Warning of use of Unsafe in JDK 23

[Thihup]

WARNING: A terminally deprecated method in sun.misc.Unsafe has been called
WARNING: sun.misc.Unsafe::objectFieldOffset has been called by com.thoughtworks.xstream.converters.reflection.SunUnsafeReflectionProvider (file:/xstream-1.4.20.jar)
WARNING: Please consider reporting this to the maintainers of class com.thoughtworks.xstream.converters.reflection.SunUnsafeReflectionProvider
WARNING: sun.misc.Unsafe::objectFieldOffset will be removed in a future release

When running with --sun-misc-unsafe-memory-access=deny (the default in the future):

java.lang.ExceptionInInitializerError
        at xstream@1.4.20/com.thoughtworks.xstream.core.util.CompositeClassLoader.<clinit>(CompositeClassLoader.java:56)
        at xstream@1.4.20/com.thoughtworks.xstream.XStream.<init>(XStream.java:403)
        at xstream@1.4.20/com.thoughtworks.xstream.XStream.<init>(XStream.java:377)
Caused by: java.lang.UnsupportedOperationException: objectFieldOffset
        at jdk.unsupported/sun.misc.Unsafe.beforeMemoryAccessSlow(Unsafe.java:1826)
        at jdk.unsupported/sun.misc.Unsafe.beforeMemoryAccess(Unsafe.java:1791)
        at jdk.unsupported/sun.misc.Unsafe.objectFieldOffset(Unsafe.java:909)
        at xstream@1.4.20/com.thoughtworks.xstream.converters.reflection.SunUnsafeReflectionProvider.getFieldOffset(SunUnsafeReflectionProvider.java:105)
        at xstream@1.4.20/com.thoughtworks.xstream.converters.reflection.SunUnsafeReflectionProvider.write(SunUnsafeReflectionProvider.java:66)
        at xstream@1.4.20/com.thoughtworks.xstream.converters.reflection.SunUnsafeReflectionProvider.writeField(SunUnsafeReflectionProvider.java:56)
        at xstream@1.4.20/com.thoughtworks.xstream.core.JVM.<clinit>(JVM.java:100)
        ... 30 more

Related:
https://openjdk.org/jeps/471

[Dark-Leader]

Getting the same warning for JDK 24 and Xstream version 1.4.21
Any updates?

[stewue]

Getting the same warning for JDK 25. The related pull request trying to refactor the code is closed. So any updates?

[vlsi]

Currently, xstream uses feature detection to figure out "java reflection vs unsafe":

xstream/xstream/src/java/com/thoughtworks/xstream/core/JVM.java

Line 98 in e79126f

final Class<?> unsafeClass = Class.forName("sun.misc.Unsafe");

What if we add if (!isVersion(17)) { .. attempt unsafe tests..}

In other words, what if xstream completely skips unsafe with Java 17+?

Currently, the warning is very hard to deal with from the users' perspective, and Unsafe is known to be deprecated and probably removed. So it does not seem to help much keeping it within the codebase.

[hazendaz]

FYI, Class.forName(String) without a classloader can leak classloaders in dynamic/redeployable environments (Jenkins, Maven, etc.). Safer pattern is:

ClassLoader cl = Thread.currentThread().getContextClassLoader();
if (cl == null) cl = XStream.class.getClassLoader();
Class<?> type = Class.forName(className, false, cl);

This avoids retention issues while still resolving classes dynamically.

[yudalang3]

Yes, this is a significant issue. We kindly ask the developers to pay attention to it and look into whether it can be resolved.

[long76]

ping

[jglick]

I stumbled across 8c543bf by @joehni but it does not appear to resolve the issue (as described in #362 (comment)). I was unable to confirm since it would not compile:

xstream/src/java/com/thoughtworks/xstream/core/util/JdkMiscUnsafe.java:[25,36] package jdk.internal.misc does not exist

The problem is simple enough to reproduce in master (currently a0f1637) or v-1.4.x (currently 66fcb13):

$ mvn -V -pl xstream test -Dtest=XStreamTest
Apache Maven 3.9.16 (2bdd9fddda4b155ebf8000e807eb73fd829a51d5)
Maven home: …
Java version: 25.0.3, vendor: Eclipse Adoptium, runtime: …
Default locale: en_US, platform encoding: UTF-8
OS name: "linux", version: "6.17.…", arch: "amd64", family: "unix"
…
[INFO] -------------------------------------------------------
[INFO]  T E S T S
[INFO] -------------------------------------------------------
[INFO] Running com.thoughtworks.xstream.XStreamTest
WARNING: A terminally deprecated method in sun.misc.Unsafe has been called
WARNING: sun.misc.Unsafe::objectFieldOffset has been called by com.thoughtworks.xstream.converters.reflection.SunUnsafeReflectionProvider (file:/src/gh/x-stream/xstream/xstream/target/classes/)
WARNING: Please consider reporting this to the maintainers of class com.thoughtworks.xstream.converters.reflection.SunUnsafeReflectionProvider
WARNING: sun.misc.Unsafe::objectFieldOffset will be removed in a future release
[INFO] Tests run: 19, Failures: 0, Errors: 0, Skipped: 0, Time elapsed: 0.218 s -- in com.thoughtworks.xstream.XStreamTest