If a non-public class is forced into the serialized form page using @serial, and the class has a serializable superclass, the superclass is a vital part of the specification of the non-public class, but there is no indication anywhere in the output as to what the superclass must be. As an example, look at the output produced for java.net.SocketPermissionCollection; it should be specified that this has java.security.PermissionCollection as its superclass, but there is no such indication.

N/A

Are you suggesting that the java.net.SocketPermissionCollection class
simply have a link to its superclass, or that the superclass actually
appear in the serialized form page?

java.security.PermissionCollection (public, serializable)
  |
  +-java.net.SocketPermissionCollection (package-private, serializable)


Declarations and @serial tags are:

/**
 * (no @serial tag)
 */
public abstract class PermissionCollection extends Object implements Serializable

/**
 * @serial include 
 */
final class SocketPermissionCollection extends PermissionCollection implements Serializable

  xxxxx@xxxxx   2002-04-26

Bob's suggestion to add the "extends" clause is the way to go.
  xxxxx@xxxxx   2002-04-30

I have fixed this bug. The bug fix is pending review.
  xxxxx@xxxxx   2002-07-08

I have putback this fix.
  xxxxx@xxxxx   2002-09-30