When CPortletAdapter receives a SESSION_DONE event, it tries to clear the portlet state which involves getting the session details. If the session has already been invalidated by some other means (which seems to always be the case when a user is loggin out), Tomcat 4.1.31 will return a NullPointerException. From Tomcat 5.5.10 onwards, it will return an IllegalStateException as per the servlet spec starting at 2.4. CPortletAdapter has code to catch this IllegalStateException as thrown by Tomcat 5.5.10 and carry on releasing the portlet state info, but it does not have provision to catch a NullPointerException as thrown by Tomcat 4.1.31. Adding an extra explicit catch for the NullPointerException resolved the problem for me, but perhaps a more generic exception catch might be more appropriate for dealing with other possible exceptions thrown by servlet containers in this situation???

Without the fix, portlet states never get released and build up in the tenured memory pool resulting in the Tomcat JVM constantly garbage collecting (100% CPU usage) before finally running out of memory and terminating the JVM process - self destruction.