1 /* Copyright (C) 2001-2015 Free Software Foundation, Inc.
3 This file is part of libgcj.
5 This software is copyrighted work licensed under the terms of the
6 Libgcj License. Please consult the file "LIBGCJ_LICENSE" for
9 /* Written by Tom Tromey <tromey@redhat.com> */
11 /* Uncomment this to enable debugging output. */
12 /* #define VERIFY_DEBUG */
16 #include "coretypes.h"
21 #include "double-int.h"
30 /* Hack to work around namespace pollution from java-tree.h. */
33 /* This is used to mark states which are not scheduled for
35 #define INVALID_STATE ((state *) -1)
37 static void ATTRIBUTE_PRINTF_1
38 debug_print (const char *fmt ATTRIBUTE_UNUSED
, ...)
43 vfprintf (stderr
, fmt
, ap
);
45 #endif /* VERIFY_DEBUG */
48 /* This started as a fairly ordinary verifier, and for the most part
49 it remains so. It works in the obvious way, by modeling the effect
50 of each opcode as it is encountered. For most opcodes, this is a
51 straightforward operation.
53 This verifier does not do type merging. It used to, but this
54 results in difficulty verifying some relatively simple code
55 involving interfaces, and it pushed some verification work into the
58 Instead of merging reference types, when we reach a point where two
59 flows of control merge, we simply keep the union of reference types
60 from each branch. Then, when we need to verify a fact about a
61 reference on the stack (e.g., that it is compatible with the
62 argument type of a method), we check to ensure that all possible
63 types satisfy the requirement.
65 Another area this verifier differs from the norm is in its handling
66 of subroutines. The JVM specification has some confusing things to
67 say about subroutines. For instance, it makes claims about not
68 allowing subroutines to merge and it rejects recursive subroutines.
69 For the most part these are red herrings; we used to try to follow
70 these things but they lead to problems. For example, the notion of
71 "being in a subroutine" is not well-defined: is an exception
72 handler in a subroutine? If you never execute the `ret' but
73 instead `goto 1' do you remain in the subroutine?
75 For clarity on what is really required for type safety, read
76 "Simple Verification Technique for Complex Java Bytecode
77 Subroutines" by Alessandro Coglio. Among other things this paper
78 shows that recursive subroutines are not harmful to type safety.
79 We implement something similar to what he proposes. Note that this
80 means that this verifier will accept code that is rejected by some
83 For those not wanting to read the paper, the basic observation is
84 that we can maintain split states in subroutines. We maintain one
85 state for each calling `jsr'. In other words, we re-verify a
86 subroutine once for each caller, using the exact types held by the
87 callers (as opposed to the old approach of merging types and
88 keeping a bitmap registering what did or did not change). This
89 approach lets us continue to verify correctly even when a
90 subroutine is exited via `goto' or `athrow' and not `ret'.
92 In some other areas the JVM specification is (mildly) incorrect,
93 so we diverge. For instance, you cannot
94 violate type safety by allocating an object with `new' and then
95 failing to initialize it, no matter how one branches or where one
96 stores the uninitialized reference. See "Improving the official
97 specification of Java bytecode verification" by Alessandro Coglio.
99 Note that there's no real point in enforcing that padding bytes or
100 the mystery byte of invokeinterface must be 0, but we do that
103 The verifier is currently neither completely lazy nor eager when it
104 comes to loading classes. It tries to represent types by name when
105 possible, and then loads them when it needs to verify a fact about
106 the type. Checking types by name is valid because we only use
107 names which come from the current class' constant pool. Since all
108 such names are looked up using the same class loader, there is no
109 danger that we might be fooled into comparing different types with
112 In the future we plan to allow for a completely lazy mode of
113 operation, where the verifier will construct a list of type
114 assertions to be checked later.
116 Some test cases for the verifier live in the "verify" module of the
117 Mauve test suite. However, some of these are presently
118 (2004-01-20) believed to be incorrect. (More precisely the notion
119 of "correct" is not well-defined, and this verifier differs from
120 others while remaining type-safe.) Some other tests live in the
123 This verifier is also written to be pluggable. This means that it
124 is intended for use in a variety of environments, not just libgcj.
125 As a result the verifier expects a number of type and method
126 declarations to be declared in "verify.h". The intent is that you
127 recompile the verifier for your particular environment. This
128 approach was chosen so that operations could be inlined in verify.h
131 See the verify.h that accompanies this copy of the verifier to see
132 what types, preprocessor defines, and functions must be declared.
133 The interface is ad hoc, but was defined so that it could be
134 implemented to connect to a pure C program.
137 #define FLAG_INSN_START 1
138 #define FLAG_BRANCH_TARGET 2
139 #define FLAG_INSN_SEEN 4
143 struct ref_intersection
;
145 typedef struct state state
;
146 typedef struct type type
;
147 typedef struct ref_intersection ref_intersection
;
149 /*typedef struct state_list state_list;*/
151 typedef struct state_list
154 struct state_list
*next
;
157 typedef struct vfy_string_list
160 struct vfy_string_list
*next
;
163 typedef struct verifier_context
165 /* The current PC. */
167 /* The PC corresponding to the start of the current instruction. */
170 /* The current state of the stack, locals, etc. */
171 state
*current_state
;
173 /* At each branch target we keep a linked list of all the states we
174 can process at that point. We'll only have multiple states at a
175 given PC if they both have different return-address types in the
176 same stack or local slot. This array is indexed by PC and holds
177 the list of all such states. */
180 /* We keep a linked list of all the states which we must reverify.
181 This is the head of the list. */
182 state
*next_verify_state
;
184 /* We keep some flags for each instruction. The values are the
185 FLAG_* constants defined above. This is an array indexed by PC. */
188 /* The bytecode itself. */
189 const unsigned char *bytecode
;
190 /* The exceptions. */
191 vfy_exception
*exception
;
193 /* Defining class. */
194 vfy_jclass current_class
;
196 vfy_method
*current_method
;
198 /* A linked list of utf8 objects we allocate. */
199 vfy_string_list
*utf8_list
;
201 /* A linked list of all ref_intersection objects we allocate. */
202 ref_intersection
*isect_list
;
205 /* The current verifier's state data. This is maintained by
206 {push/pop}_verifier_context to provide a shorthand form to access
207 the verification state. */
208 static GTY(()) verifier_context
*vfr
;
210 /* Local function declarations. */
211 bool type_initialized (type
*t
);
212 int ref_count_dimensions (ref_intersection
*ref
);
215 verify_fail_pc (const char *s
, int pc
)
217 vfy_fail (s
, pc
, vfr
->current_class
, vfr
->current_method
);
221 verify_fail (const char *s
)
223 verify_fail_pc (s
, vfr
->PC
);
226 /* This enum holds a list of tags for all the different types we
227 need to handle. Reference types are treated specially by the
229 typedef enum type_val
233 /* The values for primitive types are chosen to correspond to values
234 specified to newarray. */
244 /* Used when overwriting second word of a double or long in the
245 local variables. Also used after merging local variable states
246 to indicate an unusable value. */
249 /* This is the second word of a two-word value, i.e., a double or
253 /* Everything after `reference_type' must be a reference type. */
256 uninitialized_reference_type
259 /* This represents a merged class type. Some verifiers (including
260 earlier versions of this one) will compute the intersection of
261 two class types when merging states. However, this loses
262 critical information about interfaces implemented by the various
263 classes. So instead we keep track of all the actual classes that
265 struct ref_intersection
267 /* Whether or not this type has been resolved. */
270 /* Actual type data. */
273 /* For a resolved reference type, this is a pointer to the class. */
275 /* For other reference types, this it the name of the class. */
279 /* Link to the next reference in the intersection. */
280 ref_intersection
*ref_next
;
282 /* This is used to keep track of all the allocated
283 ref_intersection objects, so we can free them.
284 FIXME: we should allocate these in chunks. */
285 ref_intersection
*alloc_next
;
288 static ref_intersection
*
291 ref_intersection
*new_ref
=
292 (ref_intersection
*) vfy_alloc (sizeof (ref_intersection
));
294 new_ref
->alloc_next
= vfr
->isect_list
;
295 vfr
->isect_list
= new_ref
;
299 static ref_intersection
*
300 clone_ref (ref_intersection
*dup
)
302 ref_intersection
*new_ref
= make_ref ();
304 new_ref
->is_resolved
= dup
->is_resolved
;
305 new_ref
->data
= dup
->data
;
310 resolve_ref (ref_intersection
*ref
)
312 if (ref
->is_resolved
)
314 ref
->data
.klass
= vfy_find_class (vfr
->current_class
, ref
->data
.name
);
315 ref
->is_resolved
= true;
319 refs_equal (ref_intersection
*ref1
, ref_intersection
*ref2
)
321 if (! ref1
->is_resolved
&& ! ref2
->is_resolved
322 && vfy_strings_equal (ref1
->data
.name
, ref2
->data
.name
))
324 if (! ref1
->is_resolved
)
326 if (! ref2
->is_resolved
)
328 return ref1
->data
.klass
== ref2
->data
.klass
;
331 /* Merge REF1 type into REF2, returning the result. This will
332 return REF2 if all the classes in THIS already appear in
334 static ref_intersection
*
335 merge_refs (ref_intersection
*ref1
, ref_intersection
*ref2
)
337 ref_intersection
*tail
= ref2
;
338 for (; ref1
!= NULL
; ref1
= ref1
->ref_next
)
341 ref_intersection
*iter
;
342 for (iter
= ref2
; iter
!= NULL
; iter
= iter
->ref_next
)
344 if (refs_equal (ref1
, iter
))
353 ref_intersection
*new_tail
= clone_ref (ref1
);
354 new_tail
->ref_next
= tail
;
361 /* See if an object of type SOURCE can be assigned to an object of
362 type TARGET. This might resolve classes in one chain or the other. */
364 ref_compatible (ref_intersection
*target
, ref_intersection
*source
)
366 for (; target
!= NULL
; target
= target
->ref_next
)
368 ref_intersection
*source_iter
= source
;
370 for (; source_iter
!= NULL
; source_iter
= source_iter
->ref_next
)
372 /* Avoid resolving if possible. */
373 if (! target
->is_resolved
374 && ! source_iter
->is_resolved
375 && vfy_strings_equal (target
->data
.name
,
376 source_iter
->data
.name
))
379 if (! target
->is_resolved
)
380 resolve_ref (target
);
381 if (! source_iter
->is_resolved
)
382 resolve_ref (source_iter
);
384 if (! vfy_is_assignable_from (target
->data
.klass
,
385 source_iter
->data
.klass
))
394 ref_isarray (ref_intersection
*ref
)
396 /* assert (ref_next == NULL); */
397 if (ref
->is_resolved
)
398 return vfy_is_array (ref
->data
.klass
);
400 return vfy_string_bytes (ref
->data
.name
)[0] == '[';
404 ref_isinterface (ref_intersection
*ref
)
406 /* assert (ref_next == NULL); */
407 if (! ref
->is_resolved
)
409 return vfy_is_interface (ref
->data
.klass
);
413 ref_isabstract (ref_intersection
*ref
)
415 /* assert (ref_next == NULL); */
416 if (! ref
->is_resolved
)
418 return vfy_is_abstract (ref
->data
.klass
);
422 ref_getclass (ref_intersection
*ref
)
424 if (! ref
->is_resolved
)
426 return ref
->data
.klass
;
430 ref_count_dimensions (ref_intersection
*ref
)
433 if (ref
->is_resolved
)
435 vfy_jclass k
= ref
->data
.klass
;
436 while (vfy_is_array (k
))
438 k
= vfy_get_component_type (k
);
444 const char *p
= vfy_string_bytes (ref
->data
.name
);
451 /* Return the type_val corresponding to a primitive signature
452 character. For instance `I' returns `int.class'. */
454 get_type_val_for_signature (char sig
)
487 verify_fail ("invalid signature");
493 /* Return the type_val corresponding to a primitive class. */
495 get_type_val_for_primtype (vfy_jclass k
)
497 return get_type_val_for_signature (vfy_get_primitive_char (k
));
500 /* The `type' class is used to represent a single type in the verifier. */
506 /* For reference types, the representation of the type. */
507 ref_intersection
*klass
;
509 /* This is used in two situations.
511 First, when constructing a new object, it is the PC of the
512 `new' instruction which created the object. We use the special
513 value UNINIT to mean that this is uninitialized. The special
514 value SELF is used for the case where the current method is
515 itself the <init> method. the special value EITHER is used
516 when we may optionally allow either an uninitialized or
517 initialized reference to match.
519 Second, when the key is return_address_type, this holds the PC
520 of the instruction following the `jsr'. */
528 /* Make a new instance given the type tag. We assume a generic
529 `reference_type' means Object. */
531 init_type_from_tag (type
*t
, type_val k
)
534 /* For reference_type, if KLASS==NULL then that means we are
535 looking for a generic object of any kind, including an
536 uninitialized reference. */
541 /* Make a type for the given type_val tag K. */
543 make_type (type_val k
)
546 init_type_from_tag (&t
, k
);
550 /* Make a new instance given a class. */
552 init_type_from_class (type
*t
, vfy_jclass k
)
554 t
->key
= reference_type
;
555 t
->klass
= make_ref ();
556 t
->klass
->is_resolved
= true;
557 t
->klass
->data
.klass
= k
;
558 t
->klass
->ref_next
= NULL
;
563 make_type_from_class (vfy_jclass k
)
566 init_type_from_class (&t
, k
);
571 init_type_from_string (type
*t
, vfy_string n
)
573 t
->key
= reference_type
;
574 t
->klass
= make_ref ();
575 t
->klass
->is_resolved
= false;
576 t
->klass
->data
.name
= n
;
577 t
->klass
->ref_next
= NULL
;
582 make_type_from_string (vfy_string n
)
585 init_type_from_string (&t
, n
);
589 /* Promote a numeric type. */
591 vfy_promote_type (type
*t
)
593 if (t
->key
== boolean_type
|| t
->key
== char_type
594 || t
->key
== byte_type
|| t
->key
== short_type
)
597 #define promote_type vfy_promote_type
599 /* Mark this type as the uninitialized result of `new'. */
601 type_set_uninitialized (type
*t
, int npc
)
603 if (t
->key
== reference_type
)
604 t
->key
= uninitialized_reference_type
;
606 verify_fail ("internal error in type::uninitialized");
610 /* Mark this type as now initialized. */
612 type_set_initialized (type
*t
, int npc
)
614 if (npc
!= UNINIT
&& t
->pc
== npc
&& t
->key
== uninitialized_reference_type
)
616 t
->key
= reference_type
;
621 /* Mark this type as a particular return address. */
622 static void type_set_return_address (type
*t
, int npc
)
627 /* Return true if this type and type OTHER are considered
628 mergeable for the purposes of state merging. This is related
629 to subroutine handling. For this purpose two types are
630 considered unmergeable if they are both return-addresses but
631 have different PCs. */
633 type_state_mergeable_p (type
*t1
, type
*t2
)
635 return (t1
->key
!= return_address_type
636 || t2
->key
!= return_address_type
637 || t1
->pc
== t2
->pc
);
640 /* Return true if an object of type K can be assigned to a variable
641 of type T. Handle various special cases too. Might modify
642 T or K. Note however that this does not perform numeric
645 types_compatible (type
*t
, type
*k
)
647 /* Any type is compatible with the unsuitable type. */
648 if (k
->key
== unsuitable_type
)
651 if (t
->key
< reference_type
|| k
->key
< reference_type
)
652 return t
->key
== k
->key
;
654 /* The `null' type is convertible to any initialized reference
656 if (t
->key
== null_type
)
657 return k
->key
!= uninitialized_reference_type
;
658 if (k
->key
== null_type
)
659 return t
->key
!= uninitialized_reference_type
;
661 /* A special case for a generic reference. */
662 if (t
->klass
== NULL
)
664 if (k
->klass
== NULL
)
665 verify_fail ("programmer error in type::compatible");
667 /* Handle the special 'EITHER' case, which is only used in a
668 special case of 'putfield'. Note that we only need to handle
669 this on the LHS of a check. */
670 if (! type_initialized (t
) && t
->pc
== EITHER
)
672 /* If the RHS is uninitialized, it must be an uninitialized
674 if (! type_initialized (k
) && k
->pc
!= SELF
)
677 else if (type_initialized (t
) != type_initialized (k
))
679 /* An initialized type and an uninitialized type are not
680 otherwise compatible. */
685 /* Two uninitialized objects are compatible if either:
686 * The PCs are identical, or
687 * One PC is UNINIT. */
688 if (type_initialized (t
))
690 if (t
->pc
!= k
->pc
&& t
->pc
!= UNINIT
&& k
->pc
!= UNINIT
)
695 return ref_compatible (t
->klass
, k
->klass
);
698 /* Return true if two types are equal. Only valid for reference
701 types_equal (type
*t1
, type
*t2
)
703 if ((t1
->key
!= reference_type
&& t1
->key
!= uninitialized_reference_type
)
704 || (t2
->key
!= reference_type
705 && t2
->key
!= uninitialized_reference_type
))
707 /* Only single-ref types are allowed. */
708 if (t1
->klass
->ref_next
|| t2
->klass
->ref_next
)
710 return refs_equal (t1
->klass
, t2
->klass
);
714 type_isvoid (type
*t
)
716 return t
->key
== void_type
;
720 type_iswide (type
*t
)
722 return t
->key
== long_type
|| t
->key
== double_type
;
725 /* Return number of stack or local variable slots taken by this type. */
729 return type_iswide (t
) ? 2 : 1;
733 type_isarray (type
*t
)
735 /* We treat null_type as not an array. This is ok based on the
736 current uses of this method. */
737 if (t
->key
== reference_type
)
738 return ref_isarray (t
->klass
);
743 type_isnull (type
*t
)
745 return t
->key
== null_type
;
749 type_isinterface (type
*t
)
751 if (t
->key
!= reference_type
)
753 return ref_isinterface (t
->klass
);
757 type_isabstract (type
*t
)
759 if (t
->key
!= reference_type
)
761 return ref_isabstract (t
->klass
);
764 /* Return the element type of an array. */
766 type_array_element (type
*t
)
771 if (t
->key
!= reference_type
)
772 verify_fail ("programmer error in type::element_type()");
774 k
= vfy_get_component_type (ref_getclass (t
->klass
));
775 if (vfy_is_primitive (k
))
776 init_type_from_tag (&et
, get_type_val_for_primtype (k
));
778 init_type_from_class (&et
, k
);
782 /* Return the array type corresponding to an initialized
783 reference. We could expand this to work for other kinds of
784 types, but currently we don't need to. */
786 type_to_array (type
*t
)
791 if (t
->key
!= reference_type
)
792 verify_fail ("internal error in type::to_array()");
794 k
= ref_getclass (t
->klass
);
795 init_type_from_class (&at
, vfy_get_array_class (k
));
800 type_isreference (type
*t
)
802 return t
->key
>= reference_type
;
806 type_get_pc (type
*t
)
812 type_initialized (type
*t
)
814 return t
->key
== reference_type
|| t
->key
== null_type
;
818 type_verify_dimensions (type
*t
, int ndims
)
820 /* The way this is written, we don't need to check isarray(). */
821 if (t
->key
!= reference_type
)
822 verify_fail ("internal error in verify_dimensions:"
823 " not a reference type");
825 if (ref_count_dimensions (t
->klass
) < ndims
)
826 verify_fail ("array type has fewer dimensions"
830 /* Merge OLD_TYPE into this. On error throw exception. Return
831 true if the merge caused a type change. */
833 merge_types (type
*t
, type
*old_type
, bool local_semantics
)
835 bool changed
= false;
836 bool refo
= type_isreference (old_type
);
837 bool refn
= type_isreference (t
);
840 if (old_type
->key
== null_type
)
842 else if (t
->key
== null_type
)
847 else if (type_initialized (t
) != type_initialized (old_type
))
848 verify_fail ("merging initialized and uninitialized types");
851 ref_intersection
*merged
;
852 if (! type_initialized (t
))
855 t
->pc
= old_type
->pc
;
856 else if (old_type
->pc
== UNINIT
)
858 else if (t
->pc
!= old_type
->pc
)
859 verify_fail ("merging different uninitialized types");
862 merged
= merge_refs (old_type
->klass
, t
->klass
);
863 if (merged
!= t
->klass
)
870 else if (refo
|| refn
|| t
->key
!= old_type
->key
)
874 /* If we already have an `unsuitable' type, then we
875 don't need to change again. */
876 if (t
->key
!= unsuitable_type
)
878 t
->key
= unsuitable_type
;
883 verify_fail ("unmergeable type");
895 case boolean_type
: c
= 'Z'; break;
896 case byte_type
: c
= 'B'; break;
897 case char_type
: c
= 'C'; break;
898 case short_type
: c
= 'S'; break;
899 case int_type
: c
= 'I'; break;
900 case long_type
: c
= 'J'; break;
901 case float_type
: c
= 'F'; break;
902 case double_type
: c
= 'D'; break;
903 case void_type
: c
= 'V'; break;
904 case unsuitable_type
: c
= '-'; break;
905 case return_address_type
: c
= 'r'; break;
906 case continuation_type
: c
= '+'; break;
907 case reference_type
: c
= 'L'; break;
908 case null_type
: c
= '@'; break;
909 case uninitialized_reference_type
: c
= 'U'; break;
911 debug_print ("%c", c
);
913 #endif /* VERIFY_DEBUG */
915 /* This class holds all the state information we need for a given
919 /* The current top of the stack, in terms of slots. */
921 /* The current depth of the stack. This will be larger than
922 STACKTOP when wide types are on the stack. */
926 /* The local variables. */
928 /* We keep track of the type of `this' specially. This is used to
929 ensure that an instance initializer invokes another initializer
930 on `this' before returning. We must keep track of this
931 specially because otherwise we might be confused by code which
932 assigns to locals[0] (overwriting `this') and then returns
933 without really initializing. */
936 /* The PC for this state. This is only valid on states which are
937 permanently attached to a given PC. For an object like
938 `current_state', which is used transiently, this has no
941 /* We keep a linked list of all states requiring reverification.
942 If this is the special value INVALID_STATE then this state is
943 not on the list. NULL marks the end of the linked list. */
947 /* NO_NEXT is the PC value meaning that a new state must be
948 acquired from the verification list. */
952 init_state_with_stack (state
*s
, int max_stack
, int max_locals
)
957 s
->stack
= (type
*) vfy_alloc (max_stack
* sizeof (type
));
958 for (i
= 0; i
< max_stack
; ++i
)
959 init_type_from_tag (&s
->stack
[i
], unsuitable_type
);
960 s
->locals
= (type
*) vfy_alloc (max_locals
* sizeof (type
));
961 for (i
= 0; i
< max_locals
; ++i
)
962 init_type_from_tag (&s
->locals
[i
], unsuitable_type
);
963 init_type_from_tag (&s
->this_type
, unsuitable_type
);
965 s
->next
= INVALID_STATE
;
969 copy_state (state
*s
, state
*copy
, int max_stack
, int max_locals
)
972 s
->stacktop
= copy
->stacktop
;
973 s
->stackdepth
= copy
->stackdepth
;
974 for (i
= 0; i
< max_stack
; ++i
)
975 s
->stack
[i
] = copy
->stack
[i
];
976 for (i
= 0; i
< max_locals
; ++i
)
977 s
->locals
[i
] = copy
->locals
[i
];
979 s
->this_type
= copy
->this_type
;
980 /* Don't modify `next' or `pc'. */
984 copy_state_with_stack (state
*s
, state
*orig
, int max_stack
, int max_locals
)
986 init_state_with_stack (s
, max_stack
, max_locals
);
987 copy_state (s
, orig
, max_stack
, max_locals
);
990 /* Allocate a new state, copying ORIG. */
992 make_state_copy (state
*orig
, int max_stack
, int max_locals
)
994 state
*s
= (state
*) vfy_alloc (sizeof (state
));
995 copy_state_with_stack (s
, orig
, max_stack
, max_locals
);
1000 make_state (int max_stack
, int max_locals
)
1002 state
*s
= (state
*) vfy_alloc (sizeof (state
));
1003 init_state_with_stack (s
, max_stack
, max_locals
);
1008 free_state (state
*s
)
1010 if (s
->stack
!= NULL
)
1011 vfy_free (s
->stack
);
1012 if (s
->locals
!= NULL
)
1013 vfy_free (s
->locals
);
1016 /* Modify this state to reflect entry to an exception handler. */
1018 state_set_exception (state
*s
, type
*t
, int max_stack
)
1024 for (i
= s
->stacktop
; i
< max_stack
; ++i
)
1025 init_type_from_tag (&s
->stack
[i
], unsuitable_type
);
1028 /* Merge STATE_OLD into this state. Destructively modifies this
1029 state. Returns true if the new state was in fact changed.
1030 Will throw an exception if the states are not mergeable. */
1032 merge_states (state
*s
, state
*state_old
, int max_locals
)
1035 bool changed
= false;
1037 /* Special handling for `this'. If one or the other is
1038 uninitialized, then the merge is uninitialized. */
1039 if (type_initialized (&s
->this_type
))
1040 s
->this_type
= state_old
->this_type
;
1043 if (state_old
->stacktop
!= s
->stacktop
) /* FIXME stackdepth instead? */
1044 verify_fail ("stack sizes differ");
1045 for (i
= 0; i
< state_old
->stacktop
; ++i
)
1047 if (merge_types (&s
->stack
[i
], &state_old
->stack
[i
], false))
1051 /* Merge local variables. */
1052 for (i
= 0; i
< max_locals
; ++i
)
1054 if (merge_types (&s
->locals
[i
], &state_old
->locals
[i
], true))
1061 /* Ensure that `this' has been initialized. */
1063 state_check_this_initialized (state
*s
)
1065 if (type_isreference (&s
->this_type
) && ! type_initialized (&s
->this_type
))
1066 verify_fail ("`this' is uninitialized");
1069 /* Set type of `this'. */
1071 state_set_this_type (state
*s
, type
*k
)
1076 /* Mark each `new'd object we know of that was allocated at PC as
1079 state_set_initialized (state
*s
, int pc
, int max_locals
)
1082 for (i
= 0; i
< s
->stacktop
; ++i
)
1083 type_set_initialized (&s
->stack
[i
], pc
);
1084 for (i
= 0; i
< max_locals
; ++i
)
1085 type_set_initialized (&s
->locals
[i
], pc
);
1086 type_set_initialized (&s
->this_type
, pc
);
1089 /* This tests to see whether two states can be considered "merge
1090 compatible". If both states have a return-address in the same
1091 slot, and the return addresses are different, then they are not
1092 compatible and we must not try to merge them. */
1094 state_mergeable_p (state
*s
, state
*other
, int max_locals
)
1099 /* This is tricky: if the stack sizes differ, then not only are
1100 these not mergeable, but in fact we should give an error, as
1101 we've found two execution paths that reach a branch target
1102 with different stack depths. FIXME stackdepth instead? */
1103 if (s
->stacktop
!= other
->stacktop
)
1104 verify_fail ("stack sizes differ");
1106 for (i
= 0; i
< s
->stacktop
; ++i
)
1107 if (! type_state_mergeable_p (&s
->stack
[i
], &other
->stack
[i
]))
1109 for (i
= 0; i
< max_locals
; ++i
)
1110 if (! type_state_mergeable_p (&s
->locals
[i
], &other
->locals
[i
]))
1116 state_reverify (state
*s
)
1118 if (s
->next
== INVALID_STATE
)
1120 s
->next
= vfr
->next_verify_state
;
1121 vfr
->next_verify_state
= s
;
1127 debug_print_state (state
*s
, const char *leader
, int pc
, int max_stack
,
1131 debug_print ("%s [%4d]: [stack] ", leader
, pc
);
1132 for (i
= 0; i
< s
->stacktop
; ++i
)
1133 type_print (&s
->stack
[i
]);
1134 for (; i
< max_stack
; ++i
)
1136 debug_print (" [local] ");
1137 for (i
= 0; i
< max_locals
; ++i
)
1138 type_print (&s
->locals
[i
]);
1139 debug_print (" | %p\n", s
);
1143 debug_print_state (state
*s ATTRIBUTE_UNUSED
,
1144 const char *leader ATTRIBUTE_UNUSED
,
1145 int pc ATTRIBUTE_UNUSED
, int max_stack ATTRIBUTE_UNUSED
,
1146 int max_locals ATTRIBUTE_UNUSED
)
1149 #endif /* VERIFY_DEBUG */
1155 state
*s
= vfr
->current_state
;
1156 if (s
->stacktop
<= 0)
1157 verify_fail ("stack empty");
1158 r
= s
->stack
[--s
->stacktop
];
1159 s
->stackdepth
-= type_depth (&r
);
1160 if (s
->stackdepth
< 0)
1161 verify_fail_pc ("stack empty", vfr
->start_PC
);
1168 type r
= pop_raw ();
1169 if (type_iswide (&r
))
1170 verify_fail ("narrow pop of wide type");
1175 vfy_pop_type_t (type match
)
1178 vfy_promote_type (&match
);
1180 if (! types_compatible (&match
, &t
))
1181 verify_fail ("incompatible type on stack");
1186 vfy_pop_type (type_val match
)
1188 type t
= make_type (match
);
1189 return vfy_pop_type_t (t
);
1192 #define pop_type vfy_pop_type
1193 #define pop_type_t vfy_pop_type_t
1195 /* Pop a reference which is guaranteed to be initialized. MATCH
1196 doesn't have to be a reference type; in this case this acts like
1199 pop_init_ref_t (type match
)
1201 type t
= pop_raw ();
1202 if (type_isreference (&t
) && ! type_initialized (&t
))
1203 verify_fail ("initialized reference required");
1204 else if (! types_compatible (&match
, &t
))
1205 verify_fail ("incompatible type on stack");
1210 pop_init_ref (type_val match
)
1212 type t
= make_type (match
);
1213 return pop_init_ref_t (t
);
1216 /* Pop a reference type or a return address. */
1218 pop_ref_or_return (void)
1220 type t
= pop_raw ();
1221 if (! type_isreference (&t
) && t
.key
!= return_address_type
)
1222 verify_fail ("expected reference or return address on stack");
1227 vfy_push_type_t (type t
)
1230 state
*s
= vfr
->current_state
;
1231 /* If T is a numeric type like short, promote it to int. */
1234 depth
= type_depth (&t
);
1236 if (s
->stackdepth
+ depth
> vfr
->current_method
->max_stack
)
1237 verify_fail ("stack overflow");
1238 s
->stack
[s
->stacktop
++] = t
;
1239 s
->stackdepth
+= depth
;
1243 vfy_push_type (type_val tval
)
1245 type t
= make_type (tval
);
1246 vfy_push_type_t (t
);
1249 #define push_type vfy_push_type
1250 #define push_type_t vfy_push_type_t
1253 set_variable (int index
, type t
)
1256 state
*s
= vfr
->current_state
;
1257 /* If T is a numeric type like short, promote it to int. */
1260 depth
= type_depth (&t
);
1261 if (index
> vfr
->current_method
->max_locals
- depth
)
1262 verify_fail ("invalid local variable");
1263 s
->locals
[index
] = t
;
1266 init_type_from_tag (&s
->locals
[index
+ 1], continuation_type
);
1267 if (index
> 0 && type_iswide (&s
->locals
[index
- 1]))
1268 init_type_from_tag (&s
->locals
[index
- 1], unsuitable_type
);
1272 get_variable_t (int index
, type
*t
)
1274 state
*s
= vfr
->current_state
;
1275 int depth
= type_depth (t
);
1276 if (index
> vfr
->current_method
->max_locals
- depth
)
1277 verify_fail ("invalid local variable");
1278 if (! types_compatible (t
, &s
->locals
[index
]))
1279 verify_fail ("incompatible type in local variable");
1282 type cont
= make_type (continuation_type
);
1283 if (! types_compatible (&s
->locals
[index
+ 1], &cont
))
1284 verify_fail ("invalid local variable");
1286 return s
->locals
[index
];
1290 get_variable (int index
, type_val v
)
1292 type t
= make_type (v
);
1293 return get_variable_t (index
, &t
);
1296 /* Make sure ARRAY is an array type and that its elements are
1297 compatible with type ELEMENT. Returns the actual element type. */
1299 require_array_type_t (type array
, type element
)
1302 /* An odd case. Here we just pretend that everything went ok. If
1303 the requested element type is some kind of reference, return
1304 the null type instead. */
1305 if (type_isnull (&array
))
1306 return type_isreference (&element
) ? make_type (null_type
) : element
;
1308 if (! type_isarray (&array
))
1309 verify_fail ("array required");
1311 t
= type_array_element (&array
);
1312 if (! types_compatible (&element
, &t
))
1314 /* Special case for byte arrays, which must also be boolean
1317 if (element
.key
== byte_type
)
1319 type e2
= make_type (boolean_type
);
1320 ok
= types_compatible (&e2
, &t
);
1323 verify_fail ("incompatible array element type");
1326 /* Return T and not ELEMENT, because T might be specialized. */
1331 require_array_type (type array
, type_val element
)
1333 type t
= make_type (element
);
1334 return require_array_type_t (array
, t
);
1340 if (vfr
->PC
>= vfr
->current_method
->code_length
)
1341 verify_fail ("premature end of bytecode");
1342 return (jint
) vfr
->bytecode
[vfr
->PC
++] & 0xff;
1348 jint b1
= get_byte ();
1349 jint b2
= get_byte ();
1350 return (jint
) ((b1
<< 8) | b2
) & 0xffff;
1356 signed char b1
= (signed char) get_byte ();
1357 jint b2
= get_byte ();
1358 jshort s
= (b1
<< 8) | b2
;
1365 jint b1
= get_byte ();
1366 jint b2
= get_byte ();
1367 jint b3
= get_byte ();
1368 jint b4
= get_byte ();
1369 jword result
= (b1
<< 24) | (b2
<< 16) | (b3
<< 8) | b4
;
1370 /* In the compiler, 'jint' might have more than 32 bits, so we must
1372 return WORD_TO_INT (result
);
1376 compute_jump (int offset
)
1378 int npc
= vfr
->start_PC
+ offset
;
1379 if (npc
< 0 || npc
>= vfr
->current_method
->code_length
)
1380 verify_fail_pc ("branch out of range", vfr
->start_PC
);
1384 /* Add a new state to the state list at NPC. */
1386 add_new_state (int npc
, state
*old_state
)
1389 vfy_method
*current_method
= vfr
->current_method
;
1390 state
*new_state
= make_state_copy (old_state
, current_method
->max_stack
,
1391 current_method
->max_locals
);
1392 debug_print ("== New state in add_new_state\n");
1393 debug_print_state (new_state
, "New", npc
, current_method
->max_stack
,
1394 current_method
->max_locals
);
1396 nlink
= (state_list
*) vfy_alloc (sizeof (state_list
));
1397 nlink
->val
= new_state
;
1398 nlink
->next
= vfr
->states
[npc
];
1399 vfr
->states
[npc
] = nlink
;
1400 new_state
->pc
= npc
;
1404 /* Merge the indicated state into the state at the branch target and
1405 schedule a new PC if there is a change. NPC is the PC of the
1406 branch target, and FROM_STATE is the state at the source of the
1407 branch. This method returns true if the destination state
1408 changed and requires reverification, false otherwise. */
1410 merge_into (int npc
, state
*from_state
)
1412 /* Iterate over all target states and merge our state into each,
1413 if applicable. FIXME one improvement we could make here is
1414 "state destruction". Merging a new state into an existing one
1415 might cause a return_address_type to be merged to
1416 unsuitable_type. In this case the resulting state may now be
1417 mergeable with other states currently held in parallel at this
1418 location. So in this situation we could pairwise compare and
1419 reduce the number of parallel states. */
1421 bool applicable
= false;
1422 for (iter
= vfr
->states
[npc
]; iter
!= NULL
; iter
= iter
->next
)
1424 state
*new_state
= iter
->val
;
1425 vfy_method
*current_method
= vfr
->current_method
;
1427 if (state_mergeable_p (new_state
, from_state
,
1428 current_method
->max_locals
))
1433 debug_print ("== Merge states in merge_into\n");
1434 debug_print_state (from_state
, "Frm", vfr
->start_PC
, current_method
->max_stack
,
1435 current_method
->max_locals
);
1436 debug_print_state (new_state
, " To", npc
, current_method
->max_stack
,
1437 current_method
->max_locals
);
1438 changed
= merge_states (new_state
, from_state
,
1439 current_method
->max_locals
);
1440 debug_print_state (new_state
, "New", npc
, current_method
->max_stack
,
1441 current_method
->max_locals
);
1444 state_reverify (new_state
);
1450 /* Either we don't yet have a state at NPC, or we have a
1451 return-address type that is in conflict with all existing
1452 state. So, we need to create a new entry. */
1453 state
*new_state
= add_new_state (npc
, from_state
);
1454 /* A new state added in this way must always be reverified. */
1455 state_reverify (new_state
);
1460 push_jump (int offset
)
1462 int npc
= compute_jump (offset
);
1463 /* According to the JVM Spec, we need to check for uninitialized
1464 objects here. However, this does not actually affect type
1465 safety, and the Eclipse java compiler generates code that
1466 violates this constraint. */
1467 merge_into (npc
, vfr
->current_state
);
1471 push_exception_jump (type t
, int pc
)
1474 /* According to the JVM Spec, we need to check for uninitialized
1475 objects here. However, this does not actually affect type
1476 safety, and the Eclipse java compiler generates code that
1477 violates this constraint. */
1478 copy_state_with_stack (&s
, vfr
->current_state
,
1479 vfr
->current_method
->max_stack
,
1480 vfr
->current_method
->max_locals
);
1481 if (vfr
->current_method
->max_stack
< 1)
1482 verify_fail ("stack overflow at exception handler");
1483 state_set_exception (&s
, &t
, vfr
->current_method
->max_stack
);
1484 merge_into (pc
, &s
);
1485 /* FIXME: leak.. need free_state or GC */
1491 state
*new_state
= vfr
->next_verify_state
;
1492 if (new_state
== INVALID_STATE
)
1493 verify_fail ("programmer error in pop_jump");
1494 if (new_state
!= NULL
)
1496 vfr
->next_verify_state
= new_state
->next
;
1497 new_state
->next
= INVALID_STATE
;
1503 invalidate_pc (void)
1509 note_branch_target (int pc
)
1511 /* Don't check `pc <= PC', because we've advanced PC after
1512 fetching the target and we haven't yet checked the next
1514 if (pc
< vfr
->PC
&& ! (vfr
->flags
[pc
] & FLAG_INSN_START
))
1515 verify_fail_pc ("branch not to instruction start", vfr
->start_PC
);
1516 vfr
->flags
[pc
] |= FLAG_BRANCH_TARGET
;
1522 while ((vfr
->PC
% 4) > 0)
1523 if (get_byte () != 0)
1524 verify_fail ("found nonzero padding byte");
1527 /* Do the work for a `ret' instruction. INDEX is the index into the
1530 handle_ret_insn (int index
)
1532 type ret
= make_type (return_address_type
);
1533 type ret_addr
= get_variable_t (index
, &ret
);
1534 /* It would be nice if we could do this. However, the JVM Spec
1535 doesn't say that this is what happens. It is implied that
1536 reusing a return address is invalid, but there's no actual
1537 prohibition against it. */
1538 /* set_variable (index, unsuitable_type); */
1540 int npc
= type_get_pc (&ret_addr
);
1541 /* We might be returning to a `jsr' that is at the end of the
1542 bytecode. This is ok if we never return from the called
1543 subroutine, but if we see this here it is an error. */
1544 if (npc
>= vfr
->current_method
->code_length
)
1545 verify_fail ("fell off end");
1547 /* According to the JVM Spec, we need to check for uninitialized
1548 objects here. However, this does not actually affect type
1549 safety, and the Eclipse java compiler generates code that
1550 violates this constraint. */
1551 merge_into (npc
, vfr
->current_state
);
1555 static void handle_jsr_insn (int offset
)
1558 int npc
= compute_jump (offset
);
1560 /* According to the JVM Spec, we need to check for uninitialized
1561 objects here. However, this does not actually affect type
1562 safety, and the Eclipse java compiler generates code that
1563 violates this constraint. */
1565 /* Modify our state as appropriate for entry into a subroutine. */
1566 ret_addr
= make_type (return_address_type
);
1567 type_set_return_address (&ret_addr
, vfr
->PC
);
1568 vfy_push_type_t (ret_addr
);
1569 merge_into (npc
, vfr
->current_state
);
1574 construct_primitive_array_type (type_val prim
)
1576 vfy_jclass k
= NULL
;
1587 k
= vfy_get_primitive_type ((int) prim
);
1590 /* These aren't used here but we call them out to avoid
1593 case unsuitable_type
:
1594 case return_address_type
:
1595 case continuation_type
:
1596 case reference_type
:
1598 case uninitialized_reference_type
:
1600 verify_fail ("unknown type in construct_primitive_array_type");
1602 k
= vfy_get_array_class (k
);
1606 /* This pass computes the location of branch targets and also
1607 instruction starts. */
1609 branch_prepass (void)
1612 vfr
->flags
= (char *) vfy_alloc (vfr
->current_method
->code_length
);
1614 for (i
= 0; i
< vfr
->current_method
->code_length
; ++i
)
1618 while (vfr
->PC
< vfr
->current_method
->code_length
)
1621 /* Set `start_PC' early so that error checking can have the
1623 vfr
->start_PC
= vfr
->PC
;
1624 vfr
->flags
[vfr
->PC
] |= FLAG_INSN_START
;
1626 opcode
= (java_opcode
) vfr
->bytecode
[vfr
->PC
++];
1630 case op_aconst_null
:
1766 case op_monitorenter
:
1767 case op_monitorexit
:
1775 case op_arraylength
:
1807 case op_invokespecial
:
1808 case op_invokestatic
:
1809 case op_invokevirtual
:
1813 case op_multianewarray
:
1836 note_branch_target (compute_jump (get_short ()));
1839 case op_tableswitch
:
1843 note_branch_target (compute_jump (get_int ()));
1847 verify_fail_pc ("invalid tableswitch", vfr
->start_PC
);
1848 for (i
= low
; i
<= hi
; ++i
)
1849 note_branch_target (compute_jump (get_int ()));
1853 case op_lookupswitch
:
1857 note_branch_target (compute_jump (get_int ()));
1858 npairs
= get_int ();
1860 verify_fail_pc ("too few pairs in lookupswitch", vfr
->start_PC
);
1861 while (npairs
-- > 0)
1864 note_branch_target (compute_jump (get_int ()));
1869 case op_invokeinterface
:
1877 opcode
= (java_opcode
) get_byte ();
1879 if (opcode
== op_iinc
)
1886 note_branch_target (compute_jump (get_int ()));
1890 /* These are unused here, but we call them out explicitly
1891 so that -Wswitch-enum doesn't complain. */
1897 case op_putstatic_1
:
1898 case op_putstatic_2
:
1899 case op_putstatic_4
:
1900 case op_putstatic_8
:
1901 case op_putstatic_a
:
1903 case op_getfield_2s
:
1904 case op_getfield_2u
:
1908 case op_getstatic_1
:
1909 case op_getstatic_2s
:
1910 case op_getstatic_2u
:
1911 case op_getstatic_4
:
1912 case op_getstatic_8
:
1913 case op_getstatic_a
:
1914 #endif /* VFY_FAST_OPCODES */
1916 verify_fail_pc ("unrecognized instruction in branch_prepass",
1920 /* See if any previous branch tried to branch to the middle of
1921 this instruction. */
1922 for (pc
= vfr
->start_PC
+ 1; pc
< vfr
->PC
; ++pc
)
1924 if ((vfr
->flags
[pc
] & FLAG_BRANCH_TARGET
))
1925 verify_fail_pc ("branch to middle of instruction", pc
);
1929 /* Verify exception handlers. */
1930 for (i
= 0; i
< vfr
->current_method
->exc_count
; ++i
)
1932 int handler
, start
, end
, htype
;
1933 vfy_get_exception (vfr
->exception
, i
, &handler
, &start
, &end
, &htype
);
1934 if (! (vfr
->flags
[handler
] & FLAG_INSN_START
))
1935 verify_fail_pc ("exception handler not at instruction start",
1937 if (! (vfr
->flags
[start
] & FLAG_INSN_START
))
1938 verify_fail_pc ("exception start not at instruction start", start
);
1939 if (end
!= vfr
->current_method
->code_length
1940 && ! (vfr
->flags
[end
] & FLAG_INSN_START
))
1941 verify_fail_pc ("exception end not at instruction start", end
);
1943 vfr
->flags
[handler
] |= FLAG_BRANCH_TARGET
;
1948 check_pool_index (int index
)
1950 if (index
< 0 || index
>= vfy_get_constants_size (vfr
->current_class
))
1951 verify_fail_pc ("constant pool index out of range", vfr
->start_PC
);
1955 check_class_constant (int index
)
1957 type t
= { (type_val
) 0, 0, 0 };
1958 vfy_constants
*pool
;
1960 check_pool_index (index
);
1961 pool
= vfy_get_constants (vfr
->current_class
);
1962 if (vfy_tag (pool
, index
) == JV_CONSTANT_ResolvedClass
)
1963 init_type_from_class (&t
, vfy_get_pool_class (pool
, index
));
1964 else if (vfy_tag (pool
, index
) == JV_CONSTANT_Class
)
1965 init_type_from_string (&t
, vfy_get_pool_string (pool
, index
));
1967 verify_fail_pc ("expected class constant", vfr
->start_PC
);
1972 check_constant (int index
)
1974 type t
= { (type_val
) 0, 0, 0 };
1975 vfy_constants
*pool
;
1977 check_pool_index (index
);
1978 pool
= vfy_get_constants (vfr
->current_class
);
1979 if (vfy_tag (pool
, index
) == JV_CONSTANT_ResolvedString
1980 || vfy_tag (pool
, index
) == JV_CONSTANT_String
)
1981 init_type_from_class (&t
, vfy_string_type ());
1982 else if (vfy_tag (pool
, index
) == JV_CONSTANT_Integer
)
1983 init_type_from_tag (&t
, int_type
);
1984 else if (vfy_tag (pool
, index
) == JV_CONSTANT_Float
)
1985 init_type_from_tag (&t
, float_type
);
1986 else if (vfy_tag (pool
, index
) == JV_CONSTANT_Class
1987 || vfy_tag (pool
, index
) == JV_CONSTANT_ResolvedClass
)
1988 /* FIXME: should only allow this for 1.5 bytecode. */
1989 init_type_from_class (&t
, vfy_class_type ());
1991 verify_fail_pc ("String, int, or float constant expected", vfr
->start_PC
);
1996 check_wide_constant (int index
)
1998 type t
= { (type_val
) 0, 0, 0 };
1999 vfy_constants
*pool
;
2001 check_pool_index (index
);
2002 pool
= vfy_get_constants (vfr
->current_class
);
2003 if (vfy_tag (pool
, index
) == JV_CONSTANT_Long
)
2004 init_type_from_tag (&t
, long_type
);
2005 else if (vfy_tag (pool
, index
) == JV_CONSTANT_Double
)
2006 init_type_from_tag (&t
, double_type
);
2008 verify_fail_pc ("long or double constant expected", vfr
->start_PC
);
2012 /* Helper for both field and method. These are laid out the same in
2013 the constant pool. */
2015 handle_field_or_method (int index
, int expected
,
2016 vfy_string
*name
, vfy_string
*fmtype
)
2018 vfy_uint_16 class_index
, name_and_type_index
;
2019 vfy_uint_16 name_index
, desc_index
;
2020 vfy_constants
*pool
;
2022 check_pool_index (index
);
2023 pool
= vfy_get_constants (vfr
->current_class
);
2024 if (vfy_tag (pool
, index
) != expected
)
2025 verify_fail_pc ("didn't see expected constant", vfr
->start_PC
);
2026 /* Once we know we have a Fieldref or Methodref we assume that it
2027 is correctly laid out in the constant pool. I think the code
2028 in defineclass.cc guarantees this. */
2029 vfy_load_indexes (pool
, index
, &class_index
, &name_and_type_index
);
2030 vfy_load_indexes (pool
, name_and_type_index
, &name_index
, &desc_index
);
2032 *name
= vfy_get_pool_string (pool
, name_index
);
2033 *fmtype
= vfy_get_pool_string (pool
, desc_index
);
2035 return check_class_constant (class_index
);
2038 /* Return field's type, compute class' type if requested. If
2039 PUTFIELD is true, use the special 'putfield' semantics. */
2041 check_field_constant (int index
, type
*class_type
, bool putfield
)
2043 vfy_string name
, field_type
;
2047 type ct
= handle_field_or_method (index
,
2048 JV_CONSTANT_Fieldref
,
2049 &name
, &field_type
);
2052 typec
= vfy_string_bytes (field_type
);
2053 if (typec
[0] == '[' || typec
[0] == 'L')
2054 init_type_from_string (&t
, field_type
);
2056 init_type_from_tag (&t
, get_type_val_for_signature (typec
[0]));
2058 /* We have an obscure special case here: we can use `putfield' on a
2059 field declared in this class, even if `this' has not yet been
2062 && ! type_initialized (&vfr
->current_state
->this_type
)
2063 && vfr
->current_state
->this_type
.pc
== SELF
2064 && types_equal (&vfr
->current_state
->this_type
, &ct
)
2065 && vfy_class_has_field (vfr
->current_class
, name
, field_type
))
2066 /* Note that we don't actually know whether we're going to match
2067 against 'this' or some other object of the same type. So,
2068 here we set things up so that it doesn't matter. This relies
2069 on knowing what our caller is up to. */
2070 type_set_uninitialized (class_type
, EITHER
);
2076 check_method_constant (int index
, bool is_interface
,
2077 vfy_string
*method_name
,
2078 vfy_string
*method_signature
)
2080 return handle_field_or_method (index
,
2082 ? JV_CONSTANT_InterfaceMethodref
2083 : JV_CONSTANT_Methodref
),
2084 method_name
, method_signature
);
2088 get_one_type (const char *p
, type
*t
)
2090 const char *start
= p
;
2110 name
= vfy_get_string (start
, p
- start
);
2111 *t
= make_type_from_string (name
);
2115 /* Casting to jchar here is ok since we are looking at an ASCII
2117 rt
= get_type_val_for_signature (v
);
2119 if (arraycount
== 0)
2121 /* Callers of this function eventually push their arguments on
2122 the stack. So, promote them here. */
2123 type new_t
= make_type (rt
);
2124 vfy_promote_type (&new_t
);
2129 k
= construct_primitive_array_type (rt
);
2130 while (--arraycount
> 0)
2131 k
= vfy_get_array_class (k
);
2132 *t
= make_type_from_class (k
);
2137 compute_argument_types (vfy_string signature
, type
*types
)
2140 const char *p
= vfy_string_bytes (signature
);
2147 p
= get_one_type (p
, &types
[i
++]);
2151 compute_return_type (vfy_string signature
)
2153 const char *p
= vfy_string_bytes (signature
);
2158 get_one_type (p
, &t
);
2163 check_return_type (type onstack
)
2165 type rt
= compute_return_type (vfy_get_signature (vfr
->current_method
));
2166 if (! types_compatible (&rt
, &onstack
))
2167 verify_fail ("incompatible return type");
2170 /* Initialize the stack for the new method. Returns true if this
2171 method is an instance initializer. */
2173 initialize_stack (void)
2177 bool is_init
= vfy_strings_equal (vfy_get_method_name (vfr
->current_method
),
2179 bool is_clinit
= vfy_strings_equal (vfy_get_method_name (vfr
->current_method
),
2182 if (! vfy_is_static (vfr
->current_method
))
2184 type kurr
= make_type_from_class (vfr
->current_class
);
2187 type_set_uninitialized (&kurr
, SELF
);
2191 verify_fail ("<clinit> method must be static");
2192 set_variable (0, kurr
);
2193 state_set_this_type (vfr
->current_state
, &kurr
);
2199 verify_fail ("<init> method must be non-static");
2202 /* We have to handle wide arguments specially here. */
2203 arg_count
= vfy_count_arguments (vfy_get_signature (vfr
->current_method
));
2205 type
*arg_types
= (type
*) vfy_alloc (arg_count
* sizeof (type
));
2206 compute_argument_types (vfy_get_signature (vfr
->current_method
), arg_types
);
2207 for (i
= 0; i
< arg_count
; ++i
)
2209 set_variable (var
, arg_types
[i
]);
2211 if (type_iswide (&arg_types
[i
]))
2214 vfy_free (arg_types
);
2221 verify_instructions_0 (void)
2226 vfr
->current_state
= make_state (vfr
->current_method
->max_stack
,
2227 vfr
->current_method
->max_locals
);
2232 /* True if we are verifying an instance initializer. */
2233 this_is_init
= initialize_stack ();
2235 vfr
->states
= (state_list
**) vfy_alloc (sizeof (state_list
*)
2236 * vfr
->current_method
->code_length
);
2238 for (i
= 0; i
< vfr
->current_method
->code_length
; ++i
)
2239 vfr
->states
[i
] = NULL
;
2241 vfr
->next_verify_state
= NULL
;
2247 /* If the PC was invalidated, get a new one from the work list. */
2248 if (vfr
->PC
== NO_NEXT
)
2250 state
*new_state
= pop_jump ();
2251 /* If it is null, we're done. */
2252 if (new_state
== NULL
)
2255 vfr
->PC
= new_state
->pc
;
2256 debug_print ("== State pop from pending list\n");
2257 /* Set up the current state. */
2258 copy_state (vfr
->current_state
, new_state
,
2259 vfr
->current_method
->max_stack
, vfr
->current_method
->max_locals
);
2263 /* We only have to do this checking in the situation where
2264 control flow falls through from the previous instruction.
2265 Otherwise merging is done at the time we push the branch.
2266 Note that we'll catch the off-the-end problem just
2268 if (vfr
->PC
< vfr
->current_method
->code_length
2269 && vfr
->states
[vfr
->PC
] != NULL
)
2271 /* We've already visited this instruction. So merge
2272 the states together. It is simplest, but not most
2273 efficient, to just always invalidate the PC here. */
2274 merge_into (vfr
->PC
, vfr
->current_state
);
2280 /* Control can't fall off the end of the bytecode. We need to
2281 check this in both cases, not just the fall-through case,
2282 because we don't check to see whether a `jsr' appears at
2283 the end of the bytecode until we process a `ret'. */
2284 if (vfr
->PC
>= vfr
->current_method
->code_length
)
2285 verify_fail ("fell off end");
2286 vfr
->flags
[vfr
->PC
] |= FLAG_INSN_SEEN
;
2288 /* We only have to keep saved state at branch targets. If
2289 we're at a branch target and the state here hasn't been set
2290 yet, we set it now. You might notice that `ret' targets
2291 won't necessarily have FLAG_BRANCH_TARGET set. This
2292 doesn't matter, since those states will be filled in by
2294 /* Note that other parts of the compiler assume that there is a
2295 label with a type map at PC=0. */
2296 if (vfr
->states
[vfr
->PC
] == NULL
2297 && (vfr
->PC
== 0 || (vfr
->flags
[vfr
->PC
] & FLAG_BRANCH_TARGET
) != 0))
2298 add_new_state (vfr
->PC
, vfr
->current_state
);
2300 /* Set this before handling exceptions so that debug output is
2302 vfr
->start_PC
= vfr
->PC
;
2304 /* Update states for all active exception handlers. Ordinarily
2305 there are not many exception handlers. So we simply run
2306 through them all. */
2307 for (i
= 0; i
< vfr
->current_method
->exc_count
; ++i
)
2309 int hpc
, start
, end
, htype
;
2310 vfy_get_exception (vfr
->exception
, i
, &hpc
, &start
, &end
, &htype
);
2311 if (vfr
->PC
>= start
&& vfr
->PC
< end
)
2313 type handler
= make_type_from_class (vfy_throwable_type ());
2315 handler
= check_class_constant (htype
);
2316 push_exception_jump (handler
, hpc
);
2321 debug_print_state (vfr
->current_state
, " ", vfr
->PC
,
2322 vfr
->current_method
->max_stack
,
2323 vfr
->current_method
->max_locals
);
2324 opcode
= (java_opcode
) vfr
->bytecode
[vfr
->PC
++];
2330 case op_aconst_null
:
2331 push_type (null_type
);
2341 push_type (int_type
);
2346 push_type (long_type
);
2352 push_type (float_type
);
2357 push_type (double_type
);
2362 push_type (int_type
);
2367 push_type (int_type
);
2371 push_type_t (check_constant (get_byte ()));
2374 push_type_t (check_constant (get_ushort ()));
2377 push_type_t (check_wide_constant (get_ushort ()));
2381 push_type_t (get_variable (get_byte (), int_type
));
2384 push_type_t (get_variable (get_byte (), long_type
));
2387 push_type_t (get_variable (get_byte (), float_type
));
2390 push_type_t (get_variable (get_byte (), double_type
));
2393 push_type_t (get_variable (get_byte (), reference_type
));
2400 push_type_t (get_variable (opcode
- op_iload_0
, int_type
));
2406 push_type_t (get_variable (opcode
- op_lload_0
, long_type
));
2412 push_type_t (get_variable (opcode
- op_fload_0
, float_type
));
2418 push_type_t (get_variable (opcode
- op_dload_0
, double_type
));
2424 push_type_t (get_variable (opcode
- op_aload_0
, reference_type
));
2427 pop_type (int_type
);
2428 push_type_t (require_array_type (pop_init_ref (reference_type
),
2432 pop_type (int_type
);
2433 push_type_t (require_array_type (pop_init_ref (reference_type
),
2437 pop_type (int_type
);
2438 push_type_t (require_array_type (pop_init_ref (reference_type
),
2442 pop_type (int_type
);
2443 push_type_t (require_array_type (pop_init_ref (reference_type
),
2447 pop_type (int_type
);
2448 push_type_t (require_array_type (pop_init_ref (reference_type
),
2452 pop_type (int_type
);
2453 require_array_type (pop_init_ref (reference_type
), byte_type
);
2454 push_type (int_type
);
2457 pop_type (int_type
);
2458 require_array_type (pop_init_ref (reference_type
), char_type
);
2459 push_type (int_type
);
2462 pop_type (int_type
);
2463 require_array_type (pop_init_ref (reference_type
), short_type
);
2464 push_type (int_type
);
2467 set_variable (get_byte (), pop_type (int_type
));
2470 set_variable (get_byte (), pop_type (long_type
));
2473 set_variable (get_byte (), pop_type (float_type
));
2476 set_variable (get_byte (), pop_type (double_type
));
2479 set_variable (get_byte (), pop_ref_or_return ());
2485 set_variable (opcode
- op_istore_0
, pop_type (int_type
));
2491 set_variable (opcode
- op_lstore_0
, pop_type (long_type
));
2497 set_variable (opcode
- op_fstore_0
, pop_type (float_type
));
2503 set_variable (opcode
- op_dstore_0
, pop_type (double_type
));
2509 set_variable (opcode
- op_astore_0
, pop_ref_or_return ());
2512 pop_type (int_type
);
2513 pop_type (int_type
);
2514 require_array_type (pop_init_ref (reference_type
), int_type
);
2517 pop_type (long_type
);
2518 pop_type (int_type
);
2519 require_array_type (pop_init_ref (reference_type
), long_type
);
2522 pop_type (float_type
);
2523 pop_type (int_type
);
2524 require_array_type (pop_init_ref (reference_type
), float_type
);
2527 pop_type (double_type
);
2528 pop_type (int_type
);
2529 require_array_type (pop_init_ref (reference_type
), double_type
);
2532 pop_type (reference_type
);
2533 pop_type (int_type
);
2534 require_array_type (pop_init_ref (reference_type
), reference_type
);
2537 pop_type (int_type
);
2538 pop_type (int_type
);
2539 require_array_type (pop_init_ref (reference_type
), byte_type
);
2542 pop_type (int_type
);
2543 pop_type (int_type
);
2544 require_array_type (pop_init_ref (reference_type
), char_type
);
2547 pop_type (int_type
);
2548 pop_type (int_type
);
2549 require_array_type (pop_init_ref (reference_type
), short_type
);
2556 type t
= pop_raw ();
2557 if (! type_iswide (&t
))
2580 type t2
= pop_raw ();
2581 if (! type_iswide (&t2
))
2595 type t
= pop_raw ();
2596 if (! type_iswide (&t
))
2610 type t1
= pop_raw ();
2612 if (! type_iswide (&t1
))
2627 type t1
= pop_raw ();
2628 if (type_iswide (&t1
))
2630 type t2
= pop_raw ();
2631 if (type_iswide (&t2
))
2648 type t3
= pop_raw ();
2649 if (type_iswide (&t3
))
2686 pop_type (int_type
);
2687 push_type_t (pop_type (int_type
));
2697 pop_type (long_type
);
2698 push_type_t (pop_type (long_type
));
2703 pop_type (int_type
);
2704 push_type_t (pop_type (long_type
));
2711 pop_type (float_type
);
2712 push_type_t (pop_type (float_type
));
2719 pop_type (double_type
);
2720 push_type_t (pop_type (double_type
));
2726 push_type_t (pop_type (int_type
));
2729 push_type_t (pop_type (long_type
));
2732 push_type_t (pop_type (float_type
));
2735 push_type_t (pop_type (double_type
));
2738 get_variable (get_byte (), int_type
);
2742 pop_type (int_type
);
2743 push_type (long_type
);
2746 pop_type (int_type
);
2747 push_type (float_type
);
2750 pop_type (int_type
);
2751 push_type (double_type
);
2754 pop_type (long_type
);
2755 push_type (int_type
);
2758 pop_type (long_type
);
2759 push_type (float_type
);
2762 pop_type (long_type
);
2763 push_type (double_type
);
2766 pop_type (float_type
);
2767 push_type (int_type
);
2770 pop_type (float_type
);
2771 push_type (long_type
);
2774 pop_type (float_type
);
2775 push_type (double_type
);
2778 pop_type (double_type
);
2779 push_type (int_type
);
2782 pop_type (double_type
);
2783 push_type (long_type
);
2786 pop_type (double_type
);
2787 push_type (float_type
);
2790 pop_type (long_type
);
2791 pop_type (long_type
);
2792 push_type (int_type
);
2796 pop_type (float_type
);
2797 pop_type (float_type
);
2798 push_type (int_type
);
2802 pop_type (double_type
);
2803 pop_type (double_type
);
2804 push_type (int_type
);
2812 pop_type (int_type
);
2813 push_jump (get_short ());
2821 pop_type (int_type
);
2822 pop_type (int_type
);
2823 push_jump (get_short ());
2827 pop_type (reference_type
);
2828 pop_type (reference_type
);
2829 push_jump (get_short ());
2832 push_jump (get_short ());
2836 handle_jsr_insn (get_short ());
2839 handle_ret_insn (get_byte ());
2841 case op_tableswitch
:
2845 pop_type (int_type
);
2847 push_jump (get_int ());
2850 /* Already checked LOW -vs- HIGH. */
2851 for (i
= low
; i
<= high
; ++i
)
2852 push_jump (get_int ());
2857 case op_lookupswitch
:
2860 jint npairs
, lastkey
;
2862 pop_type (int_type
);
2864 push_jump (get_int ());
2865 npairs
= get_int ();
2866 /* Already checked NPAIRS >= 0. */
2868 for (i
= 0; i
< npairs
; ++i
)
2870 jint key
= get_int ();
2871 if (i
> 0 && key
<= lastkey
)
2872 verify_fail_pc ("lookupswitch pairs unsorted", vfr
->start_PC
);
2874 push_jump (get_int ());
2880 check_return_type (pop_type (int_type
));
2884 check_return_type (pop_type (long_type
));
2888 check_return_type (pop_type (float_type
));
2892 check_return_type (pop_type (double_type
));
2896 check_return_type (pop_init_ref (reference_type
));
2900 /* We only need to check this when the return type is void,
2901 because all instance initializers return void. We also
2902 need to special-case Object constructors, as they can't
2903 call a superclass <init>. */
2904 if (this_is_init
&& vfr
->current_class
!= vfy_object_type ())
2905 state_check_this_initialized (vfr
->current_state
);
2906 check_return_type (make_type (void_type
));
2910 push_type_t (check_field_constant (get_ushort (), NULL
, false));
2913 pop_type_t (check_field_constant (get_ushort (), NULL
, false));
2918 type field
= check_field_constant (get_ushort (), &klass
, false);
2920 push_type_t (field
);
2926 type field
= check_field_constant (get_ushort (), &klass
, true);
2932 case op_invokevirtual
:
2933 case op_invokespecial
:
2934 case op_invokestatic
:
2935 case op_invokeinterface
:
2937 vfy_string method_name
, method_signature
;
2941 bool is_init
= false;
2944 = check_method_constant (get_ushort (),
2945 opcode
== op_invokeinterface
,
2948 /* NARGS is only used when we're processing
2949 invokeinterface. It is simplest for us to compute it
2950 here and then verify it later. */
2952 if (opcode
== op_invokeinterface
)
2954 nargs
= get_byte ();
2955 if (get_byte () != 0)
2956 verify_fail ("invokeinterface dummy byte is wrong");
2959 namec
= vfy_string_bytes (method_name
);
2961 if (vfy_strings_equal (method_name
, vfy_init_name()))
2964 if (opcode
!= op_invokespecial
)
2965 verify_fail ("can't invoke <init>");
2967 else if (namec
[0] == '<')
2968 verify_fail ("can't invoke method starting with `<'");
2970 arg_count
= vfy_count_arguments (method_signature
);
2972 /* Pop arguments and check types. */
2973 type
*arg_types
= (type
*) vfy_alloc (arg_count
* sizeof (type
));
2975 compute_argument_types (method_signature
, arg_types
);
2976 for (i
= arg_count
- 1; i
>= 0; --i
)
2978 /* This is only used for verifying the byte for
2980 nargs
-= type_depth (&arg_types
[i
]);
2981 pop_init_ref_t (arg_types
[i
]);
2984 vfy_free (arg_types
);
2987 if (opcode
== op_invokeinterface
2989 verify_fail ("wrong argument count for invokeinterface");
2991 if (opcode
!= op_invokestatic
)
2994 type t
= class_type
;
2997 /* In this case the PC doesn't matter. */
2998 type_set_uninitialized (&t
, UNINIT
);
2999 /* FIXME: check to make sure that the <init>
3000 call is to the right class.
3001 It must either be super or an exact class
3005 if (! types_compatible (&t
, &raw
))
3006 verify_fail ("incompatible type on stack");
3009 state_set_initialized (vfr
->current_state
,
3010 type_get_pc (&raw
), vfr
->current_method
->max_locals
);
3013 rt
= compute_return_type (method_signature
);
3014 if (! type_isvoid (&rt
))
3021 type t
= check_class_constant (get_ushort ());
3022 if (type_isarray (&t
) || type_isinterface (&t
)
3023 || type_isabstract (&t
))
3024 verify_fail ("type is array, interface, or abstract");
3025 type_set_uninitialized (&t
, vfr
->start_PC
);
3032 int atype
= get_byte ();
3035 /* We intentionally have chosen constants to make this
3037 if (atype
< boolean_type
|| atype
> long_type
)
3038 verify_fail_pc ("type not primitive", vfr
->start_PC
);
3039 pop_type (int_type
);
3040 k
= construct_primitive_array_type ((type_val
) atype
);
3041 init_type_from_class (&t
, k
);
3048 pop_type (int_type
);
3049 t
= check_class_constant (get_ushort ());
3050 push_type_t (type_to_array (&t
));
3053 case op_arraylength
:
3055 type t
= pop_init_ref (reference_type
);
3056 if (! type_isarray (&t
) && ! type_isnull (&t
))
3057 verify_fail ("array type expected");
3058 push_type (int_type
);
3062 pop_type_t (make_type_from_class (vfy_throwable_type ()));
3066 pop_init_ref (reference_type
);
3067 push_type_t (check_class_constant (get_ushort ()));
3070 pop_init_ref (reference_type
);
3071 check_class_constant (get_ushort ());
3072 push_type (int_type
);
3074 case op_monitorenter
:
3075 pop_init_ref (reference_type
);
3077 case op_monitorexit
:
3078 pop_init_ref (reference_type
);
3082 switch (get_byte ())
3085 push_type_t (get_variable (get_ushort (), int_type
));
3088 push_type_t (get_variable (get_ushort (), long_type
));
3091 push_type_t (get_variable (get_ushort (), float_type
));
3094 push_type_t (get_variable (get_ushort (), double_type
));
3097 push_type_t (get_variable (get_ushort (), reference_type
));
3100 set_variable (get_ushort (), pop_type (int_type
));
3103 set_variable (get_ushort (), pop_type (long_type
));
3106 set_variable (get_ushort (), pop_type (float_type
));
3109 set_variable (get_ushort (), pop_type (double_type
));
3112 set_variable (get_ushort (), pop_init_ref (reference_type
));
3115 handle_ret_insn (get_short ());
3118 get_variable (get_ushort (), int_type
);
3122 verify_fail_pc ("unrecognized wide instruction", vfr
->start_PC
);
3126 case op_multianewarray
:
3129 type atype
= check_class_constant (get_ushort ());
3130 int dim
= get_byte ();
3132 verify_fail_pc ("too few dimensions to multianewarray", vfr
->start_PC
);
3133 type_verify_dimensions (&atype
, dim
);
3134 for (i
= 0; i
< dim
; ++i
)
3135 pop_type (int_type
);
3136 push_type_t (atype
);
3141 pop_type (reference_type
);
3142 push_jump (get_short ());
3145 push_jump (get_int ());
3149 handle_jsr_insn (get_int ());
3153 /* Unrecognized opcode. */
3154 verify_fail_pc ("unrecognized instruction in verify_instructions_0",
3160 /* This turns a `type' into something suitable for use by the type map
3161 in the other parts of the compiler. In particular, reference types
3162 are mapped to Object, primitive types are unchanged, and other
3163 types are mapped using special functions declared in verify.h. */
3165 collapse_type (type
*t
)
3178 return vfy_get_primitive_type (t
->key
);
3180 case unsuitable_type
:
3181 case continuation_type
:
3182 return vfy_unsuitable_type ();
3184 case return_address_type
:
3185 return vfy_return_address_type ();
3188 return vfy_null_type ();
3190 case reference_type
:
3191 case uninitialized_reference_type
:
3192 return vfy_object_type ();
3199 verify_instructions (void)
3204 verify_instructions_0 ();
3206 /* Now tell the rest of the compiler about the types we've found. */
3207 for (i
= 0; i
< vfr
->current_method
->code_length
; ++i
)
3212 if ((vfr
->flags
[i
] & FLAG_INSN_SEEN
) != 0)
3213 vfy_note_instruction_seen (i
);
3215 if (! vfr
->states
[i
])
3218 curr
= vfr
->states
[i
]->val
;
3219 vfy_note_stack_depth (vfr
->current_method
, i
, curr
->stackdepth
);
3221 /* Tell the compiler about each local variable. */
3222 for (j
= 0; j
< vfr
->current_method
->max_locals
; ++j
)
3223 vfy_note_local_type (vfr
->current_method
, i
, j
,
3224 collapse_type (&curr
->locals
[j
]));
3225 /* Tell the compiler about each stack slot. */
3226 for (slot
= j
= 0; j
< curr
->stacktop
; ++j
, ++slot
)
3228 vfy_note_stack_type (vfr
->current_method
, i
, slot
,
3229 collapse_type (&curr
->stack
[j
]));
3230 if (type_iswide (&curr
->stack
[j
]))
3233 vfy_note_stack_type (vfr
->current_method
, i
, slot
,
3234 vfy_unsuitable_type ());
3237 gcc_assert (slot
== curr
->stackdepth
);
3242 make_verifier_context (vfy_method
*m
)
3244 vfr
= (verifier_context
*) vfy_alloc (sizeof (struct verifier_context
));
3246 vfr
->current_method
= m
;
3247 vfr
->bytecode
= vfy_get_bytecode (m
);
3248 vfr
->exception
= vfy_get_exceptions (m
);
3249 vfr
->current_class
= m
->defining_class
;
3253 vfr
->utf8_list
= NULL
;
3254 vfr
->isect_list
= NULL
;
3258 free_verifier_context (void)
3260 vfy_string_list
*utf8_list
;
3261 ref_intersection
*isect_list
;
3264 vfy_free (vfr
->flags
);
3266 utf8_list
= vfr
->utf8_list
;
3267 while (utf8_list
!= NULL
)
3269 vfy_string_list
*n
= utf8_list
->next
;
3270 vfy_free (utf8_list
);
3274 isect_list
= vfr
->isect_list
;
3275 while (isect_list
!= NULL
)
3277 ref_intersection
*next
= isect_list
->alloc_next
;
3278 vfy_free (isect_list
);
3282 if (vfr
->states
!= NULL
)
3285 for (i
= 0; i
< vfr
->current_method
->code_length
; ++i
)
3287 state_list
*iter
= vfr
->states
[i
];
3288 while (iter
!= NULL
)
3290 state_list
*next
= iter
->next
;
3291 free_state (iter
->val
);
3292 vfy_free (iter
->val
);
3297 vfy_free (vfr
->states
);
3304 verify_method (vfy_method
*meth
)
3306 debug_print ("verify_method (%s) %i\n", vfy_string_bytes (meth
->name
),
3310 verify_fail ("verifier re-entered");
3312 make_verifier_context (meth
);
3313 verify_instructions ();
3314 free_verifier_context ();