Proper fix for Java 10 complaining about illegal reflection access by jaxb-impl 2.3.0?

Question

We are looking at upgrading some legacy code to Java 10. As JAXB is not visible by default (EDIT: and the proper long term solution is not to circumvent the symptom using various JVM flags, but fix it properly) I have added this snippet to my pom.xml:

    <!-- https://mvnrepository.com/artifact/javax.xml.bind/jaxb-api -->
    <dependency>
        <groupId>javax.xml.bind</groupId>
        <artifactId>jaxb-api</artifactId>
        <version>2.3.0</version>
    </dependency>
    <dependency>
        <groupId>com.sun.xml.bind</groupId>
        <artifactId>jaxb-core</artifactId>
        <version>2.3.0</version>
    </dependency>
    <dependency>
        <groupId>com.sun.xml.bind</groupId>
        <artifactId>jaxb-impl</artifactId>
        <version>2.3.0</version>
    </dependency>

Unfortunately there is still a warning printed at startup to stderr. Apparently this is not the correct fix.

WARNING: An illegal reflective access operation has occurred
WARNING: Illegal reflective access by com.sun.xml.bind.v2.runtime.reflect.opt.Injector (file:/home/tra/.m2/repository/com/sun/xml/bind/jaxb-impl/2.3.0/jaxb-impl-2.3.0.jar) to method java.lang.ClassLoader.defineClass(java.lang.String,byte[],int,int)
WARNING: Please consider reporting this to the maintainers of com.sun.xml.bind.v2.runtime.reflect.opt.Injector
WARNING: Use --illegal-access=warn to enable warnings of further illegal reflective access operations
WARNING: All illegal access operations will be denied in a future release

The full output from --illegal-access=debug is:

WARNING: Illegal reflective access by com.sun.xml.bind.v2.runtime.reflect.opt.Injector (file:/home/tra/.m2/repository/com/sun/xml/bind/jaxb-impl/2.3.0/jaxb-impl-2.3.0.jar) to method java.lang.ClassLoader.defineClass(java.lang.String,byte[],int,int)
    at com.sun.xml.bind.v2.runtime.reflect.opt.Injector.getMethod(Injector.java:222)
    at com.sun.xml.bind.v2.runtime.reflect.opt.Injector.access$000(Injector.java:74)
    at com.sun.xml.bind.v2.runtime.reflect.opt.Injector$1.run(Injector.java:175)
    at com.sun.xml.bind.v2.runtime.reflect.opt.Injector$1.run(Injector.java:172)
    at java.base/java.security.AccessController.doPrivileged(Native Method)
    at com.sun.xml.bind.v2.runtime.reflect.opt.Injector.<clinit>(Injector.java:171)
    at com.sun.xml.bind.v2.runtime.reflect.opt.AccessorInjector.prepare(AccessorInjector.java:81)
    at com.sun.xml.bind.v2.runtime.reflect.opt.OptimizedAccessorFactory.get(OptimizedAccessorFactory.java:179)
    at com.sun.xml.bind.v2.runtime.reflect.Accessor$FieldReflection.optimize(Accessor.java:285)
    at com.sun.xml.bind.v2.runtime.property.ArrayProperty.<init>(ArrayProperty.java:68)
    at com.sun.xml.bind.v2.runtime.property.ArrayERProperty.<init>(ArrayERProperty.java:88)
    at com.sun.xml.bind.v2.runtime.property.ArrayElementProperty.<init>(ArrayElementProperty.java:100)
    at com.sun.xml.bind.v2.runtime.property.ArrayElementNodeProperty.<init>(ArrayElementNodeProperty.java:62)
    at com.sun.xml.bind.v2.runtime.property.PropertyFactory.create(PropertyFactory.java:128)
    at com.sun.xml.bind.v2.runtime.ClassBeanInfoImpl.<init>(ClassBeanInfoImpl.java:181)
    at com.sun.xml.bind.v2.runtime.JAXBContextImpl.getOrCreate(JAXBContextImpl.java:514)
    at com.sun.xml.bind.v2.runtime.JAXBContextImpl.<init>(JAXBContextImpl.java:331)
    at com.sun.xml.bind.v2.runtime.JAXBContextImpl.<init>(JAXBContextImpl.java:139)
    at com.sun.xml.bind.v2.runtime.JAXBContextImpl$JAXBContextBuilder.build(JAXBContextImpl.java:1156)
    at com.sun.xml.bind.v2.ContextFactory.createContext(ContextFactory.java:165)
    at javax.xml.bind.ContextFinder.newInstance(ContextFinder.java:297)
    at javax.xml.bind.ContextFinder.newInstance(ContextFinder.java:286)
    at javax.xml.bind.ContextFinder.find(ContextFinder.java:409)
    at javax.xml.bind.JAXBContext.newInstance(JAXBContext.java:721)
    at javax.xml.bind.JAXBContext.newInstance(JAXBContext.java:662)
    at dk.statsbiblioteket.medieplatform.autonomous.PremisManipulatorFactory.<init>(PremisManipulatorFactory.java:28)
    at dk.statsbiblioteket.digital_pligtaflevering_aviser.tools.modules.DomsModule.providePremisManipulatorFactory(DomsModule.java:182)
    at dk.statsbiblioteket.digital_pligtaflevering_aviser.tools.modules.DomsModule_ProvidePremisManipulatorFactoryFactory.get(DomsModule_ProvidePremisManipulatorFactoryFactory.java:32)
    at dk.statsbiblioteket.digital_pligtaflevering_aviser.tools.modules.DomsModule_ProvidePremisManipulatorFactoryFactory.get(DomsModule_ProvidePremisManipulatorFactoryFactory.java:11)
    at dk.statsbiblioteket.digital_pligtaflevering_aviser.tools.modules.DomsModule_ProvideSBOIEventIndexFactory.get(DomsModule_ProvideSBOIEventIndexFactory.java:56)
    at dk.statsbiblioteket.digital_pligtaflevering_aviser.tools.modules.DomsModule_ProvideSBOIEventIndexFactory.get(DomsModule_ProvideSBOIEventIndexFactory.java:12)
    at dk.statsbiblioteket.digital_pligtaflevering_aviser.doms.DomsRepository_Factory.get(DomsRepository_Factory.java:53)
WARNING: Illegal reflective access by com.sun.xml.bind.v2.runtime.reflect.opt.Injector (file:/home/tra/.m2/repository/com/sun/xml/bind/jaxb-impl/2.3.0/jaxb-impl-2.3.0.jar) to method java.lang.ClassLoader.resolveClass(java.lang.Class)
    at com.sun.xml.bind.v2.runtime.reflect.opt.Injector.getMethod(Injector.java:222)
    at com.sun.xml.bind.v2.runtime.reflect.opt.Injector.access$000(Injector.java:74)
    at com.sun.xml.bind.v2.runtime.reflect.opt.Injector$1.run(Injector.java:175)
    at com.sun.xml.bind.v2.runtime.reflect.opt.Injector$1.run(Injector.java:172)
    at java.base/java.security.AccessController.doPrivileged(Native Method)
    at com.sun.xml.bind.v2.runtime.reflect.opt.Injector.<clinit>(Injector.java:171)
    at com.sun.xml.bind.v2.runtime.reflect.opt.AccessorInjector.prepare(AccessorInjector.java:81)
    at com.sun.xml.bind.v2.runtime.reflect.opt.OptimizedAccessorFactory.get(OptimizedAccessorFactory.java:179)
    at com.sun.xml.bind.v2.runtime.reflect.Accessor$FieldReflection.optimize(Accessor.java:285)
    at com.sun.xml.bind.v2.runtime.property.ArrayProperty.<init>(ArrayProperty.java:68)
    at com.sun.xml.bind.v2.runtime.property.ArrayERProperty.<init>(ArrayERProperty.java:88)
    at com.sun.xml.bind.v2.runtime.property.ArrayElementProperty.<init>(ArrayElementProperty.java:100)
    at com.sun.xml.bind.v2.runtime.property.ArrayElementNodeProperty.<init>(ArrayElementNodeProperty.java:62)
    at com.sun.xml.bind.v2.runtime.property.PropertyFactory.create(PropertyFactory.java:128)
    at com.sun.xml.bind.v2.runtime.ClassBeanInfoImpl.<init>(ClassBeanInfoImpl.java:181)
    at com.sun.xml.bind.v2.runtime.JAXBContextImpl.getOrCreate(JAXBContextImpl.java:514)
    at com.sun.xml.bind.v2.runtime.JAXBContextImpl.<init>(JAXBContextImpl.java:331)
    at com.sun.xml.bind.v2.runtime.JAXBContextImpl.<init>(JAXBContextImpl.java:139)
    at com.sun.xml.bind.v2.runtime.JAXBContextImpl$JAXBContextBuilder.build(JAXBContextImpl.java:1156)
    at com.sun.xml.bind.v2.ContextFactory.createContext(ContextFactory.java:165)
    at javax.xml.bind.ContextFinder.newInstance(ContextFinder.java:297)
    at javax.xml.bind.ContextFinder.newInstance(ContextFinder.java:286)
    at javax.xml.bind.ContextFinder.find(ContextFinder.java:409)
    at javax.xml.bind.JAXBContext.newInstance(JAXBContext.java:721)
    at javax.xml.bind.JAXBContext.newInstance(JAXBContext.java:662)
    at dk.statsbiblioteket.medieplatform.autonomous.PremisManipulatorFactory.<init>(PremisManipulatorFactory.java:28)
    at dk.statsbiblioteket.digital_pligtaflevering_aviser.tools.modules.DomsModule.providePremisManipulatorFactory(DomsModule.java:182)
    at dk.statsbiblioteket.digital_pligtaflevering_aviser.tools.modules.DomsModule_ProvidePremisManipulatorFactoryFactory.get(DomsModule_ProvidePremisManipulatorFactoryFactory.java:32)
    at dk.statsbiblioteket.digital_pligtaflevering_aviser.tools.modules.DomsModule_ProvidePremisManipulatorFactoryFactory.get(DomsModule_ProvidePremisManipulatorFactoryFactory.java:11)
    at dk.statsbiblioteket.digital_pligtaflevering_aviser.tools.modules.DomsModule_ProvideSBOIEventIndexFactory.get(DomsModule_ProvideSBOIEventIndexFactory.java:56)
    at dk.statsbiblioteket.digital_pligtaflevering_aviser.tools.modules.DomsModule_ProvideSBOIEventIndexFactory.get(DomsModule_ProvideSBOIEventIndexFactory.java:12)
    at dk.statsbiblioteket.digital_pligtaflevering_aviser.doms.DomsRepository_Factory.get(DomsRepository_Factory.java:53)
WARNING: Illegal reflective access by com.sun.xml.bind.v2.runtime.reflect.opt.Injector (file:/home/tra/.m2/repository/com/sun/xml/bind/jaxb-impl/2.3.0/jaxb-impl-2.3.0.jar) to method java.lang.ClassLoader.findLoadedClass(java.lang.String)
    at com.sun.xml.bind.v2.runtime.reflect.opt.Injector.getMethod(Injector.java:222)
    at com.sun.xml.bind.v2.runtime.reflect.opt.Injector.access$000(Injector.java:74)
    at com.sun.xml.bind.v2.runtime.reflect.opt.Injector$1.run(Injector.java:175)
    at com.sun.xml.bind.v2.runtime.reflect.opt.Injector$1.run(Injector.java:172)
    at java.base/java.security.AccessController.doPrivileged(Native Method)
    at com.sun.xml.bind.v2.runtime.reflect.opt.Injector.<clinit>(Injector.java:171)
    at com.sun.xml.bind.v2.runtime.reflect.opt.AccessorInjector.prepare(AccessorInjector.java:81)
    at com.sun.xml.bind.v2.runtime.reflect.opt.OptimizedAccessorFactory.get(OptimizedAccessorFactory.java:179)
    at com.sun.xml.bind.v2.runtime.reflect.Accessor$FieldReflection.optimize(Accessor.java:285)
    at com.sun.xml.bind.v2.runtime.property.ArrayProperty.<init>(ArrayProperty.java:68)
    at com.sun.xml.bind.v2.runtime.property.ArrayERProperty.<init>(ArrayERProperty.java:88)
    at com.sun.xml.bind.v2.runtime.property.ArrayElementProperty.<init>(ArrayElementProperty.java:100)
    at com.sun.xml.bind.v2.runtime.property.ArrayElementNodeProperty.<init>(ArrayElementNodeProperty.java:62)
    at com.sun.xml.bind.v2.runtime.property.PropertyFactory.create(PropertyFactory.java:128)
    at com.sun.xml.bind.v2.runtime.ClassBeanInfoImpl.<init>(ClassBeanInfoImpl.java:181)
    at com.sun.xml.bind.v2.runtime.JAXBContextImpl.getOrCreate(JAXBContextImpl.java:514)
    at com.sun.xml.bind.v2.runtime.JAXBContextImpl.<init>(JAXBContextImpl.java:331)
    at com.sun.xml.bind.v2.runtime.JAXBContextImpl.<init>(JAXBContextImpl.java:139)
    at com.sun.xml.bind.v2.runtime.JAXBContextImpl$JAXBContextBuilder.build(JAXBContextImpl.java:1156)
    at com.sun.xml.bind.v2.ContextFactory.createContext(ContextFactory.java:165)
    at javax.xml.bind.ContextFinder.newInstance(ContextFinder.java:297)
    at javax.xml.bind.ContextFinder.newInstance(ContextFinder.java:286)
    at javax.xml.bind.ContextFinder.find(ContextFinder.java:409)
    at javax.xml.bind.JAXBContext.newInstance(JAXBContext.java:721)
    at javax.xml.bind.JAXBContext.newInstance(JAXBContext.java:662)
    at dk.statsbiblioteket.medieplatform.autonomous.PremisManipulatorFactory.<init>(PremisManipulatorFactory.java:28)
    at dk.statsbiblioteket.digital_pligtaflevering_aviser.tools.modules.DomsModule.providePremisManipulatorFactory(DomsModule.java:182)
    at dk.statsbiblioteket.digital_pligtaflevering_aviser.tools.modules.DomsModule_ProvidePremisManipulatorFactoryFactory.get(DomsModule_ProvidePremisManipulatorFactoryFactory.java:32)
    at dk.statsbiblioteket.digital_pligtaflevering_aviser.tools.modules.DomsModule_ProvidePremisManipulatorFactoryFactory.get(DomsModule_ProvidePremisManipulatorFactoryFactory.java:11)
    at dk.statsbiblioteket.digital_pligtaflevering_aviser.tools.modules.DomsModule_ProvideSBOIEventIndexFactory.get(DomsModule_ProvideSBOIEventIndexFactory.java:56)
    at dk.statsbiblioteket.digital_pligtaflevering_aviser.tools.modules.DomsModule_ProvideSBOIEventIndexFactory.get(DomsModule_ProvideSBOIEventIndexFactory.java:12)
    at dk.statsbiblioteket.digital_pligtaflevering_aviser.doms.DomsRepository_Factory.get(DomsRepository_Factory.java:53)

What are the proper dependencies to use here to resolve this problem?

Can you run your application with `--illegal-access=debug` and update the question? — ZhekaKozlov, May 08 '18 at 17:05
Would've recommended reporting this to JAXB owners. Seems like a bug registered already and tracked at [#javaee/jaxb-v2/issues/1197](https://github.com/javaee/jaxb-v2/issues/1197). Also, in the meanwhile, [this article can be of use](https://www.javacodegeeks.com/2018/04/jdk-11-and-proxies-in-a-world-past-sun-misc-unsafe.html) for developers to look into the `MethoHandles.LookUp` implementation as an alternative to the usage of `Unsafe.defineClass` — Naman, May 08 '18 at 19:10
@nullpointer Bug is only three days old, so it did not exist when I researched this initially. I hope that it prompts the JAXB maintainers to create a proper fix. — Thorbjørn Ravn Andersen, May 08 '18 at 22:26
Since this issue likely exists since Java 9, I think, the JAXB developers should be aware of it. So the long term solution is to wait for a fixed version, but in the meanwhile, you can just live with the reported access. That’s the precisely the rational behind it, make developers aware of the issue while still running the code with the current version. — Holger, May 09 '18 at 09:31

score 37 · Accepted Answer · edited Jun 18 '20 at 21:19

37

jaxb-ri runtime uses ClassLoader#defineClass / Unsafe#defineClass to do some bytecode modification in runtime to optimize performance. ClassLoader#defineClass is tried first which causes the warning.

This legacy optimization is removed completely in jaxb-ri master (after 2.3.0, not released yet).

To disable this optimization for 2.3.0, set system property com.sun.xml.bind.v2.bytecode.ClassTailor.noOptimize.

After next jaxb-ri release updating to newest version will remove the warning. jaxb-core artifact will be discontinued in favor for JPMS support. Correct pom will look like:

<dependency>
    <groupId>javax.xml.bind</groupId>
    <artifactId>jaxb-api</artifactId>
    <version>2.4.0</version> 
</dependency>
<dependency>
    <groupId>org.glassfish.jaxb</groupId>
    <artifactId>jaxb-runtime</artifactId>
    <version>2.4.0</version> 
</dependency>

If you wish to try early, you can pick latest promoted build from: https://maven.java.net/content/groups/promoted/org/glassfish/jaxb/jaxb-runtime/

edited Jun 18 '20 at 21:19

Vishal Kharde

964
2
9
22

answered May 09 '18 at 10:46

Roman Grigoriadi

1,552
11
8

So the proper fix is to update to the new version when released? – Thorbjørn Ravn Andersen May 09 '18 at 11:03
1

Yes. Don't forget to remove jaxb-core from dependencies, this artifact will be discontinued because of JPMS split package problem. – Roman Grigoriadi May 09 '18 at 12:02
Please provide the correct pom.xml snippet then for a 500 point bounty. Is there an approximate ETA for the new release? – Thorbjørn Ravn Andersen May 09 '18 at 12:32
I believe [this](https://stackoverflow.com/questions/50237516/proper-fix-for-java-10-complaining-about-illegal-reflection-access-by-jaxb-impl/50251510#50251510) with a mix of Java-11 release including [JEP-320](http://openjdk.java.net/jeps/320), would make life easy for a good part of Java community. Thanks for replying here as well. :) – Naman May 10 '18 at 03:43
@RomanGrigoriadi . any idea when 2.4 would be available in Maven? I can see 2.4 Snapshot being taken in Github. – Imran Aug 27 '18 at 07:33
According to https://mvnrepository.com/artifact/javax.xml.bind/jaxb-api it appears that 2.4 has been released. I do not work on the project in the question anymore, but I would appreciate hearing from others that have the same problem, if upgrading fixes it? – Thorbjørn Ravn Andersen Dec 29 '18 at 17:08
It appears that of now version 2.4 is available in maven repository but it scares me that I see a "b" in this version, so I guess it might still be in beta? Has anyone checked if the warning disappears with the suggestion above ? I am a rookie in web services and I don't dare to change something that is already working – GGEv Apr 04 '19 at 13:40
4

Version 2.3.1 has now been released and fixes the 'Illegal reflective access' warning for me on java 11. 2.4.0 still isn't released officially, so 2.3.1 seems a better bet to me. – JosephH Jun 13 '19 at 02:52
1

@Evan To my understanding that b is for build, not beta. – Thorbjørn Ravn Andersen Aug 28 '19 at 08:21
You can also set this property with: System.setProperty("com.sun.xml.bind.v2.bytecode.ClassTailor.noOptimize", "true"); – StanGreen Jul 20 '20 at 17:34
Why the warning comes back with version 3.0.0? – sify Jan 21 '21 at 09:25
in version 3.0.0, I have to: System.setProperty("org.glassfish.jaxb.runtime.v2.bytecode.ClassTailor.noOptimize", "true"); – sify Jan 21 '21 at 10:34
Update: I don't need to set the property, it's a mrjar problem – sify Jan 29 '21 at 06:43

score 8 · Answer 2 · edited Jun 17 '20 at 14:45

kudos to @Roman Grigoriadi , He was right, the updated 2.4 version fixes the warning issues.

Just add the dependencies below to the pom file

<dependency>
  <groupId>javax.xml.bind</groupId>
  <artifactId>jaxb-api</artifactId>
  <version>2.4.0-b180830.0359</version>
</dependency>
<dependency>
  <groupId>org.glassfish.jaxb</groupId>
  <artifactId>jaxb-runtime</artifactId>
  <version>2.4.0-b180608.0325</version>
</dependency>

score 2 · Answer 3 · answered Dec 02 '20 at 11:17

I just spent half a day going through old blogs and posts about this subject, most outdated and not working. Or only working with warnings at runtime. As of december 2020, the following works with Java 15, without any errors or warnings:

<dependency>
    <groupId>javax.xml.bind</groupId>
    <artifactId>jaxb-api</artifactId>
    <version>2.3.1</version>
</dependency>
<dependency>
    <groupId>org.glassfish.jaxb</groupId>
    <artifactId>jaxb-runtime</artifactId>
    <version>2.3.2</version>
</dependency>

bourgesl · Answer 4 · 2021-03-31T10:12:03.753

To make JAXB 2.3.3 work with JDK 16 (ie work with JDK 1.8 to 17 EA): ALWAYS add 'Multi-Release: true' to your MANIFEST.MF !

see my comments:

https://github.com/eclipse-ee4j/jaxb-ri/issues/1197#issuecomment-810908755

Here are my concrete maven (explicit) dependencies to use JAXB 2.3.3 in my project:

<!-- JAXB 2.3.3 (jdk 8+) -->
    <dependency>
        <groupId>jakarta.xml.bind</groupId>
        <artifactId>jakarta.xml.bind-api</artifactId>
        <version>2.3.3</version>
    </dependency>
    <dependency>
        <groupId>org.glassfish.jaxb</groupId>
        <artifactId>jaxb-runtime</artifactId>
        <version>2.3.3</version>
    </dependency>

    <!-- JAXB dependencies -->
    <dependency>
        <groupId>jakarta.activation</groupId>
        <artifactId>jakarta.activation-api</artifactId>
        <version>1.2.2</version>
    </dependency>
    <dependency>
        <groupId>com.sun.activation</groupId>
        <artifactId>jakarta.activation</artifactId>
        <version>1.2.2</version>
    </dependency>

    <dependency>
        <groupId>com.sun.istack</groupId>
        <artifactId>istack-commons-runtime</artifactId>
        <version>3.0.11</version>
    </dependency>
    <dependency>
        <groupId>com.sun.xml.fastinfoset</groupId>
        <artifactId>FastInfoset</artifactId>
        <version>1.2.18</version>
    </dependency>
    <dependency>
        <groupId>org.jvnet.staxex</groupId>
        <artifactId>stax-ex</artifactId>
        <version>1.8.3</version>
    </dependency>
    <dependency>
        <groupId>org.glassfish.jaxb</groupId>
        <artifactId>txw2</artifactId>
        <version>2.3.3</version>
    </dependency>

Proper fix for Java 10 complaining about illegal reflection access by jaxb-impl 2.3.0?

4 Answers4

Linked

Related