Draft: 8387350

src/java.base/share/classes/java/io/ObjectOutputStream.java

@@ -1402,9 +1402,17 @@ private void writeRecordData(Object obj, ObjectStreamClass desc)
     private void writeSerialData(Object obj, ObjectStreamClass desc)
         throws IOException
     {
+        // As per the serialization spec, the serializable object's list of classes
+        // (that is, the class it instantiates and its superclasses) is processed
+        // in superclass-to-subclass order, starting with the first class that
+        // implements Serializable.
         ObjectStreamClass.ClassDataSlot[] slots = desc.getClassDataLayout();
         for (int i = 0; i < slots.length; i++) {
             ObjectStreamClass slotDesc = slots[i].desc;
+            // Verify that each of these classes comply with the serialization spec.
+            // Specifically, if the class is a concrete value class, or it has strict
+            // initialization instance field(s) then throw InvalidClassException.
+            slotDesc.checkSerialize();
             if (slotDesc.hasWriteObjectMethod()) {
                 PutFieldImpl oldPut = curPut;
                 curPut = null;

src/java.base/share/classes/java/io/ObjectStreamClass.java

@@ -350,8 +350,15 @@ private ObjectStreamClass(final Class<?> cl) {
         isProxy = Proxy.isProxyClass(cl);
         isEnum = Enum.class.isAssignableFrom(cl);
         isRecord = cl.isRecord();
-        requiresDeserializer = cl.isValue() || ValueClass.hasStrictInstanceField(cl);
         serializable = Serializable.class.isAssignableFrom(cl);
+        // Serialization specification states that if a class implements java.io.Serializable,
+        // then serialization/deserialization isn't allowed if that class is a concrete value class
+        // or if that class has strict initialization instance field(s).
+        // However, for some JDK classes we make a provision to bypass that restriction.
+        // Such classes are required to have a jdk.internal.value.Deserializer associated with it.
+        requiresDeserializer = serializable &&
+                (ValueClass.isConcreteValueClass(cl) || ValueClass.hasStrictInstanceField(cl));
+
         externalizable = Externalizable.class.isAssignableFrom(cl);
 
         Class<?> superCl = cl.getSuperclass();