ArrayIndexOutOfBoundsException caused by Jsf20ControllerImpl dynamically adding and removing PhaseListeners

Issue

org.jboss.portletbridge.bridge.controller.Jsf20ControllerImpl dynamically adds and removes javax.faces.event.PhaseListeners to the same javax.faces.lifecycle.Lifecycle object on each request it processes. The Lifecycle object is shared across threads working on requests from different users.

Under somewhat higher load, this leads to race conditions with the org.springframework.faces.webflow.JsfUtils.notifyAfterListeners() method used from within our framework. It seems that dynamically adding/removing PhaseListeners to the same Lifecycle instance will cause problems when notifying the listeners attached to the LifeCycle later on:

Caused by: java.lang.ArrayIndexOutOfBoundsException: 9
        at org.springframework.faces.webflow.JsfUtils.notifyAfterListeners(JsfUtils.java:39) [spring-faces-2.3.3.RELEASE.jar:2.3.3.RELEASE]
        at org.springframework.faces.webflow.FlowLifecycle.invokePhase(FlowLifecycle.java:129) [spring-faces-2.3.3.RELEASE.jar:2.3.3.RELEASE]
        at org.springframework.faces.webflow.FlowLifecycle.execute(FlowLifecycle.java:70) [spring-faces-2.3.3.RELEASE.jar:2.3.3.RELEASE]
        at com.sample.PortletBridgeJsfView.processEvent(PortletBridgeJsfView.java:113) [com.sample.jar:]
        at org.springframework.webflow.engine.ViewState.handleEvent(ViewState.java:226) [spring-webflow-2.3.3.RELEASE.jar:2.3.3.RELEASE]
        at org.springframework.webflow.engine.ViewState.resume(ViewState.java:196) [spring-webflow-2.3.3.RELEASE.jar:2.3.3.RELEASE]
        at org.springframework.webflow.engine.Flow.resume(Flow.java:545) [spring-webflow-2.3.3.RELEASE.jar:2.3.3.RELEASE]
        at org.springframework.webflow.engine.impl.FlowExecutionImpl.resume(FlowExecutionImpl.java:258) [spring-webflow-2.3.3.RELEASE.jar:2.3.3.RELEASE]
        ... 144 more

A similar problem was discovered for the Liferay portal:
https://issues.liferay.com/browse/FACES-1252

What can be done to avoid this situation? Would our application code be responsible for generating a new Lifecycle object per request? Is there some configuration that we are missing in the portlet bridge or other component?