{"record":{"id":"05d950b5ef035960","repo":"pinpoint-apm/pinpoint","slug":"cannot-access-classloader-defineclass-string-byte","errorCode":null,"errorMessage":"Cannot access ClassLoader.defineClass(String, byte[], int, int)","messagePattern":"Cannot access ClassLoader\\.defineClass\\(String, byte\\[\\], int, int\\)","errorType":"exception","errorClass":"IllegalStateException","httpStatus":null,"severity":"critical","filePath":"agent-module/profiler/src/main/java/com/navercorp/pinpoint/profiler/instrument/classloading/ReflectionDefineClass.java","lineNumber":38,"sourceCode":"import org.apache.logging.log4j.Logger;\n\nimport java.lang.reflect.InvocationTargetException;\nimport java.lang.reflect.Method;\n\n/**\n * @author Woonduk Kang(emeroad)\n */\nfinal class ReflectionDefineClass implements DefineClass {\n\n    private final Logger logger = LogManager.getLogger(this.getClass());\n\n    private static final Method DEFINE_CLASS;\n    static {\n        try {\n            DEFINE_CLASS = ClassLoader.class.getDeclaredMethod(\"defineClass\", String.class, byte[].class, int.class, int.class);\n            DEFINE_CLASS.setAccessible(true);\n        } catch (ReflectiveOperationException e) {\n            throw new IllegalStateException(\"Cannot access ClassLoader.defineClass(String, byte[], int, int)\", e);\n        }\n    }\n\n    @Override\n    public Class<?> defineClass(ClassLoader classLoader, String name, byte[] bytes) {\n        if (logger.isDebugEnabled()) {\n            logger.debug(\"define class:{} cl:{}\", name, classLoader);\n        }\n        try {\n            return (Class<?>) DEFINE_CLASS.invoke(classLoader, name, bytes, 0, bytes.length);\n        } catch (InvocationTargetException e) {\n            // unwrap: the message of the LinkageError/ClassFormatError thrown by the VM is on the cause\n            final Throwable cause = e.getCause() != null ? e.getCause() : e;\n            throw handleDefineClassFail(classLoader, name, cause);\n        } catch (ReflectiveOperationException e) {\n            throw handleDefineClassFail(classLoader, name, e);\n        }\n    }","sourceCodeStart":20,"sourceCodeEnd":56,"githubUrl":"https://github.com/pinpoint-apm/pinpoint/blob/744c3d3075e595656abb1ae331ad2c0e4c9eb996/agent-module/profiler/src/main/java/com/navercorp/pinpoint/profiler/instrument/classloading/ReflectionDefineClass.java#L20-L56","documentation":"ReflectionDefineClass obtains a reflective handle to the protected ClassLoader.defineClass(String, byte[], int, int) method in a static initializer and calls setAccessible(true). If the JVM refuses (method missing or reflective access denied by the module system / SecurityManager), an IllegalStateException is thrown during class initialization, failing agent startup before any plugin is loaded. Pinpoint uses this to define plugin classes into arbitrary application classloaders.","triggerScenarios":"The agent runs on a JVM where ClassLoader.getDeclaredMethod(\"defineClass\", ...) fails or setAccessible(true) is rejected: JDK 9+ with strong encapsulation and no --add-opens for java.lang, a SecurityManager denying ReflectPermission(\"suppressAccessChecks\"), or an exotic/hardened JVM that hides defineClass.","commonSituations":"Upgrading the target app to JDK 16+ where default strong encapsulation blocks setAccessible on JDK internals; containers applying legacy SecurityManager policies; running the agent on an unsupported or custom JDK build.","solutions":["Add the required JVM flags: --add-opens java.base/java.lang=ALL-UNNAMED (plus any others listed in the agent startup log) to the application's launch command.","Remove or relax the SecurityManager policy so ReflectPermission(\"suppressAccessChecks\") is granted to the pinpoint agent codebase.","Verify the pinpoint agent version is certified for your JDK; upgrade the agent if running on a newer JDK that changed access rules.","If the SecurityManager is not actually required, disable it (e.g. -Djava.security.manager=allow is not enough on newer JDKs — remove the manager).","Confirm the JVM is a standard OpenJDK/HotSpot build supported by pinpoint, not a hardened variant stripping protected members."],"exampleFix":"// before\njava -jar app.jar\n// after\njava --add-opens java.base/java.lang=ALL-UNNAMED -javaagent:$AGENT_HOME/pinpoint-bootstrap.jar -jar app.jar","handlingStrategy":"validation","validationCode":"// preflight check before enabling the pinpoint agent on a new JVM\nboolean canDefine = false;\ntry {\n    Method m = ClassLoader.class.getDeclaredMethod(\"defineClass\", String.class, byte[].class, int.class, int.class);\n    m.setAccessible(true);\n    canDefine = true;\n} catch (ReflectiveOperationException e) {\n    System.err.println(\"Agent unsupported: need --add-opens java.base/java.lang=ALL-UNNAMED\");\n}\nif (!canDefine) throw new IllegalStateException(\"JVM blocks ClassLoader.defineClass reflection; add --add-opens flags\");","typeGuard":"static boolean supportsReflectiveDefineClass() {\n    try {\n        Method m = ClassLoader.class.getDeclaredMethod(\"defineClass\", String.class, byte[].class, int.class, int.class);\n        m.setAccessible(true);\n        return true;\n    } catch (ReflectiveOperationException | SecurityException e) {\n        return false;\n    }\n}","tryCatchPattern":"try {\n    agentBootstrap.start();\n} catch (IllegalStateException e) {\n    if (e.getMessage().contains(\"Cannot access ClassLoader.defineClass\")) {\n        System.err.println(\"Restart JVM with: --add-opens java.base/java.lang=ALL-UNNAMED\");\n    } else throw e;\n}","preventionTips":["Include --add-opens flags in the standard JVM launch template for every environment.","Test agent startup on the exact JDK build (including vendor/custom builds) before rollout.","Audit SecurityManager policies; grant ReflectPermission(\"suppressAccessChecks\") to the agent codebase or drop the SecurityManager.","Track pinpoint agent release notes for JDK support before upgrading the runtime."],"tags":["java","reflection","pinpoint-agent","jdk9-modules","startup"],"backgroundTag":"reflective-access-denied","analyzedSha":"744c3d3075e595656abb1ae331ad2c0e4c9eb996","analyzedAt":"2026-09-07T18:48:45.289Z","contentChangedAt":"2026-09-07T18:48:45.289Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}