1 /*
2  * Copyright (c) 2008, 2018, Oracle and/or its affiliates. All rights reserved.
3  * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
4  *
5  * This code is free software; you can redistribute it and/or modify it
6  * under the terms of the GNU General Public License version 2 only, as
7  * published by the Free Software Foundation.
8  *
9  * This code is distributed in the hope that it will be useful, but WITHOUT
10  * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
11  * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
12  * version 2 for more details (a copy is included in the LICENSE file that
13  * accompanied this code).
14  *
15  * You should have received a copy of the GNU General Public License version
16  * 2 along with this work; if not, write to the Free Software Foundation,
17  * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
18  *
19  * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
20  * or visit www.oracle.com if you need additional information or have any
21  * questions.
22  *
23  */
24 
25 #include "precompiled.hpp"
26 #include "interpreter/interpreter.hpp"
27 #include "memory/resourceArea.hpp"
28 #include "oops/markOop.hpp"
29 #include "oops/method.hpp"
30 #include "oops/oop.inline.hpp"
31 #include "runtime/frame.inline.hpp"
32 #include "runtime/handles.inline.hpp"
33 #include "runtime/javaCalls.hpp"
34 #include "runtime/monitorChunk.hpp"
35 #include "runtime/signature.hpp"
36 #include "runtime/stubCodeGenerator.hpp"
37 #include "runtime/stubRoutines.hpp"
38 #include "vmreg_arm.inline.hpp"
39 #ifdef COMPILER1
40 #include "c1/c1_Runtime1.hpp"
41 #include "runtime/vframeArray.hpp"
42 #endif
43 #include "prims/methodHandles.hpp"
44 
45 #ifdef ASSERT
check_location_valid()46 void RegisterMap::check_location_valid() {
47 }
48 #endif
49 
50 
51 // Profiling/safepoint support
52 
safe_for_sender(JavaThread * thread)53 bool frame::safe_for_sender(JavaThread *thread) {
54   address   sp = (address)_sp;
55   address   fp = (address)_fp;
56   address   unextended_sp = (address)_unextended_sp;
57 
58   static size_t stack_guard_size = os::uses_stack_guard_pages() ?
59     (JavaThread::stack_red_zone_size() + JavaThread::stack_yellow_zone_size()) : 0;
60   size_t usable_stack_size = thread->stack_size() - stack_guard_size;
61 
62   // sp must be within the usable part of the stack (not in guards)
63   bool sp_safe = (sp != NULL &&
64                  (sp <= thread->stack_base()) &&
65                  (sp >= thread->stack_base() - usable_stack_size));
66 
67   if (!sp_safe) {
68     return false;
69   }
70 
71   bool unextended_sp_safe = (unextended_sp != NULL &&
72                              (unextended_sp <= thread->stack_base()) &&
73                              (unextended_sp >= sp));
74   if (!unextended_sp_safe) {
75     return false;
76   }
77 
78   // We know sp/unextended_sp are safe. Only fp is questionable here.
79 
80   bool fp_safe = (fp != NULL &&
81                   (fp <= thread->stack_base()) &&
82                   fp >= sp);
83 
84   if (_cb != NULL ) {
85 
86     // First check if frame is complete and tester is reliable
87     // Unfortunately we can only check frame complete for runtime stubs and nmethod
88     // other generic buffer blobs are more problematic so we just assume they are
89     // ok. adapter blobs never have a frame complete and are never ok.
90 
91     if (!_cb->is_frame_complete_at(_pc)) {
92       if (_cb->is_compiled() || _cb->is_adapter_blob() || _cb->is_runtime_stub()) {
93         return false;
94       }
95     }
96 
97     // Could just be some random pointer within the codeBlob
98     if (!_cb->code_contains(_pc)) {
99       return false;
100     }
101 
102     // Entry frame checks
103     if (is_entry_frame()) {
104       // an entry frame must have a valid fp.
105       return fp_safe && is_entry_frame_valid(thread);
106     }
107 
108     intptr_t* sender_sp = NULL;
109     address   sender_pc = NULL;
110 
111     if (is_interpreted_frame()) {
112       // fp must be safe
113       if (!fp_safe) {
114         return false;
115       }
116 
117       sender_pc = (address) this->fp()[return_addr_offset];
118       sender_sp = (intptr_t*) addr_at(sender_sp_offset);
119 
120     } else {
121       // must be some sort of compiled/runtime frame
122       // fp does not have to be safe (although it could be check for c1?)
123 
124       sender_sp = _unextended_sp + _cb->frame_size();
125       // Is sender_sp safe?
126       if ((address)sender_sp >= thread->stack_base()) {
127         return false;
128       }
129       // With our calling conventions, the return_address should
130       // end up being the word on the stack
131       sender_pc = (address) *(sender_sp - sender_sp_offset + return_addr_offset);
132     }
133 
134     // We must always be able to find a recognizable pc
135     CodeBlob* sender_blob = CodeCache::find_blob_unsafe(sender_pc);
136     if (sender_pc == NULL || sender_blob == NULL) {
137       return false;
138     }
139 
140 
141     // If the potential sender is the interpreter then we can do some more checking
142     if (Interpreter::contains(sender_pc)) {
143 
144       // FP is always saved in a recognizable place in any code we generate. However
145       // only if the sender is interpreted/call_stub (c1 too?) are we certain that the saved FP
146       // is really a frame pointer.
147 
148       intptr_t *saved_fp = (intptr_t*)*(sender_sp - frame::sender_sp_offset + link_offset);
149       bool saved_fp_safe = ((address)saved_fp <= thread->stack_base()) && (saved_fp > sender_sp);
150 
151       if (!saved_fp_safe) {
152         return false;
153       }
154 
155       // construct the potential sender
156 
157       frame sender(sender_sp, saved_fp, sender_pc);
158 
159       return sender.is_interpreted_frame_valid(thread);
160     }
161 
162     if (sender_blob->is_zombie() || sender_blob->is_unloaded()) {
163       return false;
164     }
165 
166     // Could just be some random pointer within the codeBlob
167     if (!sender_blob->code_contains(sender_pc)) {
168       return false;
169     }
170 
171     // We should never be able to see an adapter if the current frame is something from code cache
172     if (sender_blob->is_adapter_blob()) {
173       return false;
174     }
175 
176     // Could be the call_stub
177     if (StubRoutines::returns_to_call_stub(sender_pc)) {
178       intptr_t *saved_fp = (intptr_t*)*(sender_sp - frame::sender_sp_offset + link_offset);
179       bool saved_fp_safe = ((address)saved_fp <= thread->stack_base()) && (saved_fp >= sender_sp);
180 
181       if (!saved_fp_safe) {
182         return false;
183       }
184 
185       // construct the potential sender
186 
187       frame sender(sender_sp, saved_fp, sender_pc);
188 
189       // Validate the JavaCallWrapper an entry frame must have
190       address jcw = (address)sender.entry_frame_call_wrapper();
191 
192       bool jcw_safe = (jcw <= thread->stack_base()) && (jcw > (address)sender.fp());
193 
194       return jcw_safe;
195     }
196 
197     // If the frame size is 0 something (or less) is bad because every nmethod has a non-zero frame size
198     // because the return address counts against the callee's frame.
199 
200     if (sender_blob->frame_size() <= 0) {
201       assert(!sender_blob->is_compiled(), "should count return address at least");
202       return false;
203     }
204 
205     // We should never be able to see anything here except an nmethod. If something in the
206     // code cache (current frame) is called by an entity within the code cache that entity
207     // should not be anything but the call stub (already covered), the interpreter (already covered)
208     // or an nmethod.
209 
210     if (!sender_blob->is_compiled()) {
211       return false;
212     }
213 
214     // Could put some more validation for the potential non-interpreted sender
215     // frame we'd create by calling sender if I could think of any. Wait for next crash in forte...
216 
217     // One idea is seeing if the sender_pc we have is one that we'd expect to call to current cb
218 
219     // We've validated the potential sender that would be created
220     return true;
221   }
222 
223   // Must be native-compiled frame. Since sender will try and use fp to find
224   // linkages it must be safe
225 
226   if (!fp_safe) {
227     return false;
228   }
229 
230   // Will the pc we fetch be non-zero (which we'll find at the oldest frame)
231 
232   if ((address) this->fp()[return_addr_offset] == NULL) return false;
233 
234 
235   // could try and do some more potential verification of native frame if we could think of some...
236 
237   return true;
238 }
239 
240 
patch_pc(Thread * thread,address pc)241 void frame::patch_pc(Thread* thread, address pc) {
242   address* pc_addr = &((address *)sp())[-sender_sp_offset+return_addr_offset];
243   if (TracePcPatching) {
244     tty->print_cr("patch_pc at address" INTPTR_FORMAT " [" INTPTR_FORMAT " -> " INTPTR_FORMAT "] ",
245                   p2i(pc_addr), p2i(*pc_addr), p2i(pc));
246   }
247   *pc_addr = pc;
248   _cb = CodeCache::find_blob(pc);
249   address original_pc = CompiledMethod::get_deopt_original_pc(this);
250   if (original_pc != NULL) {
251     assert(original_pc == _pc, "expected original PC to be stored before patching");
252     _deopt_state = is_deoptimized;
253     // leave _pc as is
254   } else {
255     _deopt_state = not_deoptimized;
256     _pc = pc;
257   }
258 }
259 
is_interpreted_frame() const260 bool frame::is_interpreted_frame() const  {
261   return Interpreter::contains(pc());
262 }
263 
frame_size(RegisterMap * map) const264 int frame::frame_size(RegisterMap* map) const {
265   frame sender = this->sender(map);
266   return sender.sp() - sp();
267 }
268 
entry_frame_argument_at(int offset) const269 intptr_t* frame::entry_frame_argument_at(int offset) const {
270   assert(is_entry_frame(), "entry frame expected");
271   // convert offset to index to deal with tsi
272   int index = (Interpreter::expr_offset_in_bytes(offset)/wordSize);
273   // Entry frame's arguments are always in relation to unextended_sp()
274   return &unextended_sp()[index];
275 }
276 
277 // sender_sp
interpreter_frame_sender_sp() const278 intptr_t* frame::interpreter_frame_sender_sp() const {
279   assert(is_interpreted_frame(), "interpreted frame expected");
280   return (intptr_t*) at(interpreter_frame_sender_sp_offset);
281 }
282 
set_interpreter_frame_sender_sp(intptr_t * sender_sp)283 void frame::set_interpreter_frame_sender_sp(intptr_t* sender_sp) {
284   assert(is_interpreted_frame(), "interpreted frame expected");
285   ptr_at_put(interpreter_frame_sender_sp_offset, (intptr_t) sender_sp);
286 }
287 
288 
289 // monitor elements
290 
interpreter_frame_monitor_begin() const291 BasicObjectLock* frame::interpreter_frame_monitor_begin() const {
292   return (BasicObjectLock*) addr_at(interpreter_frame_monitor_block_bottom_offset);
293 }
294 
interpreter_frame_monitor_end() const295 BasicObjectLock* frame::interpreter_frame_monitor_end() const {
296   BasicObjectLock* result = (BasicObjectLock*) *addr_at(interpreter_frame_monitor_block_top_offset);
297   // make sure the pointer points inside the frame
298   assert((intptr_t) fp() >  (intptr_t) result, "result must <  than frame pointer");
299   assert((intptr_t) sp() <= (intptr_t) result, "result must >= than stack pointer");
300   return result;
301 }
302 
interpreter_frame_set_monitor_end(BasicObjectLock * value)303 void frame::interpreter_frame_set_monitor_end(BasicObjectLock* value) {
304   *((BasicObjectLock**)addr_at(interpreter_frame_monitor_block_top_offset)) = value;
305 }
306 
307 
308 // Used by template based interpreter deoptimization
interpreter_frame_set_last_sp(intptr_t * sp)309 void frame::interpreter_frame_set_last_sp(intptr_t* sp) {
310     *((intptr_t**)addr_at(interpreter_frame_last_sp_offset)) = sp;
311 }
312 
313 
sender_for_entry_frame(RegisterMap * map) const314 frame frame::sender_for_entry_frame(RegisterMap* map) const {
315   assert(map != NULL, "map must be set");
316   // Java frame called from C; skip all C frames and return top C
317   // frame of that chunk as the sender
318   JavaFrameAnchor* jfa = entry_frame_call_wrapper()->anchor();
319   assert(!entry_frame_is_first(), "next Java fp must be non zero");
320   assert(jfa->last_Java_sp() > sp(), "must be above this frame on stack");
321   map->clear();
322   assert(map->include_argument_oops(), "should be set by clear");
323   if (jfa->last_Java_pc() != NULL) {
324     frame fr(jfa->last_Java_sp(), jfa->last_Java_fp(), jfa->last_Java_pc());
325     return fr;
326   }
327   frame fr(jfa->last_Java_sp(), jfa->last_Java_fp());
328   return fr;
329 }
330 
331 //------------------------------------------------------------------------------
332 // frame::verify_deopt_original_pc
333 //
334 // Verifies the calculated original PC of a deoptimization PC for the
335 // given unextended SP.  The unextended SP might also be the saved SP
336 // for MethodHandle call sites.
337 #ifdef ASSERT
verify_deopt_original_pc(CompiledMethod * nm,intptr_t * unextended_sp,bool is_method_handle_return)338 void frame::verify_deopt_original_pc(CompiledMethod* nm, intptr_t* unextended_sp, bool is_method_handle_return) {
339   frame fr;
340 
341   // This is ugly but it's better than to change {get,set}_original_pc
342   // to take an SP value as argument.  And it's only a debugging
343   // method anyway.
344   fr._unextended_sp = unextended_sp;
345 
346   address original_pc = nm->get_original_pc(&fr);
347   assert(nm->insts_contains_inclusive(original_pc),
348          "original PC must be in the main code section of the the compiled method (or must be immediately following it)");
349   assert(nm->is_method_handle_return(original_pc) == is_method_handle_return, "must be");
350 }
351 #endif
352 
353 //------------------------------------------------------------------------------
354 // frame::adjust_unextended_sp
adjust_unextended_sp()355 void frame::adjust_unextended_sp() {
356   // same as on x86
357 
358   // If we are returning to a compiled MethodHandle call site, the
359   // saved_fp will in fact be a saved value of the unextended SP.  The
360   // simplest way to tell whether we are returning to such a call site
361   // is as follows:
362 
363   CompiledMethod* sender_cm = (_cb == NULL) ? NULL : _cb->as_compiled_method_or_null();
364   if (sender_cm != NULL) {
365     // If the sender PC is a deoptimization point, get the original
366     // PC.  For MethodHandle call site the unextended_sp is stored in
367     // saved_fp.
368     if (sender_cm->is_deopt_mh_entry(_pc)) {
369       DEBUG_ONLY(verify_deopt_mh_original_pc(sender_cm, _fp));
370       _unextended_sp = _fp;
371     }
372     else if (sender_cm->is_deopt_entry(_pc)) {
373       DEBUG_ONLY(verify_deopt_original_pc(sender_cm, _unextended_sp));
374     }
375     else if (sender_cm->is_method_handle_return(_pc)) {
376       _unextended_sp = _fp;
377     }
378   }
379 }
380 
381 //------------------------------------------------------------------------------
382 // frame::update_map_with_saved_link
update_map_with_saved_link(RegisterMap * map,intptr_t ** link_addr)383 void frame::update_map_with_saved_link(RegisterMap* map, intptr_t** link_addr) {
384   // see x86 for comments
385   map->set_location(FP->as_VMReg(), (address) link_addr);
386 }
387 
sender_for_interpreter_frame(RegisterMap * map) const388 frame frame::sender_for_interpreter_frame(RegisterMap* map) const {
389   // SP is the raw SP from the sender after adapter or interpreter
390   // extension.
391   intptr_t* sender_sp = this->sender_sp();
392 
393   // This is the sp before any possible extension (adapter/locals).
394   intptr_t* unextended_sp = interpreter_frame_sender_sp();
395 
396 #ifdef COMPILER2
397   if (map->update_map()) {
398     update_map_with_saved_link(map, (intptr_t**) addr_at(link_offset));
399   }
400 #endif // COMPILER2
401 
402   return frame(sender_sp, unextended_sp, link(), sender_pc());
403 }
404 
sender_for_compiled_frame(RegisterMap * map) const405 frame frame::sender_for_compiled_frame(RegisterMap* map) const {
406   assert(map != NULL, "map must be set");
407 
408   // frame owned by optimizing compiler
409   assert(_cb->frame_size() >= 0, "must have non-zero frame size");
410   intptr_t* sender_sp = unextended_sp() + _cb->frame_size();
411   intptr_t* unextended_sp = sender_sp;
412 
413   address sender_pc = (address) *(sender_sp - sender_sp_offset + return_addr_offset);
414 
415   // This is the saved value of FP which may or may not really be an FP.
416   // It is only an FP if the sender is an interpreter frame (or C1?).
417   intptr_t** saved_fp_addr = (intptr_t**) (sender_sp - sender_sp_offset + link_offset);
418 
419   if (map->update_map()) {
420     // Tell GC to use argument oopmaps for some runtime stubs that need it.
421     // For C1, the runtime stub might not have oop maps, so set this flag
422     // outside of update_register_map.
423     map->set_include_argument_oops(_cb->caller_must_gc_arguments(map->thread()));
424     if (_cb->oop_maps() != NULL) {
425       OopMapSet::update_register_map(this, map);
426     }
427 
428     // Since the prolog does the save and restore of FP there is no oopmap
429     // for it so we must fill in its location as if there was an oopmap entry
430     // since if our caller was compiled code there could be live jvm state in it.
431     update_map_with_saved_link(map, saved_fp_addr);
432   }
433 
434   assert(sender_sp != sp(), "must have changed");
435   return frame(sender_sp, unextended_sp, *saved_fp_addr, sender_pc);
436 }
437 
sender(RegisterMap * map) const438 frame frame::sender(RegisterMap* map) const {
439   // Default is we done have to follow them. The sender_for_xxx will
440   // update it accordingly
441   map->set_include_argument_oops(false);
442 
443   if (is_entry_frame())       return sender_for_entry_frame(map);
444   if (is_interpreted_frame()) return sender_for_interpreter_frame(map);
445   assert(_cb == CodeCache::find_blob(pc()),"Must be the same");
446 
447   if (_cb != NULL) {
448     return sender_for_compiled_frame(map);
449   }
450 
451   assert(false, "should not be called for a C frame");
452   return frame();
453 }
454 
is_interpreted_frame_valid(JavaThread * thread) const455 bool frame::is_interpreted_frame_valid(JavaThread* thread) const {
456   assert(is_interpreted_frame(), "Not an interpreted frame");
457   // These are reasonable sanity checks
458   if (fp() == 0 || (intptr_t(fp()) & (wordSize-1)) != 0) {
459     return false;
460   }
461   if (sp() == 0 || (intptr_t(sp()) & (wordSize-1)) != 0) {
462     return false;
463   }
464   if (fp() + interpreter_frame_initial_sp_offset < sp()) {
465     return false;
466   }
467   // These are hacks to keep us out of trouble.
468   // The problem with these is that they mask other problems
469   if (fp() <= sp()) {        // this attempts to deal with unsigned comparison above
470     return false;
471   }
472   // do some validation of frame elements
473 
474   // first the method
475 
476   Method* m = *interpreter_frame_method_addr();
477 
478   // validate the method we'd find in this potential sender
479   if (!Method::is_valid_method(m)) return false;
480 
481   // stack frames shouldn't be much larger than max_stack elements
482 
483   if (fp() - sp() > 1024 + m->max_stack()*Interpreter::stackElementSize) {
484     return false;
485   }
486 
487   // validate bci/bcp
488 
489   address bcp = interpreter_frame_bcp();
490   if (m->validate_bci_from_bcp(bcp) < 0) {
491     return false;
492   }
493 
494   // validate ConstantPoolCache*
495   ConstantPoolCache* cp = *interpreter_frame_cache_addr();
496   if (cp == NULL || !cp->is_metaspace_object()) return false;
497 
498   // validate locals
499 
500   address locals =  (address) *interpreter_frame_locals_addr();
501 
502   if (locals > thread->stack_base() || locals < (address) fp()) return false;
503 
504   // We'd have to be pretty unlucky to be mislead at this point
505 
506   return true;
507 }
508 
interpreter_frame_result(oop * oop_result,jvalue * value_result)509 BasicType frame::interpreter_frame_result(oop* oop_result, jvalue* value_result) {
510   assert(is_interpreted_frame(), "interpreted frame expected");
511   Method* method = interpreter_frame_method();
512   BasicType type = method->result_type();
513 
514   intptr_t* res_addr;
515   if (method->is_native()) {
516     // Prior to calling into the runtime to report the method_exit both of
517     // the possible return value registers are saved.
518     // Return value registers are pushed to the native stack
519     res_addr = (intptr_t*)sp();
520 #ifdef __ABI_HARD__
521     // FP result is pushed onto a stack along with integer result registers
522     if (type == T_FLOAT || type == T_DOUBLE) {
523       res_addr += 2;
524     }
525 #endif // __ABI_HARD__
526   } else {
527     res_addr = (intptr_t*)interpreter_frame_tos_address();
528   }
529 
530   switch (type) {
531     case T_OBJECT  :
532     case T_ARRAY   : {
533       oop obj;
534       if (method->is_native()) {
535         obj = cast_to_oop(at(interpreter_frame_oop_temp_offset));
536       } else {
537         obj = *(oop*)res_addr;
538       }
539       assert(obj == NULL || Universe::heap()->is_in(obj), "sanity check");
540       *oop_result = obj;
541       break;
542     }
543     case T_BOOLEAN : value_result->z = *(jboolean*)res_addr; break;
544     case T_BYTE    : value_result->b = *(jbyte*)res_addr; break;
545     case T_CHAR    : value_result->c = *(jchar*)res_addr; break;
546     case T_SHORT   : value_result->s = *(jshort*)res_addr; break;
547     case T_INT     : value_result->i = *(jint*)res_addr; break;
548     case T_LONG    : value_result->j = *(jlong*)res_addr; break;
549     case T_FLOAT   : value_result->f = *(jfloat*)res_addr; break;
550     case T_DOUBLE  : value_result->d = *(jdouble*)res_addr; break;
551     case T_VOID    : /* Nothing to do */ break;
552     default        : ShouldNotReachHere();
553   }
554 
555   return type;
556 }
557 
558 
interpreter_frame_tos_at(jint offset) const559 intptr_t* frame::interpreter_frame_tos_at(jint offset) const {
560   int index = (Interpreter::expr_offset_in_bytes(offset)/wordSize);
561   return &interpreter_frame_tos_address()[index];
562 }
563 
564 #ifndef PRODUCT
565 
566 #define DESCRIBE_FP_OFFSET(name) \
567   values.describe(frame_no, fp() + frame::name##_offset, #name)
568 
describe_pd(FrameValues & values,int frame_no)569 void frame::describe_pd(FrameValues& values, int frame_no) {
570   if (is_interpreted_frame()) {
571     DESCRIBE_FP_OFFSET(interpreter_frame_sender_sp);
572     DESCRIBE_FP_OFFSET(interpreter_frame_last_sp);
573     DESCRIBE_FP_OFFSET(interpreter_frame_method);
574     DESCRIBE_FP_OFFSET(interpreter_frame_mdp);
575     DESCRIBE_FP_OFFSET(interpreter_frame_cache);
576     DESCRIBE_FP_OFFSET(interpreter_frame_locals);
577     DESCRIBE_FP_OFFSET(interpreter_frame_bcp);
578     DESCRIBE_FP_OFFSET(interpreter_frame_initial_sp);
579   }
580 }
581 
582 // This is a generic constructor which is only used by pns() in debug.cpp.
frame(void * sp,void * fp,void * pc)583 frame::frame(void* sp, void* fp, void* pc) {
584   init((intptr_t*)sp, (intptr_t*)fp, (address)pc);
585 }
586 
pd_ps()587 void frame::pd_ps() {}
588 #endif
589 
initial_deoptimization_info()590 intptr_t *frame::initial_deoptimization_info() {
591   // used to reset the saved FP
592   return fp();
593 }
594 
real_fp() const595 intptr_t* frame::real_fp() const {
596   if (is_entry_frame()) {
597     // Work-around: FP (currently) does not conform to the ABI for entry
598     // frames (see generate_call_stub). Might be worth fixing as another CR.
599     // Following code assumes (and asserts) this has not yet been fixed.
600     assert(frame::entry_frame_call_wrapper_offset == 0, "adjust this code");
601     intptr_t* new_fp = fp();
602     new_fp += 5; // saved R0,R1,R2,R4,R10
603 #ifndef __SOFTFP__
604     new_fp += 8*2; // saved D8..D15
605 #endif
606     return new_fp;
607   }
608   if (_cb != NULL) {
609     // use the frame size if valid
610     int size = _cb->frame_size();
611     if (size > 0) {
612       return unextended_sp() + size;
613     }
614   }
615   // else rely on fp()
616   assert(! is_compiled_frame(), "unknown compiled frame size");
617   return fp();
618 }
619