Proper fix for Java 10 complaining about illegal reflection access by jaxb-impl 2.3.0?

Asked 8/5, 2018 at 15:42 Answered 31/3, 2021 at 9:27

We are looking at upgrading some legacy code to Java 10. As JAXB is not visible by default (EDIT: and the proper long term solution is not to circumvent the symptom using various JVM flags, but fix it properly) I have added this snippet to my pom.xml:

    <!-- https://mvnrepository.com/artifact/javax.xml.bind/jaxb-api -->
    <dependency>
        <groupId>javax.xml.bind</groupId>
        <artifactId>jaxb-api</artifactId>
        <version>2.3.0</version>
    </dependency>
    <dependency>
        <groupId>com.sun.xml.bind</groupId>
        <artifactId>jaxb-core</artifactId>
        <version>2.3.0</version>
    </dependency>
    <dependency>
        <groupId>com.sun.xml.bind</groupId>
        <artifactId>jaxb-impl</artifactId>
        <version>2.3.0</version>
    </dependency>

Unfortunately there is still a warning printed at startup to stderr. Apparently this is not the correct fix.

WARNING: An illegal reflective access operation has occurred
WARNING: Illegal reflective access by com.sun.xml.bind.v2.runtime.reflect.opt.Injector (file:/home/tra/.m2/repository/com/sun/xml/bind/jaxb-impl/2.3.0/jaxb-impl-2.3.0.jar) to method java.lang.ClassLoader.defineClass(java.lang.String,byte[],int,int)
WARNING: Please consider reporting this to the maintainers of com.sun.xml.bind.v2.runtime.reflect.opt.Injector
WARNING: Use --illegal-access=warn to enable warnings of further illegal reflective access operations
WARNING: All illegal access operations will be denied in a future release

The full output from --illegal-access=debug is:

WARNING: Illegal reflective access by com.sun.xml.bind.v2.runtime.reflect.opt.Injector (file:/home/tra/.m2/repository/com/sun/xml/bind/jaxb-impl/2.3.0/jaxb-impl-2.3.0.jar) to method java.lang.ClassLoader.defineClass(java.lang.String,byte[],int,int)
    at com.sun.xml.bind.v2.runtime.reflect.opt.Injector.getMethod(Injector.java:222)
    at com.sun.xml.bind.v2.runtime.reflect.opt.Injector.access$000(Injector.java:74)
    at com.sun.xml.bind.v2.runtime.reflect.opt.Injector$1.run(Injector.java:175)
    at com.sun.xml.bind.v2.runtime.reflect.opt.Injector$1.run(Injector.java:172)
    at java.base/java.security.AccessController.doPrivileged(Native Method)
    at com.sun.xml.bind.v2.runtime.reflect.opt.Injector.<clinit>(Injector.java:171)
    at com.sun.xml.bind.v2.runtime.reflect.opt.AccessorInjector.prepare(AccessorInjector.java:81)
    at com.sun.xml.bind.v2.runtime.reflect.opt.OptimizedAccessorFactory.get(OptimizedAccessorFactory.java:179)
    at com.sun.xml.bind.v2.runtime.reflect.Accessor$FieldReflection.optimize(Accessor.java:285)
    at com.sun.xml.bind.v2.runtime.property.ArrayProperty.<init>(ArrayProperty.java:68)
    at com.sun.xml.bind.v2.runtime.property.ArrayERProperty.<init>(ArrayERProperty.java:88)
    at com.sun.xml.bind.v2.runtime.property.ArrayElementProperty.<init>(ArrayElementProperty.java:100)
    at com.sun.xml.bind.v2.runtime.property.ArrayElementNodeProperty.<init>(ArrayElementNodeProperty.java:62)
    at com.sun.xml.bind.v2.runtime.property.PropertyFactory.create(PropertyFactory.java:128)
    at com.sun.xml.bind.v2.runtime.ClassBeanInfoImpl.<init>(ClassBeanInfoImpl.java:181)
    at com.sun.xml.bind.v2.runtime.JAXBContextImpl.getOrCreate(JAXBContextImpl.java:514)
    at com.sun.xml.bind.v2.runtime.JAXBContextImpl.<init>(JAXBContextImpl.java:331)
    at com.sun.xml.bind.v2.runtime.JAXBContextImpl.<init>(JAXBContextImpl.java:139)
    at com.sun.xml.bind.v2.runtime.JAXBContextImpl$JAXBContextBuilder.build(JAXBContextImpl.java:1156)
    at com.sun.xml.bind.v2.ContextFactory.createContext(ContextFactory.java:165)
    at javax.xml.bind.ContextFinder.newInstance(ContextFinder.java:297)
    at javax.xml.bind.ContextFinder.newInstance(ContextFinder.java:286)
    at javax.xml.bind.ContextFinder.find(ContextFinder.java:409)
    at javax.xml.bind.JAXBContext.newInstance(JAXBContext.java:721)
    at javax.xml.bind.JAXBContext.newInstance(JAXBContext.java:662)
    at dk.statsbiblioteket.medieplatform.autonomous.PremisManipulatorFactory.<init>(PremisManipulatorFactory.java:28)
    at dk.statsbiblioteket.digital_pligtaflevering_aviser.tools.modules.DomsModule.providePremisManipulatorFactory(DomsModule.java:182)
    at dk.statsbiblioteket.digital_pligtaflevering_aviser.tools.modules.DomsModule_ProvidePremisManipulatorFactoryFactory.get(DomsModule_ProvidePremisManipulatorFactoryFactory.java:32)
    at dk.statsbiblioteket.digital_pligtaflevering_aviser.tools.modules.DomsModule_ProvidePremisManipulatorFactoryFactory.get(DomsModule_ProvidePremisManipulatorFactoryFactory.java:11)
    at dk.statsbiblioteket.digital_pligtaflevering_aviser.tools.modules.DomsModule_ProvideSBOIEventIndexFactory.get(DomsModule_ProvideSBOIEventIndexFactory.java:56)
    at dk.statsbiblioteket.digital_pligtaflevering_aviser.tools.modules.DomsModule_ProvideSBOIEventIndexFactory.get(DomsModule_ProvideSBOIEventIndexFactory.java:12)
    at dk.statsbiblioteket.digital_pligtaflevering_aviser.doms.DomsRepository_Factory.get(DomsRepository_Factory.java:53)
WARNING: Illegal reflective access by com.sun.xml.bind.v2.runtime.reflect.opt.Injector (file:/home/tra/.m2/repository/com/sun/xml/bind/jaxb-impl/2.3.0/jaxb-impl-2.3.0.jar) to method java.lang.ClassLoader.resolveClass(java.lang.Class)
    at com.sun.xml.bind.v2.runtime.reflect.opt.Injector.getMethod(Injector.java:222)
    at com.sun.xml.bind.v2.runtime.reflect.opt.Injector.access$000(Injector.java:74)
    at com.sun.xml.bind.v2.runtime.reflect.opt.Injector$1.run(Injector.java:175)
    at com.sun.xml.bind.v2.runtime.reflect.opt.Injector$1.run(Injector.java:172)
    at java.base/java.security.AccessController.doPrivileged(Native Method)
    at com.sun.xml.bind.v2.runtime.reflect.opt.Injector.<clinit>(Injector.java:171)
    at com.sun.xml.bind.v2.runtime.reflect.opt.AccessorInjector.prepare(AccessorInjector.java:81)
    at com.sun.xml.bind.v2.runtime.reflect.opt.OptimizedAccessorFactory.get(OptimizedAccessorFactory.java:179)
    at com.sun.xml.bind.v2.runtime.reflect.Accessor$FieldReflection.optimize(Accessor.java:285)
    at com.sun.xml.bind.v2.runtime.property.ArrayProperty.<init>(ArrayProperty.java:68)
    at com.sun.xml.bind.v2.runtime.property.ArrayERProperty.<init>(ArrayERProperty.java:88)
    at com.sun.xml.bind.v2.runtime.property.ArrayElementProperty.<init>(ArrayElementProperty.java:100)
    at com.sun.xml.bind.v2.runtime.property.ArrayElementNodeProperty.<init>(ArrayElementNodeProperty.java:62)
    at com.sun.xml.bind.v2.runtime.property.PropertyFactory.create(PropertyFactory.java:128)
    at com.sun.xml.bind.v2.runtime.ClassBeanInfoImpl.<init>(ClassBeanInfoImpl.java:181)
    at com.sun.xml.bind.v2.runtime.JAXBContextImpl.getOrCreate(JAXBContextImpl.java:514)
    at com.sun.xml.bind.v2.runtime.JAXBContextImpl.<init>(JAXBContextImpl.java:331)
    at com.sun.xml.bind.v2.runtime.JAXBContextImpl.<init>(JAXBContextImpl.java:139)
    at com.sun.xml.bind.v2.runtime.JAXBContextImpl$JAXBContextBuilder.build(JAXBContextImpl.java:1156)
    at com.sun.xml.bind.v2.ContextFactory.createContext(ContextFactory.java:165)
    at javax.xml.bind.ContextFinder.newInstance(ContextFinder.java:297)
    at javax.xml.bind.ContextFinder.newInstance(ContextFinder.java:286)
    at javax.xml.bind.ContextFinder.find(ContextFinder.java:409)
    at javax.xml.bind.JAXBContext.newInstance(JAXBContext.java:721)
    at javax.xml.bind.JAXBContext.newInstance(JAXBContext.java:662)
    at dk.statsbiblioteket.medieplatform.autonomous.PremisManipulatorFactory.<init>(PremisManipulatorFactory.java:28)
    at dk.statsbiblioteket.digital_pligtaflevering_aviser.tools.modules.DomsModule.providePremisManipulatorFactory(DomsModule.java:182)
    at dk.statsbiblioteket.digital_pligtaflevering_aviser.tools.modules.DomsModule_ProvidePremisManipulatorFactoryFactory.get(DomsModule_ProvidePremisManipulatorFactoryFactory.java:32)
    at dk.statsbiblioteket.digital_pligtaflevering_aviser.tools.modules.DomsModule_ProvidePremisManipulatorFactoryFactory.get(DomsModule_ProvidePremisManipulatorFactoryFactory.java:11)
    at dk.statsbiblioteket.digital_pligtaflevering_aviser.tools.modules.DomsModule_ProvideSBOIEventIndexFactory.get(DomsModule_ProvideSBOIEventIndexFactory.java:56)
    at dk.statsbiblioteket.digital_pligtaflevering_aviser.tools.modules.DomsModule_ProvideSBOIEventIndexFactory.get(DomsModule_ProvideSBOIEventIndexFactory.java:12)
    at dk.statsbiblioteket.digital_pligtaflevering_aviser.doms.DomsRepository_Factory.get(DomsRepository_Factory.java:53)
WARNING: Illegal reflective access by com.sun.xml.bind.v2.runtime.reflect.opt.Injector (file:/home/tra/.m2/repository/com/sun/xml/bind/jaxb-impl/2.3.0/jaxb-impl-2.3.0.jar) to method java.lang.ClassLoader.findLoadedClass(java.lang.String)
    at com.sun.xml.bind.v2.runtime.reflect.opt.Injector.getMethod(Injector.java:222)
    at com.sun.xml.bind.v2.runtime.reflect.opt.Injector.access$000(Injector.java:74)
    at com.sun.xml.bind.v2.runtime.reflect.opt.Injector$1.run(Injector.java:175)
    at com.sun.xml.bind.v2.runtime.reflect.opt.Injector$1.run(Injector.java:172)
    at java.base/java.security.AccessController.doPrivileged(Native Method)
    at com.sun.xml.bind.v2.runtime.reflect.opt.Injector.<clinit>(Injector.java:171)
    at com.sun.xml.bind.v2.runtime.reflect.opt.AccessorInjector.prepare(AccessorInjector.java:81)
    at com.sun.xml.bind.v2.runtime.reflect.opt.OptimizedAccessorFactory.get(OptimizedAccessorFactory.java:179)
    at com.sun.xml.bind.v2.runtime.reflect.Accessor$FieldReflection.optimize(Accessor.java:285)
    at com.sun.xml.bind.v2.runtime.property.ArrayProperty.<init>(ArrayProperty.java:68)
    at com.sun.xml.bind.v2.runtime.property.ArrayERProperty.<init>(ArrayERProperty.java:88)
    at com.sun.xml.bind.v2.runtime.property.ArrayElementProperty.<init>(ArrayElementProperty.java:100)
    at com.sun.xml.bind.v2.runtime.property.ArrayElementNodeProperty.<init>(ArrayElementNodeProperty.java:62)
    at com.sun.xml.bind.v2.runtime.property.PropertyFactory.create(PropertyFactory.java:128)
    at com.sun.xml.bind.v2.runtime.ClassBeanInfoImpl.<init>(ClassBeanInfoImpl.java:181)
    at com.sun.xml.bind.v2.runtime.JAXBContextImpl.getOrCreate(JAXBContextImpl.java:514)
    at com.sun.xml.bind.v2.runtime.JAXBContextImpl.<init>(JAXBContextImpl.java:331)
    at com.sun.xml.bind.v2.runtime.JAXBContextImpl.<init>(JAXBContextImpl.java:139)
    at com.sun.xml.bind.v2.runtime.JAXBContextImpl$JAXBContextBuilder.build(JAXBContextImpl.java:1156)
    at com.sun.xml.bind.v2.ContextFactory.createContext(ContextFactory.java:165)
    at javax.xml.bind.ContextFinder.newInstance(ContextFinder.java:297)
    at javax.xml.bind.ContextFinder.newInstance(ContextFinder.java:286)
    at javax.xml.bind.ContextFinder.find(ContextFinder.java:409)
    at javax.xml.bind.JAXBContext.newInstance(JAXBContext.java:721)
    at javax.xml.bind.JAXBContext.newInstance(JAXBContext.java:662)
    at dk.statsbiblioteket.medieplatform.autonomous.PremisManipulatorFactory.<init>(PremisManipulatorFactory.java:28)
    at dk.statsbiblioteket.digital_pligtaflevering_aviser.tools.modules.DomsModule.providePremisManipulatorFactory(DomsModule.java:182)
    at dk.statsbiblioteket.digital_pligtaflevering_aviser.tools.modules.DomsModule_ProvidePremisManipulatorFactoryFactory.get(DomsModule_ProvidePremisManipulatorFactoryFactory.java:32)
    at dk.statsbiblioteket.digital_pligtaflevering_aviser.tools.modules.DomsModule_ProvidePremisManipulatorFactoryFactory.get(DomsModule_ProvidePremisManipulatorFactoryFactory.java:11)
    at dk.statsbiblioteket.digital_pligtaflevering_aviser.tools.modules.DomsModule_ProvideSBOIEventIndexFactory.get(DomsModule_ProvideSBOIEventIndexFactory.java:56)
    at dk.statsbiblioteket.digital_pligtaflevering_aviser.tools.modules.DomsModule_ProvideSBOIEventIndexFactory.get(DomsModule_ProvideSBOIEventIndexFactory.java:12)
    at dk.statsbiblioteket.digital_pligtaflevering_aviser.doms.DomsRepository_Factory.get(DomsRepository_Factory.java:53)

What are the proper dependencies to use here to resolve this problem?

Emerick answered 8/5, 2018 at 15:42 Comment(5)

Can you run your application with --illegal-access=debug and update the question? – Hydropic 8/5, 2018 at 17:5

Would've recommended reporting this to JAXB owners. Seems like a bug registered already and tracked at #javaee/jaxb-v2/issues/1197. Also, in the meanwhile, this article can be of use for developers to look into the MethoHandles.LookUp implementation as an alternative to the usage of Unsafe.defineClass – Radman 8/5, 2018 at 19:10

@nullpointer Bug is only three days old, so it did not exist when I researched this initially. I hope that it prompts the JAXB maintainers to create a proper fix. – Prudi 8/5, 2018 at 22:26

@Hydropic Added requested output. – Prudi 9/5, 2018 at 9:30

Since this issue likely exists since Java 9, I think, the JAXB developers should be aware of it. So the long term solution is to wait for a fixed version, but in the meanwhile, you can just live with the reported access. That’s the precisely the rational behind it, make developers aware of the issue while still running the code with the current version. – Mashie 9/5, 2018 at 9:31

jaxb-ri runtime uses ClassLoader#defineClass / Unsafe#defineClass to do some bytecode modification in runtime to optimize performance. ClassLoader#defineClass is tried first which causes the warning.

This legacy optimization is removed completely in jaxb-ri master (after 2.3.0, not released yet).

To disable this optimization for 2.3.0, set system property com.sun.xml.bind.v2.bytecode.ClassTailor.noOptimize.

After next jaxb-ri release updating to newest version will remove the warning. jaxb-core artifact will be discontinued in favor for JPMS support. Correct pom will look like:

<dependency>
    <groupId>javax.xml.bind</groupId>
    <artifactId>jaxb-api</artifactId>
    <version>2.4.0</version> 
</dependency>
<dependency>
    <groupId>org.glassfish.jaxb</groupId>
    <artifactId>jaxb-runtime</artifactId>
    <version>2.4.0</version> 
</dependency>

If you wish to try early, you can pick latest promoted build from: https://maven.java.net/content/groups/promoted/org/glassfish/jaxb/jaxb-runtime/

Director answered 9/5, 2018 at 10:46 Comment(15)

So the proper fix is to update to the new version when released? – Prudi 9/5, 2018 at 11:3

Yes. Don't forget to remove jaxb-core from dependencies, this artifact will be discontinued because of JPMS split package problem. – Director 9/5, 2018 at 12:2

Please provide the correct pom.xml snippet then for a 500 point bounty. Is there an approximate ETA for the new release? – Prudi 9/5, 2018 at 12:32

I believe this with a mix of Java-11 release including JEP-320, would make life easy for a good part of Java community. Thanks for replying here as well. :) – Radman 10/5, 2018 at 3:43

@RomanGrigoriadi . any idea when 2.4 would be available in Maven? I can see 2.4 Snapshot being taken in Github. – Nicolnicola 27/8, 2018 at 7:33

According to mvnrepository.com/artifact/javax.xml.bind/jaxb-api it appears that 2.4 has been released. I do not work on the project in the question anymore, but I would appreciate hearing from others that have the same problem, if upgrading fixes it? – Prudi 29/12, 2018 at 17:8

It appears that of now version 2.4 is available in maven repository but it scares me that I see a "b" in this version, so I guess it might still be in beta? Has anyone checked if the warning disappears with the suggestion above ? I am a rookie in web services and I don't dare to change something that is already working – Ducharme 4/4, 2019 at 13:40

Version 2.3.1 has now been released and fixes the 'Illegal reflective access' warning for me on java 11. 2.4.0 still isn't released officially, so 2.3.1 seems a better bet to me. – Scipio 13/6, 2019 at 2:52

@Evan To my understanding that b is for build, not beta. – Prudi 28/8, 2019 at 8:21

You can also set this property with: System.setProperty("com.sun.xml.bind.v2.bytecode.ClassTailor.noOptimize", "true"); – Punster 20/7, 2020 at 17:34

Why the warning comes back with version 3.0.0? – Ethiopic 21/1, 2021 at 9:25

in version 3.0.0, I have to: System.setProperty("org.glassfish.jaxb.runtime.v2.bytecode.ClassTailor.noOptimize", "true"); – Ethiopic 21/1, 2021 at 10:34

Update: I don't need to set the property, it's a mrjar problem – Ethiopic 29/1, 2021 at 6:43

Thanks a lot bro the key was to use the same version in both packages. – Procryptic 11/11, 2022 at 6:37

If someone wants the logging of INFO: The optimized code generation is disabled gone, disable the JUL logger for com.sun.xml.bind.v2.runtime.reflect.opt.AccessorInjector. – Bullheaded 12/7, 2023 at 9:1

kudos to @Roman Grigoriadi , He was right, the updated 2.4 version fixes the warning issues.

Just add the dependencies below to the pom file

<dependency>
  <groupId>javax.xml.bind</groupId>
  <artifactId>jaxb-api</artifactId>
  <version>2.4.0-b180830.0359</version>
</dependency>
<dependency>
  <groupId>org.glassfish.jaxb</groupId>
  <artifactId>jaxb-runtime</artifactId>
  <version>2.4.0-b180608.0325</version>
</dependency>

Ducharme answered 4/4, 2019 at 13:47 Comment(0)

I just spent half a day going through old blogs and posts about this subject, most outdated and not working. Or only working with warnings at runtime. As of december 2020, the following works with Java 15, without any errors or warnings:

<dependency>
    <groupId>javax.xml.bind</groupId>
    <artifactId>jaxb-api</artifactId>
    <version>2.3.1</version>
</dependency>
<dependency>
    <groupId>org.glassfish.jaxb</groupId>
    <artifactId>jaxb-runtime</artifactId>
    <version>2.3.2</version>
</dependency>

Chronogram answered 2/12, 2020 at 11:17 Comment(0)

To make JAXB 2.3.3 work with JDK 16 (ie work with JDK 1.8 to 17 EA): ALWAYS add 'Multi-Release: true' to your MANIFEST.MF !

see my comments:

https://github.com/eclipse-ee4j/jaxb-ri/issues/1197#issuecomment-810908755

Here are my concrete maven (explicit) dependencies to use JAXB 2.3.3 in my project:

<!-- JAXB 2.3.3 (jdk 8+) -->
    <dependency>
        <groupId>jakarta.xml.bind</groupId>
        <artifactId>jakarta.xml.bind-api</artifactId>
        <version>2.3.3</version>
    </dependency>
    <dependency>
        <groupId>org.glassfish.jaxb</groupId>
        <artifactId>jaxb-runtime</artifactId>
        <version>2.3.3</version>
    </dependency>

    <!-- JAXB dependencies -->
    <dependency>
        <groupId>jakarta.activation</groupId>
        <artifactId>jakarta.activation-api</artifactId>
        <version>1.2.2</version>
    </dependency>
    <dependency>
        <groupId>com.sun.activation</groupId>
        <artifactId>jakarta.activation</artifactId>
        <version>1.2.2</version>
    </dependency>

    <dependency>
        <groupId>com.sun.istack</groupId>
        <artifactId>istack-commons-runtime</artifactId>
        <version>3.0.11</version>
    </dependency>
    <dependency>
        <groupId>com.sun.xml.fastinfoset</groupId>
        <artifactId>FastInfoset</artifactId>
        <version>1.2.18</version>
    </dependency>
    <dependency>
        <groupId>org.jvnet.staxex</groupId>
        <artifactId>stax-ex</artifactId>
        <version>1.8.3</version>
    </dependency>
    <dependency>
        <groupId>org.glassfish.jaxb</groupId>
        <artifactId>txw2</artifactId>
        <version>2.3.3</version>
    </dependency>

Dysthymia answered 31/3, 2021 at 9:27 Comment(1)

Note that this is because you are creating a single jar from all your dependencies. Then you need to include all the fields from their MANIFEST.MF's in your new homemade global MANIFEST.MF. If you don't repack, this shouldn't be necessary. – Prudi 5/11, 2021 at 11:24

Hot tags

Godot Unity Godot Help Programming Godot 4.X GUI GDScript 3D 2D Physics CSharp Godot 3.X VR XR Projects C++

Recommended topics

Hot tags