Hi Alan, I second that the Unsafe::defineClass method should be removed at some point. I'd very much prefer using a stable API over following up changes on internal API.
However, for Java agents, there is still no good way to define auxiliary classes. There is an open ticket on https://bugs.openjdk.java.net/browse/JDK-8201784 and I have described my concerns with the suggested API in the linked discussion as being insufficient for many use cases. I still hope that a defineClass method can be added to the Instrumentation interface; I would not know of any other good use case that currently makes use of the internal Unsafe version but agents. As of today, Unsafe::defineClass is however still a crucial element for many Java agents that are widely used in the enterprise space, e.g. for APM tools, security monitoring or metrics extraction. Not offering an alternative would lock out these tools and stop a large fraction of Java users from updating their production environments until a new workaround is found. I hope that you consider an API for Java agents to define classes as a blocker issue to be solved prior to removing Unsafe::defineClass alltogether. Thanks and best regards, Rafael
