深入理解Java中的反射机制和使用原理！详细解析invoke方法的执行和使用

反射的概念

反射:Refelection,反射是Java的特征之一,允许运行中的Java程序获取自身信息,并可以操作类或者对象的内部属性
- 通过反射,可以在运行时获得程序或者程序中的每一个类型的成员活成成员的信息
- 程序中的对象一般都是在编译时就确定下来,Java反射机制可以动态地创建对象并且调用相关属性,这些对象的类型在编译时是未知的
- 也就是说 ,可以通过反射机制直接创建对象,即使这个对象类型在编译时是未知的
Java反射提供下列功能:
- 在运行时判断任意一个对象所属的类
- 在运行时构造任意一个类的对象
- 在运行时判断任意一个类所具有的成员变量和方法,可以通过反射调用 private 方法
- 在运行时调用任意一个对象的方法

反射的原理

反射的核心: JVM在运行时才动态加载类或者调用方法以及访问属性,不需要事先(比如编译时)知道运行对象是什么
类的加载:
- Java反射机制是围绕Class类展开的
- 首先要了解类的加载机制:
  - JVM 使用 ClassLoader 将字节码文件,即 class 文件加载到方法区内存中

Class clazz = ClassLoader.getSystemClassLoader().loadClass("com.mypackage.MyClass");

ClassLoader类根据类的完全限定名加载类并返回一个 Class 对象

ReflectionData:
- 为了提高反射的性能,必须要提供缓存
- class 类内部使用一个 useCaches 静态变量来标记是否使用缓存
- 这个值可以通过外部的 sun.reflect.noCaches 配置是否禁用缓存
- class 类内部提供了一个 ReflectionData 内部类用来存放反射数据的缓存,并声明了一个 reflectionData 域
- 由于稍后进行按需延迟加载并缓存,所以这个域并没有指向一个实例化的 ReflectionData 对象

// 标记是否使用缓存,可以通过外部的sun.reflect.noCaches配置是否禁用缓存
private static boolean useCaches = true;static class ReflectionData<T> {volatile Field[] declaredFields;volatile Field[] publicFields;volatile Method[] declaredMethods;volatile Method[] publicMethods;volatile Constructor<T>[] declaredConstructors;volatile Constructors<T>[] publicConstructors;volatile Field[] declaredPublicFields;volatile Method[] declaredPublicMethods;final int redefinedCount;ReflectionData(int redefinedCount) {this.redefinedCount = redefinedCount;}
}// 这个是SoftReference,在内存资源紧张的时候可能会被回收// volatile保证多线程环境下读写的正确性private volatile transient SoftReference<RefelectionData<T>> reflectionData;// 这个主要用于和ReflectionData中的redefinedCount进行比较// 如果两个值不相等,说明ReflectionData缓存的数据已经过期了private volatile transient classRedefinedCount = 0;

反射的主要用途

反射最重要的用途就是开发各种通用框架
- 很多框架都是配置化的,通过 XML 文件配置 Bean
- 为了保证框架的通用性,需要根据配置文件加载不同的对象或者类,调用不同的方法
- 要运用反射,运行时动态加载需要加载的对象
示例:
- 在运用 Struts 2 框架的开发中会在 struts.xml 中配置 Action:

<action name="login"class="org.ScZyhSoft.test.action.SimpleLoginAction"method="execute"><result>/shop/shop-index.jsp</result><result name="error">login.jsp</result></action>

配置文件与 Action 建立映射关系
当 View 层发出请求时,请求会被 StrutsPrepareAndExecuteFilter 拦截
StrutsPrepareAndExecuteFilter会动态地创建Action实例
- 请求 login.action
- StrutsPrepareAndExecuteFilter 会解析 struts.xml 文件
- 检索 action 中 name 为 login 的 Action
- 根据 class 属性创建 SimpleLoginAction 实例
- 使用 invoke 方法调用 execute 方法
反射是各种容器实现的核心

反射的运用

反射相关的类在 StrutsPrepareAndExecuteFilter 包
反射可以用于:
- 判断对象所属的类
- 获得class对象
- 构造任意一个对象
- 调用一个对象
九大预定义的Class对象:
- 基本的Java类型: boolean, byte, char, short, int, long, float, double
- 关键字void通过class属性的也表示为Class对象
- 包装类或者void类的静态TYPE字段:
  - Integer.TYPE == int.class
  - Integer.class == int.class
- 数组类型的Class实例对象:
  - Class<String[]> clz = String[].class;
  - 数组的Class对象如何比较是否相等:
    - 数组的维数
    - 数组的类型
    - Class类中的 isArray() ,用来判断是否表示一个数组类型

获得Class对象

使用Class类的forName静态方法:

public static Class<?> forName(String className);/* 在JDBC中使用这个方法加载数据库驱动 */
Class.forName(driver);

直接获取一个对象的class:

Class<?> klass=int.class;
Class<?> classInt=Integer.TYPE;

调用对象的getClass()方法:

StringBuilder str=new StringBuilder("A");
Class<?> klass=str.getClass();

判断是否是某个类的实例

一般来说,使用 instanceof 关键字判断是否为某个类的实例
在反射中,可以使用 Class 对象的 isInstance() 方法来判断是否为某个类的实例,这是一个 native 方法

public native boolean isInstance(Object obj);

创建实例

通过反射生成对象的实例主要有两种方式:

使用Class对象的newInstance()方法来创建Class对象对应类的实例:

Class<?> c = String.class;
Object str = c.newInstance();

先通过Class对象获取指定的Constructor对象,再调用Constructor对象的newInstance()方法来创建实例: 可以用指定的构造器构造类的实例

/* 获取String所对应的Class对象 */
Class<?> c=String.class;/* 获取String类带一个String参数的构造器 */
Constructor constructor=c.getConstructor(String.class);/* 根据构造器创建实例 */
Object obj=constructor.newInstance("abc");
System.out.println(obj);

获取方法

获取Class对象的方法集合,主要有三种方法:

getDeclaredMethods():

返回类或接口声明的所有方法:
- 包括公共,保护,默认(包)访问和私有方法
- 不包括继承的方法

public Method[] getDeclaredMethods() throws SecurityException {}

getMethods():返回某个类所有的public方法
- 包括继承类的 public 方法

public Method[] getMethods() throws SecurityException {}

getMethod():

返回一个特定的方法
- 第一个参数 :方法名称
- 后面的参数 :方法的参数对应Class的对象

public Method getMethod(String name,Class<?>... parameterType) {}

获取方法示例:

public class MethodTest {public static void methodTest() throws IllegalAccessException, InstantiationException, NoSuchMethodException, InvocationTargetException {Class<?> c = methodClass.class;Object object = c.newInstance();Method[] methods = c.getMethods();Method[] declaredMethods = c.getDeclaredMethods();// 获取methodClass类中的add方法Method method = c.getMethod("add", int.class, int.class);// getMethods()方法获取的所有方法System.out.println("getMethods获取的方法:");for (Method m:methods)System.out.println(m);// getDeclaredMethods()方法获取的所有方法System.out.println("getDeclaredMethods获取的方法:");for (Method m:declaredMethods)System.out.println(m);}
}class methodClass {public final int n = 3;public int add(int a, int b) {return a + b;}public int sub(int a, int b) {return a * b;}
}

程序运行结果:

getMethods获取的方法：
public int org.ScZyhSoft.common.methodClass.add(int,int)
public int org.ScZyhSoft.common.methodClass.sub(int,int)
public final void java.lang.Object.wait() throws java.lang.InterruptedException
public final void java.lang.Object.wait(long,int) throws java.lang.InterruptedException
public final native void java.lang.Object.wait(long) throws java.lang.InterruptedException
public boolean java.lang.Object.equals(java.lang.Object)
public java.lang.String java.lang.Object.toString()
public native int java.lang.Object.hashCode()
public final native java.lang.Class java.lang.Object.getClass()
public final native void java.lang.Object.notify()
public final native void java.lang.Object.notifyAll()
getDeclaredMethods获取的方法：
public int org.ScZyhSoft.common.methodClass.add(int,int)
public int org.ScZyhSoft.common.methodClass.sub(int,int)

通过 getMethods() 获取的方法可以获取到父类的方法

获取构造器信息

通过 Class 类的 getConstructor 方法得到 Constructor 类的一个实例
Constructor 类中 newInstance 方法可以创建一个对象的实例:

public T newInstance(Objec ... initargs)

newInstance方法可以根据传入的参数来调用对应的 Constructor 创建对象的实例

获取类的成员变量信息

getFileds: 获取公有的成员变量
getDeclaredFields: 获取所有已声明的成员变量,但是不能得到父类的成员变量

调用方法

从类中获取一个方法后,可以使用 invoke() 来调用这个方法

public Object invoke(Object obj, Object ... args) throws IllegalAccessException, IllegalArgumentException, InvocationTargetException {}

示例:

public class InvokeTest {public static void main(String[] args) throws IllegalAccessException, InstantiationException, NoSuchMethodException, InvocationTargetException {Class<?> klass = method.class;// 创建methodClass的实例Object obj = klass.newInstance();// 获取methodClass的add方法Method method = klass.getMethod("add", int.class, int.class);// 调用method对应的方法,实现add(1,4)Object result = method.invoke(obj, 1, 4);System.out.println(result);}
}class methodClass {public final int n = 3;public int add(int a, int b) {return a + b;}public int sub(int a,int b) {return a * b;}
}

利用反射创建数组

数组是Java中一种特殊的数据类型,可以赋值给一个 Object Reference
利用反射创建数组的示例:

public static void ArrayTest() throws ClassNotFoundException {Class<?> cls = class.forName("java.lang.String");Object array = Array.newInstance(cls, 25);// 在数组中添加数据Array.set(array, 0, "C");Array.set(array, 1, "Java");Array.set(array, 2, "Python");Array.set(array, 3, "Scala");Array.set(array, 4, "Docker");// 获取数据中的某一项内容System.out.println(Array.get(array, 3));
}

Array类是 java.lang.reflect.Array 类,通过 Array.newInstance() 创建数组对象:

public static Object newInstance(Class<?> componentType, int length) throws NegativeArraySizeException {return newArray(componentType, length);
}

newArray方法是一个 native 方法,具体实现在 HotSpot JVM 中,源码如下:

private static native Object newArray(Class<?> componentType, int length) throws NegativeArraySizeException;----------------------------------------------------------- newArray源码目录: openjdk\hotspot\src\share\vm\runtime\reflection.cpparrayOop Reflection::reflect_new_array(oop element_mirror, jint length, TRAPS) {if (element_mirror == NULL) {THROW_0(vmSymbols::java_lang_NullPointerException());}if (length < 0) {THROW_0(vmSymbols::java_lang_NegativeArraySizeException());}if (java_lang_Class::is_primitive(element_mirror)) {Klass* tak = basic_type_mirror_to_arrayklass(element_mirror, CHECK_NULL);return TypeArrayKlass::cast(tak)->allocate(length, THREAD);} else {Klass* k = java_lang_Class::as_Klass(element_mirror);if (k->oop_is_array() && ArrayKlass::cast(k)->dimension() >= MAX_DIM) {THROW_0(vmSymbols::java_lang_IllegalArgumentException());}return oopFactory::new_objArray(k, length, THREAD);}
}

Array类的set和get方法都是native方法,具体实现在HotSpot JVM中,对应关系如下:
- set: Reflection::array_set
- get: Reflection::array_get

invoke方法

在Java中很多方法都会调用 invoke 方法,很多异常的抛出多会定位到 invoke 方法:

java.lang.NullPointerExceptionat ......at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62)at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)at java.lang.reflect.Method.invoke(Method.java:497)

invoke执行过程

invoke 方法用来在运行时动态地调用某个实例的方法,实现如下:

@CallSensitive
public Object invoke(Object obj, Object ... args) throws IllegalAccessException, IllegalArgumentException, InvocationTargetException {if (!override) {if (!Reflection.quickCheckMemberAccess(clazz, modifiers)) {Class<?> caller = Refelection.getCallerClass();checkAccess(caller, clazz, obj, modifiers);}}MethodAccessor ma = methodAccessor;if (ma == null) {ma = acquireMethodAccessor();}return ma.invoke(obj, args);
}

权限检查

AccessibleObject类是Field,Method和Constructor对象的基类:
- 提供将反射的对象标记为在使用时取消默认Java语言访问控制检查的能力
invoke方法会首先检查AccessibleObject的override属性的值:
- override默认值为false:
  - 表示需要权限调用规则,调用方法时需要检查权限
  - 也可以使用 setAccessible() 设置为 true
- override如果值为true:
  - 表示忽略权限规则,调用方法时无需检查权限
  - 也就是说,可以调用任意private方法,违反了封装
如果override属性为默认值false,则进行进一步的权限检查:

首先用 Reflection.quickCheckMemberAccess(clazz, modifiers) 方法检查方法是否为 public

1.1 如果是public方法的话,就跳过本步

1.2 如果不是public方法的话,就用Reflection.getCallerClass()方法获取调用这个方法的Class对象,这是一个 native 方法

@CallerSensitivepublic static native Class<?> getCallerClass();----------------------------------------------------------- 在OpenJDK中可以找到getCallerClass方法的JNI入口-Reflection.cJNIEXPORT jclass JNICALL Java_sun_reflect_Reflection_getCallerClass__
(JNIEnv *env, jclass unused)
{return JVM_GetCallerClass(env, JVM_CALLER_DEPTH);
}----------------------------------------------------------- JVM_GetCallerClass的源码位于jvm.cpp中VM_ENTRY(jclass, JVM_GetCallerClass(JNIEnv* env, int depth))JVMWrapper("JVM_GetCallerClass");// Pre-JDK 8 and early builds of JDK 8 don't have a CallerSensitive annotation; or// sun.reflect.Reflection.getCallerClass with a depth parameter is provided// temporarily for existing code to use until a replacement API is defined.if (SystemDictionary::reflect_CallerSensitive_klass() == NULL || depth != JVM_CALLER_DEPTH) {Klass* k = thread->security_get_caller_class(depth);return (k == NULL) ? NULL : (jclass) JNIHandles::make_local(env, k->java_mirror());}// Getting the class of the caller frame.//// The call stack at this point looks something like this://// [0] [ @CallerSensitive public sun.reflect.Reflection.getCallerClass ]// [1] [ @CallerSensitive API.method                                   ]// [.] [ (skipped intermediate frames)                                 ]// [n] [ caller                                                        ]vframeStream vfst(thread);// Cf. LibraryCallKit::inline_native_Reflection_getCallerClassfor (int n = 0; !vfst.at_end(); vfst.security_next(), n++) {Method* m = vfst.method();assert(m != NULL, "sanity");switch (n) {case 0:// This must only be called from Reflection.getCallerClassif (m->intrinsic_id() != vmIntrinsics::_getCallerClass) {THROW_MSG_NULL(vmSymbols::java_lang_InternalError(), "JVM_GetCallerClass must only be called from Reflection.getCallerClass");}// fall-throughcase 1:// Frame 0 and 1 must be caller sensitive.if (!m->caller_sensitive()) {THROW_MSG_NULL(vmSymbols::java_lang_InternalError(), err_msg("CallerSensitive annotation expected at frame %d", n));}break;default:if (!m->is_ignored_by_security_stack_walk()) {// We have reached the desired frame; return the holder class.return (jclass) JNIHandles::make_local(env, m->method_holder()->java_mirror());}break;}}return NULL;
JVM_END

获取 Class 对象 caller 后使用 checkAccess 方法进行一次快速的权限校验 ,checkAccess 方法实现如下:

volatile Object securityCheckCache;void checkAccess(Class<?> caller, Class<?> clazz, Object obj, int modifiers) throws IllegalAccessException {if(caller == clazz){    // 快速校验return;              // 权限通过校验}Object cache = securityCheckCache;   // 读取volatileClass<?> targetClass = clazz;if (obj != null && Modifier.isProtected(modifiers) && ((targetClass = obj.getClass()) != clazz)) {  // 必须匹配caller,targetClass中的一个if (cache instanceof Class[]) {Class<?>[] cache2 = (Class<?>[]) cache;if (cache2[1] == targetClass && cache[0] == caller) {return;        // 校验通过}}} else if (cache == caller) {return;             // 校验通过}slowCheckMemberAccess(caller, clazz, obj, modifiers, targetClass);}

首先先执行一次快速校验,一旦 Class 正确则权限检查通过;如果未通过,则创建一个缓存,中间再进行检查

如果上面所有的权限检查都未通过,将会执行更详细的检查:

void slowCheckMemberAccess(Class<?> caller, Class<?> clazz, Object obj, int modifiers, Class<?> targetClass) throws IllegalAccessException {Refelection.ensureMemberAccess(caller, clazz, obj, modifiers);// 如果成功,就更新缓存Object cache = ((targetClass == clazz) ? caller : new Class<?>[] {caller, targetClass});securityCheckCache = cache;
}

用 Reflection.ensureMemberAccess 方法继续检查权限.若检查通过就更新缓存,这样下一次同一个类调用同一个方法时就不用执行权限检查了,这是一种简单的缓存机制

由于 JMM 的 happens-before 规则能够保证缓存初始化能够在写缓存之间发生,因此两个cache不需要声明为volatile

检查权限的工作到此结束.如果没有通过检查就会抛出异常,如果通过检查就会到下一步

调用MethodAccessor的invoke方法

Method.invoke() 不是自身实现反射调用逻辑,而是通过 sun.refelect.MethodAccessor 来处理
Method对象的基本构成:
- 每个 Java 方法有且只有一个 Method 对象作为 root, 相当于根对象,对用户不可见
- 当创建 Method 对象时,代码中获得的 Method 对象相当于其副本或者引用
- root 对象持有一个 MethodAccessor 对象,所有获取到的 Method 对象都共享这一个 MethodAccessor 对象
- 必须保证 MethodAccessor 在内存中的可见性
root对象及其声明:

private volatile MethodAccessor methodAccessor;
/*** For sharing of MethodAccessors. This branching structure is* currently only two levels deep (i.e., one root Method and* potentially many Method objects pointing to it.)* * If this branching structure would ever contain cycles, deadlocks can* occur in annotation code.*/
private Method  root;

MethodAccessor:

/*** This interface provides the declaration for* java.lang.reflect.Method.invoke(). Each Method object is* configured with a (possibly dynamically-generated) class which* implements this interface*/public interface MethodAccessor {// Matches specification in {@link java.lang.reflect.Method}public Object invoke(Object obj, Object[] args) throws IllegalArgumentException, InvocationTargetException;}

MethodAccessor是一个接口,定义了 invoke() 方法,通过 Usage 可以看出 MethodAccessor 的具体实现类:

sun.reflect.DelegatingMethodAccessorImpl
sun.reflect.MethodAccessorImpl
sun.reflect.NativeMethodAccessorImpl

第一次调用 Java 方法对应的 Method 对象的 invoke() 方法之前,实现调用逻辑的 MethodAccess 对象还没有创建
第一次调用时,才开始创建 MethodAccessor 并更新为 root, 然后调用 MethodAccessor.invoke() 完成反射调用

/*** NOTE that there is no synchronization used here. * It is correct(though not efficient) to generate more than one MethodAccessor for a given Method.* However, avoiding synchronization will probably make the implementation more scalable.*/private MethodAccessor acquireMethodAccessor() {// First check to see if one has been created yet, and take it if soMethodAccessor tmp = null;if (root != null)tmp = root.getMethodAccessor();if (tmp != null) {methodAccessor = tmp;} else {tmp = reflectionFactory.newMethodAccessor(this);setMethodAccessor(tmp);} return tmp;
}

methodAccessor 实例由 reflectionFactory 对象操控生成 ,reflectionFactory 是在 AccessibleObject 中声明的:

/*** Reflection factory used by subclasses for creating field,* method, and constructor accessors. Note that this is called very early in the bootstrapping process.*/
static final ReflectionFactory reflectionFactory = AccessController.doPrivileged(new sun.reflect.ReflectionFactory.GetReflectionFactoryAction());

sun.reflect.ReflectionFactory 方法:

public class ReflectionFactory {private static boolean initted = false;private static Permission reflectionFactoryAccessPerm = new RuntimePermission("reflectionFactoryAccess");private static ReflectionFactory soleInstance = new ReflectionFactory();// Provides access to package-private mechanisms in java.lang.reflectprivate static volatile LangReflectAccess langReflectAccess;/*** "Inflation" mechanism. Loading bytecodes to implement Method.invoke() and Constructor.* newInstance() currently costs 3-4x more than an invocation via native code for the first invocation (though subsequent invocations have been benchmarked to be over 20x faster)* Unfortunately this cost increases startup time for certain applications that use reflection intensively (but only once per class) to bootstrap themselves* To avoid this penalty we reuse the existing JVM entry points for the first few invocations of Methods and Constructors and then switch to the bytecode-based implementations*/// Package-private to be accessible to NativeMethodAccessorImpl and NativeConstructorAccessorImplprivate static noInflation = false;private static int inflationThreshold = 15;// 生成MethodAccessorpublic MethodAccessor newMethodAccessor(Method method) {checkInitted();if (noInflation && !ReflectUtil.isVMAnonymousClass(method.getDeclaringClass())) {return new MethodAccessorGenerator().generateMethod(method.getDeclaringClass(),method.getName(),method.getParameterTypes(),method.getReturnType(),method.getExceptionTypes(),method.getModifiers());} else {NativeMethodAccessorImpl acc = new NativeMethodAccessorImpl(method);DelegatingMethodAccessorImpl res = new DelegatingMethodAccessorImpl(acc);acc.setParent(res);return res;}}/*** We have to defer full initialization of this class until after the static initializer is run since java.lang.reflect* Method's static initializer (more properly, that for java.lang.reflect.AccessibleObject) causes this class's to be run, before the system properties are set up*/private static void checkInitted() {if (initted) return;AccessController.doPrivileged(new PrivilegedAction<Void>() {public Void run() {/*** Tests to ensure the system properties table is fully initialized* This is needed because reflection code is called very early in the initialization process (before command-line arguments have been parsed and therefore these user-settable properties installed* We assume that if System.out is non-null then the System class has been fully initialized and that the bulk of the startup code has been run*/if (System.out == null) {// java.lang.System not yet fully initializedreturn null;}String val = System.getProperty("sun.reflect.noInflation");if (val != null && val.equals("true")) {noInflation = true;}val = System.getProperty("sun.reflect.inflationThreshold");if (val != null) {try {inflationThreshold = Integer.parseInt(val);} catch (NumberFormatException e) {throw new RuntimeException("Unable to parse property sun.reflect.inflationThreshold", e);}}initted = true;return null;}});}
}

实际的MethodAccessor实现有两个版本,一个是Java版本,一个是native版本,两者各有特点:
- 初次启动时 Method.invoke() 和 Constructor.newInstance() 方法采用native方法要比Java方法快3-4倍
- 启动后 native 方法又要消耗额外的性能而慢于 Java 方法
- Java实现的版本在初始化时需要较多时间,但长久来说性能较好
这是HotSpot的优化方式带来的性能特性:
- 跨越native边界会对优化有阻碍作用
为了尽可能地减少性能损耗,HotSpot JDK采用inflation方式:
- Java方法在被反射调用时,开头若干次使用native版
- 等反射调用次数超过阈值时则生成一个专用的 MethodAccessor 实现类,生成其中的 invoke() 方法的字节码
- 以后对该Java方法的反射调用就会使用Java版本
ReflectionFactory.newMethodAccessor()生成MethodAccessor对象的逻辑:
- native 版开始会会生成 NativeMethodAccessorImpl 和 DelegatingMethodAccessorImpl 两个对象
DelegatingMethodAccessorImpl:

/* Delegates its invocation to another MethodAccessorImpl and can change its delegate at run time */
class DelegatingMethodAccessorImpl extends MethodAccessorImpl {private MethodAccessorImpl delegate;DelegatingMethodAccessorImpl(MethodAccessorImpl delegate) {setDelegate(delegate);}public Object invoke(Object obj, Object[] args)throws IllegalArgumentException, InvocationTargetException{return delegate.invoke(obj, args);}void setDelegate(MethodAccessorImpl delegate) {this.delegate = delegate;}
}

DelegatingMethodAccessorImpl对象是一个中间层,方便在 native 版与 Java 版的 MethodAccessor 之间进行切换

native版MethodAccessor的Java方面的声明: sun.reflect.NativeMethodAccessorImpl

/* Used only for the first few invocations of a Method; afterward,switches to bytecode-based implementation */
class NativeMethodAccessorImpl extends MethodAccessorImpl {private Method method;private DelegatingMethodAccessorImpl parent;private int numInvocations;NativeMethodAccessorImpl(Method method) {this.method = method;}public Object invoke(Object obj, Object[] args)throws IllegalArgumentException, InvocationTargetException{/* We can't inflate methods belonging to vm-anonymous classes because that kind of class can't be referred to by name, hence can't be found from the generated bytecode */if (++numInvocations > ReflectionFactory.inflationThreshold()&& !ReflectUtil.isVMAnonymousClass(method.getDeclaringClass())) {MethodAccessorImpl acc = (MethodAccessorImpl)new MethodAccessorGenerator().generateMethod(method.getDeclaringClass(),method.getName(),method.getParameterTypes(),method.getReturnType(),method.getExceptionTypes(),method.getModifiers());parent.setDelegate(acc);}return invoke0(method, obj, args);}void setParent(DelegatingMethodAccessorImpl parent) {this.parent = parent;}private static native Object invoke0(Method m, Object obj, Object[] args);
}

每次 NativeMethodAccessorImpl.invoke() 方法被调用时,程序调用计数器都会增加 1, 看看是否超过阈值
如果超过则调用 MethodAccessorGenerator.generateMethod() 来生成 Java 版的 MethodAccessor 的实现类
改变 DelegatingMethodAccessorImpl 所引用的 MethodAccessor 为 Java 版
经由 DelegatingMethodAccessorImpl.invoke() 调用到的就是 Java 版的实现

JVM层invoke0方法

invoke0 方法是一个 native 方法,在 HotSpot JVM 里调用 JVM_InvokeMethod 函数:

JNIEXPORT jobject JNICALL Java_sun_reflect_NativeMethodAccessorImpl_invoke0
(JNIEnv *env, jclass unused, jobject m, jobject obj, jobjectArray args)
{return JVM_InvokeMethod(env, m, obj, args);
}

openjdk/hotspot/src/share/vm/prims/jvm.cpp:

JVM_ENTRY(jobject, JVM_InvokeMethod(JNIEnv *env, jobject method, jobject obj, jobjectArray args0))JVMWrapper("JVM_InvokeMethod");Handle method_handle;if (thread->stack_available((address) &method_handle) >= JVMInvokeMethodSlack) {method_handle = Handle(THREAD, JNIHandles::resolve(method));Handle receiver(THREAD, JNIHandles::resolve(obj));objArrayHandle args(THREAD, objArrayOop(JNIHandles::resolve(args0)));oop result = Reflection::invoke_method(method_handle(), receiver, args, CHECK_NULL);jobject res = JNIHandles::make_local(env, result);if (JvmtiExport::should_post_vm_object_alloc()) {oop ret_type = java_lang_reflect_Method::return_type(method_handle());assert(ret_type != NULL, "sanity check: ret_type oop must not be NULL!");if (java_lang_Class::is_primitive(ret_type)) {// Only for primitive type vm allocates memory for java object.// See box() method.JvmtiExport::post_vm_object_alloc(JavaThread::current(), result);}}return res;} else {THROW_0(vmSymbols::java_lang_StackOverflowError());}
JVM_END

关键部分为 Reflection::invoke_method: openjdk/hotspot/src/share/vm/runtime/reflection.cpp

oop Reflection::invoke_method(oop method_mirror, Handle receiver, objArrayHandle args, TRAPS) {oop mirror             = java_lang_reflect_Method::clazz(method_mirror);int slot               = java_lang_reflect_Method::slot(method_mirror);bool override          = java_lang_reflect_Method::override(method_mirror) != 0;objArrayHandle ptypes(THREAD, objArrayOop(java_lang_reflect_Method::parameter_types(method_mirror)));oop return_type_mirror = java_lang_reflect_Method::return_type(method_mirror);BasicType rtype;if (java_lang_Class::is_primitive(return_type_mirror)) {rtype = basic_type_mirror_to_basic_type(return_type_mirror, CHECK_NULL);} else {rtype = T_OBJECT;}instanceKlassHandle klass(THREAD, java_lang_Class::as_Klass(mirror));Method* m = klass->method_with_idnum(slot);if (m == NULL) {THROW_MSG_0(vmSymbols::java_lang_InternalError(), "invoke");}methodHandle method(THREAD, m);return invoke(klass, method, receiver, override, ptypes, rtype, args, true, THREAD);
}

Java的对象模型 :klass 和 oop

Java版的实现

Java 版 MethodAccessor 的生成使用 MethodAccessorGenerator 实现

Generator for sun.reflect.MethodAccessor andsun.reflect.ConstructorAccessor objects using bytecodes toimplement reflection. A java.lang.reflect.Method orjava.lang.reflect.Constructor object can delegate its invoke ornewInstance method to an accessor using native code or to onegenerated by this class. (Methods and Constructors were mergedtogether in this class to ensure maximum code sharing.)

运用了 asm 动态生成字节码技术 - sun.reflect.ClassFileAssembler

invoke总结

invoke方法的过程:
MagicAccessorImpl:
- 原本Java的安全机制使得不同类之间不是任意信息都可见,但JDK里面专门设了个 MagicAccessorImpl 标记类开了个后门来允许不同类之间信息可以互相访问,由JVM管理

/** <P> MagicAccessorImpl (named for parity with FieldAccessorImpl andothers, not because it actually implements an interface) is amarker class in the hierarchy. All subclasses of this class are"magically" granted access by the VM to otherwise inaccessiblefields and methods of other classes. It is used to hold the codefor dynamically-generated FieldAccessorImpl and MethodAccessorImplsubclasses. (Use of the word "unsafe" was avoided in this class'sname to avoid confusion with {@link sun.misc.Unsafe}.) </P><P> The bug fix for 4486457 also necessitated disablingverification for this class and all subclasses, as opposed to justSerializationConstructorAccessorImpl and subclasses, to avoidhaving to indicate to the VM which of these dynamically-generatedstub classes were known to be able to pass the verifier. </P><P> Do not change the name of this class without also changing theVM's code. </P> */
class MagicAccessorImpl {
}

@CallerSensitive注解

Summary: Improve the security of the JDK’s method-handle implementation by replacing the existinghand-maintained list of caller-sensitive methods with a mechanism that accurately identifiessuch methods and allows their callers to be discovered reliably.
/*** A method annotated @CallerSensitive is sensitive to its calling class,* via {@link sun.reflect.Reflection#getCallerClass Reflection.getCallerClass},* or via some equivalent.** @author John R. Rose*/
@Retention(RetentionPolicy.RUNTIME)
@Target({METHOD})
public @interface CallerSensitive {
}

用@CallerSensitive注解修饰的方法从一开始就知道具体调用此方法的对象
- 不用再经过一系列的检查就能确定具体调用此方法的对象
- 实际上是调用 sun.reflect.Reflection.getCallerClass 方法
Reflection类位于调用栈中的0帧位置
- sun.reflect.Reflection.getCallerClass() 方法返回调用栈中从0帧开始的第x帧中的类实例
- 该方法提供的机制可用于确定调用者类,从而实现"感知调用者(Caller Sensitive)"的行为
- 即允许应用程序根据调用类或调用栈中的其它类来改变其自身的行为

反射注意点

反射会额外消耗系统资源,如果不需要动态地创建一个对象,就不要使用反射
反射调用方法时可以忽略权限检查.可能会破坏封装性而导致安全问题