1 /*
   2  * Copyright (c) 1998, 2019, Oracle and/or its affiliates. All rights reserved.
   3  * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
   4  *
   5  * This code is free software; you can redistribute it and/or modify it
   6  * under the terms of the GNU General Public License version 2 only, as
   7  * published by the Free Software Foundation.
   8  *
   9  * This code is distributed in the hope that it will be useful, but WITHOUT
  10  * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
  11  * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
  12  * version 2 for more details (a copy is included in the LICENSE file that
  13  * accompanied this code).
  14  *
  15  * You should have received a copy of the GNU General Public License version
  16  * 2 along with this work; if not, write to the Free Software Foundation,
  17  * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
  18  *
  19  * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
  20  * or visit www.oracle.com if you need additional information or have any
  21  * questions.
  22  *
  23  */
  24 
  25 #include "precompiled.hpp"
  26 #include "jvm.h"
  27 #include "classfile/classFileStream.hpp"
  28 #include "classfile/classLoader.hpp"
  29 #include "classfile/javaClasses.hpp"
  30 #include "classfile/stackMapTable.hpp"
  31 #include "classfile/stackMapFrame.hpp"
  32 #include "classfile/stackMapTableFormat.hpp"
  33 #include "classfile/symbolTable.hpp"
  34 #include "classfile/systemDictionary.hpp"
  35 #include "classfile/verifier.hpp"
  36 #include "classfile/vmSymbols.hpp"
  37 #include "interpreter/bytecodes.hpp"
  38 #include "interpreter/bytecodeStream.hpp"
  39 #include "logging/log.hpp"
  40 #include "logging/logStream.hpp"
  41 #include "memory/oopFactory.hpp"
  42 #include "memory/resourceArea.hpp"
  43 #include "memory/universe.hpp"
  44 #include "oops/constantPool.inline.hpp"
  45 #include "oops/instanceKlass.hpp"
  46 #include "oops/oop.inline.hpp"
  47 #include "oops/typeArrayOop.hpp"
  48 #include "runtime/fieldDescriptor.hpp"
  49 #include "runtime/handles.inline.hpp"
  50 #include "runtime/interfaceSupport.inline.hpp"
  51 #include "runtime/javaCalls.hpp"
  52 #include "runtime/jniHandles.inline.hpp"
  53 #include "runtime/orderAccess.hpp"
  54 #include "runtime/os.hpp"
  55 #include "runtime/safepointVerifiers.hpp"
  56 #include "runtime/thread.hpp"
  57 #include "services/threadService.hpp"
  58 #include "utilities/align.hpp"
  59 #include "utilities/bytes.hpp"
  60 
  61 #define NOFAILOVER_MAJOR_VERSION                       51
  62 #define NONZERO_PADDING_BYTES_IN_SWITCH_MAJOR_VERSION  51
  63 #define STATIC_METHOD_IN_INTERFACE_MAJOR_VERSION       52
  64 #define VALUETYPE_MAJOR_VERSION                        56
  65 #define MAX_ARRAY_DIMENSIONS 255
  66 
  67 // Access to external entry for VerifyClassCodes - old byte code verifier
  68 
  69 extern "C" {
  70   typedef jboolean (*verify_byte_codes_fn_t)(JNIEnv *, jclass, char *, jint);
  71   typedef jboolean (*verify_byte_codes_fn_new_t)(JNIEnv *, jclass, char *, jint, jint);
  72 }
  73 
  74 static void* volatile _verify_byte_codes_fn = NULL;
  75 
  76 static volatile jint _is_new_verify_byte_codes_fn = (jint) true;
  77 
  78 static void* verify_byte_codes_fn() {
  79   if (OrderAccess::load_acquire(&_verify_byte_codes_fn) == NULL) {
  80     void *lib_handle = os::native_java_library();
  81     void *func = os::dll_lookup(lib_handle, "VerifyClassCodesForMajorVersion");
  82     OrderAccess::release_store(&_verify_byte_codes_fn, func);
  83     if (func == NULL) {
  84       _is_new_verify_byte_codes_fn = false;
  85       func = os::dll_lookup(lib_handle, "VerifyClassCodes");
  86       OrderAccess::release_store(&_verify_byte_codes_fn, func);
  87     }
  88   }
  89   return (void*)_verify_byte_codes_fn;
  90 }
  91 
  92 
  93 // Methods in Verifier
  94 
  95 bool Verifier::should_verify_for(oop class_loader, bool should_verify_class) {
  96   return (class_loader == NULL || !should_verify_class) ?
  97     BytecodeVerificationLocal : BytecodeVerificationRemote;
  98 }
  99 
 100 bool Verifier::relax_access_for(oop loader) {
 101   bool trusted = java_lang_ClassLoader::is_trusted_loader(loader);
 102   bool need_verify =
 103     // verifyAll
 104     (BytecodeVerificationLocal && BytecodeVerificationRemote) ||
 105     // verifyRemote
 106     (!BytecodeVerificationLocal && BytecodeVerificationRemote && !trusted);
 107   return !need_verify;
 108 }
 109 
 110 void Verifier::trace_class_resolution(Klass* resolve_class, InstanceKlass* verify_class) {
 111   assert(verify_class != NULL, "Unexpected null verify_class");
 112   ResourceMark rm;
 113   Symbol* s = verify_class->source_file_name();
 114   const char* source_file = (s != NULL ? s->as_C_string() : NULL);
 115   const char* verify = verify_class->external_name();
 116   const char* resolve = resolve_class->external_name();
 117   // print in a single call to reduce interleaving between threads
 118   if (source_file != NULL) {
 119     log_debug(class, resolve)("%s %s %s (verification)", verify, resolve, source_file);
 120   } else {
 121     log_debug(class, resolve)("%s %s (verification)", verify, resolve);
 122   }
 123 }
 124 
 125 // Prints the end-verification message to the appropriate output.
 126 void Verifier::log_end_verification(outputStream* st, const char* klassName, Symbol* exception_name, TRAPS) {
 127   if (HAS_PENDING_EXCEPTION) {
 128     st->print("Verification for %s has", klassName);
 129     st->print_cr(" exception pending %s ",
 130                  PENDING_EXCEPTION->klass()->external_name());
 131   } else if (exception_name != NULL) {
 132     st->print_cr("Verification for %s failed", klassName);
 133   }
 134   st->print_cr("End class verification for: %s", klassName);
 135 }
 136 
 137 bool Verifier::verify(InstanceKlass* klass, bool should_verify_class, TRAPS) {
 138   HandleMark hm(THREAD);
 139   ResourceMark rm(THREAD);
 140 
 141   // Eagerly allocate the identity hash code for a klass. This is a fallout
 142   // from 6320749 and 8059924: hash code generator is not supposed to be called
 143   // during the safepoint, but it allows to sneak the hashcode in during
 144   // verification. Without this eager hashcode generation, we may end up
 145   // installing the hashcode during some other operation, which may be at
 146   // safepoint -- blowing up the checks. It was previously done as the side
 147   // effect (sic!) for external_name(), but instead of doing that, we opt to
 148   // explicitly push the hashcode in here. This is signify the following block
 149   // is IMPORTANT:
 150   if (klass->java_mirror() != NULL) {
 151     klass->java_mirror()->identity_hash();
 152   }
 153 
 154   if (!is_eligible_for_verification(klass, should_verify_class)) {
 155     return true;
 156   }
 157 
 158   // Timer includes any side effects of class verification (resolution,
 159   // etc), but not recursive calls to Verifier::verify().
 160   JavaThread* jt = (JavaThread*)THREAD;
 161   PerfClassTraceTime timer(ClassLoader::perf_class_verify_time(),
 162                            ClassLoader::perf_class_verify_selftime(),
 163                            ClassLoader::perf_classes_verified(),
 164                            jt->get_thread_stat()->perf_recursion_counts_addr(),
 165                            jt->get_thread_stat()->perf_timers_addr(),
 166                            PerfClassTraceTime::CLASS_VERIFY);
 167 
 168   // If the class should be verified, first see if we can use the split
 169   // verifier.  If not, or if verification fails and can failover, then
 170   // call the inference verifier.
 171   Symbol* exception_name = NULL;
 172   const size_t message_buffer_len = klass->name()->utf8_length() + 1024;
 173   char* message_buffer = NULL;
 174   char* exception_message = NULL;
 175 
 176   log_info(class, init)("Start class verification for: %s", klass->external_name());
 177   if (klass->major_version() >= STACKMAP_ATTRIBUTE_MAJOR_VERSION) {
 178     ClassVerifier split_verifier(klass, THREAD);
 179     split_verifier.verify_class(THREAD);
 180     exception_name = split_verifier.result();
 181 
 182     // If DumpSharedSpaces is set then don't fall back to the old verifier on
 183     // verification failure. If a class fails verification with the split verifier,
 184     // it might fail the CDS runtime verifier constraint check. In that case, we
 185     // don't want to share the class. We only archive classes that pass the split
 186     // verifier.
 187     bool can_failover = !DumpSharedSpaces &&
 188       klass->major_version() < NOFAILOVER_MAJOR_VERSION;
 189 
 190     if (can_failover && !HAS_PENDING_EXCEPTION &&  // Split verifier doesn't set PENDING_EXCEPTION for failure
 191         (exception_name == vmSymbols::java_lang_VerifyError() ||
 192          exception_name == vmSymbols::java_lang_ClassFormatError())) {
 193       log_info(verification)("Fail over class verification to old verifier for: %s", klass->external_name());
 194       log_info(class, init)("Fail over class verification to old verifier for: %s", klass->external_name());
 195       message_buffer = NEW_RESOURCE_ARRAY(char, message_buffer_len);
 196       exception_message = message_buffer;
 197       exception_name = inference_verify(
 198         klass, message_buffer, message_buffer_len, THREAD);
 199     }
 200     if (exception_name != NULL) {
 201       exception_message = split_verifier.exception_message();
 202     }
 203   } else {
 204     message_buffer = NEW_RESOURCE_ARRAY(char, message_buffer_len);
 205     exception_message = message_buffer;
 206     exception_name = inference_verify(
 207         klass, message_buffer, message_buffer_len, THREAD);
 208   }
 209 
 210   LogTarget(Info, class, init) lt1;
 211   if (lt1.is_enabled()) {
 212     LogStream ls(lt1);
 213     log_end_verification(&ls, klass->external_name(), exception_name, THREAD);
 214   }
 215   LogTarget(Info, verification) lt2;
 216   if (lt2.is_enabled()) {
 217     LogStream ls(lt2);
 218     log_end_verification(&ls, klass->external_name(), exception_name, THREAD);
 219   }
 220 
 221   if (HAS_PENDING_EXCEPTION) {
 222     return false; // use the existing exception
 223   } else if (exception_name == NULL) {
 224     return true; // verification succeeded
 225   } else { // VerifyError or ClassFormatError to be created and thrown
 226     Klass* kls =
 227       SystemDictionary::resolve_or_fail(exception_name, true, CHECK_false);
 228     if (log_is_enabled(Debug, class, resolve)) {
 229       Verifier::trace_class_resolution(kls, klass);
 230     }
 231 
 232     while (kls != NULL) {
 233       if (kls == klass) {
 234         // If the class being verified is the exception we're creating
 235         // or one of it's superclasses, we're in trouble and are going
 236         // to infinitely recurse when we try to initialize the exception.
 237         // So bail out here by throwing the preallocated VM error.
 238         THROW_OOP_(Universe::virtual_machine_error_instance(), false);
 239       }
 240       kls = kls->super();
 241     }
 242     if (message_buffer != NULL) {
 243       message_buffer[message_buffer_len - 1] = '\0'; // just to be sure
 244     }
 245     assert(exception_message != NULL, "");
 246     THROW_MSG_(exception_name, exception_message, false);
 247   }
 248 }
 249 
 250 bool Verifier::is_eligible_for_verification(InstanceKlass* klass, bool should_verify_class) {
 251   Symbol* name = klass->name();
 252   Klass* refl_magic_klass = SystemDictionary::reflect_MagicAccessorImpl_klass();
 253 
 254   bool is_reflect = refl_magic_klass != NULL && klass->is_subtype_of(refl_magic_klass);
 255 
 256   return (should_verify_for(klass->class_loader(), should_verify_class) &&
 257     // return if the class is a bootstrapping class
 258     // or defineClass specified not to verify by default (flags override passed arg)
 259     // We need to skip the following four for bootstrapping
 260     name != vmSymbols::java_lang_Object() &&
 261     name != vmSymbols::java_lang_Class() &&
 262     name != vmSymbols::java_lang_String() &&
 263     name != vmSymbols::java_lang_Throwable() &&
 264 
 265     // Can not verify the bytecodes for shared classes because they have
 266     // already been rewritten to contain constant pool cache indices,
 267     // which the verifier can't understand.
 268     // Shared classes shouldn't have stackmaps either.
 269     !klass->is_shared() &&
 270 
 271     // As of the fix for 4486457 we disable verification for all of the
 272     // dynamically-generated bytecodes associated with the 1.4
 273     // reflection implementation, not just those associated with
 274     // jdk/internal/reflect/SerializationConstructorAccessor.
 275     // NOTE: this is called too early in the bootstrapping process to be
 276     // guarded by Universe::is_gte_jdk14x_version().
 277     // Also for lambda generated code, gte jdk8
 278     (!is_reflect));
 279 }
 280 
 281 Symbol* Verifier::inference_verify(
 282     InstanceKlass* klass, char* message, size_t message_len, TRAPS) {
 283   JavaThread* thread = (JavaThread*)THREAD;
 284   JNIEnv *env = thread->jni_environment();
 285 
 286   void* verify_func = verify_byte_codes_fn();
 287 
 288   if (verify_func == NULL) {
 289     jio_snprintf(message, message_len, "Could not link verifier");
 290     return vmSymbols::java_lang_VerifyError();
 291   }
 292 
 293   ResourceMark rm(THREAD);
 294   log_info(verification)("Verifying class %s with old format", klass->external_name());
 295 
 296   jclass cls = (jclass) JNIHandles::make_local(env, klass->java_mirror());
 297   jint result;
 298 
 299   {
 300     HandleMark hm(thread);
 301     ThreadToNativeFromVM ttn(thread);
 302     // ThreadToNativeFromVM takes care of changing thread_state, so safepoint
 303     // code knows that we have left the VM
 304 
 305     if (_is_new_verify_byte_codes_fn) {
 306       verify_byte_codes_fn_new_t func =
 307         CAST_TO_FN_PTR(verify_byte_codes_fn_new_t, verify_func);
 308       result = (*func)(env, cls, message, (int)message_len,
 309           klass->major_version());
 310     } else {
 311       verify_byte_codes_fn_t func =
 312         CAST_TO_FN_PTR(verify_byte_codes_fn_t, verify_func);
 313       result = (*func)(env, cls, message, (int)message_len);
 314     }
 315   }
 316 
 317   JNIHandles::destroy_local(cls);
 318 
 319   // These numbers are chosen so that VerifyClassCodes interface doesn't need
 320   // to be changed (still return jboolean (unsigned char)), and result is
 321   // 1 when verification is passed.
 322   if (result == 0) {
 323     return vmSymbols::java_lang_VerifyError();
 324   } else if (result == 1) {
 325     return NULL; // verified.
 326   } else if (result == 2) {
 327     THROW_MSG_(vmSymbols::java_lang_OutOfMemoryError(), message, NULL);
 328   } else if (result == 3) {
 329     return vmSymbols::java_lang_ClassFormatError();
 330   } else {
 331     ShouldNotReachHere();
 332     return NULL;
 333   }
 334 }
 335 
 336 TypeOrigin TypeOrigin::null() {
 337   return TypeOrigin();
 338 }
 339 TypeOrigin TypeOrigin::local(u2 index, StackMapFrame* frame) {
 340   assert(frame != NULL, "Must have a frame");
 341   return TypeOrigin(CF_LOCALS, index, StackMapFrame::copy(frame),
 342      frame->local_at(index));
 343 }
 344 TypeOrigin TypeOrigin::stack(u2 index, StackMapFrame* frame) {
 345   assert(frame != NULL, "Must have a frame");
 346   return TypeOrigin(CF_STACK, index, StackMapFrame::copy(frame),
 347       frame->stack_at(index));
 348 }
 349 TypeOrigin TypeOrigin::sm_local(u2 index, StackMapFrame* frame) {
 350   assert(frame != NULL, "Must have a frame");
 351   return TypeOrigin(SM_LOCALS, index, StackMapFrame::copy(frame),
 352       frame->local_at(index));
 353 }
 354 TypeOrigin TypeOrigin::sm_stack(u2 index, StackMapFrame* frame) {
 355   assert(frame != NULL, "Must have a frame");
 356   return TypeOrigin(SM_STACK, index, StackMapFrame::copy(frame),
 357       frame->stack_at(index));
 358 }
 359 TypeOrigin TypeOrigin::bad_index(u2 index) {
 360   return TypeOrigin(BAD_INDEX, index, NULL, VerificationType::bogus_type());
 361 }
 362 TypeOrigin TypeOrigin::cp(u2 index, VerificationType vt) {
 363   return TypeOrigin(CONST_POOL, index, NULL, vt);
 364 }
 365 TypeOrigin TypeOrigin::signature(VerificationType vt) {
 366   return TypeOrigin(SIG, 0, NULL, vt);
 367 }
 368 TypeOrigin TypeOrigin::implicit(VerificationType t) {
 369   return TypeOrigin(IMPLICIT, 0, NULL, t);
 370 }
 371 TypeOrigin TypeOrigin::frame(StackMapFrame* frame) {
 372   return TypeOrigin(FRAME_ONLY, 0, StackMapFrame::copy(frame),
 373                     VerificationType::bogus_type());
 374 }
 375 
 376 void TypeOrigin::reset_frame() {
 377   if (_frame != NULL) {
 378     _frame->restore();
 379   }
 380 }
 381 
 382 void TypeOrigin::details(outputStream* ss) const {
 383   _type.print_on(ss);
 384   switch (_origin) {
 385     case CF_LOCALS:
 386       ss->print(" (current frame, locals[%d])", _index);
 387       break;
 388     case CF_STACK:
 389       ss->print(" (current frame, stack[%d])", _index);
 390       break;
 391     case SM_LOCALS:
 392       ss->print(" (stack map, locals[%d])", _index);
 393       break;
 394     case SM_STACK:
 395       ss->print(" (stack map, stack[%d])", _index);
 396       break;
 397     case CONST_POOL:
 398       ss->print(" (constant pool %d)", _index);
 399       break;
 400     case SIG:
 401       ss->print(" (from method signature)");
 402       break;
 403     case IMPLICIT:
 404     case FRAME_ONLY:
 405     case NONE:
 406     default:
 407       ;
 408   }
 409 }
 410 
 411 #ifdef ASSERT
 412 void TypeOrigin::print_on(outputStream* str) const {
 413   str->print("{%d,%d,%p:", _origin, _index, _frame);
 414   if (_frame != NULL) {
 415     _frame->print_on(str);
 416   } else {
 417     str->print("null");
 418   }
 419   str->print(",");
 420   _type.print_on(str);
 421   str->print("}");
 422 }
 423 #endif
 424 
 425 void ErrorContext::details(outputStream* ss, const Method* method) const {
 426   if (is_valid()) {
 427     ss->cr();
 428     ss->print_cr("Exception Details:");
 429     location_details(ss, method);
 430     reason_details(ss);
 431     frame_details(ss);
 432     bytecode_details(ss, method);
 433     handler_details(ss, method);
 434     stackmap_details(ss, method);
 435   }
 436 }
 437 
 438 void ErrorContext::reason_details(outputStream* ss) const {
 439   streamIndentor si(ss);
 440   ss->indent().print_cr("Reason:");
 441   streamIndentor si2(ss);
 442   ss->indent().print("%s", "");
 443   switch (_fault) {
 444     case INVALID_BYTECODE:
 445       ss->print("Error exists in the bytecode");
 446       break;
 447     case WRONG_TYPE:
 448       if (_expected.is_valid()) {
 449         ss->print("Type ");
 450         _type.details(ss);
 451         ss->print(" is not assignable to ");
 452         _expected.details(ss);
 453       } else {
 454         ss->print("Invalid type: ");
 455         _type.details(ss);
 456       }
 457       break;
 458     case FLAGS_MISMATCH:
 459       if (_expected.is_valid()) {
 460         ss->print("Current frame's flags are not assignable "
 461                   "to stack map frame's.");
 462       } else {
 463         ss->print("Current frame's flags are invalid in this context.");
 464       }
 465       break;
 466     case BAD_CP_INDEX:
 467       ss->print("Constant pool index %d is invalid", _type.index());
 468       break;
 469     case BAD_LOCAL_INDEX:
 470       ss->print("Local index %d is invalid", _type.index());
 471       break;
 472     case LOCALS_SIZE_MISMATCH:
 473       ss->print("Current frame's local size doesn't match stackmap.");
 474       break;
 475     case STACK_SIZE_MISMATCH:
 476       ss->print("Current frame's stack size doesn't match stackmap.");
 477       break;
 478     case STACK_OVERFLOW:
 479       ss->print("Exceeded max stack size.");
 480       break;
 481     case STACK_UNDERFLOW:
 482       ss->print("Attempt to pop empty stack.");
 483       break;
 484     case MISSING_STACKMAP:
 485       ss->print("Expected stackmap frame at this location.");
 486       break;
 487     case BAD_STACKMAP:
 488       ss->print("Invalid stackmap specification.");
 489       break;
 490     case WRONG_VALUE_TYPE:
 491       ss->print("Type ");
 492       _type.details(ss);
 493       ss->print(" and type ");
 494       _expected.details(ss);
 495       ss->print(" must be identical inline types.");
 496       break;
 497     case UNKNOWN:
 498     default:
 499       ShouldNotReachHere();
 500       ss->print_cr("Unknown");
 501   }
 502   ss->cr();
 503 }
 504 
 505 void ErrorContext::location_details(outputStream* ss, const Method* method) const {
 506   if (_bci != -1 && method != NULL) {
 507     streamIndentor si(ss);
 508     const char* bytecode_name = "<invalid>";
 509     if (method->validate_bci(_bci) != -1) {
 510       Bytecodes::Code code = Bytecodes::code_or_bp_at(method->bcp_from(_bci));
 511       if (Bytecodes::is_defined(code)) {
 512           bytecode_name = Bytecodes::name(code);
 513       } else {
 514           bytecode_name = "<illegal>";
 515       }
 516     }
 517     InstanceKlass* ik = method->method_holder();
 518     ss->indent().print_cr("Location:");
 519     streamIndentor si2(ss);
 520     ss->indent().print_cr("%s.%s%s @%d: %s",
 521         ik->name()->as_C_string(), method->name()->as_C_string(),
 522         method->signature()->as_C_string(), _bci, bytecode_name);
 523   }
 524 }
 525 
 526 void ErrorContext::frame_details(outputStream* ss) const {
 527   streamIndentor si(ss);
 528   if (_type.is_valid() && _type.frame() != NULL) {
 529     ss->indent().print_cr("Current Frame:");
 530     streamIndentor si2(ss);
 531     _type.frame()->print_on(ss);
 532   }
 533   if (_expected.is_valid() && _expected.frame() != NULL) {
 534     ss->indent().print_cr("Stackmap Frame:");
 535     streamIndentor si2(ss);
 536     _expected.frame()->print_on(ss);
 537   }
 538 }
 539 
 540 void ErrorContext::bytecode_details(outputStream* ss, const Method* method) const {
 541   if (method != NULL) {
 542     streamIndentor si(ss);
 543     ss->indent().print_cr("Bytecode:");
 544     streamIndentor si2(ss);
 545     ss->print_data(method->code_base(), method->code_size(), false);
 546   }
 547 }
 548 
 549 void ErrorContext::handler_details(outputStream* ss, const Method* method) const {
 550   if (method != NULL) {
 551     streamIndentor si(ss);
 552     ExceptionTable table(method);
 553     if (table.length() > 0) {
 554       ss->indent().print_cr("Exception Handler Table:");
 555       streamIndentor si2(ss);
 556       for (int i = 0; i < table.length(); ++i) {
 557         ss->indent().print_cr("bci [%d, %d] => handler: %d", table.start_pc(i),
 558             table.end_pc(i), table.handler_pc(i));
 559       }
 560     }
 561   }
 562 }
 563 
 564 void ErrorContext::stackmap_details(outputStream* ss, const Method* method) const {
 565   if (method != NULL && method->has_stackmap_table()) {
 566     streamIndentor si(ss);
 567     ss->indent().print_cr("Stackmap Table:");
 568     Array<u1>* data = method->stackmap_data();
 569     stack_map_table* sm_table =
 570         stack_map_table::at((address)data->adr_at(0));
 571     stack_map_frame* sm_frame = sm_table->entries();
 572     streamIndentor si2(ss);
 573     int current_offset = -1;
 574     address end_of_sm_table = (address)sm_table + method->stackmap_data()->length();
 575     for (u2 i = 0; i < sm_table->number_of_entries(); ++i) {
 576       ss->indent();
 577       if (!sm_frame->verify((address)sm_frame, end_of_sm_table)) {
 578         sm_frame->print_truncated(ss, current_offset);
 579         return;
 580       }
 581       sm_frame->print_on(ss, current_offset);
 582       ss->cr();
 583       current_offset += sm_frame->offset_delta();
 584       sm_frame = sm_frame->next();
 585     }
 586   }
 587 }
 588 
 589 // Methods in ClassVerifier
 590 
 591 VerificationType reference_or_valuetype(InstanceKlass* klass) {
 592   if (klass->is_value()) {
 593     return VerificationType::valuetype_type(klass->name());
 594   } else {
 595     return VerificationType::reference_type(klass->name());
 596   }
 597 }
 598 
 599 ClassVerifier::ClassVerifier(
 600     InstanceKlass* klass, TRAPS)
 601     : _thread(THREAD), _previous_symbol(NULL), _symbols(NULL), _exception_type(NULL),
 602       _message(NULL), _method_signatures_table(NULL), _klass(klass) {
 603   _this_type = reference_or_valuetype(klass);
 604 }
 605 
 606 ClassVerifier::~ClassVerifier() {
 607   // Decrement the reference count for any symbols created.
 608   if (_symbols != NULL) {
 609     for (int i = 0; i < _symbols->length(); i++) {
 610       Symbol* s = _symbols->at(i);
 611       s->decrement_refcount();
 612     }
 613   }
 614 }
 615 
 616 VerificationType ClassVerifier::object_type() const {
 617   return VerificationType::reference_type(vmSymbols::java_lang_Object());
 618 }
 619 
 620 TypeOrigin ClassVerifier::ref_ctx(const char* sig) {
 621   VerificationType vt = VerificationType::reference_type(
 622                          create_temporary_symbol(sig, (int)strlen(sig)));
 623   return TypeOrigin::implicit(vt);
 624 }
 625 
 626 void ClassVerifier::verify_class(TRAPS) {
 627   log_info(verification)("Verifying class %s with new format", _klass->external_name());
 628 
 629   // Either verifying both local and remote classes or just remote classes.
 630   assert(BytecodeVerificationRemote, "Should not be here");
 631 
 632   // Create hash table containing method signatures.
 633   method_signatures_table_type method_signatures_table;
 634   set_method_signatures_table(&method_signatures_table);
 635 
 636   Array<Method*>* methods = _klass->methods();
 637   int num_methods = methods->length();
 638 
 639   for (int index = 0; index < num_methods; index++) {
 640     // Check for recursive re-verification before each method.
 641     if (was_recursively_verified())  return;
 642 
 643     Method* m = methods->at(index);
 644     if (m->is_native() || m->is_abstract() || m->is_overpass()) {
 645       // If m is native or abstract, skip it.  It is checked in class file
 646       // parser that methods do not override a final method.  Overpass methods
 647       // are trusted since the VM generates them.
 648       continue;
 649     }
 650     verify_method(methodHandle(THREAD, m), CHECK_VERIFY(this));
 651   }
 652 
 653   if (was_recursively_verified()){
 654     log_info(verification)("Recursive verification detected for: %s", _klass->external_name());
 655     log_info(class, init)("Recursive verification detected for: %s",
 656                         _klass->external_name());
 657   }
 658 }
 659 
 660 // Translate the signature entries into verification types and save them in
 661 // the growable array.  Also, save the count of arguments.
 662 void ClassVerifier::translate_signature(Symbol* const method_sig,
 663                                         sig_as_verification_types* sig_verif_types,
 664                                         TRAPS) {
 665   SignatureStream sig_stream(method_sig);
 666   VerificationType sig_type[2];
 667   int sig_i = 0;
 668   GrowableArray<VerificationType>* verif_types = sig_verif_types->sig_verif_types();
 669 
 670   // Translate the signature arguments into verification types.
 671   while (!sig_stream.at_return_type()) {
 672     int n = change_sig_to_verificationType(&sig_stream, sig_type);
 673     assert(n <= 2, "Unexpected signature type");
 674 
 675     // Store verification type(s).  Longs and Doubles each have two verificationTypes.
 676     for (int x = 0; x < n; x++) {
 677       verif_types->push(sig_type[x]);
 678     }
 679     sig_i += n;
 680     sig_stream.next();
 681   }
 682 
 683   // Set final arg count, not including the return type.  The final arg count will
 684   // be compared with sig_verify_types' length to see if there is a return type.
 685   sig_verif_types->set_num_args(sig_i);
 686 
 687   // Store verification type(s) for the return type, if there is one.
 688   if (sig_stream.type() != T_VOID) {
 689     int n = change_sig_to_verificationType(&sig_stream, sig_type);
 690     assert(n <= 2, "Unexpected signature return type");
 691     for (int y = 0; y < n; y++) {
 692       verif_types->push(sig_type[y]);
 693     }
 694   }
 695 }
 696 
 697 void ClassVerifier::create_method_sig_entry(sig_as_verification_types* sig_verif_types,
 698                                             int sig_index, TRAPS) {
 699   // Translate the signature into verification types.
 700   ConstantPool* cp = _klass->constants();
 701   Symbol* const method_sig = cp->symbol_at(sig_index);
 702   translate_signature(method_sig, sig_verif_types, CHECK_VERIFY(this));
 703 
 704   // Add the list of this signature's verification types to the table.
 705   bool is_unique = method_signatures_table()->put(sig_index, sig_verif_types);
 706   assert(is_unique, "Duplicate entries in method_signature_table");
 707 }
 708 
 709 void ClassVerifier::verify_method(const methodHandle& m, TRAPS) {
 710   HandleMark hm(THREAD);
 711   _method = m;   // initialize _method
 712   log_info(verification)("Verifying method %s", m->name_and_sig_as_C_string());
 713 
 714 // For clang, the only good constant format string is a literal constant format string.
 715 #define bad_type_msg "Bad type on operand stack in %s"
 716 
 717   int32_t max_stack = m->verifier_max_stack();
 718   int32_t max_locals = m->max_locals();
 719   constantPoolHandle cp(THREAD, m->constants());
 720 
 721   // Method signature was checked in ClassFileParser.
 722   assert(SignatureVerifier::is_valid_method_signature(m->signature()),
 723          "Invalid method signature");
 724 
 725   // Initial stack map frame: offset is 0, stack is initially empty.
 726   StackMapFrame current_frame(max_locals, max_stack, this);
 727   // Set initial locals
 728   VerificationType return_type = current_frame.set_locals_from_arg(
 729     m, current_type(), CHECK_VERIFY(this));
 730 
 731   int32_t stackmap_index = 0; // index to the stackmap array
 732 
 733   u4 code_length = m->code_size();
 734 
 735   // Scan the bytecode and map each instruction's start offset to a number.
 736   char* code_data = generate_code_data(m, code_length, CHECK_VERIFY(this));
 737 
 738   int ex_min = code_length;
 739   int ex_max = -1;
 740   // Look through each item on the exception table. Each of the fields must refer
 741   // to a legal instruction.
 742   if (was_recursively_verified()) return;
 743   verify_exception_handler_table(
 744     code_length, code_data, ex_min, ex_max, CHECK_VERIFY(this));
 745 
 746   // Look through each entry on the local variable table and make sure
 747   // its range of code array offsets is valid. (4169817)
 748   if (m->has_localvariable_table()) {
 749     verify_local_variable_table(code_length, code_data, CHECK_VERIFY(this));
 750   }
 751 
 752   Array<u1>* stackmap_data = m->stackmap_data();
 753   StackMapStream stream(stackmap_data);
 754   StackMapReader reader(this, &stream, code_data, code_length, THREAD);
 755   StackMapTable stackmap_table(&reader, &current_frame, max_locals, max_stack,
 756                                code_data, code_length, CHECK_VERIFY(this));
 757 
 758   LogTarget(Info, verification) lt;
 759   if (lt.is_enabled()) {
 760     ResourceMark rm(THREAD);
 761     LogStream ls(lt);
 762     stackmap_table.print_on(&ls);
 763   }
 764 
 765   RawBytecodeStream bcs(m);
 766 
 767   // Scan the byte code linearly from the start to the end
 768   bool no_control_flow = false; // Set to true when there is no direct control
 769                                 // flow from current instruction to the next
 770                                 // instruction in sequence
 771 
 772   Bytecodes::Code opcode;
 773   while (!bcs.is_last_bytecode()) {
 774     // Check for recursive re-verification before each bytecode.
 775     if (was_recursively_verified())  return;
 776 
 777     opcode = bcs.raw_next();
 778     u2 bci = bcs.bci();
 779 
 780     // Set current frame's offset to bci
 781     current_frame.set_offset(bci);
 782     current_frame.set_mark();
 783 
 784     // Make sure every offset in stackmap table point to the beginning to
 785     // an instruction. Match current_frame to stackmap_table entry with
 786     // the same offset if exists.
 787     stackmap_index = verify_stackmap_table(
 788       stackmap_index, bci, &current_frame, &stackmap_table,
 789       no_control_flow, CHECK_VERIFY(this));
 790 
 791 
 792     bool this_uninit = false;  // Set to true when invokespecial <init> initialized 'this'
 793     bool verified_exc_handlers = false;
 794 
 795     // Merge with the next instruction
 796     {
 797       u2 index;
 798       int target;
 799       VerificationType type, type2;
 800       VerificationType atype;
 801 
 802       LogTarget(Info, verification) lt;
 803       if (lt.is_enabled()) {
 804         ResourceMark rm(THREAD);
 805         LogStream ls(lt);
 806         current_frame.print_on(&ls);
 807         lt.print("offset = %d,  opcode = %s", bci,
 808                  opcode == Bytecodes::_illegal ? "illegal" : Bytecodes::name(opcode));
 809       }
 810 
 811       // Make sure wide instruction is in correct format
 812       if (bcs.is_wide()) {
 813         if (opcode != Bytecodes::_iinc   && opcode != Bytecodes::_iload  &&
 814             opcode != Bytecodes::_aload  && opcode != Bytecodes::_lload  &&
 815             opcode != Bytecodes::_istore && opcode != Bytecodes::_astore &&
 816             opcode != Bytecodes::_lstore && opcode != Bytecodes::_fload  &&
 817             opcode != Bytecodes::_dload  && opcode != Bytecodes::_fstore &&
 818             opcode != Bytecodes::_dstore) {
 819           /* Unreachable?  RawBytecodeStream's raw_next() returns 'illegal'
 820            * if we encounter a wide instruction that modifies an invalid
 821            * opcode (not one of the ones listed above) */
 822           verify_error(ErrorContext::bad_code(bci), "Bad wide instruction");
 823           return;
 824         }
 825       }
 826 
 827       // Look for possible jump target in exception handlers and see if it
 828       // matches current_frame.  Do this check here for astore*, dstore*,
 829       // fstore*, istore*, and lstore* opcodes because they can change the type
 830       // state by adding a local.  JVM Spec says that the incoming type state
 831       // should be used for this check.  So, do the check here before a possible
 832       // local is added to the type state.
 833       if (Bytecodes::is_store_into_local(opcode) && bci >= ex_min && bci < ex_max) {
 834         if (was_recursively_verified()) return;
 835         verify_exception_handler_targets(
 836           bci, this_uninit, &current_frame, &stackmap_table, CHECK_VERIFY(this));
 837         verified_exc_handlers = true;
 838       }
 839 
 840       if (was_recursively_verified()) return;
 841 
 842       switch (opcode) {
 843         case Bytecodes::_nop :
 844           no_control_flow = false; break;
 845         case Bytecodes::_aconst_null :
 846           current_frame.push_stack(
 847             VerificationType::null_type(), CHECK_VERIFY(this));
 848           no_control_flow = false; break;
 849         case Bytecodes::_iconst_m1 :
 850         case Bytecodes::_iconst_0 :
 851         case Bytecodes::_iconst_1 :
 852         case Bytecodes::_iconst_2 :
 853         case Bytecodes::_iconst_3 :
 854         case Bytecodes::_iconst_4 :
 855         case Bytecodes::_iconst_5 :
 856           current_frame.push_stack(
 857             VerificationType::integer_type(), CHECK_VERIFY(this));
 858           no_control_flow = false; break;
 859         case Bytecodes::_lconst_0 :
 860         case Bytecodes::_lconst_1 :
 861           current_frame.push_stack_2(
 862             VerificationType::long_type(),
 863             VerificationType::long2_type(), CHECK_VERIFY(this));
 864           no_control_flow = false; break;
 865         case Bytecodes::_fconst_0 :
 866         case Bytecodes::_fconst_1 :
 867         case Bytecodes::_fconst_2 :
 868           current_frame.push_stack(
 869             VerificationType::float_type(), CHECK_VERIFY(this));
 870           no_control_flow = false; break;
 871         case Bytecodes::_dconst_0 :
 872         case Bytecodes::_dconst_1 :
 873           current_frame.push_stack_2(
 874             VerificationType::double_type(),
 875             VerificationType::double2_type(), CHECK_VERIFY(this));
 876           no_control_flow = false; break;
 877         case Bytecodes::_sipush :
 878         case Bytecodes::_bipush :
 879           current_frame.push_stack(
 880             VerificationType::integer_type(), CHECK_VERIFY(this));
 881           no_control_flow = false; break;
 882         case Bytecodes::_ldc :
 883           verify_ldc(
 884             opcode, bcs.get_index_u1(), &current_frame,
 885             cp, bci, CHECK_VERIFY(this));
 886           no_control_flow = false; break;
 887         case Bytecodes::_ldc_w :
 888         case Bytecodes::_ldc2_w :
 889           verify_ldc(
 890             opcode, bcs.get_index_u2(), &current_frame,
 891             cp, bci, CHECK_VERIFY(this));
 892           no_control_flow = false; break;
 893         case Bytecodes::_iload :
 894           verify_iload(bcs.get_index(), &current_frame, CHECK_VERIFY(this));
 895           no_control_flow = false; break;
 896         case Bytecodes::_iload_0 :
 897         case Bytecodes::_iload_1 :
 898         case Bytecodes::_iload_2 :
 899         case Bytecodes::_iload_3 :
 900           index = opcode - Bytecodes::_iload_0;
 901           verify_iload(index, &current_frame, CHECK_VERIFY(this));
 902           no_control_flow = false; break;
 903         case Bytecodes::_lload :
 904           verify_lload(bcs.get_index(), &current_frame, CHECK_VERIFY(this));
 905           no_control_flow = false; break;
 906         case Bytecodes::_lload_0 :
 907         case Bytecodes::_lload_1 :
 908         case Bytecodes::_lload_2 :
 909         case Bytecodes::_lload_3 :
 910           index = opcode - Bytecodes::_lload_0;
 911           verify_lload(index, &current_frame, CHECK_VERIFY(this));
 912           no_control_flow = false; break;
 913         case Bytecodes::_fload :
 914           verify_fload(bcs.get_index(), &current_frame, CHECK_VERIFY(this));
 915           no_control_flow = false; break;
 916         case Bytecodes::_fload_0 :
 917         case Bytecodes::_fload_1 :
 918         case Bytecodes::_fload_2 :
 919         case Bytecodes::_fload_3 :
 920           index = opcode - Bytecodes::_fload_0;
 921           verify_fload(index, &current_frame, CHECK_VERIFY(this));
 922           no_control_flow = false; break;
 923         case Bytecodes::_dload :
 924           verify_dload(bcs.get_index(), &current_frame, CHECK_VERIFY(this));
 925           no_control_flow = false; break;
 926         case Bytecodes::_dload_0 :
 927         case Bytecodes::_dload_1 :
 928         case Bytecodes::_dload_2 :
 929         case Bytecodes::_dload_3 :
 930           index = opcode - Bytecodes::_dload_0;
 931           verify_dload(index, &current_frame, CHECK_VERIFY(this));
 932           no_control_flow = false; break;
 933         case Bytecodes::_aload :
 934           verify_aload(bcs.get_index(), &current_frame, CHECK_VERIFY(this));
 935           no_control_flow = false; break;
 936         case Bytecodes::_aload_0 :
 937         case Bytecodes::_aload_1 :
 938         case Bytecodes::_aload_2 :
 939         case Bytecodes::_aload_3 :
 940           index = opcode - Bytecodes::_aload_0;
 941           verify_aload(index, &current_frame, CHECK_VERIFY(this));
 942           no_control_flow = false; break;
 943         case Bytecodes::_iaload :
 944           type = current_frame.pop_stack(
 945             VerificationType::integer_type(), CHECK_VERIFY(this));
 946           atype = current_frame.pop_stack(
 947             VerificationType::reference_check(), CHECK_VERIFY(this));
 948           if (!atype.is_int_array()) {
 949             verify_error(ErrorContext::bad_type(bci,
 950                 current_frame.stack_top_ctx(), ref_ctx("[I")),
 951                 bad_type_msg, "iaload");
 952             return;
 953           }
 954           current_frame.push_stack(
 955             VerificationType::integer_type(), CHECK_VERIFY(this));
 956           no_control_flow = false; break;
 957         case Bytecodes::_baload :
 958           type = current_frame.pop_stack(
 959             VerificationType::integer_type(), CHECK_VERIFY(this));
 960           atype = current_frame.pop_stack(
 961             VerificationType::reference_check(), CHECK_VERIFY(this));
 962           if (!atype.is_bool_array() && !atype.is_byte_array()) {
 963             verify_error(
 964                 ErrorContext::bad_type(bci, current_frame.stack_top_ctx()),
 965                 bad_type_msg, "baload");
 966             return;
 967           }
 968           current_frame.push_stack(
 969             VerificationType::integer_type(), CHECK_VERIFY(this));
 970           no_control_flow = false; break;
 971         case Bytecodes::_caload :
 972           type = current_frame.pop_stack(
 973             VerificationType::integer_type(), CHECK_VERIFY(this));
 974           atype = current_frame.pop_stack(
 975             VerificationType::reference_check(), CHECK_VERIFY(this));
 976           if (!atype.is_char_array()) {
 977             verify_error(ErrorContext::bad_type(bci,
 978                 current_frame.stack_top_ctx(), ref_ctx("[C")),
 979                 bad_type_msg, "caload");
 980             return;
 981           }
 982           current_frame.push_stack(
 983             VerificationType::integer_type(), CHECK_VERIFY(this));
 984           no_control_flow = false; break;
 985         case Bytecodes::_saload :
 986           type = current_frame.pop_stack(
 987             VerificationType::integer_type(), CHECK_VERIFY(this));
 988           atype = current_frame.pop_stack(
 989             VerificationType::reference_check(), CHECK_VERIFY(this));
 990           if (!atype.is_short_array()) {
 991             verify_error(ErrorContext::bad_type(bci,
 992                 current_frame.stack_top_ctx(), ref_ctx("[S")),
 993                 bad_type_msg, "saload");
 994             return;
 995           }
 996           current_frame.push_stack(
 997             VerificationType::integer_type(), CHECK_VERIFY(this));
 998           no_control_flow = false; break;
 999         case Bytecodes::_laload :
1000           type = current_frame.pop_stack(
1001             VerificationType::integer_type(), CHECK_VERIFY(this));
1002           atype = current_frame.pop_stack(
1003             VerificationType::reference_check(), CHECK_VERIFY(this));
1004           if (!atype.is_long_array()) {
1005             verify_error(ErrorContext::bad_type(bci,
1006                 current_frame.stack_top_ctx(), ref_ctx("[J")),
1007                 bad_type_msg, "laload");
1008             return;
1009           }
1010           current_frame.push_stack_2(
1011             VerificationType::long_type(),
1012             VerificationType::long2_type(), CHECK_VERIFY(this));
1013           no_control_flow = false; break;
1014         case Bytecodes::_faload :
1015           type = current_frame.pop_stack(
1016             VerificationType::integer_type(), CHECK_VERIFY(this));
1017           atype = current_frame.pop_stack(
1018             VerificationType::reference_check(), CHECK_VERIFY(this));
1019           if (!atype.is_float_array()) {
1020             verify_error(ErrorContext::bad_type(bci,
1021                 current_frame.stack_top_ctx(), ref_ctx("[F")),
1022                 bad_type_msg, "faload");
1023             return;
1024           }
1025           current_frame.push_stack(
1026             VerificationType::float_type(), CHECK_VERIFY(this));
1027           no_control_flow = false; break;
1028         case Bytecodes::_daload :
1029           type = current_frame.pop_stack(
1030             VerificationType::integer_type(), CHECK_VERIFY(this));
1031           atype = current_frame.pop_stack(
1032             VerificationType::reference_check(), CHECK_VERIFY(this));
1033           if (!atype.is_double_array()) {
1034             verify_error(ErrorContext::bad_type(bci,
1035                 current_frame.stack_top_ctx(), ref_ctx("[D")),
1036                 bad_type_msg, "daload");
1037             return;
1038           }
1039           current_frame.push_stack_2(
1040             VerificationType::double_type(),
1041             VerificationType::double2_type(), CHECK_VERIFY(this));
1042           no_control_flow = false; break;
1043         case Bytecodes::_aaload : {
1044           type = current_frame.pop_stack(
1045             VerificationType::integer_type(), CHECK_VERIFY(this));
1046           atype = current_frame.pop_stack(
1047             VerificationType::reference_check(), CHECK_VERIFY(this));
1048           if (!atype.is_nonscalar_array()) {
1049             verify_error(ErrorContext::bad_type(bci,
1050                 current_frame.stack_top_ctx(),
1051                 TypeOrigin::implicit(VerificationType::reference_check())),
1052                 bad_type_msg, "aaload");
1053             return;
1054           }
1055           if (atype.is_null()) {
1056             current_frame.push_stack(
1057               VerificationType::null_type(), CHECK_VERIFY(this));
1058           } else {
1059             VerificationType component =
1060               atype.get_component(this, CHECK_VERIFY(this));
1061             current_frame.push_stack(component, CHECK_VERIFY(this));
1062           }
1063           no_control_flow = false; break;
1064         }
1065         case Bytecodes::_istore :
1066           verify_istore(bcs.get_index(), &current_frame, CHECK_VERIFY(this));
1067           no_control_flow = false; break;
1068         case Bytecodes::_istore_0 :
1069         case Bytecodes::_istore_1 :
1070         case Bytecodes::_istore_2 :
1071         case Bytecodes::_istore_3 :
1072           index = opcode - Bytecodes::_istore_0;
1073           verify_istore(index, &current_frame, CHECK_VERIFY(this));
1074           no_control_flow = false; break;
1075         case Bytecodes::_lstore :
1076           verify_lstore(bcs.get_index(), &current_frame, CHECK_VERIFY(this));
1077           no_control_flow = false; break;
1078         case Bytecodes::_lstore_0 :
1079         case Bytecodes::_lstore_1 :
1080         case Bytecodes::_lstore_2 :
1081         case Bytecodes::_lstore_3 :
1082           index = opcode - Bytecodes::_lstore_0;
1083           verify_lstore(index, &current_frame, CHECK_VERIFY(this));
1084           no_control_flow = false; break;
1085         case Bytecodes::_fstore :
1086           verify_fstore(bcs.get_index(), &current_frame, CHECK_VERIFY(this));
1087           no_control_flow = false; break;
1088         case Bytecodes::_fstore_0 :
1089         case Bytecodes::_fstore_1 :
1090         case Bytecodes::_fstore_2 :
1091         case Bytecodes::_fstore_3 :
1092           index = opcode - Bytecodes::_fstore_0;
1093           verify_fstore(index, &current_frame, CHECK_VERIFY(this));
1094           no_control_flow = false; break;
1095         case Bytecodes::_dstore :
1096           verify_dstore(bcs.get_index(), &current_frame, CHECK_VERIFY(this));
1097           no_control_flow = false; break;
1098         case Bytecodes::_dstore_0 :
1099         case Bytecodes::_dstore_1 :
1100         case Bytecodes::_dstore_2 :
1101         case Bytecodes::_dstore_3 :
1102           index = opcode - Bytecodes::_dstore_0;
1103           verify_dstore(index, &current_frame, CHECK_VERIFY(this));
1104           no_control_flow = false; break;
1105         case Bytecodes::_astore :
1106           verify_astore(bcs.get_index(), &current_frame, CHECK_VERIFY(this));
1107           no_control_flow = false; break;
1108         case Bytecodes::_astore_0 :
1109         case Bytecodes::_astore_1 :
1110         case Bytecodes::_astore_2 :
1111         case Bytecodes::_astore_3 :
1112           index = opcode - Bytecodes::_astore_0;
1113           verify_astore(index, &current_frame, CHECK_VERIFY(this));
1114           no_control_flow = false; break;
1115         case Bytecodes::_iastore :
1116           type = current_frame.pop_stack(
1117             VerificationType::integer_type(), CHECK_VERIFY(this));
1118           type2 = current_frame.pop_stack(
1119             VerificationType::integer_type(), CHECK_VERIFY(this));
1120           atype = current_frame.pop_stack(
1121             VerificationType::reference_check(), CHECK_VERIFY(this));
1122           if (!atype.is_int_array()) {
1123             verify_error(ErrorContext::bad_type(bci,
1124                 current_frame.stack_top_ctx(), ref_ctx("[I")),
1125                 bad_type_msg, "iastore");
1126             return;
1127           }
1128           no_control_flow = false; break;
1129         case Bytecodes::_bastore :
1130           type = current_frame.pop_stack(
1131             VerificationType::integer_type(), CHECK_VERIFY(this));
1132           type2 = current_frame.pop_stack(
1133             VerificationType::integer_type(), CHECK_VERIFY(this));
1134           atype = current_frame.pop_stack(
1135             VerificationType::reference_check(), CHECK_VERIFY(this));
1136           if (!atype.is_bool_array() && !atype.is_byte_array()) {
1137             verify_error(
1138                 ErrorContext::bad_type(bci, current_frame.stack_top_ctx()),
1139                 bad_type_msg, "bastore");
1140             return;
1141           }
1142           no_control_flow = false; break;
1143         case Bytecodes::_castore :
1144           current_frame.pop_stack(
1145             VerificationType::integer_type(), CHECK_VERIFY(this));
1146           current_frame.pop_stack(
1147             VerificationType::integer_type(), CHECK_VERIFY(this));
1148           atype = current_frame.pop_stack(
1149             VerificationType::reference_check(), CHECK_VERIFY(this));
1150           if (!atype.is_char_array()) {
1151             verify_error(ErrorContext::bad_type(bci,
1152                 current_frame.stack_top_ctx(), ref_ctx("[C")),
1153                 bad_type_msg, "castore");
1154             return;
1155           }
1156           no_control_flow = false; break;
1157         case Bytecodes::_sastore :
1158           current_frame.pop_stack(
1159             VerificationType::integer_type(), CHECK_VERIFY(this));
1160           current_frame.pop_stack(
1161             VerificationType::integer_type(), CHECK_VERIFY(this));
1162           atype = current_frame.pop_stack(
1163             VerificationType::reference_check(), CHECK_VERIFY(this));
1164           if (!atype.is_short_array()) {
1165             verify_error(ErrorContext::bad_type(bci,
1166                 current_frame.stack_top_ctx(), ref_ctx("[S")),
1167                 bad_type_msg, "sastore");
1168             return;
1169           }
1170           no_control_flow = false; break;
1171         case Bytecodes::_lastore :
1172           current_frame.pop_stack_2(
1173             VerificationType::long2_type(),
1174             VerificationType::long_type(), CHECK_VERIFY(this));
1175           current_frame.pop_stack(
1176             VerificationType::integer_type(), CHECK_VERIFY(this));
1177           atype = current_frame.pop_stack(
1178             VerificationType::reference_check(), CHECK_VERIFY(this));
1179           if (!atype.is_long_array()) {
1180             verify_error(ErrorContext::bad_type(bci,
1181                 current_frame.stack_top_ctx(), ref_ctx("[J")),
1182                 bad_type_msg, "lastore");
1183             return;
1184           }
1185           no_control_flow = false; break;
1186         case Bytecodes::_fastore :
1187           current_frame.pop_stack(
1188             VerificationType::float_type(), CHECK_VERIFY(this));
1189           current_frame.pop_stack
1190             (VerificationType::integer_type(), CHECK_VERIFY(this));
1191           atype = current_frame.pop_stack(
1192             VerificationType::reference_check(), CHECK_VERIFY(this));
1193           if (!atype.is_float_array()) {
1194             verify_error(ErrorContext::bad_type(bci,
1195                 current_frame.stack_top_ctx(), ref_ctx("[F")),
1196                 bad_type_msg, "fastore");
1197             return;
1198           }
1199           no_control_flow = false; break;
1200         case Bytecodes::_dastore :
1201           current_frame.pop_stack_2(
1202             VerificationType::double2_type(),
1203             VerificationType::double_type(), CHECK_VERIFY(this));
1204           current_frame.pop_stack(
1205             VerificationType::integer_type(), CHECK_VERIFY(this));
1206           atype = current_frame.pop_stack(
1207             VerificationType::reference_check(), CHECK_VERIFY(this));
1208           if (!atype.is_double_array()) {
1209             verify_error(ErrorContext::bad_type(bci,
1210                 current_frame.stack_top_ctx(), ref_ctx("[D")),
1211                 bad_type_msg, "dastore");
1212             return;
1213           }
1214           no_control_flow = false; break;
1215         case Bytecodes::_aastore :
1216           type = current_frame.pop_stack(object_type(), CHECK_VERIFY(this));
1217           type2 = current_frame.pop_stack(
1218             VerificationType::integer_type(), CHECK_VERIFY(this));
1219           atype = current_frame.pop_stack(
1220             VerificationType::reference_check(), CHECK_VERIFY(this));
1221           // more type-checking is done at runtime
1222           if (!atype.is_nonscalar_array()) {
1223             verify_error(ErrorContext::bad_type(bci,
1224                 current_frame.stack_top_ctx(),
1225                 TypeOrigin::implicit(VerificationType::reference_check())),
1226                 bad_type_msg, "aastore");
1227             return;
1228           }
1229           // 4938384: relaxed constraint in JVMS 3nd edition.
1230           no_control_flow = false; break;
1231         case Bytecodes::_pop :
1232           current_frame.pop_stack(
1233             VerificationType::category1_check(), CHECK_VERIFY(this));
1234           no_control_flow = false; break;
1235         case Bytecodes::_pop2 :
1236           type = current_frame.pop_stack(CHECK_VERIFY(this));
1237           if (type.is_category1()) {
1238             current_frame.pop_stack(
1239               VerificationType::category1_check(), CHECK_VERIFY(this));
1240           } else if (type.is_category2_2nd()) {
1241             current_frame.pop_stack(
1242               VerificationType::category2_check(), CHECK_VERIFY(this));
1243           } else {
1244             /* Unreachable? Would need a category2_1st on TOS
1245              * which does not appear possible. */
1246             verify_error(
1247                 ErrorContext::bad_type(bci, current_frame.stack_top_ctx()),
1248                 bad_type_msg, "pop2");
1249             return;
1250           }
1251           no_control_flow = false; break;
1252         case Bytecodes::_dup :
1253           type = current_frame.pop_stack(
1254             VerificationType::category1_check(), CHECK_VERIFY(this));
1255           current_frame.push_stack(type, CHECK_VERIFY(this));
1256           current_frame.push_stack(type, CHECK_VERIFY(this));
1257           no_control_flow = false; break;
1258         case Bytecodes::_dup_x1 :
1259           type = current_frame.pop_stack(
1260             VerificationType::category1_check(), CHECK_VERIFY(this));
1261           type2 = current_frame.pop_stack(
1262             VerificationType::category1_check(), CHECK_VERIFY(this));
1263           current_frame.push_stack(type, CHECK_VERIFY(this));
1264           current_frame.push_stack(type2, CHECK_VERIFY(this));
1265           current_frame.push_stack(type, CHECK_VERIFY(this));
1266           no_control_flow = false; break;
1267         case Bytecodes::_dup_x2 :
1268         {
1269           VerificationType type3;
1270           type = current_frame.pop_stack(
1271             VerificationType::category1_check(), CHECK_VERIFY(this));
1272           type2 = current_frame.pop_stack(CHECK_VERIFY(this));
1273           if (type2.is_category1()) {
1274             type3 = current_frame.pop_stack(
1275               VerificationType::category1_check(), CHECK_VERIFY(this));
1276           } else if (type2.is_category2_2nd()) {
1277             type3 = current_frame.pop_stack(
1278               VerificationType::category2_check(), CHECK_VERIFY(this));
1279           } else {
1280             /* Unreachable? Would need a category2_1st at stack depth 2 with
1281              * a category1 on TOS which does not appear possible. */
1282             verify_error(ErrorContext::bad_type(
1283                 bci, current_frame.stack_top_ctx()), bad_type_msg, "dup_x2");
1284             return;
1285           }
1286           current_frame.push_stack(type, CHECK_VERIFY(this));
1287           current_frame.push_stack(type3, CHECK_VERIFY(this));
1288           current_frame.push_stack(type2, CHECK_VERIFY(this));
1289           current_frame.push_stack(type, CHECK_VERIFY(this));
1290           no_control_flow = false; break;
1291         }
1292         case Bytecodes::_dup2 :
1293           type = current_frame.pop_stack(CHECK_VERIFY(this));
1294           if (type.is_category1()) {
1295             type2 = current_frame.pop_stack(
1296               VerificationType::category1_check(), CHECK_VERIFY(this));
1297           } else if (type.is_category2_2nd()) {
1298             type2 = current_frame.pop_stack(
1299               VerificationType::category2_check(), CHECK_VERIFY(this));
1300           } else {
1301             /* Unreachable?  Would need a category2_1st on TOS which does not
1302              * appear possible. */
1303             verify_error(
1304                 ErrorContext::bad_type(bci, current_frame.stack_top_ctx()),
1305                 bad_type_msg, "dup2");
1306             return;
1307           }
1308           current_frame.push_stack(type2, CHECK_VERIFY(this));
1309           current_frame.push_stack(type, CHECK_VERIFY(this));
1310           current_frame.push_stack(type2, CHECK_VERIFY(this));
1311           current_frame.push_stack(type, CHECK_VERIFY(this));
1312           no_control_flow = false; break;
1313         case Bytecodes::_dup2_x1 :
1314         {
1315           VerificationType type3;
1316           type = current_frame.pop_stack(CHECK_VERIFY(this));
1317           if (type.is_category1()) {
1318             type2 = current_frame.pop_stack(
1319               VerificationType::category1_check(), CHECK_VERIFY(this));
1320           } else if (type.is_category2_2nd()) {
1321             type2 = current_frame.pop_stack(
1322               VerificationType::category2_check(), CHECK_VERIFY(this));
1323           } else {
1324             /* Unreachable?  Would need a category2_1st on TOS which does
1325              * not appear possible. */
1326             verify_error(
1327                 ErrorContext::bad_type(bci, current_frame.stack_top_ctx()),
1328                 bad_type_msg, "dup2_x1");
1329             return;
1330           }
1331           type3 = current_frame.pop_stack(
1332             VerificationType::category1_check(), CHECK_VERIFY(this));
1333           current_frame.push_stack(type2, CHECK_VERIFY(this));
1334           current_frame.push_stack(type, CHECK_VERIFY(this));
1335           current_frame.push_stack(type3, CHECK_VERIFY(this));
1336           current_frame.push_stack(type2, CHECK_VERIFY(this));
1337           current_frame.push_stack(type, CHECK_VERIFY(this));
1338           no_control_flow = false; break;
1339         }
1340         case Bytecodes::_dup2_x2 :
1341         {
1342           VerificationType type3, type4;
1343           type = current_frame.pop_stack(CHECK_VERIFY(this));
1344           if (type.is_category1()) {
1345             type2 = current_frame.pop_stack(
1346               VerificationType::category1_check(), CHECK_VERIFY(this));
1347           } else if (type.is_category2_2nd()) {
1348             type2 = current_frame.pop_stack(
1349               VerificationType::category2_check(), CHECK_VERIFY(this));
1350           } else {
1351             /* Unreachable?  Would need a category2_1st on TOS which does
1352              * not appear possible. */
1353             verify_error(
1354                 ErrorContext::bad_type(bci, current_frame.stack_top_ctx()),
1355                 bad_type_msg, "dup2_x2");
1356             return;
1357           }
1358           type3 = current_frame.pop_stack(CHECK_VERIFY(this));
1359           if (type3.is_category1()) {
1360             type4 = current_frame.pop_stack(
1361               VerificationType::category1_check(), CHECK_VERIFY(this));
1362           } else if (type3.is_category2_2nd()) {
1363             type4 = current_frame.pop_stack(
1364               VerificationType::category2_check(), CHECK_VERIFY(this));
1365           } else {
1366             /* Unreachable?  Would need a category2_1st on TOS after popping
1367              * a long/double or two category 1's, which does not
1368              * appear possible. */
1369             verify_error(
1370                 ErrorContext::bad_type(bci, current_frame.stack_top_ctx()),
1371                 bad_type_msg, "dup2_x2");
1372             return;
1373           }
1374           current_frame.push_stack(type2, CHECK_VERIFY(this));
1375           current_frame.push_stack(type, CHECK_VERIFY(this));
1376           current_frame.push_stack(type4, CHECK_VERIFY(this));
1377           current_frame.push_stack(type3, CHECK_VERIFY(this));
1378           current_frame.push_stack(type2, CHECK_VERIFY(this));
1379           current_frame.push_stack(type, CHECK_VERIFY(this));
1380           no_control_flow = false; break;
1381         }
1382         case Bytecodes::_swap :
1383           type = current_frame.pop_stack(
1384             VerificationType::category1_check(), CHECK_VERIFY(this));
1385           type2 = current_frame.pop_stack(
1386             VerificationType::category1_check(), CHECK_VERIFY(this));
1387           current_frame.push_stack(type, CHECK_VERIFY(this));
1388           current_frame.push_stack(type2, CHECK_VERIFY(this));
1389           no_control_flow = false; break;
1390         case Bytecodes::_iadd :
1391         case Bytecodes::_isub :
1392         case Bytecodes::_imul :
1393         case Bytecodes::_idiv :
1394         case Bytecodes::_irem :
1395         case Bytecodes::_ishl :
1396         case Bytecodes::_ishr :
1397         case Bytecodes::_iushr :
1398         case Bytecodes::_ior :
1399         case Bytecodes::_ixor :
1400         case Bytecodes::_iand :
1401           current_frame.pop_stack(
1402             VerificationType::integer_type(), CHECK_VERIFY(this));
1403           // fall through
1404         case Bytecodes::_ineg :
1405           current_frame.pop_stack(
1406             VerificationType::integer_type(), CHECK_VERIFY(this));
1407           current_frame.push_stack(
1408             VerificationType::integer_type(), CHECK_VERIFY(this));
1409           no_control_flow = false; break;
1410         case Bytecodes::_ladd :
1411         case Bytecodes::_lsub :
1412         case Bytecodes::_lmul :
1413         case Bytecodes::_ldiv :
1414         case Bytecodes::_lrem :
1415         case Bytecodes::_land :
1416         case Bytecodes::_lor :
1417         case Bytecodes::_lxor :
1418           current_frame.pop_stack_2(
1419             VerificationType::long2_type(),
1420             VerificationType::long_type(), CHECK_VERIFY(this));
1421           // fall through
1422         case Bytecodes::_lneg :
1423           current_frame.pop_stack_2(
1424             VerificationType::long2_type(),
1425             VerificationType::long_type(), CHECK_VERIFY(this));
1426           current_frame.push_stack_2(
1427             VerificationType::long_type(),
1428             VerificationType::long2_type(), CHECK_VERIFY(this));
1429           no_control_flow = false; break;
1430         case Bytecodes::_lshl :
1431         case Bytecodes::_lshr :
1432         case Bytecodes::_lushr :
1433           current_frame.pop_stack(
1434             VerificationType::integer_type(), CHECK_VERIFY(this));
1435           current_frame.pop_stack_2(
1436             VerificationType::long2_type(),
1437             VerificationType::long_type(), CHECK_VERIFY(this));
1438           current_frame.push_stack_2(
1439             VerificationType::long_type(),
1440             VerificationType::long2_type(), CHECK_VERIFY(this));
1441           no_control_flow = false; break;
1442         case Bytecodes::_fadd :
1443         case Bytecodes::_fsub :
1444         case Bytecodes::_fmul :
1445         case Bytecodes::_fdiv :
1446         case Bytecodes::_frem :
1447           current_frame.pop_stack(
1448             VerificationType::float_type(), CHECK_VERIFY(this));
1449           // fall through
1450         case Bytecodes::_fneg :
1451           current_frame.pop_stack(
1452             VerificationType::float_type(), CHECK_VERIFY(this));
1453           current_frame.push_stack(
1454             VerificationType::float_type(), CHECK_VERIFY(this));
1455           no_control_flow = false; break;
1456         case Bytecodes::_dadd :
1457         case Bytecodes::_dsub :
1458         case Bytecodes::_dmul :
1459         case Bytecodes::_ddiv :
1460         case Bytecodes::_drem :
1461           current_frame.pop_stack_2(
1462             VerificationType::double2_type(),
1463             VerificationType::double_type(), CHECK_VERIFY(this));
1464           // fall through
1465         case Bytecodes::_dneg :
1466           current_frame.pop_stack_2(
1467             VerificationType::double2_type(),
1468             VerificationType::double_type(), CHECK_VERIFY(this));
1469           current_frame.push_stack_2(
1470             VerificationType::double_type(),
1471             VerificationType::double2_type(), CHECK_VERIFY(this));
1472           no_control_flow = false; break;
1473         case Bytecodes::_iinc :
1474           verify_iinc(bcs.get_index(), &current_frame, CHECK_VERIFY(this));
1475           no_control_flow = false; break;
1476         case Bytecodes::_i2l :
1477           type = current_frame.pop_stack(
1478             VerificationType::integer_type(), CHECK_VERIFY(this));
1479           current_frame.push_stack_2(
1480             VerificationType::long_type(),
1481             VerificationType::long2_type(), CHECK_VERIFY(this));
1482           no_control_flow = false; break;
1483        case Bytecodes::_l2i :
1484           current_frame.pop_stack_2(
1485             VerificationType::long2_type(),
1486             VerificationType::long_type(), CHECK_VERIFY(this));
1487           current_frame.push_stack(
1488             VerificationType::integer_type(), CHECK_VERIFY(this));
1489           no_control_flow = false; break;
1490         case Bytecodes::_i2f :
1491           current_frame.pop_stack(
1492             VerificationType::integer_type(), CHECK_VERIFY(this));
1493           current_frame.push_stack(
1494             VerificationType::float_type(), CHECK_VERIFY(this));
1495           no_control_flow = false; break;
1496         case Bytecodes::_i2d :
1497           current_frame.pop_stack(
1498             VerificationType::integer_type(), CHECK_VERIFY(this));
1499           current_frame.push_stack_2(
1500             VerificationType::double_type(),
1501             VerificationType::double2_type(), CHECK_VERIFY(this));
1502           no_control_flow = false; break;
1503         case Bytecodes::_l2f :
1504           current_frame.pop_stack_2(
1505             VerificationType::long2_type(),
1506             VerificationType::long_type(), CHECK_VERIFY(this));
1507           current_frame.push_stack(
1508             VerificationType::float_type(), CHECK_VERIFY(this));
1509           no_control_flow = false; break;
1510         case Bytecodes::_l2d :
1511           current_frame.pop_stack_2(
1512             VerificationType::long2_type(),
1513             VerificationType::long_type(), CHECK_VERIFY(this));
1514           current_frame.push_stack_2(
1515             VerificationType::double_type(),
1516             VerificationType::double2_type(), CHECK_VERIFY(this));
1517           no_control_flow = false; break;
1518         case Bytecodes::_f2i :
1519           current_frame.pop_stack(
1520             VerificationType::float_type(), CHECK_VERIFY(this));
1521           current_frame.push_stack(
1522             VerificationType::integer_type(), CHECK_VERIFY(this));
1523           no_control_flow = false; break;
1524         case Bytecodes::_f2l :
1525           current_frame.pop_stack(
1526             VerificationType::float_type(), CHECK_VERIFY(this));
1527           current_frame.push_stack_2(
1528             VerificationType::long_type(),
1529             VerificationType::long2_type(), CHECK_VERIFY(this));
1530           no_control_flow = false; break;
1531         case Bytecodes::_f2d :
1532           current_frame.pop_stack(
1533             VerificationType::float_type(), CHECK_VERIFY(this));
1534           current_frame.push_stack_2(
1535             VerificationType::double_type(),
1536             VerificationType::double2_type(), CHECK_VERIFY(this));
1537           no_control_flow = false; break;
1538         case Bytecodes::_d2i :
1539           current_frame.pop_stack_2(
1540             VerificationType::double2_type(),
1541             VerificationType::double_type(), CHECK_VERIFY(this));
1542           current_frame.push_stack(
1543             VerificationType::integer_type(), CHECK_VERIFY(this));
1544           no_control_flow = false; break;
1545         case Bytecodes::_d2l :
1546           current_frame.pop_stack_2(
1547             VerificationType::double2_type(),
1548             VerificationType::double_type(), CHECK_VERIFY(this));
1549           current_frame.push_stack_2(
1550             VerificationType::long_type(),
1551             VerificationType::long2_type(), CHECK_VERIFY(this));
1552           no_control_flow = false; break;
1553         case Bytecodes::_d2f :
1554           current_frame.pop_stack_2(
1555             VerificationType::double2_type(),
1556             VerificationType::double_type(), CHECK_VERIFY(this));
1557           current_frame.push_stack(
1558             VerificationType::float_type(), CHECK_VERIFY(this));
1559           no_control_flow = false; break;
1560         case Bytecodes::_i2b :
1561         case Bytecodes::_i2c :
1562         case Bytecodes::_i2s :
1563           current_frame.pop_stack(
1564             VerificationType::integer_type(), CHECK_VERIFY(this));
1565           current_frame.push_stack(
1566             VerificationType::integer_type(), CHECK_VERIFY(this));
1567           no_control_flow = false; break;
1568         case Bytecodes::_lcmp :
1569           current_frame.pop_stack_2(
1570             VerificationType::long2_type(),
1571             VerificationType::long_type(), CHECK_VERIFY(this));
1572           current_frame.pop_stack_2(
1573             VerificationType::long2_type(),
1574             VerificationType::long_type(), CHECK_VERIFY(this));
1575           current_frame.push_stack(
1576             VerificationType::integer_type(), CHECK_VERIFY(this));
1577           no_control_flow = false; break;
1578         case Bytecodes::_fcmpl :
1579         case Bytecodes::_fcmpg :
1580           current_frame.pop_stack(
1581             VerificationType::float_type(), CHECK_VERIFY(this));
1582           current_frame.pop_stack(
1583             VerificationType::float_type(), CHECK_VERIFY(this));
1584           current_frame.push_stack(
1585             VerificationType::integer_type(), CHECK_VERIFY(this));
1586           no_control_flow = false; break;
1587         case Bytecodes::_dcmpl :
1588         case Bytecodes::_dcmpg :
1589           current_frame.pop_stack_2(
1590             VerificationType::double2_type(),
1591             VerificationType::double_type(), CHECK_VERIFY(this));
1592           current_frame.pop_stack_2(
1593             VerificationType::double2_type(),
1594             VerificationType::double_type(), CHECK_VERIFY(this));
1595           current_frame.push_stack(
1596             VerificationType::integer_type(), CHECK_VERIFY(this));
1597           no_control_flow = false; break;
1598         case Bytecodes::_if_icmpeq:
1599         case Bytecodes::_if_icmpne:
1600         case Bytecodes::_if_icmplt:
1601         case Bytecodes::_if_icmpge:
1602         case Bytecodes::_if_icmpgt:
1603         case Bytecodes::_if_icmple:
1604           current_frame.pop_stack(
1605             VerificationType::integer_type(), CHECK_VERIFY(this));
1606           // fall through
1607         case Bytecodes::_ifeq:
1608         case Bytecodes::_ifne:
1609         case Bytecodes::_iflt:
1610         case Bytecodes::_ifge:
1611         case Bytecodes::_ifgt:
1612         case Bytecodes::_ifle:
1613           current_frame.pop_stack(
1614             VerificationType::integer_type(), CHECK_VERIFY(this));
1615           target = bcs.dest();
1616           stackmap_table.check_jump_target(
1617             &current_frame, target, CHECK_VERIFY(this));
1618           no_control_flow = false; break;
1619         case Bytecodes::_if_acmpeq :
1620         case Bytecodes::_if_acmpne :
1621           current_frame.pop_stack(
1622             VerificationType::nonscalar_check(), CHECK_VERIFY(this));
1623           // fall through
1624         case Bytecodes::_ifnull :
1625         case Bytecodes::_ifnonnull :
1626           current_frame.pop_stack(
1627             VerificationType::nonscalar_check(), CHECK_VERIFY(this));
1628           target = bcs.dest();
1629           stackmap_table.check_jump_target
1630             (&current_frame, target, CHECK_VERIFY(this));
1631           no_control_flow = false; break;
1632         case Bytecodes::_goto :
1633           target = bcs.dest();
1634           stackmap_table.check_jump_target(
1635             &current_frame, target, CHECK_VERIFY(this));
1636           no_control_flow = true; break;
1637         case Bytecodes::_goto_w :
1638           target = bcs.dest_w();
1639           stackmap_table.check_jump_target(
1640             &current_frame, target, CHECK_VERIFY(this));
1641           no_control_flow = true; break;
1642         case Bytecodes::_tableswitch :
1643         case Bytecodes::_lookupswitch :
1644           verify_switch(
1645             &bcs, code_length, code_data, &current_frame,
1646             &stackmap_table, CHECK_VERIFY(this));
1647           no_control_flow = true; break;
1648         case Bytecodes::_ireturn :
1649           type = current_frame.pop_stack(
1650             VerificationType::integer_type(), CHECK_VERIFY(this));
1651           verify_return_value(return_type, type, bci,
1652                               &current_frame, CHECK_VERIFY(this));
1653           no_control_flow = true; break;
1654         case Bytecodes::_lreturn :
1655           type2 = current_frame.pop_stack(
1656             VerificationType::long2_type(), CHECK_VERIFY(this));
1657           type = current_frame.pop_stack(
1658             VerificationType::long_type(), CHECK_VERIFY(this));
1659           verify_return_value(return_type, type, bci,
1660                               &current_frame, CHECK_VERIFY(this));
1661           no_control_flow = true; break;
1662         case Bytecodes::_freturn :
1663           type = current_frame.pop_stack(
1664             VerificationType::float_type(), CHECK_VERIFY(this));
1665           verify_return_value(return_type, type, bci,
1666                               &current_frame, CHECK_VERIFY(this));
1667           no_control_flow = true; break;
1668         case Bytecodes::_dreturn :
1669           type2 = current_frame.pop_stack(
1670             VerificationType::double2_type(),  CHECK_VERIFY(this));
1671           type = current_frame.pop_stack(
1672             VerificationType::double_type(), CHECK_VERIFY(this));
1673           verify_return_value(return_type, type, bci,
1674                               &current_frame, CHECK_VERIFY(this));
1675           no_control_flow = true; break;
1676         case Bytecodes::_areturn :
1677           type = current_frame.pop_stack(
1678             VerificationType::nonscalar_check(), CHECK_VERIFY(this));
1679           verify_return_value(return_type, type, bci,
1680                               &current_frame, CHECK_VERIFY(this));
1681           no_control_flow = true; break;
1682         case Bytecodes::_return :
1683           if (return_type != VerificationType::bogus_type()) {
1684             verify_error(ErrorContext::bad_code(bci),
1685                          "Method expects a return value");
1686             return;
1687           }
1688           // Make sure "this" has been initialized if current method is an
1689           // <init>.
1690           if (_method->is_object_constructor() &&
1691               current_frame.flag_this_uninit()) {
1692             verify_error(ErrorContext::bad_code(bci),
1693                          "Constructor must call super() or this() "
1694                          "before return");
1695             return;
1696           }
1697           no_control_flow = true; break;
1698         case Bytecodes::_getstatic :
1699         case Bytecodes::_putstatic :
1700           // pass TRUE, operand can be an array type for getstatic/putstatic.
1701           verify_field_instructions(
1702             &bcs, &current_frame, cp, true, CHECK_VERIFY(this));
1703           no_control_flow = false; break;
1704         case Bytecodes::_getfield :
1705         case Bytecodes::_putfield :
1706           // pass FALSE, operand can't be an array type for getfield/putfield.
1707           verify_field_instructions(
1708             &bcs, &current_frame, cp, false, CHECK_VERIFY(this));
1709           no_control_flow = false; break;
1710         case Bytecodes::_withfield :
1711           if (_klass->major_version() < VALUETYPE_MAJOR_VERSION) {
1712             class_format_error(
1713               "withfield not supported by this class file version (%d.%d), class %s",
1714               _klass->major_version(), _klass->minor_version(), _klass->external_name());
1715             return;
1716           }
1717           // pass FALSE, operand can't be an array type for withfield.
1718           verify_field_instructions(
1719             &bcs, &current_frame, cp, false, CHECK_VERIFY(this));
1720           no_control_flow = false; break;
1721         case Bytecodes::_invokevirtual :
1722         case Bytecodes::_invokespecial :
1723         case Bytecodes::_invokestatic :
1724         case Bytecodes::_invokeinterface :
1725         case Bytecodes::_invokedynamic :
1726           verify_invoke_instructions(
1727             &bcs, code_length, &current_frame, (bci >= ex_min && bci < ex_max),
1728             &this_uninit, cp, &stackmap_table, CHECK_VERIFY(this));
1729           no_control_flow = false; break;
1730         case Bytecodes::_new :
1731         {
1732           index = bcs.get_index_u2();
1733           verify_cp_class_type(bci, index, cp, CHECK_VERIFY(this));
1734           VerificationType new_class_type =
1735             cp_index_to_type(index, cp, CHECK_VERIFY(this));
1736           if (!new_class_type.is_object()) {
1737             verify_error(ErrorContext::bad_type(bci,
1738                 TypeOrigin::cp(index, new_class_type)),
1739                 "Illegal new instruction");
1740             return;
1741           }
1742           type = VerificationType::uninitialized_type(bci);
1743           current_frame.push_stack(type, CHECK_VERIFY(this));
1744           no_control_flow = false; break;
1745         }
1746         case Bytecodes::_defaultvalue :
1747         {
1748           if (_klass->major_version() < VALUETYPE_MAJOR_VERSION) {
1749             class_format_error(
1750               "defaultvalue not supported by this class file version (%d.%d), class %s",
1751               _klass->major_version(), _klass->minor_version(), _klass->external_name());
1752             return;
1753           }
1754           index = bcs.get_index_u2();
1755           verify_cp_class_type(bci, index, cp, CHECK_VERIFY(this));
1756           VerificationType ref_type = cp_index_to_type(index, cp, CHECK_VERIFY(this));
1757           if (!ref_type.is_object()) {
1758             verify_error(ErrorContext::bad_type(bci,
1759                 TypeOrigin::cp(index, ref_type)),
1760                 "Illegal defaultvalue instruction");
1761             return;
1762           }
1763           VerificationType value_type =
1764             VerificationType::change_ref_to_valuetype(ref_type);
1765           current_frame.push_stack(value_type, CHECK_VERIFY(this));
1766           no_control_flow = false; break;
1767         }
1768         case Bytecodes::_newarray :
1769           type = get_newarray_type(bcs.get_index(), bci, CHECK_VERIFY(this));
1770           current_frame.pop_stack(
1771             VerificationType::integer_type(),  CHECK_VERIFY(this));
1772           current_frame.push_stack(type, CHECK_VERIFY(this));
1773           no_control_flow = false; break;
1774         case Bytecodes::_anewarray :
1775           verify_anewarray(
1776             bci, bcs.get_index_u2(), cp, &current_frame, CHECK_VERIFY(this));
1777           no_control_flow = false; break;
1778         case Bytecodes::_arraylength :
1779           type = current_frame.pop_stack(
1780             VerificationType::reference_check(), CHECK_VERIFY(this));
1781           if (!(type.is_null() || type.is_array())) {
1782             verify_error(ErrorContext::bad_type(
1783                 bci, current_frame.stack_top_ctx()),
1784                 bad_type_msg, "arraylength");
1785           }
1786           current_frame.push_stack(
1787             VerificationType::integer_type(), CHECK_VERIFY(this));
1788           no_control_flow = false; break;
1789         case Bytecodes::_checkcast :
1790         {
1791           index = bcs.get_index_u2();
1792           verify_cp_class_type(bci, index, cp, CHECK_VERIFY(this));
1793           current_frame.pop_stack(object_type(), CHECK_VERIFY(this));
1794           VerificationType klass_type = cp_index_to_type(
1795             index, cp, CHECK_VERIFY(this));
1796           current_frame.push_stack(klass_type, CHECK_VERIFY(this));
1797           no_control_flow = false; break;
1798         }
1799         case Bytecodes::_instanceof : {
1800           index = bcs.get_index_u2();
1801           verify_cp_class_type(bci, index, cp, CHECK_VERIFY(this));
1802           current_frame.pop_stack(object_type(), CHECK_VERIFY(this));
1803           current_frame.push_stack(
1804             VerificationType::integer_type(), CHECK_VERIFY(this));
1805           no_control_flow = false; break;
1806         }
1807         case Bytecodes::_monitorenter :
1808         case Bytecodes::_monitorexit : {
1809           VerificationType ref = current_frame.pop_stack(
1810             VerificationType::nonscalar_check(), CHECK_VERIFY(this));
1811           no_control_flow = false; break;
1812         }
1813         case Bytecodes::_multianewarray :
1814         {
1815           index = bcs.get_index_u2();
1816           u2 dim = *(bcs.bcp()+3);
1817           verify_cp_class_type(bci, index, cp, CHECK_VERIFY(this));
1818           VerificationType new_array_type =
1819             cp_index_to_type(index, cp, CHECK_VERIFY(this));
1820           if (!new_array_type.is_array()) {
1821             verify_error(ErrorContext::bad_type(bci,
1822                 TypeOrigin::cp(index, new_array_type)),
1823                 "Illegal constant pool index in multianewarray instruction");
1824             return;
1825           }
1826           if (dim < 1 || new_array_type.dimensions() < dim) {
1827             verify_error(ErrorContext::bad_code(bci),
1828                 "Illegal dimension in multianewarray instruction: %d", dim);
1829             return;
1830           }
1831           for (int i = 0; i < dim; i++) {
1832             current_frame.pop_stack(
1833               VerificationType::integer_type(), CHECK_VERIFY(this));
1834           }
1835           current_frame.push_stack(new_array_type, CHECK_VERIFY(this));
1836           no_control_flow = false; break;
1837         }
1838         case Bytecodes::_athrow :
1839           type = VerificationType::reference_type(
1840             vmSymbols::java_lang_Throwable());
1841           current_frame.pop_stack(type, CHECK_VERIFY(this));
1842           no_control_flow = true; break;
1843         default:
1844           // We only need to check the valid bytecodes in class file.
1845           // And jsr and ret are not in the new class file format in JDK1.5.
1846           verify_error(ErrorContext::bad_code(bci),
1847               "Bad instruction: %02x", opcode);
1848           no_control_flow = false;
1849           return;
1850       }  // end switch
1851     }  // end Merge with the next instruction
1852 
1853     // Look for possible jump target in exception handlers and see if it matches
1854     // current_frame.  Don't do this check if it has already been done (for
1855     // ([a,d,f,i,l]store* opcodes).  This check cannot be done earlier because
1856     // opcodes, such as invokespecial, may set the this_uninit flag.
1857     assert(!(verified_exc_handlers && this_uninit),
1858       "Exception handler targets got verified before this_uninit got set");
1859     if (!verified_exc_handlers && bci >= ex_min && bci < ex_max) {
1860       if (was_recursively_verified()) return;
1861       verify_exception_handler_targets(
1862         bci, this_uninit, &current_frame, &stackmap_table, CHECK_VERIFY(this));
1863     }
1864   } // end while
1865 
1866   // Make sure that control flow does not fall through end of the method
1867   if (!no_control_flow) {
1868     verify_error(ErrorContext::bad_code(code_length),
1869         "Control flow falls through code end");
1870     return;
1871   }
1872 }
1873 
1874 #undef bad_type_message
1875 
1876 char* ClassVerifier::generate_code_data(const methodHandle& m, u4 code_length, TRAPS) {
1877   char* code_data = NEW_RESOURCE_ARRAY(char, code_length);
1878   memset(code_data, 0, sizeof(char) * code_length);
1879   RawBytecodeStream bcs(m);
1880 
1881   while (!bcs.is_last_bytecode()) {
1882     if (bcs.raw_next() != Bytecodes::_illegal) {
1883       int bci = bcs.bci();
1884       if (bcs.raw_code() == Bytecodes::_new) {
1885         code_data[bci] = NEW_OFFSET;
1886       } else {
1887         code_data[bci] = BYTECODE_OFFSET;
1888       }
1889     } else {
1890       verify_error(ErrorContext::bad_code(bcs.bci()), "Bad instruction");
1891       return NULL;
1892     }
1893   }
1894 
1895   return code_data;
1896 }
1897 
1898 // Since this method references the constant pool, call was_recursively_verified()
1899 // before calling this method to make sure a prior class load did not cause the
1900 // current class to get verified.
1901 void ClassVerifier::verify_exception_handler_table(u4 code_length, char* code_data, int& min, int& max, TRAPS) {
1902   ExceptionTable exhandlers(_method());
1903   int exlength = exhandlers.length();
1904   constantPoolHandle cp (THREAD, _method->constants());
1905 
1906   for(int i = 0; i < exlength; i++) {
1907     u2 start_pc = exhandlers.start_pc(i);
1908     u2 end_pc = exhandlers.end_pc(i);
1909     u2 handler_pc = exhandlers.handler_pc(i);
1910     if (start_pc >= code_length || code_data[start_pc] == 0) {
1911       class_format_error("Illegal exception table start_pc %d", start_pc);
1912       return;
1913     }
1914     if (end_pc != code_length) {   // special case: end_pc == code_length
1915       if (end_pc > code_length || code_data[end_pc] == 0) {
1916         class_format_error("Illegal exception table end_pc %d", end_pc);
1917         return;
1918       }
1919     }
1920     if (handler_pc >= code_length || code_data[handler_pc] == 0) {
1921       class_format_error("Illegal exception table handler_pc %d", handler_pc);
1922       return;
1923     }
1924     int catch_type_index = exhandlers.catch_type_index(i);
1925     if (catch_type_index != 0) {
1926       VerificationType catch_type = cp_index_to_type(
1927         catch_type_index, cp, CHECK_VERIFY(this));
1928       VerificationType throwable =
1929         VerificationType::reference_type(vmSymbols::java_lang_Throwable());
1930       bool is_subclass = throwable.is_assignable_from(
1931         catch_type, this, false, CHECK_VERIFY(this));
1932       if (!is_subclass) {
1933         // 4286534: should throw VerifyError according to recent spec change
1934         verify_error(ErrorContext::bad_type(handler_pc,
1935             TypeOrigin::cp(catch_type_index, catch_type),
1936             TypeOrigin::implicit(throwable)),
1937             "Catch type is not a subclass "
1938             "of Throwable in exception handler %d", handler_pc);
1939         return;
1940       }
1941     }
1942     if (start_pc < min) min = start_pc;
1943     if (end_pc > max) max = end_pc;
1944   }
1945 }
1946 
1947 void ClassVerifier::verify_local_variable_table(u4 code_length, char* code_data, TRAPS) {
1948   int localvariable_table_length = _method->localvariable_table_length();
1949   if (localvariable_table_length > 0) {
1950     LocalVariableTableElement* table = _method->localvariable_table_start();
1951     for (int i = 0; i < localvariable_table_length; i++) {
1952       u2 start_bci = table[i].start_bci;
1953       u2 length = table[i].length;
1954 
1955       if (start_bci >= code_length || code_data[start_bci] == 0) {
1956         class_format_error(
1957           "Illegal local variable table start_pc %d", start_bci);
1958         return;
1959       }
1960       u4 end_bci = (u4)(start_bci + length);
1961       if (end_bci != code_length) {
1962         if (end_bci >= code_length || code_data[end_bci] == 0) {
1963           class_format_error( "Illegal local variable table length %d", length);
1964           return;
1965         }
1966       }
1967     }
1968   }
1969 }
1970 
1971 u2 ClassVerifier::verify_stackmap_table(u2 stackmap_index, u2 bci,
1972                                         StackMapFrame* current_frame,
1973                                         StackMapTable* stackmap_table,
1974                                         bool no_control_flow, TRAPS) {
1975   if (stackmap_index < stackmap_table->get_frame_count()) {
1976     u2 this_offset = stackmap_table->get_offset(stackmap_index);
1977     if (no_control_flow && this_offset > bci) {
1978       verify_error(ErrorContext::missing_stackmap(bci),
1979                    "Expecting a stack map frame");
1980       return 0;
1981     }
1982     if (this_offset == bci) {
1983       ErrorContext ctx;
1984       // See if current stack map can be assigned to the frame in table.
1985       // current_frame is the stackmap frame got from the last instruction.
1986       // If matched, current_frame will be updated by this method.
1987       bool matches = stackmap_table->match_stackmap(
1988         current_frame, this_offset, stackmap_index,
1989         !no_control_flow, true, &ctx, CHECK_VERIFY_(this, 0));
1990       if (!matches) {
1991         // report type error
1992         verify_error(ctx, "Instruction type does not match stack map");
1993         return 0;
1994       }
1995       stackmap_index++;
1996     } else if (this_offset < bci) {
1997       // current_offset should have met this_offset.
1998       class_format_error("Bad stack map offset %d", this_offset);
1999       return 0;
2000     }
2001   } else if (no_control_flow) {
2002     verify_error(ErrorContext::bad_code(bci), "Expecting a stack map frame");
2003     return 0;
2004   }
2005   return stackmap_index;
2006 }
2007 
2008 // Since this method references the constant pool, call was_recursively_verified()
2009 // before calling this method to make sure a prior class load did not cause the
2010 // current class to get verified.
2011 void ClassVerifier::verify_exception_handler_targets(u2 bci, bool this_uninit,
2012                                                      StackMapFrame* current_frame,
2013                                                      StackMapTable* stackmap_table, TRAPS) {
2014   constantPoolHandle cp (THREAD, _method->constants());
2015   ExceptionTable exhandlers(_method());
2016   int exlength = exhandlers.length();
2017   for(int i = 0; i < exlength; i++) {
2018     u2 start_pc = exhandlers.start_pc(i);
2019     u2 end_pc = exhandlers.end_pc(i);
2020     u2 handler_pc = exhandlers.handler_pc(i);
2021     int catch_type_index = exhandlers.catch_type_index(i);
2022     if(bci >= start_pc && bci < end_pc) {
2023       u1 flags = current_frame->flags();
2024       if (this_uninit) {  flags |= FLAG_THIS_UNINIT; }
2025       StackMapFrame* new_frame = current_frame->frame_in_exception_handler(flags);
2026       if (catch_type_index != 0) {
2027         if (was_recursively_verified()) return;
2028         // We know that this index refers to a subclass of Throwable
2029         VerificationType catch_type = cp_index_to_type(
2030           catch_type_index, cp, CHECK_VERIFY(this));
2031         new_frame->push_stack(catch_type, CHECK_VERIFY(this));
2032       } else {
2033         VerificationType throwable =
2034           VerificationType::reference_type(vmSymbols::java_lang_Throwable());
2035         new_frame->push_stack(throwable, CHECK_VERIFY(this));
2036       }
2037       ErrorContext ctx;
2038       bool matches = stackmap_table->match_stackmap(
2039         new_frame, handler_pc, true, false, &ctx, CHECK_VERIFY(this));
2040       if (!matches) {
2041         verify_error(ctx, "Stack map does not match the one at "
2042             "exception handler %d", handler_pc);
2043         return;
2044       }
2045     }
2046   }
2047 }
2048 
2049 void ClassVerifier::verify_cp_index(
2050     u2 bci, const constantPoolHandle& cp, int index, TRAPS) {
2051   int nconstants = cp->length();
2052   if ((index <= 0) || (index >= nconstants)) {
2053     verify_error(ErrorContext::bad_cp_index(bci, index),
2054         "Illegal constant pool index %d in class %s",
2055         index, cp->pool_holder()->external_name());
2056     return;
2057   }
2058 }
2059 
2060 void ClassVerifier::verify_cp_type(
2061     u2 bci, int index, const constantPoolHandle& cp, unsigned int types, TRAPS) {
2062 
2063   // In some situations, bytecode rewriting may occur while we're verifying.
2064   // In this case, a constant pool cache exists and some indices refer to that
2065   // instead.  Be sure we don't pick up such indices by accident.
2066   // We must check was_recursively_verified() before we get here.
2067   guarantee(cp->cache() == NULL, "not rewritten yet");
2068 
2069   verify_cp_index(bci, cp, index, CHECK_VERIFY(this));
2070   unsigned int tag = cp->tag_at(index).value();
2071 
2072   if ((types & (1 << tag)) == 0) {
2073     verify_error(ErrorContext::bad_cp_index(bci, index),
2074       "Illegal type at constant pool entry %d in class %s",
2075       index, cp->pool_holder()->external_name());
2076     return;
2077   }
2078 }
2079 
2080 void ClassVerifier::verify_cp_class_type(
2081     u2 bci, int index, const constantPoolHandle& cp, TRAPS) {
2082   verify_cp_index(bci, cp, index, CHECK_VERIFY(this));
2083   constantTag tag = cp->tag_at(index);
2084   if (!tag.is_klass() && !tag.is_unresolved_klass()) {
2085     verify_error(ErrorContext::bad_cp_index(bci, index),
2086         "Illegal type at constant pool entry %d in class %s",
2087         index, cp->pool_holder()->external_name());
2088     return;
2089   }
2090 }
2091 
2092 void ClassVerifier::verify_error(ErrorContext ctx, const char* msg, ...) {
2093   stringStream ss;
2094 
2095   ctx.reset_frames();
2096   _exception_type = vmSymbols::java_lang_VerifyError();
2097   _error_context = ctx;
2098   va_list va;
2099   va_start(va, msg);
2100   ss.vprint(msg, va);
2101   va_end(va);
2102   _message = ss.as_string();
2103 #ifdef ASSERT
2104   ResourceMark rm;
2105   const char* exception_name = _exception_type->as_C_string();
2106   Exceptions::debug_check_abort(exception_name, NULL);
2107 #endif // ndef ASSERT
2108 }
2109 
2110 void ClassVerifier::class_format_error(const char* msg, ...) {
2111   stringStream ss;
2112   _exception_type = vmSymbols::java_lang_ClassFormatError();
2113   va_list va;
2114   va_start(va, msg);
2115   ss.vprint(msg, va);
2116   va_end(va);
2117   if (!_method.is_null()) {
2118     ss.print(" in method '");
2119     _method->print_external_name(&ss);
2120     ss.print("'");
2121   }
2122   _message = ss.as_string();
2123 }
2124 
2125 Klass* ClassVerifier::load_class(Symbol* name, TRAPS) {
2126   HandleMark hm(THREAD);
2127   // Get current loader and protection domain first.
2128   oop loader = current_class()->class_loader();
2129   oop protection_domain = current_class()->protection_domain();
2130 
2131   Klass* kls = SystemDictionary::resolve_or_fail(
2132     name, Handle(THREAD, loader), Handle(THREAD, protection_domain),
2133     true, THREAD);
2134 
2135   if (kls != NULL) {
2136     if (log_is_enabled(Debug, class, resolve)) {
2137       Verifier::trace_class_resolution(kls, current_class());
2138     }
2139   }
2140   return kls;
2141 }
2142 
2143 bool ClassVerifier::is_protected_access(InstanceKlass* this_class,
2144                                         Klass* target_class,
2145                                         Symbol* field_name,
2146                                         Symbol* field_sig,
2147                                         bool is_method) {
2148   NoSafepointVerifier nosafepoint;
2149 
2150   // If target class isn't a super class of this class, we don't worry about this case
2151   if (!this_class->is_subclass_of(target_class)) {
2152     return false;
2153   }
2154   // Check if the specified method or field is protected
2155   InstanceKlass* target_instance = InstanceKlass::cast(target_class);
2156   fieldDescriptor fd;
2157   if (is_method) {
2158     Method* m = target_instance->uncached_lookup_method(field_name, field_sig, Klass::find_overpass);
2159     if (m != NULL && m->is_protected()) {
2160       if (!this_class->is_same_class_package(m->method_holder())) {
2161         return true;
2162       }
2163     }
2164   } else {
2165     Klass* member_klass = target_instance->find_field(field_name, field_sig, &fd);
2166     if (member_klass != NULL && fd.is_protected()) {
2167       if (!this_class->is_same_class_package(member_klass)) {
2168         return true;
2169       }
2170     }
2171   }
2172   return false;
2173 }
2174 
2175 void ClassVerifier::verify_ldc(
2176     int opcode, u2 index, StackMapFrame* current_frame,
2177     const constantPoolHandle& cp, u2 bci, TRAPS) {
2178   verify_cp_index(bci, cp, index, CHECK_VERIFY(this));
2179   constantTag tag = cp->tag_at(index);
2180   unsigned int types = 0;
2181   if (opcode == Bytecodes::_ldc || opcode == Bytecodes::_ldc_w) {
2182     if (!tag.is_unresolved_klass()) {
2183       types = (1 << JVM_CONSTANT_Integer) | (1 << JVM_CONSTANT_Float)
2184             | (1 << JVM_CONSTANT_String) | (1 << JVM_CONSTANT_Class)
2185             | (1 << JVM_CONSTANT_MethodHandle) | (1 << JVM_CONSTANT_MethodType)
2186             | (1 << JVM_CONSTANT_Dynamic);
2187       // Note:  The class file parser already verified the legality of
2188       // MethodHandle and MethodType constants.
2189       verify_cp_type(bci, index, cp, types, CHECK_VERIFY(this));
2190     }
2191   } else {
2192     assert(opcode == Bytecodes::_ldc2_w, "must be ldc2_w");
2193     types = (1 << JVM_CONSTANT_Double) | (1 << JVM_CONSTANT_Long)
2194           | (1 << JVM_CONSTANT_Dynamic);
2195     verify_cp_type(bci, index, cp, types, CHECK_VERIFY(this));
2196   }
2197   if (tag.is_string() && cp->is_pseudo_string_at(index)) {
2198     current_frame->push_stack(object_type(), CHECK_VERIFY(this));
2199   } else if (tag.is_string()) {
2200     current_frame->push_stack(
2201       VerificationType::reference_type(
2202         vmSymbols::java_lang_String()), CHECK_VERIFY(this));
2203   } else if (tag.is_klass() || tag.is_unresolved_klass()) {
2204     current_frame->push_stack(
2205       VerificationType::reference_type(
2206         vmSymbols::java_lang_Class()), CHECK_VERIFY(this));
2207   } else if (tag.is_int()) {
2208     current_frame->push_stack(
2209       VerificationType::integer_type(), CHECK_VERIFY(this));
2210   } else if (tag.is_float()) {
2211     current_frame->push_stack(
2212       VerificationType::float_type(), CHECK_VERIFY(this));
2213   } else if (tag.is_double()) {
2214     current_frame->push_stack_2(
2215       VerificationType::double_type(),
2216       VerificationType::double2_type(), CHECK_VERIFY(this));
2217   } else if (tag.is_long()) {
2218     current_frame->push_stack_2(
2219       VerificationType::long_type(),
2220       VerificationType::long2_type(), CHECK_VERIFY(this));
2221   } else if (tag.is_method_handle()) {
2222     current_frame->push_stack(
2223       VerificationType::reference_type(
2224         vmSymbols::java_lang_invoke_MethodHandle()), CHECK_VERIFY(this));
2225   } else if (tag.is_method_type()) {
2226     current_frame->push_stack(
2227       VerificationType::reference_type(
2228         vmSymbols::java_lang_invoke_MethodType()), CHECK_VERIFY(this));
2229   } else if (tag.is_dynamic_constant()) {
2230     Symbol* constant_type = cp->uncached_signature_ref_at(index);
2231     // Field signature was checked in ClassFileParser.
2232     assert(SignatureVerifier::is_valid_type_signature(constant_type),
2233            "Invalid type for dynamic constant");
2234     assert(sizeof(VerificationType) == sizeof(uintptr_t),
2235           "buffer type must match VerificationType size");
2236     uintptr_t constant_type_buffer[2];
2237     VerificationType* v_constant_type = (VerificationType*)constant_type_buffer;
2238     SignatureStream sig_stream(constant_type, false);
2239     int n = change_sig_to_verificationType(&sig_stream, v_constant_type);
2240     int opcode_n = (opcode == Bytecodes::_ldc2_w ? 2 : 1);
2241     if (n != opcode_n) {
2242       // wrong kind of ldc; reverify against updated type mask
2243       types &= ~(1 << JVM_CONSTANT_Dynamic);
2244       verify_cp_type(bci, index, cp, types, CHECK_VERIFY(this));
2245     }
2246     for (int i = 0; i < n; i++) {
2247       current_frame->push_stack(v_constant_type[i], CHECK_VERIFY(this));
2248     }
2249   } else {
2250     /* Unreachable? verify_cp_type has already validated the cp type. */
2251     verify_error(
2252         ErrorContext::bad_cp_index(bci, index), "Invalid index in ldc");
2253     return;
2254   }
2255 }
2256 
2257 void ClassVerifier::verify_switch(
2258     RawBytecodeStream* bcs, u4 code_length, char* code_data,
2259     StackMapFrame* current_frame, StackMapTable* stackmap_table, TRAPS) {
2260   int bci = bcs->bci();
2261   address bcp = bcs->bcp();
2262   address aligned_bcp = align_up(bcp + 1, jintSize);
2263 
2264   if (_klass->major_version() < NONZERO_PADDING_BYTES_IN_SWITCH_MAJOR_VERSION) {
2265     // 4639449 & 4647081: padding bytes must be 0
2266     u2 padding_offset = 1;
2267     while ((bcp + padding_offset) < aligned_bcp) {
2268       if(*(bcp + padding_offset) != 0) {
2269         verify_error(ErrorContext::bad_code(bci),
2270                      "Nonzero padding byte in lookupswitch or tableswitch");
2271         return;
2272       }
2273       padding_offset++;
2274     }
2275   }
2276 
2277   int default_offset = (int) Bytes::get_Java_u4(aligned_bcp);
2278   int keys, delta;
2279   current_frame->pop_stack(
2280     VerificationType::integer_type(), CHECK_VERIFY(this));
2281   if (bcs->raw_code() == Bytecodes::_tableswitch) {
2282     jint low = (jint)Bytes::get_Java_u4(aligned_bcp + jintSize);
2283     jint high = (jint)Bytes::get_Java_u4(aligned_bcp + 2*jintSize);
2284     if (low > high) {
2285       verify_error(ErrorContext::bad_code(bci),
2286           "low must be less than or equal to high in tableswitch");
2287       return;
2288     }
2289     keys = high - low + 1;
2290     if (keys < 0) {
2291       verify_error(ErrorContext::bad_code(bci), "too many keys in tableswitch");
2292       return;
2293     }
2294     delta = 1;
2295   } else {
2296     keys = (int)Bytes::get_Java_u4(aligned_bcp + jintSize);
2297     if (keys < 0) {
2298       verify_error(ErrorContext::bad_code(bci),
2299                    "number of keys in lookupswitch less than 0");
2300       return;
2301     }
2302     delta = 2;
2303     // Make sure that the lookupswitch items are sorted
2304     for (int i = 0; i < (keys - 1); i++) {
2305       jint this_key = Bytes::get_Java_u4(aligned_bcp + (2+2*i)*jintSize);
2306       jint next_key = Bytes::get_Java_u4(aligned_bcp + (2+2*i+2)*jintSize);
2307       if (this_key >= next_key) {
2308         verify_error(ErrorContext::bad_code(bci),
2309                      "Bad lookupswitch instruction");
2310         return;
2311       }
2312     }
2313   }
2314   int target = bci + default_offset;
2315   stackmap_table->check_jump_target(current_frame, target, CHECK_VERIFY(this));
2316   for (int i = 0; i < keys; i++) {
2317     // Because check_jump_target() may safepoint, the bytecode could have
2318     // moved, which means 'aligned_bcp' is no good and needs to be recalculated.
2319     aligned_bcp = align_up(bcs->bcp() + 1, jintSize);
2320     target = bci + (jint)Bytes::get_Java_u4(aligned_bcp+(3+i*delta)*jintSize);
2321     stackmap_table->check_jump_target(
2322       current_frame, target, CHECK_VERIFY(this));
2323   }
2324   NOT_PRODUCT(aligned_bcp = NULL);  // no longer valid at this point
2325 }
2326 
2327 bool ClassVerifier::name_in_supers(
2328     Symbol* ref_name, InstanceKlass* current) {
2329   Klass* super = current->super();
2330   while (super != NULL) {
2331     if (super->name() == ref_name) {
2332       return true;
2333     }
2334     super = super->super();
2335   }
2336   return false;
2337 }
2338 
2339 void ClassVerifier::verify_field_instructions(RawBytecodeStream* bcs,
2340                                               StackMapFrame* current_frame,
2341                                               const constantPoolHandle& cp,
2342                                               bool allow_arrays,
2343                                               TRAPS) {
2344   u2 index = bcs->get_index_u2();
2345   verify_cp_type(bcs->bci(), index, cp,
2346       1 << JVM_CONSTANT_Fieldref, CHECK_VERIFY(this));
2347 
2348   // Get field name and signature
2349   Symbol* field_name = cp->name_ref_at(index);
2350   Symbol* field_sig = cp->signature_ref_at(index);
2351 
2352   // Field signature was checked in ClassFileParser.
2353   assert(SignatureVerifier::is_valid_type_signature(field_sig),
2354          "Invalid field signature");
2355 
2356   // Get referenced class type
2357   VerificationType ref_class_type = cp_ref_index_to_type(
2358     index, cp, CHECK_VERIFY(this));
2359   if (!ref_class_type.is_object() &&
2360       (!allow_arrays || !ref_class_type.is_array())) {
2361     verify_error(ErrorContext::bad_type(bcs->bci(),
2362         TypeOrigin::cp(index, ref_class_type)),
2363         "Expecting reference to class in class %s at constant pool index %d",
2364         _klass->external_name(), index);
2365     return;
2366   }
2367 
2368   VerificationType target_class_type = ref_class_type;
2369 
2370   assert(sizeof(VerificationType) == sizeof(uintptr_t),
2371         "buffer type must match VerificationType size");
2372   uintptr_t field_type_buffer[2];
2373   VerificationType* field_type = (VerificationType*)field_type_buffer;
2374   // If we make a VerificationType[2] array directly, the compiler calls
2375   // to the c-runtime library to do the allocation instead of just
2376   // stack allocating it.  Plus it would run constructors.  This shows up
2377   // in performance profiles.
2378 
2379   SignatureStream sig_stream(field_sig, false);
2380   VerificationType stack_object_type;
2381   int n = change_sig_to_verificationType(&sig_stream, field_type);
2382   u2 bci = bcs->bci();
2383   bool is_assignable;
2384   switch (bcs->raw_code()) {
2385     case Bytecodes::_getstatic: {
2386       for (int i = 0; i < n; i++) {
2387         current_frame->push_stack(field_type[i], CHECK_VERIFY(this));
2388       }
2389       break;
2390     }
2391     case Bytecodes::_putstatic: {
2392       for (int i = n - 1; i >= 0; i--) {
2393         current_frame->pop_stack(field_type[i], CHECK_VERIFY(this));
2394       }
2395       break;
2396     }
2397     case Bytecodes::_withfield: {
2398       for (int i = n - 1; i >= 0; i--) {
2399         current_frame->pop_stack(field_type[i], CHECK_VERIFY(this));
2400       }
2401       // stack_object_type and target_class_type must be the same value type.
2402       stack_object_type =
2403         current_frame->pop_stack(VerificationType::valuetype_check(), CHECK_VERIFY(this));
2404       VerificationType target_value_type =
2405         VerificationType::change_ref_to_valuetype(target_class_type);
2406       if (!stack_object_type.equals(target_value_type)) {
2407         verify_error(ErrorContext::bad_value_type(bci,
2408             current_frame->stack_top_ctx(),
2409             TypeOrigin::cp(index, target_class_type)),
2410             "Invalid type on operand stack in withfield instruction");
2411         return;
2412       }
2413       current_frame->push_stack(target_value_type, CHECK_VERIFY(this));
2414       break;
2415     }
2416     case Bytecodes::_getfield: {
2417       stack_object_type = current_frame->pop_stack(
2418         target_class_type, CHECK_VERIFY(this));
2419       for (int i = 0; i < n; i++) {
2420         current_frame->push_stack(field_type[i], CHECK_VERIFY(this));
2421       }
2422       goto check_protected;
2423     }
2424     case Bytecodes::_putfield: {
2425       for (int i = n - 1; i >= 0; i--) {
2426         current_frame->pop_stack(field_type[i], CHECK_VERIFY(this));
2427       }
2428       stack_object_type = current_frame->pop_stack(CHECK_VERIFY(this));
2429 
2430       // The JVMS 2nd edition allows field initialization before the superclass
2431       // initializer, if the field is defined within the current class.
2432       fieldDescriptor fd;
2433       if (stack_object_type == VerificationType::uninitialized_this_type() &&
2434           target_class_type.equals(current_type()) &&
2435           _klass->find_local_field(field_name, field_sig, &fd)) {
2436         stack_object_type = current_type();
2437       }
2438       is_assignable = target_class_type.is_assignable_from(
2439         stack_object_type, this, false, CHECK_VERIFY(this));
2440       if (!is_assignable) {
2441         verify_error(ErrorContext::bad_type(bci,
2442             current_frame->stack_top_ctx(),
2443             TypeOrigin::cp(index, target_class_type)),
2444             "Bad type on operand stack in putfield");
2445         return;
2446       }
2447     }
2448     check_protected: {
2449       if (_this_type == stack_object_type)
2450         break; // stack_object_type must be assignable to _current_class_type
2451       if (was_recursively_verified()) return;
2452       Symbol* ref_class_name =
2453         cp->klass_name_at(cp->klass_ref_index_at(index));
2454       if (!name_in_supers(ref_class_name, current_class()))
2455         // stack_object_type must be assignable to _current_class_type since:
2456         // 1. stack_object_type must be assignable to ref_class.
2457         // 2. ref_class must be _current_class or a subclass of it. It can't
2458         //    be a superclass of it. See revised JVMS 5.4.4.
2459         break;
2460 
2461       Klass* ref_class_oop = load_class(ref_class_name, CHECK);
2462       if (is_protected_access(current_class(), ref_class_oop, field_name,
2463                               field_sig, false)) {
2464         // It's protected access, check if stack object is assignable to
2465         // current class.
2466         is_assignable = current_type().is_assignable_from(
2467           stack_object_type, this, true, CHECK_VERIFY(this));
2468         if (!is_assignable) {
2469           verify_error(ErrorContext::bad_type(bci,
2470               current_frame->stack_top_ctx(),
2471               TypeOrigin::implicit(current_type())),
2472               "Bad access to protected data in getfield");
2473           return;
2474         }
2475       }
2476       break;
2477     }
2478     default: ShouldNotReachHere();
2479   }
2480 }
2481 
2482 // Look at the method's handlers.  If the bci is in the handler's try block
2483 // then check if the handler_pc is already on the stack.  If not, push it
2484 // unless the handler has already been scanned.
2485 void ClassVerifier::push_handlers(ExceptionTable* exhandlers,
2486                                   GrowableArray<u4>* handler_list,
2487                                   GrowableArray<u4>* handler_stack,
2488                                   u4 bci) {
2489   int exlength = exhandlers->length();
2490   for(int x = 0; x < exlength; x++) {
2491     if (bci >= exhandlers->start_pc(x) && bci < exhandlers->end_pc(x)) {
2492       u4 exhandler_pc = exhandlers->handler_pc(x);
2493       if (!handler_list->contains(exhandler_pc)) {
2494         handler_stack->append_if_missing(exhandler_pc);
2495         handler_list->append(exhandler_pc);
2496       }
2497     }
2498   }
2499 }
2500 
2501 // Return TRUE if all code paths starting with start_bc_offset end in
2502 // bytecode athrow or loop.
2503 bool ClassVerifier::ends_in_athrow(u4 start_bc_offset) {
2504   ResourceMark rm;
2505   // Create bytecode stream.
2506   RawBytecodeStream bcs(method());
2507   u4 code_length = method()->code_size();
2508   bcs.set_start(start_bc_offset);
2509   u4 target;
2510   // Create stack for storing bytecode start offsets for if* and *switch.
2511   GrowableArray<u4>* bci_stack = new GrowableArray<u4>(30);
2512   // Create stack for handlers for try blocks containing this handler.
2513   GrowableArray<u4>* handler_stack = new GrowableArray<u4>(30);
2514   // Create list of handlers that have been pushed onto the handler_stack
2515   // so that handlers embedded inside of their own TRY blocks only get
2516   // scanned once.
2517   GrowableArray<u4>* handler_list = new GrowableArray<u4>(30);
2518   // Create list of visited branch opcodes (goto* and if*).
2519   GrowableArray<u4>* visited_branches = new GrowableArray<u4>(30);
2520   ExceptionTable exhandlers(_method());
2521 
2522   while (true) {
2523     if (bcs.is_last_bytecode()) {
2524       // if no more starting offsets to parse or if at the end of the
2525       // method then return false.
2526       if ((bci_stack->is_empty()) || ((u4)bcs.end_bci() == code_length))
2527         return false;
2528       // Pop a bytecode starting offset and scan from there.
2529       bcs.set_start(bci_stack->pop());
2530     }
2531     Bytecodes::Code opcode = bcs.raw_next();
2532     u4 bci = bcs.bci();
2533 
2534     // If the bytecode is in a TRY block, push its handlers so they
2535     // will get parsed.
2536     push_handlers(&exhandlers, handler_list, handler_stack, bci);
2537 
2538     switch (opcode) {
2539       case Bytecodes::_if_icmpeq:
2540       case Bytecodes::_if_icmpne:
2541       case Bytecodes::_if_icmplt:
2542       case Bytecodes::_if_icmpge:
2543       case Bytecodes::_if_icmpgt:
2544       case Bytecodes::_if_icmple:
2545       case Bytecodes::_ifeq:
2546       case Bytecodes::_ifne:
2547       case Bytecodes::_iflt:
2548       case Bytecodes::_ifge:
2549       case Bytecodes::_ifgt:
2550       case Bytecodes::_ifle:
2551       case Bytecodes::_if_acmpeq:
2552       case Bytecodes::_if_acmpne:
2553       case Bytecodes::_ifnull:
2554       case Bytecodes::_ifnonnull:
2555         target = bcs.dest();
2556         if (visited_branches->contains(bci)) {
2557           if (bci_stack->is_empty()) {
2558             if (handler_stack->is_empty()) {
2559               return true;
2560             } else {
2561               // Parse the catch handlers for try blocks containing athrow.
2562               bcs.set_start(handler_stack->pop());
2563             }
2564           } else {
2565             // Pop a bytecode starting offset and scan from there.
2566             bcs.set_start(bci_stack->pop());
2567           }
2568         } else {
2569           if (target > bci) { // forward branch
2570             if (target >= code_length) return false;
2571             // Push the branch target onto the stack.
2572             bci_stack->push(target);
2573             // then, scan bytecodes starting with next.
2574             bcs.set_start(bcs.next_bci());
2575           } else { // backward branch
2576             // Push bytecode offset following backward branch onto the stack.
2577             bci_stack->push(bcs.next_bci());
2578             // Check bytecodes starting with branch target.
2579             bcs.set_start(target);
2580           }
2581           // Record target so we don't branch here again.
2582           visited_branches->append(bci);
2583         }
2584         break;
2585 
2586       case Bytecodes::_goto:
2587       case Bytecodes::_goto_w:
2588         target = (opcode == Bytecodes::_goto ? bcs.dest() : bcs.dest_w());
2589         if (visited_branches->contains(bci)) {
2590           if (bci_stack->is_empty()) {
2591             if (handler_stack->is_empty()) {
2592               return true;
2593             } else {
2594               // Parse the catch handlers for try blocks containing athrow.
2595               bcs.set_start(handler_stack->pop());
2596             }
2597           } else {
2598             // Been here before, pop new starting offset from stack.
2599             bcs.set_start(bci_stack->pop());
2600           }
2601         } else {
2602           if (target >= code_length) return false;
2603           // Continue scanning from the target onward.
2604           bcs.set_start(target);
2605           // Record target so we don't branch here again.
2606           visited_branches->append(bci);
2607         }
2608         break;
2609 
2610       // Check that all switch alternatives end in 'athrow' bytecodes. Since it
2611       // is  difficult to determine where each switch alternative ends, parse
2612       // each switch alternative until either hit a 'return', 'athrow', or reach
2613       // the end of the method's bytecodes.  This is gross but should be okay
2614       // because:
2615       // 1. tableswitch and lookupswitch byte codes in handlers for ctor explicit
2616       //    constructor invocations should be rare.
2617       // 2. if each switch alternative ends in an athrow then the parsing should be
2618       //    short.  If there is no athrow then it is bogus code, anyway.
2619       case Bytecodes::_lookupswitch:
2620       case Bytecodes::_tableswitch:
2621         {
2622           address aligned_bcp = align_up(bcs.bcp() + 1, jintSize);
2623           u4 default_offset = Bytes::get_Java_u4(aligned_bcp) + bci;
2624           int keys, delta;
2625           if (opcode == Bytecodes::_tableswitch) {
2626             jint low = (jint)Bytes::get_Java_u4(aligned_bcp + jintSize);
2627             jint high = (jint)Bytes::get_Java_u4(aligned_bcp + 2*jintSize);
2628             // This is invalid, but let the regular bytecode verifier
2629             // report this because the user will get a better error message.
2630             if (low > high) return true;
2631             keys = high - low + 1;
2632             delta = 1;
2633           } else {
2634             keys = (int)Bytes::get_Java_u4(aligned_bcp + jintSize);
2635             delta = 2;
2636           }
2637           // Invalid, let the regular bytecode verifier deal with it.
2638           if (keys < 0) return true;
2639 
2640           // Push the offset of the next bytecode onto the stack.
2641           bci_stack->push(bcs.next_bci());
2642 
2643           // Push the switch alternatives onto the stack.
2644           for (int i = 0; i < keys; i++) {
2645             u4 target = bci + (jint)Bytes::get_Java_u4(aligned_bcp+(3+i*delta)*jintSize);
2646             if (target > code_length) return false;
2647             bci_stack->push(target);
2648           }
2649 
2650           // Start bytecode parsing for the switch at the default alternative.
2651           if (default_offset > code_length) return false;
2652           bcs.set_start(default_offset);
2653           break;
2654         }
2655 
2656       case Bytecodes::_return:
2657         return false;
2658 
2659       case Bytecodes::_athrow:
2660         {
2661           if (bci_stack->is_empty()) {
2662             if (handler_stack->is_empty()) {
2663               return true;
2664             } else {
2665               // Parse the catch handlers for try blocks containing athrow.
2666               bcs.set_start(handler_stack->pop());
2667             }
2668           } else {
2669             // Pop a bytecode offset and starting scanning from there.
2670             bcs.set_start(bci_stack->pop());
2671           }
2672         }
2673         break;
2674 
2675       default:
2676         ;
2677     } // end switch
2678   } // end while loop
2679 
2680   return false;
2681 }
2682 
2683 void ClassVerifier::verify_invoke_init(
2684     RawBytecodeStream* bcs, u2 ref_class_index, VerificationType ref_class_type,
2685     StackMapFrame* current_frame, u4 code_length, bool in_try_block,
2686     bool *this_uninit, const constantPoolHandle& cp, StackMapTable* stackmap_table,
2687     TRAPS) {
2688   u2 bci = bcs->bci();
2689   VerificationType type = current_frame->pop_stack(
2690     VerificationType::reference_check(), CHECK_VERIFY(this));
2691   if (type == VerificationType::uninitialized_this_type()) {
2692     // The method must be an <init> method of this class or its superclass
2693     Klass* superk = current_class()->super();
2694     if (ref_class_type.name() != current_class()->name() &&
2695         ref_class_type.name() != superk->name()) {
2696       verify_error(ErrorContext::bad_type(bci,
2697           TypeOrigin::implicit(ref_class_type),
2698           TypeOrigin::implicit(current_type())),
2699           "Bad <init> method call");
2700       return;
2701     }
2702 
2703     // If this invokespecial call is done from inside of a TRY block then make
2704     // sure that all catch clause paths end in a throw.  Otherwise, this can
2705     // result in returning an incomplete object.
2706     if (in_try_block) {
2707       ExceptionTable exhandlers(_method());
2708       int exlength = exhandlers.length();
2709       for(int i = 0; i < exlength; i++) {
2710         u2 start_pc = exhandlers.start_pc(i);
2711         u2 end_pc = exhandlers.end_pc(i);
2712 
2713         if (bci >= start_pc && bci < end_pc) {
2714           if (!ends_in_athrow(exhandlers.handler_pc(i))) {
2715             verify_error(ErrorContext::bad_code(bci),
2716               "Bad <init> method call from after the start of a try block");
2717             return;
2718           } else if (log_is_enabled(Info, verification)) {
2719             ResourceMark rm(THREAD);
2720             log_info(verification)("Survived call to ends_in_athrow(): %s",
2721                                           current_class()->name()->as_C_string());
2722           }
2723         }
2724       }
2725 
2726       // Check the exception handler target stackmaps with the locals from the
2727       // incoming stackmap (before initialize_object() changes them to outgoing
2728       // state).
2729       if (was_recursively_verified()) return;
2730       verify_exception_handler_targets(bci, true, current_frame,
2731                                        stackmap_table, CHECK_VERIFY(this));
2732     } // in_try_block
2733 
2734     current_frame->initialize_object(type, current_type());
2735     *this_uninit = true;
2736   } else if (type.is_uninitialized()) {
2737     u2 new_offset = type.bci();
2738     address new_bcp = bcs->bcp() - bci + new_offset;
2739     if (new_offset > (code_length - 3) || (*new_bcp) != Bytecodes::_new) {
2740       /* Unreachable?  Stack map parsing ensures valid type and new
2741        * instructions have a valid BCI. */
2742       verify_error(ErrorContext::bad_code(new_offset),
2743                    "Expecting new instruction");
2744       return;
2745     }
2746     u2 new_class_index = Bytes::get_Java_u2(new_bcp + 1);
2747     if (was_recursively_verified()) return;
2748     verify_cp_class_type(bci, new_class_index, cp, CHECK_VERIFY(this));
2749 
2750     // The method must be an <init> method of the indicated class
2751     VerificationType new_class_type = cp_index_to_type(
2752       new_class_index, cp, CHECK_VERIFY(this));
2753     if (!new_class_type.equals(ref_class_type)) {
2754       verify_error(ErrorContext::bad_type(bci,
2755           TypeOrigin::cp(new_class_index, new_class_type),
2756           TypeOrigin::cp(ref_class_index, ref_class_type)),
2757           "Call to wrong <init> method");
2758       return;
2759     }
2760     // According to the VM spec, if the referent class is a superclass of the
2761     // current class, and is in a different runtime package, and the method is
2762     // protected, then the objectref must be the current class or a subclass
2763     // of the current class.
2764     VerificationType objectref_type = new_class_type;
2765     if (name_in_supers(ref_class_type.name(), current_class())) {
2766       Klass* ref_klass = load_class(ref_class_type.name(), CHECK);
2767       if (was_recursively_verified()) return;
2768       Method* m = InstanceKlass::cast(ref_klass)->uncached_lookup_method(
2769         vmSymbols::object_initializer_name(),
2770         cp->signature_ref_at(bcs->get_index_u2()),
2771         Klass::find_overpass);
2772       // Do nothing if method is not found.  Let resolution detect the error.
2773       if (m != NULL) {
2774         InstanceKlass* mh = m->method_holder();
2775         if (m->is_protected() && !mh->is_same_class_package(_klass)) {
2776           bool assignable = current_type().is_assignable_from(
2777             objectref_type, this, true, CHECK_VERIFY(this));
2778           if (!assignable) {
2779             verify_error(ErrorContext::bad_type(bci,
2780                 TypeOrigin::cp(new_class_index, objectref_type),
2781                 TypeOrigin::implicit(current_type())),
2782                 "Bad access to protected <init> method");
2783             return;
2784           }
2785         }
2786       }
2787     }
2788     // Check the exception handler target stackmaps with the locals from the
2789     // incoming stackmap (before initialize_object() changes them to outgoing
2790     // state).
2791     if (in_try_block) {
2792       if (was_recursively_verified()) return;
2793       verify_exception_handler_targets(bci, *this_uninit, current_frame,
2794                                        stackmap_table, CHECK_VERIFY(this));
2795     }
2796     current_frame->initialize_object(type, new_class_type);
2797   } else {
2798     verify_error(ErrorContext::bad_type(bci, current_frame->stack_top_ctx()),
2799         "Bad operand type when invoking <init>");
2800     return;
2801   }
2802 }
2803 
2804 bool ClassVerifier::is_same_or_direct_interface(
2805     InstanceKlass* klass,
2806     VerificationType klass_type,
2807     VerificationType ref_class_type) {
2808   if (ref_class_type.equals(klass_type)) return true;
2809   Array<InstanceKlass*>* local_interfaces = klass->local_interfaces();
2810   if (local_interfaces != NULL) {
2811     for (int x = 0; x < local_interfaces->length(); x++) {
2812       InstanceKlass* k = local_interfaces->at(x);
2813       assert (k != NULL && k->is_interface(), "invalid interface");
2814       if (ref_class_type.equals(VerificationType::reference_type(k->name()))) {
2815         return true;
2816       }
2817     }
2818   }
2819   return false;
2820 }
2821 
2822 void ClassVerifier::verify_invoke_instructions(
2823     RawBytecodeStream* bcs, u4 code_length, StackMapFrame* current_frame,
2824     bool in_try_block, bool *this_uninit,
2825     const constantPoolHandle& cp, StackMapTable* stackmap_table, TRAPS) {
2826   // Make sure the constant pool item is the right type
2827   u2 index = bcs->get_index_u2();
2828   Bytecodes::Code opcode = bcs->raw_code();
2829   unsigned int types = 0;
2830   switch (opcode) {
2831     case Bytecodes::_invokeinterface:
2832       types = 1 << JVM_CONSTANT_InterfaceMethodref;
2833       break;
2834     case Bytecodes::_invokedynamic:
2835       types = 1 << JVM_CONSTANT_InvokeDynamic;
2836       break;
2837     case Bytecodes::_invokespecial:
2838     case Bytecodes::_invokestatic:
2839       types = (_klass->major_version() < STATIC_METHOD_IN_INTERFACE_MAJOR_VERSION) ?
2840         (1 << JVM_CONSTANT_Methodref) :
2841         ((1 << JVM_CONSTANT_InterfaceMethodref) | (1 << JVM_CONSTANT_Methodref));
2842       break;
2843     default:
2844       types = 1 << JVM_CONSTANT_Methodref;
2845   }
2846   verify_cp_type(bcs->bci(), index, cp, types, CHECK_VERIFY(this));
2847 
2848   // Get method name and signature
2849   Symbol* method_name = cp->name_ref_at(index);
2850   Symbol* method_sig = cp->signature_ref_at(index);
2851 
2852   // Method signature was checked in ClassFileParser.
2853   assert(SignatureVerifier::is_valid_method_signature(method_sig),
2854          "Invalid method signature");
2855 
2856   // Get referenced class
2857   VerificationType ref_class_type;
2858   if (opcode == Bytecodes::_invokedynamic) {
2859     if (_klass->major_version() < Verifier::INVOKEDYNAMIC_MAJOR_VERSION) {
2860       class_format_error(
2861         "invokedynamic instructions not supported by this class file version (%d), class %s",
2862         _klass->major_version(), _klass->external_name());
2863       return;
2864     }
2865   } else {
2866     ref_class_type = cp_ref_index_to_type(index, cp, CHECK_VERIFY(this));
2867   }
2868 
2869   assert(sizeof(VerificationType) == sizeof(uintptr_t),
2870         "buffer type must match VerificationType size");
2871 
2872   // Get the UTF8 index for this signature.
2873   int sig_index = cp->signature_ref_index_at(cp->name_and_type_ref_index_at(index));
2874 
2875   // Get the signature's verification types.
2876   sig_as_verification_types* mth_sig_verif_types;
2877   sig_as_verification_types** mth_sig_verif_types_ptr = method_signatures_table()->get(sig_index);
2878   if (mth_sig_verif_types_ptr != NULL) {
2879     // Found the entry for the signature's verification types in the hash table.
2880     mth_sig_verif_types = *mth_sig_verif_types_ptr;
2881     assert(mth_sig_verif_types != NULL, "Unexpected NULL sig_as_verification_types value");
2882   } else {
2883     // Not found, add the entry to the table.
2884     GrowableArray<VerificationType>* verif_types = new GrowableArray<VerificationType>(10);
2885     mth_sig_verif_types = new sig_as_verification_types(verif_types);
2886     create_method_sig_entry(mth_sig_verif_types, sig_index, CHECK_VERIFY(this));
2887   }
2888 
2889   // Get the number of arguments for this signature.
2890   int nargs = mth_sig_verif_types->num_args();
2891 
2892   // Check instruction operands
2893   u2 bci = bcs->bci();
2894   if (opcode == Bytecodes::_invokeinterface) {
2895     address bcp = bcs->bcp();
2896     // 4905268: count operand in invokeinterface should be nargs+1, not nargs.
2897     // JSR202 spec: The count operand of an invokeinterface instruction is valid if it is
2898     // the difference between the size of the operand stack before and after the instruction
2899     // executes.
2900     if (*(bcp+3) != (nargs+1)) {
2901       verify_error(ErrorContext::bad_code(bci),
2902           "Inconsistent args count operand in invokeinterface");
2903       return;
2904     }
2905     if (*(bcp+4) != 0) {
2906       verify_error(ErrorContext::bad_code(bci),
2907           "Fourth operand byte of invokeinterface must be zero");
2908       return;
2909     }
2910   }
2911 
2912   if (opcode == Bytecodes::_invokedynamic) {
2913     address bcp = bcs->bcp();
2914     if (*(bcp+3) != 0 || *(bcp+4) != 0) {
2915       verify_error(ErrorContext::bad_code(bci),
2916           "Third and fourth operand bytes of invokedynamic must be zero");
2917       return;
2918     }
2919   }
2920 
2921   if (method_name->char_at(0) == '<') {
2922     // Make sure <init> can only be invoked by invokespecial or invokestatic.
2923     // The allowed invocation mode of <init> depends on its signature.
2924     if ((opcode != Bytecodes::_invokespecial &&
2925          opcode != Bytecodes::_invokestatic) ||
2926         method_name != vmSymbols::object_initializer_name()) {
2927       verify_error(ErrorContext::bad_code(bci),
2928           "Illegal call to internal method");
2929       return;
2930     }
2931   } else if (opcode == Bytecodes::_invokespecial
2932              && !is_same_or_direct_interface(current_class(), current_type(), ref_class_type)
2933              && !ref_class_type.equals(VerificationType::reference_type(
2934                   current_class()->super()->name()))) { // super() can never be a value_type.
2935     bool subtype = false;
2936     bool have_imr_indirect = cp->tag_at(index).value() == JVM_CONSTANT_InterfaceMethodref;
2937     if (!current_class()->is_unsafe_anonymous()) {
2938       subtype = ref_class_type.is_assignable_from(
2939                  current_type(), this, false, CHECK_VERIFY(this));
2940     } else {
2941       InstanceKlass* unsafe_host = current_class()->unsafe_anonymous_host();
2942       VerificationType unsafe_anonymous_host_type = reference_or_valuetype(unsafe_host);
2943       subtype = ref_class_type.is_assignable_from(unsafe_anonymous_host_type, this, false, CHECK_VERIFY(this));
2944 
2945       // If invokespecial of IMR, need to recheck for same or
2946       // direct interface relative to the host class
2947       have_imr_indirect = (have_imr_indirect &&
2948                            !is_same_or_direct_interface(
2949                              unsafe_host,
2950                              unsafe_anonymous_host_type, ref_class_type));
2951     }
2952     if (!subtype) {
2953       verify_error(ErrorContext::bad_code(bci),
2954           "Bad invokespecial instruction: "
2955           "current class isn't assignable to reference class.");
2956        return;
2957     } else if (have_imr_indirect) {
2958       verify_error(ErrorContext::bad_code(bci),
2959           "Bad invokespecial instruction: "
2960           "interface method reference is in an indirect superinterface.");
2961       return;
2962     }
2963 
2964   }
2965 
2966   // Get the verification types for the method's arguments.
2967   GrowableArray<VerificationType>* sig_verif_types = mth_sig_verif_types->sig_verif_types();
2968   assert(sig_verif_types != NULL, "Missing signature's array of verification types");
2969   // Match method descriptor with operand stack
2970   // The arguments are on the stack in descending order.
2971   for (int i = nargs - 1; i >= 0; i--) { // Run backwards
2972     current_frame->pop_stack(sig_verif_types->at(i), CHECK_VERIFY(this));
2973   }
2974 
2975   // Check objectref on operand stack
2976   if (opcode != Bytecodes::_invokestatic &&
2977       opcode != Bytecodes::_invokedynamic) {
2978     if (method_name == vmSymbols::object_initializer_name()) {  // <init> method
2979       // (use of <init> as a static factory is handled under invokestatic)
2980       verify_invoke_init(bcs, index, ref_class_type, current_frame,
2981         code_length, in_try_block, this_uninit, cp, stackmap_table,
2982         CHECK_VERIFY(this));
2983       if (was_recursively_verified()) return;
2984     } else {   // other methods
2985       // Ensures that target class is assignable to method class.
2986       if (opcode == Bytecodes::_invokespecial) {
2987         if (!current_class()->is_unsafe_anonymous()) {
2988           current_frame->pop_stack(current_type(), CHECK_VERIFY(this));
2989         } else {
2990           // anonymous class invokespecial calls: check if the
2991           // objectref is a subtype of the unsafe_anonymous_host of the current class
2992           // to allow an anonymous class to reference methods in the unsafe_anonymous_host
2993           VerificationType top = current_frame->pop_stack(CHECK_VERIFY(this));
2994 
2995           InstanceKlass* unsafe_host = current_class()->unsafe_anonymous_host();
2996           VerificationType host_type = reference_or_valuetype(unsafe_host);
2997           bool subtype = host_type.is_assignable_from(top, this, false, CHECK_VERIFY(this));
2998           if (!subtype) {
2999             verify_error( ErrorContext::bad_type(current_frame->offset(),
3000               current_frame->stack_top_ctx(),
3001               TypeOrigin::implicit(top)),
3002               "Bad type on operand stack");
3003             return;
3004           }
3005         }
3006       } else if (opcode == Bytecodes::_invokevirtual) {
3007         VerificationType stack_object_type =
3008           current_frame->pop_stack(ref_class_type, CHECK_VERIFY(this));
3009         if (current_type() != stack_object_type) {
3010           if (was_recursively_verified()) return;
3011           assert(cp->cache() == NULL, "not rewritten yet");
3012           Symbol* ref_class_name =
3013             cp->klass_name_at(cp->klass_ref_index_at(index));
3014           // See the comments in verify_field_instructions() for
3015           // the rationale behind this.
3016           if (name_in_supers(ref_class_name, current_class())) {
3017             Klass* ref_class = load_class(ref_class_name, CHECK);
3018             if (is_protected_access(
3019                   _klass, ref_class, method_name, method_sig, true)) {
3020               // It's protected access, check if stack object is
3021               // assignable to current class.
3022               bool is_assignable = current_type().is_assignable_from(
3023                 stack_object_type, this, true, CHECK_VERIFY(this));
3024               if (!is_assignable) {
3025                 if (ref_class_type.name() == vmSymbols::java_lang_Object()
3026                     && stack_object_type.is_array()
3027                     && method_name == vmSymbols::clone_name()) {
3028                   // Special case: arrays pretend to implement public Object
3029                   // clone().
3030                 } else {
3031                   verify_error(ErrorContext::bad_type(bci,
3032                       current_frame->stack_top_ctx(),
3033                       TypeOrigin::implicit(current_type())),
3034                       "Bad access to protected data in invokevirtual");
3035                   return;
3036                 }
3037               }
3038             }
3039           }
3040         }
3041       } else {
3042         assert(opcode == Bytecodes::_invokeinterface, "Unexpected opcode encountered");
3043         current_frame->pop_stack(ref_class_type, CHECK_VERIFY(this));
3044       }
3045     }
3046   }
3047   // Push the result type.
3048   int sig_verif_types_len = sig_verif_types->length();
3049   if (sig_verif_types_len > nargs) {  // There's a return type
3050     if (method_name == vmSymbols::object_initializer_name() &&
3051         opcode != Bytecodes::_invokestatic) {
3052       // an <init> method must have a void return type, unless it's a static factory
3053       verify_error(ErrorContext::bad_code(bci),
3054           "Return type must be void in <init> method");
3055       return;
3056     }
3057 
3058     assert(sig_verif_types_len <= nargs + 2,
3059            "Signature verification types array return type is bogus");
3060     for (int i = nargs; i < sig_verif_types_len; i++) {
3061       assert(i == nargs || sig_verif_types->at(i).is_long2() ||
3062              sig_verif_types->at(i).is_double2(), "Unexpected return verificationType");
3063       current_frame->push_stack(sig_verif_types->at(i), CHECK_VERIFY(this));
3064     }
3065   } else {
3066     // an <init> method may not have a void return type, if it's a static factory
3067     if (method_name == vmSymbols::object_initializer_name() &&
3068         opcode != Bytecodes::_invokespecial) {
3069       verify_error(ErrorContext::bad_code(bci),
3070           "Return type must be non-void in <init> static factory method");
3071       return;
3072     }
3073   }
3074 }
3075 
3076 VerificationType ClassVerifier::get_newarray_type(
3077     u2 index, u2 bci, TRAPS) {
3078   const char* from_bt[] = {
3079     NULL, NULL, NULL, NULL, "[Z", "[C", "[F", "[D", "[B", "[S", "[I", "[J",
3080   };
3081   if (index < T_BOOLEAN || index > T_LONG) {
3082     verify_error(ErrorContext::bad_code(bci), "Illegal newarray instruction");
3083     return VerificationType::bogus_type();
3084   }
3085 
3086   // from_bt[index] contains the array signature which has a length of 2
3087   Symbol* sig = create_temporary_symbol(from_bt[index], 2);
3088   return VerificationType::reference_type(sig);
3089 }
3090 
3091 void ClassVerifier::verify_anewarray(
3092     u2 bci, u2 index, const constantPoolHandle& cp,
3093     StackMapFrame* current_frame, TRAPS) {
3094   verify_cp_class_type(bci, index, cp, CHECK_VERIFY(this));
3095   current_frame->pop_stack(
3096     VerificationType::integer_type(), CHECK_VERIFY(this));
3097 
3098   if (was_recursively_verified()) return;
3099   VerificationType component_type =
3100     cp_index_to_type(index, cp, CHECK_VERIFY(this));
3101   int length;
3102   char* arr_sig_str;
3103   if (component_type.is_array()) {     // it's an array
3104     const char* component_name = component_type.name()->as_utf8();
3105     // Check for more than MAX_ARRAY_DIMENSIONS
3106     length = (int)strlen(component_name);
3107     if (length > MAX_ARRAY_DIMENSIONS &&
3108         component_name[MAX_ARRAY_DIMENSIONS - 1] == '[') {
3109       verify_error(ErrorContext::bad_code(bci),
3110         "Illegal anewarray instruction, array has more than 255 dimensions");
3111     }
3112     // add one dimension to component
3113     length++;
3114     arr_sig_str = NEW_RESOURCE_ARRAY_IN_THREAD(THREAD, char, length + 1);
3115     int n = os::snprintf(arr_sig_str, length + 1, "[%s", component_name);
3116     assert(n == length, "Unexpected number of characters in string");
3117   } else {         // it's an object or interface
3118     const char* component_name = component_type.name()->as_utf8();
3119     char Q_or_L = component_type.is_valuetype() ? 'Q' : 'L';
3120     // add one dimension to component with 'L' or 'Q' prepended and ';' appended.
3121     length = (int)strlen(component_name) + 3;
3122     arr_sig_str = NEW_RESOURCE_ARRAY_IN_THREAD(THREAD, char, length + 1);
3123     int n = os::snprintf(arr_sig_str, length + 1, "[%c%s;", Q_or_L, component_name);
3124     assert(n == length, "Unexpected number of characters in string");
3125   }
3126   Symbol* arr_sig = create_temporary_symbol(arr_sig_str, length);
3127   VerificationType new_array_type = VerificationType::reference_type(arr_sig);
3128   current_frame->push_stack(new_array_type, CHECK_VERIFY(this));
3129 }
3130 
3131 void ClassVerifier::verify_iload(u2 index, StackMapFrame* current_frame, TRAPS) {
3132   current_frame->get_local(
3133     index, VerificationType::integer_type(), CHECK_VERIFY(this));
3134   current_frame->push_stack(
3135     VerificationType::integer_type(), CHECK_VERIFY(this));
3136 }
3137 
3138 void ClassVerifier::verify_lload(u2 index, StackMapFrame* current_frame, TRAPS) {
3139   current_frame->get_local_2(
3140     index, VerificationType::long_type(),
3141     VerificationType::long2_type(), CHECK_VERIFY(this));
3142   current_frame->push_stack_2(
3143     VerificationType::long_type(),
3144     VerificationType::long2_type(), CHECK_VERIFY(this));
3145 }
3146 
3147 void ClassVerifier::verify_fload(u2 index, StackMapFrame* current_frame, TRAPS) {
3148   current_frame->get_local(
3149     index, VerificationType::float_type(), CHECK_VERIFY(this));
3150   current_frame->push_stack(
3151     VerificationType::float_type(), CHECK_VERIFY(this));
3152 }
3153 
3154 void ClassVerifier::verify_dload(u2 index, StackMapFrame* current_frame, TRAPS) {
3155   current_frame->get_local_2(
3156     index, VerificationType::double_type(),
3157     VerificationType::double2_type(), CHECK_VERIFY(this));
3158   current_frame->push_stack_2(
3159     VerificationType::double_type(),
3160     VerificationType::double2_type(), CHECK_VERIFY(this));
3161 }
3162 
3163 void ClassVerifier::verify_aload(u2 index, StackMapFrame* current_frame, TRAPS) {
3164   VerificationType type = current_frame->get_local(
3165     index, VerificationType::nonscalar_check(), CHECK_VERIFY(this));
3166   current_frame->push_stack(type, CHECK_VERIFY(this));
3167 }
3168 
3169 void ClassVerifier::verify_istore(u2 index, StackMapFrame* current_frame, TRAPS) {
3170   current_frame->pop_stack(
3171     VerificationType::integer_type(), CHECK_VERIFY(this));
3172   current_frame->set_local(
3173     index, VerificationType::integer_type(), CHECK_VERIFY(this));
3174 }
3175 
3176 void ClassVerifier::verify_lstore(u2 index, StackMapFrame* current_frame, TRAPS) {
3177   current_frame->pop_stack_2(
3178     VerificationType::long2_type(),
3179     VerificationType::long_type(), CHECK_VERIFY(this));
3180   current_frame->set_local_2(
3181     index, VerificationType::long_type(),
3182     VerificationType::long2_type(), CHECK_VERIFY(this));
3183 }
3184 
3185 void ClassVerifier::verify_fstore(u2 index, StackMapFrame* current_frame, TRAPS) {
3186   current_frame->pop_stack(VerificationType::float_type(), CHECK_VERIFY(this));
3187   current_frame->set_local(
3188     index, VerificationType::float_type(), CHECK_VERIFY(this));
3189 }
3190 
3191 void ClassVerifier::verify_dstore(u2 index, StackMapFrame* current_frame, TRAPS) {
3192   current_frame->pop_stack_2(
3193     VerificationType::double2_type(),
3194     VerificationType::double_type(), CHECK_VERIFY(this));
3195   current_frame->set_local_2(
3196     index, VerificationType::double_type(),
3197     VerificationType::double2_type(), CHECK_VERIFY(this));
3198 }
3199 
3200 void ClassVerifier::verify_astore(u2 index, StackMapFrame* current_frame, TRAPS) {
3201   VerificationType type = current_frame->pop_stack(
3202     VerificationType::nonscalar_check(), CHECK_VERIFY(this));
3203   current_frame->set_local(index, type, CHECK_VERIFY(this));
3204 }
3205 
3206 void ClassVerifier::verify_iinc(u2 index, StackMapFrame* current_frame, TRAPS) {
3207   VerificationType type = current_frame->get_local(
3208     index, VerificationType::integer_type(), CHECK_VERIFY(this));
3209   current_frame->set_local(index, type, CHECK_VERIFY(this));
3210 }
3211 
3212 void ClassVerifier::verify_return_value(
3213     VerificationType return_type, VerificationType type, u2 bci,
3214     StackMapFrame* current_frame, TRAPS) {
3215   if (return_type == VerificationType::bogus_type()) {
3216     verify_error(ErrorContext::bad_type(bci,
3217         current_frame->stack_top_ctx(), TypeOrigin::signature(return_type)),
3218         "Method expects a return value");
3219     return;
3220   }
3221   bool match = return_type.is_assignable_from(type, this, false, CHECK_VERIFY(this));
3222   if (!match) {
3223     verify_error(ErrorContext::bad_type(bci,
3224         current_frame->stack_top_ctx(), TypeOrigin::signature(return_type)),
3225         "Bad return type");
3226     return;
3227   }
3228 }
3229 
3230 // The verifier creates symbols which are substrings of Symbols.
3231 // These are stored in the verifier until the end of verification so that
3232 // they can be reference counted.
3233 Symbol* ClassVerifier::create_temporary_symbol(const Symbol *s, int begin,
3234                                                int end) {
3235   const char* name = (const char*)s->base() + begin;
3236   int length = end - begin;
3237   return create_temporary_symbol(name, length);
3238 }
3239 
3240 Symbol* ClassVerifier::create_temporary_symbol(const char *name, int length) {
3241   // Quick deduplication check
3242   if (_previous_symbol != NULL && _previous_symbol->equals(name, length)) {
3243     return _previous_symbol;
3244   }
3245   Symbol* sym = SymbolTable::new_symbol(name, length);
3246   if (!sym->is_permanent()) {
3247     if (_symbols == NULL) {
3248       _symbols = new GrowableArray<Symbol*>(50, 0, NULL);
3249     }
3250     _symbols->push(sym);
3251   }
3252   _previous_symbol = sym;
3253   return sym;
3254 }
--- EOF ---