1、對象序列化和持久化Object Serialization and Persistence2022-3-7Institute of Computer SoftwareNanjing University1摘要對象序列化對象持久化Language levelDatabasesHibernate2022-3-7Institute of Computer SoftwareNanjing University2摘要對象序列化對象持久化Language levelDatabasesHibernate2022-3-7Institute of Computer SoftwareNanjing Univers

2、ity3摘要對象序列化對象持久化Language levelDatabasesHibernate2022-3-7Institute of Computer SoftwareNanjing University4Object SerializationWhyWhatHow 2022-3-7Institute of Computer SoftwareNanjing University5Java Object Serialization - WhySerialization is used for lightweight persistence and for communication via

3、sockets or Remote Method Invocation (RMI). 2022-3-7Institute of Computer SoftwareNanjing University6Java Object Serialization - Examplepublic class Client public static void main(String args) try / Create a socket Socket soc = new Socket(InetAddress.getLocalHost(), 8020); OutputStream o = soc.getOut

4、putStream(); ObjectOutput s = new ObjectOutputStream(o); s.writeObject(Todays date); s.writeObject(new Date(); s.flush(); s.close(); catch (Exception e) System.out.println(e.getMessage(); System.out.println(Error during serialization); System.exit(1); 2022-3-7Institute of Computer SoftwareNanjing Un

5、iversity7Java Object Serialization - Examplepublic class Server public static void main(String args) ServerSocket ser = null; Socket soc = null; String str = null; Date d = null; try ser = new ServerSocket(8020);soc = ser.accept();InputStream o = soc.getInputStream();ObjectInput s = new ObjectInputS

6、tream(o);str = (String) s.readObject();d = (Date) s.readObject();s.close();System.out.println(str);System.out.println(d); catch (Exception e) System.out.println(e.getMessage(); System.out.println(Error during serialization); System.exit(1); 2022-3-7Institute of Computer SoftwareNanjing University8Ja

7、va Object Serialization - ExampleWriting to an object stream2022-3-7Institute of Computer SoftwareNanjing University9 / Serialize todays date to a file. FileOutputStream f = new FileOutputStream(tmp); ObjectOutput s = new ObjectOutputStream(f); s.writeObject(Today); s.writeObject(new Date(); s.flush

8、();Java Object Serialization - ExampleReading from an object stream2022-3-7Institute of Computer SoftwareNanjing University10 / Deserialize a string and date from a file. FileInputStream in = new FileInputStream(tmp); ObjectInputStream s = new ObjectInputStream(in); String today = (String)s.readObje

9、ct(); Date date = (Date)s.readObject();Java Object Serialization - WhatObject Serialization extends the core Java Input/Output classes with support for objects.Object Serialization supports the encoding of objects, and the objects reachable from them, into a stream of bytes; and it supports the comp

10、lementary reconstruction of the object graph from the stream. 2022-3-7Institute of Computer SoftwareNanjing University11Java Object Serialization - GoalHave a simple yet extensible mechanism. Maintain the Java object type and safety properties in the serialized form. Be extensible to support marshal

11、ing and unmarshaling as needed for remote objects. Be extensible to support simple persistence of Java objects. Require per class implementation only for customization. Allow the object to define its external format. 2022-3-7Institute of Computer SoftwareNanjing University12Java Object Serialization

12、 - HowObjects to be saved in the stream may support either the Serializable or the Externalizable interface. For Serializable objects, the stream includes sufficient information to restore the fields in the stream to a compatible version of the class. For Externalizable objects, the class is solely

13、responsible for the external format of its contents. 2022-3-7Institute of Computer SoftwareNanjing University13The Serializable Interfacepublic interface java.io.Serializable ; A Serializable class must do the following:Implement the java.io.Serializable interface Identify the fields that should be

14、serializableHave access to the no-arg constructor of its first nonserializable superclass 2022-3-7Institute of Computer SoftwareNanjing University14The Serializable InterfaceThe class can optionally define the following methods:writeObject (ObjectOutputStream)readObject (ObjectInputStream)writeRepla

15、ce ()readResolve ()2022-3-7Institute of Computer SoftwareNanjing University15思考：如果一個(gè)可序列化的類實(shí)現(xiàn)了以上四個(gè)方法，那么在序列化和反序列化的過程中，這幾個(gè)方法的調(diào)用次序如何？The Externalizable Interfacepublic interface Externalizable extends Serializable public void writeExternal(ObjectOutput out) throws IOException; public void readExternal(O

16、bjectInput in) throws IOException, java.lang.ClassNotFoundException; 2022-3-7Institute of Computer SoftwareNanjing University16The Externalizable InterfaceThe class of an Externalizable object must do the following: Implement the java.io.Externalizable interface Implement a writeExternal method to s

17、ave the state of the objectImplement a readExternal method to read the data written by the writeExternal method from the stream and restore the state of the object Have the writeExternal and readExternal methods be solely responsible for the format, if an externally defined format is written Have a

18、public no-arg constructor 2022-3-7Institute of Computer SoftwareNanjing University17The Externalizable InterfaceAn Externalizable class can optionally define the following methods: writeReplacereadResolve2022-3-7Institute of Computer SoftwareNanjing University18Note: 聲明類實(shí)現(xiàn)Externalizable接口會有重大的安全風(fēng)險(xiǎn)。w

19、riteExternal()與readExternal()方法聲明為public，惡意類可以用這些方法讀取和寫入對象數(shù)據(jù)。如果對象包含敏感信息，則要格外小心。區(qū)別Serializable自動(dòng)存儲必要信息，用以反序列化被存儲的實(shí)例優(yōu)點(diǎn)內(nèi)建支持易于實(shí)現(xiàn)缺點(diǎn)占用空間過大速度慢Externalizable只保存被存儲的類的標(biāo)識，完全由程序員完成讀取和寫入工作優(yōu)點(diǎn)開銷較少可能的速度提升缺點(diǎn)虛擬機(jī)不提供幫助，程序員負(fù)擔(dān)重2022-3-719Institute of Computer SoftwareNanjing UniversityserialVersionUIDprivate static final

20、 long serialVersionUIDFor compabilityInvalidClassException It is strongly recommended that all serializable classes explicitly declare serialVersionUID valuesserialver；eclipse2022-3-7Institute of Computer SoftwareNanjing University20Serialization Principles如果該類有父類如果父類實(shí)現(xiàn)了可序列化接口，則OK如果父類沒有實(shí)現(xiàn)可序列化接口，則父類所

21、有字段的屬性默認(rèn)情況下不會被序列化如果該類的某個(gè)屬性標(biāo)識為static類型的，則該屬性不能序列化；如果該類的某個(gè)屬性采用transient關(guān)鍵字標(biāo)識，則該屬性不能序列化；2022-3-7Institute of Computer SoftwareNanjing University21Serialization Principles在我們標(biāo)注一個(gè)類可以序列化的時(shí)候，其以下屬性應(yīng)該設(shè)置為transient來避免序列化：線程相關(guān)的屬性；需要訪問IO、本地資源、網(wǎng)絡(luò)資源等的屬性；沒有實(shí)現(xiàn)可序列化接口的屬性； 2022-3-7Institute of Computer SoftwareNanjing

22、University22Some Items from Effective Java2022-3-7Institute of Computer SoftwareNanjing University23Effective Java for Serialization1. Implement Serializable judiciously 謹(jǐn)慎地實(shí)現(xiàn)Serializable代價(jià)1：一旦一個(gè)類被發(fā)布，則“改變這個(gè)類的實(shí)現(xiàn)”的靈活性將大大降低。序列化會使類的演化受到限制。代價(jià)2：增加了錯(cuò)誤和安全漏洞的可能性。序列化機(jī)制是一種語言之外的對象創(chuàng)建機(jī)制。代價(jià)3：隨著一個(gè)類的新版本的發(fā)行，相關(guān)的測試負(fù)擔(dān)增加

23、了?？尚蛄谢惖淖兓酱?，它就越需要測試。2022-3-7Institute of Computer SoftwareNanjing University24Effective Java for SerializationNotes: 為了繼承而設(shè)計(jì)的類應(yīng)該很少實(shí)現(xiàn)Serializable，接口也應(yīng)該很少會擴(kuò)展它。對于為繼承而設(shè)計(jì)的不可序列化的類，應(yīng)該考慮提供一個(gè)無參數(shù)的構(gòu)造函數(shù)。內(nèi)部類應(yīng)該很少實(shí)現(xiàn)Serializable。2022-3-7Institute of Computer SoftwareNanjing University25Effective Java for Serializa

24、tion2. Consider using a custom serialized form 考慮使用自定義的序列化形式如果一個(gè)對象的物理表示等同于它的邏輯內(nèi)容，則默認(rèn)的序列化形式可能是合適的。即使確定了默認(rèn)序列化形式是合適的，通常仍然要提供一個(gè)readObject方法以保證約束關(guān)系和安全性。2022-3-7Institute of Computer SoftwareNanjing University26Effective Java for Serialization2022-3-7Institute of Computer SoftwareNanjing University27Effec

25、tive Java for Serialization2022-3-7Institute of Computer SoftwareNanjing University28Effective Java for Serialization當(dāng)一個(gè)對象的物理表示與它的邏輯數(shù)據(jù)內(nèi)容有實(shí)質(zhì)性的區(qū)別時(shí)，使用默認(rèn)序列化形式有4個(gè)缺點(diǎn):它使這個(gè)類的導(dǎo)出API永久地束縛在該類的內(nèi)部表示上。它要消耗過多的空間。它要消耗過多的時(shí)間。它會引起棧溢出。2022-3-7Institute of Computer SoftwareNanjing University292022-3-7Institute of Compute

26、r SoftwareNanjing University30Effective Java for Serialization2022-3-7Institute of Computer SoftwareNanjing University31Effective Java for Serialization如果所有的實(shí)例域都是transient的，那么省去調(diào)用defaultWriteObject和defaultReadObject也是允許的，但是不推薦這樣做。在決定將一個(gè)域做成非transient之前，請一定要確信它的值將是該對象邏輯狀態(tài)的一部分。不管你選擇了哪種序列化形式，你都要為自己編寫的每個(gè)

27、序列化的類聲明一個(gè)顯式的序列化版本UID。2022-3-7Institute of Computer SoftwareNanjing University32private static final long serialVersionID = randomLongValueEffective Java for Serialization3. Write readObject methods defensively 保護(hù)性地編寫readObject方法readObject方法實(shí)際上相當(dāng)于另一個(gè)共有的構(gòu)造函數(shù)，如同其他構(gòu)造函數(shù)一樣，它也要求所有同樣的注意事項(xiàng)：檢查實(shí)參的有效性，并且必要時(shí)對參數(shù)進(jìn)

28、行保護(hù)性拷貝。2022-3-7Institute of Computer SoftwareNanjing University33VersioningVersioning raises some fundamental questions about the identity of a class, including what constitutes a compatible change. A compatible change is a change that does not affect the contract between the class and its callers.2

29、022-3-7Institute of Computer SoftwareNanjing University34Incompatible changesDeleting fieldsMoving classes up or down the hierarchyChanging a nonstatic field to static or a nontransient field to transientChanging the declared type of a primitive fieldChanging the writeObject or readObject method so

30、that it no longer writes or reads the default field data or changing it so that it attempts to write it or read it when the previous version did not.2022-3-7Institute of Computer SoftwareNanjing University35Incompatible changesChanging a class from Serializable to Externalizable or vice versaChangin

31、g a class from a non-enum type to an enum type or vice versaRemoving either Serializable or ExternalizableAdding the writeReplace or readResolve method to a class is incompatible if the behavior would produce an object that is incompatible with any older version of the class.2022-3-7Institute of Com

32、puter SoftwareNanjing University36Compatible changesAdding fieldsAdding classesRemoving classesAdding writeObject/readObject methodsRemoving writeObject/readObject methodsAdding java.io.SerializableChanging the access to a fieldChanging a field from static to nonstatic or transient to nontransient20

33、22-3-7Institute of Computer SoftwareNanjing University37摘要對象序列化對象持久化Language levelDatabasesHibernate2022-3-7Institute of Computer SoftwareNanjing University38摘要對象序列化對象持久化Language levelDatabasesHibernate2022-3-7Institute of Computer SoftwareNanjing University39Object PersistenceDuring execution of ap

34、plication: objects are created and manipulatedWhat happens to objects after termination?Various kinds of objectsTransient objects:Disappear with current sessionPersistent objects:Stay around from session to sessionMay be shared with other applications (e.g. databases)2022-3-7Institute of Computer So

35、ftwareNanjing University40Approaches to manipulate persistent objectsPersistence mechanisms from programming languagesRelational databasesObject-oriented databases2022-3-7Institute of Computer SoftwareNanjing University41Persistence from programming languagesMechanisms for storing objects in files a

36、nd retrieving themSimple objects:e.g. integers, charactersconventional methods usableComposite objects:contain references to other objectsPersistence Closure principle:Any storage and retrieval mechanism must handle the object and all its dependents. otherwise: dangling references2022-3-7Institute o

37、f Computer SoftwareNanjing University42對象結(jié)構(gòu)的存儲與提取對象持久化的難點(diǎn)之一：對象之間的引用2022-3-7Institute of Computer SoftwareNanjing University43對象結(jié)構(gòu)的存儲與提取需持久化整個(gè)對象引用閉包Persistence closureJava的serialization規(guī)則缺省規(guī)則：非static 非transient 的數(shù)據(jù)成員用戶定義class List implements Serializable List next; private static final ObjectStreamFi

38、eld serialPersistentFields = new ObjectStreamField(next, List.class); 2022-3-7Institute of Computer SoftwareNanjing University44對象結(jié)構(gòu)的存儲與提取閉包可能太大小對象引用（共享的）大對象2022-3-7Institute of Computer SoftwareNanjing University45對象結(jié)構(gòu)的存儲與提取Java 的 transient 修飾子Transient fields 不被序列化Static fields 也不被序列化開發(fā)者負(fù)責(zé)維護(hù)2022-3

39、-7Institute of Computer SoftwareNanjing University46Schema evolutionFact: Classes changeProblem: Objects are stored of which class descriptions have changedSchema evolution:At least one class used by the retrieving system differs from its counterpart stored by the storing system.Object retrieval mis

40、match (Object mismatch):The retrieving system retrieves a particular object whose own generating class was different in the storing system.No fully satisfactory solution2022-3-7Institute of Computer SoftwareNanjing University47Different approachesNaive, extreme approaches:Forsake previously stored o

41、bjectsOver a migration path from old format to newa one-time, en masse conversion of old objectsnot applicable to a large persistent store or to one that must be available continuouslyMost general solution: On-the-fly conversionNote: We cover only the retrieval part. Whether to write back the conver

42、ted object is a separate issue.2022-3-7Institute of Computer SoftwareNanjing University48On-the-fly object conversionThree separate issues:Detection:Catch object mismatchNotification:Make retrieving system aware of object mismatchCorrection:Bring mismatched object to a consistent stateMake it a corr

43、ect instance of the new class version2022-3-7Institute of Computer SoftwareNanjing University49DetectionDetect a mismatch between two versions of an objects generating classTwo categories of detection policy:Nominal approach:Each class version has a version nameCentral registration mechanism necessa

44、ryStructural approach:Deduce class descriptor from actual class structureStore class descriptorSimple detection: compare class descriptors of retrieved object with new class descriptor2022-3-7Institute of Computer SoftwareNanjing University50Detection: Structural ApproachWhat does the class descript

45、or need to contain?Trade-off between efficiency and reliabilityTwo extreme approaches:C1: class nameC2: entire class text (e.g. abstract syntax tree)Reasonable approaches:C3: class name, list of attributes (name and type)C4: in addition to C3: class invariant2022-3-7Institute of Computer SoftwareNan

46、jing University51NotificationWhat happens when the detection mechanism has caught an object mismatch?Language level mechanism Class ANY could include a procedure:correct_mismatch is- Handle object retrieval mismatch.localexception: EXCEPTIONSdocreate exceptionexception.raise ( Routine failure: Objec

47、t mismatch during retrieval )end2022-3-7Institute of Computer SoftwareNanjing University52CorrectionHow do we correct an object that caused a mismatch?Current situation:Retrieval mechanism has created a new object (deduced from a stored object with same generating class)A mismatch has been detected

48、new object is in temporary (maybe inconsistent) state2022-3-7Institute of Computer SoftwareNanjing University53Correction增加attribute刪除attribute2022-3-7Institute of Computer SoftwareNanjing University540.0Attribute was not in stored version.Field is initialized to default value of attribute typeStore

49、d version had a field.New version has removed attribute.Attributes have not changed.Correctioncorrect_mismatch is- Handle object retrieval mismatch- by correctly setting up balance.dobalance := deposits.total - withdrawals.totalensureconsistent: balance = deposits.total - withdrawals.totalend2022-3-

50、7Institute of Computer SoftwareNanjing University55 deposits withdrawalsbalance 0.0900100200240300new field (initialized to default value)old fieldsWrong!維護(hù)不變式維護(hù)不變式自動(dòng)對象轉(zhuǎn)換：JavaserialVersionUID 自動(dòng)定義 （根據(jù)類文件生成）1. Class name 2. The class modifiers 3. The name of each interface 4. For each field of the cl

51、ass (except private static and private transient fields): The name of the field The modifiers of the field The descriptor of the field 5. For each method including constructors, except private methods and constructors: The name of the method The modifiers of the method The descriptor of the method 2

52、022-3-7Institute of Computer SoftwareNanjing University56自動(dòng)對象轉(zhuǎn)換：Java手工指定ANY-ACCESS-MODIFIER static final long serialVersionUID = 42L; 類改變時(shí)仍然能夠反序列化Java定義了一些“兼容”條件，符合條件的自動(dòng)轉(zhuǎn)換可以容忍的：adding fields, etc.太糟糕的: “Changing the type of a field”, deleting fields, etc2022-3-7Institute of Computer SoftwareNanjing

53、University57對于實(shí)在“糟糕”的類修改可以定制序列化和反序列化方法 private void readObject(ObjectInputStream in) private void writeObject(ObjectOutputStream out) 2022-3-7Institute of Computer SoftwareNanjing University58摘要對象序列化對象持久化Language levelDatabasesHibernate2022-3-7Institute of Computer SoftwareNanjing University59對象持久化與

54、數(shù)據(jù)庫Deficiency of language level mechanismsthere is only one entry object; there is no support for content-based queries; each call to retrieved re-creates the entire structure, with no sharing of objects between successive calls;there is no support for letting different client applications access th

55、e same persistent data simultaneouslya full-fledged solution requires taking advantage of database technology2022-3-7Institute of Computer SoftwareNanjing University60對象持久化與數(shù)據(jù)庫A set of mechanisms for storing and retrieving data items is a DBMS if it supports the following items:PersistenceProgrammab

56、le structureArbitrary sizeAccess controlProperty-based queryingIntegrity constraintsAdministrationSharingLockingTransactions2022-3-7Institute of Computer SoftwareNanjing University61自然地，要用數(shù)據(jù)庫來存儲持久化對象對象持久化與數(shù)據(jù)庫關(guān)系型數(shù)據(jù)庫：數(shù)據(jù)庫的主流A relational database is a set of relations, each containing a set of tuples (o

57、r records).關(guān)系代數(shù)Selection, Projection , Join2022-3-7Institute of Computer SoftwareNanjing University62對象持久化與數(shù)據(jù)庫Operations: relational algebra: selection, projection, joinQueries: standardized language (SQL)Usually “normalized”: every field is a simple value; it cannot be a reference2022-3-7Institute

58、of Computer SoftwareNanjing University63“The Carterhouse of Parma”“The Red and the Black”Title“Madame Bovary”“Eugnie Grandet”date1830183918561833pages341307425346author“Stendahl”“Stendahl”“Flaubert”“Balzac”Relation books:fieldfield name (= attribute)columntuple(= row)OperationsSelection: date 1833Pr

59、ojectionJoin2022-3-7Institute of Computer SoftwareNanjing University64“The Carterhouse of Parma”Title“Madame Bovary”date18391856pages307425author“Stendahl”“Flaubert”O(jiān)perationsSelectionProjection: on authorJoin2022-3-7Institute of Computer SoftwareNanjing University65author“Stendahl”“Flaubert”“Balzac

60、”O(jiān)perationsSelectionProjectionJoin: books authors2022-3-7Institute of Computer SoftwareNanjing University66“The Carterhouse of Parma”“The Red and the Black”Title“Madame Bovary”“Eugnie Grandet”date1830183918561833pages341307425346author“Stendahl”“Stendahl”“Flaubert”“Balzac”real name“Henri Beyle”“Henr