1 /*
2  * Copyright (c) 1998, 2018, Oracle and/or its affiliates. All rights reserved.
3  * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
4  *
5  * This code is free software; you can redistribute it and/or modify it
6  * under the terms of the GNU General Public License version 2 only, as
7  * published by the Free Software Foundation.
8  *
9  * This code is distributed in the hope that it will be useful, but WITHOUT
10  * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
11  * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
12  * version 2 for more details (a copy is included in the LICENSE file that
13  * accompanied this code).
14  *
15  * You should have received a copy of the GNU General Public License version
16  * 2 along with this work; if not, write to the Free Software Foundation,
17  * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
18  *
19  * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
20  * or visit www.oracle.com if you need additional information or have any
21  * questions.
22  *
23  */
24 
25 #include "precompiled.hpp"
26 #include "classfile/classFileStream.hpp"
27 #include "classfile/javaClasses.hpp"
28 #include "classfile/stackMapTable.hpp"
29 #include "classfile/stackMapFrame.hpp"
30 #include "classfile/stackMapTableFormat.hpp"
31 #include "classfile/systemDictionary.hpp"
32 #include "classfile/verifier.hpp"
33 #include "classfile/vmSymbols.hpp"
34 #include "interpreter/bytecodes.hpp"
35 #include "interpreter/bytecodeStream.hpp"
36 #include "memory/oopFactory.hpp"
37 #include "memory/resourceArea.hpp"
38 #include "oops/instanceKlass.hpp"
39 #include "oops/oop.inline.hpp"
40 #include "oops/typeArrayOop.hpp"
41 #include "prims/jvm.h"
42 #include "runtime/fieldDescriptor.hpp"
43 #include "runtime/handles.inline.hpp"
44 #include "runtime/interfaceSupport.hpp"
45 #include "runtime/javaCalls.hpp"
46 #include "runtime/orderAccess.inline.hpp"
47 #include "runtime/os.hpp"
48 #ifdef TARGET_ARCH_x86
49 # include "bytes_x86.hpp"
50 #endif
51 #ifdef TARGET_ARCH_aarch64
52 # include "bytes_aarch64.hpp"
53 #endif
54 #ifdef TARGET_ARCH_sparc
55 # include "bytes_sparc.hpp"
56 #endif
57 #ifdef TARGET_ARCH_zero
58 # include "bytes_zero.hpp"
59 #endif
60 #ifdef TARGET_ARCH_arm
61 # include "bytes_arm.hpp"
62 #endif
63 #ifdef TARGET_ARCH_ppc
64 # include "bytes_ppc.hpp"
65 #endif
66 
67 #define NOFAILOVER_MAJOR_VERSION                       51
68 #define NONZERO_PADDING_BYTES_IN_SWITCH_MAJOR_VERSION  51
69 #define STATIC_METHOD_IN_INTERFACE_MAJOR_VERSION       52
70 
71 // Access to external entry for VerifyClassCodes - old byte code verifier
72 
73 extern "C" {
74   typedef jboolean (*verify_byte_codes_fn_t)(JNIEnv *, jclass, char *, jint);
75   typedef jboolean (*verify_byte_codes_fn_new_t)(JNIEnv *, jclass, char *, jint, jint);
76 }
77 
78 static void* volatile _verify_byte_codes_fn = NULL;
79 
80 static volatile jint _is_new_verify_byte_codes_fn = (jint) true;
81 
verify_byte_codes_fn()82 static void* verify_byte_codes_fn() {
83   if (_verify_byte_codes_fn == NULL) {
84     void *lib_handle = os::native_java_library();
85     void *func = os::dll_lookup(lib_handle, "VerifyClassCodesForMajorVersion");
86     OrderAccess::release_store_ptr(&_verify_byte_codes_fn, func);
87     if (func == NULL) {
88       OrderAccess::release_store(&_is_new_verify_byte_codes_fn, false);
89       func = os::dll_lookup(lib_handle, "VerifyClassCodes");
90       OrderAccess::release_store_ptr(&_verify_byte_codes_fn, func);
91     }
92   }
93   return (void*)_verify_byte_codes_fn;
94 }
95 
96 
97 // Methods in Verifier
98 
should_verify_for(oop class_loader,bool should_verify_class)99 bool Verifier::should_verify_for(oop class_loader, bool should_verify_class) {
100   return (class_loader == NULL || !should_verify_class) ?
101     BytecodeVerificationLocal : BytecodeVerificationRemote;
102 }
103 
relax_access_for(oop loader)104 bool Verifier::relax_access_for(oop loader) {
105   bool trusted = java_lang_ClassLoader::is_trusted_loader(loader);
106   bool need_verify =
107     // verifyAll
108     (BytecodeVerificationLocal && BytecodeVerificationRemote) ||
109     // verifyRemote
110     (!BytecodeVerificationLocal && BytecodeVerificationRemote && !trusted);
111   return !need_verify;
112 }
113 
verify(instanceKlassHandle klass,Verifier::Mode mode,bool should_verify_class,TRAPS)114 bool Verifier::verify(instanceKlassHandle klass, Verifier::Mode mode, bool should_verify_class, TRAPS) {
115   HandleMark hm;
116   ResourceMark rm(THREAD);
117 
118   Symbol* exception_name = NULL;
119   const size_t message_buffer_len = klass->name()->utf8_length() + 1024;
120   char* message_buffer = NEW_RESOURCE_ARRAY(char, message_buffer_len);
121   char* exception_message = message_buffer;
122 
123   const char* klassName = klass->external_name();
124   bool can_failover = FailOverToOldVerifier &&
125       klass->major_version() < NOFAILOVER_MAJOR_VERSION;
126 
127   // If the class should be verified, first see if we can use the split
128   // verifier.  If not, or if verification fails and FailOverToOldVerifier
129   // is set, then call the inference verifier.
130   if (is_eligible_for_verification(klass, should_verify_class)) {
131     if (TraceClassInitialization) {
132       tty->print_cr("Start class verification for: %s", klassName);
133     }
134     if (klass->major_version() >= STACKMAP_ATTRIBUTE_MAJOR_VERSION) {
135       ClassVerifier split_verifier(klass, THREAD);
136       split_verifier.verify_class(THREAD);
137       exception_name = split_verifier.result();
138       if (can_failover && !HAS_PENDING_EXCEPTION &&
139           (exception_name == vmSymbols::java_lang_VerifyError() ||
140            exception_name == vmSymbols::java_lang_ClassFormatError())) {
141         if (TraceClassInitialization || VerboseVerification) {
142           tty->print_cr(
143             "Fail over class verification to old verifier for: %s", klassName);
144         }
145         exception_name = inference_verify(
146           klass, message_buffer, message_buffer_len, THREAD);
147       }
148       if (exception_name != NULL) {
149         exception_message = split_verifier.exception_message();
150       }
151     } else {
152       exception_name = inference_verify(
153           klass, message_buffer, message_buffer_len, THREAD);
154     }
155 
156     if (TraceClassInitialization || VerboseVerification) {
157       if (HAS_PENDING_EXCEPTION) {
158         tty->print("Verification for %s has", klassName);
159         tty->print_cr(" exception pending %s ",
160           InstanceKlass::cast(PENDING_EXCEPTION->klass())->external_name());
161       } else if (exception_name != NULL) {
162         tty->print_cr("Verification for %s failed", klassName);
163       }
164       tty->print_cr("End class verification for: %s", klassName);
165     }
166   }
167 
168   if (HAS_PENDING_EXCEPTION) {
169     return false; // use the existing exception
170   } else if (exception_name == NULL) {
171     return true; // verifcation succeeded
172   } else { // VerifyError or ClassFormatError to be created and thrown
173     ResourceMark rm(THREAD);
174     instanceKlassHandle kls =
175       SystemDictionary::resolve_or_fail(exception_name, true, CHECK_false);
176     while (!kls.is_null()) {
177       if (kls == klass) {
178         // If the class being verified is the exception we're creating
179         // or one of it's superclasses, we're in trouble and are going
180         // to infinitely recurse when we try to initialize the exception.
181         // So bail out here by throwing the preallocated VM error.
182         THROW_OOP_(Universe::virtual_machine_error_instance(), false);
183       }
184       kls = kls->super();
185     }
186     message_buffer[message_buffer_len - 1] = '\0'; // just to be sure
187     THROW_MSG_(exception_name, exception_message, false);
188   }
189 }
190 
is_eligible_for_verification(instanceKlassHandle klass,bool should_verify_class)191 bool Verifier::is_eligible_for_verification(instanceKlassHandle klass, bool should_verify_class) {
192   Symbol* name = klass->name();
193   Klass* refl_magic_klass = SystemDictionary::reflect_MagicAccessorImpl_klass();
194 
195   bool is_reflect = refl_magic_klass != NULL && klass->is_subtype_of(refl_magic_klass);
196 
197   return (should_verify_for(klass->class_loader(), should_verify_class) &&
198     // return if the class is a bootstrapping class
199     // or defineClass specified not to verify by default (flags override passed arg)
200     // We need to skip the following four for bootstraping
201     name != vmSymbols::java_lang_Object() &&
202     name != vmSymbols::java_lang_Class() &&
203     name != vmSymbols::java_lang_String() &&
204     name != vmSymbols::java_lang_Throwable() &&
205 
206     // Can not verify the bytecodes for shared classes because they have
207     // already been rewritten to contain constant pool cache indices,
208     // which the verifier can't understand.
209     // Shared classes shouldn't have stackmaps either.
210     !klass()->is_shared() &&
211 
212     // As of the fix for 4486457 we disable verification for all of the
213     // dynamically-generated bytecodes associated with the 1.4
214     // reflection implementation, not just those associated with
215     // sun/reflect/SerializationConstructorAccessor.
216     // NOTE: this is called too early in the bootstrapping process to be
217     // guarded by Universe::is_gte_jdk14x_version()/UseNewReflection.
218     // Also for lambda generated code, gte jdk8
219     (!is_reflect || VerifyReflectionBytecodes));
220 }
221 
inference_verify(instanceKlassHandle klass,char * message,size_t message_len,TRAPS)222 Symbol* Verifier::inference_verify(
223     instanceKlassHandle klass, char* message, size_t message_len, TRAPS) {
224   JavaThread* thread = (JavaThread*)THREAD;
225   JNIEnv *env = thread->jni_environment();
226 
227   void* verify_func = verify_byte_codes_fn();
228 
229   if (verify_func == NULL) {
230     jio_snprintf(message, message_len, "Could not link verifier");
231     return vmSymbols::java_lang_VerifyError();
232   }
233 
234   ResourceMark rm(THREAD);
235   if (VerboseVerification) {
236     tty->print_cr("Verifying class %s with old format", klass->external_name());
237   }
238 
239   jclass cls = (jclass) JNIHandles::make_local(env, klass->java_mirror());
240   jint result;
241 
242   {
243     HandleMark hm(thread);
244     ThreadToNativeFromVM ttn(thread);
245     // ThreadToNativeFromVM takes care of changing thread_state, so safepoint
246     // code knows that we have left the VM
247 
248     if (_is_new_verify_byte_codes_fn) {
249       verify_byte_codes_fn_new_t func =
250         CAST_TO_FN_PTR(verify_byte_codes_fn_new_t, verify_func);
251       result = (*func)(env, cls, message, (int)message_len,
252           klass->major_version());
253     } else {
254       verify_byte_codes_fn_t func =
255         CAST_TO_FN_PTR(verify_byte_codes_fn_t, verify_func);
256       result = (*func)(env, cls, message, (int)message_len);
257     }
258   }
259 
260   JNIHandles::destroy_local(cls);
261 
262   // These numbers are chosen so that VerifyClassCodes interface doesn't need
263   // to be changed (still return jboolean (unsigned char)), and result is
264   // 1 when verification is passed.
265   if (result == 0) {
266     return vmSymbols::java_lang_VerifyError();
267   } else if (result == 1) {
268     return NULL; // verified.
269   } else if (result == 2) {
270     THROW_MSG_(vmSymbols::java_lang_OutOfMemoryError(), message, NULL);
271   } else if (result == 3) {
272     return vmSymbols::java_lang_ClassFormatError();
273   } else {
274     ShouldNotReachHere();
275     return NULL;
276   }
277 }
278 
null()279 TypeOrigin TypeOrigin::null() {
280   return TypeOrigin();
281 }
local(u2 index,StackMapFrame * frame)282 TypeOrigin TypeOrigin::local(u2 index, StackMapFrame* frame) {
283   assert(frame != NULL, "Must have a frame");
284   return TypeOrigin(CF_LOCALS, index, StackMapFrame::copy(frame),
285      frame->local_at(index));
286 }
stack(u2 index,StackMapFrame * frame)287 TypeOrigin TypeOrigin::stack(u2 index, StackMapFrame* frame) {
288   assert(frame != NULL, "Must have a frame");
289   return TypeOrigin(CF_STACK, index, StackMapFrame::copy(frame),
290       frame->stack_at(index));
291 }
sm_local(u2 index,StackMapFrame * frame)292 TypeOrigin TypeOrigin::sm_local(u2 index, StackMapFrame* frame) {
293   assert(frame != NULL, "Must have a frame");
294   return TypeOrigin(SM_LOCALS, index, StackMapFrame::copy(frame),
295       frame->local_at(index));
296 }
sm_stack(u2 index,StackMapFrame * frame)297 TypeOrigin TypeOrigin::sm_stack(u2 index, StackMapFrame* frame) {
298   assert(frame != NULL, "Must have a frame");
299   return TypeOrigin(SM_STACK, index, StackMapFrame::copy(frame),
300       frame->stack_at(index));
301 }
bad_index(u2 index)302 TypeOrigin TypeOrigin::bad_index(u2 index) {
303   return TypeOrigin(BAD_INDEX, index, NULL, VerificationType::bogus_type());
304 }
cp(u2 index,VerificationType vt)305 TypeOrigin TypeOrigin::cp(u2 index, VerificationType vt) {
306   return TypeOrigin(CONST_POOL, index, NULL, vt);
307 }
signature(VerificationType vt)308 TypeOrigin TypeOrigin::signature(VerificationType vt) {
309   return TypeOrigin(SIG, 0, NULL, vt);
310 }
implicit(VerificationType t)311 TypeOrigin TypeOrigin::implicit(VerificationType t) {
312   return TypeOrigin(IMPLICIT, 0, NULL, t);
313 }
frame(StackMapFrame * frame)314 TypeOrigin TypeOrigin::frame(StackMapFrame* frame) {
315   return TypeOrigin(FRAME_ONLY, 0, StackMapFrame::copy(frame),
316                     VerificationType::bogus_type());
317 }
318 
reset_frame()319 void TypeOrigin::reset_frame() {
320   if (_frame != NULL) {
321     _frame->restore();
322   }
323 }
324 
details(outputStream * ss) const325 void TypeOrigin::details(outputStream* ss) const {
326   _type.print_on(ss);
327   switch (_origin) {
328     case CF_LOCALS:
329       ss->print(" (current frame, locals[%d])", _index);
330       break;
331     case CF_STACK:
332       ss->print(" (current frame, stack[%d])", _index);
333       break;
334     case SM_LOCALS:
335       ss->print(" (stack map, locals[%d])", _index);
336       break;
337     case SM_STACK:
338       ss->print(" (stack map, stack[%d])", _index);
339       break;
340     case CONST_POOL:
341       ss->print(" (constant pool %d)", _index);
342       break;
343     case SIG:
344       ss->print(" (from method signature)");
345       break;
346     case IMPLICIT:
347     case FRAME_ONLY:
348     case NONE:
349     default:
350       ;
351   }
352 }
353 
354 #ifdef ASSERT
print_on(outputStream * str) const355 void TypeOrigin::print_on(outputStream* str) const {
356   str->print("{%d,%d,%p:", _origin, _index, _frame);
357   if (_frame != NULL) {
358     _frame->print_on(str);
359   } else {
360     str->print("null");
361   }
362   str->print(",");
363   _type.print_on(str);
364   str->print("}");
365 }
366 #endif
367 
details(outputStream * ss,const Method * method) const368 void ErrorContext::details(outputStream* ss, const Method* method) const {
369   if (is_valid()) {
370     ss->cr();
371     ss->print_cr("Exception Details:");
372     location_details(ss, method);
373     reason_details(ss);
374     frame_details(ss);
375     bytecode_details(ss, method);
376     handler_details(ss, method);
377     stackmap_details(ss, method);
378   }
379 }
380 
reason_details(outputStream * ss) const381 void ErrorContext::reason_details(outputStream* ss) const {
382   streamIndentor si(ss);
383   ss->indent().print_cr("Reason:");
384   streamIndentor si2(ss);
385   ss->indent().print("%s", "");
386   switch (_fault) {
387     case INVALID_BYTECODE:
388       ss->print("Error exists in the bytecode");
389       break;
390     case WRONG_TYPE:
391       if (_expected.is_valid()) {
392         ss->print("Type ");
393         _type.details(ss);
394         ss->print(" is not assignable to ");
395         _expected.details(ss);
396       } else {
397         ss->print("Invalid type: ");
398         _type.details(ss);
399       }
400       break;
401     case FLAGS_MISMATCH:
402       if (_expected.is_valid()) {
403         ss->print("Current frame's flags are not assignable "
404                   "to stack map frame's.");
405       } else {
406         ss->print("Current frame's flags are invalid in this context.");
407       }
408       break;
409     case BAD_CP_INDEX:
410       ss->print("Constant pool index %d is invalid", _type.index());
411       break;
412     case BAD_LOCAL_INDEX:
413       ss->print("Local index %d is invalid", _type.index());
414       break;
415     case LOCALS_SIZE_MISMATCH:
416       ss->print("Current frame's local size doesn't match stackmap.");
417       break;
418     case STACK_SIZE_MISMATCH:
419       ss->print("Current frame's stack size doesn't match stackmap.");
420       break;
421     case STACK_OVERFLOW:
422       ss->print("Exceeded max stack size.");
423       break;
424     case STACK_UNDERFLOW:
425       ss->print("Attempt to pop empty stack.");
426       break;
427     case MISSING_STACKMAP:
428       ss->print("Expected stackmap frame at this location.");
429       break;
430     case BAD_STACKMAP:
431       ss->print("Invalid stackmap specification.");
432       break;
433     case UNKNOWN:
434     default:
435       ShouldNotReachHere();
436       ss->print_cr("Unknown");
437   }
438   ss->cr();
439 }
440 
location_details(outputStream * ss,const Method * method) const441 void ErrorContext::location_details(outputStream* ss, const Method* method) const {
442   if (_bci != -1 && method != NULL) {
443     streamIndentor si(ss);
444     const char* bytecode_name = "<invalid>";
445     if (method->validate_bci_from_bcx(_bci) != -1) {
446       Bytecodes::Code code = Bytecodes::code_or_bp_at(method->bcp_from(_bci));
447       if (Bytecodes::is_defined(code)) {
448           bytecode_name = Bytecodes::name(code);
449       } else {
450           bytecode_name = "<illegal>";
451       }
452     }
453     InstanceKlass* ik = method->method_holder();
454     ss->indent().print_cr("Location:");
455     streamIndentor si2(ss);
456     ss->indent().print_cr("%s.%s%s @%d: %s",
457         ik->name()->as_C_string(), method->name()->as_C_string(),
458         method->signature()->as_C_string(), _bci, bytecode_name);
459   }
460 }
461 
frame_details(outputStream * ss) const462 void ErrorContext::frame_details(outputStream* ss) const {
463   streamIndentor si(ss);
464   if (_type.is_valid() && _type.frame() != NULL) {
465     ss->indent().print_cr("Current Frame:");
466     streamIndentor si2(ss);
467     _type.frame()->print_on(ss);
468   }
469   if (_expected.is_valid() && _expected.frame() != NULL) {
470     ss->indent().print_cr("Stackmap Frame:");
471     streamIndentor si2(ss);
472     _expected.frame()->print_on(ss);
473   }
474 }
475 
bytecode_details(outputStream * ss,const Method * method) const476 void ErrorContext::bytecode_details(outputStream* ss, const Method* method) const {
477   if (method != NULL) {
478     streamIndentor si(ss);
479     ss->indent().print_cr("Bytecode:");
480     streamIndentor si2(ss);
481     ss->print_data(method->code_base(), method->code_size(), false);
482   }
483 }
484 
handler_details(outputStream * ss,const Method * method) const485 void ErrorContext::handler_details(outputStream* ss, const Method* method) const {
486   if (method != NULL) {
487     streamIndentor si(ss);
488     ExceptionTable table(method);
489     if (table.length() > 0) {
490       ss->indent().print_cr("Exception Handler Table:");
491       streamIndentor si2(ss);
492       for (int i = 0; i < table.length(); ++i) {
493         ss->indent().print_cr("bci [%d, %d] => handler: %d", table.start_pc(i),
494             table.end_pc(i), table.handler_pc(i));
495       }
496     }
497   }
498 }
499 
stackmap_details(outputStream * ss,const Method * method) const500 void ErrorContext::stackmap_details(outputStream* ss, const Method* method) const {
501   if (method != NULL && method->has_stackmap_table()) {
502     streamIndentor si(ss);
503     ss->indent().print_cr("Stackmap Table:");
504     Array<u1>* data = method->stackmap_data();
505     stack_map_table* sm_table =
506         stack_map_table::at((address)data->adr_at(0));
507     stack_map_frame* sm_frame = sm_table->entries();
508     streamIndentor si2(ss);
509     int current_offset = -1;
510     address end_of_sm_table = (address)sm_table + method->stackmap_data()->length();
511     for (u2 i = 0; i < sm_table->number_of_entries(); ++i) {
512       ss->indent();
513       if (!sm_frame->verify((address)sm_frame, end_of_sm_table)) {
514         sm_frame->print_truncated(ss, current_offset);
515         return;
516       }
517       sm_frame->print_on(ss, current_offset);
518       ss->cr();
519       current_offset += sm_frame->offset_delta();
520       sm_frame = sm_frame->next();
521     }
522   }
523 }
524 
525 // Methods in ClassVerifier
526 
ClassVerifier(instanceKlassHandle klass,TRAPS)527 ClassVerifier::ClassVerifier(
528     instanceKlassHandle klass, TRAPS)
529     : _thread(THREAD), _exception_type(NULL), _message(NULL), _klass(klass) {
530   _this_type = VerificationType::reference_type(klass->name());
531   // Create list to hold symbols in reference area.
532   _symbols = new GrowableArray<Symbol*>(100, 0, NULL);
533 }
534 
~ClassVerifier()535 ClassVerifier::~ClassVerifier() {
536   // Decrement the reference count for any symbols created.
537   for (int i = 0; i < _symbols->length(); i++) {
538     Symbol* s = _symbols->at(i);
539     s->decrement_refcount();
540   }
541 }
542 
object_type() const543 VerificationType ClassVerifier::object_type() const {
544   return VerificationType::reference_type(vmSymbols::java_lang_Object());
545 }
546 
ref_ctx(const char * sig,TRAPS)547 TypeOrigin ClassVerifier::ref_ctx(const char* sig, TRAPS) {
548   VerificationType vt = VerificationType::reference_type(
549       create_temporary_symbol(sig, (int)strlen(sig), THREAD));
550   return TypeOrigin::implicit(vt);
551 }
552 
verify_class(TRAPS)553 void ClassVerifier::verify_class(TRAPS) {
554   if (VerboseVerification) {
555     tty->print_cr("Verifying class %s with new format",
556       _klass->external_name());
557   }
558 
559   Array<Method*>* methods = _klass->methods();
560   int num_methods = methods->length();
561 
562   for (int index = 0; index < num_methods; index++) {
563     // Check for recursive re-verification before each method.
564     if (was_recursively_verified())  return;
565 
566     Method* m = methods->at(index);
567     if (m->is_native() || m->is_abstract() || m->is_overpass()) {
568       // If m is native or abstract, skip it.  It is checked in class file
569       // parser that methods do not override a final method.  Overpass methods
570       // are trusted since the VM generates them.
571       continue;
572     }
573     verify_method(methodHandle(THREAD, m), CHECK_VERIFY(this));
574   }
575 
576   if (VerboseVerification || TraceClassInitialization) {
577     if (was_recursively_verified())
578       tty->print_cr("Recursive verification detected for: %s",
579           _klass->external_name());
580   }
581 }
582 
verify_method(methodHandle m,TRAPS)583 void ClassVerifier::verify_method(methodHandle m, TRAPS) {
584   HandleMark hm(THREAD);
585   _method = m;   // initialize _method
586   if (VerboseVerification) {
587     tty->print_cr("Verifying method %s", m->name_and_sig_as_C_string());
588   }
589 
590 // For clang, the only good constant format string is a literal constant format string.
591 #define bad_type_msg "Bad type on operand stack in %s"
592 
593   int32_t max_stack = m->verifier_max_stack();
594   int32_t max_locals = m->max_locals();
595   constantPoolHandle cp(THREAD, m->constants());
596 
597   if (!SignatureVerifier::is_valid_method_signature(m->signature())) {
598     class_format_error("Invalid method signature");
599     return;
600   }
601 
602   // Initial stack map frame: offset is 0, stack is initially empty.
603   StackMapFrame current_frame(max_locals, max_stack, this);
604   // Set initial locals
605   VerificationType return_type = current_frame.set_locals_from_arg(
606     m, current_type(), CHECK_VERIFY(this));
607 
608   int32_t stackmap_index = 0; // index to the stackmap array
609 
610   u4 code_length = m->code_size();
611 
612   // Scan the bytecode and map each instruction's start offset to a number.
613   char* code_data = generate_code_data(m, code_length, CHECK_VERIFY(this));
614 
615   int ex_min = code_length;
616   int ex_max = -1;
617   // Look through each item on the exception table. Each of the fields must refer
618   // to a legal instruction.
619   verify_exception_handler_table(
620     code_length, code_data, ex_min, ex_max, CHECK_VERIFY(this));
621 
622   // Look through each entry on the local variable table and make sure
623   // its range of code array offsets is valid. (4169817)
624   if (m->has_localvariable_table()) {
625     verify_local_variable_table(code_length, code_data, CHECK_VERIFY(this));
626   }
627 
628   Array<u1>* stackmap_data = m->stackmap_data();
629   StackMapStream stream(stackmap_data);
630   StackMapReader reader(this, &stream, code_data, code_length, THREAD);
631   StackMapTable stackmap_table(&reader, &current_frame, max_locals, max_stack,
632                                code_data, code_length, CHECK_VERIFY(this));
633 
634   if (VerboseVerification) {
635     stackmap_table.print_on(tty);
636   }
637 
638   RawBytecodeStream bcs(m);
639 
640   // Scan the byte code linearly from the start to the end
641   bool no_control_flow = false; // Set to true when there is no direct control
642                                 // flow from current instruction to the next
643                                 // instruction in sequence
644 
645   Bytecodes::Code opcode;
646   while (!bcs.is_last_bytecode()) {
647     // Check for recursive re-verification before each bytecode.
648     if (was_recursively_verified())  return;
649 
650     opcode = bcs.raw_next();
651     u2 bci = bcs.bci();
652 
653     // Set current frame's offset to bci
654     current_frame.set_offset(bci);
655     current_frame.set_mark();
656 
657     // Make sure every offset in stackmap table point to the beginning to
658     // an instruction. Match current_frame to stackmap_table entry with
659     // the same offset if exists.
660     stackmap_index = verify_stackmap_table(
661       stackmap_index, bci, &current_frame, &stackmap_table,
662       no_control_flow, CHECK_VERIFY(this));
663 
664 
665     bool this_uninit = false;  // Set to true when invokespecial <init> initialized 'this'
666     bool verified_exc_handlers = false;
667 
668     // Merge with the next instruction
669     {
670       u2 index;
671       int target;
672       VerificationType type, type2;
673       VerificationType atype;
674 
675 #ifndef PRODUCT
676       if (VerboseVerification) {
677         current_frame.print_on(tty);
678         tty->print_cr("offset = %d,  opcode = %s", bci, Bytecodes::name(opcode));
679       }
680 #endif
681 
682       // Make sure wide instruction is in correct format
683       if (bcs.is_wide()) {
684         if (opcode != Bytecodes::_iinc   && opcode != Bytecodes::_iload  &&
685             opcode != Bytecodes::_aload  && opcode != Bytecodes::_lload  &&
686             opcode != Bytecodes::_istore && opcode != Bytecodes::_astore &&
687             opcode != Bytecodes::_lstore && opcode != Bytecodes::_fload  &&
688             opcode != Bytecodes::_dload  && opcode != Bytecodes::_fstore &&
689             opcode != Bytecodes::_dstore) {
690           /* Unreachable?  RawBytecodeStream's raw_next() returns 'illegal'
691            * if we encounter a wide instruction that modifies an invalid
692            * opcode (not one of the ones listed above) */
693           verify_error(ErrorContext::bad_code(bci), "Bad wide instruction");
694           return;
695         }
696       }
697 
698       // Look for possible jump target in exception handlers and see if it
699       // matches current_frame.  Do this check here for astore*, dstore*,
700       // fstore*, istore*, and lstore* opcodes because they can change the type
701       // state by adding a local.  JVM Spec says that the incoming type state
702       // should be used for this check.  So, do the check here before a possible
703       // local is added to the type state.
704       if (Bytecodes::is_store_into_local(opcode) && bci >= ex_min && bci < ex_max) {
705         verify_exception_handler_targets(
706           bci, this_uninit, &current_frame, &stackmap_table, CHECK_VERIFY(this));
707         verified_exc_handlers = true;
708       }
709 
710       switch (opcode) {
711         case Bytecodes::_nop :
712           no_control_flow = false; break;
713         case Bytecodes::_aconst_null :
714           current_frame.push_stack(
715             VerificationType::null_type(), CHECK_VERIFY(this));
716           no_control_flow = false; break;
717         case Bytecodes::_iconst_m1 :
718         case Bytecodes::_iconst_0 :
719         case Bytecodes::_iconst_1 :
720         case Bytecodes::_iconst_2 :
721         case Bytecodes::_iconst_3 :
722         case Bytecodes::_iconst_4 :
723         case Bytecodes::_iconst_5 :
724           current_frame.push_stack(
725             VerificationType::integer_type(), CHECK_VERIFY(this));
726           no_control_flow = false; break;
727         case Bytecodes::_lconst_0 :
728         case Bytecodes::_lconst_1 :
729           current_frame.push_stack_2(
730             VerificationType::long_type(),
731             VerificationType::long2_type(), CHECK_VERIFY(this));
732           no_control_flow = false; break;
733         case Bytecodes::_fconst_0 :
734         case Bytecodes::_fconst_1 :
735         case Bytecodes::_fconst_2 :
736           current_frame.push_stack(
737             VerificationType::float_type(), CHECK_VERIFY(this));
738           no_control_flow = false; break;
739         case Bytecodes::_dconst_0 :
740         case Bytecodes::_dconst_1 :
741           current_frame.push_stack_2(
742             VerificationType::double_type(),
743             VerificationType::double2_type(), CHECK_VERIFY(this));
744           no_control_flow = false; break;
745         case Bytecodes::_sipush :
746         case Bytecodes::_bipush :
747           current_frame.push_stack(
748             VerificationType::integer_type(), CHECK_VERIFY(this));
749           no_control_flow = false; break;
750         case Bytecodes::_ldc :
751           verify_ldc(
752             opcode, bcs.get_index_u1(), &current_frame,
753             cp, bci, CHECK_VERIFY(this));
754           no_control_flow = false; break;
755         case Bytecodes::_ldc_w :
756         case Bytecodes::_ldc2_w :
757           verify_ldc(
758             opcode, bcs.get_index_u2(), &current_frame,
759             cp, bci, CHECK_VERIFY(this));
760           no_control_flow = false; break;
761         case Bytecodes::_iload :
762           verify_iload(bcs.get_index(), &current_frame, CHECK_VERIFY(this));
763           no_control_flow = false; break;
764         case Bytecodes::_iload_0 :
765         case Bytecodes::_iload_1 :
766         case Bytecodes::_iload_2 :
767         case Bytecodes::_iload_3 :
768           index = opcode - Bytecodes::_iload_0;
769           verify_iload(index, &current_frame, CHECK_VERIFY(this));
770           no_control_flow = false; break;
771         case Bytecodes::_lload :
772           verify_lload(bcs.get_index(), &current_frame, CHECK_VERIFY(this));
773           no_control_flow = false; break;
774         case Bytecodes::_lload_0 :
775         case Bytecodes::_lload_1 :
776         case Bytecodes::_lload_2 :
777         case Bytecodes::_lload_3 :
778           index = opcode - Bytecodes::_lload_0;
779           verify_lload(index, &current_frame, CHECK_VERIFY(this));
780           no_control_flow = false; break;
781         case Bytecodes::_fload :
782           verify_fload(bcs.get_index(), &current_frame, CHECK_VERIFY(this));
783           no_control_flow = false; break;
784         case Bytecodes::_fload_0 :
785         case Bytecodes::_fload_1 :
786         case Bytecodes::_fload_2 :
787         case Bytecodes::_fload_3 :
788           index = opcode - Bytecodes::_fload_0;
789           verify_fload(index, &current_frame, CHECK_VERIFY(this));
790           no_control_flow = false; break;
791         case Bytecodes::_dload :
792           verify_dload(bcs.get_index(), &current_frame, CHECK_VERIFY(this));
793           no_control_flow = false; break;
794         case Bytecodes::_dload_0 :
795         case Bytecodes::_dload_1 :
796         case Bytecodes::_dload_2 :
797         case Bytecodes::_dload_3 :
798           index = opcode - Bytecodes::_dload_0;
799           verify_dload(index, &current_frame, CHECK_VERIFY(this));
800           no_control_flow = false; break;
801         case Bytecodes::_aload :
802           verify_aload(bcs.get_index(), &current_frame, CHECK_VERIFY(this));
803           no_control_flow = false; break;
804         case Bytecodes::_aload_0 :
805         case Bytecodes::_aload_1 :
806         case Bytecodes::_aload_2 :
807         case Bytecodes::_aload_3 :
808           index = opcode - Bytecodes::_aload_0;
809           verify_aload(index, &current_frame, CHECK_VERIFY(this));
810           no_control_flow = false; break;
811         case Bytecodes::_iaload :
812           type = current_frame.pop_stack(
813             VerificationType::integer_type(), CHECK_VERIFY(this));
814           atype = current_frame.pop_stack(
815             VerificationType::reference_check(), CHECK_VERIFY(this));
816           if (!atype.is_int_array()) {
817             verify_error(ErrorContext::bad_type(bci,
818                 current_frame.stack_top_ctx(), ref_ctx("[I", THREAD)),
819                 bad_type_msg, "iaload");
820             return;
821           }
822           current_frame.push_stack(
823             VerificationType::integer_type(), CHECK_VERIFY(this));
824           no_control_flow = false; break;
825         case Bytecodes::_baload :
826           type = current_frame.pop_stack(
827             VerificationType::integer_type(), CHECK_VERIFY(this));
828           atype = current_frame.pop_stack(
829             VerificationType::reference_check(), CHECK_VERIFY(this));
830           if (!atype.is_bool_array() && !atype.is_byte_array()) {
831             verify_error(
832                 ErrorContext::bad_type(bci, current_frame.stack_top_ctx()),
833                 bad_type_msg, "baload");
834             return;
835           }
836           current_frame.push_stack(
837             VerificationType::integer_type(), CHECK_VERIFY(this));
838           no_control_flow = false; break;
839         case Bytecodes::_caload :
840           type = current_frame.pop_stack(
841             VerificationType::integer_type(), CHECK_VERIFY(this));
842           atype = current_frame.pop_stack(
843             VerificationType::reference_check(), CHECK_VERIFY(this));
844           if (!atype.is_char_array()) {
845             verify_error(ErrorContext::bad_type(bci,
846                 current_frame.stack_top_ctx(), ref_ctx("[C", THREAD)),
847                 bad_type_msg, "caload");
848             return;
849           }
850           current_frame.push_stack(
851             VerificationType::integer_type(), CHECK_VERIFY(this));
852           no_control_flow = false; break;
853         case Bytecodes::_saload :
854           type = current_frame.pop_stack(
855             VerificationType::integer_type(), CHECK_VERIFY(this));
856           atype = current_frame.pop_stack(
857             VerificationType::reference_check(), CHECK_VERIFY(this));
858           if (!atype.is_short_array()) {
859             verify_error(ErrorContext::bad_type(bci,
860                 current_frame.stack_top_ctx(), ref_ctx("[S", THREAD)),
861                 bad_type_msg, "saload");
862             return;
863           }
864           current_frame.push_stack(
865             VerificationType::integer_type(), CHECK_VERIFY(this));
866           no_control_flow = false; break;
867         case Bytecodes::_laload :
868           type = current_frame.pop_stack(
869             VerificationType::integer_type(), CHECK_VERIFY(this));
870           atype = current_frame.pop_stack(
871             VerificationType::reference_check(), CHECK_VERIFY(this));
872           if (!atype.is_long_array()) {
873             verify_error(ErrorContext::bad_type(bci,
874                 current_frame.stack_top_ctx(), ref_ctx("[J", THREAD)),
875                 bad_type_msg, "laload");
876             return;
877           }
878           current_frame.push_stack_2(
879             VerificationType::long_type(),
880             VerificationType::long2_type(), CHECK_VERIFY(this));
881           no_control_flow = false; break;
882         case Bytecodes::_faload :
883           type = current_frame.pop_stack(
884             VerificationType::integer_type(), CHECK_VERIFY(this));
885           atype = current_frame.pop_stack(
886             VerificationType::reference_check(), CHECK_VERIFY(this));
887           if (!atype.is_float_array()) {
888             verify_error(ErrorContext::bad_type(bci,
889                 current_frame.stack_top_ctx(), ref_ctx("[F", THREAD)),
890                 bad_type_msg, "faload");
891             return;
892           }
893           current_frame.push_stack(
894             VerificationType::float_type(), CHECK_VERIFY(this));
895           no_control_flow = false; break;
896         case Bytecodes::_daload :
897           type = current_frame.pop_stack(
898             VerificationType::integer_type(), CHECK_VERIFY(this));
899           atype = current_frame.pop_stack(
900             VerificationType::reference_check(), CHECK_VERIFY(this));
901           if (!atype.is_double_array()) {
902             verify_error(ErrorContext::bad_type(bci,
903                 current_frame.stack_top_ctx(), ref_ctx("[D", THREAD)),
904                 bad_type_msg, "daload");
905             return;
906           }
907           current_frame.push_stack_2(
908             VerificationType::double_type(),
909             VerificationType::double2_type(), CHECK_VERIFY(this));
910           no_control_flow = false; break;
911         case Bytecodes::_aaload : {
912           type = current_frame.pop_stack(
913             VerificationType::integer_type(), CHECK_VERIFY(this));
914           atype = current_frame.pop_stack(
915             VerificationType::reference_check(), CHECK_VERIFY(this));
916           if (!atype.is_reference_array()) {
917             verify_error(ErrorContext::bad_type(bci,
918                 current_frame.stack_top_ctx(),
919                 TypeOrigin::implicit(VerificationType::reference_check())),
920                 bad_type_msg, "aaload");
921             return;
922           }
923           if (atype.is_null()) {
924             current_frame.push_stack(
925               VerificationType::null_type(), CHECK_VERIFY(this));
926           } else {
927             VerificationType component =
928               atype.get_component(this, CHECK_VERIFY(this));
929             current_frame.push_stack(component, CHECK_VERIFY(this));
930           }
931           no_control_flow = false; break;
932         }
933         case Bytecodes::_istore :
934           verify_istore(bcs.get_index(), &current_frame, CHECK_VERIFY(this));
935           no_control_flow = false; break;
936         case Bytecodes::_istore_0 :
937         case Bytecodes::_istore_1 :
938         case Bytecodes::_istore_2 :
939         case Bytecodes::_istore_3 :
940           index = opcode - Bytecodes::_istore_0;
941           verify_istore(index, &current_frame, CHECK_VERIFY(this));
942           no_control_flow = false; break;
943         case Bytecodes::_lstore :
944           verify_lstore(bcs.get_index(), &current_frame, CHECK_VERIFY(this));
945           no_control_flow = false; break;
946         case Bytecodes::_lstore_0 :
947         case Bytecodes::_lstore_1 :
948         case Bytecodes::_lstore_2 :
949         case Bytecodes::_lstore_3 :
950           index = opcode - Bytecodes::_lstore_0;
951           verify_lstore(index, &current_frame, CHECK_VERIFY(this));
952           no_control_flow = false; break;
953         case Bytecodes::_fstore :
954           verify_fstore(bcs.get_index(), &current_frame, CHECK_VERIFY(this));
955           no_control_flow = false; break;
956         case Bytecodes::_fstore_0 :
957         case Bytecodes::_fstore_1 :
958         case Bytecodes::_fstore_2 :
959         case Bytecodes::_fstore_3 :
960           index = opcode - Bytecodes::_fstore_0;
961           verify_fstore(index, &current_frame, CHECK_VERIFY(this));
962           no_control_flow = false; break;
963         case Bytecodes::_dstore :
964           verify_dstore(bcs.get_index(), &current_frame, CHECK_VERIFY(this));
965           no_control_flow = false; break;
966         case Bytecodes::_dstore_0 :
967         case Bytecodes::_dstore_1 :
968         case Bytecodes::_dstore_2 :
969         case Bytecodes::_dstore_3 :
970           index = opcode - Bytecodes::_dstore_0;
971           verify_dstore(index, &current_frame, CHECK_VERIFY(this));
972           no_control_flow = false; break;
973         case Bytecodes::_astore :
974           verify_astore(bcs.get_index(), &current_frame, CHECK_VERIFY(this));
975           no_control_flow = false; break;
976         case Bytecodes::_astore_0 :
977         case Bytecodes::_astore_1 :
978         case Bytecodes::_astore_2 :
979         case Bytecodes::_astore_3 :
980           index = opcode - Bytecodes::_astore_0;
981           verify_astore(index, &current_frame, CHECK_VERIFY(this));
982           no_control_flow = false; break;
983         case Bytecodes::_iastore :
984           type = current_frame.pop_stack(
985             VerificationType::integer_type(), CHECK_VERIFY(this));
986           type2 = current_frame.pop_stack(
987             VerificationType::integer_type(), CHECK_VERIFY(this));
988           atype = current_frame.pop_stack(
989             VerificationType::reference_check(), CHECK_VERIFY(this));
990           if (!atype.is_int_array()) {
991             verify_error(ErrorContext::bad_type(bci,
992                 current_frame.stack_top_ctx(), ref_ctx("[I", THREAD)),
993                 bad_type_msg, "iastore");
994             return;
995           }
996           no_control_flow = false; break;
997         case Bytecodes::_bastore :
998           type = current_frame.pop_stack(
999             VerificationType::integer_type(), CHECK_VERIFY(this));
1000           type2 = current_frame.pop_stack(
1001             VerificationType::integer_type(), CHECK_VERIFY(this));
1002           atype = current_frame.pop_stack(
1003             VerificationType::reference_check(), CHECK_VERIFY(this));
1004           if (!atype.is_bool_array() && !atype.is_byte_array()) {
1005             verify_error(
1006                 ErrorContext::bad_type(bci, current_frame.stack_top_ctx()),
1007                 bad_type_msg, "bastore");
1008             return;
1009           }
1010           no_control_flow = false; break;
1011         case Bytecodes::_castore :
1012           current_frame.pop_stack(
1013             VerificationType::integer_type(), CHECK_VERIFY(this));
1014           current_frame.pop_stack(
1015             VerificationType::integer_type(), CHECK_VERIFY(this));
1016           atype = current_frame.pop_stack(
1017             VerificationType::reference_check(), CHECK_VERIFY(this));
1018           if (!atype.is_char_array()) {
1019             verify_error(ErrorContext::bad_type(bci,
1020                 current_frame.stack_top_ctx(), ref_ctx("[C", THREAD)),
1021                 bad_type_msg, "castore");
1022             return;
1023           }
1024           no_control_flow = false; break;
1025         case Bytecodes::_sastore :
1026           current_frame.pop_stack(
1027             VerificationType::integer_type(), CHECK_VERIFY(this));
1028           current_frame.pop_stack(
1029             VerificationType::integer_type(), CHECK_VERIFY(this));
1030           atype = current_frame.pop_stack(
1031             VerificationType::reference_check(), CHECK_VERIFY(this));
1032           if (!atype.is_short_array()) {
1033             verify_error(ErrorContext::bad_type(bci,
1034                 current_frame.stack_top_ctx(), ref_ctx("[S", THREAD)),
1035                 bad_type_msg, "sastore");
1036             return;
1037           }
1038           no_control_flow = false; break;
1039         case Bytecodes::_lastore :
1040           current_frame.pop_stack_2(
1041             VerificationType::long2_type(),
1042             VerificationType::long_type(), CHECK_VERIFY(this));
1043           current_frame.pop_stack(
1044             VerificationType::integer_type(), CHECK_VERIFY(this));
1045           atype = current_frame.pop_stack(
1046             VerificationType::reference_check(), CHECK_VERIFY(this));
1047           if (!atype.is_long_array()) {
1048             verify_error(ErrorContext::bad_type(bci,
1049                 current_frame.stack_top_ctx(), ref_ctx("[J", THREAD)),
1050                 bad_type_msg, "lastore");
1051             return;
1052           }
1053           no_control_flow = false; break;
1054         case Bytecodes::_fastore :
1055           current_frame.pop_stack(
1056             VerificationType::float_type(), CHECK_VERIFY(this));
1057           current_frame.pop_stack
1058             (VerificationType::integer_type(), CHECK_VERIFY(this));
1059           atype = current_frame.pop_stack(
1060             VerificationType::reference_check(), CHECK_VERIFY(this));
1061           if (!atype.is_float_array()) {
1062             verify_error(ErrorContext::bad_type(bci,
1063                 current_frame.stack_top_ctx(), ref_ctx("[F", THREAD)),
1064                 bad_type_msg, "fastore");
1065             return;
1066           }
1067           no_control_flow = false; break;
1068         case Bytecodes::_dastore :
1069           current_frame.pop_stack_2(
1070             VerificationType::double2_type(),
1071             VerificationType::double_type(), CHECK_VERIFY(this));
1072           current_frame.pop_stack(
1073             VerificationType::integer_type(), CHECK_VERIFY(this));
1074           atype = current_frame.pop_stack(
1075             VerificationType::reference_check(), CHECK_VERIFY(this));
1076           if (!atype.is_double_array()) {
1077             verify_error(ErrorContext::bad_type(bci,
1078                 current_frame.stack_top_ctx(), ref_ctx("[D", THREAD)),
1079                 bad_type_msg, "dastore");
1080             return;
1081           }
1082           no_control_flow = false; break;
1083         case Bytecodes::_aastore :
1084           type = current_frame.pop_stack(object_type(), CHECK_VERIFY(this));
1085           type2 = current_frame.pop_stack(
1086             VerificationType::integer_type(), CHECK_VERIFY(this));
1087           atype = current_frame.pop_stack(
1088             VerificationType::reference_check(), CHECK_VERIFY(this));
1089           // more type-checking is done at runtime
1090           if (!atype.is_reference_array()) {
1091             verify_error(ErrorContext::bad_type(bci,
1092                 current_frame.stack_top_ctx(),
1093                 TypeOrigin::implicit(VerificationType::reference_check())),
1094                 bad_type_msg, "aastore");
1095             return;
1096           }
1097           // 4938384: relaxed constraint in JVMS 3nd edition.
1098           no_control_flow = false; break;
1099         case Bytecodes::_pop :
1100           current_frame.pop_stack(
1101             VerificationType::category1_check(), CHECK_VERIFY(this));
1102           no_control_flow = false; break;
1103         case Bytecodes::_pop2 :
1104           type = current_frame.pop_stack(CHECK_VERIFY(this));
1105           if (type.is_category1()) {
1106             current_frame.pop_stack(
1107               VerificationType::category1_check(), CHECK_VERIFY(this));
1108           } else if (type.is_category2_2nd()) {
1109             current_frame.pop_stack(
1110               VerificationType::category2_check(), CHECK_VERIFY(this));
1111           } else {
1112             /* Unreachable? Would need a category2_1st on TOS
1113              * which does not appear possible. */
1114             verify_error(
1115                 ErrorContext::bad_type(bci, current_frame.stack_top_ctx()),
1116                 bad_type_msg, "pop2");
1117             return;
1118           }
1119           no_control_flow = false; break;
1120         case Bytecodes::_dup :
1121           type = current_frame.pop_stack(
1122             VerificationType::category1_check(), CHECK_VERIFY(this));
1123           current_frame.push_stack(type, CHECK_VERIFY(this));
1124           current_frame.push_stack(type, CHECK_VERIFY(this));
1125           no_control_flow = false; break;
1126         case Bytecodes::_dup_x1 :
1127           type = current_frame.pop_stack(
1128             VerificationType::category1_check(), CHECK_VERIFY(this));
1129           type2 = current_frame.pop_stack(
1130             VerificationType::category1_check(), CHECK_VERIFY(this));
1131           current_frame.push_stack(type, CHECK_VERIFY(this));
1132           current_frame.push_stack(type2, CHECK_VERIFY(this));
1133           current_frame.push_stack(type, CHECK_VERIFY(this));
1134           no_control_flow = false; break;
1135         case Bytecodes::_dup_x2 :
1136         {
1137           VerificationType type3;
1138           type = current_frame.pop_stack(
1139             VerificationType::category1_check(), CHECK_VERIFY(this));
1140           type2 = current_frame.pop_stack(CHECK_VERIFY(this));
1141           if (type2.is_category1()) {
1142             type3 = current_frame.pop_stack(
1143               VerificationType::category1_check(), CHECK_VERIFY(this));
1144           } else if (type2.is_category2_2nd()) {
1145             type3 = current_frame.pop_stack(
1146               VerificationType::category2_check(), CHECK_VERIFY(this));
1147           } else {
1148             /* Unreachable? Would need a category2_1st at stack depth 2 with
1149              * a category1 on TOS which does not appear possible. */
1150             verify_error(ErrorContext::bad_type(
1151                 bci, current_frame.stack_top_ctx()), bad_type_msg, "dup_x2");
1152             return;
1153           }
1154           current_frame.push_stack(type, CHECK_VERIFY(this));
1155           current_frame.push_stack(type3, CHECK_VERIFY(this));
1156           current_frame.push_stack(type2, CHECK_VERIFY(this));
1157           current_frame.push_stack(type, CHECK_VERIFY(this));
1158           no_control_flow = false; break;
1159         }
1160         case Bytecodes::_dup2 :
1161           type = current_frame.pop_stack(CHECK_VERIFY(this));
1162           if (type.is_category1()) {
1163             type2 = current_frame.pop_stack(
1164               VerificationType::category1_check(), CHECK_VERIFY(this));
1165           } else if (type.is_category2_2nd()) {
1166             type2 = current_frame.pop_stack(
1167               VerificationType::category2_check(), CHECK_VERIFY(this));
1168           } else {
1169             /* Unreachable?  Would need a category2_1st on TOS which does not
1170              * appear possible. */
1171             verify_error(
1172                 ErrorContext::bad_type(bci, current_frame.stack_top_ctx()),
1173                 bad_type_msg, "dup2");
1174             return;
1175           }
1176           current_frame.push_stack(type2, CHECK_VERIFY(this));
1177           current_frame.push_stack(type, CHECK_VERIFY(this));
1178           current_frame.push_stack(type2, CHECK_VERIFY(this));
1179           current_frame.push_stack(type, CHECK_VERIFY(this));
1180           no_control_flow = false; break;
1181         case Bytecodes::_dup2_x1 :
1182         {
1183           VerificationType type3;
1184           type = current_frame.pop_stack(CHECK_VERIFY(this));
1185           if (type.is_category1()) {
1186             type2 = current_frame.pop_stack(
1187               VerificationType::category1_check(), CHECK_VERIFY(this));
1188           } else if (type.is_category2_2nd()) {
1189             type2 = current_frame.pop_stack(
1190               VerificationType::category2_check(), CHECK_VERIFY(this));
1191           } else {
1192             /* Unreachable?  Would need a category2_1st on TOS which does
1193              * not appear possible. */
1194             verify_error(
1195                 ErrorContext::bad_type(bci, current_frame.stack_top_ctx()),
1196                 bad_type_msg, "dup2_x1");
1197             return;
1198           }
1199           type3 = current_frame.pop_stack(
1200             VerificationType::category1_check(), CHECK_VERIFY(this));
1201           current_frame.push_stack(type2, CHECK_VERIFY(this));
1202           current_frame.push_stack(type, CHECK_VERIFY(this));
1203           current_frame.push_stack(type3, CHECK_VERIFY(this));
1204           current_frame.push_stack(type2, CHECK_VERIFY(this));
1205           current_frame.push_stack(type, CHECK_VERIFY(this));
1206           no_control_flow = false; break;
1207         }
1208         case Bytecodes::_dup2_x2 :
1209         {
1210           VerificationType type3, type4;
1211           type = current_frame.pop_stack(CHECK_VERIFY(this));
1212           if (type.is_category1()) {
1213             type2 = current_frame.pop_stack(
1214               VerificationType::category1_check(), CHECK_VERIFY(this));
1215           } else if (type.is_category2_2nd()) {
1216             type2 = current_frame.pop_stack(
1217               VerificationType::category2_check(), CHECK_VERIFY(this));
1218           } else {
1219             /* Unreachable?  Would need a category2_1st on TOS which does
1220              * not appear possible. */
1221             verify_error(
1222                 ErrorContext::bad_type(bci, current_frame.stack_top_ctx()),
1223                 bad_type_msg, "dup2_x2");
1224             return;
1225           }
1226           type3 = current_frame.pop_stack(CHECK_VERIFY(this));
1227           if (type3.is_category1()) {
1228             type4 = current_frame.pop_stack(
1229               VerificationType::category1_check(), CHECK_VERIFY(this));
1230           } else if (type3.is_category2_2nd()) {
1231             type4 = current_frame.pop_stack(
1232               VerificationType::category2_check(), CHECK_VERIFY(this));
1233           } else {
1234             /* Unreachable?  Would need a category2_1st on TOS after popping
1235              * a long/double or two category 1's, which does not
1236              * appear possible. */
1237             verify_error(
1238                 ErrorContext::bad_type(bci, current_frame.stack_top_ctx()),
1239                 bad_type_msg, "dup2_x2");
1240             return;
1241           }
1242           current_frame.push_stack(type2, CHECK_VERIFY(this));
1243           current_frame.push_stack(type, CHECK_VERIFY(this));
1244           current_frame.push_stack(type4, CHECK_VERIFY(this));
1245           current_frame.push_stack(type3, CHECK_VERIFY(this));
1246           current_frame.push_stack(type2, CHECK_VERIFY(this));
1247           current_frame.push_stack(type, CHECK_VERIFY(this));
1248           no_control_flow = false; break;
1249         }
1250         case Bytecodes::_swap :
1251           type = current_frame.pop_stack(
1252             VerificationType::category1_check(), CHECK_VERIFY(this));
1253           type2 = current_frame.pop_stack(
1254             VerificationType::category1_check(), CHECK_VERIFY(this));
1255           current_frame.push_stack(type, CHECK_VERIFY(this));
1256           current_frame.push_stack(type2, CHECK_VERIFY(this));
1257           no_control_flow = false; break;
1258         case Bytecodes::_iadd :
1259         case Bytecodes::_isub :
1260         case Bytecodes::_imul :
1261         case Bytecodes::_idiv :
1262         case Bytecodes::_irem :
1263         case Bytecodes::_ishl :
1264         case Bytecodes::_ishr :
1265         case Bytecodes::_iushr :
1266         case Bytecodes::_ior :
1267         case Bytecodes::_ixor :
1268         case Bytecodes::_iand :
1269           current_frame.pop_stack(
1270             VerificationType::integer_type(), CHECK_VERIFY(this));
1271           // fall through
1272         case Bytecodes::_ineg :
1273           current_frame.pop_stack(
1274             VerificationType::integer_type(), CHECK_VERIFY(this));
1275           current_frame.push_stack(
1276             VerificationType::integer_type(), CHECK_VERIFY(this));
1277           no_control_flow = false; break;
1278         case Bytecodes::_ladd :
1279         case Bytecodes::_lsub :
1280         case Bytecodes::_lmul :
1281         case Bytecodes::_ldiv :
1282         case Bytecodes::_lrem :
1283         case Bytecodes::_land :
1284         case Bytecodes::_lor :
1285         case Bytecodes::_lxor :
1286           current_frame.pop_stack_2(
1287             VerificationType::long2_type(),
1288             VerificationType::long_type(), CHECK_VERIFY(this));
1289           // fall through
1290         case Bytecodes::_lneg :
1291           current_frame.pop_stack_2(
1292             VerificationType::long2_type(),
1293             VerificationType::long_type(), CHECK_VERIFY(this));
1294           current_frame.push_stack_2(
1295             VerificationType::long_type(),
1296             VerificationType::long2_type(), CHECK_VERIFY(this));
1297           no_control_flow = false; break;
1298         case Bytecodes::_lshl :
1299         case Bytecodes::_lshr :
1300         case Bytecodes::_lushr :
1301           current_frame.pop_stack(
1302             VerificationType::integer_type(), CHECK_VERIFY(this));
1303           current_frame.pop_stack_2(
1304             VerificationType::long2_type(),
1305             VerificationType::long_type(), CHECK_VERIFY(this));
1306           current_frame.push_stack_2(
1307             VerificationType::long_type(),
1308             VerificationType::long2_type(), CHECK_VERIFY(this));
1309           no_control_flow = false; break;
1310         case Bytecodes::_fadd :
1311         case Bytecodes::_fsub :
1312         case Bytecodes::_fmul :
1313         case Bytecodes::_fdiv :
1314         case Bytecodes::_frem :
1315           current_frame.pop_stack(
1316             VerificationType::float_type(), CHECK_VERIFY(this));
1317           // fall through
1318         case Bytecodes::_fneg :
1319           current_frame.pop_stack(
1320             VerificationType::float_type(), CHECK_VERIFY(this));
1321           current_frame.push_stack(
1322             VerificationType::float_type(), CHECK_VERIFY(this));
1323           no_control_flow = false; break;
1324         case Bytecodes::_dadd :
1325         case Bytecodes::_dsub :
1326         case Bytecodes::_dmul :
1327         case Bytecodes::_ddiv :
1328         case Bytecodes::_drem :
1329           current_frame.pop_stack_2(
1330             VerificationType::double2_type(),
1331             VerificationType::double_type(), CHECK_VERIFY(this));
1332           // fall through
1333         case Bytecodes::_dneg :
1334           current_frame.pop_stack_2(
1335             VerificationType::double2_type(),
1336             VerificationType::double_type(), CHECK_VERIFY(this));
1337           current_frame.push_stack_2(
1338             VerificationType::double_type(),
1339             VerificationType::double2_type(), CHECK_VERIFY(this));
1340           no_control_flow = false; break;
1341         case Bytecodes::_iinc :
1342           verify_iinc(bcs.get_index(), &current_frame, CHECK_VERIFY(this));
1343           no_control_flow = false; break;
1344         case Bytecodes::_i2l :
1345           type = current_frame.pop_stack(
1346             VerificationType::integer_type(), CHECK_VERIFY(this));
1347           current_frame.push_stack_2(
1348             VerificationType::long_type(),
1349             VerificationType::long2_type(), CHECK_VERIFY(this));
1350           no_control_flow = false; break;
1351        case Bytecodes::_l2i :
1352           current_frame.pop_stack_2(
1353             VerificationType::long2_type(),
1354             VerificationType::long_type(), CHECK_VERIFY(this));
1355           current_frame.push_stack(
1356             VerificationType::integer_type(), CHECK_VERIFY(this));
1357           no_control_flow = false; break;
1358         case Bytecodes::_i2f :
1359           current_frame.pop_stack(
1360             VerificationType::integer_type(), CHECK_VERIFY(this));
1361           current_frame.push_stack(
1362             VerificationType::float_type(), CHECK_VERIFY(this));
1363           no_control_flow = false; break;
1364         case Bytecodes::_i2d :
1365           current_frame.pop_stack(
1366             VerificationType::integer_type(), CHECK_VERIFY(this));
1367           current_frame.push_stack_2(
1368             VerificationType::double_type(),
1369             VerificationType::double2_type(), CHECK_VERIFY(this));
1370           no_control_flow = false; break;
1371         case Bytecodes::_l2f :
1372           current_frame.pop_stack_2(
1373             VerificationType::long2_type(),
1374             VerificationType::long_type(), CHECK_VERIFY(this));
1375           current_frame.push_stack(
1376             VerificationType::float_type(), CHECK_VERIFY(this));
1377           no_control_flow = false; break;
1378         case Bytecodes::_l2d :
1379           current_frame.pop_stack_2(
1380             VerificationType::long2_type(),
1381             VerificationType::long_type(), CHECK_VERIFY(this));
1382           current_frame.push_stack_2(
1383             VerificationType::double_type(),
1384             VerificationType::double2_type(), CHECK_VERIFY(this));
1385           no_control_flow = false; break;
1386         case Bytecodes::_f2i :
1387           current_frame.pop_stack(
1388             VerificationType::float_type(), CHECK_VERIFY(this));
1389           current_frame.push_stack(
1390             VerificationType::integer_type(), CHECK_VERIFY(this));
1391           no_control_flow = false; break;
1392         case Bytecodes::_f2l :
1393           current_frame.pop_stack(
1394             VerificationType::float_type(), CHECK_VERIFY(this));
1395           current_frame.push_stack_2(
1396             VerificationType::long_type(),
1397             VerificationType::long2_type(), CHECK_VERIFY(this));
1398           no_control_flow = false; break;
1399         case Bytecodes::_f2d :
1400           current_frame.pop_stack(
1401             VerificationType::float_type(), CHECK_VERIFY(this));
1402           current_frame.push_stack_2(
1403             VerificationType::double_type(),
1404             VerificationType::double2_type(), CHECK_VERIFY(this));
1405           no_control_flow = false; break;
1406         case Bytecodes::_d2i :
1407           current_frame.pop_stack_2(
1408             VerificationType::double2_type(),
1409             VerificationType::double_type(), CHECK_VERIFY(this));
1410           current_frame.push_stack(
1411             VerificationType::integer_type(), CHECK_VERIFY(this));
1412           no_control_flow = false; break;
1413         case Bytecodes::_d2l :
1414           current_frame.pop_stack_2(
1415             VerificationType::double2_type(),
1416             VerificationType::double_type(), CHECK_VERIFY(this));
1417           current_frame.push_stack_2(
1418             VerificationType::long_type(),
1419             VerificationType::long2_type(), CHECK_VERIFY(this));
1420           no_control_flow = false; break;
1421         case Bytecodes::_d2f :
1422           current_frame.pop_stack_2(
1423             VerificationType::double2_type(),
1424             VerificationType::double_type(), CHECK_VERIFY(this));
1425           current_frame.push_stack(
1426             VerificationType::float_type(), CHECK_VERIFY(this));
1427           no_control_flow = false; break;
1428         case Bytecodes::_i2b :
1429         case Bytecodes::_i2c :
1430         case Bytecodes::_i2s :
1431           current_frame.pop_stack(
1432             VerificationType::integer_type(), CHECK_VERIFY(this));
1433           current_frame.push_stack(
1434             VerificationType::integer_type(), CHECK_VERIFY(this));
1435           no_control_flow = false; break;
1436         case Bytecodes::_lcmp :
1437           current_frame.pop_stack_2(
1438             VerificationType::long2_type(),
1439             VerificationType::long_type(), CHECK_VERIFY(this));
1440           current_frame.pop_stack_2(
1441             VerificationType::long2_type(),
1442             VerificationType::long_type(), CHECK_VERIFY(this));
1443           current_frame.push_stack(
1444             VerificationType::integer_type(), CHECK_VERIFY(this));
1445           no_control_flow = false; break;
1446         case Bytecodes::_fcmpl :
1447         case Bytecodes::_fcmpg :
1448           current_frame.pop_stack(
1449             VerificationType::float_type(), CHECK_VERIFY(this));
1450           current_frame.pop_stack(
1451             VerificationType::float_type(), CHECK_VERIFY(this));
1452           current_frame.push_stack(
1453             VerificationType::integer_type(), CHECK_VERIFY(this));
1454           no_control_flow = false; break;
1455         case Bytecodes::_dcmpl :
1456         case Bytecodes::_dcmpg :
1457           current_frame.pop_stack_2(
1458             VerificationType::double2_type(),
1459             VerificationType::double_type(), CHECK_VERIFY(this));
1460           current_frame.pop_stack_2(
1461             VerificationType::double2_type(),
1462             VerificationType::double_type(), CHECK_VERIFY(this));
1463           current_frame.push_stack(
1464             VerificationType::integer_type(), CHECK_VERIFY(this));
1465           no_control_flow = false; break;
1466         case Bytecodes::_if_icmpeq:
1467         case Bytecodes::_if_icmpne:
1468         case Bytecodes::_if_icmplt:
1469         case Bytecodes::_if_icmpge:
1470         case Bytecodes::_if_icmpgt:
1471         case Bytecodes::_if_icmple:
1472           current_frame.pop_stack(
1473             VerificationType::integer_type(), CHECK_VERIFY(this));
1474           // fall through
1475         case Bytecodes::_ifeq:
1476         case Bytecodes::_ifne:
1477         case Bytecodes::_iflt:
1478         case Bytecodes::_ifge:
1479         case Bytecodes::_ifgt:
1480         case Bytecodes::_ifle:
1481           current_frame.pop_stack(
1482             VerificationType::integer_type(), CHECK_VERIFY(this));
1483           target = bcs.dest();
1484           stackmap_table.check_jump_target(
1485             &current_frame, target, CHECK_VERIFY(this));
1486           no_control_flow = false; break;
1487         case Bytecodes::_if_acmpeq :
1488         case Bytecodes::_if_acmpne :
1489           current_frame.pop_stack(
1490             VerificationType::reference_check(), CHECK_VERIFY(this));
1491           // fall through
1492         case Bytecodes::_ifnull :
1493         case Bytecodes::_ifnonnull :
1494           current_frame.pop_stack(
1495             VerificationType::reference_check(), CHECK_VERIFY(this));
1496           target = bcs.dest();
1497           stackmap_table.check_jump_target
1498             (&current_frame, target, CHECK_VERIFY(this));
1499           no_control_flow = false; break;
1500         case Bytecodes::_goto :
1501           target = bcs.dest();
1502           stackmap_table.check_jump_target(
1503             &current_frame, target, CHECK_VERIFY(this));
1504           no_control_flow = true; break;
1505         case Bytecodes::_goto_w :
1506           target = bcs.dest_w();
1507           stackmap_table.check_jump_target(
1508             &current_frame, target, CHECK_VERIFY(this));
1509           no_control_flow = true; break;
1510         case Bytecodes::_tableswitch :
1511         case Bytecodes::_lookupswitch :
1512           verify_switch(
1513             &bcs, code_length, code_data, &current_frame,
1514             &stackmap_table, CHECK_VERIFY(this));
1515           no_control_flow = true; break;
1516         case Bytecodes::_ireturn :
1517           type = current_frame.pop_stack(
1518             VerificationType::integer_type(), CHECK_VERIFY(this));
1519           verify_return_value(return_type, type, bci,
1520                               &current_frame, CHECK_VERIFY(this));
1521           no_control_flow = true; break;
1522         case Bytecodes::_lreturn :
1523           type2 = current_frame.pop_stack(
1524             VerificationType::long2_type(), CHECK_VERIFY(this));
1525           type = current_frame.pop_stack(
1526             VerificationType::long_type(), CHECK_VERIFY(this));
1527           verify_return_value(return_type, type, bci,
1528                               &current_frame, CHECK_VERIFY(this));
1529           no_control_flow = true; break;
1530         case Bytecodes::_freturn :
1531           type = current_frame.pop_stack(
1532             VerificationType::float_type(), CHECK_VERIFY(this));
1533           verify_return_value(return_type, type, bci,
1534                               &current_frame, CHECK_VERIFY(this));
1535           no_control_flow = true; break;
1536         case Bytecodes::_dreturn :
1537           type2 = current_frame.pop_stack(
1538             VerificationType::double2_type(),  CHECK_VERIFY(this));
1539           type = current_frame.pop_stack(
1540             VerificationType::double_type(), CHECK_VERIFY(this));
1541           verify_return_value(return_type, type, bci,
1542                               &current_frame, CHECK_VERIFY(this));
1543           no_control_flow = true; break;
1544         case Bytecodes::_areturn :
1545           type = current_frame.pop_stack(
1546             VerificationType::reference_check(), CHECK_VERIFY(this));
1547           verify_return_value(return_type, type, bci,
1548                               &current_frame, CHECK_VERIFY(this));
1549           no_control_flow = true; break;
1550         case Bytecodes::_return :
1551           if (return_type != VerificationType::bogus_type()) {
1552             verify_error(ErrorContext::bad_code(bci),
1553                          "Method expects a return value");
1554             return;
1555           }
1556           // Make sure "this" has been initialized if current method is an
1557           // <init>
1558           if (_method->name() == vmSymbols::object_initializer_name() &&
1559               current_frame.flag_this_uninit()) {
1560             verify_error(ErrorContext::bad_code(bci),
1561                          "Constructor must call super() or this() "
1562                          "before return");
1563             return;
1564           }
1565           no_control_flow = true; break;
1566         case Bytecodes::_getstatic :
1567         case Bytecodes::_putstatic :
1568         case Bytecodes::_getfield :
1569         case Bytecodes::_putfield :
1570           verify_field_instructions(
1571             &bcs, &current_frame, cp, CHECK_VERIFY(this));
1572           no_control_flow = false; break;
1573         case Bytecodes::_invokevirtual :
1574         case Bytecodes::_invokespecial :
1575         case Bytecodes::_invokestatic :
1576           verify_invoke_instructions(
1577             &bcs, code_length, &current_frame, (bci >= ex_min && bci < ex_max),
1578             &this_uninit, return_type, cp, &stackmap_table, CHECK_VERIFY(this));
1579           no_control_flow = false; break;
1580         case Bytecodes::_invokeinterface :
1581         case Bytecodes::_invokedynamic :
1582           verify_invoke_instructions(
1583             &bcs, code_length, &current_frame, (bci >= ex_min && bci < ex_max),
1584             &this_uninit, return_type, cp, &stackmap_table, CHECK_VERIFY(this));
1585           no_control_flow = false; break;
1586         case Bytecodes::_new :
1587         {
1588           index = bcs.get_index_u2();
1589           verify_cp_class_type(bci, index, cp, CHECK_VERIFY(this));
1590           VerificationType new_class_type =
1591             cp_index_to_type(index, cp, CHECK_VERIFY(this));
1592           if (!new_class_type.is_object()) {
1593             verify_error(ErrorContext::bad_type(bci,
1594                 TypeOrigin::cp(index, new_class_type)),
1595                 "Illegal new instruction");
1596             return;
1597           }
1598           type = VerificationType::uninitialized_type(bci);
1599           current_frame.push_stack(type, CHECK_VERIFY(this));
1600           no_control_flow = false; break;
1601         }
1602         case Bytecodes::_newarray :
1603           type = get_newarray_type(bcs.get_index(), bci, CHECK_VERIFY(this));
1604           current_frame.pop_stack(
1605             VerificationType::integer_type(),  CHECK_VERIFY(this));
1606           current_frame.push_stack(type, CHECK_VERIFY(this));
1607           no_control_flow = false; break;
1608         case Bytecodes::_anewarray :
1609           verify_anewarray(
1610             bci, bcs.get_index_u2(), cp, &current_frame, CHECK_VERIFY(this));
1611           no_control_flow = false; break;
1612         case Bytecodes::_arraylength :
1613           type = current_frame.pop_stack(
1614             VerificationType::reference_check(), CHECK_VERIFY(this));
1615           if (!(type.is_null() || type.is_array())) {
1616             verify_error(ErrorContext::bad_type(
1617                 bci, current_frame.stack_top_ctx()),
1618                 bad_type_msg, "arraylength");
1619           }
1620           current_frame.push_stack(
1621             VerificationType::integer_type(), CHECK_VERIFY(this));
1622           no_control_flow = false; break;
1623         case Bytecodes::_checkcast :
1624         {
1625           index = bcs.get_index_u2();
1626           verify_cp_class_type(bci, index, cp, CHECK_VERIFY(this));
1627           current_frame.pop_stack(object_type(), CHECK_VERIFY(this));
1628           VerificationType klass_type = cp_index_to_type(
1629             index, cp, CHECK_VERIFY(this));
1630           current_frame.push_stack(klass_type, CHECK_VERIFY(this));
1631           no_control_flow = false; break;
1632         }
1633         case Bytecodes::_instanceof : {
1634           index = bcs.get_index_u2();
1635           verify_cp_class_type(bci, index, cp, CHECK_VERIFY(this));
1636           current_frame.pop_stack(object_type(), CHECK_VERIFY(this));
1637           current_frame.push_stack(
1638             VerificationType::integer_type(), CHECK_VERIFY(this));
1639           no_control_flow = false; break;
1640         }
1641         case Bytecodes::_monitorenter :
1642         case Bytecodes::_monitorexit :
1643           current_frame.pop_stack(
1644             VerificationType::reference_check(), CHECK_VERIFY(this));
1645           no_control_flow = false; break;
1646         case Bytecodes::_multianewarray :
1647         {
1648           index = bcs.get_index_u2();
1649           u2 dim = *(bcs.bcp()+3);
1650           verify_cp_class_type(bci, index, cp, CHECK_VERIFY(this));
1651           VerificationType new_array_type =
1652             cp_index_to_type(index, cp, CHECK_VERIFY(this));
1653           if (!new_array_type.is_array()) {
1654             verify_error(ErrorContext::bad_type(bci,
1655                 TypeOrigin::cp(index, new_array_type)),
1656                 "Illegal constant pool index in multianewarray instruction");
1657             return;
1658           }
1659           if (dim < 1 || new_array_type.dimensions() < dim) {
1660             verify_error(ErrorContext::bad_code(bci),
1661                 "Illegal dimension in multianewarray instruction: %d", dim);
1662             return;
1663           }
1664           for (int i = 0; i < dim; i++) {
1665             current_frame.pop_stack(
1666               VerificationType::integer_type(), CHECK_VERIFY(this));
1667           }
1668           current_frame.push_stack(new_array_type, CHECK_VERIFY(this));
1669           no_control_flow = false; break;
1670         }
1671         case Bytecodes::_athrow :
1672           type = VerificationType::reference_type(
1673             vmSymbols::java_lang_Throwable());
1674           current_frame.pop_stack(type, CHECK_VERIFY(this));
1675           no_control_flow = true; break;
1676         default:
1677           // We only need to check the valid bytecodes in class file.
1678           // And jsr and ret are not in the new class file format in JDK1.5.
1679           verify_error(ErrorContext::bad_code(bci),
1680               "Bad instruction: %02x", opcode);
1681           no_control_flow = false;
1682           return;
1683       }  // end switch
1684     }  // end Merge with the next instruction
1685 
1686     // Look for possible jump target in exception handlers and see if it matches
1687     // current_frame.  Don't do this check if it has already been done (for
1688     // ([a,d,f,i,l]store* opcodes).  This check cannot be done earlier because
1689     // opcodes, such as invokespecial, may set the this_uninit flag.
1690     assert(!(verified_exc_handlers && this_uninit),
1691       "Exception handler targets got verified before this_uninit got set");
1692     if (!verified_exc_handlers && bci >= ex_min && bci < ex_max) {
1693       verify_exception_handler_targets(
1694         bci, this_uninit, &current_frame, &stackmap_table, CHECK_VERIFY(this));
1695     }
1696   } // end while
1697 
1698   // Make sure that control flow does not fall through end of the method
1699   if (!no_control_flow) {
1700     verify_error(ErrorContext::bad_code(code_length),
1701         "Control flow falls through code end");
1702     return;
1703   }
1704 }
1705 
1706 #undef bad_type_message
1707 
generate_code_data(methodHandle m,u4 code_length,TRAPS)1708 char* ClassVerifier::generate_code_data(methodHandle m, u4 code_length, TRAPS) {
1709   char* code_data = NEW_RESOURCE_ARRAY(char, code_length);
1710   memset(code_data, 0, sizeof(char) * code_length);
1711   RawBytecodeStream bcs(m);
1712 
1713   while (!bcs.is_last_bytecode()) {
1714     if (bcs.raw_next() != Bytecodes::_illegal) {
1715       int bci = bcs.bci();
1716       if (bcs.raw_code() == Bytecodes::_new) {
1717         code_data[bci] = NEW_OFFSET;
1718       } else {
1719         code_data[bci] = BYTECODE_OFFSET;
1720       }
1721     } else {
1722       verify_error(ErrorContext::bad_code(bcs.bci()), "Bad instruction");
1723       return NULL;
1724     }
1725   }
1726 
1727   return code_data;
1728 }
1729 
verify_exception_handler_table(u4 code_length,char * code_data,int & min,int & max,TRAPS)1730 void ClassVerifier::verify_exception_handler_table(u4 code_length, char* code_data, int& min, int& max, TRAPS) {
1731   ExceptionTable exhandlers(_method());
1732   int exlength = exhandlers.length();
1733   constantPoolHandle cp (THREAD, _method->constants());
1734 
1735   for(int i = 0; i < exlength; i++) {
1736     //reacquire the table in case a GC happened
1737     ExceptionTable exhandlers(_method());
1738     u2 start_pc = exhandlers.start_pc(i);
1739     u2 end_pc = exhandlers.end_pc(i);
1740     u2 handler_pc = exhandlers.handler_pc(i);
1741     if (start_pc >= code_length || code_data[start_pc] == 0) {
1742       class_format_error("Illegal exception table start_pc %d", start_pc);
1743       return;
1744     }
1745     if (end_pc != code_length) {   // special case: end_pc == code_length
1746       if (end_pc > code_length || code_data[end_pc] == 0) {
1747         class_format_error("Illegal exception table end_pc %d", end_pc);
1748         return;
1749       }
1750     }
1751     if (handler_pc >= code_length || code_data[handler_pc] == 0) {
1752       class_format_error("Illegal exception table handler_pc %d", handler_pc);
1753       return;
1754     }
1755     int catch_type_index = exhandlers.catch_type_index(i);
1756     if (catch_type_index != 0) {
1757       VerificationType catch_type = cp_index_to_type(
1758         catch_type_index, cp, CHECK_VERIFY(this));
1759       VerificationType throwable =
1760         VerificationType::reference_type(vmSymbols::java_lang_Throwable());
1761       bool is_subclass = throwable.is_assignable_from(
1762         catch_type, this, false, CHECK_VERIFY(this));
1763       if (!is_subclass) {
1764         // 4286534: should throw VerifyError according to recent spec change
1765         verify_error(ErrorContext::bad_type(handler_pc,
1766             TypeOrigin::cp(catch_type_index, catch_type),
1767             TypeOrigin::implicit(throwable)),
1768             "Catch type is not a subclass "
1769             "of Throwable in exception handler %d", handler_pc);
1770         return;
1771       }
1772     }
1773     if (start_pc < min) min = start_pc;
1774     if (end_pc > max) max = end_pc;
1775   }
1776 }
1777 
verify_local_variable_table(u4 code_length,char * code_data,TRAPS)1778 void ClassVerifier::verify_local_variable_table(u4 code_length, char* code_data, TRAPS) {
1779   int localvariable_table_length = _method()->localvariable_table_length();
1780   if (localvariable_table_length > 0) {
1781     LocalVariableTableElement* table = _method()->localvariable_table_start();
1782     for (int i = 0; i < localvariable_table_length; i++) {
1783       u2 start_bci = table[i].start_bci;
1784       u2 length = table[i].length;
1785 
1786       if (start_bci >= code_length || code_data[start_bci] == 0) {
1787         class_format_error(
1788           "Illegal local variable table start_pc %d", start_bci);
1789         return;
1790       }
1791       u4 end_bci = (u4)(start_bci + length);
1792       if (end_bci != code_length) {
1793         if (end_bci >= code_length || code_data[end_bci] == 0) {
1794           class_format_error( "Illegal local variable table length %d", length);
1795           return;
1796         }
1797       }
1798     }
1799   }
1800 }
1801 
verify_stackmap_table(u2 stackmap_index,u2 bci,StackMapFrame * current_frame,StackMapTable * stackmap_table,bool no_control_flow,TRAPS)1802 u2 ClassVerifier::verify_stackmap_table(u2 stackmap_index, u2 bci,
1803                                         StackMapFrame* current_frame,
1804                                         StackMapTable* stackmap_table,
1805                                         bool no_control_flow, TRAPS) {
1806   if (stackmap_index < stackmap_table->get_frame_count()) {
1807     u2 this_offset = stackmap_table->get_offset(stackmap_index);
1808     if (no_control_flow && this_offset > bci) {
1809       verify_error(ErrorContext::missing_stackmap(bci),
1810                    "Expecting a stack map frame");
1811       return 0;
1812     }
1813     if (this_offset == bci) {
1814       ErrorContext ctx;
1815       // See if current stack map can be assigned to the frame in table.
1816       // current_frame is the stackmap frame got from the last instruction.
1817       // If matched, current_frame will be updated by this method.
1818       bool matches = stackmap_table->match_stackmap(
1819         current_frame, this_offset, stackmap_index,
1820         !no_control_flow, true, &ctx, CHECK_VERIFY_(this, 0));
1821       if (!matches) {
1822         // report type error
1823         verify_error(ctx, "Instruction type does not match stack map");
1824         return 0;
1825       }
1826       stackmap_index++;
1827     } else if (this_offset < bci) {
1828       // current_offset should have met this_offset.
1829       class_format_error("Bad stack map offset %d", this_offset);
1830       return 0;
1831     }
1832   } else if (no_control_flow) {
1833     verify_error(ErrorContext::bad_code(bci), "Expecting a stack map frame");
1834     return 0;
1835   }
1836   return stackmap_index;
1837 }
1838 
verify_exception_handler_targets(u2 bci,bool this_uninit,StackMapFrame * current_frame,StackMapTable * stackmap_table,TRAPS)1839 void ClassVerifier::verify_exception_handler_targets(u2 bci, bool this_uninit, StackMapFrame* current_frame,
1840                                                      StackMapTable* stackmap_table, TRAPS) {
1841   constantPoolHandle cp (THREAD, _method->constants());
1842   ExceptionTable exhandlers(_method());
1843   int exlength = exhandlers.length();
1844   for(int i = 0; i < exlength; i++) {
1845     //reacquire the table in case a GC happened
1846     ExceptionTable exhandlers(_method());
1847     u2 start_pc = exhandlers.start_pc(i);
1848     u2 end_pc = exhandlers.end_pc(i);
1849     u2 handler_pc = exhandlers.handler_pc(i);
1850     int catch_type_index = exhandlers.catch_type_index(i);
1851     if(bci >= start_pc && bci < end_pc) {
1852       u1 flags = current_frame->flags();
1853       if (this_uninit) {  flags |= FLAG_THIS_UNINIT; }
1854       StackMapFrame* new_frame = current_frame->frame_in_exception_handler(flags);
1855       if (catch_type_index != 0) {
1856         // We know that this index refers to a subclass of Throwable
1857         VerificationType catch_type = cp_index_to_type(
1858           catch_type_index, cp, CHECK_VERIFY(this));
1859         new_frame->push_stack(catch_type, CHECK_VERIFY(this));
1860       } else {
1861         VerificationType throwable =
1862           VerificationType::reference_type(vmSymbols::java_lang_Throwable());
1863         new_frame->push_stack(throwable, CHECK_VERIFY(this));
1864       }
1865       ErrorContext ctx;
1866       bool matches = stackmap_table->match_stackmap(
1867         new_frame, handler_pc, true, false, &ctx, CHECK_VERIFY(this));
1868       if (!matches) {
1869         verify_error(ctx, "Stack map does not match the one at "
1870             "exception handler %d", handler_pc);
1871         return;
1872       }
1873     }
1874   }
1875 }
1876 
verify_cp_index(u2 bci,constantPoolHandle cp,int index,TRAPS)1877 void ClassVerifier::verify_cp_index(
1878     u2 bci, constantPoolHandle cp, int index, TRAPS) {
1879   int nconstants = cp->length();
1880   if ((index <= 0) || (index >= nconstants)) {
1881     verify_error(ErrorContext::bad_cp_index(bci, index),
1882         "Illegal constant pool index %d in class %s",
1883         index, cp->pool_holder()->external_name());
1884     return;
1885   }
1886 }
1887 
verify_cp_type(u2 bci,int index,constantPoolHandle cp,unsigned int types,TRAPS)1888 void ClassVerifier::verify_cp_type(
1889     u2 bci, int index, constantPoolHandle cp, unsigned int types, TRAPS) {
1890 
1891   // In some situations, bytecode rewriting may occur while we're verifying.
1892   // In this case, a constant pool cache exists and some indices refer to that
1893   // instead.  Be sure we don't pick up such indices by accident.
1894   // We must check was_recursively_verified() before we get here.
1895   guarantee(cp->cache() == NULL, "not rewritten yet");
1896 
1897   verify_cp_index(bci, cp, index, CHECK_VERIFY(this));
1898   unsigned int tag = cp->tag_at(index).value();
1899   if ((types & (1 << tag)) == 0) {
1900     verify_error(ErrorContext::bad_cp_index(bci, index),
1901       "Illegal type at constant pool entry %d in class %s",
1902       index, cp->pool_holder()->external_name());
1903     return;
1904   }
1905 }
1906 
verify_cp_class_type(u2 bci,int index,constantPoolHandle cp,TRAPS)1907 void ClassVerifier::verify_cp_class_type(
1908     u2 bci, int index, constantPoolHandle cp, TRAPS) {
1909   verify_cp_index(bci, cp, index, CHECK_VERIFY(this));
1910   constantTag tag = cp->tag_at(index);
1911   if (!tag.is_klass() && !tag.is_unresolved_klass()) {
1912     verify_error(ErrorContext::bad_cp_index(bci, index),
1913         "Illegal type at constant pool entry %d in class %s",
1914         index, cp->pool_holder()->external_name());
1915     return;
1916   }
1917 }
1918 
verify_error(ErrorContext ctx,const char * msg,...)1919 void ClassVerifier::verify_error(ErrorContext ctx, const char* msg, ...) {
1920   stringStream ss;
1921 
1922   ctx.reset_frames();
1923   _exception_type = vmSymbols::java_lang_VerifyError();
1924   _error_context = ctx;
1925   va_list va;
1926   va_start(va, msg);
1927   ss.vprint(msg, va);
1928   va_end(va);
1929   _message = ss.as_string();
1930 #ifdef ASSERT
1931   ResourceMark rm;
1932   const char* exception_name = _exception_type->as_C_string();
1933   Exceptions::debug_check_abort(exception_name, NULL);
1934 #endif // ndef ASSERT
1935 }
1936 
class_format_error(const char * msg,...)1937 void ClassVerifier::class_format_error(const char* msg, ...) {
1938   stringStream ss;
1939   _exception_type = vmSymbols::java_lang_ClassFormatError();
1940   va_list va;
1941   va_start(va, msg);
1942   ss.vprint(msg, va);
1943   va_end(va);
1944   if (!_method.is_null()) {
1945     ss.print(" in method %s", _method->name_and_sig_as_C_string());
1946   }
1947   _message = ss.as_string();
1948 }
1949 
load_class(Symbol * name,TRAPS)1950 Klass* ClassVerifier::load_class(Symbol* name, TRAPS) {
1951   // Get current loader and protection domain first.
1952   oop loader = current_class()->class_loader();
1953   oop protection_domain = current_class()->protection_domain();
1954 
1955   return SystemDictionary::resolve_or_fail(
1956     name, Handle(THREAD, loader), Handle(THREAD, protection_domain),
1957     true, CHECK_NULL);
1958 }
1959 
is_protected_access(instanceKlassHandle this_class,Klass * target_class,Symbol * field_name,Symbol * field_sig,bool is_method)1960 bool ClassVerifier::is_protected_access(instanceKlassHandle this_class,
1961                                         Klass* target_class,
1962                                         Symbol* field_name,
1963                                         Symbol* field_sig,
1964                                         bool is_method) {
1965   No_Safepoint_Verifier nosafepoint;
1966 
1967   // If target class isn't a super class of this class, we don't worry about this case
1968   if (!this_class->is_subclass_of(target_class)) {
1969     return false;
1970   }
1971   // Check if the specified method or field is protected
1972   InstanceKlass* target_instance = InstanceKlass::cast(target_class);
1973   fieldDescriptor fd;
1974   if (is_method) {
1975     Method* m = target_instance->uncached_lookup_method(field_name, field_sig, Klass::find_overpass);
1976     if (m != NULL && m->is_protected()) {
1977       if (!this_class->is_same_class_package(m->method_holder())) {
1978         return true;
1979       }
1980     }
1981   } else {
1982     Klass* member_klass = target_instance->find_field(field_name, field_sig, &fd);
1983     if (member_klass != NULL && fd.is_protected()) {
1984       if (!this_class->is_same_class_package(member_klass)) {
1985         return true;
1986       }
1987     }
1988   }
1989   return false;
1990 }
1991 
verify_ldc(int opcode,u2 index,StackMapFrame * current_frame,constantPoolHandle cp,u2 bci,TRAPS)1992 void ClassVerifier::verify_ldc(
1993     int opcode, u2 index, StackMapFrame* current_frame,
1994     constantPoolHandle cp, u2 bci, TRAPS) {
1995   verify_cp_index(bci, cp, index, CHECK_VERIFY(this));
1996   constantTag tag = cp->tag_at(index);
1997   unsigned int types;
1998   if (opcode == Bytecodes::_ldc || opcode == Bytecodes::_ldc_w) {
1999     if (!tag.is_unresolved_klass()) {
2000       types = (1 << JVM_CONSTANT_Integer) | (1 << JVM_CONSTANT_Float)
2001             | (1 << JVM_CONSTANT_String)  | (1 << JVM_CONSTANT_Class)
2002             | (1 << JVM_CONSTANT_MethodHandle) | (1 << JVM_CONSTANT_MethodType);
2003       // Note:  The class file parser already verified the legality of
2004       // MethodHandle and MethodType constants.
2005       verify_cp_type(bci, index, cp, types, CHECK_VERIFY(this));
2006     }
2007   } else {
2008     assert(opcode == Bytecodes::_ldc2_w, "must be ldc2_w");
2009     types = (1 << JVM_CONSTANT_Double) | (1 << JVM_CONSTANT_Long);
2010     verify_cp_type(bci, index, cp, types, CHECK_VERIFY(this));
2011   }
2012   if (tag.is_string() && cp->is_pseudo_string_at(index)) {
2013     current_frame->push_stack(object_type(), CHECK_VERIFY(this));
2014   } else if (tag.is_string()) {
2015     current_frame->push_stack(
2016       VerificationType::reference_type(
2017         vmSymbols::java_lang_String()), CHECK_VERIFY(this));
2018   } else if (tag.is_klass() || tag.is_unresolved_klass()) {
2019     current_frame->push_stack(
2020       VerificationType::reference_type(
2021         vmSymbols::java_lang_Class()), CHECK_VERIFY(this));
2022   } else if (tag.is_int()) {
2023     current_frame->push_stack(
2024       VerificationType::integer_type(), CHECK_VERIFY(this));
2025   } else if (tag.is_float()) {
2026     current_frame->push_stack(
2027       VerificationType::float_type(), CHECK_VERIFY(this));
2028   } else if (tag.is_double()) {
2029     current_frame->push_stack_2(
2030       VerificationType::double_type(),
2031       VerificationType::double2_type(), CHECK_VERIFY(this));
2032   } else if (tag.is_long()) {
2033     current_frame->push_stack_2(
2034       VerificationType::long_type(),
2035       VerificationType::long2_type(), CHECK_VERIFY(this));
2036   } else if (tag.is_method_handle()) {
2037     current_frame->push_stack(
2038       VerificationType::reference_type(
2039         vmSymbols::java_lang_invoke_MethodHandle()), CHECK_VERIFY(this));
2040   } else if (tag.is_method_type()) {
2041     current_frame->push_stack(
2042       VerificationType::reference_type(
2043         vmSymbols::java_lang_invoke_MethodType()), CHECK_VERIFY(this));
2044   } else {
2045     /* Unreachable? verify_cp_type has already validated the cp type. */
2046     verify_error(
2047         ErrorContext::bad_cp_index(bci, index), "Invalid index in ldc");
2048     return;
2049   }
2050 }
2051 
verify_switch(RawBytecodeStream * bcs,u4 code_length,char * code_data,StackMapFrame * current_frame,StackMapTable * stackmap_table,TRAPS)2052 void ClassVerifier::verify_switch(
2053     RawBytecodeStream* bcs, u4 code_length, char* code_data,
2054     StackMapFrame* current_frame, StackMapTable* stackmap_table, TRAPS) {
2055   int bci = bcs->bci();
2056   address bcp = bcs->bcp();
2057   address aligned_bcp = (address) round_to((intptr_t)(bcp + 1), jintSize);
2058 
2059   if (_klass->major_version() < NONZERO_PADDING_BYTES_IN_SWITCH_MAJOR_VERSION) {
2060     // 4639449 & 4647081: padding bytes must be 0
2061     u2 padding_offset = 1;
2062     while ((bcp + padding_offset) < aligned_bcp) {
2063       if(*(bcp + padding_offset) != 0) {
2064         verify_error(ErrorContext::bad_code(bci),
2065                      "Nonzero padding byte in lookswitch or tableswitch");
2066         return;
2067       }
2068       padding_offset++;
2069     }
2070   }
2071 
2072   int default_offset = (int) Bytes::get_Java_u4(aligned_bcp);
2073   int keys, delta;
2074   current_frame->pop_stack(
2075     VerificationType::integer_type(), CHECK_VERIFY(this));
2076   if (bcs->raw_code() == Bytecodes::_tableswitch) {
2077     jint low = (jint)Bytes::get_Java_u4(aligned_bcp + jintSize);
2078     jint high = (jint)Bytes::get_Java_u4(aligned_bcp + 2*jintSize);
2079     if (low > high) {
2080       verify_error(ErrorContext::bad_code(bci),
2081           "low must be less than or equal to high in tableswitch");
2082       return;
2083     }
2084     keys = high - low + 1;
2085     if (keys < 0) {
2086       verify_error(ErrorContext::bad_code(bci), "too many keys in tableswitch");
2087       return;
2088     }
2089     delta = 1;
2090   } else {
2091     keys = (int)Bytes::get_Java_u4(aligned_bcp + jintSize);
2092     if (keys < 0) {
2093       verify_error(ErrorContext::bad_code(bci),
2094                    "number of keys in lookupswitch less than 0");
2095       return;
2096     }
2097     delta = 2;
2098     // Make sure that the lookupswitch items are sorted
2099     for (int i = 0; i < (keys - 1); i++) {
2100       jint this_key = Bytes::get_Java_u4(aligned_bcp + (2+2*i)*jintSize);
2101       jint next_key = Bytes::get_Java_u4(aligned_bcp + (2+2*i+2)*jintSize);
2102       if (this_key >= next_key) {
2103         verify_error(ErrorContext::bad_code(bci),
2104                      "Bad lookupswitch instruction");
2105         return;
2106       }
2107     }
2108   }
2109   int target = bci + default_offset;
2110   stackmap_table->check_jump_target(current_frame, target, CHECK_VERIFY(this));
2111   for (int i = 0; i < keys; i++) {
2112     // Because check_jump_target() may safepoint, the bytecode could have
2113     // moved, which means 'aligned_bcp' is no good and needs to be recalculated.
2114     aligned_bcp = (address)round_to((intptr_t)(bcs->bcp() + 1), jintSize);
2115     target = bci + (jint)Bytes::get_Java_u4(aligned_bcp+(3+i*delta)*jintSize);
2116     stackmap_table->check_jump_target(
2117       current_frame, target, CHECK_VERIFY(this));
2118   }
2119   NOT_PRODUCT(aligned_bcp = NULL);  // no longer valid at this point
2120 }
2121 
name_in_supers(Symbol * ref_name,instanceKlassHandle current)2122 bool ClassVerifier::name_in_supers(
2123     Symbol* ref_name, instanceKlassHandle current) {
2124   Klass* super = current->super();
2125   while (super != NULL) {
2126     if (super->name() == ref_name) {
2127       return true;
2128     }
2129     super = super->super();
2130   }
2131   return false;
2132 }
2133 
verify_field_instructions(RawBytecodeStream * bcs,StackMapFrame * current_frame,constantPoolHandle cp,TRAPS)2134 void ClassVerifier::verify_field_instructions(RawBytecodeStream* bcs,
2135                                               StackMapFrame* current_frame,
2136                                               constantPoolHandle cp,
2137                                               TRAPS) {
2138   u2 index = bcs->get_index_u2();
2139   verify_cp_type(bcs->bci(), index, cp,
2140       1 << JVM_CONSTANT_Fieldref, CHECK_VERIFY(this));
2141 
2142   // Get field name and signature
2143   Symbol* field_name = cp->name_ref_at(index);
2144   Symbol* field_sig = cp->signature_ref_at(index);
2145   bool is_getfield = false;
2146 
2147   if (!SignatureVerifier::is_valid_type_signature(field_sig)) {
2148     class_format_error(
2149       "Invalid signature for field in class %s referenced "
2150       "from constant pool index %d", _klass->external_name(), index);
2151     return;
2152   }
2153 
2154   // Get referenced class type
2155   VerificationType ref_class_type = cp_ref_index_to_type(
2156     index, cp, CHECK_VERIFY(this));
2157   if (!ref_class_type.is_object()) {
2158     /* Unreachable?  Class file parser verifies Fieldref contents */
2159     verify_error(ErrorContext::bad_type(bcs->bci(),
2160         TypeOrigin::cp(index, ref_class_type)),
2161         "Expecting reference to class in class %s at constant pool index %d",
2162         _klass->external_name(), index);
2163     return;
2164   }
2165   VerificationType target_class_type = ref_class_type;
2166 
2167   assert(sizeof(VerificationType) == sizeof(uintptr_t),
2168         "buffer type must match VerificationType size");
2169   uintptr_t field_type_buffer[2];
2170   VerificationType* field_type = (VerificationType*)field_type_buffer;
2171   // If we make a VerificationType[2] array directly, the compiler calls
2172   // to the c-runtime library to do the allocation instead of just
2173   // stack allocating it.  Plus it would run constructors.  This shows up
2174   // in performance profiles.
2175 
2176   SignatureStream sig_stream(field_sig, false);
2177   VerificationType stack_object_type;
2178   int n = change_sig_to_verificationType(
2179     &sig_stream, field_type, CHECK_VERIFY(this));
2180   u2 bci = bcs->bci();
2181   bool is_assignable;
2182   switch (bcs->raw_code()) {
2183     case Bytecodes::_getstatic: {
2184       for (int i = 0; i < n; i++) {
2185         current_frame->push_stack(field_type[i], CHECK_VERIFY(this));
2186       }
2187       break;
2188     }
2189     case Bytecodes::_putstatic: {
2190       for (int i = n - 1; i >= 0; i--) {
2191         current_frame->pop_stack(field_type[i], CHECK_VERIFY(this));
2192       }
2193       break;
2194     }
2195     case Bytecodes::_getfield: {
2196       is_getfield = true;
2197       stack_object_type = current_frame->pop_stack(
2198         target_class_type, CHECK_VERIFY(this));
2199       goto check_protected;
2200     }
2201     case Bytecodes::_putfield: {
2202       for (int i = n - 1; i >= 0; i--) {
2203         current_frame->pop_stack(field_type[i], CHECK_VERIFY(this));
2204       }
2205       stack_object_type = current_frame->pop_stack(CHECK_VERIFY(this));
2206 
2207       // The JVMS 2nd edition allows field initialization before the superclass
2208       // initializer, if the field is defined within the current class.
2209       fieldDescriptor fd;
2210       if (stack_object_type == VerificationType::uninitialized_this_type() &&
2211           target_class_type.equals(current_type()) &&
2212           _klass->find_local_field(field_name, field_sig, &fd)) {
2213         stack_object_type = current_type();
2214       }
2215       is_assignable = target_class_type.is_assignable_from(
2216         stack_object_type, this, false, CHECK_VERIFY(this));
2217       if (!is_assignable) {
2218         verify_error(ErrorContext::bad_type(bci,
2219             current_frame->stack_top_ctx(),
2220             TypeOrigin::cp(index, target_class_type)),
2221             "Bad type on operand stack in putfield");
2222         return;
2223       }
2224     }
2225     check_protected: {
2226       if (_this_type == stack_object_type)
2227         break; // stack_object_type must be assignable to _current_class_type
2228       if (was_recursively_verified()) {
2229         if (is_getfield) {
2230           // Push field type for getfield.
2231           for (int i = 0; i < n; i++) {
2232             current_frame->push_stack(field_type[i], CHECK_VERIFY(this));
2233           }
2234         }
2235         return;
2236       }
2237       Symbol* ref_class_name =
2238         cp->klass_name_at(cp->klass_ref_index_at(index));
2239       if (!name_in_supers(ref_class_name, current_class()))
2240         // stack_object_type must be assignable to _current_class_type since:
2241         // 1. stack_object_type must be assignable to ref_class.
2242         // 2. ref_class must be _current_class or a subclass of it. It can't
2243         //    be a superclass of it. See revised JVMS 5.4.4.
2244         break;
2245 
2246       Klass* ref_class_oop = load_class(ref_class_name, CHECK);
2247       if (is_protected_access(current_class(), ref_class_oop, field_name,
2248                               field_sig, false)) {
2249         // It's protected access, check if stack object is assignable to
2250         // current class.
2251         is_assignable = current_type().is_assignable_from(
2252           stack_object_type, this, true, CHECK_VERIFY(this));
2253         if (!is_assignable) {
2254           verify_error(ErrorContext::bad_type(bci,
2255               current_frame->stack_top_ctx(),
2256               TypeOrigin::implicit(current_type())),
2257               "Bad access to protected data in getfield");
2258           return;
2259         }
2260       }
2261       break;
2262     }
2263     default: ShouldNotReachHere();
2264   }
2265   if (is_getfield) {
2266     // Push field type for getfield after doing protection check.
2267     for (int i = 0; i < n; i++) {
2268       current_frame->push_stack(field_type[i], CHECK_VERIFY(this));
2269     }
2270   }
2271 }
2272 
2273 // Look at the method's handlers.  If the bci is in the handler's try block
2274 // then check if the handler_pc is already on the stack.  If not, push it
2275 // unless the handler has already been scanned.
push_handlers(ExceptionTable * exhandlers,GrowableArray<u4> * handler_list,GrowableArray<u4> * handler_stack,u4 bci)2276 void ClassVerifier::push_handlers(ExceptionTable* exhandlers,
2277                                   GrowableArray<u4>* handler_list,
2278                                   GrowableArray<u4>* handler_stack,
2279                                   u4 bci) {
2280   int exlength = exhandlers->length();
2281   for(int x = 0; x < exlength; x++) {
2282     if (bci >= exhandlers->start_pc(x) && bci < exhandlers->end_pc(x)) {
2283       u4 exhandler_pc = exhandlers->handler_pc(x);
2284       if (!handler_list->contains(exhandler_pc)) {
2285         handler_stack->append_if_missing(exhandler_pc);
2286         handler_list->append(exhandler_pc);
2287       }
2288     }
2289   }
2290 }
2291 
2292 // Return TRUE if all code paths starting with start_bc_offset end in
2293 // bytecode athrow or loop.
ends_in_athrow(u4 start_bc_offset)2294 bool ClassVerifier::ends_in_athrow(u4 start_bc_offset) {
2295   ResourceMark rm;
2296   // Create bytecode stream.
2297   RawBytecodeStream bcs(method());
2298   u4 code_length = method()->code_size();
2299   bcs.set_start(start_bc_offset);
2300   u4 target;
2301   // Create stack for storing bytecode start offsets for if* and *switch.
2302   GrowableArray<u4>* bci_stack = new GrowableArray<u4>(30);
2303   // Create stack for handlers for try blocks containing this handler.
2304   GrowableArray<u4>* handler_stack = new GrowableArray<u4>(30);
2305   // Create list of handlers that have been pushed onto the handler_stack
2306   // so that handlers embedded inside of their own TRY blocks only get
2307   // scanned once.
2308   GrowableArray<u4>* handler_list = new GrowableArray<u4>(30);
2309   // Create list of visited branch opcodes (goto* and if*).
2310   GrowableArray<u4>* visited_branches = new GrowableArray<u4>(30);
2311   ExceptionTable exhandlers(_method());
2312 
2313   while (true) {
2314     if (bcs.is_last_bytecode()) {
2315       // if no more starting offsets to parse or if at the end of the
2316       // method then return false.
2317       if ((bci_stack->is_empty()) || ((u4)bcs.end_bci() == code_length))
2318         return false;
2319       // Pop a bytecode starting offset and scan from there.
2320       bcs.set_start(bci_stack->pop());
2321     }
2322     Bytecodes::Code opcode = bcs.raw_next();
2323     u4 bci = bcs.bci();
2324 
2325     // If the bytecode is in a TRY block, push its handlers so they
2326     // will get parsed.
2327     push_handlers(&exhandlers, handler_list, handler_stack, bci);
2328 
2329     switch (opcode) {
2330       case Bytecodes::_if_icmpeq:
2331       case Bytecodes::_if_icmpne:
2332       case Bytecodes::_if_icmplt:
2333       case Bytecodes::_if_icmpge:
2334       case Bytecodes::_if_icmpgt:
2335       case Bytecodes::_if_icmple:
2336       case Bytecodes::_ifeq:
2337       case Bytecodes::_ifne:
2338       case Bytecodes::_iflt:
2339       case Bytecodes::_ifge:
2340       case Bytecodes::_ifgt:
2341       case Bytecodes::_ifle:
2342       case Bytecodes::_if_acmpeq:
2343       case Bytecodes::_if_acmpne:
2344       case Bytecodes::_ifnull:
2345       case Bytecodes::_ifnonnull:
2346         target = bcs.dest();
2347         if (visited_branches->contains(bci)) {
2348           if (bci_stack->is_empty()) {
2349             if (handler_stack->is_empty()) {
2350               return true;
2351             } else {
2352               // Parse the catch handlers for try blocks containing athrow.
2353               bcs.set_start(handler_stack->pop());
2354             }
2355           } else {
2356             // Pop a bytecode starting offset and scan from there.
2357             bcs.set_start(bci_stack->pop());
2358           }
2359         } else {
2360           if (target > bci) { // forward branch
2361             if (target >= code_length) return false;
2362             // Push the branch target onto the stack.
2363             bci_stack->push(target);
2364             // then, scan bytecodes starting with next.
2365             bcs.set_start(bcs.next_bci());
2366           } else { // backward branch
2367             // Push bytecode offset following backward branch onto the stack.
2368             bci_stack->push(bcs.next_bci());
2369             // Check bytecodes starting with branch target.
2370             bcs.set_start(target);
2371           }
2372           // Record target so we don't branch here again.
2373           visited_branches->append(bci);
2374         }
2375         break;
2376 
2377       case Bytecodes::_goto:
2378       case Bytecodes::_goto_w:
2379         target = (opcode == Bytecodes::_goto ? bcs.dest() : bcs.dest_w());
2380         if (visited_branches->contains(bci)) {
2381           if (bci_stack->is_empty()) {
2382             if (handler_stack->is_empty()) {
2383               return true;
2384             } else {
2385               // Parse the catch handlers for try blocks containing athrow.
2386               bcs.set_start(handler_stack->pop());
2387             }
2388           } else {
2389             // Been here before, pop new starting offset from stack.
2390             bcs.set_start(bci_stack->pop());
2391           }
2392         } else {
2393           if (target >= code_length) return false;
2394           // Continue scanning from the target onward.
2395           bcs.set_start(target);
2396           // Record target so we don't branch here again.
2397           visited_branches->append(bci);
2398         }
2399         break;
2400 
2401       // Check that all switch alternatives end in 'athrow' bytecodes. Since it
2402       // is  difficult to determine where each switch alternative ends, parse
2403       // each switch alternative until either hit a 'return', 'athrow', or reach
2404       // the end of the method's bytecodes.  This is gross but should be okay
2405       // because:
2406       // 1. tableswitch and lookupswitch byte codes in handlers for ctor explicit
2407       //    constructor invocations should be rare.
2408       // 2. if each switch alternative ends in an athrow then the parsing should be
2409       //    short.  If there is no athrow then it is bogus code, anyway.
2410       case Bytecodes::_lookupswitch:
2411       case Bytecodes::_tableswitch:
2412         {
2413           address aligned_bcp = (address) round_to((intptr_t)(bcs.bcp() + 1), jintSize);
2414           u4 default_offset = Bytes::get_Java_u4(aligned_bcp) + bci;
2415           int keys, delta;
2416           if (opcode == Bytecodes::_tableswitch) {
2417             jint low = (jint)Bytes::get_Java_u4(aligned_bcp + jintSize);
2418             jint high = (jint)Bytes::get_Java_u4(aligned_bcp + 2*jintSize);
2419             // This is invalid, but let the regular bytecode verifier
2420             // report this because the user will get a better error message.
2421             if (low > high) return true;
2422             keys = high - low + 1;
2423             delta = 1;
2424           } else {
2425             keys = (int)Bytes::get_Java_u4(aligned_bcp + jintSize);
2426             delta = 2;
2427           }
2428           // Invalid, let the regular bytecode verifier deal with it.
2429           if (keys < 0) return true;
2430 
2431           // Push the offset of the next bytecode onto the stack.
2432           bci_stack->push(bcs.next_bci());
2433 
2434           // Push the switch alternatives onto the stack.
2435           for (int i = 0; i < keys; i++) {
2436             u4 target = bci + (jint)Bytes::get_Java_u4(aligned_bcp+(3+i*delta)*jintSize);
2437             if (target > code_length) return false;
2438             bci_stack->push(target);
2439           }
2440 
2441           // Start bytecode parsing for the switch at the default alternative.
2442           if (default_offset > code_length) return false;
2443           bcs.set_start(default_offset);
2444           break;
2445         }
2446 
2447       case Bytecodes::_return:
2448         return false;
2449 
2450       case Bytecodes::_athrow:
2451         {
2452           if (bci_stack->is_empty()) {
2453             if (handler_stack->is_empty()) {
2454               return true;
2455             } else {
2456               // Parse the catch handlers for try blocks containing athrow.
2457               bcs.set_start(handler_stack->pop());
2458             }
2459           } else {
2460             // Pop a bytecode offset and starting scanning from there.
2461             bcs.set_start(bci_stack->pop());
2462           }
2463         }
2464         break;
2465 
2466       default:
2467         ;
2468     } // end switch
2469   } // end while loop
2470 
2471   return false;
2472 }
2473 
verify_invoke_init(RawBytecodeStream * bcs,u2 ref_class_index,VerificationType ref_class_type,StackMapFrame * current_frame,u4 code_length,bool in_try_block,bool * this_uninit,constantPoolHandle cp,StackMapTable * stackmap_table,TRAPS)2474 void ClassVerifier::verify_invoke_init(
2475     RawBytecodeStream* bcs, u2 ref_class_index, VerificationType ref_class_type,
2476     StackMapFrame* current_frame, u4 code_length, bool in_try_block,
2477     bool *this_uninit, constantPoolHandle cp, StackMapTable* stackmap_table,
2478     TRAPS) {
2479   u2 bci = bcs->bci();
2480   VerificationType type = current_frame->pop_stack(
2481     VerificationType::reference_check(), CHECK_VERIFY(this));
2482   if (type == VerificationType::uninitialized_this_type()) {
2483     // The method must be an <init> method of this class or its superclass
2484     Klass* superk = current_class()->super();
2485     if (ref_class_type.name() != current_class()->name() &&
2486         ref_class_type.name() != superk->name()) {
2487       verify_error(ErrorContext::bad_type(bci,
2488           TypeOrigin::implicit(ref_class_type),
2489           TypeOrigin::implicit(current_type())),
2490           "Bad <init> method call");
2491       return;
2492     }
2493 
2494     // If this invokespecial call is done from inside of a TRY block then make
2495     // sure that all catch clause paths end in a throw.  Otherwise, this can
2496     // result in returning an incomplete object.
2497     if (in_try_block) {
2498       ExceptionTable exhandlers(_method());
2499       int exlength = exhandlers.length();
2500       for(int i = 0; i < exlength; i++) {
2501         u2 start_pc = exhandlers.start_pc(i);
2502         u2 end_pc = exhandlers.end_pc(i);
2503 
2504         if (bci >= start_pc && bci < end_pc) {
2505           if (!ends_in_athrow(exhandlers.handler_pc(i))) {
2506             verify_error(ErrorContext::bad_code(bci),
2507               "Bad <init> method call from after the start of a try block");
2508             return;
2509           } else if (VerboseVerification) {
2510             ResourceMark rm;
2511             tty->print_cr(
2512               "Survived call to ends_in_athrow(): %s",
2513               current_class()->name()->as_C_string());
2514           }
2515         }
2516       }
2517 
2518       // Check the exception handler target stackmaps with the locals from the
2519       // incoming stackmap (before initialize_object() changes them to outgoing
2520       // state).
2521       verify_exception_handler_targets(bci, true, current_frame,
2522                                        stackmap_table, CHECK_VERIFY(this));
2523     } // in_try_block
2524 
2525     current_frame->initialize_object(type, current_type());
2526     *this_uninit = true;
2527   } else if (type.is_uninitialized()) {
2528     u2 new_offset = type.bci();
2529     address new_bcp = bcs->bcp() - bci + new_offset;
2530     if (new_offset > (code_length - 3) || (*new_bcp) != Bytecodes::_new) {
2531       /* Unreachable?  Stack map parsing ensures valid type and new
2532        * instructions have a valid BCI. */
2533       verify_error(ErrorContext::bad_code(new_offset),
2534                    "Expecting new instruction");
2535       return;
2536     }
2537     u2 new_class_index = Bytes::get_Java_u2(new_bcp + 1);
2538     verify_cp_class_type(bci, new_class_index, cp, CHECK_VERIFY(this));
2539 
2540     // The method must be an <init> method of the indicated class
2541     VerificationType new_class_type = cp_index_to_type(
2542       new_class_index, cp, CHECK_VERIFY(this));
2543     if (!new_class_type.equals(ref_class_type)) {
2544       verify_error(ErrorContext::bad_type(bci,
2545           TypeOrigin::cp(new_class_index, new_class_type),
2546           TypeOrigin::cp(ref_class_index, ref_class_type)),
2547           "Call to wrong <init> method");
2548       return;
2549     }
2550     // According to the VM spec, if the referent class is a superclass of the
2551     // current class, and is in a different runtime package, and the method is
2552     // protected, then the objectref must be the current class or a subclass
2553     // of the current class.
2554     VerificationType objectref_type = new_class_type;
2555     if (name_in_supers(ref_class_type.name(), current_class())) {
2556       Klass* ref_klass = load_class(ref_class_type.name(), CHECK);
2557       Method* m = InstanceKlass::cast(ref_klass)->uncached_lookup_method(
2558         vmSymbols::object_initializer_name(),
2559         cp->signature_ref_at(bcs->get_index_u2()), Klass::find_overpass);
2560       // Do nothing if method is not found.  Let resolution detect the error.
2561       if (m != NULL) {
2562         instanceKlassHandle mh(THREAD, m->method_holder());
2563         if (m->is_protected() && !mh->is_same_class_package(_klass())) {
2564           bool assignable = current_type().is_assignable_from(
2565             objectref_type, this, true, CHECK_VERIFY(this));
2566           if (!assignable) {
2567             verify_error(ErrorContext::bad_type(bci,
2568                 TypeOrigin::cp(new_class_index, objectref_type),
2569                 TypeOrigin::implicit(current_type())),
2570                 "Bad access to protected <init> method");
2571             return;
2572           }
2573         }
2574       }
2575     }
2576     // Check the exception handler target stackmaps with the locals from the
2577     // incoming stackmap (before initialize_object() changes them to outgoing
2578     // state).
2579     if (in_try_block) {
2580       verify_exception_handler_targets(bci, *this_uninit, current_frame,
2581                                        stackmap_table, CHECK_VERIFY(this));
2582     }
2583     current_frame->initialize_object(type, new_class_type);
2584   } else {
2585     verify_error(ErrorContext::bad_type(bci, current_frame->stack_top_ctx()),
2586         "Bad operand type when invoking <init>");
2587     return;
2588   }
2589 }
2590 
is_same_or_direct_interface(instanceKlassHandle klass,VerificationType klass_type,VerificationType ref_class_type)2591 bool ClassVerifier::is_same_or_direct_interface(
2592     instanceKlassHandle klass,
2593     VerificationType klass_type,
2594     VerificationType ref_class_type) {
2595   if (ref_class_type.equals(klass_type)) return true;
2596   Array<Klass*>* local_interfaces = klass->local_interfaces();
2597   if (local_interfaces != NULL) {
2598     for (int x = 0; x < local_interfaces->length(); x++) {
2599       Klass* k = local_interfaces->at(x);
2600       assert (k != NULL && k->is_interface(), "invalid interface");
2601       if (ref_class_type.equals(VerificationType::reference_type(k->name()))) {
2602         return true;
2603       }
2604     }
2605   }
2606   return false;
2607 }
2608 
verify_invoke_instructions(RawBytecodeStream * bcs,u4 code_length,StackMapFrame * current_frame,bool in_try_block,bool * this_uninit,VerificationType return_type,constantPoolHandle cp,StackMapTable * stackmap_table,TRAPS)2609 void ClassVerifier::verify_invoke_instructions(
2610     RawBytecodeStream* bcs, u4 code_length, StackMapFrame* current_frame,
2611     bool in_try_block, bool *this_uninit, VerificationType return_type,
2612     constantPoolHandle cp, StackMapTable* stackmap_table, TRAPS) {
2613   // Make sure the constant pool item is the right type
2614   u2 index = bcs->get_index_u2();
2615   Bytecodes::Code opcode = bcs->raw_code();
2616   unsigned int types;
2617   switch (opcode) {
2618     case Bytecodes::_invokeinterface:
2619       types = 1 << JVM_CONSTANT_InterfaceMethodref;
2620       break;
2621     case Bytecodes::_invokedynamic:
2622       types = 1 << JVM_CONSTANT_InvokeDynamic;
2623       break;
2624     case Bytecodes::_invokespecial:
2625     case Bytecodes::_invokestatic:
2626       types = (_klass->major_version() < STATIC_METHOD_IN_INTERFACE_MAJOR_VERSION) ?
2627         (1 << JVM_CONSTANT_Methodref) :
2628         ((1 << JVM_CONSTANT_InterfaceMethodref) | (1 << JVM_CONSTANT_Methodref));
2629       break;
2630     default:
2631       types = 1 << JVM_CONSTANT_Methodref;
2632   }
2633   verify_cp_type(bcs->bci(), index, cp, types, CHECK_VERIFY(this));
2634 
2635   // Get method name and signature
2636   Symbol* method_name = cp->name_ref_at(index);
2637   Symbol* method_sig = cp->signature_ref_at(index);
2638 
2639   if (!SignatureVerifier::is_valid_method_signature(method_sig)) {
2640     class_format_error(
2641       "Invalid method signature in class %s referenced "
2642       "from constant pool index %d", _klass->external_name(), index);
2643     return;
2644   }
2645 
2646   // Get referenced class type
2647   VerificationType ref_class_type;
2648   if (opcode == Bytecodes::_invokedynamic) {
2649     if (!EnableInvokeDynamic ||
2650         _klass->major_version() < Verifier::INVOKEDYNAMIC_MAJOR_VERSION) {
2651         if (!EnableInvokeDynamic) {
2652             class_format_error("invokedynamic instructions not enabled in this JVM");
2653         } else {
2654             class_format_error("invokedynamic instructions not supported by this class file version (%d), class %s",
2655                                _klass->major_version(), _klass->external_name());
2656         }
2657       return;
2658     }
2659   } else {
2660     ref_class_type = cp_ref_index_to_type(index, cp, CHECK_VERIFY(this));
2661   }
2662 
2663   // For a small signature length, we just allocate 128 bytes instead
2664   // of parsing the signature once to find its size.
2665   // -3 is for '(', ')' and return descriptor; multiply by 2 is for
2666   // longs/doubles to be consertive.
2667   assert(sizeof(VerificationType) == sizeof(uintptr_t),
2668         "buffer type must match VerificationType size");
2669   uintptr_t on_stack_sig_types_buffer[128];
2670   // If we make a VerificationType[128] array directly, the compiler calls
2671   // to the c-runtime library to do the allocation instead of just
2672   // stack allocating it.  Plus it would run constructors.  This shows up
2673   // in performance profiles.
2674 
2675   VerificationType* sig_types;
2676   int size = (method_sig->utf8_length() - 3) * 2;
2677   if (size > 128) {
2678     // Long and double occupies two slots here.
2679     ArgumentSizeComputer size_it(method_sig);
2680     size = size_it.size();
2681     sig_types = NEW_RESOURCE_ARRAY_IN_THREAD(THREAD, VerificationType, size);
2682   } else{
2683     sig_types = (VerificationType*)on_stack_sig_types_buffer;
2684   }
2685   SignatureStream sig_stream(method_sig);
2686   int sig_i = 0;
2687   while (!sig_stream.at_return_type()) {
2688     sig_i += change_sig_to_verificationType(
2689       &sig_stream, &sig_types[sig_i], CHECK_VERIFY(this));
2690     sig_stream.next();
2691   }
2692   int nargs = sig_i;
2693 
2694 #ifdef ASSERT
2695   {
2696     ArgumentSizeComputer size_it(method_sig);
2697     assert(nargs == size_it.size(), "Argument sizes do not match");
2698     assert(nargs <= (method_sig->utf8_length() - 3) * 2, "estimate of max size isn't conservative enough");
2699   }
2700 #endif
2701 
2702   // Check instruction operands
2703   u2 bci = bcs->bci();
2704   if (opcode == Bytecodes::_invokeinterface) {
2705     address bcp = bcs->bcp();
2706     // 4905268: count operand in invokeinterface should be nargs+1, not nargs.
2707     // JSR202 spec: The count operand of an invokeinterface instruction is valid if it is
2708     // the difference between the size of the operand stack before and after the instruction
2709     // executes.
2710     if (*(bcp+3) != (nargs+1)) {
2711       verify_error(ErrorContext::bad_code(bci),
2712           "Inconsistent args count operand in invokeinterface");
2713       return;
2714     }
2715     if (*(bcp+4) != 0) {
2716       verify_error(ErrorContext::bad_code(bci),
2717           "Fourth operand byte of invokeinterface must be zero");
2718       return;
2719     }
2720   }
2721 
2722   if (opcode == Bytecodes::_invokedynamic) {
2723     address bcp = bcs->bcp();
2724     if (*(bcp+3) != 0 || *(bcp+4) != 0) {
2725       verify_error(ErrorContext::bad_code(bci),
2726           "Third and fourth operand bytes of invokedynamic must be zero");
2727       return;
2728     }
2729   }
2730 
2731   if (method_name->byte_at(0) == '<') {
2732     // Make sure <init> can only be invoked by invokespecial
2733     if (opcode != Bytecodes::_invokespecial ||
2734         method_name != vmSymbols::object_initializer_name()) {
2735       verify_error(ErrorContext::bad_code(bci),
2736           "Illegal call to internal method");
2737       return;
2738     }
2739   } else if (opcode == Bytecodes::_invokespecial
2740              && !is_same_or_direct_interface(current_class(), current_type(), ref_class_type)
2741              && !ref_class_type.equals(VerificationType::reference_type(
2742                   current_class()->super()->name()))) {
2743     bool subtype = false;
2744     bool have_imr_indirect = cp->tag_at(index).value() == JVM_CONSTANT_InterfaceMethodref;
2745     if (!current_class()->is_anonymous()) {
2746       subtype = ref_class_type.is_assignable_from(
2747                  current_type(), this, false, CHECK_VERIFY(this));
2748     } else {
2749       VerificationType host_klass_type =
2750                         VerificationType::reference_type(current_class()->host_klass()->name());
2751       subtype = ref_class_type.is_assignable_from(host_klass_type, this, false, CHECK_VERIFY(this));
2752 
2753       // If invokespecial of IMR, need to recheck for same or
2754       // direct interface relative to the host class
2755       have_imr_indirect = (have_imr_indirect &&
2756                            !is_same_or_direct_interface(
2757                              InstanceKlass::cast(current_class()->host_klass()),
2758                              host_klass_type, ref_class_type));
2759     }
2760     if (!subtype) {
2761       verify_error(ErrorContext::bad_code(bci),
2762           "Bad invokespecial instruction: "
2763           "current class isn't assignable to reference class.");
2764        return;
2765     } else if (have_imr_indirect) {
2766       verify_error(ErrorContext::bad_code(bci),
2767           "Bad invokespecial instruction: "
2768           "interface method reference is in an indirect superinterface.");
2769       return;
2770     }
2771 
2772   }
2773   // Match method descriptor with operand stack
2774   for (int i = nargs - 1; i >= 0; i--) {  // Run backwards
2775     current_frame->pop_stack(sig_types[i], CHECK_VERIFY(this));
2776   }
2777   // Check objectref on operand stack
2778   if (opcode != Bytecodes::_invokestatic &&
2779       opcode != Bytecodes::_invokedynamic) {
2780     if (method_name == vmSymbols::object_initializer_name()) {  // <init> method
2781       verify_invoke_init(bcs, index, ref_class_type, current_frame,
2782         code_length, in_try_block, this_uninit, cp, stackmap_table,
2783         CHECK_VERIFY(this));
2784     } else {   // other methods
2785       // Ensures that target class is assignable to method class.
2786       if (opcode == Bytecodes::_invokespecial) {
2787         if (!current_class()->is_anonymous()) {
2788           current_frame->pop_stack(current_type(), CHECK_VERIFY(this));
2789         } else {
2790           // anonymous class invokespecial calls: check if the
2791           // objectref is a subtype of the host_klass of the current class
2792           // to allow an anonymous class to reference methods in the host_klass
2793           VerificationType top = current_frame->pop_stack(CHECK_VERIFY(this));
2794           VerificationType hosttype =
2795             VerificationType::reference_type(current_class()->host_klass()->name());
2796           bool subtype = hosttype.is_assignable_from(top, this, false, CHECK_VERIFY(this));
2797           if (!subtype) {
2798             verify_error( ErrorContext::bad_type(current_frame->offset(),
2799               current_frame->stack_top_ctx(),
2800               TypeOrigin::implicit(top)),
2801               "Bad type on operand stack");
2802             return;
2803           }
2804         }
2805       } else if (opcode == Bytecodes::_invokevirtual) {
2806         VerificationType stack_object_type =
2807           current_frame->pop_stack(ref_class_type, CHECK_VERIFY(this));
2808         if (current_type() != stack_object_type) {
2809           assert(cp->cache() == NULL, "not rewritten yet");
2810           Symbol* ref_class_name =
2811             cp->klass_name_at(cp->klass_ref_index_at(index));
2812           // See the comments in verify_field_instructions() for
2813           // the rationale behind this.
2814           if (name_in_supers(ref_class_name, current_class())) {
2815             Klass* ref_class = load_class(ref_class_name, CHECK);
2816             if (is_protected_access(
2817                   _klass, ref_class, method_name, method_sig, true)) {
2818               // It's protected access, check if stack object is
2819               // assignable to current class.
2820               bool is_assignable = current_type().is_assignable_from(
2821                 stack_object_type, this, true, CHECK_VERIFY(this));
2822               if (!is_assignable) {
2823                 if (ref_class_type.name() == vmSymbols::java_lang_Object()
2824                     && stack_object_type.is_array()
2825                     && method_name == vmSymbols::clone_name()) {
2826                   // Special case: arrays pretend to implement public Object
2827                   // clone().
2828                 } else {
2829                   verify_error(ErrorContext::bad_type(bci,
2830                       current_frame->stack_top_ctx(),
2831                       TypeOrigin::implicit(current_type())),
2832                       "Bad access to protected data in invokevirtual");
2833                   return;
2834                 }
2835               }
2836             }
2837           }
2838         }
2839       } else {
2840         assert(opcode == Bytecodes::_invokeinterface, "Unexpected opcode encountered");
2841         current_frame->pop_stack(ref_class_type, CHECK_VERIFY(this));
2842       }
2843     }
2844   }
2845   // Push the result type.
2846   if (sig_stream.type() != T_VOID) {
2847     if (method_name == vmSymbols::object_initializer_name()) {
2848       // <init> method must have a void return type
2849       /* Unreachable?  Class file parser verifies that methods with '<' have
2850        * void return */
2851       verify_error(ErrorContext::bad_code(bci),
2852           "Return type must be void in <init> method");
2853       return;
2854     }
2855     VerificationType return_type[2];
2856     int n = change_sig_to_verificationType(
2857       &sig_stream, return_type, CHECK_VERIFY(this));
2858     for (int i = 0; i < n; i++) {
2859       current_frame->push_stack(return_type[i], CHECK_VERIFY(this)); // push types backwards
2860     }
2861   }
2862 }
2863 
get_newarray_type(u2 index,u2 bci,TRAPS)2864 VerificationType ClassVerifier::get_newarray_type(
2865     u2 index, u2 bci, TRAPS) {
2866   const char* from_bt[] = {
2867     NULL, NULL, NULL, NULL, "[Z", "[C", "[F", "[D", "[B", "[S", "[I", "[J",
2868   };
2869   if (index < T_BOOLEAN || index > T_LONG) {
2870     verify_error(ErrorContext::bad_code(bci), "Illegal newarray instruction");
2871     return VerificationType::bogus_type();
2872   }
2873 
2874   // from_bt[index] contains the array signature which has a length of 2
2875   Symbol* sig = create_temporary_symbol(
2876     from_bt[index], 2, CHECK_(VerificationType::bogus_type()));
2877   return VerificationType::reference_type(sig);
2878 }
2879 
verify_anewarray(u2 bci,u2 index,constantPoolHandle cp,StackMapFrame * current_frame,TRAPS)2880 void ClassVerifier::verify_anewarray(
2881     u2 bci, u2 index, constantPoolHandle cp,
2882     StackMapFrame* current_frame, TRAPS) {
2883   verify_cp_class_type(bci, index, cp, CHECK_VERIFY(this));
2884   current_frame->pop_stack(
2885     VerificationType::integer_type(), CHECK_VERIFY(this));
2886 
2887   VerificationType component_type =
2888     cp_index_to_type(index, cp, CHECK_VERIFY(this));
2889   int length;
2890   char* arr_sig_str;
2891   if (component_type.is_array()) {     // it's an array
2892     const char* component_name = component_type.name()->as_utf8();
2893     // add one dimension to component
2894     length = (int)strlen(component_name) + 1;
2895     arr_sig_str = NEW_RESOURCE_ARRAY_IN_THREAD(THREAD, char, length);
2896     arr_sig_str[0] = '[';
2897     strncpy(&arr_sig_str[1], component_name, length - 1);
2898   } else {         // it's an object or interface
2899     const char* component_name = component_type.name()->as_utf8();
2900     // add one dimension to component with 'L' prepended and ';' postpended.
2901     length = (int)strlen(component_name) + 3;
2902     arr_sig_str = NEW_RESOURCE_ARRAY_IN_THREAD(THREAD, char, length);
2903     arr_sig_str[0] = '[';
2904     arr_sig_str[1] = 'L';
2905     strncpy(&arr_sig_str[2], component_name, length - 2);
2906     arr_sig_str[length - 1] = ';';
2907   }
2908   Symbol* arr_sig = create_temporary_symbol(
2909     arr_sig_str, length, CHECK_VERIFY(this));
2910   VerificationType new_array_type = VerificationType::reference_type(arr_sig);
2911   current_frame->push_stack(new_array_type, CHECK_VERIFY(this));
2912 }
2913 
verify_iload(u2 index,StackMapFrame * current_frame,TRAPS)2914 void ClassVerifier::verify_iload(u2 index, StackMapFrame* current_frame, TRAPS) {
2915   current_frame->get_local(
2916     index, VerificationType::integer_type(), CHECK_VERIFY(this));
2917   current_frame->push_stack(
2918     VerificationType::integer_type(), CHECK_VERIFY(this));
2919 }
2920 
verify_lload(u2 index,StackMapFrame * current_frame,TRAPS)2921 void ClassVerifier::verify_lload(u2 index, StackMapFrame* current_frame, TRAPS) {
2922   current_frame->get_local_2(
2923     index, VerificationType::long_type(),
2924     VerificationType::long2_type(), CHECK_VERIFY(this));
2925   current_frame->push_stack_2(
2926     VerificationType::long_type(),
2927     VerificationType::long2_type(), CHECK_VERIFY(this));
2928 }
2929 
verify_fload(u2 index,StackMapFrame * current_frame,TRAPS)2930 void ClassVerifier::verify_fload(u2 index, StackMapFrame* current_frame, TRAPS) {
2931   current_frame->get_local(
2932     index, VerificationType::float_type(), CHECK_VERIFY(this));
2933   current_frame->push_stack(
2934     VerificationType::float_type(), CHECK_VERIFY(this));
2935 }
2936 
verify_dload(u2 index,StackMapFrame * current_frame,TRAPS)2937 void ClassVerifier::verify_dload(u2 index, StackMapFrame* current_frame, TRAPS) {
2938   current_frame->get_local_2(
2939     index, VerificationType::double_type(),
2940     VerificationType::double2_type(), CHECK_VERIFY(this));
2941   current_frame->push_stack_2(
2942     VerificationType::double_type(),
2943     VerificationType::double2_type(), CHECK_VERIFY(this));
2944 }
2945 
verify_aload(u2 index,StackMapFrame * current_frame,TRAPS)2946 void ClassVerifier::verify_aload(u2 index, StackMapFrame* current_frame, TRAPS) {
2947   VerificationType type = current_frame->get_local(
2948     index, VerificationType::reference_check(), CHECK_VERIFY(this));
2949   current_frame->push_stack(type, CHECK_VERIFY(this));
2950 }
2951 
verify_istore(u2 index,StackMapFrame * current_frame,TRAPS)2952 void ClassVerifier::verify_istore(u2 index, StackMapFrame* current_frame, TRAPS) {
2953   current_frame->pop_stack(
2954     VerificationType::integer_type(), CHECK_VERIFY(this));
2955   current_frame->set_local(
2956     index, VerificationType::integer_type(), CHECK_VERIFY(this));
2957 }
2958 
verify_lstore(u2 index,StackMapFrame * current_frame,TRAPS)2959 void ClassVerifier::verify_lstore(u2 index, StackMapFrame* current_frame, TRAPS) {
2960   current_frame->pop_stack_2(
2961     VerificationType::long2_type(),
2962     VerificationType::long_type(), CHECK_VERIFY(this));
2963   current_frame->set_local_2(
2964     index, VerificationType::long_type(),
2965     VerificationType::long2_type(), CHECK_VERIFY(this));
2966 }
2967 
verify_fstore(u2 index,StackMapFrame * current_frame,TRAPS)2968 void ClassVerifier::verify_fstore(u2 index, StackMapFrame* current_frame, TRAPS) {
2969   current_frame->pop_stack(VerificationType::float_type(), CHECK_VERIFY(this));
2970   current_frame->set_local(
2971     index, VerificationType::float_type(), CHECK_VERIFY(this));
2972 }
2973 
verify_dstore(u2 index,StackMapFrame * current_frame,TRAPS)2974 void ClassVerifier::verify_dstore(u2 index, StackMapFrame* current_frame, TRAPS) {
2975   current_frame->pop_stack_2(
2976     VerificationType::double2_type(),
2977     VerificationType::double_type(), CHECK_VERIFY(this));
2978   current_frame->set_local_2(
2979     index, VerificationType::double_type(),
2980     VerificationType::double2_type(), CHECK_VERIFY(this));
2981 }
2982 
verify_astore(u2 index,StackMapFrame * current_frame,TRAPS)2983 void ClassVerifier::verify_astore(u2 index, StackMapFrame* current_frame, TRAPS) {
2984   VerificationType type = current_frame->pop_stack(
2985     VerificationType::reference_check(), CHECK_VERIFY(this));
2986   current_frame->set_local(index, type, CHECK_VERIFY(this));
2987 }
2988 
verify_iinc(u2 index,StackMapFrame * current_frame,TRAPS)2989 void ClassVerifier::verify_iinc(u2 index, StackMapFrame* current_frame, TRAPS) {
2990   VerificationType type = current_frame->get_local(
2991     index, VerificationType::integer_type(), CHECK_VERIFY(this));
2992   current_frame->set_local(index, type, CHECK_VERIFY(this));
2993 }
2994 
verify_return_value(VerificationType return_type,VerificationType type,u2 bci,StackMapFrame * current_frame,TRAPS)2995 void ClassVerifier::verify_return_value(
2996     VerificationType return_type, VerificationType type, u2 bci,
2997     StackMapFrame* current_frame, TRAPS) {
2998   if (return_type == VerificationType::bogus_type()) {
2999     verify_error(ErrorContext::bad_type(bci,
3000         current_frame->stack_top_ctx(), TypeOrigin::signature(return_type)),
3001         "Method expects a return value");
3002     return;
3003   }
3004   bool match = return_type.is_assignable_from(type, this, false, CHECK_VERIFY(this));
3005   if (!match) {
3006     verify_error(ErrorContext::bad_type(bci,
3007         current_frame->stack_top_ctx(), TypeOrigin::signature(return_type)),
3008         "Bad return type");
3009     return;
3010   }
3011 }
3012 
3013 // The verifier creates symbols which are substrings of Symbols.
3014 // These are stored in the verifier until the end of verification so that
3015 // they can be reference counted.
create_temporary_symbol(const Symbol * s,int begin,int end,TRAPS)3016 Symbol* ClassVerifier::create_temporary_symbol(const Symbol *s, int begin,
3017                                                int end, TRAPS) {
3018   Symbol* sym = SymbolTable::new_symbol(s, begin, end, CHECK_NULL);
3019   _symbols->push(sym);
3020   return sym;
3021 }
3022 
create_temporary_symbol(const char * s,int length,TRAPS)3023 Symbol* ClassVerifier::create_temporary_symbol(const char *s, int length, TRAPS) {
3024   Symbol* sym = SymbolTable::new_symbol(s, length, CHECK_NULL);
3025   _symbols->push(sym);
3026   return sym;
3027 }
3028