java序列化反序列化深入探究

When---什么時候需要序列化和反序列化:

簡單的寫一個hello world程序，用不到序列化和反序列化。寫一個排序算法也用不到序列化和反序列化。但是當你想要將一個對象進行持久化寫入文件，或者你想將一個對象從一個網絡地址通過網絡協議發送到另一個網絡地址時，這時候就需要考慮序列化和反序列化了。另外如果你想對一個對象實例進行深度拷貝，也可以通過序列化和反序列化的方式進行。

 

What---什么是序列化和反序列化：

Serialization-序列化：可以看做是將一個對象轉化為二進制流的過程

Deserialization-反序列化：可以看做是將對象的二進制流重新讀取轉換成對象的過程

 

How---怎么實現序列化：

只有實現了 Serializable 或 Externalizable 接口的類的對象才能被序列化，否則拋出異常。
對於實現了這兩個接口，具體序列化和反序列化的過程又分以下3中情況：
情況1：若類僅僅實現了Serializable接口，則可以按照以下方式進行序列化和反序列化
ObjectOutputStream采用默認的序列化方式，對對象的非transient的實例變量進行序列化。
ObjcetInputStream采用默認的反序列化方式，對對象的非transient的實例變量進行反序列化。

情況2：若類不僅實現了Serializable接口，並且還定義了readObject(ObjectInputStream in)和writeObject(ObjectOutputSteam out)，則采用以下方式進行序列化與反序列化。
ObjectOutputStream調用對象的writeObject(ObjectOutputStream out)的方法進行序列化。
ObjectInputStream會調用對象的readObject(ObjectInputStream in)的方法進行反序列化。

情況3：若類實現了Externalnalizable接口，且類必須實現readExternal(ObjectInput in)和writeExternal(ObjectOutput out)方法，則按照以下方式進行序列化與反序列化。
ObjectOutputStream調用對象的writeExternal(ObjectOutput out))的方法進行序列化。
ObjectInputStream會調用對象的readExternal(ObjectInput in)的方法進行反序列化。

 為了進一步說明，我們直接看jdk底層ArrayList的序列化和反序列化：

// 實現了Serializable接口，可以被序列化
public class ArrayList<E> extends AbstractList<E>
        implements List<E>, RandomAccess, Cloneable, java.io.Serializable
{
    private static final long serialVersionUID = 8683452581122892189L;

    /**
     * The array buffer into which the elements of the ArrayList are stored.
     * The capacity of the ArrayList is the length of this array buffer.
     */
    // 實際元素被transient修飾,默認不會進行序列化
    private transient Object[] elementData;

    .....

    /**
     * Save the state of the <tt>ArrayList</tt> instance to a stream (that
     * is, serialize it).
     *
     * @serialData The length of the array backing the <tt>ArrayList</tt>
     *             instance is emitted (int), followed by all of its elements
     *             (each an <tt>Object</tt>) in the proper order.
     */
    private void writeObject(java.io.ObjectOutputStream s)
        throws java.io.IOException{
    // Write out element count, and any hidden stuff
    int expectedModCount = modCount;
    s.defaultWriteObject();

        // Write out array length
        s.writeInt(elementData.length);

    // Write out all elements in the proper order.
    for (int i=0; i<size; i++)
            s.writeObject(elementData[i]);

    if (modCount != expectedModCount) {
            throw new ConcurrentModificationException();
        }

    }
    
    /**
     * Reconstitute the <tt>ArrayList</tt> instance from a stream (that is,
     * deserialize it).
     */
    private void readObject(java.io.ObjectInputStream s)
        throws java.io.IOException, ClassNotFoundException {
    // Read in size, and any hidden stuff
    s.defaultReadObject();

        // Read in array length and allocate array
        int arrayLength = s.readInt();
        Object[] a = elementData = new Object[arrayLength];

    // Read in all elements in the proper order.
    for (int i=0; i<size; i++)
            a[i] = s.readObject();
    }
}

可以看到，初看之下ArrayList的實際存儲元素不能被序列化。但實際上根據我們上面的第二條原則，知道因為其重寫了writeObject和readObject方法,而在方法的內部實現了對具體存儲對象的序列化與反序列化。那么這兩個方法究竟是在什么時候執行的呢？我們需要轉到ObjectOutputStream這個對象上來：

/**
 * Serialization's descriptor for classes.  It contains the name and
 * serialVersionUID of the class.  The ObjectStreamClass for a specific class
 * loaded in this Java VM can be found/created using the lookup method. 16  */
// 在序列化對象之前會封裝一個ObjectStreamClass對象
public class ObjectStreamClass implements Serializable  {
    /** class-defined writeObject method, or null if none */
    private Method writeObjectMethod;
    
     /**
     * Creates local class descriptor representing given class.
     */
    private ObjectStreamClass(final Class cl) { 36 　　 
　　　　　　......

    if (serializable) {
        AccessController.doPrivileged(new PrivilegedAction() {
        public Object run() {
            if (isEnum) {
            suid = Long.valueOf(0);
            fields = NO_FIELDS;
            return null;
            }
            if (cl.isArray()) {
            fields = NO_FIELDS;
            return null;
            }
    
            suid = getDeclaredSUID(cl);
            try {
            fields = getSerialFields(cl);
            computeFieldOffsets();
            } catch (InvalidClassException e) {
            serializeEx = deserializeEx = e;
            fields = NO_FIELDS;
            }
            
            if (externalizable) {
            cons = getExternalizableConstructor(cl);
            } else {
            cons = getSerializableConstructor(cl);
                        // 其實就是writeObject方法
            writeObjectMethod = getPrivateMethod(cl, "writeObject", 
 65                 new Class[] { ObjectOutputStream.class }, 
 66                 Void.TYPE);
            readObjectMethod = getPrivateMethod(cl, "readObject", 
                new Class[] { ObjectInputStream.class }, 
                Void.TYPE);
            readObjectNoDataMethod = getPrivateMethod(
                cl, "readObjectNoData", null, Void.TYPE);
            hasWriteObjectData = (writeObjectMethod != null);
            }
            writeReplaceMethod = getInheritableMethod(
            cl, "writeReplace", null, Object.class);
            readResolveMethod = getInheritableMethod(
            cl, "readResolve", null, Object.class);
            return null;
        }
        });
    } else {
        suid = Long.valueOf(0);
        fields = NO_FIELDS;
    }

   　　.......107     }

    /**
     * Returns non-static private method with given signature defined by given
     * class, or null if none found.  Access checks are disabled on the
     * returned method (if any).
     */
    private static Method getPrivateMethod(Class cl, String name, 
                       Class[] argTypes,
                       Class returnType)
    {
    try {
        Method meth = cl.getDeclaredMethod(name, argTypes);
        meth.setAccessible(true);
        int mods = meth.getModifiers();
        return ((meth.getReturnType() == returnType) &&
            ((mods & Modifier.STATIC) == 0) &&
            ((mods & Modifier.PRIVATE) != 0)) ? meth : null;
    } catch (NoSuchMethodException ex) {
        return null;
    }
    }


     /**
     * Returns true if represented class is serializable (but not
     * externalizable) and defines a conformant writeObject method.  Otherwise,
     * returns false.
     */
    boolean hasWriteObjectMethod() {
    return (writeObjectMethod != null);
    }
}

public class ObjectOutputStream
    extends OutputStream implements ObjectOutput, ObjectStreamConstants
{
    /**
     * Magic number that is written to the stream header.
     */
    final static short STREAM_MAGIC = (short)0xaced;

    /**
     * Version number that is written to the stream header.
     */
    final static short STREAM_VERSION = 5;


    public ObjectOutputStream(OutputStream out) throws IOException {
    verifySubclass();
    bout = new BlockDataOutputStream(out);
    handles = new HandleTable(10, (float) 3.00);
    subs = new ReplaceTable(10, (float) 3.00);
    enableOverride = false;
        // 寫入頭信息
    writeStreamHeader();
    bout.setBlockDataMode(true);
        if (extendedDebugInfo) {
        debugInfoStack = new DebugTraceInfoStack();
    } else {
        debugInfoStack = null;
        }   
    }

     protected void writeStreamHeader() throws IOException {
    bout.writeShort(STREAM_MAGIC);
    bout.writeShort(STREAM_VERSION);
    }

    /**
     * Write the specified object to the ObjectOutputStream.  The class of the
     * object, the signature of the class, and the values of the non-transient
     * and non-static fields of the class and all of its supertypes are
     * written.  Default serialization for a class can be overridden using the
     * writeObject and the readObject methods.  Objects referenced by this
     * object are written transitively so that a complete equivalent graph of
     * objects can be reconstructed by an ObjectInputStream.196      */
    public final void writeObject(Object obj) throws IOException {
    if (enableOverride) {
        writeObjectOverride(obj);
        return;
    }
    try {
        writeObject0(obj, false);
    } catch (IOException ex) {
        if (depth == 0) {
        writeFatalException(ex);
        }
        throw ex;
    }
    }

     /**
     * Underlying writeObject/writeUnshared implementation.
     */
    private void writeObject0(Object obj, boolean unshared) 
    throws IOException 
    {
    boolean oldMode = bout.setBlockDataMode(false);
    depth++;
    try {
        // handle previously written and non-replaceable objects
     　　......
        // check for replacement object
        ......241      261 
        // if object replaced, run through original checks a second time
     　　......279 
        // remaining cases
        if (obj instanceof String) {
        writeString((String) obj, unshared);
        } else if (cl.isArray()) {
        writeArray(obj, desc, unshared);
        } else if (obj instanceof Enum) {
        writeEnum((Enum) obj, desc, unshared);
        } else if (obj instanceof Serializable) {
                // 如果不是特殊對象類型，最終會調用該方法
 writeOrdinaryObject(obj, desc, unshared);
        } else {
        if (extendedDebugInfo) {
            throw new NotSerializableException(
            cl.getName() + "\n" + debugInfoStack.toString());
        } else {
            throw new NotSerializableException(cl.getName());
        }    
        }
    } finally {
        depth--;
        bout.setBlockDataMode(oldMode);
    }
    }   

    private void writeOrdinaryObject(Object obj, 
                     ObjectStreamClass desc, 
                     boolean unshared) 
    throws IOException 
    {
        if (extendedDebugInfo) {
        debugInfoStack.push(
        (depth == 1 ? "root " : "") + "object (class \"" + 
        obj.getClass().getName() + "\", " + obj.toString() + ")");
        }
        try {
        desc.checkSerialize();

        bout.writeByte(TC_OBJECT);
        writeClassDesc(desc, false);
        handles.assign(unshared ? null : obj);
        if (desc.isExternalizable() && !desc.isProxy()) {
        writeExternalData((Externalizable) obj);
        } else {
                // 一般情況下會調用該方法
 writeSerialData(obj, desc);
        }
    } finally {
            if (extendedDebugInfo) {
        debugInfoStack.pop();
        }  
        }
    }            

 　　/**
     * Writes instance data for each serializable class of given object, from
     * superclass to subclass.
     */
    private void writeSerialData(Object obj, ObjectStreamClass desc) 
    throws IOException 
    {
    ObjectStreamClass.ClassDataSlot[] slots = desc.getClassDataLayout();
    for (int i = 0; i < slots.length; i++) {
        ObjectStreamClass slotDesc = slots[i].desc;
            // 如果重寫了序列化的方法writeObject，則調用對應的方法進行寫入，其實就是ObjectStreamClass 中的對應方法，可以得出序列化的第2條規則
        if (slotDesc.hasWriteObjectMethod()) {
        PutFieldImpl oldPut = curPut;
        curPut = null;

        if (extendedDebugInfo) {
            debugInfoStack.push(
            "custom writeObject data (class \"" + 
            slotDesc.getName() + "\")");
        }

                SerialCallbackContext oldContext = curContext;
        try {
                    curContext = new SerialCallbackContext(obj, slotDesc);

            bout.setBlockDataMode(true);
            slotDesc.invokeWriteObject(obj, this);
            bout.setBlockDataMode(false);
            bout.writeByte(TC_ENDBLOCKDATA);
        } finally {
                    curContext.setUsed();
                    curContext = oldContext;

            if (extendedDebugInfo) {
            debugInfoStack.pop();
            }    
        } 

        curPut = oldPut;
        } else {
                // 未重寫調用默認的方法
        defaultWriteFields(obj, slotDesc);
        }
    }
    }             

以上代碼就是分析序列化情況2的實現，反序列化也可以同樣跟蹤發現，這里不再重復。

 

Deeper---其他序列化反序列化的深入問題：

a. 被transient和static修飾的成員變量不會被序列化

b. 有個需要注意的點來自 Serializable 接口的說明文檔，簡單說明如下：

假設A實現了Serializable接口，且A為B的子類，B沒有實現Serializable接口。那么在序列化和反序列話的時候，B的無參構造函數負責B的相關屬性的序列化和反序列化。特殊的，當B沒有無參構造函數的時候，將A對象進行序列化時不會報錯，但是反序列化獲取A的時候報錯。

static class SubSerializableTest extends SerializableTest implements Serializable {
        private static final long serialVersionUID = 1L;
        
        private String subName;
        
        public SubSerializableTest(String name, String subName) {
            super(name, 18);
            this.subName = subName;
        }

        public String getSubName() {
            return subName;
        }
    }
    
    static class SerializableTest {
        
        public SerializableTest() {
            this.name = "aaa";
            this.age = 21;
        }
        
        public SerializableTest(String name, int age) {
            this.name = name;
        }
        
        private String name;
        
        private int age;

        public String getName() {
            return name;
        }

        public void setName(String name) {
            this.name = name;
        }

        public int getAge() {
            return age;
        }

        public void setAge(int age) {
            this.age = age;
        }
    }
    
    SubSerializableTest subTest = new SubSerializableTest("KiDe", "KiDe");
    ObjectOutputStream oos = new ObjectOutputStream(new FileOutputStream(new File("e:/1.txt")));
    oos.writeObject(subTest);
    oos.close();
    
    ObjectInputStream ois = new ObjectInputStream(new FileInputStream(new File("e:/1.txt")));
    subTest = (SubSerializableTest) ois.readObject();        // 如果SerializableTest未實現無參的構造函數，則拋出 Exception in thread "main" java.io.InvalidClassException: test.Test$SubSerializableTest; test.Test$SubSerializableTest; no valid constructor
    System.out.println(subTest.getName());        // aaa
    System.out.println(subTest.getSubName());    // KiDe
    ois.close();

另外多說一句，假設B是A的一個屬性但是B沒有實現 Serializable 接口，這時候不管序列化還是反序列化A都會報異常：
Exception in thread "main" java.io.NotSerializableException: test.Test$SerializableTest。

c. 由於上面所講的限制，就存在需要特殊處理未實現 Serializable 接口的屬性，這時候可以重寫下面三個方法：
private void writeObject(java.io.ObjectOutputStream out) throws IOException
private void readObject(java.io.ObjectInputStream in) throws IOException, ClassNotFoundException;
private void readObjectNoData() throws ObjectStreamException;

前面兩個方法主要用來序列化和反序列化被transient或者static修飾的屬性，將其寫入流：

private void writeObject(ObjectOutputStream out) throws IOException {
System.out.println("writeOject");
    out.defaultWriteObject();
    out.writeInt(123);
}

private void readObject(ObjectInputStream in) throws IOException, ClassNotFoundException {
    System.out.println("readOject");
    in.defaultReadObject();
    System.out.println(in.readInt());;
}

第三個方法屬於一種防御性方法，一般不會用到，官方解釋是；
The readObjectNoData method is responsible for initializing the state of the object for its particular class in the event that the serialization stream does not list the given class as a superclass of the object being deserialized. This may occur in cases where the receiving party uses a different version of the deserialized instance's class than the sending party, and the receiver's version extends classes that are not extended by the sender's version. This may also occur if the serialization stream has been tampered; hence, readObjectNoData is useful for initializing deserialized objects properly despite a "hostile" or incomplete source stream.

這里暫時沒有試驗出這個方法的使用場景，略過。

 

d.  還有兩個方法在序列化和反序列化的時候會被自動調用到：

ANY-ACCESS-MODIFIER Object writeReplace() throws ObjectStreamException;
ANY-ACCESS-MODIFIER Object readResolve() throws ObjectStreamException;

其中writeReplace調用在writeObject之前，可以修改對象屬性，最終返回this，readResolve調用在readObject之后，可以修改讀取到的對象的屬性，返回this

一般的應用是在單例模式中，重寫readResoive方法，返回單例。防止通過序列化和反序列化導致單例模式生效的問題。