Invoking overridable methods from the readObject() method can allow the overriding method to read the state of the subclass before it is fully constructed because the base class is deserialized first, followed by the subclass. As a result, readObject() must not call any overridable methods.

Also see the related rule MET06-J. Do not invoke overridable methods in clone().

Noncompliant Code Example

This noncompliant code example invokes an overridable method from the readObject() method.

private void readObject(final ObjectInputStream stream)
                        throws IOException, ClassNotFoundException {
  overridableMethod(); 
  stream.defaultReadObject();
}

public void overridableMethod() {
  // ...
}

Compliant Solution

This compliant solution removes the call to the overridable method. When removing such calls is infeasible, declare the method private or final.

private void readObject(final ObjectInputStream stream)
                        throws IOException, ClassNotFoundException {
  stream.defaultReadObject();
}

Exceptions

*SER09-EX0:* The {{readObject()}} method may invoke the overridable methods {{defaultReadObject()}} and {{readFields()}} in class {{java.io.ObjectInputStream}} \[[SCG 2009|AA. Bibliography#SCG 09]\].

Risk Assessment

Invoking overridable methods from the readObject() method can lead to initialization errors.

Related Guidelines

Bibliography

      13. Serialization (SER)