Avoiding sun.misc.Unsafe and embracing modules in Java libraries: missing links

[Jochen Theodorou]

On 03.04.2018 21:26, Henri Tremblay wrote:
[...]
> For completeness, there are 4 ways to create a class without calling a
> constructor right now that I'm aware of:
> 
>     - Unsafe.allocateInstance

which is supposed to go away at some point

>     - sun.reflect.ReflectionFactory.newConstructorForSerialization (my
>     favorite because it's the fastest one)

which afaik works in java9 but is also one of those critical doomed APIs

>     - Generate an extending class forgetting to call the super constructor
>     (so it's not exactly that same class that is instantiated). It requires
>     -Xverify:none

Is this really an option for a production environment?

>     - Generate a class extending MagicAccessorImpl that will then
>     instantiates the wanted class but calling the wrong constructor

Is jdk.internal.reflect.MagicAccessorImpl still usable in Java9+? I 
thought this is no longer exported

Under the premise that all critical API usages will be removed in the 
future and replacement APIs will be created I think we might indeed 
still miss something here

bye Jochen