...
When defensive copying is necessary, make the defensive copies before parameter validation, and validate the copies rather than the original parameters. See rule SER07-J. Make defensive copies of private mutable components during deserialization for additional information.
...