Right now, if you pore through servlet/build.xml, we build gwt-servlet.jar by first building the classes for gwt-user, then filtering out a set of blacklisted packages from it. As we've added things, of course, the secret blacklist has grown stale, and that explains why some never-sane-in-server-context things like UiBinder are now packaged into gwt-servlet.jar.
I'd like to change that, but it's breaking at least theoretically if anyone *had* found a server-side use, sane or otherwise. The fix would be easy (nothing stops you from dropping gwt-user onto your server, I suppose), and I'd be a bit disturbed if you did have a sane server-side use... but hey, I've been surprised before, which is why I'm asking. It also turns out that I-think-too-many legitimately server-side things (like, say, RPC) need to touch "client" packaged classes for things like enums and whatnot, and the classes with those enums then pull in a large list of other client things, and so client-only stuff like DomEvents turns out actually to be required. I'm not---at least not yet---talking about refactoring those things, just about getting to a whitelist algorithm for gwt-servlet with a minimal set of "grandfathered" client classes. As near as I can tell, the new definition of gwt-servlet would be, using ant ** and * wildcards mixed with shell-style comments 'cause XML ones are ugly: # what I actually want to keep in gwt-servlet: com/google/gwt/**/server/**/*.java com/google/gwt/**/shared/**/*.java # What server and shared RPC need, despite the "client" designation: com/google/gwt/user/client/rpc/*.java com/google/gwt/user/client/rpc/impl/AbstractSerialization*.java com/google/gwt/user/client/rpc/RpcRequestBuilder.java com/google/gwt/http/client/*.java com/google/gwt/xhr/client/ReadyStateChangeHandler.java com/google/gwt/xhr/client/XMLHttpRequest.java com/google/gwt/user/client/Timer.java com/google/gwt/user/client/rpc/SerializationException.java com/google/gwt/user/client/rpc/SerializationStreamReader.java com/google/gwt/user/client/rpc/SerializationStreamWriter.java com/google/gwt/rpc/client/ast/*.java com/google/gwt/rpc/client/impl/CommandSerializationStreamWriterBase.java com/google/gwt/rpc/client/impl/CommandClientSerializationStreamReader.java com/google/gwt/rpc/client/impl/EscapeUtil.java com/google/gwt/user/client/rpc/impl/ClientSerializationStreamWriter.java com/google/gwt/user/client/rpc/impl/Serializer.java com/google/gwt/rpc/client/impl/HasValuesCommandSink.java com/google/gwt/rpc/client/impl/SimplePayloadSink.java com/google/gwt/rpc/client/impl/RemoteException.java # and what they need, at least for compilation, and i'm not sure about all code paths: com/google/gwt/core/client/GWT.java com/google/gwt/core/client/JavaScriptException.java com/google/gwt/core/client/JavaScriptObject.java com/google/gwt/core/client/JsArray.java com/google/gwt/core/client/Duration.java com/google/gwt/core/client/Scheduler.java com/google/gwt/user/client/Window.java com/google/gwt/user/client/Window*.java com/google/gwt/user/client/BaseListenerWrapper.java com/google/gwt/user/client/Element.java com/google/gwt/user/client/Event.java com/google/gwt/user/client/EventListener.java com/google/gwt/user/client/EventPreview.java com/google/gwt/user/client/NativePreviewEvent.java com/google/gwt/user/client/History.java com/google/gwt/user/client/impl/HistoryImpl.java com/google/gwt/user/client/impl/DomImpl.java com/google/gwt/user/client/HistoryListener.java com/google/gwt/user/client/Cookies.java com/google/gwt/user/client/ui/Widget.java com/google/gwt/user/client/ui/HasWidgets.java com/google/gwt/user/client/ui/AbsolutePanel.java com/google/gwt/user/client/ui/ComplexPanel.java com/google/gwt/user/client/ui/IndexedPanel.java com/google/gwt/user/client/ui/InsertPanel.java com/google/gwt/user/client/ui/Panel.java com/google/gwt/user/client/ui/AttachDetachException.java com/google/gwt/user/client/ui/UIObject.java com/google/gwt/user/client/ui/RootPanel.java com/google/gwt/user/client/ui/WidgetCollection.java com/google/gwt/event/dom/client/HasNativeEvent.java com/google/gwt/event/dom/client/PrivateMap.java com/google/gwt/event/dom/client/DomEvent.java com/google/gwt/user/client/DOM.java com/google/gwt/user/client/impl/DOMImpl.java com/google/gwt/user/client/impl/WindowImpl.java com/google/gwt/dom/client/*.java com/google/gwt/core/client/impl/Impl.java com/google/gwt/core/client/impl/StackTraceCreator.java com/google/gwt/core/client/impl/SchedulerImpl.java com/google/gwt/core/client/impl/AsyncFragmentLoader.java com/google/gwt/core/client/JsArrayInteger.java com/google/gwt/core/client/JsArrayString.java com/google/gwt/core/client/RunAsyncCallback.java com/google/gwt/i18n/client/constants/*.java com/google/gwt/i18n/client/impl/*.java com/google/gwt/i18n/client/*.java As you might guess, I made that list by making gwt-servlet compile itself instead of using user, which probably isn't smart from a compile-time perspective. We can look at exactly what's "really" reachable from the server and shared root set, to see if we can prune at least the silly ones like DomEvent. My main objective, though, is to get to a whitelist approach at all. Anyone think that's a bad idea? -- http://groups.google.com/group/Google-Web-Toolkit-Contributors
