JDK-8007079 : Changes in default serialVersionUID calculation since JDK8-b73
  • Type: Bug
  • Component: security-libs
  • Sub-Component: java.security
  • Affected Version: 8
  • Priority: P2
  • Status: Closed
  • Resolution: Duplicate
  • Submitted: 2013-01-29
  • Updated: 2013-02-05
  • Resolved: 2013-01-29
Related Reports
Blocks :  
JDK-8006934 - Interface default methods showing up in implementing class c
Duplicate :  
JDK-8006934 - Interface default methods showing up in implementing class c
Relates :  
JDK-4897937 - serialVersionUID computation should ignore the ACC_SYNTHETIC flag
Description
Please see minimized test below:

$ cat Test.java 
public class Test extends java.security.Signer implements java.io.Serializable {
    String n;

    public Test(String s) {
        n = s;
    }
}

$ /java/re/jdk/7/promoted/fcs/b148/binaries/solaris-sparc/bin/javac Test.java
Note: Test.java uses or overrides a deprecated API.
Note: Recompile with -Xlint:deprecation for details.

$ /java/re/jdk/7/promoted/fcs/b148/binaries/solaris-sparc/bin/serialver Test
Test:    static final long serialVersionUID = 7190557222763814429L;

$ /java/re/jdk/8/promoted/ea/b72/binaries/solaris-sparc/bin/serialver Test
Test:    static final long serialVersionUID = 7190557222763814429L;

$ /java/re/jdk/8/promoted/ea/b73/binaries/solaris-sparc/bin/serialver Test
Test:    static final long serialVersionUID = -4685217835722692979L;
Comments
Marked as duplicate of JDK-8006934. Once that is fixed, this problem should go away.
29-01-2013
The serialVersionUID is computed from the class's fields and methods, and the latter are discovered via the Class.getDeclaredMethods call. Unfortunately, default methods in a superinterface show up in the return value of Class.getDeclaredMethods on an implementing class, so the resulting serialVersionUID is different. This seems like a bug. Brian Goetz (29-Jan-2013) said, "Its definitely a bug, which comes from a reflection bug where default methods show up in getDeclaredMethods." So this seems like a reflection bug, not a serialization or security bug. Either this should be closed out as a dupe of a reflection bug, or the component/subcomp/summary of this issue should be updated appropriately.
29-01-2013
I have linked as blocking JDK-8006934
29-01-2013
The root cause is interface default methods showing up in implementing class getDeclaredMethods()
29-01-2013
The following JCK8-b17 tests failed under JDK8-b73 to the issue: api/java_security/Signer/serial/index.html#Input[serial2002] api/java_security/Identity/serial/index.html#Input[serial2002]
29-01-2013
Is there a lambda bug open for this and/or can it be marked a duplicate for now?
29-01-2013
JDK-7019834 added a default method to java.security.Principal that Signer implements. A side effect of default methods is that it changes the serial version UID. This issue is currently being discussed on the lambda-dev list, and needs to be fully understood before jdk8 is finalized.
29-01-2013
Perhaps, default SVUID calculation is affected somehow by the fact that java.security.Signer is deprecated.
29-01-2013