sun.reflect.ReflectionFactory was added in JDK 1.4 as JDK-internal infrastructure for Java serialization. Over time, third-party libraries used it to implement serialization mechanisms with behavior similar to Java serialization. This lead to JEP 260 recognizing sun.reflect.ReflectionFactory as a "critical internal API" to remain accessible in JDK 9.
The 1-arg newConstructorForSerialization method is used to taking a serializable class, find the nearest superclass that is not serializable, and return the no-arg constructor of that superclass. This constructor is important in the canonical operation of deserialization. This method has a bug in that it fails to check that its argument class implements java.io.Serializable. The 2-arg newConstructorForSerialization was developed as a JDK-internal utility method. It was declared public only incidentally, to allow use by parts of the JDK outside sun.reflect. It was never intended as a supported API for third-party libraries. It fails to check that its argument class implements java.io.Serializable, and also that its argument constructor is a no-arg constructor. The 1-arg newConstructorForSerialization is changed to return null when invoked with a class that does not implement java.io.Serializable. The 2-arg newConstructorForSerialization is deprecated or removal and its implementation changed to throw UnsupportedOperationException by default. A system property can is introduced to restore legacy and undocumented/unsupporrted behavior to give method for anything using these method to migrate. --------- - [x] I confirm that I make this contribution in accordance with the [OpenJDK Interim AI Policy](https://openjdk.org/legal/ai). ------------- Commit messages: - Update - Merge branch 'master' into JDK-8393262 - Initial commit Changes: https://git.openjdk.org/jdk/pull/33561/files Webrev: https://webrevs.openjdk.org/?repo=jdk&pr=33561&range=00 Issue: https://bugs.openjdk.org/browse/JDK-8393262 Stats: 318 lines in 5 files changed: 270 ins; 8 del; 40 mod Patch: https://git.openjdk.org/jdk/pull/33561.diff Fetch: git fetch https://git.openjdk.org/jdk.git pull/33561/head:pull/33561 PR: https://git.openjdk.org/jdk/pull/33561
