On 03.04.2018 21:26, Henri Tremblay wrote:
[...]
For completeness, there are 4 ways to create a class without calling a
constructor right now that I'm aware of:
- Unsafe.allocateInstance
which is supposed to go away at some point
- sun.reflect.ReflectionFactory.newConstructorForSerialization (my
favorite because it's the fastest one)
which afaik works in java9 but is also one of those critical doomed APIs
- Generate an extending class forgetting to call the super constructor
(so it's not exactly that same class that is instantiated). It requires
-Xverify:none
Is this really an option for a production environment?
- Generate a class extending MagicAccessorImpl that will then
instantiates the wanted class but calling the wrong constructor
Is jdk.internal.reflect.MagicAccessorImpl still usable in Java9+? I
thought this is no longer exported
Under the premise that all critical API usages will be removed in the
future and replacement APIs will be created I think we might indeed
still miss something here
bye Jochen
