docs: public static final Object getAsObject(byte[] bytes, ExternalContext ctx)
      {
          ByteArrayInputStream input = null;
  
          try
          {
              input = new ByteArrayInputStream(bytes);
  
              // get the Factory that was instantiated @ startup
              SerialFactory serialFactory = (SerialFactory) ctx.getApplicationMap().get(SERIAL_FACTORY);
              
              if(serialFactory == null)
              {
                  throw new NullPointerException("serialFactory");
              }
              
              ObjectInputStream s = null;
              Exception pendingException = null;
              try
              {
                  s = serialFactory.getObjectInputStream(input); 
                  Object object = null;
                  if (System.getSecurityManager() != null)
                  {
                      final ObjectInputStream ois = s;
                      object = AccessController.doPrivileged(new PrivilegedExceptionAction<Object>()
                      {
                          //Put IOException and ClassNotFoundException as "checked" exceptions,
                          //so AccessController wrap them in a PrivilegedActionException
                          public Object run() throws PrivilegedActionException, 
                                                     IOException, ClassNotFoundException
                          {
                              return ois.readObject();
                          }
                      });
                      // Since s has the same instance as ois,
                      // we don't need to close it here, rather
                      // close it on the finally block related to s
                      // and avoid duplicate close exceptions
                      // finally
                      // {
                      //    ois.close();
                      // }
                  }
                  else
                  {
                      object = s.readObject();
                  }
                  return object;
              }
              catch (Exception e)
              {
                  pendingException = e;
                  throw new FacesException(e);
              }
              finally
              {
                  if (s != null)
                  {
                      try
                      {
                          s.close();
                      }
                      catch (IOException e)
                      {
                          // If a previous exception is thrown 
                          // ignore this, but if not, wrap it in a
                          // FacesException and throw it. In this way
                          // we preserve the original semantic of this
                          // method, but we handle correctly the case
                          // when we close a stream. Obviously, the 
                          // information about this exception is lost,
                          // but note that the interesting information 
                          // is always on pendingException, since we
                          // only do a readObject() on the outer try block.
                          if (pendingException == null)
                          {
                              throw new FacesException(e);
                          }                        
                      }
                      finally
                      {
                          s = null;
                      }
                  }
              }
          }
          finally
          {
              if (input != null)
              {
                  try
                  {
                      input.close();
                  }
                  catch (IOException e)
                  {
                      //ignore it, because ByteArrayInputStream.close has
                      //no effect, but it is better to call close and preserve
                      //semantic from previous code.
                  }
                  finally
                  {
                      input = null;
                  }
              }
          }
      }