Question

Personally, I think inheritance is a great tool, that, when applied reasonably, can greatly simplify code.

However, I seems to me that many modern tools dislike inheritance. Let’s take a simple example: Serialize a class to XML. As soon as inheritance is involved, this can easily turn into a mess. Especially if you’re trying to serialize a derived class using the base class serializer.

Sure, we can work around that. Something like a KnownType attribute and stuff. Besides being an itch in your code that you have to remember to update every time you add a derived class, that fails, too, if you receive a class from outside your scope that was not known at compile time. (Okay, in some cases you can still work around that, for instance using the NetDataContract serializer in .NET. Surely a certain advancement.)

In any case, the basic principle still exists: Serialization and inheritance don’t mix well. Considering the huge list of programming strategies that became possible and even common in the past decade, I feel tempted to say that inheritance should be avoided in areas that relate to serialization (in particular remoting and databases).

Does that make sense? Or am messing things up? How do you handle inheritance and serialization?

Answer 1

There are indeed a few gotcha with inheritance and serialization. One is that it leads to an asymmetry between serialization/deserialization. If a class is subclassed, this will work transparently during serialization, but will fail during deserialization, unless the deserialization is made aware of the new class. That’s why we have tags such as @SeeAlso to annotate data for XML serialization.

These problems are however not new about inheritance. It’s frequently discussed under the terminology open/closed world. Either you consider you know the whole world and classes, or you might be in a case where new classes are added by third-parties. In a closed world assumption, serialization isn’t much a problem. It’s more problematic in an open world assumption.

But inheritance and the open world assumption have anyway other gotchas. E.g. if you remove a protected method in your classes and refactor accordingly, how can you ensure that there isn’t a third party class that was using it? In an open world, the public and internal API of your classes must be considered as frozen once made available to other. And you must take great care to evolve the system.

There are other more technical internal details of how serialization works that can be surprising. That’s for Java, but I’m pretty sure .NET has similarities. E.g. Serialization Killer, by Gilad Bracha, or Serialization and security manager bug exploit.