Every Class object contains a reference to the ClassLoader that defined it.

Class objects for array classes are not created by class loaders, but are created automatically as required by the Java runtime. The class loader for an array class, as returned by getClassLoader() is the same as the class loader for its element type; if the element type is a primitive type, then the array class has no class loader.

Applications implement subclasses of ClassLoader in order to extend the manner in which the Java virtual machine dynamically loads classes.

Class loaders may typically be used by security managers to indicate security domains.

The ClassLoader class uses a delegation model to search for classes and resources. Each instance of ClassLoader has an associated parent class loader. When requested to find a class or resource, a ClassLoader instance will delegate the search for the class or resource to its parent class loader before attempting to find the class or resource itself. The virtual machine's built-in class loader, called the "bootstrap class loader", does not itself have a parent but may serve as the parent of a ClassLoader instance.

Normally, the Java virtual machine loads classes from the local file system in a platform-dependent manner. For example, on UNIX systems, the virtual machine loads classes from the directory defined by the CLASSPATH environment variable.

However, some classes may not originate from a file; they may originate from other sources, such as the network, or they could be constructed by an application. The method defineClass converts an array of bytes into an instance of class Class. Instances of this newly defined class can be created using Class.newInstance.

The methods and constructors of objects created by a class loader may reference other classes. To determine the class(es) referred to, the Java virtual machine invokes the loadClass method of the class loader that originally created the class.

For example, an application could create a network class loader to download class files from a server. Sample code might look like:

 
ClassLoader loader = new NetworkClassLoader(host, port); 
Object main = loader.loadClass("Main", true).newInstance(); 
 . . . 

The network class loader subclass must define the methods findClass and loadClassData to load a class from the network. Once it has downloaded the bytes that make up the class, it should use the method defineClass to create a class instance. A sample implementation is:

 
class NetworkClassLoader extends ClassLoader { 
String host; 
int port; 

public Class findClass(String name) { 
byte[] b = loadClassData(name); 
return defineClass(name, b, 0, b.length); 
} 

private byte[] loadClassData(String name) { 
// load the class data from the connection 
 . . . 
} 
} 

If there is a security manager, its checkCreateClassLoader method is invoked. This may result in a security exception.

If there is a security manager, its checkCreateClassLoader method is invoked. This may result in a security exception.

This method is first invoked early in the runtime's startup sequence, at which point it creates the system class loader and sets it as the context class loader of the invoking Thread.

The default system class loader is an implementation-dependent instance of this class.

If the system property "java.system.class.loader" is defined when this method is first invoked then the value of that property is taken to be the name of a class that will be returned as the system class loader. The class is loaded using the default system class loader and must define a public constructor that takes a single parameter of type ClassLoader which is used as the delegation parent. An instance is then created using this constructor with the default system class loader as the parameter. The resulting class loader is defined to be the system class loader.

If a security manager is present, and the invoker's class loader is not null and the invoker's class loader is not the same as or an ancestor of the system class loader, then this method invokes the security manager's checkPermission method with a RuntimePermission("getClassLoader") permission to verify access to the system class loader. If not, a SecurityException will be thrown.

The search order is described in the documentation for getSystemResource(String).

This method assigns a default ProtectionDomain to the newly defined class. The ProtectionDomain is effectively granted the same set of permissions returned when CodeSource(null,null)) is invoked. The default domain is created on the first invocation of defineClass, and re-used on subsequent invocations.

To assign a specific ProtectionDomain to the class, use the defineClass method that takes a ProtectionDomain as one of its arguments.

The first class defined in a package determines the exact set of certificates that all subsequent classes defined in that package must contain. The set of certificates for a class is obtained from the CodeSource within the ProtectionDomain of the class. Any classes added to that package must contain the same set of certificates or a SecurityException will be thrown. Note that if the name argument is null, this check is not performed. You should always pass in the name of the class you are defining as well as the bytes. This ensures that the class you are defining is indeed the class you think it is.

The specified class name cannot begin with "java.", since all classes in the "java.* packages can only be defined by the bootstrap class loader. If the name parameter is not null, it must be equal to the name of the class specified by the byte array "b", otherwise a NoClassDefFoundError will be thrown.

This method loads the class through the system class loader (see getSystemClassLoader()). The Class object returned might have more than one ClassLoader associated with it. Subclasses of ClassLoader need not usually invoke this method, because most class loaders need to override just findClass(String).

If a security manager is present, and the invoker's class loader is not null and is not an ancestor of this class loader, then this method invokes the security manager's checkPermission method with a RuntimePermission("getClassLoader") permission to verify access to the parent class loader is permitted. If not, a SecurityException will be thrown.

The name of a resource is a '/'-separated path name that identifies the resource.

This method will first search the parent class loader for the resource; if the parent is null the path of the class loader built-in to the virtual machine is searched. That failing, this method will invoke findResource(String) to find the resource.

The search order is described in the documentation for getResource(String).

The name of a resource is a /-separated path name that identifies the resource.

The search order is described in the documentation for getResource(String).

1. Invoke findLoadedClass(String) to check if the class has already been loaded.

2. Invoke the loadClass method on the parent class loader. If the parent is null the class loader built-in to the virtual machine is used, instead.

3. Invoke the findClass(String) method to find the class.

If the class was found using the above steps, and the resolve flag is true, this method will then invoke the resolveClass(Class) method on the resulting Class object.

Subclasses of ClassLoader are encouraged to override findClass(String), rather than this method.

If the named class is not a top-level class, this invocation will have no effect on the actual assertion status of any class, and its return value is undefined.

A subpackage of a package named p is any package whose name begins with "p.". For example, javax.swing.text is a subpackage of javax.swing, and both java.util and java.lang.reflect are subpackages of java.

In the event that multiple package defaults apply to a given class, the package default pertaining to the most specific package takes precedence over the others. For example, if javax.lang and javax.lang.reflect both have package defaults associated with them, the latter package default applies to classes in javax.lang.reflect.

Package defaults take precedence over the class loader's default assertion status, and may be overridden on a per-class basis by invoking setClassAssertionStatus(String,boolean).