1 /*
2 * Copyright (c) 1998, 2017, Oracle and/or its affiliates. All rights reserved.
3 * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
4 *
5 * This code is free software; you can redistribute it and/or modify it
6 * under the terms of the GNU General Public License version 2 only, as
7 * published by the Free Software Foundation.
8 *
9 * This code is distributed in the hope that it will be useful, but WITHOUT
10 * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
11 * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
12 * version 2 for more details (a copy is included in the LICENSE file that
13 * accompanied this code).
14 *
15 * You should have received a copy of the GNU General Public License version
16 * 2 along with this work; if not, write to the Free Software Foundation,
17 * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
18 *
19 * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
20 * or visit www.oracle.com if you need additional information or have any
21 * questions.
22 *
23 */
24
25 #include "precompiled.hpp"
26 #include "classfile/classFileStream.hpp"
27 #include "classfile/javaClasses.hpp"
28 #include "classfile/stackMapTable.hpp"
29 #include "classfile/stackMapFrame.hpp"
30 #include "classfile/stackMapTableFormat.hpp"
31 #include "classfile/systemDictionary.hpp"
32 #include "classfile/verifier.hpp"
33 #include "classfile/vmSymbols.hpp"
34 #include "interpreter/bytecodes.hpp"
35 #include "interpreter/bytecodeStream.hpp"
36 #include "logging/log.hpp"
37 #include "memory/oopFactory.hpp"
38 #include "memory/resourceArea.hpp"
39 #include "oops/instanceKlass.hpp"
40 #include "oops/oop.inline.hpp"
41 #include "oops/typeArrayOop.hpp"
42 #include "prims/jvm.h"
43 #include "runtime/fieldDescriptor.hpp"
44 #include "runtime/handles.inline.hpp"
45 #include "runtime/interfaceSupport.hpp"
46 #include "runtime/javaCalls.hpp"
47 #include "runtime/orderAccess.inline.hpp"
48 #include "runtime/os.hpp"
49 #include "runtime/thread.hpp"
50 #include "services/threadService.hpp"
51 #include "utilities/bytes.hpp"
52 #include "logging/log.hpp"
53
54 #define NOFAILOVER_MAJOR_VERSION 51
55 #define NONZERO_PADDING_BYTES_IN_SWITCH_MAJOR_VERSION 51
56 #define STATIC_METHOD_IN_INTERFACE_MAJOR_VERSION 52
57 #define MAX_ARRAY_DIMENSIONS 255
58
59 // Access to external entry for VerifyClassCodes - old byte code verifier
60
61 extern "C" {
62 typedef jboolean (*verify_byte_codes_fn_t)(JNIEnv *, jclass, char *, jint);
63 typedef jboolean (*verify_byte_codes_fn_new_t)(JNIEnv *, jclass, char *, jint, jint);
64 }
65
66 static void* volatile _verify_byte_codes_fn = NULL;
67
68 static volatile jint _is_new_verify_byte_codes_fn = (jint) true;
69
70 static void* verify_byte_codes_fn() {
71 if (OrderAccess::load_ptr_acquire(&_verify_byte_codes_fn) == NULL) {
72 void *lib_handle = os::native_java_library();
73 void *func = os::dll_lookup(lib_handle, "VerifyClassCodesForMajorVersion");
74 OrderAccess::release_store_ptr(&_verify_byte_codes_fn, func);
75 if (func == NULL) {
76 _is_new_verify_byte_codes_fn = false;
77 func = os::dll_lookup(lib_handle, "VerifyClassCodes");
78 OrderAccess::release_store_ptr(&_verify_byte_codes_fn, func);
79 }
80 }
81 return (void*)_verify_byte_codes_fn;
82 }
83
84
85 // Methods in Verifier
86
87 bool Verifier::should_verify_for(oop class_loader, bool should_verify_class) {
88 return (class_loader == NULL || !should_verify_class) ?
89 BytecodeVerificationLocal : BytecodeVerificationRemote;
90 }
91
92 bool Verifier::relax_access_for(oop loader) {
93 bool trusted = java_lang_ClassLoader::is_trusted_loader(loader);
94 bool need_verify =
95 // verifyAll
96 (BytecodeVerificationLocal && BytecodeVerificationRemote) ||
97 // verifyRemote
98 (!BytecodeVerificationLocal && BytecodeVerificationRemote && !trusted);
99 return !need_verify;
100 }
101
102 void Verifier::trace_class_resolution(Klass* resolve_class, InstanceKlass* verify_class) {
103 assert(verify_class != NULL, "Unexpected null verify_class");
104 ResourceMark rm;
105 Symbol* s = verify_class->source_file_name();
106 const char* source_file = (s != NULL ? s->as_C_string() : NULL);
107 const char* verify = verify_class->external_name();
108 const char* resolve = resolve_class->external_name();
109 // print in a single call to reduce interleaving between threads
110 if (source_file != NULL) {
111 log_debug(class, resolve)("%s %s %s (verification)", verify, resolve, source_file);
112 } else {
113 log_debug(class, resolve)("%s %s (verification)", verify, resolve);
114 }
115 }
116
117 // Prints the end-verification message to the appropriate output.
118 void Verifier::log_end_verification(outputStream* st, const char* klassName, Symbol* exception_name, TRAPS) {
119 if (HAS_PENDING_EXCEPTION) {
120 st->print("Verification for %s has", klassName);
121 st->print_cr(" exception pending %s ",
122 PENDING_EXCEPTION->klass()->external_name());
123 } else if (exception_name != NULL) {
124 st->print_cr("Verification for %s failed", klassName);
125 }
126 st->print_cr("End class verification for: %s", klassName);
127 }
128
129 bool Verifier::verify(InstanceKlass* klass, Verifier::Mode mode, bool should_verify_class, TRAPS) {
130 HandleMark hm(THREAD);
131 ResourceMark rm(THREAD);
132
133 // Eagerly allocate the identity hash code for a klass. This is a fallout
134 // from 6320749 and 8059924: hash code generator is not supposed to be called
135 // during the safepoint, but it allows to sneak the hashcode in during
136 // verification. Without this eager hashcode generation, we may end up
137 // installing the hashcode during some other operation, which may be at
138 // safepoint -- blowing up the checks. It was previously done as the side
139 // effect (sic!) for external_name(), but instead of doing that, we opt to
140 // explicitly push the hashcode in here. This is signify the following block
141 // is IMPORTANT:
142 if (klass->java_mirror() != NULL) {
143 klass->java_mirror()->identity_hash();
144 }
145
146 if (!is_eligible_for_verification(klass, should_verify_class)) {
147 return true;
148 }
149
150 // Timer includes any side effects of class verification (resolution,
151 // etc), but not recursive calls to Verifier::verify().
152 JavaThread* jt = (JavaThread*)THREAD;
153 PerfClassTraceTime timer(ClassLoader::perf_class_verify_time(),
154 ClassLoader::perf_class_verify_selftime(),
155 ClassLoader::perf_classes_verified(),
156 jt->get_thread_stat()->perf_recursion_counts_addr(),
157 jt->get_thread_stat()->perf_timers_addr(),
158 PerfClassTraceTime::CLASS_VERIFY);
159
160 // If the class should be verified, first see if we can use the split
161 // verifier. If not, or if verification fails and FailOverToOldVerifier
162 // is set, then call the inference verifier.
163
164 Symbol* exception_name = NULL;
165 const size_t message_buffer_len = klass->name()->utf8_length() + 1024;
166 char* message_buffer = NEW_RESOURCE_ARRAY(char, message_buffer_len);
167 char* exception_message = message_buffer;
168
169 const char* klassName = klass->external_name();
170 bool can_failover = FailOverToOldVerifier &&
171 klass->major_version() < NOFAILOVER_MAJOR_VERSION;
172
173 log_info(class, init)("Start class verification for: %s", klassName);
174 if (klass->major_version() >= STACKMAP_ATTRIBUTE_MAJOR_VERSION) {
175 ClassVerifier split_verifier(klass, THREAD);
176 split_verifier.verify_class(THREAD);
177 exception_name = split_verifier.result();
178 if (can_failover && !HAS_PENDING_EXCEPTION &&
179 (exception_name == vmSymbols::java_lang_VerifyError() ||
180 exception_name == vmSymbols::java_lang_ClassFormatError())) {
181 log_info(verification)("Fail over class verification to old verifier for: %s", klassName);
182 log_info(class, init)("Fail over class verification to old verifier for: %s", klassName);
183 exception_name = inference_verify(
184 klass, message_buffer, message_buffer_len, THREAD);
185 }
186 if (exception_name != NULL) {
187 exception_message = split_verifier.exception_message();
188 }
189 } else {
190 exception_name = inference_verify(
191 klass, message_buffer, message_buffer_len, THREAD);
192 }
193
194 if (log_is_enabled(Info, class, init)){
195 log_end_verification(Log(class, init)::info_stream(), klassName, exception_name, THREAD);
196 }
197 if (log_is_enabled(Info, verification)){
198 log_end_verification(Log(verification)::info_stream(), klassName, exception_name, THREAD);
199 }
200
201 if (HAS_PENDING_EXCEPTION) {
202 return false; // use the existing exception
203 } else if (exception_name == NULL) {
204 return true; // verifcation succeeded
205 } else { // VerifyError or ClassFormatError to be created and thrown
206 ResourceMark rm(THREAD);
207 Klass* kls =
208 SystemDictionary::resolve_or_fail(exception_name, true, CHECK_false);
209 if (log_is_enabled(Debug, class, resolve)) {
210 Verifier::trace_class_resolution(kls, klass);
211 }
212
213 while (kls != NULL) {
214 if (kls == klass) {
215 // If the class being verified is the exception we're creating
216 // or one of it's superclasses, we're in trouble and are going
217 // to infinitely recurse when we try to initialize the exception.
218 // So bail out here by throwing the preallocated VM error.
219 THROW_OOP_(Universe::virtual_machine_error_instance(), false);
220 }
221 kls = kls->super();
222 }
223 message_buffer[message_buffer_len - 1] = '\0'; // just to be sure
224 THROW_MSG_(exception_name, exception_message, false);
225 }
226 }
227
228 bool Verifier::is_eligible_for_verification(InstanceKlass* klass, bool should_verify_class) {
229 Symbol* name = klass->name();
230 Klass* refl_magic_klass = SystemDictionary::reflect_MagicAccessorImpl_klass();
231
232 bool is_reflect = refl_magic_klass != NULL && klass->is_subtype_of(refl_magic_klass);
233
234 return (should_verify_for(klass->class_loader(), should_verify_class) &&
235 // return if the class is a bootstrapping class
236 // or defineClass specified not to verify by default (flags override passed arg)
237 // We need to skip the following four for bootstraping
238 name != vmSymbols::java_lang_Object() &&
239 name != vmSymbols::java_lang_Class() &&
240 name != vmSymbols::java_lang_String() &&
241 name != vmSymbols::java_lang_Throwable() &&
242
243 // Can not verify the bytecodes for shared classes because they have
244 // already been rewritten to contain constant pool cache indices,
245 // which the verifier can't understand.
246 // Shared classes shouldn't have stackmaps either.
247 !klass->is_shared() &&
248
249 // As of the fix for 4486457 we disable verification for all of the
250 // dynamically-generated bytecodes associated with the 1.4
251 // reflection implementation, not just those associated with
252 // jdk/internal/reflect/SerializationConstructorAccessor.
253 // NOTE: this is called too early in the bootstrapping process to be
254 // guarded by Universe::is_gte_jdk14x_version().
255 // Also for lambda generated code, gte jdk8
256 (!is_reflect));
257 }
258
259 Symbol* Verifier::inference_verify(
260 InstanceKlass* klass, char* message, size_t message_len, TRAPS) {
261 JavaThread* thread = (JavaThread*)THREAD;
262 JNIEnv *env = thread->jni_environment();
263
264 void* verify_func = verify_byte_codes_fn();
265
266 if (verify_func == NULL) {
267 jio_snprintf(message, message_len, "Could not link verifier");
268 return vmSymbols::java_lang_VerifyError();
269 }
270
271 ResourceMark rm(THREAD);
272 log_info(verification)("Verifying class %s with old format", klass->external_name());
273
274 jclass cls = (jclass) JNIHandles::make_local(env, klass->java_mirror());
275 jint result;
276
277 {
278 HandleMark hm(thread);
279 ThreadToNativeFromVM ttn(thread);
280 // ThreadToNativeFromVM takes care of changing thread_state, so safepoint
281 // code knows that we have left the VM
282
283 if (_is_new_verify_byte_codes_fn) {
284 verify_byte_codes_fn_new_t func =
285 CAST_TO_FN_PTR(verify_byte_codes_fn_new_t, verify_func);
286 result = (*func)(env, cls, message, (int)message_len,
287 klass->major_version());
288 } else {
289 verify_byte_codes_fn_t func =
290 CAST_TO_FN_PTR(verify_byte_codes_fn_t, verify_func);
291 result = (*func)(env, cls, message, (int)message_len);
292 }
293 }
294
295 JNIHandles::destroy_local(cls);
296
297 // These numbers are chosen so that VerifyClassCodes interface doesn't need
298 // to be changed (still return jboolean (unsigned char)), and result is
299 // 1 when verification is passed.
300 if (result == 0) {
301 return vmSymbols::java_lang_VerifyError();
302 } else if (result == 1) {
303 return NULL; // verified.
304 } else if (result == 2) {
305 THROW_MSG_(vmSymbols::java_lang_OutOfMemoryError(), message, NULL);
306 } else if (result == 3) {
307 return vmSymbols::java_lang_ClassFormatError();
308 } else {
309 ShouldNotReachHere();
310 return NULL;
311 }
312 }
313
314 TypeOrigin TypeOrigin::null() {
315 return TypeOrigin();
316 }
317 TypeOrigin TypeOrigin::local(u2 index, StackMapFrame* frame) {
318 assert(frame != NULL, "Must have a frame");
319 return TypeOrigin(CF_LOCALS, index, StackMapFrame::copy(frame),
320 frame->local_at(index));
321 }
322 TypeOrigin TypeOrigin::stack(u2 index, StackMapFrame* frame) {
323 assert(frame != NULL, "Must have a frame");
324 return TypeOrigin(CF_STACK, index, StackMapFrame::copy(frame),
325 frame->stack_at(index));
326 }
327 TypeOrigin TypeOrigin::sm_local(u2 index, StackMapFrame* frame) {
328 assert(frame != NULL, "Must have a frame");
329 return TypeOrigin(SM_LOCALS, index, StackMapFrame::copy(frame),
330 frame->local_at(index));
331 }
332 TypeOrigin TypeOrigin::sm_stack(u2 index, StackMapFrame* frame) {
333 assert(frame != NULL, "Must have a frame");
334 return TypeOrigin(SM_STACK, index, StackMapFrame::copy(frame),
335 frame->stack_at(index));
336 }
337 TypeOrigin TypeOrigin::bad_index(u2 index) {
338 return TypeOrigin(BAD_INDEX, index, NULL, VerificationType::bogus_type());
339 }
340 TypeOrigin TypeOrigin::cp(u2 index, VerificationType vt) {
341 return TypeOrigin(CONST_POOL, index, NULL, vt);
342 }
343 TypeOrigin TypeOrigin::signature(VerificationType vt) {
344 return TypeOrigin(SIG, 0, NULL, vt);
345 }
346 TypeOrigin TypeOrigin::implicit(VerificationType t) {
347 return TypeOrigin(IMPLICIT, 0, NULL, t);
348 }
349 TypeOrigin TypeOrigin::frame(StackMapFrame* frame) {
350 return TypeOrigin(FRAME_ONLY, 0, StackMapFrame::copy(frame),
351 VerificationType::bogus_type());
352 }
353
354 void TypeOrigin::reset_frame() {
355 if (_frame != NULL) {
356 _frame->restore();
357 }
358 }
359
360 void TypeOrigin::details(outputStream* ss) const {
361 _type.print_on(ss);
362 switch (_origin) {
363 case CF_LOCALS:
364 ss->print(" (current frame, locals[%d])", _index);
365 break;
366 case CF_STACK:
367 ss->print(" (current frame, stack[%d])", _index);
368 break;
369 case SM_LOCALS:
370 ss->print(" (stack map, locals[%d])", _index);
371 break;
372 case SM_STACK:
373 ss->print(" (stack map, stack[%d])", _index);
374 break;
375 case CONST_POOL:
376 ss->print(" (constant pool %d)", _index);
377 break;
378 case SIG:
379 ss->print(" (from method signature)");
380 break;
381 case IMPLICIT:
382 case FRAME_ONLY:
383 case NONE:
384 default:
385 ;
386 }
387 }
388
389 #ifdef ASSERT
390 void TypeOrigin::print_on(outputStream* str) const {
391 str->print("{%d,%d,%p:", _origin, _index, _frame);
392 if (_frame != NULL) {
393 _frame->print_on(str);
394 } else {
395 str->print("null");
396 }
397 str->print(",");
398 _type.print_on(str);
399 str->print("}");
400 }
401 #endif
402
403 void ErrorContext::details(outputStream* ss, const Method* method) const {
404 if (is_valid()) {
405 ss->cr();
406 ss->print_cr("Exception Details:");
407 location_details(ss, method);
408 reason_details(ss);
409 frame_details(ss);
410 bytecode_details(ss, method);
411 handler_details(ss, method);
412 stackmap_details(ss, method);
413 }
414 }
415
416 void ErrorContext::reason_details(outputStream* ss) const {
417 streamIndentor si(ss);
418 ss->indent().print_cr("Reason:");
419 streamIndentor si2(ss);
420 ss->indent().print("%s", "");
421 switch (_fault) {
422 case INVALID_BYTECODE:
423 ss->print("Error exists in the bytecode");
424 break;
425 case WRONG_TYPE:
426 if (_expected.is_valid()) {
427 ss->print("Type ");
428 _type.details(ss);
429 ss->print(" is not assignable to ");
430 _expected.details(ss);
431 } else {
432 ss->print("Invalid type: ");
433 _type.details(ss);
434 }
435 break;
436 case FLAGS_MISMATCH:
437 if (_expected.is_valid()) {
438 ss->print("Current frame's flags are not assignable "
439 "to stack map frame's.");
440 } else {
441 ss->print("Current frame's flags are invalid in this context.");
442 }
443 break;
444 case BAD_CP_INDEX:
445 ss->print("Constant pool index %d is invalid", _type.index());
446 break;
447 case BAD_LOCAL_INDEX:
448 ss->print("Local index %d is invalid", _type.index());
449 break;
450 case LOCALS_SIZE_MISMATCH:
451 ss->print("Current frame's local size doesn't match stackmap.");
452 break;
453 case STACK_SIZE_MISMATCH:
454 ss->print("Current frame's stack size doesn't match stackmap.");
455 break;
456 case STACK_OVERFLOW:
457 ss->print("Exceeded max stack size.");
458 break;
459 case STACK_UNDERFLOW:
460 ss->print("Attempt to pop empty stack.");
461 break;
462 case MISSING_STACKMAP:
463 ss->print("Expected stackmap frame at this location.");
464 break;
465 case BAD_STACKMAP:
466 ss->print("Invalid stackmap specification.");
467 break;
468 case UNKNOWN:
469 default:
470 ShouldNotReachHere();
471 ss->print_cr("Unknown");
472 }
473 ss->cr();
474 }
475
476 void ErrorContext::location_details(outputStream* ss, const Method* method) const {
477 if (_bci != -1 && method != NULL) {
478 streamIndentor si(ss);
479 const char* bytecode_name = "<invalid>";
480 if (method->validate_bci(_bci) != -1) {
481 Bytecodes::Code code = Bytecodes::code_or_bp_at(method->bcp_from(_bci));
482 if (Bytecodes::is_defined(code)) {
483 bytecode_name = Bytecodes::name(code);
484 } else {
485 bytecode_name = "<illegal>";
486 }
487 }
488 InstanceKlass* ik = method->method_holder();
489 ss->indent().print_cr("Location:");
490 streamIndentor si2(ss);
491 ss->indent().print_cr("%s.%s%s @%d: %s",
492 ik->name()->as_C_string(), method->name()->as_C_string(),
493 method->signature()->as_C_string(), _bci, bytecode_name);
494 }
495 }
496
497 void ErrorContext::frame_details(outputStream* ss) const {
498 streamIndentor si(ss);
499 if (_type.is_valid() && _type.frame() != NULL) {
500 ss->indent().print_cr("Current Frame:");
501 streamIndentor si2(ss);
502 _type.frame()->print_on(ss);
503 }
504 if (_expected.is_valid() && _expected.frame() != NULL) {
505 ss->indent().print_cr("Stackmap Frame:");
506 streamIndentor si2(ss);
507 _expected.frame()->print_on(ss);
508 }
509 }
510
511 void ErrorContext::bytecode_details(outputStream* ss, const Method* method) const {
512 if (method != NULL) {
513 streamIndentor si(ss);
514 ss->indent().print_cr("Bytecode:");
515 streamIndentor si2(ss);
516 ss->print_data(method->code_base(), method->code_size(), false);
517 }
518 }
519
520 void ErrorContext::handler_details(outputStream* ss, const Method* method) const {
521 if (method != NULL) {
522 streamIndentor si(ss);
523 ExceptionTable table(method);
524 if (table.length() > 0) {
525 ss->indent().print_cr("Exception Handler Table:");
526 streamIndentor si2(ss);
527 for (int i = 0; i < table.length(); ++i) {
528 ss->indent().print_cr("bci [%d, %d] => handler: %d", table.start_pc(i),
529 table.end_pc(i), table.handler_pc(i));
530 }
531 }
532 }
533 }
534
535 void ErrorContext::stackmap_details(outputStream* ss, const Method* method) const {
536 if (method != NULL && method->has_stackmap_table()) {
537 streamIndentor si(ss);
538 ss->indent().print_cr("Stackmap Table:");
539 Array<u1>* data = method->stackmap_data();
540 stack_map_table* sm_table =
541 stack_map_table::at((address)data->adr_at(0));
542 stack_map_frame* sm_frame = sm_table->entries();
543 streamIndentor si2(ss);
544 int current_offset = -1;
545 address end_of_sm_table = (address)sm_table + method->stackmap_data()->length();
546 for (u2 i = 0; i < sm_table->number_of_entries(); ++i) {
547 ss->indent();
548 if (!sm_frame->verify((address)sm_frame, end_of_sm_table)) {
549 sm_frame->print_truncated(ss, current_offset);
550 return;
551 }
552 sm_frame->print_on(ss, current_offset);
553 ss->cr();
554 current_offset += sm_frame->offset_delta();
555 sm_frame = sm_frame->next();
556 }
557 }
558 }
559
560 // Methods in ClassVerifier
561
562 ClassVerifier::ClassVerifier(
563 InstanceKlass* klass, TRAPS)
564 : _thread(THREAD), _exception_type(NULL), _message(NULL), _klass(klass) {
565 _this_type = VerificationType::reference_type(klass->name());
566 // Create list to hold symbols in reference area.
567 _symbols = new GrowableArray<Symbol*>(100, 0, NULL);
568 }
569
570 ClassVerifier::~ClassVerifier() {
571 // Decrement the reference count for any symbols created.
572 for (int i = 0; i < _symbols->length(); i++) {
573 Symbol* s = _symbols->at(i);
574 s->decrement_refcount();
575 }
576 }
577
578 VerificationType ClassVerifier::object_type() const {
579 return VerificationType::reference_type(vmSymbols::java_lang_Object());
580 }
581
582 TypeOrigin ClassVerifier::ref_ctx(const char* sig, TRAPS) {
583 VerificationType vt = VerificationType::reference_type(
584 create_temporary_symbol(sig, (int)strlen(sig), THREAD));
585 return TypeOrigin::implicit(vt);
586 }
587
588 void ClassVerifier::verify_class(TRAPS) {
589 log_info(verification)("Verifying class %s with new format", _klass->external_name());
590
591 Array<Method*>* methods = _klass->methods();
592 int num_methods = methods->length();
593
594 for (int index = 0; index < num_methods; index++) {
595 // Check for recursive re-verification before each method.
596 if (was_recursively_verified()) return;
597
598 Method* m = methods->at(index);
599 if (m->is_native() || m->is_abstract() || m->is_overpass()) {
600 // If m is native or abstract, skip it. It is checked in class file
601 // parser that methods do not override a final method. Overpass methods
602 // are trusted since the VM generates them.
603 continue;
604 }
605 verify_method(methodHandle(THREAD, m), CHECK_VERIFY(this));
606 }
607
608 if (was_recursively_verified()){
609 log_info(verification)("Recursive verification detected for: %s", _klass->external_name());
610 log_info(class, init)("Recursive verification detected for: %s",
611 _klass->external_name());
612 }
613 }
614
615 void ClassVerifier::verify_method(const methodHandle& m, TRAPS) {
616 HandleMark hm(THREAD);
617 _method = m; // initialize _method
618 log_info(verification)("Verifying method %s", m->name_and_sig_as_C_string());
619
620 // For clang, the only good constant format string is a literal constant format string.
621 #define bad_type_msg "Bad type on operand stack in %s"
622
623 int32_t max_stack = m->verifier_max_stack();
624 int32_t max_locals = m->max_locals();
625 constantPoolHandle cp(THREAD, m->constants());
626
627 if (!SignatureVerifier::is_valid_method_signature(m->signature())) {
628 class_format_error("Invalid method signature");
629 return;
630 }
631
632 // Initial stack map frame: offset is 0, stack is initially empty.
633 StackMapFrame current_frame(max_locals, max_stack, this);
634 // Set initial locals
635 VerificationType return_type = current_frame.set_locals_from_arg(
636 m, current_type(), CHECK_VERIFY(this));
637
638 int32_t stackmap_index = 0; // index to the stackmap array
639
640 u4 code_length = m->code_size();
641
642 // Scan the bytecode and map each instruction's start offset to a number.
643 char* code_data = generate_code_data(m, code_length, CHECK_VERIFY(this));
644
645 int ex_min = code_length;
646 int ex_max = -1;
647 // Look through each item on the exception table. Each of the fields must refer
648 // to a legal instruction.
649 if (was_recursively_verified()) return;
650 verify_exception_handler_table(
651 code_length, code_data, ex_min, ex_max, CHECK_VERIFY(this));
652
653 // Look through each entry on the local variable table and make sure
654 // its range of code array offsets is valid. (4169817)
655 if (m->has_localvariable_table()) {
656 verify_local_variable_table(code_length, code_data, CHECK_VERIFY(this));
657 }
658
659 Array<u1>* stackmap_data = m->stackmap_data();
660 StackMapStream stream(stackmap_data);
661 StackMapReader reader(this, &stream, code_data, code_length, THREAD);
662 StackMapTable stackmap_table(&reader, ¤t_frame, max_locals, max_stack,
663 code_data, code_length, CHECK_VERIFY(this));
664
665 if (log_is_enabled(Info, verification)) {
666 ResourceMark rm(THREAD);
667 stackmap_table.print_on(Log(verification)::info_stream());
668 }
669
670 RawBytecodeStream bcs(m);
671
672 // Scan the byte code linearly from the start to the end
673 bool no_control_flow = false; // Set to true when there is no direct control
674 // flow from current instruction to the next
675 // instruction in sequence
676
677 Bytecodes::Code opcode;
678 while (!bcs.is_last_bytecode()) {
679 // Check for recursive re-verification before each bytecode.
680 if (was_recursively_verified()) return;
681
682 opcode = bcs.raw_next();
683 u2 bci = bcs.bci();
684
685 // Set current frame's offset to bci
686 current_frame.set_offset(bci);
687 current_frame.set_mark();
688
689 // Make sure every offset in stackmap table point to the beginning to
690 // an instruction. Match current_frame to stackmap_table entry with
691 // the same offset if exists.
692 stackmap_index = verify_stackmap_table(
693 stackmap_index, bci, ¤t_frame, &stackmap_table,
694 no_control_flow, CHECK_VERIFY(this));
695
696
697 bool this_uninit = false; // Set to true when invokespecial <init> initialized 'this'
698 bool verified_exc_handlers = false;
699
700 // Merge with the next instruction
701 {
702 u2 index;
703 int target;
704 VerificationType type, type2;
705 VerificationType atype;
706
707 if (log_is_enabled(Info, verification)) {
708 ResourceMark rm(THREAD);
709 current_frame.print_on(Log(verification)::info_stream());
710 log_info(verification)("offset = %d, opcode = %s", bci, Bytecodes::name(opcode));
711 }
712
713 // Make sure wide instruction is in correct format
714 if (bcs.is_wide()) {
715 if (opcode != Bytecodes::_iinc && opcode != Bytecodes::_iload &&
716 opcode != Bytecodes::_aload && opcode != Bytecodes::_lload &&
717 opcode != Bytecodes::_istore && opcode != Bytecodes::_astore &&
718 opcode != Bytecodes::_lstore && opcode != Bytecodes::_fload &&
719 opcode != Bytecodes::_dload && opcode != Bytecodes::_fstore &&
720 opcode != Bytecodes::_dstore) {
721 /* Unreachable? RawBytecodeStream's raw_next() returns 'illegal'
722 * if we encounter a wide instruction that modifies an invalid
723 * opcode (not one of the ones listed above) */
724 verify_error(ErrorContext::bad_code(bci), "Bad wide instruction");
725 return;
726 }
727 }
728
729 // Look for possible jump target in exception handlers and see if it
730 // matches current_frame. Do this check here for astore*, dstore*,
731 // fstore*, istore*, and lstore* opcodes because they can change the type
732 // state by adding a local. JVM Spec says that the incoming type state
733 // should be used for this check. So, do the check here before a possible
734 // local is added to the type state.
735 if (Bytecodes::is_store_into_local(opcode) && bci >= ex_min && bci < ex_max) {
736 if (was_recursively_verified()) return;
737 verify_exception_handler_targets(
738 bci, this_uninit, ¤t_frame, &stackmap_table, CHECK_VERIFY(this));
739 verified_exc_handlers = true;
740 }
741
742 if (was_recursively_verified()) return;
743
744 switch (opcode) {
745 case Bytecodes::_nop :
746 no_control_flow = false; break;
747 case Bytecodes::_aconst_null :
748 current_frame.push_stack(
749 VerificationType::null_type(), CHECK_VERIFY(this));
750 no_control_flow = false; break;
751 case Bytecodes::_iconst_m1 :
752 case Bytecodes::_iconst_0 :
753 case Bytecodes::_iconst_1 :
754 case Bytecodes::_iconst_2 :
755 case Bytecodes::_iconst_3 :
756 case Bytecodes::_iconst_4 :
757 case Bytecodes::_iconst_5 :
758 current_frame.push_stack(
759 VerificationType::integer_type(), CHECK_VERIFY(this));
760 no_control_flow = false; break;
761 case Bytecodes::_lconst_0 :
762 case Bytecodes::_lconst_1 :
763 current_frame.push_stack_2(
764 VerificationType::long_type(),
765 VerificationType::long2_type(), CHECK_VERIFY(this));
766 no_control_flow = false; break;
767 case Bytecodes::_fconst_0 :
768 case Bytecodes::_fconst_1 :
769 case Bytecodes::_fconst_2 :
770 current_frame.push_stack(
771 VerificationType::float_type(), CHECK_VERIFY(this));
772 no_control_flow = false; break;
773 case Bytecodes::_dconst_0 :
774 case Bytecodes::_dconst_1 :
775 current_frame.push_stack_2(
776 VerificationType::double_type(),
777 VerificationType::double2_type(), CHECK_VERIFY(this));
778 no_control_flow = false; break;
779 case Bytecodes::_sipush :
780 case Bytecodes::_bipush :
781 current_frame.push_stack(
782 VerificationType::integer_type(), CHECK_VERIFY(this));
783 no_control_flow = false; break;
784 case Bytecodes::_ldc :
785 verify_ldc(
786 opcode, bcs.get_index_u1(), ¤t_frame,
787 cp, bci, CHECK_VERIFY(this));
788 no_control_flow = false; break;
789 case Bytecodes::_ldc_w :
790 case Bytecodes::_ldc2_w :
791 verify_ldc(
792 opcode, bcs.get_index_u2(), ¤t_frame,
793 cp, bci, CHECK_VERIFY(this));
794 no_control_flow = false; break;
795 case Bytecodes::_iload :
796 verify_iload(bcs.get_index(), ¤t_frame, CHECK_VERIFY(this));
797 no_control_flow = false; break;
798 case Bytecodes::_iload_0 :
799 case Bytecodes::_iload_1 :
800 case Bytecodes::_iload_2 :
801 case Bytecodes::_iload_3 :
802 index = opcode - Bytecodes::_iload_0;
803 verify_iload(index, ¤t_frame, CHECK_VERIFY(this));
804 no_control_flow = false; break;
805 case Bytecodes::_lload :
806 verify_lload(bcs.get_index(), ¤t_frame, CHECK_VERIFY(this));
807 no_control_flow = false; break;
808 case Bytecodes::_lload_0 :
809 case Bytecodes::_lload_1 :
810 case Bytecodes::_lload_2 :
811 case Bytecodes::_lload_3 :
812 index = opcode - Bytecodes::_lload_0;
813 verify_lload(index, ¤t_frame, CHECK_VERIFY(this));
814 no_control_flow = false; break;
815 case Bytecodes::_fload :
816 verify_fload(bcs.get_index(), ¤t_frame, CHECK_VERIFY(this));
817 no_control_flow = false; break;
818 case Bytecodes::_fload_0 :
819 case Bytecodes::_fload_1 :
820 case Bytecodes::_fload_2 :
821 case Bytecodes::_fload_3 :
822 index = opcode - Bytecodes::_fload_0;
823 verify_fload(index, ¤t_frame, CHECK_VERIFY(this));
824 no_control_flow = false; break;
825 case Bytecodes::_dload :
826 verify_dload(bcs.get_index(), ¤t_frame, CHECK_VERIFY(this));
827 no_control_flow = false; break;
828 case Bytecodes::_dload_0 :
829 case Bytecodes::_dload_1 :
830 case Bytecodes::_dload_2 :
831 case Bytecodes::_dload_3 :
832 index = opcode - Bytecodes::_dload_0;
833 verify_dload(index, ¤t_frame, CHECK_VERIFY(this));
834 no_control_flow = false; break;
835 case Bytecodes::_aload :
836 verify_aload(bcs.get_index(), ¤t_frame, CHECK_VERIFY(this));
837 no_control_flow = false; break;
838 case Bytecodes::_aload_0 :
839 case Bytecodes::_aload_1 :
840 case Bytecodes::_aload_2 :
841 case Bytecodes::_aload_3 :
842 index = opcode - Bytecodes::_aload_0;
843 verify_aload(index, ¤t_frame, CHECK_VERIFY(this));
844 no_control_flow = false; break;
845 case Bytecodes::_iaload :
846 type = current_frame.pop_stack(
847 VerificationType::integer_type(), CHECK_VERIFY(this));
848 atype = current_frame.pop_stack(
849 VerificationType::reference_check(), CHECK_VERIFY(this));
850 if (!atype.is_int_array()) {
851 verify_error(ErrorContext::bad_type(bci,
852 current_frame.stack_top_ctx(), ref_ctx("[I", THREAD)),
853 bad_type_msg, "iaload");
854 return;
855 }
856 current_frame.push_stack(
857 VerificationType::integer_type(), CHECK_VERIFY(this));
858 no_control_flow = false; break;
859 case Bytecodes::_baload :
860 type = current_frame.pop_stack(
861 VerificationType::integer_type(), CHECK_VERIFY(this));
862 atype = current_frame.pop_stack(
863 VerificationType::reference_check(), CHECK_VERIFY(this));
864 if (!atype.is_bool_array() && !atype.is_byte_array()) {
865 verify_error(
866 ErrorContext::bad_type(bci, current_frame.stack_top_ctx()),
867 bad_type_msg, "baload");
868 return;
869 }
870 current_frame.push_stack(
871 VerificationType::integer_type(), CHECK_VERIFY(this));
872 no_control_flow = false; break;
873 case Bytecodes::_caload :
874 type = current_frame.pop_stack(
875 VerificationType::integer_type(), CHECK_VERIFY(this));
876 atype = current_frame.pop_stack(
877 VerificationType::reference_check(), CHECK_VERIFY(this));
878 if (!atype.is_char_array()) {
879 verify_error(ErrorContext::bad_type(bci,
880 current_frame.stack_top_ctx(), ref_ctx("[C", THREAD)),
881 bad_type_msg, "caload");
882 return;
883 }
884 current_frame.push_stack(
885 VerificationType::integer_type(), CHECK_VERIFY(this));
886 no_control_flow = false; break;
887 case Bytecodes::_saload :
888 type = current_frame.pop_stack(
889 VerificationType::integer_type(), CHECK_VERIFY(this));
890 atype = current_frame.pop_stack(
891 VerificationType::reference_check(), CHECK_VERIFY(this));
892 if (!atype.is_short_array()) {
893 verify_error(ErrorContext::bad_type(bci,
894 current_frame.stack_top_ctx(), ref_ctx("[S", THREAD)),
895 bad_type_msg, "saload");
896 return;
897 }
898 current_frame.push_stack(
899 VerificationType::integer_type(), CHECK_VERIFY(this));
900 no_control_flow = false; break;
901 case Bytecodes::_laload :
902 type = current_frame.pop_stack(
903 VerificationType::integer_type(), CHECK_VERIFY(this));
904 atype = current_frame.pop_stack(
905 VerificationType::reference_check(), CHECK_VERIFY(this));
906 if (!atype.is_long_array()) {
907 verify_error(ErrorContext::bad_type(bci,
908 current_frame.stack_top_ctx(), ref_ctx("[J", THREAD)),
909 bad_type_msg, "laload");
910 return;
911 }
912 current_frame.push_stack_2(
913 VerificationType::long_type(),
914 VerificationType::long2_type(), CHECK_VERIFY(this));
915 no_control_flow = false; break;
916 case Bytecodes::_faload :
917 type = current_frame.pop_stack(
918 VerificationType::integer_type(), CHECK_VERIFY(this));
919 atype = current_frame.pop_stack(
920 VerificationType::reference_check(), CHECK_VERIFY(this));
921 if (!atype.is_float_array()) {
922 verify_error(ErrorContext::bad_type(bci,
923 current_frame.stack_top_ctx(), ref_ctx("[F", THREAD)),
924 bad_type_msg, "faload");
925 return;
926 }
927 current_frame.push_stack(
928 VerificationType::float_type(), CHECK_VERIFY(this));
929 no_control_flow = false; break;
930 case Bytecodes::_daload :
931 type = current_frame.pop_stack(
932 VerificationType::integer_type(), CHECK_VERIFY(this));
933 atype = current_frame.pop_stack(
934 VerificationType::reference_check(), CHECK_VERIFY(this));
935 if (!atype.is_double_array()) {
936 verify_error(ErrorContext::bad_type(bci,
937 current_frame.stack_top_ctx(), ref_ctx("[D", THREAD)),
938 bad_type_msg, "daload");
939 return;
940 }
941 current_frame.push_stack_2(
942 VerificationType::double_type(),
943 VerificationType::double2_type(), CHECK_VERIFY(this));
944 no_control_flow = false; break;
945 case Bytecodes::_aaload : {
946 type = current_frame.pop_stack(
947 VerificationType::integer_type(), CHECK_VERIFY(this));
948 atype = current_frame.pop_stack(
949 VerificationType::reference_check(), CHECK_VERIFY(this));
950 if (!atype.is_reference_array()) {
951 verify_error(ErrorContext::bad_type(bci,
952 current_frame.stack_top_ctx(),
953 TypeOrigin::implicit(VerificationType::reference_check())),
954 bad_type_msg, "aaload");
955 return;
956 }
957 if (atype.is_null()) {
958 current_frame.push_stack(
959 VerificationType::null_type(), CHECK_VERIFY(this));
960 } else {
961 VerificationType component =
962 atype.get_component(this, CHECK_VERIFY(this));
963 current_frame.push_stack(component, CHECK_VERIFY(this));
964 }
965 no_control_flow = false; break;
966 }
967 case Bytecodes::_istore :
968 verify_istore(bcs.get_index(), ¤t_frame, CHECK_VERIFY(this));
969 no_control_flow = false; break;
970 case Bytecodes::_istore_0 :
971 case Bytecodes::_istore_1 :
972 case Bytecodes::_istore_2 :
973 case Bytecodes::_istore_3 :
974 index = opcode - Bytecodes::_istore_0;
975 verify_istore(index, ¤t_frame, CHECK_VERIFY(this));
976 no_control_flow = false; break;
977 case Bytecodes::_lstore :
978 verify_lstore(bcs.get_index(), ¤t_frame, CHECK_VERIFY(this));
979 no_control_flow = false; break;
980 case Bytecodes::_lstore_0 :
981 case Bytecodes::_lstore_1 :
982 case Bytecodes::_lstore_2 :
983 case Bytecodes::_lstore_3 :
984 index = opcode - Bytecodes::_lstore_0;
985 verify_lstore(index, ¤t_frame, CHECK_VERIFY(this));
986 no_control_flow = false; break;
987 case Bytecodes::_fstore :
988 verify_fstore(bcs.get_index(), ¤t_frame, CHECK_VERIFY(this));
989 no_control_flow = false; break;
990 case Bytecodes::_fstore_0 :
991 case Bytecodes::_fstore_1 :
992 case Bytecodes::_fstore_2 :
993 case Bytecodes::_fstore_3 :
994 index = opcode - Bytecodes::_fstore_0;
995 verify_fstore(index, ¤t_frame, CHECK_VERIFY(this));
996 no_control_flow = false; break;
997 case Bytecodes::_dstore :
998 verify_dstore(bcs.get_index(), ¤t_frame, CHECK_VERIFY(this));
999 no_control_flow = false; break;
1000 case Bytecodes::_dstore_0 :
1001 case Bytecodes::_dstore_1 :
1002 case Bytecodes::_dstore_2 :
1003 case Bytecodes::_dstore_3 :
1004 index = opcode - Bytecodes::_dstore_0;
1005 verify_dstore(index, ¤t_frame, CHECK_VERIFY(this));
1006 no_control_flow = false; break;
1007 case Bytecodes::_astore :
1008 verify_astore(bcs.get_index(), ¤t_frame, CHECK_VERIFY(this));
1009 no_control_flow = false; break;
1010 case Bytecodes::_astore_0 :
1011 case Bytecodes::_astore_1 :
1012 case Bytecodes::_astore_2 :
1013 case Bytecodes::_astore_3 :
1014 index = opcode - Bytecodes::_astore_0;
1015 verify_astore(index, ¤t_frame, CHECK_VERIFY(this));
1016 no_control_flow = false; break;
1017 case Bytecodes::_iastore :
1018 type = current_frame.pop_stack(
1019 VerificationType::integer_type(), CHECK_VERIFY(this));
1020 type2 = current_frame.pop_stack(
1021 VerificationType::integer_type(), CHECK_VERIFY(this));
1022 atype = current_frame.pop_stack(
1023 VerificationType::reference_check(), CHECK_VERIFY(this));
1024 if (!atype.is_int_array()) {
1025 verify_error(ErrorContext::bad_type(bci,
1026 current_frame.stack_top_ctx(), ref_ctx("[I", THREAD)),
1027 bad_type_msg, "iastore");
1028 return;
1029 }
1030 no_control_flow = false; break;
1031 case Bytecodes::_bastore :
1032 type = current_frame.pop_stack(
1033 VerificationType::integer_type(), CHECK_VERIFY(this));
1034 type2 = current_frame.pop_stack(
1035 VerificationType::integer_type(), CHECK_VERIFY(this));
1036 atype = current_frame.pop_stack(
1037 VerificationType::reference_check(), CHECK_VERIFY(this));
1038 if (!atype.is_bool_array() && !atype.is_byte_array()) {
1039 verify_error(
1040 ErrorContext::bad_type(bci, current_frame.stack_top_ctx()),
1041 bad_type_msg, "bastore");
1042 return;
1043 }
1044 no_control_flow = false; break;
1045 case Bytecodes::_castore :
1046 current_frame.pop_stack(
1047 VerificationType::integer_type(), CHECK_VERIFY(this));
1048 current_frame.pop_stack(
1049 VerificationType::integer_type(), CHECK_VERIFY(this));
1050 atype = current_frame.pop_stack(
1051 VerificationType::reference_check(), CHECK_VERIFY(this));
1052 if (!atype.is_char_array()) {
1053 verify_error(ErrorContext::bad_type(bci,
1054 current_frame.stack_top_ctx(), ref_ctx("[C", THREAD)),
1055 bad_type_msg, "castore");
1056 return;
1057 }
1058 no_control_flow = false; break;
1059 case Bytecodes::_sastore :
1060 current_frame.pop_stack(
1061 VerificationType::integer_type(), CHECK_VERIFY(this));
1062 current_frame.pop_stack(
1063 VerificationType::integer_type(), CHECK_VERIFY(this));
1064 atype = current_frame.pop_stack(
1065 VerificationType::reference_check(), CHECK_VERIFY(this));
1066 if (!atype.is_short_array()) {
1067 verify_error(ErrorContext::bad_type(bci,
1068 current_frame.stack_top_ctx(), ref_ctx("[S", THREAD)),
1069 bad_type_msg, "sastore");
1070 return;
1071 }
1072 no_control_flow = false; break;
1073 case Bytecodes::_lastore :
1074 current_frame.pop_stack_2(
1075 VerificationType::long2_type(),
1076 VerificationType::long_type(), CHECK_VERIFY(this));
1077 current_frame.pop_stack(
1078 VerificationType::integer_type(), CHECK_VERIFY(this));
1079 atype = current_frame.pop_stack(
1080 VerificationType::reference_check(), CHECK_VERIFY(this));
1081 if (!atype.is_long_array()) {
1082 verify_error(ErrorContext::bad_type(bci,
1083 current_frame.stack_top_ctx(), ref_ctx("[J", THREAD)),
1084 bad_type_msg, "lastore");
1085 return;
1086 }
1087 no_control_flow = false; break;
1088 case Bytecodes::_fastore :
1089 current_frame.pop_stack(
1090 VerificationType::float_type(), CHECK_VERIFY(this));
1091 current_frame.pop_stack
1092 (VerificationType::integer_type(), CHECK_VERIFY(this));
1093 atype = current_frame.pop_stack(
1094 VerificationType::reference_check(), CHECK_VERIFY(this));
1095 if (!atype.is_float_array()) {
1096 verify_error(ErrorContext::bad_type(bci,
1097 current_frame.stack_top_ctx(), ref_ctx("[F", THREAD)),
1098 bad_type_msg, "fastore");
1099 return;
1100 }
1101 no_control_flow = false; break;
1102 case Bytecodes::_dastore :
1103 current_frame.pop_stack_2(
1104 VerificationType::double2_type(),
1105 VerificationType::double_type(), CHECK_VERIFY(this));
1106 current_frame.pop_stack(
1107 VerificationType::integer_type(), CHECK_VERIFY(this));
1108 atype = current_frame.pop_stack(
1109 VerificationType::reference_check(), CHECK_VERIFY(this));
1110 if (!atype.is_double_array()) {
1111 verify_error(ErrorContext::bad_type(bci,
1112 current_frame.stack_top_ctx(), ref_ctx("[D", THREAD)),
1113 bad_type_msg, "dastore");
1114 return;
1115 }
1116 no_control_flow = false; break;
1117 case Bytecodes::_aastore :
1118 type = current_frame.pop_stack(object_type(), CHECK_VERIFY(this));
1119 type2 = current_frame.pop_stack(
1120 VerificationType::integer_type(), CHECK_VERIFY(this));
1121 atype = current_frame.pop_stack(
1122 VerificationType::reference_check(), CHECK_VERIFY(this));
1123 // more type-checking is done at runtime
1124 if (!atype.is_reference_array()) {
1125 verify_error(ErrorContext::bad_type(bci,
1126 current_frame.stack_top_ctx(),
1127 TypeOrigin::implicit(VerificationType::reference_check())),
1128 bad_type_msg, "aastore");
1129 return;
1130 }
1131 // 4938384: relaxed constraint in JVMS 3nd edition.
1132 no_control_flow = false; break;
1133 case Bytecodes::_pop :
1134 current_frame.pop_stack(
1135 VerificationType::category1_check(), CHECK_VERIFY(this));
1136 no_control_flow = false; break;
1137 case Bytecodes::_pop2 :
1138 type = current_frame.pop_stack(CHECK_VERIFY(this));
1139 if (type.is_category1()) {
1140 current_frame.pop_stack(
1141 VerificationType::category1_check(), CHECK_VERIFY(this));
1142 } else if (type.is_category2_2nd()) {
1143 current_frame.pop_stack(
1144 VerificationType::category2_check(), CHECK_VERIFY(this));
1145 } else {
1146 /* Unreachable? Would need a category2_1st on TOS
1147 * which does not appear possible. */
1148 verify_error(
1149 ErrorContext::bad_type(bci, current_frame.stack_top_ctx()),
1150 bad_type_msg, "pop2");
1151 return;
1152 }
1153 no_control_flow = false; break;
1154 case Bytecodes::_dup :
1155 type = current_frame.pop_stack(
1156 VerificationType::category1_check(), CHECK_VERIFY(this));
1157 current_frame.push_stack(type, CHECK_VERIFY(this));
1158 current_frame.push_stack(type, CHECK_VERIFY(this));
1159 no_control_flow = false; break;
1160 case Bytecodes::_dup_x1 :
1161 type = current_frame.pop_stack(
1162 VerificationType::category1_check(), CHECK_VERIFY(this));
1163 type2 = current_frame.pop_stack(
1164 VerificationType::category1_check(), CHECK_VERIFY(this));
1165 current_frame.push_stack(type, CHECK_VERIFY(this));
1166 current_frame.push_stack(type2, CHECK_VERIFY(this));
1167 current_frame.push_stack(type, CHECK_VERIFY(this));
1168 no_control_flow = false; break;
1169 case Bytecodes::_dup_x2 :
1170 {
1171 VerificationType type3;
1172 type = current_frame.pop_stack(
1173 VerificationType::category1_check(), CHECK_VERIFY(this));
1174 type2 = current_frame.pop_stack(CHECK_VERIFY(this));
1175 if (type2.is_category1()) {
1176 type3 = current_frame.pop_stack(
1177 VerificationType::category1_check(), CHECK_VERIFY(this));
1178 } else if (type2.is_category2_2nd()) {
1179 type3 = current_frame.pop_stack(
1180 VerificationType::category2_check(), CHECK_VERIFY(this));
1181 } else {
1182 /* Unreachable? Would need a category2_1st at stack depth 2 with
1183 * a category1 on TOS which does not appear possible. */
1184 verify_error(ErrorContext::bad_type(
1185 bci, current_frame.stack_top_ctx()), bad_type_msg, "dup_x2");
1186 return;
1187 }
1188 current_frame.push_stack(type, CHECK_VERIFY(this));
1189 current_frame.push_stack(type3, CHECK_VERIFY(this));
1190 current_frame.push_stack(type2, CHECK_VERIFY(this));
1191 current_frame.push_stack(type, CHECK_VERIFY(this));
1192 no_control_flow = false; break;
1193 }
1194 case Bytecodes::_dup2 :
1195 type = current_frame.pop_stack(CHECK_VERIFY(this));
1196 if (type.is_category1()) {
1197 type2 = current_frame.pop_stack(
1198 VerificationType::category1_check(), CHECK_VERIFY(this));
1199 } else if (type.is_category2_2nd()) {
1200 type2 = current_frame.pop_stack(
1201 VerificationType::category2_check(), CHECK_VERIFY(this));
1202 } else {
1203 /* Unreachable? Would need a category2_1st on TOS which does not
1204 * appear possible. */
1205 verify_error(
1206 ErrorContext::bad_type(bci, current_frame.stack_top_ctx()),
1207 bad_type_msg, "dup2");
1208 return;
1209 }
1210 current_frame.push_stack(type2, CHECK_VERIFY(this));
1211 current_frame.push_stack(type, CHECK_VERIFY(this));
1212 current_frame.push_stack(type2, CHECK_VERIFY(this));
1213 current_frame.push_stack(type, CHECK_VERIFY(this));
1214 no_control_flow = false; break;
1215 case Bytecodes::_dup2_x1 :
1216 {
1217 VerificationType type3;
1218 type = current_frame.pop_stack(CHECK_VERIFY(this));
1219 if (type.is_category1()) {
1220 type2 = current_frame.pop_stack(
1221 VerificationType::category1_check(), CHECK_VERIFY(this));
1222 } else if (type.is_category2_2nd()) {
1223 type2 = current_frame.pop_stack(
1224 VerificationType::category2_check(), CHECK_VERIFY(this));
1225 } else {
1226 /* Unreachable? Would need a category2_1st on TOS which does
1227 * not appear possible. */
1228 verify_error(
1229 ErrorContext::bad_type(bci, current_frame.stack_top_ctx()),
1230 bad_type_msg, "dup2_x1");
1231 return;
1232 }
1233 type3 = current_frame.pop_stack(
1234 VerificationType::category1_check(), CHECK_VERIFY(this));
1235 current_frame.push_stack(type2, CHECK_VERIFY(this));
1236 current_frame.push_stack(type, CHECK_VERIFY(this));
1237 current_frame.push_stack(type3, CHECK_VERIFY(this));
1238 current_frame.push_stack(type2, CHECK_VERIFY(this));
1239 current_frame.push_stack(type, CHECK_VERIFY(this));
1240 no_control_flow = false; break;
1241 }
1242 case Bytecodes::_dup2_x2 :
1243 {
1244 VerificationType type3, type4;
1245 type = current_frame.pop_stack(CHECK_VERIFY(this));
1246 if (type.is_category1()) {
1247 type2 = current_frame.pop_stack(
1248 VerificationType::category1_check(), CHECK_VERIFY(this));
1249 } else if (type.is_category2_2nd()) {
1250 type2 = current_frame.pop_stack(
1251 VerificationType::category2_check(), CHECK_VERIFY(this));
1252 } else {
1253 /* Unreachable? Would need a category2_1st on TOS which does
1254 * not appear possible. */
1255 verify_error(
1256 ErrorContext::bad_type(bci, current_frame.stack_top_ctx()),
1257 bad_type_msg, "dup2_x2");
1258 return;
1259 }
1260 type3 = current_frame.pop_stack(CHECK_VERIFY(this));
1261 if (type3.is_category1()) {
1262 type4 = current_frame.pop_stack(
1263 VerificationType::category1_check(), CHECK_VERIFY(this));
1264 } else if (type3.is_category2_2nd()) {
1265 type4 = current_frame.pop_stack(
1266 VerificationType::category2_check(), CHECK_VERIFY(this));
1267 } else {
1268 /* Unreachable? Would need a category2_1st on TOS after popping
1269 * a long/double or two category 1's, which does not
1270 * appear possible. */
1271 verify_error(
1272 ErrorContext::bad_type(bci, current_frame.stack_top_ctx()),
1273 bad_type_msg, "dup2_x2");
1274 return;
1275 }
1276 current_frame.push_stack(type2, CHECK_VERIFY(this));
1277 current_frame.push_stack(type, CHECK_VERIFY(this));
1278 current_frame.push_stack(type4, CHECK_VERIFY(this));
1279 current_frame.push_stack(type3, CHECK_VERIFY(this));
1280 current_frame.push_stack(type2, CHECK_VERIFY(this));
1281 current_frame.push_stack(type, CHECK_VERIFY(this));
1282 no_control_flow = false; break;
1283 }
1284 case Bytecodes::_swap :
1285 type = current_frame.pop_stack(
1286 VerificationType::category1_check(), CHECK_VERIFY(this));
1287 type2 = current_frame.pop_stack(
1288 VerificationType::category1_check(), CHECK_VERIFY(this));
1289 current_frame.push_stack(type, CHECK_VERIFY(this));
1290 current_frame.push_stack(type2, CHECK_VERIFY(this));
1291 no_control_flow = false; break;
1292 case Bytecodes::_iadd :
1293 case Bytecodes::_isub :
1294 case Bytecodes::_imul :
1295 case Bytecodes::_idiv :
1296 case Bytecodes::_irem :
1297 case Bytecodes::_ishl :
1298 case Bytecodes::_ishr :
1299 case Bytecodes::_iushr :
1300 case Bytecodes::_ior :
1301 case Bytecodes::_ixor :
1302 case Bytecodes::_iand :
1303 current_frame.pop_stack(
1304 VerificationType::integer_type(), CHECK_VERIFY(this));
1305 // fall through
1306 case Bytecodes::_ineg :
1307 current_frame.pop_stack(
1308 VerificationType::integer_type(), CHECK_VERIFY(this));
1309 current_frame.push_stack(
1310 VerificationType::integer_type(), CHECK_VERIFY(this));
1311 no_control_flow = false; break;
1312 case Bytecodes::_ladd :
1313 case Bytecodes::_lsub :
1314 case Bytecodes::_lmul :
1315 case Bytecodes::_ldiv :
1316 case Bytecodes::_lrem :
1317 case Bytecodes::_land :
1318 case Bytecodes::_lor :
1319 case Bytecodes::_lxor :
1320 current_frame.pop_stack_2(
1321 VerificationType::long2_type(),
1322 VerificationType::long_type(), CHECK_VERIFY(this));
1323 // fall through
1324 case Bytecodes::_lneg :
1325 current_frame.pop_stack_2(
1326 VerificationType::long2_type(),
1327 VerificationType::long_type(), CHECK_VERIFY(this));
1328 current_frame.push_stack_2(
1329 VerificationType::long_type(),
1330 VerificationType::long2_type(), CHECK_VERIFY(this));
1331 no_control_flow = false; break;
1332 case Bytecodes::_lshl :
1333 case Bytecodes::_lshr :
1334 case Bytecodes::_lushr :
1335 current_frame.pop_stack(
1336 VerificationType::integer_type(), CHECK_VERIFY(this));
1337 current_frame.pop_stack_2(
1338 VerificationType::long2_type(),
1339 VerificationType::long_type(), CHECK_VERIFY(this));
1340 current_frame.push_stack_2(
1341 VerificationType::long_type(),
1342 VerificationType::long2_type(), CHECK_VERIFY(this));
1343 no_control_flow = false; break;
1344 case Bytecodes::_fadd :
1345 case Bytecodes::_fsub :
1346 case Bytecodes::_fmul :
1347 case Bytecodes::_fdiv :
1348 case Bytecodes::_frem :
1349 current_frame.pop_stack(
1350 VerificationType::float_type(), CHECK_VERIFY(this));
1351 // fall through
1352 case Bytecodes::_fneg :
1353 current_frame.pop_stack(
1354 VerificationType::float_type(), CHECK_VERIFY(this));
1355 current_frame.push_stack(
1356 VerificationType::float_type(), CHECK_VERIFY(this));
1357 no_control_flow = false; break;
1358 case Bytecodes::_dadd :
1359 case Bytecodes::_dsub :
1360 case Bytecodes::_dmul :
1361 case Bytecodes::_ddiv :
1362 case Bytecodes::_drem :
1363 current_frame.pop_stack_2(
1364 VerificationType::double2_type(),
1365 VerificationType::double_type(), CHECK_VERIFY(this));
1366 // fall through
1367 case Bytecodes::_dneg :
1368 current_frame.pop_stack_2(
1369 VerificationType::double2_type(),
1370 VerificationType::double_type(), CHECK_VERIFY(this));
1371 current_frame.push_stack_2(
1372 VerificationType::double_type(),
1373 VerificationType::double2_type(), CHECK_VERIFY(this));
1374 no_control_flow = false; break;
1375 case Bytecodes::_iinc :
1376 verify_iinc(bcs.get_index(), ¤t_frame, CHECK_VERIFY(this));
1377 no_control_flow = false; break;
1378 case Bytecodes::_i2l :
1379 type = current_frame.pop_stack(
1380 VerificationType::integer_type(), CHECK_VERIFY(this));
1381 current_frame.push_stack_2(
1382 VerificationType::long_type(),
1383 VerificationType::long2_type(), CHECK_VERIFY(this));
1384 no_control_flow = false; break;
1385 case Bytecodes::_l2i :
1386 current_frame.pop_stack_2(
1387 VerificationType::long2_type(),
1388 VerificationType::long_type(), CHECK_VERIFY(this));
1389 current_frame.push_stack(
1390 VerificationType::integer_type(), CHECK_VERIFY(this));
1391 no_control_flow = false; break;
1392 case Bytecodes::_i2f :
1393 current_frame.pop_stack(
1394 VerificationType::integer_type(), CHECK_VERIFY(this));
1395 current_frame.push_stack(
1396 VerificationType::float_type(), CHECK_VERIFY(this));
1397 no_control_flow = false; break;
1398 case Bytecodes::_i2d :
1399 current_frame.pop_stack(
1400 VerificationType::integer_type(), CHECK_VERIFY(this));
1401 current_frame.push_stack_2(
1402 VerificationType::double_type(),
1403 VerificationType::double2_type(), CHECK_VERIFY(this));
1404 no_control_flow = false; break;
1405 case Bytecodes::_l2f :
1406 current_frame.pop_stack_2(
1407 VerificationType::long2_type(),
1408 VerificationType::long_type(), CHECK_VERIFY(this));
1409 current_frame.push_stack(
1410 VerificationType::float_type(), CHECK_VERIFY(this));
1411 no_control_flow = false; break;
1412 case Bytecodes::_l2d :
1413 current_frame.pop_stack_2(
1414 VerificationType::long2_type(),
1415 VerificationType::long_type(), CHECK_VERIFY(this));
1416 current_frame.push_stack_2(
1417 VerificationType::double_type(),
1418 VerificationType::double2_type(), CHECK_VERIFY(this));
1419 no_control_flow = false; break;
1420 case Bytecodes::_f2i :
1421 current_frame.pop_stack(
1422 VerificationType::float_type(), CHECK_VERIFY(this));
1423 current_frame.push_stack(
1424 VerificationType::integer_type(), CHECK_VERIFY(this));
1425 no_control_flow = false; break;
1426 case Bytecodes::_f2l :
1427 current_frame.pop_stack(
1428 VerificationType::float_type(), CHECK_VERIFY(this));
1429 current_frame.push_stack_2(
1430 VerificationType::long_type(),
1431 VerificationType::long2_type(), CHECK_VERIFY(this));
1432 no_control_flow = false; break;
1433 case Bytecodes::_f2d :
1434 current_frame.pop_stack(
1435 VerificationType::float_type(), CHECK_VERIFY(this));
1436 current_frame.push_stack_2(
1437 VerificationType::double_type(),
1438 VerificationType::double2_type(), CHECK_VERIFY(this));
1439 no_control_flow = false; break;
1440 case Bytecodes::_d2i :
1441 current_frame.pop_stack_2(
1442 VerificationType::double2_type(),
1443 VerificationType::double_type(), CHECK_VERIFY(this));
1444 current_frame.push_stack(
1445 VerificationType::integer_type(), CHECK_VERIFY(this));
1446 no_control_flow = false; break;
1447 case Bytecodes::_d2l :
1448 current_frame.pop_stack_2(
1449 VerificationType::double2_type(),
1450 VerificationType::double_type(), CHECK_VERIFY(this));
1451 current_frame.push_stack_2(
1452 VerificationType::long_type(),
1453 VerificationType::long2_type(), CHECK_VERIFY(this));
1454 no_control_flow = false; break;
1455 case Bytecodes::_d2f :
1456 current_frame.pop_stack_2(
1457 VerificationType::double2_type(),
1458 VerificationType::double_type(), CHECK_VERIFY(this));
1459 current_frame.push_stack(
1460 VerificationType::float_type(), CHECK_VERIFY(this));
1461 no_control_flow = false; break;
1462 case Bytecodes::_i2b :
1463 case Bytecodes::_i2c :
1464 case Bytecodes::_i2s :
1465 current_frame.pop_stack(
1466 VerificationType::integer_type(), CHECK_VERIFY(this));
1467 current_frame.push_stack(
1468 VerificationType::integer_type(), CHECK_VERIFY(this));
1469 no_control_flow = false; break;
1470 case Bytecodes::_lcmp :
1471 current_frame.pop_stack_2(
1472 VerificationType::long2_type(),
1473 VerificationType::long_type(), CHECK_VERIFY(this));
1474 current_frame.pop_stack_2(
1475 VerificationType::long2_type(),
1476 VerificationType::long_type(), CHECK_VERIFY(this));
1477 current_frame.push_stack(
1478 VerificationType::integer_type(), CHECK_VERIFY(this));
1479 no_control_flow = false; break;
1480 case Bytecodes::_fcmpl :
1481 case Bytecodes::_fcmpg :
1482 current_frame.pop_stack(
1483 VerificationType::float_type(), CHECK_VERIFY(this));
1484 current_frame.pop_stack(
1485 VerificationType::float_type(), CHECK_VERIFY(this));
1486 current_frame.push_stack(
1487 VerificationType::integer_type(), CHECK_VERIFY(this));
1488 no_control_flow = false; break;
1489 case Bytecodes::_dcmpl :
1490 case Bytecodes::_dcmpg :
1491 current_frame.pop_stack_2(
1492 VerificationType::double2_type(),
1493 VerificationType::double_type(), CHECK_VERIFY(this));
1494 current_frame.pop_stack_2(
1495 VerificationType::double2_type(),
1496 VerificationType::double_type(), CHECK_VERIFY(this));
1497 current_frame.push_stack(
1498 VerificationType::integer_type(), CHECK_VERIFY(this));
1499 no_control_flow = false; break;
1500 case Bytecodes::_if_icmpeq:
1501 case Bytecodes::_if_icmpne:
1502 case Bytecodes::_if_icmplt:
1503 case Bytecodes::_if_icmpge:
1504 case Bytecodes::_if_icmpgt:
1505 case Bytecodes::_if_icmple:
1506 current_frame.pop_stack(
1507 VerificationType::integer_type(), CHECK_VERIFY(this));
1508 // fall through
1509 case Bytecodes::_ifeq:
1510 case Bytecodes::_ifne:
1511 case Bytecodes::_iflt:
1512 case Bytecodes::_ifge:
1513 case Bytecodes::_ifgt:
1514 case Bytecodes::_ifle:
1515 current_frame.pop_stack(
1516 VerificationType::integer_type(), CHECK_VERIFY(this));
1517 target = bcs.dest();
1518 stackmap_table.check_jump_target(
1519 ¤t_frame, target, CHECK_VERIFY(this));
1520 no_control_flow = false; break;
1521 case Bytecodes::_if_acmpeq :
1522 case Bytecodes::_if_acmpne :
1523 current_frame.pop_stack(
1524 VerificationType::reference_check(), CHECK_VERIFY(this));
1525 // fall through
1526 case Bytecodes::_ifnull :
1527 case Bytecodes::_ifnonnull :
1528 current_frame.pop_stack(
1529 VerificationType::reference_check(), CHECK_VERIFY(this));
1530 target = bcs.dest();
1531 stackmap_table.check_jump_target
1532 (¤t_frame, target, CHECK_VERIFY(this));
1533 no_control_flow = false; break;
1534 case Bytecodes::_goto :
1535 target = bcs.dest();
1536 stackmap_table.check_jump_target(
1537 ¤t_frame, target, CHECK_VERIFY(this));
1538 no_control_flow = true; break;
1539 case Bytecodes::_goto_w :
1540 target = bcs.dest_w();
1541 stackmap_table.check_jump_target(
1542 ¤t_frame, target, CHECK_VERIFY(this));
1543 no_control_flow = true; break;
1544 case Bytecodes::_tableswitch :
1545 case Bytecodes::_lookupswitch :
1546 verify_switch(
1547 &bcs, code_length, code_data, ¤t_frame,
1548 &stackmap_table, CHECK_VERIFY(this));
1549 no_control_flow = true; break;
1550 case Bytecodes::_ireturn :
1551 type = current_frame.pop_stack(
1552 VerificationType::integer_type(), CHECK_VERIFY(this));
1553 verify_return_value(return_type, type, bci,
1554 ¤t_frame, CHECK_VERIFY(this));
1555 no_control_flow = true; break;
1556 case Bytecodes::_lreturn :
1557 type2 = current_frame.pop_stack(
1558 VerificationType::long2_type(), CHECK_VERIFY(this));
1559 type = current_frame.pop_stack(
1560 VerificationType::long_type(), CHECK_VERIFY(this));
1561 verify_return_value(return_type, type, bci,
1562 ¤t_frame, CHECK_VERIFY(this));
1563 no_control_flow = true; break;
1564 case Bytecodes::_freturn :
1565 type = current_frame.pop_stack(
1566 VerificationType::float_type(), CHECK_VERIFY(this));
1567 verify_return_value(return_type, type, bci,
1568 ¤t_frame, CHECK_VERIFY(this));
1569 no_control_flow = true; break;
1570 case Bytecodes::_dreturn :
1571 type2 = current_frame.pop_stack(
1572 VerificationType::double2_type(), CHECK_VERIFY(this));
1573 type = current_frame.pop_stack(
1574 VerificationType::double_type(), CHECK_VERIFY(this));
1575 verify_return_value(return_type, type, bci,
1576 ¤t_frame, CHECK_VERIFY(this));
1577 no_control_flow = true; break;
1578 case Bytecodes::_areturn :
1579 type = current_frame.pop_stack(
1580 VerificationType::reference_check(), CHECK_VERIFY(this));
1581 verify_return_value(return_type, type, bci,
1582 ¤t_frame, CHECK_VERIFY(this));
1583 no_control_flow = true; break;
1584 case Bytecodes::_return :
1585 if (return_type != VerificationType::bogus_type()) {
1586 verify_error(ErrorContext::bad_code(bci),
1587 "Method expects a return value");
1588 return;
1589 }
1590 // Make sure "this" has been initialized if current method is an
1591 // <init>.
1592 if (_method->name() == vmSymbols::object_initializer_name() &&
1593 current_frame.flag_this_uninit()) {
1594 verify_error(ErrorContext::bad_code(bci),
1595 "Constructor must call super() or this() "
1596 "before return");
1597 return;
1598 }
1599 no_control_flow = true; break;
1600 case Bytecodes::_getstatic :
1601 case Bytecodes::_putstatic :
1602 // pass TRUE, operand can be an array type for getstatic/putstatic.
1603 verify_field_instructions(
1604 &bcs, ¤t_frame, cp, true, CHECK_VERIFY(this));
1605 no_control_flow = false; break;
1606 case Bytecodes::_getfield :
1607 case Bytecodes::_putfield :
1608 // pass FALSE, operand can't be an array type for getfield/putfield.
1609 verify_field_instructions(
1610 &bcs, ¤t_frame, cp, false, CHECK_VERIFY(this));
1611 no_control_flow = false; break;
1612 case Bytecodes::_invokevirtual :
1613 case Bytecodes::_invokespecial :
1614 case Bytecodes::_invokestatic :
1615 verify_invoke_instructions(
1616 &bcs, code_length, ¤t_frame, (bci >= ex_min && bci < ex_max),
1617 &this_uninit, return_type, cp, &stackmap_table, CHECK_VERIFY(this));
1618 no_control_flow = false; break;
1619 case Bytecodes::_invokeinterface :
1620 case Bytecodes::_invokedynamic :
1621 verify_invoke_instructions(
1622 &bcs, code_length, ¤t_frame, (bci >= ex_min && bci < ex_max),
1623 &this_uninit, return_type, cp, &stackmap_table, CHECK_VERIFY(this));
1624 no_control_flow = false; break;
1625 case Bytecodes::_new :
1626 {
1627 index = bcs.get_index_u2();
1628 verify_cp_class_type(bci, index, cp, CHECK_VERIFY(this));
1629 VerificationType new_class_type =
1630 cp_index_to_type(index, cp, CHECK_VERIFY(this));
1631 if (!new_class_type.is_object()) {
1632 verify_error(ErrorContext::bad_type(bci,
1633 TypeOrigin::cp(index, new_class_type)),
1634 "Illegal new instruction");
1635 return;
1636 }
1637 type = VerificationType::uninitialized_type(bci);
1638 current_frame.push_stack(type, CHECK_VERIFY(this));
1639 no_control_flow = false; break;
1640 }
1641 case Bytecodes::_newarray :
1642 type = get_newarray_type(bcs.get_index(), bci, CHECK_VERIFY(this));
1643 current_frame.pop_stack(
1644 VerificationType::integer_type(), CHECK_VERIFY(this));
1645 current_frame.push_stack(type, CHECK_VERIFY(this));
1646 no_control_flow = false; break;
1647 case Bytecodes::_anewarray :
1648 verify_anewarray(
1649 bci, bcs.get_index_u2(), cp, ¤t_frame, CHECK_VERIFY(this));
1650 no_control_flow = false; break;
1651 case Bytecodes::_arraylength :
1652 type = current_frame.pop_stack(
1653 VerificationType::reference_check(), CHECK_VERIFY(this));
1654 if (!(type.is_null() || type.is_array())) {
1655 verify_error(ErrorContext::bad_type(
1656 bci, current_frame.stack_top_ctx()),
1657 bad_type_msg, "arraylength");
1658 }
1659 current_frame.push_stack(
1660 VerificationType::integer_type(), CHECK_VERIFY(this));
1661 no_control_flow = false; break;
1662 case Bytecodes::_checkcast :
1663 {
1664 index = bcs.get_index_u2();
1665 verify_cp_class_type(bci, index, cp, CHECK_VERIFY(this));
1666 current_frame.pop_stack(object_type(), CHECK_VERIFY(this));
1667 VerificationType klass_type = cp_index_to_type(
1668 index, cp, CHECK_VERIFY(this));
1669 current_frame.push_stack(klass_type, CHECK_VERIFY(this));
1670 no_control_flow = false; break;
1671 }
1672 case Bytecodes::_instanceof : {
1673 index = bcs.get_index_u2();
1674 verify_cp_class_type(bci, index, cp, CHECK_VERIFY(this));
1675 current_frame.pop_stack(object_type(), CHECK_VERIFY(this));
1676 current_frame.push_stack(
1677 VerificationType::integer_type(), CHECK_VERIFY(this));
1678 no_control_flow = false; break;
1679 }
1680 case Bytecodes::_monitorenter :
1681 case Bytecodes::_monitorexit :
1682 current_frame.pop_stack(
1683 VerificationType::reference_check(), CHECK_VERIFY(this));
1684 no_control_flow = false; break;
1685 case Bytecodes::_multianewarray :
1686 {
1687 index = bcs.get_index_u2();
1688 u2 dim = *(bcs.bcp()+3);
1689 verify_cp_class_type(bci, index, cp, CHECK_VERIFY(this));
1690 VerificationType new_array_type =
1691 cp_index_to_type(index, cp, CHECK_VERIFY(this));
1692 if (!new_array_type.is_array()) {
1693 verify_error(ErrorContext::bad_type(bci,
1694 TypeOrigin::cp(index, new_array_type)),
1695 "Illegal constant pool index in multianewarray instruction");
1696 return;
1697 }
1698 if (dim < 1 || new_array_type.dimensions() < dim) {
1699 verify_error(ErrorContext::bad_code(bci),
1700 "Illegal dimension in multianewarray instruction: %d", dim);
1701 return;
1702 }
1703 for (int i = 0; i < dim; i++) {
1704 current_frame.pop_stack(
1705 VerificationType::integer_type(), CHECK_VERIFY(this));
1706 }
1707 current_frame.push_stack(new_array_type, CHECK_VERIFY(this));
1708 no_control_flow = false; break;
1709 }
1710 case Bytecodes::_athrow :
1711 type = VerificationType::reference_type(
1712 vmSymbols::java_lang_Throwable());
1713 current_frame.pop_stack(type, CHECK_VERIFY(this));
1714 no_control_flow = true; break;
1715 default:
1716 // We only need to check the valid bytecodes in class file.
1717 // And jsr and ret are not in the new class file format in JDK1.5.
1718 verify_error(ErrorContext::bad_code(bci),
1719 "Bad instruction: %02x", opcode);
1720 no_control_flow = false;
1721 return;
1722 } // end switch
1723 } // end Merge with the next instruction
1724
1725 // Look for possible jump target in exception handlers and see if it matches
1726 // current_frame. Don't do this check if it has already been done (for
1727 // ([a,d,f,i,l]store* opcodes). This check cannot be done earlier because
1728 // opcodes, such as invokespecial, may set the this_uninit flag.
1729 assert(!(verified_exc_handlers && this_uninit),
1730 "Exception handler targets got verified before this_uninit got set");
1731 if (!verified_exc_handlers && bci >= ex_min && bci < ex_max) {
1732 if (was_recursively_verified()) return;
1733 verify_exception_handler_targets(
1734 bci, this_uninit, ¤t_frame, &stackmap_table, CHECK_VERIFY(this));
1735 }
1736 } // end while
1737
1738 // Make sure that control flow does not fall through end of the method
1739 if (!no_control_flow) {
1740 verify_error(ErrorContext::bad_code(code_length),
1741 "Control flow falls through code end");
1742 return;
1743 }
1744 }
1745
1746 #undef bad_type_message
1747
1748 char* ClassVerifier::generate_code_data(const methodHandle& m, u4 code_length, TRAPS) {
1749 char* code_data = NEW_RESOURCE_ARRAY(char, code_length);
1750 memset(code_data, 0, sizeof(char) * code_length);
1751 RawBytecodeStream bcs(m);
1752
1753 while (!bcs.is_last_bytecode()) {
1754 if (bcs.raw_next() != Bytecodes::_illegal) {
1755 int bci = bcs.bci();
1756 if (bcs.raw_code() == Bytecodes::_new) {
1757 code_data[bci] = NEW_OFFSET;
1758 } else {
1759 code_data[bci] = BYTECODE_OFFSET;
1760 }
1761 } else {
1762 verify_error(ErrorContext::bad_code(bcs.bci()), "Bad instruction");
1763 return NULL;
1764 }
1765 }
1766
1767 return code_data;
1768 }
1769
1770 // Since this method references the constant pool, call was_recursively_verified()
1771 // before calling this method to make sure a prior class load did not cause the
1772 // current class to get verified.
1773 void ClassVerifier::verify_exception_handler_table(u4 code_length, char* code_data, int& min, int& max, TRAPS) {
1774 ExceptionTable exhandlers(_method());
1775 int exlength = exhandlers.length();
1776 constantPoolHandle cp (THREAD, _method->constants());
1777
1778 for(int i = 0; i < exlength; i++) {
1779 u2 start_pc = exhandlers.start_pc(i);
1780 u2 end_pc = exhandlers.end_pc(i);
1781 u2 handler_pc = exhandlers.handler_pc(i);
1782 if (start_pc >= code_length || code_data[start_pc] == 0) {
1783 class_format_error("Illegal exception table start_pc %d", start_pc);
1784 return;
1785 }
1786 if (end_pc != code_length) { // special case: end_pc == code_length
1787 if (end_pc > code_length || code_data[end_pc] == 0) {
1788 class_format_error("Illegal exception table end_pc %d", end_pc);
1789 return;
1790 }
1791 }
1792 if (handler_pc >= code_length || code_data[handler_pc] == 0) {
1793 class_format_error("Illegal exception table handler_pc %d", handler_pc);
1794 return;
1795 }
1796 int catch_type_index = exhandlers.catch_type_index(i);
1797 if (catch_type_index != 0) {
1798 VerificationType catch_type = cp_index_to_type(
1799 catch_type_index, cp, CHECK_VERIFY(this));
1800 VerificationType throwable =
1801 VerificationType::reference_type(vmSymbols::java_lang_Throwable());
1802 bool is_subclass = throwable.is_assignable_from(
1803 catch_type, this, false, CHECK_VERIFY(this));
1804 if (!is_subclass) {
1805 // 4286534: should throw VerifyError according to recent spec change
1806 verify_error(ErrorContext::bad_type(handler_pc,
1807 TypeOrigin::cp(catch_type_index, catch_type),
1808 TypeOrigin::implicit(throwable)),
1809 "Catch type is not a subclass "
1810 "of Throwable in exception handler %d", handler_pc);
1811 return;
1812 }
1813 }
1814 if (start_pc < min) min = start_pc;
1815 if (end_pc > max) max = end_pc;
1816 }
1817 }
1818
1819 void ClassVerifier::verify_local_variable_table(u4 code_length, char* code_data, TRAPS) {
1820 int localvariable_table_length = _method->localvariable_table_length();
1821 if (localvariable_table_length > 0) {
1822 LocalVariableTableElement* table = _method->localvariable_table_start();
1823 for (int i = 0; i < localvariable_table_length; i++) {
1824 u2 start_bci = table[i].start_bci;
1825 u2 length = table[i].length;
1826
1827 if (start_bci >= code_length || code_data[start_bci] == 0) {
1828 class_format_error(
1829 "Illegal local variable table start_pc %d", start_bci);
1830 return;
1831 }
1832 u4 end_bci = (u4)(start_bci + length);
1833 if (end_bci != code_length) {
1834 if (end_bci >= code_length || code_data[end_bci] == 0) {
1835 class_format_error( "Illegal local variable table length %d", length);
1836 return;
1837 }
1838 }
1839 }
1840 }
1841 }
1842
1843 u2 ClassVerifier::verify_stackmap_table(u2 stackmap_index, u2 bci,
1844 StackMapFrame* current_frame,
1845 StackMapTable* stackmap_table,
1846 bool no_control_flow, TRAPS) {
1847 if (stackmap_index < stackmap_table->get_frame_count()) {
1848 u2 this_offset = stackmap_table->get_offset(stackmap_index);
1849 if (no_control_flow && this_offset > bci) {
1850 verify_error(ErrorContext::missing_stackmap(bci),
1851 "Expecting a stack map frame");
1852 return 0;
1853 }
1854 if (this_offset == bci) {
1855 ErrorContext ctx;
1856 // See if current stack map can be assigned to the frame in table.
1857 // current_frame is the stackmap frame got from the last instruction.
1858 // If matched, current_frame will be updated by this method.
1859 bool matches = stackmap_table->match_stackmap(
1860 current_frame, this_offset, stackmap_index,
1861 !no_control_flow, true, &ctx, CHECK_VERIFY_(this, 0));
1862 if (!matches) {
1863 // report type error
1864 verify_error(ctx, "Instruction type does not match stack map");
1865 return 0;
1866 }
1867 stackmap_index++;
1868 } else if (this_offset < bci) {
1869 // current_offset should have met this_offset.
1870 class_format_error("Bad stack map offset %d", this_offset);
1871 return 0;
1872 }
1873 } else if (no_control_flow) {
1874 verify_error(ErrorContext::bad_code(bci), "Expecting a stack map frame");
1875 return 0;
1876 }
1877 return stackmap_index;
1878 }
1879
1880 // Since this method references the constant pool, call was_recursively_verified()
1881 // before calling this method to make sure a prior class load did not cause the
1882 // current class to get verified.
1883 void ClassVerifier::verify_exception_handler_targets(u2 bci, bool this_uninit,
1884 StackMapFrame* current_frame,
1885 StackMapTable* stackmap_table, TRAPS) {
1886 constantPoolHandle cp (THREAD, _method->constants());
1887 ExceptionTable exhandlers(_method());
1888 int exlength = exhandlers.length();
1889 for(int i = 0; i < exlength; i++) {
1890 u2 start_pc = exhandlers.start_pc(i);
1891 u2 end_pc = exhandlers.end_pc(i);
1892 u2 handler_pc = exhandlers.handler_pc(i);
1893 int catch_type_index = exhandlers.catch_type_index(i);
1894 if(bci >= start_pc && bci < end_pc) {
1895 u1 flags = current_frame->flags();
1896 if (this_uninit) { flags |= FLAG_THIS_UNINIT; }
1897 StackMapFrame* new_frame = current_frame->frame_in_exception_handler(flags);
1898 if (catch_type_index != 0) {
1899 if (was_recursively_verified()) return;
1900 // We know that this index refers to a subclass of Throwable
1901 VerificationType catch_type = cp_index_to_type(
1902 catch_type_index, cp, CHECK_VERIFY(this));
1903 new_frame->push_stack(catch_type, CHECK_VERIFY(this));
1904 } else {
1905 VerificationType throwable =
1906 VerificationType::reference_type(vmSymbols::java_lang_Throwable());
1907 new_frame->push_stack(throwable, CHECK_VERIFY(this));
1908 }
1909 ErrorContext ctx;
1910 bool matches = stackmap_table->match_stackmap(
1911 new_frame, handler_pc, true, false, &ctx, CHECK_VERIFY(this));
1912 if (!matches) {
1913 verify_error(ctx, "Stack map does not match the one at "
1914 "exception handler %d", handler_pc);
1915 return;
1916 }
1917 }
1918 }
1919 }
1920
1921 void ClassVerifier::verify_cp_index(
1922 u2 bci, const constantPoolHandle& cp, int index, TRAPS) {
1923 int nconstants = cp->length();
1924 if ((index <= 0) || (index >= nconstants)) {
1925 verify_error(ErrorContext::bad_cp_index(bci, index),
1926 "Illegal constant pool index %d in class %s",
1927 index, cp->pool_holder()->external_name());
1928 return;
1929 }
1930 }
1931
1932 void ClassVerifier::verify_cp_type(
1933 u2 bci, int index, const constantPoolHandle& cp, unsigned int types, TRAPS) {
1934
1935 // In some situations, bytecode rewriting may occur while we're verifying.
1936 // In this case, a constant pool cache exists and some indices refer to that
1937 // instead. Be sure we don't pick up such indices by accident.
1938 // We must check was_recursively_verified() before we get here.
1939 guarantee(cp->cache() == NULL, "not rewritten yet");
1940
1941 verify_cp_index(bci, cp, index, CHECK_VERIFY(this));
1942 unsigned int tag = cp->tag_at(index).value();
1943 if ((types & (1 << tag)) == 0) {
1944 verify_error(ErrorContext::bad_cp_index(bci, index),
1945 "Illegal type at constant pool entry %d in class %s",
1946 index, cp->pool_holder()->external_name());
1947 return;
1948 }
1949 }
1950
1951 void ClassVerifier::verify_cp_class_type(
1952 u2 bci, int index, const constantPoolHandle& cp, TRAPS) {
1953 verify_cp_index(bci, cp, index, CHECK_VERIFY(this));
1954 constantTag tag = cp->tag_at(index);
1955 if (!tag.is_klass() && !tag.is_unresolved_klass()) {
1956 verify_error(ErrorContext::bad_cp_index(bci, index),
1957 "Illegal type at constant pool entry %d in class %s",
1958 index, cp->pool_holder()->external_name());
1959 return;
1960 }
1961 }
1962
1963 void ClassVerifier::verify_error(ErrorContext ctx, const char* msg, ...) {
1964 stringStream ss;
1965
1966 ctx.reset_frames();
1967 _exception_type = vmSymbols::java_lang_VerifyError();
1968 _error_context = ctx;
1969 va_list va;
1970 va_start(va, msg);
1971 ss.vprint(msg, va);
1972 va_end(va);
1973 _message = ss.as_string();
1974 #ifdef ASSERT
1975 ResourceMark rm;
1976 const char* exception_name = _exception_type->as_C_string();
1977 Exceptions::debug_check_abort(exception_name, NULL);
1978 #endif // ndef ASSERT
1979 }
1980
1981 void ClassVerifier::class_format_error(const char* msg, ...) {
1982 stringStream ss;
1983 _exception_type = vmSymbols::java_lang_ClassFormatError();
1984 va_list va;
1985 va_start(va, msg);
1986 ss.vprint(msg, va);
1987 va_end(va);
1988 if (!_method.is_null()) {
1989 ss.print(" in method %s", _method->name_and_sig_as_C_string());
1990 }
1991 _message = ss.as_string();
1992 }
1993
1994 Klass* ClassVerifier::load_class(Symbol* name, TRAPS) {
1995 HandleMark hm(THREAD);
1996 // Get current loader and protection domain first.
1997 oop loader = current_class()->class_loader();
1998 oop protection_domain = current_class()->protection_domain();
1999
2000 Klass* kls = SystemDictionary::resolve_or_fail(
2001 name, Handle(THREAD, loader), Handle(THREAD, protection_domain),
2002 true, THREAD);
2003
2004 if (log_is_enabled(Debug, class, resolve)) {
2005 InstanceKlass* cur_class = InstanceKlass::cast(current_class());
2006 Verifier::trace_class_resolution(kls, cur_class);
2007 }
2008 return kls;
2009 }
2010
2011 bool ClassVerifier::is_protected_access(InstanceKlass* this_class,
2012 Klass* target_class,
2013 Symbol* field_name,
2014 Symbol* field_sig,
2015 bool is_method) {
2016 NoSafepointVerifier nosafepoint;
2017
2018 // If target class isn't a super class of this class, we don't worry about this case
2019 if (!this_class->is_subclass_of(target_class)) {
2020 return false;
2021 }
2022 // Check if the specified method or field is protected
2023 InstanceKlass* target_instance = InstanceKlass::cast(target_class);
2024 fieldDescriptor fd;
2025 if (is_method) {
2026 Method* m = target_instance->uncached_lookup_method(field_name, field_sig, Klass::find_overpass);
2027 if (m != NULL && m->is_protected()) {
2028 if (!this_class->is_same_class_package(m->method_holder())) {
2029 return true;
2030 }
2031 }
2032 } else {
2033 Klass* member_klass = target_instance->find_field(field_name, field_sig, &fd);
2034 if (member_klass != NULL && fd.is_protected()) {
2035 if (!this_class->is_same_class_package(member_klass)) {
2036 return true;
2037 }
2038 }
2039 }
2040 return false;
2041 }
2042
2043 void ClassVerifier::verify_ldc(
2044 int opcode, u2 index, StackMapFrame* current_frame,
2045 const constantPoolHandle& cp, u2 bci, TRAPS) {
2046 verify_cp_index(bci, cp, index, CHECK_VERIFY(this));
2047 constantTag tag = cp->tag_at(index);
2048 unsigned int types;
2049 if (opcode == Bytecodes::_ldc || opcode == Bytecodes::_ldc_w) {
2050 if (!tag.is_unresolved_klass()) {
2051 types = (1 << JVM_CONSTANT_Integer) | (1 << JVM_CONSTANT_Float)
2052 | (1 << JVM_CONSTANT_String) | (1 << JVM_CONSTANT_Class)
2053 | (1 << JVM_CONSTANT_MethodHandle) | (1 << JVM_CONSTANT_MethodType);
2054 // Note: The class file parser already verified the legality of
2055 // MethodHandle and MethodType constants.
2056 verify_cp_type(bci, index, cp, types, CHECK_VERIFY(this));
2057 }
2058 } else {
2059 assert(opcode == Bytecodes::_ldc2_w, "must be ldc2_w");
2060 types = (1 << JVM_CONSTANT_Double) | (1 << JVM_CONSTANT_Long);
2061 verify_cp_type(bci, index, cp, types, CHECK_VERIFY(this));
2062 }
2063 if (tag.is_string() && cp->is_pseudo_string_at(index)) {
2064 current_frame->push_stack(object_type(), CHECK_VERIFY(this));
2065 } else if (tag.is_string()) {
2066 current_frame->push_stack(
2067 VerificationType::reference_type(
2068 vmSymbols::java_lang_String()), CHECK_VERIFY(this));
2069 } else if (tag.is_klass() || tag.is_unresolved_klass()) {
2070 current_frame->push_stack(
2071 VerificationType::reference_type(
2072 vmSymbols::java_lang_Class()), CHECK_VERIFY(this));
2073 } else if (tag.is_int()) {
2074 current_frame->push_stack(
2075 VerificationType::integer_type(), CHECK_VERIFY(this));
2076 } else if (tag.is_float()) {
2077 current_frame->push_stack(
2078 VerificationType::float_type(), CHECK_VERIFY(this));
2079 } else if (tag.is_double()) {
2080 current_frame->push_stack_2(
2081 VerificationType::double_type(),
2082 VerificationType::double2_type(), CHECK_VERIFY(this));
2083 } else if (tag.is_long()) {
2084 current_frame->push_stack_2(
2085 VerificationType::long_type(),
2086 VerificationType::long2_type(), CHECK_VERIFY(this));
2087 } else if (tag.is_method_handle()) {
2088 current_frame->push_stack(
2089 VerificationType::reference_type(
2090 vmSymbols::java_lang_invoke_MethodHandle()), CHECK_VERIFY(this));
2091 } else if (tag.is_method_type()) {
2092 current_frame->push_stack(
2093 VerificationType::reference_type(
2094 vmSymbols::java_lang_invoke_MethodType()), CHECK_VERIFY(this));
2095 } else {
2096 /* Unreachable? verify_cp_type has already validated the cp type. */
2097 verify_error(
2098 ErrorContext::bad_cp_index(bci, index), "Invalid index in ldc");
2099 return;
2100 }
2101 }
2102
2103 void ClassVerifier::verify_switch(
2104 RawBytecodeStream* bcs, u4 code_length, char* code_data,
2105 StackMapFrame* current_frame, StackMapTable* stackmap_table, TRAPS) {
2106 int bci = bcs->bci();
2107 address bcp = bcs->bcp();
2108 address aligned_bcp = (address) round_to((intptr_t)(bcp + 1), jintSize);
2109
2110 if (_klass->major_version() < NONZERO_PADDING_BYTES_IN_SWITCH_MAJOR_VERSION) {
2111 // 4639449 & 4647081: padding bytes must be 0
2112 u2 padding_offset = 1;
2113 while ((bcp + padding_offset) < aligned_bcp) {
2114 if(*(bcp + padding_offset) != 0) {
2115 verify_error(ErrorContext::bad_code(bci),
2116 "Nonzero padding byte in lookupswitch or tableswitch");
2117 return;
2118 }
2119 padding_offset++;
2120 }
2121 }
2122
2123 int default_offset = (int) Bytes::get_Java_u4(aligned_bcp);
2124 int keys, delta;
2125 current_frame->pop_stack(
2126 VerificationType::integer_type(), CHECK_VERIFY(this));
2127 if (bcs->raw_code() == Bytecodes::_tableswitch) {
2128 jint low = (jint)Bytes::get_Java_u4(aligned_bcp + jintSize);
2129 jint high = (jint)Bytes::get_Java_u4(aligned_bcp + 2*jintSize);
2130 if (low > high) {
2131 verify_error(ErrorContext::bad_code(bci),
2132 "low must be less than or equal to high in tableswitch");
2133 return;
2134 }
2135 keys = high - low + 1;
2136 if (keys < 0) {
2137 verify_error(ErrorContext::bad_code(bci), "too many keys in tableswitch");
2138 return;
2139 }
2140 delta = 1;
2141 } else {
2142 keys = (int)Bytes::get_Java_u4(aligned_bcp + jintSize);
2143 if (keys < 0) {
2144 verify_error(ErrorContext::bad_code(bci),
2145 "number of keys in lookupswitch less than 0");
2146 return;
2147 }
2148 delta = 2;
2149 // Make sure that the lookupswitch items are sorted
2150 for (int i = 0; i < (keys - 1); i++) {
2151 jint this_key = Bytes::get_Java_u4(aligned_bcp + (2+2*i)*jintSize);
2152 jint next_key = Bytes::get_Java_u4(aligned_bcp + (2+2*i+2)*jintSize);
2153 if (this_key >= next_key) {
2154 verify_error(ErrorContext::bad_code(bci),
2155 "Bad lookupswitch instruction");
2156 return;
2157 }
2158 }
2159 }
2160 int target = bci + default_offset;
2161 stackmap_table->check_jump_target(current_frame, target, CHECK_VERIFY(this));
2162 for (int i = 0; i < keys; i++) {
2163 // Because check_jump_target() may safepoint, the bytecode could have
2164 // moved, which means 'aligned_bcp' is no good and needs to be recalculated.
2165 aligned_bcp = (address)round_to((intptr_t)(bcs->bcp() + 1), jintSize);
2166 target = bci + (jint)Bytes::get_Java_u4(aligned_bcp+(3+i*delta)*jintSize);
2167 stackmap_table->check_jump_target(
2168 current_frame, target, CHECK_VERIFY(this));
2169 }
2170 NOT_PRODUCT(aligned_bcp = NULL); // no longer valid at this point
2171 }
2172
2173 bool ClassVerifier::name_in_supers(
2174 Symbol* ref_name, InstanceKlass* current) {
2175 Klass* super = current->super();
2176 while (super != NULL) {
2177 if (super->name() == ref_name) {
2178 return true;
2179 }
2180 super = super->super();
2181 }
2182 return false;
2183 }
2184
2185 void ClassVerifier::verify_field_instructions(RawBytecodeStream* bcs,
2186 StackMapFrame* current_frame,
2187 const constantPoolHandle& cp,
2188 bool allow_arrays,
2189 TRAPS) {
2190 u2 index = bcs->get_index_u2();
2191 verify_cp_type(bcs->bci(), index, cp,
2192 1 << JVM_CONSTANT_Fieldref, CHECK_VERIFY(this));
2193
2194 // Get field name and signature
2195 Symbol* field_name = cp->name_ref_at(index);
2196 Symbol* field_sig = cp->signature_ref_at(index);
2197
2198 if (!SignatureVerifier::is_valid_type_signature(field_sig)) {
2199 class_format_error(
2200 "Invalid signature for field in class %s referenced "
2201 "from constant pool index %d", _klass->external_name(), index);
2202 return;
2203 }
2204
2205 // Get referenced class type
2206 VerificationType ref_class_type = cp_ref_index_to_type(
2207 index, cp, CHECK_VERIFY(this));
2208 if (!ref_class_type.is_object() &&
2209 (!allow_arrays || !ref_class_type.is_array())) {
2210 verify_error(ErrorContext::bad_type(bcs->bci(),
2211 TypeOrigin::cp(index, ref_class_type)),
2212 "Expecting reference to class in class %s at constant pool index %d",
2213 _klass->external_name(), index);
2214 return;
2215 }
2216 VerificationType target_class_type = ref_class_type;
2217
2218 assert(sizeof(VerificationType) == sizeof(uintptr_t),
2219 "buffer type must match VerificationType size");
2220 uintptr_t field_type_buffer[2];
2221 VerificationType* field_type = (VerificationType*)field_type_buffer;
2222 // If we make a VerificationType[2] array directly, the compiler calls
2223 // to the c-runtime library to do the allocation instead of just
2224 // stack allocating it. Plus it would run constructors. This shows up
2225 // in performance profiles.
2226
2227 SignatureStream sig_stream(field_sig, false);
2228 VerificationType stack_object_type;
2229 int n = change_sig_to_verificationType(
2230 &sig_stream, field_type, CHECK_VERIFY(this));
2231 u2 bci = bcs->bci();
2232 bool is_assignable;
2233 switch (bcs->raw_code()) {
2234 case Bytecodes::_getstatic: {
2235 for (int i = 0; i < n; i++) {
2236 current_frame->push_stack(field_type[i], CHECK_VERIFY(this));
2237 }
2238 break;
2239 }
2240 case Bytecodes::_putstatic: {
2241 for (int i = n - 1; i >= 0; i--) {
2242 current_frame->pop_stack(field_type[i], CHECK_VERIFY(this));
2243 }
2244 break;
2245 }
2246 case Bytecodes::_getfield: {
2247 stack_object_type = current_frame->pop_stack(
2248 target_class_type, CHECK_VERIFY(this));
2249 for (int i = 0; i < n; i++) {
2250 current_frame->push_stack(field_type[i], CHECK_VERIFY(this));
2251 }
2252 goto check_protected;
2253 }
2254 case Bytecodes::_putfield: {
2255 for (int i = n - 1; i >= 0; i--) {
2256 current_frame->pop_stack(field_type[i], CHECK_VERIFY(this));
2257 }
2258 stack_object_type = current_frame->pop_stack(CHECK_VERIFY(this));
2259
2260 // The JVMS 2nd edition allows field initialization before the superclass
2261 // initializer, if the field is defined within the current class.
2262 fieldDescriptor fd;
2263 if (stack_object_type == VerificationType::uninitialized_this_type() &&
2264 target_class_type.equals(current_type()) &&
2265 _klass->find_local_field(field_name, field_sig, &fd)) {
2266 stack_object_type = current_type();
2267 }
2268 is_assignable = target_class_type.is_assignable_from(
2269 stack_object_type, this, false, CHECK_VERIFY(this));
2270 if (!is_assignable) {
2271 verify_error(ErrorContext::bad_type(bci,
2272 current_frame->stack_top_ctx(),
2273 TypeOrigin::cp(index, target_class_type)),
2274 "Bad type on operand stack in putfield");
2275 return;
2276 }
2277 }
2278 check_protected: {
2279 if (_this_type == stack_object_type)
2280 break; // stack_object_type must be assignable to _current_class_type
2281 if (was_recursively_verified()) return;
2282 Symbol* ref_class_name =
2283 cp->klass_name_at(cp->klass_ref_index_at(index));
2284 if (!name_in_supers(ref_class_name, current_class()))
2285 // stack_object_type must be assignable to _current_class_type since:
2286 // 1. stack_object_type must be assignable to ref_class.
2287 // 2. ref_class must be _current_class or a subclass of it. It can't
2288 // be a superclass of it. See revised JVMS 5.4.4.
2289 break;
2290
2291 Klass* ref_class_oop = load_class(ref_class_name, CHECK);
2292 if (is_protected_access(current_class(), ref_class_oop, field_name,
2293 field_sig, false)) {
2294 // It's protected access, check if stack object is assignable to
2295 // current class.
2296 is_assignable = current_type().is_assignable_from(
2297 stack_object_type, this, true, CHECK_VERIFY(this));
2298 if (!is_assignable) {
2299 verify_error(ErrorContext::bad_type(bci,
2300 current_frame->stack_top_ctx(),
2301 TypeOrigin::implicit(current_type())),
2302 "Bad access to protected data in getfield");
2303 return;
2304 }
2305 }
2306 break;
2307 }
2308 default: ShouldNotReachHere();
2309 }
2310 }
2311
2312 // Look at the method's handlers. If the bci is in the handler's try block
2313 // then check if the handler_pc is already on the stack. If not, push it
2314 // unless the handler has already been scanned.
2315 void ClassVerifier::push_handlers(ExceptionTable* exhandlers,
2316 GrowableArray<u4>* handler_list,
2317 GrowableArray<u4>* handler_stack,
2318 u4 bci) {
2319 int exlength = exhandlers->length();
2320 for(int x = 0; x < exlength; x++) {
2321 if (bci >= exhandlers->start_pc(x) && bci < exhandlers->end_pc(x)) {
2322 u4 exhandler_pc = exhandlers->handler_pc(x);
2323 if (!handler_list->contains(exhandler_pc)) {
2324 handler_stack->append_if_missing(exhandler_pc);
2325 handler_list->append(exhandler_pc);
2326 }
2327 }
2328 }
2329 }
2330
2331 // Return TRUE if all code paths starting with start_bc_offset end in
2332 // bytecode athrow or loop.
2333 bool ClassVerifier::ends_in_athrow(u4 start_bc_offset) {
2334 ResourceMark rm;
2335 // Create bytecode stream.
2336 RawBytecodeStream bcs(method());
2337 u4 code_length = method()->code_size();
2338 bcs.set_start(start_bc_offset);
2339 u4 target;
2340 // Create stack for storing bytecode start offsets for if* and *switch.
2341 GrowableArray<u4>* bci_stack = new GrowableArray<u4>(30);
2342 // Create stack for handlers for try blocks containing this handler.
2343 GrowableArray<u4>* handler_stack = new GrowableArray<u4>(30);
2344 // Create list of handlers that have been pushed onto the handler_stack
2345 // so that handlers embedded inside of their own TRY blocks only get
2346 // scanned once.
2347 GrowableArray<u4>* handler_list = new GrowableArray<u4>(30);
2348 // Create list of visited branch opcodes (goto* and if*).
2349 GrowableArray<u4>* visited_branches = new GrowableArray<u4>(30);
2350 ExceptionTable exhandlers(_method());
2351
2352 while (true) {
2353 if (bcs.is_last_bytecode()) {
2354 // if no more starting offsets to parse or if at the end of the
2355 // method then return false.
2356 if ((bci_stack->is_empty()) || ((u4)bcs.end_bci() == code_length))
2357 return false;
2358 // Pop a bytecode starting offset and scan from there.
2359 bcs.set_start(bci_stack->pop());
2360 }
2361 Bytecodes::Code opcode = bcs.raw_next();
2362 u4 bci = bcs.bci();
2363
2364 // If the bytecode is in a TRY block, push its handlers so they
2365 // will get parsed.
2366 push_handlers(&exhandlers, handler_list, handler_stack, bci);
2367
2368 switch (opcode) {
2369 case Bytecodes::_if_icmpeq:
2370 case Bytecodes::_if_icmpne:
2371 case Bytecodes::_if_icmplt:
2372 case Bytecodes::_if_icmpge:
2373 case Bytecodes::_if_icmpgt:
2374 case Bytecodes::_if_icmple:
2375 case Bytecodes::_ifeq:
2376 case Bytecodes::_ifne:
2377 case Bytecodes::_iflt:
2378 case Bytecodes::_ifge:
2379 case Bytecodes::_ifgt:
2380 case Bytecodes::_ifle:
2381 case Bytecodes::_if_acmpeq:
2382 case Bytecodes::_if_acmpne:
2383 case Bytecodes::_ifnull:
2384 case Bytecodes::_ifnonnull:
2385 target = bcs.dest();
2386 if (visited_branches->contains(bci)) {
2387 if (bci_stack->is_empty()) {
2388 if (handler_stack->is_empty()) {
2389 return true;
2390 } else {
2391 // Parse the catch handlers for try blocks containing athrow.
2392 bcs.set_start(handler_stack->pop());
2393 }
2394 } else {
2395 // Pop a bytecode starting offset and scan from there.
2396 bcs.set_start(bci_stack->pop());
2397 }
2398 } else {
2399 if (target > bci) { // forward branch
2400 if (target >= code_length) return false;
2401 // Push the branch target onto the stack.
2402 bci_stack->push(target);
2403 // then, scan bytecodes starting with next.
2404 bcs.set_start(bcs.next_bci());
2405 } else { // backward branch
2406 // Push bytecode offset following backward branch onto the stack.
2407 bci_stack->push(bcs.next_bci());
2408 // Check bytecodes starting with branch target.
2409 bcs.set_start(target);
2410 }
2411 // Record target so we don't branch here again.
2412 visited_branches->append(bci);
2413 }
2414 break;
2415
2416 case Bytecodes::_goto:
2417 case Bytecodes::_goto_w:
2418 target = (opcode == Bytecodes::_goto ? bcs.dest() : bcs.dest_w());
2419 if (visited_branches->contains(bci)) {
2420 if (bci_stack->is_empty()) {
2421 if (handler_stack->is_empty()) {
2422 return true;
2423 } else {
2424 // Parse the catch handlers for try blocks containing athrow.
2425 bcs.set_start(handler_stack->pop());
2426 }
2427 } else {
2428 // Been here before, pop new starting offset from stack.
2429 bcs.set_start(bci_stack->pop());
2430 }
2431 } else {
2432 if (target >= code_length) return false;
2433 // Continue scanning from the target onward.
2434 bcs.set_start(target);
2435 // Record target so we don't branch here again.
2436 visited_branches->append(bci);
2437 }
2438 break;
2439
2440 // Check that all switch alternatives end in 'athrow' bytecodes. Since it
2441 // is difficult to determine where each switch alternative ends, parse
2442 // each switch alternative until either hit a 'return', 'athrow', or reach
2443 // the end of the method's bytecodes. This is gross but should be okay
2444 // because:
2445 // 1. tableswitch and lookupswitch byte codes in handlers for ctor explicit
2446 // constructor invocations should be rare.
2447 // 2. if each switch alternative ends in an athrow then the parsing should be
2448 // short. If there is no athrow then it is bogus code, anyway.
2449 case Bytecodes::_lookupswitch:
2450 case Bytecodes::_tableswitch:
2451 {
2452 address aligned_bcp = (address) round_to((intptr_t)(bcs.bcp() + 1), jintSize);
2453 u4 default_offset = Bytes::get_Java_u4(aligned_bcp) + bci;
2454 int keys, delta;
2455 if (opcode == Bytecodes::_tableswitch) {
2456 jint low = (jint)Bytes::get_Java_u4(aligned_bcp + jintSize);
2457 jint high = (jint)Bytes::get_Java_u4(aligned_bcp + 2*jintSize);
2458 // This is invalid, but let the regular bytecode verifier
2459 // report this because the user will get a better error message.
2460 if (low > high) return true;
2461 keys = high - low + 1;
2462 delta = 1;
2463 } else {
2464 keys = (int)Bytes::get_Java_u4(aligned_bcp + jintSize);
2465 delta = 2;
2466 }
2467 // Invalid, let the regular bytecode verifier deal with it.
2468 if (keys < 0) return true;
2469
2470 // Push the offset of the next bytecode onto the stack.
2471 bci_stack->push(bcs.next_bci());
2472
2473 // Push the switch alternatives onto the stack.
2474 for (int i = 0; i < keys; i++) {
2475 u4 target = bci + (jint)Bytes::get_Java_u4(aligned_bcp+(3+i*delta)*jintSize);
2476 if (target > code_length) return false;
2477 bci_stack->push(target);
2478 }
2479
2480 // Start bytecode parsing for the switch at the default alternative.
2481 if (default_offset > code_length) return false;
2482 bcs.set_start(default_offset);
2483 break;
2484 }
2485
2486 case Bytecodes::_return:
2487 return false;
2488
2489 case Bytecodes::_athrow:
2490 {
2491 if (bci_stack->is_empty()) {
2492 if (handler_stack->is_empty()) {
2493 return true;
2494 } else {
2495 // Parse the catch handlers for try blocks containing athrow.
2496 bcs.set_start(handler_stack->pop());
2497 }
2498 } else {
2499 // Pop a bytecode offset and starting scanning from there.
2500 bcs.set_start(bci_stack->pop());
2501 }
2502 }
2503 break;
2504
2505 default:
2506 ;
2507 } // end switch
2508 } // end while loop
2509
2510 return false;
2511 }
2512
2513 void ClassVerifier::verify_invoke_init(
2514 RawBytecodeStream* bcs, u2 ref_class_index, VerificationType ref_class_type,
2515 StackMapFrame* current_frame, u4 code_length, bool in_try_block,
2516 bool *this_uninit, const constantPoolHandle& cp, StackMapTable* stackmap_table,
2517 TRAPS) {
2518 u2 bci = bcs->bci();
2519 VerificationType type = current_frame->pop_stack(
2520 VerificationType::reference_check(), CHECK_VERIFY(this));
2521 if (type == VerificationType::uninitialized_this_type()) {
2522 // The method must be an <init> method of this class or its superclass
2523 Klass* superk = current_class()->super();
2524 if (ref_class_type.name() != current_class()->name() &&
2525 ref_class_type.name() != superk->name()) {
2526 verify_error(ErrorContext::bad_type(bci,
2527 TypeOrigin::implicit(ref_class_type),
2528 TypeOrigin::implicit(current_type())),
2529 "Bad <init> method call");
2530 return;
2531 }
2532
2533 // If this invokespecial call is done from inside of a TRY block then make
2534 // sure that all catch clause paths end in a throw. Otherwise, this can
2535 // result in returning an incomplete object.
2536 if (in_try_block) {
2537 ExceptionTable exhandlers(_method());
2538 int exlength = exhandlers.length();
2539 for(int i = 0; i < exlength; i++) {
2540 u2 start_pc = exhandlers.start_pc(i);
2541 u2 end_pc = exhandlers.end_pc(i);
2542
2543 if (bci >= start_pc && bci < end_pc) {
2544 if (!ends_in_athrow(exhandlers.handler_pc(i))) {
2545 verify_error(ErrorContext::bad_code(bci),
2546 "Bad <init> method call from after the start of a try block");
2547 return;
2548 } else if (log_is_enabled(Info, verification)) {
2549 ResourceMark rm(THREAD);
2550 log_info(verification)("Survived call to ends_in_athrow(): %s",
2551 current_class()->name()->as_C_string());
2552 }
2553 }
2554 }
2555
2556 // Check the exception handler target stackmaps with the locals from the
2557 // incoming stackmap (before initialize_object() changes them to outgoing
2558 // state).
2559 if (was_recursively_verified()) return;
2560 verify_exception_handler_targets(bci, true, current_frame,
2561 stackmap_table, CHECK_VERIFY(this));
2562 } // in_try_block
2563
2564 current_frame->initialize_object(type, current_type());
2565 *this_uninit = true;
2566 } else if (type.is_uninitialized()) {
2567 u2 new_offset = type.bci();
2568 address new_bcp = bcs->bcp() - bci + new_offset;
2569 if (new_offset > (code_length - 3) || (*new_bcp) != Bytecodes::_new) {
2570 /* Unreachable? Stack map parsing ensures valid type and new
2571 * instructions have a valid BCI. */
2572 verify_error(ErrorContext::bad_code(new_offset),
2573 "Expecting new instruction");
2574 return;
2575 }
2576 u2 new_class_index = Bytes::get_Java_u2(new_bcp + 1);
2577 if (was_recursively_verified()) return;
2578 verify_cp_class_type(bci, new_class_index, cp, CHECK_VERIFY(this));
2579
2580 // The method must be an <init> method of the indicated class
2581 VerificationType new_class_type = cp_index_to_type(
2582 new_class_index, cp, CHECK_VERIFY(this));
2583 if (!new_class_type.equals(ref_class_type)) {
2584 verify_error(ErrorContext::bad_type(bci,
2585 TypeOrigin::cp(new_class_index, new_class_type),
2586 TypeOrigin::cp(ref_class_index, ref_class_type)),
2587 "Call to wrong <init> method");
2588 return;
2589 }
2590 // According to the VM spec, if the referent class is a superclass of the
2591 // current class, and is in a different runtime package, and the method is
2592 // protected, then the objectref must be the current class or a subclass
2593 // of the current class.
2594 VerificationType objectref_type = new_class_type;
2595 if (name_in_supers(ref_class_type.name(), current_class())) {
2596 Klass* ref_klass = load_class(ref_class_type.name(), CHECK);
2597 if (was_recursively_verified()) return;
2598 Method* m = InstanceKlass::cast(ref_klass)->uncached_lookup_method(
2599 vmSymbols::object_initializer_name(),
2600 cp->signature_ref_at(bcs->get_index_u2()),
2601 Klass::find_overpass);
2602 // Do nothing if method is not found. Let resolution detect the error.
2603 if (m != NULL) {
2604 InstanceKlass* mh = m->method_holder();
2605 if (m->is_protected() && !mh->is_same_class_package(_klass)) {
2606 bool assignable = current_type().is_assignable_from(
2607 objectref_type, this, true, CHECK_VERIFY(this));
2608 if (!assignable) {
2609 verify_error(ErrorContext::bad_type(bci,
2610 TypeOrigin::cp(new_class_index, objectref_type),
2611 TypeOrigin::implicit(current_type())),
2612 "Bad access to protected <init> method");
2613 return;
2614 }
2615 }
2616 }
2617 }
2618 // Check the exception handler target stackmaps with the locals from the
2619 // incoming stackmap (before initialize_object() changes them to outgoing
2620 // state).
2621 if (in_try_block) {
2622 if (was_recursively_verified()) return;
2623 verify_exception_handler_targets(bci, *this_uninit, current_frame,
2624 stackmap_table, CHECK_VERIFY(this));
2625 }
2626 current_frame->initialize_object(type, new_class_type);
2627 } else {
2628 verify_error(ErrorContext::bad_type(bci, current_frame->stack_top_ctx()),
2629 "Bad operand type when invoking <init>");
2630 return;
2631 }
2632 }
2633
2634 bool ClassVerifier::is_same_or_direct_interface(
2635 InstanceKlass* klass,
2636 VerificationType klass_type,
2637 VerificationType ref_class_type) {
2638 if (ref_class_type.equals(klass_type)) return true;
2639 Array<Klass*>* local_interfaces = klass->local_interfaces();
2640 if (local_interfaces != NULL) {
2641 for (int x = 0; x < local_interfaces->length(); x++) {
2642 Klass* k = local_interfaces->at(x);
2643 assert (k != NULL && k->is_interface(), "invalid interface");
2644 if (ref_class_type.equals(VerificationType::reference_type(k->name()))) {
2645 return true;
2646 }
2647 }
2648 }
2649 return false;
2650 }
2651
2652 void ClassVerifier::verify_invoke_instructions(
2653 RawBytecodeStream* bcs, u4 code_length, StackMapFrame* current_frame,
2654 bool in_try_block, bool *this_uninit, VerificationType return_type,
2655 const constantPoolHandle& cp, StackMapTable* stackmap_table, TRAPS) {
2656 // Make sure the constant pool item is the right type
2657 u2 index = bcs->get_index_u2();
2658 Bytecodes::Code opcode = bcs->raw_code();
2659 unsigned int types;
2660 switch (opcode) {
2661 case Bytecodes::_invokeinterface:
2662 types = 1 << JVM_CONSTANT_InterfaceMethodref;
2663 break;
2664 case Bytecodes::_invokedynamic:
2665 types = 1 << JVM_CONSTANT_InvokeDynamic;
2666 break;
2667 case Bytecodes::_invokespecial:
2668 case Bytecodes::_invokestatic:
2669 types = (_klass->major_version() < STATIC_METHOD_IN_INTERFACE_MAJOR_VERSION) ?
2670 (1 << JVM_CONSTANT_Methodref) :
2671 ((1 << JVM_CONSTANT_InterfaceMethodref) | (1 << JVM_CONSTANT_Methodref));
2672 break;
2673 default:
2674 types = 1 << JVM_CONSTANT_Methodref;
2675 }
2676 verify_cp_type(bcs->bci(), index, cp, types, CHECK_VERIFY(this));
2677
2678 // Get method name and signature
2679 Symbol* method_name = cp->name_ref_at(index);
2680 Symbol* method_sig = cp->signature_ref_at(index);
2681
2682 if (!SignatureVerifier::is_valid_method_signature(method_sig)) {
2683 class_format_error(
2684 "Invalid method signature in class %s referenced "
2685 "from constant pool index %d", _klass->external_name(), index);
2686 return;
2687 }
2688
2689 // Get referenced class type
2690 VerificationType ref_class_type;
2691 if (opcode == Bytecodes::_invokedynamic) {
2692 if (_klass->major_version() < Verifier::INVOKEDYNAMIC_MAJOR_VERSION) {
2693 class_format_error(
2694 "invokedynamic instructions not supported by this class file version (%d), class %s",
2695 _klass->major_version(), _klass->external_name());
2696 return;
2697 }
2698 } else {
2699 ref_class_type = cp_ref_index_to_type(index, cp, CHECK_VERIFY(this));
2700 }
2701
2702 // For a small signature length, we just allocate 128 bytes instead
2703 // of parsing the signature once to find its size.
2704 // -3 is for '(', ')' and return descriptor; multiply by 2 is for
2705 // longs/doubles to be consertive.
2706 assert(sizeof(VerificationType) == sizeof(uintptr_t),
2707 "buffer type must match VerificationType size");
2708 uintptr_t on_stack_sig_types_buffer[128];
2709 // If we make a VerificationType[128] array directly, the compiler calls
2710 // to the c-runtime library to do the allocation instead of just
2711 // stack allocating it. Plus it would run constructors. This shows up
2712 // in performance profiles.
2713
2714 VerificationType* sig_types;
2715 int size = (method_sig->utf8_length() - 3) * 2;
2716 if (size > 128) {
2717 // Long and double occupies two slots here.
2718 ArgumentSizeComputer size_it(method_sig);
2719 size = size_it.size();
2720 sig_types = NEW_RESOURCE_ARRAY_IN_THREAD(THREAD, VerificationType, size);
2721 } else{
2722 sig_types = (VerificationType*)on_stack_sig_types_buffer;
2723 }
2724 SignatureStream sig_stream(method_sig);
2725 int sig_i = 0;
2726 while (!sig_stream.at_return_type()) {
2727 sig_i += change_sig_to_verificationType(
2728 &sig_stream, &sig_types[sig_i], CHECK_VERIFY(this));
2729 sig_stream.next();
2730 }
2731 int nargs = sig_i;
2732
2733 #ifdef ASSERT
2734 {
2735 ArgumentSizeComputer size_it(method_sig);
2736 assert(nargs == size_it.size(), "Argument sizes do not match");
2737 assert(nargs <= (method_sig->utf8_length() - 3) * 2, "estimate of max size isn't conservative enough");
2738 }
2739 #endif
2740
2741 // Check instruction operands
2742 u2 bci = bcs->bci();
2743 if (opcode == Bytecodes::_invokeinterface) {
2744 address bcp = bcs->bcp();
2745 // 4905268: count operand in invokeinterface should be nargs+1, not nargs.
2746 // JSR202 spec: The count operand of an invokeinterface instruction is valid if it is
2747 // the difference between the size of the operand stack before and after the instruction
2748 // executes.
2749 if (*(bcp+3) != (nargs+1)) {
2750 verify_error(ErrorContext::bad_code(bci),
2751 "Inconsistent args count operand in invokeinterface");
2752 return;
2753 }
2754 if (*(bcp+4) != 0) {
2755 verify_error(ErrorContext::bad_code(bci),
2756 "Fourth operand byte of invokeinterface must be zero");
2757 return;
2758 }
2759 }
2760
2761 if (opcode == Bytecodes::_invokedynamic) {
2762 address bcp = bcs->bcp();
2763 if (*(bcp+3) != 0 || *(bcp+4) != 0) {
2764 verify_error(ErrorContext::bad_code(bci),
2765 "Third and fourth operand bytes of invokedynamic must be zero");
2766 return;
2767 }
2768 }
2769
2770 if (method_name->byte_at(0) == '<') {
2771 // Make sure <init> can only be invoked by invokespecial
2772 if (opcode != Bytecodes::_invokespecial ||
2773 method_name != vmSymbols::object_initializer_name()) {
2774 verify_error(ErrorContext::bad_code(bci),
2775 "Illegal call to internal method");
2776 return;
2777 }
2778 } else if (opcode == Bytecodes::_invokespecial
2779 && !is_same_or_direct_interface(current_class(), current_type(), ref_class_type)
2780 && !ref_class_type.equals(VerificationType::reference_type(
2781 current_class()->super()->name()))) {
2782 bool subtype = false;
2783 bool have_imr_indirect = cp->tag_at(index).value() == JVM_CONSTANT_InterfaceMethodref;
2784 if (!current_class()->is_anonymous()) {
2785 subtype = ref_class_type.is_assignable_from(
2786 current_type(), this, false, CHECK_VERIFY(this));
2787 } else {
2788 VerificationType host_klass_type =
2789 VerificationType::reference_type(current_class()->host_klass()->name());
2790 subtype = ref_class_type.is_assignable_from(host_klass_type, this, false, CHECK_VERIFY(this));
2791
2792 // If invokespecial of IMR, need to recheck for same or
2793 // direct interface relative to the host class
2794 have_imr_indirect = (have_imr_indirect &&
2795 !is_same_or_direct_interface(
2796 current_class()->host_klass(),
2797 host_klass_type, ref_class_type));
2798 }
2799 if (!subtype) {
2800 verify_error(ErrorContext::bad_code(bci),
2801 "Bad invokespecial instruction: "
2802 "current class isn't assignable to reference class.");
2803 return;
2804 } else if (have_imr_indirect) {
2805 verify_error(ErrorContext::bad_code(bci),
2806 "Bad invokespecial instruction: "
2807 "interface method reference is in an indirect superinterface.");
2808 return;
2809 }
2810
2811 }
2812 // Match method descriptor with operand stack
2813 for (int i = nargs - 1; i >= 0; i--) { // Run backwards
2814 current_frame->pop_stack(sig_types[i], CHECK_VERIFY(this));
2815 }
2816 // Check objectref on operand stack
2817 if (opcode != Bytecodes::_invokestatic &&
2818 opcode != Bytecodes::_invokedynamic) {
2819 if (method_name == vmSymbols::object_initializer_name()) { // <init> method
2820 verify_invoke_init(bcs, index, ref_class_type, current_frame,
2821 code_length, in_try_block, this_uninit, cp, stackmap_table,
2822 CHECK_VERIFY(this));
2823 if (was_recursively_verified()) return;
2824 } else { // other methods
2825 // Ensures that target class is assignable to method class.
2826 if (opcode == Bytecodes::_invokespecial) {
2827 if (!current_class()->is_anonymous()) {
2828 current_frame->pop_stack(current_type(), CHECK_VERIFY(this));
2829 } else {
2830 // anonymous class invokespecial calls: check if the
2831 // objectref is a subtype of the host_klass of the current class
2832 // to allow an anonymous class to reference methods in the host_klass
2833 VerificationType top = current_frame->pop_stack(CHECK_VERIFY(this));
2834 VerificationType hosttype =
2835 VerificationType::reference_type(current_class()->host_klass()->name());
2836 bool subtype = hosttype.is_assignable_from(top, this, false, CHECK_VERIFY(this));
2837 if (!subtype) {
2838 verify_error( ErrorContext::bad_type(current_frame->offset(),
2839 current_frame->stack_top_ctx(),
2840 TypeOrigin::implicit(top)),
2841 "Bad type on operand stack");
2842 return;
2843 }
2844 }
2845 } else if (opcode == Bytecodes::_invokevirtual) {
2846 VerificationType stack_object_type =
2847 current_frame->pop_stack(ref_class_type, CHECK_VERIFY(this));
2848 if (current_type() != stack_object_type) {
2849 if (was_recursively_verified()) return;
2850 assert(cp->cache() == NULL, "not rewritten yet");
2851 Symbol* ref_class_name =
2852 cp->klass_name_at(cp->klass_ref_index_at(index));
2853 // See the comments in verify_field_instructions() for
2854 // the rationale behind this.
2855 if (name_in_supers(ref_class_name, current_class())) {
2856 Klass* ref_class = load_class(ref_class_name, CHECK);
2857 if (is_protected_access(
2858 _klass, ref_class, method_name, method_sig, true)) {
2859 // It's protected access, check if stack object is
2860 // assignable to current class.
2861 bool is_assignable = current_type().is_assignable_from(
2862 stack_object_type, this, true, CHECK_VERIFY(this));
2863 if (!is_assignable) {
2864 if (ref_class_type.name() == vmSymbols::java_lang_Object()
2865 && stack_object_type.is_array()
2866 && method_name == vmSymbols::clone_name()) {
2867 // Special case: arrays pretend to implement public Object
2868 // clone().
2869 } else {
2870 verify_error(ErrorContext::bad_type(bci,
2871 current_frame->stack_top_ctx(),
2872 TypeOrigin::implicit(current_type())),
2873 "Bad access to protected data in invokevirtual");
2874 return;
2875 }
2876 }
2877 }
2878 }
2879 }
2880 } else {
2881 assert(opcode == Bytecodes::_invokeinterface, "Unexpected opcode encountered");
2882 current_frame->pop_stack(ref_class_type, CHECK_VERIFY(this));
2883 }
2884 }
2885 }
2886 // Push the result type.
2887 if (sig_stream.type() != T_VOID) {
2888 if (method_name == vmSymbols::object_initializer_name()) {
2889 // <init> method must have a void return type
2890 /* Unreachable? Class file parser verifies that methods with '<' have
2891 * void return */
2892 verify_error(ErrorContext::bad_code(bci),
2893 "Return type must be void in <init> method");
2894 return;
2895 }
2896 VerificationType return_type[2];
2897 int n = change_sig_to_verificationType(
2898 &sig_stream, return_type, CHECK_VERIFY(this));
2899 for (int i = 0; i < n; i++) {
2900 current_frame->push_stack(return_type[i], CHECK_VERIFY(this)); // push types backwards
2901 }
2902 }
2903 }
2904
2905 VerificationType ClassVerifier::get_newarray_type(
2906 u2 index, u2 bci, TRAPS) {
2907 const char* from_bt[] = {
2908 NULL, NULL, NULL, NULL, "[Z", "[C", "[F", "[D", "[B", "[S", "[I", "[J",
2909 };
2910 if (index < T_BOOLEAN || index > T_LONG) {
2911 verify_error(ErrorContext::bad_code(bci), "Illegal newarray instruction");
2912 return VerificationType::bogus_type();
2913 }
2914
2915 // from_bt[index] contains the array signature which has a length of 2
2916 Symbol* sig = create_temporary_symbol(
2917 from_bt[index], 2, CHECK_(VerificationType::bogus_type()));
2918 return VerificationType::reference_type(sig);
2919 }
2920
2921 void ClassVerifier::verify_anewarray(
2922 u2 bci, u2 index, const constantPoolHandle& cp,
2923 StackMapFrame* current_frame, TRAPS) {
2924 verify_cp_class_type(bci, index, cp, CHECK_VERIFY(this));
2925 current_frame->pop_stack(
2926 VerificationType::integer_type(), CHECK_VERIFY(this));
2927
2928 if (was_recursively_verified()) return;
2929 VerificationType component_type =
2930 cp_index_to_type(index, cp, CHECK_VERIFY(this));
2931 int length;
2932 char* arr_sig_str;
2933 if (component_type.is_array()) { // it's an array
2934 const char* component_name = component_type.name()->as_utf8();
2935 // Check for more than MAX_ARRAY_DIMENSIONS
2936 length = (int)strlen(component_name);
2937 if (length > MAX_ARRAY_DIMENSIONS &&
2938 component_name[MAX_ARRAY_DIMENSIONS - 1] == '[') {
2939 verify_error(ErrorContext::bad_code(bci),
2940 "Illegal anewarray instruction, array has more than 255 dimensions");
2941 }
2942 // add one dimension to component
2943 length++;
2944 arr_sig_str = NEW_RESOURCE_ARRAY_IN_THREAD(THREAD, char, length);
2945 arr_sig_str[0] = '[';
2946 strncpy(&arr_sig_str[1], component_name, length - 1);
2947 } else { // it's an object or interface
2948 const char* component_name = component_type.name()->as_utf8();
2949 // add one dimension to component with 'L' prepended and ';' postpended.
2950 length = (int)strlen(component_name) + 3;
2951 arr_sig_str = NEW_RESOURCE_ARRAY_IN_THREAD(THREAD, char, length);
2952 arr_sig_str[0] = '[';
2953 arr_sig_str[1] = 'L';
2954 strncpy(&arr_sig_str[2], component_name, length - 2);
2955 arr_sig_str[length - 1] = ';';
2956 }
2957 Symbol* arr_sig = create_temporary_symbol(
2958 arr_sig_str, length, CHECK_VERIFY(this));
2959 VerificationType new_array_type = VerificationType::reference_type(arr_sig);
2960 current_frame->push_stack(new_array_type, CHECK_VERIFY(this));
2961 }
2962
2963 void ClassVerifier::verify_iload(u2 index, StackMapFrame* current_frame, TRAPS) {
2964 current_frame->get_local(
2965 index, VerificationType::integer_type(), CHECK_VERIFY(this));
2966 current_frame->push_stack(
2967 VerificationType::integer_type(), CHECK_VERIFY(this));
2968 }
2969
2970 void ClassVerifier::verify_lload(u2 index, StackMapFrame* current_frame, TRAPS) {
2971 current_frame->get_local_2(
2972 index, VerificationType::long_type(),
2973 VerificationType::long2_type(), CHECK_VERIFY(this));
2974 current_frame->push_stack_2(
2975 VerificationType::long_type(),
2976 VerificationType::long2_type(), CHECK_VERIFY(this));
2977 }
2978
2979 void ClassVerifier::verify_fload(u2 index, StackMapFrame* current_frame, TRAPS) {
2980 current_frame->get_local(
2981 index, VerificationType::float_type(), CHECK_VERIFY(this));
2982 current_frame->push_stack(
2983 VerificationType::float_type(), CHECK_VERIFY(this));
2984 }
2985
2986 void ClassVerifier::verify_dload(u2 index, StackMapFrame* current_frame, TRAPS) {
2987 current_frame->get_local_2(
2988 index, VerificationType::double_type(),
2989 VerificationType::double2_type(), CHECK_VERIFY(this));
2990 current_frame->push_stack_2(
2991 VerificationType::double_type(),
2992 VerificationType::double2_type(), CHECK_VERIFY(this));
2993 }
2994
2995 void ClassVerifier::verify_aload(u2 index, StackMapFrame* current_frame, TRAPS) {
2996 VerificationType type = current_frame->get_local(
2997 index, VerificationType::reference_check(), CHECK_VERIFY(this));
2998 current_frame->push_stack(type, CHECK_VERIFY(this));
2999 }
3000
3001 void ClassVerifier::verify_istore(u2 index, StackMapFrame* current_frame, TRAPS) {
3002 current_frame->pop_stack(
3003 VerificationType::integer_type(), CHECK_VERIFY(this));
3004 current_frame->set_local(
3005 index, VerificationType::integer_type(), CHECK_VERIFY(this));
3006 }
3007
3008 void ClassVerifier::verify_lstore(u2 index, StackMapFrame* current_frame, TRAPS) {
3009 current_frame->pop_stack_2(
3010 VerificationType::long2_type(),
3011 VerificationType::long_type(), CHECK_VERIFY(this));
3012 current_frame->set_local_2(
3013 index, VerificationType::long_type(),
3014 VerificationType::long2_type(), CHECK_VERIFY(this));
3015 }
3016
3017 void ClassVerifier::verify_fstore(u2 index, StackMapFrame* current_frame, TRAPS) {
3018 current_frame->pop_stack(VerificationType::float_type(), CHECK_VERIFY(this));
3019 current_frame->set_local(
3020 index, VerificationType::float_type(), CHECK_VERIFY(this));
3021 }
3022
3023 void ClassVerifier::verify_dstore(u2 index, StackMapFrame* current_frame, TRAPS) {
3024 current_frame->pop_stack_2(
3025 VerificationType::double2_type(),
3026 VerificationType::double_type(), CHECK_VERIFY(this));
3027 current_frame->set_local_2(
3028 index, VerificationType::double_type(),
3029 VerificationType::double2_type(), CHECK_VERIFY(this));
3030 }
3031
3032 void ClassVerifier::verify_astore(u2 index, StackMapFrame* current_frame, TRAPS) {
3033 VerificationType type = current_frame->pop_stack(
3034 VerificationType::reference_check(), CHECK_VERIFY(this));
3035 current_frame->set_local(index, type, CHECK_VERIFY(this));
3036 }
3037
3038 void ClassVerifier::verify_iinc(u2 index, StackMapFrame* current_frame, TRAPS) {
3039 VerificationType type = current_frame->get_local(
3040 index, VerificationType::integer_type(), CHECK_VERIFY(this));
3041 current_frame->set_local(index, type, CHECK_VERIFY(this));
3042 }
3043
3044 void ClassVerifier::verify_return_value(
3045 VerificationType return_type, VerificationType type, u2 bci,
3046 StackMapFrame* current_frame, TRAPS) {
3047 if (return_type == VerificationType::bogus_type()) {
3048 verify_error(ErrorContext::bad_type(bci,
3049 current_frame->stack_top_ctx(), TypeOrigin::signature(return_type)),
3050 "Method expects a return value");
3051 return;
3052 }
3053 bool match = return_type.is_assignable_from(type, this, false, CHECK_VERIFY(this));
3054 if (!match) {
3055 verify_error(ErrorContext::bad_type(bci,
3056 current_frame->stack_top_ctx(), TypeOrigin::signature(return_type)),
3057 "Bad return type");
3058 return;
3059 }
3060 }
3061
3062 // The verifier creates symbols which are substrings of Symbols.
3063 // These are stored in the verifier until the end of verification so that
3064 // they can be reference counted.
3065 Symbol* ClassVerifier::create_temporary_symbol(const Symbol *s, int begin,
3066 int end, TRAPS) {
3067 Symbol* sym = SymbolTable::new_symbol(s, begin, end, CHECK_NULL);
3068 _symbols->push(sym);
3069 return sym;
3070 }
3071
3072 Symbol* ClassVerifier::create_temporary_symbol(const char *s, int length, TRAPS) {
3073 Symbol* sym = SymbolTable::new_symbol(s, length, CHECK_NULL);
3074 _symbols->push(sym);
3075 return sym;
3076 }