ObjectInputStream (was: Still driving off the cliff)

[Jesse Glick]

On 02/24/2012 12:26 PM, David M. Lloyd wrote:
> look at how ObjectInputStream resolves classes by default

...bizarrely, in fact. In NetBeans we created NbObjectInputStream [1] in part to solve this exact problem. (The getNBClassLoader method returns a "master" loader, also 
the default TCCL, which can load from any enabled module when unambiguous.)

While NbOIS is a helpful replacement for OIS in module code, if a module calls a preexisting library using plain OIS, and this library tries to deserialize an instance of 
a class defined in some unrelated module, you are out of luck. Perhaps Jigsaw's ObjectStreamClass should be modified to store the module ID where available, which would 
be easier to use and also handle cases where multiple modules define a class of the same name?

[1] https://hg.netbeans.org/core-main/raw-file/default/openide.util/src/org/openide/util/io/NbObjectInputStream.java