Few issues here :

1. in AclCacheManager#_computeBitSetAndPutInCache, we do values.put(__CACHE_BISET_KEY, null); after writeLock.tryLock(), and if a second user asked its acl, it removes all BitSet entries before putting its own, that is to say not more than one BitSet is present in the cache.
2. but this was hidden by filterCache and queryResultCache and in practice, the BitSet cache was never used => we should find a way to not use them when there is an AclQuery