Warning of use of Unsafe in JDK 23

[Thihup]

WARNING: A terminally deprecated method in sun.misc.Unsafe has been called
WARNING: sun.misc.Unsafe::objectFieldOffset has been called by com.thoughtworks.xstream.converters.reflection.SunUnsafeReflectionProvider (file:/xstream-1.4.20.jar)
WARNING: Please consider reporting this to the maintainers of class com.thoughtworks.xstream.converters.reflection.SunUnsafeReflectionProvider
WARNING: sun.misc.Unsafe::objectFieldOffset will be removed in a future release

When running with --sun-misc-unsafe-memory-access=deny (the default in the future):

java.lang.ExceptionInInitializerError
        at xstream@1.4.20/com.thoughtworks.xstream.core.util.CompositeClassLoader.<clinit>(CompositeClassLoader.java:56)
        at xstream@1.4.20/com.thoughtworks.xstream.XStream.<init>(XStream.java:403)
        at xstream@1.4.20/com.thoughtworks.xstream.XStream.<init>(XStream.java:377)
Caused by: java.lang.UnsupportedOperationException: objectFieldOffset
        at jdk.unsupported/sun.misc.Unsafe.beforeMemoryAccessSlow(Unsafe.java:1826)
        at jdk.unsupported/sun.misc.Unsafe.beforeMemoryAccess(Unsafe.java:1791)
        at jdk.unsupported/sun.misc.Unsafe.objectFieldOffset(Unsafe.java:909)
        at xstream@1.4.20/com.thoughtworks.xstream.converters.reflection.SunUnsafeReflectionProvider.getFieldOffset(SunUnsafeReflectionProvider.java:105)
        at xstream@1.4.20/com.thoughtworks.xstream.converters.reflection.SunUnsafeReflectionProvider.write(SunUnsafeReflectionProvider.java:66)
        at xstream@1.4.20/com.thoughtworks.xstream.converters.reflection.SunUnsafeReflectionProvider.writeField(SunUnsafeReflectionProvider.java:56)
        at xstream@1.4.20/com.thoughtworks.xstream.core.JVM.<clinit>(JVM.java:100)
        ... 30 more

Related:
https://openjdk.org/jeps/471

[Dark-Leader]

Getting the same warning for JDK 24 and Xstream version 1.4.21
Any updates?

[stewue]

Getting the same warning for JDK 25. The related pull request trying to refactor the code is closed. So any updates?

[vlsi]

Currently, xstream uses feature detection to figure out "java reflection vs unsafe":

xstream/xstream/src/java/com/thoughtworks/xstream/core/JVM.java

Line 98 in e79126f

final Class<?> unsafeClass = Class.forName("sun.misc.Unsafe");

What if we add if (!isVersion(17)) { .. attempt unsafe tests..}

In other words, what if xstream completely skips unsafe with Java 17+?

Currently, the warning is very hard to deal with from the users' perspective, and Unsafe is known to be deprecated and probably removed. So it does not seem to help much keeping it within the codebase.