了解非最终类的克隆方法

Question

I'm reading J. Bloch's effective java and now I'm at the section 39 (making defensive copy). He mentioned that it's not good to make defensive copies through the clone method, because:

Note also that we did not use Date's clone method to make the defensive copies. Because Date is nonfinal, the clone method is not guaranteed to return an object whose class is java.util.Date: it could return an instance of an untrusted subclass specifically designed for malicious mischief.

The emphasized statement is not apparent to me. Actually, let's consut with the javadocs . There was no any reference about creating subclasses. The only we can be sure about is this:

this method creates a new instance of the class of this object and initializes all its fields with exactly the contents of the corresponding fields of this object, as if by assignment; the contents of the fields are not themselves cloned.

So why did J. Bloch say that it could create the subclass ? Couldn't you explain how it implies from the javadoc (I can't see that on my own).

Answer 1

It is implicit in the Javadocs quote: The class of "this" object can be a subclass of the declared type of the variable referencing the object (due to polymorphism). The clone method is protected so it can be invoked in a subclass of a certain class.

public class Test {
    public static void main(String[] args) throws Exception {
        Foo foo = new Bar();
        Foo copyOfFoo = createCopyOfFoo(foo);
        System.out.println(copyOfFoo);
    }


    private static Foo createCopyOfFoo(Foo foo) throws CloneNotSupportedException {
        Foo clone = (Foo) foo.clone();
        return clone;
    }
}

class Foo implements Cloneable {
    @Override
    protected Object clone() throws CloneNotSupportedException {
        return super.clone();
    }
}

class Bar extends Foo {
    private int x = 1;

    @Override
    public String toString() {
        return "Bar [x=" + x + "]";
    }
}

Output:

Bar [x=1]