @@
 public class BitList<E> extends AbstractList<E> implements Cloneable {
     private final BitSet rootSet;
     private volatile List<E> originList;
-    private static final BitList emptyList = new BitList(Collections.emptyList());
     private volatile List<E> tailList = null;
 
     public BitList(List<E> originList) {
@@ -174,9 +173,12 @@ public synchronized E randomSelectOne() {
         return get(ThreadLocalRandom.current().nextInt(cardinality + tailSize));
     }
 
-    @SuppressWarnings("unchecked")
+    /**
+     * Returns a new empty BitList. A new instance is created on each call because BitList is mutable;
+     * a shared singleton would cause cross-caller state contamination (see issue #16131).
+     */
     public static <T> BitList<T> emptyList() {
-        return emptyList;
+        return new BitList<>(Collections.emptyList());
     }
 
     // Provided by JDK List interface

dubbo-cluster/src/test/java/org/apache/dubbo/rpc/cluster/router/state/BitListTest.java

@@ -579,6 +579,69 @@ void testClone2() {
         Assertions.assertEquals(2, set.size());
     }
 
+    @Test
+    void testEmptyListReturnsIndependentInstances() {
+        // Verify that emptyList() returns separate instances to prevent shared mutable state
+        BitList<String> empty1 = BitList.emptyList();
+        BitList<String> empty2 = BitList.emptyList();
+
+        Assertions.assertNotSame(empty1, empty2, "emptyList() must return distinct instances");
+    }
+
+    @Test
+    void testEmptyListMutationDoesNotAffectOtherEmptyList() {
+        // This test reproduces the bug from issue #16131:
+        // When emptyList() returned a shared singleton, adding elements to one
+        // empty list would contaminate all other empty lists.
+        BitList<String> empty1 = BitList.emptyList();
+        BitList<String> empty2 = BitList.emptyList();
+
+        // Simulate what AbstractDirectory does: start with emptyList, then add invokers
+        empty1.add("InvokerA");
+        empty1.add("InvokerB");
+
+        // empty2 must remain empty - this was the core bug
+        Assertions.assertTrue(empty2.isEmpty(), "Mutating one emptyList must not affect another");
+        Assertions.assertEquals(0, empty2.size());
+    }
+
+    @Test
+    void testEmptyListTailListMutationDoesNotAffectOtherEmptyList() {
+        // Test that addToTailList on one emptyList doesn't leak to another
+        BitList<String> empty1 = BitList.emptyList();
+        BitList<String> empty2 = BitList.emptyList();
+
+        empty1.addToTailList("X");
+        empty1.addToTailList("Y");
+
+        Assertions.assertEquals(2, empty1.size());
+        Assertions.assertTrue(empty2.isEmpty());
+        Assertions.assertFalse(empty2.hasMoreElementInTailList());
+    }
+
+    @Test
+    void testEmptyListAndOperationDoesNotAffectOtherEmptyList() {
+        // The and() method is used in AbstractStateRouter.route() to mutate invokers in-place.
+        // This test verifies that and() on one emptyList doesn't contaminate another.
+        BitList<String> source = new BitList<>(Arrays.asList("A", "B", "C"));
+        BitList<String> empty1 = BitList.emptyList();
+        BitList<String> empty2 = BitList.emptyList();
+
+        // and() mutates rootSet and may add tailList elements in-place
+        empty1.and(source);
+
+        Assertions.assertTrue(empty2.isEmpty(), "and() on one emptyList must not affect another");
+        Assertions.assertEquals(0, empty2.size());
+    }
+
+    @Test
+    void testEmptyListIsInitiallyEmpty() {
+        BitList<String> empty = BitList.emptyList();
+        Assertions.assertTrue(empty.isEmpty());
+        Assertions.assertEquals(0, empty.size());
+        Assertions.assertFalse(empty.iterator().hasNext());
+    }
+
     @Test
     void testConcurrent() throws InterruptedException {
         for (int i = 0; i < 100000; i++) {