Review Request JDK-8181443: Replace usages of jdk.internal.misc.Unsafe with MethodHandles.Lookup.defineClass

[Rafael Winterhalter]

Hi Alan,

I second that the Unsafe::defineClass method should be removed at some
point. I'd very much prefer using a stable API over following up changes on
internal API.

However, for Java agents, there is still no good way to define auxiliary
classes. There is an open ticket on
https://bugs.openjdk.java.net/browse/JDK-8201784 and I have described my
concerns with the suggested API in the linked discussion as being
insufficient for many use cases. I still hope that a defineClass method can
be added to the Instrumentation interface; I would not know of any other
good use case that currently makes use of the internal Unsafe version but
agents.

As of today, Unsafe::defineClass is however still a crucial element for
many Java agents that are widely used in the enterprise space, e.g. for APM
tools, security monitoring or metrics extraction. Not offering an
alternative would lock out these tools and stop a large fraction of Java
users from updating their production environments until a new workaround is
found. I hope that you consider an API for Java agents to define classes as
a blocker issue to be solved prior to removing Unsafe::defineClass
alltogether.

Thanks and best regards,
Rafael