In-depth analysis of Java serialization and deserialization

This article brings you relevant knowledge about java, which mainly introduces the relevant content about serialization and deserialization. Serialization is a means of object persistence. Below Let's take a look, I hope it will be helpful to everyone.

Recommended learning: "java Video Tutorial"

Serialization of Java Objects

The Java platform allows us Create reusable Java objects in memory, but generally, these objects may exist only when the JVM is running, that is, the life cycle of these objects will not be longer than the life cycle of the JVM. But in real applications, it may be required to save (persist) the specified object after the JVM stops running, and to re-read the saved object in the future. Java object serialization can help us achieve this function.

Using Java object serialization, when saving an object, its state will be saved as a set of bytes, and in the future, these bytes will be assembled into objects. It must be noted that object serialization saves the "state" of the object, that is, its member variables. It can be seen that object serialization will not pay attention to the static variables in the class.

In addition to object serialization being used when persisting objects, object serialization is also used when using RMI (remote method invocation) or transferring objects over the network. The Java Serialization API provides a standard mechanism for handling object serialization. The API is simple and easy to use.

How to serialize and deserialize Java objects

In Java, as long as a class implements the java.io.Serializable interface, then it can be Serialization. Here is a piece of code:

code 1 Create a User class for serialization and deserialization

package com.hollis;import java.io.Serializable;import java.util.Date;/**
 * Created by hollis on 16/2/2.
 */public class User implements Serializable{    private String name;    private int age;    private Date birthday;    private transient String gender;    private static final long serialVersionUID = -6849794470754667710L;    public String getName() {        return name;
    }    public void setName(String name) {        this.name = name;
    }    public int getAge() {        return age;
    }    public void setAge(int age) {        this.age = age;
    }    public Date getBirthday() {        return birthday;
    }    public void setBirthday(Date birthday) {        this.birthday = birthday;
    }    public String getGender() {        return gender;
    }    public void setGender(String gender) {        this.gender = gender;
    }    @Override
    public String toString() {        return "User{" +                "name='" + name + ''' +
                ", age=" + age +
                ", gender=" + gender +
                ", birthday=" + birthday +
                '}';
    }
}

code 2 Demo for serializing and deserializing User

package com.hollis;import org.apache.commons.io.FileUtils;import org.apache.commons.io.IOUtils;import java.io.*;import java.util.Date;/**
 * Created by hollis on 16/2/2.
 */
public class SerializableDemo {

    public static void main(String[] args) {
        //Initializes The Object
        User user = new User();
        user.setName("hollis");
        user.setGender("male");
        user.setAge(23);
        user.setBirthday(new Date());
        System.out.println(user);

        //Write Obj to File
        ObjectOutputStream oos = null;
        try {            oos = new ObjectOutputStream(new FileOutputStream("tempFile"));
            oos.writeObject(user);
        } catch (IOException e) {
            e.printStackTrace();
        } finally {
            IOUtils.closeQuietly(oos);
        }

        //Read Obj from File
        File file = new File("tempFile");
        ObjectInputStream ois = null;
        try {            ois = new ObjectInputStream(new FileInputStream(file));
            User newUser = (User) ois.readObject();
            System.out.println(newUser);
        } catch (IOException e) {
            e.printStackTrace();
        } catch (ClassNotFoundException e) {
            e.printStackTrace();
        } finally {
            IOUtils.closeQuietly(ois);
            try {
                FileUtils.forceDelete(file);
            } catch (IOException e) {
                e.printStackTrace();
            }
        }

    }
}
//output 
//User{name='hollis', age=23, gender=male, birthday=Tue Feb 02 17:37:38 CST 2016}
//User{name='hollis', age=23, gender=null, birthday=Tue Feb 02 17:37:38 CST 2016}

Knowledge related to serialization and deserialization

1. In Java, as long as a class implements the java.io.Serializable interface, then it can be serialized.

2. Serialize and deserialize objects through ObjectOutputStream and ObjectInputStream

3. Whether the virtual machine allows deserialization, not only Depends on whether the class path and function code are consistent. A very important point is whether the serialization IDs of the two classes are consistent (that is, private static final long serialVersionUID)

4. Serialization and merging Static variables are not saved.

5. If you want to serialize the parent class object, you need to let the parent class also implement the Serializable interface.

6. The function of the Transient keyword is to control the serialization of variables. Adding this keyword before the variable declaration can prevent the variable from being serialized into the file. After being deserialized, the transient variable The value is set to the initial value, such as 0 for int type and null for object type.

7. The server sends serialized object data to the client. Some data in the object is sensitive, such as password strings. It is hoped that the password field will be encrypted during serialization, and the client If you have the decryption key, the password can only be read when the client deserializes it. This can ensure the data security of the serialized object to a certain extent.

Serialization of ArrayList

Before introducing ArrayList serialization, let’s consider a question:

How to customize serialization and deserialization strategies

With this question, let’s look at the source code of java.util.ArrayList

code 3

public class ArrayList<E> extends AbstractList<E>
        implements List<E>, RandomAccess, Cloneable, java.io.Serializable{    private static final long serialVersionUID = 8683452581122892189L;
    transient Object[] elementData; // non-private to simplify nested class access
    private int size;
}

The author omitted other member variables , from the above code we can know that ArrayList implements the java.io.Serializable interface, then we can serialize and deserialize it. Because elementData is transient, we believe that this member variable will not be serialized and retained. Let's write a Demo to verify our idea:

code 4

public static void main(String[] args) throws IOException, ClassNotFoundException {
        List<String> stringList = new ArrayList<String>();
        stringList.add("hello");
        stringList.add("world");
        stringList.add("hollis");
        stringList.add("chuang");
        System.out.println("init StringList" + stringList);
        ObjectOutputStream objectOutputStream = new ObjectOutputStream(new FileOutputStream("stringlist"));
        objectOutputStream.writeObject(stringList);

        IOUtils.close(objectOutputStream);
        File file = new File("stringlist");
        ObjectInputStream objectInputStream = new ObjectInputStream(new FileInputStream(file));
        List<String> newStringList = (List<String>)objectInputStream.readObject();
        IOUtils.close(objectInputStream);
        if(file.exists()){
            file.delete();
        }
        System.out.println("new StringList" + newStringList);
    }
//init StringList[hello, world, hollis, chuang]//new StringList[hello, world, hollis, chuang]

Anyone who knows ArrayList knows that the bottom layer of ArrayList is implemented through an array. Then arrayelementData is actually used to save the elements in the list. We know from the way this attribute is declared that it cannot be persisted through serialization. So why does the result of code 4 retain the elements in the List through serialization and deserialization?

writeObject and readObject methods

defines two methods in ArrayList: writeObject and readObject.

The conclusion is given here:

During the serialization process, if the writeObject and readObject methods are defined in the serialized class, the virtual machine will try to call the writeObject and readObject methods in the object class. , perform user-defined serialization and deserialization.

If there is no such method, the default call is the defaultWriteObject method of ObjectOutputStream and the defaultReadObject method of ObjectInputStream.

用户自定义的 writeObject 和 readObject 方法可以允许用户控制序列化的过程，比如可以在序列化的过程中动态改变序列化的数值。

来看一下这两个方法的具体实现：

code 5

private void readObject(java.io.ObjectInputStream s)
        throws java.io.IOException, ClassNotFoundException {
        elementData = EMPTY_ELEMENTDATA;        // Read in size, and any hidden stuff
        s.defaultReadObject();        // Read in capacity
        s.readInt(); // ignored

        if (size > 0) {            // be like clone(), allocate array based upon size not capacity
            ensureCapacityInternal(size);            Object[] a = elementData;            // Read in all elements in the proper order.
            for (int i=0; i<size; i++) {                a[i] = s.readObject();
            }
        }
    }

code 6

private void writeObject(java.io.ObjectOutputStream s)
        throws java.io.IOException{        // Write out element count, and any hidden stuff
        int expectedModCount = modCount;
        s.defaultWriteObject();        // Write out size as capacity for behavioural compatibility with clone()
        s.writeInt(size);        // Write out all elements in the proper order.
        for (int i=0; i<size; i++) {
            s.writeObject(elementData[i]);
        }        if (modCount != expectedModCount) {            throw new ConcurrentModificationException();
        }
    }

那么为什么ArrayList要用这种方式来实现序列化呢？

why transient

ArrayList实际上是动态数组，每次在放满以后自动增长设定的长度值，如果数组自动增长长度设为100，而实际只放了一个元素，那就会序列化99个null元素。为了保证在序列化的时候不会将这么多null同时进行序列化，ArrayList把元素数组设置为transient。

why writeObject and readObject

前面说过，为了防止一个包含大量空对象的数组被序列化，为了优化存储，所以，ArrayList使用transient来声明elementData。 但是，作为一个集合，在序列化过程中还必须保证其中的元素可以被持久化下来，所以，通过重写writeObject 和 readObject方法的方式把其中的元素保留下来。

writeObject方法把elementData数组中的元素遍历的保存到输出流（ObjectOutputStream）中。

readObject方法从输入流（ObjectInputStream）中读出对象并保存赋值到elementData数组中。

至此，我们先试着来回答刚刚提出的问题：

如何自定义的序列化和反序列化策略

答：可以通过在被序列化的类中增加writeObject 和 readObject方法。那么问题又来了：

虽然ArrayList中写了writeObject 和 readObject 方法，但是这两个方法并没有显示的被调用啊。

那么如果一个类中包含writeObject 和 readObject 方法，那么这两个方法是怎么被调用的呢?

ObjectOutputStream

从code 4中，我们可以看出，对象的序列化过程通过ObjectOutputStream和ObjectInputputStream来实现的，那么带着刚刚的问题，我们来分析一下ArrayList中的writeObject 和 readObject 方法到底是如何被调用的呢？

为了节省篇幅，这里给出ObjectOutputStream的writeObject的调用栈：

writeObject ---> writeObject0 --->writeOrdinaryObject--->writeSerialData--->invokeWriteObject<p>这里看一下invokeWriteObject：</p><pre class="brush:php;toolbar:false">void invokeWriteObject(Object obj, ObjectOutputStream out)         throws IOException, UnsupportedOperationException     {        if (writeObjectMethod != null) {            try {                 writeObjectMethod.invoke(obj, new Object[]{ out });             } catch (InvocationTargetException ex) {                Throwable th = ex.getTargetException();                if (th instanceof IOException) {                    throw (IOException) th;                 } else {                     throwMiscException(th);                 }             } catch (IllegalAccessException ex) {                // should not occur, as access checks have been suppressed                 throw new InternalError(ex);             }         } else {            throw new UnsupportedOperationException();         }     }</pre><p>其中<code>writeObjectMethod.invoke(obj, new Object[]{ out });是关键，通过反射的方式调用writeObjectMethod方法。官方是这么解释这个writeObjectMethod的：

class-defined writeObject method, or null if none

在我们的例子中，这个方法就是我们在ArrayList中定义的writeObject方法。通过反射的方式被调用了。

至此，我们先试着来回答刚刚提出的问题：

如果一个类中包含writeObject 和 readObject 方法，那么这两个方法是怎么被调用的?

答：在使用ObjectOutputStream的writeObject方法和ObjectInputStream的readObject方法时，会通过反射的方式调用。

至此，我们已经介绍完了ArrayList的序列化方式。那么，不知道有没有人提出这样的疑问：

Serializable明明就是一个空的接口，它是怎么保证只有实现了该接口的方法才能进行序列化与反序列化的呢？

Serializable接口的定义：

public interface Serializable {
}

读者可以尝试把code 1中的继承Serializable的代码去掉，再执行code 2，会抛出java.io.NotSerializableException。

其实这个问题也很好回答，我们再回到刚刚ObjectOutputStream的writeObject的调用栈：

writeObject ---> writeObject0 --->writeOrdinaryObject--->writeSerialData--->invokeWriteObject

writeObject0方法中有这么一段代码：

if (obj instanceof String) {                writeString((String) obj, unshared);
            } else if (cl.isArray()) {                writeArray(obj, desc, unshared);
            } else if (obj instanceof Enum) {                writeEnum((Enum<?>) obj, desc, unshared);
            } else if (obj instanceof Serializable) {                writeOrdinaryObject(obj, desc, unshared);
            } else {
                if (extendedDebugInfo) {
                    throw new NotSerializableException(
                        cl.getName() + "\n" + debugInfoStack.toString());
                } else {
                    throw new NotSerializableException(cl.getName());
                }
            }

在进行序列化操作时，会判断要被序列化的类是否是Enum、Array和Serializable类型，如果不是则直接抛出NotSerializableException。

总结

1、如果一个类想被序列化，需要实现Serializable接口。否则将抛出NotSerializableException异常，这是因为，在序列化操作过程中会对类型进行检查，要求被序列化的类必须属于Enum、Array和Serializable类型其中的任何一种。

2、在变量声明前加上该关键字，可以阻止该变量被序列化到文件中。

3、在类中增加writeObject 和 readObject 方法可以实现自定义序列化策略

推荐学习：《java视频教程》

The above is the detailed content of In-depth analysis of Java serialization and deserialization. For more information, please follow other related articles on the PHP Chinese website!