1 /*
2 * Copyright (c) 1997, 2010, Oracle and/or its affiliates. All rights reserved.
3 * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
4 *
5 * This code is free software; you can redistribute it and/or modify it
6 * under the terms of the GNU General Public License version 2 only, as
7 * published by the Free Software Foundation.
8 *
9 * This code is distributed in the hope that it will be useful, but WITHOUT
10 * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
11 * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
12 * version 2 for more details (a copy is included in the LICENSE file that
13 * accompanied this code).
14 *
15 * You should have received a copy of the GNU General Public License version
16 * 2 along with this work; if not, write to the Free Software Foundation,
17 * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
18 *
19 * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
20 * or visit www.oracle.com if you need additional information or have any
21 * questions.
22 *
23 */
24
25 # include "incls/_precompiled.incl"
26 # include "incls/_frame_x86.cpp.incl"
27
28 #ifdef ASSERT
29 void RegisterMap::check_location_valid() {
30 }
31 #endif
32
33
34 // Profiling/safepoint support
35
36 bool frame::safe_for_sender(JavaThread *thread) {
37 address sp = (address)_sp;
38 address fp = (address)_fp;
39 address unextended_sp = (address)_unextended_sp;
40 // sp must be within the stack
41 bool sp_safe = (sp <= thread->stack_base()) &&
42 (sp >= thread->stack_base() - thread->stack_size());
43
44 if (!sp_safe) {
45 return false;
46 }
47
48 // unextended sp must be within the stack and above or equal sp
49 bool unextended_sp_safe = (unextended_sp <= thread->stack_base()) &&
50 (unextended_sp >= sp);
51
52 if (!unextended_sp_safe) {
53 return false;
54 }
55
56 // an fp must be within the stack and above (but not equal) sp
57 bool fp_safe = (fp <= thread->stack_base()) && (fp > sp);
58
59 // We know sp/unextended_sp are safe only fp is questionable here
60
61 // If the current frame is known to the code cache then we can attempt to
62 // to construct the sender and do some validation of it. This goes a long way
63 // toward eliminating issues when we get in frame construction code
64
65 if (_cb != NULL ) {
66
67 // First check if frame is complete and tester is reliable
68 // Unfortunately we can only check frame complete for runtime stubs and nmethod
69 // other generic buffer blobs are more problematic so we just assume they are
70 // ok. adapter blobs never have a frame complete and are never ok.
71
72 if (!_cb->is_frame_complete_at(_pc)) {
73 if (_cb->is_nmethod() || _cb->is_adapter_blob() || _cb->is_runtime_stub()) {
74 return false;
75 }
76 }
77 // Entry frame checks
78 if (is_entry_frame()) {
79 // an entry frame must have a valid fp.
80
81 if (!fp_safe) return false;
82
83 // Validate the JavaCallWrapper an entry frame must have
84
85 address jcw = (address)entry_frame_call_wrapper();
86
87 bool jcw_safe = (jcw <= thread->stack_base()) && ( jcw > fp);
88
89 return jcw_safe;
90
91 }
92
93 intptr_t* sender_sp = NULL;
94 address sender_pc = NULL;
95
96 if (is_interpreted_frame()) {
97 // fp must be safe
98 if (!fp_safe) {
99 return false;
100 }
101
102 sender_pc = (address) this->fp()[return_addr_offset];
103 sender_sp = (intptr_t*) addr_at(sender_sp_offset);
104
105 } else {
106 // must be some sort of compiled/runtime frame
107 // fp does not have to be safe (although it could be check for c1?)
108
109 sender_sp = _unextended_sp + _cb->frame_size();
110 // On Intel the return_address is always the word on the stack
111 sender_pc = (address) *(sender_sp-1);
112 }
113
114 // We must always be able to find a recognizable pc
115 CodeBlob* sender_blob = CodeCache::find_blob_unsafe(sender_pc);
116 if (sender_pc == NULL || sender_blob == NULL) {
117 return false;
118 }
119
120
121 // If the potential sender is the interpreter then we can do some more checking
122 if (Interpreter::contains(sender_pc)) {
123
124 // ebp is always saved in a recognizable place in any code we generate. However
125 // only if the sender is interpreted/call_stub (c1 too?) are we certain that the saved ebp
126 // is really a frame pointer.
127
128 intptr_t *saved_fp = (intptr_t*)*(sender_sp - frame::sender_sp_offset);
129 bool saved_fp_safe = ((address)saved_fp <= thread->stack_base()) && (saved_fp > sender_sp);
130
131 if (!saved_fp_safe) {
132 return false;
133 }
134
135 // construct the potential sender
136
137 frame sender(sender_sp, saved_fp, sender_pc);
138
139 return sender.is_interpreted_frame_valid(thread);
140
141 }
142
143 // Could just be some random pointer within the codeBlob
144 if (!sender_blob->code_contains(sender_pc)) {
145 return false;
146 }
147
148 // We should never be able to see an adapter if the current frame is something from code cache
149 if (sender_blob->is_adapter_blob()) {
150 return false;
151 }
152
153 // Could be the call_stub
154
155 if (StubRoutines::returns_to_call_stub(sender_pc)) {
156 intptr_t *saved_fp = (intptr_t*)*(sender_sp - frame::sender_sp_offset);
157 bool saved_fp_safe = ((address)saved_fp <= thread->stack_base()) && (saved_fp > sender_sp);
158
159 if (!saved_fp_safe) {
160 return false;
161 }
162
163 // construct the potential sender
164
165 frame sender(sender_sp, saved_fp, sender_pc);
166
167 // Validate the JavaCallWrapper an entry frame must have
168 address jcw = (address)sender.entry_frame_call_wrapper();
169
170 bool jcw_safe = (jcw <= thread->stack_base()) && ( jcw > (address)sender.fp());
171
172 return jcw_safe;
173 }
174
175 // If the frame size is 0 something is bad because every nmethod has a non-zero frame size
176 // because the return address counts against the callee's frame.
177
178 if (sender_blob->frame_size() == 0) {
179 assert(!sender_blob->is_nmethod(), "should count return address at least");
180 return false;
181 }
182
183 // We should never be able to see anything here except an nmethod. If something in the
184 // code cache (current frame) is called by an entity within the code cache that entity
185 // should not be anything but the call stub (already covered), the interpreter (already covered)
186 // or an nmethod.
187
188 assert(sender_blob->is_nmethod(), "Impossible call chain");
189
190 // Could put some more validation for the potential non-interpreted sender
191 // frame we'd create by calling sender if I could think of any. Wait for next crash in forte...
192
193 // One idea is seeing if the sender_pc we have is one that we'd expect to call to current cb
194
195 // We've validated the potential sender that would be created
196 return true;
197 }
198
199 // Must be native-compiled frame. Since sender will try and use fp to find
200 // linkages it must be safe
201
202 if (!fp_safe) {
203 return false;
204 }
205
206 // Will the pc we fetch be non-zero (which we'll find at the oldest frame)
207
208 if ( (address) this->fp()[return_addr_offset] == NULL) return false;
209
210
211 // could try and do some more potential verification of native frame if we could think of some...
212
213 return true;
214
215 }
216
217
218 void frame::patch_pc(Thread* thread, address pc) {
219 if (TracePcPatching) {
220 tty->print_cr("patch_pc at address" INTPTR_FORMAT " [" INTPTR_FORMAT " -> " INTPTR_FORMAT "] ",
221 &((address *)sp())[-1], ((address *)sp())[-1], pc);
222 }
223 ((address *)sp())[-1] = pc;
224 _cb = CodeCache::find_blob(pc);
225 address original_pc = nmethod::get_deopt_original_pc(this);
226 if (original_pc != NULL) {
227 assert(original_pc == _pc, "expected original PC to be stored before patching");
228 _deopt_state = is_deoptimized;
229 // leave _pc as is
230 } else {
231 _deopt_state = not_deoptimized;
232 _pc = pc;
233 }
234 }
235
236 bool frame::is_interpreted_frame() const {
237 return Interpreter::contains(pc());
238 }
239
240 int frame::frame_size(RegisterMap* map) const {
241 frame sender = this->sender(map);
242 return sender.sp() - sp();
243 }
244
245 intptr_t* frame::entry_frame_argument_at(int offset) const {
246 // convert offset to index to deal with tsi
247 int index = (Interpreter::expr_offset_in_bytes(offset)/wordSize);
248 // Entry frame's arguments are always in relation to unextended_sp()
249 return &unextended_sp()[index];
250 }
251
252 // sender_sp
253 #ifdef CC_INTERP
254 intptr_t* frame::interpreter_frame_sender_sp() const {
255 assert(is_interpreted_frame(), "interpreted frame expected");
256 // QQQ why does this specialize method exist if frame::sender_sp() does same thing?
257 // seems odd and if we always know interpreted vs. non then sender_sp() is really
258 // doing too much work.
259 return get_interpreterState()->sender_sp();
260 }
261
262 // monitor elements
263
264 BasicObjectLock* frame::interpreter_frame_monitor_begin() const {
265 return get_interpreterState()->monitor_base();
266 }
267
268 BasicObjectLock* frame::interpreter_frame_monitor_end() const {
269 return (BasicObjectLock*) get_interpreterState()->stack_base();
270 }
271
272 #else // CC_INTERP
273
274 intptr_t* frame::interpreter_frame_sender_sp() const {
275 assert(is_interpreted_frame(), "interpreted frame expected");
276 return (intptr_t*) at(interpreter_frame_sender_sp_offset);
277 }
278
279 void frame::set_interpreter_frame_sender_sp(intptr_t* sender_sp) {
280 assert(is_interpreted_frame(), "interpreted frame expected");
281 ptr_at_put(interpreter_frame_sender_sp_offset, (intptr_t) sender_sp);
282 }
283
284
285 // monitor elements
286
287 BasicObjectLock* frame::interpreter_frame_monitor_begin() const {
288 return (BasicObjectLock*) addr_at(interpreter_frame_monitor_block_bottom_offset);
289 }
290
291 BasicObjectLock* frame::interpreter_frame_monitor_end() const {
292 BasicObjectLock* result = (BasicObjectLock*) *addr_at(interpreter_frame_monitor_block_top_offset);
293 // make sure the pointer points inside the frame
294 assert(sp() <= (intptr_t*) result, "monitor end should be above the stack pointer");
295 assert((intptr_t*) result < fp(), "monitor end should be strictly below the frame pointer");
296 return result;
297 }
298
299 void frame::interpreter_frame_set_monitor_end(BasicObjectLock* value) {
300 *((BasicObjectLock**)addr_at(interpreter_frame_monitor_block_top_offset)) = value;
301 }
302
303 // Used by template based interpreter deoptimization
304 void frame::interpreter_frame_set_last_sp(intptr_t* sp) {
305 *((intptr_t**)addr_at(interpreter_frame_last_sp_offset)) = sp;
306 }
307 #endif // CC_INTERP
308
309 frame frame::sender_for_entry_frame(RegisterMap* map) const {
310 assert(map != NULL, "map must be set");
311 // Java frame called from C; skip all C frames and return top C
312 // frame of that chunk as the sender
313 JavaFrameAnchor* jfa = entry_frame_call_wrapper()->anchor();
314 assert(!entry_frame_is_first(), "next Java fp must be non zero");
315 assert(jfa->last_Java_sp() > sp(), "must be above this frame on stack");
316 map->clear();
317 assert(map->include_argument_oops(), "should be set by clear");
318 if (jfa->last_Java_pc() != NULL ) {
319 frame fr(jfa->last_Java_sp(), jfa->last_Java_fp(), jfa->last_Java_pc());
320 return fr;
321 }
322 frame fr(jfa->last_Java_sp(), jfa->last_Java_fp());
323 return fr;
324 }
325
326
327 //------------------------------------------------------------------------------
328 // frame::verify_deopt_original_pc
329 //
330 // Verifies the calculated original PC of a deoptimization PC for the
331 // given unextended SP. The unextended SP might also be the saved SP
332 // for MethodHandle call sites.
333 #if ASSERT
334 void frame::verify_deopt_original_pc(nmethod* nm, intptr_t* unextended_sp, bool is_method_handle_return) {
335 frame fr;
336
337 // This is ugly but it's better than to change {get,set}_original_pc
338 // to take an SP value as argument. And it's only a debugging
339 // method anyway.
340 fr._unextended_sp = unextended_sp;
341
342 address original_pc = nm->get_original_pc(&fr);
343 assert(nm->insts_contains(original_pc), "original PC must be in nmethod");
344 assert(nm->is_method_handle_return(original_pc) == is_method_handle_return, "must be");
345 }
346 #endif
347
348
349 //------------------------------------------------------------------------------
350 // frame::sender_for_interpreter_frame
351 frame frame::sender_for_interpreter_frame(RegisterMap* map) const {
352 // SP is the raw SP from the sender after adapter or interpreter
353 // extension.
354 intptr_t* sender_sp = this->sender_sp();
355
356 // This is the sp before any possible extension (adapter/locals).
357 intptr_t* unextended_sp = interpreter_frame_sender_sp();
358
359 // Stored FP.
360 intptr_t* saved_fp = link();
361
362 address sender_pc = this->sender_pc();
363 CodeBlob* sender_cb = CodeCache::find_blob_unsafe(sender_pc);
364 assert(sender_cb, "sanity");
365 nmethod* sender_nm = sender_cb->as_nmethod_or_null();
366
367 if (sender_nm != NULL) {
368 // If the sender PC is a deoptimization point, get the original
369 // PC. For MethodHandle call site the unextended_sp is stored in
370 // saved_fp.
371 if (sender_nm->is_deopt_mh_entry(sender_pc)) {
372 DEBUG_ONLY(verify_deopt_mh_original_pc(sender_nm, saved_fp));
373 unextended_sp = saved_fp;
374 }
375 else if (sender_nm->is_deopt_entry(sender_pc)) {
376 DEBUG_ONLY(verify_deopt_original_pc(sender_nm, unextended_sp));
377 }
378 else if (sender_nm->is_method_handle_return(sender_pc)) {
379 unextended_sp = saved_fp;
380 }
381 }
382
383 // The interpreter and compiler(s) always save EBP/RBP in a known
384 // location on entry. We must record where that location is
385 // so this if EBP/RBP was live on callout from c2 we can find
386 // the saved copy no matter what it called.
387
388 // Since the interpreter always saves EBP/RBP if we record where it is then
389 // we don't have to always save EBP/RBP on entry and exit to c2 compiled
390 // code, on entry will be enough.
391 #ifdef COMPILER2
392 if (map->update_map()) {
393 map->set_location(rbp->as_VMReg(), (address) addr_at(link_offset));
394 #ifdef AMD64
395 // this is weird "H" ought to be at a higher address however the
396 // oopMaps seems to have the "H" regs at the same address and the
397 // vanilla register.
398 // XXXX make this go away
399 if (true) {
400 map->set_location(rbp->as_VMReg()->next(), (address)addr_at(link_offset));
401 }
402 #endif // AMD64
403 }
404 #endif // COMPILER2
405
406 return frame(sender_sp, unextended_sp, saved_fp, sender_pc);
407 }
408
409
410 //------------------------------------------------------------------------------
411 // frame::sender_for_compiled_frame
412 frame frame::sender_for_compiled_frame(RegisterMap* map) const {
413 assert(map != NULL, "map must be set");
414
415 // frame owned by optimizing compiler
416 assert(_cb->frame_size() >= 0, "must have non-zero frame size");
417 intptr_t* sender_sp = unextended_sp() + _cb->frame_size();
418 intptr_t* unextended_sp = sender_sp;
419
420 // On Intel the return_address is always the word on the stack
421 address sender_pc = (address) *(sender_sp-1);
422
423 // This is the saved value of EBP which may or may not really be an FP.
424 // It is only an FP if the sender is an interpreter frame (or C1?).
425 intptr_t* saved_fp = (intptr_t*) *(sender_sp - frame::sender_sp_offset);
426
427 // If we are returning to a compiled MethodHandle call site, the
428 // saved_fp will in fact be a saved value of the unextended SP. The
429 // simplest way to tell whether we are returning to such a call site
430 // is as follows:
431 CodeBlob* sender_cb = CodeCache::find_blob_unsafe(sender_pc);
432 assert(sender_cb, "sanity");
433 nmethod* sender_nm = sender_cb->as_nmethod_or_null();
434
435 if (sender_nm != NULL) {
436 // If the sender PC is a deoptimization point, get the original
437 // PC. For MethodHandle call site the unextended_sp is stored in
438 // saved_fp.
439 if (sender_nm->is_deopt_mh_entry(sender_pc)) {
440 DEBUG_ONLY(verify_deopt_mh_original_pc(sender_nm, saved_fp));
441 unextended_sp = saved_fp;
442 }
443 else if (sender_nm->is_deopt_entry(sender_pc)) {
444 DEBUG_ONLY(verify_deopt_original_pc(sender_nm, unextended_sp));
445 }
446 else if (sender_nm->is_method_handle_return(sender_pc)) {
447 unextended_sp = saved_fp;
448 }
449 }
450
451 if (map->update_map()) {
452 // Tell GC to use argument oopmaps for some runtime stubs that need it.
453 // For C1, the runtime stub might not have oop maps, so set this flag
454 // outside of update_register_map.
455 map->set_include_argument_oops(_cb->caller_must_gc_arguments(map->thread()));
456 if (_cb->oop_maps() != NULL) {
457 OopMapSet::update_register_map(this, map);
458 }
459 // Since the prolog does the save and restore of EBP there is no oopmap
460 // for it so we must fill in its location as if there was an oopmap entry
461 // since if our caller was compiled code there could be live jvm state in it.
462 map->set_location(rbp->as_VMReg(), (address) (sender_sp - frame::sender_sp_offset));
463 #ifdef AMD64
464 // this is weird "H" ought to be at a higher address however the
465 // oopMaps seems to have the "H" regs at the same address and the
466 // vanilla register.
467 // XXXX make this go away
468 if (true) {
469 map->set_location(rbp->as_VMReg()->next(), (address) (sender_sp - frame::sender_sp_offset));
470 }
471 #endif // AMD64
472 }
473
474 assert(sender_sp != sp(), "must have changed");
475 return frame(sender_sp, unextended_sp, saved_fp, sender_pc);
476 }
477
478
479 //------------------------------------------------------------------------------
480 // frame::sender
481 frame frame::sender(RegisterMap* map) const {
482 // Default is we done have to follow them. The sender_for_xxx will
483 // update it accordingly
484 map->set_include_argument_oops(false);
485
486 if (is_entry_frame()) return sender_for_entry_frame(map);
487 if (is_interpreted_frame()) return sender_for_interpreter_frame(map);
488 assert(_cb == CodeCache::find_blob(pc()),"Must be the same");
489
490 if (_cb != NULL) {
491 return sender_for_compiled_frame(map);
492 }
493 // Must be native-compiled frame, i.e. the marshaling code for native
494 // methods that exists in the core system.
495 return frame(sender_sp(), link(), sender_pc());
496 }
497
498
499 bool frame::interpreter_frame_equals_unpacked_fp(intptr_t* fp) {
500 assert(is_interpreted_frame(), "must be interpreter frame");
501 methodOop method = interpreter_frame_method();
502 // When unpacking an optimized frame the frame pointer is
503 // adjusted with:
504 int diff = (method->max_locals() - method->size_of_parameters()) *
505 Interpreter::stackElementWords;
506 return _fp == (fp - diff);
507 }
508
509 void frame::pd_gc_epilog() {
510 // nothing done here now
511 }
512
513 bool frame::is_interpreted_frame_valid(JavaThread* thread) const {
514 // QQQ
515 #ifdef CC_INTERP
516 #else
517 assert(is_interpreted_frame(), "Not an interpreted frame");
518 // These are reasonable sanity checks
519 if (fp() == 0 || (intptr_t(fp()) & (wordSize-1)) != 0) {
520 return false;
521 }
522 if (sp() == 0 || (intptr_t(sp()) & (wordSize-1)) != 0) {
523 return false;
524 }
525 if (fp() + interpreter_frame_initial_sp_offset < sp()) {
526 return false;
527 }
528 // These are hacks to keep us out of trouble.
529 // The problem with these is that they mask other problems
530 if (fp() <= sp()) { // this attempts to deal with unsigned comparison above
531 return false;
532 }
533
534 // do some validation of frame elements
535
536 // first the method
537
538 methodOop m = *interpreter_frame_method_addr();
539
540 // validate the method we'd find in this potential sender
541 if (!Universe::heap()->is_valid_method(m)) return false;
542
543 // stack frames shouldn't be much larger than max_stack elements
544
545 if (fp() - sp() > 1024 + m->max_stack()*Interpreter::stackElementSize) {
546 return false;
547 }
548
549 // validate bci/bcx
550
551 intptr_t bcx = interpreter_frame_bcx();
552 if (m->validate_bci_from_bcx(bcx) < 0) {
553 return false;
554 }
555
556 // validate constantPoolCacheOop
557
558 constantPoolCacheOop cp = *interpreter_frame_cache_addr();
559
560 if (cp == NULL ||
561 !Space::is_aligned(cp) ||
562 !Universe::heap()->is_permanent((void*)cp)) return false;
563
564 // validate locals
565
566 address locals = (address) *interpreter_frame_locals_addr();
567
568 if (locals > thread->stack_base() || locals < (address) fp()) return false;
569
570 // We'd have to be pretty unlucky to be mislead at this point
571
572 #endif // CC_INTERP
573 return true;
574 }
575
576 BasicType frame::interpreter_frame_result(oop* oop_result, jvalue* value_result) {
577 #ifdef CC_INTERP
578 // Needed for JVMTI. The result should always be in the
579 // interpreterState object
580 interpreterState istate = get_interpreterState();
581 #endif // CC_INTERP
582 assert(is_interpreted_frame(), "interpreted frame expected");
583 methodOop method = interpreter_frame_method();
584 BasicType type = method->result_type();
585
586 intptr_t* tos_addr;
587 if (method->is_native()) {
588 // Prior to calling into the runtime to report the method_exit the possible
589 // return value is pushed to the native stack. If the result is a jfloat/jdouble
590 // then ST0 is saved before EAX/EDX. See the note in generate_native_result
591 tos_addr = (intptr_t*)sp();
592 if (type == T_FLOAT || type == T_DOUBLE) {
593 // QQQ seems like this code is equivalent on the two platforms
594 #ifdef AMD64
595 // This is times two because we do a push(ltos) after pushing XMM0
596 // and that takes two interpreter stack slots.
597 tos_addr += 2 * Interpreter::stackElementWords;
598 #else
599 tos_addr += 2;
600 #endif // AMD64
601 }
602 } else {
603 tos_addr = (intptr_t*)interpreter_frame_tos_address();
604 }
605
606 switch (type) {
607 case T_OBJECT :
608 case T_ARRAY : {
609 oop obj;
610 if (method->is_native()) {
611 #ifdef CC_INTERP
612 obj = istate->_oop_temp;
613 #else
614 obj = (oop) at(interpreter_frame_oop_temp_offset);
615 #endif // CC_INTERP
616 } else {
617 oop* obj_p = (oop*)tos_addr;
618 obj = (obj_p == NULL) ? (oop)NULL : *obj_p;
619 }
620 assert(obj == NULL || Universe::heap()->is_in(obj), "sanity check");
621 *oop_result = obj;
622 break;
623 }
624 case T_BOOLEAN : value_result->z = *(jboolean*)tos_addr; break;
625 case T_BYTE : value_result->b = *(jbyte*)tos_addr; break;
626 case T_CHAR : value_result->c = *(jchar*)tos_addr; break;
627 case T_SHORT : value_result->s = *(jshort*)tos_addr; break;
628 case T_INT : value_result->i = *(jint*)tos_addr; break;
629 case T_LONG : value_result->j = *(jlong*)tos_addr; break;
630 case T_FLOAT : {
631 #ifdef AMD64
632 value_result->f = *(jfloat*)tos_addr;
633 #else
634 if (method->is_native()) {
635 jdouble d = *(jdouble*)tos_addr; // Result was in ST0 so need to convert to jfloat
636 value_result->f = (jfloat)d;
637 } else {
638 value_result->f = *(jfloat*)tos_addr;
639 }
640 #endif // AMD64
641 break;
642 }
643 case T_DOUBLE : value_result->d = *(jdouble*)tos_addr; break;
644 case T_VOID : /* Nothing to do */ break;
645 default : ShouldNotReachHere();
646 }
647
648 return type;
649 }
650
651
652 intptr_t* frame::interpreter_frame_tos_at(jint offset) const {
653 int index = (Interpreter::expr_offset_in_bytes(offset)/wordSize);
654 return &interpreter_frame_tos_address()[index];
655 }