1 /*
   2  * Copyright (c) 1997, 2019, Oracle and/or its affiliates. All rights reserved.
   3  * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
   4  *
   5  * This code is free software; you can redistribute it and/or modify it
   6  * under the terms of the GNU General Public License version 2 only, as
   7  * published by the Free Software Foundation.
   8  *
   9  * This code is distributed in the hope that it will be useful, but WITHOUT
  10  * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
  11  * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
  12  * version 2 for more details (a copy is included in the LICENSE file that
  13  * accompanied this code).
  14  *
  15  * You should have received a copy of the GNU General Public License version
  16  * 2 along with this work; if not, write to the Free Software Foundation,
  17  * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
  18  *
  19  * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
  20  * or visit www.oracle.com if you need additional information or have any
  21  * questions.
  22  *
  23  */
  24 
  25 #include "precompiled.hpp"
  26 #include "interpreter/interpreter.hpp"
  27 #include "memory/resourceArea.hpp"
  28 #include "memory/universe.hpp"
  29 #include "oops/markOop.hpp"
  30 #include "oops/method.hpp"
  31 #include "oops/oop.inline.hpp"
  32 #include "prims/methodHandles.hpp"
  33 #include "runtime/frame.inline.hpp"
  34 #include "runtime/handles.inline.hpp"
  35 #include "runtime/javaCalls.hpp"
  36 #include "runtime/monitorChunk.hpp"
  37 #include "runtime/os.inline.hpp"
  38 #include "runtime/signature.hpp"
  39 #include "runtime/stubCodeGenerator.hpp"
  40 #include "runtime/stubRoutines.hpp"
  41 #include "vmreg_x86.inline.hpp"
  42 #ifdef COMPILER1
  43 #include "c1/c1_Runtime1.hpp"
  44 #include "runtime/vframeArray.hpp"
  45 #endif
  46 
  47 #ifdef ASSERT
  48 void RegisterMap::check_location_valid() {
  49 }
  50 #endif
  51 
  52 // Profiling/safepoint support
  53 
  54 bool frame::safe_for_sender(JavaThread *thread) {
  55   address   sp = (address)_sp;
  56   address   fp = (address)_fp;
  57   address   unextended_sp = (address)_unextended_sp;
  58 
  59   // consider stack guards when trying to determine "safe" stack pointers
  60   static size_t stack_guard_size = os::uses_stack_guard_pages() ?
  61     JavaThread::stack_red_zone_size() + JavaThread::stack_yellow_zone_size() : 0;
  62   size_t usable_stack_size = thread->stack_size() - stack_guard_size;
  63 
  64   // sp must be within the usable part of the stack (not in guards)
  65   bool sp_safe = (sp < thread->stack_base()) &&
  66                  (sp >= thread->stack_base() - usable_stack_size);
  67 
  68 
  69   if (!sp_safe) {
  70     return false;
  71   }
  72 
  73   // unextended sp must be within the stack and above or equal sp
  74   bool unextended_sp_safe = (unextended_sp < thread->stack_base()) &&
  75                             (unextended_sp >= sp);
  76 
  77   if (!unextended_sp_safe) {
  78     return false;
  79   }
  80 
  81   // an fp must be within the stack and above (but not equal) sp
  82   // second evaluation on fp+ is added to handle situation where fp is -1
  83   bool fp_safe = (fp < thread->stack_base() && (fp > sp) && (((fp + (return_addr_offset * sizeof(void*))) < thread->stack_base())));
  84 
  85   // We know sp/unextended_sp are safe only fp is questionable here
  86 
  87   // If the current frame is known to the code cache then we can attempt to
  88   // to construct the sender and do some validation of it. This goes a long way
  89   // toward eliminating issues when we get in frame construction code
  90 
  91   if (_cb != NULL ) {
  92 
  93     // First check if frame is complete and tester is reliable
  94     // Unfortunately we can only check frame complete for runtime stubs and nmethod
  95     // other generic buffer blobs are more problematic so we just assume they are
  96     // ok. adapter blobs never have a frame complete and are never ok.
  97 
  98     if (!_cb->is_frame_complete_at(_pc)) {
  99       if (_cb->is_compiled() || _cb->is_adapter_blob() || _cb->is_runtime_stub()) {
 100         return false;
 101       }
 102     }
 103 
 104     // Could just be some random pointer within the codeBlob
 105     if (!_cb->code_contains(_pc)) {
 106       return false;
 107     }
 108 
 109     // Entry frame checks
 110     if (is_entry_frame()) {
 111       // an entry frame must have a valid fp.
 112       return fp_safe && is_entry_frame_valid(thread);
 113     }
 114 
 115     intptr_t* sender_sp = NULL;
 116     intptr_t* sender_unextended_sp = NULL;
 117     address   sender_pc = NULL;
 118     intptr_t* saved_fp =  NULL;
 119 
 120     if (is_interpreted_frame()) {
 121       // fp must be safe
 122       if (!fp_safe) {
 123         return false;
 124       }
 125 
 126       sender_pc = (address) this->fp()[return_addr_offset];
 127       // for interpreted frames, the value below is the sender "raw" sp,
 128       // which can be different from the sender unextended sp (the sp seen
 129       // by the sender) because of current frame local variables
 130       sender_sp = (intptr_t*) addr_at(sender_sp_offset);
 131       sender_unextended_sp = (intptr_t*) this->fp()[interpreter_frame_sender_sp_offset];
 132       saved_fp = (intptr_t*) this->fp()[link_offset];
 133 
 134     } else {
 135       // must be some sort of compiled/runtime frame
 136       // fp does not have to be safe (although it could be check for c1?)
 137 
 138       // check for a valid frame_size, otherwise we are unlikely to get a valid sender_pc
 139       if (_cb->frame_size() <= 0) {
 140         return false;
 141       }
 142 
 143       sender_sp = _unextended_sp + _cb->frame_size();
 144       // Is sender_sp safe?
 145       if ((address)sender_sp >= thread->stack_base()) {
 146         return false;
 147       }
 148       // On Intel the return_address is always the word on the stack
 149       sender_pc = (address) *(sender_sp-1);
 150       // Note: frame::sender_sp_offset is only valid for compiled frame
 151       intptr_t** saved_fp_addr = (intptr_t**) (sender_sp - frame::sender_sp_offset);
 152       saved_fp = *saved_fp_addr;
 153 
 154       // Repair the sender sp if this is a method with scalarized value type args
 155       sender_sp = repair_sender_sp(sender_sp, saved_fp_addr);
 156       sender_unextended_sp = sender_sp;
 157     }
 158 
 159     // If the potential sender is the interpreter then we can do some more checking
 160     if (Interpreter::contains(sender_pc)) {
 161 
 162       // ebp is always saved in a recognizable place in any code we generate. However
 163       // only if the sender is interpreted/call_stub (c1 too?) are we certain that the saved ebp
 164       // is really a frame pointer.
 165 
 166       bool saved_fp_safe = ((address)saved_fp < thread->stack_base()) && (saved_fp > sender_sp);
 167 
 168       if (!saved_fp_safe) {
 169         return false;
 170       }
 171 
 172       // construct the potential sender
 173 
 174       frame sender(sender_sp, sender_unextended_sp, saved_fp, sender_pc);
 175 
 176       return sender.is_interpreted_frame_valid(thread);
 177 
 178     }
 179 
 180     // We must always be able to find a recognizable pc
 181     CodeBlob* sender_blob = CodeCache::find_blob_unsafe(sender_pc);
 182     if (sender_pc == NULL ||  sender_blob == NULL) {
 183       return false;
 184     }
 185 
 186     // Could be a zombie method
 187     if (sender_blob->is_zombie() || sender_blob->is_unloaded()) {
 188       return false;
 189     }
 190 
 191     // Could just be some random pointer within the codeBlob
 192     if (!sender_blob->code_contains(sender_pc)) {
 193       return false;
 194     }
 195 
 196     // We should never be able to see an adapter if the current frame is something from code cache
 197     if (sender_blob->is_adapter_blob()) {
 198       return false;
 199     }
 200 
 201     // Could be the call_stub
 202     if (StubRoutines::returns_to_call_stub(sender_pc)) {
 203       bool saved_fp_safe = ((address)saved_fp < thread->stack_base()) && (saved_fp > sender_sp);
 204 
 205       if (!saved_fp_safe) {
 206         return false;
 207       }
 208 
 209       // construct the potential sender
 210 
 211       frame sender(sender_sp, sender_unextended_sp, saved_fp, sender_pc);
 212 
 213       // Validate the JavaCallWrapper an entry frame must have
 214       address jcw = (address)sender.entry_frame_call_wrapper();
 215 
 216       bool jcw_safe = (jcw < thread->stack_base()) && (jcw > (address)sender.fp());
 217 
 218       return jcw_safe;
 219     }
 220 
 221     CompiledMethod* nm = sender_blob->as_compiled_method_or_null();
 222     if (nm != NULL) {
 223         if (nm->is_deopt_mh_entry(sender_pc) || nm->is_deopt_entry(sender_pc) ||
 224             nm->method()->is_method_handle_intrinsic()) {
 225             return false;
 226         }
 227     }
 228 
 229     // If the frame size is 0 something (or less) is bad because every nmethod has a non-zero frame size
 230     // because the return address counts against the callee's frame.
 231 
 232     if (sender_blob->frame_size() <= 0) {
 233       assert(!sender_blob->is_compiled(), "should count return address at least");
 234       return false;
 235     }
 236 
 237     // We should never be able to see anything here except an nmethod. If something in the
 238     // code cache (current frame) is called by an entity within the code cache that entity
 239     // should not be anything but the call stub (already covered), the interpreter (already covered)
 240     // or an nmethod.
 241 
 242     if (!sender_blob->is_compiled()) {
 243         return false;
 244     }
 245 
 246     // Could put some more validation for the potential non-interpreted sender
 247     // frame we'd create by calling sender if I could think of any. Wait for next crash in forte...
 248 
 249     // One idea is seeing if the sender_pc we have is one that we'd expect to call to current cb
 250 
 251     // We've validated the potential sender that would be created
 252     return true;
 253   }
 254 
 255   // Must be native-compiled frame. Since sender will try and use fp to find
 256   // linkages it must be safe
 257 
 258   if (!fp_safe) {
 259     return false;
 260   }
 261 
 262   // Will the pc we fetch be non-zero (which we'll find at the oldest frame)
 263 
 264   if ( (address) this->fp()[return_addr_offset] == NULL) return false;
 265 
 266 
 267   // could try and do some more potential verification of native frame if we could think of some...
 268 
 269   return true;
 270 
 271 }
 272 
 273 
 274 void frame::patch_pc(Thread* thread, address pc) {
 275   address* pc_addr = &(((address*) sp())[-1]);
 276   if (TracePcPatching) {
 277     tty->print_cr("patch_pc at address " INTPTR_FORMAT " [" INTPTR_FORMAT " -> " INTPTR_FORMAT "]",
 278                   p2i(pc_addr), p2i(*pc_addr), p2i(pc));
 279   }
 280   // Either the return address is the original one or we are going to
 281   // patch in the same address that's already there.
 282   assert(_pc == *pc_addr || pc == *pc_addr, "must be");
 283   *pc_addr = pc;
 284   _cb = CodeCache::find_blob(pc);
 285   address original_pc = CompiledMethod::get_deopt_original_pc(this);
 286   if (original_pc != NULL) {
 287     assert(original_pc == _pc, "expected original PC to be stored before patching");
 288     _deopt_state = is_deoptimized;
 289     // leave _pc as is
 290   } else {
 291     _deopt_state = not_deoptimized;
 292     _pc = pc;
 293   }
 294 }
 295 
 296 bool frame::is_interpreted_frame() const  {
 297   return Interpreter::contains(pc());
 298 }
 299 
 300 int frame::frame_size(RegisterMap* map) const {
 301   frame sender = this->sender(map);
 302   return sender.sp() - sp();
 303 }
 304 
 305 intptr_t* frame::entry_frame_argument_at(int offset) const {
 306   // convert offset to index to deal with tsi
 307   int index = (Interpreter::expr_offset_in_bytes(offset)/wordSize);
 308   // Entry frame's arguments are always in relation to unextended_sp()
 309   return &unextended_sp()[index];
 310 }
 311 
 312 // sender_sp
 313 
 314 intptr_t* frame::interpreter_frame_sender_sp() const {
 315   assert(is_interpreted_frame(), "interpreted frame expected");
 316   return (intptr_t*) at(interpreter_frame_sender_sp_offset);
 317 }
 318 
 319 void frame::set_interpreter_frame_sender_sp(intptr_t* sender_sp) {
 320   assert(is_interpreted_frame(), "interpreted frame expected");
 321   ptr_at_put(interpreter_frame_sender_sp_offset, (intptr_t) sender_sp);
 322 }
 323 
 324 
 325 // monitor elements
 326 
 327 BasicObjectLock* frame::interpreter_frame_monitor_begin() const {
 328   return (BasicObjectLock*) addr_at(interpreter_frame_monitor_block_bottom_offset);
 329 }
 330 
 331 BasicObjectLock* frame::interpreter_frame_monitor_end() const {
 332   BasicObjectLock* result = (BasicObjectLock*) *addr_at(interpreter_frame_monitor_block_top_offset);
 333   // make sure the pointer points inside the frame
 334   assert(sp() <= (intptr_t*) result, "monitor end should be above the stack pointer");
 335   assert((intptr_t*) result < fp(),  "monitor end should be strictly below the frame pointer");
 336   return result;
 337 }
 338 
 339 void frame::interpreter_frame_set_monitor_end(BasicObjectLock* value) {
 340   *((BasicObjectLock**)addr_at(interpreter_frame_monitor_block_top_offset)) = value;
 341 }
 342 
 343 // Used by template based interpreter deoptimization
 344 void frame::interpreter_frame_set_last_sp(intptr_t* sp) {
 345     *((intptr_t**)addr_at(interpreter_frame_last_sp_offset)) = sp;
 346 }
 347 
 348 frame frame::sender_for_entry_frame(RegisterMap* map) const {
 349   assert(map != NULL, "map must be set");
 350   // Java frame called from C; skip all C frames and return top C
 351   // frame of that chunk as the sender
 352   JavaFrameAnchor* jfa = entry_frame_call_wrapper()->anchor();
 353   assert(!entry_frame_is_first(), "next Java fp must be non zero");
 354   assert(jfa->last_Java_sp() > sp(), "must be above this frame on stack");
 355   // Since we are walking the stack now this nested anchor is obviously walkable
 356   // even if it wasn't when it was stacked.
 357   if (!jfa->walkable()) {
 358     // Capture _last_Java_pc (if needed) and mark anchor walkable.
 359     jfa->capture_last_Java_pc();
 360   }
 361   map->clear();
 362   assert(map->include_argument_oops(), "should be set by clear");
 363   vmassert(jfa->last_Java_pc() != NULL, "not walkable");
 364   frame fr(jfa->last_Java_sp(), jfa->last_Java_fp(), jfa->last_Java_pc());
 365   return fr;
 366 }
 367 
 368 //------------------------------------------------------------------------------
 369 // frame::verify_deopt_original_pc
 370 //
 371 // Verifies the calculated original PC of a deoptimization PC for the
 372 // given unextended SP.
 373 #ifdef ASSERT
 374 void frame::verify_deopt_original_pc(CompiledMethod* nm, intptr_t* unextended_sp) {
 375   frame fr;
 376 
 377   // This is ugly but it's better than to change {get,set}_original_pc
 378   // to take an SP value as argument.  And it's only a debugging
 379   // method anyway.
 380   fr._unextended_sp = unextended_sp;
 381 
 382   address original_pc = nm->get_original_pc(&fr);
 383   assert(nm->insts_contains_inclusive(original_pc),
 384          "original PC must be in the main code section of the the compiled method (or must be immediately following it)");
 385 }
 386 #endif
 387 
 388 //------------------------------------------------------------------------------
 389 // frame::adjust_unextended_sp
 390 #ifdef ASSERT
 391 void frame::adjust_unextended_sp() {
 392   // On x86, sites calling method handle intrinsics and lambda forms are treated
 393   // as any other call site. Therefore, no special action is needed when we are
 394   // returning to any of these call sites.
 395 
 396   if (_cb != NULL) {
 397     CompiledMethod* sender_cm = _cb->as_compiled_method_or_null();
 398     if (sender_cm != NULL) {
 399       // If the sender PC is a deoptimization point, get the original PC.
 400       if (sender_cm->is_deopt_entry(_pc) ||
 401           sender_cm->is_deopt_mh_entry(_pc)) {
 402         verify_deopt_original_pc(sender_cm, _unextended_sp);
 403       }
 404     }
 405   }
 406 }
 407 #endif
 408 
 409 //------------------------------------------------------------------------------
 410 // frame::update_map_with_saved_link
 411 void frame::update_map_with_saved_link(RegisterMap* map, intptr_t** link_addr) {
 412   // The interpreter and compiler(s) always save EBP/RBP in a known
 413   // location on entry. We must record where that location is
 414   // so this if EBP/RBP was live on callout from c2 we can find
 415   // the saved copy no matter what it called.
 416 
 417   // Since the interpreter always saves EBP/RBP if we record where it is then
 418   // we don't have to always save EBP/RBP on entry and exit to c2 compiled
 419   // code, on entry will be enough.
 420   map->set_location(rbp->as_VMReg(), (address) link_addr);
 421 #ifdef AMD64
 422   // this is weird "H" ought to be at a higher address however the
 423   // oopMaps seems to have the "H" regs at the same address and the
 424   // vanilla register.
 425   // XXXX make this go away
 426   if (true) {
 427     map->set_location(rbp->as_VMReg()->next(), (address) link_addr);
 428   }
 429 #endif // AMD64
 430 }
 431 
 432 
 433 //------------------------------------------------------------------------------
 434 // frame::sender_for_interpreter_frame
 435 frame frame::sender_for_interpreter_frame(RegisterMap* map) const {
 436   // SP is the raw SP from the sender after adapter or interpreter
 437   // extension.
 438   intptr_t* sender_sp = this->sender_sp();
 439 
 440   // This is the sp before any possible extension (adapter/locals).
 441   intptr_t* unextended_sp = interpreter_frame_sender_sp();
 442 
 443 #if COMPILER2_OR_JVMCI
 444   if (map->update_map()) {
 445     update_map_with_saved_link(map, (intptr_t**) addr_at(link_offset));
 446   }
 447 #endif // COMPILER2_OR_JVMCI
 448 
 449   return frame(sender_sp, unextended_sp, link(), sender_pc());
 450 }
 451 
 452 
 453 //------------------------------------------------------------------------------
 454 // frame::sender_for_compiled_frame
 455 frame frame::sender_for_compiled_frame(RegisterMap* map) const {
 456   assert(map != NULL, "map must be set");
 457 
 458   // frame owned by optimizing compiler
 459   assert(_cb->frame_size() >= 0, "must have non-zero frame size");
 460   intptr_t* sender_sp = unextended_sp() + _cb->frame_size();
 461 
 462   // On Intel the return_address is always the word on the stack
 463   address sender_pc = (address) *(sender_sp-1);
 464 
 465   // This is the saved value of EBP which may or may not really be an FP.
 466   // It is only an FP if the sender is an interpreter frame (or C1?).
 467   intptr_t** saved_fp_addr = (intptr_t**) (sender_sp - frame::sender_sp_offset);
 468 
 469   // Repair the sender sp if this is a method with scalarized value type args
 470   sender_sp = repair_sender_sp(sender_sp, saved_fp_addr);
 471 
 472   if (map->update_map()) {
 473     // Tell GC to use argument oopmaps for some runtime stubs that need it.
 474     // For C1, the runtime stub might not have oop maps, so set this flag
 475     // outside of update_register_map.
 476     bool caller_args = _cb->caller_must_gc_arguments(map->thread());
 477     if (!caller_args) {
 478       nmethod* nm = _cb->as_nmethod_or_null();
 479       if (nm != NULL && nm->is_compiled_by_c1() &&
 480           nm->method()->has_scalarized_args() &&
 481           pc() < nm->verified_value_entry_point()) {
 482         // The VEP and VVEP(RO) of C1-compiled methods call buffer_value_args_xxx
 483         // before doing any argument shuffling, so we need to scan the oops
 484         // as the caller passes them.
 485         NativeCall* call = nativeCall_before(pc());
 486         address dest = call->destination();
 487         if (dest == Runtime1::entry_for(Runtime1::buffer_value_args_no_receiver_id) ||
 488             dest == Runtime1::entry_for(Runtime1::buffer_value_args_id)) {
 489           caller_args = true;
 490         }
 491       }
 492     }
 493     map->set_include_argument_oops(caller_args);
 494     if (_cb->oop_maps() != NULL) {
 495       OopMapSet::update_register_map(this, map);
 496     }
 497 
 498     // Since the prolog does the save and restore of EBP there is no oopmap
 499     // for it so we must fill in its location as if there was an oopmap entry
 500     // since if our caller was compiled code there could be live jvm state in it.
 501     update_map_with_saved_link(map, saved_fp_addr);
 502   }
 503 
 504   assert(sender_sp != sp(), "must have changed");
 505   return frame(sender_sp, sender_sp, *saved_fp_addr, sender_pc);
 506 }
 507 
 508 
 509 //------------------------------------------------------------------------------
 510 // frame::sender
 511 frame frame::sender(RegisterMap* map) const {
 512   // Default is we don't have to follow them. The sender_for_xxx will
 513   // update it accordingly
 514   map->set_include_argument_oops(false);
 515 
 516   if (is_entry_frame())       return sender_for_entry_frame(map);
 517   if (is_interpreted_frame()) return sender_for_interpreter_frame(map);
 518   assert(_cb == CodeCache::find_blob(pc()),"Must be the same");
 519 
 520   if (_cb != NULL) {
 521     return sender_for_compiled_frame(map);
 522   }
 523   // Must be native-compiled frame, i.e. the marshaling code for native
 524   // methods that exists in the core system.
 525   return frame(sender_sp(), link(), sender_pc());
 526 }
 527 
 528 bool frame::is_interpreted_frame_valid(JavaThread* thread) const {
 529   assert(is_interpreted_frame(), "Not an interpreted frame");
 530   // These are reasonable sanity checks
 531   if (fp() == 0 || (intptr_t(fp()) & (wordSize-1)) != 0) {
 532     return false;
 533   }
 534   if (sp() == 0 || (intptr_t(sp()) & (wordSize-1)) != 0) {
 535     return false;
 536   }
 537   if (fp() + interpreter_frame_initial_sp_offset < sp()) {
 538     return false;
 539   }
 540   // These are hacks to keep us out of trouble.
 541   // The problem with these is that they mask other problems
 542   if (fp() <= sp()) {        // this attempts to deal with unsigned comparison above
 543     return false;
 544   }
 545 
 546   // do some validation of frame elements
 547   // first the method
 548 
 549   Method* m = *interpreter_frame_method_addr();
 550 
 551   // validate the method we'd find in this potential sender
 552   if (!Method::is_valid_method(m)) return false;
 553 
 554   // stack frames shouldn't be much larger than max_stack elements
 555   // this test requires the use the unextended_sp which is the sp as seen by
 556   // the current frame, and not sp which is the "raw" pc which could point
 557   // further because of local variables of the callee method inserted after
 558   // method arguments
 559   if (fp() - unextended_sp() > 1024 + m->max_stack()*Interpreter::stackElementSize) {
 560     return false;
 561   }
 562 
 563   // validate bci/bcp
 564 
 565   address bcp = interpreter_frame_bcp();
 566   if (m->validate_bci_from_bcp(bcp) < 0) {
 567     return false;
 568   }
 569 
 570   // validate ConstantPoolCache*
 571   ConstantPoolCache* cp = *interpreter_frame_cache_addr();
 572   if (MetaspaceObj::is_valid(cp) == false) return false;
 573 
 574   // validate locals
 575 
 576   address locals =  (address) *interpreter_frame_locals_addr();
 577 
 578   if (locals > thread->stack_base() || locals < (address) fp()) return false;
 579 
 580   // We'd have to be pretty unlucky to be mislead at this point
 581   return true;
 582 }
 583 
 584 BasicType frame::interpreter_frame_result(oop* oop_result, jvalue* value_result) {
 585   assert(is_interpreted_frame(), "interpreted frame expected");
 586   Method* method = interpreter_frame_method();
 587   BasicType type = method->result_type();
 588 
 589   intptr_t* tos_addr;
 590   if (method->is_native()) {
 591     // Prior to calling into the runtime to report the method_exit the possible
 592     // return value is pushed to the native stack. If the result is a jfloat/jdouble
 593     // then ST0 is saved before EAX/EDX. See the note in generate_native_result
 594     tos_addr = (intptr_t*)sp();
 595     if (type == T_FLOAT || type == T_DOUBLE) {
 596     // QQQ seems like this code is equivalent on the two platforms
 597 #ifdef AMD64
 598       // This is times two because we do a push(ltos) after pushing XMM0
 599       // and that takes two interpreter stack slots.
 600       tos_addr += 2 * Interpreter::stackElementWords;
 601 #else
 602       tos_addr += 2;
 603 #endif // AMD64
 604     }
 605   } else {
 606     tos_addr = (intptr_t*)interpreter_frame_tos_address();
 607   }
 608 
 609   switch (type) {
 610     case T_OBJECT  :
 611     case T_VALUETYPE:
 612     case T_ARRAY   : {
 613       oop obj;
 614       if (method->is_native()) {
 615         obj = cast_to_oop(at(interpreter_frame_oop_temp_offset));
 616       } else {
 617         oop* obj_p = (oop*)tos_addr;
 618         obj = (obj_p == NULL) ? (oop)NULL : *obj_p;
 619       }
 620       assert(obj == NULL || Universe::heap()->is_in(obj), "sanity check");
 621       *oop_result = obj;
 622       break;
 623     }
 624     case T_BOOLEAN : value_result->z = *(jboolean*)tos_addr; break;
 625     case T_BYTE    : value_result->b = *(jbyte*)tos_addr; break;
 626     case T_CHAR    : value_result->c = *(jchar*)tos_addr; break;
 627     case T_SHORT   : value_result->s = *(jshort*)tos_addr; break;
 628     case T_INT     : value_result->i = *(jint*)tos_addr; break;
 629     case T_LONG    : value_result->j = *(jlong*)tos_addr; break;
 630     case T_FLOAT   : {
 631 #ifdef AMD64
 632         value_result->f = *(jfloat*)tos_addr;
 633 #else
 634       if (method->is_native()) {
 635         jdouble d = *(jdouble*)tos_addr;  // Result was in ST0 so need to convert to jfloat
 636         value_result->f = (jfloat)d;
 637       } else {
 638         value_result->f = *(jfloat*)tos_addr;
 639       }
 640 #endif // AMD64
 641       break;
 642     }
 643     case T_DOUBLE  : value_result->d = *(jdouble*)tos_addr; break;
 644     case T_VOID    : /* Nothing to do */ break;
 645     default        : ShouldNotReachHere();
 646   }
 647 
 648   return type;
 649 }
 650 
 651 
 652 intptr_t* frame::interpreter_frame_tos_at(jint offset) const {
 653   int index = (Interpreter::expr_offset_in_bytes(offset)/wordSize);
 654   return &interpreter_frame_tos_address()[index];
 655 }
 656 
 657 #ifndef PRODUCT
 658 
 659 #define DESCRIBE_FP_OFFSET(name) \
 660   values.describe(frame_no, fp() + frame::name##_offset, #name)
 661 
 662 void frame::describe_pd(FrameValues& values, int frame_no) {
 663   if (is_interpreted_frame()) {
 664     DESCRIBE_FP_OFFSET(interpreter_frame_sender_sp);
 665     DESCRIBE_FP_OFFSET(interpreter_frame_last_sp);
 666     DESCRIBE_FP_OFFSET(interpreter_frame_method);
 667     DESCRIBE_FP_OFFSET(interpreter_frame_mirror);
 668     DESCRIBE_FP_OFFSET(interpreter_frame_mdp);
 669     DESCRIBE_FP_OFFSET(interpreter_frame_cache);
 670     DESCRIBE_FP_OFFSET(interpreter_frame_locals);
 671     DESCRIBE_FP_OFFSET(interpreter_frame_bcp);
 672     DESCRIBE_FP_OFFSET(interpreter_frame_initial_sp);
 673 #ifdef AMD64
 674   } else if (is_entry_frame()) {
 675     // This could be more descriptive if we use the enum in
 676     // stubGenerator to map to real names but it's most important to
 677     // claim these frame slots so the error checking works.
 678     for (int i = 0; i < entry_frame_after_call_words; i++) {
 679       values.describe(frame_no, fp() - i, err_msg("call_stub word fp - %d", i));
 680     }
 681 #endif // AMD64
 682   }
 683 }
 684 #endif // !PRODUCT
 685 
 686 intptr_t *frame::initial_deoptimization_info() {
 687   // used to reset the saved FP
 688   return fp();
 689 }
 690 
 691 intptr_t* frame::real_fp() const {
 692   if (_cb != NULL) {
 693     // use the frame size if valid
 694     int size = _cb->frame_size();
 695     if (size > 0) {
 696       return unextended_sp() + size;
 697     }
 698   }
 699   // else rely on fp()
 700   assert(! is_compiled_frame(), "unknown compiled frame size");
 701   return fp();
 702 }
 703 
 704 #ifndef PRODUCT
 705 // This is a generic constructor which is only used by pns() in debug.cpp.
 706 frame::frame(void* sp, void* fp, void* pc) {
 707   init((intptr_t*)sp, (intptr_t*)fp, (address)pc);
 708 }
 709 
 710 void frame::pd_ps() {}
 711 #endif
 712 
 713 // Check for a method with scalarized value type arguments that needs
 714 // a stack repair and return the repaired sender stack pointer.
 715 intptr_t* frame::repair_sender_sp(intptr_t* sender_sp, intptr_t** saved_fp_addr) const {
 716   CompiledMethod* cm = _cb->as_compiled_method_or_null();
 717   if (cm != NULL && cm->needs_stack_repair()) {
 718     // The stack increment resides just below the saved rbp on the stack
 719     // and does not account for the return address.
 720     intptr_t* sp_inc_addr = (intptr_t*) (saved_fp_addr - 1);
 721     int sp_inc = (*sp_inc_addr) / wordSize;
 722     int real_frame_size = sp_inc;
 723     if (!cm->is_compiled_by_c1()) {
 724       // Add size of return address (C1 already includes the RA size)
 725       real_frame_size += 1;
 726     }
 727     assert(real_frame_size >= _cb->frame_size(), "invalid frame size");
 728     sender_sp = unextended_sp() + real_frame_size;
 729   }
 730   return sender_sp;
 731 }
 732 
 733 void JavaFrameAnchor::make_walkable(JavaThread* thread) {
 734   // last frame set?
 735   if (last_Java_sp() == NULL) return;
 736   // already walkable?
 737   if (walkable()) return;
 738   vmassert(Thread::current() == (Thread*)thread, "not current thread");
 739   vmassert(last_Java_sp() != NULL, "not called from Java code?");
 740   vmassert(last_Java_pc() == NULL, "already walkable");
 741   capture_last_Java_pc();
 742   vmassert(walkable(), "something went wrong");
 743 }
 744 
 745 void JavaFrameAnchor::capture_last_Java_pc() {
 746   vmassert(_last_Java_sp != NULL, "no last frame set");
 747   vmassert(_last_Java_pc == NULL, "already walkable");
 748   _last_Java_pc = (address)_last_Java_sp[-1];
 749 }