ReflectionFactory is not sufficient to support custom serialization libraries

classic Classic list List threaded Threaded
4 messages Options
Reply | Threaded
Open this post in threaded view
|

ReflectionFactory is not sufficient to support custom serialization libraries

David Lloyd
The ReflectionFactory class which was introduced for the purposes of
supporting custom serialization libraries is not sufficient to the
task by itself, despite what was implied by [1].

While it allows invocation of the various non-public
serialization-related methods that are exposed by classes, it does not
allow for the actual reading and writing of serializable fields,
particularly those belonging to classes in the JDK itself; doing so
requires lots of --add-opens, as far as I can see, which largely
defeats the purpose of almost all of the methods that _were_ added to
ReflectionFactory for serialization support (because --add-opens
allows direct reflection anyway).

Is it possible to get some helper API added to ReflectionFactory to
cover this?  Or is there a second API that I have somehow completely
missed?

[1] http://mail.openjdk.java.net/pipermail/jigsaw-dev//2017-May/012660.html
--
- DML
Reply | Threaded
Open this post in threaded view
|

Re: ReflectionFactory is not sufficient to support custom serialization libraries

Alan Bateman
On 19/12/2017 18:45, David Lloyd wrote:
> The ReflectionFactory class which was introduced for the purposes of
> supporting custom serialization libraries is not sufficient to the
> task by itself, despite what was implied by [1].
>
Have you looked at how IIOP uses it?

-Alan
Reply | Threaded
Open this post in threaded view
|

Re: ReflectionFactory is not sufficient to support custom serialization libraries

David Lloyd
On Tue, Dec 19, 2017 at 1:01 PM, Alan Bateman <[hidden email]> wrote:
> On 19/12/2017 18:45, David Lloyd wrote:
>>
>> The ReflectionFactory class which was introduced for the purposes of
>> supporting custom serialization libraries is not sufficient to the
>> task by itself, despite what was implied by [1].
>>
> Have you looked at how IIOP uses it?

It looks like they are using Unsafe for accessing fields, unless I've
missed something (I'm looking at sun.corba.Bridge).

--
- DML
Reply | Threaded
Open this post in threaded view
|

Re: ReflectionFactory is not sufficient to support custom serialization libraries

Alan Bateman
On 19/12/2017 19:06, David Lloyd wrote:
> :
> It looks like they are using Unsafe for accessing fields, unless I've
> missed something (I'm looking at sun.corba.Bridge).
>
That's right, this hasn't changed. The issue is that legacy
serialization is fundamentally incompatible with strong encapsulation.
We did the minimum in JDK 9 (and 8uX) so that custom serialization
libraries using Unsafe had a solution to work with modules. The IIOP
implementation in the java.corba module was the guinea pig.

-Alan