1 /*
   2  * Copyright (c) 2008, 2018, Oracle and/or its affiliates. All rights reserved.
   3  * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
   4  *
   5  * This code is free software; you can redistribute it and/or modify it
   6  * under the terms of the GNU General Public License version 2 only, as
   7  * published by the Free Software Foundation.
   8  *
   9  * This code is distributed in the hope that it will be useful, but WITHOUT
  10  * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
  11  * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
  12  * version 2 for more details (a copy is included in the LICENSE file that
  13  * accompanied this code).
  14  *
  15  * You should have received a copy of the GNU General Public License version
  16  * 2 along with this work; if not, write to the Free Software Foundation,
  17  * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
  18  *
  19  * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
  20  * or visit www.oracle.com if you need additional information or have any
  21  * questions.
  22  *
  23  */
  24 
  25 #include "precompiled.hpp"
  26 #include "interpreter/interpreter.hpp"
  27 #include "memory/resourceArea.hpp"
  28 #include "oops/markOop.hpp"
  29 #include "oops/method.hpp"
  30 #include "oops/oop.inline.hpp"
  31 #include "runtime/frame.inline.hpp"
  32 #include "runtime/handles.inline.hpp"
  33 #include "runtime/javaCalls.hpp"
  34 #include "runtime/monitorChunk.hpp"
  35 #include "runtime/os.inline.hpp"
  36 #include "runtime/signature.hpp"
  37 #include "runtime/stubCodeGenerator.hpp"
  38 #include "runtime/stubRoutines.hpp"
  39 #include "vmreg_arm.inline.hpp"
  40 #ifdef COMPILER1
  41 #include "c1/c1_Runtime1.hpp"
  42 #include "runtime/vframeArray.hpp"
  43 #endif
  44 #include "prims/methodHandles.hpp"
  45 
  46 #ifdef ASSERT
  47 void RegisterMap::check_location_valid() {
  48 }
  49 #endif
  50 
  51 
  52 // Profiling/safepoint support
  53 
  54 bool frame::safe_for_sender(JavaThread *thread) {
  55   address   sp = (address)_sp;
  56   address   fp = (address)_fp;
  57   address   unextended_sp = (address)_unextended_sp;
  58 
  59   static size_t stack_guard_size = os::uses_stack_guard_pages() ?
  60     (JavaThread::stack_red_zone_size() + JavaThread::stack_yellow_zone_size()) : 0;
  61   size_t usable_stack_size = thread->stack_size() - stack_guard_size;
  62 
  63   // sp must be within the usable part of the stack (not in guards)
  64   bool sp_safe = (sp != NULL &&
  65                  (sp <= thread->stack_base()) &&
  66                  (sp >= thread->stack_base() - usable_stack_size));
  67 
  68   if (!sp_safe) {
  69     return false;
  70   }
  71 
  72   bool unextended_sp_safe = (unextended_sp != NULL &&
  73                              (unextended_sp <= thread->stack_base()) &&
  74                              (unextended_sp >= sp));
  75   if (!unextended_sp_safe) {
  76     return false;
  77   }
  78 
  79   // We know sp/unextended_sp are safe. Only fp is questionable here.
  80 
  81   bool fp_safe = (fp != NULL &&
  82                   (fp <= thread->stack_base()) &&
  83                   fp >= sp);
  84 
  85   if (_cb != NULL ) {
  86 
  87     // First check if frame is complete and tester is reliable
  88     // Unfortunately we can only check frame complete for runtime stubs and nmethod
  89     // other generic buffer blobs are more problematic so we just assume they are
  90     // ok. adapter blobs never have a frame complete and are never ok.
  91 
  92     if (!_cb->is_frame_complete_at(_pc)) {
  93       if (_cb->is_compiled() || _cb->is_adapter_blob() || _cb->is_runtime_stub()) {
  94         return false;
  95       }
  96     }
  97 
  98     // Could just be some random pointer within the codeBlob
  99     if (!_cb->code_contains(_pc)) {
 100       return false;
 101     }
 102 
 103     // Entry frame checks
 104     if (is_entry_frame()) {
 105       // an entry frame must have a valid fp.
 106       return fp_safe && is_entry_frame_valid(thread);
 107     }
 108 
 109     intptr_t* sender_sp = NULL;
 110     address   sender_pc = NULL;
 111 
 112     if (is_interpreted_frame()) {
 113       // fp must be safe
 114       if (!fp_safe) {
 115         return false;
 116       }
 117 
 118       sender_pc = (address) this->fp()[return_addr_offset];
 119       sender_sp = (intptr_t*) addr_at(sender_sp_offset);
 120 
 121     } else {
 122       // must be some sort of compiled/runtime frame
 123       // fp does not have to be safe (although it could be check for c1?)
 124 
 125       sender_sp = _unextended_sp + _cb->frame_size();
 126       // Is sender_sp safe?
 127       if ((address)sender_sp >= thread->stack_base()) {
 128         return false;
 129       }
 130       // With our calling conventions, the return_address should
 131       // end up being the word on the stack
 132       sender_pc = (address) *(sender_sp - sender_sp_offset + return_addr_offset);
 133     }
 134 
 135     // We must always be able to find a recognizable pc
 136     CodeBlob* sender_blob = CodeCache::find_blob_unsafe(sender_pc);
 137     if (sender_pc == NULL || sender_blob == NULL) {
 138       return false;
 139     }
 140 
 141 
 142     // If the potential sender is the interpreter then we can do some more checking
 143     if (Interpreter::contains(sender_pc)) {
 144 
 145       // FP is always saved in a recognizable place in any code we generate. However
 146       // only if the sender is interpreted/call_stub (c1 too?) are we certain that the saved FP
 147       // is really a frame pointer.
 148 
 149       intptr_t *saved_fp = (intptr_t*)*(sender_sp - frame::sender_sp_offset + link_offset);
 150       bool saved_fp_safe = ((address)saved_fp <= thread->stack_base()) && (saved_fp > sender_sp);
 151 
 152       if (!saved_fp_safe) {
 153         return false;
 154       }
 155 
 156       // construct the potential sender
 157 
 158       frame sender(sender_sp, saved_fp, sender_pc);
 159 
 160       return sender.is_interpreted_frame_valid(thread);
 161     }
 162 
 163     if (sender_blob->is_zombie() || sender_blob->is_unloaded()) {
 164       return false;
 165     }
 166 
 167     // Could just be some random pointer within the codeBlob
 168     if (!sender_blob->code_contains(sender_pc)) {
 169       return false;
 170     }
 171 
 172     // We should never be able to see an adapter if the current frame is something from code cache
 173     if (sender_blob->is_adapter_blob()) {
 174       return false;
 175     }
 176 
 177     // Could be the call_stub
 178     if (StubRoutines::returns_to_call_stub(sender_pc)) {
 179       intptr_t *saved_fp = (intptr_t*)*(sender_sp - frame::sender_sp_offset + link_offset);
 180       bool saved_fp_safe = ((address)saved_fp <= thread->stack_base()) && (saved_fp >= sender_sp);
 181 
 182       if (!saved_fp_safe) {
 183         return false;
 184       }
 185 
 186       // construct the potential sender
 187 
 188       frame sender(sender_sp, saved_fp, sender_pc);
 189 
 190       // Validate the JavaCallWrapper an entry frame must have
 191       address jcw = (address)sender.entry_frame_call_wrapper();
 192 
 193       bool jcw_safe = (jcw <= thread->stack_base()) && (jcw > (address)sender.fp());
 194 
 195       return jcw_safe;
 196     }
 197 
 198     // If the frame size is 0 something (or less) is bad because every nmethod has a non-zero frame size
 199     // because the return address counts against the callee's frame.
 200 
 201     if (sender_blob->frame_size() <= 0) {
 202       assert(!sender_blob->is_compiled(), "should count return address at least");
 203       return false;
 204     }
 205 
 206     // We should never be able to see anything here except an nmethod. If something in the
 207     // code cache (current frame) is called by an entity within the code cache that entity
 208     // should not be anything but the call stub (already covered), the interpreter (already covered)
 209     // or an nmethod.
 210 
 211     if (!sender_blob->is_compiled()) {
 212       return false;
 213     }
 214 
 215     // Could put some more validation for the potential non-interpreted sender
 216     // frame we'd create by calling sender if I could think of any. Wait for next crash in forte...
 217 
 218     // One idea is seeing if the sender_pc we have is one that we'd expect to call to current cb
 219 
 220     // We've validated the potential sender that would be created
 221     return true;
 222   }
 223 
 224   // Must be native-compiled frame. Since sender will try and use fp to find
 225   // linkages it must be safe
 226 
 227   if (!fp_safe) {
 228     return false;
 229   }
 230 
 231   // Will the pc we fetch be non-zero (which we'll find at the oldest frame)
 232 
 233   if ((address) this->fp()[return_addr_offset] == NULL) return false;
 234 
 235 
 236   // could try and do some more potential verification of native frame if we could think of some...
 237 
 238   return true;
 239 }
 240 
 241 
 242 void frame::patch_pc(Thread* thread, address pc) {
 243   address* pc_addr = &((address *)sp())[-sender_sp_offset+return_addr_offset];
 244   if (TracePcPatching) {
 245     tty->print_cr("patch_pc at address" INTPTR_FORMAT " [" INTPTR_FORMAT " -> " INTPTR_FORMAT "] ",
 246                   p2i(pc_addr), p2i(*pc_addr), p2i(pc));
 247   }
 248   *pc_addr = pc;
 249   _cb = CodeCache::find_blob(pc);
 250   address original_pc = CompiledMethod::get_deopt_original_pc(this);
 251   if (original_pc != NULL) {
 252     assert(original_pc == _pc, "expected original PC to be stored before patching");
 253     _deopt_state = is_deoptimized;
 254     // leave _pc as is
 255   } else {
 256     _deopt_state = not_deoptimized;
 257     _pc = pc;
 258   }
 259 }
 260 
 261 bool frame::is_interpreted_frame() const  {
 262   return Interpreter::contains(pc());
 263 }
 264 
 265 int frame::frame_size(RegisterMap* map) const {
 266   frame sender = this->sender(map);
 267   return sender.sp() - sp();
 268 }
 269 
 270 intptr_t* frame::entry_frame_argument_at(int offset) const {
 271   assert(is_entry_frame(), "entry frame expected");
 272   // convert offset to index to deal with tsi
 273   int index = (Interpreter::expr_offset_in_bytes(offset)/wordSize);
 274   // Entry frame's arguments are always in relation to unextended_sp()
 275   return &unextended_sp()[index];
 276 }
 277 
 278 // sender_sp
 279 intptr_t* frame::interpreter_frame_sender_sp() const {
 280   assert(is_interpreted_frame(), "interpreted frame expected");
 281   return (intptr_t*) at(interpreter_frame_sender_sp_offset);
 282 }
 283 
 284 void frame::set_interpreter_frame_sender_sp(intptr_t* sender_sp) {
 285   assert(is_interpreted_frame(), "interpreted frame expected");
 286   ptr_at_put(interpreter_frame_sender_sp_offset, (intptr_t) sender_sp);
 287 }
 288 
 289 
 290 // monitor elements
 291 
 292 BasicObjectLock* frame::interpreter_frame_monitor_begin() const {
 293   return (BasicObjectLock*) addr_at(interpreter_frame_monitor_block_bottom_offset);
 294 }
 295 
 296 BasicObjectLock* frame::interpreter_frame_monitor_end() const {
 297   BasicObjectLock* result = (BasicObjectLock*) *addr_at(interpreter_frame_monitor_block_top_offset);
 298   // make sure the pointer points inside the frame
 299   assert((intptr_t) fp() >  (intptr_t) result, "result must <  than frame pointer");
 300   assert((intptr_t) sp() <= (intptr_t) result, "result must >= than stack pointer");
 301   return result;
 302 }
 303 
 304 void frame::interpreter_frame_set_monitor_end(BasicObjectLock* value) {
 305   *((BasicObjectLock**)addr_at(interpreter_frame_monitor_block_top_offset)) = value;
 306 }
 307 
 308 
 309 // Used by template based interpreter deoptimization
 310 void frame::interpreter_frame_set_last_sp(intptr_t* sp) {
 311     *((intptr_t**)addr_at(interpreter_frame_last_sp_offset)) = sp;
 312 }
 313 
 314 
 315 frame frame::sender_for_entry_frame(RegisterMap* map) const {
 316   assert(map != NULL, "map must be set");
 317   // Java frame called from C; skip all C frames and return top C
 318   // frame of that chunk as the sender
 319   JavaFrameAnchor* jfa = entry_frame_call_wrapper()->anchor();
 320   assert(!entry_frame_is_first(), "next Java fp must be non zero");
 321   assert(jfa->last_Java_sp() > sp(), "must be above this frame on stack");
 322   map->clear();
 323   assert(map->include_argument_oops(), "should be set by clear");
 324   if (jfa->last_Java_pc() != NULL) {
 325     frame fr(jfa->last_Java_sp(), jfa->last_Java_fp(), jfa->last_Java_pc());
 326     return fr;
 327   }
 328   frame fr(jfa->last_Java_sp(), jfa->last_Java_fp());
 329   return fr;
 330 }
 331 
 332 //------------------------------------------------------------------------------
 333 // frame::verify_deopt_original_pc
 334 //
 335 // Verifies the calculated original PC of a deoptimization PC for the
 336 // given unextended SP.  The unextended SP might also be the saved SP
 337 // for MethodHandle call sites.
 338 #ifdef ASSERT
 339 void frame::verify_deopt_original_pc(CompiledMethod* nm, intptr_t* unextended_sp, bool is_method_handle_return) {
 340   frame fr;
 341 
 342   // This is ugly but it's better than to change {get,set}_original_pc
 343   // to take an SP value as argument.  And it's only a debugging
 344   // method anyway.
 345   fr._unextended_sp = unextended_sp;
 346 
 347   address original_pc = nm->get_original_pc(&fr);
 348   assert(nm->insts_contains_inclusive(original_pc),
 349          "original PC must be in the main code section of the the compiled method (or must be immediately following it)");
 350   assert(nm->is_method_handle_return(original_pc) == is_method_handle_return, "must be");
 351 }
 352 #endif
 353 
 354 //------------------------------------------------------------------------------
 355 // frame::adjust_unextended_sp
 356 void frame::adjust_unextended_sp() {
 357   // same as on x86
 358 
 359   // If we are returning to a compiled MethodHandle call site, the
 360   // saved_fp will in fact be a saved value of the unextended SP.  The
 361   // simplest way to tell whether we are returning to such a call site
 362   // is as follows:
 363 
 364   CompiledMethod* sender_cm = (_cb == NULL) ? NULL : _cb->as_compiled_method_or_null();
 365   if (sender_cm != NULL) {
 366     // If the sender PC is a deoptimization point, get the original
 367     // PC.  For MethodHandle call site the unextended_sp is stored in
 368     // saved_fp.
 369     if (sender_cm->is_deopt_mh_entry(_pc)) {
 370       DEBUG_ONLY(verify_deopt_mh_original_pc(sender_cm, _fp));
 371       _unextended_sp = _fp;
 372     }
 373     else if (sender_cm->is_deopt_entry(_pc)) {
 374       DEBUG_ONLY(verify_deopt_original_pc(sender_cm, _unextended_sp));
 375     }
 376     else if (sender_cm->is_method_handle_return(_pc)) {
 377       _unextended_sp = _fp;
 378     }
 379   }
 380 }
 381 
 382 //------------------------------------------------------------------------------
 383 // frame::update_map_with_saved_link
 384 void frame::update_map_with_saved_link(RegisterMap* map, intptr_t** link_addr) {
 385   // see x86 for comments
 386   map->set_location(FP->as_VMReg(), (address) link_addr);
 387 }
 388 
 389 frame frame::sender_for_interpreter_frame(RegisterMap* map) const {
 390   // SP is the raw SP from the sender after adapter or interpreter
 391   // extension.
 392   intptr_t* sender_sp = this->sender_sp();
 393 
 394   // This is the sp before any possible extension (adapter/locals).
 395   intptr_t* unextended_sp = interpreter_frame_sender_sp();
 396 
 397 #ifdef COMPILER2
 398   if (map->update_map()) {
 399     update_map_with_saved_link(map, (intptr_t**) addr_at(link_offset));
 400   }
 401 #endif // COMPILER2
 402 
 403   return frame(sender_sp, unextended_sp, link(), sender_pc());
 404 }
 405 
 406 frame frame::sender_for_compiled_frame(RegisterMap* map) const {
 407   assert(map != NULL, "map must be set");
 408 
 409   // frame owned by optimizing compiler
 410   assert(_cb->frame_size() >= 0, "must have non-zero frame size");
 411   intptr_t* sender_sp = unextended_sp() + _cb->frame_size();
 412   intptr_t* unextended_sp = sender_sp;
 413 
 414   address sender_pc = (address) *(sender_sp - sender_sp_offset + return_addr_offset);
 415 
 416   // This is the saved value of FP which may or may not really be an FP.
 417   // It is only an FP if the sender is an interpreter frame (or C1?).
 418   intptr_t** saved_fp_addr = (intptr_t**) (sender_sp - sender_sp_offset + link_offset);
 419 
 420   if (map->update_map()) {
 421     // Tell GC to use argument oopmaps for some runtime stubs that need it.
 422     // For C1, the runtime stub might not have oop maps, so set this flag
 423     // outside of update_register_map.
 424     map->set_include_argument_oops(_cb->caller_must_gc_arguments(map->thread()));
 425     if (_cb->oop_maps() != NULL) {
 426       OopMapSet::update_register_map(this, map);
 427     }
 428 
 429     // Since the prolog does the save and restore of FP there is no oopmap
 430     // for it so we must fill in its location as if there was an oopmap entry
 431     // since if our caller was compiled code there could be live jvm state in it.
 432     update_map_with_saved_link(map, saved_fp_addr);
 433   }
 434 
 435   assert(sender_sp != sp(), "must have changed");
 436   return frame(sender_sp, unextended_sp, *saved_fp_addr, sender_pc);
 437 }
 438 
 439 frame frame::sender(RegisterMap* map) const {
 440   // Default is we done have to follow them. The sender_for_xxx will
 441   // update it accordingly
 442   map->set_include_argument_oops(false);
 443 
 444   if (is_entry_frame())       return sender_for_entry_frame(map);
 445   if (is_interpreted_frame()) return sender_for_interpreter_frame(map);
 446   assert(_cb == CodeCache::find_blob(pc()),"Must be the same");
 447 
 448   if (_cb != NULL) {
 449     return sender_for_compiled_frame(map);
 450   }
 451 
 452   assert(false, "should not be called for a C frame");
 453   return frame();
 454 }
 455 
 456 bool frame::is_interpreted_frame_valid(JavaThread* thread) const {
 457   assert(is_interpreted_frame(), "Not an interpreted frame");
 458   // These are reasonable sanity checks
 459   if (fp() == 0 || (intptr_t(fp()) & (wordSize-1)) != 0) {
 460     return false;
 461   }
 462   if (sp() == 0 || (intptr_t(sp()) & (wordSize-1)) != 0) {
 463     return false;
 464   }
 465   if (fp() + interpreter_frame_initial_sp_offset < sp()) {
 466     return false;
 467   }
 468   // These are hacks to keep us out of trouble.
 469   // The problem with these is that they mask other problems
 470   if (fp() <= sp()) {        // this attempts to deal with unsigned comparison above
 471     return false;
 472   }
 473   // do some validation of frame elements
 474 
 475   // first the method
 476 
 477   Method* m = *interpreter_frame_method_addr();
 478 
 479   // validate the method we'd find in this potential sender
 480   if (!Method::is_valid_method(m)) return false;
 481 
 482   // stack frames shouldn't be much larger than max_stack elements
 483 
 484   if (fp() - sp() > 1024 + m->max_stack()*Interpreter::stackElementSize) {
 485     return false;
 486   }
 487 
 488   // validate bci/bcp
 489 
 490   address bcp = interpreter_frame_bcp();
 491   if (m->validate_bci_from_bcp(bcp) < 0) {
 492     return false;
 493   }
 494 
 495   // validate ConstantPoolCache*
 496   ConstantPoolCache* cp = *interpreter_frame_cache_addr();
 497   if (MetaspaceObj::is_valid(cp) == false) return false;
 498 
 499   // validate locals
 500 
 501   address locals =  (address) *interpreter_frame_locals_addr();
 502 
 503   if (locals > thread->stack_base() || locals < (address) fp()) return false;
 504 
 505   // We'd have to be pretty unlucky to be mislead at this point
 506 
 507   return true;
 508 }
 509 
 510 BasicType frame::interpreter_frame_result(oop* oop_result, jvalue* value_result) {
 511   assert(is_interpreted_frame(), "interpreted frame expected");
 512   Method* method = interpreter_frame_method();
 513   BasicType type = method->result_type();
 514 
 515   intptr_t* res_addr;
 516   if (method->is_native()) {
 517     // Prior to calling into the runtime to report the method_exit both of
 518     // the possible return value registers are saved.
 519     // Return value registers are pushed to the native stack
 520     res_addr = (intptr_t*)sp();
 521 #ifdef __ABI_HARD__
 522     // FP result is pushed onto a stack along with integer result registers
 523     if (type == T_FLOAT || type == T_DOUBLE) {
 524       res_addr += 2;
 525     }
 526 #endif // __ABI_HARD__
 527   } else {
 528     res_addr = (intptr_t*)interpreter_frame_tos_address();
 529   }
 530 
 531   switch (type) {
 532     case T_OBJECT  :
 533     case T_ARRAY   : {
 534       oop obj;
 535       if (method->is_native()) {
 536         obj = cast_to_oop(at(interpreter_frame_oop_temp_offset));
 537       } else {
 538         obj = *(oop*)res_addr;
 539       }
 540       assert(obj == NULL || Universe::heap()->is_in(obj), "sanity check");
 541       *oop_result = obj;
 542       break;
 543     }
 544     case T_BOOLEAN : value_result->z = *(jboolean*)res_addr; break;
 545     case T_BYTE    : value_result->b = *(jbyte*)res_addr; break;
 546     case T_CHAR    : value_result->c = *(jchar*)res_addr; break;
 547     case T_SHORT   : value_result->s = *(jshort*)res_addr; break;
 548     case T_INT     : value_result->i = *(jint*)res_addr; break;
 549     case T_LONG    : value_result->j = *(jlong*)res_addr; break;
 550     case T_FLOAT   : value_result->f = *(jfloat*)res_addr; break;
 551     case T_DOUBLE  : value_result->d = *(jdouble*)res_addr; break;
 552     case T_VOID    : /* Nothing to do */ break;
 553     default        : ShouldNotReachHere();
 554   }
 555 
 556   return type;
 557 }
 558 
 559 
 560 intptr_t* frame::interpreter_frame_tos_at(jint offset) const {
 561   int index = (Interpreter::expr_offset_in_bytes(offset)/wordSize);
 562   return &interpreter_frame_tos_address()[index];
 563 }
 564 
 565 #ifndef PRODUCT
 566 
 567 #define DESCRIBE_FP_OFFSET(name) \
 568   values.describe(frame_no, fp() + frame::name##_offset, #name)
 569 
 570 void frame::describe_pd(FrameValues& values, int frame_no) {
 571   if (is_interpreted_frame()) {
 572     DESCRIBE_FP_OFFSET(interpreter_frame_sender_sp);
 573     DESCRIBE_FP_OFFSET(interpreter_frame_last_sp);
 574     DESCRIBE_FP_OFFSET(interpreter_frame_method);
 575     DESCRIBE_FP_OFFSET(interpreter_frame_mdp);
 576     DESCRIBE_FP_OFFSET(interpreter_frame_cache);
 577     DESCRIBE_FP_OFFSET(interpreter_frame_locals);
 578     DESCRIBE_FP_OFFSET(interpreter_frame_bcp);
 579     DESCRIBE_FP_OFFSET(interpreter_frame_initial_sp);
 580   }
 581 }
 582 
 583 // This is a generic constructor which is only used by pns() in debug.cpp.
 584 frame::frame(void* sp, void* fp, void* pc) {
 585   init((intptr_t*)sp, (intptr_t*)fp, (address)pc);
 586 }
 587 
 588 void frame::pd_ps() {}
 589 #endif
 590 
 591 intptr_t *frame::initial_deoptimization_info() {
 592   // used to reset the saved FP
 593   return fp();
 594 }
 595 
 596 intptr_t* frame::real_fp() const {
 597   if (is_entry_frame()) {
 598     // Work-around: FP (currently) does not conform to the ABI for entry
 599     // frames (see generate_call_stub). Might be worth fixing as another CR.
 600     // Following code assumes (and asserts) this has not yet been fixed.
 601     assert(frame::entry_frame_call_wrapper_offset == 0, "adjust this code");
 602     intptr_t* new_fp = fp();
 603     new_fp += 5; // saved R0,R1,R2,R4,R10
 604 #ifndef __SOFTFP__
 605     new_fp += 8*2; // saved D8..D15
 606 #endif
 607     return new_fp;
 608   }
 609   if (_cb != NULL) {
 610     // use the frame size if valid
 611     int size = _cb->frame_size();
 612     if (size > 0) {
 613       return unextended_sp() + size;
 614     }
 615   }
 616   // else rely on fp()
 617   assert(! is_compiled_frame(), "unknown compiled frame size");
 618   return fp();
 619 }