1 /*
  2  * Copyright (c) 1997, 2025, Oracle and/or its affiliates. All rights reserved.
  3  * Copyright (c) 2014, 2020, Red Hat Inc. All rights reserved.
  4  * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
  5  *
  6  * This code is free software; you can redistribute it and/or modify it
  7  * under the terms of the GNU General Public License version 2 only, as
  8  * published by the Free Software Foundation.
  9  *
 10  * This code is distributed in the hope that it will be useful, but WITHOUT
 11  * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
 12  * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
 13  * version 2 for more details (a copy is included in the LICENSE file that
 14  * accompanied this code).
 15  *
 16  * You should have received a copy of the GNU General Public License version
 17  * 2 along with this work; if not, write to the Free Software Foundation,
 18  * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
 19  *
 20  * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
 21  * or visit www.oracle.com if you need additional information or have any
 22  * questions.
 23  *
 24  */
 25 
 26 #include "compiler/oopMap.hpp"
 27 #include "interpreter/interpreter.hpp"
 28 #include "memory/resourceArea.hpp"
 29 #include "memory/universe.hpp"
 30 #include "oops/markWord.hpp"
 31 #include "oops/method.hpp"
 32 #include "oops/oop.inline.hpp"
 33 #include "prims/methodHandles.hpp"
 34 #include "runtime/frame.inline.hpp"
 35 #include "runtime/handles.inline.hpp"
 36 #include "runtime/javaCalls.hpp"
 37 #include "runtime/monitorChunk.hpp"
 38 #include "runtime/os.inline.hpp"
 39 #include "runtime/signature.hpp"
 40 #include "runtime/stackWatermarkSet.hpp"
 41 #include "runtime/stubCodeGenerator.hpp"
 42 #include "runtime/stubRoutines.hpp"
 43 #include "vmreg_aarch64.inline.hpp"
 44 #ifdef COMPILER1
 45 #include "c1/c1_Runtime1.hpp"
 46 #include "runtime/vframeArray.hpp"
 47 #endif
 48 
 49 #ifdef ASSERT
 50 void RegisterMap::check_location_valid() {
 51 }
 52 #endif
 53 
 54 
 55 // Profiling/safepoint support
 56 
 57 bool frame::safe_for_sender(JavaThread *thread) {
 58   if (is_heap_frame()) {
 59     return true;
 60   }
 61   address   sp = (address)_sp;
 62   address   fp = (address)_fp;
 63   address   unextended_sp = (address)_unextended_sp;
 64 
 65   // consider stack guards when trying to determine "safe" stack pointers
 66   // sp must be within the usable part of the stack (not in guards)
 67   if (!thread->is_in_usable_stack(sp)) {
 68     return false;
 69   }
 70 
 71   // When we are running interpreted code the machine stack pointer, SP, is
 72   // set low enough so that the Java expression stack can grow and shrink
 73   // without ever exceeding the machine stack bounds.  So, ESP >= SP.
 74 
 75   // When we call out of an interpreted method, SP is incremented so that
 76   // the space between SP and ESP is removed.  The SP saved in the callee's
 77   // frame is the SP *before* this increment.  So, when we walk a stack of
 78   // interpreter frames the sender's SP saved in a frame might be less than
 79   // the SP at the point of call.
 80 
 81   // So unextended sp must be within the stack but we need not to check
 82   // that unextended sp >= sp
 83   if (!thread->is_in_full_stack_checked(unextended_sp)) {
 84     return false;
 85   }
 86 
 87   // an fp must be within the stack and above (but not equal) sp
 88   // second evaluation on fp+ is added to handle situation where fp is -1
 89   bool fp_safe = thread->is_in_stack_range_excl(fp, sp) &&
 90                  thread->is_in_full_stack_checked(fp + (return_addr_offset * sizeof(void*)));
 91 
 92   // We know sp/unextended_sp are safe only fp is questionable here
 93 
 94   // If the current frame is known to the code cache then we can attempt to
 95   // to construct the sender and do some validation of it. This goes a long way
 96   // toward eliminating issues when we get in frame construction code
 97 
 98   if (_cb != nullptr ) {
 99 
100     // First check if frame is complete and tester is reliable
101     // Unfortunately we can only check frame complete for runtime stubs and nmethod
102     // other generic buffer blobs are more problematic so we just assume they are
103     // ok. adapter blobs never have a frame complete and are never ok.
104 
105     if (!_cb->is_frame_complete_at(_pc)) {
106       if (_cb->is_nmethod() || _cb->is_adapter_blob() || _cb->is_runtime_stub()) {
107         return false;
108       }
109     }
110 
111     // Could just be some random pointer within the codeBlob
112     if (!_cb->code_contains(_pc)) {
113       return false;
114     }
115 
116     // Entry frame checks
117     if (is_entry_frame()) {
118       // an entry frame must have a valid fp.
119       return fp_safe && is_entry_frame_valid(thread);
120     } else if (is_upcall_stub_frame()) {
121       return fp_safe;
122     }
123 
124     intptr_t* sender_sp = nullptr;
125     intptr_t* sender_unextended_sp = nullptr;
126     address   sender_pc = nullptr;
127     intptr_t* saved_fp =  nullptr;
128 
129     if (is_interpreted_frame()) {
130       // fp must be safe
131       if (!fp_safe) {
132         return false;
133       }
134 
135       // for interpreted frames, the value below is the sender "raw" sp,
136       // which can be different from the sender unextended sp (the sp seen
137       // by the sender) because of current frame local variables
138       sender_sp = (intptr_t*) addr_at(sender_sp_offset);
139       sender_unextended_sp = (intptr_t*) this->fp()[interpreter_frame_sender_sp_offset];
140       saved_fp = (intptr_t*) this->fp()[link_offset];
141       sender_pc = pauth_strip_verifiable((address) this->fp()[return_addr_offset]);
142     } else {
143       // must be some sort of compiled/runtime frame
144       // fp does not have to be safe (although it could be check for c1?)
145 
146       // check for a valid frame_size, otherwise we are unlikely to get a valid sender_pc
147       if (_cb->frame_size() <= 0) {
148         return false;
149       }
150 
151       sender_sp = _unextended_sp + _cb->frame_size();
152       // Is sender_sp safe?
153       if (!thread->is_in_full_stack_checked((address)sender_sp)) {
154         return false;
155       }
156       sender_unextended_sp = sender_sp;
157       // Note: frame::sender_sp_offset is only valid for compiled frame
158       saved_fp = (intptr_t*) *(sender_sp - frame::sender_sp_offset);
159       // Note: PAC authentication may fail in case broken frame is passed in.
160       // Just strip it for now.
161       sender_pc = pauth_strip_pointer((address) *(sender_sp - 1));
162     }
163 
164     if (Continuation::is_return_barrier_entry(sender_pc)) {
165       // sender_pc might be invalid so check that the frame
166       // actually belongs to a Continuation.
167       if (!Continuation::is_frame_in_continuation(thread, *this)) {
168         return false;
169       }
170       // If our sender_pc is the return barrier, then our "real" sender is the continuation entry
171       frame s = Continuation::continuation_bottom_sender(thread, *this, sender_sp);
172       sender_sp = s.sp();
173       sender_pc = s.pc();
174     }
175 
176     // If the potential sender is the interpreter then we can do some more checking
177     if (Interpreter::contains(sender_pc)) {
178 
179       // fp is always saved in a recognizable place in any code we generate. However
180       // only if the sender is interpreted/call_stub (c1 too?) are we certain that the saved fp
181       // is really a frame pointer.
182 
183       if (!thread->is_in_stack_range_excl((address)saved_fp, (address)sender_sp)) {
184         return false;
185       }
186 
187       // construct the potential sender
188 
189       frame sender(sender_sp, sender_unextended_sp, saved_fp, sender_pc);
190 
191       return sender.is_interpreted_frame_valid(thread);
192 
193     }
194 
195     // We must always be able to find a recognizable pc
196     CodeBlob* sender_blob = CodeCache::find_blob(sender_pc);
197     if (sender_pc == nullptr ||  sender_blob == nullptr) {
198       return false;
199     }
200 
201     // Could just be some random pointer within the codeBlob
202     if (!sender_blob->code_contains(sender_pc)) {
203       return false;
204     }
205 
206     // We should never be able to see an adapter if the current frame is something from code cache
207     if (sender_blob->is_adapter_blob()) {
208       return false;
209     }
210 
211     // Could be the call_stub
212     if (StubRoutines::returns_to_call_stub(sender_pc)) {
213       if (!thread->is_in_stack_range_excl((address)saved_fp, (address)sender_sp)) {
214         return false;
215       }
216 
217       // construct the potential sender
218 
219       frame sender(sender_sp, sender_unextended_sp, saved_fp, sender_pc);
220 
221       // Validate the JavaCallWrapper an entry frame must have
222       address jcw = (address)sender.entry_frame_call_wrapper();
223 
224       return thread->is_in_stack_range_excl(jcw, (address)sender.fp());
225     } else if (sender_blob->is_upcall_stub()) {
226       return false;
227     }
228 
229     nmethod* nm = sender_blob->as_nmethod_or_null();
230     if (nm != nullptr) {
231       if (nm->is_deopt_mh_entry(sender_pc) || nm->is_deopt_entry(sender_pc) ||
232           nm->method()->is_method_handle_intrinsic()) {
233         return false;
234       }
235     }
236 
237     // If the frame size is 0 something (or less) is bad because every nmethod has a non-zero frame size
238     // because the return address counts against the callee's frame.
239 
240     if (sender_blob->frame_size() <= 0) {
241       assert(!sender_blob->is_nmethod(), "should count return address at least");
242       return false;
243     }
244 
245     // We should never be able to see anything here except an nmethod. If something in the
246     // code cache (current frame) is called by an entity within the code cache that entity
247     // should not be anything but the call stub (already covered), the interpreter (already covered)
248     // or an nmethod.
249 
250     if (!sender_blob->is_nmethod()) {
251         return false;
252     }
253 
254     // Could put some more validation for the potential non-interpreted sender
255     // frame we'd create by calling sender if I could think of any. Wait for next crash in forte...
256 
257     // One idea is seeing if the sender_pc we have is one that we'd expect to call to current cb
258 
259     // We've validated the potential sender that would be created
260     return true;
261   }
262 
263   // Must be native-compiled frame. Since sender will try and use fp to find
264   // linkages it must be safe
265 
266   if (!fp_safe) {
267     return false;
268   }
269 
270   // Will the pc we fetch be non-zero (which we'll find at the oldest frame)
271 
272   if ( (address) this->fp()[return_addr_offset] == nullptr) return false;
273 
274 
275   // could try and do some more potential verification of native frame if we could think of some...
276 
277   return true;
278 
279 }
280 
281 void frame::patch_pc(Thread* thread, address pc) {
282   assert(_cb == CodeCache::find_blob(pc), "unexpected pc");
283   address* pc_addr = &(((address*) sp())[-1]);
284   address signed_pc = pauth_sign_return_address(pc);
285   address pc_old = pauth_strip_verifiable(*pc_addr);
286 
287   if (TracePcPatching) {
288     tty->print("patch_pc at address " INTPTR_FORMAT " [" INTPTR_FORMAT " -> " INTPTR_FORMAT "]",
289                   p2i(pc_addr), p2i(pc_old), p2i(pc));
290     if (VM_Version::use_rop_protection()) {
291       tty->print(" [signed " INTPTR_FORMAT " -> " INTPTR_FORMAT "]", p2i(*pc_addr), p2i(signed_pc));
292     }
293     tty->print_cr("");
294   }
295 
296   assert(!Continuation::is_return_barrier_entry(pc_old), "return barrier");
297 
298   // Either the return address is the original one or we are going to
299   // patch in the same address that's already there.
300   assert(_pc == pc_old || pc == pc_old || pc_old == nullptr, "");
301   DEBUG_ONLY(address old_pc = _pc;)
302   *pc_addr = signed_pc;
303   _pc = pc; // must be set before call to get_deopt_original_pc
304   address original_pc = get_deopt_original_pc();
305   if (original_pc != nullptr) {
306     assert(original_pc == old_pc, "expected original PC to be stored before patching");
307     _deopt_state = is_deoptimized;
308     _pc = original_pc;
309   } else {
310     _deopt_state = not_deoptimized;
311   }
312 }
313 
314 intptr_t* frame::entry_frame_argument_at(int offset) const {
315   // convert offset to index to deal with tsi
316   int index = (Interpreter::expr_offset_in_bytes(offset)/wordSize);
317   // Entry frame's arguments are always in relation to unextended_sp()
318   return &unextended_sp()[index];
319 }
320 
321 // locals
322 
323 void frame::interpreter_frame_set_locals(intptr_t* locs)  {
324   assert(is_interpreted_frame(), "interpreted frame expected");
325   // set relativized locals
326   ptr_at_put(interpreter_frame_locals_offset, (intptr_t) (locs - fp()));
327 }
328 
329 // sender_sp
330 
331 intptr_t* frame::interpreter_frame_sender_sp() const {
332   assert(is_interpreted_frame(), "interpreted frame expected");
333   return (intptr_t*) at(interpreter_frame_sender_sp_offset);
334 }
335 
336 void frame::set_interpreter_frame_sender_sp(intptr_t* sender_sp) {
337   assert(is_interpreted_frame(), "interpreted frame expected");
338   ptr_at_put(interpreter_frame_sender_sp_offset, (intptr_t) sender_sp);
339 }
340 
341 
342 // monitor elements
343 
344 BasicObjectLock* frame::interpreter_frame_monitor_begin() const {
345   return (BasicObjectLock*) addr_at(interpreter_frame_monitor_block_bottom_offset);
346 }
347 
348 BasicObjectLock* frame::interpreter_frame_monitor_end() const {
349   BasicObjectLock* result = (BasicObjectLock*) at_relative(interpreter_frame_monitor_block_top_offset);
350   // make sure the pointer points inside the frame
351   assert(sp() <= (intptr_t*) result, "monitor end should be above the stack pointer");
352   assert((intptr_t*) result < fp(),  "monitor end should be strictly below the frame pointer");
353   return result;
354 }
355 
356 void frame::interpreter_frame_set_monitor_end(BasicObjectLock* value) {
357   assert(is_interpreted_frame(), "interpreted frame expected");
358   // set relativized monitor_block_top
359   ptr_at_put(interpreter_frame_monitor_block_top_offset, (intptr_t*)value - fp());
360   assert(at_absolute(interpreter_frame_monitor_block_top_offset) <= interpreter_frame_monitor_block_top_offset, "");
361 }
362 
363 // Used by template based interpreter deoptimization
364 void frame::interpreter_frame_set_last_sp(intptr_t* sp) {
365   assert(is_interpreted_frame(), "interpreted frame expected");
366   // set relativized last_sp
367   ptr_at_put(interpreter_frame_last_sp_offset, sp != nullptr ? (sp - fp()) : 0);
368 }
369 
370 // Used by template based interpreter deoptimization
371 void frame::interpreter_frame_set_extended_sp(intptr_t* sp) {
372   assert(is_interpreted_frame(), "interpreted frame expected");
373   // set relativized extended_sp
374   ptr_at_put(interpreter_frame_extended_sp_offset, (sp - fp()));
375 }
376 
377 frame frame::sender_for_entry_frame(RegisterMap* map) const {
378   assert(map != nullptr, "map must be set");
379   // Java frame called from C; skip all C frames and return top C
380   // frame of that chunk as the sender
381   JavaFrameAnchor* jfa = entry_frame_call_wrapper()->anchor();
382   assert(!entry_frame_is_first(), "next Java fp must be non zero");
383   assert(jfa->last_Java_sp() > sp(), "must be above this frame on stack");
384   // Since we are walking the stack now this nested anchor is obviously walkable
385   // even if it wasn't when it was stacked.
386   jfa->make_walkable();
387   map->clear();
388   assert(map->include_argument_oops(), "should be set by clear");
389   frame fr(jfa->last_Java_sp(), jfa->last_Java_fp(), jfa->last_Java_pc());
390   fr.set_sp_is_trusted();
391 
392   return fr;
393 }
394 
395 UpcallStub::FrameData* UpcallStub::frame_data_for_frame(const frame& frame) const {
396   assert(frame.is_upcall_stub_frame(), "wrong frame");
397   // need unextended_sp here, since normal sp is wrong for interpreter callees
398   return reinterpret_cast<UpcallStub::FrameData*>(
399     reinterpret_cast<address>(frame.unextended_sp()) + in_bytes(_frame_data_offset));
400 }
401 
402 bool frame::upcall_stub_frame_is_first() const {
403   assert(is_upcall_stub_frame(), "must be optimzed entry frame");
404   UpcallStub* blob = _cb->as_upcall_stub();
405   JavaFrameAnchor* jfa = blob->jfa_for_frame(*this);
406   return jfa->last_Java_sp() == nullptr;
407 }
408 
409 frame frame::sender_for_upcall_stub_frame(RegisterMap* map) const {
410   assert(map != nullptr, "map must be set");
411   UpcallStub* blob = _cb->as_upcall_stub();
412   // Java frame called from C; skip all C frames and return top C
413   // frame of that chunk as the sender
414   JavaFrameAnchor* jfa = blob->jfa_for_frame(*this);
415   assert(!upcall_stub_frame_is_first(), "must have a frame anchor to go back to");
416   assert(jfa->last_Java_sp() > sp(), "must be above this frame on stack");
417   // Since we are walking the stack now this nested anchor is obviously walkable
418   // even if it wasn't when it was stacked.
419   jfa->make_walkable();
420   map->clear();
421   assert(map->include_argument_oops(), "should be set by clear");
422   frame fr(jfa->last_Java_sp(), jfa->last_Java_fp(), jfa->last_Java_pc());
423 
424   return fr;
425 }
426 
427 #if defined(ASSERT)
428 static address get_register_address_in_stub(const frame& stub_fr, VMReg reg) {
429   RegisterMap map(nullptr,
430                   RegisterMap::UpdateMap::include,
431                   RegisterMap::ProcessFrames::skip,
432                   RegisterMap::WalkContinuation::skip);
433   stub_fr.oop_map()->update_register_map(&stub_fr, &map);
434   return map.location(reg, stub_fr.sp());
435 }
436 #endif
437 
438 JavaThread** frame::saved_thread_address(const frame& f) {
439   CodeBlob* cb = f.cb();
440   assert(cb != nullptr && cb->is_runtime_stub(), "invalid frame");
441 
442   JavaThread** thread_addr;
443 #ifdef COMPILER1
444   if (cb == Runtime1::blob_for(C1StubId::monitorenter_id) ||
445       cb == Runtime1::blob_for(C1StubId::monitorenter_nofpu_id)) {
446     thread_addr = (JavaThread**)(f.sp() + Runtime1::runtime_blob_current_thread_offset(f));
447   } else
448 #endif
449   {
450     // c2 only saves rbp in the stub frame so nothing to do.
451     thread_addr = nullptr;
452   }
453   assert(get_register_address_in_stub(f, SharedRuntime::thread_register()) == (address)thread_addr, "wrong thread address");
454   return thread_addr;
455 }
456 
457 //------------------------------------------------------------------------------
458 // frame::verify_deopt_original_pc
459 //
460 // Verifies the calculated original PC of a deoptimization PC for the
461 // given unextended SP.
462 #ifdef ASSERT
463 void frame::verify_deopt_original_pc(nmethod* nm, intptr_t* unextended_sp) {
464   frame fr;
465 
466   // This is ugly but it's better than to change {get,set}_original_pc
467   // to take an SP value as argument.  And it's only a debugging
468   // method anyway.
469   fr._unextended_sp = unextended_sp;
470 
471   address original_pc = nm->get_original_pc(&fr);
472   assert(nm->insts_contains_inclusive(original_pc),
473          "original PC must be in the main code section of the compiled method (or must be immediately following it)");
474 }
475 #endif
476 
477 //------------------------------------------------------------------------------
478 // frame::adjust_unextended_sp
479 #ifdef ASSERT
480 void frame::adjust_unextended_sp() {
481   // On aarch64, sites calling method handle intrinsics and lambda forms are treated
482   // as any other call site. Therefore, no special action is needed when we are
483   // returning to any of these call sites.
484 
485   if (_cb != nullptr) {
486     nmethod* sender_nm = _cb->as_nmethod_or_null();
487     if (sender_nm != nullptr) {
488       // If the sender PC is a deoptimization point, get the original PC.
489       if (sender_nm->is_deopt_entry(_pc) ||
490           sender_nm->is_deopt_mh_entry(_pc)) {
491         verify_deopt_original_pc(sender_nm, _unextended_sp);
492       }
493     }
494   }
495 }
496 #endif
497 
498 
499 //------------------------------------------------------------------------------
500 // frame::sender_for_interpreter_frame
501 frame frame::sender_for_interpreter_frame(RegisterMap* map) const {
502   // SP is the raw SP from the sender after adapter or interpreter
503   // extension.
504   intptr_t* sender_sp = this->sender_sp();
505 
506   // This is the sp before any possible extension (adapter/locals).
507   intptr_t* unextended_sp = interpreter_frame_sender_sp();
508   intptr_t* sender_fp = link();
509 
510 #if defined(COMPILER1) || COMPILER2_OR_JVMCI
511   if (map->update_map()) {
512     update_map_with_saved_link(map, (intptr_t**) addr_at(link_offset));
513   }
514 #endif // defined(COMPILER1) || COMPILER1_OR_COMPILER2
515 
516   // For ROP protection, Interpreter will have signed the sender_pc,
517   // but there is no requirement to authenticate it here.
518   address sender_pc = pauth_strip_verifiable(sender_pc_maybe_signed());
519 
520   if (Continuation::is_return_barrier_entry(sender_pc)) {
521     if (map->walk_cont()) { // about to walk into an h-stack
522       return Continuation::top_frame(*this, map);
523     } else {
524       return Continuation::continuation_bottom_sender(map->thread(), *this, sender_sp);
525     }
526   }
527 
528   return frame(sender_sp, unextended_sp, sender_fp, sender_pc);
529 }
530 
531 bool frame::is_interpreted_frame_valid(JavaThread* thread) const {
532   assert(is_interpreted_frame(), "Not an interpreted frame");
533   // These are reasonable sanity checks
534   if (fp() == nullptr || (intptr_t(fp()) & (wordSize-1)) != 0) {
535     return false;
536   }
537   if (sp() == nullptr || (intptr_t(sp()) & (wordSize-1)) != 0) {
538     return false;
539   }
540   if (fp() + interpreter_frame_initial_sp_offset < sp()) {
541     return false;
542   }
543   // These are hacks to keep us out of trouble.
544   // The problem with these is that they mask other problems
545   if (fp() <= sp()) {        // this attempts to deal with unsigned comparison above
546     return false;
547   }
548 
549   // do some validation of frame elements
550 
551   // first the method
552 
553   Method* m = safe_interpreter_frame_method();
554 
555   // validate the method we'd find in this potential sender
556   if (!Method::is_valid_method(m)) return false;
557 
558   // stack frames shouldn't be much larger than max_stack elements
559   // this test requires the use of unextended_sp which is the sp as seen by
560   // the current frame, and not sp which is the "raw" pc which could point
561   // further because of local variables of the callee method inserted after
562   // method arguments
563   if (fp() - unextended_sp() > 1024 + m->max_stack()*Interpreter::stackElementSize) {
564     return false;
565   }
566 
567   // validate bci/bcx
568 
569   address  bcp    = interpreter_frame_bcp();
570   if (m->validate_bci_from_bcp(bcp) < 0) {
571     return false;
572   }
573 
574   // validate constantPoolCache*
575   ConstantPoolCache* cp = *interpreter_frame_cache_addr();
576   if (MetaspaceObj::is_valid(cp) == false) return false;
577 
578   // validate locals
579 
580   address locals =  (address)interpreter_frame_locals();
581   return thread->is_in_stack_range_incl(locals, (address)fp());
582 }
583 
584 BasicType frame::interpreter_frame_result(oop* oop_result, jvalue* value_result) {
585   assert(is_interpreted_frame(), "interpreted frame expected");
586   Method* method = interpreter_frame_method();
587   BasicType type = method->result_type();
588 
589   intptr_t* tos_addr;
590   if (method->is_native()) {
591     // TODO : ensure AARCH64 does the same as Intel here i.e. push v0 then r0
592     // Prior to calling into the runtime to report the method_exit the possible
593     // return value is pushed to the native stack. If the result is a jfloat/jdouble
594     // then ST0 is saved before EAX/EDX. See the note in generate_native_result
595     tos_addr = (intptr_t*)sp();
596     if (type == T_FLOAT || type == T_DOUBLE) {
597       // This is times two because we do a push(ltos) after pushing XMM0
598       // and that takes two interpreter stack slots.
599       tos_addr += 2 * Interpreter::stackElementWords;
600     }
601   } else {
602     tos_addr = (intptr_t*)interpreter_frame_tos_address();
603   }
604 
605   switch (type) {
606     case T_OBJECT  :
607     case T_ARRAY   : {
608       oop obj;
609       if (method->is_native()) {
610         obj = cast_to_oop(at(interpreter_frame_oop_temp_offset));
611       } else {
612         oop* obj_p = (oop*)tos_addr;
613         obj = (obj_p == nullptr) ? (oop)nullptr : *obj_p;
614       }
615       assert(Universe::is_in_heap_or_null(obj), "sanity check");
616       *oop_result = obj;
617       break;
618     }
619     case T_BOOLEAN : value_result->z = *(jboolean*)tos_addr; break;
620     case T_BYTE    : value_result->b = *(jbyte*)tos_addr; break;
621     case T_CHAR    : value_result->c = *(jchar*)tos_addr; break;
622     case T_SHORT   : value_result->s = *(jshort*)tos_addr; break;
623     case T_INT     : value_result->i = *(jint*)tos_addr; break;
624     case T_LONG    : value_result->j = *(jlong*)tos_addr; break;
625     case T_FLOAT   : {
626         value_result->f = *(jfloat*)tos_addr;
627       break;
628     }
629     case T_DOUBLE  : value_result->d = *(jdouble*)tos_addr; break;
630     case T_VOID    : /* Nothing to do */ break;
631     default        : ShouldNotReachHere();
632   }
633 
634   return type;
635 }
636 
637 intptr_t* frame::interpreter_frame_tos_at(jint offset) const {
638   int index = (Interpreter::expr_offset_in_bytes(offset)/wordSize);
639   return &interpreter_frame_tos_address()[index];
640 }
641 
642 #ifndef PRODUCT
643 
644 #define DESCRIBE_FP_OFFSET(name) \
645   values.describe(frame_no, fp() + frame::name##_offset, #name)
646 
647 void frame::describe_pd(FrameValues& values, int frame_no) {
648   if (is_interpreted_frame()) {
649     DESCRIBE_FP_OFFSET(interpreter_frame_sender_sp);
650     DESCRIBE_FP_OFFSET(interpreter_frame_last_sp);
651     DESCRIBE_FP_OFFSET(interpreter_frame_method);
652     DESCRIBE_FP_OFFSET(interpreter_frame_mdp);
653     DESCRIBE_FP_OFFSET(interpreter_frame_extended_sp);
654     DESCRIBE_FP_OFFSET(interpreter_frame_mirror);
655     DESCRIBE_FP_OFFSET(interpreter_frame_cache);
656     DESCRIBE_FP_OFFSET(interpreter_frame_locals);
657     DESCRIBE_FP_OFFSET(interpreter_frame_bcp);
658     DESCRIBE_FP_OFFSET(interpreter_frame_initial_sp);
659   }
660 
661   if (is_java_frame() || Continuation::is_continuation_enterSpecial(*this)) {
662     intptr_t* ret_pc_loc;
663     intptr_t* fp_loc;
664     if (is_interpreted_frame()) {
665       ret_pc_loc = fp() + return_addr_offset;
666       fp_loc = fp();
667     } else {
668       ret_pc_loc = real_fp() - return_addr_offset;
669       fp_loc = real_fp() - sender_sp_offset;
670     }
671     address ret_pc = *(address*)ret_pc_loc;
672     values.describe(frame_no, ret_pc_loc,
673       Continuation::is_return_barrier_entry(ret_pc) ? "return address (return barrier)" : "return address");
674     values.describe(-1, fp_loc, "saved fp", 0); // "unowned" as value belongs to sender
675   }
676 }
677 #endif
678 
679 intptr_t *frame::initial_deoptimization_info() {
680   // Not used on aarch64, but we must return something.
681   return nullptr;
682 }
683 
684 #undef DESCRIBE_FP_OFFSET
685 
686 #define DESCRIBE_FP_OFFSET(name)                     \
687   {                                                  \
688     uintptr_t *p = (uintptr_t *)fp;                  \
689     printf(INTPTR_FORMAT " " INTPTR_FORMAT " %s\n",  \
690            (uintptr_t)(p + frame::name##_offset),    \
691            p[frame::name##_offset], #name);          \
692   }
693 
694 static THREAD_LOCAL uintptr_t nextfp;
695 static THREAD_LOCAL uintptr_t nextpc;
696 static THREAD_LOCAL uintptr_t nextsp;
697 static THREAD_LOCAL RegisterMap *reg_map;
698 
699 static void printbc(Method *m, intptr_t bcx) {
700   const char *name;
701   char buf[16];
702   if (m->validate_bci_from_bcp((address)bcx) < 0
703       || !m->contains((address)bcx)) {
704     name = "???";
705     snprintf(buf, sizeof buf, "(bad)");
706   } else {
707     int bci = m->bci_from((address)bcx);
708     snprintf(buf, sizeof buf, "%d", bci);
709     name = Bytecodes::name(m->code_at(bci));
710   }
711   ResourceMark rm;
712   printf("%s : %s ==> %s\n", m->name_and_sig_as_C_string(), buf, name);
713 }
714 
715 static void internal_pf(uintptr_t sp, uintptr_t fp, uintptr_t pc, uintptr_t bcx) {
716   if (! fp)
717     return;
718 
719   DESCRIBE_FP_OFFSET(return_addr);
720   DESCRIBE_FP_OFFSET(link);
721   DESCRIBE_FP_OFFSET(interpreter_frame_sender_sp);
722   DESCRIBE_FP_OFFSET(interpreter_frame_last_sp);
723   DESCRIBE_FP_OFFSET(interpreter_frame_method);
724   DESCRIBE_FP_OFFSET(interpreter_frame_mdp);
725   DESCRIBE_FP_OFFSET(interpreter_frame_extended_sp);
726   DESCRIBE_FP_OFFSET(interpreter_frame_mirror);
727   DESCRIBE_FP_OFFSET(interpreter_frame_cache);
728   DESCRIBE_FP_OFFSET(interpreter_frame_locals);
729   DESCRIBE_FP_OFFSET(interpreter_frame_bcp);
730   DESCRIBE_FP_OFFSET(interpreter_frame_initial_sp);
731   uintptr_t *p = (uintptr_t *)fp;
732 
733   // We want to see all frames, native and Java.  For compiled and
734   // interpreted frames we have special information that allows us to
735   // unwind them; for everything else we assume that the native frame
736   // pointer chain is intact.
737   frame this_frame((intptr_t*)sp, (intptr_t*)fp, (address)pc);
738   if (this_frame.is_compiled_frame() ||
739       this_frame.is_interpreted_frame()) {
740     frame sender = this_frame.sender(reg_map);
741     nextfp = (uintptr_t)sender.fp();
742     nextpc = (uintptr_t)sender.pc();
743     nextsp = (uintptr_t)sender.unextended_sp();
744   } else {
745     nextfp = p[frame::link_offset];
746     nextpc = p[frame::return_addr_offset];
747     nextsp = (uintptr_t)&p[frame::sender_sp_offset];
748   }
749 
750   if (bcx == -1ULL)
751     bcx = p[frame::interpreter_frame_bcp_offset];
752 
753   if (Interpreter::contains((address)pc)) {
754     Method* m = (Method*)p[frame::interpreter_frame_method_offset];
755     if(m && m->is_method()) {
756       printbc(m, bcx);
757     } else
758       printf("not a Method\n");
759   } else {
760     CodeBlob *cb = CodeCache::find_blob((address)pc);
761     if (cb != nullptr) {
762       if (cb->is_nmethod()) {
763         ResourceMark rm;
764         nmethod* nm = (nmethod*)cb;
765         printf("nmethod %s\n", nm->method()->name_and_sig_as_C_string());
766       } else if (cb->name()) {
767         printf("CodeBlob %s\n", cb->name());
768       }
769     }
770   }
771 }
772 
773 extern "C" void npf() {
774   CodeBlob *cb = CodeCache::find_blob((address)nextpc);
775   // C2 does not always chain the frame pointers when it can, instead
776   // preferring to use fixed offsets from SP, so a simple leave() does
777   // not work.  Instead, it adds the frame size to SP then pops FP and
778   // LR.  We have to do the same thing to get a good call chain.
779   if (cb && cb->frame_size())
780     nextfp = nextsp + wordSize * (cb->frame_size() - 2);
781   internal_pf (nextsp, nextfp, nextpc, -1);
782 }
783 
784 extern "C" void pf(uintptr_t sp, uintptr_t fp, uintptr_t pc,
785                    uintptr_t bcx, uintptr_t thread) {
786   if (!reg_map) {
787     reg_map = NEW_C_HEAP_OBJ(RegisterMap, mtInternal);
788     ::new (reg_map) RegisterMap(reinterpret_cast<JavaThread*>(thread),
789                                 RegisterMap::UpdateMap::skip,
790                                 RegisterMap::ProcessFrames::include,
791                                 RegisterMap::WalkContinuation::skip);
792   } else {
793     *reg_map = RegisterMap(reinterpret_cast<JavaThread*>(thread),
794                            RegisterMap::UpdateMap::skip,
795                            RegisterMap::ProcessFrames::include,
796                            RegisterMap::WalkContinuation::skip);
797   }
798 
799   {
800     CodeBlob *cb = CodeCache::find_blob((address)pc);
801     if (cb && cb->frame_size())
802       fp = sp + wordSize * (cb->frame_size() - 2);
803   }
804   internal_pf(sp, fp, pc, bcx);
805 }
806 
807 // support for printing out where we are in a Java method
808 // needs to be passed current fp and bcp register values
809 // prints method name, bc index and bytecode name
810 extern "C" void pm(uintptr_t fp, uintptr_t bcx) {
811   DESCRIBE_FP_OFFSET(interpreter_frame_method);
812   uintptr_t *p = (uintptr_t *)fp;
813   Method* m = (Method*)p[frame::interpreter_frame_method_offset];
814   printbc(m, bcx);
815 }
816 
817 #ifndef PRODUCT
818 // This is a generic constructor which is only used by pns() in debug.cpp.
819 frame::frame(void* sp, void* fp, void* pc) {
820   init((intptr_t*)sp, (intptr_t*)fp, (address)pc);
821 }
822 
823 #endif
824 
825 void JavaFrameAnchor::make_walkable() {
826   // last frame set?
827   if (last_Java_sp() == nullptr) return;
828   // already walkable?
829   if (walkable()) return;
830   vmassert(last_Java_sp() != nullptr, "not called from Java code?");
831   vmassert(last_Java_pc() == nullptr, "already walkable");
832   _last_Java_pc = (address)_last_Java_sp[-1];
833   vmassert(walkable(), "something went wrong");
834 }