java序列化反序列化深入探究（转）

When---什么时候需要序列化和反序列化:

简单的写一个hello world程序，用不到序列化和反序列化。写一个排序算法也用不到序列化和反序列化。但是当你想要将一个对象进行持久化写入文件，或者你想将一个对象从一个网络地址通过网络协议发送到另一个网络地址时，这时候就需要考虑序列化和反序列化了。另外如果你想对一个对象实例进行深度拷贝，也可以通过序列化和反序列化的方式进行。

 

What---什么是序列化和反序列化：

Serialization-序列化：可以看做是将一个对象转化为二进制流的过程

Deserialization-反序列化：可以看做是将对象的二进制流重新读取转换成对象的过程

 

How---怎么实现序列化：

只有实现了 Serializable 或 Externalizable 接口的类的对象才能被序列化，否则抛出异常。
对于实现了这两个接口，具体序列化和反序列化的过程又分以下3中情况：
情况1：若类仅仅实现了Serializable接口，则可以按照以下方式进行序列化和反序列化
ObjectOutputStream采用默认的序列化方式，对对象的非transient的实例变量进行序列化。
ObjcetInputStream采用默认的反序列化方式，对对象的非transient的实例变量进行反序列化。

情况2：若类不仅实现了Serializable接口，并且还定义了readObject(ObjectInputStream in)和writeObject(ObjectOutputSteam out)，则采用以下方式进行序列化与反序列化。
ObjectOutputStream调用对象的writeObject(ObjectOutputStream out)的方法进行序列化。
ObjectInputStream会调用对象的readObject(ObjectInputStream in)的方法进行反序列化。

情况3：若类实现了Externalnalizable接口，且类必须实现readExternal(ObjectInput in)和writeExternal(ObjectOutput out)方法，则按照以下方式进行序列化与反序列化。
ObjectOutputStream调用对象的writeExternal(ObjectOutput out))的方法进行序列化。
ObjectInputStream会调用对象的readExternal(ObjectInput in)的方法进行反序列化。

 为了进一步说明，我们直接看jdk底层ArrayList的序列化和反序列化：

 1 // 实现了Serializable接口，可以被序列化
 2 public class ArrayList<E> extends AbstractList<E>
 3         implements List<E>, RandomAccess, Cloneable, java.io.Serializable
 4 {
 5     private static final long serialVersionUID = 8683452581122892189L;
 6 
 7     /**
 8      * The array buffer into which the elements of the ArrayList are stored.
 9      * The capacity of the ArrayList is the length of this array buffer.
10      */
11     // 实际元素被transient修饰,默认不会进行序列化
12     private transient Object[] elementData;
13 
14     .....
15 
16     /**
17      * Save the state of the <tt>ArrayList</tt> instance to a stream (that
18      * is, serialize it).
19      *
20      * @serialData The length of the array backing the <tt>ArrayList</tt>
21      *             instance is emitted (int), followed by all of its elements
22      *             (each an <tt>Object</tt>) in the proper order.
23      */
24     private void writeObject(java.io.ObjectOutputStream s)
25         throws java.io.IOException{
26     // Write out element count, and any hidden stuff
27     int expectedModCount = modCount;
28     s.defaultWriteObject();
29 
30         // Write out array length
31         s.writeInt(elementData.length);
32 
33     // Write out all elements in the proper order.
34     for (int i=0; i<size; i++)
35             s.writeObject(elementData[i]);
36 
37     if (modCount != expectedModCount) {
38             throw new ConcurrentModificationException();
39         }
40 
41     }
42     
43     /**
44      * Reconstitute the <tt>ArrayList</tt> instance from a stream (that is,
45      * deserialize it).
46      */
47     private void readObject(java.io.ObjectInputStream s)
48         throws java.io.IOException, ClassNotFoundException {
49     // Read in size, and any hidden stuff
50     s.defaultReadObject();
51 
52         // Read in array length and allocate array
53         int arrayLength = s.readInt();
54         Object[] a = elementData = new Object[arrayLength];
55 
56     // Read in all elements in the proper order.
57     for (int i=0; i<size; i++)
58             a[i] = s.readObject();
59     }
60 }

View Code

可以看到，初看之下ArrayList的实际存储元素不能被序列化。但实际上根据我们上面的第二条原则，知道因为其重写了writeObject和readObject方法,而在方法的内部实现了对具体存储对象的序列化与反序列化。那么这两个方法究竟是在什么时候执行的呢？我们需要转到ObjectOutputStream这个对象上来：

  1 /**
  2  * Serialization's descriptor for classes.  It contains the name and
  3  * serialVersionUID of the class.  The ObjectStreamClass for a specific class
  4  * loaded in this Java VM can be found/created using the lookup method. 16  */
  5 // 在序列化对象之前会封装一个ObjectStreamClass对象
  6 public class ObjectStreamClass implements Serializable  {
  7     /** class-defined writeObject method, or null if none */
  8     private Method writeObjectMethod;
  9     
 10      /**
 11      * Creates local class descriptor representing given class.
 12      */
 13     private ObjectStreamClass(final Class cl) { 36 　　 
 14 　　　　　　......
 15     if (serializable) {
 16         AccessController.doPrivileged(new PrivilegedAction() {
 17         public Object run() {
 18             if (isEnum) {
 19             suid = Long.valueOf(0);
 20             fields = NO_FIELDS;
 21             return null;
 22             }
 23             if (cl.isArray()) {
 24             fields = NO_FIELDS;
 25             return null;
 26             }
 27     
 28             suid = getDeclaredSUID(cl);
 29             try {
 30             fields = getSerialFields(cl);
 31             computeFieldOffsets();
 32             } catch (InvalidClassException e) {
 33             serializeEx = deserializeEx = e;
 34             fields = NO_FIELDS;
 35             }
 36             
 37             if (externalizable) {
 38             cons = getExternalizableConstructor(cl);
 39             } else {
 40             cons = getSerializableConstructor(cl);
 41                         // 其实就是writeObject方法
 42             writeObjectMethod = getPrivateMethod(cl, "writeObject", 
 43                 new Class[] { ObjectOutputStream.class }, 
 44                 Void.TYPE);
 45             readObjectMethod = getPrivateMethod(cl, "readObject", 
 46                 new Class[] { ObjectInputStream.class }, 
 47                 Void.TYPE);
 48             readObjectNoDataMethod = getPrivateMethod(
 49                 cl, "readObjectNoData", null, Void.TYPE);
 50             hasWriteObjectData = (writeObjectMethod != null);
 51             }
 52             writeReplaceMethod = getInheritableMethod(
 53             cl, "writeReplace", null, Object.class);
 54             readResolveMethod = getInheritableMethod(
 55             cl, "readResolve", null, Object.class);
 56             return null;
 57         }
 58         });
 59     } else {
 60         suid = Long.valueOf(0);
 61         fields = NO_FIELDS;
 62     }
 63 
 64    　　.......107     }
 65 
 66     /**
 67      * Returns non-static private method with given signature defined by given
 68      * class, or null if none found.  Access checks are disabled on the
 69      * returned method (if any).
 70      */
 71     private static Method getPrivateMethod(Class cl, String name, 
 72                        Class[] argTypes,
 73                        Class returnType)
 74     {
 75     try {
 76         Method meth = cl.getDeclaredMethod(name, argTypes);
 77         meth.setAccessible(true);
 78         int mods = meth.getModifiers();
 79         return ((meth.getReturnType() == returnType) &&
 80             ((mods & Modifier.STATIC) == 0) &&
 81             ((mods & Modifier.PRIVATE) != 0)) ? meth : null;
 82     } catch (NoSuchMethodException ex) {
 83         return null;
 84     }
 85     }
 86 
 87 
 88      /**
 89      * Returns true if represented class is serializable (but not
 90      * externalizable) and defines a conformant writeObject method.  Otherwise,
 91      * returns false.
 92      */
 93     boolean hasWriteObjectMethod() {
 94     return (writeObjectMethod != null);
 95     }
 96 }
 97 
 98 public class ObjectOutputStream
 99     extends OutputStream implements ObjectOutput, ObjectStreamConstants
100 {
101     /**
102      * Magic number that is written to the stream header.
103      */
104     final static short STREAM_MAGIC = (short)0xaced;
105 
106     /**
107      * Version number that is written to the stream header.
108      */
109     final static short STREAM_VERSION = 5;
110 
111 
112     public ObjectOutputStream(OutputStream out) throws IOException {
113     verifySubclass();
114     bout = new BlockDataOutputStream(out);
115     handles = new HandleTable(10, (float) 3.00);
116     subs = new ReplaceTable(10, (float) 3.00);
117     enableOverride = false;
118         // 写入头信息
119     writeStreamHeader();
120     bout.setBlockDataMode(true);
121         if (extendedDebugInfo) {
122         debugInfoStack = new DebugTraceInfoStack();
123     } else {
124         debugInfoStack = null;
125         }   
126     }
127 
128      protected void writeStreamHeader() throws IOException {
129     bout.writeShort(STREAM_MAGIC);
130     bout.writeShort(STREAM_VERSION);
131     }
132 
133     /**
134      * Write the specified object to the ObjectOutputStream.  The class of the
135      * object, the signature of the class, and the values of the non-transient
136      * and non-static fields of the class and all of its supertypes are
137      * written.  Default serialization for a class can be overridden using the
138      * writeObject and the readObject methods.  Objects referenced by this
139      * object are written transitively so that a complete equivalent graph of
140      * objects can be reconstructed by an ObjectInputStream.196      */
141     public final void writeObject(Object obj) throws IOException {
142     if (enableOverride) {
143         writeObjectOverride(obj);
144         return;
145     }
146     try {
147         writeObject0(obj, false);
148     } catch (IOException ex) {
149         if (depth == 0) {
150         writeFatalException(ex);
151         }
152         throw ex;
153     }
154     }
155 
156      /**
157      * Underlying writeObject/writeUnshared implementation.
158      */
159     private void writeObject0(Object obj, boolean unshared) 
160     throws IOException 
161     {
162     boolean oldMode = bout.setBlockDataMode(false);
163     depth++;
164     try {
165         // handle previously written and non-replaceable objects
166      　　......
167         // check for replacement object
168         ......241      261 
169         // if object replaced, run through original checks a second time
170      　　......279 
171         // remaining cases
172         if (obj instanceof String) {
173         writeString((String) obj, unshared);
174         } else if (cl.isArray()) {
175         writeArray(obj, desc, unshared);
176         } else if (obj instanceof Enum) {
177         writeEnum((Enum) obj, desc, unshared);
178         } else if (obj instanceof Serializable) {
179                 // 如果不是特殊对象类型，最终会调用该方法
180         writeOrdinaryObject(obj, desc, unshared);
181         } else {
182         if (extendedDebugInfo) {
183             throw new NotSerializableException(
184             cl.getName() + "\n" + debugInfoStack.toString());
185         } else {
186             throw new NotSerializableException(cl.getName());
187         }    
188         }
189     } finally {
190         depth--;
191         bout.setBlockDataMode(oldMode);
192     }
193     }   
194 
195     private void writeOrdinaryObject(Object obj, 
196                      ObjectStreamClass desc, 
197                      boolean unshared) 
198     throws IOException 
199     {
200         if (extendedDebugInfo) {
201         debugInfoStack.push(
202         (depth == 1 ? "root " : "") + "object (class \"" + 
203         obj.getClass().getName() + "\", " + obj.toString() + ")");
204         }
205         try {
206         desc.checkSerialize();
207 
208         bout.writeByte(TC_OBJECT);
209         writeClassDesc(desc, false);
210         handles.assign(unshared ? null : obj);
211         if (desc.isExternalizable() && !desc.isProxy()) {
212         writeExternalData((Externalizable) obj);
213         } else {
214                 // 一般情况下会调用该方法
215         writeSerialData(obj, desc);
216         }
217     } finally {
218             if (extendedDebugInfo) {
219         debugInfoStack.pop();
220         }  
221         }
222     }            
223 
224  　　/**
225      * Writes instance data for each serializable class of given object, from
226      * superclass to subclass.
227      */
228     private void writeSerialData(Object obj, ObjectStreamClass desc) 
229     throws IOException 
230     {
231     ObjectStreamClass.ClassDataSlot[] slots = desc.getClassDataLayout();
232     for (int i = 0; i < slots.length; i++) {
233         ObjectStreamClass slotDesc = slots[i].desc;
234             // 如果重写了序列化的方法writeObject，则调用对应的方法进行写入，其实就是ObjectStreamClass 中的对应方法，可以得出序列化的第2条规则
235         if (slotDesc.hasWriteObjectMethod()) {
236         PutFieldImpl oldPut = curPut;
237         curPut = null;
238 
239         if (extendedDebugInfo) {
240             debugInfoStack.push(
241             "custom writeObject data (class \"" + 
242             slotDesc.getName() + "\")");
243         }
244 
245                 SerialCallbackContext oldContext = curContext;
246         try {
247                     curContext = new SerialCallbackContext(obj, slotDesc);
248 
249             bout.setBlockDataMode(true);
250             slotDesc.invokeWriteObject(obj, this);
251             bout.setBlockDataMode(false);
252             bout.writeByte(TC_ENDBLOCKDATA);
253         } finally {
254                     curContext.setUsed();
255                     curContext = oldContext;
256 
257             if (extendedDebugInfo) {
258             debugInfoStack.pop();
259             }    
260         } 
261 
262         curPut = oldPut;
263         } else {
264                 // 未重写调用默认的方法
265         defaultWriteFields(obj, slotDesc);
266         }
267     }
268     }

View Code

以上代码就是分析序列化情况2的实现，反序列化也可以同样跟踪发现，这里不再重复。

 

Deeper---其他序列化反序列化的深入问题：

a. 被transient和static修饰的成员变量不会被序列化

b. 有个需要注意的点来自 Serializable 接口的说明文档，简单说明如下：

假设A实现了Serializable接口，且A为B的子类，B没有实现Serializable接口。那么在序列化和反序列话的时候，B的无参构造函数负责B的相关属性的序列化和反序列化。特殊的，当B没有无参构造函数的时候，将A对象进行序列化时不会报错，但是反序列化获取A的时候报错。

 1 static class SubSerializableTest extends SerializableTest implements Serializable {
 2         private static final long serialVersionUID = 1L;
 3         
 4         private String subName;
 5         
 6         public SubSerializableTest(String name, String subName) {
 7             super(name, 18);
 8             this.subName = subName;
 9         }
10 
11         public String getSubName() {
12             return subName;
13         }
14     }
15     
16     static class SerializableTest {
17         
18         public SerializableTest() {
19             this.name = "aaa";
20             this.age = 21;
21         }
22         
23         public SerializableTest(String name, int age) {
24             this.name = name;
25         }
26         
27         private String name;
28         
29         private int age;
30 
31         public String getName() {
32             return name;
33         }
34 
35         public void setName(String name) {
36             this.name = name;
37         }
38 
39         public int getAge() {
40             return age;
41         }
42 
43         public void setAge(int age) {
44             this.age = age;
45         }
46     }
47     
48     SubSerializableTest subTest = new SubSerializableTest("KiDe", "KiDe");
49     ObjectOutputStream oos = new ObjectOutputStream(new FileOutputStream(new File("e:/1.txt")));
50     oos.writeObject(subTest);
51     oos.close();
52     
53     ObjectInputStream ois = new ObjectInputStream(new FileInputStream(new File("e:/1.txt")));
54     subTest = (SubSerializableTest) ois.readObject();        // 如果SerializableTest未实现无参的构造函数，则抛出 Exception in thread "main" java.io.InvalidClassException: test.Test$SubSerializableTest; test.Test$SubSerializableTest; no valid constructor
55     System.out.println(subTest.getName());        // aaa
56     System.out.println(subTest.getSubName());    // KiDe
57     ois.close();

View Code

另外多说一句，假设B是A的一个属性但是B没有实现 Serializable 接口，这时候不管序列化还是反序列化A都会报异常：
Exception in thread "main" java.io.NotSerializableException: test.Test$SerializableTest。

c. 由于上面所讲的限制，就存在需要特殊处理未实现 Serializable 接口的属性，这时候可以重写下面三个方法：
private void writeObject(java.io.ObjectOutputStream out) throws IOException
private void readObject(java.io.ObjectInputStream in) throws IOException, ClassNotFoundException;
private void readObjectNoData() throws ObjectStreamException;

前面两个方法主要用来序列化和反序列化被transient或者static修饰的属性，将其写入流：

 1 private void writeObject(ObjectOutputStream out) throws IOException {
 2 System.out.println("writeOject");
 3     out.defaultWriteObject();
 4     out.writeInt(123);
 5 }
 6 
 7 private void readObject(ObjectInputStream in) throws IOException, ClassNotFoundException {
 8     System.out.println("readOject");
 9     in.defaultReadObject();
10     System.out.println(in.readInt());;
11 }

第三个方法属于一种防御性方法，一般不会用到，官方解释是；
The readObjectNoData method is responsible for initializing the state of the object for its particular class in the event that the serialization stream does not list the given class as a superclass of the object being deserialized. This may occur in cases where the receiving party uses a different version of the deserialized instance's class than the sending party, and the receiver's version extends classes that are not extended by the sender's version. This may also occur if the serialization stream has been tampered; hence, readObjectNoData is useful for initializing deserialized objects properly despite a "hostile" or incomplete source stream.

这里暂时没有试验出这个方法的使用场景，略过。

 

d.  还有两个方法在序列化和反序列化的时候会被自动调用到：

ANY-ACCESS-MODIFIER Object writeReplace() throws ObjectStreamException;
ANY-ACCESS-MODIFIER Object readResolve() throws ObjectStreamException;

其中writeReplace调用在writeObject之前，可以修改对象属性，最终返回this，readResolve调用在readObject之后，可以修改读取到的对象的属性，返回this

一般的应用是在单例模式中，重写readResoive方法，返回单例。防止通过序列化和反序列化导致单例模式生效的问题。