Form protection tokens get lost because of a race condition when persisting tokens
If two (or more) scripts are executed (almost) at the same time, both scripts retrieve the same token array from the session. Both scripts will create new tokens independently. The script that is executed last will overwrite the tokens generated by the first script.
Before writing all tokens back to the session we need to retrieve the current tokens from the session again and lock this for one process only.
- Apply the test patch
- Reload the backend
- Go to file list module and wait until both frames loaded
- hover over the help icon in navigation frame
(issue imported from #M17289)