Serializing and deserializing an object that doesn't implement Serializable

Question

Motivation:

To aid in remote debugging (Java), it's useful to be able to request remote servers to send over arbitrary objects to my local machine for inspection. However, this means that the remote server must be able to serialize an arbitrary java object that is not known in advance at runtime.

In particular, I would like to be able to serialize even those objects which don't implement Serializable. I stumbled upon JBossSerialization which claimed with that with JBossSerialization...

...You can serialize classes that are not implementing Serializable

Great! And even better, I managed to find the code that supposedly demonstrates how to do this.

Problem

So pinching the code from schabell.org, I wrote a quick test to check that I could serialize and deserialize without problems:

import org.jboss.serial.io.JBossObjectInputStream;
import org.jboss.serial.io.JBossObjectOutputStream;
import java.io.*;

class MyObj {   // Test class which doesn't implement Serializable
    public int x;
    MyObj(int x) {this.x = x;}
}

public class SerializationTest {

    public static void main(String[] args) {
        MyObj obj = new MyObj(1);
        byte[] byteArray = getByteArrayFromObject(obj);            // Try to serialize
        MyObj result = (MyObj) getObjectFromByteArray(byteArray);  // Try to deserialize
        System.out.println(result.x);
    }

    // Code that I pinched from website below (http://www.schabell.org/2009/03/jboss-serialization-simple-example.html):
    public static Object getObjectFromByteArray(byte[] bytes) {
        Object result = null;

        try {
            ByteArrayInputStream bais = new ByteArrayInputStream(bytes);
            ObjectInputStream ois = new JBossObjectInputStream(bais);
            result = ois.readObject();   // ERROR HERE!!!
            ois.close();
        } catch (IOException ioEx) {
            ioEx.printStackTrace();
        } catch (ClassNotFoundException cnfEx) {
            cnfEx.printStackTrace();
        }

        return result;
    }

    public static byte[] getByteArrayFromObject(Object obj) {
        byte[] result = null;

        try {
            ByteArrayOutputStream baos = new ByteArrayOutputStream();
            ObjectOutputStream oos = new JBossObjectOutputStream(baos);
            oos.writeObject(obj);
            oos.flush();
            oos.close();
            baos.close();
            result = baos.toByteArray();
        } catch (IOException ioEx) {
            ioEx.printStackTrace();
        }

        return result;
    }
}

Problem is that the test failed. Debugging indicated that I could only serialize, but not deserialize. The call to ois.readObject() on line 26 is the culprit and gives as SerializationException:

org.jboss.serial.exception.SerializationException: Could not create instance of MyObj - MyObj
    at org.jboss.serial.classmetamodel.ClassMetaData.newInstance(ClassMetaData.java:342)
    at org.jboss.serial.persister.RegularObjectPersister.readData(RegularObjectPersister.java:239)
    at org.jboss.serial.objectmetamodel.ObjectDescriptorFactory.readObjectDescriptionFromStreaming(ObjectDescriptorFactory.java:412)
    at org.jboss.serial.objectmetamodel.ObjectDescriptorFactory.objectFromDescription(ObjectDescriptorFactory.java:82)
    at org.jboss.serial.objectmetamodel.DataContainer$DataContainerDirectInput.readObject(DataContainer.java:643)
    at org.jboss.serial.io.JBossObjectInputStream.readObjectOverride(JBossObjectInputStream.java:163)
    at java.io.ObjectInputStream.readObject(ObjectInputStream.java:364)
    at SerializationTest.getObjectFromByteArray(SerializationTest.java:44)
    at SerializationTest.main(SerializationTest.java:15)
Caused by: java.lang.InstantiationException: MyObj
    at java.lang.Class.newInstance(Class.java:359)
    at org.jboss.serial.classmetamodel.ClassMetaData.newInstance(ClassMetaData.java:334)
    ... 8 more

Does anyone know what's going wrong here and how I can get round this?

Or indeed if JBossSerialization isn't the right tool for this, what is?

Edit:

As @Dima points out, the SerializationException is caused by a lack of a public default constructor of the MyObj class. However, adding a default constructor to MyObj isn't an option as I'd like to be able to serialize arbitrary objects, including those without a default constructor.

Answer 1

Well, it is actually impossible to do what you want in a way, that would be both safe and universal.

You can take a look at Kryo, as someone suggested in comments as well. It does have a way to instantiate objects without invoking a constructor, but it is off by default and there is a good reason for it.

Consider this for example:

public class CanonicalObject {
    public static HashMap<String,CannicalObject> canons = new HahMap<~>();
    public String name;
    private CanonicalObject(String name) { 
        this.name = name;            
        canons.put(name, this);
    }
    public static synchronized CanonicalObject getCanonicalInstance(String name) {            
        CanonicalObject co = canon.get(name);
        return co == null ? new CanonicalObject(name) : co;
    }
}

(This is a "semi-real-life" example, in that there are real uses for this pattern. I am aware of the "memory leak", there are ways to avoid it in real applications, but they are irrelevant to this example, so I am just ignoring that issue for the sake of simplicity).

If you serialize an instance of this object, when you deserialize it on the other end, the whole "canonicalization" part will be skipped, which can cause subtle problems in application, that are really hard to diagnose, such as comparisons like if(canon1 != canon2) fireMissile() resulting in "friendly fire" and, possibly, a WorldWar III.

Note, that the problem here is broader than just a constructor not invoked by deserialization: the canon.put call could very well be put into getCanonicalInstance() instead of the constructor, and that would present the problem even if the constructor was invoked.

This is an illustration of why, as a matter of policy, you should not be serializing objects that are not designed to be serialized. IT can sometimes work, but, when it does not, it results in situations that are really hard to detect, and usually even harder to fix.