1 /*
   2  * Copyright (c) 1998, 2015, Oracle and/or its affiliates. All rights reserved.
   3  * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
   4  *
   5  * This code is free software; you can redistribute it and/or modify it
   6  * under the terms of the GNU General Public License version 2 only, as
   7  * published by the Free Software Foundation.
   8  *
   9  * This code is distributed in the hope that it will be useful, but WITHOUT
  10  * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
  11  * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
  12  * version 2 for more details (a copy is included in the LICENSE file that
  13  * accompanied this code).
  14  *
  15  * You should have received a copy of the GNU General Public License version
  16  * 2 along with this work; if not, write to the Free Software Foundation,
  17  * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
  18  *
  19  * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
  20  * or visit www.oracle.com if you need additional information or have any
  21  * questions.
  22  *
  23  */
  24 
  25 #include "precompiled.hpp"
  26 #include "classfile/classFileStream.hpp"
  27 #include "classfile/javaClasses.hpp"
  28 #include "classfile/stackMapTable.hpp"
  29 #include "classfile/stackMapFrame.hpp"
  30 #include "classfile/stackMapTableFormat.hpp"
  31 #include "classfile/systemDictionary.hpp"
  32 #include "classfile/verifier.hpp"
  33 #include "classfile/vmSymbols.hpp"
  34 #include "interpreter/bytecodes.hpp"
  35 #include "interpreter/bytecodeStream.hpp"
  36 #include "memory/oopFactory.hpp"
  37 #include "memory/resourceArea.hpp"
  38 #include "oops/instanceKlass.hpp"
  39 #include "oops/oop.inline.hpp"
  40 #include "oops/typeArrayOop.hpp"
  41 #include "prims/jvm.h"
  42 #include "runtime/fieldDescriptor.hpp"
  43 #include "runtime/handles.inline.hpp"
  44 #include "runtime/interfaceSupport.hpp"
  45 #include "runtime/javaCalls.hpp"
  46 #include "runtime/orderAccess.inline.hpp"
  47 #include "runtime/os.hpp"
  48 #include "utilities/bytes.hpp"
  49 
  50 #define NOFAILOVER_MAJOR_VERSION                       51
  51 #define NONZERO_PADDING_BYTES_IN_SWITCH_MAJOR_VERSION  51
  52 #define STATIC_METHOD_IN_INTERFACE_MAJOR_VERSION       52
  53 
  54 // Access to external entry for VerifyClassCodes - old byte code verifier
  55 
  56 extern "C" {
  57   typedef jboolean (*verify_byte_codes_fn_t)(JNIEnv *, jclass, char *, jint);
  58   typedef jboolean (*verify_byte_codes_fn_new_t)(JNIEnv *, jclass, char *, jint, jint);
  59 }
  60 
  61 static void* volatile _verify_byte_codes_fn = NULL;
  62 
  63 static volatile jint _is_new_verify_byte_codes_fn = (jint) true;
  64 
  65 static void* verify_byte_codes_fn() {
  66   if (_verify_byte_codes_fn == NULL) {
  67     void *lib_handle = os::native_java_library();
  68     void *func = os::dll_lookup(lib_handle, "VerifyClassCodesForMajorVersion");
  69     OrderAccess::release_store_ptr(&_verify_byte_codes_fn, func);
  70     if (func == NULL) {
  71       OrderAccess::release_store(&_is_new_verify_byte_codes_fn, false);
  72       func = os::dll_lookup(lib_handle, "VerifyClassCodes");
  73       OrderAccess::release_store_ptr(&_verify_byte_codes_fn, func);
  74     }
  75   }
  76   return (void*)_verify_byte_codes_fn;
  77 }
  78 
  79 
  80 // Methods in Verifier
  81 
  82 bool Verifier::should_verify_for(oop class_loader, bool should_verify_class) {
  83   return (class_loader == NULL || !should_verify_class) ?
  84     BytecodeVerificationLocal : BytecodeVerificationRemote;
  85 }
  86 
  87 bool Verifier::relax_verify_for(oop loader) {
  88   bool trusted = java_lang_ClassLoader::is_trusted_loader(loader);
  89   bool need_verify =
  90     // verifyAll
  91     (BytecodeVerificationLocal && BytecodeVerificationRemote) ||
  92     // verifyRemote
  93     (!BytecodeVerificationLocal && BytecodeVerificationRemote && !trusted);
  94   return !need_verify;
  95 }
  96 
  97 bool Verifier::verify(instanceKlassHandle klass, Verifier::Mode mode, bool should_verify_class, TRAPS) {
  98   HandleMark hm;
  99   ResourceMark rm(THREAD);
 100 
 101   // Eagerly allocate the identity hash code for a klass. This is a fallout
 102   // from 6320749 and 8059924: hash code generator is not supposed to be called
 103   // during the safepoint, but it allows to sneak the hashcode in during
 104   // verification. Without this eager hashcode generation, we may end up
 105   // installing the hashcode during some other operation, which may be at
 106   // safepoint -- blowing up the checks. It was previously done as the side
 107   // effect (sic!) for external_name(), but instead of doing that, we opt to
 108   // explicitly push the hashcode in here. This is signify the following block
 109   // is IMPORTANT:
 110   if (klass->java_mirror() != NULL) {
 111     klass->java_mirror()->identity_hash();
 112   }
 113 
 114   if (!is_eligible_for_verification(klass, should_verify_class)) {
 115     return true;
 116   }
 117 
 118   // If the class should be verified, first see if we can use the split
 119   // verifier.  If not, or if verification fails and FailOverToOldVerifier
 120   // is set, then call the inference verifier.
 121 
 122   Symbol* exception_name = NULL;
 123   const size_t message_buffer_len = klass->name()->utf8_length() + 1024;
 124   char* message_buffer = NEW_RESOURCE_ARRAY(char, message_buffer_len);
 125   char* exception_message = message_buffer;
 126 
 127   const char* klassName = klass->external_name();
 128   bool can_failover = FailOverToOldVerifier &&
 129      klass->major_version() < NOFAILOVER_MAJOR_VERSION;
 130 
 131   if (TraceClassInitialization) {
 132     tty->print_cr("Start class verification for: %s", klassName);
 133   }
 134   if (klass->major_version() >= STACKMAP_ATTRIBUTE_MAJOR_VERSION) {
 135     ClassVerifier split_verifier(klass, THREAD);
 136     split_verifier.verify_class(THREAD);
 137     exception_name = split_verifier.result();
 138     if (can_failover && !HAS_PENDING_EXCEPTION &&
 139         (exception_name == vmSymbols::java_lang_VerifyError() ||
 140          exception_name == vmSymbols::java_lang_ClassFormatError())) {
 141       if (TraceClassInitialization || VerboseVerification) {
 142         tty->print_cr(
 143           "Fail over class verification to old verifier for: %s", klassName);
 144       }
 145       exception_name = inference_verify(
 146         klass, message_buffer, message_buffer_len, THREAD);
 147     }
 148     if (exception_name != NULL) {
 149       exception_message = split_verifier.exception_message();
 150     }
 151   } else {
 152     exception_name = inference_verify(
 153         klass, message_buffer, message_buffer_len, THREAD);
 154   }
 155 
 156   if (TraceClassInitialization || VerboseVerification) {
 157     if (HAS_PENDING_EXCEPTION) {
 158       tty->print("Verification for %s has", klassName);
 159       tty->print_cr(" exception pending %s ",
 160         InstanceKlass::cast(PENDING_EXCEPTION->klass())->external_name());
 161     } else if (exception_name != NULL) {
 162       tty->print_cr("Verification for %s failed", klassName);
 163     }
 164     tty->print_cr("End class verification for: %s", klassName);
 165   }
 166 
 167   if (HAS_PENDING_EXCEPTION) {
 168     return false; // use the existing exception
 169   } else if (exception_name == NULL) {
 170     return true; // verifcation succeeded
 171   } else { // VerifyError or ClassFormatError to be created and thrown
 172     ResourceMark rm(THREAD);
 173     instanceKlassHandle kls =
 174       SystemDictionary::resolve_or_fail(exception_name, true, CHECK_false);
 175     while (!kls.is_null()) {
 176       if (kls == klass) {
 177         // If the class being verified is the exception we're creating
 178         // or one of it's superclasses, we're in trouble and are going
 179         // to infinitely recurse when we try to initialize the exception.
 180         // So bail out here by throwing the preallocated VM error.
 181         THROW_OOP_(Universe::virtual_machine_error_instance(), false);
 182       }
 183       kls = kls->super();
 184     }
 185     message_buffer[message_buffer_len - 1] = '\0'; // just to be sure
 186     THROW_MSG_(exception_name, exception_message, false);
 187   }
 188 }
 189 
 190 bool Verifier::is_eligible_for_verification(instanceKlassHandle klass, bool should_verify_class) {
 191   Symbol* name = klass->name();
 192   Klass* refl_magic_klass = SystemDictionary::reflect_MagicAccessorImpl_klass();
 193 
 194   bool is_reflect = refl_magic_klass != NULL && klass->is_subtype_of(refl_magic_klass);
 195 
 196   return (should_verify_for(klass->class_loader(), should_verify_class) &&
 197     // return if the class is a bootstrapping class
 198     // or defineClass specified not to verify by default (flags override passed arg)
 199     // We need to skip the following four for bootstraping
 200     name != vmSymbols::java_lang_Object() &&
 201     name != vmSymbols::java_lang_Class() &&
 202     name != vmSymbols::java_lang_String() &&
 203     name != vmSymbols::java_lang_Throwable() &&
 204 
 205     // Can not verify the bytecodes for shared classes because they have
 206     // already been rewritten to contain constant pool cache indices,
 207     // which the verifier can't understand.
 208     // Shared classes shouldn't have stackmaps either.
 209     !klass()->is_shared() &&
 210 
 211     // As of the fix for 4486457 we disable verification for all of the
 212     // dynamically-generated bytecodes associated with the 1.4
 213     // reflection implementation, not just those associated with
 214     // sun/reflect/SerializationConstructorAccessor.
 215     // NOTE: this is called too early in the bootstrapping process to be
 216     // guarded by Universe::is_gte_jdk14x_version().
 217     // Also for lambda generated code, gte jdk8
 218     (!is_reflect));
 219 }
 220 
 221 Symbol* Verifier::inference_verify(
 222     instanceKlassHandle klass, char* message, size_t message_len, TRAPS) {
 223   JavaThread* thread = (JavaThread*)THREAD;
 224   JNIEnv *env = thread->jni_environment();
 225 
 226   void* verify_func = verify_byte_codes_fn();
 227 
 228   if (verify_func == NULL) {
 229     jio_snprintf(message, message_len, "Could not link verifier");
 230     return vmSymbols::java_lang_VerifyError();
 231   }
 232 
 233   ResourceMark rm(THREAD);
 234   if (VerboseVerification) {
 235     tty->print_cr("Verifying class %s with old format", klass->external_name());
 236   }
 237 
 238   jclass cls = (jclass) JNIHandles::make_local(env, klass->java_mirror());
 239   jint result;
 240 
 241   {
 242     HandleMark hm(thread);
 243     ThreadToNativeFromVM ttn(thread);
 244     // ThreadToNativeFromVM takes care of changing thread_state, so safepoint
 245     // code knows that we have left the VM
 246 
 247     if (_is_new_verify_byte_codes_fn) {
 248       verify_byte_codes_fn_new_t func =
 249         CAST_TO_FN_PTR(verify_byte_codes_fn_new_t, verify_func);
 250       result = (*func)(env, cls, message, (int)message_len,
 251           klass->major_version());
 252     } else {
 253       verify_byte_codes_fn_t func =
 254         CAST_TO_FN_PTR(verify_byte_codes_fn_t, verify_func);
 255       result = (*func)(env, cls, message, (int)message_len);
 256     }
 257   }
 258 
 259   JNIHandles::destroy_local(cls);
 260 
 261   // These numbers are chosen so that VerifyClassCodes interface doesn't need
 262   // to be changed (still return jboolean (unsigned char)), and result is
 263   // 1 when verification is passed.
 264   if (result == 0) {
 265     return vmSymbols::java_lang_VerifyError();
 266   } else if (result == 1) {
 267     return NULL; // verified.
 268   } else if (result == 2) {
 269     THROW_MSG_(vmSymbols::java_lang_OutOfMemoryError(), message, NULL);
 270   } else if (result == 3) {
 271     return vmSymbols::java_lang_ClassFormatError();
 272   } else {
 273     ShouldNotReachHere();
 274     return NULL;
 275   }
 276 }
 277 
 278 TypeOrigin TypeOrigin::null() {
 279   return TypeOrigin();
 280 }
 281 TypeOrigin TypeOrigin::local(u2 index, StackMapFrame* frame) {
 282   assert(frame != NULL, "Must have a frame");
 283   return TypeOrigin(CF_LOCALS, index, StackMapFrame::copy(frame),
 284      frame->local_at(index));
 285 }
 286 TypeOrigin TypeOrigin::stack(u2 index, StackMapFrame* frame) {
 287   assert(frame != NULL, "Must have a frame");
 288   return TypeOrigin(CF_STACK, index, StackMapFrame::copy(frame),
 289       frame->stack_at(index));
 290 }
 291 TypeOrigin TypeOrigin::sm_local(u2 index, StackMapFrame* frame) {
 292   assert(frame != NULL, "Must have a frame");
 293   return TypeOrigin(SM_LOCALS, index, StackMapFrame::copy(frame),
 294       frame->local_at(index));
 295 }
 296 TypeOrigin TypeOrigin::sm_stack(u2 index, StackMapFrame* frame) {
 297   assert(frame != NULL, "Must have a frame");
 298   return TypeOrigin(SM_STACK, index, StackMapFrame::copy(frame),
 299       frame->stack_at(index));
 300 }
 301 TypeOrigin TypeOrigin::bad_index(u2 index) {
 302   return TypeOrigin(BAD_INDEX, index, NULL, VerificationType::bogus_type());
 303 }
 304 TypeOrigin TypeOrigin::cp(u2 index, VerificationType vt) {
 305   return TypeOrigin(CONST_POOL, index, NULL, vt);
 306 }
 307 TypeOrigin TypeOrigin::signature(VerificationType vt) {
 308   return TypeOrigin(SIG, 0, NULL, vt);
 309 }
 310 TypeOrigin TypeOrigin::implicit(VerificationType t) {
 311   return TypeOrigin(IMPLICIT, 0, NULL, t);
 312 }
 313 TypeOrigin TypeOrigin::frame(StackMapFrame* frame) {
 314   return TypeOrigin(FRAME_ONLY, 0, StackMapFrame::copy(frame),
 315                     VerificationType::bogus_type());
 316 }
 317 
 318 void TypeOrigin::reset_frame() {
 319   if (_frame != NULL) {
 320     _frame->restore();
 321   }
 322 }
 323 
 324 void TypeOrigin::details(outputStream* ss) const {
 325   _type.print_on(ss);
 326   switch (_origin) {
 327     case CF_LOCALS:
 328       ss->print(" (current frame, locals[%d])", _index);
 329       break;
 330     case CF_STACK:
 331       ss->print(" (current frame, stack[%d])", _index);
 332       break;
 333     case SM_LOCALS:
 334       ss->print(" (stack map, locals[%d])", _index);
 335       break;
 336     case SM_STACK:
 337       ss->print(" (stack map, stack[%d])", _index);
 338       break;
 339     case CONST_POOL:
 340       ss->print(" (constant pool %d)", _index);
 341       break;
 342     case SIG:
 343       ss->print(" (from method signature)");
 344       break;
 345     case IMPLICIT:
 346     case FRAME_ONLY:
 347     case NONE:
 348     default:
 349       ;
 350   }
 351 }
 352 
 353 #ifdef ASSERT
 354 void TypeOrigin::print_on(outputStream* str) const {
 355   str->print("{%d,%d,%p:", _origin, _index, _frame);
 356   if (_frame != NULL) {
 357     _frame->print_on(str);
 358   } else {
 359     str->print("null");
 360   }
 361   str->print(",");
 362   _type.print_on(str);
 363   str->print("}");
 364 }
 365 #endif
 366 
 367 void ErrorContext::details(outputStream* ss, const Method* method) const {
 368   if (is_valid()) {
 369     ss->cr();
 370     ss->print_cr("Exception Details:");
 371     location_details(ss, method);
 372     reason_details(ss);
 373     frame_details(ss);
 374     bytecode_details(ss, method);
 375     handler_details(ss, method);
 376     stackmap_details(ss, method);
 377   }
 378 }
 379 
 380 void ErrorContext::reason_details(outputStream* ss) const {
 381   streamIndentor si(ss);
 382   ss->indent().print_cr("Reason:");
 383   streamIndentor si2(ss);
 384   ss->indent().print("%s", "");
 385   switch (_fault) {
 386     case INVALID_BYTECODE:
 387       ss->print("Error exists in the bytecode");
 388       break;
 389     case WRONG_TYPE:
 390       if (_expected.is_valid()) {
 391         ss->print("Type ");
 392         _type.details(ss);
 393         ss->print(" is not assignable to ");
 394         _expected.details(ss);
 395       } else {
 396         ss->print("Invalid type: ");
 397         _type.details(ss);
 398       }
 399       break;
 400     case FLAGS_MISMATCH:
 401       if (_expected.is_valid()) {
 402         ss->print("Current frame's flags are not assignable "
 403                   "to stack map frame's.");
 404       } else {
 405         ss->print("Current frame's flags are invalid in this context.");
 406       }
 407       break;
 408     case BAD_CP_INDEX:
 409       ss->print("Constant pool index %d is invalid", _type.index());
 410       break;
 411     case BAD_LOCAL_INDEX:
 412       ss->print("Local index %d is invalid", _type.index());
 413       break;
 414     case LOCALS_SIZE_MISMATCH:
 415       ss->print("Current frame's local size doesn't match stackmap.");
 416       break;
 417     case STACK_SIZE_MISMATCH:
 418       ss->print("Current frame's stack size doesn't match stackmap.");
 419       break;
 420     case STACK_OVERFLOW:
 421       ss->print("Exceeded max stack size.");
 422       break;
 423     case STACK_UNDERFLOW:
 424       ss->print("Attempt to pop empty stack.");
 425       break;
 426     case MISSING_STACKMAP:
 427       ss->print("Expected stackmap frame at this location.");
 428       break;
 429     case BAD_STACKMAP:
 430       ss->print("Invalid stackmap specification.");
 431       break;
 432     case UNKNOWN:
 433     default:
 434       ShouldNotReachHere();
 435       ss->print_cr("Unknown");
 436   }
 437   ss->cr();
 438 }
 439 
 440 void ErrorContext::location_details(outputStream* ss, const Method* method) const {
 441   if (_bci != -1 && method != NULL) {
 442     streamIndentor si(ss);
 443     const char* bytecode_name = "<invalid>";
 444     if (method->validate_bci(_bci) != -1) {
 445       Bytecodes::Code code = Bytecodes::code_or_bp_at(method->bcp_from(_bci));
 446       if (Bytecodes::is_defined(code)) {
 447           bytecode_name = Bytecodes::name(code);
 448       } else {
 449           bytecode_name = "<illegal>";
 450       }
 451     }
 452     InstanceKlass* ik = method->method_holder();
 453     ss->indent().print_cr("Location:");
 454     streamIndentor si2(ss);
 455     ss->indent().print_cr("%s.%s%s @%d: %s",
 456         ik->name()->as_C_string(), method->name()->as_C_string(),
 457         method->signature()->as_C_string(), _bci, bytecode_name);
 458   }
 459 }
 460 
 461 void ErrorContext::frame_details(outputStream* ss) const {
 462   streamIndentor si(ss);
 463   if (_type.is_valid() && _type.frame() != NULL) {
 464     ss->indent().print_cr("Current Frame:");
 465     streamIndentor si2(ss);
 466     _type.frame()->print_on(ss);
 467   }
 468   if (_expected.is_valid() && _expected.frame() != NULL) {
 469     ss->indent().print_cr("Stackmap Frame:");
 470     streamIndentor si2(ss);
 471     _expected.frame()->print_on(ss);
 472   }
 473 }
 474 
 475 void ErrorContext::bytecode_details(outputStream* ss, const Method* method) const {
 476   if (method != NULL) {
 477     streamIndentor si(ss);
 478     ss->indent().print_cr("Bytecode:");
 479     streamIndentor si2(ss);
 480     ss->print_data(method->code_base(), method->code_size(), false);
 481   }
 482 }
 483 
 484 void ErrorContext::handler_details(outputStream* ss, const Method* method) const {
 485   if (method != NULL) {
 486     streamIndentor si(ss);
 487     ExceptionTable table(method);
 488     if (table.length() > 0) {
 489       ss->indent().print_cr("Exception Handler Table:");
 490       streamIndentor si2(ss);
 491       for (int i = 0; i < table.length(); ++i) {
 492         ss->indent().print_cr("bci [%d, %d] => handler: %d", table.start_pc(i),
 493             table.end_pc(i), table.handler_pc(i));
 494       }
 495     }
 496   }
 497 }
 498 
 499 void ErrorContext::stackmap_details(outputStream* ss, const Method* method) const {
 500   if (method != NULL && method->has_stackmap_table()) {
 501     streamIndentor si(ss);
 502     ss->indent().print_cr("Stackmap Table:");
 503     Array<u1>* data = method->stackmap_data();
 504     stack_map_table* sm_table =
 505         stack_map_table::at((address)data->adr_at(0));
 506     stack_map_frame* sm_frame = sm_table->entries();
 507     streamIndentor si2(ss);
 508     int current_offset = -1;
 509     for (u2 i = 0; i < sm_table->number_of_entries(); ++i) {
 510       ss->indent();
 511       sm_frame->print_on(ss, current_offset);
 512       ss->cr();
 513       current_offset += sm_frame->offset_delta();
 514       sm_frame = sm_frame->next();
 515     }
 516   }
 517 }
 518 
 519 // Methods in ClassVerifier
 520 
 521 ClassVerifier::ClassVerifier(
 522     instanceKlassHandle klass, TRAPS)
 523     : _thread(THREAD), _exception_type(NULL), _message(NULL), _klass(klass) {
 524   _this_type = VerificationType::reference_type(klass->name());
 525   // Create list to hold symbols in reference area.
 526   _symbols = new GrowableArray<Symbol*>(100, 0, NULL);
 527 }
 528 
 529 ClassVerifier::~ClassVerifier() {
 530   // Decrement the reference count for any symbols created.
 531   for (int i = 0; i < _symbols->length(); i++) {
 532     Symbol* s = _symbols->at(i);
 533     s->decrement_refcount();
 534   }
 535 }
 536 
 537 VerificationType ClassVerifier::object_type() const {
 538   return VerificationType::reference_type(vmSymbols::java_lang_Object());
 539 }
 540 
 541 TypeOrigin ClassVerifier::ref_ctx(const char* sig, TRAPS) {
 542   VerificationType vt = VerificationType::reference_type(
 543       create_temporary_symbol(sig, (int)strlen(sig), THREAD));
 544   return TypeOrigin::implicit(vt);
 545 }
 546 
 547 void ClassVerifier::verify_class(TRAPS) {
 548   if (VerboseVerification) {
 549     tty->print_cr("Verifying class %s with new format",
 550       _klass->external_name());
 551   }
 552 
 553   Array<Method*>* methods = _klass->methods();
 554   int num_methods = methods->length();
 555 
 556   for (int index = 0; index < num_methods; index++) {
 557     // Check for recursive re-verification before each method.
 558     if (was_recursively_verified())  return;
 559 
 560     Method* m = methods->at(index);
 561     if (m->is_native() || m->is_abstract() || m->is_overpass()) {
 562       // If m is native or abstract, skip it.  It is checked in class file
 563       // parser that methods do not override a final method.  Overpass methods
 564       // are trusted since the VM generates them.
 565       continue;
 566     }
 567     verify_method(methodHandle(THREAD, m), CHECK_VERIFY(this));
 568   }
 569 
 570   if (VerboseVerification || TraceClassInitialization) {
 571     if (was_recursively_verified())
 572       tty->print_cr("Recursive verification detected for: %s",
 573           _klass->external_name());
 574   }
 575 }
 576 
 577 void ClassVerifier::verify_method(methodHandle m, TRAPS) {
 578   HandleMark hm(THREAD);
 579   _method = m;   // initialize _method
 580   if (VerboseVerification) {
 581     tty->print_cr("Verifying method %s", m->name_and_sig_as_C_string());
 582   }
 583 
 584 // For clang, the only good constant format string is a literal constant format string.
 585 #define bad_type_msg "Bad type on operand stack in %s"
 586 
 587   int32_t max_stack = m->verifier_max_stack();
 588   int32_t max_locals = m->max_locals();
 589   constantPoolHandle cp(THREAD, m->constants());
 590 
 591   if (!SignatureVerifier::is_valid_method_signature(m->signature())) {
 592     class_format_error("Invalid method signature");
 593     return;
 594   }
 595 
 596   // Initial stack map frame: offset is 0, stack is initially empty.
 597   StackMapFrame current_frame(max_locals, max_stack, this);
 598   // Set initial locals
 599   VerificationType return_type = current_frame.set_locals_from_arg(
 600     m, current_type(), CHECK_VERIFY(this));
 601 
 602   int32_t stackmap_index = 0; // index to the stackmap array
 603 
 604   u4 code_length = m->code_size();
 605 
 606   // Scan the bytecode and map each instruction's start offset to a number.
 607   char* code_data = generate_code_data(m, code_length, CHECK_VERIFY(this));
 608 
 609   int ex_min = code_length;
 610   int ex_max = -1;
 611   // Look through each item on the exception table. Each of the fields must refer
 612   // to a legal instruction.
 613   verify_exception_handler_table(
 614     code_length, code_data, ex_min, ex_max, CHECK_VERIFY(this));
 615 
 616   // Look through each entry on the local variable table and make sure
 617   // its range of code array offsets is valid. (4169817)
 618   if (m->has_localvariable_table()) {
 619     verify_local_variable_table(code_length, code_data, CHECK_VERIFY(this));
 620   }
 621 
 622   Array<u1>* stackmap_data = m->stackmap_data();
 623   StackMapStream stream(stackmap_data);
 624   StackMapReader reader(this, &stream, code_data, code_length, THREAD);
 625   StackMapTable stackmap_table(&reader, &current_frame, max_locals, max_stack,
 626                                code_data, code_length, CHECK_VERIFY(this));
 627 
 628   if (VerboseVerification) {
 629     stackmap_table.print_on(tty);
 630   }
 631 
 632   RawBytecodeStream bcs(m);
 633 
 634   // Scan the byte code linearly from the start to the end
 635   bool no_control_flow = false; // Set to true when there is no direct control
 636                                 // flow from current instruction to the next
 637                                 // instruction in sequence
 638 
 639   Bytecodes::Code opcode;
 640   while (!bcs.is_last_bytecode()) {
 641     // Check for recursive re-verification before each bytecode.
 642     if (was_recursively_verified())  return;
 643 
 644     opcode = bcs.raw_next();
 645     u2 bci = bcs.bci();
 646 
 647     // Set current frame's offset to bci
 648     current_frame.set_offset(bci);
 649     current_frame.set_mark();
 650 
 651     // Make sure every offset in stackmap table point to the beginning to
 652     // an instruction. Match current_frame to stackmap_table entry with
 653     // the same offset if exists.
 654     stackmap_index = verify_stackmap_table(
 655       stackmap_index, bci, &current_frame, &stackmap_table,
 656       no_control_flow, CHECK_VERIFY(this));
 657 
 658 
 659     bool this_uninit = false;  // Set to true when invokespecial <init> initialized 'this'
 660     bool verified_exc_handlers = false;
 661 
 662     // Merge with the next instruction
 663     {
 664       u2 index;
 665       int target;
 666       VerificationType type, type2;
 667       VerificationType atype;
 668 
 669 #ifndef PRODUCT
 670       if (VerboseVerification) {
 671         current_frame.print_on(tty);
 672         tty->print_cr("offset = %d,  opcode = %s", bci, Bytecodes::name(opcode));
 673       }
 674 #endif
 675 
 676       // Make sure wide instruction is in correct format
 677       if (bcs.is_wide()) {
 678         if (opcode != Bytecodes::_iinc   && opcode != Bytecodes::_iload  &&
 679             opcode != Bytecodes::_aload  && opcode != Bytecodes::_lload  &&
 680             opcode != Bytecodes::_istore && opcode != Bytecodes::_astore &&
 681             opcode != Bytecodes::_lstore && opcode != Bytecodes::_fload  &&
 682             opcode != Bytecodes::_dload  && opcode != Bytecodes::_fstore &&
 683             opcode != Bytecodes::_dstore) {
 684           /* Unreachable?  RawBytecodeStream's raw_next() returns 'illegal'
 685            * if we encounter a wide instruction that modifies an invalid
 686            * opcode (not one of the ones listed above) */
 687           verify_error(ErrorContext::bad_code(bci), "Bad wide instruction");
 688           return;
 689         }
 690       }
 691 
 692       // Look for possible jump target in exception handlers and see if it
 693       // matches current_frame.  Do this check here for astore*, dstore*,
 694       // fstore*, istore*, and lstore* opcodes because they can change the type
 695       // state by adding a local.  JVM Spec says that the incoming type state
 696       // should be used for this check.  So, do the check here before a possible
 697       // local is added to the type state.
 698       if (Bytecodes::is_store_into_local(opcode) && bci >= ex_min && bci < ex_max) {
 699         verify_exception_handler_targets(
 700           bci, this_uninit, &current_frame, &stackmap_table, CHECK_VERIFY(this));
 701         verified_exc_handlers = true;
 702       }
 703 
 704       switch (opcode) {
 705         case Bytecodes::_nop :
 706           no_control_flow = false; break;
 707         case Bytecodes::_aconst_null :
 708           current_frame.push_stack(
 709             VerificationType::null_type(), CHECK_VERIFY(this));
 710           no_control_flow = false; break;
 711         case Bytecodes::_iconst_m1 :
 712         case Bytecodes::_iconst_0 :
 713         case Bytecodes::_iconst_1 :
 714         case Bytecodes::_iconst_2 :
 715         case Bytecodes::_iconst_3 :
 716         case Bytecodes::_iconst_4 :
 717         case Bytecodes::_iconst_5 :
 718           current_frame.push_stack(
 719             VerificationType::integer_type(), CHECK_VERIFY(this));
 720           no_control_flow = false; break;
 721         case Bytecodes::_lconst_0 :
 722         case Bytecodes::_lconst_1 :
 723           current_frame.push_stack_2(
 724             VerificationType::long_type(),
 725             VerificationType::long2_type(), CHECK_VERIFY(this));
 726           no_control_flow = false; break;
 727         case Bytecodes::_fconst_0 :
 728         case Bytecodes::_fconst_1 :
 729         case Bytecodes::_fconst_2 :
 730           current_frame.push_stack(
 731             VerificationType::float_type(), CHECK_VERIFY(this));
 732           no_control_flow = false; break;
 733         case Bytecodes::_dconst_0 :
 734         case Bytecodes::_dconst_1 :
 735           current_frame.push_stack_2(
 736             VerificationType::double_type(),
 737             VerificationType::double2_type(), CHECK_VERIFY(this));
 738           no_control_flow = false; break;
 739         case Bytecodes::_sipush :
 740         case Bytecodes::_bipush :
 741           current_frame.push_stack(
 742             VerificationType::integer_type(), CHECK_VERIFY(this));
 743           no_control_flow = false; break;
 744         case Bytecodes::_ldc :
 745           verify_ldc(
 746             opcode, bcs.get_index_u1(), &current_frame,
 747             cp, bci, CHECK_VERIFY(this));
 748           no_control_flow = false; break;
 749         case Bytecodes::_ldc_w :
 750         case Bytecodes::_ldc2_w :
 751           verify_ldc(
 752             opcode, bcs.get_index_u2(), &current_frame,
 753             cp, bci, CHECK_VERIFY(this));
 754           no_control_flow = false; break;
 755         case Bytecodes::_iload :
 756           verify_iload(bcs.get_index(), &current_frame, CHECK_VERIFY(this));
 757           no_control_flow = false; break;
 758         case Bytecodes::_iload_0 :
 759         case Bytecodes::_iload_1 :
 760         case Bytecodes::_iload_2 :
 761         case Bytecodes::_iload_3 :
 762           index = opcode - Bytecodes::_iload_0;
 763           verify_iload(index, &current_frame, CHECK_VERIFY(this));
 764           no_control_flow = false; break;
 765         case Bytecodes::_lload :
 766           verify_lload(bcs.get_index(), &current_frame, CHECK_VERIFY(this));
 767           no_control_flow = false; break;
 768         case Bytecodes::_lload_0 :
 769         case Bytecodes::_lload_1 :
 770         case Bytecodes::_lload_2 :
 771         case Bytecodes::_lload_3 :
 772           index = opcode - Bytecodes::_lload_0;
 773           verify_lload(index, &current_frame, CHECK_VERIFY(this));
 774           no_control_flow = false; break;
 775         case Bytecodes::_fload :
 776           verify_fload(bcs.get_index(), &current_frame, CHECK_VERIFY(this));
 777           no_control_flow = false; break;
 778         case Bytecodes::_fload_0 :
 779         case Bytecodes::_fload_1 :
 780         case Bytecodes::_fload_2 :
 781         case Bytecodes::_fload_3 :
 782           index = opcode - Bytecodes::_fload_0;
 783           verify_fload(index, &current_frame, CHECK_VERIFY(this));
 784           no_control_flow = false; break;
 785         case Bytecodes::_dload :
 786           verify_dload(bcs.get_index(), &current_frame, CHECK_VERIFY(this));
 787           no_control_flow = false; break;
 788         case Bytecodes::_dload_0 :
 789         case Bytecodes::_dload_1 :
 790         case Bytecodes::_dload_2 :
 791         case Bytecodes::_dload_3 :
 792           index = opcode - Bytecodes::_dload_0;
 793           verify_dload(index, &current_frame, CHECK_VERIFY(this));
 794           no_control_flow = false; break;
 795         case Bytecodes::_aload :
 796           verify_aload(bcs.get_index(), &current_frame, CHECK_VERIFY(this));
 797           no_control_flow = false; break;
 798         case Bytecodes::_aload_0 :
 799         case Bytecodes::_aload_1 :
 800         case Bytecodes::_aload_2 :
 801         case Bytecodes::_aload_3 :
 802           index = opcode - Bytecodes::_aload_0;
 803           verify_aload(index, &current_frame, CHECK_VERIFY(this));
 804           no_control_flow = false; break;
 805         case Bytecodes::_iaload :
 806           type = current_frame.pop_stack(
 807             VerificationType::integer_type(), CHECK_VERIFY(this));
 808           atype = current_frame.pop_stack(
 809             VerificationType::reference_check(), CHECK_VERIFY(this));
 810           if (!atype.is_int_array()) {
 811             verify_error(ErrorContext::bad_type(bci,
 812                 current_frame.stack_top_ctx(), ref_ctx("[I", THREAD)),
 813                 bad_type_msg, "iaload");
 814             return;
 815           }
 816           current_frame.push_stack(
 817             VerificationType::integer_type(), CHECK_VERIFY(this));
 818           no_control_flow = false; break;
 819         case Bytecodes::_baload :
 820           type = current_frame.pop_stack(
 821             VerificationType::integer_type(), CHECK_VERIFY(this));
 822           atype = current_frame.pop_stack(
 823             VerificationType::reference_check(), CHECK_VERIFY(this));
 824           if (!atype.is_bool_array() && !atype.is_byte_array()) {
 825             verify_error(
 826                 ErrorContext::bad_type(bci, current_frame.stack_top_ctx()),
 827                 bad_type_msg, "baload");
 828             return;
 829           }
 830           current_frame.push_stack(
 831             VerificationType::integer_type(), CHECK_VERIFY(this));
 832           no_control_flow = false; break;
 833         case Bytecodes::_caload :
 834           type = current_frame.pop_stack(
 835             VerificationType::integer_type(), CHECK_VERIFY(this));
 836           atype = current_frame.pop_stack(
 837             VerificationType::reference_check(), CHECK_VERIFY(this));
 838           if (!atype.is_char_array()) {
 839             verify_error(ErrorContext::bad_type(bci,
 840                 current_frame.stack_top_ctx(), ref_ctx("[C", THREAD)),
 841                 bad_type_msg, "caload");
 842             return;
 843           }
 844           current_frame.push_stack(
 845             VerificationType::integer_type(), CHECK_VERIFY(this));
 846           no_control_flow = false; break;
 847         case Bytecodes::_saload :
 848           type = current_frame.pop_stack(
 849             VerificationType::integer_type(), CHECK_VERIFY(this));
 850           atype = current_frame.pop_stack(
 851             VerificationType::reference_check(), CHECK_VERIFY(this));
 852           if (!atype.is_short_array()) {
 853             verify_error(ErrorContext::bad_type(bci,
 854                 current_frame.stack_top_ctx(), ref_ctx("[S", THREAD)),
 855                 bad_type_msg, "saload");
 856             return;
 857           }
 858           current_frame.push_stack(
 859             VerificationType::integer_type(), CHECK_VERIFY(this));
 860           no_control_flow = false; break;
 861         case Bytecodes::_laload :
 862           type = current_frame.pop_stack(
 863             VerificationType::integer_type(), CHECK_VERIFY(this));
 864           atype = current_frame.pop_stack(
 865             VerificationType::reference_check(), CHECK_VERIFY(this));
 866           if (!atype.is_long_array()) {
 867             verify_error(ErrorContext::bad_type(bci,
 868                 current_frame.stack_top_ctx(), ref_ctx("[J", THREAD)),
 869                 bad_type_msg, "laload");
 870             return;
 871           }
 872           current_frame.push_stack_2(
 873             VerificationType::long_type(),
 874             VerificationType::long2_type(), CHECK_VERIFY(this));
 875           no_control_flow = false; break;
 876         case Bytecodes::_faload :
 877           type = current_frame.pop_stack(
 878             VerificationType::integer_type(), CHECK_VERIFY(this));
 879           atype = current_frame.pop_stack(
 880             VerificationType::reference_check(), CHECK_VERIFY(this));
 881           if (!atype.is_float_array()) {
 882             verify_error(ErrorContext::bad_type(bci,
 883                 current_frame.stack_top_ctx(), ref_ctx("[F", THREAD)),
 884                 bad_type_msg, "faload");
 885             return;
 886           }
 887           current_frame.push_stack(
 888             VerificationType::float_type(), CHECK_VERIFY(this));
 889           no_control_flow = false; break;
 890         case Bytecodes::_daload :
 891           type = current_frame.pop_stack(
 892             VerificationType::integer_type(), CHECK_VERIFY(this));
 893           atype = current_frame.pop_stack(
 894             VerificationType::reference_check(), CHECK_VERIFY(this));
 895           if (!atype.is_double_array()) {
 896             verify_error(ErrorContext::bad_type(bci,
 897                 current_frame.stack_top_ctx(), ref_ctx("[D", THREAD)),
 898                 bad_type_msg, "daload");
 899             return;
 900           }
 901           current_frame.push_stack_2(
 902             VerificationType::double_type(),
 903             VerificationType::double2_type(), CHECK_VERIFY(this));
 904           no_control_flow = false; break;
 905         case Bytecodes::_aaload : {
 906           type = current_frame.pop_stack(
 907             VerificationType::integer_type(), CHECK_VERIFY(this));
 908           atype = current_frame.pop_stack(
 909             VerificationType::reference_check(), CHECK_VERIFY(this));
 910           if (!atype.is_reference_array()) {
 911             verify_error(ErrorContext::bad_type(bci,
 912                 current_frame.stack_top_ctx(),
 913                 TypeOrigin::implicit(VerificationType::reference_check())),
 914                 bad_type_msg, "aaload");
 915             return;
 916           }
 917           if (atype.is_null()) {
 918             current_frame.push_stack(
 919               VerificationType::null_type(), CHECK_VERIFY(this));
 920           } else {
 921             VerificationType component =
 922               atype.get_component(this, CHECK_VERIFY(this));
 923             current_frame.push_stack(component, CHECK_VERIFY(this));
 924           }
 925           no_control_flow = false; break;
 926         }
 927         case Bytecodes::_istore :
 928           verify_istore(bcs.get_index(), &current_frame, CHECK_VERIFY(this));
 929           no_control_flow = false; break;
 930         case Bytecodes::_istore_0 :
 931         case Bytecodes::_istore_1 :
 932         case Bytecodes::_istore_2 :
 933         case Bytecodes::_istore_3 :
 934           index = opcode - Bytecodes::_istore_0;
 935           verify_istore(index, &current_frame, CHECK_VERIFY(this));
 936           no_control_flow = false; break;
 937         case Bytecodes::_lstore :
 938           verify_lstore(bcs.get_index(), &current_frame, CHECK_VERIFY(this));
 939           no_control_flow = false; break;
 940         case Bytecodes::_lstore_0 :
 941         case Bytecodes::_lstore_1 :
 942         case Bytecodes::_lstore_2 :
 943         case Bytecodes::_lstore_3 :
 944           index = opcode - Bytecodes::_lstore_0;
 945           verify_lstore(index, &current_frame, CHECK_VERIFY(this));
 946           no_control_flow = false; break;
 947         case Bytecodes::_fstore :
 948           verify_fstore(bcs.get_index(), &current_frame, CHECK_VERIFY(this));
 949           no_control_flow = false; break;
 950         case Bytecodes::_fstore_0 :
 951         case Bytecodes::_fstore_1 :
 952         case Bytecodes::_fstore_2 :
 953         case Bytecodes::_fstore_3 :
 954           index = opcode - Bytecodes::_fstore_0;
 955           verify_fstore(index, &current_frame, CHECK_VERIFY(this));
 956           no_control_flow = false; break;
 957         case Bytecodes::_dstore :
 958           verify_dstore(bcs.get_index(), &current_frame, CHECK_VERIFY(this));
 959           no_control_flow = false; break;
 960         case Bytecodes::_dstore_0 :
 961         case Bytecodes::_dstore_1 :
 962         case Bytecodes::_dstore_2 :
 963         case Bytecodes::_dstore_3 :
 964           index = opcode - Bytecodes::_dstore_0;
 965           verify_dstore(index, &current_frame, CHECK_VERIFY(this));
 966           no_control_flow = false; break;
 967         case Bytecodes::_astore :
 968           verify_astore(bcs.get_index(), &current_frame, CHECK_VERIFY(this));
 969           no_control_flow = false; break;
 970         case Bytecodes::_astore_0 :
 971         case Bytecodes::_astore_1 :
 972         case Bytecodes::_astore_2 :
 973         case Bytecodes::_astore_3 :
 974           index = opcode - Bytecodes::_astore_0;
 975           verify_astore(index, &current_frame, CHECK_VERIFY(this));
 976           no_control_flow = false; break;
 977         case Bytecodes::_iastore :
 978           type = current_frame.pop_stack(
 979             VerificationType::integer_type(), CHECK_VERIFY(this));
 980           type2 = current_frame.pop_stack(
 981             VerificationType::integer_type(), CHECK_VERIFY(this));
 982           atype = current_frame.pop_stack(
 983             VerificationType::reference_check(), CHECK_VERIFY(this));
 984           if (!atype.is_int_array()) {
 985             verify_error(ErrorContext::bad_type(bci,
 986                 current_frame.stack_top_ctx(), ref_ctx("[I", THREAD)),
 987                 bad_type_msg, "iastore");
 988             return;
 989           }
 990           no_control_flow = false; break;
 991         case Bytecodes::_bastore :
 992           type = current_frame.pop_stack(
 993             VerificationType::integer_type(), CHECK_VERIFY(this));
 994           type2 = current_frame.pop_stack(
 995             VerificationType::integer_type(), CHECK_VERIFY(this));
 996           atype = current_frame.pop_stack(
 997             VerificationType::reference_check(), CHECK_VERIFY(this));
 998           if (!atype.is_bool_array() && !atype.is_byte_array()) {
 999             verify_error(
1000                 ErrorContext::bad_type(bci, current_frame.stack_top_ctx()),
1001                 bad_type_msg, "bastore");
1002             return;
1003           }
1004           no_control_flow = false; break;
1005         case Bytecodes::_castore :
1006           current_frame.pop_stack(
1007             VerificationType::integer_type(), CHECK_VERIFY(this));
1008           current_frame.pop_stack(
1009             VerificationType::integer_type(), CHECK_VERIFY(this));
1010           atype = current_frame.pop_stack(
1011             VerificationType::reference_check(), CHECK_VERIFY(this));
1012           if (!atype.is_char_array()) {
1013             verify_error(ErrorContext::bad_type(bci,
1014                 current_frame.stack_top_ctx(), ref_ctx("[C", THREAD)),
1015                 bad_type_msg, "castore");
1016             return;
1017           }
1018           no_control_flow = false; break;
1019         case Bytecodes::_sastore :
1020           current_frame.pop_stack(
1021             VerificationType::integer_type(), CHECK_VERIFY(this));
1022           current_frame.pop_stack(
1023             VerificationType::integer_type(), CHECK_VERIFY(this));
1024           atype = current_frame.pop_stack(
1025             VerificationType::reference_check(), CHECK_VERIFY(this));
1026           if (!atype.is_short_array()) {
1027             verify_error(ErrorContext::bad_type(bci,
1028                 current_frame.stack_top_ctx(), ref_ctx("[S", THREAD)),
1029                 bad_type_msg, "sastore");
1030             return;
1031           }
1032           no_control_flow = false; break;
1033         case Bytecodes::_lastore :
1034           current_frame.pop_stack_2(
1035             VerificationType::long2_type(),
1036             VerificationType::long_type(), CHECK_VERIFY(this));
1037           current_frame.pop_stack(
1038             VerificationType::integer_type(), CHECK_VERIFY(this));
1039           atype = current_frame.pop_stack(
1040             VerificationType::reference_check(), CHECK_VERIFY(this));
1041           if (!atype.is_long_array()) {
1042             verify_error(ErrorContext::bad_type(bci,
1043                 current_frame.stack_top_ctx(), ref_ctx("[J", THREAD)),
1044                 bad_type_msg, "lastore");
1045             return;
1046           }
1047           no_control_flow = false; break;
1048         case Bytecodes::_fastore :
1049           current_frame.pop_stack(
1050             VerificationType::float_type(), CHECK_VERIFY(this));
1051           current_frame.pop_stack
1052             (VerificationType::integer_type(), CHECK_VERIFY(this));
1053           atype = current_frame.pop_stack(
1054             VerificationType::reference_check(), CHECK_VERIFY(this));
1055           if (!atype.is_float_array()) {
1056             verify_error(ErrorContext::bad_type(bci,
1057                 current_frame.stack_top_ctx(), ref_ctx("[F", THREAD)),
1058                 bad_type_msg, "fastore");
1059             return;
1060           }
1061           no_control_flow = false; break;
1062         case Bytecodes::_dastore :
1063           current_frame.pop_stack_2(
1064             VerificationType::double2_type(),
1065             VerificationType::double_type(), CHECK_VERIFY(this));
1066           current_frame.pop_stack(
1067             VerificationType::integer_type(), CHECK_VERIFY(this));
1068           atype = current_frame.pop_stack(
1069             VerificationType::reference_check(), CHECK_VERIFY(this));
1070           if (!atype.is_double_array()) {
1071             verify_error(ErrorContext::bad_type(bci,
1072                 current_frame.stack_top_ctx(), ref_ctx("[D", THREAD)),
1073                 bad_type_msg, "dastore");
1074             return;
1075           }
1076           no_control_flow = false; break;
1077         case Bytecodes::_aastore :
1078           type = current_frame.pop_stack(object_type(), CHECK_VERIFY(this));
1079           type2 = current_frame.pop_stack(
1080             VerificationType::integer_type(), CHECK_VERIFY(this));
1081           atype = current_frame.pop_stack(
1082             VerificationType::reference_check(), CHECK_VERIFY(this));
1083           // more type-checking is done at runtime
1084           if (!atype.is_reference_array()) {
1085             verify_error(ErrorContext::bad_type(bci,
1086                 current_frame.stack_top_ctx(),
1087                 TypeOrigin::implicit(VerificationType::reference_check())),
1088                 bad_type_msg, "aastore");
1089             return;
1090           }
1091           // 4938384: relaxed constraint in JVMS 3nd edition.
1092           no_control_flow = false; break;
1093         case Bytecodes::_pop :
1094           current_frame.pop_stack(
1095             VerificationType::category1_check(), CHECK_VERIFY(this));
1096           no_control_flow = false; break;
1097         case Bytecodes::_pop2 :
1098           type = current_frame.pop_stack(CHECK_VERIFY(this));
1099           if (type.is_category1()) {
1100             current_frame.pop_stack(
1101               VerificationType::category1_check(), CHECK_VERIFY(this));
1102           } else if (type.is_category2_2nd()) {
1103             current_frame.pop_stack(
1104               VerificationType::category2_check(), CHECK_VERIFY(this));
1105           } else {
1106             /* Unreachable? Would need a category2_1st on TOS
1107              * which does not appear possible. */
1108             verify_error(
1109                 ErrorContext::bad_type(bci, current_frame.stack_top_ctx()),
1110                 bad_type_msg, "pop2");
1111             return;
1112           }
1113           no_control_flow = false; break;
1114         case Bytecodes::_dup :
1115           type = current_frame.pop_stack(
1116             VerificationType::category1_check(), CHECK_VERIFY(this));
1117           current_frame.push_stack(type, CHECK_VERIFY(this));
1118           current_frame.push_stack(type, CHECK_VERIFY(this));
1119           no_control_flow = false; break;
1120         case Bytecodes::_dup_x1 :
1121           type = current_frame.pop_stack(
1122             VerificationType::category1_check(), CHECK_VERIFY(this));
1123           type2 = current_frame.pop_stack(
1124             VerificationType::category1_check(), CHECK_VERIFY(this));
1125           current_frame.push_stack(type, CHECK_VERIFY(this));
1126           current_frame.push_stack(type2, CHECK_VERIFY(this));
1127           current_frame.push_stack(type, CHECK_VERIFY(this));
1128           no_control_flow = false; break;
1129         case Bytecodes::_dup_x2 :
1130         {
1131           VerificationType type3;
1132           type = current_frame.pop_stack(
1133             VerificationType::category1_check(), CHECK_VERIFY(this));
1134           type2 = current_frame.pop_stack(CHECK_VERIFY(this));
1135           if (type2.is_category1()) {
1136             type3 = current_frame.pop_stack(
1137               VerificationType::category1_check(), CHECK_VERIFY(this));
1138           } else if (type2.is_category2_2nd()) {
1139             type3 = current_frame.pop_stack(
1140               VerificationType::category2_check(), CHECK_VERIFY(this));
1141           } else {
1142             /* Unreachable? Would need a category2_1st at stack depth 2 with
1143              * a category1 on TOS which does not appear possible. */
1144             verify_error(ErrorContext::bad_type(
1145                 bci, current_frame.stack_top_ctx()), bad_type_msg, "dup_x2");
1146             return;
1147           }
1148           current_frame.push_stack(type, CHECK_VERIFY(this));
1149           current_frame.push_stack(type3, CHECK_VERIFY(this));
1150           current_frame.push_stack(type2, CHECK_VERIFY(this));
1151           current_frame.push_stack(type, CHECK_VERIFY(this));
1152           no_control_flow = false; break;
1153         }
1154         case Bytecodes::_dup2 :
1155           type = current_frame.pop_stack(CHECK_VERIFY(this));
1156           if (type.is_category1()) {
1157             type2 = current_frame.pop_stack(
1158               VerificationType::category1_check(), CHECK_VERIFY(this));
1159           } else if (type.is_category2_2nd()) {
1160             type2 = current_frame.pop_stack(
1161               VerificationType::category2_check(), CHECK_VERIFY(this));
1162           } else {
1163             /* Unreachable?  Would need a category2_1st on TOS which does not
1164              * appear possible. */
1165             verify_error(
1166                 ErrorContext::bad_type(bci, current_frame.stack_top_ctx()),
1167                 bad_type_msg, "dup2");
1168             return;
1169           }
1170           current_frame.push_stack(type2, CHECK_VERIFY(this));
1171           current_frame.push_stack(type, CHECK_VERIFY(this));
1172           current_frame.push_stack(type2, CHECK_VERIFY(this));
1173           current_frame.push_stack(type, CHECK_VERIFY(this));
1174           no_control_flow = false; break;
1175         case Bytecodes::_dup2_x1 :
1176         {
1177           VerificationType type3;
1178           type = current_frame.pop_stack(CHECK_VERIFY(this));
1179           if (type.is_category1()) {
1180             type2 = current_frame.pop_stack(
1181               VerificationType::category1_check(), CHECK_VERIFY(this));
1182           } else if (type.is_category2_2nd()) {
1183             type2 = current_frame.pop_stack(
1184               VerificationType::category2_check(), CHECK_VERIFY(this));
1185           } else {
1186             /* Unreachable?  Would need a category2_1st on TOS which does
1187              * not appear possible. */
1188             verify_error(
1189                 ErrorContext::bad_type(bci, current_frame.stack_top_ctx()),
1190                 bad_type_msg, "dup2_x1");
1191             return;
1192           }
1193           type3 = current_frame.pop_stack(
1194             VerificationType::category1_check(), CHECK_VERIFY(this));
1195           current_frame.push_stack(type2, CHECK_VERIFY(this));
1196           current_frame.push_stack(type, CHECK_VERIFY(this));
1197           current_frame.push_stack(type3, CHECK_VERIFY(this));
1198           current_frame.push_stack(type2, CHECK_VERIFY(this));
1199           current_frame.push_stack(type, CHECK_VERIFY(this));
1200           no_control_flow = false; break;
1201         }
1202         case Bytecodes::_dup2_x2 :
1203         {
1204           VerificationType type3, type4;
1205           type = current_frame.pop_stack(CHECK_VERIFY(this));
1206           if (type.is_category1()) {
1207             type2 = current_frame.pop_stack(
1208               VerificationType::category1_check(), CHECK_VERIFY(this));
1209           } else if (type.is_category2_2nd()) {
1210             type2 = current_frame.pop_stack(
1211               VerificationType::category2_check(), CHECK_VERIFY(this));
1212           } else {
1213             /* Unreachable?  Would need a category2_1st on TOS which does
1214              * not appear possible. */
1215             verify_error(
1216                 ErrorContext::bad_type(bci, current_frame.stack_top_ctx()),
1217                 bad_type_msg, "dup2_x2");
1218             return;
1219           }
1220           type3 = current_frame.pop_stack(CHECK_VERIFY(this));
1221           if (type3.is_category1()) {
1222             type4 = current_frame.pop_stack(
1223               VerificationType::category1_check(), CHECK_VERIFY(this));
1224           } else if (type3.is_category2_2nd()) {
1225             type4 = current_frame.pop_stack(
1226               VerificationType::category2_check(), CHECK_VERIFY(this));
1227           } else {
1228             /* Unreachable?  Would need a category2_1st on TOS after popping
1229              * a long/double or two category 1's, which does not
1230              * appear possible. */
1231             verify_error(
1232                 ErrorContext::bad_type(bci, current_frame.stack_top_ctx()),
1233                 bad_type_msg, "dup2_x2");
1234             return;
1235           }
1236           current_frame.push_stack(type2, CHECK_VERIFY(this));
1237           current_frame.push_stack(type, CHECK_VERIFY(this));
1238           current_frame.push_stack(type4, CHECK_VERIFY(this));
1239           current_frame.push_stack(type3, CHECK_VERIFY(this));
1240           current_frame.push_stack(type2, CHECK_VERIFY(this));
1241           current_frame.push_stack(type, CHECK_VERIFY(this));
1242           no_control_flow = false; break;
1243         }
1244         case Bytecodes::_swap :
1245           type = current_frame.pop_stack(
1246             VerificationType::category1_check(), CHECK_VERIFY(this));
1247           type2 = current_frame.pop_stack(
1248             VerificationType::category1_check(), CHECK_VERIFY(this));
1249           current_frame.push_stack(type, CHECK_VERIFY(this));
1250           current_frame.push_stack(type2, CHECK_VERIFY(this));
1251           no_control_flow = false; break;
1252         case Bytecodes::_iadd :
1253         case Bytecodes::_isub :
1254         case Bytecodes::_imul :
1255         case Bytecodes::_idiv :
1256         case Bytecodes::_irem :
1257         case Bytecodes::_ishl :
1258         case Bytecodes::_ishr :
1259         case Bytecodes::_iushr :
1260         case Bytecodes::_ior :
1261         case Bytecodes::_ixor :
1262         case Bytecodes::_iand :
1263           current_frame.pop_stack(
1264             VerificationType::integer_type(), CHECK_VERIFY(this));
1265           // fall through
1266         case Bytecodes::_ineg :
1267           current_frame.pop_stack(
1268             VerificationType::integer_type(), CHECK_VERIFY(this));
1269           current_frame.push_stack(
1270             VerificationType::integer_type(), CHECK_VERIFY(this));
1271           no_control_flow = false; break;
1272         case Bytecodes::_ladd :
1273         case Bytecodes::_lsub :
1274         case Bytecodes::_lmul :
1275         case Bytecodes::_ldiv :
1276         case Bytecodes::_lrem :
1277         case Bytecodes::_land :
1278         case Bytecodes::_lor :
1279         case Bytecodes::_lxor :
1280           current_frame.pop_stack_2(
1281             VerificationType::long2_type(),
1282             VerificationType::long_type(), CHECK_VERIFY(this));
1283           // fall through
1284         case Bytecodes::_lneg :
1285           current_frame.pop_stack_2(
1286             VerificationType::long2_type(),
1287             VerificationType::long_type(), CHECK_VERIFY(this));
1288           current_frame.push_stack_2(
1289             VerificationType::long_type(),
1290             VerificationType::long2_type(), CHECK_VERIFY(this));
1291           no_control_flow = false; break;
1292         case Bytecodes::_lshl :
1293         case Bytecodes::_lshr :
1294         case Bytecodes::_lushr :
1295           current_frame.pop_stack(
1296             VerificationType::integer_type(), CHECK_VERIFY(this));
1297           current_frame.pop_stack_2(
1298             VerificationType::long2_type(),
1299             VerificationType::long_type(), CHECK_VERIFY(this));
1300           current_frame.push_stack_2(
1301             VerificationType::long_type(),
1302             VerificationType::long2_type(), CHECK_VERIFY(this));
1303           no_control_flow = false; break;
1304         case Bytecodes::_fadd :
1305         case Bytecodes::_fsub :
1306         case Bytecodes::_fmul :
1307         case Bytecodes::_fdiv :
1308         case Bytecodes::_frem :
1309           current_frame.pop_stack(
1310             VerificationType::float_type(), CHECK_VERIFY(this));
1311           // fall through
1312         case Bytecodes::_fneg :
1313           current_frame.pop_stack(
1314             VerificationType::float_type(), CHECK_VERIFY(this));
1315           current_frame.push_stack(
1316             VerificationType::float_type(), CHECK_VERIFY(this));
1317           no_control_flow = false; break;
1318         case Bytecodes::_dadd :
1319         case Bytecodes::_dsub :
1320         case Bytecodes::_dmul :
1321         case Bytecodes::_ddiv :
1322         case Bytecodes::_drem :
1323           current_frame.pop_stack_2(
1324             VerificationType::double2_type(),
1325             VerificationType::double_type(), CHECK_VERIFY(this));
1326           // fall through
1327         case Bytecodes::_dneg :
1328           current_frame.pop_stack_2(
1329             VerificationType::double2_type(),
1330             VerificationType::double_type(), CHECK_VERIFY(this));
1331           current_frame.push_stack_2(
1332             VerificationType::double_type(),
1333             VerificationType::double2_type(), CHECK_VERIFY(this));
1334           no_control_flow = false; break;
1335         case Bytecodes::_iinc :
1336           verify_iinc(bcs.get_index(), &current_frame, CHECK_VERIFY(this));
1337           no_control_flow = false; break;
1338         case Bytecodes::_i2l :
1339           type = current_frame.pop_stack(
1340             VerificationType::integer_type(), CHECK_VERIFY(this));
1341           current_frame.push_stack_2(
1342             VerificationType::long_type(),
1343             VerificationType::long2_type(), CHECK_VERIFY(this));
1344           no_control_flow = false; break;
1345        case Bytecodes::_l2i :
1346           current_frame.pop_stack_2(
1347             VerificationType::long2_type(),
1348             VerificationType::long_type(), CHECK_VERIFY(this));
1349           current_frame.push_stack(
1350             VerificationType::integer_type(), CHECK_VERIFY(this));
1351           no_control_flow = false; break;
1352         case Bytecodes::_i2f :
1353           current_frame.pop_stack(
1354             VerificationType::integer_type(), CHECK_VERIFY(this));
1355           current_frame.push_stack(
1356             VerificationType::float_type(), CHECK_VERIFY(this));
1357           no_control_flow = false; break;
1358         case Bytecodes::_i2d :
1359           current_frame.pop_stack(
1360             VerificationType::integer_type(), CHECK_VERIFY(this));
1361           current_frame.push_stack_2(
1362             VerificationType::double_type(),
1363             VerificationType::double2_type(), CHECK_VERIFY(this));
1364           no_control_flow = false; break;
1365         case Bytecodes::_l2f :
1366           current_frame.pop_stack_2(
1367             VerificationType::long2_type(),
1368             VerificationType::long_type(), CHECK_VERIFY(this));
1369           current_frame.push_stack(
1370             VerificationType::float_type(), CHECK_VERIFY(this));
1371           no_control_flow = false; break;
1372         case Bytecodes::_l2d :
1373           current_frame.pop_stack_2(
1374             VerificationType::long2_type(),
1375             VerificationType::long_type(), CHECK_VERIFY(this));
1376           current_frame.push_stack_2(
1377             VerificationType::double_type(),
1378             VerificationType::double2_type(), CHECK_VERIFY(this));
1379           no_control_flow = false; break;
1380         case Bytecodes::_f2i :
1381           current_frame.pop_stack(
1382             VerificationType::float_type(), CHECK_VERIFY(this));
1383           current_frame.push_stack(
1384             VerificationType::integer_type(), CHECK_VERIFY(this));
1385           no_control_flow = false; break;
1386         case Bytecodes::_f2l :
1387           current_frame.pop_stack(
1388             VerificationType::float_type(), CHECK_VERIFY(this));
1389           current_frame.push_stack_2(
1390             VerificationType::long_type(),
1391             VerificationType::long2_type(), CHECK_VERIFY(this));
1392           no_control_flow = false; break;
1393         case Bytecodes::_f2d :
1394           current_frame.pop_stack(
1395             VerificationType::float_type(), CHECK_VERIFY(this));
1396           current_frame.push_stack_2(
1397             VerificationType::double_type(),
1398             VerificationType::double2_type(), CHECK_VERIFY(this));
1399           no_control_flow = false; break;
1400         case Bytecodes::_d2i :
1401           current_frame.pop_stack_2(
1402             VerificationType::double2_type(),
1403             VerificationType::double_type(), CHECK_VERIFY(this));
1404           current_frame.push_stack(
1405             VerificationType::integer_type(), CHECK_VERIFY(this));
1406           no_control_flow = false; break;
1407         case Bytecodes::_d2l :
1408           current_frame.pop_stack_2(
1409             VerificationType::double2_type(),
1410             VerificationType::double_type(), CHECK_VERIFY(this));
1411           current_frame.push_stack_2(
1412             VerificationType::long_type(),
1413             VerificationType::long2_type(), CHECK_VERIFY(this));
1414           no_control_flow = false; break;
1415         case Bytecodes::_d2f :
1416           current_frame.pop_stack_2(
1417             VerificationType::double2_type(),
1418             VerificationType::double_type(), CHECK_VERIFY(this));
1419           current_frame.push_stack(
1420             VerificationType::float_type(), CHECK_VERIFY(this));
1421           no_control_flow = false; break;
1422         case Bytecodes::_i2b :
1423         case Bytecodes::_i2c :
1424         case Bytecodes::_i2s :
1425           current_frame.pop_stack(
1426             VerificationType::integer_type(), CHECK_VERIFY(this));
1427           current_frame.push_stack(
1428             VerificationType::integer_type(), CHECK_VERIFY(this));
1429           no_control_flow = false; break;
1430         case Bytecodes::_lcmp :
1431           current_frame.pop_stack_2(
1432             VerificationType::long2_type(),
1433             VerificationType::long_type(), CHECK_VERIFY(this));
1434           current_frame.pop_stack_2(
1435             VerificationType::long2_type(),
1436             VerificationType::long_type(), CHECK_VERIFY(this));
1437           current_frame.push_stack(
1438             VerificationType::integer_type(), CHECK_VERIFY(this));
1439           no_control_flow = false; break;
1440         case Bytecodes::_fcmpl :
1441         case Bytecodes::_fcmpg :
1442           current_frame.pop_stack(
1443             VerificationType::float_type(), CHECK_VERIFY(this));
1444           current_frame.pop_stack(
1445             VerificationType::float_type(), CHECK_VERIFY(this));
1446           current_frame.push_stack(
1447             VerificationType::integer_type(), CHECK_VERIFY(this));
1448           no_control_flow = false; break;
1449         case Bytecodes::_dcmpl :
1450         case Bytecodes::_dcmpg :
1451           current_frame.pop_stack_2(
1452             VerificationType::double2_type(),
1453             VerificationType::double_type(), CHECK_VERIFY(this));
1454           current_frame.pop_stack_2(
1455             VerificationType::double2_type(),
1456             VerificationType::double_type(), CHECK_VERIFY(this));
1457           current_frame.push_stack(
1458             VerificationType::integer_type(), CHECK_VERIFY(this));
1459           no_control_flow = false; break;
1460         case Bytecodes::_if_icmpeq:
1461         case Bytecodes::_if_icmpne:
1462         case Bytecodes::_if_icmplt:
1463         case Bytecodes::_if_icmpge:
1464         case Bytecodes::_if_icmpgt:
1465         case Bytecodes::_if_icmple:
1466           current_frame.pop_stack(
1467             VerificationType::integer_type(), CHECK_VERIFY(this));
1468           // fall through
1469         case Bytecodes::_ifeq:
1470         case Bytecodes::_ifne:
1471         case Bytecodes::_iflt:
1472         case Bytecodes::_ifge:
1473         case Bytecodes::_ifgt:
1474         case Bytecodes::_ifle:
1475           current_frame.pop_stack(
1476             VerificationType::integer_type(), CHECK_VERIFY(this));
1477           target = bcs.dest();
1478           stackmap_table.check_jump_target(
1479             &current_frame, target, CHECK_VERIFY(this));
1480           no_control_flow = false; break;
1481         case Bytecodes::_if_acmpeq :
1482         case Bytecodes::_if_acmpne :
1483           current_frame.pop_stack(
1484             VerificationType::reference_check(), CHECK_VERIFY(this));
1485           // fall through
1486         case Bytecodes::_ifnull :
1487         case Bytecodes::_ifnonnull :
1488           current_frame.pop_stack(
1489             VerificationType::reference_check(), CHECK_VERIFY(this));
1490           target = bcs.dest();
1491           stackmap_table.check_jump_target
1492             (&current_frame, target, CHECK_VERIFY(this));
1493           no_control_flow = false; break;
1494         case Bytecodes::_goto :
1495           target = bcs.dest();
1496           stackmap_table.check_jump_target(
1497             &current_frame, target, CHECK_VERIFY(this));
1498           no_control_flow = true; break;
1499         case Bytecodes::_goto_w :
1500           target = bcs.dest_w();
1501           stackmap_table.check_jump_target(
1502             &current_frame, target, CHECK_VERIFY(this));
1503           no_control_flow = true; break;
1504         case Bytecodes::_tableswitch :
1505         case Bytecodes::_lookupswitch :
1506           verify_switch(
1507             &bcs, code_length, code_data, &current_frame,
1508             &stackmap_table, CHECK_VERIFY(this));
1509           no_control_flow = true; break;
1510         case Bytecodes::_ireturn :
1511           type = current_frame.pop_stack(
1512             VerificationType::integer_type(), CHECK_VERIFY(this));
1513           verify_return_value(return_type, type, bci,
1514                               &current_frame, CHECK_VERIFY(this));
1515           no_control_flow = true; break;
1516         case Bytecodes::_lreturn :
1517           type2 = current_frame.pop_stack(
1518             VerificationType::long2_type(), CHECK_VERIFY(this));
1519           type = current_frame.pop_stack(
1520             VerificationType::long_type(), CHECK_VERIFY(this));
1521           verify_return_value(return_type, type, bci,
1522                               &current_frame, CHECK_VERIFY(this));
1523           no_control_flow = true; break;
1524         case Bytecodes::_freturn :
1525           type = current_frame.pop_stack(
1526             VerificationType::float_type(), CHECK_VERIFY(this));
1527           verify_return_value(return_type, type, bci,
1528                               &current_frame, CHECK_VERIFY(this));
1529           no_control_flow = true; break;
1530         case Bytecodes::_dreturn :
1531           type2 = current_frame.pop_stack(
1532             VerificationType::double2_type(),  CHECK_VERIFY(this));
1533           type = current_frame.pop_stack(
1534             VerificationType::double_type(), CHECK_VERIFY(this));
1535           verify_return_value(return_type, type, bci,
1536                               &current_frame, CHECK_VERIFY(this));
1537           no_control_flow = true; break;
1538         case Bytecodes::_areturn :
1539           type = current_frame.pop_stack(
1540             VerificationType::reference_check(), CHECK_VERIFY(this));
1541           verify_return_value(return_type, type, bci,
1542                               &current_frame, CHECK_VERIFY(this));
1543           no_control_flow = true; break;
1544         case Bytecodes::_return :
1545           if (return_type != VerificationType::bogus_type()) {
1546             verify_error(ErrorContext::bad_code(bci),
1547                          "Method expects a return value");
1548             return;
1549           }
1550           // Make sure "this" has been initialized if current method is an
1551           // <init>
1552           if (_method->name() == vmSymbols::object_initializer_name() &&
1553               current_frame.flag_this_uninit()) {
1554             verify_error(ErrorContext::bad_code(bci),
1555                          "Constructor must call super() or this() "
1556                          "before return");
1557             return;
1558           }
1559           no_control_flow = true; break;
1560         case Bytecodes::_getstatic :
1561         case Bytecodes::_putstatic :
1562           // pass TRUE, operand can be an array type for getstatic/putstatic.
1563           verify_field_instructions(
1564             &bcs, &current_frame, cp, true, CHECK_VERIFY(this));
1565           no_control_flow = false; break;
1566         case Bytecodes::_getfield :
1567         case Bytecodes::_putfield :
1568           // pass FALSE, operand can't be an array type for getfield/putfield.
1569           verify_field_instructions(
1570             &bcs, &current_frame, cp, false, CHECK_VERIFY(this));
1571           no_control_flow = false; break;
1572         case Bytecodes::_invokevirtual :
1573         case Bytecodes::_invokespecial :
1574         case Bytecodes::_invokestatic :
1575           verify_invoke_instructions(
1576             &bcs, code_length, &current_frame, (bci >= ex_min && bci < ex_max),
1577             &this_uninit, return_type, cp, &stackmap_table, CHECK_VERIFY(this));
1578           no_control_flow = false; break;
1579         case Bytecodes::_invokeinterface :
1580         case Bytecodes::_invokedynamic :
1581           verify_invoke_instructions(
1582             &bcs, code_length, &current_frame, (bci >= ex_min && bci < ex_max),
1583             &this_uninit, return_type, cp, &stackmap_table, CHECK_VERIFY(this));
1584           no_control_flow = false; break;
1585         case Bytecodes::_new :
1586         {
1587           index = bcs.get_index_u2();
1588           verify_cp_class_type(bci, index, cp, CHECK_VERIFY(this));
1589           VerificationType new_class_type =
1590             cp_index_to_type(index, cp, CHECK_VERIFY(this));
1591           if (!new_class_type.is_object()) {
1592             verify_error(ErrorContext::bad_type(bci,
1593                 TypeOrigin::cp(index, new_class_type)),
1594                 "Illegal new instruction");
1595             return;
1596           }
1597           type = VerificationType::uninitialized_type(bci);
1598           current_frame.push_stack(type, CHECK_VERIFY(this));
1599           no_control_flow = false; break;
1600         }
1601         case Bytecodes::_newarray :
1602           type = get_newarray_type(bcs.get_index(), bci, CHECK_VERIFY(this));
1603           current_frame.pop_stack(
1604             VerificationType::integer_type(),  CHECK_VERIFY(this));
1605           current_frame.push_stack(type, CHECK_VERIFY(this));
1606           no_control_flow = false; break;
1607         case Bytecodes::_anewarray :
1608           verify_anewarray(
1609             bci, bcs.get_index_u2(), cp, &current_frame, CHECK_VERIFY(this));
1610           no_control_flow = false; break;
1611         case Bytecodes::_arraylength :
1612           type = current_frame.pop_stack(
1613             VerificationType::reference_check(), CHECK_VERIFY(this));
1614           if (!(type.is_null() || type.is_array())) {
1615             verify_error(ErrorContext::bad_type(
1616                 bci, current_frame.stack_top_ctx()),
1617                 bad_type_msg, "arraylength");
1618           }
1619           current_frame.push_stack(
1620             VerificationType::integer_type(), CHECK_VERIFY(this));
1621           no_control_flow = false; break;
1622         case Bytecodes::_checkcast :
1623         {
1624           index = bcs.get_index_u2();
1625           verify_cp_class_type(bci, index, cp, CHECK_VERIFY(this));
1626           current_frame.pop_stack(object_type(), CHECK_VERIFY(this));
1627           VerificationType klass_type = cp_index_to_type(
1628             index, cp, CHECK_VERIFY(this));
1629           current_frame.push_stack(klass_type, CHECK_VERIFY(this));
1630           no_control_flow = false; break;
1631         }
1632         case Bytecodes::_instanceof : {
1633           index = bcs.get_index_u2();
1634           verify_cp_class_type(bci, index, cp, CHECK_VERIFY(this));
1635           current_frame.pop_stack(object_type(), CHECK_VERIFY(this));
1636           current_frame.push_stack(
1637             VerificationType::integer_type(), CHECK_VERIFY(this));
1638           no_control_flow = false; break;
1639         }
1640         case Bytecodes::_monitorenter :
1641         case Bytecodes::_monitorexit :
1642           current_frame.pop_stack(
1643             VerificationType::reference_check(), CHECK_VERIFY(this));
1644           no_control_flow = false; break;
1645         case Bytecodes::_multianewarray :
1646         {
1647           index = bcs.get_index_u2();
1648           u2 dim = *(bcs.bcp()+3);
1649           verify_cp_class_type(bci, index, cp, CHECK_VERIFY(this));
1650           VerificationType new_array_type =
1651             cp_index_to_type(index, cp, CHECK_VERIFY(this));
1652           if (!new_array_type.is_array()) {
1653             verify_error(ErrorContext::bad_type(bci,
1654                 TypeOrigin::cp(index, new_array_type)),
1655                 "Illegal constant pool index in multianewarray instruction");
1656             return;
1657           }
1658           if (dim < 1 || new_array_type.dimensions() < dim) {
1659             verify_error(ErrorContext::bad_code(bci),
1660                 "Illegal dimension in multianewarray instruction: %d", dim);
1661             return;
1662           }
1663           for (int i = 0; i < dim; i++) {
1664             current_frame.pop_stack(
1665               VerificationType::integer_type(), CHECK_VERIFY(this));
1666           }
1667           current_frame.push_stack(new_array_type, CHECK_VERIFY(this));
1668           no_control_flow = false; break;
1669         }
1670         case Bytecodes::_athrow :
1671           type = VerificationType::reference_type(
1672             vmSymbols::java_lang_Throwable());
1673           current_frame.pop_stack(type, CHECK_VERIFY(this));
1674           no_control_flow = true; break;
1675         default:
1676           // We only need to check the valid bytecodes in class file.
1677           // And jsr and ret are not in the new class file format in JDK1.5.
1678           verify_error(ErrorContext::bad_code(bci),
1679               "Bad instruction: %02x", opcode);
1680           no_control_flow = false;
1681           return;
1682       }  // end switch
1683     }  // end Merge with the next instruction
1684 
1685     // Look for possible jump target in exception handlers and see if it matches
1686     // current_frame.  Don't do this check if it has already been done (for
1687     // ([a,d,f,i,l]store* opcodes).  This check cannot be done earlier because
1688     // opcodes, such as invokespecial, may set the this_uninit flag.
1689     assert(!(verified_exc_handlers && this_uninit),
1690       "Exception handler targets got verified before this_uninit got set");
1691     if (!verified_exc_handlers && bci >= ex_min && bci < ex_max) {
1692       verify_exception_handler_targets(
1693         bci, this_uninit, &current_frame, &stackmap_table, CHECK_VERIFY(this));
1694     }
1695   } // end while
1696 
1697   // Make sure that control flow does not fall through end of the method
1698   if (!no_control_flow) {
1699     verify_error(ErrorContext::bad_code(code_length),
1700         "Control flow falls through code end");
1701     return;
1702   }
1703 }
1704 
1705 #undef bad_type_message
1706 
1707 char* ClassVerifier::generate_code_data(methodHandle m, u4 code_length, TRAPS) {
1708   char* code_data = NEW_RESOURCE_ARRAY(char, code_length);
1709   memset(code_data, 0, sizeof(char) * code_length);
1710   RawBytecodeStream bcs(m);
1711 
1712   while (!bcs.is_last_bytecode()) {
1713     if (bcs.raw_next() != Bytecodes::_illegal) {
1714       int bci = bcs.bci();
1715       if (bcs.raw_code() == Bytecodes::_new) {
1716         code_data[bci] = NEW_OFFSET;
1717       } else {
1718         code_data[bci] = BYTECODE_OFFSET;
1719       }
1720     } else {
1721       verify_error(ErrorContext::bad_code(bcs.bci()), "Bad instruction");
1722       return NULL;
1723     }
1724   }
1725 
1726   return code_data;
1727 }
1728 
1729 void ClassVerifier::verify_exception_handler_table(u4 code_length, char* code_data, int& min, int& max, TRAPS) {
1730   ExceptionTable exhandlers(_method());
1731   int exlength = exhandlers.length();
1732   constantPoolHandle cp (THREAD, _method->constants());
1733 
1734   for(int i = 0; i < exlength; i++) {
1735     u2 start_pc = exhandlers.start_pc(i);
1736     u2 end_pc = exhandlers.end_pc(i);
1737     u2 handler_pc = exhandlers.handler_pc(i);
1738     if (start_pc >= code_length || code_data[start_pc] == 0) {
1739       class_format_error("Illegal exception table start_pc %d", start_pc);
1740       return;
1741     }
1742     if (end_pc != code_length) {   // special case: end_pc == code_length
1743       if (end_pc > code_length || code_data[end_pc] == 0) {
1744         class_format_error("Illegal exception table end_pc %d", end_pc);
1745         return;
1746       }
1747     }
1748     if (handler_pc >= code_length || code_data[handler_pc] == 0) {
1749       class_format_error("Illegal exception table handler_pc %d", handler_pc);
1750       return;
1751     }
1752     int catch_type_index = exhandlers.catch_type_index(i);
1753     if (catch_type_index != 0) {
1754       VerificationType catch_type = cp_index_to_type(
1755         catch_type_index, cp, CHECK_VERIFY(this));
1756       VerificationType throwable =
1757         VerificationType::reference_type(vmSymbols::java_lang_Throwable());
1758       bool is_subclass = throwable.is_assignable_from(
1759         catch_type, this, false, CHECK_VERIFY(this));
1760       if (!is_subclass) {
1761         // 4286534: should throw VerifyError according to recent spec change
1762         verify_error(ErrorContext::bad_type(handler_pc,
1763             TypeOrigin::cp(catch_type_index, catch_type),
1764             TypeOrigin::implicit(throwable)),
1765             "Catch type is not a subclass "
1766             "of Throwable in exception handler %d", handler_pc);
1767         return;
1768       }
1769     }
1770     if (start_pc < min) min = start_pc;
1771     if (end_pc > max) max = end_pc;
1772   }
1773 }
1774 
1775 void ClassVerifier::verify_local_variable_table(u4 code_length, char* code_data, TRAPS) {
1776   int localvariable_table_length = _method()->localvariable_table_length();
1777   if (localvariable_table_length > 0) {
1778     LocalVariableTableElement* table = _method()->localvariable_table_start();
1779     for (int i = 0; i < localvariable_table_length; i++) {
1780       u2 start_bci = table[i].start_bci;
1781       u2 length = table[i].length;
1782 
1783       if (start_bci >= code_length || code_data[start_bci] == 0) {
1784         class_format_error(
1785           "Illegal local variable table start_pc %d", start_bci);
1786         return;
1787       }
1788       u4 end_bci = (u4)(start_bci + length);
1789       if (end_bci != code_length) {
1790         if (end_bci >= code_length || code_data[end_bci] == 0) {
1791           class_format_error( "Illegal local variable table length %d", length);
1792           return;
1793         }
1794       }
1795     }
1796   }
1797 }
1798 
1799 u2 ClassVerifier::verify_stackmap_table(u2 stackmap_index, u2 bci,
1800                                         StackMapFrame* current_frame,
1801                                         StackMapTable* stackmap_table,
1802                                         bool no_control_flow, TRAPS) {
1803   if (stackmap_index < stackmap_table->get_frame_count()) {
1804     u2 this_offset = stackmap_table->get_offset(stackmap_index);
1805     if (no_control_flow && this_offset > bci) {
1806       verify_error(ErrorContext::missing_stackmap(bci),
1807                    "Expecting a stack map frame");
1808       return 0;
1809     }
1810     if (this_offset == bci) {
1811       ErrorContext ctx;
1812       // See if current stack map can be assigned to the frame in table.
1813       // current_frame is the stackmap frame got from the last instruction.
1814       // If matched, current_frame will be updated by this method.
1815       bool matches = stackmap_table->match_stackmap(
1816         current_frame, this_offset, stackmap_index,
1817         !no_control_flow, true, false, &ctx, CHECK_VERIFY_(this, 0));
1818       if (!matches) {
1819         // report type error
1820         verify_error(ctx, "Instruction type does not match stack map");
1821         return 0;
1822       }
1823       stackmap_index++;
1824     } else if (this_offset < bci) {
1825       // current_offset should have met this_offset.
1826       class_format_error("Bad stack map offset %d", this_offset);
1827       return 0;
1828     }
1829   } else if (no_control_flow) {
1830     verify_error(ErrorContext::bad_code(bci), "Expecting a stack map frame");
1831     return 0;
1832   }
1833   return stackmap_index;
1834 }
1835 
1836 void ClassVerifier::verify_exception_handler_targets(u2 bci, bool this_uninit, StackMapFrame* current_frame,
1837                                                      StackMapTable* stackmap_table, TRAPS) {
1838   constantPoolHandle cp (THREAD, _method->constants());
1839   ExceptionTable exhandlers(_method());
1840   int exlength = exhandlers.length();
1841   for(int i = 0; i < exlength; i++) {
1842     u2 start_pc = exhandlers.start_pc(i);
1843     u2 end_pc = exhandlers.end_pc(i);
1844     u2 handler_pc = exhandlers.handler_pc(i);
1845     int catch_type_index = exhandlers.catch_type_index(i);
1846     if(bci >= start_pc && bci < end_pc) {
1847       u1 flags = current_frame->flags();
1848       if (this_uninit) {  flags |= FLAG_THIS_UNINIT; }
1849       StackMapFrame* new_frame = current_frame->frame_in_exception_handler(flags);
1850       if (catch_type_index != 0) {
1851         // We know that this index refers to a subclass of Throwable
1852         VerificationType catch_type = cp_index_to_type(
1853           catch_type_index, cp, CHECK_VERIFY(this));
1854         new_frame->push_stack(catch_type, CHECK_VERIFY(this));
1855       } else {
1856         VerificationType throwable =
1857           VerificationType::reference_type(vmSymbols::java_lang_Throwable());
1858         new_frame->push_stack(throwable, CHECK_VERIFY(this));
1859       }
1860       ErrorContext ctx;
1861       bool matches = stackmap_table->match_stackmap(
1862         new_frame, handler_pc, true, false, true, &ctx, CHECK_VERIFY(this));
1863       if (!matches) {
1864         verify_error(ctx, "Stack map does not match the one at "
1865             "exception handler %d", handler_pc);
1866         return;
1867       }
1868     }
1869   }
1870 }
1871 
1872 void ClassVerifier::verify_cp_index(
1873     u2 bci, constantPoolHandle cp, int index, TRAPS) {
1874   int nconstants = cp->length();
1875   if ((index <= 0) || (index >= nconstants)) {
1876     verify_error(ErrorContext::bad_cp_index(bci, index),
1877         "Illegal constant pool index %d in class %s",
1878         index, cp->pool_holder()->external_name());
1879     return;
1880   }
1881 }
1882 
1883 void ClassVerifier::verify_cp_type(
1884     u2 bci, int index, constantPoolHandle cp, unsigned int types, TRAPS) {
1885 
1886   // In some situations, bytecode rewriting may occur while we're verifying.
1887   // In this case, a constant pool cache exists and some indices refer to that
1888   // instead.  Be sure we don't pick up such indices by accident.
1889   // We must check was_recursively_verified() before we get here.
1890   guarantee(cp->cache() == NULL, "not rewritten yet");
1891 
1892   verify_cp_index(bci, cp, index, CHECK_VERIFY(this));
1893   unsigned int tag = cp->tag_at(index).value();
1894   if ((types & (1 << tag)) == 0) {
1895     verify_error(ErrorContext::bad_cp_index(bci, index),
1896       "Illegal type at constant pool entry %d in class %s",
1897       index, cp->pool_holder()->external_name());
1898     return;
1899   }
1900 }
1901 
1902 void ClassVerifier::verify_cp_class_type(
1903     u2 bci, int index, constantPoolHandle cp, TRAPS) {
1904   verify_cp_index(bci, cp, index, CHECK_VERIFY(this));
1905   constantTag tag = cp->tag_at(index);
1906   if (!tag.is_klass() && !tag.is_unresolved_klass()) {
1907     verify_error(ErrorContext::bad_cp_index(bci, index),
1908         "Illegal type at constant pool entry %d in class %s",
1909         index, cp->pool_holder()->external_name());
1910     return;
1911   }
1912 }
1913 
1914 void ClassVerifier::verify_error(ErrorContext ctx, const char* msg, ...) {
1915   stringStream ss;
1916 
1917   ctx.reset_frames();
1918   _exception_type = vmSymbols::java_lang_VerifyError();
1919   _error_context = ctx;
1920   va_list va;
1921   va_start(va, msg);
1922   ss.vprint(msg, va);
1923   va_end(va);
1924   _message = ss.as_string();
1925 #ifdef ASSERT
1926   ResourceMark rm;
1927   const char* exception_name = _exception_type->as_C_string();
1928   Exceptions::debug_check_abort(exception_name, NULL);
1929 #endif // ndef ASSERT
1930 }
1931 
1932 void ClassVerifier::class_format_error(const char* msg, ...) {
1933   stringStream ss;
1934   _exception_type = vmSymbols::java_lang_ClassFormatError();
1935   va_list va;
1936   va_start(va, msg);
1937   ss.vprint(msg, va);
1938   va_end(va);
1939   if (!_method.is_null()) {
1940     ss.print(" in method %s", _method->name_and_sig_as_C_string());
1941   }
1942   _message = ss.as_string();
1943 }
1944 
1945 Klass* ClassVerifier::load_class(Symbol* name, TRAPS) {
1946   // Get current loader and protection domain first.
1947   oop loader = current_class()->class_loader();
1948   oop protection_domain = current_class()->protection_domain();
1949 
1950   return SystemDictionary::resolve_or_fail(
1951     name, Handle(THREAD, loader), Handle(THREAD, protection_domain),
1952     true, THREAD);
1953 }
1954 
1955 bool ClassVerifier::is_protected_access(instanceKlassHandle this_class,
1956                                         Klass* target_class,
1957                                         Symbol* field_name,
1958                                         Symbol* field_sig,
1959                                         bool is_method) {
1960   No_Safepoint_Verifier nosafepoint;
1961 
1962   // If target class isn't a super class of this class, we don't worry about this case
1963   if (!this_class->is_subclass_of(target_class)) {
1964     return false;
1965   }
1966   // Check if the specified method or field is protected
1967   InstanceKlass* target_instance = InstanceKlass::cast(target_class);
1968   fieldDescriptor fd;
1969   if (is_method) {
1970     Method* m = target_instance->uncached_lookup_method(field_name, field_sig, Klass::find_overpass);
1971     if (m != NULL && m->is_protected()) {
1972       if (!this_class->is_same_class_package(m->method_holder())) {
1973         return true;
1974       }
1975     }
1976   } else {
1977     Klass* member_klass = target_instance->find_field(field_name, field_sig, &fd);
1978     if (member_klass != NULL && fd.is_protected()) {
1979       if (!this_class->is_same_class_package(member_klass)) {
1980         return true;
1981       }
1982     }
1983   }
1984   return false;
1985 }
1986 
1987 void ClassVerifier::verify_ldc(
1988     int opcode, u2 index, StackMapFrame* current_frame,
1989     constantPoolHandle cp, u2 bci, TRAPS) {
1990   verify_cp_index(bci, cp, index, CHECK_VERIFY(this));
1991   constantTag tag = cp->tag_at(index);
1992   unsigned int types;
1993   if (opcode == Bytecodes::_ldc || opcode == Bytecodes::_ldc_w) {
1994     if (!tag.is_unresolved_klass()) {
1995       types = (1 << JVM_CONSTANT_Integer) | (1 << JVM_CONSTANT_Float)
1996             | (1 << JVM_CONSTANT_String)  | (1 << JVM_CONSTANT_Class)
1997             | (1 << JVM_CONSTANT_MethodHandle) | (1 << JVM_CONSTANT_MethodType);
1998       // Note:  The class file parser already verified the legality of
1999       // MethodHandle and MethodType constants.
2000       verify_cp_type(bci, index, cp, types, CHECK_VERIFY(this));
2001     }
2002   } else {
2003     assert(opcode == Bytecodes::_ldc2_w, "must be ldc2_w");
2004     types = (1 << JVM_CONSTANT_Double) | (1 << JVM_CONSTANT_Long);
2005     verify_cp_type(bci, index, cp, types, CHECK_VERIFY(this));
2006   }
2007   if (tag.is_string() && cp->is_pseudo_string_at(index)) {
2008     current_frame->push_stack(object_type(), CHECK_VERIFY(this));
2009   } else if (tag.is_string()) {
2010     current_frame->push_stack(
2011       VerificationType::reference_type(
2012         vmSymbols::java_lang_String()), CHECK_VERIFY(this));
2013   } else if (tag.is_klass() || tag.is_unresolved_klass()) {
2014     current_frame->push_stack(
2015       VerificationType::reference_type(
2016         vmSymbols::java_lang_Class()), CHECK_VERIFY(this));
2017   } else if (tag.is_int()) {
2018     current_frame->push_stack(
2019       VerificationType::integer_type(), CHECK_VERIFY(this));
2020   } else if (tag.is_float()) {
2021     current_frame->push_stack(
2022       VerificationType::float_type(), CHECK_VERIFY(this));
2023   } else if (tag.is_double()) {
2024     current_frame->push_stack_2(
2025       VerificationType::double_type(),
2026       VerificationType::double2_type(), CHECK_VERIFY(this));
2027   } else if (tag.is_long()) {
2028     current_frame->push_stack_2(
2029       VerificationType::long_type(),
2030       VerificationType::long2_type(), CHECK_VERIFY(this));
2031   } else if (tag.is_method_handle()) {
2032     current_frame->push_stack(
2033       VerificationType::reference_type(
2034         vmSymbols::java_lang_invoke_MethodHandle()), CHECK_VERIFY(this));
2035   } else if (tag.is_method_type()) {
2036     current_frame->push_stack(
2037       VerificationType::reference_type(
2038         vmSymbols::java_lang_invoke_MethodType()), CHECK_VERIFY(this));
2039   } else {
2040     /* Unreachable? verify_cp_type has already validated the cp type. */
2041     verify_error(
2042         ErrorContext::bad_cp_index(bci, index), "Invalid index in ldc");
2043     return;
2044   }
2045 }
2046 
2047 void ClassVerifier::verify_switch(
2048     RawBytecodeStream* bcs, u4 code_length, char* code_data,
2049     StackMapFrame* current_frame, StackMapTable* stackmap_table, TRAPS) {
2050   int bci = bcs->bci();
2051   address bcp = bcs->bcp();
2052   address aligned_bcp = (address) round_to((intptr_t)(bcp + 1), jintSize);
2053 
2054   if (_klass->major_version() < NONZERO_PADDING_BYTES_IN_SWITCH_MAJOR_VERSION) {
2055     // 4639449 & 4647081: padding bytes must be 0
2056     u2 padding_offset = 1;
2057     while ((bcp + padding_offset) < aligned_bcp) {
2058       if(*(bcp + padding_offset) != 0) {
2059         verify_error(ErrorContext::bad_code(bci),
2060                      "Nonzero padding byte in lookupswitch or tableswitch");
2061         return;
2062       }
2063       padding_offset++;
2064     }
2065   }
2066 
2067   int default_offset = (int) Bytes::get_Java_u4(aligned_bcp);
2068   int keys, delta;
2069   current_frame->pop_stack(
2070     VerificationType::integer_type(), CHECK_VERIFY(this));
2071   if (bcs->raw_code() == Bytecodes::_tableswitch) {
2072     jint low = (jint)Bytes::get_Java_u4(aligned_bcp + jintSize);
2073     jint high = (jint)Bytes::get_Java_u4(aligned_bcp + 2*jintSize);
2074     if (low > high) {
2075       verify_error(ErrorContext::bad_code(bci),
2076           "low must be less than or equal to high in tableswitch");
2077       return;
2078     }
2079     keys = high - low + 1;
2080     if (keys < 0) {
2081       verify_error(ErrorContext::bad_code(bci), "too many keys in tableswitch");
2082       return;
2083     }
2084     delta = 1;
2085   } else {
2086     keys = (int)Bytes::get_Java_u4(aligned_bcp + jintSize);
2087     if (keys < 0) {
2088       verify_error(ErrorContext::bad_code(bci),
2089                    "number of keys in lookupswitch less than 0");
2090       return;
2091     }
2092     delta = 2;
2093     // Make sure that the lookupswitch items are sorted
2094     for (int i = 0; i < (keys - 1); i++) {
2095       jint this_key = Bytes::get_Java_u4(aligned_bcp + (2+2*i)*jintSize);
2096       jint next_key = Bytes::get_Java_u4(aligned_bcp + (2+2*i+2)*jintSize);
2097       if (this_key >= next_key) {
2098         verify_error(ErrorContext::bad_code(bci),
2099                      "Bad lookupswitch instruction");
2100         return;
2101       }
2102     }
2103   }
2104   int target = bci + default_offset;
2105   stackmap_table->check_jump_target(current_frame, target, CHECK_VERIFY(this));
2106   for (int i = 0; i < keys; i++) {
2107     // Because check_jump_target() may safepoint, the bytecode could have
2108     // moved, which means 'aligned_bcp' is no good and needs to be recalculated.
2109     aligned_bcp = (address)round_to((intptr_t)(bcs->bcp() + 1), jintSize);
2110     target = bci + (jint)Bytes::get_Java_u4(aligned_bcp+(3+i*delta)*jintSize);
2111     stackmap_table->check_jump_target(
2112       current_frame, target, CHECK_VERIFY(this));
2113   }
2114   NOT_PRODUCT(aligned_bcp = NULL);  // no longer valid at this point
2115 }
2116 
2117 bool ClassVerifier::name_in_supers(
2118     Symbol* ref_name, instanceKlassHandle current) {
2119   Klass* super = current->super();
2120   while (super != NULL) {
2121     if (super->name() == ref_name) {
2122       return true;
2123     }
2124     super = super->super();
2125   }
2126   return false;
2127 }
2128 
2129 void ClassVerifier::verify_field_instructions(RawBytecodeStream* bcs,
2130                                               StackMapFrame* current_frame,
2131                                               constantPoolHandle cp,
2132                                               bool allow_arrays,
2133                                               TRAPS) {
2134   u2 index = bcs->get_index_u2();
2135   verify_cp_type(bcs->bci(), index, cp,
2136       1 << JVM_CONSTANT_Fieldref, CHECK_VERIFY(this));
2137 
2138   // Get field name and signature
2139   Symbol* field_name = cp->name_ref_at(index);
2140   Symbol* field_sig = cp->signature_ref_at(index);
2141 
2142   if (!SignatureVerifier::is_valid_type_signature(field_sig)) {
2143     class_format_error(
2144       "Invalid signature for field in class %s referenced "
2145       "from constant pool index %d", _klass->external_name(), index);
2146     return;
2147   }
2148 
2149   // Get referenced class type
2150   VerificationType ref_class_type = cp_ref_index_to_type(
2151     index, cp, CHECK_VERIFY(this));
2152   if (!ref_class_type.is_object() &&
2153     (!allow_arrays || !ref_class_type.is_array())) {
2154     verify_error(ErrorContext::bad_type(bcs->bci(),
2155         TypeOrigin::cp(index, ref_class_type)),
2156         "Expecting reference to class in class %s at constant pool index %d",
2157         _klass->external_name(), index);
2158     return;
2159   }
2160   VerificationType target_class_type = ref_class_type;
2161 
2162   assert(sizeof(VerificationType) == sizeof(uintptr_t),
2163         "buffer type must match VerificationType size");
2164   uintptr_t field_type_buffer[2];
2165   VerificationType* field_type = (VerificationType*)field_type_buffer;
2166   // If we make a VerificationType[2] array directly, the compiler calls
2167   // to the c-runtime library to do the allocation instead of just
2168   // stack allocating it.  Plus it would run constructors.  This shows up
2169   // in performance profiles.
2170 
2171   SignatureStream sig_stream(field_sig, false);
2172   VerificationType stack_object_type;
2173   int n = change_sig_to_verificationType(
2174     &sig_stream, field_type, CHECK_VERIFY(this));
2175   u2 bci = bcs->bci();
2176   bool is_assignable;
2177   switch (bcs->raw_code()) {
2178     case Bytecodes::_getstatic: {
2179       for (int i = 0; i < n; i++) {
2180         current_frame->push_stack(field_type[i], CHECK_VERIFY(this));
2181       }
2182       break;
2183     }
2184     case Bytecodes::_putstatic: {
2185       for (int i = n - 1; i >= 0; i--) {
2186         current_frame->pop_stack(field_type[i], CHECK_VERIFY(this));
2187       }
2188       break;
2189     }
2190     case Bytecodes::_getfield: {
2191       stack_object_type = current_frame->pop_stack(
2192         target_class_type, CHECK_VERIFY(this));
2193       for (int i = 0; i < n; i++) {
2194         current_frame->push_stack(field_type[i], CHECK_VERIFY(this));
2195       }
2196       goto check_protected;
2197     }
2198     case Bytecodes::_putfield: {
2199       for (int i = n - 1; i >= 0; i--) {
2200         current_frame->pop_stack(field_type[i], CHECK_VERIFY(this));
2201       }
2202       stack_object_type = current_frame->pop_stack(CHECK_VERIFY(this));
2203 
2204       // The JVMS 2nd edition allows field initialization before the superclass
2205       // initializer, if the field is defined within the current class.
2206       fieldDescriptor fd;
2207       if (stack_object_type == VerificationType::uninitialized_this_type() &&
2208           target_class_type.equals(current_type()) &&
2209           _klass->find_local_field(field_name, field_sig, &fd)) {
2210         stack_object_type = current_type();
2211       }
2212       is_assignable = target_class_type.is_assignable_from(
2213         stack_object_type, this, false, CHECK_VERIFY(this));
2214       if (!is_assignable) {
2215         verify_error(ErrorContext::bad_type(bci,
2216             current_frame->stack_top_ctx(),
2217             TypeOrigin::cp(index, target_class_type)),
2218             "Bad type on operand stack in putfield");
2219         return;
2220       }
2221     }
2222     check_protected: {
2223       if (_this_type == stack_object_type)
2224         break; // stack_object_type must be assignable to _current_class_type
2225       Symbol* ref_class_name =
2226         cp->klass_name_at(cp->klass_ref_index_at(index));
2227       if (!name_in_supers(ref_class_name, current_class()))
2228         // stack_object_type must be assignable to _current_class_type since:
2229         // 1. stack_object_type must be assignable to ref_class.
2230         // 2. ref_class must be _current_class or a subclass of it. It can't
2231         //    be a superclass of it. See revised JVMS 5.4.4.
2232         break;
2233 
2234       Klass* ref_class_oop = load_class(ref_class_name, CHECK);
2235       if (is_protected_access(current_class(), ref_class_oop, field_name,
2236                               field_sig, false)) {
2237         // It's protected access, check if stack object is assignable to
2238         // current class.
2239         is_assignable = current_type().is_assignable_from(
2240           stack_object_type, this, true, CHECK_VERIFY(this));
2241         if (!is_assignable) {
2242           verify_error(ErrorContext::bad_type(bci,
2243               current_frame->stack_top_ctx(),
2244               TypeOrigin::implicit(current_type())),
2245               "Bad access to protected data in getfield");
2246           return;
2247         }
2248       }
2249       break;
2250     }
2251     default: ShouldNotReachHere();
2252   }
2253 }
2254 
2255 // Look at the method's handlers.  If the bci is in the handler's try block
2256 // then check if the handler_pc is already on the stack.  If not, push it
2257 // unless the handler has already been scanned.
2258 void ClassVerifier::push_handlers(ExceptionTable* exhandlers,
2259                                   GrowableArray<u4>* handler_list,
2260                                   GrowableArray<u4>* handler_stack,
2261                                   u4 bci) {
2262   int exlength = exhandlers->length();
2263   for(int x = 0; x < exlength; x++) {
2264     if (bci >= exhandlers->start_pc(x) && bci < exhandlers->end_pc(x)) {
2265       u4 exhandler_pc = exhandlers->handler_pc(x);
2266       if (!handler_list->contains(exhandler_pc)) {
2267         handler_stack->append_if_missing(exhandler_pc);
2268         handler_list->append(exhandler_pc);
2269       }
2270     }
2271   }
2272 }
2273 
2274 // Return TRUE if all code paths starting with start_bc_offset end in
2275 // bytecode athrow or loop.
2276 bool ClassVerifier::ends_in_athrow(u4 start_bc_offset) {
2277   ResourceMark rm;
2278   // Create bytecode stream.
2279   RawBytecodeStream bcs(method());
2280   u4 code_length = method()->code_size();
2281   bcs.set_start(start_bc_offset);
2282   u4 target;
2283   // Create stack for storing bytecode start offsets for if* and *switch.
2284   GrowableArray<u4>* bci_stack = new GrowableArray<u4>(30);
2285   // Create stack for handlers for try blocks containing this handler.
2286   GrowableArray<u4>* handler_stack = new GrowableArray<u4>(30);
2287   // Create list of handlers that have been pushed onto the handler_stack
2288   // so that handlers embedded inside of their own TRY blocks only get
2289   // scanned once.
2290   GrowableArray<u4>* handler_list = new GrowableArray<u4>(30);
2291   // Create list of visited branch opcodes (goto* and if*).
2292   GrowableArray<u4>* visited_branches = new GrowableArray<u4>(30);
2293   ExceptionTable exhandlers(_method());
2294 
2295   while (true) {
2296     if (bcs.is_last_bytecode()) {
2297       // if no more starting offsets to parse or if at the end of the
2298       // method then return false.
2299       if ((bci_stack->is_empty()) || ((u4)bcs.end_bci() == code_length))
2300         return false;
2301       // Pop a bytecode starting offset and scan from there.
2302       bcs.set_start(bci_stack->pop());
2303     }
2304     Bytecodes::Code opcode = bcs.raw_next();
2305     u4 bci = bcs.bci();
2306 
2307     // If the bytecode is in a TRY block, push its handlers so they
2308     // will get parsed.
2309     push_handlers(&exhandlers, handler_list, handler_stack, bci);
2310 
2311     switch (opcode) {
2312       case Bytecodes::_if_icmpeq:
2313       case Bytecodes::_if_icmpne:
2314       case Bytecodes::_if_icmplt:
2315       case Bytecodes::_if_icmpge:
2316       case Bytecodes::_if_icmpgt:
2317       case Bytecodes::_if_icmple:
2318       case Bytecodes::_ifeq:
2319       case Bytecodes::_ifne:
2320       case Bytecodes::_iflt:
2321       case Bytecodes::_ifge:
2322       case Bytecodes::_ifgt:
2323       case Bytecodes::_ifle:
2324       case Bytecodes::_if_acmpeq:
2325       case Bytecodes::_if_acmpne:
2326       case Bytecodes::_ifnull:
2327       case Bytecodes::_ifnonnull:
2328         target = bcs.dest();
2329         if (visited_branches->contains(bci)) {
2330           if (bci_stack->is_empty()) return true;
2331           // Pop a bytecode starting offset and scan from there.
2332           bcs.set_start(bci_stack->pop());
2333         } else {
2334           if (target > bci) { // forward branch
2335             if (target >= code_length) return false;
2336             // Push the branch target onto the stack.
2337             bci_stack->push(target);
2338             // then, scan bytecodes starting with next.
2339             bcs.set_start(bcs.next_bci());
2340           } else { // backward branch
2341             // Push bytecode offset following backward branch onto the stack.
2342             bci_stack->push(bcs.next_bci());
2343             // Check bytecodes starting with branch target.
2344             bcs.set_start(target);
2345           }
2346           // Record target so we don't branch here again.
2347           visited_branches->append(bci);
2348         }
2349         break;
2350 
2351       case Bytecodes::_goto:
2352       case Bytecodes::_goto_w:
2353         target = (opcode == Bytecodes::_goto ? bcs.dest() : bcs.dest_w());
2354         if (visited_branches->contains(bci)) {
2355           if (bci_stack->is_empty()) return true;
2356           // Been here before, pop new starting offset from stack.
2357           bcs.set_start(bci_stack->pop());
2358         } else {
2359           if (target >= code_length) return false;
2360           // Continue scanning from the target onward.
2361           bcs.set_start(target);
2362           // Record target so we don't branch here again.
2363           visited_branches->append(bci);
2364         }
2365         break;
2366 
2367       // Check that all switch alternatives end in 'athrow' bytecodes. Since it
2368       // is  difficult to determine where each switch alternative ends, parse
2369       // each switch alternative until either hit a 'return', 'athrow', or reach
2370       // the end of the method's bytecodes.  This is gross but should be okay
2371       // because:
2372       // 1. tableswitch and lookupswitch byte codes in handlers for ctor explicit
2373       //    constructor invocations should be rare.
2374       // 2. if each switch alternative ends in an athrow then the parsing should be
2375       //    short.  If there is no athrow then it is bogus code, anyway.
2376       case Bytecodes::_lookupswitch:
2377       case Bytecodes::_tableswitch:
2378         {
2379           address aligned_bcp = (address) round_to((intptr_t)(bcs.bcp() + 1), jintSize);
2380           u4 default_offset = Bytes::get_Java_u4(aligned_bcp) + bci;
2381           int keys, delta;
2382           if (opcode == Bytecodes::_tableswitch) {
2383             jint low = (jint)Bytes::get_Java_u4(aligned_bcp + jintSize);
2384             jint high = (jint)Bytes::get_Java_u4(aligned_bcp + 2*jintSize);
2385             // This is invalid, but let the regular bytecode verifier
2386             // report this because the user will get a better error message.
2387             if (low > high) return true;
2388             keys = high - low + 1;
2389             delta = 1;
2390           } else {
2391             keys = (int)Bytes::get_Java_u4(aligned_bcp + jintSize);
2392             delta = 2;
2393           }
2394           // Invalid, let the regular bytecode verifier deal with it.
2395           if (keys < 0) return true;
2396 
2397           // Push the offset of the next bytecode onto the stack.
2398           bci_stack->push(bcs.next_bci());
2399 
2400           // Push the switch alternatives onto the stack.
2401           for (int i = 0; i < keys; i++) {
2402             u4 target = bci + (jint)Bytes::get_Java_u4(aligned_bcp+(3+i*delta)*jintSize);
2403             if (target > code_length) return false;
2404             bci_stack->push(target);
2405           }
2406 
2407           // Start bytecode parsing for the switch at the default alternative.
2408           if (default_offset > code_length) return false;
2409           bcs.set_start(default_offset);
2410           break;
2411         }
2412 
2413       case Bytecodes::_return:
2414         return false;
2415 
2416       case Bytecodes::_athrow:
2417         {
2418           if (bci_stack->is_empty()) {
2419             if (handler_stack->is_empty()) {
2420               return true;
2421             } else {
2422               // Parse the catch handlers for try blocks containing athrow.
2423               bcs.set_start(handler_stack->pop());
2424             }
2425           } else {
2426             // Pop a bytecode offset and starting scanning from there.
2427             bcs.set_start(bci_stack->pop());
2428           }
2429         }
2430         break;
2431 
2432       default:
2433         ;
2434     } // end switch
2435   } // end while loop
2436 
2437   return false;
2438 }
2439 
2440 void ClassVerifier::verify_invoke_init(
2441     RawBytecodeStream* bcs, u2 ref_class_index, VerificationType ref_class_type,
2442     StackMapFrame* current_frame, u4 code_length, bool in_try_block,
2443     bool *this_uninit, constantPoolHandle cp, StackMapTable* stackmap_table,
2444     TRAPS) {
2445   u2 bci = bcs->bci();
2446   VerificationType type = current_frame->pop_stack(
2447     VerificationType::reference_check(), CHECK_VERIFY(this));
2448   if (type == VerificationType::uninitialized_this_type()) {
2449     // The method must be an <init> method of this class or its superclass
2450     Klass* superk = current_class()->super();
2451     if (ref_class_type.name() != current_class()->name() &&
2452         ref_class_type.name() != superk->name()) {
2453       verify_error(ErrorContext::bad_type(bci,
2454           TypeOrigin::implicit(ref_class_type),
2455           TypeOrigin::implicit(current_type())),
2456           "Bad <init> method call");
2457       return;
2458     }
2459 
2460     // If this invokespecial call is done from inside of a TRY block then make
2461     // sure that all catch clause paths end in a throw.  Otherwise, this can
2462     // result in returning an incomplete object.
2463     if (in_try_block) {
2464       ExceptionTable exhandlers(_method());
2465       int exlength = exhandlers.length();
2466       for(int i = 0; i < exlength; i++) {
2467         u2 start_pc = exhandlers.start_pc(i);
2468         u2 end_pc = exhandlers.end_pc(i);
2469 
2470         if (bci >= start_pc && bci < end_pc) {
2471           if (!ends_in_athrow(exhandlers.handler_pc(i))) {
2472             verify_error(ErrorContext::bad_code(bci),
2473               "Bad <init> method call from after the start of a try block");
2474             return;
2475           } else if (VerboseVerification) {
2476             ResourceMark rm;
2477             tty->print_cr(
2478               "Survived call to ends_in_athrow(): %s",
2479               current_class()->name()->as_C_string());
2480           }
2481         }
2482       }
2483 
2484       // Check the exception handler target stackmaps with the locals from the
2485       // incoming stackmap (before initialize_object() changes them to outgoing
2486       // state).
2487       verify_exception_handler_targets(bci, true, current_frame,
2488                                        stackmap_table, CHECK_VERIFY(this));
2489     } // in_try_block
2490 
2491     current_frame->initialize_object(type, current_type());
2492     *this_uninit = true;
2493   } else if (type.is_uninitialized()) {
2494     u2 new_offset = type.bci();
2495     address new_bcp = bcs->bcp() - bci + new_offset;
2496     if (new_offset > (code_length - 3) || (*new_bcp) != Bytecodes::_new) {
2497       /* Unreachable?  Stack map parsing ensures valid type and new
2498        * instructions have a valid BCI. */
2499       verify_error(ErrorContext::bad_code(new_offset),
2500                    "Expecting new instruction");
2501       return;
2502     }
2503     u2 new_class_index = Bytes::get_Java_u2(new_bcp + 1);
2504     verify_cp_class_type(bci, new_class_index, cp, CHECK_VERIFY(this));
2505 
2506     // The method must be an <init> method of the indicated class
2507     VerificationType new_class_type = cp_index_to_type(
2508       new_class_index, cp, CHECK_VERIFY(this));
2509     if (!new_class_type.equals(ref_class_type)) {
2510       verify_error(ErrorContext::bad_type(bci,
2511           TypeOrigin::cp(new_class_index, new_class_type),
2512           TypeOrigin::cp(ref_class_index, ref_class_type)),
2513           "Call to wrong <init> method");
2514       return;
2515     }
2516     // According to the VM spec, if the referent class is a superclass of the
2517     // current class, and is in a different runtime package, and the method is
2518     // protected, then the objectref must be the current class or a subclass
2519     // of the current class.
2520     VerificationType objectref_type = new_class_type;
2521     if (name_in_supers(ref_class_type.name(), current_class())) {
2522       Klass* ref_klass = load_class(ref_class_type.name(), CHECK);
2523       Method* m = InstanceKlass::cast(ref_klass)->uncached_lookup_method(
2524         vmSymbols::object_initializer_name(),
2525         cp->signature_ref_at(bcs->get_index_u2()),
2526         Klass::find_overpass);
2527       // Do nothing if method is not found.  Let resolution detect the error.
2528       if (m != NULL) {
2529         instanceKlassHandle mh(THREAD, m->method_holder());
2530         if (m->is_protected() && !mh->is_same_class_package(_klass())) {
2531           bool assignable = current_type().is_assignable_from(
2532             objectref_type, this, true, CHECK_VERIFY(this));
2533           if (!assignable) {
2534             verify_error(ErrorContext::bad_type(bci,
2535                 TypeOrigin::cp(new_class_index, objectref_type),
2536                 TypeOrigin::implicit(current_type())),
2537                 "Bad access to protected <init> method");
2538             return;
2539           }
2540         }
2541       }
2542     }
2543     // Check the exception handler target stackmaps with the locals from the
2544     // incoming stackmap (before initialize_object() changes them to outgoing
2545     // state).
2546     if (in_try_block) {
2547       verify_exception_handler_targets(bci, *this_uninit, current_frame,
2548                                        stackmap_table, CHECK_VERIFY(this));
2549     }
2550     current_frame->initialize_object(type, new_class_type);
2551   } else {
2552     verify_error(ErrorContext::bad_type(bci, current_frame->stack_top_ctx()),
2553         "Bad operand type when invoking <init>");
2554     return;
2555   }
2556 }
2557 
2558 bool ClassVerifier::is_same_or_direct_interface(
2559     instanceKlassHandle klass,
2560     VerificationType klass_type,
2561     VerificationType ref_class_type) {
2562   if (ref_class_type.equals(klass_type)) return true;
2563   Array<Klass*>* local_interfaces = klass->local_interfaces();
2564   if (local_interfaces != NULL) {
2565     for (int x = 0; x < local_interfaces->length(); x++) {
2566       Klass* k = local_interfaces->at(x);
2567       assert (k != NULL && k->is_interface(), "invalid interface");
2568       if (ref_class_type.equals(VerificationType::reference_type(k->name()))) {
2569         return true;
2570       }
2571     }
2572   }
2573   return false;
2574 }
2575 
2576 void ClassVerifier::verify_invoke_instructions(
2577     RawBytecodeStream* bcs, u4 code_length, StackMapFrame* current_frame,
2578     bool in_try_block, bool *this_uninit, VerificationType return_type,
2579     constantPoolHandle cp, StackMapTable* stackmap_table, TRAPS) {
2580   // Make sure the constant pool item is the right type
2581   u2 index = bcs->get_index_u2();
2582   Bytecodes::Code opcode = bcs->raw_code();
2583   unsigned int types;
2584   switch (opcode) {
2585     case Bytecodes::_invokeinterface:
2586       types = 1 << JVM_CONSTANT_InterfaceMethodref;
2587       break;
2588     case Bytecodes::_invokedynamic:
2589       types = 1 << JVM_CONSTANT_InvokeDynamic;
2590       break;
2591     case Bytecodes::_invokespecial:
2592     case Bytecodes::_invokestatic:
2593       types = (_klass->major_version() < STATIC_METHOD_IN_INTERFACE_MAJOR_VERSION) ?
2594         (1 << JVM_CONSTANT_Methodref) :
2595         ((1 << JVM_CONSTANT_InterfaceMethodref) | (1 << JVM_CONSTANT_Methodref));
2596       break;
2597     default:
2598       types = 1 << JVM_CONSTANT_Methodref;
2599   }
2600   verify_cp_type(bcs->bci(), index, cp, types, CHECK_VERIFY(this));
2601 
2602   // Get method name and signature
2603   Symbol* method_name = cp->name_ref_at(index);
2604   Symbol* method_sig = cp->signature_ref_at(index);
2605 
2606   if (!SignatureVerifier::is_valid_method_signature(method_sig)) {
2607     class_format_error(
2608       "Invalid method signature in class %s referenced "
2609       "from constant pool index %d", _klass->external_name(), index);
2610     return;
2611   }
2612 
2613   // Get referenced class type
2614   VerificationType ref_class_type;
2615   if (opcode == Bytecodes::_invokedynamic) {
2616     if (_klass->major_version() < Verifier::INVOKEDYNAMIC_MAJOR_VERSION) {
2617       class_format_error(
2618         "invokedynamic instructions not supported by this class file version (%d), class %s",
2619         _klass->major_version(), _klass->external_name());
2620       return;
2621     }
2622   } else {
2623     ref_class_type = cp_ref_index_to_type(index, cp, CHECK_VERIFY(this));
2624   }
2625 
2626   // For a small signature length, we just allocate 128 bytes instead
2627   // of parsing the signature once to find its size.
2628   // -3 is for '(', ')' and return descriptor; multiply by 2 is for
2629   // longs/doubles to be consertive.
2630   assert(sizeof(VerificationType) == sizeof(uintptr_t),
2631         "buffer type must match VerificationType size");
2632   uintptr_t on_stack_sig_types_buffer[128];
2633   // If we make a VerificationType[128] array directly, the compiler calls
2634   // to the c-runtime library to do the allocation instead of just
2635   // stack allocating it.  Plus it would run constructors.  This shows up
2636   // in performance profiles.
2637 
2638   VerificationType* sig_types;
2639   int size = (method_sig->utf8_length() - 3) * 2;
2640   if (size > 128) {
2641     // Long and double occupies two slots here.
2642     ArgumentSizeComputer size_it(method_sig);
2643     size = size_it.size();
2644     sig_types = NEW_RESOURCE_ARRAY_IN_THREAD(THREAD, VerificationType, size);
2645   } else{
2646     sig_types = (VerificationType*)on_stack_sig_types_buffer;
2647   }
2648   SignatureStream sig_stream(method_sig);
2649   int sig_i = 0;
2650   while (!sig_stream.at_return_type()) {
2651     sig_i += change_sig_to_verificationType(
2652       &sig_stream, &sig_types[sig_i], CHECK_VERIFY(this));
2653     sig_stream.next();
2654   }
2655   int nargs = sig_i;
2656 
2657 #ifdef ASSERT
2658   {
2659     ArgumentSizeComputer size_it(method_sig);
2660     assert(nargs == size_it.size(), "Argument sizes do not match");
2661     assert(nargs <= (method_sig->utf8_length() - 3) * 2, "estimate of max size isn't conservative enough");
2662   }
2663 #endif
2664 
2665   // Check instruction operands
2666   u2 bci = bcs->bci();
2667   if (opcode == Bytecodes::_invokeinterface) {
2668     address bcp = bcs->bcp();
2669     // 4905268: count operand in invokeinterface should be nargs+1, not nargs.
2670     // JSR202 spec: The count operand of an invokeinterface instruction is valid if it is
2671     // the difference between the size of the operand stack before and after the instruction
2672     // executes.
2673     if (*(bcp+3) != (nargs+1)) {
2674       verify_error(ErrorContext::bad_code(bci),
2675           "Inconsistent args count operand in invokeinterface");
2676       return;
2677     }
2678     if (*(bcp+4) != 0) {
2679       verify_error(ErrorContext::bad_code(bci),
2680           "Fourth operand byte of invokeinterface must be zero");
2681       return;
2682     }
2683   }
2684 
2685   if (opcode == Bytecodes::_invokedynamic) {
2686     address bcp = bcs->bcp();
2687     if (*(bcp+3) != 0 || *(bcp+4) != 0) {
2688       verify_error(ErrorContext::bad_code(bci),
2689           "Third and fourth operand bytes of invokedynamic must be zero");
2690       return;
2691     }
2692   }
2693 
2694   if (method_name->byte_at(0) == '<') {
2695     // Make sure <init> can only be invoked by invokespecial
2696     if (opcode != Bytecodes::_invokespecial ||
2697         method_name != vmSymbols::object_initializer_name()) {
2698       verify_error(ErrorContext::bad_code(bci),
2699           "Illegal call to internal method");
2700       return;
2701     }
2702   } else if (opcode == Bytecodes::_invokespecial
2703              && !is_same_or_direct_interface(current_class(), current_type(), ref_class_type)
2704              && !ref_class_type.equals(VerificationType::reference_type(
2705                   current_class()->super()->name()))) {
2706     bool subtype = false;
2707     bool have_imr_indirect = cp->tag_at(index).value() == JVM_CONSTANT_InterfaceMethodref;
2708     if (!current_class()->is_anonymous()) {
2709       subtype = ref_class_type.is_assignable_from(
2710                  current_type(), this, false, CHECK_VERIFY(this));
2711     } else {
2712       VerificationType host_klass_type =
2713                         VerificationType::reference_type(current_class()->host_klass()->name());
2714       subtype = ref_class_type.is_assignable_from(host_klass_type, this, false, CHECK_VERIFY(this));
2715 
2716       // If invokespecial of IMR, need to recheck for same or
2717       // direct interface relative to the host class
2718       have_imr_indirect = (have_imr_indirect &&
2719                            !is_same_or_direct_interface(
2720                              InstanceKlass::cast(current_class()->host_klass()),
2721                              host_klass_type, ref_class_type));
2722     }
2723     if (!subtype) {
2724       verify_error(ErrorContext::bad_code(bci),
2725           "Bad invokespecial instruction: "
2726           "current class isn't assignable to reference class.");
2727        return;
2728     } else if (have_imr_indirect) {
2729       verify_error(ErrorContext::bad_code(bci),
2730           "Bad invokespecial instruction: "
2731           "interface method reference is in an indirect superinterface.");
2732       return;
2733     }
2734 
2735   }
2736   // Match method descriptor with operand stack
2737   for (int i = nargs - 1; i >= 0; i--) {  // Run backwards
2738     current_frame->pop_stack(sig_types[i], CHECK_VERIFY(this));
2739   }
2740   // Check objectref on operand stack
2741   if (opcode != Bytecodes::_invokestatic &&
2742       opcode != Bytecodes::_invokedynamic) {
2743     if (method_name == vmSymbols::object_initializer_name()) {  // <init> method
2744       verify_invoke_init(bcs, index, ref_class_type, current_frame,
2745         code_length, in_try_block, this_uninit, cp, stackmap_table,
2746         CHECK_VERIFY(this));
2747     } else {   // other methods
2748       // Ensures that target class is assignable to method class.
2749       if (opcode == Bytecodes::_invokespecial) {
2750         if (!current_class()->is_anonymous()) {
2751           current_frame->pop_stack(current_type(), CHECK_VERIFY(this));
2752         } else {
2753           // anonymous class invokespecial calls: check if the
2754           // objectref is a subtype of the host_klass of the current class
2755           // to allow an anonymous class to reference methods in the host_klass
2756           VerificationType top = current_frame->pop_stack(CHECK_VERIFY(this));
2757           VerificationType hosttype =
2758             VerificationType::reference_type(current_class()->host_klass()->name());
2759           bool subtype = hosttype.is_assignable_from(top, this, false, CHECK_VERIFY(this));
2760           if (!subtype) {
2761             verify_error( ErrorContext::bad_type(current_frame->offset(),
2762               current_frame->stack_top_ctx(),
2763               TypeOrigin::implicit(top)),
2764               "Bad type on operand stack");
2765             return;
2766           }
2767         }
2768       } else if (opcode == Bytecodes::_invokevirtual) {
2769         VerificationType stack_object_type =
2770           current_frame->pop_stack(ref_class_type, CHECK_VERIFY(this));
2771         if (current_type() != stack_object_type) {
2772           assert(cp->cache() == NULL, "not rewritten yet");
2773           Symbol* ref_class_name =
2774             cp->klass_name_at(cp->klass_ref_index_at(index));
2775           // See the comments in verify_field_instructions() for
2776           // the rationale behind this.
2777           if (name_in_supers(ref_class_name, current_class())) {
2778             Klass* ref_class = load_class(ref_class_name, CHECK);
2779             if (is_protected_access(
2780                   _klass, ref_class, method_name, method_sig, true)) {
2781               // It's protected access, check if stack object is
2782               // assignable to current class.
2783               bool is_assignable = current_type().is_assignable_from(
2784                 stack_object_type, this, true, CHECK_VERIFY(this));
2785               if (!is_assignable) {
2786                 if (ref_class_type.name() == vmSymbols::java_lang_Object()
2787                     && stack_object_type.is_array()
2788                     && method_name == vmSymbols::clone_name()) {
2789                   // Special case: arrays pretend to implement public Object
2790                   // clone().
2791                 } else {
2792                   verify_error(ErrorContext::bad_type(bci,
2793                       current_frame->stack_top_ctx(),
2794                       TypeOrigin::implicit(current_type())),
2795                       "Bad access to protected data in invokevirtual");
2796                   return;
2797                 }
2798               }
2799             }
2800           }
2801         }
2802       } else {
2803         assert(opcode == Bytecodes::_invokeinterface, "Unexpected opcode encountered");
2804         current_frame->pop_stack(ref_class_type, CHECK_VERIFY(this));
2805       }
2806     }
2807   }
2808   // Push the result type.
2809   if (sig_stream.type() != T_VOID) {
2810     if (method_name == vmSymbols::object_initializer_name()) {
2811       // <init> method must have a void return type
2812       /* Unreachable?  Class file parser verifies that methods with '<' have
2813        * void return */
2814       verify_error(ErrorContext::bad_code(bci),
2815           "Return type must be void in <init> method");
2816       return;
2817     }
2818     VerificationType return_type[2];
2819     int n = change_sig_to_verificationType(
2820       &sig_stream, return_type, CHECK_VERIFY(this));
2821     for (int i = 0; i < n; i++) {
2822       current_frame->push_stack(return_type[i], CHECK_VERIFY(this)); // push types backwards
2823     }
2824   }
2825 }
2826 
2827 VerificationType ClassVerifier::get_newarray_type(
2828     u2 index, u2 bci, TRAPS) {
2829   const char* from_bt[] = {
2830     NULL, NULL, NULL, NULL, "[Z", "[C", "[F", "[D", "[B", "[S", "[I", "[J",
2831   };
2832   if (index < T_BOOLEAN || index > T_LONG) {
2833     verify_error(ErrorContext::bad_code(bci), "Illegal newarray instruction");
2834     return VerificationType::bogus_type();
2835   }
2836 
2837   // from_bt[index] contains the array signature which has a length of 2
2838   Symbol* sig = create_temporary_symbol(
2839     from_bt[index], 2, CHECK_(VerificationType::bogus_type()));
2840   return VerificationType::reference_type(sig);
2841 }
2842 
2843 void ClassVerifier::verify_anewarray(
2844     u2 bci, u2 index, constantPoolHandle cp,
2845     StackMapFrame* current_frame, TRAPS) {
2846   verify_cp_class_type(bci, index, cp, CHECK_VERIFY(this));
2847   current_frame->pop_stack(
2848     VerificationType::integer_type(), CHECK_VERIFY(this));
2849 
2850   VerificationType component_type =
2851     cp_index_to_type(index, cp, CHECK_VERIFY(this));
2852   int length;
2853   char* arr_sig_str;
2854   if (component_type.is_array()) {     // it's an array
2855     const char* component_name = component_type.name()->as_utf8();
2856     // add one dimension to component
2857     length = (int)strlen(component_name) + 1;
2858     arr_sig_str = NEW_RESOURCE_ARRAY_IN_THREAD(THREAD, char, length);
2859     arr_sig_str[0] = '[';
2860     strncpy(&arr_sig_str[1], component_name, length - 1);
2861   } else {         // it's an object or interface
2862     const char* component_name = component_type.name()->as_utf8();
2863     // add one dimension to component with 'L' prepended and ';' postpended.
2864     length = (int)strlen(component_name) + 3;
2865     arr_sig_str = NEW_RESOURCE_ARRAY_IN_THREAD(THREAD, char, length);
2866     arr_sig_str[0] = '[';
2867     arr_sig_str[1] = 'L';
2868     strncpy(&arr_sig_str[2], component_name, length - 2);
2869     arr_sig_str[length - 1] = ';';
2870   }
2871   Symbol* arr_sig = create_temporary_symbol(
2872     arr_sig_str, length, CHECK_VERIFY(this));
2873   VerificationType new_array_type = VerificationType::reference_type(arr_sig);
2874   current_frame->push_stack(new_array_type, CHECK_VERIFY(this));
2875 }
2876 
2877 void ClassVerifier::verify_iload(u2 index, StackMapFrame* current_frame, TRAPS) {
2878   current_frame->get_local(
2879     index, VerificationType::integer_type(), CHECK_VERIFY(this));
2880   current_frame->push_stack(
2881     VerificationType::integer_type(), CHECK_VERIFY(this));
2882 }
2883 
2884 void ClassVerifier::verify_lload(u2 index, StackMapFrame* current_frame, TRAPS) {
2885   current_frame->get_local_2(
2886     index, VerificationType::long_type(),
2887     VerificationType::long2_type(), CHECK_VERIFY(this));
2888   current_frame->push_stack_2(
2889     VerificationType::long_type(),
2890     VerificationType::long2_type(), CHECK_VERIFY(this));
2891 }
2892 
2893 void ClassVerifier::verify_fload(u2 index, StackMapFrame* current_frame, TRAPS) {
2894   current_frame->get_local(
2895     index, VerificationType::float_type(), CHECK_VERIFY(this));
2896   current_frame->push_stack(
2897     VerificationType::float_type(), CHECK_VERIFY(this));
2898 }
2899 
2900 void ClassVerifier::verify_dload(u2 index, StackMapFrame* current_frame, TRAPS) {
2901   current_frame->get_local_2(
2902     index, VerificationType::double_type(),
2903     VerificationType::double2_type(), CHECK_VERIFY(this));
2904   current_frame->push_stack_2(
2905     VerificationType::double_type(),
2906     VerificationType::double2_type(), CHECK_VERIFY(this));
2907 }
2908 
2909 void ClassVerifier::verify_aload(u2 index, StackMapFrame* current_frame, TRAPS) {
2910   VerificationType type = current_frame->get_local(
2911     index, VerificationType::reference_check(), CHECK_VERIFY(this));
2912   current_frame->push_stack(type, CHECK_VERIFY(this));
2913 }
2914 
2915 void ClassVerifier::verify_istore(u2 index, StackMapFrame* current_frame, TRAPS) {
2916   current_frame->pop_stack(
2917     VerificationType::integer_type(), CHECK_VERIFY(this));
2918   current_frame->set_local(
2919     index, VerificationType::integer_type(), CHECK_VERIFY(this));
2920 }
2921 
2922 void ClassVerifier::verify_lstore(u2 index, StackMapFrame* current_frame, TRAPS) {
2923   current_frame->pop_stack_2(
2924     VerificationType::long2_type(),
2925     VerificationType::long_type(), CHECK_VERIFY(this));
2926   current_frame->set_local_2(
2927     index, VerificationType::long_type(),
2928     VerificationType::long2_type(), CHECK_VERIFY(this));
2929 }
2930 
2931 void ClassVerifier::verify_fstore(u2 index, StackMapFrame* current_frame, TRAPS) {
2932   current_frame->pop_stack(VerificationType::float_type(), CHECK_VERIFY(this));
2933   current_frame->set_local(
2934     index, VerificationType::float_type(), CHECK_VERIFY(this));
2935 }
2936 
2937 void ClassVerifier::verify_dstore(u2 index, StackMapFrame* current_frame, TRAPS) {
2938   current_frame->pop_stack_2(
2939     VerificationType::double2_type(),
2940     VerificationType::double_type(), CHECK_VERIFY(this));
2941   current_frame->set_local_2(
2942     index, VerificationType::double_type(),
2943     VerificationType::double2_type(), CHECK_VERIFY(this));
2944 }
2945 
2946 void ClassVerifier::verify_astore(u2 index, StackMapFrame* current_frame, TRAPS) {
2947   VerificationType type = current_frame->pop_stack(
2948     VerificationType::reference_check(), CHECK_VERIFY(this));
2949   current_frame->set_local(index, type, CHECK_VERIFY(this));
2950 }
2951 
2952 void ClassVerifier::verify_iinc(u2 index, StackMapFrame* current_frame, TRAPS) {
2953   VerificationType type = current_frame->get_local(
2954     index, VerificationType::integer_type(), CHECK_VERIFY(this));
2955   current_frame->set_local(index, type, CHECK_VERIFY(this));
2956 }
2957 
2958 void ClassVerifier::verify_return_value(
2959     VerificationType return_type, VerificationType type, u2 bci,
2960     StackMapFrame* current_frame, TRAPS) {
2961   if (return_type == VerificationType::bogus_type()) {
2962     verify_error(ErrorContext::bad_type(bci,
2963         current_frame->stack_top_ctx(), TypeOrigin::signature(return_type)),
2964         "Method expects a return value");
2965     return;
2966   }
2967   bool match = return_type.is_assignable_from(type, this, false, CHECK_VERIFY(this));
2968   if (!match) {
2969     verify_error(ErrorContext::bad_type(bci,
2970         current_frame->stack_top_ctx(), TypeOrigin::signature(return_type)),
2971         "Bad return type");
2972     return;
2973   }
2974 }
2975 
2976 // The verifier creates symbols which are substrings of Symbols.
2977 // These are stored in the verifier until the end of verification so that
2978 // they can be reference counted.
2979 Symbol* ClassVerifier::create_temporary_symbol(const Symbol *s, int begin,
2980                                                int end, TRAPS) {
2981   Symbol* sym = SymbolTable::new_symbol(s, begin, end, CHECK_NULL);
2982   _symbols->push(sym);
2983   return sym;
2984 }
2985 
2986 Symbol* ClassVerifier::create_temporary_symbol(const char *s, int length, TRAPS) {
2987   Symbol* sym = SymbolTable::new_symbol(s, length, CHECK_NULL);
2988   _symbols->push(sym);
2989   return sym;
2990 }