Java Unsafe

Unsafe很强大，提供了一组底层（low-level）、unsafe的操作

 

Java Unsafe－获取对象内存地址，对象成员变量相对对象内存地址偏移量以及通过这种方式获取对象成员变量的值

Java Unsafe－获取对象成员变量相对对象内存地址偏移量

Java Unsafe获取对象成员变量相对对象内存地址偏移量

 

UnsafeTestKlass

public class UnsafeTestKlass {

 

    private int value;

    

    public UnsafeTestKlass() {

       this(99);

    }

    

    public UnsafeTestKlass(int value) {

       this.value = value;

    }

    

    public int value() {

       return value;

    }

}

获取Unsafe

private Unsafe getUnsafe() throws Throwable {

    Class<?> unsafeClass = Unsafe.class;

    for (Field f : unsafeClass.getDeclaredFields()) {

        if ("theUnsafe".equals(f.getName())) {

            f.setAccessible(true);

            return (Unsafe) f.get(null);

        }

    }

    throw new IllegalAccessException("no declared field: theUnsafe");

}

 

例子

@Test

public void getObjectFieldAddressOffset() throws Throwable {

    Field field = UnsafeTestKlass.class.getDeclaredField("value");

    Unsafe unsafe = getUnsafe();

    long valueOffset = unsafe.objectFieldOffset(field);

    System.out.println("value offset: " + valueOffset);

}

 

<!--EndFragment--> areastRtm-��B P]B r-fareast;mso-hansi-theme-font:minor-fareast; mso-bidi-font-family:"Courier New";color:black;mso-themecolor:text1; mso-font-kerning:0pt'>}

 

 

 

 

 

Java Unsafe获取对象内存地址，对象成员变量相对对象内存地址偏移量以及通过这种方式获取对象成员变量的值

 

UnsafeTestKlass

public class UnsafeTestKlass {

 

    private int value;

    

    public UnsafeTestKlass() {

       this(99);

    }

    

    public UnsafeTestKlass(int value) {

       this.value = value;

    }

    

    public int value() {

       return value;

    }

}

 

获取对象内存地址

public long location(Object object) throws Throwable {

Unsafe unsafe = getUnsafe();

       

Object[] array = new Object[] {object};

 

long baseOffset = unsafe.arrayBaseOffset(Object[].class);

int addressSize = unsafe.addressSize();

long location;

switch (addressSize) {

case 4:

location = unsafe.getInt(array, baseOffset);

           break;

       case 8:

           location = unsafe.getLong(array, baseOffset);

           break;

       default:

           throw new Error("unsupported address size: " + addressSize);

    }

    return (location);

}

 

获取Unsafe

private Unsafe getUnsafe() throws Throwable {

    Class<?> unsafeClass = Unsafe.class;

    for (Field f : unsafeClass.getDeclaredFields()) {

        if ("theUnsafe".equals(f.getName())) {

            f.setAccessible(true);

            return (Unsafe) f.get(null);

        }

    }

    throw new IllegalAccessException("no declared field: theUnsafe");

}

 

例子

/**

* here are three way to get the field value of an object:

 * 1: reflection

 * 2: address offset of field base object

 * 3: absolute address of the field of object:

 *    address of object + address offset of field base object 

 * 

 * @throws Throwable

 */

@Test

public void getObjectFieldValue() throws Throwable {

    UnsafeTestKlass klass = new UnsafeTestKlass();

 

    Field field = UnsafeTestKlass.class.getDeclaredField("value");

    field.setAccessible(true);

    int value1 = (Integer) field.get(klass);

    System.out.println("value1: " + value1);

        

    Assert.assertTrue(value1 == klass.value());

 

    Unsafe unsafe = getUnsafe();

    long valueOffset = unsafe.objectFieldOffset(field);

    System.out.println("value offset: " + valueOffset);

    int value2 = unsafe.getInt(klass, valueOffset);

    System.out.println("value2: " + value2);

        

    Assert.assertTrue(value1 == value2);

        

    long baseAddress = location(klass);

    System.out.println("base address: " + baseAddress);

    int value3 = unsafe.getInt(baseAddress + valueOffset);

    System.out.println("value3: " + value3);

    Assert.assertTrue(value1 == value3);

}

 

park/unpark

 

CAS操作

针对CAS操作提供了3个方法：compareAndSwapInt、compareAndSwapLong、compareAndSwapObject，分别用于原子操作更新Java变量，第1个用于int类型，第2个用于long类型，第3个用于Object类型。

Lock/Unlock

monitorEnter、monitorExit、tryMonitorEnter

monitorEnter用于加锁，monitorExit用于解锁。

 

 

创建实例但不初始化

allocateInstance

定义类

defineClass

有两种形式：

    /**
     * Tell the VM to define a class, without security checks.  By default, the
     * class loader and protection domain come from the caller's class.
     */
    public native Class defineClass(String name, byte[] b, int off, int len,
                                    ClassLoader loader,
                                    ProtectionDomain protectionDomain);

    /**
     * @deprecated Use defineClass(String, byte[], int, int, ClassLoader, ProtectionDomain)
     *             instead. This method will be removed in JDK 8.
     */
    @Deprecated
    @CallerSensitive
    public native Class defineClass(String name, byte[] b, int off, int len);

第2中方式已经废弃。

对象成员变量偏移量

 

类成员变量偏移量

和对象成员变量偏移量概念一样，一个是对象成员，一个是类成员。类在java中也是一个对象。

类成员变量基准地址

 

操作对象成员

 

操作对象成员（Volatile）

getObjectVolatile、putObjectVolatile

 

getIntVolatile、putIntVolatile、getBooleanVolatile、putBooleanVolatile、getByteVolatile、putByteVolatile、getShortVolatile、putShortVolatile、getCharVolatile、putCharVolatile、getLongVolatile、putLongVolatile、getFloatVolatile、putFloatVolatile、getDoubleVolatile、putDoubleVolatile

 

操作对象成员（Ordered/Lazy）

putOrderedObject、putOrderedInt、putOrderedLong

本地内存操作

setMemory、copyMemory

copyMemory有两种形式：

 

    /**
     * Sets all bytes in a given block of memory to a copy of another
     * block.
     *
     * <p>This method determines each block's base address by means of two parameters,
     * and so it provides (in effect) a <em>double-register</em> addressing mode,
     * as discussed in {@link #getInt(Object,long)}.  When the object reference is null,
     * the offset supplies an absolute base address.
     *
     * <p>The transfers are in coherent (atomic) units of a size determined
     * by the address and length parameters.  If the effective addresses and
     * length are all even modulo 8, the transfer takes place in 'long' units.
     * If the effective addresses and length are (resp.) even modulo 4 or 2,
     * the transfer takes place in units of 'int' or 'short'.
     */
    public native void copyMemory(Object srcBase, long srcOffset,
                                  Object destBase, long destOffset,
                                  long bytes);

 

 

    /**
     * Sets all bytes in a given block of memory to a copy of another
     * block.  This provides a <em>single-register</em> addressing mode,
     * as discussed in {@link #getInt(Object,long)}.
     *
     * Equivalent to <code>copyMemory(null, srcAddress, null, destAddress, bytes)</code>.
     */
    public void copyMemory(long srcAddress, long destAddress, long bytes) {
        copyMemory(null, srcAddress, null, destAddress, bytes);
    }

 

 

 

分配本地内存（native memory）

allocateMemory、reallocateMemory

 

释放本地内存（native memory）

freeMemory

对象成员偏移量操作

 

根据对象实际内存地址获取native指针（native pointer）

这里的实际内存地址就是Java对象在内存中的实际存储的地址，而这里的native指针（native pointer）指的是Java对象的一个native指针引用。

 

这就像C中：

 

A a;
A *ptr = &a;

上面的实际内存地址就相当于这里的a，native指针（native pointer）就相当于这里的ptr，它指向a，存放的是a的地址。

 

 

通过getAddress方法可以根据对象实际内存地址获取native指针（native pointer）。

 

另外还有个方法putAddress，该方法将一个native指针（native pointer）存入一个内存地址中。

 

throw

throwException

 

获取系统负载

getLoadAverage

Java Unsafe-如何得到Unsafe

 

Unsafe(sun.misc.Unsafe)是jdk中自带的一个类，因为是在sun.misc包下，所以一般也不建议直接使用，同时Unsafe提供了一组底层（low-level）、unsafe的操作。Unsafe类注释中也有这样一段描述：

写道

虽然该类及所有方法都是公开的，但使用该类是有限的，因为只有受信任的代码才能获得它的实例。

 

在Unsafe类中有个getUnsafe静态方法（public）, 

 

@CallerSensitive
public static Unsafe getUnsafe() {
Class cc = Reflection.getCallerClass();
if (cc.getClassLoader() != null)
        throw new SecurityException("Unsafe");
    return theUnsafe;
}

 

 

注意这个方法上有个@CallerSensitive注解。

但如果使用这个方法来尝试得到Unsafe的话，恐怕不能直接如偿所愿了。该方法正常调用将返回错误。

@Test

publicvoid getUnsafe1() throws Throwable {

Unsafe unsafe = getUnsafe();

Assert.assertNotNull(unsafe);

}

错误信息如下：

java.lang.SecurityException: Unsafe

    at sun.misc.Unsafe.getUnsafe(Unsafe.java:68)

    at com.java.UnsafeTest.getUnsafe0(UnsafeTest.java:25)

    at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)

    at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:39)

    at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:25)

    at java.lang.reflect.Method.invoke(Method.java:597)

    at org.junit.runners.model.FrameworkMethod$1.runReflectiveCall(FrameworkMethod.java:50)

    at org.junit.internal.runners.model.ReflectiveCallable.run(ReflectiveCallable.java:12)

    at org.junit.runners.model.FrameworkMethod.invokeExplosively(FrameworkMethod.java:47)

    at org.junit.internal.runners.statements.InvokeMethod.evaluate(InvokeMethod.java:17)

    at org.junit.runners.ParentRunner.runLeaf(ParentRunner.java:325)

    at org.junit.runners.BlockJUnit4ClassRunner.runChild(BlockJUnit4ClassRunner.java:78)

    at org.junit.runners.BlockJUnit4ClassRunner.runChild(BlockJUnit4ClassRunner.java:57)

    at org.junit.runners.ParentRunner$3.run(ParentRunner.java:290)

    at org.junit.runners.ParentRunner$1.schedule(ParentRunner.java:71)

    at org.junit.runners.ParentRunner.runChildren(ParentRunner.java:288)

    at org.junit.runners.ParentRunner.access$000(ParentRunner.java:58)

    at org.junit.runners.ParentRunner$2.evaluate(ParentRunner.java:268)

    at org.junit.runners.ParentRunner.run(ParentRunner.java:363)

    at org.eclipse.jdt.internal.junit4.runner.JUnit4TestReference.run(JUnit4TestReference.java:86)

    at org.eclipse.jdt.internal.junit.runner.TestExecution.run(TestExecution.java:38)

    at org.eclipse.jdt.internal.junit.runner.RemoteTestRunner.runTests(RemoteTestRunner.java:459)

    at org.eclipse.jdt.internal.junit.runner.RemoteTestRunner.runTests(RemoteTestRunner.java:678)

    at org.eclipse.jdt.internal.junit.runner.RemoteTestRunner.run(RemoteTestRunner.java:382)

    at org.eclipse.jdt.internal.junit.runner.RemoteTestRunner.main(RemoteTestRunner.java:192)

 

原因在与Unsafe类中getUnsafe方法被标注为@CallerSensitive，其中有如下一条代码：

Class cc = Reflection.getCallerClass();

它调用了Reflection类的getCallerClass()方法，Reflection类（sun.reflect.Reflection）在jdk\src\share\classes\sun\reflect目录下。该方法是个native方法：

@CallerSensitive

public static native Class getCallerClass();

对应的实现Reflection.c在jdk\src\share\native\sun\reflect目录下。该方法实现：

JNIEXPORT jclass JNICALL Java_sun_reflect_Reflection_getCallerClass

(JNIEnv *env, jclass unused)

{

    // Until there is hotspot @CallerSensitive support,

    // depth must always be 2 to get the immediate caller

    return JVM_GetCallerClass(env, 2);

}

这个方法直接调用了JVM_GetCallerClass方法，这里第二个参数表示深度(depth)， 固定传值2表示得到直接调用者， 该方法实现jvm.cpp在hotspot\src\share\vm\prims目录下。该方法实现：

JVM_ENTRY(jclass, JVM_GetCallerClass(JNIEnv* env, int depth))

  JVMWrapper("JVM_GetCallerClass");

  klassOop k = thread->security_get_caller_class(depth);

  return (k == NULL) ? NULL : (jclass) JNIHandles::make_local(env, Klass::cast(k)->java_mirror());

JVM_END

 

Class classLoader:

Class类的classLoader字段，反射访问这个字段是被过滤掉的，所以通过reflection（反射）方式无法访问到这个字段。

1、Initialized in JVM not by private constructor

2、This field is filtered from reflection access, i.e. getDeclaredField will throw NoSuchFieldException

 

@org.junit.Test
public void getClassLoader() {
    Class klass = this.getClass();
    ClassLoader classLoader = klass.getClassLoader();
    Assert.assertNotNull(classLoader);

    Object field = null;
    try {
        field = field(klass, "classLoader");
        Assert.fail("fail");
    } catch (IllegalAccessException e) {
        e.printStackTrace();
    }
    Assert.assertNull(field);
}

 

如何得到Unsafe

 

可以通过反射的方式来访问Unsafe类中的theUnsafe静态成员变量，该theUnsafe静态成员变量在Unsafe第一次使用时就已经初始化。

private Unsafe getUnsafe() throws Throwable {

Class<?> unsafeClass = Unsafe.class;

for (Field f : unsafeClass.getDeclaredFields()) {

if ("theUnsafe".equals(f.getName())) {

f.setAccessible(true);

return (Unsafe) f.get(null);

}

}

thrownew IllegalAccessException("no declared field: theUnsafe");

}

 

@Test

publicvoid getUnsafe1() throws Throwable {

Unsafe unsafe = getUnsafe();

Assert.assertNotNull(unsafe);

}

另一种方式也是通过反射的方式调用私有构造方法

@Test

publicvoid getUnsafe2() throws Throwable {

Constructor<Unsafe> constructor = Unsafe.class.getDeclaredConstructor(new Class<?>[0]);

constructor.setAccessible(true);

Unsafe unsafe = constructor.newInstance(new Object[0]);

Assert.assertNotNull(unsafe);

}

由于在Unsafe第一次使用时就已经初始化创建了一个实例（Unsafe类中的theUnsafe静态成员变量），所以这种方式实际上又创建了一个实例。

 

 

 

Java Unsafe获取对象内存地址

 

public class UnsafeTestKlass {

 

    private int value;

   

    public UnsafeTestKlass() {

       this(99);

    }

   

    public UnsafeTestKlass(int value) {

       this.value = value;

    }

   

    public int value() {

       return value;

    }

}

获取对象内存地址

public long location(Object object) throws Throwable {

Unsafe unsafe = getUnsafe();

      

Object[] array = new Object[] {object};

 

long baseOffset = unsafe.arrayBaseOffset(Object[].class);

int addressSize = unsafe.addressSize();

long location;

switch (addressSize) {

case 4:

location = unsafe.getInt(array, baseOffset);

           break;

       case 8:

           location = unsafe.getLong(array, baseOffset);

           break;

       default:

           throw new Error("unsupported address size: " + addressSize);

    }

    return (location);

}

 

例子

@Test

public void getObjectAddress() throws Throwable {

    UnsafeTestKlass klass = new UnsafeTestKlass();

    long baseAddress = location(klass);

    System.out.println("base address: " + baseAddress);

}

 

 

 

关于Java Unsafe实现原理可参考另一篇文章：https://lobin.iteye.com/blog/2327452。