1 /*
   2  * Copyright (c) 1998, 2018, Oracle and/or its affiliates. All rights reserved.
   3  * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
   4  *
   5  * This code is free software; you can redistribute it and/or modify it
   6  * under the terms of the GNU General Public License version 2 only, as
   7  * published by the Free Software Foundation.
   8  *
   9  * This code is distributed in the hope that it will be useful, but WITHOUT
  10  * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
  11  * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
  12  * version 2 for more details (a copy is included in the LICENSE file that
  13  * accompanied this code).
  14  *
  15  * You should have received a copy of the GNU General Public License version
  16  * 2 along with this work; if not, write to the Free Software Foundation,
  17  * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
  18  *
  19  * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
  20  * or visit www.oracle.com if you need additional information or have any
  21  * questions.
  22  *
  23  */
  24 
  25 #include "precompiled.hpp"
  26 #include "classfile/classFileStream.hpp"
  27 #include "classfile/javaClasses.hpp"
  28 #include "classfile/stackMapTable.hpp"
  29 #include "classfile/stackMapFrame.hpp"
  30 #include "classfile/stackMapTableFormat.hpp"
  31 #include "classfile/systemDictionary.hpp"
  32 #include "classfile/verifier.hpp"
  33 #include "classfile/vmSymbols.hpp"
  34 #include "interpreter/bytecodes.hpp"
  35 #include "interpreter/bytecodeStream.hpp"
  36 #include "memory/oopFactory.hpp"
  37 #include "memory/resourceArea.hpp"
  38 #include "oops/instanceKlass.hpp"
  39 #include "oops/oop.inline.hpp"
  40 #include "oops/typeArrayOop.hpp"
  41 #include "prims/jvm.h"
  42 #include "runtime/fieldDescriptor.hpp"
  43 #include "runtime/handles.inline.hpp"
  44 #include "runtime/interfaceSupport.hpp"
  45 #include "runtime/javaCalls.hpp"
  46 #include "runtime/orderAccess.inline.hpp"
  47 #include "runtime/os.hpp"
  48 #ifdef TARGET_ARCH_x86
  49 # include "bytes_x86.hpp"
  50 #endif
  51 #ifdef TARGET_ARCH_sparc
  52 # include "bytes_sparc.hpp"
  53 #endif
  54 #ifdef TARGET_ARCH_zero
  55 # include "bytes_zero.hpp"
  56 #endif
  57 #ifdef TARGET_ARCH_arm
  58 # include "bytes_arm.hpp"
  59 #endif
  60 #ifdef TARGET_ARCH_ppc
  61 # include "bytes_ppc.hpp"
  62 #endif
  63 #ifdef TARGET_ARCH_aarch32
  64 # include "bytes_aarch32.hpp"
  65 #endif
  66 
  67 #define NOFAILOVER_MAJOR_VERSION                       51
  68 #define NONZERO_PADDING_BYTES_IN_SWITCH_MAJOR_VERSION  51
  69 #define STATIC_METHOD_IN_INTERFACE_MAJOR_VERSION       52
  70 
  71 // Access to external entry for VerifyClassCodes - old byte code verifier
  72 
  73 extern "C" {
  74   typedef jboolean (*verify_byte_codes_fn_t)(JNIEnv *, jclass, char *, jint);
  75   typedef jboolean (*verify_byte_codes_fn_new_t)(JNIEnv *, jclass, char *, jint, jint);
  76 }
  77 
  78 static void* volatile _verify_byte_codes_fn = NULL;
  79 
  80 static volatile jint _is_new_verify_byte_codes_fn = (jint) true;
  81 
  82 static void* verify_byte_codes_fn() {
  83   if (_verify_byte_codes_fn == NULL) {
  84     void *lib_handle = os::native_java_library();
  85     void *func = os::dll_lookup(lib_handle, "VerifyClassCodesForMajorVersion");
  86     OrderAccess::release_store_ptr(&_verify_byte_codes_fn, func);
  87     if (func == NULL) {
  88       OrderAccess::release_store(&_is_new_verify_byte_codes_fn, false);
  89       func = os::dll_lookup(lib_handle, "VerifyClassCodes");
  90       OrderAccess::release_store_ptr(&_verify_byte_codes_fn, func);
  91     }
  92   }
  93   return (void*)_verify_byte_codes_fn;
  94 }
  95 
  96 
  97 // Methods in Verifier
  98 
  99 bool Verifier::should_verify_for(oop class_loader, bool should_verify_class) {
 100   return (class_loader == NULL || !should_verify_class) ?
 101     BytecodeVerificationLocal : BytecodeVerificationRemote;
 102 }
 103 
 104 bool Verifier::relax_verify_for(oop loader) {
 105   bool trusted = java_lang_ClassLoader::is_trusted_loader(loader);
 106   bool need_verify =
 107     // verifyAll
 108     (BytecodeVerificationLocal && BytecodeVerificationRemote) ||
 109     // verifyRemote
 110     (!BytecodeVerificationLocal && BytecodeVerificationRemote && !trusted);
 111   return !need_verify;
 112 }
 113 
 114 bool Verifier::verify(instanceKlassHandle klass, Verifier::Mode mode, bool should_verify_class, TRAPS) {
 115   HandleMark hm;
 116   ResourceMark rm(THREAD);
 117 
 118   Symbol* exception_name = NULL;
 119   const size_t message_buffer_len = klass->name()->utf8_length() + 1024;
 120   char* message_buffer = NEW_RESOURCE_ARRAY(char, message_buffer_len);
 121   char* exception_message = message_buffer;
 122 
 123   const char* klassName = klass->external_name();
 124   bool can_failover = FailOverToOldVerifier &&
 125       klass->major_version() < NOFAILOVER_MAJOR_VERSION;
 126 
 127   // If the class should be verified, first see if we can use the split
 128   // verifier.  If not, or if verification fails and FailOverToOldVerifier
 129   // is set, then call the inference verifier.
 130   if (is_eligible_for_verification(klass, should_verify_class)) {
 131     if (TraceClassInitialization) {
 132       tty->print_cr("Start class verification for: %s", klassName);
 133     }
 134     if (klass->major_version() >= STACKMAP_ATTRIBUTE_MAJOR_VERSION) {
 135       ClassVerifier split_verifier(klass, THREAD);
 136       split_verifier.verify_class(THREAD);
 137       exception_name = split_verifier.result();
 138       if (can_failover && !HAS_PENDING_EXCEPTION &&
 139           (exception_name == vmSymbols::java_lang_VerifyError() ||
 140            exception_name == vmSymbols::java_lang_ClassFormatError())) {
 141         if (TraceClassInitialization || VerboseVerification) {
 142           tty->print_cr(
 143             "Fail over class verification to old verifier for: %s", klassName);
 144         }
 145         exception_name = inference_verify(
 146           klass, message_buffer, message_buffer_len, THREAD);
 147       }
 148       if (exception_name != NULL) {
 149         exception_message = split_verifier.exception_message();
 150       }
 151     } else {
 152       exception_name = inference_verify(
 153           klass, message_buffer, message_buffer_len, THREAD);
 154     }
 155 
 156     if (TraceClassInitialization || VerboseVerification) {
 157       if (HAS_PENDING_EXCEPTION) {
 158         tty->print("Verification for %s has", klassName);
 159         tty->print_cr(" exception pending %s ",
 160           InstanceKlass::cast(PENDING_EXCEPTION->klass())->external_name());
 161       } else if (exception_name != NULL) {
 162         tty->print_cr("Verification for %s failed", klassName);
 163       }
 164       tty->print_cr("End class verification for: %s", klassName);
 165     }
 166   }
 167 
 168   if (HAS_PENDING_EXCEPTION) {
 169     return false; // use the existing exception
 170   } else if (exception_name == NULL) {
 171     return true; // verifcation succeeded
 172   } else { // VerifyError or ClassFormatError to be created and thrown
 173     ResourceMark rm(THREAD);
 174     instanceKlassHandle kls =
 175       SystemDictionary::resolve_or_fail(exception_name, true, CHECK_false);
 176     while (!kls.is_null()) {
 177       if (kls == klass) {
 178         // If the class being verified is the exception we're creating
 179         // or one of it's superclasses, we're in trouble and are going
 180         // to infinitely recurse when we try to initialize the exception.
 181         // So bail out here by throwing the preallocated VM error.
 182         THROW_OOP_(Universe::virtual_machine_error_instance(), false);
 183       }
 184       kls = kls->super();
 185     }
 186     message_buffer[message_buffer_len - 1] = '\0'; // just to be sure
 187     THROW_MSG_(exception_name, exception_message, false);
 188   }
 189 }
 190 
 191 bool Verifier::is_eligible_for_verification(instanceKlassHandle klass, bool should_verify_class) {
 192   Symbol* name = klass->name();
 193   Klass* refl_magic_klass = SystemDictionary::reflect_MagicAccessorImpl_klass();
 194 
 195   bool is_reflect = refl_magic_klass != NULL && klass->is_subtype_of(refl_magic_klass);
 196 
 197   return (should_verify_for(klass->class_loader(), should_verify_class) &&
 198     // return if the class is a bootstrapping class
 199     // or defineClass specified not to verify by default (flags override passed arg)
 200     // We need to skip the following four for bootstraping
 201     name != vmSymbols::java_lang_Object() &&
 202     name != vmSymbols::java_lang_Class() &&
 203     name != vmSymbols::java_lang_String() &&
 204     name != vmSymbols::java_lang_Throwable() &&
 205 
 206     // Can not verify the bytecodes for shared classes because they have
 207     // already been rewritten to contain constant pool cache indices,
 208     // which the verifier can't understand.
 209     // Shared classes shouldn't have stackmaps either.
 210     !klass()->is_shared() &&
 211 
 212     // As of the fix for 4486457 we disable verification for all of the
 213     // dynamically-generated bytecodes associated with the 1.4
 214     // reflection implementation, not just those associated with
 215     // sun/reflect/SerializationConstructorAccessor.
 216     // NOTE: this is called too early in the bootstrapping process to be
 217     // guarded by Universe::is_gte_jdk14x_version()/UseNewReflection.
 218     // Also for lambda generated code, gte jdk8
 219     (!is_reflect || VerifyReflectionBytecodes));
 220 }
 221 
 222 Symbol* Verifier::inference_verify(
 223     instanceKlassHandle klass, char* message, size_t message_len, TRAPS) {
 224   JavaThread* thread = (JavaThread*)THREAD;
 225   JNIEnv *env = thread->jni_environment();
 226 
 227   void* verify_func = verify_byte_codes_fn();
 228 
 229   if (verify_func == NULL) {
 230     jio_snprintf(message, message_len, "Could not link verifier");
 231     return vmSymbols::java_lang_VerifyError();
 232   }
 233 
 234   ResourceMark rm(THREAD);
 235   if (VerboseVerification) {
 236     tty->print_cr("Verifying class %s with old format", klass->external_name());
 237   }
 238 
 239   jclass cls = (jclass) JNIHandles::make_local(env, klass->java_mirror());
 240   jint result;
 241 
 242   {
 243     HandleMark hm(thread);
 244     ThreadToNativeFromVM ttn(thread);
 245     // ThreadToNativeFromVM takes care of changing thread_state, so safepoint
 246     // code knows that we have left the VM
 247 
 248     if (_is_new_verify_byte_codes_fn) {
 249       verify_byte_codes_fn_new_t func =
 250         CAST_TO_FN_PTR(verify_byte_codes_fn_new_t, verify_func);
 251       result = (*func)(env, cls, message, (int)message_len,
 252           klass->major_version());
 253     } else {
 254       verify_byte_codes_fn_t func =
 255         CAST_TO_FN_PTR(verify_byte_codes_fn_t, verify_func);
 256       result = (*func)(env, cls, message, (int)message_len);
 257     }
 258   }
 259 
 260   JNIHandles::destroy_local(cls);
 261 
 262   // These numbers are chosen so that VerifyClassCodes interface doesn't need
 263   // to be changed (still return jboolean (unsigned char)), and result is
 264   // 1 when verification is passed.
 265   if (result == 0) {
 266     return vmSymbols::java_lang_VerifyError();
 267   } else if (result == 1) {
 268     return NULL; // verified.
 269   } else if (result == 2) {
 270     THROW_MSG_(vmSymbols::java_lang_OutOfMemoryError(), message, NULL);
 271   } else if (result == 3) {
 272     return vmSymbols::java_lang_ClassFormatError();
 273   } else {
 274     ShouldNotReachHere();
 275     return NULL;
 276   }
 277 }
 278 
 279 TypeOrigin TypeOrigin::null() {
 280   return TypeOrigin();
 281 }
 282 TypeOrigin TypeOrigin::local(u2 index, StackMapFrame* frame) {
 283   assert(frame != NULL, "Must have a frame");
 284   return TypeOrigin(CF_LOCALS, index, StackMapFrame::copy(frame),
 285      frame->local_at(index));
 286 }
 287 TypeOrigin TypeOrigin::stack(u2 index, StackMapFrame* frame) {
 288   assert(frame != NULL, "Must have a frame");
 289   return TypeOrigin(CF_STACK, index, StackMapFrame::copy(frame),
 290       frame->stack_at(index));
 291 }
 292 TypeOrigin TypeOrigin::sm_local(u2 index, StackMapFrame* frame) {
 293   assert(frame != NULL, "Must have a frame");
 294   return TypeOrigin(SM_LOCALS, index, StackMapFrame::copy(frame),
 295       frame->local_at(index));
 296 }
 297 TypeOrigin TypeOrigin::sm_stack(u2 index, StackMapFrame* frame) {
 298   assert(frame != NULL, "Must have a frame");
 299   return TypeOrigin(SM_STACK, index, StackMapFrame::copy(frame),
 300       frame->stack_at(index));
 301 }
 302 TypeOrigin TypeOrigin::bad_index(u2 index) {
 303   return TypeOrigin(BAD_INDEX, index, NULL, VerificationType::bogus_type());
 304 }
 305 TypeOrigin TypeOrigin::cp(u2 index, VerificationType vt) {
 306   return TypeOrigin(CONST_POOL, index, NULL, vt);
 307 }
 308 TypeOrigin TypeOrigin::signature(VerificationType vt) {
 309   return TypeOrigin(SIG, 0, NULL, vt);
 310 }
 311 TypeOrigin TypeOrigin::implicit(VerificationType t) {
 312   return TypeOrigin(IMPLICIT, 0, NULL, t);
 313 }
 314 TypeOrigin TypeOrigin::frame(StackMapFrame* frame) {
 315   return TypeOrigin(FRAME_ONLY, 0, StackMapFrame::copy(frame),
 316                     VerificationType::bogus_type());
 317 }
 318 
 319 void TypeOrigin::reset_frame() {
 320   if (_frame != NULL) {
 321     _frame->restore();
 322   }
 323 }
 324 
 325 void TypeOrigin::details(outputStream* ss) const {
 326   _type.print_on(ss);
 327   switch (_origin) {
 328     case CF_LOCALS:
 329       ss->print(" (current frame, locals[%d])", _index);
 330       break;
 331     case CF_STACK:
 332       ss->print(" (current frame, stack[%d])", _index);
 333       break;
 334     case SM_LOCALS:
 335       ss->print(" (stack map, locals[%d])", _index);
 336       break;
 337     case SM_STACK:
 338       ss->print(" (stack map, stack[%d])", _index);
 339       break;
 340     case CONST_POOL:
 341       ss->print(" (constant pool %d)", _index);
 342       break;
 343     case SIG:
 344       ss->print(" (from method signature)");
 345       break;
 346     case IMPLICIT:
 347     case FRAME_ONLY:
 348     case NONE:
 349     default:
 350       ;
 351   }
 352 }
 353 
 354 #ifdef ASSERT
 355 void TypeOrigin::print_on(outputStream* str) const {
 356   str->print("{%d,%d,%p:", _origin, _index, _frame);
 357   if (_frame != NULL) {
 358     _frame->print_on(str);
 359   } else {
 360     str->print("null");
 361   }
 362   str->print(",");
 363   _type.print_on(str);
 364   str->print("}");
 365 }
 366 #endif
 367 
 368 void ErrorContext::details(outputStream* ss, const Method* method) const {
 369   if (is_valid()) {
 370     ss->cr();
 371     ss->print_cr("Exception Details:");
 372     location_details(ss, method);
 373     reason_details(ss);
 374     frame_details(ss);
 375     bytecode_details(ss, method);
 376     handler_details(ss, method);
 377     stackmap_details(ss, method);
 378   }
 379 }
 380 
 381 void ErrorContext::reason_details(outputStream* ss) const {
 382   streamIndentor si(ss);
 383   ss->indent().print_cr("Reason:");
 384   streamIndentor si2(ss);
 385   ss->indent().print("%s", "");
 386   switch (_fault) {
 387     case INVALID_BYTECODE:
 388       ss->print("Error exists in the bytecode");
 389       break;
 390     case WRONG_TYPE:
 391       if (_expected.is_valid()) {
 392         ss->print("Type ");
 393         _type.details(ss);
 394         ss->print(" is not assignable to ");
 395         _expected.details(ss);
 396       } else {
 397         ss->print("Invalid type: ");
 398         _type.details(ss);
 399       }
 400       break;
 401     case FLAGS_MISMATCH:
 402       if (_expected.is_valid()) {
 403         ss->print("Current frame's flags are not assignable "
 404                   "to stack map frame's.");
 405       } else {
 406         ss->print("Current frame's flags are invalid in this context.");
 407       }
 408       break;
 409     case BAD_CP_INDEX:
 410       ss->print("Constant pool index %d is invalid", _type.index());
 411       break;
 412     case BAD_LOCAL_INDEX:
 413       ss->print("Local index %d is invalid", _type.index());
 414       break;
 415     case LOCALS_SIZE_MISMATCH:
 416       ss->print("Current frame's local size doesn't match stackmap.");
 417       break;
 418     case STACK_SIZE_MISMATCH:
 419       ss->print("Current frame's stack size doesn't match stackmap.");
 420       break;
 421     case STACK_OVERFLOW:
 422       ss->print("Exceeded max stack size.");
 423       break;
 424     case STACK_UNDERFLOW:
 425       ss->print("Attempt to pop empty stack.");
 426       break;
 427     case MISSING_STACKMAP:
 428       ss->print("Expected stackmap frame at this location.");
 429       break;
 430     case BAD_STACKMAP:
 431       ss->print("Invalid stackmap specification.");
 432       break;
 433     case UNKNOWN:
 434     default:
 435       ShouldNotReachHere();
 436       ss->print_cr("Unknown");
 437   }
 438   ss->cr();
 439 }
 440 
 441 void ErrorContext::location_details(outputStream* ss, const Method* method) const {
 442   if (_bci != -1 && method != NULL) {
 443     streamIndentor si(ss);
 444     const char* bytecode_name = "<invalid>";
 445     if (method->validate_bci_from_bcx(_bci) != -1) {
 446       Bytecodes::Code code = Bytecodes::code_or_bp_at(method->bcp_from(_bci));
 447       if (Bytecodes::is_defined(code)) {
 448           bytecode_name = Bytecodes::name(code);
 449       } else {
 450           bytecode_name = "<illegal>";
 451       }
 452     }
 453     InstanceKlass* ik = method->method_holder();
 454     ss->indent().print_cr("Location:");
 455     streamIndentor si2(ss);
 456     ss->indent().print_cr("%s.%s%s @%d: %s",
 457         ik->name()->as_C_string(), method->name()->as_C_string(),
 458         method->signature()->as_C_string(), _bci, bytecode_name);
 459   }
 460 }
 461 
 462 void ErrorContext::frame_details(outputStream* ss) const {
 463   streamIndentor si(ss);
 464   if (_type.is_valid() && _type.frame() != NULL) {
 465     ss->indent().print_cr("Current Frame:");
 466     streamIndentor si2(ss);
 467     _type.frame()->print_on(ss);
 468   }
 469   if (_expected.is_valid() && _expected.frame() != NULL) {
 470     ss->indent().print_cr("Stackmap Frame:");
 471     streamIndentor si2(ss);
 472     _expected.frame()->print_on(ss);
 473   }
 474 }
 475 
 476 void ErrorContext::bytecode_details(outputStream* ss, const Method* method) const {
 477   if (method != NULL) {
 478     streamIndentor si(ss);
 479     ss->indent().print_cr("Bytecode:");
 480     streamIndentor si2(ss);
 481     ss->print_data(method->code_base(), method->code_size(), false);
 482   }
 483 }
 484 
 485 void ErrorContext::handler_details(outputStream* ss, const Method* method) const {
 486   if (method != NULL) {
 487     streamIndentor si(ss);
 488     ExceptionTable table(method);
 489     if (table.length() > 0) {
 490       ss->indent().print_cr("Exception Handler Table:");
 491       streamIndentor si2(ss);
 492       for (int i = 0; i < table.length(); ++i) {
 493         ss->indent().print_cr("bci [%d, %d] => handler: %d", table.start_pc(i),
 494             table.end_pc(i), table.handler_pc(i));
 495       }
 496     }
 497   }
 498 }
 499 
 500 void ErrorContext::stackmap_details(outputStream* ss, const Method* method) const {
 501   if (method != NULL && method->has_stackmap_table()) {
 502     streamIndentor si(ss);
 503     ss->indent().print_cr("Stackmap Table:");
 504     Array<u1>* data = method->stackmap_data();
 505     stack_map_table* sm_table =
 506         stack_map_table::at((address)data->adr_at(0));
 507     stack_map_frame* sm_frame = sm_table->entries();
 508     streamIndentor si2(ss);
 509     int current_offset = -1;
 510     address end_of_sm_table = (address)sm_table + method->stackmap_data()->length();
 511     for (u2 i = 0; i < sm_table->number_of_entries(); ++i) {
 512       ss->indent();
 513       if (!sm_frame->verify((address)sm_frame, end_of_sm_table)) {
 514         sm_frame->print_truncated(ss, current_offset);
 515         return;
 516       }
 517       sm_frame->print_on(ss, current_offset);
 518       ss->cr();
 519       current_offset += sm_frame->offset_delta();
 520       sm_frame = sm_frame->next();
 521     }
 522   }
 523 }
 524 
 525 // Methods in ClassVerifier
 526 
 527 ClassVerifier::ClassVerifier(
 528     instanceKlassHandle klass, TRAPS)
 529     : _thread(THREAD), _exception_type(NULL), _message(NULL), _klass(klass) {
 530   _this_type = VerificationType::reference_type(klass->name());
 531   // Create list to hold symbols in reference area.
 532   _symbols = new GrowableArray<Symbol*>(100, 0, NULL);
 533 }
 534 
 535 ClassVerifier::~ClassVerifier() {
 536   // Decrement the reference count for any symbols created.
 537   for (int i = 0; i < _symbols->length(); i++) {
 538     Symbol* s = _symbols->at(i);
 539     s->decrement_refcount();
 540   }
 541 }
 542 
 543 VerificationType ClassVerifier::object_type() const {
 544   return VerificationType::reference_type(vmSymbols::java_lang_Object());
 545 }
 546 
 547 TypeOrigin ClassVerifier::ref_ctx(const char* sig, TRAPS) {
 548   VerificationType vt = VerificationType::reference_type(
 549       create_temporary_symbol(sig, (int)strlen(sig), THREAD));
 550   return TypeOrigin::implicit(vt);
 551 }
 552 
 553 void ClassVerifier::verify_class(TRAPS) {
 554   if (VerboseVerification) {
 555     tty->print_cr("Verifying class %s with new format",
 556       _klass->external_name());
 557   }
 558 
 559   Array<Method*>* methods = _klass->methods();
 560   int num_methods = methods->length();
 561 
 562   for (int index = 0; index < num_methods; index++) {
 563     // Check for recursive re-verification before each method.
 564     if (was_recursively_verified())  return;
 565 
 566     Method* m = methods->at(index);
 567     if (m->is_native() || m->is_abstract() || m->is_overpass()) {
 568       // If m is native or abstract, skip it.  It is checked in class file
 569       // parser that methods do not override a final method.  Overpass methods
 570       // are trusted since the VM generates them.
 571       continue;
 572     }
 573     verify_method(methodHandle(THREAD, m), CHECK_VERIFY(this));
 574   }
 575 
 576   if (VerboseVerification || TraceClassInitialization) {
 577     if (was_recursively_verified())
 578       tty->print_cr("Recursive verification detected for: %s",
 579           _klass->external_name());
 580   }
 581 }
 582 
 583 void ClassVerifier::verify_method(methodHandle m, TRAPS) {
 584   HandleMark hm(THREAD);
 585   _method = m;   // initialize _method
 586   if (VerboseVerification) {
 587     tty->print_cr("Verifying method %s", m->name_and_sig_as_C_string());
 588   }
 589 
 590 // For clang, the only good constant format string is a literal constant format string.
 591 #define bad_type_msg "Bad type on operand stack in %s"
 592 
 593   int32_t max_stack = m->verifier_max_stack();
 594   int32_t max_locals = m->max_locals();
 595   constantPoolHandle cp(THREAD, m->constants());
 596 
 597   if (!SignatureVerifier::is_valid_method_signature(m->signature())) {
 598     class_format_error("Invalid method signature");
 599     return;
 600   }
 601 
 602   // Initial stack map frame: offset is 0, stack is initially empty.
 603   StackMapFrame current_frame(max_locals, max_stack, this);
 604   // Set initial locals
 605   VerificationType return_type = current_frame.set_locals_from_arg(
 606     m, current_type(), CHECK_VERIFY(this));
 607 
 608   int32_t stackmap_index = 0; // index to the stackmap array
 609 
 610   u4 code_length = m->code_size();
 611 
 612   // Scan the bytecode and map each instruction's start offset to a number.
 613   char* code_data = generate_code_data(m, code_length, CHECK_VERIFY(this));
 614 
 615   int ex_min = code_length;
 616   int ex_max = -1;
 617   // Look through each item on the exception table. Each of the fields must refer
 618   // to a legal instruction.
 619   verify_exception_handler_table(
 620     code_length, code_data, ex_min, ex_max, CHECK_VERIFY(this));
 621 
 622   // Look through each entry on the local variable table and make sure
 623   // its range of code array offsets is valid. (4169817)
 624   if (m->has_localvariable_table()) {
 625     verify_local_variable_table(code_length, code_data, CHECK_VERIFY(this));
 626   }
 627 
 628   Array<u1>* stackmap_data = m->stackmap_data();
 629   StackMapStream stream(stackmap_data);
 630   StackMapReader reader(this, &stream, code_data, code_length, THREAD);
 631   StackMapTable stackmap_table(&reader, &current_frame, max_locals, max_stack,
 632                                code_data, code_length, CHECK_VERIFY(this));
 633 
 634   if (VerboseVerification) {
 635     stackmap_table.print_on(tty);
 636   }
 637 
 638   RawBytecodeStream bcs(m);
 639 
 640   // Scan the byte code linearly from the start to the end
 641   bool no_control_flow = false; // Set to true when there is no direct control
 642                                 // flow from current instruction to the next
 643                                 // instruction in sequence
 644 
 645   Bytecodes::Code opcode;
 646   while (!bcs.is_last_bytecode()) {
 647     // Check for recursive re-verification before each bytecode.
 648     if (was_recursively_verified())  return;
 649 
 650     opcode = bcs.raw_next();
 651     u2 bci = bcs.bci();
 652 
 653     // Set current frame's offset to bci
 654     current_frame.set_offset(bci);
 655     current_frame.set_mark();
 656 
 657     // Make sure every offset in stackmap table point to the beginning to
 658     // an instruction. Match current_frame to stackmap_table entry with
 659     // the same offset if exists.
 660     stackmap_index = verify_stackmap_table(
 661       stackmap_index, bci, &current_frame, &stackmap_table,
 662       no_control_flow, CHECK_VERIFY(this));
 663 
 664 
 665     bool this_uninit = false;  // Set to true when invokespecial <init> initialized 'this'
 666     bool verified_exc_handlers = false;
 667 
 668     // Merge with the next instruction
 669     {
 670       u2 index;
 671       int target;
 672       VerificationType type, type2;
 673       VerificationType atype;
 674 
 675 #ifndef PRODUCT
 676       if (VerboseVerification) {
 677         current_frame.print_on(tty);
 678         tty->print_cr("offset = %d,  opcode = %s", bci, Bytecodes::name(opcode));
 679       }
 680 #endif
 681 
 682       // Make sure wide instruction is in correct format
 683       if (bcs.is_wide()) {
 684         if (opcode != Bytecodes::_iinc   && opcode != Bytecodes::_iload  &&
 685             opcode != Bytecodes::_aload  && opcode != Bytecodes::_lload  &&
 686             opcode != Bytecodes::_istore && opcode != Bytecodes::_astore &&
 687             opcode != Bytecodes::_lstore && opcode != Bytecodes::_fload  &&
 688             opcode != Bytecodes::_dload  && opcode != Bytecodes::_fstore &&
 689             opcode != Bytecodes::_dstore) {
 690           /* Unreachable?  RawBytecodeStream's raw_next() returns 'illegal'
 691            * if we encounter a wide instruction that modifies an invalid
 692            * opcode (not one of the ones listed above) */
 693           verify_error(ErrorContext::bad_code(bci), "Bad wide instruction");
 694           return;
 695         }
 696       }
 697 
 698       // Look for possible jump target in exception handlers and see if it
 699       // matches current_frame.  Do this check here for astore*, dstore*,
 700       // fstore*, istore*, and lstore* opcodes because they can change the type
 701       // state by adding a local.  JVM Spec says that the incoming type state
 702       // should be used for this check.  So, do the check here before a possible
 703       // local is added to the type state.
 704       if (Bytecodes::is_store_into_local(opcode) && bci >= ex_min && bci < ex_max) {
 705         verify_exception_handler_targets(
 706           bci, this_uninit, &current_frame, &stackmap_table, CHECK_VERIFY(this));
 707         verified_exc_handlers = true;
 708       }
 709 
 710       switch (opcode) {
 711         case Bytecodes::_nop :
 712           no_control_flow = false; break;
 713         case Bytecodes::_aconst_null :
 714           current_frame.push_stack(
 715             VerificationType::null_type(), CHECK_VERIFY(this));
 716           no_control_flow = false; break;
 717         case Bytecodes::_iconst_m1 :
 718         case Bytecodes::_iconst_0 :
 719         case Bytecodes::_iconst_1 :
 720         case Bytecodes::_iconst_2 :
 721         case Bytecodes::_iconst_3 :
 722         case Bytecodes::_iconst_4 :
 723         case Bytecodes::_iconst_5 :
 724           current_frame.push_stack(
 725             VerificationType::integer_type(), CHECK_VERIFY(this));
 726           no_control_flow = false; break;
 727         case Bytecodes::_lconst_0 :
 728         case Bytecodes::_lconst_1 :
 729           current_frame.push_stack_2(
 730             VerificationType::long_type(),
 731             VerificationType::long2_type(), CHECK_VERIFY(this));
 732           no_control_flow = false; break;
 733         case Bytecodes::_fconst_0 :
 734         case Bytecodes::_fconst_1 :
 735         case Bytecodes::_fconst_2 :
 736           current_frame.push_stack(
 737             VerificationType::float_type(), CHECK_VERIFY(this));
 738           no_control_flow = false; break;
 739         case Bytecodes::_dconst_0 :
 740         case Bytecodes::_dconst_1 :
 741           current_frame.push_stack_2(
 742             VerificationType::double_type(),
 743             VerificationType::double2_type(), CHECK_VERIFY(this));
 744           no_control_flow = false; break;
 745         case Bytecodes::_sipush :
 746         case Bytecodes::_bipush :
 747           current_frame.push_stack(
 748             VerificationType::integer_type(), CHECK_VERIFY(this));
 749           no_control_flow = false; break;
 750         case Bytecodes::_ldc :
 751           verify_ldc(
 752             opcode, bcs.get_index_u1(), &current_frame,
 753             cp, bci, CHECK_VERIFY(this));
 754           no_control_flow = false; break;
 755         case Bytecodes::_ldc_w :
 756         case Bytecodes::_ldc2_w :
 757           verify_ldc(
 758             opcode, bcs.get_index_u2(), &current_frame,
 759             cp, bci, CHECK_VERIFY(this));
 760           no_control_flow = false; break;
 761         case Bytecodes::_iload :
 762           verify_iload(bcs.get_index(), &current_frame, CHECK_VERIFY(this));
 763           no_control_flow = false; break;
 764         case Bytecodes::_iload_0 :
 765         case Bytecodes::_iload_1 :
 766         case Bytecodes::_iload_2 :
 767         case Bytecodes::_iload_3 :
 768           index = opcode - Bytecodes::_iload_0;
 769           verify_iload(index, &current_frame, CHECK_VERIFY(this));
 770           no_control_flow = false; break;
 771         case Bytecodes::_lload :
 772           verify_lload(bcs.get_index(), &current_frame, CHECK_VERIFY(this));
 773           no_control_flow = false; break;
 774         case Bytecodes::_lload_0 :
 775         case Bytecodes::_lload_1 :
 776         case Bytecodes::_lload_2 :
 777         case Bytecodes::_lload_3 :
 778           index = opcode - Bytecodes::_lload_0;
 779           verify_lload(index, &current_frame, CHECK_VERIFY(this));
 780           no_control_flow = false; break;
 781         case Bytecodes::_fload :
 782           verify_fload(bcs.get_index(), &current_frame, CHECK_VERIFY(this));
 783           no_control_flow = false; break;
 784         case Bytecodes::_fload_0 :
 785         case Bytecodes::_fload_1 :
 786         case Bytecodes::_fload_2 :
 787         case Bytecodes::_fload_3 :
 788           index = opcode - Bytecodes::_fload_0;
 789           verify_fload(index, &current_frame, CHECK_VERIFY(this));
 790           no_control_flow = false; break;
 791         case Bytecodes::_dload :
 792           verify_dload(bcs.get_index(), &current_frame, CHECK_VERIFY(this));
 793           no_control_flow = false; break;
 794         case Bytecodes::_dload_0 :
 795         case Bytecodes::_dload_1 :
 796         case Bytecodes::_dload_2 :
 797         case Bytecodes::_dload_3 :
 798           index = opcode - Bytecodes::_dload_0;
 799           verify_dload(index, &current_frame, CHECK_VERIFY(this));
 800           no_control_flow = false; break;
 801         case Bytecodes::_aload :
 802           verify_aload(bcs.get_index(), &current_frame, CHECK_VERIFY(this));
 803           no_control_flow = false; break;
 804         case Bytecodes::_aload_0 :
 805         case Bytecodes::_aload_1 :
 806         case Bytecodes::_aload_2 :
 807         case Bytecodes::_aload_3 :
 808           index = opcode - Bytecodes::_aload_0;
 809           verify_aload(index, &current_frame, CHECK_VERIFY(this));
 810           no_control_flow = false; break;
 811         case Bytecodes::_iaload :
 812           type = current_frame.pop_stack(
 813             VerificationType::integer_type(), CHECK_VERIFY(this));
 814           atype = current_frame.pop_stack(
 815             VerificationType::reference_check(), CHECK_VERIFY(this));
 816           if (!atype.is_int_array()) {
 817             verify_error(ErrorContext::bad_type(bci,
 818                 current_frame.stack_top_ctx(), ref_ctx("[I", THREAD)),
 819                 bad_type_msg, "iaload");
 820             return;
 821           }
 822           current_frame.push_stack(
 823             VerificationType::integer_type(), CHECK_VERIFY(this));
 824           no_control_flow = false; break;
 825         case Bytecodes::_baload :
 826           type = current_frame.pop_stack(
 827             VerificationType::integer_type(), CHECK_VERIFY(this));
 828           atype = current_frame.pop_stack(
 829             VerificationType::reference_check(), CHECK_VERIFY(this));
 830           if (!atype.is_bool_array() && !atype.is_byte_array()) {
 831             verify_error(
 832                 ErrorContext::bad_type(bci, current_frame.stack_top_ctx()),
 833                 bad_type_msg, "baload");
 834             return;
 835           }
 836           current_frame.push_stack(
 837             VerificationType::integer_type(), CHECK_VERIFY(this));
 838           no_control_flow = false; break;
 839         case Bytecodes::_caload :
 840           type = current_frame.pop_stack(
 841             VerificationType::integer_type(), CHECK_VERIFY(this));
 842           atype = current_frame.pop_stack(
 843             VerificationType::reference_check(), CHECK_VERIFY(this));
 844           if (!atype.is_char_array()) {
 845             verify_error(ErrorContext::bad_type(bci,
 846                 current_frame.stack_top_ctx(), ref_ctx("[C", THREAD)),
 847                 bad_type_msg, "caload");
 848             return;
 849           }
 850           current_frame.push_stack(
 851             VerificationType::integer_type(), CHECK_VERIFY(this));
 852           no_control_flow = false; break;
 853         case Bytecodes::_saload :
 854           type = current_frame.pop_stack(
 855             VerificationType::integer_type(), CHECK_VERIFY(this));
 856           atype = current_frame.pop_stack(
 857             VerificationType::reference_check(), CHECK_VERIFY(this));
 858           if (!atype.is_short_array()) {
 859             verify_error(ErrorContext::bad_type(bci,
 860                 current_frame.stack_top_ctx(), ref_ctx("[S", THREAD)),
 861                 bad_type_msg, "saload");
 862             return;
 863           }
 864           current_frame.push_stack(
 865             VerificationType::integer_type(), CHECK_VERIFY(this));
 866           no_control_flow = false; break;
 867         case Bytecodes::_laload :
 868           type = current_frame.pop_stack(
 869             VerificationType::integer_type(), CHECK_VERIFY(this));
 870           atype = current_frame.pop_stack(
 871             VerificationType::reference_check(), CHECK_VERIFY(this));
 872           if (!atype.is_long_array()) {
 873             verify_error(ErrorContext::bad_type(bci,
 874                 current_frame.stack_top_ctx(), ref_ctx("[J", THREAD)),
 875                 bad_type_msg, "laload");
 876             return;
 877           }
 878           current_frame.push_stack_2(
 879             VerificationType::long_type(),
 880             VerificationType::long2_type(), CHECK_VERIFY(this));
 881           no_control_flow = false; break;
 882         case Bytecodes::_faload :
 883           type = current_frame.pop_stack(
 884             VerificationType::integer_type(), CHECK_VERIFY(this));
 885           atype = current_frame.pop_stack(
 886             VerificationType::reference_check(), CHECK_VERIFY(this));
 887           if (!atype.is_float_array()) {
 888             verify_error(ErrorContext::bad_type(bci,
 889                 current_frame.stack_top_ctx(), ref_ctx("[F", THREAD)),
 890                 bad_type_msg, "faload");
 891             return;
 892           }
 893           current_frame.push_stack(
 894             VerificationType::float_type(), CHECK_VERIFY(this));
 895           no_control_flow = false; break;
 896         case Bytecodes::_daload :
 897           type = current_frame.pop_stack(
 898             VerificationType::integer_type(), CHECK_VERIFY(this));
 899           atype = current_frame.pop_stack(
 900             VerificationType::reference_check(), CHECK_VERIFY(this));
 901           if (!atype.is_double_array()) {
 902             verify_error(ErrorContext::bad_type(bci,
 903                 current_frame.stack_top_ctx(), ref_ctx("[D", THREAD)),
 904                 bad_type_msg, "daload");
 905             return;
 906           }
 907           current_frame.push_stack_2(
 908             VerificationType::double_type(),
 909             VerificationType::double2_type(), CHECK_VERIFY(this));
 910           no_control_flow = false; break;
 911         case Bytecodes::_aaload : {
 912           type = current_frame.pop_stack(
 913             VerificationType::integer_type(), CHECK_VERIFY(this));
 914           atype = current_frame.pop_stack(
 915             VerificationType::reference_check(), CHECK_VERIFY(this));
 916           if (!atype.is_reference_array()) {
 917             verify_error(ErrorContext::bad_type(bci,
 918                 current_frame.stack_top_ctx(),
 919                 TypeOrigin::implicit(VerificationType::reference_check())),
 920                 bad_type_msg, "aaload");
 921             return;
 922           }
 923           if (atype.is_null()) {
 924             current_frame.push_stack(
 925               VerificationType::null_type(), CHECK_VERIFY(this));
 926           } else {
 927             VerificationType component =
 928               atype.get_component(this, CHECK_VERIFY(this));
 929             current_frame.push_stack(component, CHECK_VERIFY(this));
 930           }
 931           no_control_flow = false; break;
 932         }
 933         case Bytecodes::_istore :
 934           verify_istore(bcs.get_index(), &current_frame, CHECK_VERIFY(this));
 935           no_control_flow = false; break;
 936         case Bytecodes::_istore_0 :
 937         case Bytecodes::_istore_1 :
 938         case Bytecodes::_istore_2 :
 939         case Bytecodes::_istore_3 :
 940           index = opcode - Bytecodes::_istore_0;
 941           verify_istore(index, &current_frame, CHECK_VERIFY(this));
 942           no_control_flow = false; break;
 943         case Bytecodes::_lstore :
 944           verify_lstore(bcs.get_index(), &current_frame, CHECK_VERIFY(this));
 945           no_control_flow = false; break;
 946         case Bytecodes::_lstore_0 :
 947         case Bytecodes::_lstore_1 :
 948         case Bytecodes::_lstore_2 :
 949         case Bytecodes::_lstore_3 :
 950           index = opcode - Bytecodes::_lstore_0;
 951           verify_lstore(index, &current_frame, CHECK_VERIFY(this));
 952           no_control_flow = false; break;
 953         case Bytecodes::_fstore :
 954           verify_fstore(bcs.get_index(), &current_frame, CHECK_VERIFY(this));
 955           no_control_flow = false; break;
 956         case Bytecodes::_fstore_0 :
 957         case Bytecodes::_fstore_1 :
 958         case Bytecodes::_fstore_2 :
 959         case Bytecodes::_fstore_3 :
 960           index = opcode - Bytecodes::_fstore_0;
 961           verify_fstore(index, &current_frame, CHECK_VERIFY(this));
 962           no_control_flow = false; break;
 963         case Bytecodes::_dstore :
 964           verify_dstore(bcs.get_index(), &current_frame, CHECK_VERIFY(this));
 965           no_control_flow = false; break;
 966         case Bytecodes::_dstore_0 :
 967         case Bytecodes::_dstore_1 :
 968         case Bytecodes::_dstore_2 :
 969         case Bytecodes::_dstore_3 :
 970           index = opcode - Bytecodes::_dstore_0;
 971           verify_dstore(index, &current_frame, CHECK_VERIFY(this));
 972           no_control_flow = false; break;
 973         case Bytecodes::_astore :
 974           verify_astore(bcs.get_index(), &current_frame, CHECK_VERIFY(this));
 975           no_control_flow = false; break;
 976         case Bytecodes::_astore_0 :
 977         case Bytecodes::_astore_1 :
 978         case Bytecodes::_astore_2 :
 979         case Bytecodes::_astore_3 :
 980           index = opcode - Bytecodes::_astore_0;
 981           verify_astore(index, &current_frame, CHECK_VERIFY(this));
 982           no_control_flow = false; break;
 983         case Bytecodes::_iastore :
 984           type = current_frame.pop_stack(
 985             VerificationType::integer_type(), CHECK_VERIFY(this));
 986           type2 = current_frame.pop_stack(
 987             VerificationType::integer_type(), CHECK_VERIFY(this));
 988           atype = current_frame.pop_stack(
 989             VerificationType::reference_check(), CHECK_VERIFY(this));
 990           if (!atype.is_int_array()) {
 991             verify_error(ErrorContext::bad_type(bci,
 992                 current_frame.stack_top_ctx(), ref_ctx("[I", THREAD)),
 993                 bad_type_msg, "iastore");
 994             return;
 995           }
 996           no_control_flow = false; break;
 997         case Bytecodes::_bastore :
 998           type = current_frame.pop_stack(
 999             VerificationType::integer_type(), CHECK_VERIFY(this));
1000           type2 = current_frame.pop_stack(
1001             VerificationType::integer_type(), CHECK_VERIFY(this));
1002           atype = current_frame.pop_stack(
1003             VerificationType::reference_check(), CHECK_VERIFY(this));
1004           if (!atype.is_bool_array() && !atype.is_byte_array()) {
1005             verify_error(
1006                 ErrorContext::bad_type(bci, current_frame.stack_top_ctx()),
1007                 bad_type_msg, "bastore");
1008             return;
1009           }
1010           no_control_flow = false; break;
1011         case Bytecodes::_castore :
1012           current_frame.pop_stack(
1013             VerificationType::integer_type(), CHECK_VERIFY(this));
1014           current_frame.pop_stack(
1015             VerificationType::integer_type(), CHECK_VERIFY(this));
1016           atype = current_frame.pop_stack(
1017             VerificationType::reference_check(), CHECK_VERIFY(this));
1018           if (!atype.is_char_array()) {
1019             verify_error(ErrorContext::bad_type(bci,
1020                 current_frame.stack_top_ctx(), ref_ctx("[C", THREAD)),
1021                 bad_type_msg, "castore");
1022             return;
1023           }
1024           no_control_flow = false; break;
1025         case Bytecodes::_sastore :
1026           current_frame.pop_stack(
1027             VerificationType::integer_type(), CHECK_VERIFY(this));
1028           current_frame.pop_stack(
1029             VerificationType::integer_type(), CHECK_VERIFY(this));
1030           atype = current_frame.pop_stack(
1031             VerificationType::reference_check(), CHECK_VERIFY(this));
1032           if (!atype.is_short_array()) {
1033             verify_error(ErrorContext::bad_type(bci,
1034                 current_frame.stack_top_ctx(), ref_ctx("[S", THREAD)),
1035                 bad_type_msg, "sastore");
1036             return;
1037           }
1038           no_control_flow = false; break;
1039         case Bytecodes::_lastore :
1040           current_frame.pop_stack_2(
1041             VerificationType::long2_type(),
1042             VerificationType::long_type(), CHECK_VERIFY(this));
1043           current_frame.pop_stack(
1044             VerificationType::integer_type(), CHECK_VERIFY(this));
1045           atype = current_frame.pop_stack(
1046             VerificationType::reference_check(), CHECK_VERIFY(this));
1047           if (!atype.is_long_array()) {
1048             verify_error(ErrorContext::bad_type(bci,
1049                 current_frame.stack_top_ctx(), ref_ctx("[J", THREAD)),
1050                 bad_type_msg, "lastore");
1051             return;
1052           }
1053           no_control_flow = false; break;
1054         case Bytecodes::_fastore :
1055           current_frame.pop_stack(
1056             VerificationType::float_type(), CHECK_VERIFY(this));
1057           current_frame.pop_stack
1058             (VerificationType::integer_type(), CHECK_VERIFY(this));
1059           atype = current_frame.pop_stack(
1060             VerificationType::reference_check(), CHECK_VERIFY(this));
1061           if (!atype.is_float_array()) {
1062             verify_error(ErrorContext::bad_type(bci,
1063                 current_frame.stack_top_ctx(), ref_ctx("[F", THREAD)),
1064                 bad_type_msg, "fastore");
1065             return;
1066           }
1067           no_control_flow = false; break;
1068         case Bytecodes::_dastore :
1069           current_frame.pop_stack_2(
1070             VerificationType::double2_type(),
1071             VerificationType::double_type(), CHECK_VERIFY(this));
1072           current_frame.pop_stack(
1073             VerificationType::integer_type(), CHECK_VERIFY(this));
1074           atype = current_frame.pop_stack(
1075             VerificationType::reference_check(), CHECK_VERIFY(this));
1076           if (!atype.is_double_array()) {
1077             verify_error(ErrorContext::bad_type(bci,
1078                 current_frame.stack_top_ctx(), ref_ctx("[D", THREAD)),
1079                 bad_type_msg, "dastore");
1080             return;
1081           }
1082           no_control_flow = false; break;
1083         case Bytecodes::_aastore :
1084           type = current_frame.pop_stack(object_type(), CHECK_VERIFY(this));
1085           type2 = current_frame.pop_stack(
1086             VerificationType::integer_type(), CHECK_VERIFY(this));
1087           atype = current_frame.pop_stack(
1088             VerificationType::reference_check(), CHECK_VERIFY(this));
1089           // more type-checking is done at runtime
1090           if (!atype.is_reference_array()) {
1091             verify_error(ErrorContext::bad_type(bci,
1092                 current_frame.stack_top_ctx(),
1093                 TypeOrigin::implicit(VerificationType::reference_check())),
1094                 bad_type_msg, "aastore");
1095             return;
1096           }
1097           // 4938384: relaxed constraint in JVMS 3nd edition.
1098           no_control_flow = false; break;
1099         case Bytecodes::_pop :
1100           current_frame.pop_stack(
1101             VerificationType::category1_check(), CHECK_VERIFY(this));
1102           no_control_flow = false; break;
1103         case Bytecodes::_pop2 :
1104           type = current_frame.pop_stack(CHECK_VERIFY(this));
1105           if (type.is_category1()) {
1106             current_frame.pop_stack(
1107               VerificationType::category1_check(), CHECK_VERIFY(this));
1108           } else if (type.is_category2_2nd()) {
1109             current_frame.pop_stack(
1110               VerificationType::category2_check(), CHECK_VERIFY(this));
1111           } else {
1112             /* Unreachable? Would need a category2_1st on TOS
1113              * which does not appear possible. */
1114             verify_error(
1115                 ErrorContext::bad_type(bci, current_frame.stack_top_ctx()),
1116                 bad_type_msg, "pop2");
1117             return;
1118           }
1119           no_control_flow = false; break;
1120         case Bytecodes::_dup :
1121           type = current_frame.pop_stack(
1122             VerificationType::category1_check(), CHECK_VERIFY(this));
1123           current_frame.push_stack(type, CHECK_VERIFY(this));
1124           current_frame.push_stack(type, CHECK_VERIFY(this));
1125           no_control_flow = false; break;
1126         case Bytecodes::_dup_x1 :
1127           type = current_frame.pop_stack(
1128             VerificationType::category1_check(), CHECK_VERIFY(this));
1129           type2 = current_frame.pop_stack(
1130             VerificationType::category1_check(), CHECK_VERIFY(this));
1131           current_frame.push_stack(type, CHECK_VERIFY(this));
1132           current_frame.push_stack(type2, CHECK_VERIFY(this));
1133           current_frame.push_stack(type, CHECK_VERIFY(this));
1134           no_control_flow = false; break;
1135         case Bytecodes::_dup_x2 :
1136         {
1137           VerificationType type3;
1138           type = current_frame.pop_stack(
1139             VerificationType::category1_check(), CHECK_VERIFY(this));
1140           type2 = current_frame.pop_stack(CHECK_VERIFY(this));
1141           if (type2.is_category1()) {
1142             type3 = current_frame.pop_stack(
1143               VerificationType::category1_check(), CHECK_VERIFY(this));
1144           } else if (type2.is_category2_2nd()) {
1145             type3 = current_frame.pop_stack(
1146               VerificationType::category2_check(), CHECK_VERIFY(this));
1147           } else {
1148             /* Unreachable? Would need a category2_1st at stack depth 2 with
1149              * a category1 on TOS which does not appear possible. */
1150             verify_error(ErrorContext::bad_type(
1151                 bci, current_frame.stack_top_ctx()), bad_type_msg, "dup_x2");
1152             return;
1153           }
1154           current_frame.push_stack(type, CHECK_VERIFY(this));
1155           current_frame.push_stack(type3, CHECK_VERIFY(this));
1156           current_frame.push_stack(type2, CHECK_VERIFY(this));
1157           current_frame.push_stack(type, CHECK_VERIFY(this));
1158           no_control_flow = false; break;
1159         }
1160         case Bytecodes::_dup2 :
1161           type = current_frame.pop_stack(CHECK_VERIFY(this));
1162           if (type.is_category1()) {
1163             type2 = current_frame.pop_stack(
1164               VerificationType::category1_check(), CHECK_VERIFY(this));
1165           } else if (type.is_category2_2nd()) {
1166             type2 = current_frame.pop_stack(
1167               VerificationType::category2_check(), CHECK_VERIFY(this));
1168           } else {
1169             /* Unreachable?  Would need a category2_1st on TOS which does not
1170              * appear possible. */
1171             verify_error(
1172                 ErrorContext::bad_type(bci, current_frame.stack_top_ctx()),
1173                 bad_type_msg, "dup2");
1174             return;
1175           }
1176           current_frame.push_stack(type2, CHECK_VERIFY(this));
1177           current_frame.push_stack(type, CHECK_VERIFY(this));
1178           current_frame.push_stack(type2, CHECK_VERIFY(this));
1179           current_frame.push_stack(type, CHECK_VERIFY(this));
1180           no_control_flow = false; break;
1181         case Bytecodes::_dup2_x1 :
1182         {
1183           VerificationType type3;
1184           type = current_frame.pop_stack(CHECK_VERIFY(this));
1185           if (type.is_category1()) {
1186             type2 = current_frame.pop_stack(
1187               VerificationType::category1_check(), CHECK_VERIFY(this));
1188           } else if (type.is_category2_2nd()) {
1189             type2 = current_frame.pop_stack(
1190               VerificationType::category2_check(), CHECK_VERIFY(this));
1191           } else {
1192             /* Unreachable?  Would need a category2_1st on TOS which does
1193              * not appear possible. */
1194             verify_error(
1195                 ErrorContext::bad_type(bci, current_frame.stack_top_ctx()),
1196                 bad_type_msg, "dup2_x1");
1197             return;
1198           }
1199           type3 = current_frame.pop_stack(
1200             VerificationType::category1_check(), CHECK_VERIFY(this));
1201           current_frame.push_stack(type2, CHECK_VERIFY(this));
1202           current_frame.push_stack(type, CHECK_VERIFY(this));
1203           current_frame.push_stack(type3, CHECK_VERIFY(this));
1204           current_frame.push_stack(type2, CHECK_VERIFY(this));
1205           current_frame.push_stack(type, CHECK_VERIFY(this));
1206           no_control_flow = false; break;
1207         }
1208         case Bytecodes::_dup2_x2 :
1209         {
1210           VerificationType type3, type4;
1211           type = current_frame.pop_stack(CHECK_VERIFY(this));
1212           if (type.is_category1()) {
1213             type2 = current_frame.pop_stack(
1214               VerificationType::category1_check(), CHECK_VERIFY(this));
1215           } else if (type.is_category2_2nd()) {
1216             type2 = current_frame.pop_stack(
1217               VerificationType::category2_check(), CHECK_VERIFY(this));
1218           } else {
1219             /* Unreachable?  Would need a category2_1st on TOS which does
1220              * not appear possible. */
1221             verify_error(
1222                 ErrorContext::bad_type(bci, current_frame.stack_top_ctx()),
1223                 bad_type_msg, "dup2_x2");
1224             return;
1225           }
1226           type3 = current_frame.pop_stack(CHECK_VERIFY(this));
1227           if (type3.is_category1()) {
1228             type4 = current_frame.pop_stack(
1229               VerificationType::category1_check(), CHECK_VERIFY(this));
1230           } else if (type3.is_category2_2nd()) {
1231             type4 = current_frame.pop_stack(
1232               VerificationType::category2_check(), CHECK_VERIFY(this));
1233           } else {
1234             /* Unreachable?  Would need a category2_1st on TOS after popping
1235              * a long/double or two category 1's, which does not
1236              * appear possible. */
1237             verify_error(
1238                 ErrorContext::bad_type(bci, current_frame.stack_top_ctx()),
1239                 bad_type_msg, "dup2_x2");
1240             return;
1241           }
1242           current_frame.push_stack(type2, CHECK_VERIFY(this));
1243           current_frame.push_stack(type, CHECK_VERIFY(this));
1244           current_frame.push_stack(type4, CHECK_VERIFY(this));
1245           current_frame.push_stack(type3, CHECK_VERIFY(this));
1246           current_frame.push_stack(type2, CHECK_VERIFY(this));
1247           current_frame.push_stack(type, CHECK_VERIFY(this));
1248           no_control_flow = false; break;
1249         }
1250         case Bytecodes::_swap :
1251           type = current_frame.pop_stack(
1252             VerificationType::category1_check(), CHECK_VERIFY(this));
1253           type2 = current_frame.pop_stack(
1254             VerificationType::category1_check(), CHECK_VERIFY(this));
1255           current_frame.push_stack(type, CHECK_VERIFY(this));
1256           current_frame.push_stack(type2, CHECK_VERIFY(this));
1257           no_control_flow = false; break;
1258         case Bytecodes::_iadd :
1259         case Bytecodes::_isub :
1260         case Bytecodes::_imul :
1261         case Bytecodes::_idiv :
1262         case Bytecodes::_irem :
1263         case Bytecodes::_ishl :
1264         case Bytecodes::_ishr :
1265         case Bytecodes::_iushr :
1266         case Bytecodes::_ior :
1267         case Bytecodes::_ixor :
1268         case Bytecodes::_iand :
1269           current_frame.pop_stack(
1270             VerificationType::integer_type(), CHECK_VERIFY(this));
1271           // fall through
1272         case Bytecodes::_ineg :
1273           current_frame.pop_stack(
1274             VerificationType::integer_type(), CHECK_VERIFY(this));
1275           current_frame.push_stack(
1276             VerificationType::integer_type(), CHECK_VERIFY(this));
1277           no_control_flow = false; break;
1278         case Bytecodes::_ladd :
1279         case Bytecodes::_lsub :
1280         case Bytecodes::_lmul :
1281         case Bytecodes::_ldiv :
1282         case Bytecodes::_lrem :
1283         case Bytecodes::_land :
1284         case Bytecodes::_lor :
1285         case Bytecodes::_lxor :
1286           current_frame.pop_stack_2(
1287             VerificationType::long2_type(),
1288             VerificationType::long_type(), CHECK_VERIFY(this));
1289           // fall through
1290         case Bytecodes::_lneg :
1291           current_frame.pop_stack_2(
1292             VerificationType::long2_type(),
1293             VerificationType::long_type(), CHECK_VERIFY(this));
1294           current_frame.push_stack_2(
1295             VerificationType::long_type(),
1296             VerificationType::long2_type(), CHECK_VERIFY(this));
1297           no_control_flow = false; break;
1298         case Bytecodes::_lshl :
1299         case Bytecodes::_lshr :
1300         case Bytecodes::_lushr :
1301           current_frame.pop_stack(
1302             VerificationType::integer_type(), CHECK_VERIFY(this));
1303           current_frame.pop_stack_2(
1304             VerificationType::long2_type(),
1305             VerificationType::long_type(), CHECK_VERIFY(this));
1306           current_frame.push_stack_2(
1307             VerificationType::long_type(),
1308             VerificationType::long2_type(), CHECK_VERIFY(this));
1309           no_control_flow = false; break;
1310         case Bytecodes::_fadd :
1311         case Bytecodes::_fsub :
1312         case Bytecodes::_fmul :
1313         case Bytecodes::_fdiv :
1314         case Bytecodes::_frem :
1315           current_frame.pop_stack(
1316             VerificationType::float_type(), CHECK_VERIFY(this));
1317           // fall through
1318         case Bytecodes::_fneg :
1319           current_frame.pop_stack(
1320             VerificationType::float_type(), CHECK_VERIFY(this));
1321           current_frame.push_stack(
1322             VerificationType::float_type(), CHECK_VERIFY(this));
1323           no_control_flow = false; break;
1324         case Bytecodes::_dadd :
1325         case Bytecodes::_dsub :
1326         case Bytecodes::_dmul :
1327         case Bytecodes::_ddiv :
1328         case Bytecodes::_drem :
1329           current_frame.pop_stack_2(
1330             VerificationType::double2_type(),
1331             VerificationType::double_type(), CHECK_VERIFY(this));
1332           // fall through
1333         case Bytecodes::_dneg :
1334           current_frame.pop_stack_2(
1335             VerificationType::double2_type(),
1336             VerificationType::double_type(), CHECK_VERIFY(this));
1337           current_frame.push_stack_2(
1338             VerificationType::double_type(),
1339             VerificationType::double2_type(), CHECK_VERIFY(this));
1340           no_control_flow = false; break;
1341         case Bytecodes::_iinc :
1342           verify_iinc(bcs.get_index(), &current_frame, CHECK_VERIFY(this));
1343           no_control_flow = false; break;
1344         case Bytecodes::_i2l :
1345           type = current_frame.pop_stack(
1346             VerificationType::integer_type(), CHECK_VERIFY(this));
1347           current_frame.push_stack_2(
1348             VerificationType::long_type(),
1349             VerificationType::long2_type(), CHECK_VERIFY(this));
1350           no_control_flow = false; break;
1351        case Bytecodes::_l2i :
1352           current_frame.pop_stack_2(
1353             VerificationType::long2_type(),
1354             VerificationType::long_type(), CHECK_VERIFY(this));
1355           current_frame.push_stack(
1356             VerificationType::integer_type(), CHECK_VERIFY(this));
1357           no_control_flow = false; break;
1358         case Bytecodes::_i2f :
1359           current_frame.pop_stack(
1360             VerificationType::integer_type(), CHECK_VERIFY(this));
1361           current_frame.push_stack(
1362             VerificationType::float_type(), CHECK_VERIFY(this));
1363           no_control_flow = false; break;
1364         case Bytecodes::_i2d :
1365           current_frame.pop_stack(
1366             VerificationType::integer_type(), CHECK_VERIFY(this));
1367           current_frame.push_stack_2(
1368             VerificationType::double_type(),
1369             VerificationType::double2_type(), CHECK_VERIFY(this));
1370           no_control_flow = false; break;
1371         case Bytecodes::_l2f :
1372           current_frame.pop_stack_2(
1373             VerificationType::long2_type(),
1374             VerificationType::long_type(), CHECK_VERIFY(this));
1375           current_frame.push_stack(
1376             VerificationType::float_type(), CHECK_VERIFY(this));
1377           no_control_flow = false; break;
1378         case Bytecodes::_l2d :
1379           current_frame.pop_stack_2(
1380             VerificationType::long2_type(),
1381             VerificationType::long_type(), CHECK_VERIFY(this));
1382           current_frame.push_stack_2(
1383             VerificationType::double_type(),
1384             VerificationType::double2_type(), CHECK_VERIFY(this));
1385           no_control_flow = false; break;
1386         case Bytecodes::_f2i :
1387           current_frame.pop_stack(
1388             VerificationType::float_type(), CHECK_VERIFY(this));
1389           current_frame.push_stack(
1390             VerificationType::integer_type(), CHECK_VERIFY(this));
1391           no_control_flow = false; break;
1392         case Bytecodes::_f2l :
1393           current_frame.pop_stack(
1394             VerificationType::float_type(), CHECK_VERIFY(this));
1395           current_frame.push_stack_2(
1396             VerificationType::long_type(),
1397             VerificationType::long2_type(), CHECK_VERIFY(this));
1398           no_control_flow = false; break;
1399         case Bytecodes::_f2d :
1400           current_frame.pop_stack(
1401             VerificationType::float_type(), CHECK_VERIFY(this));
1402           current_frame.push_stack_2(
1403             VerificationType::double_type(),
1404             VerificationType::double2_type(), CHECK_VERIFY(this));
1405           no_control_flow = false; break;
1406         case Bytecodes::_d2i :
1407           current_frame.pop_stack_2(
1408             VerificationType::double2_type(),
1409             VerificationType::double_type(), CHECK_VERIFY(this));
1410           current_frame.push_stack(
1411             VerificationType::integer_type(), CHECK_VERIFY(this));
1412           no_control_flow = false; break;
1413         case Bytecodes::_d2l :
1414           current_frame.pop_stack_2(
1415             VerificationType::double2_type(),
1416             VerificationType::double_type(), CHECK_VERIFY(this));
1417           current_frame.push_stack_2(
1418             VerificationType::long_type(),
1419             VerificationType::long2_type(), CHECK_VERIFY(this));
1420           no_control_flow = false; break;
1421         case Bytecodes::_d2f :
1422           current_frame.pop_stack_2(
1423             VerificationType::double2_type(),
1424             VerificationType::double_type(), CHECK_VERIFY(this));
1425           current_frame.push_stack(
1426             VerificationType::float_type(), CHECK_VERIFY(this));
1427           no_control_flow = false; break;
1428         case Bytecodes::_i2b :
1429         case Bytecodes::_i2c :
1430         case Bytecodes::_i2s :
1431           current_frame.pop_stack(
1432             VerificationType::integer_type(), CHECK_VERIFY(this));
1433           current_frame.push_stack(
1434             VerificationType::integer_type(), CHECK_VERIFY(this));
1435           no_control_flow = false; break;
1436         case Bytecodes::_lcmp :
1437           current_frame.pop_stack_2(
1438             VerificationType::long2_type(),
1439             VerificationType::long_type(), CHECK_VERIFY(this));
1440           current_frame.pop_stack_2(
1441             VerificationType::long2_type(),
1442             VerificationType::long_type(), CHECK_VERIFY(this));
1443           current_frame.push_stack(
1444             VerificationType::integer_type(), CHECK_VERIFY(this));
1445           no_control_flow = false; break;
1446         case Bytecodes::_fcmpl :
1447         case Bytecodes::_fcmpg :
1448           current_frame.pop_stack(
1449             VerificationType::float_type(), CHECK_VERIFY(this));
1450           current_frame.pop_stack(
1451             VerificationType::float_type(), CHECK_VERIFY(this));
1452           current_frame.push_stack(
1453             VerificationType::integer_type(), CHECK_VERIFY(this));
1454           no_control_flow = false; break;
1455         case Bytecodes::_dcmpl :
1456         case Bytecodes::_dcmpg :
1457           current_frame.pop_stack_2(
1458             VerificationType::double2_type(),
1459             VerificationType::double_type(), CHECK_VERIFY(this));
1460           current_frame.pop_stack_2(
1461             VerificationType::double2_type(),
1462             VerificationType::double_type(), CHECK_VERIFY(this));
1463           current_frame.push_stack(
1464             VerificationType::integer_type(), CHECK_VERIFY(this));
1465           no_control_flow = false; break;
1466         case Bytecodes::_if_icmpeq:
1467         case Bytecodes::_if_icmpne:
1468         case Bytecodes::_if_icmplt:
1469         case Bytecodes::_if_icmpge:
1470         case Bytecodes::_if_icmpgt:
1471         case Bytecodes::_if_icmple:
1472           current_frame.pop_stack(
1473             VerificationType::integer_type(), CHECK_VERIFY(this));
1474           // fall through
1475         case Bytecodes::_ifeq:
1476         case Bytecodes::_ifne:
1477         case Bytecodes::_iflt:
1478         case Bytecodes::_ifge:
1479         case Bytecodes::_ifgt:
1480         case Bytecodes::_ifle:
1481           current_frame.pop_stack(
1482             VerificationType::integer_type(), CHECK_VERIFY(this));
1483           target = bcs.dest();
1484           stackmap_table.check_jump_target(
1485             &current_frame, target, CHECK_VERIFY(this));
1486           no_control_flow = false; break;
1487         case Bytecodes::_if_acmpeq :
1488         case Bytecodes::_if_acmpne :
1489           current_frame.pop_stack(
1490             VerificationType::reference_check(), CHECK_VERIFY(this));
1491           // fall through
1492         case Bytecodes::_ifnull :
1493         case Bytecodes::_ifnonnull :
1494           current_frame.pop_stack(
1495             VerificationType::reference_check(), CHECK_VERIFY(this));
1496           target = bcs.dest();
1497           stackmap_table.check_jump_target
1498             (&current_frame, target, CHECK_VERIFY(this));
1499           no_control_flow = false; break;
1500         case Bytecodes::_goto :
1501           target = bcs.dest();
1502           stackmap_table.check_jump_target(
1503             &current_frame, target, CHECK_VERIFY(this));
1504           no_control_flow = true; break;
1505         case Bytecodes::_goto_w :
1506           target = bcs.dest_w();
1507           stackmap_table.check_jump_target(
1508             &current_frame, target, CHECK_VERIFY(this));
1509           no_control_flow = true; break;
1510         case Bytecodes::_tableswitch :
1511         case Bytecodes::_lookupswitch :
1512           verify_switch(
1513             &bcs, code_length, code_data, &current_frame,
1514             &stackmap_table, CHECK_VERIFY(this));
1515           no_control_flow = true; break;
1516         case Bytecodes::_ireturn :
1517           type = current_frame.pop_stack(
1518             VerificationType::integer_type(), CHECK_VERIFY(this));
1519           verify_return_value(return_type, type, bci,
1520                               &current_frame, CHECK_VERIFY(this));
1521           no_control_flow = true; break;
1522         case Bytecodes::_lreturn :
1523           type2 = current_frame.pop_stack(
1524             VerificationType::long2_type(), CHECK_VERIFY(this));
1525           type = current_frame.pop_stack(
1526             VerificationType::long_type(), CHECK_VERIFY(this));
1527           verify_return_value(return_type, type, bci,
1528                               &current_frame, CHECK_VERIFY(this));
1529           no_control_flow = true; break;
1530         case Bytecodes::_freturn :
1531           type = current_frame.pop_stack(
1532             VerificationType::float_type(), CHECK_VERIFY(this));
1533           verify_return_value(return_type, type, bci,
1534                               &current_frame, CHECK_VERIFY(this));
1535           no_control_flow = true; break;
1536         case Bytecodes::_dreturn :
1537           type2 = current_frame.pop_stack(
1538             VerificationType::double2_type(),  CHECK_VERIFY(this));
1539           type = current_frame.pop_stack(
1540             VerificationType::double_type(), CHECK_VERIFY(this));
1541           verify_return_value(return_type, type, bci,
1542                               &current_frame, CHECK_VERIFY(this));
1543           no_control_flow = true; break;
1544         case Bytecodes::_areturn :
1545           type = current_frame.pop_stack(
1546             VerificationType::reference_check(), CHECK_VERIFY(this));
1547           verify_return_value(return_type, type, bci,
1548                               &current_frame, CHECK_VERIFY(this));
1549           no_control_flow = true; break;
1550         case Bytecodes::_return :
1551           if (return_type != VerificationType::bogus_type()) {
1552             verify_error(ErrorContext::bad_code(bci),
1553                          "Method expects a return value");
1554             return;
1555           }
1556           // Make sure "this" has been initialized if current method is an
1557           // <init>
1558           if (_method->name() == vmSymbols::object_initializer_name() &&
1559               current_frame.flag_this_uninit()) {
1560             verify_error(ErrorContext::bad_code(bci),
1561                          "Constructor must call super() or this() "
1562                          "before return");
1563             return;
1564           }
1565           no_control_flow = true; break;
1566         case Bytecodes::_getstatic :
1567         case Bytecodes::_putstatic :
1568         case Bytecodes::_getfield :
1569         case Bytecodes::_putfield :
1570           verify_field_instructions(
1571             &bcs, &current_frame, cp, CHECK_VERIFY(this));
1572           no_control_flow = false; break;
1573         case Bytecodes::_invokevirtual :
1574         case Bytecodes::_invokespecial :
1575         case Bytecodes::_invokestatic :
1576           verify_invoke_instructions(
1577             &bcs, code_length, &current_frame, (bci >= ex_min && bci < ex_max),
1578             &this_uninit, return_type, cp, &stackmap_table, CHECK_VERIFY(this));
1579           no_control_flow = false; break;
1580         case Bytecodes::_invokeinterface :
1581         case Bytecodes::_invokedynamic :
1582           verify_invoke_instructions(
1583             &bcs, code_length, &current_frame, (bci >= ex_min && bci < ex_max),
1584             &this_uninit, return_type, cp, &stackmap_table, CHECK_VERIFY(this));
1585           no_control_flow = false; break;
1586         case Bytecodes::_new :
1587         {
1588           index = bcs.get_index_u2();
1589           verify_cp_class_type(bci, index, cp, CHECK_VERIFY(this));
1590           VerificationType new_class_type =
1591             cp_index_to_type(index, cp, CHECK_VERIFY(this));
1592           if (!new_class_type.is_object()) {
1593             verify_error(ErrorContext::bad_type(bci,
1594                 TypeOrigin::cp(index, new_class_type)),
1595                 "Illegal new instruction");
1596             return;
1597           }
1598           type = VerificationType::uninitialized_type(bci);
1599           current_frame.push_stack(type, CHECK_VERIFY(this));
1600           no_control_flow = false; break;
1601         }
1602         case Bytecodes::_newarray :
1603           type = get_newarray_type(bcs.get_index(), bci, CHECK_VERIFY(this));
1604           current_frame.pop_stack(
1605             VerificationType::integer_type(),  CHECK_VERIFY(this));
1606           current_frame.push_stack(type, CHECK_VERIFY(this));
1607           no_control_flow = false; break;
1608         case Bytecodes::_anewarray :
1609           verify_anewarray(
1610             bci, bcs.get_index_u2(), cp, &current_frame, CHECK_VERIFY(this));
1611           no_control_flow = false; break;
1612         case Bytecodes::_arraylength :
1613           type = current_frame.pop_stack(
1614             VerificationType::reference_check(), CHECK_VERIFY(this));
1615           if (!(type.is_null() || type.is_array())) {
1616             verify_error(ErrorContext::bad_type(
1617                 bci, current_frame.stack_top_ctx()),
1618                 bad_type_msg, "arraylength");
1619           }
1620           current_frame.push_stack(
1621             VerificationType::integer_type(), CHECK_VERIFY(this));
1622           no_control_flow = false; break;
1623         case Bytecodes::_checkcast :
1624         {
1625           index = bcs.get_index_u2();
1626           verify_cp_class_type(bci, index, cp, CHECK_VERIFY(this));
1627           current_frame.pop_stack(object_type(), CHECK_VERIFY(this));
1628           VerificationType klass_type = cp_index_to_type(
1629             index, cp, CHECK_VERIFY(this));
1630           current_frame.push_stack(klass_type, CHECK_VERIFY(this));
1631           no_control_flow = false; break;
1632         }
1633         case Bytecodes::_instanceof : {
1634           index = bcs.get_index_u2();
1635           verify_cp_class_type(bci, index, cp, CHECK_VERIFY(this));
1636           current_frame.pop_stack(object_type(), CHECK_VERIFY(this));
1637           current_frame.push_stack(
1638             VerificationType::integer_type(), CHECK_VERIFY(this));
1639           no_control_flow = false; break;
1640         }
1641         case Bytecodes::_monitorenter :
1642         case Bytecodes::_monitorexit :
1643           current_frame.pop_stack(
1644             VerificationType::reference_check(), CHECK_VERIFY(this));
1645           no_control_flow = false; break;
1646         case Bytecodes::_multianewarray :
1647         {
1648           index = bcs.get_index_u2();
1649           u2 dim = *(bcs.bcp()+3);
1650           verify_cp_class_type(bci, index, cp, CHECK_VERIFY(this));
1651           VerificationType new_array_type =
1652             cp_index_to_type(index, cp, CHECK_VERIFY(this));
1653           if (!new_array_type.is_array()) {
1654             verify_error(ErrorContext::bad_type(bci,
1655                 TypeOrigin::cp(index, new_array_type)),
1656                 "Illegal constant pool index in multianewarray instruction");
1657             return;
1658           }
1659           if (dim < 1 || new_array_type.dimensions() < dim) {
1660             verify_error(ErrorContext::bad_code(bci),
1661                 "Illegal dimension in multianewarray instruction: %d", dim);
1662             return;
1663           }
1664           for (int i = 0; i < dim; i++) {
1665             current_frame.pop_stack(
1666               VerificationType::integer_type(), CHECK_VERIFY(this));
1667           }
1668           current_frame.push_stack(new_array_type, CHECK_VERIFY(this));
1669           no_control_flow = false; break;
1670         }
1671         case Bytecodes::_athrow :
1672           type = VerificationType::reference_type(
1673             vmSymbols::java_lang_Throwable());
1674           current_frame.pop_stack(type, CHECK_VERIFY(this));
1675           no_control_flow = true; break;
1676         default:
1677           // We only need to check the valid bytecodes in class file.
1678           // And jsr and ret are not in the new class file format in JDK1.5.
1679           verify_error(ErrorContext::bad_code(bci),
1680               "Bad instruction: %02x", opcode);
1681           no_control_flow = false;
1682           return;
1683       }  // end switch
1684     }  // end Merge with the next instruction
1685 
1686     // Look for possible jump target in exception handlers and see if it matches
1687     // current_frame.  Don't do this check if it has already been done (for
1688     // ([a,d,f,i,l]store* opcodes).  This check cannot be done earlier because
1689     // opcodes, such as invokespecial, may set the this_uninit flag.
1690     assert(!(verified_exc_handlers && this_uninit),
1691       "Exception handler targets got verified before this_uninit got set");
1692     if (!verified_exc_handlers && bci >= ex_min && bci < ex_max) {
1693       verify_exception_handler_targets(
1694         bci, this_uninit, &current_frame, &stackmap_table, CHECK_VERIFY(this));
1695     }
1696   } // end while
1697 
1698   // Make sure that control flow does not fall through end of the method
1699   if (!no_control_flow) {
1700     verify_error(ErrorContext::bad_code(code_length),
1701         "Control flow falls through code end");
1702     return;
1703   }
1704 }
1705 
1706 #undef bad_type_message
1707 
1708 char* ClassVerifier::generate_code_data(methodHandle m, u4 code_length, TRAPS) {
1709   char* code_data = NEW_RESOURCE_ARRAY(char, code_length);
1710   memset(code_data, 0, sizeof(char) * code_length);
1711   RawBytecodeStream bcs(m);
1712 
1713   while (!bcs.is_last_bytecode()) {
1714     if (bcs.raw_next() != Bytecodes::_illegal) {
1715       int bci = bcs.bci();
1716       if (bcs.raw_code() == Bytecodes::_new) {
1717         code_data[bci] = NEW_OFFSET;
1718       } else {
1719         code_data[bci] = BYTECODE_OFFSET;
1720       }
1721     } else {
1722       verify_error(ErrorContext::bad_code(bcs.bci()), "Bad instruction");
1723       return NULL;
1724     }
1725   }
1726 
1727   return code_data;
1728 }
1729 
1730 void ClassVerifier::verify_exception_handler_table(u4 code_length, char* code_data, int& min, int& max, TRAPS) {
1731   ExceptionTable exhandlers(_method());
1732   int exlength = exhandlers.length();
1733   constantPoolHandle cp (THREAD, _method->constants());
1734 
1735   for(int i = 0; i < exlength; i++) {
1736     //reacquire the table in case a GC happened
1737     ExceptionTable exhandlers(_method());
1738     u2 start_pc = exhandlers.start_pc(i);
1739     u2 end_pc = exhandlers.end_pc(i);
1740     u2 handler_pc = exhandlers.handler_pc(i);
1741     if (start_pc >= code_length || code_data[start_pc] == 0) {
1742       class_format_error("Illegal exception table start_pc %d", start_pc);
1743       return;
1744     }
1745     if (end_pc != code_length) {   // special case: end_pc == code_length
1746       if (end_pc > code_length || code_data[end_pc] == 0) {
1747         class_format_error("Illegal exception table end_pc %d", end_pc);
1748         return;
1749       }
1750     }
1751     if (handler_pc >= code_length || code_data[handler_pc] == 0) {
1752       class_format_error("Illegal exception table handler_pc %d", handler_pc);
1753       return;
1754     }
1755     int catch_type_index = exhandlers.catch_type_index(i);
1756     if (catch_type_index != 0) {
1757       VerificationType catch_type = cp_index_to_type(
1758         catch_type_index, cp, CHECK_VERIFY(this));
1759       VerificationType throwable =
1760         VerificationType::reference_type(vmSymbols::java_lang_Throwable());
1761       bool is_subclass = throwable.is_assignable_from(
1762         catch_type, this, false, CHECK_VERIFY(this));
1763       if (!is_subclass) {
1764         // 4286534: should throw VerifyError according to recent spec change
1765         verify_error(ErrorContext::bad_type(handler_pc,
1766             TypeOrigin::cp(catch_type_index, catch_type),
1767             TypeOrigin::implicit(throwable)),
1768             "Catch type is not a subclass "
1769             "of Throwable in exception handler %d", handler_pc);
1770         return;
1771       }
1772     }
1773     if (start_pc < min) min = start_pc;
1774     if (end_pc > max) max = end_pc;
1775   }
1776 }
1777 
1778 void ClassVerifier::verify_local_variable_table(u4 code_length, char* code_data, TRAPS) {
1779   int localvariable_table_length = _method()->localvariable_table_length();
1780   if (localvariable_table_length > 0) {
1781     LocalVariableTableElement* table = _method()->localvariable_table_start();
1782     for (int i = 0; i < localvariable_table_length; i++) {
1783       u2 start_bci = table[i].start_bci;
1784       u2 length = table[i].length;
1785 
1786       if (start_bci >= code_length || code_data[start_bci] == 0) {
1787         class_format_error(
1788           "Illegal local variable table start_pc %d", start_bci);
1789         return;
1790       }
1791       u4 end_bci = (u4)(start_bci + length);
1792       if (end_bci != code_length) {
1793         if (end_bci >= code_length || code_data[end_bci] == 0) {
1794           class_format_error( "Illegal local variable table length %d", length);
1795           return;
1796         }
1797       }
1798     }
1799   }
1800 }
1801 
1802 u2 ClassVerifier::verify_stackmap_table(u2 stackmap_index, u2 bci,
1803                                         StackMapFrame* current_frame,
1804                                         StackMapTable* stackmap_table,
1805                                         bool no_control_flow, TRAPS) {
1806   if (stackmap_index < stackmap_table->get_frame_count()) {
1807     u2 this_offset = stackmap_table->get_offset(stackmap_index);
1808     if (no_control_flow && this_offset > bci) {
1809       verify_error(ErrorContext::missing_stackmap(bci),
1810                    "Expecting a stack map frame");
1811       return 0;
1812     }
1813     if (this_offset == bci) {
1814       ErrorContext ctx;
1815       // See if current stack map can be assigned to the frame in table.
1816       // current_frame is the stackmap frame got from the last instruction.
1817       // If matched, current_frame will be updated by this method.
1818       bool matches = stackmap_table->match_stackmap(
1819         current_frame, this_offset, stackmap_index,
1820         !no_control_flow, true, &ctx, CHECK_VERIFY_(this, 0));
1821       if (!matches) {
1822         // report type error
1823         verify_error(ctx, "Instruction type does not match stack map");
1824         return 0;
1825       }
1826       stackmap_index++;
1827     } else if (this_offset < bci) {
1828       // current_offset should have met this_offset.
1829       class_format_error("Bad stack map offset %d", this_offset);
1830       return 0;
1831     }
1832   } else if (no_control_flow) {
1833     verify_error(ErrorContext::bad_code(bci), "Expecting a stack map frame");
1834     return 0;
1835   }
1836   return stackmap_index;
1837 }
1838 
1839 void ClassVerifier::verify_exception_handler_targets(u2 bci, bool this_uninit, StackMapFrame* current_frame,
1840                                                      StackMapTable* stackmap_table, TRAPS) {
1841   constantPoolHandle cp (THREAD, _method->constants());
1842   ExceptionTable exhandlers(_method());
1843   int exlength = exhandlers.length();
1844   for(int i = 0; i < exlength; i++) {
1845     //reacquire the table in case a GC happened
1846     ExceptionTable exhandlers(_method());
1847     u2 start_pc = exhandlers.start_pc(i);
1848     u2 end_pc = exhandlers.end_pc(i);
1849     u2 handler_pc = exhandlers.handler_pc(i);
1850     int catch_type_index = exhandlers.catch_type_index(i);
1851     if(bci >= start_pc && bci < end_pc) {
1852       u1 flags = current_frame->flags();
1853       if (this_uninit) {  flags |= FLAG_THIS_UNINIT; }
1854       StackMapFrame* new_frame = current_frame->frame_in_exception_handler(flags);
1855       if (catch_type_index != 0) {
1856         // We know that this index refers to a subclass of Throwable
1857         VerificationType catch_type = cp_index_to_type(
1858           catch_type_index, cp, CHECK_VERIFY(this));
1859         new_frame->push_stack(catch_type, CHECK_VERIFY(this));
1860       } else {
1861         VerificationType throwable =
1862           VerificationType::reference_type(vmSymbols::java_lang_Throwable());
1863         new_frame->push_stack(throwable, CHECK_VERIFY(this));
1864       }
1865       ErrorContext ctx;
1866       bool matches = stackmap_table->match_stackmap(
1867         new_frame, handler_pc, true, false, &ctx, CHECK_VERIFY(this));
1868       if (!matches) {
1869         verify_error(ctx, "Stack map does not match the one at "
1870             "exception handler %d", handler_pc);
1871         return;
1872       }
1873     }
1874   }
1875 }
1876 
1877 void ClassVerifier::verify_cp_index(
1878     u2 bci, constantPoolHandle cp, int index, TRAPS) {
1879   int nconstants = cp->length();
1880   if ((index <= 0) || (index >= nconstants)) {
1881     verify_error(ErrorContext::bad_cp_index(bci, index),
1882         "Illegal constant pool index %d in class %s",
1883         index, cp->pool_holder()->external_name());
1884     return;
1885   }
1886 }
1887 
1888 void ClassVerifier::verify_cp_type(
1889     u2 bci, int index, constantPoolHandle cp, unsigned int types, TRAPS) {
1890 
1891   // In some situations, bytecode rewriting may occur while we're verifying.
1892   // In this case, a constant pool cache exists and some indices refer to that
1893   // instead.  Be sure we don't pick up such indices by accident.
1894   // We must check was_recursively_verified() before we get here.
1895   guarantee(cp->cache() == NULL, "not rewritten yet");
1896 
1897   verify_cp_index(bci, cp, index, CHECK_VERIFY(this));
1898   unsigned int tag = cp->tag_at(index).value();
1899   if ((types & (1 << tag)) == 0) {
1900     verify_error(ErrorContext::bad_cp_index(bci, index),
1901       "Illegal type at constant pool entry %d in class %s",
1902       index, cp->pool_holder()->external_name());
1903     return;
1904   }
1905 }
1906 
1907 void ClassVerifier::verify_cp_class_type(
1908     u2 bci, int index, constantPoolHandle cp, TRAPS) {
1909   verify_cp_index(bci, cp, index, CHECK_VERIFY(this));
1910   constantTag tag = cp->tag_at(index);
1911   if (!tag.is_klass() && !tag.is_unresolved_klass()) {
1912     verify_error(ErrorContext::bad_cp_index(bci, index),
1913         "Illegal type at constant pool entry %d in class %s",
1914         index, cp->pool_holder()->external_name());
1915     return;
1916   }
1917 }
1918 
1919 void ClassVerifier::verify_error(ErrorContext ctx, const char* msg, ...) {
1920   stringStream ss;
1921 
1922   ctx.reset_frames();
1923   _exception_type = vmSymbols::java_lang_VerifyError();
1924   _error_context = ctx;
1925   va_list va;
1926   va_start(va, msg);
1927   ss.vprint(msg, va);
1928   va_end(va);
1929   _message = ss.as_string();
1930 #ifdef ASSERT
1931   ResourceMark rm;
1932   const char* exception_name = _exception_type->as_C_string();
1933   Exceptions::debug_check_abort(exception_name, NULL);
1934 #endif // ndef ASSERT
1935 }
1936 
1937 void ClassVerifier::class_format_error(const char* msg, ...) {
1938   stringStream ss;
1939   _exception_type = vmSymbols::java_lang_ClassFormatError();
1940   va_list va;
1941   va_start(va, msg);
1942   ss.vprint(msg, va);
1943   va_end(va);
1944   if (!_method.is_null()) {
1945     ss.print(" in method %s", _method->name_and_sig_as_C_string());
1946   }
1947   _message = ss.as_string();
1948 }
1949 
1950 Klass* ClassVerifier::load_class(Symbol* name, TRAPS) {
1951   // Get current loader and protection domain first.
1952   oop loader = current_class()->class_loader();
1953   oop protection_domain = current_class()->protection_domain();
1954 
1955   return SystemDictionary::resolve_or_fail(
1956     name, Handle(THREAD, loader), Handle(THREAD, protection_domain),
1957     true, CHECK_NULL);
1958 }
1959 
1960 bool ClassVerifier::is_protected_access(instanceKlassHandle this_class,
1961                                         Klass* target_class,
1962                                         Symbol* field_name,
1963                                         Symbol* field_sig,
1964                                         bool is_method) {
1965   No_Safepoint_Verifier nosafepoint;
1966 
1967   // If target class isn't a super class of this class, we don't worry about this case
1968   if (!this_class->is_subclass_of(target_class)) {
1969     return false;
1970   }
1971   // Check if the specified method or field is protected
1972   InstanceKlass* target_instance = InstanceKlass::cast(target_class);
1973   fieldDescriptor fd;
1974   if (is_method) {
1975     Method* m = target_instance->uncached_lookup_method(field_name, field_sig, Klass::find_overpass);
1976     if (m != NULL && m->is_protected()) {
1977       if (!this_class->is_same_class_package(m->method_holder())) {
1978         return true;
1979       }
1980     }
1981   } else {
1982     Klass* member_klass = target_instance->find_field(field_name, field_sig, &fd);
1983     if (member_klass != NULL && fd.is_protected()) {
1984       if (!this_class->is_same_class_package(member_klass)) {
1985         return true;
1986       }
1987     }
1988   }
1989   return false;
1990 }
1991 
1992 void ClassVerifier::verify_ldc(
1993     int opcode, u2 index, StackMapFrame* current_frame,
1994     constantPoolHandle cp, u2 bci, TRAPS) {
1995   verify_cp_index(bci, cp, index, CHECK_VERIFY(this));
1996   constantTag tag = cp->tag_at(index);
1997   unsigned int types;
1998   if (opcode == Bytecodes::_ldc || opcode == Bytecodes::_ldc_w) {
1999     if (!tag.is_unresolved_klass()) {
2000       types = (1 << JVM_CONSTANT_Integer) | (1 << JVM_CONSTANT_Float)
2001             | (1 << JVM_CONSTANT_String)  | (1 << JVM_CONSTANT_Class)
2002             | (1 << JVM_CONSTANT_MethodHandle) | (1 << JVM_CONSTANT_MethodType);
2003       // Note:  The class file parser already verified the legality of
2004       // MethodHandle and MethodType constants.
2005       verify_cp_type(bci, index, cp, types, CHECK_VERIFY(this));
2006     }
2007   } else {
2008     assert(opcode == Bytecodes::_ldc2_w, "must be ldc2_w");
2009     types = (1 << JVM_CONSTANT_Double) | (1 << JVM_CONSTANT_Long);
2010     verify_cp_type(bci, index, cp, types, CHECK_VERIFY(this));
2011   }
2012   if (tag.is_string() && cp->is_pseudo_string_at(index)) {
2013     current_frame->push_stack(object_type(), CHECK_VERIFY(this));
2014   } else if (tag.is_string()) {
2015     current_frame->push_stack(
2016       VerificationType::reference_type(
2017         vmSymbols::java_lang_String()), CHECK_VERIFY(this));
2018   } else if (tag.is_klass() || tag.is_unresolved_klass()) {
2019     current_frame->push_stack(
2020       VerificationType::reference_type(
2021         vmSymbols::java_lang_Class()), CHECK_VERIFY(this));
2022   } else if (tag.is_int()) {
2023     current_frame->push_stack(
2024       VerificationType::integer_type(), CHECK_VERIFY(this));
2025   } else if (tag.is_float()) {
2026     current_frame->push_stack(
2027       VerificationType::float_type(), CHECK_VERIFY(this));
2028   } else if (tag.is_double()) {
2029     current_frame->push_stack_2(
2030       VerificationType::double_type(),
2031       VerificationType::double2_type(), CHECK_VERIFY(this));
2032   } else if (tag.is_long()) {
2033     current_frame->push_stack_2(
2034       VerificationType::long_type(),
2035       VerificationType::long2_type(), CHECK_VERIFY(this));
2036   } else if (tag.is_method_handle()) {
2037     current_frame->push_stack(
2038       VerificationType::reference_type(
2039         vmSymbols::java_lang_invoke_MethodHandle()), CHECK_VERIFY(this));
2040   } else if (tag.is_method_type()) {
2041     current_frame->push_stack(
2042       VerificationType::reference_type(
2043         vmSymbols::java_lang_invoke_MethodType()), CHECK_VERIFY(this));
2044   } else {
2045     /* Unreachable? verify_cp_type has already validated the cp type. */
2046     verify_error(
2047         ErrorContext::bad_cp_index(bci, index), "Invalid index in ldc");
2048     return;
2049   }
2050 }
2051 
2052 void ClassVerifier::verify_switch(
2053     RawBytecodeStream* bcs, u4 code_length, char* code_data,
2054     StackMapFrame* current_frame, StackMapTable* stackmap_table, TRAPS) {
2055   int bci = bcs->bci();
2056   address bcp = bcs->bcp();
2057   address aligned_bcp = (address) round_to((intptr_t)(bcp + 1), jintSize);
2058 
2059   if (_klass->major_version() < NONZERO_PADDING_BYTES_IN_SWITCH_MAJOR_VERSION) {
2060     // 4639449 & 4647081: padding bytes must be 0
2061     u2 padding_offset = 1;
2062     while ((bcp + padding_offset) < aligned_bcp) {
2063       if(*(bcp + padding_offset) != 0) {
2064         verify_error(ErrorContext::bad_code(bci),
2065                      "Nonzero padding byte in lookswitch or tableswitch");
2066         return;
2067       }
2068       padding_offset++;
2069     }
2070   }
2071 
2072   int default_offset = (int) Bytes::get_Java_u4(aligned_bcp);
2073   int keys, delta;
2074   current_frame->pop_stack(
2075     VerificationType::integer_type(), CHECK_VERIFY(this));
2076   if (bcs->raw_code() == Bytecodes::_tableswitch) {
2077     jint low = (jint)Bytes::get_Java_u4(aligned_bcp + jintSize);
2078     jint high = (jint)Bytes::get_Java_u4(aligned_bcp + 2*jintSize);
2079     if (low > high) {
2080       verify_error(ErrorContext::bad_code(bci),
2081           "low must be less than or equal to high in tableswitch");
2082       return;
2083     }
2084     keys = high - low + 1;
2085     if (keys < 0) {
2086       verify_error(ErrorContext::bad_code(bci), "too many keys in tableswitch");
2087       return;
2088     }
2089     delta = 1;
2090   } else {
2091     keys = (int)Bytes::get_Java_u4(aligned_bcp + jintSize);
2092     if (keys < 0) {
2093       verify_error(ErrorContext::bad_code(bci),
2094                    "number of keys in lookupswitch less than 0");
2095       return;
2096     }
2097     delta = 2;
2098     // Make sure that the lookupswitch items are sorted
2099     for (int i = 0; i < (keys - 1); i++) {
2100       jint this_key = Bytes::get_Java_u4(aligned_bcp + (2+2*i)*jintSize);
2101       jint next_key = Bytes::get_Java_u4(aligned_bcp + (2+2*i+2)*jintSize);
2102       if (this_key >= next_key) {
2103         verify_error(ErrorContext::bad_code(bci),
2104                      "Bad lookupswitch instruction");
2105         return;
2106       }
2107     }
2108   }
2109   int target = bci + default_offset;
2110   stackmap_table->check_jump_target(current_frame, target, CHECK_VERIFY(this));
2111   for (int i = 0; i < keys; i++) {
2112     // Because check_jump_target() may safepoint, the bytecode could have
2113     // moved, which means 'aligned_bcp' is no good and needs to be recalculated.
2114     aligned_bcp = (address)round_to((intptr_t)(bcs->bcp() + 1), jintSize);
2115     target = bci + (jint)Bytes::get_Java_u4(aligned_bcp+(3+i*delta)*jintSize);
2116     stackmap_table->check_jump_target(
2117       current_frame, target, CHECK_VERIFY(this));
2118   }
2119   NOT_PRODUCT(aligned_bcp = NULL);  // no longer valid at this point
2120 }
2121 
2122 bool ClassVerifier::name_in_supers(
2123     Symbol* ref_name, instanceKlassHandle current) {
2124   Klass* super = current->super();
2125   while (super != NULL) {
2126     if (super->name() == ref_name) {
2127       return true;
2128     }
2129     super = super->super();
2130   }
2131   return false;
2132 }
2133 
2134 void ClassVerifier::verify_field_instructions(RawBytecodeStream* bcs,
2135                                               StackMapFrame* current_frame,
2136                                               constantPoolHandle cp,
2137                                               TRAPS) {
2138   u2 index = bcs->get_index_u2();
2139   verify_cp_type(bcs->bci(), index, cp,
2140       1 << JVM_CONSTANT_Fieldref, CHECK_VERIFY(this));
2141 
2142   // Get field name and signature
2143   Symbol* field_name = cp->name_ref_at(index);
2144   Symbol* field_sig = cp->signature_ref_at(index);
2145 
2146   if (!SignatureVerifier::is_valid_type_signature(field_sig)) {
2147     class_format_error(
2148       "Invalid signature for field in class %s referenced "
2149       "from constant pool index %d", _klass->external_name(), index);
2150     return;
2151   }
2152 
2153   // Get referenced class type
2154   VerificationType ref_class_type = cp_ref_index_to_type(
2155     index, cp, CHECK_VERIFY(this));
2156   if (!ref_class_type.is_object()) {
2157     /* Unreachable?  Class file parser verifies Fieldref contents */
2158     verify_error(ErrorContext::bad_type(bcs->bci(),
2159         TypeOrigin::cp(index, ref_class_type)),
2160         "Expecting reference to class in class %s at constant pool index %d",
2161         _klass->external_name(), index);
2162     return;
2163   }
2164   VerificationType target_class_type = ref_class_type;
2165 
2166   assert(sizeof(VerificationType) == sizeof(uintptr_t),
2167         "buffer type must match VerificationType size");
2168   uintptr_t field_type_buffer[2];
2169   VerificationType* field_type = (VerificationType*)field_type_buffer;
2170   // If we make a VerificationType[2] array directly, the compiler calls
2171   // to the c-runtime library to do the allocation instead of just
2172   // stack allocating it.  Plus it would run constructors.  This shows up
2173   // in performance profiles.
2174 
2175   SignatureStream sig_stream(field_sig, false);
2176   VerificationType stack_object_type;
2177   int n = change_sig_to_verificationType(
2178     &sig_stream, field_type, CHECK_VERIFY(this));
2179   u2 bci = bcs->bci();
2180   bool is_assignable;
2181   switch (bcs->raw_code()) {
2182     case Bytecodes::_getstatic: {
2183       for (int i = 0; i < n; i++) {
2184         current_frame->push_stack(field_type[i], CHECK_VERIFY(this));
2185       }
2186       break;
2187     }
2188     case Bytecodes::_putstatic: {
2189       for (int i = n - 1; i >= 0; i--) {
2190         current_frame->pop_stack(field_type[i], CHECK_VERIFY(this));
2191       }
2192       break;
2193     }
2194     case Bytecodes::_getfield: {
2195       stack_object_type = current_frame->pop_stack(
2196         target_class_type, CHECK_VERIFY(this));
2197       for (int i = 0; i < n; i++) {
2198         current_frame->push_stack(field_type[i], CHECK_VERIFY(this));
2199       }
2200       goto check_protected;
2201     }
2202     case Bytecodes::_putfield: {
2203       for (int i = n - 1; i >= 0; i--) {
2204         current_frame->pop_stack(field_type[i], CHECK_VERIFY(this));
2205       }
2206       stack_object_type = current_frame->pop_stack(CHECK_VERIFY(this));
2207 
2208       // The JVMS 2nd edition allows field initialization before the superclass
2209       // initializer, if the field is defined within the current class.
2210       fieldDescriptor fd;
2211       if (stack_object_type == VerificationType::uninitialized_this_type() &&
2212           target_class_type.equals(current_type()) &&
2213           _klass->find_local_field(field_name, field_sig, &fd)) {
2214         stack_object_type = current_type();
2215       }
2216       is_assignable = target_class_type.is_assignable_from(
2217         stack_object_type, this, false, CHECK_VERIFY(this));
2218       if (!is_assignable) {
2219         verify_error(ErrorContext::bad_type(bci,
2220             current_frame->stack_top_ctx(),
2221             TypeOrigin::cp(index, target_class_type)),
2222             "Bad type on operand stack in putfield");
2223         return;
2224       }
2225     }
2226     check_protected: {
2227       if (_this_type == stack_object_type)
2228         break; // stack_object_type must be assignable to _current_class_type
2229       Symbol* ref_class_name =
2230         cp->klass_name_at(cp->klass_ref_index_at(index));
2231       if (!name_in_supers(ref_class_name, current_class()))
2232         // stack_object_type must be assignable to _current_class_type since:
2233         // 1. stack_object_type must be assignable to ref_class.
2234         // 2. ref_class must be _current_class or a subclass of it. It can't
2235         //    be a superclass of it. See revised JVMS 5.4.4.
2236         break;
2237 
2238       Klass* ref_class_oop = load_class(ref_class_name, CHECK);
2239       if (is_protected_access(current_class(), ref_class_oop, field_name,
2240                               field_sig, false)) {
2241         // It's protected access, check if stack object is assignable to
2242         // current class.
2243         is_assignable = current_type().is_assignable_from(
2244           stack_object_type, this, true, CHECK_VERIFY(this));
2245         if (!is_assignable) {
2246           verify_error(ErrorContext::bad_type(bci,
2247               current_frame->stack_top_ctx(),
2248               TypeOrigin::implicit(current_type())),
2249               "Bad access to protected data in getfield");
2250           return;
2251         }
2252       }
2253       break;
2254     }
2255     default: ShouldNotReachHere();
2256   }
2257 }
2258 
2259 // Look at the method's handlers.  If the bci is in the handler's try block
2260 // then check if the handler_pc is already on the stack.  If not, push it
2261 // unless the handler has already been scanned.
2262 void ClassVerifier::push_handlers(ExceptionTable* exhandlers,
2263                                   GrowableArray<u4>* handler_list,
2264                                   GrowableArray<u4>* handler_stack,
2265                                   u4 bci) {
2266   int exlength = exhandlers->length();
2267   for(int x = 0; x < exlength; x++) {
2268     if (bci >= exhandlers->start_pc(x) && bci < exhandlers->end_pc(x)) {
2269       u4 exhandler_pc = exhandlers->handler_pc(x);
2270       if (!handler_list->contains(exhandler_pc)) {
2271         handler_stack->append_if_missing(exhandler_pc);
2272         handler_list->append(exhandler_pc);
2273       }
2274     }
2275   }
2276 }
2277 
2278 // Return TRUE if all code paths starting with start_bc_offset end in
2279 // bytecode athrow or loop.
2280 bool ClassVerifier::ends_in_athrow(u4 start_bc_offset) {
2281   ResourceMark rm;
2282   // Create bytecode stream.
2283   RawBytecodeStream bcs(method());
2284   u4 code_length = method()->code_size();
2285   bcs.set_start(start_bc_offset);
2286   u4 target;
2287   // Create stack for storing bytecode start offsets for if* and *switch.
2288   GrowableArray<u4>* bci_stack = new GrowableArray<u4>(30);
2289   // Create stack for handlers for try blocks containing this handler.
2290   GrowableArray<u4>* handler_stack = new GrowableArray<u4>(30);
2291   // Create list of handlers that have been pushed onto the handler_stack
2292   // so that handlers embedded inside of their own TRY blocks only get
2293   // scanned once.
2294   GrowableArray<u4>* handler_list = new GrowableArray<u4>(30);
2295   // Create list of visited branch opcodes (goto* and if*).
2296   GrowableArray<u4>* visited_branches = new GrowableArray<u4>(30);
2297   ExceptionTable exhandlers(_method());
2298 
2299   while (true) {
2300     if (bcs.is_last_bytecode()) {
2301       // if no more starting offsets to parse or if at the end of the
2302       // method then return false.
2303       if ((bci_stack->is_empty()) || ((u4)bcs.end_bci() == code_length))
2304         return false;
2305       // Pop a bytecode starting offset and scan from there.
2306       bcs.set_start(bci_stack->pop());
2307     }
2308     Bytecodes::Code opcode = bcs.raw_next();
2309     u4 bci = bcs.bci();
2310 
2311     // If the bytecode is in a TRY block, push its handlers so they
2312     // will get parsed.
2313     push_handlers(&exhandlers, handler_list, handler_stack, bci);
2314 
2315     switch (opcode) {
2316       case Bytecodes::_if_icmpeq:
2317       case Bytecodes::_if_icmpne:
2318       case Bytecodes::_if_icmplt:
2319       case Bytecodes::_if_icmpge:
2320       case Bytecodes::_if_icmpgt:
2321       case Bytecodes::_if_icmple:
2322       case Bytecodes::_ifeq:
2323       case Bytecodes::_ifne:
2324       case Bytecodes::_iflt:
2325       case Bytecodes::_ifge:
2326       case Bytecodes::_ifgt:
2327       case Bytecodes::_ifle:
2328       case Bytecodes::_if_acmpeq:
2329       case Bytecodes::_if_acmpne:
2330       case Bytecodes::_ifnull:
2331       case Bytecodes::_ifnonnull:
2332         target = bcs.dest();
2333         if (visited_branches->contains(bci)) {
2334           if (bci_stack->is_empty()) {
2335             if (handler_stack->is_empty()) {
2336               return true;
2337             } else {
2338               // Parse the catch handlers for try blocks containing athrow.
2339               bcs.set_start(handler_stack->pop());
2340             }
2341           } else {
2342             // Pop a bytecode starting offset and scan from there.
2343             bcs.set_start(bci_stack->pop());
2344           }
2345         } else {
2346           if (target > bci) { // forward branch
2347             if (target >= code_length) return false;
2348             // Push the branch target onto the stack.
2349             bci_stack->push(target);
2350             // then, scan bytecodes starting with next.
2351             bcs.set_start(bcs.next_bci());
2352           } else { // backward branch
2353             // Push bytecode offset following backward branch onto the stack.
2354             bci_stack->push(bcs.next_bci());
2355             // Check bytecodes starting with branch target.
2356             bcs.set_start(target);
2357           }
2358           // Record target so we don't branch here again.
2359           visited_branches->append(bci);
2360         }
2361         break;
2362 
2363       case Bytecodes::_goto:
2364       case Bytecodes::_goto_w:
2365         target = (opcode == Bytecodes::_goto ? bcs.dest() : bcs.dest_w());
2366         if (visited_branches->contains(bci)) {
2367           if (bci_stack->is_empty()) {
2368             if (handler_stack->is_empty()) {
2369               return true;
2370             } else {
2371               // Parse the catch handlers for try blocks containing athrow.
2372               bcs.set_start(handler_stack->pop());
2373             }
2374           } else {
2375             // Been here before, pop new starting offset from stack.
2376             bcs.set_start(bci_stack->pop());
2377           }
2378         } else {
2379           if (target >= code_length) return false;
2380           // Continue scanning from the target onward.
2381           bcs.set_start(target);
2382           // Record target so we don't branch here again.
2383           visited_branches->append(bci);
2384         }
2385         break;
2386 
2387       // Check that all switch alternatives end in 'athrow' bytecodes. Since it
2388       // is  difficult to determine where each switch alternative ends, parse
2389       // each switch alternative until either hit a 'return', 'athrow', or reach
2390       // the end of the method's bytecodes.  This is gross but should be okay
2391       // because:
2392       // 1. tableswitch and lookupswitch byte codes in handlers for ctor explicit
2393       //    constructor invocations should be rare.
2394       // 2. if each switch alternative ends in an athrow then the parsing should be
2395       //    short.  If there is no athrow then it is bogus code, anyway.
2396       case Bytecodes::_lookupswitch:
2397       case Bytecodes::_tableswitch:
2398         {
2399           address aligned_bcp = (address) round_to((intptr_t)(bcs.bcp() + 1), jintSize);
2400           u4 default_offset = Bytes::get_Java_u4(aligned_bcp) + bci;
2401           int keys, delta;
2402           if (opcode == Bytecodes::_tableswitch) {
2403             jint low = (jint)Bytes::get_Java_u4(aligned_bcp + jintSize);
2404             jint high = (jint)Bytes::get_Java_u4(aligned_bcp + 2*jintSize);
2405             // This is invalid, but let the regular bytecode verifier
2406             // report this because the user will get a better error message.
2407             if (low > high) return true;
2408             keys = high - low + 1;
2409             delta = 1;
2410           } else {
2411             keys = (int)Bytes::get_Java_u4(aligned_bcp + jintSize);
2412             delta = 2;
2413           }
2414           // Invalid, let the regular bytecode verifier deal with it.
2415           if (keys < 0) return true;
2416 
2417           // Push the offset of the next bytecode onto the stack.
2418           bci_stack->push(bcs.next_bci());
2419 
2420           // Push the switch alternatives onto the stack.
2421           for (int i = 0; i < keys; i++) {
2422             u4 target = bci + (jint)Bytes::get_Java_u4(aligned_bcp+(3+i*delta)*jintSize);
2423             if (target > code_length) return false;
2424             bci_stack->push(target);
2425           }
2426 
2427           // Start bytecode parsing for the switch at the default alternative.
2428           if (default_offset > code_length) return false;
2429           bcs.set_start(default_offset);
2430           break;
2431         }
2432 
2433       case Bytecodes::_return:
2434         return false;
2435 
2436       case Bytecodes::_athrow:
2437         {
2438           if (bci_stack->is_empty()) {
2439             if (handler_stack->is_empty()) {
2440               return true;
2441             } else {
2442               // Parse the catch handlers for try blocks containing athrow.
2443               bcs.set_start(handler_stack->pop());
2444             }
2445           } else {
2446             // Pop a bytecode offset and starting scanning from there.
2447             bcs.set_start(bci_stack->pop());
2448           }
2449         }
2450         break;
2451 
2452       default:
2453         ;
2454     } // end switch
2455   } // end while loop
2456 
2457   return false;
2458 }
2459 
2460 void ClassVerifier::verify_invoke_init(
2461     RawBytecodeStream* bcs, u2 ref_class_index, VerificationType ref_class_type,
2462     StackMapFrame* current_frame, u4 code_length, bool in_try_block,
2463     bool *this_uninit, constantPoolHandle cp, StackMapTable* stackmap_table,
2464     TRAPS) {
2465   u2 bci = bcs->bci();
2466   VerificationType type = current_frame->pop_stack(
2467     VerificationType::reference_check(), CHECK_VERIFY(this));
2468   if (type == VerificationType::uninitialized_this_type()) {
2469     // The method must be an <init> method of this class or its superclass
2470     Klass* superk = current_class()->super();
2471     if (ref_class_type.name() != current_class()->name() &&
2472         ref_class_type.name() != superk->name()) {
2473       verify_error(ErrorContext::bad_type(bci,
2474           TypeOrigin::implicit(ref_class_type),
2475           TypeOrigin::implicit(current_type())),
2476           "Bad <init> method call");
2477       return;
2478     }
2479 
2480     // If this invokespecial call is done from inside of a TRY block then make
2481     // sure that all catch clause paths end in a throw.  Otherwise, this can
2482     // result in returning an incomplete object.
2483     if (in_try_block) {
2484       ExceptionTable exhandlers(_method());
2485       int exlength = exhandlers.length();
2486       for(int i = 0; i < exlength; i++) {
2487         u2 start_pc = exhandlers.start_pc(i);
2488         u2 end_pc = exhandlers.end_pc(i);
2489 
2490         if (bci >= start_pc && bci < end_pc) {
2491           if (!ends_in_athrow(exhandlers.handler_pc(i))) {
2492             verify_error(ErrorContext::bad_code(bci),
2493               "Bad <init> method call from after the start of a try block");
2494             return;
2495           } else if (VerboseVerification) {
2496             ResourceMark rm;
2497             tty->print_cr(
2498               "Survived call to ends_in_athrow(): %s",
2499               current_class()->name()->as_C_string());
2500           }
2501         }
2502       }
2503 
2504       // Check the exception handler target stackmaps with the locals from the
2505       // incoming stackmap (before initialize_object() changes them to outgoing
2506       // state).
2507       verify_exception_handler_targets(bci, true, current_frame,
2508                                        stackmap_table, CHECK_VERIFY(this));
2509     } // in_try_block
2510 
2511     current_frame->initialize_object(type, current_type());
2512     *this_uninit = true;
2513   } else if (type.is_uninitialized()) {
2514     u2 new_offset = type.bci();
2515     address new_bcp = bcs->bcp() - bci + new_offset;
2516     if (new_offset > (code_length - 3) || (*new_bcp) != Bytecodes::_new) {
2517       /* Unreachable?  Stack map parsing ensures valid type and new
2518        * instructions have a valid BCI. */
2519       verify_error(ErrorContext::bad_code(new_offset),
2520                    "Expecting new instruction");
2521       return;
2522     }
2523     u2 new_class_index = Bytes::get_Java_u2(new_bcp + 1);
2524     verify_cp_class_type(bci, new_class_index, cp, CHECK_VERIFY(this));
2525 
2526     // The method must be an <init> method of the indicated class
2527     VerificationType new_class_type = cp_index_to_type(
2528       new_class_index, cp, CHECK_VERIFY(this));
2529     if (!new_class_type.equals(ref_class_type)) {
2530       verify_error(ErrorContext::bad_type(bci,
2531           TypeOrigin::cp(new_class_index, new_class_type),
2532           TypeOrigin::cp(ref_class_index, ref_class_type)),
2533           "Call to wrong <init> method");
2534       return;
2535     }
2536     // According to the VM spec, if the referent class is a superclass of the
2537     // current class, and is in a different runtime package, and the method is
2538     // protected, then the objectref must be the current class or a subclass
2539     // of the current class.
2540     VerificationType objectref_type = new_class_type;
2541     if (name_in_supers(ref_class_type.name(), current_class())) {
2542       Klass* ref_klass = load_class(ref_class_type.name(), CHECK);
2543       Method* m = InstanceKlass::cast(ref_klass)->uncached_lookup_method(
2544         vmSymbols::object_initializer_name(),
2545         cp->signature_ref_at(bcs->get_index_u2()), Klass::find_overpass);
2546       // Do nothing if method is not found.  Let resolution detect the error.
2547       if (m != NULL) {
2548         instanceKlassHandle mh(THREAD, m->method_holder());
2549         if (m->is_protected() && !mh->is_same_class_package(_klass())) {
2550           bool assignable = current_type().is_assignable_from(
2551             objectref_type, this, true, CHECK_VERIFY(this));
2552           if (!assignable) {
2553             verify_error(ErrorContext::bad_type(bci,
2554                 TypeOrigin::cp(new_class_index, objectref_type),
2555                 TypeOrigin::implicit(current_type())),
2556                 "Bad access to protected <init> method");
2557             return;
2558           }
2559         }
2560       }
2561     }
2562     // Check the exception handler target stackmaps with the locals from the
2563     // incoming stackmap (before initialize_object() changes them to outgoing
2564     // state).
2565     if (in_try_block) {
2566       verify_exception_handler_targets(bci, *this_uninit, current_frame,
2567                                        stackmap_table, CHECK_VERIFY(this));
2568     }
2569     current_frame->initialize_object(type, new_class_type);
2570   } else {
2571     verify_error(ErrorContext::bad_type(bci, current_frame->stack_top_ctx()),
2572         "Bad operand type when invoking <init>");
2573     return;
2574   }
2575 }
2576 
2577 bool ClassVerifier::is_same_or_direct_interface(
2578     instanceKlassHandle klass,
2579     VerificationType klass_type,
2580     VerificationType ref_class_type) {
2581   if (ref_class_type.equals(klass_type)) return true;
2582   Array<Klass*>* local_interfaces = klass->local_interfaces();
2583   if (local_interfaces != NULL) {
2584     for (int x = 0; x < local_interfaces->length(); x++) {
2585       Klass* k = local_interfaces->at(x);
2586       assert (k != NULL && k->is_interface(), "invalid interface");
2587       if (ref_class_type.equals(VerificationType::reference_type(k->name()))) {
2588         return true;
2589       }
2590     }
2591   }
2592   return false;
2593 }
2594 
2595 void ClassVerifier::verify_invoke_instructions(
2596     RawBytecodeStream* bcs, u4 code_length, StackMapFrame* current_frame,
2597     bool in_try_block, bool *this_uninit, VerificationType return_type,
2598     constantPoolHandle cp, StackMapTable* stackmap_table, TRAPS) {
2599   // Make sure the constant pool item is the right type
2600   u2 index = bcs->get_index_u2();
2601   Bytecodes::Code opcode = bcs->raw_code();
2602   unsigned int types;
2603   switch (opcode) {
2604     case Bytecodes::_invokeinterface:
2605       types = 1 << JVM_CONSTANT_InterfaceMethodref;
2606       break;
2607     case Bytecodes::_invokedynamic:
2608       types = 1 << JVM_CONSTANT_InvokeDynamic;
2609       break;
2610     case Bytecodes::_invokespecial:
2611     case Bytecodes::_invokestatic:
2612       types = (_klass->major_version() < STATIC_METHOD_IN_INTERFACE_MAJOR_VERSION) ?
2613         (1 << JVM_CONSTANT_Methodref) :
2614         ((1 << JVM_CONSTANT_InterfaceMethodref) | (1 << JVM_CONSTANT_Methodref));
2615       break;
2616     default:
2617       types = 1 << JVM_CONSTANT_Methodref;
2618   }
2619   verify_cp_type(bcs->bci(), index, cp, types, CHECK_VERIFY(this));
2620 
2621   // Get method name and signature
2622   Symbol* method_name = cp->name_ref_at(index);
2623   Symbol* method_sig = cp->signature_ref_at(index);
2624 
2625   if (!SignatureVerifier::is_valid_method_signature(method_sig)) {
2626     class_format_error(
2627       "Invalid method signature in class %s referenced "
2628       "from constant pool index %d", _klass->external_name(), index);
2629     return;
2630   }
2631 
2632   // Get referenced class type
2633   VerificationType ref_class_type;
2634   if (opcode == Bytecodes::_invokedynamic) {
2635     if (!EnableInvokeDynamic ||
2636         _klass->major_version() < Verifier::INVOKEDYNAMIC_MAJOR_VERSION) {
2637         if (!EnableInvokeDynamic) {
2638             class_format_error("invokedynamic instructions not enabled in this JVM");
2639         } else {
2640             class_format_error("invokedynamic instructions not supported by this class file version (%d), class %s",
2641                                _klass->major_version(), _klass->external_name());
2642         }
2643       return;
2644     }
2645   } else {
2646     ref_class_type = cp_ref_index_to_type(index, cp, CHECK_VERIFY(this));
2647   }
2648 
2649   // For a small signature length, we just allocate 128 bytes instead
2650   // of parsing the signature once to find its size.
2651   // -3 is for '(', ')' and return descriptor; multiply by 2 is for
2652   // longs/doubles to be consertive.
2653   assert(sizeof(VerificationType) == sizeof(uintptr_t),
2654         "buffer type must match VerificationType size");
2655   uintptr_t on_stack_sig_types_buffer[128];
2656   // If we make a VerificationType[128] array directly, the compiler calls
2657   // to the c-runtime library to do the allocation instead of just
2658   // stack allocating it.  Plus it would run constructors.  This shows up
2659   // in performance profiles.
2660 
2661   VerificationType* sig_types;
2662   int size = (method_sig->utf8_length() - 3) * 2;
2663   if (size > 128) {
2664     // Long and double occupies two slots here.
2665     ArgumentSizeComputer size_it(method_sig);
2666     size = size_it.size();
2667     sig_types = NEW_RESOURCE_ARRAY_IN_THREAD(THREAD, VerificationType, size);
2668   } else{
2669     sig_types = (VerificationType*)on_stack_sig_types_buffer;
2670   }
2671   SignatureStream sig_stream(method_sig);
2672   int sig_i = 0;
2673   while (!sig_stream.at_return_type()) {
2674     sig_i += change_sig_to_verificationType(
2675       &sig_stream, &sig_types[sig_i], CHECK_VERIFY(this));
2676     sig_stream.next();
2677   }
2678   int nargs = sig_i;
2679 
2680 #ifdef ASSERT
2681   {
2682     ArgumentSizeComputer size_it(method_sig);
2683     assert(nargs == size_it.size(), "Argument sizes do not match");
2684     assert(nargs <= (method_sig->utf8_length() - 3) * 2, "estimate of max size isn't conservative enough");
2685   }
2686 #endif
2687 
2688   // Check instruction operands
2689   u2 bci = bcs->bci();
2690   if (opcode == Bytecodes::_invokeinterface) {
2691     address bcp = bcs->bcp();
2692     // 4905268: count operand in invokeinterface should be nargs+1, not nargs.
2693     // JSR202 spec: The count operand of an invokeinterface instruction is valid if it is
2694     // the difference between the size of the operand stack before and after the instruction
2695     // executes.
2696     if (*(bcp+3) != (nargs+1)) {
2697       verify_error(ErrorContext::bad_code(bci),
2698           "Inconsistent args count operand in invokeinterface");
2699       return;
2700     }
2701     if (*(bcp+4) != 0) {
2702       verify_error(ErrorContext::bad_code(bci),
2703           "Fourth operand byte of invokeinterface must be zero");
2704       return;
2705     }
2706   }
2707 
2708   if (opcode == Bytecodes::_invokedynamic) {
2709     address bcp = bcs->bcp();
2710     if (*(bcp+3) != 0 || *(bcp+4) != 0) {
2711       verify_error(ErrorContext::bad_code(bci),
2712           "Third and fourth operand bytes of invokedynamic must be zero");
2713       return;
2714     }
2715   }
2716 
2717   if (method_name->byte_at(0) == '<') {
2718     // Make sure <init> can only be invoked by invokespecial
2719     if (opcode != Bytecodes::_invokespecial ||
2720         method_name != vmSymbols::object_initializer_name()) {
2721       verify_error(ErrorContext::bad_code(bci),
2722           "Illegal call to internal method");
2723       return;
2724     }
2725   } else if (opcode == Bytecodes::_invokespecial
2726              && !is_same_or_direct_interface(current_class(), current_type(), ref_class_type)
2727              && !ref_class_type.equals(VerificationType::reference_type(
2728                   current_class()->super()->name()))) {
2729     bool subtype = false;
2730     bool have_imr_indirect = cp->tag_at(index).value() == JVM_CONSTANT_InterfaceMethodref;
2731     if (!current_class()->is_anonymous()) {
2732       subtype = ref_class_type.is_assignable_from(
2733                  current_type(), this, false, CHECK_VERIFY(this));
2734     } else {
2735       VerificationType host_klass_type =
2736                         VerificationType::reference_type(current_class()->host_klass()->name());
2737       subtype = ref_class_type.is_assignable_from(host_klass_type, this, false, CHECK_VERIFY(this));
2738 
2739       // If invokespecial of IMR, need to recheck for same or
2740       // direct interface relative to the host class
2741       have_imr_indirect = (have_imr_indirect &&
2742                            !is_same_or_direct_interface(
2743                              InstanceKlass::cast(current_class()->host_klass()),
2744                              host_klass_type, ref_class_type));
2745     }
2746     if (!subtype) {
2747       verify_error(ErrorContext::bad_code(bci),
2748           "Bad invokespecial instruction: "
2749           "current class isn't assignable to reference class.");
2750        return;
2751     } else if (have_imr_indirect) {
2752       verify_error(ErrorContext::bad_code(bci),
2753           "Bad invokespecial instruction: "
2754           "interface method reference is in an indirect superinterface.");
2755       return;
2756     }
2757 
2758   }
2759   // Match method descriptor with operand stack
2760   for (int i = nargs - 1; i >= 0; i--) {  // Run backwards
2761     current_frame->pop_stack(sig_types[i], CHECK_VERIFY(this));
2762   }
2763   // Check objectref on operand stack
2764   if (opcode != Bytecodes::_invokestatic &&
2765       opcode != Bytecodes::_invokedynamic) {
2766     if (method_name == vmSymbols::object_initializer_name()) {  // <init> method
2767       verify_invoke_init(bcs, index, ref_class_type, current_frame,
2768         code_length, in_try_block, this_uninit, cp, stackmap_table,
2769         CHECK_VERIFY(this));
2770     } else {   // other methods
2771       // Ensures that target class is assignable to method class.
2772       if (opcode == Bytecodes::_invokespecial) {
2773         if (!current_class()->is_anonymous()) {
2774           current_frame->pop_stack(current_type(), CHECK_VERIFY(this));
2775         } else {
2776           // anonymous class invokespecial calls: check if the
2777           // objectref is a subtype of the host_klass of the current class
2778           // to allow an anonymous class to reference methods in the host_klass
2779           VerificationType top = current_frame->pop_stack(CHECK_VERIFY(this));
2780           VerificationType hosttype =
2781             VerificationType::reference_type(current_class()->host_klass()->name());
2782           bool subtype = hosttype.is_assignable_from(top, this, false, CHECK_VERIFY(this));
2783           if (!subtype) {
2784             verify_error( ErrorContext::bad_type(current_frame->offset(),
2785               current_frame->stack_top_ctx(),
2786               TypeOrigin::implicit(top)),
2787               "Bad type on operand stack");
2788             return;
2789           }
2790         }
2791       } else if (opcode == Bytecodes::_invokevirtual) {
2792         VerificationType stack_object_type =
2793           current_frame->pop_stack(ref_class_type, CHECK_VERIFY(this));
2794         if (current_type() != stack_object_type) {
2795           assert(cp->cache() == NULL, "not rewritten yet");
2796           Symbol* ref_class_name =
2797             cp->klass_name_at(cp->klass_ref_index_at(index));
2798           // See the comments in verify_field_instructions() for
2799           // the rationale behind this.
2800           if (name_in_supers(ref_class_name, current_class())) {
2801             Klass* ref_class = load_class(ref_class_name, CHECK);
2802             if (is_protected_access(
2803                   _klass, ref_class, method_name, method_sig, true)) {
2804               // It's protected access, check if stack object is
2805               // assignable to current class.
2806               bool is_assignable = current_type().is_assignable_from(
2807                 stack_object_type, this, true, CHECK_VERIFY(this));
2808               if (!is_assignable) {
2809                 if (ref_class_type.name() == vmSymbols::java_lang_Object()
2810                     && stack_object_type.is_array()
2811                     && method_name == vmSymbols::clone_name()) {
2812                   // Special case: arrays pretend to implement public Object
2813                   // clone().
2814                 } else {
2815                   verify_error(ErrorContext::bad_type(bci,
2816                       current_frame->stack_top_ctx(),
2817                       TypeOrigin::implicit(current_type())),
2818                       "Bad access to protected data in invokevirtual");
2819                   return;
2820                 }
2821               }
2822             }
2823           }
2824         }
2825       } else {
2826         assert(opcode == Bytecodes::_invokeinterface, "Unexpected opcode encountered");
2827         current_frame->pop_stack(ref_class_type, CHECK_VERIFY(this));
2828       }
2829     }
2830   }
2831   // Push the result type.
2832   if (sig_stream.type() != T_VOID) {
2833     if (method_name == vmSymbols::object_initializer_name()) {
2834       // <init> method must have a void return type
2835       /* Unreachable?  Class file parser verifies that methods with '<' have
2836        * void return */
2837       verify_error(ErrorContext::bad_code(bci),
2838           "Return type must be void in <init> method");
2839       return;
2840     }
2841     VerificationType return_type[2];
2842     int n = change_sig_to_verificationType(
2843       &sig_stream, return_type, CHECK_VERIFY(this));
2844     for (int i = 0; i < n; i++) {
2845       current_frame->push_stack(return_type[i], CHECK_VERIFY(this)); // push types backwards
2846     }
2847   }
2848 }
2849 
2850 VerificationType ClassVerifier::get_newarray_type(
2851     u2 index, u2 bci, TRAPS) {
2852   const char* from_bt[] = {
2853     NULL, NULL, NULL, NULL, "[Z", "[C", "[F", "[D", "[B", "[S", "[I", "[J",
2854   };
2855   if (index < T_BOOLEAN || index > T_LONG) {
2856     verify_error(ErrorContext::bad_code(bci), "Illegal newarray instruction");
2857     return VerificationType::bogus_type();
2858   }
2859 
2860   // from_bt[index] contains the array signature which has a length of 2
2861   Symbol* sig = create_temporary_symbol(
2862     from_bt[index], 2, CHECK_(VerificationType::bogus_type()));
2863   return VerificationType::reference_type(sig);
2864 }
2865 
2866 void ClassVerifier::verify_anewarray(
2867     u2 bci, u2 index, constantPoolHandle cp,
2868     StackMapFrame* current_frame, TRAPS) {
2869   verify_cp_class_type(bci, index, cp, CHECK_VERIFY(this));
2870   current_frame->pop_stack(
2871     VerificationType::integer_type(), CHECK_VERIFY(this));
2872 
2873   VerificationType component_type =
2874     cp_index_to_type(index, cp, CHECK_VERIFY(this));
2875   int length;
2876   char* arr_sig_str;
2877   if (component_type.is_array()) {     // it's an array
2878     const char* component_name = component_type.name()->as_utf8();
2879     // add one dimension to component
2880     length = (int)strlen(component_name) + 1;
2881     arr_sig_str = NEW_RESOURCE_ARRAY_IN_THREAD(THREAD, char, length);
2882     arr_sig_str[0] = '[';
2883     strncpy(&arr_sig_str[1], component_name, length - 1);
2884   } else {         // it's an object or interface
2885     const char* component_name = component_type.name()->as_utf8();
2886     // add one dimension to component with 'L' prepended and ';' postpended.
2887     length = (int)strlen(component_name) + 3;
2888     arr_sig_str = NEW_RESOURCE_ARRAY_IN_THREAD(THREAD, char, length);
2889     arr_sig_str[0] = '[';
2890     arr_sig_str[1] = 'L';
2891     strncpy(&arr_sig_str[2], component_name, length - 2);
2892     arr_sig_str[length - 1] = ';';
2893   }
2894   Symbol* arr_sig = create_temporary_symbol(
2895     arr_sig_str, length, CHECK_VERIFY(this));
2896   VerificationType new_array_type = VerificationType::reference_type(arr_sig);
2897   current_frame->push_stack(new_array_type, CHECK_VERIFY(this));
2898 }
2899 
2900 void ClassVerifier::verify_iload(u2 index, StackMapFrame* current_frame, TRAPS) {
2901   current_frame->get_local(
2902     index, VerificationType::integer_type(), CHECK_VERIFY(this));
2903   current_frame->push_stack(
2904     VerificationType::integer_type(), CHECK_VERIFY(this));
2905 }
2906 
2907 void ClassVerifier::verify_lload(u2 index, StackMapFrame* current_frame, TRAPS) {
2908   current_frame->get_local_2(
2909     index, VerificationType::long_type(),
2910     VerificationType::long2_type(), CHECK_VERIFY(this));
2911   current_frame->push_stack_2(
2912     VerificationType::long_type(),
2913     VerificationType::long2_type(), CHECK_VERIFY(this));
2914 }
2915 
2916 void ClassVerifier::verify_fload(u2 index, StackMapFrame* current_frame, TRAPS) {
2917   current_frame->get_local(
2918     index, VerificationType::float_type(), CHECK_VERIFY(this));
2919   current_frame->push_stack(
2920     VerificationType::float_type(), CHECK_VERIFY(this));
2921 }
2922 
2923 void ClassVerifier::verify_dload(u2 index, StackMapFrame* current_frame, TRAPS) {
2924   current_frame->get_local_2(
2925     index, VerificationType::double_type(),
2926     VerificationType::double2_type(), CHECK_VERIFY(this));
2927   current_frame->push_stack_2(
2928     VerificationType::double_type(),
2929     VerificationType::double2_type(), CHECK_VERIFY(this));
2930 }
2931 
2932 void ClassVerifier::verify_aload(u2 index, StackMapFrame* current_frame, TRAPS) {
2933   VerificationType type = current_frame->get_local(
2934     index, VerificationType::reference_check(), CHECK_VERIFY(this));
2935   current_frame->push_stack(type, CHECK_VERIFY(this));
2936 }
2937 
2938 void ClassVerifier::verify_istore(u2 index, StackMapFrame* current_frame, TRAPS) {
2939   current_frame->pop_stack(
2940     VerificationType::integer_type(), CHECK_VERIFY(this));
2941   current_frame->set_local(
2942     index, VerificationType::integer_type(), CHECK_VERIFY(this));
2943 }
2944 
2945 void ClassVerifier::verify_lstore(u2 index, StackMapFrame* current_frame, TRAPS) {
2946   current_frame->pop_stack_2(
2947     VerificationType::long2_type(),
2948     VerificationType::long_type(), CHECK_VERIFY(this));
2949   current_frame->set_local_2(
2950     index, VerificationType::long_type(),
2951     VerificationType::long2_type(), CHECK_VERIFY(this));
2952 }
2953 
2954 void ClassVerifier::verify_fstore(u2 index, StackMapFrame* current_frame, TRAPS) {
2955   current_frame->pop_stack(VerificationType::float_type(), CHECK_VERIFY(this));
2956   current_frame->set_local(
2957     index, VerificationType::float_type(), CHECK_VERIFY(this));
2958 }
2959 
2960 void ClassVerifier::verify_dstore(u2 index, StackMapFrame* current_frame, TRAPS) {
2961   current_frame->pop_stack_2(
2962     VerificationType::double2_type(),
2963     VerificationType::double_type(), CHECK_VERIFY(this));
2964   current_frame->set_local_2(
2965     index, VerificationType::double_type(),
2966     VerificationType::double2_type(), CHECK_VERIFY(this));
2967 }
2968 
2969 void ClassVerifier::verify_astore(u2 index, StackMapFrame* current_frame, TRAPS) {
2970   VerificationType type = current_frame->pop_stack(
2971     VerificationType::reference_check(), CHECK_VERIFY(this));
2972   current_frame->set_local(index, type, CHECK_VERIFY(this));
2973 }
2974 
2975 void ClassVerifier::verify_iinc(u2 index, StackMapFrame* current_frame, TRAPS) {
2976   VerificationType type = current_frame->get_local(
2977     index, VerificationType::integer_type(), CHECK_VERIFY(this));
2978   current_frame->set_local(index, type, CHECK_VERIFY(this));
2979 }
2980 
2981 void ClassVerifier::verify_return_value(
2982     VerificationType return_type, VerificationType type, u2 bci,
2983     StackMapFrame* current_frame, TRAPS) {
2984   if (return_type == VerificationType::bogus_type()) {
2985     verify_error(ErrorContext::bad_type(bci,
2986         current_frame->stack_top_ctx(), TypeOrigin::signature(return_type)),
2987         "Method expects a return value");
2988     return;
2989   }
2990   bool match = return_type.is_assignable_from(type, this, false, CHECK_VERIFY(this));
2991   if (!match) {
2992     verify_error(ErrorContext::bad_type(bci,
2993         current_frame->stack_top_ctx(), TypeOrigin::signature(return_type)),
2994         "Bad return type");
2995     return;
2996   }
2997 }
2998 
2999 // The verifier creates symbols which are substrings of Symbols.
3000 // These are stored in the verifier until the end of verification so that
3001 // they can be reference counted.
3002 Symbol* ClassVerifier::create_temporary_symbol(const Symbol *s, int begin,
3003                                                int end, TRAPS) {
3004   Symbol* sym = SymbolTable::new_symbol(s, begin, end, CHECK_NULL);
3005   _symbols->push(sym);
3006   return sym;
3007 }
3008 
3009 Symbol* ClassVerifier::create_temporary_symbol(const char *s, int length, TRAPS) {
3010   Symbol* sym = SymbolTable::new_symbol(s, length, CHECK_NULL);
3011   _symbols->push(sym);
3012   return sym;
3013 }
--- EOF ---