(CPP_SPEC): Remove trailing semi-colon.
[official-gcc.git] / libjava / verify.cc
blob8f8c1df9eb18782aad568434be5f8db03fb498a4
1 // defineclass.cc - defining a class from .class format.
3 /* Copyright (C) 2001, 2002, 2003 Free Software Foundation
5 This file is part of libgcj.
7 This software is copyrighted work licensed under the terms of the
8 Libgcj License. Please consult the file "LIBGCJ_LICENSE" for
9 details. */
11 // Written by Tom Tromey <tromey@redhat.com>
13 // Define VERIFY_DEBUG to enable debugging output.
15 #include <config.h>
17 #include <jvm.h>
18 #include <gcj/cni.h>
19 #include <java-insns.h>
20 #include <java-interp.h>
22 #ifdef INTERPRETER
24 #include <java/lang/Class.h>
25 #include <java/lang/VerifyError.h>
26 #include <java/lang/Throwable.h>
27 #include <java/lang/reflect/Modifier.h>
28 #include <java/lang/StringBuffer.h>
30 #ifdef VERIFY_DEBUG
31 #include <stdio.h>
32 #endif /* VERIFY_DEBUG */
35 static void debug_print (const char *fmt, ...)
36 __attribute__ ((format (printf, 1, 2)));
38 static inline void
39 debug_print (const char *fmt, ...)
41 #ifdef VERIFY_DEBUG
42 va_list ap;
43 va_start (ap, fmt);
44 vfprintf (stderr, fmt, ap);
45 va_end (ap);
46 #endif /* VERIFY_DEBUG */
49 class _Jv_BytecodeVerifier
51 private:
53 static const int FLAG_INSN_START = 1;
54 static const int FLAG_BRANCH_TARGET = 2;
56 struct state;
57 struct type;
58 struct subr_info;
59 struct subr_entry_info;
60 struct linked_utf8;
62 // The current PC.
63 int PC;
64 // The PC corresponding to the start of the current instruction.
65 int start_PC;
67 // The current state of the stack, locals, etc.
68 state *current_state;
70 // We store the state at branch targets, for merging. This holds
71 // such states.
72 state **states;
74 // We keep a linked list of all the PCs which we must reverify.
75 // The link is done using the PC values. This is the head of the
76 // list.
77 int next_verify_pc;
79 // We keep some flags for each instruction. The values are the
80 // FLAG_* constants defined above.
81 char *flags;
83 // We need to keep track of which instructions can call a given
84 // subroutine. FIXME: this is inefficient. We keep a linked list
85 // of all calling `jsr's at at each jsr target.
86 subr_info **jsr_ptrs;
88 // We keep a linked list of entries which map each `ret' instruction
89 // to its unique subroutine entry point. We expect that there won't
90 // be many `ret' instructions, so a linked list is ok.
91 subr_entry_info *entry_points;
93 // The bytecode itself.
94 unsigned char *bytecode;
95 // The exceptions.
96 _Jv_InterpException *exception;
98 // Defining class.
99 jclass current_class;
100 // This method.
101 _Jv_InterpMethod *current_method;
103 // A linked list of utf8 objects we allocate. This is really ugly,
104 // but without this our utf8 objects would be collected.
105 linked_utf8 *utf8_list;
107 struct linked_utf8
109 _Jv_Utf8Const *val;
110 linked_utf8 *next;
113 _Jv_Utf8Const *make_utf8_const (char *s, int len)
115 _Jv_Utf8Const *val = _Jv_makeUtf8Const (s, len);
116 _Jv_Utf8Const *r = (_Jv_Utf8Const *) _Jv_Malloc (sizeof (_Jv_Utf8Const)
117 + val->length
118 + 1);
119 r->length = val->length;
120 r->hash = val->hash;
121 memcpy (r->data, val->data, val->length + 1);
123 linked_utf8 *lu = (linked_utf8 *) _Jv_Malloc (sizeof (linked_utf8));
124 lu->val = r;
125 lu->next = utf8_list;
126 utf8_list = lu;
128 return r;
131 __attribute__ ((__noreturn__)) void verify_fail (char *s, jint pc = -1)
133 using namespace java::lang;
134 StringBuffer *buf = new StringBuffer ();
136 buf->append (JvNewStringLatin1 ("verification failed"));
137 if (pc == -1)
138 pc = start_PC;
139 if (pc != -1)
141 buf->append (JvNewStringLatin1 (" at PC "));
142 buf->append (pc);
145 _Jv_InterpMethod *method = current_method;
146 buf->append (JvNewStringLatin1 (" in "));
147 buf->append (current_class->getName());
148 buf->append ((jchar) ':');
149 buf->append (JvNewStringUTF (method->get_method()->name->data));
150 buf->append ((jchar) '(');
151 buf->append (JvNewStringUTF (method->get_method()->signature->data));
152 buf->append ((jchar) ')');
154 buf->append (JvNewStringLatin1 (": "));
155 buf->append (JvNewStringLatin1 (s));
156 throw new java::lang::VerifyError (buf->toString ());
159 // This enum holds a list of tags for all the different types we
160 // need to handle. Reference types are treated specially by the
161 // type class.
162 enum type_val
164 void_type,
166 // The values for primitive types are chosen to correspond to values
167 // specified to newarray.
168 boolean_type = 4,
169 char_type = 5,
170 float_type = 6,
171 double_type = 7,
172 byte_type = 8,
173 short_type = 9,
174 int_type = 10,
175 long_type = 11,
177 // Used when overwriting second word of a double or long in the
178 // local variables. Also used after merging local variable states
179 // to indicate an unusable value.
180 unsuitable_type,
181 return_address_type,
182 continuation_type,
184 // There is an obscure special case which requires us to note when
185 // a local variable has not been used by a subroutine. See
186 // push_jump_merge for more information.
187 unused_by_subroutine_type,
189 // Everything after `reference_type' must be a reference type.
190 reference_type,
191 null_type,
192 unresolved_reference_type,
193 uninitialized_reference_type,
194 uninitialized_unresolved_reference_type
197 // Return the type_val corresponding to a primitive signature
198 // character. For instance `I' returns `int.class'.
199 type_val get_type_val_for_signature (jchar sig)
201 type_val rt;
202 switch (sig)
204 case 'Z':
205 rt = boolean_type;
206 break;
207 case 'B':
208 rt = byte_type;
209 break;
210 case 'C':
211 rt = char_type;
212 break;
213 case 'S':
214 rt = short_type;
215 break;
216 case 'I':
217 rt = int_type;
218 break;
219 case 'J':
220 rt = long_type;
221 break;
222 case 'F':
223 rt = float_type;
224 break;
225 case 'D':
226 rt = double_type;
227 break;
228 case 'V':
229 rt = void_type;
230 break;
231 default:
232 verify_fail ("invalid signature");
234 return rt;
237 // Return the type_val corresponding to a primitive class.
238 type_val get_type_val_for_signature (jclass k)
240 return get_type_val_for_signature ((jchar) k->method_count);
243 // This is like _Jv_IsAssignableFrom, but it works even if SOURCE or
244 // TARGET haven't been prepared.
245 static bool is_assignable_from_slow (jclass target, jclass source)
247 // This will terminate when SOURCE==Object.
248 while (true)
250 if (source == target)
251 return true;
253 if (target->isPrimitive () || source->isPrimitive ())
254 return false;
256 if (target->isArray ())
258 if (! source->isArray ())
259 return false;
260 target = target->getComponentType ();
261 source = source->getComponentType ();
263 else if (target->isInterface ())
265 for (int i = 0; i < source->interface_count; ++i)
267 // We use a recursive call because we also need to
268 // check superinterfaces.
269 if (is_assignable_from_slow (target, source->interfaces[i]))
270 return true;
272 source = source->getSuperclass ();
273 if (source == NULL)
274 return false;
276 // We must do this check before we check to see if SOURCE is
277 // an interface. This way we know that any interface is
278 // assignable to an Object.
279 else if (target == &java::lang::Object::class$)
280 return true;
281 else if (source->isInterface ())
283 for (int i = 0; i < target->interface_count; ++i)
285 // We use a recursive call because we also need to
286 // check superinterfaces.
287 if (is_assignable_from_slow (target->interfaces[i], source))
288 return true;
290 target = target->getSuperclass ();
291 if (target == NULL)
292 return false;
294 else if (source == &java::lang::Object::class$)
295 return false;
296 else
297 source = source->getSuperclass ();
301 // This is used to keep track of which `jsr's correspond to a given
302 // jsr target.
303 struct subr_info
305 // PC of the instruction just after the jsr.
306 int pc;
307 // Link.
308 subr_info *next;
311 // This is used to keep track of which subroutine entry point
312 // corresponds to which `ret' instruction.
313 struct subr_entry_info
315 // PC of the subroutine entry point.
316 int pc;
317 // PC of the `ret' instruction.
318 int ret_pc;
319 // Link.
320 subr_entry_info *next;
323 // The `type' class is used to represent a single type in the
324 // verifier.
325 struct type
327 // The type.
328 type_val key;
329 // Some associated data.
330 union
332 // For a resolved reference type, this is a pointer to the class.
333 jclass klass;
334 // For other reference types, this it the name of the class.
335 _Jv_Utf8Const *name;
336 } data;
337 // This is used when constructing a new object. It is the PC of the
338 // `new' instruction which created the object. We use the special
339 // value -2 to mean that this is uninitialized, and the special
340 // value -1 for the case where the current method is itself the
341 // <init> method.
342 int pc;
344 static const int UNINIT = -2;
345 static const int SELF = -1;
347 // Basic constructor.
348 type ()
350 key = unsuitable_type;
351 data.klass = NULL;
352 pc = UNINIT;
355 // Make a new instance given the type tag. We assume a generic
356 // `reference_type' means Object.
357 type (type_val k)
359 key = k;
360 data.klass = NULL;
361 if (key == reference_type)
362 data.klass = &java::lang::Object::class$;
363 pc = UNINIT;
366 // Make a new instance given a class.
367 type (jclass klass)
369 key = reference_type;
370 data.klass = klass;
371 pc = UNINIT;
374 // Make a new instance given the name of a class.
375 type (_Jv_Utf8Const *n)
377 key = unresolved_reference_type;
378 data.name = n;
379 pc = UNINIT;
382 // Copy constructor.
383 type (const type &t)
385 key = t.key;
386 data = t.data;
387 pc = t.pc;
390 // These operators are required because libgcj can't link in
391 // -lstdc++.
392 void *operator new[] (size_t bytes)
394 return _Jv_Malloc (bytes);
397 void operator delete[] (void *mem)
399 _Jv_Free (mem);
402 type& operator= (type_val k)
404 key = k;
405 data.klass = NULL;
406 pc = UNINIT;
407 return *this;
410 type& operator= (const type& t)
412 key = t.key;
413 data = t.data;
414 pc = t.pc;
415 return *this;
418 // Promote a numeric type.
419 type &promote ()
421 if (key == boolean_type || key == char_type
422 || key == byte_type || key == short_type)
423 key = int_type;
424 return *this;
427 // If *THIS is an unresolved reference type, resolve it.
428 void resolve (_Jv_BytecodeVerifier *verifier)
430 if (key != unresolved_reference_type
431 && key != uninitialized_unresolved_reference_type)
432 return;
434 using namespace java::lang;
435 java::lang::ClassLoader *loader
436 = verifier->current_class->getClassLoaderInternal();
437 // We might see either kind of name. Sigh.
438 if (data.name->data[0] == 'L'
439 && data.name->data[data.name->length - 1] == ';')
440 data.klass = _Jv_FindClassFromSignature (data.name->data, loader);
441 else
442 data.klass = Class::forName (_Jv_NewStringUtf8Const (data.name),
443 false, loader);
444 key = (key == unresolved_reference_type
445 ? reference_type
446 : uninitialized_reference_type);
449 // Mark this type as the uninitialized result of `new'.
450 void set_uninitialized (int npc, _Jv_BytecodeVerifier *verifier)
452 if (key == reference_type)
453 key = uninitialized_reference_type;
454 else if (key == unresolved_reference_type)
455 key = uninitialized_unresolved_reference_type;
456 else
457 verifier->verify_fail ("internal error in type::uninitialized");
458 pc = npc;
461 // Mark this type as now initialized.
462 void set_initialized (int npc)
464 if (npc != UNINIT && pc == npc
465 && (key == uninitialized_reference_type
466 || key == uninitialized_unresolved_reference_type))
468 key = (key == uninitialized_reference_type
469 ? reference_type
470 : unresolved_reference_type);
471 pc = UNINIT;
476 // Return true if an object of type K can be assigned to a variable
477 // of type *THIS. Handle various special cases too. Might modify
478 // *THIS or K. Note however that this does not perform numeric
479 // promotion.
480 bool compatible (type &k, _Jv_BytecodeVerifier *verifier)
482 // Any type is compatible with the unsuitable type.
483 if (key == unsuitable_type)
484 return true;
486 if (key < reference_type || k.key < reference_type)
487 return key == k.key;
489 // The `null' type is convertible to any initialized reference
490 // type.
491 if (key == null_type || k.key == null_type)
492 return true;
494 // Any reference type is convertible to Object. This is a special
495 // case so we don't need to unnecessarily resolve a class.
496 if (key == reference_type
497 && data.klass == &java::lang::Object::class$)
498 return true;
500 // An initialized type and an uninitialized type are not
501 // compatible.
502 if (isinitialized () != k.isinitialized ())
503 return false;
505 // Two uninitialized objects are compatible if either:
506 // * The PCs are identical, or
507 // * One PC is UNINIT.
508 if (! isinitialized ())
510 if (pc != k.pc && pc != UNINIT && k.pc != UNINIT)
511 return false;
514 // Two unresolved types are equal if their names are the same.
515 if (! isresolved ()
516 && ! k.isresolved ()
517 && _Jv_equalUtf8Consts (data.name, k.data.name))
518 return true;
520 // We must resolve both types and check assignability.
521 resolve (verifier);
522 k.resolve (verifier);
523 return is_assignable_from_slow (data.klass, k.data.klass);
526 bool isvoid () const
528 return key == void_type;
531 bool iswide () const
533 return key == long_type || key == double_type;
536 // Return number of stack or local variable slots taken by this
537 // type.
538 int depth () const
540 return iswide () ? 2 : 1;
543 bool isarray () const
545 // We treat null_type as not an array. This is ok based on the
546 // current uses of this method.
547 if (key == reference_type)
548 return data.klass->isArray ();
549 else if (key == unresolved_reference_type)
550 return data.name->data[0] == '[';
551 return false;
554 bool isnull () const
556 return key == null_type;
559 bool isinterface (_Jv_BytecodeVerifier *verifier)
561 resolve (verifier);
562 if (key != reference_type)
563 return false;
564 return data.klass->isInterface ();
567 bool isabstract (_Jv_BytecodeVerifier *verifier)
569 resolve (verifier);
570 if (key != reference_type)
571 return false;
572 using namespace java::lang::reflect;
573 return Modifier::isAbstract (data.klass->getModifiers ());
576 // Return the element type of an array.
577 type element_type (_Jv_BytecodeVerifier *verifier)
579 // FIXME: maybe should do string manipulation here.
580 resolve (verifier);
581 if (key != reference_type)
582 verifier->verify_fail ("programmer error in type::element_type()", -1);
584 jclass k = data.klass->getComponentType ();
585 if (k->isPrimitive ())
586 return type (verifier->get_type_val_for_signature (k));
587 return type (k);
590 // Return the array type corresponding to an initialized
591 // reference. We could expand this to work for other kinds of
592 // types, but currently we don't need to.
593 type to_array (_Jv_BytecodeVerifier *verifier)
595 // Resolving isn't ideal, because it might force us to load
596 // another class, but it's easy. FIXME?
597 if (key == unresolved_reference_type)
598 resolve (verifier);
600 if (key == reference_type)
601 return type (_Jv_GetArrayClass (data.klass,
602 data.klass->getClassLoaderInternal()));
603 else
604 verifier->verify_fail ("internal error in type::to_array()");
607 bool isreference () const
609 return key >= reference_type;
612 int get_pc () const
614 return pc;
617 bool isinitialized () const
619 return (key == reference_type
620 || key == null_type
621 || key == unresolved_reference_type);
624 bool isresolved () const
626 return (key == reference_type
627 || key == null_type
628 || key == uninitialized_reference_type);
631 void verify_dimensions (int ndims, _Jv_BytecodeVerifier *verifier)
633 // The way this is written, we don't need to check isarray().
634 if (key == reference_type)
636 jclass k = data.klass;
637 while (k->isArray () && ndims > 0)
639 k = k->getComponentType ();
640 --ndims;
643 else
645 // We know KEY == unresolved_reference_type.
646 char *p = data.name->data;
647 while (*p++ == '[' && ndims-- > 0)
651 if (ndims > 0)
652 verifier->verify_fail ("array type has fewer dimensions than required");
655 // Merge OLD_TYPE into this. On error throw exception.
656 bool merge (type& old_type, bool local_semantics,
657 _Jv_BytecodeVerifier *verifier)
659 bool changed = false;
660 bool refo = old_type.isreference ();
661 bool refn = isreference ();
662 if (refo && refn)
664 if (old_type.key == null_type)
666 else if (key == null_type)
668 *this = old_type;
669 changed = true;
671 else if (isinitialized () != old_type.isinitialized ())
672 verifier->verify_fail ("merging initialized and uninitialized types");
673 else
675 if (! isinitialized ())
677 if (pc == UNINIT)
678 pc = old_type.pc;
679 else if (old_type.pc == UNINIT)
681 else if (pc != old_type.pc)
682 verifier->verify_fail ("merging different uninitialized types");
685 if (! isresolved ()
686 && ! old_type.isresolved ()
687 && _Jv_equalUtf8Consts (data.name, old_type.data.name))
689 // Types are identical.
691 else
693 resolve (verifier);
694 old_type.resolve (verifier);
696 jclass k = data.klass;
697 jclass oldk = old_type.data.klass;
699 int arraycount = 0;
700 while (k->isArray () && oldk->isArray ())
702 ++arraycount;
703 k = k->getComponentType ();
704 oldk = oldk->getComponentType ();
707 // Ordinarily this terminates when we hit Object...
708 while (k != NULL)
710 if (is_assignable_from_slow (k, oldk))
711 break;
712 k = k->getSuperclass ();
713 changed = true;
715 // ... but K could have been an interface, in which
716 // case we'll end up here. We just convert this
717 // into Object.
718 if (k == NULL)
719 k = &java::lang::Object::class$;
721 if (changed)
723 while (arraycount > 0)
725 java::lang::ClassLoader *loader
726 = verifier->current_class->getClassLoaderInternal();
727 k = _Jv_GetArrayClass (k, loader);
728 --arraycount;
730 data.klass = k;
735 else if (refo || refn || key != old_type.key)
737 if (local_semantics)
739 // If we're merging into an "unused" slot, then we
740 // simply accept whatever we're merging from.
741 if (key == unused_by_subroutine_type)
743 *this = old_type;
744 changed = true;
746 else if (old_type.key == unused_by_subroutine_type)
748 // Do nothing.
750 // If we already have an `unsuitable' type, then we
751 // don't need to change again.
752 else if (key != unsuitable_type)
754 key = unsuitable_type;
755 changed = true;
758 else
759 verifier->verify_fail ("unmergeable type");
761 return changed;
764 #ifdef VERIFY_DEBUG
765 void print (void) const
767 char c = '?';
768 switch (key)
770 case boolean_type: c = 'Z'; break;
771 case byte_type: c = 'B'; break;
772 case char_type: c = 'C'; break;
773 case short_type: c = 'S'; break;
774 case int_type: c = 'I'; break;
775 case long_type: c = 'J'; break;
776 case float_type: c = 'F'; break;
777 case double_type: c = 'D'; break;
778 case void_type: c = 'V'; break;
779 case unsuitable_type: c = '-'; break;
780 case return_address_type: c = 'r'; break;
781 case continuation_type: c = '+'; break;
782 case unused_by_subroutine_type: c = '_'; break;
783 case reference_type: c = 'L'; break;
784 case null_type: c = '@'; break;
785 case unresolved_reference_type: c = 'l'; break;
786 case uninitialized_reference_type: c = 'U'; break;
787 case uninitialized_unresolved_reference_type: c = 'u'; break;
789 debug_print ("%c", c);
791 #endif /* VERIFY_DEBUG */
794 // This class holds all the state information we need for a given
795 // location.
796 struct state
798 // The current top of the stack, in terms of slots.
799 int stacktop;
800 // The current depth of the stack. This will be larger than
801 // STACKTOP when wide types are on the stack.
802 int stackdepth;
803 // The stack.
804 type *stack;
805 // The local variables.
806 type *locals;
807 // This is used in subroutines to keep track of which local
808 // variables have been accessed.
809 bool *local_changed;
810 // If not 0, then we are in a subroutine. The value is the PC of
811 // the subroutine's entry point. We can use 0 as an exceptional
812 // value because PC=0 can never be a subroutine.
813 int subroutine;
814 // This is used to keep a linked list of all the states which
815 // require re-verification. We use the PC to keep track.
816 int next;
817 // We keep track of the type of `this' specially. This is used to
818 // ensure that an instance initializer invokes another initializer
819 // on `this' before returning. We must keep track of this
820 // specially because otherwise we might be confused by code which
821 // assigns to locals[0] (overwriting `this') and then returns
822 // without really initializing.
823 type this_type;
824 // This is a list of all subroutines that have been seen at this
825 // point. Ordinarily this is NULL; it is only allocated and used
826 // in relatively weird situations involving non-ret exit from a
827 // subroutine. We have to keep track of this in this way to avoid
828 // endless recursion in these cases.
829 subr_info *seen_subrs;
831 // INVALID marks a state which is not on the linked list of states
832 // requiring reverification.
833 static const int INVALID = -1;
834 // NO_NEXT marks the state at the end of the reverification list.
835 static const int NO_NEXT = -2;
837 // This is used to mark the stack depth at the instruction just
838 // after a `jsr' when we haven't yet processed the corresponding
839 // `ret'. See handle_jsr_insn for more information.
840 static const int NO_STACK = -1;
842 state ()
843 : this_type ()
845 stack = NULL;
846 locals = NULL;
847 local_changed = NULL;
848 seen_subrs = NULL;
851 state (int max_stack, int max_locals)
852 : this_type ()
854 stacktop = 0;
855 stackdepth = 0;
856 stack = new type[max_stack];
857 for (int i = 0; i < max_stack; ++i)
858 stack[i] = unsuitable_type;
859 locals = new type[max_locals];
860 local_changed = (bool *) _Jv_Malloc (sizeof (bool) * max_locals);
861 seen_subrs = NULL;
862 for (int i = 0; i < max_locals; ++i)
864 locals[i] = unsuitable_type;
865 local_changed[i] = false;
867 next = INVALID;
868 subroutine = 0;
871 state (const state *orig, int max_stack, int max_locals,
872 bool ret_semantics = false)
874 stack = new type[max_stack];
875 locals = new type[max_locals];
876 local_changed = (bool *) _Jv_Malloc (sizeof (bool) * max_locals);
877 seen_subrs = NULL;
878 copy (orig, max_stack, max_locals, ret_semantics);
879 next = INVALID;
882 ~state ()
884 if (stack)
885 delete[] stack;
886 if (locals)
887 delete[] locals;
888 if (local_changed)
889 _Jv_Free (local_changed);
890 clean_subrs ();
893 void *operator new[] (size_t bytes)
895 return _Jv_Malloc (bytes);
898 void operator delete[] (void *mem)
900 _Jv_Free (mem);
903 void *operator new (size_t bytes)
905 return _Jv_Malloc (bytes);
908 void operator delete (void *mem)
910 _Jv_Free (mem);
913 void clean_subrs ()
915 subr_info *info = seen_subrs;
916 while (info != NULL)
918 subr_info *next = info->next;
919 _Jv_Free (info);
920 info = next;
924 void copy (const state *copy, int max_stack, int max_locals,
925 bool ret_semantics = false)
927 stacktop = copy->stacktop;
928 stackdepth = copy->stackdepth;
929 subroutine = copy->subroutine;
930 for (int i = 0; i < max_stack; ++i)
931 stack[i] = copy->stack[i];
932 for (int i = 0; i < max_locals; ++i)
934 // See push_jump_merge to understand this case.
935 if (ret_semantics)
936 locals[i] = type (copy->local_changed[i]
937 ? unsuitable_type
938 : unused_by_subroutine_type);
939 else
940 locals[i] = copy->locals[i];
941 local_changed[i] = copy->local_changed[i];
944 clean_subrs ();
945 if (copy->seen_subrs)
947 for (subr_info *info = seen_subrs; info != NULL; info = info->next)
948 add_subr (info->pc);
950 else
951 seen_subrs = NULL;
953 this_type = copy->this_type;
954 // Don't modify `next'.
957 // Modify this state to reflect entry to an exception handler.
958 void set_exception (type t, int max_stack)
960 stackdepth = 1;
961 stacktop = 1;
962 stack[0] = t;
963 for (int i = stacktop; i < max_stack; ++i)
964 stack[i] = unsuitable_type;
967 // Modify this state to reflect entry into a subroutine.
968 void enter_subroutine (int npc, int max_locals)
970 subroutine = npc;
971 // Mark all items as unchanged. Each subroutine needs to keep
972 // track of its `changed' state independently. In the case of
973 // nested subroutines, this information will be merged back into
974 // parent by the `ret'.
975 for (int i = 0; i < max_locals; ++i)
976 local_changed[i] = false;
979 // Indicate that we've been in this this subroutine.
980 void add_subr (int pc)
982 subr_info *n = (subr_info *) _Jv_Malloc (sizeof (subr_info));
983 n->pc = pc;
984 n->next = seen_subrs;
985 seen_subrs = n;
988 // Merge STATE_OLD into this state. Destructively modifies this
989 // state. Returns true if the new state was in fact changed.
990 // Will throw an exception if the states are not mergeable.
991 bool merge (state *state_old, bool ret_semantics,
992 int max_locals, _Jv_BytecodeVerifier *verifier)
994 bool changed = false;
996 // Special handling for `this'. If one or the other is
997 // uninitialized, then the merge is uninitialized.
998 if (this_type.isinitialized ())
999 this_type = state_old->this_type;
1001 // Merge subroutine states. Here we just keep track of what
1002 // subroutine we think we're in. We only check for a merge
1003 // (which is invalid) when we see a `ret'.
1004 if (subroutine == state_old->subroutine)
1006 // Nothing.
1008 else if (subroutine == 0)
1010 subroutine = state_old->subroutine;
1011 changed = true;
1013 else
1015 // If the subroutines differ, and we haven't seen this
1016 // subroutine before, indicate that the state changed. This
1017 // is needed to detect when subroutines have merged.
1018 bool found = false;
1019 for (subr_info *info = seen_subrs; info != NULL; info = info->next)
1021 if (info->pc == state_old->subroutine)
1023 found = true;
1024 break;
1027 if (! found)
1029 add_subr (state_old->subroutine);
1030 changed = true;
1034 // Merge stacks. Special handling for NO_STACK case.
1035 if (state_old->stacktop == NO_STACK)
1037 // Nothing to do in this case; we don't care about modifying
1038 // the old state.
1040 else if (stacktop == NO_STACK)
1042 stacktop = state_old->stacktop;
1043 stackdepth = state_old->stackdepth;
1044 for (int i = 0; i < stacktop; ++i)
1045 stack[i] = state_old->stack[i];
1046 changed = true;
1048 else if (state_old->stacktop != stacktop)
1049 verifier->verify_fail ("stack sizes differ");
1050 else
1052 for (int i = 0; i < state_old->stacktop; ++i)
1054 if (stack[i].merge (state_old->stack[i], false, verifier))
1055 changed = true;
1059 // Merge local variables.
1060 for (int i = 0; i < max_locals; ++i)
1062 // If we're not processing a `ret', then we merge every
1063 // local variable. If we are processing a `ret', then we
1064 // only merge locals which changed in the subroutine. When
1065 // processing a `ret', STATE_OLD is the state at the point
1066 // of the `ret', and THIS is the state just after the `jsr'.
1067 if (! ret_semantics || state_old->local_changed[i])
1069 if (locals[i].merge (state_old->locals[i], true, verifier))
1071 // Note that we don't call `note_variable' here.
1072 // This change doesn't represent a real change to a
1073 // local, but rather a merge artifact. If we're in
1074 // a subroutine which is called with two
1075 // incompatible types in a slot that is unused by
1076 // the subroutine, then we don't want to mark that
1077 // variable as having been modified.
1078 changed = true;
1082 // If we're in a subroutine, we must compute the union of
1083 // all the changed local variables.
1084 if (state_old->local_changed[i])
1085 note_variable (i);
1088 return changed;
1091 // Throw an exception if there is an uninitialized object on the
1092 // stack or in a local variable. EXCEPTION_SEMANTICS controls
1093 // whether we're using backwards-branch or exception-handing
1094 // semantics.
1095 void check_no_uninitialized_objects (int max_locals,
1096 _Jv_BytecodeVerifier *verifier,
1097 bool exception_semantics = false)
1099 if (! exception_semantics)
1101 for (int i = 0; i < stacktop; ++i)
1102 if (stack[i].isreference () && ! stack[i].isinitialized ())
1103 verifier->verify_fail ("uninitialized object on stack");
1106 for (int i = 0; i < max_locals; ++i)
1107 if (locals[i].isreference () && ! locals[i].isinitialized ())
1108 verifier->verify_fail ("uninitialized object in local variable");
1110 check_this_initialized (verifier);
1113 // Ensure that `this' has been initialized.
1114 void check_this_initialized (_Jv_BytecodeVerifier *verifier)
1116 if (this_type.isreference () && ! this_type.isinitialized ())
1117 verifier->verify_fail ("`this' is uninitialized");
1120 // Set type of `this'.
1121 void set_this_type (const type &k)
1123 this_type = k;
1126 // Note that a local variable was modified.
1127 void note_variable (int index)
1129 if (subroutine > 0)
1130 local_changed[index] = true;
1133 // Mark each `new'd object we know of that was allocated at PC as
1134 // initialized.
1135 void set_initialized (int pc, int max_locals)
1137 for (int i = 0; i < stacktop; ++i)
1138 stack[i].set_initialized (pc);
1139 for (int i = 0; i < max_locals; ++i)
1140 locals[i].set_initialized (pc);
1141 this_type.set_initialized (pc);
1144 // Return true if this state is the unmerged result of a `ret'.
1145 bool is_unmerged_ret_state (int max_locals) const
1147 if (stacktop == NO_STACK)
1148 return true;
1149 for (int i = 0; i < max_locals; ++i)
1151 if (locals[i].key == unused_by_subroutine_type)
1152 return true;
1154 return false;
1157 #ifdef VERIFY_DEBUG
1158 void print (const char *leader, int pc,
1159 int max_stack, int max_locals) const
1161 debug_print ("%s [%4d]: [stack] ", leader, pc);
1162 int i;
1163 for (i = 0; i < stacktop; ++i)
1164 stack[i].print ();
1165 for (; i < max_stack; ++i)
1166 debug_print (".");
1167 debug_print (" [local] ");
1168 for (i = 0; i < max_locals; ++i)
1170 locals[i].print ();
1171 debug_print (local_changed[i] ? "+" : " ");
1173 if (subroutine == 0)
1174 debug_print (" | None");
1175 else
1176 debug_print (" | %4d", subroutine);
1177 debug_print (" | %p\n", this);
1179 #else
1180 inline void print (const char *, int, int, int) const
1183 #endif /* VERIFY_DEBUG */
1186 type pop_raw ()
1188 if (current_state->stacktop <= 0)
1189 verify_fail ("stack empty");
1190 type r = current_state->stack[--current_state->stacktop];
1191 current_state->stackdepth -= r.depth ();
1192 if (current_state->stackdepth < 0)
1193 verify_fail ("stack empty", start_PC);
1194 return r;
1197 type pop32 ()
1199 type r = pop_raw ();
1200 if (r.iswide ())
1201 verify_fail ("narrow pop of wide type");
1202 return r;
1205 type pop64 ()
1207 type r = pop_raw ();
1208 if (! r.iswide ())
1209 verify_fail ("wide pop of narrow type");
1210 return r;
1213 type pop_type (type match)
1215 match.promote ();
1216 type t = pop_raw ();
1217 if (! match.compatible (t, this))
1218 verify_fail ("incompatible type on stack");
1219 return t;
1222 // Pop a reference which is guaranteed to be initialized. MATCH
1223 // doesn't have to be a reference type; in this case this acts like
1224 // pop_type.
1225 type pop_init_ref (type match)
1227 type t = pop_raw ();
1228 if (t.isreference () && ! t.isinitialized ())
1229 verify_fail ("initialized reference required");
1230 else if (! match.compatible (t, this))
1231 verify_fail ("incompatible type on stack");
1232 return t;
1235 // Pop a reference type or a return address.
1236 type pop_ref_or_return ()
1238 type t = pop_raw ();
1239 if (! t.isreference () && t.key != return_address_type)
1240 verify_fail ("expected reference or return address on stack");
1241 return t;
1244 void push_type (type t)
1246 // If T is a numeric type like short, promote it to int.
1247 t.promote ();
1249 int depth = t.depth ();
1250 if (current_state->stackdepth + depth > current_method->max_stack)
1251 verify_fail ("stack overflow");
1252 current_state->stack[current_state->stacktop++] = t;
1253 current_state->stackdepth += depth;
1256 void set_variable (int index, type t)
1258 // If T is a numeric type like short, promote it to int.
1259 t.promote ();
1261 int depth = t.depth ();
1262 if (index > current_method->max_locals - depth)
1263 verify_fail ("invalid local variable");
1264 current_state->locals[index] = t;
1265 current_state->note_variable (index);
1267 if (depth == 2)
1269 current_state->locals[index + 1] = continuation_type;
1270 current_state->note_variable (index + 1);
1272 if (index > 0 && current_state->locals[index - 1].iswide ())
1274 current_state->locals[index - 1] = unsuitable_type;
1275 // There's no need to call note_variable here.
1279 type get_variable (int index, type t)
1281 int depth = t.depth ();
1282 if (index > current_method->max_locals - depth)
1283 verify_fail ("invalid local variable");
1284 if (! t.compatible (current_state->locals[index], this))
1285 verify_fail ("incompatible type in local variable");
1286 if (depth == 2)
1288 type t (continuation_type);
1289 if (! current_state->locals[index + 1].compatible (t, this))
1290 verify_fail ("invalid local variable");
1292 return current_state->locals[index];
1295 // Make sure ARRAY is an array type and that its elements are
1296 // compatible with type ELEMENT. Returns the actual element type.
1297 type require_array_type (type array, type element)
1299 // An odd case. Here we just pretend that everything went ok. If
1300 // the requested element type is some kind of reference, return
1301 // the null type instead.
1302 if (array.isnull ())
1303 return element.isreference () ? type (null_type) : element;
1305 if (! array.isarray ())
1306 verify_fail ("array required");
1308 type t = array.element_type (this);
1309 if (! element.compatible (t, this))
1311 // Special case for byte arrays, which must also be boolean
1312 // arrays.
1313 bool ok = true;
1314 if (element.key == byte_type)
1316 type e2 (boolean_type);
1317 ok = e2.compatible (t, this);
1319 if (! ok)
1320 verify_fail ("incompatible array element type");
1323 // Return T and not ELEMENT, because T might be specialized.
1324 return t;
1327 jint get_byte ()
1329 if (PC >= current_method->code_length)
1330 verify_fail ("premature end of bytecode");
1331 return (jint) bytecode[PC++] & 0xff;
1334 jint get_ushort ()
1336 jint b1 = get_byte ();
1337 jint b2 = get_byte ();
1338 return (jint) ((b1 << 8) | b2) & 0xffff;
1341 jint get_short ()
1343 jint b1 = get_byte ();
1344 jint b2 = get_byte ();
1345 jshort s = (b1 << 8) | b2;
1346 return (jint) s;
1349 jint get_int ()
1351 jint b1 = get_byte ();
1352 jint b2 = get_byte ();
1353 jint b3 = get_byte ();
1354 jint b4 = get_byte ();
1355 return (b1 << 24) | (b2 << 16) | (b3 << 8) | b4;
1358 int compute_jump (int offset)
1360 int npc = start_PC + offset;
1361 if (npc < 0 || npc >= current_method->code_length)
1362 verify_fail ("branch out of range", start_PC);
1363 return npc;
1366 // Merge the indicated state into the state at the branch target and
1367 // schedule a new PC if there is a change. If RET_SEMANTICS is
1368 // true, then we are merging from a `ret' instruction into the
1369 // instruction after a `jsr'. This is a special case with its own
1370 // modified semantics.
1371 void push_jump_merge (int npc, state *nstate, bool ret_semantics = false)
1373 bool changed = true;
1374 if (states[npc] == NULL)
1376 // There's a weird situation here. If are examining the
1377 // branch that results from a `ret', and there is not yet a
1378 // state available at the branch target (the instruction just
1379 // after the `jsr'), then we have to construct a special kind
1380 // of state at that point for future merging. This special
1381 // state has the type `unused_by_subroutine_type' in each slot
1382 // which was not modified by the subroutine.
1383 states[npc] = new state (nstate, current_method->max_stack,
1384 current_method->max_locals, ret_semantics);
1385 debug_print ("== New state in push_jump_merge\n");
1386 states[npc]->print ("New", npc, current_method->max_stack,
1387 current_method->max_locals);
1389 else
1391 debug_print ("== Merge states in push_jump_merge\n");
1392 nstate->print ("Frm", start_PC, current_method->max_stack,
1393 current_method->max_locals);
1394 states[npc]->print (" To", npc, current_method->max_stack,
1395 current_method->max_locals);
1396 changed = states[npc]->merge (nstate, ret_semantics,
1397 current_method->max_locals, this);
1398 states[npc]->print ("New", npc, current_method->max_stack,
1399 current_method->max_locals);
1402 if (changed && states[npc]->next == state::INVALID)
1404 // The merge changed the state, and the new PC isn't yet on our
1405 // list of PCs to re-verify.
1406 states[npc]->next = next_verify_pc;
1407 next_verify_pc = npc;
1411 void push_jump (int offset)
1413 int npc = compute_jump (offset);
1414 if (npc < PC)
1415 current_state->check_no_uninitialized_objects (current_method->max_locals, this);
1416 push_jump_merge (npc, current_state);
1419 void push_exception_jump (type t, int pc)
1421 current_state->check_no_uninitialized_objects (current_method->max_locals,
1422 this, true);
1423 state s (current_state, current_method->max_stack,
1424 current_method->max_locals);
1425 if (current_method->max_stack < 1)
1426 verify_fail ("stack overflow at exception handler");
1427 s.set_exception (t, current_method->max_stack);
1428 push_jump_merge (pc, &s);
1431 int pop_jump ()
1433 int *prev_loc = &next_verify_pc;
1434 int npc = next_verify_pc;
1436 while (npc != state::NO_NEXT)
1438 // If the next available PC is an unmerged `ret' state, then
1439 // we aren't yet ready to handle it. That's because we would
1440 // need all kind of special cases to do so. So instead we
1441 // defer this jump until after we've processed it via a
1442 // fall-through. This has to happen because the instruction
1443 // before this one must be a `jsr'.
1444 if (! states[npc]->is_unmerged_ret_state (current_method->max_locals))
1446 *prev_loc = states[npc]->next;
1447 states[npc]->next = state::INVALID;
1448 return npc;
1451 prev_loc = &states[npc]->next;
1452 npc = states[npc]->next;
1455 // Note that we might have gotten here even when there are
1456 // remaining states to process. That can happen if we find a
1457 // `jsr' without a `ret'.
1458 return state::NO_NEXT;
1461 void invalidate_pc ()
1463 PC = state::NO_NEXT;
1466 void note_branch_target (int pc, bool is_jsr_target = false)
1468 // Don't check `pc <= PC', because we've advanced PC after
1469 // fetching the target and we haven't yet checked the next
1470 // instruction.
1471 if (pc < PC && ! (flags[pc] & FLAG_INSN_START))
1472 verify_fail ("branch not to instruction start", start_PC);
1473 flags[pc] |= FLAG_BRANCH_TARGET;
1474 if (is_jsr_target)
1476 // Record the jsr which called this instruction.
1477 subr_info *info = (subr_info *) _Jv_Malloc (sizeof (subr_info));
1478 info->pc = PC;
1479 info->next = jsr_ptrs[pc];
1480 jsr_ptrs[pc] = info;
1484 void skip_padding ()
1486 while ((PC % 4) > 0)
1487 if (get_byte () != 0)
1488 verify_fail ("found nonzero padding byte");
1491 // Return the subroutine to which the instruction at PC belongs.
1492 int get_subroutine (int pc)
1494 if (states[pc] == NULL)
1495 return 0;
1496 return states[pc]->subroutine;
1499 // Do the work for a `ret' instruction. INDEX is the index into the
1500 // local variables.
1501 void handle_ret_insn (int index)
1503 get_variable (index, return_address_type);
1505 int csub = current_state->subroutine;
1506 if (csub == 0)
1507 verify_fail ("no subroutine");
1509 // Check to see if we've merged subroutines.
1510 subr_entry_info *entry;
1511 for (entry = entry_points; entry != NULL; entry = entry->next)
1513 if (entry->ret_pc == start_PC)
1514 break;
1516 if (entry == NULL)
1518 entry = (subr_entry_info *) _Jv_Malloc (sizeof (subr_entry_info));
1519 entry->pc = csub;
1520 entry->ret_pc = start_PC;
1521 entry->next = entry_points;
1522 entry_points = entry;
1524 else if (entry->pc != csub)
1525 verify_fail ("subroutines merged");
1527 for (subr_info *subr = jsr_ptrs[csub]; subr != NULL; subr = subr->next)
1529 // We might be returning to a `jsr' that is at the end of the
1530 // bytecode. This is ok if we never return from the called
1531 // subroutine, but if we see this here it is an error.
1532 if (subr->pc >= current_method->code_length)
1533 verify_fail ("fell off end");
1535 // Temporarily modify the current state so it looks like we're
1536 // in the enclosing context.
1537 current_state->subroutine = get_subroutine (subr->pc);
1538 if (subr->pc < PC)
1539 current_state->check_no_uninitialized_objects (current_method->max_locals, this);
1540 push_jump_merge (subr->pc, current_state, true);
1543 current_state->subroutine = csub;
1544 invalidate_pc ();
1547 // We're in the subroutine SUB, calling a subroutine at DEST. Make
1548 // sure this subroutine isn't already on the stack.
1549 void check_nonrecursive_call (int sub, int dest)
1551 if (sub == 0)
1552 return;
1553 if (sub == dest)
1554 verify_fail ("recursive subroutine call");
1555 for (subr_info *info = jsr_ptrs[sub]; info != NULL; info = info->next)
1556 check_nonrecursive_call (get_subroutine (info->pc), dest);
1559 void handle_jsr_insn (int offset)
1561 int npc = compute_jump (offset);
1563 if (npc < PC)
1564 current_state->check_no_uninitialized_objects (current_method->max_locals, this);
1565 check_nonrecursive_call (current_state->subroutine, npc);
1567 // Modify our state as appropriate for entry into a subroutine.
1568 push_type (return_address_type);
1569 push_jump_merge (npc, current_state);
1570 // Clean up.
1571 pop_type (return_address_type);
1573 // On entry to the subroutine, the subroutine number must be set
1574 // and the locals must be marked as cleared. We do this after
1575 // merging state so that we don't erroneously "notice" a variable
1576 // change merely on entry.
1577 states[npc]->enter_subroutine (npc, current_method->max_locals);
1579 // Indicate that we don't know the stack depth of the instruction
1580 // following the `jsr'. The idea here is that we need to merge
1581 // the local variable state across the jsr, but the subroutine
1582 // might change the stack depth, so we can't make any assumptions
1583 // about it. So we have yet another special case. We know that
1584 // at this point PC points to the instruction after the jsr. Note
1585 // that it is ok to have a `jsr' at the end of the bytecode,
1586 // provided that the called subroutine never returns. So, we have
1587 // a special case here and another one when we handle the ret.
1588 if (PC < current_method->code_length)
1590 current_state->stacktop = state::NO_STACK;
1591 push_jump_merge (PC, current_state);
1593 invalidate_pc ();
1596 jclass construct_primitive_array_type (type_val prim)
1598 jclass k = NULL;
1599 switch (prim)
1601 case boolean_type:
1602 k = JvPrimClass (boolean);
1603 break;
1604 case char_type:
1605 k = JvPrimClass (char);
1606 break;
1607 case float_type:
1608 k = JvPrimClass (float);
1609 break;
1610 case double_type:
1611 k = JvPrimClass (double);
1612 break;
1613 case byte_type:
1614 k = JvPrimClass (byte);
1615 break;
1616 case short_type:
1617 k = JvPrimClass (short);
1618 break;
1619 case int_type:
1620 k = JvPrimClass (int);
1621 break;
1622 case long_type:
1623 k = JvPrimClass (long);
1624 break;
1626 // These aren't used here but we call them out to avoid
1627 // warnings.
1628 case void_type:
1629 case unsuitable_type:
1630 case return_address_type:
1631 case continuation_type:
1632 case unused_by_subroutine_type:
1633 case reference_type:
1634 case null_type:
1635 case unresolved_reference_type:
1636 case uninitialized_reference_type:
1637 case uninitialized_unresolved_reference_type:
1638 default:
1639 verify_fail ("unknown type in construct_primitive_array_type");
1641 k = _Jv_GetArrayClass (k, NULL);
1642 return k;
1645 // This pass computes the location of branch targets and also
1646 // instruction starts.
1647 void branch_prepass ()
1649 flags = (char *) _Jv_Malloc (current_method->code_length);
1650 jsr_ptrs = (subr_info **) _Jv_Malloc (sizeof (subr_info *)
1651 * current_method->code_length);
1653 for (int i = 0; i < current_method->code_length; ++i)
1655 flags[i] = 0;
1656 jsr_ptrs[i] = NULL;
1659 bool last_was_jsr = false;
1661 PC = 0;
1662 while (PC < current_method->code_length)
1664 // Set `start_PC' early so that error checking can have the
1665 // correct value.
1666 start_PC = PC;
1667 flags[PC] |= FLAG_INSN_START;
1669 // If the previous instruction was a jsr, then the next
1670 // instruction is a branch target -- the branch being the
1671 // corresponding `ret'.
1672 if (last_was_jsr)
1673 note_branch_target (PC);
1674 last_was_jsr = false;
1676 java_opcode opcode = (java_opcode) bytecode[PC++];
1677 switch (opcode)
1679 case op_nop:
1680 case op_aconst_null:
1681 case op_iconst_m1:
1682 case op_iconst_0:
1683 case op_iconst_1:
1684 case op_iconst_2:
1685 case op_iconst_3:
1686 case op_iconst_4:
1687 case op_iconst_5:
1688 case op_lconst_0:
1689 case op_lconst_1:
1690 case op_fconst_0:
1691 case op_fconst_1:
1692 case op_fconst_2:
1693 case op_dconst_0:
1694 case op_dconst_1:
1695 case op_iload_0:
1696 case op_iload_1:
1697 case op_iload_2:
1698 case op_iload_3:
1699 case op_lload_0:
1700 case op_lload_1:
1701 case op_lload_2:
1702 case op_lload_3:
1703 case op_fload_0:
1704 case op_fload_1:
1705 case op_fload_2:
1706 case op_fload_3:
1707 case op_dload_0:
1708 case op_dload_1:
1709 case op_dload_2:
1710 case op_dload_3:
1711 case op_aload_0:
1712 case op_aload_1:
1713 case op_aload_2:
1714 case op_aload_3:
1715 case op_iaload:
1716 case op_laload:
1717 case op_faload:
1718 case op_daload:
1719 case op_aaload:
1720 case op_baload:
1721 case op_caload:
1722 case op_saload:
1723 case op_istore_0:
1724 case op_istore_1:
1725 case op_istore_2:
1726 case op_istore_3:
1727 case op_lstore_0:
1728 case op_lstore_1:
1729 case op_lstore_2:
1730 case op_lstore_3:
1731 case op_fstore_0:
1732 case op_fstore_1:
1733 case op_fstore_2:
1734 case op_fstore_3:
1735 case op_dstore_0:
1736 case op_dstore_1:
1737 case op_dstore_2:
1738 case op_dstore_3:
1739 case op_astore_0:
1740 case op_astore_1:
1741 case op_astore_2:
1742 case op_astore_3:
1743 case op_iastore:
1744 case op_lastore:
1745 case op_fastore:
1746 case op_dastore:
1747 case op_aastore:
1748 case op_bastore:
1749 case op_castore:
1750 case op_sastore:
1751 case op_pop:
1752 case op_pop2:
1753 case op_dup:
1754 case op_dup_x1:
1755 case op_dup_x2:
1756 case op_dup2:
1757 case op_dup2_x1:
1758 case op_dup2_x2:
1759 case op_swap:
1760 case op_iadd:
1761 case op_isub:
1762 case op_imul:
1763 case op_idiv:
1764 case op_irem:
1765 case op_ishl:
1766 case op_ishr:
1767 case op_iushr:
1768 case op_iand:
1769 case op_ior:
1770 case op_ixor:
1771 case op_ladd:
1772 case op_lsub:
1773 case op_lmul:
1774 case op_ldiv:
1775 case op_lrem:
1776 case op_lshl:
1777 case op_lshr:
1778 case op_lushr:
1779 case op_land:
1780 case op_lor:
1781 case op_lxor:
1782 case op_fadd:
1783 case op_fsub:
1784 case op_fmul:
1785 case op_fdiv:
1786 case op_frem:
1787 case op_dadd:
1788 case op_dsub:
1789 case op_dmul:
1790 case op_ddiv:
1791 case op_drem:
1792 case op_ineg:
1793 case op_i2b:
1794 case op_i2c:
1795 case op_i2s:
1796 case op_lneg:
1797 case op_fneg:
1798 case op_dneg:
1799 case op_i2l:
1800 case op_i2f:
1801 case op_i2d:
1802 case op_l2i:
1803 case op_l2f:
1804 case op_l2d:
1805 case op_f2i:
1806 case op_f2l:
1807 case op_f2d:
1808 case op_d2i:
1809 case op_d2l:
1810 case op_d2f:
1811 case op_lcmp:
1812 case op_fcmpl:
1813 case op_fcmpg:
1814 case op_dcmpl:
1815 case op_dcmpg:
1816 case op_monitorenter:
1817 case op_monitorexit:
1818 case op_ireturn:
1819 case op_lreturn:
1820 case op_freturn:
1821 case op_dreturn:
1822 case op_areturn:
1823 case op_return:
1824 case op_athrow:
1825 case op_arraylength:
1826 break;
1828 case op_bipush:
1829 case op_ldc:
1830 case op_iload:
1831 case op_lload:
1832 case op_fload:
1833 case op_dload:
1834 case op_aload:
1835 case op_istore:
1836 case op_lstore:
1837 case op_fstore:
1838 case op_dstore:
1839 case op_astore:
1840 case op_ret:
1841 case op_newarray:
1842 get_byte ();
1843 break;
1845 case op_iinc:
1846 case op_sipush:
1847 case op_ldc_w:
1848 case op_ldc2_w:
1849 case op_getstatic:
1850 case op_getfield:
1851 case op_putfield:
1852 case op_putstatic:
1853 case op_new:
1854 case op_anewarray:
1855 case op_instanceof:
1856 case op_checkcast:
1857 case op_invokespecial:
1858 case op_invokestatic:
1859 case op_invokevirtual:
1860 get_short ();
1861 break;
1863 case op_multianewarray:
1864 get_short ();
1865 get_byte ();
1866 break;
1868 case op_jsr:
1869 last_was_jsr = true;
1870 // Fall through.
1871 case op_ifeq:
1872 case op_ifne:
1873 case op_iflt:
1874 case op_ifge:
1875 case op_ifgt:
1876 case op_ifle:
1877 case op_if_icmpeq:
1878 case op_if_icmpne:
1879 case op_if_icmplt:
1880 case op_if_icmpge:
1881 case op_if_icmpgt:
1882 case op_if_icmple:
1883 case op_if_acmpeq:
1884 case op_if_acmpne:
1885 case op_ifnull:
1886 case op_ifnonnull:
1887 case op_goto:
1888 note_branch_target (compute_jump (get_short ()), last_was_jsr);
1889 break;
1891 case op_tableswitch:
1893 skip_padding ();
1894 note_branch_target (compute_jump (get_int ()));
1895 jint low = get_int ();
1896 jint hi = get_int ();
1897 if (low > hi)
1898 verify_fail ("invalid tableswitch", start_PC);
1899 for (int i = low; i <= hi; ++i)
1900 note_branch_target (compute_jump (get_int ()));
1902 break;
1904 case op_lookupswitch:
1906 skip_padding ();
1907 note_branch_target (compute_jump (get_int ()));
1908 int npairs = get_int ();
1909 if (npairs < 0)
1910 verify_fail ("too few pairs in lookupswitch", start_PC);
1911 while (npairs-- > 0)
1913 get_int ();
1914 note_branch_target (compute_jump (get_int ()));
1917 break;
1919 case op_invokeinterface:
1920 get_short ();
1921 get_byte ();
1922 get_byte ();
1923 break;
1925 case op_wide:
1927 opcode = (java_opcode) get_byte ();
1928 get_short ();
1929 if (opcode == op_iinc)
1930 get_short ();
1932 break;
1934 case op_jsr_w:
1935 last_was_jsr = true;
1936 // Fall through.
1937 case op_goto_w:
1938 note_branch_target (compute_jump (get_int ()), last_was_jsr);
1939 break;
1941 // These are unused here, but we call them out explicitly
1942 // so that -Wswitch-enum doesn't complain.
1943 case op_putfield_1:
1944 case op_putfield_2:
1945 case op_putfield_4:
1946 case op_putfield_8:
1947 case op_putfield_a:
1948 case op_putstatic_1:
1949 case op_putstatic_2:
1950 case op_putstatic_4:
1951 case op_putstatic_8:
1952 case op_putstatic_a:
1953 case op_getfield_1:
1954 case op_getfield_2s:
1955 case op_getfield_2u:
1956 case op_getfield_4:
1957 case op_getfield_8:
1958 case op_getfield_a:
1959 case op_getstatic_1:
1960 case op_getstatic_2s:
1961 case op_getstatic_2u:
1962 case op_getstatic_4:
1963 case op_getstatic_8:
1964 case op_getstatic_a:
1965 default:
1966 verify_fail ("unrecognized instruction in branch_prepass",
1967 start_PC);
1970 // See if any previous branch tried to branch to the middle of
1971 // this instruction.
1972 for (int pc = start_PC + 1; pc < PC; ++pc)
1974 if ((flags[pc] & FLAG_BRANCH_TARGET))
1975 verify_fail ("branch to middle of instruction", pc);
1979 // Verify exception handlers.
1980 for (int i = 0; i < current_method->exc_count; ++i)
1982 if (! (flags[exception[i].handler_pc.i] & FLAG_INSN_START))
1983 verify_fail ("exception handler not at instruction start",
1984 exception[i].handler_pc.i);
1985 if (! (flags[exception[i].start_pc.i] & FLAG_INSN_START))
1986 verify_fail ("exception start not at instruction start",
1987 exception[i].start_pc.i);
1988 if (exception[i].end_pc.i != current_method->code_length
1989 && ! (flags[exception[i].end_pc.i] & FLAG_INSN_START))
1990 verify_fail ("exception end not at instruction start",
1991 exception[i].end_pc.i);
1993 flags[exception[i].handler_pc.i] |= FLAG_BRANCH_TARGET;
1997 void check_pool_index (int index)
1999 if (index < 0 || index >= current_class->constants.size)
2000 verify_fail ("constant pool index out of range", start_PC);
2003 type check_class_constant (int index)
2005 check_pool_index (index);
2006 _Jv_Constants *pool = &current_class->constants;
2007 if (pool->tags[index] == JV_CONSTANT_ResolvedClass)
2008 return type (pool->data[index].clazz);
2009 else if (pool->tags[index] == JV_CONSTANT_Class)
2010 return type (pool->data[index].utf8);
2011 verify_fail ("expected class constant", start_PC);
2014 type check_constant (int index)
2016 check_pool_index (index);
2017 _Jv_Constants *pool = &current_class->constants;
2018 if (pool->tags[index] == JV_CONSTANT_ResolvedString
2019 || pool->tags[index] == JV_CONSTANT_String)
2020 return type (&java::lang::String::class$);
2021 else if (pool->tags[index] == JV_CONSTANT_Integer)
2022 return type (int_type);
2023 else if (pool->tags[index] == JV_CONSTANT_Float)
2024 return type (float_type);
2025 verify_fail ("String, int, or float constant expected", start_PC);
2028 type check_wide_constant (int index)
2030 check_pool_index (index);
2031 _Jv_Constants *pool = &current_class->constants;
2032 if (pool->tags[index] == JV_CONSTANT_Long)
2033 return type (long_type);
2034 else if (pool->tags[index] == JV_CONSTANT_Double)
2035 return type (double_type);
2036 verify_fail ("long or double constant expected", start_PC);
2039 // Helper for both field and method. These are laid out the same in
2040 // the constant pool.
2041 type handle_field_or_method (int index, int expected,
2042 _Jv_Utf8Const **name,
2043 _Jv_Utf8Const **fmtype)
2045 check_pool_index (index);
2046 _Jv_Constants *pool = &current_class->constants;
2047 if (pool->tags[index] != expected)
2048 verify_fail ("didn't see expected constant", start_PC);
2049 // Once we know we have a Fieldref or Methodref we assume that it
2050 // is correctly laid out in the constant pool. I think the code
2051 // in defineclass.cc guarantees this.
2052 _Jv_ushort class_index, name_and_type_index;
2053 _Jv_loadIndexes (&pool->data[index],
2054 class_index,
2055 name_and_type_index);
2056 _Jv_ushort name_index, desc_index;
2057 _Jv_loadIndexes (&pool->data[name_and_type_index],
2058 name_index, desc_index);
2060 *name = pool->data[name_index].utf8;
2061 *fmtype = pool->data[desc_index].utf8;
2063 return check_class_constant (class_index);
2066 // Return field's type, compute class' type if requested.
2067 type check_field_constant (int index, type *class_type = NULL)
2069 _Jv_Utf8Const *name, *field_type;
2070 type ct = handle_field_or_method (index,
2071 JV_CONSTANT_Fieldref,
2072 &name, &field_type);
2073 if (class_type)
2074 *class_type = ct;
2075 if (field_type->data[0] == '[' || field_type->data[0] == 'L')
2076 return type (field_type);
2077 return get_type_val_for_signature (field_type->data[0]);
2080 type check_method_constant (int index, bool is_interface,
2081 _Jv_Utf8Const **method_name,
2082 _Jv_Utf8Const **method_signature)
2084 return handle_field_or_method (index,
2085 (is_interface
2086 ? JV_CONSTANT_InterfaceMethodref
2087 : JV_CONSTANT_Methodref),
2088 method_name, method_signature);
2091 type get_one_type (char *&p)
2093 char *start = p;
2095 int arraycount = 0;
2096 while (*p == '[')
2098 ++arraycount;
2099 ++p;
2102 char v = *p++;
2104 if (v == 'L')
2106 while (*p != ';')
2107 ++p;
2108 ++p;
2109 _Jv_Utf8Const *name = make_utf8_const (start, p - start);
2110 return type (name);
2113 // Casting to jchar here is ok since we are looking at an ASCII
2114 // character.
2115 type_val rt = get_type_val_for_signature (jchar (v));
2117 if (arraycount == 0)
2119 // Callers of this function eventually push their arguments on
2120 // the stack. So, promote them here.
2121 return type (rt).promote ();
2124 jclass k = construct_primitive_array_type (rt);
2125 while (--arraycount > 0)
2126 k = _Jv_GetArrayClass (k, NULL);
2127 return type (k);
2130 void compute_argument_types (_Jv_Utf8Const *signature,
2131 type *types)
2133 char *p = signature->data;
2134 // Skip `('.
2135 ++p;
2137 int i = 0;
2138 while (*p != ')')
2139 types[i++] = get_one_type (p);
2142 type compute_return_type (_Jv_Utf8Const *signature)
2144 char *p = signature->data;
2145 while (*p != ')')
2146 ++p;
2147 ++p;
2148 return get_one_type (p);
2151 void check_return_type (type onstack)
2153 type rt = compute_return_type (current_method->self->signature);
2154 if (! rt.compatible (onstack, this))
2155 verify_fail ("incompatible return type");
2158 // Initialize the stack for the new method. Returns true if this
2159 // method is an instance initializer.
2160 bool initialize_stack ()
2162 int var = 0;
2163 bool is_init = false;
2165 using namespace java::lang::reflect;
2166 if (! Modifier::isStatic (current_method->self->accflags))
2168 type kurr (current_class);
2169 if (_Jv_equalUtf8Consts (current_method->self->name, gcj::init_name))
2171 kurr.set_uninitialized (type::SELF, this);
2172 is_init = true;
2174 set_variable (0, kurr);
2175 current_state->set_this_type (kurr);
2176 ++var;
2179 // We have to handle wide arguments specially here.
2180 int arg_count = _Jv_count_arguments (current_method->self->signature);
2181 type arg_types[arg_count];
2182 compute_argument_types (current_method->self->signature, arg_types);
2183 for (int i = 0; i < arg_count; ++i)
2185 set_variable (var, arg_types[i]);
2186 ++var;
2187 if (arg_types[i].iswide ())
2188 ++var;
2191 return is_init;
2194 void verify_instructions_0 ()
2196 current_state = new state (current_method->max_stack,
2197 current_method->max_locals);
2199 PC = 0;
2200 start_PC = 0;
2202 // True if we are verifying an instance initializer.
2203 bool this_is_init = initialize_stack ();
2205 states = (state **) _Jv_Malloc (sizeof (state *)
2206 * current_method->code_length);
2207 for (int i = 0; i < current_method->code_length; ++i)
2208 states[i] = NULL;
2210 next_verify_pc = state::NO_NEXT;
2212 while (true)
2214 // If the PC was invalidated, get a new one from the work list.
2215 if (PC == state::NO_NEXT)
2217 PC = pop_jump ();
2218 if (PC == state::INVALID)
2219 verify_fail ("can't happen: saw state::INVALID");
2220 if (PC == state::NO_NEXT)
2221 break;
2222 debug_print ("== State pop from pending list\n");
2223 // Set up the current state.
2224 current_state->copy (states[PC], current_method->max_stack,
2225 current_method->max_locals);
2227 else
2229 // Control can't fall off the end of the bytecode. We
2230 // only need to check this in the fall-through case,
2231 // because branch bounds are checked when they are
2232 // pushed.
2233 if (PC >= current_method->code_length)
2234 verify_fail ("fell off end");
2236 // We only have to do this checking in the situation where
2237 // control flow falls through from the previous
2238 // instruction. Otherwise merging is done at the time we
2239 // push the branch.
2240 if (states[PC] != NULL)
2242 // We've already visited this instruction. So merge
2243 // the states together. If this yields no change then
2244 // we don't have to re-verify. However, if the new
2245 // state is an the result of an unmerged `ret', we
2246 // must continue through it.
2247 debug_print ("== Fall through merge\n");
2248 states[PC]->print ("Old", PC, current_method->max_stack,
2249 current_method->max_locals);
2250 current_state->print ("Cur", PC, current_method->max_stack,
2251 current_method->max_locals);
2252 if (! current_state->merge (states[PC], false,
2253 current_method->max_locals, this)
2254 && ! states[PC]->is_unmerged_ret_state (current_method->max_locals))
2256 debug_print ("== Fall through optimization\n");
2257 invalidate_pc ();
2258 continue;
2260 // Save a copy of it for later.
2261 states[PC]->copy (current_state, current_method->max_stack,
2262 current_method->max_locals);
2263 current_state->print ("New", PC, current_method->max_stack,
2264 current_method->max_locals);
2268 // We only have to keep saved state at branch targets. If
2269 // we're at a branch target and the state here hasn't been set
2270 // yet, we set it now.
2271 if (states[PC] == NULL && (flags[PC] & FLAG_BRANCH_TARGET))
2273 states[PC] = new state (current_state, current_method->max_stack,
2274 current_method->max_locals);
2277 // Set this before handling exceptions so that debug output is
2278 // sane.
2279 start_PC = PC;
2281 // Update states for all active exception handlers. Ordinarily
2282 // there are not many exception handlers. So we simply run
2283 // through them all.
2284 for (int i = 0; i < current_method->exc_count; ++i)
2286 if (PC >= exception[i].start_pc.i && PC < exception[i].end_pc.i)
2288 type handler (&java::lang::Throwable::class$);
2289 if (exception[i].handler_type.i != 0)
2290 handler = check_class_constant (exception[i].handler_type.i);
2291 push_exception_jump (handler, exception[i].handler_pc.i);
2295 current_state->print (" ", PC, current_method->max_stack,
2296 current_method->max_locals);
2297 java_opcode opcode = (java_opcode) bytecode[PC++];
2298 switch (opcode)
2300 case op_nop:
2301 break;
2303 case op_aconst_null:
2304 push_type (null_type);
2305 break;
2307 case op_iconst_m1:
2308 case op_iconst_0:
2309 case op_iconst_1:
2310 case op_iconst_2:
2311 case op_iconst_3:
2312 case op_iconst_4:
2313 case op_iconst_5:
2314 push_type (int_type);
2315 break;
2317 case op_lconst_0:
2318 case op_lconst_1:
2319 push_type (long_type);
2320 break;
2322 case op_fconst_0:
2323 case op_fconst_1:
2324 case op_fconst_2:
2325 push_type (float_type);
2326 break;
2328 case op_dconst_0:
2329 case op_dconst_1:
2330 push_type (double_type);
2331 break;
2333 case op_bipush:
2334 get_byte ();
2335 push_type (int_type);
2336 break;
2338 case op_sipush:
2339 get_short ();
2340 push_type (int_type);
2341 break;
2343 case op_ldc:
2344 push_type (check_constant (get_byte ()));
2345 break;
2346 case op_ldc_w:
2347 push_type (check_constant (get_ushort ()));
2348 break;
2349 case op_ldc2_w:
2350 push_type (check_wide_constant (get_ushort ()));
2351 break;
2353 case op_iload:
2354 push_type (get_variable (get_byte (), int_type));
2355 break;
2356 case op_lload:
2357 push_type (get_variable (get_byte (), long_type));
2358 break;
2359 case op_fload:
2360 push_type (get_variable (get_byte (), float_type));
2361 break;
2362 case op_dload:
2363 push_type (get_variable (get_byte (), double_type));
2364 break;
2365 case op_aload:
2366 push_type (get_variable (get_byte (), reference_type));
2367 break;
2369 case op_iload_0:
2370 case op_iload_1:
2371 case op_iload_2:
2372 case op_iload_3:
2373 push_type (get_variable (opcode - op_iload_0, int_type));
2374 break;
2375 case op_lload_0:
2376 case op_lload_1:
2377 case op_lload_2:
2378 case op_lload_3:
2379 push_type (get_variable (opcode - op_lload_0, long_type));
2380 break;
2381 case op_fload_0:
2382 case op_fload_1:
2383 case op_fload_2:
2384 case op_fload_3:
2385 push_type (get_variable (opcode - op_fload_0, float_type));
2386 break;
2387 case op_dload_0:
2388 case op_dload_1:
2389 case op_dload_2:
2390 case op_dload_3:
2391 push_type (get_variable (opcode - op_dload_0, double_type));
2392 break;
2393 case op_aload_0:
2394 case op_aload_1:
2395 case op_aload_2:
2396 case op_aload_3:
2397 push_type (get_variable (opcode - op_aload_0, reference_type));
2398 break;
2399 case op_iaload:
2400 pop_type (int_type);
2401 push_type (require_array_type (pop_init_ref (reference_type),
2402 int_type));
2403 break;
2404 case op_laload:
2405 pop_type (int_type);
2406 push_type (require_array_type (pop_init_ref (reference_type),
2407 long_type));
2408 break;
2409 case op_faload:
2410 pop_type (int_type);
2411 push_type (require_array_type (pop_init_ref (reference_type),
2412 float_type));
2413 break;
2414 case op_daload:
2415 pop_type (int_type);
2416 push_type (require_array_type (pop_init_ref (reference_type),
2417 double_type));
2418 break;
2419 case op_aaload:
2420 pop_type (int_type);
2421 push_type (require_array_type (pop_init_ref (reference_type),
2422 reference_type));
2423 break;
2424 case op_baload:
2425 pop_type (int_type);
2426 require_array_type (pop_init_ref (reference_type), byte_type);
2427 push_type (int_type);
2428 break;
2429 case op_caload:
2430 pop_type (int_type);
2431 require_array_type (pop_init_ref (reference_type), char_type);
2432 push_type (int_type);
2433 break;
2434 case op_saload:
2435 pop_type (int_type);
2436 require_array_type (pop_init_ref (reference_type), short_type);
2437 push_type (int_type);
2438 break;
2439 case op_istore:
2440 set_variable (get_byte (), pop_type (int_type));
2441 break;
2442 case op_lstore:
2443 set_variable (get_byte (), pop_type (long_type));
2444 break;
2445 case op_fstore:
2446 set_variable (get_byte (), pop_type (float_type));
2447 break;
2448 case op_dstore:
2449 set_variable (get_byte (), pop_type (double_type));
2450 break;
2451 case op_astore:
2452 set_variable (get_byte (), pop_ref_or_return ());
2453 break;
2454 case op_istore_0:
2455 case op_istore_1:
2456 case op_istore_2:
2457 case op_istore_3:
2458 set_variable (opcode - op_istore_0, pop_type (int_type));
2459 break;
2460 case op_lstore_0:
2461 case op_lstore_1:
2462 case op_lstore_2:
2463 case op_lstore_3:
2464 set_variable (opcode - op_lstore_0, pop_type (long_type));
2465 break;
2466 case op_fstore_0:
2467 case op_fstore_1:
2468 case op_fstore_2:
2469 case op_fstore_3:
2470 set_variable (opcode - op_fstore_0, pop_type (float_type));
2471 break;
2472 case op_dstore_0:
2473 case op_dstore_1:
2474 case op_dstore_2:
2475 case op_dstore_3:
2476 set_variable (opcode - op_dstore_0, pop_type (double_type));
2477 break;
2478 case op_astore_0:
2479 case op_astore_1:
2480 case op_astore_2:
2481 case op_astore_3:
2482 set_variable (opcode - op_astore_0, pop_ref_or_return ());
2483 break;
2484 case op_iastore:
2485 pop_type (int_type);
2486 pop_type (int_type);
2487 require_array_type (pop_init_ref (reference_type), int_type);
2488 break;
2489 case op_lastore:
2490 pop_type (long_type);
2491 pop_type (int_type);
2492 require_array_type (pop_init_ref (reference_type), long_type);
2493 break;
2494 case op_fastore:
2495 pop_type (float_type);
2496 pop_type (int_type);
2497 require_array_type (pop_init_ref (reference_type), float_type);
2498 break;
2499 case op_dastore:
2500 pop_type (double_type);
2501 pop_type (int_type);
2502 require_array_type (pop_init_ref (reference_type), double_type);
2503 break;
2504 case op_aastore:
2505 pop_type (reference_type);
2506 pop_type (int_type);
2507 require_array_type (pop_init_ref (reference_type), reference_type);
2508 break;
2509 case op_bastore:
2510 pop_type (int_type);
2511 pop_type (int_type);
2512 require_array_type (pop_init_ref (reference_type), byte_type);
2513 break;
2514 case op_castore:
2515 pop_type (int_type);
2516 pop_type (int_type);
2517 require_array_type (pop_init_ref (reference_type), char_type);
2518 break;
2519 case op_sastore:
2520 pop_type (int_type);
2521 pop_type (int_type);
2522 require_array_type (pop_init_ref (reference_type), short_type);
2523 break;
2524 case op_pop:
2525 pop32 ();
2526 break;
2527 case op_pop2:
2528 pop64 ();
2529 break;
2530 case op_dup:
2532 type t = pop32 ();
2533 push_type (t);
2534 push_type (t);
2536 break;
2537 case op_dup_x1:
2539 type t1 = pop32 ();
2540 type t2 = pop32 ();
2541 push_type (t1);
2542 push_type (t2);
2543 push_type (t1);
2545 break;
2546 case op_dup_x2:
2548 type t1 = pop32 ();
2549 type t2 = pop_raw ();
2550 if (! t2.iswide ())
2552 type t3 = pop32 ();
2553 push_type (t1);
2554 push_type (t3);
2556 else
2557 push_type (t1);
2558 push_type (t2);
2559 push_type (t1);
2561 break;
2562 case op_dup2:
2564 type t = pop_raw ();
2565 if (! t.iswide ())
2567 type t2 = pop32 ();
2568 push_type (t2);
2569 push_type (t);
2570 push_type (t2);
2572 else
2573 push_type (t);
2574 push_type (t);
2576 break;
2577 case op_dup2_x1:
2579 type t1 = pop_raw ();
2580 type t2 = pop32 ();
2581 if (! t1.iswide ())
2583 type t3 = pop32 ();
2584 push_type (t2);
2585 push_type (t1);
2586 push_type (t3);
2588 else
2589 push_type (t1);
2590 push_type (t2);
2591 push_type (t1);
2593 break;
2594 case op_dup2_x2:
2596 type t1 = pop_raw ();
2597 if (t1.iswide ())
2599 type t2 = pop_raw ();
2600 if (t2.iswide ())
2602 push_type (t1);
2603 push_type (t2);
2605 else
2607 type t3 = pop32 ();
2608 push_type (t1);
2609 push_type (t3);
2610 push_type (t2);
2612 push_type (t1);
2614 else
2616 type t2 = pop32 ();
2617 type t3 = pop_raw ();
2618 if (t3.iswide ())
2620 push_type (t2);
2621 push_type (t1);
2623 else
2625 type t4 = pop32 ();
2626 push_type (t2);
2627 push_type (t1);
2628 push_type (t4);
2630 push_type (t3);
2631 push_type (t2);
2632 push_type (t1);
2635 break;
2636 case op_swap:
2638 type t1 = pop32 ();
2639 type t2 = pop32 ();
2640 push_type (t1);
2641 push_type (t2);
2643 break;
2644 case op_iadd:
2645 case op_isub:
2646 case op_imul:
2647 case op_idiv:
2648 case op_irem:
2649 case op_ishl:
2650 case op_ishr:
2651 case op_iushr:
2652 case op_iand:
2653 case op_ior:
2654 case op_ixor:
2655 pop_type (int_type);
2656 push_type (pop_type (int_type));
2657 break;
2658 case op_ladd:
2659 case op_lsub:
2660 case op_lmul:
2661 case op_ldiv:
2662 case op_lrem:
2663 case op_land:
2664 case op_lor:
2665 case op_lxor:
2666 pop_type (long_type);
2667 push_type (pop_type (long_type));
2668 break;
2669 case op_lshl:
2670 case op_lshr:
2671 case op_lushr:
2672 pop_type (int_type);
2673 push_type (pop_type (long_type));
2674 break;
2675 case op_fadd:
2676 case op_fsub:
2677 case op_fmul:
2678 case op_fdiv:
2679 case op_frem:
2680 pop_type (float_type);
2681 push_type (pop_type (float_type));
2682 break;
2683 case op_dadd:
2684 case op_dsub:
2685 case op_dmul:
2686 case op_ddiv:
2687 case op_drem:
2688 pop_type (double_type);
2689 push_type (pop_type (double_type));
2690 break;
2691 case op_ineg:
2692 case op_i2b:
2693 case op_i2c:
2694 case op_i2s:
2695 push_type (pop_type (int_type));
2696 break;
2697 case op_lneg:
2698 push_type (pop_type (long_type));
2699 break;
2700 case op_fneg:
2701 push_type (pop_type (float_type));
2702 break;
2703 case op_dneg:
2704 push_type (pop_type (double_type));
2705 break;
2706 case op_iinc:
2707 get_variable (get_byte (), int_type);
2708 get_byte ();
2709 break;
2710 case op_i2l:
2711 pop_type (int_type);
2712 push_type (long_type);
2713 break;
2714 case op_i2f:
2715 pop_type (int_type);
2716 push_type (float_type);
2717 break;
2718 case op_i2d:
2719 pop_type (int_type);
2720 push_type (double_type);
2721 break;
2722 case op_l2i:
2723 pop_type (long_type);
2724 push_type (int_type);
2725 break;
2726 case op_l2f:
2727 pop_type (long_type);
2728 push_type (float_type);
2729 break;
2730 case op_l2d:
2731 pop_type (long_type);
2732 push_type (double_type);
2733 break;
2734 case op_f2i:
2735 pop_type (float_type);
2736 push_type (int_type);
2737 break;
2738 case op_f2l:
2739 pop_type (float_type);
2740 push_type (long_type);
2741 break;
2742 case op_f2d:
2743 pop_type (float_type);
2744 push_type (double_type);
2745 break;
2746 case op_d2i:
2747 pop_type (double_type);
2748 push_type (int_type);
2749 break;
2750 case op_d2l:
2751 pop_type (double_type);
2752 push_type (long_type);
2753 break;
2754 case op_d2f:
2755 pop_type (double_type);
2756 push_type (float_type);
2757 break;
2758 case op_lcmp:
2759 pop_type (long_type);
2760 pop_type (long_type);
2761 push_type (int_type);
2762 break;
2763 case op_fcmpl:
2764 case op_fcmpg:
2765 pop_type (float_type);
2766 pop_type (float_type);
2767 push_type (int_type);
2768 break;
2769 case op_dcmpl:
2770 case op_dcmpg:
2771 pop_type (double_type);
2772 pop_type (double_type);
2773 push_type (int_type);
2774 break;
2775 case op_ifeq:
2776 case op_ifne:
2777 case op_iflt:
2778 case op_ifge:
2779 case op_ifgt:
2780 case op_ifle:
2781 pop_type (int_type);
2782 push_jump (get_short ());
2783 break;
2784 case op_if_icmpeq:
2785 case op_if_icmpne:
2786 case op_if_icmplt:
2787 case op_if_icmpge:
2788 case op_if_icmpgt:
2789 case op_if_icmple:
2790 pop_type (int_type);
2791 pop_type (int_type);
2792 push_jump (get_short ());
2793 break;
2794 case op_if_acmpeq:
2795 case op_if_acmpne:
2796 pop_type (reference_type);
2797 pop_type (reference_type);
2798 push_jump (get_short ());
2799 break;
2800 case op_goto:
2801 push_jump (get_short ());
2802 invalidate_pc ();
2803 break;
2804 case op_jsr:
2805 handle_jsr_insn (get_short ());
2806 break;
2807 case op_ret:
2808 handle_ret_insn (get_byte ());
2809 break;
2810 case op_tableswitch:
2812 pop_type (int_type);
2813 skip_padding ();
2814 push_jump (get_int ());
2815 jint low = get_int ();
2816 jint high = get_int ();
2817 // Already checked LOW -vs- HIGH.
2818 for (int i = low; i <= high; ++i)
2819 push_jump (get_int ());
2820 invalidate_pc ();
2822 break;
2824 case op_lookupswitch:
2826 pop_type (int_type);
2827 skip_padding ();
2828 push_jump (get_int ());
2829 jint npairs = get_int ();
2830 // Already checked NPAIRS >= 0.
2831 jint lastkey = 0;
2832 for (int i = 0; i < npairs; ++i)
2834 jint key = get_int ();
2835 if (i > 0 && key <= lastkey)
2836 verify_fail ("lookupswitch pairs unsorted", start_PC);
2837 lastkey = key;
2838 push_jump (get_int ());
2840 invalidate_pc ();
2842 break;
2843 case op_ireturn:
2844 check_return_type (pop_type (int_type));
2845 invalidate_pc ();
2846 break;
2847 case op_lreturn:
2848 check_return_type (pop_type (long_type));
2849 invalidate_pc ();
2850 break;
2851 case op_freturn:
2852 check_return_type (pop_type (float_type));
2853 invalidate_pc ();
2854 break;
2855 case op_dreturn:
2856 check_return_type (pop_type (double_type));
2857 invalidate_pc ();
2858 break;
2859 case op_areturn:
2860 check_return_type (pop_init_ref (reference_type));
2861 invalidate_pc ();
2862 break;
2863 case op_return:
2864 // We only need to check this when the return type is
2865 // void, because all instance initializers return void.
2866 if (this_is_init)
2867 current_state->check_this_initialized (this);
2868 check_return_type (void_type);
2869 invalidate_pc ();
2870 break;
2871 case op_getstatic:
2872 push_type (check_field_constant (get_ushort ()));
2873 break;
2874 case op_putstatic:
2875 pop_type (check_field_constant (get_ushort ()));
2876 break;
2877 case op_getfield:
2879 type klass;
2880 type field = check_field_constant (get_ushort (), &klass);
2881 pop_type (klass);
2882 push_type (field);
2884 break;
2885 case op_putfield:
2887 type klass;
2888 type field = check_field_constant (get_ushort (), &klass);
2889 pop_type (field);
2891 // We have an obscure special case here: we can use
2892 // `putfield' on a field declared in this class, even if
2893 // `this' has not yet been initialized.
2894 if (! current_state->this_type.isinitialized ()
2895 && current_state->this_type.pc == type::SELF)
2896 klass.set_uninitialized (type::SELF, this);
2897 pop_type (klass);
2899 break;
2901 case op_invokevirtual:
2902 case op_invokespecial:
2903 case op_invokestatic:
2904 case op_invokeinterface:
2906 _Jv_Utf8Const *method_name, *method_signature;
2907 type class_type
2908 = check_method_constant (get_ushort (),
2909 opcode == op_invokeinterface,
2910 &method_name,
2911 &method_signature);
2912 // NARGS is only used when we're processing
2913 // invokeinterface. It is simplest for us to compute it
2914 // here and then verify it later.
2915 int nargs = 0;
2916 if (opcode == op_invokeinterface)
2918 nargs = get_byte ();
2919 if (get_byte () != 0)
2920 verify_fail ("invokeinterface dummy byte is wrong");
2923 bool is_init = false;
2924 if (_Jv_equalUtf8Consts (method_name, gcj::init_name))
2926 is_init = true;
2927 if (opcode != op_invokespecial)
2928 verify_fail ("can't invoke <init>");
2930 else if (method_name->data[0] == '<')
2931 verify_fail ("can't invoke method starting with `<'");
2933 // Pop arguments and check types.
2934 int arg_count = _Jv_count_arguments (method_signature);
2935 type arg_types[arg_count];
2936 compute_argument_types (method_signature, arg_types);
2937 for (int i = arg_count - 1; i >= 0; --i)
2939 // This is only used for verifying the byte for
2940 // invokeinterface.
2941 nargs -= arg_types[i].depth ();
2942 pop_init_ref (arg_types[i]);
2945 if (opcode == op_invokeinterface
2946 && nargs != 1)
2947 verify_fail ("wrong argument count for invokeinterface");
2949 if (opcode != op_invokestatic)
2951 type t = class_type;
2952 if (is_init)
2954 // In this case the PC doesn't matter.
2955 t.set_uninitialized (type::UNINIT, this);
2957 type raw = pop_raw ();
2958 bool ok = false;
2959 if (! is_init && ! raw.isinitialized ())
2961 // This is a failure.
2963 else if (is_init && raw.isnull ())
2965 // Another failure.
2967 else if (t.compatible (raw, this))
2969 ok = true;
2971 else if (opcode == op_invokeinterface)
2973 // This is a hack. We might have merged two
2974 // items and gotten `Object'. This can happen
2975 // because we don't keep track of where merges
2976 // come from. This is safe as long as the
2977 // interpreter checks interfaces at runtime.
2978 type obj (&java::lang::Object::class$);
2979 ok = raw.compatible (obj, this);
2982 if (! ok)
2983 verify_fail ("incompatible type on stack");
2985 if (is_init)
2986 current_state->set_initialized (raw.get_pc (),
2987 current_method->max_locals);
2990 type rt = compute_return_type (method_signature);
2991 if (! rt.isvoid ())
2992 push_type (rt);
2994 break;
2996 case op_new:
2998 type t = check_class_constant (get_ushort ());
2999 if (t.isarray () || t.isinterface (this) || t.isabstract (this))
3000 verify_fail ("type is array, interface, or abstract");
3001 t.set_uninitialized (start_PC, this);
3002 push_type (t);
3004 break;
3006 case op_newarray:
3008 int atype = get_byte ();
3009 // We intentionally have chosen constants to make this
3010 // valid.
3011 if (atype < boolean_type || atype > long_type)
3012 verify_fail ("type not primitive", start_PC);
3013 pop_type (int_type);
3014 push_type (construct_primitive_array_type (type_val (atype)));
3016 break;
3017 case op_anewarray:
3018 pop_type (int_type);
3019 push_type (check_class_constant (get_ushort ()).to_array (this));
3020 break;
3021 case op_arraylength:
3023 type t = pop_init_ref (reference_type);
3024 if (! t.isarray () && ! t.isnull ())
3025 verify_fail ("array type expected");
3026 push_type (int_type);
3028 break;
3029 case op_athrow:
3030 pop_type (type (&java::lang::Throwable::class$));
3031 invalidate_pc ();
3032 break;
3033 case op_checkcast:
3034 pop_init_ref (reference_type);
3035 push_type (check_class_constant (get_ushort ()));
3036 break;
3037 case op_instanceof:
3038 pop_init_ref (reference_type);
3039 check_class_constant (get_ushort ());
3040 push_type (int_type);
3041 break;
3042 case op_monitorenter:
3043 pop_init_ref (reference_type);
3044 break;
3045 case op_monitorexit:
3046 pop_init_ref (reference_type);
3047 break;
3048 case op_wide:
3050 switch (get_byte ())
3052 case op_iload:
3053 push_type (get_variable (get_ushort (), int_type));
3054 break;
3055 case op_lload:
3056 push_type (get_variable (get_ushort (), long_type));
3057 break;
3058 case op_fload:
3059 push_type (get_variable (get_ushort (), float_type));
3060 break;
3061 case op_dload:
3062 push_type (get_variable (get_ushort (), double_type));
3063 break;
3064 case op_aload:
3065 push_type (get_variable (get_ushort (), reference_type));
3066 break;
3067 case op_istore:
3068 set_variable (get_ushort (), pop_type (int_type));
3069 break;
3070 case op_lstore:
3071 set_variable (get_ushort (), pop_type (long_type));
3072 break;
3073 case op_fstore:
3074 set_variable (get_ushort (), pop_type (float_type));
3075 break;
3076 case op_dstore:
3077 set_variable (get_ushort (), pop_type (double_type));
3078 break;
3079 case op_astore:
3080 set_variable (get_ushort (), pop_init_ref (reference_type));
3081 break;
3082 case op_ret:
3083 handle_ret_insn (get_short ());
3084 break;
3085 case op_iinc:
3086 get_variable (get_ushort (), int_type);
3087 get_short ();
3088 break;
3089 default:
3090 verify_fail ("unrecognized wide instruction", start_PC);
3093 break;
3094 case op_multianewarray:
3096 type atype = check_class_constant (get_ushort ());
3097 int dim = get_byte ();
3098 if (dim < 1)
3099 verify_fail ("too few dimensions to multianewarray", start_PC);
3100 atype.verify_dimensions (dim, this);
3101 for (int i = 0; i < dim; ++i)
3102 pop_type (int_type);
3103 push_type (atype);
3105 break;
3106 case op_ifnull:
3107 case op_ifnonnull:
3108 pop_type (reference_type);
3109 push_jump (get_short ());
3110 break;
3111 case op_goto_w:
3112 push_jump (get_int ());
3113 invalidate_pc ();
3114 break;
3115 case op_jsr_w:
3116 handle_jsr_insn (get_int ());
3117 break;
3119 // These are unused here, but we call them out explicitly
3120 // so that -Wswitch-enum doesn't complain.
3121 case op_putfield_1:
3122 case op_putfield_2:
3123 case op_putfield_4:
3124 case op_putfield_8:
3125 case op_putfield_a:
3126 case op_putstatic_1:
3127 case op_putstatic_2:
3128 case op_putstatic_4:
3129 case op_putstatic_8:
3130 case op_putstatic_a:
3131 case op_getfield_1:
3132 case op_getfield_2s:
3133 case op_getfield_2u:
3134 case op_getfield_4:
3135 case op_getfield_8:
3136 case op_getfield_a:
3137 case op_getstatic_1:
3138 case op_getstatic_2s:
3139 case op_getstatic_2u:
3140 case op_getstatic_4:
3141 case op_getstatic_8:
3142 case op_getstatic_a:
3143 default:
3144 // Unrecognized opcode.
3145 verify_fail ("unrecognized instruction in verify_instructions_0",
3146 start_PC);
3151 public:
3153 void verify_instructions ()
3155 branch_prepass ();
3156 verify_instructions_0 ();
3159 _Jv_BytecodeVerifier (_Jv_InterpMethod *m)
3161 // We just print the text as utf-8. This is just for debugging
3162 // anyway.
3163 debug_print ("--------------------------------\n");
3164 debug_print ("-- Verifying method `%s'\n", m->self->name->data);
3166 current_method = m;
3167 bytecode = m->bytecode ();
3168 exception = m->exceptions ();
3169 current_class = m->defining_class;
3171 states = NULL;
3172 flags = NULL;
3173 jsr_ptrs = NULL;
3174 utf8_list = NULL;
3175 entry_points = NULL;
3178 ~_Jv_BytecodeVerifier ()
3180 if (states)
3181 _Jv_Free (states);
3182 if (flags)
3183 _Jv_Free (flags);
3185 if (jsr_ptrs)
3187 for (int i = 0; i < current_method->code_length; ++i)
3189 if (jsr_ptrs[i] != NULL)
3191 subr_info *info = jsr_ptrs[i];
3192 while (info != NULL)
3194 subr_info *next = info->next;
3195 _Jv_Free (info);
3196 info = next;
3200 _Jv_Free (jsr_ptrs);
3203 while (utf8_list != NULL)
3205 linked_utf8 *n = utf8_list->next;
3206 _Jv_Free (utf8_list->val);
3207 _Jv_Free (utf8_list);
3208 utf8_list = n;
3211 while (entry_points != NULL)
3213 subr_entry_info *next = entry_points->next;
3214 _Jv_Free (entry_points);
3215 entry_points = next;
3220 void
3221 _Jv_VerifyMethod (_Jv_InterpMethod *meth)
3223 _Jv_BytecodeVerifier v (meth);
3224 v.verify_instructions ();
3226 #endif /* INTERPRETER */