Mark ChangeLog
[official-gcc.git] / libjava / verify.cc
blob99ed8eed294eb1def6cd703679525df32b94d153
1 // verify.cc - verify bytecode
3 /* Copyright (C) 2001, 2002, 2003, 2004, 2005 Free Software Foundation
5 This file is part of libgcj.
7 This software is copyrighted work licensed under the terms of the
8 Libgcj License. Please consult the file "LIBGCJ_LICENSE" for
9 details. */
11 // Written by Tom Tromey <tromey@redhat.com>
13 // Define VERIFY_DEBUG to enable debugging output.
15 #include <config.h>
17 #include <jvm.h>
18 #include <gcj/cni.h>
19 #include <java-insns.h>
20 #include <java-interp.h>
22 // On Solaris 10/x86, <signal.h> indirectly includes <ia32/sys/reg.h>, which
23 // defines PC since g++ predefines __EXTENSIONS__. Undef here to avoid clash
24 // with PC member of class _Jv_BytecodeVerifier below.
25 #undef PC
27 #ifdef INTERPRETER
29 #include <java/lang/Class.h>
30 #include <java/lang/VerifyError.h>
31 #include <java/lang/Throwable.h>
32 #include <java/lang/reflect/Modifier.h>
33 #include <java/lang/StringBuffer.h>
35 #ifdef VERIFY_DEBUG
36 #include <stdio.h>
37 #endif /* VERIFY_DEBUG */
40 // This is used to mark states which are not scheduled for
41 // verification.
42 #define INVALID_STATE ((state *) -1)
44 static void debug_print (const char *fmt, ...)
45 __attribute__ ((format (printf, 1, 2)));
47 static inline void
48 debug_print (MAYBE_UNUSED const char *fmt, ...)
50 #ifdef VERIFY_DEBUG
51 va_list ap;
52 va_start (ap, fmt);
53 vfprintf (stderr, fmt, ap);
54 va_end (ap);
55 #endif /* VERIFY_DEBUG */
58 // This started as a fairly ordinary verifier, and for the most part
59 // it remains so. It works in the obvious way, by modeling the effect
60 // of each opcode as it is encountered. For most opcodes, this is a
61 // straightforward operation.
63 // This verifier does not do type merging. It used to, but this
64 // results in difficulty verifying some relatively simple code
65 // involving interfaces, and it pushed some verification work into the
66 // interpreter.
68 // Instead of merging reference types, when we reach a point where two
69 // flows of control merge, we simply keep the union of reference types
70 // from each branch. Then, when we need to verify a fact about a
71 // reference on the stack (e.g., that it is compatible with the
72 // argument type of a method), we check to ensure that all possible
73 // types satisfy the requirement.
75 // Another area this verifier differs from the norm is in its handling
76 // of subroutines. The JVM specification has some confusing things to
77 // say about subroutines. For instance, it makes claims about not
78 // allowing subroutines to merge and it rejects recursive subroutines.
79 // For the most part these are red herrings; we used to try to follow
80 // these things but they lead to problems. For example, the notion of
81 // "being in a subroutine" is not well-defined: is an exception
82 // handler in a subroutine? If you never execute the `ret' but
83 // instead `goto 1' do you remain in the subroutine?
85 // For clarity on what is really required for type safety, read
86 // "Simple Verification Technique for Complex Java Bytecode
87 // Subroutines" by Alessandro Coglio. Among other things this paper
88 // shows that recursive subroutines are not harmful to type safety.
89 // We implement something similar to what he proposes. Note that this
90 // means that this verifier will accept code that is rejected by some
91 // other verifiers.
93 // For those not wanting to read the paper, the basic observation is
94 // that we can maintain split states in subroutines. We maintain one
95 // state for each calling `jsr'. In other words, we re-verify a
96 // subroutine once for each caller, using the exact types held by the
97 // callers (as opposed to the old approach of merging types and
98 // keeping a bitmap registering what did or did not change). This
99 // approach lets us continue to verify correctly even when a
100 // subroutine is exited via `goto' or `athrow' and not `ret'.
102 // In some other areas the JVM specification is (mildly) incorrect,
103 // so we diverge. For instance, you cannot
104 // violate type safety by allocating an object with `new' and then
105 // failing to initialize it, no matter how one branches or where one
106 // stores the uninitialized reference. See "Improving the official
107 // specification of Java bytecode verification" by Alessandro Coglio.
109 // Note that there's no real point in enforcing that padding bytes or
110 // the mystery byte of invokeinterface must be 0, but we do that
111 // regardless.
113 // The verifier is currently neither completely lazy nor eager when it
114 // comes to loading classes. It tries to represent types by name when
115 // possible, and then loads them when it needs to verify a fact about
116 // the type. Checking types by name is valid because we only use
117 // names which come from the current class' constant pool. Since all
118 // such names are looked up using the same class loader, there is no
119 // danger that we might be fooled into comparing different types with
120 // the same name.
122 // In the future we plan to allow for a completely lazy mode of
123 // operation, where the verifier will construct a list of type
124 // assertions to be checked later.
126 // Some test cases for the verifier live in the "verify" module of the
127 // Mauve test suite. However, some of these are presently
128 // (2004-01-20) believed to be incorrect. (More precisely the notion
129 // of "correct" is not well-defined, and this verifier differs from
130 // others while remaining type-safe.) Some other tests live in the
131 // libgcj test suite.
132 class _Jv_BytecodeVerifier
134 private:
136 static const int FLAG_INSN_START = 1;
137 static const int FLAG_BRANCH_TARGET = 2;
139 struct state;
140 struct type;
141 struct linked_utf8;
142 struct ref_intersection;
144 template<typename T>
145 struct linked
147 T *val;
148 linked<T> *next;
151 // The current PC.
152 int PC;
153 // The PC corresponding to the start of the current instruction.
154 int start_PC;
156 // The current state of the stack, locals, etc.
157 state *current_state;
159 // At each branch target we keep a linked list of all the states we
160 // can process at that point. We'll only have multiple states at a
161 // given PC if they both have different return-address types in the
162 // same stack or local slot. This array is indexed by PC and holds
163 // the list of all such states.
164 linked<state> **states;
166 // We keep a linked list of all the states which we must reverify.
167 // This is the head of the list.
168 state *next_verify_state;
170 // We keep some flags for each instruction. The values are the
171 // FLAG_* constants defined above. This is an array indexed by PC.
172 char *flags;
174 // The bytecode itself.
175 unsigned char *bytecode;
176 // The exceptions.
177 _Jv_InterpException *exception;
179 // Defining class.
180 jclass current_class;
181 // This method.
182 _Jv_InterpMethod *current_method;
184 // A linked list of utf8 objects we allocate.
185 linked<_Jv_Utf8Const> *utf8_list;
187 // A linked list of all ref_intersection objects we allocate.
188 ref_intersection *isect_list;
190 // Create a new Utf-8 constant and return it. We do this to avoid
191 // having our Utf-8 constants prematurely collected.
192 _Jv_Utf8Const *make_utf8_const (char *s, int len)
194 linked<_Jv_Utf8Const> *lu = (linked<_Jv_Utf8Const> *)
195 _Jv_Malloc (sizeof (linked<_Jv_Utf8Const>)
196 + _Jv_Utf8Const::space_needed(s, len));
197 _Jv_Utf8Const *r = (_Jv_Utf8Const *) (lu + 1);
198 r->init(s, len);
199 lu->val = r;
200 lu->next = utf8_list;
201 utf8_list = lu;
203 return r;
206 __attribute__ ((__noreturn__)) void verify_fail (char *s, jint pc = -1)
208 using namespace java::lang;
209 StringBuffer *buf = new StringBuffer ();
211 buf->append (JvNewStringLatin1 ("verification failed"));
212 if (pc == -1)
213 pc = start_PC;
214 if (pc != -1)
216 buf->append (JvNewStringLatin1 (" at PC "));
217 buf->append (pc);
220 _Jv_InterpMethod *method = current_method;
221 buf->append (JvNewStringLatin1 (" in "));
222 buf->append (current_class->getName());
223 buf->append ((jchar) ':');
224 buf->append (method->get_method()->name->toString());
225 buf->append ((jchar) '(');
226 buf->append (method->get_method()->signature->toString());
227 buf->append ((jchar) ')');
229 buf->append (JvNewStringLatin1 (": "));
230 buf->append (JvNewStringLatin1 (s));
231 throw new java::lang::VerifyError (buf->toString ());
234 // This enum holds a list of tags for all the different types we
235 // need to handle. Reference types are treated specially by the
236 // type class.
237 enum type_val
239 void_type,
241 // The values for primitive types are chosen to correspond to values
242 // specified to newarray.
243 boolean_type = 4,
244 char_type = 5,
245 float_type = 6,
246 double_type = 7,
247 byte_type = 8,
248 short_type = 9,
249 int_type = 10,
250 long_type = 11,
252 // Used when overwriting second word of a double or long in the
253 // local variables. Also used after merging local variable states
254 // to indicate an unusable value.
255 unsuitable_type,
256 return_address_type,
257 // This is the second word of a two-word value, i.e., a double or
258 // a long.
259 continuation_type,
261 // Everything after `reference_type' must be a reference type.
262 reference_type,
263 null_type,
264 uninitialized_reference_type
267 // This represents a merged class type. Some verifiers (including
268 // earlier versions of this one) will compute the intersection of
269 // two class types when merging states. However, this loses
270 // critical information about interfaces implemented by the various
271 // classes. So instead we keep track of all the actual classes that
272 // have been merged.
273 struct ref_intersection
275 // Whether or not this type has been resolved.
276 bool is_resolved;
278 // Actual type data.
279 union
281 // For a resolved reference type, this is a pointer to the class.
282 jclass klass;
283 // For other reference types, this it the name of the class.
284 _Jv_Utf8Const *name;
285 } data;
287 // Link to the next reference in the intersection.
288 ref_intersection *ref_next;
290 // This is used to keep track of all the allocated
291 // ref_intersection objects, so we can free them.
292 // FIXME: we should allocate these in chunks.
293 ref_intersection *alloc_next;
295 ref_intersection (jclass klass, _Jv_BytecodeVerifier *verifier)
296 : ref_next (NULL)
298 is_resolved = true;
299 data.klass = klass;
300 alloc_next = verifier->isect_list;
301 verifier->isect_list = this;
304 ref_intersection (_Jv_Utf8Const *name, _Jv_BytecodeVerifier *verifier)
305 : ref_next (NULL)
307 is_resolved = false;
308 data.name = name;
309 alloc_next = verifier->isect_list;
310 verifier->isect_list = this;
313 ref_intersection (ref_intersection *dup, ref_intersection *tail,
314 _Jv_BytecodeVerifier *verifier)
315 : ref_next (tail)
317 is_resolved = dup->is_resolved;
318 data = dup->data;
319 alloc_next = verifier->isect_list;
320 verifier->isect_list = this;
323 bool equals (ref_intersection *other, _Jv_BytecodeVerifier *verifier)
325 if (! is_resolved && ! other->is_resolved
326 && _Jv_equalUtf8Consts (data.name, other->data.name))
327 return true;
328 if (! is_resolved)
329 resolve (verifier);
330 if (! other->is_resolved)
331 other->resolve (verifier);
332 return data.klass == other->data.klass;
335 // Merge THIS type into OTHER, returning the result. This will
336 // return OTHER if all the classes in THIS already appear in
337 // OTHER.
338 ref_intersection *merge (ref_intersection *other,
339 _Jv_BytecodeVerifier *verifier)
341 ref_intersection *tail = other;
342 for (ref_intersection *self = this; self != NULL; self = self->ref_next)
344 bool add = true;
345 for (ref_intersection *iter = other; iter != NULL;
346 iter = iter->ref_next)
348 if (iter->equals (self, verifier))
350 add = false;
351 break;
355 if (add)
356 tail = new ref_intersection (self, tail, verifier);
358 return tail;
361 void resolve (_Jv_BytecodeVerifier *verifier)
363 if (is_resolved)
364 return;
366 using namespace java::lang;
367 java::lang::ClassLoader *loader
368 = verifier->current_class->getClassLoaderInternal();
369 // We might see either kind of name. Sigh.
370 if (data.name->first() == 'L' && data.name->limit()[-1] == ';')
371 data.klass = _Jv_FindClassFromSignature (data.name->chars(), loader);
372 else
373 data.klass = Class::forName (_Jv_NewStringUtf8Const (data.name),
374 false, loader);
375 is_resolved = true;
378 // See if an object of type OTHER can be assigned to an object of
379 // type *THIS. This might resolve classes in one chain or the
380 // other.
381 bool compatible (ref_intersection *other,
382 _Jv_BytecodeVerifier *verifier)
384 ref_intersection *self = this;
386 for (; self != NULL; self = self->ref_next)
388 ref_intersection *other_iter = other;
390 for (; other_iter != NULL; other_iter = other_iter->ref_next)
392 // Avoid resolving if possible.
393 if (! self->is_resolved
394 && ! other_iter->is_resolved
395 && _Jv_equalUtf8Consts (self->data.name,
396 other_iter->data.name))
397 continue;
399 if (! self->is_resolved)
400 self->resolve(verifier);
401 if (! other_iter->is_resolved)
402 other_iter->resolve(verifier);
404 if (! is_assignable_from_slow (self->data.klass,
405 other_iter->data.klass))
406 return false;
410 return true;
413 bool isarray ()
415 // assert (ref_next == NULL);
416 if (is_resolved)
417 return data.klass->isArray ();
418 else
419 return data.name->first() == '[';
422 bool isinterface (_Jv_BytecodeVerifier *verifier)
424 // assert (ref_next == NULL);
425 if (! is_resolved)
426 resolve (verifier);
427 return data.klass->isInterface ();
430 bool isabstract (_Jv_BytecodeVerifier *verifier)
432 // assert (ref_next == NULL);
433 if (! is_resolved)
434 resolve (verifier);
435 using namespace java::lang::reflect;
436 return Modifier::isAbstract (data.klass->getModifiers ());
439 jclass getclass (_Jv_BytecodeVerifier *verifier)
441 if (! is_resolved)
442 resolve (verifier);
443 return data.klass;
446 int count_dimensions ()
448 int ndims = 0;
449 if (is_resolved)
451 jclass k = data.klass;
452 while (k->isArray ())
454 k = k->getComponentType ();
455 ++ndims;
458 else
460 char *p = data.name->chars();
461 while (*p++ == '[')
462 ++ndims;
464 return ndims;
467 void *operator new (size_t bytes)
469 return _Jv_Malloc (bytes);
472 void operator delete (void *mem)
474 _Jv_Free (mem);
478 // Return the type_val corresponding to a primitive signature
479 // character. For instance `I' returns `int.class'.
480 type_val get_type_val_for_signature (jchar sig)
482 type_val rt;
483 switch (sig)
485 case 'Z':
486 rt = boolean_type;
487 break;
488 case 'B':
489 rt = byte_type;
490 break;
491 case 'C':
492 rt = char_type;
493 break;
494 case 'S':
495 rt = short_type;
496 break;
497 case 'I':
498 rt = int_type;
499 break;
500 case 'J':
501 rt = long_type;
502 break;
503 case 'F':
504 rt = float_type;
505 break;
506 case 'D':
507 rt = double_type;
508 break;
509 case 'V':
510 rt = void_type;
511 break;
512 default:
513 verify_fail ("invalid signature");
515 return rt;
518 // Return the type_val corresponding to a primitive class.
519 type_val get_type_val_for_signature (jclass k)
521 return get_type_val_for_signature ((jchar) k->method_count);
524 // This is like _Jv_IsAssignableFrom, but it works even if SOURCE or
525 // TARGET haven't been prepared.
526 static bool is_assignable_from_slow (jclass target, jclass source)
528 // First, strip arrays.
529 while (target->isArray ())
531 // If target is array, source must be as well.
532 if (! source->isArray ())
533 return false;
534 target = target->getComponentType ();
535 source = source->getComponentType ();
538 // Quick success.
539 if (target == &java::lang::Object::class$)
540 return true;
544 if (source == target)
545 return true;
547 if (target->isPrimitive () || source->isPrimitive ())
548 return false;
550 if (target->isInterface ())
552 for (int i = 0; i < source->interface_count; ++i)
554 // We use a recursive call because we also need to
555 // check superinterfaces.
556 if (is_assignable_from_slow (target, source->getInterface (i)))
557 return true;
560 source = source->getSuperclass ();
562 while (source != NULL);
564 return false;
567 // The `type' class is used to represent a single type in the
568 // verifier.
569 struct type
571 // The type key.
572 type_val key;
574 // For reference types, the representation of the type.
575 ref_intersection *klass;
577 // This is used in two situations.
579 // First, when constructing a new object, it is the PC of the
580 // `new' instruction which created the object. We use the special
581 // value UNINIT to mean that this is uninitialized. The special
582 // value SELF is used for the case where the current method is
583 // itself the <init> method. the special value EITHER is used
584 // when we may optionally allow either an uninitialized or
585 // initialized reference to match.
587 // Second, when the key is return_address_type, this holds the PC
588 // of the instruction following the `jsr'.
589 int pc;
591 static const int UNINIT = -2;
592 static const int SELF = -1;
593 static const int EITHER = -3;
595 // Basic constructor.
596 type ()
598 key = unsuitable_type;
599 klass = NULL;
600 pc = UNINIT;
603 // Make a new instance given the type tag. We assume a generic
604 // `reference_type' means Object.
605 type (type_val k)
607 key = k;
608 // For reference_type, if KLASS==NULL then that means we are
609 // looking for a generic object of any kind, including an
610 // uninitialized reference.
611 klass = NULL;
612 pc = UNINIT;
615 // Make a new instance given a class.
616 type (jclass k, _Jv_BytecodeVerifier *verifier)
618 key = reference_type;
619 klass = new ref_intersection (k, verifier);
620 pc = UNINIT;
623 // Make a new instance given the name of a class.
624 type (_Jv_Utf8Const *n, _Jv_BytecodeVerifier *verifier)
626 key = reference_type;
627 klass = new ref_intersection (n, verifier);
628 pc = UNINIT;
631 // Copy constructor.
632 type (const type &t)
634 key = t.key;
635 klass = t.klass;
636 pc = t.pc;
639 // These operators are required because libgcj can't link in
640 // -lstdc++.
641 void *operator new[] (size_t bytes)
643 return _Jv_Malloc (bytes);
646 void operator delete[] (void *mem)
648 _Jv_Free (mem);
651 type& operator= (type_val k)
653 key = k;
654 klass = NULL;
655 pc = UNINIT;
656 return *this;
659 type& operator= (const type& t)
661 key = t.key;
662 klass = t.klass;
663 pc = t.pc;
664 return *this;
667 // Promote a numeric type.
668 type &promote ()
670 if (key == boolean_type || key == char_type
671 || key == byte_type || key == short_type)
672 key = int_type;
673 return *this;
676 // Mark this type as the uninitialized result of `new'.
677 void set_uninitialized (int npc, _Jv_BytecodeVerifier *verifier)
679 if (key == reference_type)
680 key = uninitialized_reference_type;
681 else
682 verifier->verify_fail ("internal error in type::uninitialized");
683 pc = npc;
686 // Mark this type as now initialized.
687 void set_initialized (int npc)
689 if (npc != UNINIT && pc == npc && key == uninitialized_reference_type)
691 key = reference_type;
692 pc = UNINIT;
696 // Mark this type as a particular return address.
697 void set_return_address (int npc)
699 pc = npc;
702 // Return true if this type and type OTHER are considered
703 // mergeable for the purposes of state merging. This is related
704 // to subroutine handling. For this purpose two types are
705 // considered unmergeable if they are both return-addresses but
706 // have different PCs.
707 bool state_mergeable_p (const type &other) const
709 return (key != return_address_type
710 || other.key != return_address_type
711 || pc == other.pc);
714 // Return true if an object of type K can be assigned to a variable
715 // of type *THIS. Handle various special cases too. Might modify
716 // *THIS or K. Note however that this does not perform numeric
717 // promotion.
718 bool compatible (type &k, _Jv_BytecodeVerifier *verifier)
720 // Any type is compatible with the unsuitable type.
721 if (key == unsuitable_type)
722 return true;
724 if (key < reference_type || k.key < reference_type)
725 return key == k.key;
727 // The `null' type is convertible to any initialized reference
728 // type.
729 if (key == null_type)
730 return k.key != uninitialized_reference_type;
731 if (k.key == null_type)
732 return key != uninitialized_reference_type;
734 // A special case for a generic reference.
735 if (klass == NULL)
736 return true;
737 if (k.klass == NULL)
738 verifier->verify_fail ("programmer error in type::compatible");
740 // Handle the special 'EITHER' case, which is only used in a
741 // special case of 'putfield'. Note that we only need to handle
742 // this on the LHS of a check.
743 if (! isinitialized () && pc == EITHER)
745 // If the RHS is uninitialized, it must be an uninitialized
746 // 'this'.
747 if (! k.isinitialized () && k.pc != SELF)
748 return false;
750 else if (isinitialized () != k.isinitialized ())
752 // An initialized type and an uninitialized type are not
753 // otherwise compatible.
754 return false;
756 else
758 // Two uninitialized objects are compatible if either:
759 // * The PCs are identical, or
760 // * One PC is UNINIT.
761 if (! isinitialized ())
763 if (pc != k.pc && pc != UNINIT && k.pc != UNINIT)
764 return false;
768 return klass->compatible(k.klass, verifier);
771 bool equals (const type &other, _Jv_BytecodeVerifier *vfy)
773 // Only works for reference types.
774 if ((key != reference_type
775 && key != uninitialized_reference_type)
776 || (other.key != reference_type
777 && other.key != uninitialized_reference_type))
778 return false;
779 // Only for single-valued types.
780 if (klass->ref_next || other.klass->ref_next)
781 return false;
782 return klass->equals (other.klass, vfy);
785 bool isvoid () const
787 return key == void_type;
790 bool iswide () const
792 return key == long_type || key == double_type;
795 // Return number of stack or local variable slots taken by this
796 // type.
797 int depth () const
799 return iswide () ? 2 : 1;
802 bool isarray () const
804 // We treat null_type as not an array. This is ok based on the
805 // current uses of this method.
806 if (key == reference_type)
807 return klass->isarray ();
808 return false;
811 bool isnull () const
813 return key == null_type;
816 bool isinterface (_Jv_BytecodeVerifier *verifier)
818 if (key != reference_type)
819 return false;
820 return klass->isinterface (verifier);
823 bool isabstract (_Jv_BytecodeVerifier *verifier)
825 if (key != reference_type)
826 return false;
827 return klass->isabstract (verifier);
830 // Return the element type of an array.
831 type element_type (_Jv_BytecodeVerifier *verifier)
833 if (key != reference_type)
834 verifier->verify_fail ("programmer error in type::element_type()", -1);
836 jclass k = klass->getclass (verifier)->getComponentType ();
837 if (k->isPrimitive ())
838 return type (verifier->get_type_val_for_signature (k));
839 return type (k, verifier);
842 // Return the array type corresponding to an initialized
843 // reference. We could expand this to work for other kinds of
844 // types, but currently we don't need to.
845 type to_array (_Jv_BytecodeVerifier *verifier)
847 if (key != reference_type)
848 verifier->verify_fail ("internal error in type::to_array()");
850 jclass k = klass->getclass (verifier);
851 return type (_Jv_GetArrayClass (k, k->getClassLoaderInternal()),
852 verifier);
855 bool isreference () const
857 return key >= reference_type;
860 int get_pc () const
862 return pc;
865 bool isinitialized () const
867 return key == reference_type || key == null_type;
870 bool isresolved () const
872 return (key == reference_type
873 || key == null_type
874 || key == uninitialized_reference_type);
877 void verify_dimensions (int ndims, _Jv_BytecodeVerifier *verifier)
879 // The way this is written, we don't need to check isarray().
880 if (key != reference_type)
881 verifier->verify_fail ("internal error in verify_dimensions:"
882 " not a reference type");
884 if (klass->count_dimensions () < ndims)
885 verifier->verify_fail ("array type has fewer dimensions"
886 " than required");
889 // Merge OLD_TYPE into this. On error throw exception. Return
890 // true if the merge caused a type change.
891 bool merge (type& old_type, bool local_semantics,
892 _Jv_BytecodeVerifier *verifier)
894 bool changed = false;
895 bool refo = old_type.isreference ();
896 bool refn = isreference ();
897 if (refo && refn)
899 if (old_type.key == null_type)
901 else if (key == null_type)
903 *this = old_type;
904 changed = true;
906 else if (isinitialized () != old_type.isinitialized ())
907 verifier->verify_fail ("merging initialized and uninitialized types");
908 else
910 if (! isinitialized ())
912 if (pc == UNINIT)
913 pc = old_type.pc;
914 else if (old_type.pc == UNINIT)
916 else if (pc != old_type.pc)
917 verifier->verify_fail ("merging different uninitialized types");
920 ref_intersection *merged = old_type.klass->merge (klass,
921 verifier);
922 if (merged != klass)
924 klass = merged;
925 changed = true;
929 else if (refo || refn || key != old_type.key)
931 if (local_semantics)
933 // If we already have an `unsuitable' type, then we
934 // don't need to change again.
935 if (key != unsuitable_type)
937 key = unsuitable_type;
938 changed = true;
941 else
942 verifier->verify_fail ("unmergeable type");
944 return changed;
947 #ifdef VERIFY_DEBUG
948 void print (void) const
950 char c = '?';
951 switch (key)
953 case boolean_type: c = 'Z'; break;
954 case byte_type: c = 'B'; break;
955 case char_type: c = 'C'; break;
956 case short_type: c = 'S'; break;
957 case int_type: c = 'I'; break;
958 case long_type: c = 'J'; break;
959 case float_type: c = 'F'; break;
960 case double_type: c = 'D'; break;
961 case void_type: c = 'V'; break;
962 case unsuitable_type: c = '-'; break;
963 case return_address_type: c = 'r'; break;
964 case continuation_type: c = '+'; break;
965 case reference_type: c = 'L'; break;
966 case null_type: c = '@'; break;
967 case uninitialized_reference_type: c = 'U'; break;
969 debug_print ("%c", c);
971 #endif /* VERIFY_DEBUG */
974 // This class holds all the state information we need for a given
975 // location.
976 struct state
978 // The current top of the stack, in terms of slots.
979 int stacktop;
980 // The current depth of the stack. This will be larger than
981 // STACKTOP when wide types are on the stack.
982 int stackdepth;
983 // The stack.
984 type *stack;
985 // The local variables.
986 type *locals;
987 // We keep track of the type of `this' specially. This is used to
988 // ensure that an instance initializer invokes another initializer
989 // on `this' before returning. We must keep track of this
990 // specially because otherwise we might be confused by code which
991 // assigns to locals[0] (overwriting `this') and then returns
992 // without really initializing.
993 type this_type;
995 // The PC for this state. This is only valid on states which are
996 // permanently attached to a given PC. For an object like
997 // `current_state', which is used transiently, this has no
998 // meaning.
999 int pc;
1000 // We keep a linked list of all states requiring reverification.
1001 // If this is the special value INVALID_STATE then this state is
1002 // not on the list. NULL marks the end of the linked list.
1003 state *next;
1005 // NO_NEXT is the PC value meaning that a new state must be
1006 // acquired from the verification list.
1007 static const int NO_NEXT = -1;
1009 state ()
1010 : this_type ()
1012 stack = NULL;
1013 locals = NULL;
1014 next = INVALID_STATE;
1017 state (int max_stack, int max_locals)
1018 : this_type ()
1020 stacktop = 0;
1021 stackdepth = 0;
1022 stack = new type[max_stack];
1023 for (int i = 0; i < max_stack; ++i)
1024 stack[i] = unsuitable_type;
1025 locals = new type[max_locals];
1026 for (int i = 0; i < max_locals; ++i)
1027 locals[i] = unsuitable_type;
1028 pc = NO_NEXT;
1029 next = INVALID_STATE;
1032 state (const state *orig, int max_stack, int max_locals)
1034 stack = new type[max_stack];
1035 locals = new type[max_locals];
1036 copy (orig, max_stack, max_locals);
1037 pc = NO_NEXT;
1038 next = INVALID_STATE;
1041 ~state ()
1043 if (stack)
1044 delete[] stack;
1045 if (locals)
1046 delete[] locals;
1049 void *operator new[] (size_t bytes)
1051 return _Jv_Malloc (bytes);
1054 void operator delete[] (void *mem)
1056 _Jv_Free (mem);
1059 void *operator new (size_t bytes)
1061 return _Jv_Malloc (bytes);
1064 void operator delete (void *mem)
1066 _Jv_Free (mem);
1069 void copy (const state *copy, int max_stack, int max_locals)
1071 stacktop = copy->stacktop;
1072 stackdepth = copy->stackdepth;
1073 for (int i = 0; i < max_stack; ++i)
1074 stack[i] = copy->stack[i];
1075 for (int i = 0; i < max_locals; ++i)
1076 locals[i] = copy->locals[i];
1078 this_type = copy->this_type;
1079 // Don't modify `next' or `pc'.
1082 // Modify this state to reflect entry to an exception handler.
1083 void set_exception (type t, int max_stack)
1085 stackdepth = 1;
1086 stacktop = 1;
1087 stack[0] = t;
1088 for (int i = stacktop; i < max_stack; ++i)
1089 stack[i] = unsuitable_type;
1092 inline int get_pc () const
1094 return pc;
1097 void set_pc (int npc)
1099 pc = npc;
1102 // Merge STATE_OLD into this state. Destructively modifies this
1103 // state. Returns true if the new state was in fact changed.
1104 // Will throw an exception if the states are not mergeable.
1105 bool merge (state *state_old, int max_locals,
1106 _Jv_BytecodeVerifier *verifier)
1108 bool changed = false;
1110 // Special handling for `this'. If one or the other is
1111 // uninitialized, then the merge is uninitialized.
1112 if (this_type.isinitialized ())
1113 this_type = state_old->this_type;
1115 // Merge stacks.
1116 if (state_old->stacktop != stacktop) // FIXME stackdepth instead?
1117 verifier->verify_fail ("stack sizes differ");
1118 for (int i = 0; i < state_old->stacktop; ++i)
1120 if (stack[i].merge (state_old->stack[i], false, verifier))
1121 changed = true;
1124 // Merge local variables.
1125 for (int i = 0; i < max_locals; ++i)
1127 if (locals[i].merge (state_old->locals[i], true, verifier))
1128 changed = true;
1131 return changed;
1134 // Ensure that `this' has been initialized.
1135 void check_this_initialized (_Jv_BytecodeVerifier *verifier)
1137 if (this_type.isreference () && ! this_type.isinitialized ())
1138 verifier->verify_fail ("`this' is uninitialized");
1141 // Set type of `this'.
1142 void set_this_type (const type &k)
1144 this_type = k;
1147 // Mark each `new'd object we know of that was allocated at PC as
1148 // initialized.
1149 void set_initialized (int pc, int max_locals)
1151 for (int i = 0; i < stacktop; ++i)
1152 stack[i].set_initialized (pc);
1153 for (int i = 0; i < max_locals; ++i)
1154 locals[i].set_initialized (pc);
1155 this_type.set_initialized (pc);
1158 // This tests to see whether two states can be considered "merge
1159 // compatible". If both states have a return-address in the same
1160 // slot, and the return addresses are different, then they are not
1161 // compatible and we must not try to merge them.
1162 bool state_mergeable_p (state *other, int max_locals,
1163 _Jv_BytecodeVerifier *verifier)
1165 // This is tricky: if the stack sizes differ, then not only are
1166 // these not mergeable, but in fact we should give an error, as
1167 // we've found two execution paths that reach a branch target
1168 // with different stack depths. FIXME stackdepth instead?
1169 if (stacktop != other->stacktop)
1170 verifier->verify_fail ("stack sizes differ");
1172 for (int i = 0; i < stacktop; ++i)
1173 if (! stack[i].state_mergeable_p (other->stack[i]))
1174 return false;
1175 for (int i = 0; i < max_locals; ++i)
1176 if (! locals[i].state_mergeable_p (other->locals[i]))
1177 return false;
1178 return true;
1181 void reverify (_Jv_BytecodeVerifier *verifier)
1183 if (next == INVALID_STATE)
1185 next = verifier->next_verify_state;
1186 verifier->next_verify_state = this;
1190 #ifdef VERIFY_DEBUG
1191 void print (const char *leader, int pc,
1192 int max_stack, int max_locals) const
1194 debug_print ("%s [%4d]: [stack] ", leader, pc);
1195 int i;
1196 for (i = 0; i < stacktop; ++i)
1197 stack[i].print ();
1198 for (; i < max_stack; ++i)
1199 debug_print (".");
1200 debug_print (" [local] ");
1201 for (i = 0; i < max_locals; ++i)
1202 locals[i].print ();
1203 debug_print (" | %p\n", this);
1205 #else
1206 inline void print (const char *, int, int, int) const
1209 #endif /* VERIFY_DEBUG */
1212 type pop_raw ()
1214 if (current_state->stacktop <= 0)
1215 verify_fail ("stack empty");
1216 type r = current_state->stack[--current_state->stacktop];
1217 current_state->stackdepth -= r.depth ();
1218 if (current_state->stackdepth < 0)
1219 verify_fail ("stack empty", start_PC);
1220 return r;
1223 type pop32 ()
1225 type r = pop_raw ();
1226 if (r.iswide ())
1227 verify_fail ("narrow pop of wide type");
1228 return r;
1231 type pop_type (type match)
1233 match.promote ();
1234 type t = pop_raw ();
1235 if (! match.compatible (t, this))
1236 verify_fail ("incompatible type on stack");
1237 return t;
1240 // Pop a reference which is guaranteed to be initialized. MATCH
1241 // doesn't have to be a reference type; in this case this acts like
1242 // pop_type.
1243 type pop_init_ref (type match)
1245 type t = pop_raw ();
1246 if (t.isreference () && ! t.isinitialized ())
1247 verify_fail ("initialized reference required");
1248 else if (! match.compatible (t, this))
1249 verify_fail ("incompatible type on stack");
1250 return t;
1253 // Pop a reference type or a return address.
1254 type pop_ref_or_return ()
1256 type t = pop_raw ();
1257 if (! t.isreference () && t.key != return_address_type)
1258 verify_fail ("expected reference or return address on stack");
1259 return t;
1262 void push_type (type t)
1264 // If T is a numeric type like short, promote it to int.
1265 t.promote ();
1267 int depth = t.depth ();
1268 if (current_state->stackdepth + depth > current_method->max_stack)
1269 verify_fail ("stack overflow");
1270 current_state->stack[current_state->stacktop++] = t;
1271 current_state->stackdepth += depth;
1274 void set_variable (int index, type t)
1276 // If T is a numeric type like short, promote it to int.
1277 t.promote ();
1279 int depth = t.depth ();
1280 if (index > current_method->max_locals - depth)
1281 verify_fail ("invalid local variable");
1282 current_state->locals[index] = t;
1284 if (depth == 2)
1285 current_state->locals[index + 1] = continuation_type;
1286 if (index > 0 && current_state->locals[index - 1].iswide ())
1287 current_state->locals[index - 1] = unsuitable_type;
1290 type get_variable (int index, type t)
1292 int depth = t.depth ();
1293 if (index > current_method->max_locals - depth)
1294 verify_fail ("invalid local variable");
1295 if (! t.compatible (current_state->locals[index], this))
1296 verify_fail ("incompatible type in local variable");
1297 if (depth == 2)
1299 type t (continuation_type);
1300 if (! current_state->locals[index + 1].compatible (t, this))
1301 verify_fail ("invalid local variable");
1303 return current_state->locals[index];
1306 // Make sure ARRAY is an array type and that its elements are
1307 // compatible with type ELEMENT. Returns the actual element type.
1308 type require_array_type (type array, type element)
1310 // An odd case. Here we just pretend that everything went ok. If
1311 // the requested element type is some kind of reference, return
1312 // the null type instead.
1313 if (array.isnull ())
1314 return element.isreference () ? type (null_type) : element;
1316 if (! array.isarray ())
1317 verify_fail ("array required");
1319 type t = array.element_type (this);
1320 if (! element.compatible (t, this))
1322 // Special case for byte arrays, which must also be boolean
1323 // arrays.
1324 bool ok = true;
1325 if (element.key == byte_type)
1327 type e2 (boolean_type);
1328 ok = e2.compatible (t, this);
1330 if (! ok)
1331 verify_fail ("incompatible array element type");
1334 // Return T and not ELEMENT, because T might be specialized.
1335 return t;
1338 jint get_byte ()
1340 if (PC >= current_method->code_length)
1341 verify_fail ("premature end of bytecode");
1342 return (jint) bytecode[PC++] & 0xff;
1345 jint get_ushort ()
1347 jint b1 = get_byte ();
1348 jint b2 = get_byte ();
1349 return (jint) ((b1 << 8) | b2) & 0xffff;
1352 jint get_short ()
1354 jint b1 = get_byte ();
1355 jint b2 = get_byte ();
1356 jshort s = (b1 << 8) | b2;
1357 return (jint) s;
1360 jint get_int ()
1362 jint b1 = get_byte ();
1363 jint b2 = get_byte ();
1364 jint b3 = get_byte ();
1365 jint b4 = get_byte ();
1366 return (b1 << 24) | (b2 << 16) | (b3 << 8) | b4;
1369 int compute_jump (int offset)
1371 int npc = start_PC + offset;
1372 if (npc < 0 || npc >= current_method->code_length)
1373 verify_fail ("branch out of range", start_PC);
1374 return npc;
1377 // Add a new state to the state list at NPC.
1378 state *add_new_state (int npc, state *old_state)
1380 state *new_state = new state (old_state, current_method->max_stack,
1381 current_method->max_locals);
1382 debug_print ("== New state in add_new_state\n");
1383 new_state->print ("New", npc, current_method->max_stack,
1384 current_method->max_locals);
1385 linked<state> *nlink
1386 = (linked<state> *) _Jv_Malloc (sizeof (linked<state>));
1387 nlink->val = new_state;
1388 nlink->next = states[npc];
1389 states[npc] = nlink;
1390 new_state->set_pc (npc);
1391 return new_state;
1394 // Merge the indicated state into the state at the branch target and
1395 // schedule a new PC if there is a change. NPC is the PC of the
1396 // branch target, and FROM_STATE is the state at the source of the
1397 // branch. This method returns true if the destination state
1398 // changed and requires reverification, false otherwise.
1399 void merge_into (int npc, state *from_state)
1401 // Iterate over all target states and merge our state into each,
1402 // if applicable. FIXME one improvement we could make here is
1403 // "state destruction". Merging a new state into an existing one
1404 // might cause a return_address_type to be merged to
1405 // unsuitable_type. In this case the resulting state may now be
1406 // mergeable with other states currently held in parallel at this
1407 // location. So in this situation we could pairwise compare and
1408 // reduce the number of parallel states.
1409 bool applicable = false;
1410 for (linked<state> *iter = states[npc]; iter != NULL; iter = iter->next)
1412 state *new_state = iter->val;
1413 if (new_state->state_mergeable_p (from_state,
1414 current_method->max_locals, this))
1416 applicable = true;
1418 debug_print ("== Merge states in merge_into\n");
1419 from_state->print ("Frm", start_PC, current_method->max_stack,
1420 current_method->max_locals);
1421 new_state->print (" To", npc, current_method->max_stack,
1422 current_method->max_locals);
1423 bool changed = new_state->merge (from_state,
1424 current_method->max_locals,
1425 this);
1426 new_state->print ("New", npc, current_method->max_stack,
1427 current_method->max_locals);
1429 if (changed)
1430 new_state->reverify (this);
1434 if (! applicable)
1436 // Either we don't yet have a state at NPC, or we have a
1437 // return-address type that is in conflict with all existing
1438 // state. So, we need to create a new entry.
1439 state *new_state = add_new_state (npc, from_state);
1440 // A new state added in this way must always be reverified.
1441 new_state->reverify (this);
1445 void push_jump (int offset)
1447 int npc = compute_jump (offset);
1448 // According to the JVM Spec, we need to check for uninitialized
1449 // objects here. However, this does not actually affect type
1450 // safety, and the Eclipse java compiler generates code that
1451 // violates this constraint.
1452 merge_into (npc, current_state);
1455 void push_exception_jump (type t, int pc)
1457 // According to the JVM Spec, we need to check for uninitialized
1458 // objects here. However, this does not actually affect type
1459 // safety, and the Eclipse java compiler generates code that
1460 // violates this constraint.
1461 state s (current_state, current_method->max_stack,
1462 current_method->max_locals);
1463 if (current_method->max_stack < 1)
1464 verify_fail ("stack overflow at exception handler");
1465 s.set_exception (t, current_method->max_stack);
1466 merge_into (pc, &s);
1469 state *pop_jump ()
1471 state *new_state = next_verify_state;
1472 if (new_state == INVALID_STATE)
1473 verify_fail ("programmer error in pop_jump");
1474 if (new_state != NULL)
1476 next_verify_state = new_state->next;
1477 new_state->next = INVALID_STATE;
1479 return new_state;
1482 void invalidate_pc ()
1484 PC = state::NO_NEXT;
1487 void note_branch_target (int pc)
1489 // Don't check `pc <= PC', because we've advanced PC after
1490 // fetching the target and we haven't yet checked the next
1491 // instruction.
1492 if (pc < PC && ! (flags[pc] & FLAG_INSN_START))
1493 verify_fail ("branch not to instruction start", start_PC);
1494 flags[pc] |= FLAG_BRANCH_TARGET;
1497 void skip_padding ()
1499 while ((PC % 4) > 0)
1500 if (get_byte () != 0)
1501 verify_fail ("found nonzero padding byte");
1504 // Do the work for a `ret' instruction. INDEX is the index into the
1505 // local variables.
1506 void handle_ret_insn (int index)
1508 type ret_addr = get_variable (index, return_address_type);
1509 // It would be nice if we could do this. However, the JVM Spec
1510 // doesn't say that this is what happens. It is implied that
1511 // reusing a return address is invalid, but there's no actual
1512 // prohibition against it.
1513 // set_variable (index, unsuitable_type);
1515 int npc = ret_addr.get_pc ();
1516 // We might be returning to a `jsr' that is at the end of the
1517 // bytecode. This is ok if we never return from the called
1518 // subroutine, but if we see this here it is an error.
1519 if (npc >= current_method->code_length)
1520 verify_fail ("fell off end");
1522 // According to the JVM Spec, we need to check for uninitialized
1523 // objects here. However, this does not actually affect type
1524 // safety, and the Eclipse java compiler generates code that
1525 // violates this constraint.
1526 merge_into (npc, current_state);
1527 invalidate_pc ();
1530 void handle_jsr_insn (int offset)
1532 int npc = compute_jump (offset);
1534 // According to the JVM Spec, we need to check for uninitialized
1535 // objects here. However, this does not actually affect type
1536 // safety, and the Eclipse java compiler generates code that
1537 // violates this constraint.
1539 // Modify our state as appropriate for entry into a subroutine.
1540 type ret_addr (return_address_type);
1541 ret_addr.set_return_address (PC);
1542 push_type (ret_addr);
1543 merge_into (npc, current_state);
1544 invalidate_pc ();
1547 jclass construct_primitive_array_type (type_val prim)
1549 jclass k = NULL;
1550 switch (prim)
1552 case boolean_type:
1553 k = JvPrimClass (boolean);
1554 break;
1555 case char_type:
1556 k = JvPrimClass (char);
1557 break;
1558 case float_type:
1559 k = JvPrimClass (float);
1560 break;
1561 case double_type:
1562 k = JvPrimClass (double);
1563 break;
1564 case byte_type:
1565 k = JvPrimClass (byte);
1566 break;
1567 case short_type:
1568 k = JvPrimClass (short);
1569 break;
1570 case int_type:
1571 k = JvPrimClass (int);
1572 break;
1573 case long_type:
1574 k = JvPrimClass (long);
1575 break;
1577 // These aren't used here but we call them out to avoid
1578 // warnings.
1579 case void_type:
1580 case unsuitable_type:
1581 case return_address_type:
1582 case continuation_type:
1583 case reference_type:
1584 case null_type:
1585 case uninitialized_reference_type:
1586 default:
1587 verify_fail ("unknown type in construct_primitive_array_type");
1589 k = _Jv_GetArrayClass (k, NULL);
1590 return k;
1593 // This pass computes the location of branch targets and also
1594 // instruction starts.
1595 void branch_prepass ()
1597 flags = (char *) _Jv_Malloc (current_method->code_length);
1599 for (int i = 0; i < current_method->code_length; ++i)
1600 flags[i] = 0;
1602 PC = 0;
1603 while (PC < current_method->code_length)
1605 // Set `start_PC' early so that error checking can have the
1606 // correct value.
1607 start_PC = PC;
1608 flags[PC] |= FLAG_INSN_START;
1610 java_opcode opcode = (java_opcode) bytecode[PC++];
1611 switch (opcode)
1613 case op_nop:
1614 case op_aconst_null:
1615 case op_iconst_m1:
1616 case op_iconst_0:
1617 case op_iconst_1:
1618 case op_iconst_2:
1619 case op_iconst_3:
1620 case op_iconst_4:
1621 case op_iconst_5:
1622 case op_lconst_0:
1623 case op_lconst_1:
1624 case op_fconst_0:
1625 case op_fconst_1:
1626 case op_fconst_2:
1627 case op_dconst_0:
1628 case op_dconst_1:
1629 case op_iload_0:
1630 case op_iload_1:
1631 case op_iload_2:
1632 case op_iload_3:
1633 case op_lload_0:
1634 case op_lload_1:
1635 case op_lload_2:
1636 case op_lload_3:
1637 case op_fload_0:
1638 case op_fload_1:
1639 case op_fload_2:
1640 case op_fload_3:
1641 case op_dload_0:
1642 case op_dload_1:
1643 case op_dload_2:
1644 case op_dload_3:
1645 case op_aload_0:
1646 case op_aload_1:
1647 case op_aload_2:
1648 case op_aload_3:
1649 case op_iaload:
1650 case op_laload:
1651 case op_faload:
1652 case op_daload:
1653 case op_aaload:
1654 case op_baload:
1655 case op_caload:
1656 case op_saload:
1657 case op_istore_0:
1658 case op_istore_1:
1659 case op_istore_2:
1660 case op_istore_3:
1661 case op_lstore_0:
1662 case op_lstore_1:
1663 case op_lstore_2:
1664 case op_lstore_3:
1665 case op_fstore_0:
1666 case op_fstore_1:
1667 case op_fstore_2:
1668 case op_fstore_3:
1669 case op_dstore_0:
1670 case op_dstore_1:
1671 case op_dstore_2:
1672 case op_dstore_3:
1673 case op_astore_0:
1674 case op_astore_1:
1675 case op_astore_2:
1676 case op_astore_3:
1677 case op_iastore:
1678 case op_lastore:
1679 case op_fastore:
1680 case op_dastore:
1681 case op_aastore:
1682 case op_bastore:
1683 case op_castore:
1684 case op_sastore:
1685 case op_pop:
1686 case op_pop2:
1687 case op_dup:
1688 case op_dup_x1:
1689 case op_dup_x2:
1690 case op_dup2:
1691 case op_dup2_x1:
1692 case op_dup2_x2:
1693 case op_swap:
1694 case op_iadd:
1695 case op_isub:
1696 case op_imul:
1697 case op_idiv:
1698 case op_irem:
1699 case op_ishl:
1700 case op_ishr:
1701 case op_iushr:
1702 case op_iand:
1703 case op_ior:
1704 case op_ixor:
1705 case op_ladd:
1706 case op_lsub:
1707 case op_lmul:
1708 case op_ldiv:
1709 case op_lrem:
1710 case op_lshl:
1711 case op_lshr:
1712 case op_lushr:
1713 case op_land:
1714 case op_lor:
1715 case op_lxor:
1716 case op_fadd:
1717 case op_fsub:
1718 case op_fmul:
1719 case op_fdiv:
1720 case op_frem:
1721 case op_dadd:
1722 case op_dsub:
1723 case op_dmul:
1724 case op_ddiv:
1725 case op_drem:
1726 case op_ineg:
1727 case op_i2b:
1728 case op_i2c:
1729 case op_i2s:
1730 case op_lneg:
1731 case op_fneg:
1732 case op_dneg:
1733 case op_i2l:
1734 case op_i2f:
1735 case op_i2d:
1736 case op_l2i:
1737 case op_l2f:
1738 case op_l2d:
1739 case op_f2i:
1740 case op_f2l:
1741 case op_f2d:
1742 case op_d2i:
1743 case op_d2l:
1744 case op_d2f:
1745 case op_lcmp:
1746 case op_fcmpl:
1747 case op_fcmpg:
1748 case op_dcmpl:
1749 case op_dcmpg:
1750 case op_monitorenter:
1751 case op_monitorexit:
1752 case op_ireturn:
1753 case op_lreturn:
1754 case op_freturn:
1755 case op_dreturn:
1756 case op_areturn:
1757 case op_return:
1758 case op_athrow:
1759 case op_arraylength:
1760 break;
1762 case op_bipush:
1763 case op_ldc:
1764 case op_iload:
1765 case op_lload:
1766 case op_fload:
1767 case op_dload:
1768 case op_aload:
1769 case op_istore:
1770 case op_lstore:
1771 case op_fstore:
1772 case op_dstore:
1773 case op_astore:
1774 case op_ret:
1775 case op_newarray:
1776 get_byte ();
1777 break;
1779 case op_iinc:
1780 case op_sipush:
1781 case op_ldc_w:
1782 case op_ldc2_w:
1783 case op_getstatic:
1784 case op_getfield:
1785 case op_putfield:
1786 case op_putstatic:
1787 case op_new:
1788 case op_anewarray:
1789 case op_instanceof:
1790 case op_checkcast:
1791 case op_invokespecial:
1792 case op_invokestatic:
1793 case op_invokevirtual:
1794 get_short ();
1795 break;
1797 case op_multianewarray:
1798 get_short ();
1799 get_byte ();
1800 break;
1802 case op_jsr:
1803 case op_ifeq:
1804 case op_ifne:
1805 case op_iflt:
1806 case op_ifge:
1807 case op_ifgt:
1808 case op_ifle:
1809 case op_if_icmpeq:
1810 case op_if_icmpne:
1811 case op_if_icmplt:
1812 case op_if_icmpge:
1813 case op_if_icmpgt:
1814 case op_if_icmple:
1815 case op_if_acmpeq:
1816 case op_if_acmpne:
1817 case op_ifnull:
1818 case op_ifnonnull:
1819 case op_goto:
1820 note_branch_target (compute_jump (get_short ()));
1821 break;
1823 case op_tableswitch:
1825 skip_padding ();
1826 note_branch_target (compute_jump (get_int ()));
1827 jint low = get_int ();
1828 jint hi = get_int ();
1829 if (low > hi)
1830 verify_fail ("invalid tableswitch", start_PC);
1831 for (int i = low; i <= hi; ++i)
1832 note_branch_target (compute_jump (get_int ()));
1834 break;
1836 case op_lookupswitch:
1838 skip_padding ();
1839 note_branch_target (compute_jump (get_int ()));
1840 int npairs = get_int ();
1841 if (npairs < 0)
1842 verify_fail ("too few pairs in lookupswitch", start_PC);
1843 while (npairs-- > 0)
1845 get_int ();
1846 note_branch_target (compute_jump (get_int ()));
1849 break;
1851 case op_invokeinterface:
1852 get_short ();
1853 get_byte ();
1854 get_byte ();
1855 break;
1857 case op_wide:
1859 opcode = (java_opcode) get_byte ();
1860 get_short ();
1861 if (opcode == op_iinc)
1862 get_short ();
1864 break;
1866 case op_jsr_w:
1867 case op_goto_w:
1868 note_branch_target (compute_jump (get_int ()));
1869 break;
1871 // These are unused here, but we call them out explicitly
1872 // so that -Wswitch-enum doesn't complain.
1873 case op_putfield_1:
1874 case op_putfield_2:
1875 case op_putfield_4:
1876 case op_putfield_8:
1877 case op_putfield_a:
1878 case op_putstatic_1:
1879 case op_putstatic_2:
1880 case op_putstatic_4:
1881 case op_putstatic_8:
1882 case op_putstatic_a:
1883 case op_getfield_1:
1884 case op_getfield_2s:
1885 case op_getfield_2u:
1886 case op_getfield_4:
1887 case op_getfield_8:
1888 case op_getfield_a:
1889 case op_getstatic_1:
1890 case op_getstatic_2s:
1891 case op_getstatic_2u:
1892 case op_getstatic_4:
1893 case op_getstatic_8:
1894 case op_getstatic_a:
1895 default:
1896 verify_fail ("unrecognized instruction in branch_prepass",
1897 start_PC);
1900 // See if any previous branch tried to branch to the middle of
1901 // this instruction.
1902 for (int pc = start_PC + 1; pc < PC; ++pc)
1904 if ((flags[pc] & FLAG_BRANCH_TARGET))
1905 verify_fail ("branch to middle of instruction", pc);
1909 // Verify exception handlers.
1910 for (int i = 0; i < current_method->exc_count; ++i)
1912 if (! (flags[exception[i].handler_pc.i] & FLAG_INSN_START))
1913 verify_fail ("exception handler not at instruction start",
1914 exception[i].handler_pc.i);
1915 if (! (flags[exception[i].start_pc.i] & FLAG_INSN_START))
1916 verify_fail ("exception start not at instruction start",
1917 exception[i].start_pc.i);
1918 if (exception[i].end_pc.i != current_method->code_length
1919 && ! (flags[exception[i].end_pc.i] & FLAG_INSN_START))
1920 verify_fail ("exception end not at instruction start",
1921 exception[i].end_pc.i);
1923 flags[exception[i].handler_pc.i] |= FLAG_BRANCH_TARGET;
1927 void check_pool_index (int index)
1929 if (index < 0 || index >= current_class->constants.size)
1930 verify_fail ("constant pool index out of range", start_PC);
1933 type check_class_constant (int index)
1935 check_pool_index (index);
1936 _Jv_Constants *pool = &current_class->constants;
1937 if (pool->tags[index] == JV_CONSTANT_ResolvedClass)
1938 return type (pool->data[index].clazz, this);
1939 else if (pool->tags[index] == JV_CONSTANT_Class)
1940 return type (pool->data[index].utf8, this);
1941 verify_fail ("expected class constant", start_PC);
1944 type check_constant (int index)
1946 check_pool_index (index);
1947 _Jv_Constants *pool = &current_class->constants;
1948 if (pool->tags[index] == JV_CONSTANT_ResolvedString
1949 || pool->tags[index] == JV_CONSTANT_String)
1950 return type (&java::lang::String::class$, this);
1951 else if (pool->tags[index] == JV_CONSTANT_Integer)
1952 return type (int_type);
1953 else if (pool->tags[index] == JV_CONSTANT_Float)
1954 return type (float_type);
1955 verify_fail ("String, int, or float constant expected", start_PC);
1958 type check_wide_constant (int index)
1960 check_pool_index (index);
1961 _Jv_Constants *pool = &current_class->constants;
1962 if (pool->tags[index] == JV_CONSTANT_Long)
1963 return type (long_type);
1964 else if (pool->tags[index] == JV_CONSTANT_Double)
1965 return type (double_type);
1966 verify_fail ("long or double constant expected", start_PC);
1969 // Helper for both field and method. These are laid out the same in
1970 // the constant pool.
1971 type handle_field_or_method (int index, int expected,
1972 _Jv_Utf8Const **name,
1973 _Jv_Utf8Const **fmtype)
1975 check_pool_index (index);
1976 _Jv_Constants *pool = &current_class->constants;
1977 if (pool->tags[index] != expected)
1978 verify_fail ("didn't see expected constant", start_PC);
1979 // Once we know we have a Fieldref or Methodref we assume that it
1980 // is correctly laid out in the constant pool. I think the code
1981 // in defineclass.cc guarantees this.
1982 _Jv_ushort class_index, name_and_type_index;
1983 _Jv_loadIndexes (&pool->data[index],
1984 class_index,
1985 name_and_type_index);
1986 _Jv_ushort name_index, desc_index;
1987 _Jv_loadIndexes (&pool->data[name_and_type_index],
1988 name_index, desc_index);
1990 *name = pool->data[name_index].utf8;
1991 *fmtype = pool->data[desc_index].utf8;
1993 return check_class_constant (class_index);
1996 // Return field's type, compute class' type if requested.
1997 // If PUTFIELD is true, use the special 'putfield' semantics.
1998 type check_field_constant (int index, type *class_type = NULL,
1999 bool putfield = false)
2001 _Jv_Utf8Const *name, *field_type;
2002 type ct = handle_field_or_method (index,
2003 JV_CONSTANT_Fieldref,
2004 &name, &field_type);
2005 if (class_type)
2006 *class_type = ct;
2007 type result;
2008 if (field_type->first() == '[' || field_type->first() == 'L')
2009 result = type (field_type, this);
2010 else
2011 result = get_type_val_for_signature (field_type->first());
2013 // We have an obscure special case here: we can use `putfield' on
2014 // a field declared in this class, even if `this' has not yet been
2015 // initialized.
2016 if (putfield
2017 && ! current_state->this_type.isinitialized ()
2018 && current_state->this_type.pc == type::SELF
2019 && current_state->this_type.equals (ct, this)
2020 // We don't look at the signature, figuring that if it is
2021 // wrong we will fail during linking. FIXME?
2022 && _Jv_Linker::has_field_p (current_class, name))
2023 // Note that we don't actually know whether we're going to match
2024 // against 'this' or some other object of the same type. So,
2025 // here we set things up so that it doesn't matter. This relies
2026 // on knowing what our caller is up to.
2027 class_type->set_uninitialized (type::EITHER, this);
2029 return result;
2032 type check_method_constant (int index, bool is_interface,
2033 _Jv_Utf8Const **method_name,
2034 _Jv_Utf8Const **method_signature)
2036 return handle_field_or_method (index,
2037 (is_interface
2038 ? JV_CONSTANT_InterfaceMethodref
2039 : JV_CONSTANT_Methodref),
2040 method_name, method_signature);
2043 type get_one_type (char *&p)
2045 char *start = p;
2047 int arraycount = 0;
2048 while (*p == '[')
2050 ++arraycount;
2051 ++p;
2054 char v = *p++;
2056 if (v == 'L')
2058 while (*p != ';')
2059 ++p;
2060 ++p;
2061 _Jv_Utf8Const *name = make_utf8_const (start, p - start);
2062 return type (name, this);
2065 // Casting to jchar here is ok since we are looking at an ASCII
2066 // character.
2067 type_val rt = get_type_val_for_signature (jchar (v));
2069 if (arraycount == 0)
2071 // Callers of this function eventually push their arguments on
2072 // the stack. So, promote them here.
2073 return type (rt).promote ();
2076 jclass k = construct_primitive_array_type (rt);
2077 while (--arraycount > 0)
2078 k = _Jv_GetArrayClass (k, NULL);
2079 return type (k, this);
2082 void compute_argument_types (_Jv_Utf8Const *signature,
2083 type *types)
2085 char *p = signature->chars();
2087 // Skip `('.
2088 ++p;
2090 int i = 0;
2091 while (*p != ')')
2092 types[i++] = get_one_type (p);
2095 type compute_return_type (_Jv_Utf8Const *signature)
2097 char *p = signature->chars();
2098 while (*p != ')')
2099 ++p;
2100 ++p;
2101 return get_one_type (p);
2104 void check_return_type (type onstack)
2106 type rt = compute_return_type (current_method->self->signature);
2107 if (! rt.compatible (onstack, this))
2108 verify_fail ("incompatible return type");
2111 // Initialize the stack for the new method. Returns true if this
2112 // method is an instance initializer.
2113 bool initialize_stack ()
2115 int var = 0;
2116 bool is_init = _Jv_equalUtf8Consts (current_method->self->name,
2117 gcj::init_name);
2118 bool is_clinit = _Jv_equalUtf8Consts (current_method->self->name,
2119 gcj::clinit_name);
2121 using namespace java::lang::reflect;
2122 if (! Modifier::isStatic (current_method->self->accflags))
2124 type kurr (current_class, this);
2125 if (is_init)
2127 kurr.set_uninitialized (type::SELF, this);
2128 is_init = true;
2130 else if (is_clinit)
2131 verify_fail ("<clinit> method must be static");
2132 set_variable (0, kurr);
2133 current_state->set_this_type (kurr);
2134 ++var;
2136 else
2138 if (is_init)
2139 verify_fail ("<init> method must be non-static");
2142 // We have to handle wide arguments specially here.
2143 int arg_count = _Jv_count_arguments (current_method->self->signature);
2144 type arg_types[arg_count];
2145 compute_argument_types (current_method->self->signature, arg_types);
2146 for (int i = 0; i < arg_count; ++i)
2148 set_variable (var, arg_types[i]);
2149 ++var;
2150 if (arg_types[i].iswide ())
2151 ++var;
2154 return is_init;
2157 void verify_instructions_0 ()
2159 current_state = new state (current_method->max_stack,
2160 current_method->max_locals);
2162 PC = 0;
2163 start_PC = 0;
2165 // True if we are verifying an instance initializer.
2166 bool this_is_init = initialize_stack ();
2168 states = (linked<state> **) _Jv_Malloc (sizeof (linked<state> *)
2169 * current_method->code_length);
2170 for (int i = 0; i < current_method->code_length; ++i)
2171 states[i] = NULL;
2173 next_verify_state = NULL;
2175 while (true)
2177 // If the PC was invalidated, get a new one from the work list.
2178 if (PC == state::NO_NEXT)
2180 state *new_state = pop_jump ();
2181 // If it is null, we're done.
2182 if (new_state == NULL)
2183 break;
2185 PC = new_state->get_pc ();
2186 debug_print ("== State pop from pending list\n");
2187 // Set up the current state.
2188 current_state->copy (new_state, current_method->max_stack,
2189 current_method->max_locals);
2191 else
2193 // We only have to do this checking in the situation where
2194 // control flow falls through from the previous
2195 // instruction. Otherwise merging is done at the time we
2196 // push the branch.
2197 if (states[PC] != NULL)
2199 // We've already visited this instruction. So merge
2200 // the states together. It is simplest, but not most
2201 // efficient, to just always invalidate the PC here.
2202 merge_into (PC, current_state);
2203 invalidate_pc ();
2204 continue;
2208 // Control can't fall off the end of the bytecode. We need to
2209 // check this in both cases, not just the fall-through case,
2210 // because we don't check to see whether a `jsr' appears at
2211 // the end of the bytecode until we process a `ret'.
2212 if (PC >= current_method->code_length)
2213 verify_fail ("fell off end");
2215 // We only have to keep saved state at branch targets. If
2216 // we're at a branch target and the state here hasn't been set
2217 // yet, we set it now. You might notice that `ret' targets
2218 // won't necessarily have FLAG_BRANCH_TARGET set. This
2219 // doesn't matter, since those states will be filled in by
2220 // merge_into.
2221 if (states[PC] == NULL && (flags[PC] & FLAG_BRANCH_TARGET))
2222 add_new_state (PC, current_state);
2224 // Set this before handling exceptions so that debug output is
2225 // sane.
2226 start_PC = PC;
2228 // Update states for all active exception handlers. Ordinarily
2229 // there are not many exception handlers. So we simply run
2230 // through them all.
2231 for (int i = 0; i < current_method->exc_count; ++i)
2233 if (PC >= exception[i].start_pc.i && PC < exception[i].end_pc.i)
2235 type handler (&java::lang::Throwable::class$, this);
2236 if (exception[i].handler_type.i != 0)
2237 handler = check_class_constant (exception[i].handler_type.i);
2238 push_exception_jump (handler, exception[i].handler_pc.i);
2242 current_state->print (" ", PC, current_method->max_stack,
2243 current_method->max_locals);
2244 java_opcode opcode = (java_opcode) bytecode[PC++];
2245 switch (opcode)
2247 case op_nop:
2248 break;
2250 case op_aconst_null:
2251 push_type (null_type);
2252 break;
2254 case op_iconst_m1:
2255 case op_iconst_0:
2256 case op_iconst_1:
2257 case op_iconst_2:
2258 case op_iconst_3:
2259 case op_iconst_4:
2260 case op_iconst_5:
2261 push_type (int_type);
2262 break;
2264 case op_lconst_0:
2265 case op_lconst_1:
2266 push_type (long_type);
2267 break;
2269 case op_fconst_0:
2270 case op_fconst_1:
2271 case op_fconst_2:
2272 push_type (float_type);
2273 break;
2275 case op_dconst_0:
2276 case op_dconst_1:
2277 push_type (double_type);
2278 break;
2280 case op_bipush:
2281 get_byte ();
2282 push_type (int_type);
2283 break;
2285 case op_sipush:
2286 get_short ();
2287 push_type (int_type);
2288 break;
2290 case op_ldc:
2291 push_type (check_constant (get_byte ()));
2292 break;
2293 case op_ldc_w:
2294 push_type (check_constant (get_ushort ()));
2295 break;
2296 case op_ldc2_w:
2297 push_type (check_wide_constant (get_ushort ()));
2298 break;
2300 case op_iload:
2301 push_type (get_variable (get_byte (), int_type));
2302 break;
2303 case op_lload:
2304 push_type (get_variable (get_byte (), long_type));
2305 break;
2306 case op_fload:
2307 push_type (get_variable (get_byte (), float_type));
2308 break;
2309 case op_dload:
2310 push_type (get_variable (get_byte (), double_type));
2311 break;
2312 case op_aload:
2313 push_type (get_variable (get_byte (), reference_type));
2314 break;
2316 case op_iload_0:
2317 case op_iload_1:
2318 case op_iload_2:
2319 case op_iload_3:
2320 push_type (get_variable (opcode - op_iload_0, int_type));
2321 break;
2322 case op_lload_0:
2323 case op_lload_1:
2324 case op_lload_2:
2325 case op_lload_3:
2326 push_type (get_variable (opcode - op_lload_0, long_type));
2327 break;
2328 case op_fload_0:
2329 case op_fload_1:
2330 case op_fload_2:
2331 case op_fload_3:
2332 push_type (get_variable (opcode - op_fload_0, float_type));
2333 break;
2334 case op_dload_0:
2335 case op_dload_1:
2336 case op_dload_2:
2337 case op_dload_3:
2338 push_type (get_variable (opcode - op_dload_0, double_type));
2339 break;
2340 case op_aload_0:
2341 case op_aload_1:
2342 case op_aload_2:
2343 case op_aload_3:
2344 push_type (get_variable (opcode - op_aload_0, reference_type));
2345 break;
2346 case op_iaload:
2347 pop_type (int_type);
2348 push_type (require_array_type (pop_init_ref (reference_type),
2349 int_type));
2350 break;
2351 case op_laload:
2352 pop_type (int_type);
2353 push_type (require_array_type (pop_init_ref (reference_type),
2354 long_type));
2355 break;
2356 case op_faload:
2357 pop_type (int_type);
2358 push_type (require_array_type (pop_init_ref (reference_type),
2359 float_type));
2360 break;
2361 case op_daload:
2362 pop_type (int_type);
2363 push_type (require_array_type (pop_init_ref (reference_type),
2364 double_type));
2365 break;
2366 case op_aaload:
2367 pop_type (int_type);
2368 push_type (require_array_type (pop_init_ref (reference_type),
2369 reference_type));
2370 break;
2371 case op_baload:
2372 pop_type (int_type);
2373 require_array_type (pop_init_ref (reference_type), byte_type);
2374 push_type (int_type);
2375 break;
2376 case op_caload:
2377 pop_type (int_type);
2378 require_array_type (pop_init_ref (reference_type), char_type);
2379 push_type (int_type);
2380 break;
2381 case op_saload:
2382 pop_type (int_type);
2383 require_array_type (pop_init_ref (reference_type), short_type);
2384 push_type (int_type);
2385 break;
2386 case op_istore:
2387 set_variable (get_byte (), pop_type (int_type));
2388 break;
2389 case op_lstore:
2390 set_variable (get_byte (), pop_type (long_type));
2391 break;
2392 case op_fstore:
2393 set_variable (get_byte (), pop_type (float_type));
2394 break;
2395 case op_dstore:
2396 set_variable (get_byte (), pop_type (double_type));
2397 break;
2398 case op_astore:
2399 set_variable (get_byte (), pop_ref_or_return ());
2400 break;
2401 case op_istore_0:
2402 case op_istore_1:
2403 case op_istore_2:
2404 case op_istore_3:
2405 set_variable (opcode - op_istore_0, pop_type (int_type));
2406 break;
2407 case op_lstore_0:
2408 case op_lstore_1:
2409 case op_lstore_2:
2410 case op_lstore_3:
2411 set_variable (opcode - op_lstore_0, pop_type (long_type));
2412 break;
2413 case op_fstore_0:
2414 case op_fstore_1:
2415 case op_fstore_2:
2416 case op_fstore_3:
2417 set_variable (opcode - op_fstore_0, pop_type (float_type));
2418 break;
2419 case op_dstore_0:
2420 case op_dstore_1:
2421 case op_dstore_2:
2422 case op_dstore_3:
2423 set_variable (opcode - op_dstore_0, pop_type (double_type));
2424 break;
2425 case op_astore_0:
2426 case op_astore_1:
2427 case op_astore_2:
2428 case op_astore_3:
2429 set_variable (opcode - op_astore_0, pop_ref_or_return ());
2430 break;
2431 case op_iastore:
2432 pop_type (int_type);
2433 pop_type (int_type);
2434 require_array_type (pop_init_ref (reference_type), int_type);
2435 break;
2436 case op_lastore:
2437 pop_type (long_type);
2438 pop_type (int_type);
2439 require_array_type (pop_init_ref (reference_type), long_type);
2440 break;
2441 case op_fastore:
2442 pop_type (float_type);
2443 pop_type (int_type);
2444 require_array_type (pop_init_ref (reference_type), float_type);
2445 break;
2446 case op_dastore:
2447 pop_type (double_type);
2448 pop_type (int_type);
2449 require_array_type (pop_init_ref (reference_type), double_type);
2450 break;
2451 case op_aastore:
2452 pop_type (reference_type);
2453 pop_type (int_type);
2454 require_array_type (pop_init_ref (reference_type), reference_type);
2455 break;
2456 case op_bastore:
2457 pop_type (int_type);
2458 pop_type (int_type);
2459 require_array_type (pop_init_ref (reference_type), byte_type);
2460 break;
2461 case op_castore:
2462 pop_type (int_type);
2463 pop_type (int_type);
2464 require_array_type (pop_init_ref (reference_type), char_type);
2465 break;
2466 case op_sastore:
2467 pop_type (int_type);
2468 pop_type (int_type);
2469 require_array_type (pop_init_ref (reference_type), short_type);
2470 break;
2471 case op_pop:
2472 pop32 ();
2473 break;
2474 case op_pop2:
2476 type t = pop_raw ();
2477 if (! t.iswide ())
2478 pop32 ();
2480 break;
2481 case op_dup:
2483 type t = pop32 ();
2484 push_type (t);
2485 push_type (t);
2487 break;
2488 case op_dup_x1:
2490 type t1 = pop32 ();
2491 type t2 = pop32 ();
2492 push_type (t1);
2493 push_type (t2);
2494 push_type (t1);
2496 break;
2497 case op_dup_x2:
2499 type t1 = pop32 ();
2500 type t2 = pop_raw ();
2501 if (! t2.iswide ())
2503 type t3 = pop32 ();
2504 push_type (t1);
2505 push_type (t3);
2507 else
2508 push_type (t1);
2509 push_type (t2);
2510 push_type (t1);
2512 break;
2513 case op_dup2:
2515 type t = pop_raw ();
2516 if (! t.iswide ())
2518 type t2 = pop32 ();
2519 push_type (t2);
2520 push_type (t);
2521 push_type (t2);
2523 else
2524 push_type (t);
2525 push_type (t);
2527 break;
2528 case op_dup2_x1:
2530 type t1 = pop_raw ();
2531 type t2 = pop32 ();
2532 if (! t1.iswide ())
2534 type t3 = pop32 ();
2535 push_type (t2);
2536 push_type (t1);
2537 push_type (t3);
2539 else
2540 push_type (t1);
2541 push_type (t2);
2542 push_type (t1);
2544 break;
2545 case op_dup2_x2:
2547 type t1 = pop_raw ();
2548 if (t1.iswide ())
2550 type t2 = pop_raw ();
2551 if (t2.iswide ())
2553 push_type (t1);
2554 push_type (t2);
2556 else
2558 type t3 = pop32 ();
2559 push_type (t1);
2560 push_type (t3);
2561 push_type (t2);
2563 push_type (t1);
2565 else
2567 type t2 = pop32 ();
2568 type t3 = pop_raw ();
2569 if (t3.iswide ())
2571 push_type (t2);
2572 push_type (t1);
2574 else
2576 type t4 = pop32 ();
2577 push_type (t2);
2578 push_type (t1);
2579 push_type (t4);
2581 push_type (t3);
2582 push_type (t2);
2583 push_type (t1);
2586 break;
2587 case op_swap:
2589 type t1 = pop32 ();
2590 type t2 = pop32 ();
2591 push_type (t1);
2592 push_type (t2);
2594 break;
2595 case op_iadd:
2596 case op_isub:
2597 case op_imul:
2598 case op_idiv:
2599 case op_irem:
2600 case op_ishl:
2601 case op_ishr:
2602 case op_iushr:
2603 case op_iand:
2604 case op_ior:
2605 case op_ixor:
2606 pop_type (int_type);
2607 push_type (pop_type (int_type));
2608 break;
2609 case op_ladd:
2610 case op_lsub:
2611 case op_lmul:
2612 case op_ldiv:
2613 case op_lrem:
2614 case op_land:
2615 case op_lor:
2616 case op_lxor:
2617 pop_type (long_type);
2618 push_type (pop_type (long_type));
2619 break;
2620 case op_lshl:
2621 case op_lshr:
2622 case op_lushr:
2623 pop_type (int_type);
2624 push_type (pop_type (long_type));
2625 break;
2626 case op_fadd:
2627 case op_fsub:
2628 case op_fmul:
2629 case op_fdiv:
2630 case op_frem:
2631 pop_type (float_type);
2632 push_type (pop_type (float_type));
2633 break;
2634 case op_dadd:
2635 case op_dsub:
2636 case op_dmul:
2637 case op_ddiv:
2638 case op_drem:
2639 pop_type (double_type);
2640 push_type (pop_type (double_type));
2641 break;
2642 case op_ineg:
2643 case op_i2b:
2644 case op_i2c:
2645 case op_i2s:
2646 push_type (pop_type (int_type));
2647 break;
2648 case op_lneg:
2649 push_type (pop_type (long_type));
2650 break;
2651 case op_fneg:
2652 push_type (pop_type (float_type));
2653 break;
2654 case op_dneg:
2655 push_type (pop_type (double_type));
2656 break;
2657 case op_iinc:
2658 get_variable (get_byte (), int_type);
2659 get_byte ();
2660 break;
2661 case op_i2l:
2662 pop_type (int_type);
2663 push_type (long_type);
2664 break;
2665 case op_i2f:
2666 pop_type (int_type);
2667 push_type (float_type);
2668 break;
2669 case op_i2d:
2670 pop_type (int_type);
2671 push_type (double_type);
2672 break;
2673 case op_l2i:
2674 pop_type (long_type);
2675 push_type (int_type);
2676 break;
2677 case op_l2f:
2678 pop_type (long_type);
2679 push_type (float_type);
2680 break;
2681 case op_l2d:
2682 pop_type (long_type);
2683 push_type (double_type);
2684 break;
2685 case op_f2i:
2686 pop_type (float_type);
2687 push_type (int_type);
2688 break;
2689 case op_f2l:
2690 pop_type (float_type);
2691 push_type (long_type);
2692 break;
2693 case op_f2d:
2694 pop_type (float_type);
2695 push_type (double_type);
2696 break;
2697 case op_d2i:
2698 pop_type (double_type);
2699 push_type (int_type);
2700 break;
2701 case op_d2l:
2702 pop_type (double_type);
2703 push_type (long_type);
2704 break;
2705 case op_d2f:
2706 pop_type (double_type);
2707 push_type (float_type);
2708 break;
2709 case op_lcmp:
2710 pop_type (long_type);
2711 pop_type (long_type);
2712 push_type (int_type);
2713 break;
2714 case op_fcmpl:
2715 case op_fcmpg:
2716 pop_type (float_type);
2717 pop_type (float_type);
2718 push_type (int_type);
2719 break;
2720 case op_dcmpl:
2721 case op_dcmpg:
2722 pop_type (double_type);
2723 pop_type (double_type);
2724 push_type (int_type);
2725 break;
2726 case op_ifeq:
2727 case op_ifne:
2728 case op_iflt:
2729 case op_ifge:
2730 case op_ifgt:
2731 case op_ifle:
2732 pop_type (int_type);
2733 push_jump (get_short ());
2734 break;
2735 case op_if_icmpeq:
2736 case op_if_icmpne:
2737 case op_if_icmplt:
2738 case op_if_icmpge:
2739 case op_if_icmpgt:
2740 case op_if_icmple:
2741 pop_type (int_type);
2742 pop_type (int_type);
2743 push_jump (get_short ());
2744 break;
2745 case op_if_acmpeq:
2746 case op_if_acmpne:
2747 pop_type (reference_type);
2748 pop_type (reference_type);
2749 push_jump (get_short ());
2750 break;
2751 case op_goto:
2752 push_jump (get_short ());
2753 invalidate_pc ();
2754 break;
2755 case op_jsr:
2756 handle_jsr_insn (get_short ());
2757 break;
2758 case op_ret:
2759 handle_ret_insn (get_byte ());
2760 break;
2761 case op_tableswitch:
2763 pop_type (int_type);
2764 skip_padding ();
2765 push_jump (get_int ());
2766 jint low = get_int ();
2767 jint high = get_int ();
2768 // Already checked LOW -vs- HIGH.
2769 for (int i = low; i <= high; ++i)
2770 push_jump (get_int ());
2771 invalidate_pc ();
2773 break;
2775 case op_lookupswitch:
2777 pop_type (int_type);
2778 skip_padding ();
2779 push_jump (get_int ());
2780 jint npairs = get_int ();
2781 // Already checked NPAIRS >= 0.
2782 jint lastkey = 0;
2783 for (int i = 0; i < npairs; ++i)
2785 jint key = get_int ();
2786 if (i > 0 && key <= lastkey)
2787 verify_fail ("lookupswitch pairs unsorted", start_PC);
2788 lastkey = key;
2789 push_jump (get_int ());
2791 invalidate_pc ();
2793 break;
2794 case op_ireturn:
2795 check_return_type (pop_type (int_type));
2796 invalidate_pc ();
2797 break;
2798 case op_lreturn:
2799 check_return_type (pop_type (long_type));
2800 invalidate_pc ();
2801 break;
2802 case op_freturn:
2803 check_return_type (pop_type (float_type));
2804 invalidate_pc ();
2805 break;
2806 case op_dreturn:
2807 check_return_type (pop_type (double_type));
2808 invalidate_pc ();
2809 break;
2810 case op_areturn:
2811 check_return_type (pop_init_ref (reference_type));
2812 invalidate_pc ();
2813 break;
2814 case op_return:
2815 // We only need to check this when the return type is
2816 // void, because all instance initializers return void.
2817 if (this_is_init)
2818 current_state->check_this_initialized (this);
2819 check_return_type (void_type);
2820 invalidate_pc ();
2821 break;
2822 case op_getstatic:
2823 push_type (check_field_constant (get_ushort ()));
2824 break;
2825 case op_putstatic:
2826 pop_type (check_field_constant (get_ushort ()));
2827 break;
2828 case op_getfield:
2830 type klass;
2831 type field = check_field_constant (get_ushort (), &klass);
2832 pop_type (klass);
2833 push_type (field);
2835 break;
2836 case op_putfield:
2838 type klass;
2839 type field = check_field_constant (get_ushort (), &klass, true);
2840 pop_type (field);
2841 pop_type (klass);
2843 break;
2845 case op_invokevirtual:
2846 case op_invokespecial:
2847 case op_invokestatic:
2848 case op_invokeinterface:
2850 _Jv_Utf8Const *method_name, *method_signature;
2851 type class_type
2852 = check_method_constant (get_ushort (),
2853 opcode == op_invokeinterface,
2854 &method_name,
2855 &method_signature);
2856 // NARGS is only used when we're processing
2857 // invokeinterface. It is simplest for us to compute it
2858 // here and then verify it later.
2859 int nargs = 0;
2860 if (opcode == op_invokeinterface)
2862 nargs = get_byte ();
2863 if (get_byte () != 0)
2864 verify_fail ("invokeinterface dummy byte is wrong");
2867 bool is_init = false;
2868 if (_Jv_equalUtf8Consts (method_name, gcj::init_name))
2870 is_init = true;
2871 if (opcode != op_invokespecial)
2872 verify_fail ("can't invoke <init>");
2874 else if (method_name->first() == '<')
2875 verify_fail ("can't invoke method starting with `<'");
2877 // Pop arguments and check types.
2878 int arg_count = _Jv_count_arguments (method_signature);
2879 type arg_types[arg_count];
2880 compute_argument_types (method_signature, arg_types);
2881 for (int i = arg_count - 1; i >= 0; --i)
2883 // This is only used for verifying the byte for
2884 // invokeinterface.
2885 nargs -= arg_types[i].depth ();
2886 pop_init_ref (arg_types[i]);
2889 if (opcode == op_invokeinterface
2890 && nargs != 1)
2891 verify_fail ("wrong argument count for invokeinterface");
2893 if (opcode != op_invokestatic)
2895 type t = class_type;
2896 if (is_init)
2898 // In this case the PC doesn't matter.
2899 t.set_uninitialized (type::UNINIT, this);
2900 // FIXME: check to make sure that the <init>
2901 // call is to the right class.
2902 // It must either be super or an exact class
2903 // match.
2905 type raw = pop_raw ();
2906 if (! t.compatible (raw, this))
2907 verify_fail ("incompatible type on stack");
2909 if (is_init)
2910 current_state->set_initialized (raw.get_pc (),
2911 current_method->max_locals);
2914 type rt = compute_return_type (method_signature);
2915 if (! rt.isvoid ())
2916 push_type (rt);
2918 break;
2920 case op_new:
2922 type t = check_class_constant (get_ushort ());
2923 if (t.isarray ())
2924 verify_fail ("type is array");
2925 t.set_uninitialized (start_PC, this);
2926 push_type (t);
2928 break;
2930 case op_newarray:
2932 int atype = get_byte ();
2933 // We intentionally have chosen constants to make this
2934 // valid.
2935 if (atype < boolean_type || atype > long_type)
2936 verify_fail ("type not primitive", start_PC);
2937 pop_type (int_type);
2938 type t (construct_primitive_array_type (type_val (atype)), this);
2939 push_type (t);
2941 break;
2942 case op_anewarray:
2943 pop_type (int_type);
2944 push_type (check_class_constant (get_ushort ()).to_array (this));
2945 break;
2946 case op_arraylength:
2948 type t = pop_init_ref (reference_type);
2949 if (! t.isarray () && ! t.isnull ())
2950 verify_fail ("array type expected");
2951 push_type (int_type);
2953 break;
2954 case op_athrow:
2955 pop_type (type (&java::lang::Throwable::class$, this));
2956 invalidate_pc ();
2957 break;
2958 case op_checkcast:
2959 pop_init_ref (reference_type);
2960 push_type (check_class_constant (get_ushort ()));
2961 break;
2962 case op_instanceof:
2963 pop_init_ref (reference_type);
2964 check_class_constant (get_ushort ());
2965 push_type (int_type);
2966 break;
2967 case op_monitorenter:
2968 pop_init_ref (reference_type);
2969 break;
2970 case op_monitorexit:
2971 pop_init_ref (reference_type);
2972 break;
2973 case op_wide:
2975 switch (get_byte ())
2977 case op_iload:
2978 push_type (get_variable (get_ushort (), int_type));
2979 break;
2980 case op_lload:
2981 push_type (get_variable (get_ushort (), long_type));
2982 break;
2983 case op_fload:
2984 push_type (get_variable (get_ushort (), float_type));
2985 break;
2986 case op_dload:
2987 push_type (get_variable (get_ushort (), double_type));
2988 break;
2989 case op_aload:
2990 push_type (get_variable (get_ushort (), reference_type));
2991 break;
2992 case op_istore:
2993 set_variable (get_ushort (), pop_type (int_type));
2994 break;
2995 case op_lstore:
2996 set_variable (get_ushort (), pop_type (long_type));
2997 break;
2998 case op_fstore:
2999 set_variable (get_ushort (), pop_type (float_type));
3000 break;
3001 case op_dstore:
3002 set_variable (get_ushort (), pop_type (double_type));
3003 break;
3004 case op_astore:
3005 set_variable (get_ushort (), pop_init_ref (reference_type));
3006 break;
3007 case op_ret:
3008 handle_ret_insn (get_short ());
3009 break;
3010 case op_iinc:
3011 get_variable (get_ushort (), int_type);
3012 get_short ();
3013 break;
3014 default:
3015 verify_fail ("unrecognized wide instruction", start_PC);
3018 break;
3019 case op_multianewarray:
3021 type atype = check_class_constant (get_ushort ());
3022 int dim = get_byte ();
3023 if (dim < 1)
3024 verify_fail ("too few dimensions to multianewarray", start_PC);
3025 atype.verify_dimensions (dim, this);
3026 for (int i = 0; i < dim; ++i)
3027 pop_type (int_type);
3028 push_type (atype);
3030 break;
3031 case op_ifnull:
3032 case op_ifnonnull:
3033 pop_type (reference_type);
3034 push_jump (get_short ());
3035 break;
3036 case op_goto_w:
3037 push_jump (get_int ());
3038 invalidate_pc ();
3039 break;
3040 case op_jsr_w:
3041 handle_jsr_insn (get_int ());
3042 break;
3044 // These are unused here, but we call them out explicitly
3045 // so that -Wswitch-enum doesn't complain.
3046 case op_putfield_1:
3047 case op_putfield_2:
3048 case op_putfield_4:
3049 case op_putfield_8:
3050 case op_putfield_a:
3051 case op_putstatic_1:
3052 case op_putstatic_2:
3053 case op_putstatic_4:
3054 case op_putstatic_8:
3055 case op_putstatic_a:
3056 case op_getfield_1:
3057 case op_getfield_2s:
3058 case op_getfield_2u:
3059 case op_getfield_4:
3060 case op_getfield_8:
3061 case op_getfield_a:
3062 case op_getstatic_1:
3063 case op_getstatic_2s:
3064 case op_getstatic_2u:
3065 case op_getstatic_4:
3066 case op_getstatic_8:
3067 case op_getstatic_a:
3068 default:
3069 // Unrecognized opcode.
3070 verify_fail ("unrecognized instruction in verify_instructions_0",
3071 start_PC);
3076 public:
3078 void verify_instructions ()
3080 branch_prepass ();
3081 verify_instructions_0 ();
3084 _Jv_BytecodeVerifier (_Jv_InterpMethod *m)
3086 // We just print the text as utf-8. This is just for debugging
3087 // anyway.
3088 debug_print ("--------------------------------\n");
3089 debug_print ("-- Verifying method `%s'\n", m->self->name->chars());
3091 current_method = m;
3092 bytecode = m->bytecode ();
3093 exception = m->exceptions ();
3094 current_class = m->defining_class;
3096 states = NULL;
3097 flags = NULL;
3098 utf8_list = NULL;
3099 isect_list = NULL;
3102 ~_Jv_BytecodeVerifier ()
3104 if (flags)
3105 _Jv_Free (flags);
3107 while (utf8_list != NULL)
3109 linked<_Jv_Utf8Const> *n = utf8_list->next;
3110 _Jv_Free (utf8_list);
3111 utf8_list = n;
3114 while (isect_list != NULL)
3116 ref_intersection *next = isect_list->alloc_next;
3117 delete isect_list;
3118 isect_list = next;
3121 if (states)
3123 for (int i = 0; i < current_method->code_length; ++i)
3125 linked<state> *iter = states[i];
3126 while (iter != NULL)
3128 linked<state> *next = iter->next;
3129 delete iter->val;
3130 _Jv_Free (iter);
3131 iter = next;
3134 _Jv_Free (states);
3139 void
3140 _Jv_VerifyMethod (_Jv_InterpMethod *meth)
3142 _Jv_BytecodeVerifier v (meth);
3143 v.verify_instructions ();
3146 #endif /* INTERPRETER */