1 /*
   2  * Copyright (c) 1994, 2016, Oracle and/or its affiliates. All rights reserved.
   3  * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
   4  *
   5  * This code is free software; you can redistribute it and/or modify it
   6  * under the terms of the GNU General Public License version 2 only, as
   7  * published by the Free Software Foundation.  Oracle designates this
   8  * particular file as subject to the "Classpath" exception as provided
   9  * by Oracle in the LICENSE file that accompanied this code.
  10  *
  11  * This code is distributed in the hope that it will be useful, but WITHOUT
  12  * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
  13  * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
  14  * version 2 for more details (a copy is included in the LICENSE file that
  15  * accompanied this code).
  16  *
  17  * You should have received a copy of the GNU General Public License version
  18  * 2 along with this work; if not, write to the Free Software Foundation,
  19  * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
  20  *
  21  * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
  22  * or visit www.oracle.com if you need additional information or have any
  23  * questions.
  24  */
  25 
  26 /*-
  27  *      Verify that the code within a method block doesn't exploit any
  28  *      security holes.
  29  */
  30 /*
  31    Exported function:
  32 
  33    jboolean
  34    VerifyClass(JNIEnv *env, jclass cb, char *message_buffer,
  35                jint buffer_length)
  36    jboolean
  37    VerifyClassForMajorVersion(JNIEnv *env, jclass cb, char *message_buffer,
  38                               jint buffer_length, jint major_version)
  39 
  40    This file now only uses the standard JNI and the following VM functions
  41    exported in jvm.h:
  42 
  43    JVM_FindClassFromClass
  44    JVM_IsInterface
  45    JVM_GetClassNameUTF
  46    JVM_GetClassCPEntriesCount
  47    JVM_GetClassCPTypes
  48    JVM_GetClassFieldsCount
  49    JVM_GetClassMethodsCount
  50 
  51    JVM_GetFieldIxModifiers
  52 
  53    JVM_GetMethodIxModifiers
  54    JVM_GetMethodIxExceptionTableLength
  55    JVM_GetMethodIxLocalsCount
  56    JVM_GetMethodIxArgsSize
  57    JVM_GetMethodIxMaxStack
  58    JVM_GetMethodIxNameUTF
  59    JVM_GetMethodIxSignatureUTF
  60    JVM_GetMethodIxExceptionsCount
  61    JVM_GetMethodIxExceptionIndexes
  62    JVM_GetMethodIxByteCodeLength
  63    JVM_GetMethodIxByteCode
  64    JVM_GetMethodIxExceptionTableEntry
  65    JVM_IsConstructorIx
  66 
  67    JVM_GetCPClassNameUTF
  68    JVM_GetCPFieldNameUTF
  69    JVM_GetCPMethodNameUTF
  70    JVM_GetCPFieldSignatureUTF
  71    JVM_GetCPMethodSignatureUTF
  72    JVM_GetCPFieldClassNameUTF
  73    JVM_GetCPMethodClassNameUTF
  74    JVM_GetCPFieldModifiers
  75    JVM_GetCPMethodModifiers
  76 
  77    JVM_ReleaseUTF
  78    JVM_IsSameClassPackage
  79 
  80  */
  81 
  82 #include <string.h>
  83 #include <setjmp.h>
  84 #include <assert.h>
  85 #include <limits.h>
  86 #include <stdlib.h>
  87 
  88 #include "jni.h"
  89 #include "jni_util.h"
  90 #include "jvm.h"
  91 #include "classfile_constants.h"
  92 #include "opcodes.in_out"
  93 
  94 /* On AIX malloc(0) and calloc(0, ...) return a NULL pointer, which is legal,
  95  * but the code here does not handles it. So we wrap the methods and return non-NULL
  96  * pointers even if we allocate 0 bytes.
  97  */
  98 #ifdef _AIX
  99 static int aix_dummy;
 100 static void* aix_malloc(size_t len) {
 101   if (len == 0) {
 102     return &aix_dummy;
 103   }
 104   return malloc(len);
 105 }
 106 
 107 static void* aix_calloc(size_t n, size_t size) {
 108   if (n == 0) {
 109     return &aix_dummy;
 110   }
 111   return calloc(n, size);
 112 }
 113 
 114 static void aix_free(void* p) {
 115   if (p == &aix_dummy) {
 116     return;
 117   }
 118   free(p);
 119 }
 120 
 121 #undef malloc
 122 #undef calloc
 123 #undef free
 124 #define malloc aix_malloc
 125 #define calloc aix_calloc
 126 #define free aix_free
 127 #endif
 128 
 129 #ifdef __APPLE__
 130 /* use setjmp/longjmp versions that do not save/restore the signal mask */
 131 #define setjmp _setjmp
 132 #define longjmp _longjmp
 133 #endif
 134 
 135 #define MAX_ARRAY_DIMENSIONS 255
 136 /* align byte code */
 137 #ifndef ALIGN_UP
 138 #define ALIGN_UP(n,align_grain) (((n) + ((align_grain) - 1)) & ~((align_grain)-1))
 139 #endif /* ALIGN_UP */
 140 #define UCALIGN(n) ((unsigned char *)ALIGN_UP((uintptr_t)(n),sizeof(int)))
 141 
 142 #ifdef DEBUG
 143 
 144 int verify_verbose = 0;
 145 static struct context_type *GlobalContext;
 146 #endif
 147 
 148 enum {
 149     ITEM_Bogus,
 150     ITEM_Void,                  /* only as a function return value */
 151     ITEM_Integer,
 152     ITEM_Float,
 153     ITEM_Double,
 154     ITEM_Double_2,              /* 2nd word of double in register */
 155     ITEM_Long,
 156     ITEM_Long_2,                /* 2nd word of long in register */
 157     ITEM_Array,
 158     ITEM_Object,                /* Extra info field gives name. */
 159     ITEM_NewObject,             /* Like object, but uninitialized. */
 160     ITEM_InitObject,            /* "this" is init method, before call
 161                                     to super() */
 162     ITEM_ReturnAddress,         /* Extra info gives instr # of start pc */
 163     /* The following four are only used within array types.
 164      * Normally, we use ITEM_Integer, instead. */
 165     ITEM_Byte,
 166     ITEM_Short,
 167     ITEM_Char,
 168     ITEM_Boolean
 169 };
 170 
 171 
 172 #define UNKNOWN_STACK_SIZE -1
 173 #define UNKNOWN_REGISTER_COUNT -1
 174 #define UNKNOWN_RET_INSTRUCTION -1
 175 
 176 #undef MAX
 177 #undef MIN
 178 #define MAX(a, b) ((a) > (b) ? (a) : (b))
 179 #define MIN(a, b) ((a) < (b) ? (a) : (b))
 180 
 181 #define BITS_PER_INT   (CHAR_BIT * sizeof(int)/sizeof(char))
 182 #define SET_BIT(flags, i)  (flags[(i)/BITS_PER_INT] |= \
 183                                        ((unsigned)1 << ((i) % BITS_PER_INT)))
 184 #define IS_BIT_SET(flags, i) (flags[(i)/BITS_PER_INT] & \
 185                                        ((unsigned)1 << ((i) % BITS_PER_INT)))
 186 
 187 typedef unsigned int fullinfo_type;
 188 typedef unsigned int *bitvector;
 189 
 190 #define GET_ITEM_TYPE(thing) ((thing) & 0x1F)
 191 #define GET_INDIRECTION(thing) (((thing) & 0xFFFF) >> 5)
 192 #define GET_EXTRA_INFO(thing) ((thing) >> 16)
 193 #define WITH_ZERO_INDIRECTION(thing) ((thing) & ~(0xFFE0))
 194 #define WITH_ZERO_EXTRA_INFO(thing) ((thing) & 0xFFFF)
 195 
 196 #define MAKE_FULLINFO(type, indirect, extra) \
 197      ((type) + ((indirect) << 5) + ((extra) << 16))
 198 
 199 #define MAKE_Object_ARRAY(indirect) \
 200        (context->object_info + ((indirect) << 5))
 201 
 202 #define NULL_FULLINFO MAKE_FULLINFO(ITEM_Object, 0, 0)
 203 
 204 /* JVM_OPC_invokespecial calls to <init> need to be treated special */
 205 #define JVM_OPC_invokeinit 0x100
 206 
 207 /* A hash mechanism used by the verifier.
 208  * Maps class names to unique 16 bit integers.
 209  */
 210 
 211 #define HASH_TABLE_SIZE 503
 212 
 213 /* The buckets are managed as a 256 by 256 matrix. We allocate an entire
 214  * row (256 buckets) at a time to minimize fragmentation. Rows are
 215  * allocated on demand so that we don't waste too much space.
 216  */
 217 
 218 #define MAX_HASH_ENTRIES 65536
 219 #define HASH_ROW_SIZE 256
 220 
 221 typedef struct hash_bucket_type {
 222     char *name;
 223     unsigned int hash;
 224     jclass class;
 225     unsigned short ID;
 226     unsigned short next;
 227     unsigned loadable:1;  /* from context->class loader */
 228 } hash_bucket_type;
 229 
 230 typedef struct {
 231     hash_bucket_type **buckets;
 232     unsigned short *table;
 233     int entries_used;
 234 } hash_table_type;
 235 
 236 #define GET_BUCKET(class_hash, ID)\
 237     (class_hash->buckets[ID / HASH_ROW_SIZE] + ID % HASH_ROW_SIZE)
 238 
 239 /*
 240  * There are currently two types of resources that we need to keep
 241  * track of (in addition to the CCalloc pool).
 242  */
 243 enum {
 244     VM_STRING_UTF, /* VM-allocated UTF strings */
 245     VM_MALLOC_BLK  /* malloc'ed blocks */
 246 };
 247 
 248 #define LDC_CLASS_MAJOR_VERSION 49
 249 
 250 #define LDC_METHOD_HANDLE_MAJOR_VERSION 51
 251 
 252 #define NONZERO_PADDING_BYTES_IN_SWITCH_MAJOR_VERSION 51
 253 
 254 #define STATIC_METHOD_IN_INTERFACE_MAJOR_VERSION  52
 255 
 256 #define ALLOC_STACK_SIZE 16 /* big enough */
 257 
 258 typedef struct alloc_stack_type {
 259     void *ptr;
 260     int kind;
 261     struct alloc_stack_type *next;
 262 } alloc_stack_type;
 263 
 264 /* The context type encapsulates the current invocation of the byte
 265  * code verifier.
 266  */
 267 struct context_type {
 268 
 269     JNIEnv *env;                /* current JNIEnv */
 270 
 271     /* buffers etc. */
 272     char *message;
 273     jint message_buf_len;
 274     jboolean err_code;
 275 
 276     alloc_stack_type *allocated_memory; /* all memory blocks that we have not
 277                                            had a chance to free */
 278     /* Store up to ALLOC_STACK_SIZE number of handles to allocated memory
 279        blocks here, to save mallocs. */
 280     alloc_stack_type alloc_stack[ALLOC_STACK_SIZE];
 281     int alloc_stack_top;
 282 
 283     /* these fields are per class */
 284     jclass class;               /* current class */
 285     jint major_version;
 286     jint nconstants;
 287     unsigned char *constant_types;
 288     hash_table_type class_hash;
 289 
 290     fullinfo_type object_info;  /* fullinfo for java/lang/Object */
 291     fullinfo_type string_info;  /* fullinfo for java/lang/String */
 292     fullinfo_type throwable_info; /* fullinfo for java/lang/Throwable */
 293     fullinfo_type cloneable_info; /* fullinfo for java/lang/Cloneable */
 294     fullinfo_type serializable_info; /* fullinfo for java/io/Serializable */
 295 
 296     fullinfo_type currentclass_info; /* fullinfo for context->class */
 297     fullinfo_type superclass_info;   /* fullinfo for superclass */
 298 
 299     /* these fields are per method */
 300     int method_index;   /* current method */
 301     unsigned short *exceptions; /* exceptions */
 302     unsigned char *code;        /* current code object */
 303     jint code_length;
 304     int *code_data;             /* offset to instruction number */
 305     struct instruction_data_type *instruction_data; /* info about each */
 306     struct handler_info_type *handler_info;
 307     fullinfo_type *superclasses; /* null terminated superclasses */
 308     int instruction_count;      /* number of instructions */
 309     fullinfo_type return_type;  /* function return type */
 310     fullinfo_type swap_table[4]; /* used for passing information */
 311     int bitmask_size;           /* words needed to hold bitmap of arguments */
 312 
 313     /* these fields are per field */
 314     int field_index;
 315 
 316     /* Used by the space allocator */
 317     struct CCpool *CCroot, *CCcurrent;
 318     char *CCfree_ptr;
 319     int CCfree_size;
 320 
 321     /* Jump here on any error. */
 322     jmp_buf jump_buffer;
 323 
 324 #ifdef DEBUG
 325     /* keep track of how many global refs are allocated. */
 326     int n_globalrefs;
 327 #endif
 328 };
 329 
 330 struct stack_info_type {
 331     struct stack_item_type *stack;
 332     int stack_size;
 333 };
 334 
 335 struct register_info_type {
 336     int register_count;         /* number of registers used */
 337     fullinfo_type *registers;
 338     int mask_count;             /* number of masks in the following */
 339     struct mask_type *masks;
 340 };
 341 
 342 struct mask_type {
 343     int entry;
 344     int *modifies;
 345 };
 346 
 347 typedef unsigned short flag_type;
 348 
 349 struct instruction_data_type {
 350     int opcode;         /* may turn into "canonical" opcode */
 351     unsigned changed:1;         /* has it changed */
 352     unsigned protected:1;       /* must accessor be a subclass of "this" */
 353     union {
 354         int i;                  /* operand to the opcode */
 355         int *ip;
 356         fullinfo_type fi;
 357     } operand, operand2;
 358     fullinfo_type p;
 359     struct stack_info_type stack_info;
 360     struct register_info_type register_info;
 361 #define FLAG_REACHED            0x01 /* instruction reached */
 362 #define FLAG_NEED_CONSTRUCTOR   0x02 /* must call this.<init> or super.<init> */
 363 #define FLAG_NO_RETURN          0x04 /* must throw out of method */
 364     flag_type or_flags;         /* true for at least one path to this inst */
 365 #define FLAG_CONSTRUCTED        0x01 /* this.<init> or super.<init> called */
 366     flag_type and_flags;        /* true for all paths to this instruction */
 367 };
 368 
 369 struct handler_info_type {
 370     int start, end, handler;
 371     struct stack_info_type stack_info;
 372 };
 373 
 374 struct stack_item_type {
 375     fullinfo_type item;
 376     struct stack_item_type *next;
 377 };
 378 
 379 typedef struct context_type context_type;
 380 typedef struct instruction_data_type instruction_data_type;
 381 typedef struct stack_item_type stack_item_type;
 382 typedef struct register_info_type register_info_type;
 383 typedef struct stack_info_type stack_info_type;
 384 typedef struct mask_type mask_type;
 385 
 386 static void read_all_code(context_type *context, jclass cb, int num_methods,
 387                           int** code_lengths, unsigned char*** code);
 388 static void verify_method(context_type *context, jclass cb, int index,
 389                           int code_length, unsigned char* code);
 390 static void free_all_code(context_type* context, int num_methods,
 391                           unsigned char** code);
 392 static void verify_field(context_type *context, jclass cb, int index);
 393 
 394 static void verify_opcode_operands (context_type *, unsigned int inumber, int offset);
 395 static void set_protected(context_type *, unsigned int inumber, int key, int);
 396 static jboolean is_superclass(context_type *, fullinfo_type);
 397 
 398 static void initialize_exception_table(context_type *);
 399 static int instruction_length(unsigned char *iptr, unsigned char *end);
 400 static jboolean isLegalTarget(context_type *, int offset);
 401 static void verify_constant_pool_type(context_type *, int, unsigned);
 402 
 403 static void initialize_dataflow(context_type *);
 404 static void run_dataflow(context_type *context);
 405 static void check_register_values(context_type *context, unsigned int inumber);
 406 static void check_flags(context_type *context, unsigned int inumber);
 407 static void pop_stack(context_type *, unsigned int inumber, stack_info_type *);
 408 static void update_registers(context_type *, unsigned int inumber, register_info_type *);
 409 static void update_flags(context_type *, unsigned int inumber,
 410                          flag_type *new_and_flags, flag_type *new_or_flags);
 411 static void push_stack(context_type *, unsigned int inumber, stack_info_type *stack);
 412 
 413 static void merge_into_successors(context_type *, unsigned int inumber,
 414                                   register_info_type *register_info,
 415                                   stack_info_type *stack_info,
 416                                   flag_type and_flags, flag_type or_flags);
 417 static void merge_into_one_successor(context_type *context,
 418                                      unsigned int from_inumber,
 419                                      unsigned int inumber,
 420                                      register_info_type *register_info,
 421                                      stack_info_type *stack_info,
 422                                      flag_type and_flags, flag_type or_flags,
 423                                      jboolean isException);
 424 static void merge_stack(context_type *, unsigned int inumber,
 425                         unsigned int to_inumber, stack_info_type *);
 426 static void merge_registers(context_type *, unsigned int inumber,
 427                             unsigned int to_inumber,
 428                             register_info_type *);
 429 static void merge_flags(context_type *context, unsigned int from_inumber,
 430                         unsigned int to_inumber,
 431                         flag_type new_and_flags, flag_type new_or_flags);
 432 
 433 static stack_item_type *copy_stack(context_type *, stack_item_type *);
 434 static mask_type *copy_masks(context_type *, mask_type *masks, int mask_count);
 435 static mask_type *add_to_masks(context_type *, mask_type *, int , int);
 436 
 437 static fullinfo_type decrement_indirection(fullinfo_type);
 438 
 439 static fullinfo_type merge_fullinfo_types(context_type *context,
 440                                           fullinfo_type a,
 441                                           fullinfo_type b,
 442                                           jboolean assignment);
 443 static jboolean isAssignableTo(context_type *,
 444                                fullinfo_type a,
 445                                fullinfo_type b);
 446 
 447 static jclass object_fullinfo_to_classclass(context_type *, fullinfo_type);
 448 
 449 
 450 #define NEW(type, count) \
 451         ((type *)CCalloc(context, (count)*(sizeof(type)), JNI_FALSE))
 452 #define ZNEW(type, count) \
 453         ((type *)CCalloc(context, (count)*(sizeof(type)), JNI_TRUE))
 454 
 455 static void CCinit(context_type *context);
 456 static void CCreinit(context_type *context);
 457 static void CCdestroy(context_type *context);
 458 static void *CCalloc(context_type *context, int size, jboolean zero);
 459 
 460 static fullinfo_type cp_index_to_class_fullinfo(context_type *, int, int);
 461 
 462 static const char* get_result_signature(const char* signature);
 463 
 464 static char signature_to_fieldtype(context_type *context,
 465                                    const char **signature_p, fullinfo_type *info);
 466 
 467 static void CCerror (context_type *, char *format, ...);
 468 static void CFerror (context_type *, char *format, ...);
 469 static void CCout_of_memory (context_type *);
 470 
 471 /* Because we can longjmp any time, we need to be very careful about
 472  * remembering what needs to be freed. */
 473 
 474 static void check_and_push(context_type *context, const void *ptr, int kind);
 475 static void pop_and_free(context_type *context);
 476 
 477 static int signature_to_args_size(const char *method_signature);
 478 
 479 #ifdef DEBUG
 480 static void print_stack (context_type *, stack_info_type *stack_info);
 481 static void print_registers(context_type *, register_info_type *register_info);
 482 static void print_flags(context_type *, flag_type, flag_type);
 483 static void print_formatted_fieldname(context_type *context, int index);
 484 static void print_formatted_methodname(context_type *context, int index);
 485 #endif
 486 
 487 /*
 488  * Declare library specific JNI_Onload entry if static build
 489  */
 490 DEF_STATIC_JNI_OnLoad
 491 
 492 void initialize_class_hash(context_type *context)
 493 {
 494     hash_table_type *class_hash = &(context->class_hash);
 495     class_hash->buckets = (hash_bucket_type **)
 496         calloc(MAX_HASH_ENTRIES / HASH_ROW_SIZE, sizeof(hash_bucket_type *));
 497     class_hash->table = (unsigned short *)
 498         calloc(HASH_TABLE_SIZE, sizeof(unsigned short));
 499     if (class_hash->buckets == 0 ||
 500         class_hash->table == 0)
 501         CCout_of_memory(context);
 502     class_hash->entries_used = 0;
 503 }
 504 
 505 static void finalize_class_hash(context_type *context)
 506 {
 507     hash_table_type *class_hash = &(context->class_hash);
 508     JNIEnv *env = context->env;
 509     int i;
 510     /* 4296677: bucket index starts from 1. */
 511     for (i=1;i<=class_hash->entries_used;i++) {
 512         hash_bucket_type *bucket = GET_BUCKET(class_hash, i);
 513         assert(bucket != NULL);
 514         free(bucket->name);
 515         if (bucket->class) {
 516             (*env)->DeleteGlobalRef(env, bucket->class);
 517 #ifdef DEBUG
 518             context->n_globalrefs--;
 519 #endif
 520         }
 521     }
 522     if (class_hash->buckets) {
 523         for (i=0;i<MAX_HASH_ENTRIES / HASH_ROW_SIZE; i++) {
 524             if (class_hash->buckets[i] == 0)
 525                 break;
 526             free(class_hash->buckets[i]);
 527         }
 528     }
 529     free(class_hash->buckets);
 530     free(class_hash->table);
 531 }
 532 
 533 static hash_bucket_type *
 534 new_bucket(context_type *context, unsigned short *pID)
 535 {
 536     hash_table_type *class_hash = &(context->class_hash);
 537     int i = *pID = class_hash->entries_used + 1;
 538     int row = i / HASH_ROW_SIZE;
 539     if (i >= MAX_HASH_ENTRIES)
 540         CCerror(context, "Exceeded verifier's limit of 65535 referred classes");
 541     if (class_hash->buckets[row] == 0) {
 542         class_hash->buckets[row] = (hash_bucket_type*)
 543             calloc(HASH_ROW_SIZE, sizeof(hash_bucket_type));
 544         if (class_hash->buckets[row] == 0)
 545             CCout_of_memory(context);
 546     }
 547     class_hash->entries_used++; /* only increment when we are sure there
 548                                    is no overflow. */
 549     return GET_BUCKET(class_hash, i);
 550 }
 551 
 552 static unsigned int
 553 class_hash_fun(const char *s)
 554 {
 555     int i;
 556     unsigned raw_hash;
 557     for (raw_hash = 0; (i = *s) != '\0'; ++s)
 558         raw_hash = raw_hash * 37 + i;
 559     return raw_hash;
 560 }
 561 
 562 /*
 563  * Find a class using the defining loader of the current class
 564  * and return a local reference to it.
 565  */
 566 static jclass load_class_local(context_type *context,const char *classname)
 567 {
 568     jclass cb = JVM_FindClassFromClass(context->env, classname,
 569                                  JNI_FALSE, context->class);
 570     if (cb == 0)
 571          CCerror(context, "Cannot find class %s", classname);
 572     return cb;
 573 }
 574 
 575 /*
 576  * Find a class using the defining loader of the current class
 577  * and return a global reference to it.
 578  */
 579 static jclass load_class_global(context_type *context, const char *classname)
 580 {
 581     JNIEnv *env = context->env;
 582     jclass local, global;
 583 
 584     local = load_class_local(context, classname);
 585     global = (*env)->NewGlobalRef(env, local);
 586     if (global == 0)
 587         CCout_of_memory(context);
 588 #ifdef DEBUG
 589     context->n_globalrefs++;
 590 #endif
 591     (*env)->DeleteLocalRef(env, local);
 592     return global;
 593 }
 594 
 595 /*
 596  * Return a unique ID given a local class reference. The loadable
 597  * flag is true if the defining class loader of context->class
 598  * is known to be capable of loading the class.
 599  */
 600 static unsigned short
 601 class_to_ID(context_type *context, jclass cb, jboolean loadable)
 602 {
 603     JNIEnv *env = context->env;
 604     hash_table_type *class_hash = &(context->class_hash);
 605     unsigned int hash;
 606     hash_bucket_type *bucket;
 607     unsigned short *pID;
 608     const char *name = JVM_GetClassNameUTF(env, cb);
 609 
 610     check_and_push(context, name, VM_STRING_UTF);
 611     hash = class_hash_fun(name);
 612     pID = &(class_hash->table[hash % HASH_TABLE_SIZE]);
 613     while (*pID) {
 614         bucket = GET_BUCKET(class_hash, *pID);
 615         if (bucket->hash == hash && strcmp(name, bucket->name) == 0) {
 616             /*
 617              * There is an unresolved entry with our name
 618              * so we're forced to load it in case it matches us.
 619              */
 620             if (bucket->class == 0) {
 621                 assert(bucket->loadable == JNI_TRUE);
 622                 bucket->class = load_class_global(context, name);
 623             }
 624 
 625             /*
 626              * It's already in the table. Update the loadable
 627              * state if it's known and then we're done.
 628              */
 629             if ((*env)->IsSameObject(env, cb, bucket->class)) {
 630                 if (loadable && !bucket->loadable)
 631                     bucket->loadable = JNI_TRUE;
 632                 goto done;
 633             }
 634         }
 635         pID = &bucket->next;
 636     }
 637     bucket = new_bucket(context, pID);
 638     bucket->next = 0;
 639     bucket->hash = hash;
 640     bucket->name = malloc(strlen(name) + 1);
 641     if (bucket->name == 0)
 642         CCout_of_memory(context);
 643     strcpy(bucket->name, name);
 644     bucket->loadable = loadable;
 645     bucket->class = (*env)->NewGlobalRef(env, cb);
 646     if (bucket->class == 0)
 647         CCout_of_memory(context);
 648 #ifdef DEBUG
 649     context->n_globalrefs++;
 650 #endif
 651 
 652 done:
 653     pop_and_free(context);
 654     return *pID;
 655 }
 656 
 657 /*
 658  * Return a unique ID given a class name from the constant pool.
 659  * All classes are lazily loaded from the defining loader of
 660  * context->class.
 661  */
 662 static unsigned short
 663 class_name_to_ID(context_type *context, const char *name)
 664 {
 665     hash_table_type *class_hash = &(context->class_hash);
 666     unsigned int hash = class_hash_fun(name);
 667     hash_bucket_type *bucket;
 668     unsigned short *pID;
 669     jboolean force_load = JNI_FALSE;
 670 
 671     pID = &(class_hash->table[hash % HASH_TABLE_SIZE]);
 672     while (*pID) {
 673         bucket = GET_BUCKET(class_hash, *pID);
 674         if (bucket->hash == hash && strcmp(name, bucket->name) == 0) {
 675             if (bucket->loadable)
 676                 goto done;
 677             force_load = JNI_TRUE;
 678         }
 679         pID = &bucket->next;
 680     }
 681 
 682     if (force_load) {
 683         /*
 684          * We found at least one matching named entry for a class that
 685          * was not known to be loadable through the defining class loader
 686          * of context->class. We must load our named class and update
 687          * the hash table in case one these entries matches our class.
 688          */
 689         JNIEnv *env = context->env;
 690         jclass cb = load_class_local(context, name);
 691         unsigned short id = class_to_ID(context, cb, JNI_TRUE);
 692         (*env)->DeleteLocalRef(env, cb);
 693         return id;
 694     }
 695 
 696     bucket = new_bucket(context, pID);
 697     bucket->next = 0;
 698     bucket->class = 0;
 699     bucket->loadable = JNI_TRUE; /* name-only IDs are implicitly loadable */
 700     bucket->hash = hash;
 701     bucket->name = malloc(strlen(name) + 1);
 702     if (bucket->name == 0)
 703         CCout_of_memory(context);
 704     strcpy(bucket->name, name);
 705 
 706 done:
 707     return *pID;
 708 }
 709 
 710 static const char *
 711 ID_to_class_name(context_type *context, unsigned short ID)
 712 {
 713     hash_table_type *class_hash = &(context->class_hash);
 714     hash_bucket_type *bucket = GET_BUCKET(class_hash, ID);
 715     return bucket->name;
 716 }
 717 
 718 static jclass
 719 ID_to_class(context_type *context, unsigned short ID)
 720 {
 721     hash_table_type *class_hash = &(context->class_hash);
 722     hash_bucket_type *bucket = GET_BUCKET(class_hash, ID);
 723     if (bucket->class == 0) {
 724         assert(bucket->loadable == JNI_TRUE);
 725         bucket->class = load_class_global(context, bucket->name);
 726     }
 727     return bucket->class;
 728 }
 729 
 730 static fullinfo_type
 731 make_loadable_class_info(context_type *context, jclass cb)
 732 {
 733     return MAKE_FULLINFO(ITEM_Object, 0,
 734                            class_to_ID(context, cb, JNI_TRUE));
 735 }
 736 
 737 static fullinfo_type
 738 make_class_info(context_type *context, jclass cb)
 739 {
 740     return MAKE_FULLINFO(ITEM_Object, 0,
 741                          class_to_ID(context, cb, JNI_FALSE));
 742 }
 743 
 744 static fullinfo_type
 745 make_class_info_from_name(context_type *context, const char *name)
 746 {
 747     return MAKE_FULLINFO(ITEM_Object, 0,
 748                          class_name_to_ID(context, name));
 749 }
 750 
 751 /* RETURNS
 752  * 1: on success       chosen to be consistent with previous VerifyClass
 753  * 0: verify error
 754  * 2: out of memory
 755  * 3: class format error
 756  *
 757  * Called by verify_class.  Verify the code of each of the methods
 758  * in a class.  Note that this function apparently can't be JNICALL,
 759  * because if it is the dynamic linker doesn't appear to be able to
 760  * find it on Win32.
 761  */
 762 
 763 #define CC_OK 1
 764 #define CC_VerifyError 0
 765 #define CC_OutOfMemory 2
 766 #define CC_ClassFormatError 3
 767 
 768 JNIEXPORT jboolean
 769 VerifyClassForMajorVersion(JNIEnv *env, jclass cb, char *buffer, jint len,
 770                            jint major_version)
 771 {
 772     context_type context_structure;
 773     context_type *context = &context_structure;
 774     jboolean result = CC_OK;
 775     int i;
 776     int num_methods;
 777     int* code_lengths;
 778     unsigned char** code;
 779 
 780 #ifdef DEBUG
 781     GlobalContext = context;
 782 #endif
 783 
 784     memset(context, 0, sizeof(context_type));
 785     context->message = buffer;
 786     context->message_buf_len = len;
 787 
 788     context->env = env;
 789     context->class = cb;
 790 
 791     /* Set invalid method/field index of the context, in case anyone
 792        calls CCerror */
 793     context->method_index = -1;
 794     context->field_index = -1;
 795 
 796     /* Don't call CCerror or anything that can call it above the setjmp! */
 797     if (!setjmp(context->jump_buffer)) {
 798         jclass super;
 799 
 800         CCinit(context);                /* initialize heap; may throw */
 801 
 802         initialize_class_hash(context);
 803 
 804         context->major_version = major_version;
 805         context->nconstants = JVM_GetClassCPEntriesCount(env, cb);
 806         context->constant_types = (unsigned char *)
 807             malloc(sizeof(unsigned char) * context->nconstants + 1);
 808 
 809         if (context->constant_types == 0)
 810             CCout_of_memory(context);
 811 
 812         JVM_GetClassCPTypes(env, cb, context->constant_types);
 813 
 814         if (context->constant_types == 0)
 815             CCout_of_memory(context);
 816 
 817         context->object_info =
 818             make_class_info_from_name(context, "java/lang/Object");
 819         context->string_info =
 820             make_class_info_from_name(context, "java/lang/String");
 821         context->throwable_info =
 822             make_class_info_from_name(context, "java/lang/Throwable");
 823         context->cloneable_info =
 824             make_class_info_from_name(context, "java/lang/Cloneable");
 825         context->serializable_info =
 826             make_class_info_from_name(context, "java/io/Serializable");
 827 
 828         context->currentclass_info = make_loadable_class_info(context, cb);
 829 
 830         super = (*env)->GetSuperclass(env, cb);
 831 
 832         if (super != 0) {
 833             fullinfo_type *gptr;
 834             int i = 0;
 835 
 836             context->superclass_info = make_loadable_class_info(context, super);
 837 
 838             while(super != 0) {
 839                 jclass tmp_cb = (*env)->GetSuperclass(env, super);
 840                 (*env)->DeleteLocalRef(env, super);
 841                 super = tmp_cb;
 842                 i++;
 843             }
 844             (*env)->DeleteLocalRef(env, super);
 845             super = 0;
 846 
 847             /* Can't go on context heap since it survives more than
 848                one method */
 849             context->superclasses = gptr =
 850                 malloc(sizeof(fullinfo_type)*(i + 1));
 851             if (gptr == 0) {
 852                 CCout_of_memory(context);
 853             }
 854 
 855             super = (*env)->GetSuperclass(env, context->class);
 856             while(super != 0) {
 857                 jclass tmp_cb;
 858                 *gptr++ = make_class_info(context, super);
 859                 tmp_cb = (*env)->GetSuperclass(env, super);
 860                 (*env)->DeleteLocalRef(env, super);
 861                 super = tmp_cb;
 862             }
 863             *gptr = 0;
 864         } else {
 865             context->superclass_info = 0;
 866         }
 867 
 868         (*env)->DeleteLocalRef(env, super);
 869 
 870         /* Look at each method */
 871         for (i = JVM_GetClassFieldsCount(env, cb); --i >= 0;)
 872             verify_field(context, cb, i);
 873         num_methods = JVM_GetClassMethodsCount(env, cb);
 874         read_all_code(context, cb, num_methods, &code_lengths, &code);
 875         for (i = num_methods - 1; i >= 0; --i)
 876             verify_method(context, cb, i, code_lengths[i], code[i]);
 877         free_all_code(context, num_methods, code);
 878         result = CC_OK;
 879     } else {
 880         result = context->err_code;
 881     }
 882 
 883     /* Cleanup */
 884     finalize_class_hash(context);
 885 
 886     while(context->allocated_memory)
 887         pop_and_free(context);
 888 
 889 #ifdef DEBUG
 890     GlobalContext = 0;
 891 #endif
 892 
 893     if (context->exceptions)
 894         free(context->exceptions);
 895 
 896     if (context->constant_types)
 897         free(context->constant_types);
 898 
 899     if (context->superclasses)
 900         free(context->superclasses);
 901 
 902 #ifdef DEBUG
 903     /* Make sure all global refs created in the verifier are freed */
 904     assert(context->n_globalrefs == 0);
 905 #endif
 906 
 907     CCdestroy(context);         /* destroy heap */
 908     return result;
 909 }
 910 
 911 #define OLD_FORMAT_MAX_MAJOR_VERSION 48
 912 
 913 JNIEXPORT jboolean
 914 VerifyClass(JNIEnv *env, jclass cb, char *buffer, jint len)
 915 {
 916     static int warned = 0;
 917     if (!warned) {
 918       jio_fprintf(stdout, "Warning! An old version of jvm is used. This is not supported.\n");
 919       warned = 1;
 920     }
 921     return VerifyClassForMajorVersion(env, cb, buffer, len,
 922                                       OLD_FORMAT_MAX_MAJOR_VERSION);
 923 }
 924 
 925 static void
 926 verify_field(context_type *context, jclass cb, int field_index)
 927 {
 928     JNIEnv *env = context->env;
 929     int access_bits = JVM_GetFieldIxModifiers(env, cb, field_index);
 930     context->field_index = field_index;
 931 
 932     if (  ((access_bits & JVM_ACC_PUBLIC) != 0) &&
 933           ((access_bits & (JVM_ACC_PRIVATE | JVM_ACC_PROTECTED)) != 0)) {
 934         CCerror(context, "Inconsistent access bits.");
 935     }
 936     context->field_index = -1;
 937 }
 938 
 939 
 940 /**
 941  * We read all of the class's methods' code because it is possible that
 942  * the verification of one method could resulting in linking further
 943  * down the stack (due to class loading), which could end up rewriting
 944  * some of the bytecode of methods we haven't verified yet.  Since we
 945  * don't want to see the rewritten bytecode, cache all the code and
 946  * operate only on that.
 947  */
 948 static void
 949 read_all_code(context_type* context, jclass cb, int num_methods,
 950               int** lengths_addr, unsigned char*** code_addr)
 951 {
 952     int* lengths;
 953     unsigned char** code;
 954     int i;
 955 
 956     lengths = malloc(sizeof(int) * num_methods);
 957     check_and_push(context, lengths, VM_MALLOC_BLK);
 958 
 959     code = malloc(sizeof(unsigned char*) * num_methods);
 960     check_and_push(context, code, VM_MALLOC_BLK);
 961 
 962     *(lengths_addr) = lengths;
 963     *(code_addr) = code;
 964 
 965     for (i = 0; i < num_methods; ++i) {
 966         lengths[i] = JVM_GetMethodIxByteCodeLength(context->env, cb, i);
 967         if (lengths[i] > 0) {
 968             code[i] = malloc(sizeof(unsigned char) * (lengths[i] + 1));
 969             check_and_push(context, code[i], VM_MALLOC_BLK);
 970             JVM_GetMethodIxByteCode(context->env, cb, i, code[i]);
 971         } else {
 972             code[i] = NULL;
 973         }
 974     }
 975 }
 976 
 977 static void
 978 free_all_code(context_type* context, int num_methods, unsigned char** code)
 979 {
 980   int i;
 981   for (i = 0; i < num_methods; ++i) {
 982       if (code[i] != NULL) {
 983           pop_and_free(context);
 984       }
 985   }
 986   pop_and_free(context); /* code */
 987   pop_and_free(context); /* lengths */
 988 }
 989 
 990 /* Verify the code of one method */
 991 static void
 992 verify_method(context_type *context, jclass cb, int method_index,
 993               int code_length, unsigned char* code)
 994 {
 995     JNIEnv *env = context->env;
 996     int access_bits = JVM_GetMethodIxModifiers(env, cb, method_index);
 997     int *code_data;
 998     instruction_data_type *idata = 0;
 999     int instruction_count;
1000     int i, offset;
1001     unsigned int inumber;
1002     jint nexceptions;
1003 
1004     if ((access_bits & (JVM_ACC_NATIVE | JVM_ACC_ABSTRACT)) != 0) {
1005         /* not much to do for abstract and native methods */
1006         return;
1007     }
1008 
1009     context->code_length = code_length;
1010     context->code = code;
1011 
1012     /* CCerror can give method-specific info once this is set */
1013     context->method_index = method_index;
1014 
1015     CCreinit(context);          /* initial heap */
1016     code_data = NEW(int, code_length);
1017 
1018 #ifdef DEBUG
1019     if (verify_verbose) {
1020         const char *classname = JVM_GetClassNameUTF(env, cb);
1021         const char *methodname =
1022             JVM_GetMethodIxNameUTF(env, cb, method_index);
1023         const char *signature =
1024             JVM_GetMethodIxSignatureUTF(env, cb, method_index);
1025         jio_fprintf(stdout, "Looking at %s.%s%s\n",
1026                     (classname ? classname : ""),
1027                     (methodname ? methodname : ""),
1028                     (signature ? signature : ""));
1029         JVM_ReleaseUTF(classname);
1030         JVM_ReleaseUTF(methodname);
1031         JVM_ReleaseUTF(signature);
1032     }
1033 #endif
1034 
1035     if (((access_bits & JVM_ACC_PUBLIC) != 0) &&
1036         ((access_bits & (JVM_ACC_PRIVATE | JVM_ACC_PROTECTED)) != 0)) {
1037         CCerror(context, "Inconsistent access bits.");
1038     }
1039 
1040     // If this method is an overpass method, which is generated by the VM,
1041     // we trust the code and no check needs to be done.
1042     if (JVM_IsVMGeneratedMethodIx(env, cb, method_index)) {
1043       return;
1044     }
1045 
1046     /* Run through the code.  Mark the start of each instruction, and give
1047      * the instruction a number */
1048     for (i = 0, offset = 0; offset < code_length; i++) {
1049         int length = instruction_length(&code[offset], code + code_length);
1050         int next_offset = offset + length;
1051         if (length <= 0)
1052             CCerror(context, "Illegal instruction found at offset %d", offset);
1053         if (next_offset > code_length)
1054             CCerror(context, "Code stops in the middle of instruction "
1055                     " starting at offset %d", offset);
1056         code_data[offset] = i;
1057         while (++offset < next_offset)
1058             code_data[offset] = -1; /* illegal location */
1059     }
1060     instruction_count = i;      /* number of instructions in code */
1061 
1062     /* Allocate a structure to hold info about each instruction. */
1063     idata = NEW(instruction_data_type, instruction_count);
1064 
1065     /* Initialize the heap, and other info in the context structure. */
1066     context->code = code;
1067     context->instruction_data = idata;
1068     context->code_data = code_data;
1069     context->instruction_count = instruction_count;
1070     context->handler_info =
1071         NEW(struct handler_info_type,
1072             JVM_GetMethodIxExceptionTableLength(env, cb, method_index));
1073     context->bitmask_size =
1074         (JVM_GetMethodIxLocalsCount(env, cb, method_index)
1075          + (BITS_PER_INT - 1))/BITS_PER_INT;
1076 
1077     if (instruction_count == 0)
1078         CCerror(context, "Empty code");
1079 
1080     for (inumber = 0, offset = 0; offset < code_length; inumber++) {
1081         int length = instruction_length(&code[offset], code + code_length);
1082         instruction_data_type *this_idata = &idata[inumber];
1083         this_idata->opcode = code[offset];
1084         this_idata->stack_info.stack = NULL;
1085         this_idata->stack_info.stack_size  = UNKNOWN_STACK_SIZE;
1086         this_idata->register_info.register_count = UNKNOWN_REGISTER_COUNT;
1087         this_idata->changed = JNI_FALSE;  /* no need to look at it yet. */
1088         this_idata->protected = JNI_FALSE;  /* no need to look at it yet. */
1089         this_idata->and_flags = (flag_type) -1; /* "bottom" and value */
1090         this_idata->or_flags = 0; /* "bottom" or value*/
1091         /* This also sets up this_data->operand.  It also makes the
1092          * xload_x and xstore_x instructions look like the generic form. */
1093         verify_opcode_operands(context, inumber, offset);
1094         offset += length;
1095     }
1096 
1097 
1098     /* make sure exception table is reasonable. */
1099     initialize_exception_table(context);
1100     /* Set up first instruction, and start of exception handlers. */
1101     initialize_dataflow(context);
1102     /* Run data flow analysis on the instructions. */
1103     run_dataflow(context);
1104 
1105     /* verify checked exceptions, if any */
1106     nexceptions = JVM_GetMethodIxExceptionsCount(env, cb, method_index);
1107     context->exceptions = (unsigned short *)
1108         malloc(sizeof(unsigned short) * nexceptions + 1);
1109     if (context->exceptions == 0)
1110         CCout_of_memory(context);
1111     JVM_GetMethodIxExceptionIndexes(env, cb, method_index,
1112                                     context->exceptions);
1113     for (i = 0; i < nexceptions; i++) {
1114         /* Make sure the constant pool item is JVM_CONSTANT_Class */
1115         verify_constant_pool_type(context, (int)context->exceptions[i],
1116                                   1 << JVM_CONSTANT_Class);
1117     }
1118     free(context->exceptions);
1119     context->exceptions = 0;
1120     context->code = 0;
1121     context->method_index = -1;
1122 }
1123 
1124 
1125 /* Look at a single instruction, and verify its operands.  Also, for
1126  * simplicity, move the operand into the ->operand field.
1127  * Make sure that branches don't go into the middle of nowhere.
1128  */
1129 
1130 static jint _ck_ntohl(jint n)
1131 {
1132     unsigned char *p = (unsigned char *)&n;
1133     return (p[0] << 24) | (p[1] << 16) | (p[2] << 8) | p[3];
1134 }
1135 
1136 static void
1137 verify_opcode_operands(context_type *context, unsigned int inumber, int offset)
1138 {
1139     JNIEnv *env = context->env;
1140     instruction_data_type *idata = context->instruction_data;
1141     instruction_data_type *this_idata = &idata[inumber];
1142     int *code_data = context->code_data;
1143     int mi = context->method_index;
1144     unsigned char *code = context->code;
1145     int opcode = this_idata->opcode;
1146     int var;
1147 
1148     /*
1149      * Set the ip fields to 0 not the i fields because the ip fields
1150      * are 64 bits on 64 bit architectures, the i field is only 32
1151      */
1152     this_idata->operand.ip = 0;
1153     this_idata->operand2.ip = 0;
1154 
1155     switch (opcode) {
1156 
1157     case JVM_OPC_jsr:
1158         /* instruction of ret statement */
1159         this_idata->operand2.i = UNKNOWN_RET_INSTRUCTION;
1160         /* FALLTHROUGH */
1161     case JVM_OPC_ifeq: case JVM_OPC_ifne: case JVM_OPC_iflt:
1162     case JVM_OPC_ifge: case JVM_OPC_ifgt: case JVM_OPC_ifle:
1163     case JVM_OPC_ifnull: case JVM_OPC_ifnonnull:
1164     case JVM_OPC_if_icmpeq: case JVM_OPC_if_icmpne: case JVM_OPC_if_icmplt:
1165     case JVM_OPC_if_icmpge: case JVM_OPC_if_icmpgt: case JVM_OPC_if_icmple:
1166     case JVM_OPC_if_acmpeq: case JVM_OPC_if_acmpne:
1167     case JVM_OPC_goto: {
1168         /* Set the ->operand to be the instruction number of the target. */
1169         int jump = (((signed char)(code[offset+1])) << 8) + code[offset+2];
1170         int target = offset + jump;
1171         if (!isLegalTarget(context, target))
1172             CCerror(context, "Illegal target of jump or branch");
1173         this_idata->operand.i = code_data[target];
1174         break;
1175     }
1176 
1177     case JVM_OPC_jsr_w:
1178         /* instruction of ret statement */
1179         this_idata->operand2.i = UNKNOWN_RET_INSTRUCTION;
1180         /* FALLTHROUGH */
1181     case JVM_OPC_goto_w: {
1182         /* Set the ->operand to be the instruction number of the target. */
1183         int jump = (((signed char)(code[offset+1])) << 24) +
1184                      (code[offset+2] << 16) + (code[offset+3] << 8) +
1185                      (code[offset + 4]);
1186         int target = offset + jump;
1187         if (!isLegalTarget(context, target))
1188             CCerror(context, "Illegal target of jump or branch");
1189         this_idata->operand.i = code_data[target];
1190         break;
1191     }
1192 
1193     case JVM_OPC_tableswitch:
1194     case JVM_OPC_lookupswitch: {
1195         /* Set the ->operand to be a table of possible instruction targets. */
1196         int *lpc = (int *) UCALIGN(code + offset + 1);
1197         int *lptr;
1198         int *saved_operand;
1199         int keys;
1200         int k, delta;
1201 
1202         if (context->major_version < NONZERO_PADDING_BYTES_IN_SWITCH_MAJOR_VERSION) {
1203             /* 4639449, 4647081: Padding bytes must be zero. */
1204             unsigned char* bptr = (unsigned char*) (code + offset + 1);
1205             for (; bptr < (unsigned char*)lpc; bptr++) {
1206                 if (*bptr != 0) {
1207                     CCerror(context, "Non zero padding bytes in switch");
1208                 }
1209             }
1210         }
1211         if (opcode == JVM_OPC_tableswitch) {
1212             keys = _ck_ntohl(lpc[2]) -  _ck_ntohl(lpc[1]) + 1;
1213             delta = 1;
1214         } else {
1215             keys = _ck_ntohl(lpc[1]); /* number of pairs */
1216             delta = 2;
1217             /* Make sure that the tableswitch items are sorted */
1218             for (k = keys - 1, lptr = &lpc[2]; --k >= 0; lptr += 2) {
1219                 int this_key = _ck_ntohl(lptr[0]);  /* NB: ntohl may be unsigned */
1220                 int next_key = _ck_ntohl(lptr[2]);
1221                 if (this_key >= next_key) {
1222                     CCerror(context, "Unsorted lookup switch");
1223                 }
1224             }
1225         }
1226         saved_operand = NEW(int, keys + 2);
1227         if (!isLegalTarget(context, offset + _ck_ntohl(lpc[0])))
1228             CCerror(context, "Illegal default target in switch");
1229         saved_operand[keys + 1] = code_data[offset + _ck_ntohl(lpc[0])];
1230         for (k = keys, lptr = &lpc[3]; --k >= 0; lptr += delta) {
1231             int target = offset + _ck_ntohl(lptr[0]);
1232             if (!isLegalTarget(context, target))
1233                 CCerror(context, "Illegal branch in tableswitch");
1234             saved_operand[k + 1] = code_data[target];
1235         }
1236         saved_operand[0] = keys + 1; /* number of successors */
1237         this_idata->operand.ip = saved_operand;
1238         break;
1239     }
1240 
1241     case JVM_OPC_ldc: {
1242         /* Make sure the constant pool item is the right type. */
1243         int key = code[offset + 1];
1244         int types = (1 << JVM_CONSTANT_Integer) | (1 << JVM_CONSTANT_Float) |
1245                     (1 << JVM_CONSTANT_String);
1246         if (context->major_version >= LDC_CLASS_MAJOR_VERSION) {
1247             types |= 1 << JVM_CONSTANT_Class;
1248         }
1249         if (context->major_version >= LDC_METHOD_HANDLE_MAJOR_VERSION) {
1250             types |= (1 << JVM_CONSTANT_MethodHandle) |
1251                      (1 << JVM_CONSTANT_MethodType);
1252         }
1253         this_idata->operand.i = key;
1254         verify_constant_pool_type(context, key, types);
1255         break;
1256     }
1257 
1258     case JVM_OPC_ldc_w: {
1259         /* Make sure the constant pool item is the right type. */
1260         int key = (code[offset + 1] << 8) + code[offset + 2];
1261         int types = (1 << JVM_CONSTANT_Integer) | (1 << JVM_CONSTANT_Float) |
1262                     (1 << JVM_CONSTANT_String);
1263         if (context->major_version >= LDC_CLASS_MAJOR_VERSION) {
1264             types |= 1 << JVM_CONSTANT_Class;
1265         }
1266         if (context->major_version >= LDC_METHOD_HANDLE_MAJOR_VERSION) {
1267             types |= (1 << JVM_CONSTANT_MethodHandle) |
1268                      (1 << JVM_CONSTANT_MethodType);
1269         }
1270         this_idata->operand.i = key;
1271         verify_constant_pool_type(context, key, types);
1272         break;
1273     }
1274 
1275     case JVM_OPC_ldc2_w: {
1276         /* Make sure the constant pool item is the right type. */
1277         int key = (code[offset + 1] << 8) + code[offset + 2];
1278         int types = (1 << JVM_CONSTANT_Double) | (1 << JVM_CONSTANT_Long);
1279         this_idata->operand.i = key;
1280         verify_constant_pool_type(context, key, types);
1281         break;
1282     }
1283 
1284     case JVM_OPC_getfield: case JVM_OPC_putfield:
1285     case JVM_OPC_getstatic: case JVM_OPC_putstatic: {
1286         /* Make sure the constant pool item is the right type. */
1287         int key = (code[offset + 1] << 8) + code[offset + 2];
1288         this_idata->operand.i = key;
1289         verify_constant_pool_type(context, key, 1 << JVM_CONSTANT_Fieldref);
1290         if (opcode == JVM_OPC_getfield || opcode == JVM_OPC_putfield)
1291             set_protected(context, inumber, key, opcode);
1292         break;
1293     }
1294 
1295     case JVM_OPC_invokevirtual:
1296     case JVM_OPC_invokespecial:
1297     case JVM_OPC_invokestatic:
1298     case JVM_OPC_invokeinterface: {
1299         /* Make sure the constant pool item is the right type. */
1300         int key = (code[offset + 1] << 8) + code[offset + 2];
1301         const char *methodname;
1302         jclass cb = context->class;
1303         fullinfo_type clazz_info;
1304         int is_constructor, is_internal;
1305         int kind;
1306 
1307         switch (opcode ) {
1308         case JVM_OPC_invokestatic:
1309             kind = ((context->major_version < STATIC_METHOD_IN_INTERFACE_MAJOR_VERSION)
1310                        ? (1 << JVM_CONSTANT_Methodref)
1311                        : ((1 << JVM_CONSTANT_InterfaceMethodref) | (1 << JVM_CONSTANT_Methodref)));
1312             break;
1313         case JVM_OPC_invokeinterface:
1314             kind = 1 << JVM_CONSTANT_InterfaceMethodref;
1315             break;
1316         default:
1317             kind = 1 << JVM_CONSTANT_Methodref;
1318         }
1319 
1320         /* Make sure the constant pool item is the right type. */
1321         verify_constant_pool_type(context, key, kind);
1322         methodname = JVM_GetCPMethodNameUTF(env, cb, key);
1323         check_and_push(context, methodname, VM_STRING_UTF);
1324         is_constructor = !strcmp(methodname, "<init>");
1325         is_internal = methodname[0] == '<';
1326         pop_and_free(context);
1327 
1328         clazz_info = cp_index_to_class_fullinfo(context, key,
1329                                                 JVM_CONSTANT_Methodref);
1330         this_idata->operand.i = key;
1331         this_idata->operand2.fi = clazz_info;
1332         if (is_constructor) {
1333             if (opcode != JVM_OPC_invokespecial) {
1334                 CCerror(context,
1335                         "Must call initializers using invokespecial");
1336             }
1337             this_idata->opcode = JVM_OPC_invokeinit;
1338         } else {
1339             if (is_internal) {
1340                 CCerror(context, "Illegal call to internal method");
1341             }
1342             if (opcode == JVM_OPC_invokespecial
1343                    && clazz_info != context->currentclass_info
1344                    && clazz_info != context->superclass_info) {
1345                 int not_found = 1;
1346 
1347                 jclass super = (*env)->GetSuperclass(env, context->class);
1348                 while(super != 0) {
1349                     jclass tmp_cb;
1350                     fullinfo_type new_info = make_class_info(context, super);
1351                     if (clazz_info == new_info) {
1352                         not_found = 0;
1353                         break;
1354                     }
1355                     tmp_cb = (*env)->GetSuperclass(env, super);
1356                     (*env)->DeleteLocalRef(env, super);
1357                     super = tmp_cb;
1358                 }
1359                 (*env)->DeleteLocalRef(env, super);
1360 
1361                 /* The optimizer may cause this to happen on local code */
1362                 if (not_found) {
1363                     CCerror(context, "Illegal use of nonvirtual function call");
1364                 }
1365             }
1366         }
1367         if (opcode == JVM_OPC_invokeinterface) {
1368             unsigned int args1;
1369             unsigned int args2;
1370             const char *signature =
1371                 JVM_GetCPMethodSignatureUTF(env, context->class, key);
1372             check_and_push(context, signature, VM_STRING_UTF);
1373             args1 = signature_to_args_size(signature) + 1;
1374             args2 = code[offset + 3];
1375             if (args1 != args2) {
1376                 CCerror(context,
1377                         "Inconsistent args_size for invokeinterface");
1378             }
1379             if (code[offset + 4] != 0) {
1380                 CCerror(context,
1381                         "Fourth operand byte of invokeinterface must be zero");
1382             }
1383             pop_and_free(context);
1384         } else if (opcode == JVM_OPC_invokevirtual
1385                       || opcode == JVM_OPC_invokespecial)
1386             set_protected(context, inumber, key, opcode);
1387         break;
1388     }
1389 
1390     case JVM_OPC_invokedynamic:
1391         CCerror(context,
1392                 "invokedynamic bytecode is not supported in this class file version");
1393 
1394     case JVM_OPC_instanceof:
1395     case JVM_OPC_checkcast:
1396     case JVM_OPC_new:
1397     case JVM_OPC_anewarray:
1398     case JVM_OPC_multianewarray: {
1399         /* Make sure the constant pool item is a class */
1400         int key = (code[offset + 1] << 8) + code[offset + 2];
1401         fullinfo_type target;
1402         verify_constant_pool_type(context, key, 1 << JVM_CONSTANT_Class);
1403         target = cp_index_to_class_fullinfo(context, key, JVM_CONSTANT_Class);
1404         if (GET_ITEM_TYPE(target) == ITEM_Bogus)
1405             CCerror(context, "Illegal type");
1406         switch(opcode) {
1407         case JVM_OPC_anewarray:
1408             if ((GET_INDIRECTION(target)) >= MAX_ARRAY_DIMENSIONS)
1409                 CCerror(context, "Array with too many dimensions");
1410             this_idata->operand.fi = MAKE_FULLINFO(GET_ITEM_TYPE(target),
1411                                                    GET_INDIRECTION(target) + 1,
1412                                                    GET_EXTRA_INFO(target));
1413             break;
1414         case JVM_OPC_new:
1415             if (WITH_ZERO_EXTRA_INFO(target) !=
1416                              MAKE_FULLINFO(ITEM_Object, 0, 0))
1417                 CCerror(context, "Illegal creation of multi-dimensional array");
1418             /* operand gets set to the "unitialized object".  operand2 gets
1419              * set to what the value will be after it's initialized. */
1420             this_idata->operand.fi = MAKE_FULLINFO(ITEM_NewObject, 0, inumber);
1421             this_idata->operand2.fi = target;
1422             break;
1423         case JVM_OPC_multianewarray:
1424             this_idata->operand.fi = target;
1425             this_idata->operand2.i = code[offset + 3];
1426             if (    (this_idata->operand2.i > (int)GET_INDIRECTION(target))
1427                  || (this_idata->operand2.i == 0))
1428                 CCerror(context, "Illegal dimension argument");
1429             break;
1430         default:
1431             this_idata->operand.fi = target;
1432         }
1433         break;
1434     }
1435 
1436     case JVM_OPC_newarray: {
1437         /* Cache the result of the JVM_OPC_newarray into the operand slot */
1438         fullinfo_type full_info;
1439         switch (code[offset + 1]) {
1440             case JVM_T_INT:
1441                 full_info = MAKE_FULLINFO(ITEM_Integer, 1, 0); break;
1442             case JVM_T_LONG:
1443                 full_info = MAKE_FULLINFO(ITEM_Long, 1, 0); break;
1444             case JVM_T_FLOAT:
1445                 full_info = MAKE_FULLINFO(ITEM_Float, 1, 0); break;
1446             case JVM_T_DOUBLE:
1447                 full_info = MAKE_FULLINFO(ITEM_Double, 1, 0); break;
1448             case JVM_T_BOOLEAN:
1449                 full_info = MAKE_FULLINFO(ITEM_Boolean, 1, 0); break;
1450             case JVM_T_BYTE:
1451                 full_info = MAKE_FULLINFO(ITEM_Byte, 1, 0); break;
1452             case JVM_T_CHAR:
1453                 full_info = MAKE_FULLINFO(ITEM_Char, 1, 0); break;
1454             case JVM_T_SHORT:
1455                 full_info = MAKE_FULLINFO(ITEM_Short, 1, 0); break;
1456             default:
1457                 full_info = 0;          /* Keep lint happy */
1458                 CCerror(context, "Bad type passed to newarray");
1459         }
1460         this_idata->operand.fi = full_info;
1461         break;
1462     }
1463 
1464     /* Fudge iload_x, aload_x, etc to look like their generic cousin. */
1465     case JVM_OPC_iload_0: case JVM_OPC_iload_1: case JVM_OPC_iload_2: case JVM_OPC_iload_3:
1466         this_idata->opcode = JVM_OPC_iload;
1467         var = opcode - JVM_OPC_iload_0;
1468         goto check_local_variable;
1469 
1470     case JVM_OPC_fload_0: case JVM_OPC_fload_1: case JVM_OPC_fload_2: case JVM_OPC_fload_3:
1471         this_idata->opcode = JVM_OPC_fload;
1472         var = opcode - JVM_OPC_fload_0;
1473         goto check_local_variable;
1474 
1475     case JVM_OPC_aload_0: case JVM_OPC_aload_1: case JVM_OPC_aload_2: case JVM_OPC_aload_3:
1476         this_idata->opcode = JVM_OPC_aload;
1477         var = opcode - JVM_OPC_aload_0;
1478         goto check_local_variable;
1479 
1480     case JVM_OPC_lload_0: case JVM_OPC_lload_1: case JVM_OPC_lload_2: case JVM_OPC_lload_3:
1481         this_idata->opcode = JVM_OPC_lload;
1482         var = opcode - JVM_OPC_lload_0;
1483         goto check_local_variable2;
1484 
1485     case JVM_OPC_dload_0: case JVM_OPC_dload_1: case JVM_OPC_dload_2: case JVM_OPC_dload_3:
1486         this_idata->opcode = JVM_OPC_dload;
1487         var = opcode - JVM_OPC_dload_0;
1488         goto check_local_variable2;
1489 
1490     case JVM_OPC_istore_0: case JVM_OPC_istore_1: case JVM_OPC_istore_2: case JVM_OPC_istore_3:
1491         this_idata->opcode = JVM_OPC_istore;
1492         var = opcode - JVM_OPC_istore_0;
1493         goto check_local_variable;
1494 
1495     case JVM_OPC_fstore_0: case JVM_OPC_fstore_1: case JVM_OPC_fstore_2: case JVM_OPC_fstore_3:
1496         this_idata->opcode = JVM_OPC_fstore;
1497         var = opcode - JVM_OPC_fstore_0;
1498         goto check_local_variable;
1499 
1500     case JVM_OPC_astore_0: case JVM_OPC_astore_1: case JVM_OPC_astore_2: case JVM_OPC_astore_3:
1501         this_idata->opcode = JVM_OPC_astore;
1502         var = opcode - JVM_OPC_astore_0;
1503         goto check_local_variable;
1504 
1505     case JVM_OPC_lstore_0: case JVM_OPC_lstore_1: case JVM_OPC_lstore_2: case JVM_OPC_lstore_3:
1506         this_idata->opcode = JVM_OPC_lstore;
1507         var = opcode - JVM_OPC_lstore_0;
1508         goto check_local_variable2;
1509 
1510     case JVM_OPC_dstore_0: case JVM_OPC_dstore_1: case JVM_OPC_dstore_2: case JVM_OPC_dstore_3:
1511         this_idata->opcode = JVM_OPC_dstore;
1512         var = opcode - JVM_OPC_dstore_0;
1513         goto check_local_variable2;
1514 
1515     case JVM_OPC_wide:
1516         this_idata->opcode = code[offset + 1];
1517         var = (code[offset + 2] << 8) + code[offset + 3];
1518         switch(this_idata->opcode) {
1519             case JVM_OPC_lload:  case JVM_OPC_dload:
1520             case JVM_OPC_lstore: case JVM_OPC_dstore:
1521                 goto check_local_variable2;
1522             default:
1523                 goto check_local_variable;
1524         }
1525 
1526     case JVM_OPC_iinc:              /* the increment amount doesn't matter */
1527     case JVM_OPC_ret:
1528     case JVM_OPC_aload: case JVM_OPC_iload: case JVM_OPC_fload:
1529     case JVM_OPC_astore: case JVM_OPC_istore: case JVM_OPC_fstore:
1530         var = code[offset + 1];
1531     check_local_variable:
1532         /* Make sure that the variable number isn't illegal. */
1533         this_idata->operand.i = var;
1534         if (var >= JVM_GetMethodIxLocalsCount(env, context->class, mi))
1535             CCerror(context, "Illegal local variable number");
1536         break;
1537 
1538     case JVM_OPC_lload: case JVM_OPC_dload: case JVM_OPC_lstore: case JVM_OPC_dstore:
1539         var = code[offset + 1];
1540     check_local_variable2:
1541         /* Make sure that the variable number isn't illegal. */
1542         this_idata->operand.i = var;
1543         if ((var + 1) >= JVM_GetMethodIxLocalsCount(env, context->class, mi))
1544             CCerror(context, "Illegal local variable number");
1545         break;
1546 
1547     default:
1548         if (opcode > JVM_OPC_MAX)
1549             CCerror(context, "Quick instructions shouldn't appear yet.");
1550         break;
1551     } /* of switch */
1552 }
1553 
1554 
1555 static void
1556 set_protected(context_type *context, unsigned int inumber, int key, int opcode)
1557 {
1558     JNIEnv *env = context->env;
1559     fullinfo_type clazz_info;
1560     if (opcode != JVM_OPC_invokevirtual && opcode != JVM_OPC_invokespecial) {
1561         clazz_info = cp_index_to_class_fullinfo(context, key,
1562                                                 JVM_CONSTANT_Fieldref);
1563     } else {
1564         clazz_info = cp_index_to_class_fullinfo(context, key,
1565                                                 JVM_CONSTANT_Methodref);
1566     }
1567     if (is_superclass(context, clazz_info)) {
1568         jclass calledClass =
1569             object_fullinfo_to_classclass(context, clazz_info);
1570         int access;
1571         /* 4734966: JVM_GetCPFieldModifiers() or JVM_GetCPMethodModifiers() only
1572            searches the referenced field or method in calledClass. The following
1573            while loop is added to search up the superclass chain to make this
1574            symbolic resolution consistent with the field/method resolution
1575            specified in VM spec 5.4.3. */
1576         calledClass = (*env)->NewLocalRef(env, calledClass);
1577         do {
1578             jclass tmp_cb;
1579             if (opcode != JVM_OPC_invokevirtual && opcode != JVM_OPC_invokespecial) {
1580                 access = JVM_GetCPFieldModifiers
1581                     (env, context->class, key, calledClass);
1582             } else {
1583                 access = JVM_GetCPMethodModifiers
1584                     (env, context->class, key, calledClass);
1585             }
1586             if (access != -1) {
1587                 break;
1588             }
1589             tmp_cb = (*env)->GetSuperclass(env, calledClass);
1590             (*env)->DeleteLocalRef(env, calledClass);
1591             calledClass = tmp_cb;
1592         } while (calledClass != 0);
1593 
1594         if (access == -1) {
1595             /* field/method not found, detected at runtime. */
1596         } else if (access & JVM_ACC_PROTECTED) {
1597             if (!JVM_IsSameClassPackage(env, calledClass, context->class))
1598                 context->instruction_data[inumber].protected = JNI_TRUE;
1599         }
1600         (*env)->DeleteLocalRef(env, calledClass);
1601     }
1602 }
1603 
1604 
1605 static jboolean
1606 is_superclass(context_type *context, fullinfo_type clazz_info) {
1607     fullinfo_type *fptr = context->superclasses;
1608 
1609     if (fptr == 0)
1610         return JNI_FALSE;
1611     for (; *fptr != 0; fptr++) {
1612         if (*fptr == clazz_info)
1613             return JNI_TRUE;
1614     }
1615     return JNI_FALSE;
1616 }
1617 
1618 
1619 /* Look through each item on the exception table.  Each of the fields must
1620  * refer to a legal instruction.
1621  */
1622 static void
1623 initialize_exception_table(context_type *context)
1624 {
1625     JNIEnv *env = context->env;
1626     int mi = context->method_index;
1627     struct handler_info_type *handler_info = context->handler_info;
1628     int *code_data = context->code_data;
1629     int code_length = context->code_length;
1630     int max_stack_size = JVM_GetMethodIxMaxStack(env, context->class, mi);
1631     int i = JVM_GetMethodIxExceptionTableLength(env, context->class, mi);
1632     if (max_stack_size < 1 && i > 0) {
1633         // If the method contains exception handlers, it must have room
1634         // on the expression stack for the exception that the VM could push
1635         CCerror(context, "Stack size too large");
1636     }
1637     for (; --i >= 0; handler_info++) {
1638         JVM_ExceptionTableEntryType einfo;
1639         stack_item_type *stack_item = NEW(stack_item_type, 1);
1640 
1641         JVM_GetMethodIxExceptionTableEntry(env, context->class, mi,
1642                                            i, &einfo);
1643 
1644         if (!(einfo.start_pc < einfo.end_pc &&
1645               einfo.start_pc >= 0 &&
1646               isLegalTarget(context, einfo.start_pc) &&
1647               (einfo.end_pc ==  code_length ||
1648                isLegalTarget(context, einfo.end_pc)))) {
1649             CFerror(context, "Illegal exception table range");
1650         }
1651         if (!((einfo.handler_pc > 0) &&
1652               isLegalTarget(context, einfo.handler_pc))) {
1653             CFerror(context, "Illegal exception table handler");
1654         }
1655 
1656         handler_info->start = code_data[einfo.start_pc];
1657         /* einfo.end_pc may point to one byte beyond the end of bytecodes. */
1658         handler_info->end = (einfo.end_pc == context->code_length) ?
1659             context->instruction_count : code_data[einfo.end_pc];
1660         handler_info->handler = code_data[einfo.handler_pc];
1661         handler_info->stack_info.stack = stack_item;
1662         handler_info->stack_info.stack_size = 1;
1663         stack_item->next = NULL;
1664         if (einfo.catchType != 0) {
1665             const char *classname;
1666             /* Constant pool entry type has been checked in format checker */
1667             classname = JVM_GetCPClassNameUTF(env,
1668                                               context->class,
1669                                               einfo.catchType);
1670             check_and_push(context, classname, VM_STRING_UTF);
1671             stack_item->item = make_class_info_from_name(context, classname);
1672             if (!isAssignableTo(context,
1673                                 stack_item->item,
1674                                 context->throwable_info))
1675                 CCerror(context, "catch_type not a subclass of Throwable");
1676             pop_and_free(context);
1677         } else {
1678             stack_item->item = context->throwable_info;
1679         }
1680     }
1681 }
1682 
1683 
1684 /* Given a pointer to an instruction, return its length.  Use the table
1685  * opcode_length[] which is automatically built.
1686  */
1687 static int instruction_length(unsigned char *iptr, unsigned char *end)
1688 {
1689     static unsigned char opcode_length[] = JVM_OPCODE_LENGTH_INITIALIZER;
1690     int instruction = *iptr;
1691     switch (instruction) {
1692         case JVM_OPC_tableswitch: {
1693             int *lpc = (int *)UCALIGN(iptr + 1);
1694             int index;
1695             if (lpc + 2 >= (int *)end) {
1696                 return -1; /* do not read pass the end */
1697             }
1698             index = _ck_ntohl(lpc[2]) - _ck_ntohl(lpc[1]);
1699             if ((index < 0) || (index > 65535)) {
1700                 return -1;      /* illegal */
1701             } else {
1702                 return (unsigned char *)(&lpc[index + 4]) - iptr;
1703             }
1704         }
1705 
1706         case JVM_OPC_lookupswitch: {
1707             int *lpc = (int *) UCALIGN(iptr + 1);
1708             int npairs;
1709             if (lpc + 1 >= (int *)end)
1710                 return -1; /* do not read pass the end */
1711             npairs = _ck_ntohl(lpc[1]);
1712             /* There can't be more than 64K labels because of the limit
1713              * on per-method byte code length.
1714              */
1715             if (npairs < 0 || npairs >= 65536)
1716                 return  -1;
1717             else
1718                 return (unsigned char *)(&lpc[2 * (npairs + 1)]) - iptr;
1719         }
1720 
1721         case JVM_OPC_wide:
1722             if (iptr + 1 >= end)
1723                 return -1; /* do not read pass the end */
1724             switch(iptr[1]) {
1725                 case JVM_OPC_ret:
1726                 case JVM_OPC_iload: case JVM_OPC_istore:
1727                 case JVM_OPC_fload: case JVM_OPC_fstore:
1728                 case JVM_OPC_aload: case JVM_OPC_astore:
1729                 case JVM_OPC_lload: case JVM_OPC_lstore:
1730                 case JVM_OPC_dload: case JVM_OPC_dstore:
1731                     return 4;
1732                 case JVM_OPC_iinc:
1733                     return 6;
1734                 default:
1735                     return -1;
1736             }
1737 
1738         default: {
1739             if (instruction < 0 || instruction > JVM_OPC_MAX)
1740                 return -1;
1741 
1742             /* A length of 0 indicates an error. */
1743             if (opcode_length[instruction] <= 0)
1744                 return -1;
1745 
1746             return opcode_length[instruction];
1747         }
1748     }
1749 }
1750 
1751 
1752 /* Given the target of a branch, make sure that it's a legal target. */
1753 static jboolean
1754 isLegalTarget(context_type *context, int offset)
1755 {
1756     int code_length = context->code_length;
1757     int *code_data = context->code_data;
1758     return (offset >= 0 && offset < code_length && code_data[offset] >= 0);
1759 }
1760 
1761 
1762 /* Make sure that an element of the constant pool really is of the indicated
1763  * type.
1764  */
1765 static void
1766 verify_constant_pool_type(context_type *context, int index, unsigned mask)
1767 {
1768     int nconstants = context->nconstants;
1769     unsigned char *type_table = context->constant_types;
1770     unsigned type;
1771 
1772     if ((index <= 0) || (index >= nconstants))
1773         CCerror(context, "Illegal constant pool index");
1774 
1775     type = type_table[index];
1776     if ((mask & (1 << type)) == 0)
1777         CCerror(context, "Illegal type in constant pool");
1778 }
1779 
1780 
1781 static void
1782 initialize_dataflow(context_type *context)
1783 {
1784     JNIEnv *env = context->env;
1785     instruction_data_type *idata = context->instruction_data;
1786     int mi = context->method_index;
1787     jclass cb = context->class;
1788     int args_size = JVM_GetMethodIxArgsSize(env, cb, mi);
1789     fullinfo_type *reg_ptr;
1790     fullinfo_type full_info;
1791     const char *p;
1792     const char *signature;
1793 
1794     /* Initialize the function entry, since we know everything about it. */
1795     idata[0].stack_info.stack_size = 0;
1796     idata[0].stack_info.stack = NULL;
1797     idata[0].register_info.register_count = args_size;
1798     idata[0].register_info.registers = NEW(fullinfo_type, args_size);
1799     idata[0].register_info.mask_count = 0;
1800     idata[0].register_info.masks = NULL;
1801     idata[0].and_flags = 0;     /* nothing needed */
1802     idata[0].or_flags = FLAG_REACHED; /* instruction reached */
1803     reg_ptr = idata[0].register_info.registers;
1804 
1805     if ((JVM_GetMethodIxModifiers(env, cb, mi) & JVM_ACC_STATIC) == 0) {
1806         /* A non static method.  If this is an <init> method, the first
1807          * argument is an uninitialized object.  Otherwise it is an object of
1808          * the given class type.  java.lang.Object.<init> is special since
1809          * we don't call its superclass <init> method.
1810          */
1811         if (JVM_IsConstructorIx(env, cb, mi)
1812                 && context->currentclass_info != context->object_info) {
1813             *reg_ptr++ = MAKE_FULLINFO(ITEM_InitObject, 0, 0);
1814             idata[0].or_flags |= FLAG_NEED_CONSTRUCTOR;
1815         } else {
1816             *reg_ptr++ = context->currentclass_info;
1817         }
1818     }
1819     signature = JVM_GetMethodIxSignatureUTF(env, cb, mi);
1820     check_and_push(context, signature, VM_STRING_UTF);
1821     /* Fill in each of the arguments into the registers. */
1822     for (p = signature + 1; *p != JVM_SIGNATURE_ENDFUNC; ) {
1823         char fieldchar = signature_to_fieldtype(context, &p, &full_info);
1824         switch (fieldchar) {
1825             case 'D': case 'L':
1826                 *reg_ptr++ = full_info;
1827                 *reg_ptr++ = full_info + 1;
1828                 break;
1829             default:
1830                 *reg_ptr++ = full_info;
1831                 break;
1832         }
1833     }
1834     p++;                        /* skip over right parenthesis */
1835     if (*p == 'V') {
1836         context->return_type = MAKE_FULLINFO(ITEM_Void, 0, 0);
1837     } else {
1838         signature_to_fieldtype(context, &p, &full_info);
1839         context->return_type = full_info;
1840     }
1841     pop_and_free(context);
1842     /* Indicate that we need to look at the first instruction. */
1843     idata[0].changed = JNI_TRUE;
1844 }
1845 
1846 
1847 /* Run the data flow analysis, as long as there are things to change. */
1848 static void
1849 run_dataflow(context_type *context) {
1850     JNIEnv *env = context->env;
1851     int mi = context->method_index;
1852     jclass cb = context->class;
1853     int max_stack_size = JVM_GetMethodIxMaxStack(env, cb, mi);
1854     instruction_data_type *idata = context->instruction_data;
1855     unsigned int icount = context->instruction_count;
1856     jboolean work_to_do = JNI_TRUE;
1857     unsigned int inumber;
1858 
1859     /* Run through the loop, until there is nothing left to do. */
1860     while (work_to_do) {
1861         work_to_do = JNI_FALSE;
1862         for (inumber = 0; inumber < icount; inumber++) {
1863             instruction_data_type *this_idata = &idata[inumber];
1864             if (this_idata->changed) {
1865                 register_info_type new_register_info;
1866                 stack_info_type new_stack_info;
1867                 flag_type new_and_flags, new_or_flags;
1868 
1869                 this_idata->changed = JNI_FALSE;
1870                 work_to_do = JNI_TRUE;
1871 #ifdef DEBUG
1872                 if (verify_verbose) {
1873                     int opcode = this_idata->opcode;
1874                     jio_fprintf(stdout, "Instruction %d: ", inumber);
1875                     print_stack(context, &this_idata->stack_info);
1876                     print_registers(context, &this_idata->register_info);
1877                     print_flags(context,
1878                                 this_idata->and_flags, this_idata->or_flags);
1879                     fflush(stdout);
1880                 }
1881 #endif
1882                 /* Make sure the registers and flags are appropriate */
1883                 check_register_values(context, inumber);
1884                 check_flags(context, inumber);
1885 
1886                 /* Make sure the stack can deal with this instruction */
1887                 pop_stack(context, inumber, &new_stack_info);
1888 
1889                 /* Update the registers  and flags */
1890                 update_registers(context, inumber, &new_register_info);
1891                 update_flags(context, inumber, &new_and_flags, &new_or_flags);
1892 
1893                 /* Update the stack. */
1894                 push_stack(context, inumber, &new_stack_info);
1895 
1896                 if (new_stack_info.stack_size > max_stack_size)
1897                     CCerror(context, "Stack size too large");
1898 #ifdef DEBUG
1899                 if (verify_verbose) {
1900                     jio_fprintf(stdout, "  ");
1901                     print_stack(context, &new_stack_info);
1902                     print_registers(context, &new_register_info);
1903                     print_flags(context, new_and_flags, new_or_flags);
1904                     fflush(stdout);
1905                 }
1906 #endif
1907                 /* Add the new stack and register information to any
1908                  * instructions that can follow this instruction.     */
1909                 merge_into_successors(context, inumber,
1910                                       &new_register_info, &new_stack_info,
1911                                       new_and_flags, new_or_flags);
1912             }
1913         }
1914     }
1915 }
1916 
1917 
1918 /* Make sure that the registers contain a legitimate value for the given
1919  * instruction.
1920 */
1921 
1922 static void
1923 check_register_values(context_type *context, unsigned int inumber)
1924 {
1925     instruction_data_type *idata = context->instruction_data;
1926     instruction_data_type *this_idata = &idata[inumber];
1927     int opcode = this_idata->opcode;
1928     int operand = this_idata->operand.i;
1929     int register_count = this_idata->register_info.register_count;
1930     fullinfo_type *registers = this_idata->register_info.registers;
1931     jboolean double_word = JNI_FALSE;   /* default value */
1932     int type;
1933 
1934     switch (opcode) {
1935         default:
1936             return;
1937         case JVM_OPC_iload: case JVM_OPC_iinc:
1938             type = ITEM_Integer; break;
1939         case JVM_OPC_fload:
1940             type = ITEM_Float; break;
1941         case JVM_OPC_aload:
1942             type = ITEM_Object; break;
1943         case JVM_OPC_ret:
1944             type = ITEM_ReturnAddress; break;
1945         case JVM_OPC_lload:
1946             type = ITEM_Long; double_word = JNI_TRUE; break;
1947         case JVM_OPC_dload:
1948             type = ITEM_Double; double_word = JNI_TRUE; break;
1949     }
1950     if (!double_word) {
1951         fullinfo_type reg;
1952         /* Make sure we don't have an illegal register or one with wrong type */
1953         if (operand >= register_count) {
1954             CCerror(context,
1955                     "Accessing value from uninitialized register %d", operand);
1956         }
1957         reg = registers[operand];
1958 
1959         if (WITH_ZERO_EXTRA_INFO(reg) == (unsigned)MAKE_FULLINFO(type, 0, 0)) {
1960             /* the register is obviously of the given type */
1961             return;
1962         } else if (GET_INDIRECTION(reg) > 0 && type == ITEM_Object) {
1963             /* address type stuff be used on all arrays */
1964             return;
1965         } else if (GET_ITEM_TYPE(reg) == ITEM_ReturnAddress) {
1966             CCerror(context, "Cannot load return address from register %d",
1967                               operand);
1968             /* alternatively
1969                       (GET_ITEM_TYPE(reg) == ITEM_ReturnAddress)
1970                    && (opcode == JVM_OPC_iload)
1971                    && (type == ITEM_Object || type == ITEM_Integer)
1972                but this never occurs
1973             */
1974         } else if (reg == ITEM_InitObject && type == ITEM_Object) {
1975             return;
1976         } else if (WITH_ZERO_EXTRA_INFO(reg) ==
1977                         MAKE_FULLINFO(ITEM_NewObject, 0, 0) &&
1978                    type == ITEM_Object) {
1979             return;
1980         } else {
1981             CCerror(context, "Register %d contains wrong type", operand);
1982         }
1983     } else {
1984         /* Make sure we don't have an illegal register or one with wrong type */
1985         if ((operand + 1) >= register_count) {
1986             CCerror(context,
1987                     "Accessing value from uninitialized register pair %d/%d",
1988                     operand, operand+1);
1989         } else {
1990             if ((registers[operand] == (unsigned)MAKE_FULLINFO(type, 0, 0)) &&
1991                 (registers[operand + 1] == (unsigned)MAKE_FULLINFO(type + 1, 0, 0))) {
1992                 return;
1993             } else {
1994                 CCerror(context, "Register pair %d/%d contains wrong type",
1995                         operand, operand+1);
1996             }
1997         }
1998     }
1999 }
2000 
2001 
2002 /* Make sure the flags contain legitimate values for this instruction.
2003 */
2004 
2005 static void
2006 check_flags(context_type *context, unsigned int inumber)
2007 {
2008     instruction_data_type *idata = context->instruction_data;
2009     instruction_data_type *this_idata = &idata[inumber];
2010     int opcode = this_idata->opcode;
2011     switch (opcode) {
2012         case JVM_OPC_return:
2013             /* We need a constructor, but we aren't guaranteed it's called */
2014             if ((this_idata->or_flags & FLAG_NEED_CONSTRUCTOR) &&
2015                    !(this_idata->and_flags & FLAG_CONSTRUCTED))
2016                 CCerror(context, "Constructor must call super() or this()");
2017             /* fall through */
2018         case JVM_OPC_ireturn: case JVM_OPC_lreturn:
2019         case JVM_OPC_freturn: case JVM_OPC_dreturn: case JVM_OPC_areturn:
2020             if (this_idata->or_flags & FLAG_NO_RETURN)
2021                 /* This method cannot exit normally */
2022                 CCerror(context, "Cannot return normally");
2023         default:
2024             break; /* nothing to do. */
2025     }
2026 }
2027 
2028 /* Make sure that the top of the stack contains reasonable values for the
2029  * given instruction.  The post-pop values of the stack and its size are
2030  * returned in *new_stack_info.
2031  */
2032 
2033 static void
2034 pop_stack(context_type *context, unsigned int inumber, stack_info_type *new_stack_info)
2035 {
2036     instruction_data_type *idata = context->instruction_data;
2037     instruction_data_type *this_idata = &idata[inumber];
2038     int opcode = this_idata->opcode;
2039     stack_item_type *stack = this_idata->stack_info.stack;
2040     int stack_size = this_idata->stack_info.stack_size;
2041     char *stack_operands, *p;
2042     char buffer[257];           /* for holding manufactured argument lists */
2043     fullinfo_type stack_extra_info_buffer[256]; /* save info popped off stack */
2044     fullinfo_type *stack_extra_info = &stack_extra_info_buffer[256];
2045     fullinfo_type full_info;    /* only used in case of invoke instructions */
2046     fullinfo_type put_full_info; /* only used in case JVM_OPC_putstatic and JVM_OPC_putfield */
2047 
2048     switch(opcode) {
2049         default:
2050             /* For most instructions, we just use a built-in table */
2051             stack_operands = opcode_in_out[opcode][0];
2052             break;
2053 
2054         case JVM_OPC_putstatic: case JVM_OPC_putfield: {
2055             /* The top thing on the stack depends on the signature of
2056              * the object.                         */
2057             int operand = this_idata->operand.i;
2058             const char *signature =
2059                 JVM_GetCPFieldSignatureUTF(context->env,
2060                                            context->class,
2061                                            operand);
2062             char *ip = buffer;
2063             check_and_push(context, signature, VM_STRING_UTF);
2064 #ifdef DEBUG
2065             if (verify_verbose) {
2066                 print_formatted_fieldname(context, operand);
2067             }
2068 #endif
2069             if (opcode == JVM_OPC_putfield)
2070                 *ip++ = 'A';    /* object for putfield */
2071             *ip++ = signature_to_fieldtype(context, &signature, &put_full_info);
2072             *ip = '\0';
2073             stack_operands = buffer;
2074             pop_and_free(context);
2075             break;
2076         }
2077 
2078         case JVM_OPC_invokevirtual: case JVM_OPC_invokespecial:
2079         case JVM_OPC_invokeinit:    /* invokespecial call to <init> */
2080         case JVM_OPC_invokestatic: case JVM_OPC_invokeinterface: {
2081             /* The top stuff on the stack depends on the method signature */
2082             int operand = this_idata->operand.i;
2083             const char *signature =
2084                 JVM_GetCPMethodSignatureUTF(context->env,
2085                                             context->class,
2086                                             operand);
2087             char *ip = buffer;
2088             const char *p;
2089             check_and_push(context, signature, VM_STRING_UTF);
2090 #ifdef DEBUG
2091             if (verify_verbose) {
2092                 print_formatted_methodname(context, operand);
2093             }
2094 #endif
2095             if (opcode != JVM_OPC_invokestatic)
2096                 /* First, push the object */
2097                 *ip++ = (opcode == JVM_OPC_invokeinit ? '@' : 'A');
2098             for (p = signature + 1; *p != JVM_SIGNATURE_ENDFUNC; ) {
2099                 *ip++ = signature_to_fieldtype(context, &p, &full_info);
2100                 if (ip >= buffer + sizeof(buffer) - 1)
2101                     CCerror(context, "Signature %s has too many arguments",
2102                             signature);
2103             }
2104             *ip = 0;
2105             stack_operands = buffer;
2106             pop_and_free(context);
2107             break;
2108         }
2109 
2110         case JVM_OPC_multianewarray: {
2111             /* Count can't be larger than 255. So can't overflow buffer */
2112             int count = this_idata->operand2.i; /* number of ints on stack */
2113             memset(buffer, 'I', count);
2114             buffer[count] = '\0';
2115             stack_operands = buffer;
2116             break;
2117         }
2118 
2119     } /* of switch */
2120 
2121     /* Run through the list of operands >>backwards<< */
2122     for (   p = stack_operands + strlen(stack_operands);
2123             p > stack_operands;
2124             stack = stack->next) {
2125         int type = *--p;
2126         fullinfo_type top_type = stack ? stack->item : 0;
2127         int size = (type == 'D' || type == 'L') ? 2 : 1;
2128         *--stack_extra_info = top_type;
2129         if (stack == NULL)
2130             CCerror(context, "Unable to pop operand off an empty stack");
2131 
2132         switch (type) {
2133             case 'I':
2134                 if (top_type != MAKE_FULLINFO(ITEM_Integer, 0, 0))
2135                     CCerror(context, "Expecting to find integer on stack");
2136                 break;
2137 
2138             case 'F':
2139                 if (top_type != MAKE_FULLINFO(ITEM_Float, 0, 0))
2140                     CCerror(context, "Expecting to find float on stack");
2141                 break;
2142 
2143             case 'A':           /* object or array */
2144                 if (   (GET_ITEM_TYPE(top_type) != ITEM_Object)
2145                     && (GET_INDIRECTION(top_type) == 0)) {
2146                     /* The thing isn't an object or an array.  Let's see if it's
2147                      * one of the special cases  */
2148                     if (  (WITH_ZERO_EXTRA_INFO(top_type) ==
2149                                 MAKE_FULLINFO(ITEM_ReturnAddress, 0, 0))
2150                         && (opcode == JVM_OPC_astore))
2151                         break;
2152                     if (   (GET_ITEM_TYPE(top_type) == ITEM_NewObject
2153                             || (GET_ITEM_TYPE(top_type) == ITEM_InitObject))
2154                         && ((opcode == JVM_OPC_astore) || (opcode == JVM_OPC_aload)
2155                             || (opcode == JVM_OPC_ifnull) || (opcode == JVM_OPC_ifnonnull)))
2156                         break;
2157                     /* The 2nd edition VM of the specification allows field
2158                      * initializations before the superclass initializer,
2159                      * if the field is defined within the current class.
2160                      */
2161                      if (   (GET_ITEM_TYPE(top_type) == ITEM_InitObject)
2162                          && (opcode == JVM_OPC_putfield)) {
2163                         int operand = this_idata->operand.i;
2164                         int access_bits = JVM_GetCPFieldModifiers(context->env,
2165                                                                   context->class,
2166                                                                   operand,
2167                                                                   context->class);
2168                         /* Note: This relies on the fact that
2169                          * JVM_GetCPFieldModifiers retrieves only local fields,
2170                          * and does not respect inheritance.
2171                          */
2172                         if (access_bits != -1) {
2173                             if ( cp_index_to_class_fullinfo(context, operand, JVM_CONSTANT_Fieldref) ==
2174                                  context->currentclass_info ) {
2175                                 top_type = context->currentclass_info;
2176                                 *stack_extra_info = top_type;
2177                                 break;
2178                             }
2179                         }
2180                     }
2181                     CCerror(context, "Expecting to find object/array on stack");
2182                 }
2183                 break;
2184 
2185             case '@': {         /* unitialized object, for call to <init> */
2186                 int item_type = GET_ITEM_TYPE(top_type);
2187                 if (item_type != ITEM_NewObject && item_type != ITEM_InitObject)
2188                     CCerror(context,
2189                             "Expecting to find unitialized object on stack");
2190                 break;
2191             }
2192 
2193             case 'O':           /* object, not array */
2194                 if (WITH_ZERO_EXTRA_INFO(top_type) !=
2195                        MAKE_FULLINFO(ITEM_Object, 0, 0))
2196                     CCerror(context, "Expecting to find object on stack");
2197                 break;
2198 
2199             case 'a':           /* integer, object, or array */
2200                 if (      (top_type != MAKE_FULLINFO(ITEM_Integer, 0, 0))
2201                        && (GET_ITEM_TYPE(top_type) != ITEM_Object)
2202                        && (GET_INDIRECTION(top_type) == 0))
2203                     CCerror(context,
2204                             "Expecting to find object, array, or int on stack");
2205                 break;
2206 
2207             case 'D':           /* double */
2208                 if (top_type != MAKE_FULLINFO(ITEM_Double, 0, 0))
2209                     CCerror(context, "Expecting to find double on stack");
2210                 break;
2211 
2212             case 'L':           /* long */
2213                 if (top_type != MAKE_FULLINFO(ITEM_Long, 0, 0))
2214                     CCerror(context, "Expecting to find long on stack");
2215                 break;
2216 
2217             case ']':           /* array of some type */
2218                 if (top_type == NULL_FULLINFO) {
2219                     /* do nothing */
2220                 } else switch(p[-1]) {
2221                     case 'I':   /* array of integers */
2222                         if (top_type != MAKE_FULLINFO(ITEM_Integer, 1, 0) &&
2223                             top_type != NULL_FULLINFO)
2224                             CCerror(context,
2225                                     "Expecting to find array of ints on stack");
2226                         break;
2227 
2228                     case 'L':   /* array of longs */
2229                         if (top_type != MAKE_FULLINFO(ITEM_Long, 1, 0))
2230                             CCerror(context,
2231                                    "Expecting to find array of longs on stack");
2232                         break;
2233 
2234                     case 'F':   /* array of floats */
2235                         if (top_type != MAKE_FULLINFO(ITEM_Float, 1, 0))
2236                             CCerror(context,
2237                                  "Expecting to find array of floats on stack");
2238                         break;
2239 
2240                     case 'D':   /* array of doubles */
2241                         if (top_type != MAKE_FULLINFO(ITEM_Double, 1, 0))
2242                             CCerror(context,
2243                                 "Expecting to find array of doubles on stack");
2244                         break;
2245 
2246                     case 'A': { /* array of addresses (arrays or objects) */
2247                         int indirection = GET_INDIRECTION(top_type);
2248                         if ((indirection == 0) ||
2249                             ((indirection == 1) &&
2250                                 (GET_ITEM_TYPE(top_type) != ITEM_Object)))
2251                             CCerror(context,
2252                                 "Expecting to find array of objects or arrays "
2253                                     "on stack");
2254                         break;
2255                     }
2256 
2257                     case 'B':    /* array of bytes or booleans */
2258                         if (top_type != MAKE_FULLINFO(ITEM_Byte, 1, 0) &&
2259                             top_type != MAKE_FULLINFO(ITEM_Boolean, 1, 0))
2260                             CCerror(context,
2261                                   "Expecting to find array of bytes or Booleans on stack");
2262                         break;
2263 
2264                     case 'C':   /* array of characters */
2265                         if (top_type != MAKE_FULLINFO(ITEM_Char, 1, 0))
2266                             CCerror(context,
2267                                   "Expecting to find array of chars on stack");
2268                         break;
2269 
2270                     case 'S':   /* array of shorts */
2271                         if (top_type != MAKE_FULLINFO(ITEM_Short, 1, 0))
2272                             CCerror(context,
2273                                  "Expecting to find array of shorts on stack");
2274                         break;
2275 
2276                     case '?':   /* any type of array is okay */
2277                         if (GET_INDIRECTION(top_type) == 0)
2278                             CCerror(context,
2279                                     "Expecting to find array on stack");
2280                         break;
2281 
2282                     default:
2283                         CCerror(context, "Internal error #1");
2284                         break;
2285                 }
2286                 p -= 2;         /* skip over [ <char> */
2287                 break;
2288 
2289             case '1': case '2': case '3': case '4': /* stack swapping */
2290                 if (top_type == MAKE_FULLINFO(ITEM_Double, 0, 0)
2291                     || top_type == MAKE_FULLINFO(ITEM_Long, 0, 0)) {
2292                     if ((p > stack_operands) && (p[-1] == '+')) {
2293                         context->swap_table[type - '1'] = top_type + 1;
2294                         context->swap_table[p[-2] - '1'] = top_type;
2295                         size = 2;
2296                         p -= 2;
2297                     } else {
2298                         CCerror(context,
2299                                 "Attempt to split long or double on the stack");
2300                     }
2301                 } else {
2302                     context->swap_table[type - '1'] = stack->item;
2303                     if ((p > stack_operands) && (p[-1] == '+'))
2304                         p--;    /* ignore */
2305                 }
2306                 break;
2307             case '+':           /* these should have been caught. */
2308             default:
2309                 CCerror(context, "Internal error #2");
2310         }
2311         stack_size -= size;
2312     }
2313 
2314     /* For many of the opcodes that had an "A" in their field, we really
2315      * need to go back and do a little bit more accurate testing.  We can, of
2316      * course, assume that the minimal type checking has already been done.
2317      */
2318     switch (opcode) {
2319         default: break;
2320         case JVM_OPC_aastore: {     /* array index object  */
2321             fullinfo_type array_type = stack_extra_info[0];
2322             fullinfo_type object_type = stack_extra_info[2];
2323             fullinfo_type target_type = decrement_indirection(array_type);
2324             if ((GET_ITEM_TYPE(object_type) != ITEM_Object)
2325                     && (GET_INDIRECTION(object_type) == 0)) {
2326                 CCerror(context, "Expecting reference type on operand stack in aastore");
2327             }
2328             if ((GET_ITEM_TYPE(target_type) != ITEM_Object)
2329                     && (GET_INDIRECTION(target_type) == 0)) {
2330                 CCerror(context, "Component type of the array must be reference type in aastore");
2331             }
2332             break;
2333         }
2334 
2335         case JVM_OPC_putfield:
2336         case JVM_OPC_getfield:
2337         case JVM_OPC_putstatic: {
2338             int operand = this_idata->operand.i;
2339             fullinfo_type stack_object = stack_extra_info[0];
2340             if (opcode == JVM_OPC_putfield || opcode == JVM_OPC_getfield) {
2341                 if (!isAssignableTo
2342                         (context,
2343                          stack_object,
2344                          cp_index_to_class_fullinfo
2345                              (context, operand, JVM_CONSTANT_Fieldref))) {
2346                     CCerror(context,
2347                             "Incompatible type for getting or setting field");
2348                 }
2349                 if (this_idata->protected &&
2350                     !isAssignableTo(context, stack_object,
2351                                     context->currentclass_info)) {
2352                     CCerror(context, "Bad access to protected data");
2353                 }
2354             }
2355             if (opcode == JVM_OPC_putfield || opcode == JVM_OPC_putstatic) {
2356                 int item = (opcode == JVM_OPC_putfield ? 1 : 0);
2357                 if (!isAssignableTo(context,
2358                                     stack_extra_info[item], put_full_info)) {
2359                     CCerror(context, "Bad type in putfield/putstatic");
2360                 }
2361             }
2362             break;
2363         }
2364 
2365         case JVM_OPC_athrow:
2366             if (!isAssignableTo(context, stack_extra_info[0],
2367                                 context->throwable_info)) {
2368                 CCerror(context, "Can only throw Throwable objects");
2369             }
2370             break;
2371 
2372         case JVM_OPC_aaload: {      /* array index */
2373             /* We need to pass the information to the stack updater */
2374             fullinfo_type array_type = stack_extra_info[0];
2375             context->swap_table[0] = decrement_indirection(array_type);
2376             break;
2377         }
2378 
2379         case JVM_OPC_invokevirtual: case JVM_OPC_invokespecial:
2380         case JVM_OPC_invokeinit:
2381         case JVM_OPC_invokeinterface: case JVM_OPC_invokestatic: {
2382             int operand = this_idata->operand.i;
2383             const char *signature =
2384                 JVM_GetCPMethodSignatureUTF(context->env,
2385                                             context->class,
2386                                             operand);
2387             int item;
2388             const char *p;
2389             check_and_push(context, signature, VM_STRING_UTF);
2390             if (opcode == JVM_OPC_invokestatic) {
2391                 item = 0;
2392             } else if (opcode == JVM_OPC_invokeinit) {
2393                 fullinfo_type init_type = this_idata->operand2.fi;
2394                 fullinfo_type object_type = stack_extra_info[0];
2395                 context->swap_table[0] = object_type; /* save value */
2396                 if (GET_ITEM_TYPE(stack_extra_info[0]) == ITEM_NewObject) {
2397                     /* We better be calling the appropriate init.  Find the
2398                      * inumber of the "JVM_OPC_new" instruction", and figure
2399                      * out what the type really is.
2400                      */
2401                     unsigned int new_inumber = GET_EXTRA_INFO(stack_extra_info[0]);
2402                     fullinfo_type target_type = idata[new_inumber].operand2.fi;
2403                     context->swap_table[1] = target_type;
2404 
2405                     if (target_type != init_type) {
2406                         CCerror(context, "Call to wrong initialization method");
2407                     }
2408                     if (this_idata->protected
2409                         && !isAssignableTo(context, object_type,
2410                                            context->currentclass_info)) {
2411                       CCerror(context, "Bad access to protected data");
2412                     }
2413                 } else {
2414                     /* We better be calling super() or this(). */
2415                     if (init_type != context->superclass_info &&
2416                         init_type != context->currentclass_info) {
2417                         CCerror(context, "Call to wrong initialization method");
2418                     }
2419                     context->swap_table[1] = context->currentclass_info;
2420                 }
2421                 item = 1;
2422             } else {
2423                 fullinfo_type target_type = this_idata->operand2.fi;
2424                 fullinfo_type object_type = stack_extra_info[0];
2425                 if (!isAssignableTo(context, object_type, target_type)){
2426                     CCerror(context,
2427                             "Incompatible object argument for function call");
2428                 }
2429                 if (opcode == JVM_OPC_invokespecial
2430                     && !isAssignableTo(context, object_type,
2431                                        context->currentclass_info)) {
2432                     /* Make sure object argument is assignment compatible to current class */
2433                     CCerror(context,
2434                             "Incompatible object argument for invokespecial");
2435                 }
2436                 if (this_idata->protected
2437                     && !isAssignableTo(context, object_type,
2438                                        context->currentclass_info)) {
2439                     /* This is ugly. Special dispensation.  Arrays pretend to
2440                        implement public Object clone() even though they don't */
2441                     const char *utfName =
2442                         JVM_GetCPMethodNameUTF(context->env,
2443                                                context->class,
2444                                                this_idata->operand.i);
2445                     int is_clone = utfName && (strcmp(utfName, "clone") == 0);
2446                     JVM_ReleaseUTF(utfName);
2447 
2448                     if ((target_type == context->object_info) &&
2449                         (GET_INDIRECTION(object_type) > 0) &&
2450                         is_clone) {
2451                     } else {
2452                         CCerror(context, "Bad access to protected data");
2453                     }
2454                 }
2455                 item = 1;
2456             }
2457             for (p = signature + 1; *p != JVM_SIGNATURE_ENDFUNC; item++)
2458                 if (signature_to_fieldtype(context, &p, &full_info) == 'A') {
2459                     if (!isAssignableTo(context,
2460                                         stack_extra_info[item], full_info)) {
2461                         CCerror(context, "Incompatible argument to function");
2462                     }
2463                 }
2464 
2465             pop_and_free(context);
2466             break;
2467         }
2468 
2469         case JVM_OPC_return:
2470             if (context->return_type != MAKE_FULLINFO(ITEM_Void, 0, 0))
2471                 CCerror(context, "Wrong return type in function");
2472             break;
2473 
2474         case JVM_OPC_ireturn: case JVM_OPC_lreturn: case JVM_OPC_freturn:
2475         case JVM_OPC_dreturn: case JVM_OPC_areturn: {
2476             fullinfo_type target_type = context->return_type;
2477             fullinfo_type object_type = stack_extra_info[0];
2478             if (!isAssignableTo(context, object_type, target_type)) {
2479                 CCerror(context, "Wrong return type in function");
2480             }
2481             break;
2482         }
2483 
2484         case JVM_OPC_new: {
2485             /* Make sure that nothing on the stack already looks like what
2486              * we want to create.  I can't image how this could possibly happen
2487              * but we should test for it anyway, since if it could happen, the
2488              * result would be an unitialized object being able to masquerade
2489              * as an initialized one.
2490              */
2491             stack_item_type *item;
2492             for (item = stack; item != NULL; item = item->next) {
2493                 if (item->item == this_idata->operand.fi) {
2494                     CCerror(context,
2495                             "Uninitialized object on stack at creating point");
2496                 }
2497             }
2498             /* Info for update_registers */
2499             context->swap_table[0] = this_idata->operand.fi;
2500             context->swap_table[1] = MAKE_FULLINFO(ITEM_Bogus, 0, 0);
2501 
2502             break;
2503         }
2504     }
2505     new_stack_info->stack = stack;
2506     new_stack_info->stack_size = stack_size;
2507 }
2508 
2509 
2510 /* We've already determined that the instruction is legal.  Perform the
2511  * operation on the registers, and return the updated results in
2512  * new_register_count_p and new_registers.
2513  */
2514 
2515 static void
2516 update_registers(context_type *context, unsigned int inumber,
2517                  register_info_type *new_register_info)
2518 {
2519     instruction_data_type *idata = context->instruction_data;
2520     instruction_data_type *this_idata = &idata[inumber];
2521     int opcode = this_idata->opcode;
2522     int operand = this_idata->operand.i;
2523     int register_count = this_idata->register_info.register_count;
2524     fullinfo_type *registers = this_idata->register_info.registers;
2525     stack_item_type *stack = this_idata->stack_info.stack;
2526     int mask_count = this_idata->register_info.mask_count;
2527     mask_type *masks = this_idata->register_info.masks;
2528 
2529     /* Use these as default new values. */
2530     int            new_register_count = register_count;
2531     int            new_mask_count = mask_count;
2532     fullinfo_type *new_registers = registers;
2533     mask_type     *new_masks = masks;
2534 
2535     enum { ACCESS_NONE, ACCESS_SINGLE, ACCESS_DOUBLE } access = ACCESS_NONE;
2536     int i;
2537 
2538     /* Remember, we've already verified the type at the top of the stack. */
2539     switch (opcode) {
2540         default: break;
2541         case JVM_OPC_istore: case JVM_OPC_fstore: case JVM_OPC_astore:
2542             access = ACCESS_SINGLE;
2543             goto continue_store;
2544 
2545         case JVM_OPC_lstore: case JVM_OPC_dstore:
2546             access = ACCESS_DOUBLE;
2547             goto continue_store;
2548 
2549         continue_store: {
2550             /* We have a modification to the registers.  Copy them if needed. */
2551             fullinfo_type stack_top_type = stack->item;
2552             int max_operand = operand + ((access == ACCESS_DOUBLE) ? 1 : 0);
2553 
2554             if (     max_operand < register_count
2555                   && registers[operand] == stack_top_type
2556                   && ((access == ACCESS_SINGLE) ||
2557                          (registers[operand + 1]== stack_top_type + 1)))
2558                 /* No changes have been made to the registers. */
2559                 break;
2560             new_register_count = MAX(max_operand + 1, register_count);
2561             new_registers = NEW(fullinfo_type, new_register_count);
2562             for (i = 0; i < register_count; i++)
2563                 new_registers[i] = registers[i];
2564             for (i = register_count; i < new_register_count; i++)
2565                 new_registers[i] = MAKE_FULLINFO(ITEM_Bogus, 0, 0);
2566             new_registers[operand] = stack_top_type;
2567             if (access == ACCESS_DOUBLE)
2568                 new_registers[operand + 1] = stack_top_type + 1;
2569             break;
2570         }
2571 
2572         case JVM_OPC_iload: case JVM_OPC_fload: case JVM_OPC_aload:
2573         case JVM_OPC_iinc: case JVM_OPC_ret:
2574             access = ACCESS_SINGLE;
2575             break;
2576 
2577         case JVM_OPC_lload: case JVM_OPC_dload:
2578             access = ACCESS_DOUBLE;
2579             break;
2580 
2581         case JVM_OPC_jsr: case JVM_OPC_jsr_w:
2582             for (i = 0; i < new_mask_count; i++)
2583                 if (new_masks[i].entry == operand)
2584                     CCerror(context, "Recursive call to jsr entry");
2585             new_masks = add_to_masks(context, masks, mask_count, operand);
2586             new_mask_count++;
2587             break;
2588 
2589         case JVM_OPC_invokeinit:
2590         case JVM_OPC_new: {
2591             /* For invokeinit, an uninitialized object has been initialized.
2592              * For new, all previous occurrences of an uninitialized object
2593              * from the same instruction must be made bogus.
2594              * We find all occurrences of swap_table[0] in the registers, and
2595              * replace them with swap_table[1];
2596              */
2597             fullinfo_type from = context->swap_table[0];
2598             fullinfo_type to = context->swap_table[1];
2599 
2600             int i;
2601             for (i = 0; i < register_count; i++) {
2602                 if (new_registers[i] == from) {
2603                     /* Found a match */
2604                     break;
2605                 }
2606             }
2607             if (i < register_count) { /* We broke out loop for match */
2608                 /* We have to change registers, and possibly a mask */
2609                 jboolean copied_mask = JNI_FALSE;
2610                 int k;
2611                 new_registers = NEW(fullinfo_type, register_count);
2612                 memcpy(new_registers, registers,
2613                        register_count * sizeof(registers[0]));
2614                 for ( ; i < register_count; i++) {
2615                     if (new_registers[i] == from) {
2616                         new_registers[i] = to;
2617                         for (k = 0; k < new_mask_count; k++) {
2618                             if (!IS_BIT_SET(new_masks[k].modifies, i)) {
2619                                 if (!copied_mask) {
2620                                     new_masks = copy_masks(context, new_masks,
2621                                                            mask_count);
2622                                     copied_mask = JNI_TRUE;
2623                                 }
2624                                 SET_BIT(new_masks[k].modifies, i);
2625                             }
2626                         }
2627                     }
2628                 }
2629             }
2630             break;
2631         }
2632     } /* of switch */
2633 
2634     if ((access != ACCESS_NONE) && (new_mask_count > 0)) {
2635         int i, j;
2636         for (i = 0; i < new_mask_count; i++) {
2637             int *mask = new_masks[i].modifies;
2638             if ((!IS_BIT_SET(mask, operand)) ||
2639                   ((access == ACCESS_DOUBLE) &&
2640                    !IS_BIT_SET(mask, operand + 1))) {
2641                 new_masks = copy_masks(context, new_masks, mask_count);
2642                 for (j = i; j < new_mask_count; j++) {
2643                     SET_BIT(new_masks[j].modifies, operand);
2644                     if (access == ACCESS_DOUBLE)
2645                         SET_BIT(new_masks[j].modifies, operand + 1);
2646                 }
2647                 break;
2648             }
2649         }
2650     }
2651 
2652     new_register_info->register_count = new_register_count;
2653     new_register_info->registers = new_registers;
2654     new_register_info->masks = new_masks;
2655     new_register_info->mask_count = new_mask_count;
2656 }
2657 
2658 
2659 
2660 /* We've already determined that the instruction is legal, and have updated
2661  * the registers.  Update the flags, too.
2662  */
2663 
2664 
2665 static void
2666 update_flags(context_type *context, unsigned int inumber,
2667              flag_type *new_and_flags, flag_type *new_or_flags)
2668 
2669 {
2670     instruction_data_type *idata = context->instruction_data;
2671     instruction_data_type *this_idata = &idata[inumber];
2672     flag_type and_flags = this_idata->and_flags;
2673     flag_type or_flags = this_idata->or_flags;
2674 
2675     /* Set the "we've done a constructor" flag */
2676     if (this_idata->opcode == JVM_OPC_invokeinit) {
2677         fullinfo_type from = context->swap_table[0];
2678         if (from == MAKE_FULLINFO(ITEM_InitObject, 0, 0))
2679             and_flags |= FLAG_CONSTRUCTED;
2680     }
2681     *new_and_flags = and_flags;
2682     *new_or_flags = or_flags;
2683 }
2684 
2685 
2686 
2687 /* We've already determined that the instruction is legal.  Perform the
2688  * operation on the stack;
2689  *
2690  * new_stack_size_p and new_stack_p point to the results after the pops have
2691  * already been done.  Do the pushes, and then put the results back there.
2692  */
2693 
2694 static void
2695 push_stack(context_type *context, unsigned int inumber, stack_info_type *new_stack_info)
2696 {
2697     instruction_data_type *idata = context->instruction_data;
2698     instruction_data_type *this_idata = &idata[inumber];
2699     int opcode = this_idata->opcode;
2700     int operand = this_idata->operand.i;
2701 
2702     int stack_size = new_stack_info->stack_size;
2703     stack_item_type *stack = new_stack_info->stack;
2704     char *stack_results;
2705 
2706     fullinfo_type full_info = 0;
2707     char buffer[5], *p;         /* actually [2] is big enough */
2708 
2709     /* We need to look at all those opcodes in which either we can't tell the
2710      * value pushed onto the stack from the opcode, or in which the value
2711      * pushed onto the stack is an object or array.  For the latter, we need
2712      * to make sure that full_info is set to the right value.
2713      */
2714     switch(opcode) {
2715         default:
2716             stack_results = opcode_in_out[opcode][1];
2717             break;
2718 
2719         case JVM_OPC_ldc: case JVM_OPC_ldc_w: case JVM_OPC_ldc2_w: {
2720             /* Look to constant pool to determine correct result. */
2721             unsigned char *type_table = context->constant_types;
2722             switch (type_table[operand]) {
2723                 case JVM_CONSTANT_Integer:
2724                     stack_results = "I"; break;
2725                 case JVM_CONSTANT_Float:
2726                     stack_results = "F"; break;
2727                 case JVM_CONSTANT_Double:
2728                     stack_results = "D"; break;
2729                 case JVM_CONSTANT_Long:
2730                     stack_results = "L"; break;
2731                 case JVM_CONSTANT_String:
2732                     stack_results = "A";
2733                     full_info = context->string_info;
2734                     break;
2735                 case JVM_CONSTANT_Class:
2736                     if (context->major_version < LDC_CLASS_MAJOR_VERSION)
2737                         CCerror(context, "Internal error #3");
2738                     stack_results = "A";
2739                     full_info = make_class_info_from_name(context,
2740                                                           "java/lang/Class");
2741                     break;
2742                 case JVM_CONSTANT_MethodHandle:
2743                 case JVM_CONSTANT_MethodType:
2744                     if (context->major_version < LDC_METHOD_HANDLE_MAJOR_VERSION)
2745                         CCerror(context, "Internal error #3");
2746                     stack_results = "A";
2747                     switch (type_table[operand]) {
2748                     case JVM_CONSTANT_MethodType:
2749                       full_info = make_class_info_from_name(context,
2750                                                             "java/lang/invoke/MethodType");
2751                       break;
2752                     default: //JVM_CONSTANT_MethodHandle
2753                       full_info = make_class_info_from_name(context,
2754                                                             "java/lang/invoke/MethodHandle");
2755                       break;
2756                     }
2757                     break;
2758                 default:
2759                     CCerror(context, "Internal error #3");
2760                     stack_results = ""; /* Never reached: keep lint happy */
2761             }
2762             break;
2763         }
2764 
2765         case JVM_OPC_getstatic: case JVM_OPC_getfield: {
2766             /* Look to signature to determine correct result. */
2767             int operand = this_idata->operand.i;
2768             const char *signature = JVM_GetCPFieldSignatureUTF(context->env,
2769                                                                context->class,
2770                                                                operand);
2771             check_and_push(context, signature, VM_STRING_UTF);
2772 #ifdef DEBUG
2773             if (verify_verbose) {
2774                 print_formatted_fieldname(context, operand);
2775             }
2776 #endif
2777             buffer[0] = signature_to_fieldtype(context, &signature, &full_info);
2778             buffer[1] = '\0';
2779             stack_results = buffer;
2780             pop_and_free(context);
2781             break;
2782         }
2783 
2784         case JVM_OPC_invokevirtual: case JVM_OPC_invokespecial:
2785         case JVM_OPC_invokeinit:
2786         case JVM_OPC_invokestatic: case JVM_OPC_invokeinterface: {
2787             /* Look to signature to determine correct result. */
2788             int operand = this_idata->operand.i;
2789             const char *signature = JVM_GetCPMethodSignatureUTF(context->env,
2790                                                                 context->class,
2791                                                                 operand);
2792             const char *result_signature;
2793             check_and_push(context, signature, VM_STRING_UTF);
2794             result_signature = get_result_signature(signature);
2795             if (result_signature++ == NULL) {
2796                 CCerror(context, "Illegal signature %s", signature);
2797             }
2798             if (result_signature[0] == JVM_SIGNATURE_VOID) {
2799                 stack_results = "";
2800             } else {
2801                 buffer[0] = signature_to_fieldtype(context, &result_signature,
2802                                                    &full_info);
2803                 buffer[1] = '\0';
2804                 stack_results = buffer;
2805             }
2806             pop_and_free(context);
2807             break;
2808         }
2809 
2810         case JVM_OPC_aconst_null:
2811             stack_results = opcode_in_out[opcode][1];
2812             full_info = NULL_FULLINFO; /* special NULL */
2813             break;
2814 
2815         case JVM_OPC_new:
2816         case JVM_OPC_checkcast:
2817         case JVM_OPC_newarray:
2818         case JVM_OPC_anewarray:
2819         case JVM_OPC_multianewarray:
2820             stack_results = opcode_in_out[opcode][1];
2821             /* Conveniently, this result type is stored here */
2822             full_info = this_idata->operand.fi;
2823             break;
2824 
2825         case JVM_OPC_aaload:
2826             stack_results = opcode_in_out[opcode][1];
2827             /* pop_stack() saved value for us. */
2828             full_info = context->swap_table[0];
2829             break;
2830 
2831         case JVM_OPC_aload:
2832             stack_results = opcode_in_out[opcode][1];
2833             /* The register hasn't been modified, so we can use its value. */
2834             full_info = this_idata->register_info.registers[operand];
2835             break;
2836     } /* of switch */
2837 
2838     for (p = stack_results; *p != 0; p++) {
2839         int type = *p;
2840         stack_item_type *new_item = NEW(stack_item_type, 1);
2841         new_item->next = stack;
2842         stack = new_item;
2843         switch (type) {
2844             case 'I':
2845                 stack->item = MAKE_FULLINFO(ITEM_Integer, 0, 0); break;
2846             case 'F':
2847                 stack->item = MAKE_FULLINFO(ITEM_Float, 0, 0); break;
2848             case 'D':
2849                 stack->item = MAKE_FULLINFO(ITEM_Double, 0, 0);
2850                 stack_size++; break;
2851             case 'L':
2852                 stack->item = MAKE_FULLINFO(ITEM_Long, 0, 0);
2853                 stack_size++; break;
2854             case 'R':
2855                 stack->item = MAKE_FULLINFO(ITEM_ReturnAddress, 0, operand);
2856                 break;
2857             case '1': case '2': case '3': case '4': {
2858                 /* Get the info saved in the swap_table */
2859                 fullinfo_type stype = context->swap_table[type - '1'];
2860                 stack->item = stype;
2861                 if (stype == MAKE_FULLINFO(ITEM_Long, 0, 0) ||
2862                     stype == MAKE_FULLINFO(ITEM_Double, 0, 0)) {
2863                     stack_size++; p++;
2864                 }
2865                 break;
2866             }
2867             case 'A':
2868                 /* full_info should have the appropriate value. */
2869                 assert(full_info != 0);
2870                 stack->item = full_info;
2871                 break;
2872             default:
2873                 CCerror(context, "Internal error #4");
2874 
2875             } /* switch type */
2876         stack_size++;
2877     } /* outer for loop */
2878 
2879     if (opcode == JVM_OPC_invokeinit) {
2880         /* If there are any instances of "from" on the stack, we need to
2881          * replace it with "to", since calling <init> initializes all versions
2882          * of the object, obviously.     */
2883         fullinfo_type from = context->swap_table[0];
2884         stack_item_type *ptr;
2885         for (ptr = stack; ptr != NULL; ptr = ptr->next) {
2886             if (ptr->item == from) {
2887                 fullinfo_type to = context->swap_table[1];
2888                 stack = copy_stack(context, stack);
2889                 for (ptr = stack; ptr != NULL; ptr = ptr->next)
2890                     if (ptr->item == from) ptr->item = to;
2891                 break;
2892             }
2893         }
2894     }
2895 
2896     new_stack_info->stack_size = stack_size;
2897     new_stack_info->stack = stack;
2898 }
2899 
2900 
2901 /* We've performed an instruction, and determined the new registers and stack
2902  * value.  Look at all of the possibly subsequent instructions, and merge
2903  * this stack value into theirs.
2904  */
2905 
2906 static void
2907 merge_into_successors(context_type *context, unsigned int inumber,
2908                       register_info_type *register_info,
2909                       stack_info_type *stack_info,
2910                       flag_type and_flags, flag_type or_flags)
2911 {
2912     instruction_data_type *idata = context->instruction_data;
2913     instruction_data_type *this_idata = &idata[inumber];
2914     int opcode = this_idata->opcode;
2915     int operand = this_idata->operand.i;
2916     struct handler_info_type *handler_info = context->handler_info;
2917     int handler_info_length =
2918         JVM_GetMethodIxExceptionTableLength(context->env,
2919                                             context->class,
2920                                             context->method_index);
2921 
2922 
2923     int buffer[2];              /* default value for successors */
2924     int *successors = buffer;   /* table of successors */
2925     int successors_count;
2926     int i;
2927 
2928     switch (opcode) {
2929     default:
2930         successors_count = 1;
2931         buffer[0] = inumber + 1;
2932         break;
2933 
2934     case JVM_OPC_ifeq: case JVM_OPC_ifne: case JVM_OPC_ifgt:
2935     case JVM_OPC_ifge: case JVM_OPC_iflt: case JVM_OPC_ifle:
2936     case JVM_OPC_ifnull: case JVM_OPC_ifnonnull:
2937     case JVM_OPC_if_icmpeq: case JVM_OPC_if_icmpne: case JVM_OPC_if_icmpgt:
2938     case JVM_OPC_if_icmpge: case JVM_OPC_if_icmplt: case JVM_OPC_if_icmple:
2939     case JVM_OPC_if_acmpeq: case JVM_OPC_if_acmpne:
2940         successors_count = 2;
2941         buffer[0] = inumber + 1;
2942         buffer[1] = operand;
2943         break;
2944 
2945     case JVM_OPC_jsr: case JVM_OPC_jsr_w:
2946         if (this_idata->operand2.i != UNKNOWN_RET_INSTRUCTION)
2947             idata[this_idata->operand2.i].changed = JNI_TRUE;
2948         /* FALLTHROUGH */
2949     case JVM_OPC_goto: case JVM_OPC_goto_w:
2950         successors_count = 1;
2951         buffer[0] = operand;
2952         break;
2953 
2954 
2955     case JVM_OPC_ireturn: case JVM_OPC_lreturn: case JVM_OPC_return:
2956     case JVM_OPC_freturn: case JVM_OPC_dreturn: case JVM_OPC_areturn:
2957     case JVM_OPC_athrow:
2958         /* The testing for the returns is handled in pop_stack() */
2959         successors_count = 0;
2960         break;
2961 
2962     case JVM_OPC_ret: {
2963         /* This is slightly slow, but good enough for a seldom used instruction.
2964          * The EXTRA_ITEM_INFO of the ITEM_ReturnAddress indicates the
2965          * address of the first instruction of the subroutine.  We can return
2966          * to 1 after any instruction that jsr's to that instruction.
2967          */
2968         if (this_idata->operand2.ip == NULL) {
2969             fullinfo_type *registers = this_idata->register_info.registers;
2970             int called_instruction = GET_EXTRA_INFO(registers[operand]);
2971             int i, count, *ptr;;
2972             for (i = context->instruction_count, count = 0; --i >= 0; ) {
2973                 if (((idata[i].opcode == JVM_OPC_jsr) ||
2974                      (idata[i].opcode == JVM_OPC_jsr_w)) &&
2975                     (idata[i].operand.i == called_instruction))
2976                     count++;
2977             }
2978             this_idata->operand2.ip = ptr = NEW(int, count + 1);
2979             *ptr++ = count;
2980             for (i = context->instruction_count, count = 0; --i >= 0; ) {
2981                 if (((idata[i].opcode == JVM_OPC_jsr) ||
2982                      (idata[i].opcode == JVM_OPC_jsr_w)) &&
2983                     (idata[i].operand.i == called_instruction))
2984                     *ptr++ = i + 1;
2985             }
2986         }
2987         successors = this_idata->operand2.ip; /* use this instead */
2988         successors_count = *successors++;
2989         break;
2990 
2991     }
2992 
2993     case JVM_OPC_tableswitch:
2994     case JVM_OPC_lookupswitch:
2995         successors = this_idata->operand.ip; /* use this instead */
2996         successors_count = *successors++;
2997         break;
2998     }
2999 
3000 #ifdef DEBUG
3001     if (verify_verbose) {
3002         jio_fprintf(stdout, " [");
3003         for (i = handler_info_length; --i >= 0; handler_info++)
3004             if (handler_info->start <= (int)inumber && handler_info->end > (int)inumber)
3005                 jio_fprintf(stdout, "%d* ", handler_info->handler);
3006         for (i = 0; i < successors_count; i++)
3007             jio_fprintf(stdout, "%d ", successors[i]);
3008         jio_fprintf(stdout,   "]\n");
3009     }
3010 #endif
3011 
3012     handler_info = context->handler_info;
3013     for (i = handler_info_length; --i >= 0; handler_info++) {
3014         if (handler_info->start <= (int)inumber && handler_info->end > (int)inumber) {
3015             int handler = handler_info->handler;
3016             if (opcode != JVM_OPC_invokeinit) {
3017                 merge_into_one_successor(context, inumber, handler,
3018                                          &this_idata->register_info, /* old */
3019                                          &handler_info->stack_info,
3020                                          (flag_type) (and_flags
3021                                                       & this_idata->and_flags),
3022                                          (flag_type) (or_flags
3023                                                       | this_idata->or_flags),
3024                                          JNI_TRUE);
3025             } else {
3026                 /* We need to be a little bit more careful with this
3027                  * instruction.  Things could either be in the state before
3028                  * the instruction or in the state afterwards */
3029                 fullinfo_type from = context->swap_table[0];
3030                 flag_type temp_or_flags = or_flags;
3031                 if (from == MAKE_FULLINFO(ITEM_InitObject, 0, 0))
3032                     temp_or_flags |= FLAG_NO_RETURN;
3033                 merge_into_one_successor(context, inumber, handler,
3034                                          &this_idata->register_info, /* old */
3035                                          &handler_info->stack_info,
3036                                          this_idata->and_flags,
3037                                          this_idata->or_flags,
3038                                          JNI_TRUE);
3039                 merge_into_one_successor(context, inumber, handler,
3040                                          register_info,
3041                                          &handler_info->stack_info,
3042                                          and_flags, temp_or_flags, JNI_TRUE);
3043             }
3044         }
3045     }
3046     for (i = 0; i < successors_count; i++) {
3047         int target = successors[i];
3048         if (target >= context->instruction_count)
3049             CCerror(context, "Falling off the end of the code");
3050         merge_into_one_successor(context, inumber, target,
3051                                  register_info, stack_info, and_flags, or_flags,
3052                                  JNI_FALSE);
3053     }
3054 }
3055 
3056 /* We have a new set of registers and stack values for a given instruction.
3057  * Merge this new set into the values that are already there.
3058  */
3059 
3060 static void
3061 merge_into_one_successor(context_type *context,
3062                          unsigned int from_inumber, unsigned int to_inumber,
3063                          register_info_type *new_register_info,
3064                          stack_info_type *new_stack_info,
3065                          flag_type new_and_flags, flag_type new_or_flags,
3066                          jboolean isException)
3067 {
3068     instruction_data_type *idata = context->instruction_data;
3069     register_info_type register_info_buf;
3070     stack_info_type stack_info_buf;
3071 #ifdef DEBUG
3072     instruction_data_type *this_idata = &idata[to_inumber];
3073     register_info_type old_reg_info;
3074     stack_info_type old_stack_info;
3075     flag_type old_and_flags = 0;
3076     flag_type old_or_flags = 0;
3077 #endif
3078 
3079 #ifdef DEBUG
3080     if (verify_verbose) {
3081         old_reg_info = this_idata->register_info;
3082         old_stack_info = this_idata->stack_info;
3083         old_and_flags = this_idata->and_flags;
3084         old_or_flags = this_idata->or_flags;
3085     }
3086 #endif
3087 
3088     /* All uninitialized objects are set to "bogus" when jsr and
3089      * ret are executed. Thus uninitialized objects can't propagate
3090      * into or out of a subroutine.
3091      */
3092     if (idata[from_inumber].opcode == JVM_OPC_ret ||
3093         idata[from_inumber].opcode == JVM_OPC_jsr ||
3094         idata[from_inumber].opcode == JVM_OPC_jsr_w) {
3095         int new_register_count = new_register_info->register_count;
3096         fullinfo_type *new_registers = new_register_info->registers;
3097         int i;
3098         stack_item_type *item;
3099 
3100         for (item = new_stack_info->stack; item != NULL; item = item->next) {
3101             if (GET_ITEM_TYPE(item->item) == ITEM_NewObject) {
3102                 /* This check only succeeds for hand-contrived code.
3103                  * Efficiency is not an issue.
3104                  */
3105                 stack_info_buf.stack = copy_stack(context,
3106                                                   new_stack_info->stack);
3107                 stack_info_buf.stack_size = new_stack_info->stack_size;
3108                 new_stack_info = &stack_info_buf;
3109                 for (item = new_stack_info->stack; item != NULL;
3110                      item = item->next) {
3111                     if (GET_ITEM_TYPE(item->item) == ITEM_NewObject) {
3112                         item->item = MAKE_FULLINFO(ITEM_Bogus, 0, 0);
3113                     }
3114                 }
3115                 break;
3116             }
3117         }
3118         for (i = 0; i < new_register_count; i++) {
3119             if (GET_ITEM_TYPE(new_registers[i]) == ITEM_NewObject) {
3120                 /* This check only succeeds for hand-contrived code.
3121                  * Efficiency is not an issue.
3122                  */
3123                 fullinfo_type *new_set = NEW(fullinfo_type,
3124                                              new_register_count);
3125                 for (i = 0; i < new_register_count; i++) {
3126                     fullinfo_type t = new_registers[i];
3127                     new_set[i] = GET_ITEM_TYPE(t) != ITEM_NewObject ?
3128                         t : MAKE_FULLINFO(ITEM_Bogus, 0, 0);
3129                 }
3130                 register_info_buf.register_count = new_register_count;
3131                 register_info_buf.registers = new_set;
3132                 register_info_buf.mask_count = new_register_info->mask_count;
3133                 register_info_buf.masks = new_register_info->masks;
3134                 new_register_info = &register_info_buf;
3135                 break;
3136             }
3137         }
3138     }
3139 
3140     /* Returning from a subroutine is somewhat ugly.  The actual thing
3141      * that needs to get merged into the new instruction is a joining
3142      * of info from the ret instruction with stuff in the jsr instruction
3143      */
3144     if (idata[from_inumber].opcode == JVM_OPC_ret && !isException) {
3145         int new_register_count = new_register_info->register_count;
3146         fullinfo_type *new_registers = new_register_info->registers;
3147         int new_mask_count = new_register_info->mask_count;
3148         mask_type *new_masks = new_register_info->masks;
3149         int operand = idata[from_inumber].operand.i;
3150         int called_instruction = GET_EXTRA_INFO(new_registers[operand]);
3151         instruction_data_type *jsr_idata = &idata[to_inumber - 1];
3152         register_info_type *jsr_reginfo = &jsr_idata->register_info;
3153         if (jsr_idata->operand2.i != (int)from_inumber) {
3154             if (jsr_idata->operand2.i != UNKNOWN_RET_INSTRUCTION)
3155                 CCerror(context, "Multiple returns to single jsr");
3156             jsr_idata->operand2.i = from_inumber;
3157         }
3158         if (jsr_reginfo->register_count == UNKNOWN_REGISTER_COUNT) {
3159             /* We don't want to handle the returned-to instruction until
3160              * we've dealt with the jsr instruction.   When we get to the
3161              * jsr instruction (if ever), we'll re-mark the ret instruction
3162              */
3163             ;
3164         } else {
3165             int register_count = jsr_reginfo->register_count;
3166             fullinfo_type *registers = jsr_reginfo->registers;
3167             int max_registers = MAX(register_count, new_register_count);
3168             fullinfo_type *new_set = NEW(fullinfo_type, max_registers);
3169             int *return_mask;
3170             struct register_info_type new_new_register_info;
3171             int i;
3172             /* Make sure the place we're returning from is legal! */
3173             for (i = new_mask_count; --i >= 0; )
3174                 if (new_masks[i].entry == called_instruction)
3175                     break;
3176             if (i < 0)
3177                 CCerror(context, "Illegal return from subroutine");
3178             /* pop the masks down to the indicated one.  Remember the mask
3179              * we're popping off. */
3180             return_mask = new_masks[i].modifies;
3181             new_mask_count = i;
3182             for (i = 0; i < max_registers; i++) {
3183                 if (IS_BIT_SET(return_mask, i))
3184                     new_set[i] = i < new_register_count ?
3185                           new_registers[i] : MAKE_FULLINFO(ITEM_Bogus, 0, 0);
3186                 else
3187                     new_set[i] = i < register_count ?
3188                         registers[i] : MAKE_FULLINFO(ITEM_Bogus, 0, 0);
3189             }
3190             new_new_register_info.register_count = max_registers;
3191             new_new_register_info.registers      = new_set;
3192             new_new_register_info.mask_count     = new_mask_count;
3193             new_new_register_info.masks          = new_masks;
3194 
3195 
3196             merge_stack(context, from_inumber, to_inumber, new_stack_info);
3197             merge_registers(context, to_inumber - 1, to_inumber,
3198                             &new_new_register_info);
3199             merge_flags(context, from_inumber, to_inumber, new_and_flags, new_or_flags);
3200         }
3201     } else {
3202         merge_stack(context, from_inumber, to_inumber, new_stack_info);
3203         merge_registers(context, from_inumber, to_inumber, new_register_info);
3204         merge_flags(context, from_inumber, to_inumber,
3205                     new_and_flags, new_or_flags);
3206     }
3207 
3208 #ifdef DEBUG
3209     if (verify_verbose && idata[to_inumber].changed) {
3210         register_info_type *register_info = &this_idata->register_info;
3211         stack_info_type *stack_info = &this_idata->stack_info;
3212         if (memcmp(&old_reg_info, register_info, sizeof(old_reg_info)) ||
3213             memcmp(&old_stack_info, stack_info, sizeof(old_stack_info)) ||
3214             (old_and_flags != this_idata->and_flags) ||
3215             (old_or_flags != this_idata->or_flags)) {
3216             jio_fprintf(stdout, "   %2d:", to_inumber);
3217             print_stack(context, &old_stack_info);
3218             print_registers(context, &old_reg_info);
3219             print_flags(context, old_and_flags, old_or_flags);
3220             jio_fprintf(stdout, " => ");
3221             print_stack(context, &this_idata->stack_info);
3222             print_registers(context, &this_idata->register_info);
3223             print_flags(context, this_idata->and_flags, this_idata->or_flags);
3224             jio_fprintf(stdout, "\n");
3225         }
3226     }
3227 #endif
3228 
3229 }
3230 
3231 static void
3232 merge_stack(context_type *context, unsigned int from_inumber,
3233             unsigned int to_inumber, stack_info_type *new_stack_info)
3234 {
3235     instruction_data_type *idata = context->instruction_data;
3236     instruction_data_type *this_idata = &idata[to_inumber];
3237 
3238     int new_stack_size =  new_stack_info->stack_size;
3239     stack_item_type *new_stack = new_stack_info->stack;
3240 
3241     int stack_size = this_idata->stack_info.stack_size;
3242 
3243     if (stack_size == UNKNOWN_STACK_SIZE) {
3244         /* First time at this instruction.  Just copy. */
3245         this_idata->stack_info.stack_size = new_stack_size;
3246         this_idata->stack_info.stack = new_stack;
3247         this_idata->changed = JNI_TRUE;
3248     } else if (new_stack_size != stack_size) {
3249         CCerror(context, "Inconsistent stack height %d != %d",
3250                 new_stack_size, stack_size);
3251     } else {
3252         stack_item_type *stack = this_idata->stack_info.stack;
3253         stack_item_type *old, *new;
3254         jboolean change = JNI_FALSE;
3255         for (old = stack, new = new_stack; old != NULL;
3256                    old = old->next, new = new->next) {
3257             if (!isAssignableTo(context, new->item, old->item)) {
3258                 change = JNI_TRUE;
3259                 break;
3260             }
3261         }
3262         if (change) {
3263             stack = copy_stack(context, stack);
3264             for (old = stack, new = new_stack; old != NULL;
3265                           old = old->next, new = new->next) {
3266                 if (new == NULL) {
3267                     break;
3268                 }
3269                 old->item = merge_fullinfo_types(context, old->item, new->item,
3270                                                  JNI_FALSE);
3271                 if (GET_ITEM_TYPE(old->item) == ITEM_Bogus) {
3272                         CCerror(context, "Mismatched stack types");
3273                 }
3274             }
3275             if (old != NULL || new != NULL) {
3276                 CCerror(context, "Mismatched stack types");
3277             }
3278             this_idata->stack_info.stack = stack;
3279             this_idata->changed = JNI_TRUE;
3280         }
3281     }
3282 }
3283 
3284 static void
3285 merge_registers(context_type *context, unsigned int from_inumber,
3286                 unsigned int to_inumber, register_info_type *new_register_info)
3287 {
3288     instruction_data_type *idata = context->instruction_data;
3289     instruction_data_type *this_idata = &idata[to_inumber];
3290     register_info_type    *this_reginfo = &this_idata->register_info;
3291 
3292     int            new_register_count = new_register_info->register_count;
3293     fullinfo_type *new_registers = new_register_info->registers;
3294     int            new_mask_count = new_register_info->mask_count;
3295     mask_type     *new_masks = new_register_info->masks;
3296 
3297 
3298     if (this_reginfo->register_count == UNKNOWN_REGISTER_COUNT) {
3299         this_reginfo->register_count = new_register_count;
3300         this_reginfo->registers = new_registers;
3301         this_reginfo->mask_count = new_mask_count;
3302         this_reginfo->masks = new_masks;
3303         this_idata->changed = JNI_TRUE;
3304     } else {
3305         /* See if we've got new information on the register set. */
3306         int register_count = this_reginfo->register_count;
3307         fullinfo_type *registers = this_reginfo->registers;
3308         int mask_count = this_reginfo->mask_count;
3309         mask_type *masks = this_reginfo->masks;
3310 
3311         jboolean copy = JNI_FALSE;
3312         int i, j;
3313         if (register_count > new_register_count) {
3314             /* Any register larger than new_register_count is now bogus */
3315             this_reginfo->register_count = new_register_count;
3316             register_count = new_register_count;
3317             this_idata->changed = JNI_TRUE;
3318         }
3319         for (i = 0; i < register_count; i++) {
3320             fullinfo_type prev_value = registers[i];
3321             if ((i < new_register_count)
3322                   ? (!isAssignableTo(context, new_registers[i], prev_value))
3323                   : (prev_value != MAKE_FULLINFO(ITEM_Bogus, 0, 0))) {
3324                 copy = JNI_TRUE;
3325                 break;
3326             }
3327         }
3328 
3329         if (copy) {
3330             /* We need a copy.  So do it. */
3331             fullinfo_type *new_set = NEW(fullinfo_type, register_count);
3332             for (j = 0; j < i; j++)
3333                 new_set[j] =  registers[j];
3334             for (j = i; j < register_count; j++) {
3335                 if (i >= new_register_count)
3336                     new_set[j] = MAKE_FULLINFO(ITEM_Bogus, 0, 0);
3337                 else
3338                     new_set[j] = merge_fullinfo_types(context,
3339                                                       new_registers[j],
3340                                                       registers[j], JNI_FALSE);
3341             }
3342             /* Some of the end items might now be bogus. This step isn't
3343              * necessary, but it may save work later. */
3344             while (   register_count > 0
3345                    && GET_ITEM_TYPE(new_set[register_count-1]) == ITEM_Bogus)
3346                 register_count--;
3347             this_reginfo->register_count = register_count;
3348             this_reginfo->registers = new_set;
3349             this_idata->changed = JNI_TRUE;
3350         }
3351         if (mask_count > 0) {
3352             /* If the target instruction already has a sequence of masks, then
3353              * we need to merge new_masks into it.  We want the entries on
3354              * the mask to be the longest common substring of the two.
3355              *   (e.g.   a->b->d merged with a->c->d should give a->d)
3356              * The bits set in the mask should be the or of the corresponding
3357              * entries in each of the original masks.
3358              */
3359             int i, j, k;
3360             int matches = 0;
3361             int last_match = -1;
3362             jboolean copy_needed = JNI_FALSE;
3363             for (i = 0; i < mask_count; i++) {
3364                 int entry = masks[i].entry;
3365                 for (j = last_match + 1; j < new_mask_count; j++) {
3366                     if (new_masks[j].entry == entry) {
3367                         /* We have a match */
3368                         int *prev = masks[i].modifies;
3369                         int *new = new_masks[j].modifies;
3370                         matches++;
3371                         /* See if new_mask has bits set for "entry" that
3372                          * weren't set for mask.  If so, need to copy. */
3373                         for (k = context->bitmask_size - 1;
3374                                !copy_needed && k >= 0;
3375                                k--)
3376                             if (~prev[k] & new[k])
3377                                 copy_needed = JNI_TRUE;
3378                         last_match = j;
3379                         break;
3380                     }
3381                 }
3382             }
3383             if ((matches < mask_count) || copy_needed) {
3384                 /* We need to make a copy for the new item, since either the
3385                  * size has decreased, or new bits are set. */
3386                 mask_type *copy = NEW(mask_type, matches);
3387                 for (i = 0; i < matches; i++) {
3388                     copy[i].modifies = NEW(int, context->bitmask_size);
3389                 }
3390                 this_reginfo->masks = copy;
3391                 this_reginfo->mask_count = matches;
3392                 this_idata->changed = JNI_TRUE;
3393                 matches = 0;
3394                 last_match = -1;
3395                 for (i = 0; i < mask_count; i++) {
3396                     int entry = masks[i].entry;
3397                     for (j = last_match + 1; j < new_mask_count; j++) {
3398                         if (new_masks[j].entry == entry) {
3399                             int *prev1 = masks[i].modifies;
3400                             int *prev2 = new_masks[j].modifies;
3401                             int *new = copy[matches].modifies;
3402                             copy[matches].entry = entry;
3403                             for (k = context->bitmask_size - 1; k >= 0; k--)
3404                                 new[k] = prev1[k] | prev2[k];
3405                             matches++;
3406                             last_match = j;
3407                             break;
3408                         }
3409                     }
3410                 }
3411             }
3412         }
3413     }
3414 }
3415 
3416 
3417 static void
3418 merge_flags(context_type *context, unsigned int from_inumber,
3419             unsigned int to_inumber,
3420             flag_type new_and_flags, flag_type new_or_flags)
3421 {
3422     /* Set this_idata->and_flags &= new_and_flags
3423            this_idata->or_flags |= new_or_flags
3424      */
3425     instruction_data_type *idata = context->instruction_data;
3426     instruction_data_type *this_idata = &idata[to_inumber];
3427     flag_type this_and_flags = this_idata->and_flags;
3428     flag_type this_or_flags = this_idata->or_flags;
3429     flag_type merged_and = this_and_flags & new_and_flags;
3430     flag_type merged_or = this_or_flags | new_or_flags;
3431 
3432     if ((merged_and != this_and_flags) || (merged_or != this_or_flags)) {
3433         this_idata->and_flags = merged_and;
3434         this_idata->or_flags = merged_or;
3435         this_idata->changed = JNI_TRUE;
3436     }
3437 }
3438 
3439 
3440 /* Make a copy of a stack */
3441 
3442 static stack_item_type *
3443 copy_stack(context_type *context, stack_item_type *stack)
3444 {
3445     int length;
3446     stack_item_type *ptr;
3447 
3448     /* Find the length */
3449     for (ptr = stack, length = 0; ptr != NULL; ptr = ptr->next, length++);
3450 
3451     if (length > 0) {
3452         stack_item_type *new_stack = NEW(stack_item_type, length);
3453         stack_item_type *new_ptr;
3454         for (    ptr = stack, new_ptr = new_stack;
3455                  ptr != NULL;
3456                  ptr = ptr->next, new_ptr++) {
3457             new_ptr->item = ptr->item;
3458             new_ptr->next = new_ptr + 1;
3459         }
3460         new_stack[length - 1].next = NULL;
3461         return new_stack;
3462     } else {
3463         return NULL;
3464     }
3465 }
3466 
3467 
3468 static mask_type *
3469 copy_masks(context_type *context, mask_type *masks, int mask_count)
3470 {
3471     mask_type *result = NEW(mask_type, mask_count);
3472     int bitmask_size = context->bitmask_size;
3473     int *bitmaps = NEW(int, mask_count * bitmask_size);
3474     int i;
3475     for (i = 0; i < mask_count; i++) {
3476         result[i].entry = masks[i].entry;
3477         result[i].modifies = &bitmaps[i * bitmask_size];
3478         memcpy(result[i].modifies, masks[i].modifies, bitmask_size * sizeof(int));
3479     }
3480     return result;
3481 }
3482 
3483 
3484 static mask_type *
3485 add_to_masks(context_type *context, mask_type *masks, int mask_count, int d)
3486 {
3487     mask_type *result = NEW(mask_type, mask_count + 1);
3488     int bitmask_size = context->bitmask_size;
3489     int *bitmaps = NEW(int, (mask_count + 1) * bitmask_size);
3490     int i;
3491     for (i = 0; i < mask_count; i++) {
3492         result[i].entry = masks[i].entry;
3493         result[i].modifies = &bitmaps[i * bitmask_size];
3494         memcpy(result[i].modifies, masks[i].modifies, bitmask_size * sizeof(int));
3495     }
3496     result[mask_count].entry = d;
3497     result[mask_count].modifies = &bitmaps[mask_count * bitmask_size];
3498     memset(result[mask_count].modifies, 0, bitmask_size * sizeof(int));
3499     return result;
3500 }
3501 
3502 
3503 
3504 /* We create our own storage manager, since we malloc lots of little items,
3505  * and I don't want to keep trace of when they become free.  I sure wish that
3506  * we had heaps, and I could just free the heap when done.
3507  */
3508 
3509 #define CCSegSize 2000
3510 
3511 struct CCpool {                 /* a segment of allocated memory in the pool */
3512     struct CCpool *next;
3513     int segSize;                /* almost always CCSegSize */
3514     int poolPad;
3515     char space[CCSegSize];
3516 };
3517 
3518 /* Initialize the context's heap. */
3519 static void CCinit(context_type *context)
3520 {
3521     struct CCpool *new = (struct CCpool *) malloc(sizeof(struct CCpool));
3522     /* Set context->CCroot to 0 if new == 0 to tell CCdestroy to lay off */
3523     context->CCroot = context->CCcurrent = new;
3524     if (new == 0) {
3525         CCout_of_memory(context);
3526     }
3527     new->next = NULL;
3528     new->segSize = CCSegSize;
3529     context->CCfree_size = CCSegSize;
3530     context->CCfree_ptr = &new->space[0];
3531 }
3532 
3533 
3534 /* Reuse all the space that we have in the context's heap. */
3535 static void CCreinit(context_type *context)
3536 {
3537     struct CCpool *first = context->CCroot;
3538     context->CCcurrent = first;
3539     context->CCfree_size = CCSegSize;
3540     context->CCfree_ptr = &first->space[0];
3541 }
3542 
3543 /* Destroy the context's heap. */
3544 static void CCdestroy(context_type *context)
3545 {
3546     struct CCpool *this = context->CCroot;
3547     while (this) {
3548         struct CCpool *next = this->next;
3549         free(this);
3550         this = next;
3551     }
3552     /* These two aren't necessary.  But can't hurt either */
3553     context->CCroot = context->CCcurrent = NULL;
3554     context->CCfree_ptr = 0;
3555 }
3556 
3557 /* Allocate an object of the given size from the context's heap. */
3558 static void *
3559 CCalloc(context_type *context, int size, jboolean zero)
3560 {
3561 
3562     register char *p;
3563     /* Round CC to the size of a pointer */
3564     size = (size + (sizeof(void *) - 1)) & ~(sizeof(void *) - 1);
3565 
3566     if (context->CCfree_size <  size) {
3567         struct CCpool *current = context->CCcurrent;
3568         struct CCpool *new;
3569         if (size > CCSegSize) { /* we need to allocate a special block */
3570             new = (struct CCpool *)malloc(sizeof(struct CCpool) +
3571                                           (size - CCSegSize));
3572             if (new == 0) {
3573                 CCout_of_memory(context);
3574             }
3575             new->next = current->next;
3576             new->segSize = size;
3577             current->next = new;
3578         } else {
3579             new = current->next;
3580             if (new == NULL) {
3581                 new = (struct CCpool *) malloc(sizeof(struct CCpool));
3582                 if (new == 0) {
3583                     CCout_of_memory(context);
3584                 }
3585                 current->next = new;
3586                 new->next = NULL;
3587                 new->segSize = CCSegSize;
3588             }
3589         }
3590         context->CCcurrent = new;
3591         context->CCfree_ptr = &new->space[0];
3592         context->CCfree_size = new->segSize;
3593     }
3594     p = context->CCfree_ptr;
3595     context->CCfree_ptr += size;
3596     context->CCfree_size -= size;
3597     if (zero)
3598         memset(p, 0, size);
3599     return p;
3600 }
3601 
3602 /* Get the class associated with a particular field or method or class in the
3603  * constant pool.  If is_field is true, we've got a field or method.  If
3604  * false, we've got a class.
3605  */
3606 static fullinfo_type
3607 cp_index_to_class_fullinfo(context_type *context, int cp_index, int kind)
3608 {
3609     JNIEnv *env = context->env;
3610     fullinfo_type result;
3611     const char *classname;
3612     switch (kind) {
3613     case JVM_CONSTANT_Class:
3614         classname = JVM_GetCPClassNameUTF(env,
3615                                           context->class,
3616                                           cp_index);
3617         break;
3618     case JVM_CONSTANT_Methodref:
3619         classname = JVM_GetCPMethodClassNameUTF(env,
3620                                                 context->class,
3621                                                 cp_index);
3622         break;
3623     case JVM_CONSTANT_Fieldref:
3624         classname = JVM_GetCPFieldClassNameUTF(env,
3625                                                context->class,
3626                                                cp_index);
3627         break;
3628     default:
3629         classname = NULL;
3630         CCerror(context, "Internal error #5");
3631     }
3632 
3633     check_and_push(context, classname, VM_STRING_UTF);
3634     if (classname[0] == JVM_SIGNATURE_ARRAY) {
3635         /* This make recursively call us, in case of a class array */
3636         signature_to_fieldtype(context, &classname, &result);
3637     } else {
3638         result = make_class_info_from_name(context, classname);
3639     }
3640     pop_and_free(context);
3641     return result;
3642 }
3643 
3644 
3645 static int
3646 print_CCerror_info(context_type *context)
3647 {
3648     JNIEnv *env = context->env;
3649     jclass cb = context->class;
3650     const char *classname = JVM_GetClassNameUTF(env, cb);
3651     const char *name = 0;
3652     const char *signature = 0;
3653     int n = 0;
3654     if (context->method_index != -1) {
3655         name = JVM_GetMethodIxNameUTF(env, cb, context->method_index);
3656         signature =
3657             JVM_GetMethodIxSignatureUTF(env, cb, context->method_index);
3658         n += jio_snprintf(context->message, context->message_buf_len,
3659                           "(class: %s, method: %s signature: %s) ",
3660                           (classname ? classname : ""),
3661                           (name ? name : ""),
3662                           (signature ? signature : ""));
3663     } else if (context->field_index != -1 ) {
3664         name = JVM_GetMethodIxNameUTF(env, cb, context->field_index);
3665         n += jio_snprintf(context->message, context->message_buf_len,
3666                           "(class: %s, field: %s) ",
3667                           (classname ? classname : 0),
3668                           (name ? name : 0));
3669     } else {
3670         n += jio_snprintf(context->message, context->message_buf_len,
3671                           "(class: %s) ", classname ? classname : "");
3672     }
3673     JVM_ReleaseUTF(classname);
3674     JVM_ReleaseUTF(name);
3675     JVM_ReleaseUTF(signature);
3676     return n;
3677 }
3678 
3679 static void
3680 CCerror (context_type *context, char *format, ...)
3681 {
3682     int n = print_CCerror_info(context);
3683     va_list args;
3684     if (n >= 0 && n < context->message_buf_len) {
3685         va_start(args, format);
3686         jio_vsnprintf(context->message + n, context->message_buf_len - n,
3687                       format, args);
3688         va_end(args);
3689     }
3690     context->err_code = CC_VerifyError;
3691     longjmp(context->jump_buffer, 1);
3692 }
3693 
3694 static void
3695 CCout_of_memory(context_type *context)
3696 {
3697     int n = print_CCerror_info(context);
3698     context->err_code = CC_OutOfMemory;
3699     longjmp(context->jump_buffer, 1);
3700 }
3701 
3702 static void
3703 CFerror(context_type *context, char *format, ...)
3704 {
3705     int n = print_CCerror_info(context);
3706     va_list args;
3707     if (n >= 0 && n < context->message_buf_len) {
3708         va_start(args, format);
3709         jio_vsnprintf(context->message + n, context->message_buf_len - n,
3710                       format, args);
3711         va_end(args);
3712     }
3713     context->err_code = CC_ClassFormatError;
3714     longjmp(context->jump_buffer, 1);
3715 }
3716 
3717 /*
3718  * Need to scan the entire signature to find the result type because
3719  * types in the arg list and the result type could contain embedded ')'s.
3720  */
3721 static const char* get_result_signature(const char* signature) {
3722     const char *p;
3723     for (p = signature; *p != JVM_SIGNATURE_ENDFUNC; p++) {
3724         switch (*p) {
3725           case JVM_SIGNATURE_BOOLEAN:
3726           case JVM_SIGNATURE_BYTE:
3727           case JVM_SIGNATURE_CHAR:
3728           case JVM_SIGNATURE_SHORT:
3729           case JVM_SIGNATURE_INT:
3730           case JVM_SIGNATURE_FLOAT:
3731           case JVM_SIGNATURE_DOUBLE:
3732           case JVM_SIGNATURE_LONG:
3733           case JVM_SIGNATURE_FUNC:  /* ignore initial (, if given */
3734             break;
3735           case JVM_SIGNATURE_CLASS:
3736             while (*p != JVM_SIGNATURE_ENDCLASS) p++;
3737             break;
3738           case JVM_SIGNATURE_ARRAY:
3739             while (*p == JVM_SIGNATURE_ARRAY) p++;
3740             /* If an array of classes, skip over class name, too. */
3741             if (*p == JVM_SIGNATURE_CLASS) {
3742                 while (*p != JVM_SIGNATURE_ENDCLASS) p++;
3743             }
3744             break;
3745           default:
3746             /* Indicate an error. */
3747             return NULL;
3748         }
3749     }
3750     return p++; /* skip over ')'. */
3751 }
3752 
3753 static char
3754 signature_to_fieldtype(context_type *context,
3755                        const char **signature_p, fullinfo_type *full_info_p)
3756 {
3757     const char *p = *signature_p;
3758     fullinfo_type full_info = MAKE_FULLINFO(ITEM_Bogus, 0, 0);
3759     char result;
3760     int array_depth = 0;
3761 
3762     for (;;) {
3763         switch(*p++) {
3764             default:
3765                 result = 0;
3766                 break;
3767 
3768             case JVM_SIGNATURE_BOOLEAN:
3769                 full_info = (array_depth > 0)
3770                               ? MAKE_FULLINFO(ITEM_Boolean, 0, 0)
3771                               : MAKE_FULLINFO(ITEM_Integer, 0, 0);
3772                 result = 'I';
3773                 break;
3774 
3775             case JVM_SIGNATURE_BYTE:
3776                 full_info = (array_depth > 0)
3777                               ? MAKE_FULLINFO(ITEM_Byte, 0, 0)
3778                               : MAKE_FULLINFO(ITEM_Integer, 0, 0);
3779                 result = 'I';
3780                 break;
3781 
3782             case JVM_SIGNATURE_CHAR:
3783                 full_info = (array_depth > 0)
3784                               ? MAKE_FULLINFO(ITEM_Char, 0, 0)
3785                               : MAKE_FULLINFO(ITEM_Integer, 0, 0);
3786                 result = 'I';
3787                 break;
3788 
3789             case JVM_SIGNATURE_SHORT:
3790                 full_info = (array_depth > 0)
3791                               ? MAKE_FULLINFO(ITEM_Short, 0, 0)
3792                               : MAKE_FULLINFO(ITEM_Integer, 0, 0);
3793                 result = 'I';
3794                 break;
3795 
3796             case JVM_SIGNATURE_INT:
3797                 full_info = MAKE_FULLINFO(ITEM_Integer, 0, 0);
3798                 result = 'I';
3799                 break;
3800 
3801             case JVM_SIGNATURE_FLOAT:
3802                 full_info = MAKE_FULLINFO(ITEM_Float, 0, 0);
3803                 result = 'F';
3804                 break;
3805 
3806             case JVM_SIGNATURE_DOUBLE:
3807                 full_info = MAKE_FULLINFO(ITEM_Double, 0, 0);
3808                 result = 'D';
3809                 break;
3810 
3811             case JVM_SIGNATURE_LONG:
3812                 full_info = MAKE_FULLINFO(ITEM_Long, 0, 0);
3813                 result = 'L';
3814                 break;
3815 
3816             case JVM_SIGNATURE_ARRAY:
3817                 array_depth++;
3818                 continue;       /* only time we ever do the loop > 1 */
3819 
3820             case JVM_SIGNATURE_CLASS: {
3821                 char buffer_space[256];
3822                 char *buffer = buffer_space;
3823                 char *finish = strchr(p, JVM_SIGNATURE_ENDCLASS);
3824                 int length;
3825                 if (finish == NULL) {
3826                     /* Signature must have ';' after the class name.
3827                      * If it does not, return 0 and ITEM_Bogus in full_info. */
3828                     result = 0;
3829                     break;
3830                 }
3831                 length = finish - p;
3832                 if (length + 1 > (int)sizeof(buffer_space)) {
3833                     buffer = malloc(length + 1);
3834                     check_and_push(context, buffer, VM_MALLOC_BLK);
3835                 }
3836                 memcpy(buffer, p, length);
3837                 buffer[length] = '\0';
3838                 full_info = make_class_info_from_name(context, buffer);
3839                 result = 'A';
3840                 p = finish + 1;
3841                 if (buffer != buffer_space)
3842                     pop_and_free(context);
3843                 break;
3844             }
3845         } /* end of switch */
3846         break;
3847     }
3848     *signature_p = p;
3849     if (array_depth == 0 || result == 0) {
3850         /* either not an array, or result is bogus */
3851         *full_info_p = full_info;
3852         return result;
3853     } else {
3854         if (array_depth > MAX_ARRAY_DIMENSIONS)
3855             CCerror(context, "Array with too many dimensions");
3856         *full_info_p = MAKE_FULLINFO(GET_ITEM_TYPE(full_info),
3857                                      array_depth,
3858                                      GET_EXTRA_INFO(full_info));
3859         return 'A';
3860     }
3861 }
3862 
3863 
3864 /* Given an array type, create the type that has one less level of
3865  * indirection.
3866  */
3867 
3868 static fullinfo_type
3869 decrement_indirection(fullinfo_type array_info)
3870 {
3871     if (array_info == NULL_FULLINFO) {
3872         return NULL_FULLINFO;
3873     } else {
3874         int type = GET_ITEM_TYPE(array_info);
3875         int indirection = GET_INDIRECTION(array_info) - 1;
3876         int extra_info = GET_EXTRA_INFO(array_info);
3877         if (   (indirection == 0)
3878                && ((type == ITEM_Short || type == ITEM_Byte || type == ITEM_Boolean || type == ITEM_Char)))
3879             type = ITEM_Integer;
3880         return MAKE_FULLINFO(type, indirection, extra_info);
3881     }
3882 }
3883 
3884 
3885 /* See if we can assign an object of the "from" type to an object
3886  * of the "to" type.
3887  */
3888 
3889 static jboolean isAssignableTo(context_type *context,
3890                              fullinfo_type from, fullinfo_type to)
3891 {
3892     return (merge_fullinfo_types(context, from, to, JNI_TRUE) == to);
3893 }
3894 
3895 /* Given two fullinfo_type's, find their lowest common denominator.  If
3896  * the assignable_p argument is non-null, we're really just calling to find
3897  * out if "<target> := <value>" is a legitimate assignment.
3898  *
3899  * We treat all interfaces as if they were of type java/lang/Object, since the
3900  * runtime will do the full checking.
3901  */
3902 static fullinfo_type
3903 merge_fullinfo_types(context_type *context,
3904                      fullinfo_type value, fullinfo_type target,
3905                      jboolean for_assignment)
3906 {
3907     JNIEnv *env = context->env;
3908     if (value == target) {
3909         /* If they're identical, clearly just return what we've got */
3910         return value;
3911     }
3912 
3913     /* Both must be either arrays or objects to go further */
3914     if (GET_INDIRECTION(value) == 0 && GET_ITEM_TYPE(value) != ITEM_Object)
3915         return MAKE_FULLINFO(ITEM_Bogus, 0, 0);
3916     if (GET_INDIRECTION(target) == 0 && GET_ITEM_TYPE(target) != ITEM_Object)
3917         return MAKE_FULLINFO(ITEM_Bogus, 0, 0);
3918 
3919     /* If either is NULL, return the other. */
3920     if (value == NULL_FULLINFO)
3921         return target;
3922     else if (target == NULL_FULLINFO)
3923         return value;
3924 
3925     /* If either is java/lang/Object, that's the result. */
3926     if (target == context->object_info)
3927         return target;
3928     else if (value == context->object_info) {
3929         /* Minor hack.  For assignments, Interface := Object, return Interface
3930          * rather than Object, so that isAssignableTo() will get the right
3931          * result.      */
3932         if (for_assignment && (WITH_ZERO_EXTRA_INFO(target) ==
3933                                   MAKE_FULLINFO(ITEM_Object, 0, 0))) {
3934             jclass cb = object_fullinfo_to_classclass(context,
3935                                                       target);
3936             int is_interface = cb && JVM_IsInterface(env, cb);
3937             if (is_interface)
3938                 return target;
3939         }
3940         return value;
3941     }
3942     if (GET_INDIRECTION(value) > 0 || GET_INDIRECTION(target) > 0) {
3943         /* At least one is an array.  Neither is java/lang/Object or NULL.
3944          * Moreover, the types are not identical.
3945          * The result must either be Object, or an array of some object type.
3946          */
3947         fullinfo_type value_base, target_base;
3948         int dimen_value = GET_INDIRECTION(value);
3949         int dimen_target = GET_INDIRECTION(target);
3950 
3951         if (target == context->cloneable_info ||
3952             target == context->serializable_info) {
3953             return target;
3954         }
3955 
3956         if (value == context->cloneable_info ||
3957             value == context->serializable_info) {
3958             return value;
3959         }
3960 
3961         /* First, if either item's base type isn't ITEM_Object, promote it up
3962          * to an object or array of object.  If either is elemental, we can
3963          * punt.
3964          */
3965         if (GET_ITEM_TYPE(value) != ITEM_Object) {
3966             if (dimen_value == 0)
3967                 return MAKE_FULLINFO(ITEM_Bogus, 0, 0);
3968             dimen_value--;
3969             value = MAKE_Object_ARRAY(dimen_value);
3970 
3971         }
3972         if (GET_ITEM_TYPE(target) != ITEM_Object) {
3973             if (dimen_target == 0)
3974                 return MAKE_FULLINFO(ITEM_Bogus, 0, 0);
3975             dimen_target--;
3976             target = MAKE_Object_ARRAY(dimen_target);
3977         }
3978         /* Both are now objects or arrays of some sort of object type */
3979         value_base = WITH_ZERO_INDIRECTION(value);
3980         target_base = WITH_ZERO_INDIRECTION(target);
3981         if (dimen_value == dimen_target) {
3982             /* Arrays of the same dimension.  Merge their base types. */
3983             fullinfo_type  result_base =
3984                 merge_fullinfo_types(context, value_base, target_base,
3985                                             for_assignment);
3986             if (result_base == MAKE_FULLINFO(ITEM_Bogus, 0, 0))
3987                 /* bogus in, bogus out */
3988                 return result_base;
3989             return MAKE_FULLINFO(ITEM_Object, dimen_value,
3990                                  GET_EXTRA_INFO(result_base));
3991         } else {
3992             /* Arrays of different sizes. If the smaller dimension array's base
3993              * type is java/lang/Cloneable or java/io/Serializable, return it.
3994              * Otherwise return java/lang/Object with a dimension of the smaller
3995              * of the two */
3996             if (dimen_value < dimen_target) {
3997                 if (value_base == context->cloneable_info ||
3998                     value_base == context ->serializable_info) {
3999                     return value;
4000                 }
4001                 return MAKE_Object_ARRAY(dimen_value);
4002             } else {
4003                 if (target_base == context->cloneable_info ||
4004                     target_base == context->serializable_info) {
4005                     return target;
4006                 }
4007                 return MAKE_Object_ARRAY(dimen_target);
4008             }
4009         }
4010     } else {
4011         /* Both are non-array objects. Neither is java/lang/Object or NULL */
4012         jclass cb_value, cb_target, cb_super_value, cb_super_target;
4013         fullinfo_type result_info;
4014 
4015         /* Let's get the classes corresponding to each of these.  Treat
4016          * interfaces as if they were java/lang/Object.  See hack note above. */
4017         cb_target = object_fullinfo_to_classclass(context, target);
4018         if (cb_target == 0)
4019             return MAKE_FULLINFO(ITEM_Bogus, 0, 0);
4020         if (JVM_IsInterface(env, cb_target))
4021             return for_assignment ? target : context->object_info;
4022         cb_value = object_fullinfo_to_classclass(context, value);
4023         if (cb_value == 0)
4024             return MAKE_FULLINFO(ITEM_Bogus, 0, 0);
4025         if (JVM_IsInterface(env, cb_value))
4026             return context->object_info;
4027 
4028         /* If this is for assignment of target := value, we just need to see if
4029          * cb_target is a superclass of cb_value.  Save ourselves a lot of
4030          * work.
4031          */
4032         if (for_assignment) {
4033             cb_super_value = (*env)->GetSuperclass(env, cb_value);
4034             while (cb_super_value != 0) {
4035                 jclass tmp_cb;
4036                 if ((*env)->IsSameObject(env, cb_super_value, cb_target)) {
4037                     (*env)->DeleteLocalRef(env, cb_super_value);
4038                     return target;
4039                 }
4040                 tmp_cb =  (*env)->GetSuperclass(env, cb_super_value);
4041                 (*env)->DeleteLocalRef(env, cb_super_value);
4042                 cb_super_value = tmp_cb;
4043             }
4044             (*env)->DeleteLocalRef(env, cb_super_value);
4045             return context->object_info;
4046         }
4047 
4048         /* Find out whether cb_value or cb_target is deeper in the class
4049          * tree by moving both toward the root, and seeing who gets there
4050          * first.                                                          */
4051         cb_super_value = (*env)->GetSuperclass(env, cb_value);
4052         cb_super_target = (*env)->GetSuperclass(env, cb_target);
4053         while((cb_super_value != 0) &&
4054               (cb_super_target != 0)) {
4055             jclass tmp_cb;
4056             /* Optimization.  If either hits the other when going up looking
4057              * for a parent, then might as well return the parent immediately */
4058             if ((*env)->IsSameObject(env, cb_super_value, cb_target)) {
4059                 (*env)->DeleteLocalRef(env, cb_super_value);
4060                 (*env)->DeleteLocalRef(env, cb_super_target);
4061                 return target;
4062             }
4063             if ((*env)->IsSameObject(env, cb_super_target, cb_value)) {
4064                 (*env)->DeleteLocalRef(env, cb_super_value);
4065                 (*env)->DeleteLocalRef(env, cb_super_target);
4066                 return value;
4067             }
4068             tmp_cb = (*env)->GetSuperclass(env, cb_super_value);
4069             (*env)->DeleteLocalRef(env, cb_super_value);
4070             cb_super_value = tmp_cb;
4071 
4072             tmp_cb = (*env)->GetSuperclass(env, cb_super_target);
4073             (*env)->DeleteLocalRef(env, cb_super_target);
4074             cb_super_target = tmp_cb;
4075         }
4076         cb_value = (*env)->NewLocalRef(env, cb_value);
4077         cb_target = (*env)->NewLocalRef(env, cb_target);
4078         /* At most one of the following two while clauses will be executed.
4079          * Bring the deeper of cb_target and cb_value to the depth of the
4080          * shallower one.
4081          */
4082         while (cb_super_value != 0) {
4083           /* cb_value is deeper */
4084             jclass cb_tmp;
4085 
4086             cb_tmp = (*env)->GetSuperclass(env, cb_super_value);
4087             (*env)->DeleteLocalRef(env, cb_super_value);
4088             cb_super_value = cb_tmp;
4089 
4090             cb_tmp = (*env)->GetSuperclass(env, cb_value);
4091             (*env)->DeleteLocalRef(env, cb_value);
4092             cb_value = cb_tmp;
4093         }
4094         while (cb_super_target != 0) {
4095           /* cb_target is deeper */
4096             jclass cb_tmp;
4097 
4098             cb_tmp = (*env)->GetSuperclass(env, cb_super_target);
4099             (*env)->DeleteLocalRef(env, cb_super_target);
4100             cb_super_target = cb_tmp;
4101 
4102             cb_tmp = (*env)->GetSuperclass(env, cb_target);
4103             (*env)->DeleteLocalRef(env, cb_target);
4104             cb_target = cb_tmp;
4105         }
4106 
4107         /* Walk both up, maintaining equal depth, until a join is found.  We
4108          * know that we will find one.  */
4109         while (!(*env)->IsSameObject(env, cb_value, cb_target)) {
4110             jclass cb_tmp;
4111             cb_tmp = (*env)->GetSuperclass(env, cb_value);
4112             (*env)->DeleteLocalRef(env, cb_value);
4113             cb_value = cb_tmp;
4114             cb_tmp = (*env)->GetSuperclass(env, cb_target);
4115             (*env)->DeleteLocalRef(env, cb_target);
4116             cb_target = cb_tmp;
4117         }
4118         result_info = make_class_info(context, cb_value);
4119         (*env)->DeleteLocalRef(env, cb_value);
4120         (*env)->DeleteLocalRef(env, cb_super_value);
4121         (*env)->DeleteLocalRef(env, cb_target);
4122         (*env)->DeleteLocalRef(env, cb_super_target);
4123         return result_info;
4124     } /* both items are classes */
4125 }
4126 
4127 
4128 /* Given a fullinfo_type corresponding to an Object, return the jclass
4129  * of that type.
4130  *
4131  * This function always returns a global reference!
4132  */
4133 
4134 static jclass
4135 object_fullinfo_to_classclass(context_type *context, fullinfo_type classinfo)
4136 {
4137     unsigned short info = GET_EXTRA_INFO(classinfo);
4138     return ID_to_class(context, info);
4139 }
4140 
4141 static void free_block(void *ptr, int kind)
4142 {
4143     switch (kind) {
4144     case VM_STRING_UTF:
4145         JVM_ReleaseUTF(ptr);
4146         break;
4147     case VM_MALLOC_BLK:
4148         free(ptr);
4149         break;
4150     }
4151 }
4152 
4153 static void check_and_push(context_type *context, const void *ptr, int kind)
4154 {
4155     alloc_stack_type *p;
4156     if (ptr == 0)
4157         CCout_of_memory(context);
4158     if (context->alloc_stack_top < ALLOC_STACK_SIZE)
4159         p = &(context->alloc_stack[context->alloc_stack_top++]);
4160     else {
4161         /* Otherwise we have to malloc */
4162         p = malloc(sizeof(alloc_stack_type));
4163         if (p == 0) {
4164             /* Make sure we clean up. */
4165             free_block((void *)ptr, kind);
4166             CCout_of_memory(context);
4167         }
4168     }
4169     p->kind = kind;
4170     p->ptr = (void *)ptr;
4171     p->next = context->allocated_memory;
4172     context->allocated_memory = p;
4173 }
4174 
4175 static void pop_and_free(context_type *context)
4176 {
4177     alloc_stack_type *p = context->allocated_memory;
4178     context->allocated_memory = p->next;
4179     free_block(p->ptr, p->kind);
4180     if (p < context->alloc_stack + ALLOC_STACK_SIZE &&
4181         p >= context->alloc_stack)
4182         context->alloc_stack_top--;
4183     else
4184         free(p);
4185 }
4186 
4187 static int signature_to_args_size(const char *method_signature)
4188 {
4189     const char *p;
4190     int args_size = 0;
4191     for (p = method_signature; *p != JVM_SIGNATURE_ENDFUNC; p++) {
4192         switch (*p) {
4193           case JVM_SIGNATURE_BOOLEAN:
4194           case JVM_SIGNATURE_BYTE:
4195           case JVM_SIGNATURE_CHAR:
4196           case JVM_SIGNATURE_SHORT:
4197           case JVM_SIGNATURE_INT:
4198           case JVM_SIGNATURE_FLOAT:
4199             args_size += 1;
4200             break;
4201           case JVM_SIGNATURE_CLASS:
4202             args_size += 1;
4203             while (*p != JVM_SIGNATURE_ENDCLASS) p++;
4204             break;
4205           case JVM_SIGNATURE_ARRAY:
4206             args_size += 1;
4207             while ((*p == JVM_SIGNATURE_ARRAY)) p++;
4208             /* If an array of classes, skip over class name, too. */
4209             if (*p == JVM_SIGNATURE_CLASS) {
4210                 while (*p != JVM_SIGNATURE_ENDCLASS)
4211                   p++;
4212             }
4213             break;
4214           case JVM_SIGNATURE_DOUBLE:
4215           case JVM_SIGNATURE_LONG:
4216             args_size += 2;
4217             break;
4218           case JVM_SIGNATURE_FUNC:  /* ignore initial (, if given */
4219             break;
4220           default:
4221             /* Indicate an error. */
4222             return 0;
4223         }
4224     }
4225     return args_size;
4226 }
4227 
4228 #ifdef DEBUG
4229 
4230 /* Below are for debugging. */
4231 
4232 static void print_fullinfo_type(context_type *, fullinfo_type, jboolean);
4233 
4234 static void
4235 print_stack(context_type *context, stack_info_type *stack_info)
4236 {
4237     stack_item_type *stack = stack_info->stack;
4238     if (stack_info->stack_size == UNKNOWN_STACK_SIZE) {
4239         jio_fprintf(stdout, "x");
4240     } else {
4241         jio_fprintf(stdout, "(");
4242         for ( ; stack != 0; stack = stack->next)
4243             print_fullinfo_type(context, stack->item,
4244                 (jboolean)(verify_verbose > 1 ? JNI_TRUE : JNI_FALSE));
4245         jio_fprintf(stdout, ")");
4246     }
4247 }
4248 
4249 static void
4250 print_registers(context_type *context, register_info_type *register_info)
4251 {
4252     int register_count = register_info->register_count;
4253     if (register_count == UNKNOWN_REGISTER_COUNT) {
4254         jio_fprintf(stdout, "x");
4255     } else {
4256         fullinfo_type *registers = register_info->registers;
4257         int mask_count = register_info->mask_count;
4258         mask_type *masks = register_info->masks;
4259         int i, j;
4260 
4261         jio_fprintf(stdout, "{");
4262         for (i = 0; i < register_count; i++)
4263             print_fullinfo_type(context, registers[i],
4264                 (jboolean)(verify_verbose > 1 ? JNI_TRUE : JNI_FALSE));
4265         jio_fprintf(stdout, "}");
4266         for (i = 0; i < mask_count; i++) {
4267             char *separator = "";
4268             int *modifies = masks[i].modifies;
4269             jio_fprintf(stdout, "<%d: ", masks[i].entry);
4270             for (j = 0;
4271                  j < JVM_GetMethodIxLocalsCount(context->env,
4272                                                 context->class,
4273                                                 context->method_index);
4274                  j++)
4275                 if (IS_BIT_SET(modifies, j)) {
4276                     jio_fprintf(stdout, "%s%d", separator, j);
4277                     separator = ",";
4278                 }
4279             jio_fprintf(stdout, ">");
4280         }
4281     }
4282 }
4283 
4284 
4285 static void
4286 print_flags(context_type *context, flag_type and_flags, flag_type or_flags)
4287 {
4288     if (and_flags != ((flag_type)-1) || or_flags != 0) {
4289         jio_fprintf(stdout, "<%x %x>", and_flags, or_flags);
4290     }
4291 }
4292 
4293 static void
4294 print_fullinfo_type(context_type *context, fullinfo_type type, jboolean verbose)
4295 {
4296     int i;
4297     int indirection = GET_INDIRECTION(type);
4298     for (i = indirection; i-- > 0; )
4299         jio_fprintf(stdout, "[");
4300     switch (GET_ITEM_TYPE(type)) {
4301         case ITEM_Integer:
4302             jio_fprintf(stdout, "I"); break;
4303         case ITEM_Float:
4304             jio_fprintf(stdout, "F"); break;
4305         case ITEM_Double:
4306             jio_fprintf(stdout, "D"); break;
4307         case ITEM_Double_2:
4308             jio_fprintf(stdout, "d"); break;
4309         case ITEM_Long:
4310             jio_fprintf(stdout, "L"); break;
4311         case ITEM_Long_2:
4312             jio_fprintf(stdout, "l"); break;
4313         case ITEM_ReturnAddress:
4314             jio_fprintf(stdout, "a"); break;
4315         case ITEM_Object:
4316             if (!verbose) {
4317                 jio_fprintf(stdout, "A");
4318             } else {
4319                 unsigned short extra = GET_EXTRA_INFO(type);
4320                 if (extra == 0) {
4321                     jio_fprintf(stdout, "/Null/");
4322                 } else {
4323                     const char *name = ID_to_class_name(context, extra);
4324                     const char *name2 = strrchr(name, '/');
4325                     jio_fprintf(stdout, "/%s/", name2 ? name2 + 1 : name);
4326                 }
4327             }
4328             break;
4329         case ITEM_Char:
4330             jio_fprintf(stdout, "C"); break;
4331         case ITEM_Short:
4332             jio_fprintf(stdout, "S"); break;
4333         case ITEM_Boolean:
4334             jio_fprintf(stdout, "Z"); break;
4335         case ITEM_Byte:
4336             jio_fprintf(stdout, "B"); break;
4337         case ITEM_NewObject:
4338             if (!verbose) {
4339                 jio_fprintf(stdout, "@");
4340             } else {
4341                 int inum = GET_EXTRA_INFO(type);
4342                 fullinfo_type real_type =
4343                     context->instruction_data[inum].operand2.fi;
4344                 jio_fprintf(stdout, ">");
4345                 print_fullinfo_type(context, real_type, JNI_TRUE);
4346                 jio_fprintf(stdout, "<");
4347             }
4348             break;
4349         case ITEM_InitObject:
4350             jio_fprintf(stdout, verbose ? ">/this/<" : "@");
4351             break;
4352 
4353         default:
4354             jio_fprintf(stdout, "?"); break;
4355     }
4356     for (i = indirection; i-- > 0; )
4357         jio_fprintf(stdout, "]");
4358 }
4359 
4360 
4361 static void
4362 print_formatted_fieldname(context_type *context, int index)
4363 {
4364     JNIEnv *env = context->env;
4365     jclass cb = context->class;
4366     const char *classname = JVM_GetCPFieldClassNameUTF(env, cb, index);
4367     const char *fieldname = JVM_GetCPFieldNameUTF(env, cb, index);
4368     jio_fprintf(stdout, "  <%s.%s>",
4369                 classname ? classname : "", fieldname ? fieldname : "");
4370     JVM_ReleaseUTF(classname);
4371     JVM_ReleaseUTF(fieldname);
4372 }
4373 
4374 static void
4375 print_formatted_methodname(context_type *context, int index)
4376 {
4377     JNIEnv *env = context->env;
4378     jclass cb = context->class;
4379     const char *classname = JVM_GetCPMethodClassNameUTF(env, cb, index);
4380     const char *methodname = JVM_GetCPMethodNameUTF(env, cb, index);
4381     jio_fprintf(stdout, "  <%s.%s>",
4382                 classname ? classname : "", methodname ? methodname : "");
4383     JVM_ReleaseUTF(classname);
4384     JVM_ReleaseUTF(methodname);
4385 }
4386 
4387 #endif /*DEBUG*/