 | |
Questions About Serialization in the Latest JDK:
Questions About the Serialization Subsystem:
Questions About Using Serialization within the JDK:
AnswersQuestions About Serialization in the Latest JDK:
In order to provide a developer with a final opportunity to acknowledge that a default serializable field should be serialized, javadoc emits a warning when the field is missing an An See the javadoc reference page for a complete description of the three new serialization javadoc tags,
Default serializable fields are computed independent of accessibility. Therefore, private serializable fields still need an
Questions About the Serialization Subsystem:
The decision to require that classes implement the If classes were to be marked as being serializable, the design team worried that a developer, either out of forgetfulness, laziness, or ignorance might not declare a class as being Security Restrictions: No such restriction can be made on an object once it has been serialized; the stream of bytes that are the result of object serialization can be read and altered by any object that has access to that stream. This allows any object access to the state of a serialized object, which can violate the privacy guarantees that users of the language expect. Furthermore, the bytes in the stream can be altered in arbitrary ways, allowing reconstruction of an object that was never created within the protections of a Java environment. There are cases in which the recreation of such an object could compromise not only the privacy guarantees expected by users of the Java environment, but also the integrity of the environment itself. These violations cannot be guarded against, since the whole idea of serialization is to allow an object to be converted into a form that can be moved outside of the Java environment (and therefore outside of the privacy and integrity guarantees of that environment) and then be brought back into the environment. Requiring objects to be declared Note that this sort of security problem is not one that can be dealt with by the mechanism of a security manager. Since serialization is intended to allow the transport of an object from one virtual machine to some other (either over space, as it is used in RMI, or over time, as when the stream is saved to a file), the mechanisms used for security need to be independent of the runtime environment of any particular virtual machine. We wanted to avoid as much as possible the problem of being able to serialize an object in one virtual machine and not being able to deserialize that object in some other virtual machine. Since the security manager is part of the runtime environment, using the security manager for serialization would have violated this requirement. Forcing a Conscious Decision: Examples are easy to cite. Many classes deal with information that only makes sense in the context of the runtime in which the particular object exists; examples of such information include file handles, open socket connections, security information, etc. Such data can easily be dealt with by simply declaring the fields as transient, but such a declaration is only necessary if the object is going to be serialized. A novice (or forgetful, or hurried) programmer may neglect to mark fields as transient in much the same way he or she may neglect to mark the class as implementing the Another example of this sort is the "simple" object that is the root of a graph which spans a large number of objects. Serializing such an object could result in serializing several others, since serialization works over an entire graph. Doing something like this should be a conscious decision, not one that happens by default. The need for this sort of thought was brought home to us when we were going through the base Java class libraries marking the system classes as Of course, there is no way to guarantee that a programmer or class designer is actually going to think about these issues when marking a class as
The Alternatively, the
The
Run the serialver tool, supplying the name of the class, as shown in the example that follows: serialver "[Ljava.lang.String;"
Here's a brief example that shows how to serialize a tree of objects.
import java.io.*;
class tree implements java.io.Serializable {
public tree left;
public tree right;
public int id;
public int level;
private static int count = 0;
public tree(int l) {
id = count++;
level = l;
if (l > 0) {
left = new tree(l-1);
right = new tree(l-1);
}
}
public void print(int levels) {
for (int i = 0; i < level; i++)
System.out.print(" ");
System.out.println("node " + id);
if (level <= levels && left != null)
left.print(levels);
if (level <= levels && right != null)
right.print(levels);
}
public static void main (String argv[]) {
try {
/* Create a file to write the serialized tree to. */
FileOutputStream ostream = new FileOutputStream("tree.tmp");
/* Create the output stream */
ObjectOutputStream p = new ObjectOutputStream(ostream);
/* Create a tree with three levels. */
p.writeObject(base); // Write the tree to the stream.
p.flush();
ostream.close(); // close the file.
/* Open the file and set to read objects from it. */
FileInputStream istream = new FileInputStream("tree.tmp");
ObjectInputStream q = new ObjectInputStream(istream);
/* Read a tree object, and all the subtrees */
tree new_tree = (tree)q.readObject();
new_tree.print(3); // Print out the top 3 levels of the tree
} catch (Exception ex) {
ex.printStackTrace();
}
}
}
Only the fields of Serializable objects are written out and restored. The object may be restored only if it has a no-arg constructor that will initialize the fields of non-serializable supertypes. If the subclass has access to the state of the superclass it can implement
Object serialization does not contain any encryption/decryption in itself. It writes to and reads from Java Streams, so it can be coupled with any available encryption technology. Object serialization can be used in many different ways from simple persistence, writing and read to/from files, or for RMI to communicate across hosts. RMI's use of serialization leaves encryption and decryption to the lower network transport. We expect that when a secure channel is needed, the network connections will be made using SSL or the like.
Currently there is no direct way to write objects to a random access file. You can use the ByteArray I/O streams as an intermediate place to write and read bytes to/from the random access file and create Object I/O streams from the byte streams to write/read the objects. You just have to make sure that you have the entire object in the byte stream or reading/writing the object will fail. For example,
Alternatively, the
The diff will produce the same stream each time the same object is serialized. You will need to create a new
This is not really viable for arbitrary objects because of the encoding of objects. For a particular object (such as String) you can compare the resulting bit streams. The encoding is stable, in that every time the same object is encoded it is encoded to the same set of bits.
Using the default implementation of serialization, there must be a one-to-one mapping between
Questions About Using Serialization within the JDK:
The bytecodes for a local object's methods are not passed directly in the There are no conherency guarantees for local objects passed to a remote VM, since such objects are passed by copying their contents (a true pass-by-value).
The following list shows the classes that are marked Serializable. Note that classes that extend these classes are also serializable. There are many classes for which Serialization makes no sense, such as those representing the state of something in the current VM (e.g. java.io.FileInputStream) or are exceedingly hard to do correctly (e.g. java.lang.Thread).
In JDK 1.1, Threads will not be serializable. In the present implementation, if you attempt to serialize and then deserialize a thread, there is no explicit allocation of a new native thread or stack; all that happens is that the Java object is allocated with none of the native implementation. In short, it just won't work and will fail in unpredictable ways. The difficulty with threads is that they have so much state which is intricately tied into the virtual machine that it is difficult or impossible to re-establish the context somewhere else. For example, saving the Java call stack is insufficient because if there were native methods that had called C procedures that in turn called Java, there would be an incredible mix of Java constructs and C pointers to deal with. Also, serializing the stack would imply serializing any object reachable from any stack variable. If a thread were resumed in the same VM, it would be sharing a lot of state with the original thread, and would therefore fail in unpredictable ways if both threads were running at once, just like two C threads trying to share a stack. When deserialized in a separate VM, its hard to tell what might happen.
AWT has not yet been modified to work well with Serialization. When you serialize AWT widgets, also serialized are the Peer objects that map the AWT functions to the local window system. When you deserialize (reconsitute) the AWT widgets, the old Peers are recreated, but they are out of date. Peers are native to the local window system and contain pointers to data structures in the local address space, and therefore cannnot be moved.
Note that JDK 1.1 AWT widgets will be serializable, but they will not interoperate with JDK 1.0.2 widgets.
AWT does not yet work well with serialization and you will therefore have trouble trying to pass fonts and images. This is because each contains memory pointers that are valid only in the originating VM, which will cause a segmentation violation when passed to a new VM. These problems should be corrected by the time JDK 1.1 releases. As a work around for fonts, you will need to pass the information necessary to recreate a new font object that duplicates the characteristics of the font object in the originating VM. There is no current work around to allow images to be passed correctly. *As used on this web site, the terms "Java virtual machine" or "JVM" mean a virtual machine for the Java platform.
|
| |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| ||||||||||||
