The Java to IDL specification maps a java.lang.Class to
::javax::rmi::CORBA::ClassDesc, which looks like:

package javax.rmi.CORBA;

public class ClassDesc implements java.io.Serializable {
    private String repid;
    private String codebase; // space-separated list of URLs
}

(Java to IDL ptc-00-01-06 1.3.5.11)

The spec also requires that the fields of a Serializable class
be sent in sorted order. (1.3.5.6)

Currently, the ORB incorrectly sends repid before codebase.

This bug was found as part of the Connectathon RMI-IIOP
interop effort for JavaOne, and can be tested against a
patched Borland AppServer 4.5.1.