Summary

Deprecate sun.misc.Unsafe.staticFieldOffset(Field), sun.misc.Unsafe.objectFieldOffset(Field), and sun.misc.Unsafe,staticFieldBase(Field f).

Problem

The methods defined by sun.misc.Unsafe that return field offsets are an impediment to future changes. Layout may not be fixed in the future, the VM should be allowed to re-layout dynamically based on patterns of usage.

Some libraries use these methods to get offsets (sometimes of classes with the same layout as JDK classes) so they can directly access the fields of privileged classes. This creates the potential for integrity and security issues. It's untenable for libraries to rely on this going forward.

The java.lang.invoke.VarHandle API (added in Java 9) provides strongly typed reference to a variable that is a safe and a much better alternative to many cases that use Unsafe today.

Solution

Deprecate the three methods. Future CSRs will degrade and/or remove the methods.

Add a release note.

Specification

There are no specification changes. The JDK build does not generate javadoc for the jdk.unsupported module.

The deprecated message proposed is:

@deprecated The guarantee that a field will always have the same offset
and base may not be true in a future release. The ability to provide an
offset and object reference to a heap memory accessor will be removed
in a future release. Use {@link java.lang.invoke.VarHandle} instead.