1 /*
2 * Copyright (c) 1998, 2018, Oracle and/or its affiliates. All rights reserved.
3 * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
4 *
5 * This code is free software; you can redistribute it and/or modify it
6 * under the terms of the GNU General Public License version 2 only, as
7 * published by the Free Software Foundation.
8 *
9 * This code is distributed in the hope that it will be useful, but WITHOUT
10 * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
11 * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
12 * version 2 for more details (a copy is included in the LICENSE file that
13 * accompanied this code).
14 *
15 * You should have received a copy of the GNU General Public License version
16 * 2 along with this work; if not, write to the Free Software Foundation,
17 * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
18 *
19 * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
20 * or visit www.oracle.com if you need additional information or have any
21 * questions.
22 *
23 */
24
25 #include "precompiled.hpp"
26 #include "classfile/classFileStream.hpp"
27 #include "classfile/javaClasses.hpp"
28 #include "classfile/stackMapTable.hpp"
29 #include "classfile/stackMapFrame.hpp"
30 #include "classfile/stackMapTableFormat.hpp"
31 #include "classfile/systemDictionary.hpp"
32 #include "classfile/verifier.hpp"
33 #include "classfile/vmSymbols.hpp"
34 #include "interpreter/bytecodes.hpp"
35 #include "interpreter/bytecodeStream.hpp"
36 #include "memory/oopFactory.hpp"
37 #include "memory/resourceArea.hpp"
38 #include "oops/instanceKlass.hpp"
39 #include "oops/oop.inline.hpp"
40 #include "oops/typeArrayOop.hpp"
41 #include "prims/jvm.h"
42 #include "runtime/fieldDescriptor.hpp"
43 #include "runtime/handles.inline.hpp"
44 #include "runtime/interfaceSupport.hpp"
45 #include "runtime/javaCalls.hpp"
46 #include "runtime/orderAccess.inline.hpp"
47 #include "runtime/os.hpp"
48 #ifdef TARGET_ARCH_x86
49 # include "bytes_x86.hpp"
50 #endif
51 #ifdef TARGET_ARCH_aarch64
52 # include "bytes_aarch64.hpp"
53 #endif
54 #ifdef TARGET_ARCH_sparc
55 # include "bytes_sparc.hpp"
56 #endif
57 #ifdef TARGET_ARCH_zero
58 # include "bytes_zero.hpp"
59 #endif
60 #ifdef TARGET_ARCH_arm
61 # include "bytes_arm.hpp"
62 #endif
63 #ifdef TARGET_ARCH_ppc
64 # include "bytes_ppc.hpp"
65 #endif
66
67 #define NOFAILOVER_MAJOR_VERSION 51
68 #define NONZERO_PADDING_BYTES_IN_SWITCH_MAJOR_VERSION 51
69 #define STATIC_METHOD_IN_INTERFACE_MAJOR_VERSION 52
70
71 // Access to external entry for VerifyClassCodes - old byte code verifier
72
73 extern "C" {
74 typedef jboolean (*verify_byte_codes_fn_t)(JNIEnv *, jclass, char *, jint);
75 typedef jboolean (*verify_byte_codes_fn_new_t)(JNIEnv *, jclass, char *, jint, jint);
76 }
77
78 static void* volatile _verify_byte_codes_fn = NULL;
79
80 static volatile jint _is_new_verify_byte_codes_fn = (jint) true;
81
82 static void* verify_byte_codes_fn() {
83 if (_verify_byte_codes_fn == NULL) {
84 void *lib_handle = os::native_java_library();
85 void *func = os::dll_lookup(lib_handle, "VerifyClassCodesForMajorVersion");
86 OrderAccess::release_store_ptr(&_verify_byte_codes_fn, func);
87 if (func == NULL) {
88 OrderAccess::release_store(&_is_new_verify_byte_codes_fn, false);
89 func = os::dll_lookup(lib_handle, "VerifyClassCodes");
90 OrderAccess::release_store_ptr(&_verify_byte_codes_fn, func);
91 }
92 }
93 return (void*)_verify_byte_codes_fn;
94 }
95
96
97 // Methods in Verifier
98
99 bool Verifier::should_verify_for(oop class_loader, bool should_verify_class) {
100 return (class_loader == NULL || !should_verify_class) ?
101 BytecodeVerificationLocal : BytecodeVerificationRemote;
102 }
103
104 bool Verifier::relax_access_for(oop loader) {
105 bool trusted = java_lang_ClassLoader::is_trusted_loader(loader);
106 bool need_verify =
107 // verifyAll
108 (BytecodeVerificationLocal && BytecodeVerificationRemote) ||
109 // verifyRemote
110 (!BytecodeVerificationLocal && BytecodeVerificationRemote && !trusted);
111 return !need_verify;
112 }
113
114 bool Verifier::verify(instanceKlassHandle klass, Verifier::Mode mode, bool should_verify_class, TRAPS) {
115 HandleMark hm;
116 ResourceMark rm(THREAD);
117
118 Symbol* exception_name = NULL;
119 const size_t message_buffer_len = klass->name()->utf8_length() + 1024;
120 char* message_buffer = NEW_RESOURCE_ARRAY(char, message_buffer_len);
121 char* exception_message = message_buffer;
122
123 const char* klassName = klass->external_name();
124 bool can_failover = FailOverToOldVerifier &&
125 klass->major_version() < NOFAILOVER_MAJOR_VERSION;
126
127 // If the class should be verified, first see if we can use the split
128 // verifier. If not, or if verification fails and FailOverToOldVerifier
129 // is set, then call the inference verifier.
130 if (is_eligible_for_verification(klass, should_verify_class)) {
131 if (TraceClassInitialization) {
132 tty->print_cr("Start class verification for: %s", klassName);
133 }
134 if (klass->major_version() >= STACKMAP_ATTRIBUTE_MAJOR_VERSION) {
135 ClassVerifier split_verifier(klass, THREAD);
136 split_verifier.verify_class(THREAD);
137 exception_name = split_verifier.result();
138 if (can_failover && !HAS_PENDING_EXCEPTION &&
139 (exception_name == vmSymbols::java_lang_VerifyError() ||
140 exception_name == vmSymbols::java_lang_ClassFormatError())) {
141 if (TraceClassInitialization || VerboseVerification) {
142 tty->print_cr(
143 "Fail over class verification to old verifier for: %s", klassName);
144 }
145 exception_name = inference_verify(
146 klass, message_buffer, message_buffer_len, THREAD);
147 }
148 if (exception_name != NULL) {
149 exception_message = split_verifier.exception_message();
150 }
151 } else {
152 exception_name = inference_verify(
153 klass, message_buffer, message_buffer_len, THREAD);
154 }
155
156 if (TraceClassInitialization || VerboseVerification) {
157 if (HAS_PENDING_EXCEPTION) {
158 tty->print("Verification for %s has", klassName);
159 tty->print_cr(" exception pending %s ",
160 InstanceKlass::cast(PENDING_EXCEPTION->klass())->external_name());
161 } else if (exception_name != NULL) {
162 tty->print_cr("Verification for %s failed", klassName);
163 }
164 tty->print_cr("End class verification for: %s", klassName);
165 }
166 }
167
168 if (HAS_PENDING_EXCEPTION) {
169 return false; // use the existing exception
170 } else if (exception_name == NULL) {
171 return true; // verifcation succeeded
172 } else { // VerifyError or ClassFormatError to be created and thrown
173 ResourceMark rm(THREAD);
174 instanceKlassHandle kls =
175 SystemDictionary::resolve_or_fail(exception_name, true, CHECK_false);
176 while (!kls.is_null()) {
177 if (kls == klass) {
178 // If the class being verified is the exception we're creating
179 // or one of it's superclasses, we're in trouble and are going
180 // to infinitely recurse when we try to initialize the exception.
181 // So bail out here by throwing the preallocated VM error.
182 THROW_OOP_(Universe::virtual_machine_error_instance(), false);
183 }
184 kls = kls->super();
185 }
186 message_buffer[message_buffer_len - 1] = '\0'; // just to be sure
187 THROW_MSG_(exception_name, exception_message, false);
188 }
189 }
190
191 bool Verifier::is_eligible_for_verification(instanceKlassHandle klass, bool should_verify_class) {
192 Symbol* name = klass->name();
193 Klass* refl_magic_klass = SystemDictionary::reflect_MagicAccessorImpl_klass();
194
195 bool is_reflect = refl_magic_klass != NULL && klass->is_subtype_of(refl_magic_klass);
196
197 return (should_verify_for(klass->class_loader(), should_verify_class) &&
198 // return if the class is a bootstrapping class
199 // or defineClass specified not to verify by default (flags override passed arg)
200 // We need to skip the following four for bootstraping
201 name != vmSymbols::java_lang_Object() &&
202 name != vmSymbols::java_lang_Class() &&
203 name != vmSymbols::java_lang_String() &&
204 name != vmSymbols::java_lang_Throwable() &&
205
206 // Can not verify the bytecodes for shared classes because they have
207 // already been rewritten to contain constant pool cache indices,
208 // which the verifier can't understand.
209 // Shared classes shouldn't have stackmaps either.
210 !klass()->is_shared() &&
211
212 // As of the fix for 4486457 we disable verification for all of the
213 // dynamically-generated bytecodes associated with the 1.4
214 // reflection implementation, not just those associated with
215 // sun/reflect/SerializationConstructorAccessor.
216 // NOTE: this is called too early in the bootstrapping process to be
217 // guarded by Universe::is_gte_jdk14x_version()/UseNewReflection.
218 // Also for lambda generated code, gte jdk8
219 (!is_reflect || VerifyReflectionBytecodes));
220 }
221
222 Symbol* Verifier::inference_verify(
223 instanceKlassHandle klass, char* message, size_t message_len, TRAPS) {
224 JavaThread* thread = (JavaThread*)THREAD;
225 JNIEnv *env = thread->jni_environment();
226
227 void* verify_func = verify_byte_codes_fn();
228
229 if (verify_func == NULL) {
230 jio_snprintf(message, message_len, "Could not link verifier");
231 return vmSymbols::java_lang_VerifyError();
232 }
233
234 ResourceMark rm(THREAD);
235 if (VerboseVerification) {
236 tty->print_cr("Verifying class %s with old format", klass->external_name());
237 }
238
239 jclass cls = (jclass) JNIHandles::make_local(env, klass->java_mirror());
240 jint result;
241
242 {
243 HandleMark hm(thread);
244 ThreadToNativeFromVM ttn(thread);
245 // ThreadToNativeFromVM takes care of changing thread_state, so safepoint
246 // code knows that we have left the VM
247
248 if (_is_new_verify_byte_codes_fn) {
249 verify_byte_codes_fn_new_t func =
250 CAST_TO_FN_PTR(verify_byte_codes_fn_new_t, verify_func);
251 result = (*func)(env, cls, message, (int)message_len,
252 klass->major_version());
253 } else {
254 verify_byte_codes_fn_t func =
255 CAST_TO_FN_PTR(verify_byte_codes_fn_t, verify_func);
256 result = (*func)(env, cls, message, (int)message_len);
257 }
258 }
259
260 JNIHandles::destroy_local(cls);
261
262 // These numbers are chosen so that VerifyClassCodes interface doesn't need
263 // to be changed (still return jboolean (unsigned char)), and result is
264 // 1 when verification is passed.
265 if (result == 0) {
266 return vmSymbols::java_lang_VerifyError();
267 } else if (result == 1) {
268 return NULL; // verified.
269 } else if (result == 2) {
270 THROW_MSG_(vmSymbols::java_lang_OutOfMemoryError(), message, NULL);
271 } else if (result == 3) {
272 return vmSymbols::java_lang_ClassFormatError();
273 } else {
274 ShouldNotReachHere();
275 return NULL;
276 }
277 }
278
279 TypeOrigin TypeOrigin::null() {
280 return TypeOrigin();
281 }
282 TypeOrigin TypeOrigin::local(u2 index, StackMapFrame* frame) {
283 assert(frame != NULL, "Must have a frame");
284 return TypeOrigin(CF_LOCALS, index, StackMapFrame::copy(frame),
285 frame->local_at(index));
286 }
287 TypeOrigin TypeOrigin::stack(u2 index, StackMapFrame* frame) {
288 assert(frame != NULL, "Must have a frame");
289 return TypeOrigin(CF_STACK, index, StackMapFrame::copy(frame),
290 frame->stack_at(index));
291 }
292 TypeOrigin TypeOrigin::sm_local(u2 index, StackMapFrame* frame) {
293 assert(frame != NULL, "Must have a frame");
294 return TypeOrigin(SM_LOCALS, index, StackMapFrame::copy(frame),
295 frame->local_at(index));
296 }
297 TypeOrigin TypeOrigin::sm_stack(u2 index, StackMapFrame* frame) {
298 assert(frame != NULL, "Must have a frame");
299 return TypeOrigin(SM_STACK, index, StackMapFrame::copy(frame),
300 frame->stack_at(index));
301 }
302 TypeOrigin TypeOrigin::bad_index(u2 index) {
303 return TypeOrigin(BAD_INDEX, index, NULL, VerificationType::bogus_type());
304 }
305 TypeOrigin TypeOrigin::cp(u2 index, VerificationType vt) {
306 return TypeOrigin(CONST_POOL, index, NULL, vt);
307 }
308 TypeOrigin TypeOrigin::signature(VerificationType vt) {
309 return TypeOrigin(SIG, 0, NULL, vt);
310 }
311 TypeOrigin TypeOrigin::implicit(VerificationType t) {
312 return TypeOrigin(IMPLICIT, 0, NULL, t);
313 }
314 TypeOrigin TypeOrigin::frame(StackMapFrame* frame) {
315 return TypeOrigin(FRAME_ONLY, 0, StackMapFrame::copy(frame),
316 VerificationType::bogus_type());
317 }
318
319 void TypeOrigin::reset_frame() {
320 if (_frame != NULL) {
321 _frame->restore();
322 }
323 }
324
325 void TypeOrigin::details(outputStream* ss) const {
326 _type.print_on(ss);
327 switch (_origin) {
328 case CF_LOCALS:
329 ss->print(" (current frame, locals[%d])", _index);
330 break;
331 case CF_STACK:
332 ss->print(" (current frame, stack[%d])", _index);
333 break;
334 case SM_LOCALS:
335 ss->print(" (stack map, locals[%d])", _index);
336 break;
337 case SM_STACK:
338 ss->print(" (stack map, stack[%d])", _index);
339 break;
340 case CONST_POOL:
341 ss->print(" (constant pool %d)", _index);
342 break;
343 case SIG:
344 ss->print(" (from method signature)");
345 break;
346 case IMPLICIT:
347 case FRAME_ONLY:
348 case NONE:
349 default:
350 ;
351 }
352 }
353
354 #ifdef ASSERT
355 void TypeOrigin::print_on(outputStream* str) const {
356 str->print("{%d,%d,%p:", _origin, _index, _frame);
357 if (_frame != NULL) {
358 _frame->print_on(str);
359 } else {
360 str->print("null");
361 }
362 str->print(",");
363 _type.print_on(str);
364 str->print("}");
365 }
366 #endif
367
368 void ErrorContext::details(outputStream* ss, const Method* method) const {
369 if (is_valid()) {
370 ss->cr();
371 ss->print_cr("Exception Details:");
372 location_details(ss, method);
373 reason_details(ss);
374 frame_details(ss);
375 bytecode_details(ss, method);
376 handler_details(ss, method);
377 stackmap_details(ss, method);
378 }
379 }
380
381 void ErrorContext::reason_details(outputStream* ss) const {
382 streamIndentor si(ss);
383 ss->indent().print_cr("Reason:");
384 streamIndentor si2(ss);
385 ss->indent().print("%s", "");
386 switch (_fault) {
387 case INVALID_BYTECODE:
388 ss->print("Error exists in the bytecode");
389 break;
390 case WRONG_TYPE:
391 if (_expected.is_valid()) {
392 ss->print("Type ");
393 _type.details(ss);
394 ss->print(" is not assignable to ");
395 _expected.details(ss);
396 } else {
397 ss->print("Invalid type: ");
398 _type.details(ss);
399 }
400 break;
401 case FLAGS_MISMATCH:
402 if (_expected.is_valid()) {
403 ss->print("Current frame's flags are not assignable "
404 "to stack map frame's.");
405 } else {
406 ss->print("Current frame's flags are invalid in this context.");
407 }
408 break;
409 case BAD_CP_INDEX:
410 ss->print("Constant pool index %d is invalid", _type.index());
411 break;
412 case BAD_LOCAL_INDEX:
413 ss->print("Local index %d is invalid", _type.index());
414 break;
415 case LOCALS_SIZE_MISMATCH:
416 ss->print("Current frame's local size doesn't match stackmap.");
417 break;
418 case STACK_SIZE_MISMATCH:
419 ss->print("Current frame's stack size doesn't match stackmap.");
420 break;
421 case STACK_OVERFLOW:
422 ss->print("Exceeded max stack size.");
423 break;
424 case STACK_UNDERFLOW:
425 ss->print("Attempt to pop empty stack.");
426 break;
427 case MISSING_STACKMAP:
428 ss->print("Expected stackmap frame at this location.");
429 break;
430 case BAD_STACKMAP:
431 ss->print("Invalid stackmap specification.");
432 break;
433 case UNKNOWN:
434 default:
435 ShouldNotReachHere();
436 ss->print_cr("Unknown");
437 }
438 ss->cr();
439 }
440
441 void ErrorContext::location_details(outputStream* ss, const Method* method) const {
442 if (_bci != -1 && method != NULL) {
443 streamIndentor si(ss);
444 const char* bytecode_name = "<invalid>";
445 if (method->validate_bci_from_bcx(_bci) != -1) {
446 Bytecodes::Code code = Bytecodes::code_or_bp_at(method->bcp_from(_bci));
447 if (Bytecodes::is_defined(code)) {
448 bytecode_name = Bytecodes::name(code);
449 } else {
450 bytecode_name = "<illegal>";
451 }
452 }
453 InstanceKlass* ik = method->method_holder();
454 ss->indent().print_cr("Location:");
455 streamIndentor si2(ss);
456 ss->indent().print_cr("%s.%s%s @%d: %s",
457 ik->name()->as_C_string(), method->name()->as_C_string(),
458 method->signature()->as_C_string(), _bci, bytecode_name);
459 }
460 }
461
462 void ErrorContext::frame_details(outputStream* ss) const {
463 streamIndentor si(ss);
464 if (_type.is_valid() && _type.frame() != NULL) {
465 ss->indent().print_cr("Current Frame:");
466 streamIndentor si2(ss);
467 _type.frame()->print_on(ss);
468 }
469 if (_expected.is_valid() && _expected.frame() != NULL) {
470 ss->indent().print_cr("Stackmap Frame:");
471 streamIndentor si2(ss);
472 _expected.frame()->print_on(ss);
473 }
474 }
475
476 void ErrorContext::bytecode_details(outputStream* ss, const Method* method) const {
477 if (method != NULL) {
478 streamIndentor si(ss);
479 ss->indent().print_cr("Bytecode:");
480 streamIndentor si2(ss);
481 ss->print_data(method->code_base(), method->code_size(), false);
482 }
483 }
484
485 void ErrorContext::handler_details(outputStream* ss, const Method* method) const {
486 if (method != NULL) {
487 streamIndentor si(ss);
488 ExceptionTable table(method);
489 if (table.length() > 0) {
490 ss->indent().print_cr("Exception Handler Table:");
491 streamIndentor si2(ss);
492 for (int i = 0; i < table.length(); ++i) {
493 ss->indent().print_cr("bci [%d, %d] => handler: %d", table.start_pc(i),
494 table.end_pc(i), table.handler_pc(i));
495 }
496 }
497 }
498 }
499
500 void ErrorContext::stackmap_details(outputStream* ss, const Method* method) const {
501 if (method != NULL && method->has_stackmap_table()) {
502 streamIndentor si(ss);
503 ss->indent().print_cr("Stackmap Table:");
504 Array<u1>* data = method->stackmap_data();
505 stack_map_table* sm_table =
506 stack_map_table::at((address)data->adr_at(0));
507 stack_map_frame* sm_frame = sm_table->entries();
508 streamIndentor si2(ss);
509 int current_offset = -1;
510 address end_of_sm_table = (address)sm_table + method->stackmap_data()->length();
511 for (u2 i = 0; i < sm_table->number_of_entries(); ++i) {
512 ss->indent();
513 if (!sm_frame->verify((address)sm_frame, end_of_sm_table)) {
514 sm_frame->print_truncated(ss, current_offset);
515 return;
516 }
517 sm_frame->print_on(ss, current_offset);
518 ss->cr();
519 current_offset += sm_frame->offset_delta();
520 sm_frame = sm_frame->next();
521 }
522 }
523 }
524
525 // Methods in ClassVerifier
526
527 ClassVerifier::ClassVerifier(
528 instanceKlassHandle klass, TRAPS)
529 : _thread(THREAD), _exception_type(NULL), _message(NULL), _klass(klass) {
530 _this_type = VerificationType::reference_type(klass->name());
531 // Create list to hold symbols in reference area.
532 _symbols = new GrowableArray<Symbol*>(100, 0, NULL);
533 }
534
535 ClassVerifier::~ClassVerifier() {
536 // Decrement the reference count for any symbols created.
537 for (int i = 0; i < _symbols->length(); i++) {
538 Symbol* s = _symbols->at(i);
539 s->decrement_refcount();
540 }
541 }
542
543 VerificationType ClassVerifier::object_type() const {
544 return VerificationType::reference_type(vmSymbols::java_lang_Object());
545 }
546
547 TypeOrigin ClassVerifier::ref_ctx(const char* sig, TRAPS) {
548 VerificationType vt = VerificationType::reference_type(
549 create_temporary_symbol(sig, (int)strlen(sig), THREAD));
550 return TypeOrigin::implicit(vt);
551 }
552
553 void ClassVerifier::verify_class(TRAPS) {
554 if (VerboseVerification) {
555 tty->print_cr("Verifying class %s with new format",
556 _klass->external_name());
557 }
558
559 Array<Method*>* methods = _klass->methods();
560 int num_methods = methods->length();
561
562 for (int index = 0; index < num_methods; index++) {
563 // Check for recursive re-verification before each method.
564 if (was_recursively_verified()) return;
565
566 Method* m = methods->at(index);
567 if (m->is_native() || m->is_abstract() || m->is_overpass()) {
568 // If m is native or abstract, skip it. It is checked in class file
569 // parser that methods do not override a final method. Overpass methods
570 // are trusted since the VM generates them.
571 continue;
572 }
573 verify_method(methodHandle(THREAD, m), CHECK_VERIFY(this));
574 }
575
576 if (VerboseVerification || TraceClassInitialization) {
577 if (was_recursively_verified())
578 tty->print_cr("Recursive verification detected for: %s",
579 _klass->external_name());
580 }
581 }
582
583 void ClassVerifier::verify_method(methodHandle m, TRAPS) {
584 HandleMark hm(THREAD);
585 _method = m; // initialize _method
586 if (VerboseVerification) {
587 tty->print_cr("Verifying method %s", m->name_and_sig_as_C_string());
588 }
589
590 // For clang, the only good constant format string is a literal constant format string.
591 #define bad_type_msg "Bad type on operand stack in %s"
592
593 int32_t max_stack = m->verifier_max_stack();
594 int32_t max_locals = m->max_locals();
595 constantPoolHandle cp(THREAD, m->constants());
596
597 if (!SignatureVerifier::is_valid_method_signature(m->signature())) {
598 class_format_error("Invalid method signature");
599 return;
600 }
601
602 // Initial stack map frame: offset is 0, stack is initially empty.
603 StackMapFrame current_frame(max_locals, max_stack, this);
604 // Set initial locals
605 VerificationType return_type = current_frame.set_locals_from_arg(
606 m, current_type(), CHECK_VERIFY(this));
607
608 int32_t stackmap_index = 0; // index to the stackmap array
609
610 u4 code_length = m->code_size();
611
612 // Scan the bytecode and map each instruction's start offset to a number.
613 char* code_data = generate_code_data(m, code_length, CHECK_VERIFY(this));
614
615 int ex_min = code_length;
616 int ex_max = -1;
617 // Look through each item on the exception table. Each of the fields must refer
618 // to a legal instruction.
619 verify_exception_handler_table(
620 code_length, code_data, ex_min, ex_max, CHECK_VERIFY(this));
621
622 // Look through each entry on the local variable table and make sure
623 // its range of code array offsets is valid. (4169817)
624 if (m->has_localvariable_table()) {
625 verify_local_variable_table(code_length, code_data, CHECK_VERIFY(this));
626 }
627
628 Array<u1>* stackmap_data = m->stackmap_data();
629 StackMapStream stream(stackmap_data);
630 StackMapReader reader(this, &stream, code_data, code_length, THREAD);
631 StackMapTable stackmap_table(&reader, ¤t_frame, max_locals, max_stack,
632 code_data, code_length, CHECK_VERIFY(this));
633
634 if (VerboseVerification) {
635 stackmap_table.print_on(tty);
636 }
637
638 RawBytecodeStream bcs(m);
639
640 // Scan the byte code linearly from the start to the end
641 bool no_control_flow = false; // Set to true when there is no direct control
642 // flow from current instruction to the next
643 // instruction in sequence
644
645 Bytecodes::Code opcode;
646 while (!bcs.is_last_bytecode()) {
647 // Check for recursive re-verification before each bytecode.
648 if (was_recursively_verified()) return;
649
650 opcode = bcs.raw_next();
651 u2 bci = bcs.bci();
652
653 // Set current frame's offset to bci
654 current_frame.set_offset(bci);
655 current_frame.set_mark();
656
657 // Make sure every offset in stackmap table point to the beginning to
658 // an instruction. Match current_frame to stackmap_table entry with
659 // the same offset if exists.
660 stackmap_index = verify_stackmap_table(
661 stackmap_index, bci, ¤t_frame, &stackmap_table,
662 no_control_flow, CHECK_VERIFY(this));
663
664
665 bool this_uninit = false; // Set to true when invokespecial <init> initialized 'this'
666 bool verified_exc_handlers = false;
667
668 // Merge with the next instruction
669 {
670 u2 index;
671 int target;
672 VerificationType type, type2;
673 VerificationType atype;
674
675 #ifndef PRODUCT
676 if (VerboseVerification) {
677 current_frame.print_on(tty);
678 tty->print_cr("offset = %d, opcode = %s", bci, Bytecodes::name(opcode));
679 }
680 #endif
681
682 // Make sure wide instruction is in correct format
683 if (bcs.is_wide()) {
684 if (opcode != Bytecodes::_iinc && opcode != Bytecodes::_iload &&
685 opcode != Bytecodes::_aload && opcode != Bytecodes::_lload &&
686 opcode != Bytecodes::_istore && opcode != Bytecodes::_astore &&
687 opcode != Bytecodes::_lstore && opcode != Bytecodes::_fload &&
688 opcode != Bytecodes::_dload && opcode != Bytecodes::_fstore &&
689 opcode != Bytecodes::_dstore) {
690 /* Unreachable? RawBytecodeStream's raw_next() returns 'illegal'
691 * if we encounter a wide instruction that modifies an invalid
692 * opcode (not one of the ones listed above) */
693 verify_error(ErrorContext::bad_code(bci), "Bad wide instruction");
694 return;
695 }
696 }
697
698 // Look for possible jump target in exception handlers and see if it
699 // matches current_frame. Do this check here for astore*, dstore*,
700 // fstore*, istore*, and lstore* opcodes because they can change the type
701 // state by adding a local. JVM Spec says that the incoming type state
702 // should be used for this check. So, do the check here before a possible
703 // local is added to the type state.
704 if (Bytecodes::is_store_into_local(opcode) && bci >= ex_min && bci < ex_max) {
705 verify_exception_handler_targets(
706 bci, this_uninit, ¤t_frame, &stackmap_table, CHECK_VERIFY(this));
707 verified_exc_handlers = true;
708 }
709
710 switch (opcode) {
711 case Bytecodes::_nop :
712 no_control_flow = false; break;
713 case Bytecodes::_aconst_null :
714 current_frame.push_stack(
715 VerificationType::null_type(), CHECK_VERIFY(this));
716 no_control_flow = false; break;
717 case Bytecodes::_iconst_m1 :
718 case Bytecodes::_iconst_0 :
719 case Bytecodes::_iconst_1 :
720 case Bytecodes::_iconst_2 :
721 case Bytecodes::_iconst_3 :
722 case Bytecodes::_iconst_4 :
723 case Bytecodes::_iconst_5 :
724 current_frame.push_stack(
725 VerificationType::integer_type(), CHECK_VERIFY(this));
726 no_control_flow = false; break;
727 case Bytecodes::_lconst_0 :
728 case Bytecodes::_lconst_1 :
729 current_frame.push_stack_2(
730 VerificationType::long_type(),
731 VerificationType::long2_type(), CHECK_VERIFY(this));
732 no_control_flow = false; break;
733 case Bytecodes::_fconst_0 :
734 case Bytecodes::_fconst_1 :
735 case Bytecodes::_fconst_2 :
736 current_frame.push_stack(
737 VerificationType::float_type(), CHECK_VERIFY(this));
738 no_control_flow = false; break;
739 case Bytecodes::_dconst_0 :
740 case Bytecodes::_dconst_1 :
741 current_frame.push_stack_2(
742 VerificationType::double_type(),
743 VerificationType::double2_type(), CHECK_VERIFY(this));
744 no_control_flow = false; break;
745 case Bytecodes::_sipush :
746 case Bytecodes::_bipush :
747 current_frame.push_stack(
748 VerificationType::integer_type(), CHECK_VERIFY(this));
749 no_control_flow = false; break;
750 case Bytecodes::_ldc :
751 verify_ldc(
752 opcode, bcs.get_index_u1(), ¤t_frame,
753 cp, bci, CHECK_VERIFY(this));
754 no_control_flow = false; break;
755 case Bytecodes::_ldc_w :
756 case Bytecodes::_ldc2_w :
757 verify_ldc(
758 opcode, bcs.get_index_u2(), ¤t_frame,
759 cp, bci, CHECK_VERIFY(this));
760 no_control_flow = false; break;
761 case Bytecodes::_iload :
762 verify_iload(bcs.get_index(), ¤t_frame, CHECK_VERIFY(this));
763 no_control_flow = false; break;
764 case Bytecodes::_iload_0 :
765 case Bytecodes::_iload_1 :
766 case Bytecodes::_iload_2 :
767 case Bytecodes::_iload_3 :
768 index = opcode - Bytecodes::_iload_0;
769 verify_iload(index, ¤t_frame, CHECK_VERIFY(this));
770 no_control_flow = false; break;
771 case Bytecodes::_lload :
772 verify_lload(bcs.get_index(), ¤t_frame, CHECK_VERIFY(this));
773 no_control_flow = false; break;
774 case Bytecodes::_lload_0 :
775 case Bytecodes::_lload_1 :
776 case Bytecodes::_lload_2 :
777 case Bytecodes::_lload_3 :
778 index = opcode - Bytecodes::_lload_0;
779 verify_lload(index, ¤t_frame, CHECK_VERIFY(this));
780 no_control_flow = false; break;
781 case Bytecodes::_fload :
782 verify_fload(bcs.get_index(), ¤t_frame, CHECK_VERIFY(this));
783 no_control_flow = false; break;
784 case Bytecodes::_fload_0 :
785 case Bytecodes::_fload_1 :
786 case Bytecodes::_fload_2 :
787 case Bytecodes::_fload_3 :
788 index = opcode - Bytecodes::_fload_0;
789 verify_fload(index, ¤t_frame, CHECK_VERIFY(this));
790 no_control_flow = false; break;
791 case Bytecodes::_dload :
792 verify_dload(bcs.get_index(), ¤t_frame, CHECK_VERIFY(this));
793 no_control_flow = false; break;
794 case Bytecodes::_dload_0 :
795 case Bytecodes::_dload_1 :
796 case Bytecodes::_dload_2 :
797 case Bytecodes::_dload_3 :
798 index = opcode - Bytecodes::_dload_0;
799 verify_dload(index, ¤t_frame, CHECK_VERIFY(this));
800 no_control_flow = false; break;
801 case Bytecodes::_aload :
802 verify_aload(bcs.get_index(), ¤t_frame, CHECK_VERIFY(this));
803 no_control_flow = false; break;
804 case Bytecodes::_aload_0 :
805 case Bytecodes::_aload_1 :
806 case Bytecodes::_aload_2 :
807 case Bytecodes::_aload_3 :
808 index = opcode - Bytecodes::_aload_0;
809 verify_aload(index, ¤t_frame, CHECK_VERIFY(this));
810 no_control_flow = false; break;
811 case Bytecodes::_iaload :
812 type = current_frame.pop_stack(
813 VerificationType::integer_type(), CHECK_VERIFY(this));
814 atype = current_frame.pop_stack(
815 VerificationType::reference_check(), CHECK_VERIFY(this));
816 if (!atype.is_int_array()) {
817 verify_error(ErrorContext::bad_type(bci,
818 current_frame.stack_top_ctx(), ref_ctx("[I", THREAD)),
819 bad_type_msg, "iaload");
820 return;
821 }
822 current_frame.push_stack(
823 VerificationType::integer_type(), CHECK_VERIFY(this));
824 no_control_flow = false; break;
825 case Bytecodes::_baload :
826 type = current_frame.pop_stack(
827 VerificationType::integer_type(), CHECK_VERIFY(this));
828 atype = current_frame.pop_stack(
829 VerificationType::reference_check(), CHECK_VERIFY(this));
830 if (!atype.is_bool_array() && !atype.is_byte_array()) {
831 verify_error(
832 ErrorContext::bad_type(bci, current_frame.stack_top_ctx()),
833 bad_type_msg, "baload");
834 return;
835 }
836 current_frame.push_stack(
837 VerificationType::integer_type(), CHECK_VERIFY(this));
838 no_control_flow = false; break;
839 case Bytecodes::_caload :
840 type = current_frame.pop_stack(
841 VerificationType::integer_type(), CHECK_VERIFY(this));
842 atype = current_frame.pop_stack(
843 VerificationType::reference_check(), CHECK_VERIFY(this));
844 if (!atype.is_char_array()) {
845 verify_error(ErrorContext::bad_type(bci,
846 current_frame.stack_top_ctx(), ref_ctx("[C", THREAD)),
847 bad_type_msg, "caload");
848 return;
849 }
850 current_frame.push_stack(
851 VerificationType::integer_type(), CHECK_VERIFY(this));
852 no_control_flow = false; break;
853 case Bytecodes::_saload :
854 type = current_frame.pop_stack(
855 VerificationType::integer_type(), CHECK_VERIFY(this));
856 atype = current_frame.pop_stack(
857 VerificationType::reference_check(), CHECK_VERIFY(this));
858 if (!atype.is_short_array()) {
859 verify_error(ErrorContext::bad_type(bci,
860 current_frame.stack_top_ctx(), ref_ctx("[S", THREAD)),
861 bad_type_msg, "saload");
862 return;
863 }
864 current_frame.push_stack(
865 VerificationType::integer_type(), CHECK_VERIFY(this));
866 no_control_flow = false; break;
867 case Bytecodes::_laload :
868 type = current_frame.pop_stack(
869 VerificationType::integer_type(), CHECK_VERIFY(this));
870 atype = current_frame.pop_stack(
871 VerificationType::reference_check(), CHECK_VERIFY(this));
872 if (!atype.is_long_array()) {
873 verify_error(ErrorContext::bad_type(bci,
874 current_frame.stack_top_ctx(), ref_ctx("[J", THREAD)),
875 bad_type_msg, "laload");
876 return;
877 }
878 current_frame.push_stack_2(
879 VerificationType::long_type(),
880 VerificationType::long2_type(), CHECK_VERIFY(this));
881 no_control_flow = false; break;
882 case Bytecodes::_faload :
883 type = current_frame.pop_stack(
884 VerificationType::integer_type(), CHECK_VERIFY(this));
885 atype = current_frame.pop_stack(
886 VerificationType::reference_check(), CHECK_VERIFY(this));
887 if (!atype.is_float_array()) {
888 verify_error(ErrorContext::bad_type(bci,
889 current_frame.stack_top_ctx(), ref_ctx("[F", THREAD)),
890 bad_type_msg, "faload");
891 return;
892 }
893 current_frame.push_stack(
894 VerificationType::float_type(), CHECK_VERIFY(this));
895 no_control_flow = false; break;
896 case Bytecodes::_daload :
897 type = current_frame.pop_stack(
898 VerificationType::integer_type(), CHECK_VERIFY(this));
899 atype = current_frame.pop_stack(
900 VerificationType::reference_check(), CHECK_VERIFY(this));
901 if (!atype.is_double_array()) {
902 verify_error(ErrorContext::bad_type(bci,
903 current_frame.stack_top_ctx(), ref_ctx("[D", THREAD)),
904 bad_type_msg, "daload");
905 return;
906 }
907 current_frame.push_stack_2(
908 VerificationType::double_type(),
909 VerificationType::double2_type(), CHECK_VERIFY(this));
910 no_control_flow = false; break;
911 case Bytecodes::_aaload : {
912 type = current_frame.pop_stack(
913 VerificationType::integer_type(), CHECK_VERIFY(this));
914 atype = current_frame.pop_stack(
915 VerificationType::reference_check(), CHECK_VERIFY(this));
916 if (!atype.is_reference_array()) {
917 verify_error(ErrorContext::bad_type(bci,
918 current_frame.stack_top_ctx(),
919 TypeOrigin::implicit(VerificationType::reference_check())),
920 bad_type_msg, "aaload");
921 return;
922 }
923 if (atype.is_null()) {
924 current_frame.push_stack(
925 VerificationType::null_type(), CHECK_VERIFY(this));
926 } else {
927 VerificationType component =
928 atype.get_component(this, CHECK_VERIFY(this));
929 current_frame.push_stack(component, CHECK_VERIFY(this));
930 }
931 no_control_flow = false; break;
932 }
933 case Bytecodes::_istore :
934 verify_istore(bcs.get_index(), ¤t_frame, CHECK_VERIFY(this));
935 no_control_flow = false; break;
936 case Bytecodes::_istore_0 :
937 case Bytecodes::_istore_1 :
938 case Bytecodes::_istore_2 :
939 case Bytecodes::_istore_3 :
940 index = opcode - Bytecodes::_istore_0;
941 verify_istore(index, ¤t_frame, CHECK_VERIFY(this));
942 no_control_flow = false; break;
943 case Bytecodes::_lstore :
944 verify_lstore(bcs.get_index(), ¤t_frame, CHECK_VERIFY(this));
945 no_control_flow = false; break;
946 case Bytecodes::_lstore_0 :
947 case Bytecodes::_lstore_1 :
948 case Bytecodes::_lstore_2 :
949 case Bytecodes::_lstore_3 :
950 index = opcode - Bytecodes::_lstore_0;
951 verify_lstore(index, ¤t_frame, CHECK_VERIFY(this));
952 no_control_flow = false; break;
953 case Bytecodes::_fstore :
954 verify_fstore(bcs.get_index(), ¤t_frame, CHECK_VERIFY(this));
955 no_control_flow = false; break;
956 case Bytecodes::_fstore_0 :
957 case Bytecodes::_fstore_1 :
958 case Bytecodes::_fstore_2 :
959 case Bytecodes::_fstore_3 :
960 index = opcode - Bytecodes::_fstore_0;
961 verify_fstore(index, ¤t_frame, CHECK_VERIFY(this));
962 no_control_flow = false; break;
963 case Bytecodes::_dstore :
964 verify_dstore(bcs.get_index(), ¤t_frame, CHECK_VERIFY(this));
965 no_control_flow = false; break;
966 case Bytecodes::_dstore_0 :
967 case Bytecodes::_dstore_1 :
968 case Bytecodes::_dstore_2 :
969 case Bytecodes::_dstore_3 :
970 index = opcode - Bytecodes::_dstore_0;
971 verify_dstore(index, ¤t_frame, CHECK_VERIFY(this));
972 no_control_flow = false; break;
973 case Bytecodes::_astore :
974 verify_astore(bcs.get_index(), ¤t_frame, CHECK_VERIFY(this));
975 no_control_flow = false; break;
976 case Bytecodes::_astore_0 :
977 case Bytecodes::_astore_1 :
978 case Bytecodes::_astore_2 :
979 case Bytecodes::_astore_3 :
980 index = opcode - Bytecodes::_astore_0;
981 verify_astore(index, ¤t_frame, CHECK_VERIFY(this));
982 no_control_flow = false; break;
983 case Bytecodes::_iastore :
984 type = current_frame.pop_stack(
985 VerificationType::integer_type(), CHECK_VERIFY(this));
986 type2 = current_frame.pop_stack(
987 VerificationType::integer_type(), CHECK_VERIFY(this));
988 atype = current_frame.pop_stack(
989 VerificationType::reference_check(), CHECK_VERIFY(this));
990 if (!atype.is_int_array()) {
991 verify_error(ErrorContext::bad_type(bci,
992 current_frame.stack_top_ctx(), ref_ctx("[I", THREAD)),
993 bad_type_msg, "iastore");
994 return;
995 }
996 no_control_flow = false; break;
997 case Bytecodes::_bastore :
998 type = current_frame.pop_stack(
999 VerificationType::integer_type(), CHECK_VERIFY(this));
1000 type2 = current_frame.pop_stack(
1001 VerificationType::integer_type(), CHECK_VERIFY(this));
1002 atype = current_frame.pop_stack(
1003 VerificationType::reference_check(), CHECK_VERIFY(this));
1004 if (!atype.is_bool_array() && !atype.is_byte_array()) {
1005 verify_error(
1006 ErrorContext::bad_type(bci, current_frame.stack_top_ctx()),
1007 bad_type_msg, "bastore");
1008 return;
1009 }
1010 no_control_flow = false; break;
1011 case Bytecodes::_castore :
1012 current_frame.pop_stack(
1013 VerificationType::integer_type(), CHECK_VERIFY(this));
1014 current_frame.pop_stack(
1015 VerificationType::integer_type(), CHECK_VERIFY(this));
1016 atype = current_frame.pop_stack(
1017 VerificationType::reference_check(), CHECK_VERIFY(this));
1018 if (!atype.is_char_array()) {
1019 verify_error(ErrorContext::bad_type(bci,
1020 current_frame.stack_top_ctx(), ref_ctx("[C", THREAD)),
1021 bad_type_msg, "castore");
1022 return;
1023 }
1024 no_control_flow = false; break;
1025 case Bytecodes::_sastore :
1026 current_frame.pop_stack(
1027 VerificationType::integer_type(), CHECK_VERIFY(this));
1028 current_frame.pop_stack(
1029 VerificationType::integer_type(), CHECK_VERIFY(this));
1030 atype = current_frame.pop_stack(
1031 VerificationType::reference_check(), CHECK_VERIFY(this));
1032 if (!atype.is_short_array()) {
1033 verify_error(ErrorContext::bad_type(bci,
1034 current_frame.stack_top_ctx(), ref_ctx("[S", THREAD)),
1035 bad_type_msg, "sastore");
1036 return;
1037 }
1038 no_control_flow = false; break;
1039 case Bytecodes::_lastore :
1040 current_frame.pop_stack_2(
1041 VerificationType::long2_type(),
1042 VerificationType::long_type(), CHECK_VERIFY(this));
1043 current_frame.pop_stack(
1044 VerificationType::integer_type(), CHECK_VERIFY(this));
1045 atype = current_frame.pop_stack(
1046 VerificationType::reference_check(), CHECK_VERIFY(this));
1047 if (!atype.is_long_array()) {
1048 verify_error(ErrorContext::bad_type(bci,
1049 current_frame.stack_top_ctx(), ref_ctx("[J", THREAD)),
1050 bad_type_msg, "lastore");
1051 return;
1052 }
1053 no_control_flow = false; break;
1054 case Bytecodes::_fastore :
1055 current_frame.pop_stack(
1056 VerificationType::float_type(), CHECK_VERIFY(this));
1057 current_frame.pop_stack
1058 (VerificationType::integer_type(), CHECK_VERIFY(this));
1059 atype = current_frame.pop_stack(
1060 VerificationType::reference_check(), CHECK_VERIFY(this));
1061 if (!atype.is_float_array()) {
1062 verify_error(ErrorContext::bad_type(bci,
1063 current_frame.stack_top_ctx(), ref_ctx("[F", THREAD)),
1064 bad_type_msg, "fastore");
1065 return;
1066 }
1067 no_control_flow = false; break;
1068 case Bytecodes::_dastore :
1069 current_frame.pop_stack_2(
1070 VerificationType::double2_type(),
1071 VerificationType::double_type(), CHECK_VERIFY(this));
1072 current_frame.pop_stack(
1073 VerificationType::integer_type(), CHECK_VERIFY(this));
1074 atype = current_frame.pop_stack(
1075 VerificationType::reference_check(), CHECK_VERIFY(this));
1076 if (!atype.is_double_array()) {
1077 verify_error(ErrorContext::bad_type(bci,
1078 current_frame.stack_top_ctx(), ref_ctx("[D", THREAD)),
1079 bad_type_msg, "dastore");
1080 return;
1081 }
1082 no_control_flow = false; break;
1083 case Bytecodes::_aastore :
1084 type = current_frame.pop_stack(object_type(), CHECK_VERIFY(this));
1085 type2 = current_frame.pop_stack(
1086 VerificationType::integer_type(), CHECK_VERIFY(this));
1087 atype = current_frame.pop_stack(
1088 VerificationType::reference_check(), CHECK_VERIFY(this));
1089 // more type-checking is done at runtime
1090 if (!atype.is_reference_array()) {
1091 verify_error(ErrorContext::bad_type(bci,
1092 current_frame.stack_top_ctx(),
1093 TypeOrigin::implicit(VerificationType::reference_check())),
1094 bad_type_msg, "aastore");
1095 return;
1096 }
1097 // 4938384: relaxed constraint in JVMS 3nd edition.
1098 no_control_flow = false; break;
1099 case Bytecodes::_pop :
1100 current_frame.pop_stack(
1101 VerificationType::category1_check(), CHECK_VERIFY(this));
1102 no_control_flow = false; break;
1103 case Bytecodes::_pop2 :
1104 type = current_frame.pop_stack(CHECK_VERIFY(this));
1105 if (type.is_category1()) {
1106 current_frame.pop_stack(
1107 VerificationType::category1_check(), CHECK_VERIFY(this));
1108 } else if (type.is_category2_2nd()) {
1109 current_frame.pop_stack(
1110 VerificationType::category2_check(), CHECK_VERIFY(this));
1111 } else {
1112 /* Unreachable? Would need a category2_1st on TOS
1113 * which does not appear possible. */
1114 verify_error(
1115 ErrorContext::bad_type(bci, current_frame.stack_top_ctx()),
1116 bad_type_msg, "pop2");
1117 return;
1118 }
1119 no_control_flow = false; break;
1120 case Bytecodes::_dup :
1121 type = current_frame.pop_stack(
1122 VerificationType::category1_check(), CHECK_VERIFY(this));
1123 current_frame.push_stack(type, CHECK_VERIFY(this));
1124 current_frame.push_stack(type, CHECK_VERIFY(this));
1125 no_control_flow = false; break;
1126 case Bytecodes::_dup_x1 :
1127 type = current_frame.pop_stack(
1128 VerificationType::category1_check(), CHECK_VERIFY(this));
1129 type2 = current_frame.pop_stack(
1130 VerificationType::category1_check(), CHECK_VERIFY(this));
1131 current_frame.push_stack(type, CHECK_VERIFY(this));
1132 current_frame.push_stack(type2, CHECK_VERIFY(this));
1133 current_frame.push_stack(type, CHECK_VERIFY(this));
1134 no_control_flow = false; break;
1135 case Bytecodes::_dup_x2 :
1136 {
1137 VerificationType type3;
1138 type = current_frame.pop_stack(
1139 VerificationType::category1_check(), CHECK_VERIFY(this));
1140 type2 = current_frame.pop_stack(CHECK_VERIFY(this));
1141 if (type2.is_category1()) {
1142 type3 = current_frame.pop_stack(
1143 VerificationType::category1_check(), CHECK_VERIFY(this));
1144 } else if (type2.is_category2_2nd()) {
1145 type3 = current_frame.pop_stack(
1146 VerificationType::category2_check(), CHECK_VERIFY(this));
1147 } else {
1148 /* Unreachable? Would need a category2_1st at stack depth 2 with
1149 * a category1 on TOS which does not appear possible. */
1150 verify_error(ErrorContext::bad_type(
1151 bci, current_frame.stack_top_ctx()), bad_type_msg, "dup_x2");
1152 return;
1153 }
1154 current_frame.push_stack(type, CHECK_VERIFY(this));
1155 current_frame.push_stack(type3, CHECK_VERIFY(this));
1156 current_frame.push_stack(type2, CHECK_VERIFY(this));
1157 current_frame.push_stack(type, CHECK_VERIFY(this));
1158 no_control_flow = false; break;
1159 }
1160 case Bytecodes::_dup2 :
1161 type = current_frame.pop_stack(CHECK_VERIFY(this));
1162 if (type.is_category1()) {
1163 type2 = current_frame.pop_stack(
1164 VerificationType::category1_check(), CHECK_VERIFY(this));
1165 } else if (type.is_category2_2nd()) {
1166 type2 = current_frame.pop_stack(
1167 VerificationType::category2_check(), CHECK_VERIFY(this));
1168 } else {
1169 /* Unreachable? Would need a category2_1st on TOS which does not
1170 * appear possible. */
1171 verify_error(
1172 ErrorContext::bad_type(bci, current_frame.stack_top_ctx()),
1173 bad_type_msg, "dup2");
1174 return;
1175 }
1176 current_frame.push_stack(type2, CHECK_VERIFY(this));
1177 current_frame.push_stack(type, CHECK_VERIFY(this));
1178 current_frame.push_stack(type2, CHECK_VERIFY(this));
1179 current_frame.push_stack(type, CHECK_VERIFY(this));
1180 no_control_flow = false; break;
1181 case Bytecodes::_dup2_x1 :
1182 {
1183 VerificationType type3;
1184 type = current_frame.pop_stack(CHECK_VERIFY(this));
1185 if (type.is_category1()) {
1186 type2 = current_frame.pop_stack(
1187 VerificationType::category1_check(), CHECK_VERIFY(this));
1188 } else if (type.is_category2_2nd()) {
1189 type2 = current_frame.pop_stack(
1190 VerificationType::category2_check(), CHECK_VERIFY(this));
1191 } else {
1192 /* Unreachable? Would need a category2_1st on TOS which does
1193 * not appear possible. */
1194 verify_error(
1195 ErrorContext::bad_type(bci, current_frame.stack_top_ctx()),
1196 bad_type_msg, "dup2_x1");
1197 return;
1198 }
1199 type3 = current_frame.pop_stack(
1200 VerificationType::category1_check(), CHECK_VERIFY(this));
1201 current_frame.push_stack(type2, CHECK_VERIFY(this));
1202 current_frame.push_stack(type, CHECK_VERIFY(this));
1203 current_frame.push_stack(type3, CHECK_VERIFY(this));
1204 current_frame.push_stack(type2, CHECK_VERIFY(this));
1205 current_frame.push_stack(type, CHECK_VERIFY(this));
1206 no_control_flow = false; break;
1207 }
1208 case Bytecodes::_dup2_x2 :
1209 {
1210 VerificationType type3, type4;
1211 type = current_frame.pop_stack(CHECK_VERIFY(this));
1212 if (type.is_category1()) {
1213 type2 = current_frame.pop_stack(
1214 VerificationType::category1_check(), CHECK_VERIFY(this));
1215 } else if (type.is_category2_2nd()) {
1216 type2 = current_frame.pop_stack(
1217 VerificationType::category2_check(), CHECK_VERIFY(this));
1218 } else {
1219 /* Unreachable? Would need a category2_1st on TOS which does
1220 * not appear possible. */
1221 verify_error(
1222 ErrorContext::bad_type(bci, current_frame.stack_top_ctx()),
1223 bad_type_msg, "dup2_x2");
1224 return;
1225 }
1226 type3 = current_frame.pop_stack(CHECK_VERIFY(this));
1227 if (type3.is_category1()) {
1228 type4 = current_frame.pop_stack(
1229 VerificationType::category1_check(), CHECK_VERIFY(this));
1230 } else if (type3.is_category2_2nd()) {
1231 type4 = current_frame.pop_stack(
1232 VerificationType::category2_check(), CHECK_VERIFY(this));
1233 } else {
1234 /* Unreachable? Would need a category2_1st on TOS after popping
1235 * a long/double or two category 1's, which does not
1236 * appear possible. */
1237 verify_error(
1238 ErrorContext::bad_type(bci, current_frame.stack_top_ctx()),
1239 bad_type_msg, "dup2_x2");
1240 return;
1241 }
1242 current_frame.push_stack(type2, CHECK_VERIFY(this));
1243 current_frame.push_stack(type, CHECK_VERIFY(this));
1244 current_frame.push_stack(type4, CHECK_VERIFY(this));
1245 current_frame.push_stack(type3, CHECK_VERIFY(this));
1246 current_frame.push_stack(type2, CHECK_VERIFY(this));
1247 current_frame.push_stack(type, CHECK_VERIFY(this));
1248 no_control_flow = false; break;
1249 }
1250 case Bytecodes::_swap :
1251 type = current_frame.pop_stack(
1252 VerificationType::category1_check(), CHECK_VERIFY(this));
1253 type2 = current_frame.pop_stack(
1254 VerificationType::category1_check(), CHECK_VERIFY(this));
1255 current_frame.push_stack(type, CHECK_VERIFY(this));
1256 current_frame.push_stack(type2, CHECK_VERIFY(this));
1257 no_control_flow = false; break;
1258 case Bytecodes::_iadd :
1259 case Bytecodes::_isub :
1260 case Bytecodes::_imul :
1261 case Bytecodes::_idiv :
1262 case Bytecodes::_irem :
1263 case Bytecodes::_ishl :
1264 case Bytecodes::_ishr :
1265 case Bytecodes::_iushr :
1266 case Bytecodes::_ior :
1267 case Bytecodes::_ixor :
1268 case Bytecodes::_iand :
1269 current_frame.pop_stack(
1270 VerificationType::integer_type(), CHECK_VERIFY(this));
1271 // fall through
1272 case Bytecodes::_ineg :
1273 current_frame.pop_stack(
1274 VerificationType::integer_type(), CHECK_VERIFY(this));
1275 current_frame.push_stack(
1276 VerificationType::integer_type(), CHECK_VERIFY(this));
1277 no_control_flow = false; break;
1278 case Bytecodes::_ladd :
1279 case Bytecodes::_lsub :
1280 case Bytecodes::_lmul :
1281 case Bytecodes::_ldiv :
1282 case Bytecodes::_lrem :
1283 case Bytecodes::_land :
1284 case Bytecodes::_lor :
1285 case Bytecodes::_lxor :
1286 current_frame.pop_stack_2(
1287 VerificationType::long2_type(),
1288 VerificationType::long_type(), CHECK_VERIFY(this));
1289 // fall through
1290 case Bytecodes::_lneg :
1291 current_frame.pop_stack_2(
1292 VerificationType::long2_type(),
1293 VerificationType::long_type(), CHECK_VERIFY(this));
1294 current_frame.push_stack_2(
1295 VerificationType::long_type(),
1296 VerificationType::long2_type(), CHECK_VERIFY(this));
1297 no_control_flow = false; break;
1298 case Bytecodes::_lshl :
1299 case Bytecodes::_lshr :
1300 case Bytecodes::_lushr :
1301 current_frame.pop_stack(
1302 VerificationType::integer_type(), CHECK_VERIFY(this));
1303 current_frame.pop_stack_2(
1304 VerificationType::long2_type(),
1305 VerificationType::long_type(), CHECK_VERIFY(this));
1306 current_frame.push_stack_2(
1307 VerificationType::long_type(),
1308 VerificationType::long2_type(), CHECK_VERIFY(this));
1309 no_control_flow = false; break;
1310 case Bytecodes::_fadd :
1311 case Bytecodes::_fsub :
1312 case Bytecodes::_fmul :
1313 case Bytecodes::_fdiv :
1314 case Bytecodes::_frem :
1315 current_frame.pop_stack(
1316 VerificationType::float_type(), CHECK_VERIFY(this));
1317 // fall through
1318 case Bytecodes::_fneg :
1319 current_frame.pop_stack(
1320 VerificationType::float_type(), CHECK_VERIFY(this));
1321 current_frame.push_stack(
1322 VerificationType::float_type(), CHECK_VERIFY(this));
1323 no_control_flow = false; break;
1324 case Bytecodes::_dadd :
1325 case Bytecodes::_dsub :
1326 case Bytecodes::_dmul :
1327 case Bytecodes::_ddiv :
1328 case Bytecodes::_drem :
1329 current_frame.pop_stack_2(
1330 VerificationType::double2_type(),
1331 VerificationType::double_type(), CHECK_VERIFY(this));
1332 // fall through
1333 case Bytecodes::_dneg :
1334 current_frame.pop_stack_2(
1335 VerificationType::double2_type(),
1336 VerificationType::double_type(), CHECK_VERIFY(this));
1337 current_frame.push_stack_2(
1338 VerificationType::double_type(),
1339 VerificationType::double2_type(), CHECK_VERIFY(this));
1340 no_control_flow = false; break;
1341 case Bytecodes::_iinc :
1342 verify_iinc(bcs.get_index(), ¤t_frame, CHECK_VERIFY(this));
1343 no_control_flow = false; break;
1344 case Bytecodes::_i2l :
1345 type = current_frame.pop_stack(
1346 VerificationType::integer_type(), CHECK_VERIFY(this));
1347 current_frame.push_stack_2(
1348 VerificationType::long_type(),
1349 VerificationType::long2_type(), CHECK_VERIFY(this));
1350 no_control_flow = false; break;
1351 case Bytecodes::_l2i :
1352 current_frame.pop_stack_2(
1353 VerificationType::long2_type(),
1354 VerificationType::long_type(), CHECK_VERIFY(this));
1355 current_frame.push_stack(
1356 VerificationType::integer_type(), CHECK_VERIFY(this));
1357 no_control_flow = false; break;
1358 case Bytecodes::_i2f :
1359 current_frame.pop_stack(
1360 VerificationType::integer_type(), CHECK_VERIFY(this));
1361 current_frame.push_stack(
1362 VerificationType::float_type(), CHECK_VERIFY(this));
1363 no_control_flow = false; break;
1364 case Bytecodes::_i2d :
1365 current_frame.pop_stack(
1366 VerificationType::integer_type(), CHECK_VERIFY(this));
1367 current_frame.push_stack_2(
1368 VerificationType::double_type(),
1369 VerificationType::double2_type(), CHECK_VERIFY(this));
1370 no_control_flow = false; break;
1371 case Bytecodes::_l2f :
1372 current_frame.pop_stack_2(
1373 VerificationType::long2_type(),
1374 VerificationType::long_type(), CHECK_VERIFY(this));
1375 current_frame.push_stack(
1376 VerificationType::float_type(), CHECK_VERIFY(this));
1377 no_control_flow = false; break;
1378 case Bytecodes::_l2d :
1379 current_frame.pop_stack_2(
1380 VerificationType::long2_type(),
1381 VerificationType::long_type(), CHECK_VERIFY(this));
1382 current_frame.push_stack_2(
1383 VerificationType::double_type(),
1384 VerificationType::double2_type(), CHECK_VERIFY(this));
1385 no_control_flow = false; break;
1386 case Bytecodes::_f2i :
1387 current_frame.pop_stack(
1388 VerificationType::float_type(), CHECK_VERIFY(this));
1389 current_frame.push_stack(
1390 VerificationType::integer_type(), CHECK_VERIFY(this));
1391 no_control_flow = false; break;
1392 case Bytecodes::_f2l :
1393 current_frame.pop_stack(
1394 VerificationType::float_type(), CHECK_VERIFY(this));
1395 current_frame.push_stack_2(
1396 VerificationType::long_type(),
1397 VerificationType::long2_type(), CHECK_VERIFY(this));
1398 no_control_flow = false; break;
1399 case Bytecodes::_f2d :
1400 current_frame.pop_stack(
1401 VerificationType::float_type(), CHECK_VERIFY(this));
1402 current_frame.push_stack_2(
1403 VerificationType::double_type(),
1404 VerificationType::double2_type(), CHECK_VERIFY(this));
1405 no_control_flow = false; break;
1406 case Bytecodes::_d2i :
1407 current_frame.pop_stack_2(
1408 VerificationType::double2_type(),
1409 VerificationType::double_type(), CHECK_VERIFY(this));
1410 current_frame.push_stack(
1411 VerificationType::integer_type(), CHECK_VERIFY(this));
1412 no_control_flow = false; break;
1413 case Bytecodes::_d2l :
1414 current_frame.pop_stack_2(
1415 VerificationType::double2_type(),
1416 VerificationType::double_type(), CHECK_VERIFY(this));
1417 current_frame.push_stack_2(
1418 VerificationType::long_type(),
1419 VerificationType::long2_type(), CHECK_VERIFY(this));
1420 no_control_flow = false; break;
1421 case Bytecodes::_d2f :
1422 current_frame.pop_stack_2(
1423 VerificationType::double2_type(),
1424 VerificationType::double_type(), CHECK_VERIFY(this));
1425 current_frame.push_stack(
1426 VerificationType::float_type(), CHECK_VERIFY(this));
1427 no_control_flow = false; break;
1428 case Bytecodes::_i2b :
1429 case Bytecodes::_i2c :
1430 case Bytecodes::_i2s :
1431 current_frame.pop_stack(
1432 VerificationType::integer_type(), CHECK_VERIFY(this));
1433 current_frame.push_stack(
1434 VerificationType::integer_type(), CHECK_VERIFY(this));
1435 no_control_flow = false; break;
1436 case Bytecodes::_lcmp :
1437 current_frame.pop_stack_2(
1438 VerificationType::long2_type(),
1439 VerificationType::long_type(), CHECK_VERIFY(this));
1440 current_frame.pop_stack_2(
1441 VerificationType::long2_type(),
1442 VerificationType::long_type(), CHECK_VERIFY(this));
1443 current_frame.push_stack(
1444 VerificationType::integer_type(), CHECK_VERIFY(this));
1445 no_control_flow = false; break;
1446 case Bytecodes::_fcmpl :
1447 case Bytecodes::_fcmpg :
1448 current_frame.pop_stack(
1449 VerificationType::float_type(), CHECK_VERIFY(this));
1450 current_frame.pop_stack(
1451 VerificationType::float_type(), CHECK_VERIFY(this));
1452 current_frame.push_stack(
1453 VerificationType::integer_type(), CHECK_VERIFY(this));
1454 no_control_flow = false; break;
1455 case Bytecodes::_dcmpl :
1456 case Bytecodes::_dcmpg :
1457 current_frame.pop_stack_2(
1458 VerificationType::double2_type(),
1459 VerificationType::double_type(), CHECK_VERIFY(this));
1460 current_frame.pop_stack_2(
1461 VerificationType::double2_type(),
1462 VerificationType::double_type(), CHECK_VERIFY(this));
1463 current_frame.push_stack(
1464 VerificationType::integer_type(), CHECK_VERIFY(this));
1465 no_control_flow = false; break;
1466 case Bytecodes::_if_icmpeq:
1467 case Bytecodes::_if_icmpne:
1468 case Bytecodes::_if_icmplt:
1469 case Bytecodes::_if_icmpge:
1470 case Bytecodes::_if_icmpgt:
1471 case Bytecodes::_if_icmple:
1472 current_frame.pop_stack(
1473 VerificationType::integer_type(), CHECK_VERIFY(this));
1474 // fall through
1475 case Bytecodes::_ifeq:
1476 case Bytecodes::_ifne:
1477 case Bytecodes::_iflt:
1478 case Bytecodes::_ifge:
1479 case Bytecodes::_ifgt:
1480 case Bytecodes::_ifle:
1481 current_frame.pop_stack(
1482 VerificationType::integer_type(), CHECK_VERIFY(this));
1483 target = bcs.dest();
1484 stackmap_table.check_jump_target(
1485 ¤t_frame, target, CHECK_VERIFY(this));
1486 no_control_flow = false; break;
1487 case Bytecodes::_if_acmpeq :
1488 case Bytecodes::_if_acmpne :
1489 current_frame.pop_stack(
1490 VerificationType::reference_check(), CHECK_VERIFY(this));
1491 // fall through
1492 case Bytecodes::_ifnull :
1493 case Bytecodes::_ifnonnull :
1494 current_frame.pop_stack(
1495 VerificationType::reference_check(), CHECK_VERIFY(this));
1496 target = bcs.dest();
1497 stackmap_table.check_jump_target
1498 (¤t_frame, target, CHECK_VERIFY(this));
1499 no_control_flow = false; break;
1500 case Bytecodes::_goto :
1501 target = bcs.dest();
1502 stackmap_table.check_jump_target(
1503 ¤t_frame, target, CHECK_VERIFY(this));
1504 no_control_flow = true; break;
1505 case Bytecodes::_goto_w :
1506 target = bcs.dest_w();
1507 stackmap_table.check_jump_target(
1508 ¤t_frame, target, CHECK_VERIFY(this));
1509 no_control_flow = true; break;
1510 case Bytecodes::_tableswitch :
1511 case Bytecodes::_lookupswitch :
1512 verify_switch(
1513 &bcs, code_length, code_data, ¤t_frame,
1514 &stackmap_table, CHECK_VERIFY(this));
1515 no_control_flow = true; break;
1516 case Bytecodes::_ireturn :
1517 type = current_frame.pop_stack(
1518 VerificationType::integer_type(), CHECK_VERIFY(this));
1519 verify_return_value(return_type, type, bci,
1520 ¤t_frame, CHECK_VERIFY(this));
1521 no_control_flow = true; break;
1522 case Bytecodes::_lreturn :
1523 type2 = current_frame.pop_stack(
1524 VerificationType::long2_type(), CHECK_VERIFY(this));
1525 type = current_frame.pop_stack(
1526 VerificationType::long_type(), CHECK_VERIFY(this));
1527 verify_return_value(return_type, type, bci,
1528 ¤t_frame, CHECK_VERIFY(this));
1529 no_control_flow = true; break;
1530 case Bytecodes::_freturn :
1531 type = current_frame.pop_stack(
1532 VerificationType::float_type(), CHECK_VERIFY(this));
1533 verify_return_value(return_type, type, bci,
1534 ¤t_frame, CHECK_VERIFY(this));
1535 no_control_flow = true; break;
1536 case Bytecodes::_dreturn :
1537 type2 = current_frame.pop_stack(
1538 VerificationType::double2_type(), CHECK_VERIFY(this));
1539 type = current_frame.pop_stack(
1540 VerificationType::double_type(), CHECK_VERIFY(this));
1541 verify_return_value(return_type, type, bci,
1542 ¤t_frame, CHECK_VERIFY(this));
1543 no_control_flow = true; break;
1544 case Bytecodes::_areturn :
1545 type = current_frame.pop_stack(
1546 VerificationType::reference_check(), CHECK_VERIFY(this));
1547 verify_return_value(return_type, type, bci,
1548 ¤t_frame, CHECK_VERIFY(this));
1549 no_control_flow = true; break;
1550 case Bytecodes::_return :
1551 if (return_type != VerificationType::bogus_type()) {
1552 verify_error(ErrorContext::bad_code(bci),
1553 "Method expects a return value");
1554 return;
1555 }
1556 // Make sure "this" has been initialized if current method is an
1557 // <init>
1558 if (_method->name() == vmSymbols::object_initializer_name() &&
1559 current_frame.flag_this_uninit()) {
1560 verify_error(ErrorContext::bad_code(bci),
1561 "Constructor must call super() or this() "
1562 "before return");
1563 return;
1564 }
1565 no_control_flow = true; break;
1566 case Bytecodes::_getstatic :
1567 case Bytecodes::_putstatic :
1568 case Bytecodes::_getfield :
1569 case Bytecodes::_putfield :
1570 verify_field_instructions(
1571 &bcs, ¤t_frame, cp, CHECK_VERIFY(this));
1572 no_control_flow = false; break;
1573 case Bytecodes::_invokevirtual :
1574 case Bytecodes::_invokespecial :
1575 case Bytecodes::_invokestatic :
1576 verify_invoke_instructions(
1577 &bcs, code_length, ¤t_frame, (bci >= ex_min && bci < ex_max),
1578 &this_uninit, return_type, cp, &stackmap_table, CHECK_VERIFY(this));
1579 no_control_flow = false; break;
1580 case Bytecodes::_invokeinterface :
1581 case Bytecodes::_invokedynamic :
1582 verify_invoke_instructions(
1583 &bcs, code_length, ¤t_frame, (bci >= ex_min && bci < ex_max),
1584 &this_uninit, return_type, cp, &stackmap_table, CHECK_VERIFY(this));
1585 no_control_flow = false; break;
1586 case Bytecodes::_new :
1587 {
1588 index = bcs.get_index_u2();
1589 verify_cp_class_type(bci, index, cp, CHECK_VERIFY(this));
1590 VerificationType new_class_type =
1591 cp_index_to_type(index, cp, CHECK_VERIFY(this));
1592 if (!new_class_type.is_object()) {
1593 verify_error(ErrorContext::bad_type(bci,
1594 TypeOrigin::cp(index, new_class_type)),
1595 "Illegal new instruction");
1596 return;
1597 }
1598 type = VerificationType::uninitialized_type(bci);
1599 current_frame.push_stack(type, CHECK_VERIFY(this));
1600 no_control_flow = false; break;
1601 }
1602 case Bytecodes::_newarray :
1603 type = get_newarray_type(bcs.get_index(), bci, CHECK_VERIFY(this));
1604 current_frame.pop_stack(
1605 VerificationType::integer_type(), CHECK_VERIFY(this));
1606 current_frame.push_stack(type, CHECK_VERIFY(this));
1607 no_control_flow = false; break;
1608 case Bytecodes::_anewarray :
1609 verify_anewarray(
1610 bci, bcs.get_index_u2(), cp, ¤t_frame, CHECK_VERIFY(this));
1611 no_control_flow = false; break;
1612 case Bytecodes::_arraylength :
1613 type = current_frame.pop_stack(
1614 VerificationType::reference_check(), CHECK_VERIFY(this));
1615 if (!(type.is_null() || type.is_array())) {
1616 verify_error(ErrorContext::bad_type(
1617 bci, current_frame.stack_top_ctx()),
1618 bad_type_msg, "arraylength");
1619 }
1620 current_frame.push_stack(
1621 VerificationType::integer_type(), CHECK_VERIFY(this));
1622 no_control_flow = false; break;
1623 case Bytecodes::_checkcast :
1624 {
1625 index = bcs.get_index_u2();
1626 verify_cp_class_type(bci, index, cp, CHECK_VERIFY(this));
1627 current_frame.pop_stack(object_type(), CHECK_VERIFY(this));
1628 VerificationType klass_type = cp_index_to_type(
1629 index, cp, CHECK_VERIFY(this));
1630 current_frame.push_stack(klass_type, CHECK_VERIFY(this));
1631 no_control_flow = false; break;
1632 }
1633 case Bytecodes::_instanceof : {
1634 index = bcs.get_index_u2();
1635 verify_cp_class_type(bci, index, cp, CHECK_VERIFY(this));
1636 current_frame.pop_stack(object_type(), CHECK_VERIFY(this));
1637 current_frame.push_stack(
1638 VerificationType::integer_type(), CHECK_VERIFY(this));
1639 no_control_flow = false; break;
1640 }
1641 case Bytecodes::_monitorenter :
1642 case Bytecodes::_monitorexit :
1643 current_frame.pop_stack(
1644 VerificationType::reference_check(), CHECK_VERIFY(this));
1645 no_control_flow = false; break;
1646 case Bytecodes::_multianewarray :
1647 {
1648 index = bcs.get_index_u2();
1649 u2 dim = *(bcs.bcp()+3);
1650 verify_cp_class_type(bci, index, cp, CHECK_VERIFY(this));
1651 VerificationType new_array_type =
1652 cp_index_to_type(index, cp, CHECK_VERIFY(this));
1653 if (!new_array_type.is_array()) {
1654 verify_error(ErrorContext::bad_type(bci,
1655 TypeOrigin::cp(index, new_array_type)),
1656 "Illegal constant pool index in multianewarray instruction");
1657 return;
1658 }
1659 if (dim < 1 || new_array_type.dimensions() < dim) {
1660 verify_error(ErrorContext::bad_code(bci),
1661 "Illegal dimension in multianewarray instruction: %d", dim);
1662 return;
1663 }
1664 for (int i = 0; i < dim; i++) {
1665 current_frame.pop_stack(
1666 VerificationType::integer_type(), CHECK_VERIFY(this));
1667 }
1668 current_frame.push_stack(new_array_type, CHECK_VERIFY(this));
1669 no_control_flow = false; break;
1670 }
1671 case Bytecodes::_athrow :
1672 type = VerificationType::reference_type(
1673 vmSymbols::java_lang_Throwable());
1674 current_frame.pop_stack(type, CHECK_VERIFY(this));
1675 no_control_flow = true; break;
1676 default:
1677 // We only need to check the valid bytecodes in class file.
1678 // And jsr and ret are not in the new class file format in JDK1.5.
1679 verify_error(ErrorContext::bad_code(bci),
1680 "Bad instruction: %02x", opcode);
1681 no_control_flow = false;
1682 return;
1683 } // end switch
1684 } // end Merge with the next instruction
1685
1686 // Look for possible jump target in exception handlers and see if it matches
1687 // current_frame. Don't do this check if it has already been done (for
1688 // ([a,d,f,i,l]store* opcodes). This check cannot be done earlier because
1689 // opcodes, such as invokespecial, may set the this_uninit flag.
1690 assert(!(verified_exc_handlers && this_uninit),
1691 "Exception handler targets got verified before this_uninit got set");
1692 if (!verified_exc_handlers && bci >= ex_min && bci < ex_max) {
1693 verify_exception_handler_targets(
1694 bci, this_uninit, ¤t_frame, &stackmap_table, CHECK_VERIFY(this));
1695 }
1696 } // end while
1697
1698 // Make sure that control flow does not fall through end of the method
1699 if (!no_control_flow) {
1700 verify_error(ErrorContext::bad_code(code_length),
1701 "Control flow falls through code end");
1702 return;
1703 }
1704 }
1705
1706 #undef bad_type_message
1707
1708 char* ClassVerifier::generate_code_data(methodHandle m, u4 code_length, TRAPS) {
1709 char* code_data = NEW_RESOURCE_ARRAY(char, code_length);
1710 memset(code_data, 0, sizeof(char) * code_length);
1711 RawBytecodeStream bcs(m);
1712
1713 while (!bcs.is_last_bytecode()) {
1714 if (bcs.raw_next() != Bytecodes::_illegal) {
1715 int bci = bcs.bci();
1716 if (bcs.raw_code() == Bytecodes::_new) {
1717 code_data[bci] = NEW_OFFSET;
1718 } else {
1719 code_data[bci] = BYTECODE_OFFSET;
1720 }
1721 } else {
1722 verify_error(ErrorContext::bad_code(bcs.bci()), "Bad instruction");
1723 return NULL;
1724 }
1725 }
1726
1727 return code_data;
1728 }
1729
1730 void ClassVerifier::verify_exception_handler_table(u4 code_length, char* code_data, int& min, int& max, TRAPS) {
1731 ExceptionTable exhandlers(_method());
1732 int exlength = exhandlers.length();
1733 constantPoolHandle cp (THREAD, _method->constants());
1734
1735 for(int i = 0; i < exlength; i++) {
1736 //reacquire the table in case a GC happened
1737 ExceptionTable exhandlers(_method());
1738 u2 start_pc = exhandlers.start_pc(i);
1739 u2 end_pc = exhandlers.end_pc(i);
1740 u2 handler_pc = exhandlers.handler_pc(i);
1741 if (start_pc >= code_length || code_data[start_pc] == 0) {
1742 class_format_error("Illegal exception table start_pc %d", start_pc);
1743 return;
1744 }
1745 if (end_pc != code_length) { // special case: end_pc == code_length
1746 if (end_pc > code_length || code_data[end_pc] == 0) {
1747 class_format_error("Illegal exception table end_pc %d", end_pc);
1748 return;
1749 }
1750 }
1751 if (handler_pc >= code_length || code_data[handler_pc] == 0) {
1752 class_format_error("Illegal exception table handler_pc %d", handler_pc);
1753 return;
1754 }
1755 int catch_type_index = exhandlers.catch_type_index(i);
1756 if (catch_type_index != 0) {
1757 VerificationType catch_type = cp_index_to_type(
1758 catch_type_index, cp, CHECK_VERIFY(this));
1759 VerificationType throwable =
1760 VerificationType::reference_type(vmSymbols::java_lang_Throwable());
1761 bool is_subclass = throwable.is_assignable_from(
1762 catch_type, this, false, CHECK_VERIFY(this));
1763 if (!is_subclass) {
1764 // 4286534: should throw VerifyError according to recent spec change
1765 verify_error(ErrorContext::bad_type(handler_pc,
1766 TypeOrigin::cp(catch_type_index, catch_type),
1767 TypeOrigin::implicit(throwable)),
1768 "Catch type is not a subclass "
1769 "of Throwable in exception handler %d", handler_pc);
1770 return;
1771 }
1772 }
1773 if (start_pc < min) min = start_pc;
1774 if (end_pc > max) max = end_pc;
1775 }
1776 }
1777
1778 void ClassVerifier::verify_local_variable_table(u4 code_length, char* code_data, TRAPS) {
1779 int localvariable_table_length = _method()->localvariable_table_length();
1780 if (localvariable_table_length > 0) {
1781 LocalVariableTableElement* table = _method()->localvariable_table_start();
1782 for (int i = 0; i < localvariable_table_length; i++) {
1783 u2 start_bci = table[i].start_bci;
1784 u2 length = table[i].length;
1785
1786 if (start_bci >= code_length || code_data[start_bci] == 0) {
1787 class_format_error(
1788 "Illegal local variable table start_pc %d", start_bci);
1789 return;
1790 }
1791 u4 end_bci = (u4)(start_bci + length);
1792 if (end_bci != code_length) {
1793 if (end_bci >= code_length || code_data[end_bci] == 0) {
1794 class_format_error( "Illegal local variable table length %d", length);
1795 return;
1796 }
1797 }
1798 }
1799 }
1800 }
1801
1802 u2 ClassVerifier::verify_stackmap_table(u2 stackmap_index, u2 bci,
1803 StackMapFrame* current_frame,
1804 StackMapTable* stackmap_table,
1805 bool no_control_flow, TRAPS) {
1806 if (stackmap_index < stackmap_table->get_frame_count()) {
1807 u2 this_offset = stackmap_table->get_offset(stackmap_index);
1808 if (no_control_flow && this_offset > bci) {
1809 verify_error(ErrorContext::missing_stackmap(bci),
1810 "Expecting a stack map frame");
1811 return 0;
1812 }
1813 if (this_offset == bci) {
1814 ErrorContext ctx;
1815 // See if current stack map can be assigned to the frame in table.
1816 // current_frame is the stackmap frame got from the last instruction.
1817 // If matched, current_frame will be updated by this method.
1818 bool matches = stackmap_table->match_stackmap(
1819 current_frame, this_offset, stackmap_index,
1820 !no_control_flow, true, &ctx, CHECK_VERIFY_(this, 0));
1821 if (!matches) {
1822 // report type error
1823 verify_error(ctx, "Instruction type does not match stack map");
1824 return 0;
1825 }
1826 stackmap_index++;
1827 } else if (this_offset < bci) {
1828 // current_offset should have met this_offset.
1829 class_format_error("Bad stack map offset %d", this_offset);
1830 return 0;
1831 }
1832 } else if (no_control_flow) {
1833 verify_error(ErrorContext::bad_code(bci), "Expecting a stack map frame");
1834 return 0;
1835 }
1836 return stackmap_index;
1837 }
1838
1839 void ClassVerifier::verify_exception_handler_targets(u2 bci, bool this_uninit, StackMapFrame* current_frame,
1840 StackMapTable* stackmap_table, TRAPS) {
1841 constantPoolHandle cp (THREAD, _method->constants());
1842 ExceptionTable exhandlers(_method());
1843 int exlength = exhandlers.length();
1844 for(int i = 0; i < exlength; i++) {
1845 //reacquire the table in case a GC happened
1846 ExceptionTable exhandlers(_method());
1847 u2 start_pc = exhandlers.start_pc(i);
1848 u2 end_pc = exhandlers.end_pc(i);
1849 u2 handler_pc = exhandlers.handler_pc(i);
1850 int catch_type_index = exhandlers.catch_type_index(i);
1851 if(bci >= start_pc && bci < end_pc) {
1852 u1 flags = current_frame->flags();
1853 if (this_uninit) { flags |= FLAG_THIS_UNINIT; }
1854 StackMapFrame* new_frame = current_frame->frame_in_exception_handler(flags);
1855 if (catch_type_index != 0) {
1856 // We know that this index refers to a subclass of Throwable
1857 VerificationType catch_type = cp_index_to_type(
1858 catch_type_index, cp, CHECK_VERIFY(this));
1859 new_frame->push_stack(catch_type, CHECK_VERIFY(this));
1860 } else {
1861 VerificationType throwable =
1862 VerificationType::reference_type(vmSymbols::java_lang_Throwable());
1863 new_frame->push_stack(throwable, CHECK_VERIFY(this));
1864 }
1865 ErrorContext ctx;
1866 bool matches = stackmap_table->match_stackmap(
1867 new_frame, handler_pc, true, false, &ctx, CHECK_VERIFY(this));
1868 if (!matches) {
1869 verify_error(ctx, "Stack map does not match the one at "
1870 "exception handler %d", handler_pc);
1871 return;
1872 }
1873 }
1874 }
1875 }
1876
1877 void ClassVerifier::verify_cp_index(
1878 u2 bci, constantPoolHandle cp, int index, TRAPS) {
1879 int nconstants = cp->length();
1880 if ((index <= 0) || (index >= nconstants)) {
1881 verify_error(ErrorContext::bad_cp_index(bci, index),
1882 "Illegal constant pool index %d in class %s",
1883 index, cp->pool_holder()->external_name());
1884 return;
1885 }
1886 }
1887
1888 void ClassVerifier::verify_cp_type(
1889 u2 bci, int index, constantPoolHandle cp, unsigned int types, TRAPS) {
1890
1891 // In some situations, bytecode rewriting may occur while we're verifying.
1892 // In this case, a constant pool cache exists and some indices refer to that
1893 // instead. Be sure we don't pick up such indices by accident.
1894 // We must check was_recursively_verified() before we get here.
1895 guarantee(cp->cache() == NULL, "not rewritten yet");
1896
1897 verify_cp_index(bci, cp, index, CHECK_VERIFY(this));
1898 unsigned int tag = cp->tag_at(index).value();
1899 if ((types & (1 << tag)) == 0) {
1900 verify_error(ErrorContext::bad_cp_index(bci, index),
1901 "Illegal type at constant pool entry %d in class %s",
1902 index, cp->pool_holder()->external_name());
1903 return;
1904 }
1905 }
1906
1907 void ClassVerifier::verify_cp_class_type(
1908 u2 bci, int index, constantPoolHandle cp, TRAPS) {
1909 verify_cp_index(bci, cp, index, CHECK_VERIFY(this));
1910 constantTag tag = cp->tag_at(index);
1911 if (!tag.is_klass() && !tag.is_unresolved_klass()) {
1912 verify_error(ErrorContext::bad_cp_index(bci, index),
1913 "Illegal type at constant pool entry %d in class %s",
1914 index, cp->pool_holder()->external_name());
1915 return;
1916 }
1917 }
1918
1919 void ClassVerifier::verify_error(ErrorContext ctx, const char* msg, ...) {
1920 stringStream ss;
1921
1922 ctx.reset_frames();
1923 _exception_type = vmSymbols::java_lang_VerifyError();
1924 _error_context = ctx;
1925 va_list va;
1926 va_start(va, msg);
1927 ss.vprint(msg, va);
1928 va_end(va);
1929 _message = ss.as_string();
1930 #ifdef ASSERT
1931 ResourceMark rm;
1932 const char* exception_name = _exception_type->as_C_string();
1933 Exceptions::debug_check_abort(exception_name, NULL);
1934 #endif // ndef ASSERT
1935 }
1936
1937 void ClassVerifier::class_format_error(const char* msg, ...) {
1938 stringStream ss;
1939 _exception_type = vmSymbols::java_lang_ClassFormatError();
1940 va_list va;
1941 va_start(va, msg);
1942 ss.vprint(msg, va);
1943 va_end(va);
1944 if (!_method.is_null()) {
1945 ss.print(" in method %s", _method->name_and_sig_as_C_string());
1946 }
1947 _message = ss.as_string();
1948 }
1949
1950 Klass* ClassVerifier::load_class(Symbol* name, TRAPS) {
1951 // Get current loader and protection domain first.
1952 oop loader = current_class()->class_loader();
1953 oop protection_domain = current_class()->protection_domain();
1954
1955 return SystemDictionary::resolve_or_fail(
1956 name, Handle(THREAD, loader), Handle(THREAD, protection_domain),
1957 true, CHECK_NULL);
1958 }
1959
1960 bool ClassVerifier::is_protected_access(instanceKlassHandle this_class,
1961 Klass* target_class,
1962 Symbol* field_name,
1963 Symbol* field_sig,
1964 bool is_method) {
1965 No_Safepoint_Verifier nosafepoint;
1966
1967 // If target class isn't a super class of this class, we don't worry about this case
1968 if (!this_class->is_subclass_of(target_class)) {
1969 return false;
1970 }
1971 // Check if the specified method or field is protected
1972 InstanceKlass* target_instance = InstanceKlass::cast(target_class);
1973 fieldDescriptor fd;
1974 if (is_method) {
1975 Method* m = target_instance->uncached_lookup_method(field_name, field_sig, Klass::find_overpass);
1976 if (m != NULL && m->is_protected()) {
1977 if (!this_class->is_same_class_package(m->method_holder())) {
1978 return true;
1979 }
1980 }
1981 } else {
1982 Klass* member_klass = target_instance->find_field(field_name, field_sig, &fd);
1983 if (member_klass != NULL && fd.is_protected()) {
1984 if (!this_class->is_same_class_package(member_klass)) {
1985 return true;
1986 }
1987 }
1988 }
1989 return false;
1990 }
1991
1992 void ClassVerifier::verify_ldc(
1993 int opcode, u2 index, StackMapFrame* current_frame,
1994 constantPoolHandle cp, u2 bci, TRAPS) {
1995 verify_cp_index(bci, cp, index, CHECK_VERIFY(this));
1996 constantTag tag = cp->tag_at(index);
1997 unsigned int types;
1998 if (opcode == Bytecodes::_ldc || opcode == Bytecodes::_ldc_w) {
1999 if (!tag.is_unresolved_klass()) {
2000 types = (1 << JVM_CONSTANT_Integer) | (1 << JVM_CONSTANT_Float)
2001 | (1 << JVM_CONSTANT_String) | (1 << JVM_CONSTANT_Class)
2002 | (1 << JVM_CONSTANT_MethodHandle) | (1 << JVM_CONSTANT_MethodType);
2003 // Note: The class file parser already verified the legality of
2004 // MethodHandle and MethodType constants.
2005 verify_cp_type(bci, index, cp, types, CHECK_VERIFY(this));
2006 }
2007 } else {
2008 assert(opcode == Bytecodes::_ldc2_w, "must be ldc2_w");
2009 types = (1 << JVM_CONSTANT_Double) | (1 << JVM_CONSTANT_Long);
2010 verify_cp_type(bci, index, cp, types, CHECK_VERIFY(this));
2011 }
2012 if (tag.is_string() && cp->is_pseudo_string_at(index)) {
2013 current_frame->push_stack(object_type(), CHECK_VERIFY(this));
2014 } else if (tag.is_string()) {
2015 current_frame->push_stack(
2016 VerificationType::reference_type(
2017 vmSymbols::java_lang_String()), CHECK_VERIFY(this));
2018 } else if (tag.is_klass() || tag.is_unresolved_klass()) {
2019 current_frame->push_stack(
2020 VerificationType::reference_type(
2021 vmSymbols::java_lang_Class()), CHECK_VERIFY(this));
2022 } else if (tag.is_int()) {
2023 current_frame->push_stack(
2024 VerificationType::integer_type(), CHECK_VERIFY(this));
2025 } else if (tag.is_float()) {
2026 current_frame->push_stack(
2027 VerificationType::float_type(), CHECK_VERIFY(this));
2028 } else if (tag.is_double()) {
2029 current_frame->push_stack_2(
2030 VerificationType::double_type(),
2031 VerificationType::double2_type(), CHECK_VERIFY(this));
2032 } else if (tag.is_long()) {
2033 current_frame->push_stack_2(
2034 VerificationType::long_type(),
2035 VerificationType::long2_type(), CHECK_VERIFY(this));
2036 } else if (tag.is_method_handle()) {
2037 current_frame->push_stack(
2038 VerificationType::reference_type(
2039 vmSymbols::java_lang_invoke_MethodHandle()), CHECK_VERIFY(this));
2040 } else if (tag.is_method_type()) {
2041 current_frame->push_stack(
2042 VerificationType::reference_type(
2043 vmSymbols::java_lang_invoke_MethodType()), CHECK_VERIFY(this));
2044 } else {
2045 /* Unreachable? verify_cp_type has already validated the cp type. */
2046 verify_error(
2047 ErrorContext::bad_cp_index(bci, index), "Invalid index in ldc");
2048 return;
2049 }
2050 }
2051
2052 void ClassVerifier::verify_switch(
2053 RawBytecodeStream* bcs, u4 code_length, char* code_data,
2054 StackMapFrame* current_frame, StackMapTable* stackmap_table, TRAPS) {
2055 int bci = bcs->bci();
2056 address bcp = bcs->bcp();
2057 address aligned_bcp = (address) round_to((intptr_t)(bcp + 1), jintSize);
2058
2059 if (_klass->major_version() < NONZERO_PADDING_BYTES_IN_SWITCH_MAJOR_VERSION) {
2060 // 4639449 & 4647081: padding bytes must be 0
2061 u2 padding_offset = 1;
2062 while ((bcp + padding_offset) < aligned_bcp) {
2063 if(*(bcp + padding_offset) != 0) {
2064 verify_error(ErrorContext::bad_code(bci),
2065 "Nonzero padding byte in lookswitch or tableswitch");
2066 return;
2067 }
2068 padding_offset++;
2069 }
2070 }
2071
2072 int default_offset = (int) Bytes::get_Java_u4(aligned_bcp);
2073 int keys, delta;
2074 current_frame->pop_stack(
2075 VerificationType::integer_type(), CHECK_VERIFY(this));
2076 if (bcs->raw_code() == Bytecodes::_tableswitch) {
2077 jint low = (jint)Bytes::get_Java_u4(aligned_bcp + jintSize);
2078 jint high = (jint)Bytes::get_Java_u4(aligned_bcp + 2*jintSize);
2079 if (low > high) {
2080 verify_error(ErrorContext::bad_code(bci),
2081 "low must be less than or equal to high in tableswitch");
2082 return;
2083 }
2084 keys = high - low + 1;
2085 if (keys < 0) {
2086 verify_error(ErrorContext::bad_code(bci), "too many keys in tableswitch");
2087 return;
2088 }
2089 delta = 1;
2090 } else {
2091 keys = (int)Bytes::get_Java_u4(aligned_bcp + jintSize);
2092 if (keys < 0) {
2093 verify_error(ErrorContext::bad_code(bci),
2094 "number of keys in lookupswitch less than 0");
2095 return;
2096 }
2097 delta = 2;
2098 // Make sure that the lookupswitch items are sorted
2099 for (int i = 0; i < (keys - 1); i++) {
2100 jint this_key = Bytes::get_Java_u4(aligned_bcp + (2+2*i)*jintSize);
2101 jint next_key = Bytes::get_Java_u4(aligned_bcp + (2+2*i+2)*jintSize);
2102 if (this_key >= next_key) {
2103 verify_error(ErrorContext::bad_code(bci),
2104 "Bad lookupswitch instruction");
2105 return;
2106 }
2107 }
2108 }
2109 int target = bci + default_offset;
2110 stackmap_table->check_jump_target(current_frame, target, CHECK_VERIFY(this));
2111 for (int i = 0; i < keys; i++) {
2112 // Because check_jump_target() may safepoint, the bytecode could have
2113 // moved, which means 'aligned_bcp' is no good and needs to be recalculated.
2114 aligned_bcp = (address)round_to((intptr_t)(bcs->bcp() + 1), jintSize);
2115 target = bci + (jint)Bytes::get_Java_u4(aligned_bcp+(3+i*delta)*jintSize);
2116 stackmap_table->check_jump_target(
2117 current_frame, target, CHECK_VERIFY(this));
2118 }
2119 NOT_PRODUCT(aligned_bcp = NULL); // no longer valid at this point
2120 }
2121
2122 bool ClassVerifier::name_in_supers(
2123 Symbol* ref_name, instanceKlassHandle current) {
2124 Klass* super = current->super();
2125 while (super != NULL) {
2126 if (super->name() == ref_name) {
2127 return true;
2128 }
2129 super = super->super();
2130 }
2131 return false;
2132 }
2133
2134 void ClassVerifier::verify_field_instructions(RawBytecodeStream* bcs,
2135 StackMapFrame* current_frame,
2136 constantPoolHandle cp,
2137 TRAPS) {
2138 u2 index = bcs->get_index_u2();
2139 verify_cp_type(bcs->bci(), index, cp,
2140 1 << JVM_CONSTANT_Fieldref, CHECK_VERIFY(this));
2141
2142 // Get field name and signature
2143 Symbol* field_name = cp->name_ref_at(index);
2144 Symbol* field_sig = cp->signature_ref_at(index);
2145
2146 if (!SignatureVerifier::is_valid_type_signature(field_sig)) {
2147 class_format_error(
2148 "Invalid signature for field in class %s referenced "
2149 "from constant pool index %d", _klass->external_name(), index);
2150 return;
2151 }
2152
2153 // Get referenced class type
2154 VerificationType ref_class_type = cp_ref_index_to_type(
2155 index, cp, CHECK_VERIFY(this));
2156 if (!ref_class_type.is_object()) {
2157 /* Unreachable? Class file parser verifies Fieldref contents */
2158 verify_error(ErrorContext::bad_type(bcs->bci(),
2159 TypeOrigin::cp(index, ref_class_type)),
2160 "Expecting reference to class in class %s at constant pool index %d",
2161 _klass->external_name(), index);
2162 return;
2163 }
2164 VerificationType target_class_type = ref_class_type;
2165
2166 assert(sizeof(VerificationType) == sizeof(uintptr_t),
2167 "buffer type must match VerificationType size");
2168 uintptr_t field_type_buffer[2];
2169 VerificationType* field_type = (VerificationType*)field_type_buffer;
2170 // If we make a VerificationType[2] array directly, the compiler calls
2171 // to the c-runtime library to do the allocation instead of just
2172 // stack allocating it. Plus it would run constructors. This shows up
2173 // in performance profiles.
2174
2175 SignatureStream sig_stream(field_sig, false);
2176 VerificationType stack_object_type;
2177 int n = change_sig_to_verificationType(
2178 &sig_stream, field_type, CHECK_VERIFY(this));
2179 u2 bci = bcs->bci();
2180 bool is_assignable;
2181 switch (bcs->raw_code()) {
2182 case Bytecodes::_getstatic: {
2183 for (int i = 0; i < n; i++) {
2184 current_frame->push_stack(field_type[i], CHECK_VERIFY(this));
2185 }
2186 break;
2187 }
2188 case Bytecodes::_putstatic: {
2189 for (int i = n - 1; i >= 0; i--) {
2190 current_frame->pop_stack(field_type[i], CHECK_VERIFY(this));
2191 }
2192 break;
2193 }
2194 case Bytecodes::_getfield: {
2195 stack_object_type = current_frame->pop_stack(
2196 target_class_type, CHECK_VERIFY(this));
2197 for (int i = 0; i < n; i++) {
2198 current_frame->push_stack(field_type[i], CHECK_VERIFY(this));
2199 }
2200 goto check_protected;
2201 }
2202 case Bytecodes::_putfield: {
2203 for (int i = n - 1; i >= 0; i--) {
2204 current_frame->pop_stack(field_type[i], CHECK_VERIFY(this));
2205 }
2206 stack_object_type = current_frame->pop_stack(CHECK_VERIFY(this));
2207
2208 // The JVMS 2nd edition allows field initialization before the superclass
2209 // initializer, if the field is defined within the current class.
2210 fieldDescriptor fd;
2211 if (stack_object_type == VerificationType::uninitialized_this_type() &&
2212 target_class_type.equals(current_type()) &&
2213 _klass->find_local_field(field_name, field_sig, &fd)) {
2214 stack_object_type = current_type();
2215 }
2216 is_assignable = target_class_type.is_assignable_from(
2217 stack_object_type, this, false, CHECK_VERIFY(this));
2218 if (!is_assignable) {
2219 verify_error(ErrorContext::bad_type(bci,
2220 current_frame->stack_top_ctx(),
2221 TypeOrigin::cp(index, target_class_type)),
2222 "Bad type on operand stack in putfield");
2223 return;
2224 }
2225 }
2226 check_protected: {
2227 if (_this_type == stack_object_type)
2228 break; // stack_object_type must be assignable to _current_class_type
2229 Symbol* ref_class_name =
2230 cp->klass_name_at(cp->klass_ref_index_at(index));
2231 if (!name_in_supers(ref_class_name, current_class()))
2232 // stack_object_type must be assignable to _current_class_type since:
2233 // 1. stack_object_type must be assignable to ref_class.
2234 // 2. ref_class must be _current_class or a subclass of it. It can't
2235 // be a superclass of it. See revised JVMS 5.4.4.
2236 break;
2237
2238 Klass* ref_class_oop = load_class(ref_class_name, CHECK);
2239 if (is_protected_access(current_class(), ref_class_oop, field_name,
2240 field_sig, false)) {
2241 // It's protected access, check if stack object is assignable to
2242 // current class.
2243 is_assignable = current_type().is_assignable_from(
2244 stack_object_type, this, true, CHECK_VERIFY(this));
2245 if (!is_assignable) {
2246 verify_error(ErrorContext::bad_type(bci,
2247 current_frame->stack_top_ctx(),
2248 TypeOrigin::implicit(current_type())),
2249 "Bad access to protected data in getfield");
2250 return;
2251 }
2252 }
2253 break;
2254 }
2255 default: ShouldNotReachHere();
2256 }
2257 }
2258
2259 // Look at the method's handlers. If the bci is in the handler's try block
2260 // then check if the handler_pc is already on the stack. If not, push it
2261 // unless the handler has already been scanned.
2262 void ClassVerifier::push_handlers(ExceptionTable* exhandlers,
2263 GrowableArray<u4>* handler_list,
2264 GrowableArray<u4>* handler_stack,
2265 u4 bci) {
2266 int exlength = exhandlers->length();
2267 for(int x = 0; x < exlength; x++) {
2268 if (bci >= exhandlers->start_pc(x) && bci < exhandlers->end_pc(x)) {
2269 u4 exhandler_pc = exhandlers->handler_pc(x);
2270 if (!handler_list->contains(exhandler_pc)) {
2271 handler_stack->append_if_missing(exhandler_pc);
2272 handler_list->append(exhandler_pc);
2273 }
2274 }
2275 }
2276 }
2277
2278 // Return TRUE if all code paths starting with start_bc_offset end in
2279 // bytecode athrow or loop.
2280 bool ClassVerifier::ends_in_athrow(u4 start_bc_offset) {
2281 ResourceMark rm;
2282 // Create bytecode stream.
2283 RawBytecodeStream bcs(method());
2284 u4 code_length = method()->code_size();
2285 bcs.set_start(start_bc_offset);
2286 u4 target;
2287 // Create stack for storing bytecode start offsets for if* and *switch.
2288 GrowableArray<u4>* bci_stack = new GrowableArray<u4>(30);
2289 // Create stack for handlers for try blocks containing this handler.
2290 GrowableArray<u4>* handler_stack = new GrowableArray<u4>(30);
2291 // Create list of handlers that have been pushed onto the handler_stack
2292 // so that handlers embedded inside of their own TRY blocks only get
2293 // scanned once.
2294 GrowableArray<u4>* handler_list = new GrowableArray<u4>(30);
2295 // Create list of visited branch opcodes (goto* and if*).
2296 GrowableArray<u4>* visited_branches = new GrowableArray<u4>(30);
2297 ExceptionTable exhandlers(_method());
2298
2299 while (true) {
2300 if (bcs.is_last_bytecode()) {
2301 // if no more starting offsets to parse or if at the end of the
2302 // method then return false.
2303 if ((bci_stack->is_empty()) || ((u4)bcs.end_bci() == code_length))
2304 return false;
2305 // Pop a bytecode starting offset and scan from there.
2306 bcs.set_start(bci_stack->pop());
2307 }
2308 Bytecodes::Code opcode = bcs.raw_next();
2309 u4 bci = bcs.bci();
2310
2311 // If the bytecode is in a TRY block, push its handlers so they
2312 // will get parsed.
2313 push_handlers(&exhandlers, handler_list, handler_stack, bci);
2314
2315 switch (opcode) {
2316 case Bytecodes::_if_icmpeq:
2317 case Bytecodes::_if_icmpne:
2318 case Bytecodes::_if_icmplt:
2319 case Bytecodes::_if_icmpge:
2320 case Bytecodes::_if_icmpgt:
2321 case Bytecodes::_if_icmple:
2322 case Bytecodes::_ifeq:
2323 case Bytecodes::_ifne:
2324 case Bytecodes::_iflt:
2325 case Bytecodes::_ifge:
2326 case Bytecodes::_ifgt:
2327 case Bytecodes::_ifle:
2328 case Bytecodes::_if_acmpeq:
2329 case Bytecodes::_if_acmpne:
2330 case Bytecodes::_ifnull:
2331 case Bytecodes::_ifnonnull:
2332 target = bcs.dest();
2333 if (visited_branches->contains(bci)) {
2334 if (bci_stack->is_empty()) {
2335 if (handler_stack->is_empty()) {
2336 return true;
2337 } else {
2338 // Parse the catch handlers for try blocks containing athrow.
2339 bcs.set_start(handler_stack->pop());
2340 }
2341 } else {
2342 // Pop a bytecode starting offset and scan from there.
2343 bcs.set_start(bci_stack->pop());
2344 }
2345 } else {
2346 if (target > bci) { // forward branch
2347 if (target >= code_length) return false;
2348 // Push the branch target onto the stack.
2349 bci_stack->push(target);
2350 // then, scan bytecodes starting with next.
2351 bcs.set_start(bcs.next_bci());
2352 } else { // backward branch
2353 // Push bytecode offset following backward branch onto the stack.
2354 bci_stack->push(bcs.next_bci());
2355 // Check bytecodes starting with branch target.
2356 bcs.set_start(target);
2357 }
2358 // Record target so we don't branch here again.
2359 visited_branches->append(bci);
2360 }
2361 break;
2362
2363 case Bytecodes::_goto:
2364 case Bytecodes::_goto_w:
2365 target = (opcode == Bytecodes::_goto ? bcs.dest() : bcs.dest_w());
2366 if (visited_branches->contains(bci)) {
2367 if (bci_stack->is_empty()) {
2368 if (handler_stack->is_empty()) {
2369 return true;
2370 } else {
2371 // Parse the catch handlers for try blocks containing athrow.
2372 bcs.set_start(handler_stack->pop());
2373 }
2374 } else {
2375 // Been here before, pop new starting offset from stack.
2376 bcs.set_start(bci_stack->pop());
2377 }
2378 } else {
2379 if (target >= code_length) return false;
2380 // Continue scanning from the target onward.
2381 bcs.set_start(target);
2382 // Record target so we don't branch here again.
2383 visited_branches->append(bci);
2384 }
2385 break;
2386
2387 // Check that all switch alternatives end in 'athrow' bytecodes. Since it
2388 // is difficult to determine where each switch alternative ends, parse
2389 // each switch alternative until either hit a 'return', 'athrow', or reach
2390 // the end of the method's bytecodes. This is gross but should be okay
2391 // because:
2392 // 1. tableswitch and lookupswitch byte codes in handlers for ctor explicit
2393 // constructor invocations should be rare.
2394 // 2. if each switch alternative ends in an athrow then the parsing should be
2395 // short. If there is no athrow then it is bogus code, anyway.
2396 case Bytecodes::_lookupswitch:
2397 case Bytecodes::_tableswitch:
2398 {
2399 address aligned_bcp = (address) round_to((intptr_t)(bcs.bcp() + 1), jintSize);
2400 u4 default_offset = Bytes::get_Java_u4(aligned_bcp) + bci;
2401 int keys, delta;
2402 if (opcode == Bytecodes::_tableswitch) {
2403 jint low = (jint)Bytes::get_Java_u4(aligned_bcp + jintSize);
2404 jint high = (jint)Bytes::get_Java_u4(aligned_bcp + 2*jintSize);
2405 // This is invalid, but let the regular bytecode verifier
2406 // report this because the user will get a better error message.
2407 if (low > high) return true;
2408 keys = high - low + 1;
2409 delta = 1;
2410 } else {
2411 keys = (int)Bytes::get_Java_u4(aligned_bcp + jintSize);
2412 delta = 2;
2413 }
2414 // Invalid, let the regular bytecode verifier deal with it.
2415 if (keys < 0) return true;
2416
2417 // Push the offset of the next bytecode onto the stack.
2418 bci_stack->push(bcs.next_bci());
2419
2420 // Push the switch alternatives onto the stack.
2421 for (int i = 0; i < keys; i++) {
2422 u4 target = bci + (jint)Bytes::get_Java_u4(aligned_bcp+(3+i*delta)*jintSize);
2423 if (target > code_length) return false;
2424 bci_stack->push(target);
2425 }
2426
2427 // Start bytecode parsing for the switch at the default alternative.
2428 if (default_offset > code_length) return false;
2429 bcs.set_start(default_offset);
2430 break;
2431 }
2432
2433 case Bytecodes::_return:
2434 return false;
2435
2436 case Bytecodes::_athrow:
2437 {
2438 if (bci_stack->is_empty()) {
2439 if (handler_stack->is_empty()) {
2440 return true;
2441 } else {
2442 // Parse the catch handlers for try blocks containing athrow.
2443 bcs.set_start(handler_stack->pop());
2444 }
2445 } else {
2446 // Pop a bytecode offset and starting scanning from there.
2447 bcs.set_start(bci_stack->pop());
2448 }
2449 }
2450 break;
2451
2452 default:
2453 ;
2454 } // end switch
2455 } // end while loop
2456
2457 return false;
2458 }
2459
2460 void ClassVerifier::verify_invoke_init(
2461 RawBytecodeStream* bcs, u2 ref_class_index, VerificationType ref_class_type,
2462 StackMapFrame* current_frame, u4 code_length, bool in_try_block,
2463 bool *this_uninit, constantPoolHandle cp, StackMapTable* stackmap_table,
2464 TRAPS) {
2465 u2 bci = bcs->bci();
2466 VerificationType type = current_frame->pop_stack(
2467 VerificationType::reference_check(), CHECK_VERIFY(this));
2468 if (type == VerificationType::uninitialized_this_type()) {
2469 // The method must be an <init> method of this class or its superclass
2470 Klass* superk = current_class()->super();
2471 if (ref_class_type.name() != current_class()->name() &&
2472 ref_class_type.name() != superk->name()) {
2473 verify_error(ErrorContext::bad_type(bci,
2474 TypeOrigin::implicit(ref_class_type),
2475 TypeOrigin::implicit(current_type())),
2476 "Bad <init> method call");
2477 return;
2478 }
2479
2480 // If this invokespecial call is done from inside of a TRY block then make
2481 // sure that all catch clause paths end in a throw. Otherwise, this can
2482 // result in returning an incomplete object.
2483 if (in_try_block) {
2484 ExceptionTable exhandlers(_method());
2485 int exlength = exhandlers.length();
2486 for(int i = 0; i < exlength; i++) {
2487 u2 start_pc = exhandlers.start_pc(i);
2488 u2 end_pc = exhandlers.end_pc(i);
2489
2490 if (bci >= start_pc && bci < end_pc) {
2491 if (!ends_in_athrow(exhandlers.handler_pc(i))) {
2492 verify_error(ErrorContext::bad_code(bci),
2493 "Bad <init> method call from after the start of a try block");
2494 return;
2495 } else if (VerboseVerification) {
2496 ResourceMark rm;
2497 tty->print_cr(
2498 "Survived call to ends_in_athrow(): %s",
2499 current_class()->name()->as_C_string());
2500 }
2501 }
2502 }
2503
2504 // Check the exception handler target stackmaps with the locals from the
2505 // incoming stackmap (before initialize_object() changes them to outgoing
2506 // state).
2507 verify_exception_handler_targets(bci, true, current_frame,
2508 stackmap_table, CHECK_VERIFY(this));
2509 } // in_try_block
2510
2511 current_frame->initialize_object(type, current_type());
2512 *this_uninit = true;
2513 } else if (type.is_uninitialized()) {
2514 u2 new_offset = type.bci();
2515 address new_bcp = bcs->bcp() - bci + new_offset;
2516 if (new_offset > (code_length - 3) || (*new_bcp) != Bytecodes::_new) {
2517 /* Unreachable? Stack map parsing ensures valid type and new
2518 * instructions have a valid BCI. */
2519 verify_error(ErrorContext::bad_code(new_offset),
2520 "Expecting new instruction");
2521 return;
2522 }
2523 u2 new_class_index = Bytes::get_Java_u2(new_bcp + 1);
2524 verify_cp_class_type(bci, new_class_index, cp, CHECK_VERIFY(this));
2525
2526 // The method must be an <init> method of the indicated class
2527 VerificationType new_class_type = cp_index_to_type(
2528 new_class_index, cp, CHECK_VERIFY(this));
2529 if (!new_class_type.equals(ref_class_type)) {
2530 verify_error(ErrorContext::bad_type(bci,
2531 TypeOrigin::cp(new_class_index, new_class_type),
2532 TypeOrigin::cp(ref_class_index, ref_class_type)),
2533 "Call to wrong <init> method");
2534 return;
2535 }
2536 // According to the VM spec, if the referent class is a superclass of the
2537 // current class, and is in a different runtime package, and the method is
2538 // protected, then the objectref must be the current class or a subclass
2539 // of the current class.
2540 VerificationType objectref_type = new_class_type;
2541 if (name_in_supers(ref_class_type.name(), current_class())) {
2542 Klass* ref_klass = load_class(ref_class_type.name(), CHECK);
2543 Method* m = InstanceKlass::cast(ref_klass)->uncached_lookup_method(
2544 vmSymbols::object_initializer_name(),
2545 cp->signature_ref_at(bcs->get_index_u2()), Klass::find_overpass);
2546 // Do nothing if method is not found. Let resolution detect the error.
2547 if (m != NULL) {
2548 instanceKlassHandle mh(THREAD, m->method_holder());
2549 if (m->is_protected() && !mh->is_same_class_package(_klass())) {
2550 bool assignable = current_type().is_assignable_from(
2551 objectref_type, this, true, CHECK_VERIFY(this));
2552 if (!assignable) {
2553 verify_error(ErrorContext::bad_type(bci,
2554 TypeOrigin::cp(new_class_index, objectref_type),
2555 TypeOrigin::implicit(current_type())),
2556 "Bad access to protected <init> method");
2557 return;
2558 }
2559 }
2560 }
2561 }
2562 // Check the exception handler target stackmaps with the locals from the
2563 // incoming stackmap (before initialize_object() changes them to outgoing
2564 // state).
2565 if (in_try_block) {
2566 verify_exception_handler_targets(bci, *this_uninit, current_frame,
2567 stackmap_table, CHECK_VERIFY(this));
2568 }
2569 current_frame->initialize_object(type, new_class_type);
2570 } else {
2571 verify_error(ErrorContext::bad_type(bci, current_frame->stack_top_ctx()),
2572 "Bad operand type when invoking <init>");
2573 return;
2574 }
2575 }
2576
2577 bool ClassVerifier::is_same_or_direct_interface(
2578 instanceKlassHandle klass,
2579 VerificationType klass_type,
2580 VerificationType ref_class_type) {
2581 if (ref_class_type.equals(klass_type)) return true;
2582 Array<Klass*>* local_interfaces = klass->local_interfaces();
2583 if (local_interfaces != NULL) {
2584 for (int x = 0; x < local_interfaces->length(); x++) {
2585 Klass* k = local_interfaces->at(x);
2586 assert (k != NULL && k->is_interface(), "invalid interface");
2587 if (ref_class_type.equals(VerificationType::reference_type(k->name()))) {
2588 return true;
2589 }
2590 }
2591 }
2592 return false;
2593 }
2594
2595 void ClassVerifier::verify_invoke_instructions(
2596 RawBytecodeStream* bcs, u4 code_length, StackMapFrame* current_frame,
2597 bool in_try_block, bool *this_uninit, VerificationType return_type,
2598 constantPoolHandle cp, StackMapTable* stackmap_table, TRAPS) {
2599 // Make sure the constant pool item is the right type
2600 u2 index = bcs->get_index_u2();
2601 Bytecodes::Code opcode = bcs->raw_code();
2602 unsigned int types;
2603 switch (opcode) {
2604 case Bytecodes::_invokeinterface:
2605 types = 1 << JVM_CONSTANT_InterfaceMethodref;
2606 break;
2607 case Bytecodes::_invokedynamic:
2608 types = 1 << JVM_CONSTANT_InvokeDynamic;
2609 break;
2610 case Bytecodes::_invokespecial:
2611 case Bytecodes::_invokestatic:
2612 types = (_klass->major_version() < STATIC_METHOD_IN_INTERFACE_MAJOR_VERSION) ?
2613 (1 << JVM_CONSTANT_Methodref) :
2614 ((1 << JVM_CONSTANT_InterfaceMethodref) | (1 << JVM_CONSTANT_Methodref));
2615 break;
2616 default:
2617 types = 1 << JVM_CONSTANT_Methodref;
2618 }
2619 verify_cp_type(bcs->bci(), index, cp, types, CHECK_VERIFY(this));
2620
2621 // Get method name and signature
2622 Symbol* method_name = cp->name_ref_at(index);
2623 Symbol* method_sig = cp->signature_ref_at(index);
2624
2625 if (!SignatureVerifier::is_valid_method_signature(method_sig)) {
2626 class_format_error(
2627 "Invalid method signature in class %s referenced "
2628 "from constant pool index %d", _klass->external_name(), index);
2629 return;
2630 }
2631
2632 // Get referenced class type
2633 VerificationType ref_class_type;
2634 if (opcode == Bytecodes::_invokedynamic) {
2635 if (!EnableInvokeDynamic ||
2636 _klass->major_version() < Verifier::INVOKEDYNAMIC_MAJOR_VERSION) {
2637 if (!EnableInvokeDynamic) {
2638 class_format_error("invokedynamic instructions not enabled in this JVM");
2639 } else {
2640 class_format_error("invokedynamic instructions not supported by this class file version (%d), class %s",
2641 _klass->major_version(), _klass->external_name());
2642 }
2643 return;
2644 }
2645 } else {
2646 ref_class_type = cp_ref_index_to_type(index, cp, CHECK_VERIFY(this));
2647 }
2648
2649 // For a small signature length, we just allocate 128 bytes instead
2650 // of parsing the signature once to find its size.
2651 // -3 is for '(', ')' and return descriptor; multiply by 2 is for
2652 // longs/doubles to be consertive.
2653 assert(sizeof(VerificationType) == sizeof(uintptr_t),
2654 "buffer type must match VerificationType size");
2655 uintptr_t on_stack_sig_types_buffer[128];
2656 // If we make a VerificationType[128] array directly, the compiler calls
2657 // to the c-runtime library to do the allocation instead of just
2658 // stack allocating it. Plus it would run constructors. This shows up
2659 // in performance profiles.
2660
2661 VerificationType* sig_types;
2662 int size = (method_sig->utf8_length() - 3) * 2;
2663 if (size > 128) {
2664 // Long and double occupies two slots here.
2665 ArgumentSizeComputer size_it(method_sig);
2666 size = size_it.size();
2667 sig_types = NEW_RESOURCE_ARRAY_IN_THREAD(THREAD, VerificationType, size);
2668 } else{
2669 sig_types = (VerificationType*)on_stack_sig_types_buffer;
2670 }
2671 SignatureStream sig_stream(method_sig);
2672 int sig_i = 0;
2673 while (!sig_stream.at_return_type()) {
2674 sig_i += change_sig_to_verificationType(
2675 &sig_stream, &sig_types[sig_i], CHECK_VERIFY(this));
2676 sig_stream.next();
2677 }
2678 int nargs = sig_i;
2679
2680 #ifdef ASSERT
2681 {
2682 ArgumentSizeComputer size_it(method_sig);
2683 assert(nargs == size_it.size(), "Argument sizes do not match");
2684 assert(nargs <= (method_sig->utf8_length() - 3) * 2, "estimate of max size isn't conservative enough");
2685 }
2686 #endif
2687
2688 // Check instruction operands
2689 u2 bci = bcs->bci();
2690 if (opcode == Bytecodes::_invokeinterface) {
2691 address bcp = bcs->bcp();
2692 // 4905268: count operand in invokeinterface should be nargs+1, not nargs.
2693 // JSR202 spec: The count operand of an invokeinterface instruction is valid if it is
2694 // the difference between the size of the operand stack before and after the instruction
2695 // executes.
2696 if (*(bcp+3) != (nargs+1)) {
2697 verify_error(ErrorContext::bad_code(bci),
2698 "Inconsistent args count operand in invokeinterface");
2699 return;
2700 }
2701 if (*(bcp+4) != 0) {
2702 verify_error(ErrorContext::bad_code(bci),
2703 "Fourth operand byte of invokeinterface must be zero");
2704 return;
2705 }
2706 }
2707
2708 if (opcode == Bytecodes::_invokedynamic) {
2709 address bcp = bcs->bcp();
2710 if (*(bcp+3) != 0 || *(bcp+4) != 0) {
2711 verify_error(ErrorContext::bad_code(bci),
2712 "Third and fourth operand bytes of invokedynamic must be zero");
2713 return;
2714 }
2715 }
2716
2717 if (method_name->byte_at(0) == '<') {
2718 // Make sure <init> can only be invoked by invokespecial
2719 if (opcode != Bytecodes::_invokespecial ||
2720 method_name != vmSymbols::object_initializer_name()) {
2721 verify_error(ErrorContext::bad_code(bci),
2722 "Illegal call to internal method");
2723 return;
2724 }
2725 } else if (opcode == Bytecodes::_invokespecial
2726 && !is_same_or_direct_interface(current_class(), current_type(), ref_class_type)
2727 && !ref_class_type.equals(VerificationType::reference_type(
2728 current_class()->super()->name()))) {
2729 bool subtype = false;
2730 bool have_imr_indirect = cp->tag_at(index).value() == JVM_CONSTANT_InterfaceMethodref;
2731 if (!current_class()->is_anonymous()) {
2732 subtype = ref_class_type.is_assignable_from(
2733 current_type(), this, false, CHECK_VERIFY(this));
2734 } else {
2735 VerificationType host_klass_type =
2736 VerificationType::reference_type(current_class()->host_klass()->name());
2737 subtype = ref_class_type.is_assignable_from(host_klass_type, this, false, CHECK_VERIFY(this));
2738
2739 // If invokespecial of IMR, need to recheck for same or
2740 // direct interface relative to the host class
2741 have_imr_indirect = (have_imr_indirect &&
2742 !is_same_or_direct_interface(
2743 InstanceKlass::cast(current_class()->host_klass()),
2744 host_klass_type, ref_class_type));
2745 }
2746 if (!subtype) {
2747 verify_error(ErrorContext::bad_code(bci),
2748 "Bad invokespecial instruction: "
2749 "current class isn't assignable to reference class.");
2750 return;
2751 } else if (have_imr_indirect) {
2752 verify_error(ErrorContext::bad_code(bci),
2753 "Bad invokespecial instruction: "
2754 "interface method reference is in an indirect superinterface.");
2755 return;
2756 }
2757
2758 }
2759 // Match method descriptor with operand stack
2760 for (int i = nargs - 1; i >= 0; i--) { // Run backwards
2761 current_frame->pop_stack(sig_types[i], CHECK_VERIFY(this));
2762 }
2763 // Check objectref on operand stack
2764 if (opcode != Bytecodes::_invokestatic &&
2765 opcode != Bytecodes::_invokedynamic) {
2766 if (method_name == vmSymbols::object_initializer_name()) { // <init> method
2767 verify_invoke_init(bcs, index, ref_class_type, current_frame,
2768 code_length, in_try_block, this_uninit, cp, stackmap_table,
2769 CHECK_VERIFY(this));
2770 } else { // other methods
2771 // Ensures that target class is assignable to method class.
2772 if (opcode == Bytecodes::_invokespecial) {
2773 if (!current_class()->is_anonymous()) {
2774 current_frame->pop_stack(current_type(), CHECK_VERIFY(this));
2775 } else {
2776 // anonymous class invokespecial calls: check if the
2777 // objectref is a subtype of the host_klass of the current class
2778 // to allow an anonymous class to reference methods in the host_klass
2779 VerificationType top = current_frame->pop_stack(CHECK_VERIFY(this));
2780 VerificationType hosttype =
2781 VerificationType::reference_type(current_class()->host_klass()->name());
2782 bool subtype = hosttype.is_assignable_from(top, this, false, CHECK_VERIFY(this));
2783 if (!subtype) {
2784 verify_error( ErrorContext::bad_type(current_frame->offset(),
2785 current_frame->stack_top_ctx(),
2786 TypeOrigin::implicit(top)),
2787 "Bad type on operand stack");
2788 return;
2789 }
2790 }
2791 } else if (opcode == Bytecodes::_invokevirtual) {
2792 VerificationType stack_object_type =
2793 current_frame->pop_stack(ref_class_type, CHECK_VERIFY(this));
2794 if (current_type() != stack_object_type) {
2795 assert(cp->cache() == NULL, "not rewritten yet");
2796 Symbol* ref_class_name =
2797 cp->klass_name_at(cp->klass_ref_index_at(index));
2798 // See the comments in verify_field_instructions() for
2799 // the rationale behind this.
2800 if (name_in_supers(ref_class_name, current_class())) {
2801 Klass* ref_class = load_class(ref_class_name, CHECK);
2802 if (is_protected_access(
2803 _klass, ref_class, method_name, method_sig, true)) {
2804 // It's protected access, check if stack object is
2805 // assignable to current class.
2806 bool is_assignable = current_type().is_assignable_from(
2807 stack_object_type, this, true, CHECK_VERIFY(this));
2808 if (!is_assignable) {
2809 if (ref_class_type.name() == vmSymbols::java_lang_Object()
2810 && stack_object_type.is_array()
2811 && method_name == vmSymbols::clone_name()) {
2812 // Special case: arrays pretend to implement public Object
2813 // clone().
2814 } else {
2815 verify_error(ErrorContext::bad_type(bci,
2816 current_frame->stack_top_ctx(),
2817 TypeOrigin::implicit(current_type())),
2818 "Bad access to protected data in invokevirtual");
2819 return;
2820 }
2821 }
2822 }
2823 }
2824 }
2825 } else {
2826 assert(opcode == Bytecodes::_invokeinterface, "Unexpected opcode encountered");
2827 current_frame->pop_stack(ref_class_type, CHECK_VERIFY(this));
2828 }
2829 }
2830 }
2831 // Push the result type.
2832 if (sig_stream.type() != T_VOID) {
2833 if (method_name == vmSymbols::object_initializer_name()) {
2834 // <init> method must have a void return type
2835 /* Unreachable? Class file parser verifies that methods with '<' have
2836 * void return */
2837 verify_error(ErrorContext::bad_code(bci),
2838 "Return type must be void in <init> method");
2839 return;
2840 }
2841 VerificationType return_type[2];
2842 int n = change_sig_to_verificationType(
2843 &sig_stream, return_type, CHECK_VERIFY(this));
2844 for (int i = 0; i < n; i++) {
2845 current_frame->push_stack(return_type[i], CHECK_VERIFY(this)); // push types backwards
2846 }
2847 }
2848 }
2849
2850 VerificationType ClassVerifier::get_newarray_type(
2851 u2 index, u2 bci, TRAPS) {
2852 const char* from_bt[] = {
2853 NULL, NULL, NULL, NULL, "[Z", "[C", "[F", "[D", "[B", "[S", "[I", "[J",
2854 };
2855 if (index < T_BOOLEAN || index > T_LONG) {
2856 verify_error(ErrorContext::bad_code(bci), "Illegal newarray instruction");
2857 return VerificationType::bogus_type();
2858 }
2859
2860 // from_bt[index] contains the array signature which has a length of 2
2861 Symbol* sig = create_temporary_symbol(
2862 from_bt[index], 2, CHECK_(VerificationType::bogus_type()));
2863 return VerificationType::reference_type(sig);
2864 }
2865
2866 void ClassVerifier::verify_anewarray(
2867 u2 bci, u2 index, constantPoolHandle cp,
2868 StackMapFrame* current_frame, TRAPS) {
2869 verify_cp_class_type(bci, index, cp, CHECK_VERIFY(this));
2870 current_frame->pop_stack(
2871 VerificationType::integer_type(), CHECK_VERIFY(this));
2872
2873 VerificationType component_type =
2874 cp_index_to_type(index, cp, CHECK_VERIFY(this));
2875 int length;
2876 char* arr_sig_str;
2877 if (component_type.is_array()) { // it's an array
2878 const char* component_name = component_type.name()->as_utf8();
2879 // add one dimension to component
2880 length = (int)strlen(component_name) + 1;
2881 arr_sig_str = NEW_RESOURCE_ARRAY_IN_THREAD(THREAD, char, length);
2882 arr_sig_str[0] = '[';
2883 strncpy(&arr_sig_str[1], component_name, length - 1);
2884 } else { // it's an object or interface
2885 const char* component_name = component_type.name()->as_utf8();
2886 // add one dimension to component with 'L' prepended and ';' postpended.
2887 length = (int)strlen(component_name) + 3;
2888 arr_sig_str = NEW_RESOURCE_ARRAY_IN_THREAD(THREAD, char, length);
2889 arr_sig_str[0] = '[';
2890 arr_sig_str[1] = 'L';
2891 strncpy(&arr_sig_str[2], component_name, length - 2);
2892 arr_sig_str[length - 1] = ';';
2893 }
2894 Symbol* arr_sig = create_temporary_symbol(
2895 arr_sig_str, length, CHECK_VERIFY(this));
2896 VerificationType new_array_type = VerificationType::reference_type(arr_sig);
2897 current_frame->push_stack(new_array_type, CHECK_VERIFY(this));
2898 }
2899
2900 void ClassVerifier::verify_iload(u2 index, StackMapFrame* current_frame, TRAPS) {
2901 current_frame->get_local(
2902 index, VerificationType::integer_type(), CHECK_VERIFY(this));
2903 current_frame->push_stack(
2904 VerificationType::integer_type(), CHECK_VERIFY(this));
2905 }
2906
2907 void ClassVerifier::verify_lload(u2 index, StackMapFrame* current_frame, TRAPS) {
2908 current_frame->get_local_2(
2909 index, VerificationType::long_type(),
2910 VerificationType::long2_type(), CHECK_VERIFY(this));
2911 current_frame->push_stack_2(
2912 VerificationType::long_type(),
2913 VerificationType::long2_type(), CHECK_VERIFY(this));
2914 }
2915
2916 void ClassVerifier::verify_fload(u2 index, StackMapFrame* current_frame, TRAPS) {
2917 current_frame->get_local(
2918 index, VerificationType::float_type(), CHECK_VERIFY(this));
2919 current_frame->push_stack(
2920 VerificationType::float_type(), CHECK_VERIFY(this));
2921 }
2922
2923 void ClassVerifier::verify_dload(u2 index, StackMapFrame* current_frame, TRAPS) {
2924 current_frame->get_local_2(
2925 index, VerificationType::double_type(),
2926 VerificationType::double2_type(), CHECK_VERIFY(this));
2927 current_frame->push_stack_2(
2928 VerificationType::double_type(),
2929 VerificationType::double2_type(), CHECK_VERIFY(this));
2930 }
2931
2932 void ClassVerifier::verify_aload(u2 index, StackMapFrame* current_frame, TRAPS) {
2933 VerificationType type = current_frame->get_local(
2934 index, VerificationType::reference_check(), CHECK_VERIFY(this));
2935 current_frame->push_stack(type, CHECK_VERIFY(this));
2936 }
2937
2938 void ClassVerifier::verify_istore(u2 index, StackMapFrame* current_frame, TRAPS) {
2939 current_frame->pop_stack(
2940 VerificationType::integer_type(), CHECK_VERIFY(this));
2941 current_frame->set_local(
2942 index, VerificationType::integer_type(), CHECK_VERIFY(this));
2943 }
2944
2945 void ClassVerifier::verify_lstore(u2 index, StackMapFrame* current_frame, TRAPS) {
2946 current_frame->pop_stack_2(
2947 VerificationType::long2_type(),
2948 VerificationType::long_type(), CHECK_VERIFY(this));
2949 current_frame->set_local_2(
2950 index, VerificationType::long_type(),
2951 VerificationType::long2_type(), CHECK_VERIFY(this));
2952 }
2953
2954 void ClassVerifier::verify_fstore(u2 index, StackMapFrame* current_frame, TRAPS) {
2955 current_frame->pop_stack(VerificationType::float_type(), CHECK_VERIFY(this));
2956 current_frame->set_local(
2957 index, VerificationType::float_type(), CHECK_VERIFY(this));
2958 }
2959
2960 void ClassVerifier::verify_dstore(u2 index, StackMapFrame* current_frame, TRAPS) {
2961 current_frame->pop_stack_2(
2962 VerificationType::double2_type(),
2963 VerificationType::double_type(), CHECK_VERIFY(this));
2964 current_frame->set_local_2(
2965 index, VerificationType::double_type(),
2966 VerificationType::double2_type(), CHECK_VERIFY(this));
2967 }
2968
2969 void ClassVerifier::verify_astore(u2 index, StackMapFrame* current_frame, TRAPS) {
2970 VerificationType type = current_frame->pop_stack(
2971 VerificationType::reference_check(), CHECK_VERIFY(this));
2972 current_frame->set_local(index, type, CHECK_VERIFY(this));
2973 }
2974
2975 void ClassVerifier::verify_iinc(u2 index, StackMapFrame* current_frame, TRAPS) {
2976 VerificationType type = current_frame->get_local(
2977 index, VerificationType::integer_type(), CHECK_VERIFY(this));
2978 current_frame->set_local(index, type, CHECK_VERIFY(this));
2979 }
2980
2981 void ClassVerifier::verify_return_value(
2982 VerificationType return_type, VerificationType type, u2 bci,
2983 StackMapFrame* current_frame, TRAPS) {
2984 if (return_type == VerificationType::bogus_type()) {
2985 verify_error(ErrorContext::bad_type(bci,
2986 current_frame->stack_top_ctx(), TypeOrigin::signature(return_type)),
2987 "Method expects a return value");
2988 return;
2989 }
2990 bool match = return_type.is_assignable_from(type, this, false, CHECK_VERIFY(this));
2991 if (!match) {
2992 verify_error(ErrorContext::bad_type(bci,
2993 current_frame->stack_top_ctx(), TypeOrigin::signature(return_type)),
2994 "Bad return type");
2995 return;
2996 }
2997 }
2998
2999 // The verifier creates symbols which are substrings of Symbols.
3000 // These are stored in the verifier until the end of verification so that
3001 // they can be reference counted.
3002 Symbol* ClassVerifier::create_temporary_symbol(const Symbol *s, int begin,
3003 int end, TRAPS) {
3004 Symbol* sym = SymbolTable::new_symbol(s, begin, end, CHECK_NULL);
3005 _symbols->push(sym);
3006 return sym;
3007 }
3008
3009 Symbol* ClassVerifier::create_temporary_symbol(const char *s, int length, TRAPS) {
3010 Symbol* sym = SymbolTable::new_symbol(s, length, CHECK_NULL);
3011 _symbols->push(sym);
3012 return sym;
3013 }