1 /*
  2  * Copyright (c) 1997, 2025, Oracle and/or its affiliates. All rights reserved.
  3  * Copyright (c) 2014, 2020, Red Hat Inc. All rights reserved.
  4  * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
  5  *
  6  * This code is free software; you can redistribute it and/or modify it
  7  * under the terms of the GNU General Public License version 2 only, as
  8  * published by the Free Software Foundation.
  9  *
 10  * This code is distributed in the hope that it will be useful, but WITHOUT
 11  * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
 12  * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
 13  * version 2 for more details (a copy is included in the LICENSE file that
 14  * accompanied this code).
 15  *
 16  * You should have received a copy of the GNU General Public License version
 17  * 2 along with this work; if not, write to the Free Software Foundation,
 18  * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
 19  *
 20  * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
 21  * or visit www.oracle.com if you need additional information or have any
 22  * questions.
 23  *
 24  */
 25 
 26 #include "compiler/oopMap.hpp"
 27 #include "interpreter/interpreter.hpp"
 28 #include "memory/resourceArea.hpp"
 29 #include "memory/universe.hpp"
 30 #include "oops/markWord.hpp"
 31 #include "oops/method.hpp"
 32 #include "oops/oop.inline.hpp"
 33 #include "prims/methodHandles.hpp"
 34 #include "runtime/frame.inline.hpp"
 35 #include "runtime/handles.inline.hpp"
 36 #include "runtime/javaCalls.hpp"
 37 #include "runtime/monitorChunk.hpp"
 38 #include "runtime/os.inline.hpp"
 39 #include "runtime/signature.hpp"
 40 #include "runtime/stackWatermarkSet.hpp"
 41 #include "runtime/stubCodeGenerator.hpp"
 42 #include "runtime/stubRoutines.hpp"
 43 #include "vmreg_aarch64.inline.hpp"
 44 #ifdef COMPILER1
 45 #include "c1/c1_Runtime1.hpp"
 46 #include "runtime/vframeArray.hpp"
 47 #endif
 48 
 49 #ifdef ASSERT
 50 void RegisterMap::check_location_valid() {
 51 }
 52 #endif
 53 
 54 
 55 // Profiling/safepoint support
 56 
 57 bool frame::safe_for_sender(JavaThread *thread) {
 58   if (is_heap_frame()) {
 59     return true;
 60   }
 61   address   sp = (address)_sp;
 62   address   fp = (address)_fp;
 63   address   unextended_sp = (address)_unextended_sp;
 64 
 65   // consider stack guards when trying to determine "safe" stack pointers
 66   // sp must be within the usable part of the stack (not in guards)
 67   if (!thread->is_in_usable_stack(sp)) {
 68     return false;
 69   }
 70 
 71   // When we are running interpreted code the machine stack pointer, SP, is
 72   // set low enough so that the Java expression stack can grow and shrink
 73   // without ever exceeding the machine stack bounds.  So, ESP >= SP.
 74 
 75   // When we call out of an interpreted method, SP is incremented so that
 76   // the space between SP and ESP is removed.  The SP saved in the callee's
 77   // frame is the SP *before* this increment.  So, when we walk a stack of
 78   // interpreter frames the sender's SP saved in a frame might be less than
 79   // the SP at the point of call.
 80 
 81   // So unextended sp must be within the stack but we need not to check
 82   // that unextended sp >= sp
 83   if (!thread->is_in_full_stack_checked(unextended_sp)) {
 84     return false;
 85   }
 86 
 87   // an fp must be within the stack and above (but not equal) sp
 88   // second evaluation on fp+ is added to handle situation where fp is -1
 89   bool fp_safe = thread->is_in_stack_range_excl(fp, sp) &&
 90                  thread->is_in_full_stack_checked(fp + (return_addr_offset * sizeof(void*)));
 91 
 92   // We know sp/unextended_sp are safe only fp is questionable here
 93 
 94   // If the current frame is known to the code cache then we can attempt to
 95   // to construct the sender and do some validation of it. This goes a long way
 96   // toward eliminating issues when we get in frame construction code
 97 
 98   if (_cb != nullptr ) {
 99 
100     // First check if frame is complete and tester is reliable
101     // Unfortunately we can only check frame complete for runtime stubs and nmethod
102     // other generic buffer blobs are more problematic so we just assume they are
103     // ok. adapter blobs never have a frame complete and are never ok.
104 
105     if (!_cb->is_frame_complete_at(_pc)) {
106       if (_cb->is_nmethod() || _cb->is_adapter_blob() || _cb->is_runtime_stub()) {
107         return false;
108       }
109     }
110 
111     // Could just be some random pointer within the codeBlob
112     if (!_cb->code_contains(_pc)) {
113       return false;
114     }
115 
116     // Entry frame checks
117     if (is_entry_frame()) {
118       // an entry frame must have a valid fp.
119       return fp_safe && is_entry_frame_valid(thread);
120     } else if (is_upcall_stub_frame()) {
121       return fp_safe;
122     }
123 
124     intptr_t* sender_sp = nullptr;
125     intptr_t* sender_unextended_sp = nullptr;
126     address   sender_pc = nullptr;
127     intptr_t* saved_fp =  nullptr;
128 
129     if (is_interpreted_frame()) {
130       // fp must be safe
131       if (!fp_safe) {
132         return false;
133       }
134 
135       // for interpreted frames, the value below is the sender "raw" sp,
136       // which can be different from the sender unextended sp (the sp seen
137       // by the sender) because of current frame local variables
138       sender_sp = (intptr_t*) addr_at(sender_sp_offset);
139       sender_unextended_sp = (intptr_t*) this->fp()[interpreter_frame_sender_sp_offset];
140       saved_fp = (intptr_t*) this->fp()[link_offset];
141       sender_pc = pauth_strip_verifiable((address) this->fp()[return_addr_offset]);
142     } else {
143       // must be some sort of compiled/runtime frame
144       // fp does not have to be safe (although it could be check for c1?)
145 
146       // check for a valid frame_size, otherwise we are unlikely to get a valid sender_pc
147       if (_cb->frame_size() <= 0) {
148         return false;
149       }
150 
151       sender_sp = _unextended_sp + _cb->frame_size();
152       // Is sender_sp safe?
153       if (!thread->is_in_full_stack_checked((address)sender_sp)) {
154         return false;
155       }
156       // Note: frame::sender_sp_offset is only valid for compiled frame
157       intptr_t **saved_fp_addr = (intptr_t**) (sender_sp - frame::sender_sp_offset);
158       saved_fp = *saved_fp_addr;
159       // Note: PAC authentication may fail in case broken frame is passed in.
160       // Just strip it for now.
161       sender_pc = pauth_strip_pointer((address) *(sender_sp - 1));
162 
163       // Repair the sender sp if this is a method with scalarized inline type args
164       sender_sp = repair_sender_sp(sender_sp, saved_fp_addr);
165       sender_unextended_sp = sender_sp;
166     }
167     if (Continuation::is_return_barrier_entry(sender_pc)) {
168       // sender_pc might be invalid so check that the frame
169       // actually belongs to a Continuation.
170       if (!Continuation::is_frame_in_continuation(thread, *this)) {
171         return false;
172       }
173       // If our sender_pc is the return barrier, then our "real" sender is the continuation entry
174       frame s = Continuation::continuation_bottom_sender(thread, *this, sender_sp);
175       sender_sp = s.sp();
176       sender_pc = s.pc();
177     }
178 
179     // If the potential sender is the interpreter then we can do some more checking
180     if (Interpreter::contains(sender_pc)) {
181 
182       // fp is always saved in a recognizable place in any code we generate. However
183       // only if the sender is interpreted/call_stub (c1 too?) are we certain that the saved fp
184       // is really a frame pointer.
185 
186       if (!thread->is_in_stack_range_excl((address)saved_fp, (address)sender_sp)) {
187         return false;
188       }
189 
190       // construct the potential sender
191 
192       frame sender(sender_sp, sender_unextended_sp, saved_fp, sender_pc);
193 
194       return sender.is_interpreted_frame_valid(thread);
195 
196     }
197 
198     // We must always be able to find a recognizable pc
199     CodeBlob* sender_blob = CodeCache::find_blob(sender_pc);
200     if (sender_pc == nullptr ||  sender_blob == nullptr) {
201       return false;
202     }
203 
204     // Could just be some random pointer within the codeBlob
205     if (!sender_blob->code_contains(sender_pc)) {
206       return false;
207     }
208 
209     // We should never be able to see an adapter if the current frame is something from code cache
210     if (sender_blob->is_adapter_blob()) {
211       return false;
212     }
213 
214     // Could be the call_stub
215     if (StubRoutines::returns_to_call_stub(sender_pc)) {
216       if (!thread->is_in_stack_range_excl((address)saved_fp, (address)sender_sp)) {
217         return false;
218       }
219 
220       // construct the potential sender
221 
222       frame sender(sender_sp, sender_unextended_sp, saved_fp, sender_pc);
223 
224       // Validate the JavaCallWrapper an entry frame must have
225       address jcw = (address)sender.entry_frame_call_wrapper();
226 
227       return thread->is_in_stack_range_excl(jcw, (address)sender.fp());
228     } else if (sender_blob->is_upcall_stub()) {
229       return false;
230     }
231 
232     nmethod* nm = sender_blob->as_nmethod_or_null();
233     if (nm != nullptr) {
234       if (nm->is_deopt_mh_entry(sender_pc) || nm->is_deopt_entry(sender_pc) ||
235           nm->method()->is_method_handle_intrinsic()) {
236         return false;
237       }
238     }
239 
240     // If the frame size is 0 something (or less) is bad because every nmethod has a non-zero frame size
241     // because the return address counts against the callee's frame.
242 
243     if (sender_blob->frame_size() <= 0) {
244       assert(!sender_blob->is_nmethod(), "should count return address at least");
245       return false;
246     }
247 
248     // We should never be able to see anything here except an nmethod. If something in the
249     // code cache (current frame) is called by an entity within the code cache that entity
250     // should not be anything but the call stub (already covered), the interpreter (already covered)
251     // or an nmethod.
252 
253     if (!sender_blob->is_nmethod()) {
254         return false;
255     }
256 
257     // Could put some more validation for the potential non-interpreted sender
258     // frame we'd create by calling sender if I could think of any. Wait for next crash in forte...
259 
260     // One idea is seeing if the sender_pc we have is one that we'd expect to call to current cb
261 
262     // We've validated the potential sender that would be created
263     return true;
264   }
265 
266   // Must be native-compiled frame. Since sender will try and use fp to find
267   // linkages it must be safe
268 
269   if (!fp_safe) {
270     return false;
271   }
272 
273   // Will the pc we fetch be non-zero (which we'll find at the oldest frame)
274 
275   if ( (address) this->fp()[return_addr_offset] == nullptr) return false;
276 
277 
278   // could try and do some more potential verification of native frame if we could think of some...
279 
280   return true;
281 
282 }
283 
284 void frame::patch_pc(Thread* thread, address pc) {
285   assert(_cb == CodeCache::find_blob(pc), "unexpected pc");
286   address* pc_addr = &(((address*) sp())[-1]);
287   address signed_pc = pauth_sign_return_address(pc);
288   address pc_old = pauth_strip_verifiable(*pc_addr);
289 
290   if (TracePcPatching) {
291     tty->print("patch_pc at address " INTPTR_FORMAT " [" INTPTR_FORMAT " -> " INTPTR_FORMAT "]",
292                   p2i(pc_addr), p2i(pc_old), p2i(pc));
293     if (VM_Version::use_rop_protection()) {
294       tty->print(" [signed " INTPTR_FORMAT " -> " INTPTR_FORMAT "]", p2i(*pc_addr), p2i(signed_pc));
295     }
296     tty->print_cr("");
297   }
298 
299   assert(!Continuation::is_return_barrier_entry(pc_old), "return barrier");
300 
301   // Either the return address is the original one or we are going to
302   // patch in the same address that's already there.
303   assert(_pc == pc_old || pc == pc_old || pc_old == nullptr, "");
304   DEBUG_ONLY(address old_pc = _pc;)
305   *pc_addr = signed_pc;
306   _pc = pc; // must be set before call to get_deopt_original_pc
307   address original_pc = get_deopt_original_pc();
308   if (original_pc != nullptr) {
309     assert(original_pc == old_pc, "expected original PC to be stored before patching");
310     _deopt_state = is_deoptimized;
311     _pc = original_pc;
312   } else {
313     _deopt_state = not_deoptimized;
314   }
315 }
316 
317 intptr_t* frame::entry_frame_argument_at(int offset) const {
318   // convert offset to index to deal with tsi
319   int index = (Interpreter::expr_offset_in_bytes(offset)/wordSize);
320   // Entry frame's arguments are always in relation to unextended_sp()
321   return &unextended_sp()[index];
322 }
323 
324 // locals
325 
326 void frame::interpreter_frame_set_locals(intptr_t* locs)  {
327   assert(is_interpreted_frame(), "interpreted frame expected");
328   // set relativized locals
329   ptr_at_put(interpreter_frame_locals_offset, (intptr_t) (locs - fp()));
330 }
331 
332 // sender_sp
333 
334 intptr_t* frame::interpreter_frame_sender_sp() const {
335   assert(is_interpreted_frame(), "interpreted frame expected");
336   return (intptr_t*) at(interpreter_frame_sender_sp_offset);
337 }
338 
339 void frame::set_interpreter_frame_sender_sp(intptr_t* sender_sp) {
340   assert(is_interpreted_frame(), "interpreted frame expected");
341   ptr_at_put(interpreter_frame_sender_sp_offset, (intptr_t) sender_sp);
342 }
343 
344 
345 // monitor elements
346 
347 BasicObjectLock* frame::interpreter_frame_monitor_begin() const {
348   return (BasicObjectLock*) addr_at(interpreter_frame_monitor_block_bottom_offset);
349 }
350 
351 BasicObjectLock* frame::interpreter_frame_monitor_end() const {
352   BasicObjectLock* result = (BasicObjectLock*) at_relative(interpreter_frame_monitor_block_top_offset);
353   // make sure the pointer points inside the frame
354   assert(sp() <= (intptr_t*) result, "monitor end should be above the stack pointer");
355   assert((intptr_t*) result < fp(),  "monitor end should be strictly below the frame pointer");
356   return result;
357 }
358 
359 void frame::interpreter_frame_set_monitor_end(BasicObjectLock* value) {
360   assert(is_interpreted_frame(), "interpreted frame expected");
361   // set relativized monitor_block_top
362   ptr_at_put(interpreter_frame_monitor_block_top_offset, (intptr_t*)value - fp());
363   assert(at_absolute(interpreter_frame_monitor_block_top_offset) <= interpreter_frame_monitor_block_top_offset, "");
364 }
365 
366 // Used by template based interpreter deoptimization
367 void frame::interpreter_frame_set_last_sp(intptr_t* sp) {
368   assert(is_interpreted_frame(), "interpreted frame expected");
369   // set relativized last_sp
370   ptr_at_put(interpreter_frame_last_sp_offset, sp != nullptr ? (sp - fp()) : 0);
371 }
372 
373 // Used by template based interpreter deoptimization
374 void frame::interpreter_frame_set_extended_sp(intptr_t* sp) {
375   assert(is_interpreted_frame(), "interpreted frame expected");
376   // set relativized extended_sp
377   ptr_at_put(interpreter_frame_extended_sp_offset, (sp - fp()));
378 }
379 
380 frame frame::sender_for_entry_frame(RegisterMap* map) const {
381   assert(map != nullptr, "map must be set");
382   // Java frame called from C; skip all C frames and return top C
383   // frame of that chunk as the sender
384   JavaFrameAnchor* jfa = entry_frame_call_wrapper()->anchor();
385   assert(!entry_frame_is_first(), "next Java fp must be non zero");
386   assert(jfa->last_Java_sp() > sp(), "must be above this frame on stack");
387   // Since we are walking the stack now this nested anchor is obviously walkable
388   // even if it wasn't when it was stacked.
389   jfa->make_walkable();
390   map->clear();
391   assert(map->include_argument_oops(), "should be set by clear");
392   frame fr(jfa->last_Java_sp(), jfa->last_Java_fp(), jfa->last_Java_pc());
393   fr.set_sp_is_trusted();
394 
395   return fr;
396 }
397 
398 UpcallStub::FrameData* UpcallStub::frame_data_for_frame(const frame& frame) const {
399   assert(frame.is_upcall_stub_frame(), "wrong frame");
400   // need unextended_sp here, since normal sp is wrong for interpreter callees
401   return reinterpret_cast<UpcallStub::FrameData*>(
402     reinterpret_cast<address>(frame.unextended_sp()) + in_bytes(_frame_data_offset));
403 }
404 
405 bool frame::upcall_stub_frame_is_first() const {
406   assert(is_upcall_stub_frame(), "must be optimzed entry frame");
407   UpcallStub* blob = _cb->as_upcall_stub();
408   JavaFrameAnchor* jfa = blob->jfa_for_frame(*this);
409   return jfa->last_Java_sp() == nullptr;
410 }
411 
412 frame frame::sender_for_upcall_stub_frame(RegisterMap* map) const {
413   assert(map != nullptr, "map must be set");
414   UpcallStub* blob = _cb->as_upcall_stub();
415   // Java frame called from C; skip all C frames and return top C
416   // frame of that chunk as the sender
417   JavaFrameAnchor* jfa = blob->jfa_for_frame(*this);
418   assert(!upcall_stub_frame_is_first(), "must have a frame anchor to go back to");
419   assert(jfa->last_Java_sp() > sp(), "must be above this frame on stack");
420   // Since we are walking the stack now this nested anchor is obviously walkable
421   // even if it wasn't when it was stacked.
422   jfa->make_walkable();
423   map->clear();
424   assert(map->include_argument_oops(), "should be set by clear");
425   frame fr(jfa->last_Java_sp(), jfa->last_Java_fp(), jfa->last_Java_pc());
426 
427   return fr;
428 }
429 
430 #if defined(ASSERT)
431 static address get_register_address_in_stub(const frame& stub_fr, VMReg reg) {
432   RegisterMap map(nullptr,
433                   RegisterMap::UpdateMap::include,
434                   RegisterMap::ProcessFrames::skip,
435                   RegisterMap::WalkContinuation::skip);
436   stub_fr.oop_map()->update_register_map(&stub_fr, &map);
437   return map.location(reg, stub_fr.sp());
438 }
439 #endif
440 
441 JavaThread** frame::saved_thread_address(const frame& f) {
442   CodeBlob* cb = f.cb();
443   assert(cb != nullptr && cb->is_runtime_stub(), "invalid frame");
444 
445   JavaThread** thread_addr;
446 #ifdef COMPILER1
447   if (cb == Runtime1::blob_for(C1StubId::monitorenter_id) ||
448       cb == Runtime1::blob_for(C1StubId::monitorenter_nofpu_id)) {
449     thread_addr = (JavaThread**)(f.sp() + Runtime1::runtime_blob_current_thread_offset(f));
450   } else
451 #endif
452   {
453     // c2 only saves rbp in the stub frame so nothing to do.
454     thread_addr = nullptr;
455   }
456   assert(get_register_address_in_stub(f, SharedRuntime::thread_register()) == (address)thread_addr, "wrong thread address");
457   return thread_addr;
458 }
459 
460 //------------------------------------------------------------------------------
461 // frame::verify_deopt_original_pc
462 //
463 // Verifies the calculated original PC of a deoptimization PC for the
464 // given unextended SP.
465 #ifdef ASSERT
466 void frame::verify_deopt_original_pc(nmethod* nm, intptr_t* unextended_sp) {
467   frame fr;
468 
469   // This is ugly but it's better than to change {get,set}_original_pc
470   // to take an SP value as argument.  And it's only a debugging
471   // method anyway.
472   fr._unextended_sp = unextended_sp;
473 
474   address original_pc = nm->get_original_pc(&fr);
475   assert(nm->insts_contains_inclusive(original_pc),
476          "original PC must be in the main code section of the compiled method (or must be immediately following it)");
477 }
478 #endif
479 
480 //------------------------------------------------------------------------------
481 // frame::adjust_unextended_sp
482 #ifdef ASSERT
483 void frame::adjust_unextended_sp() {
484   // On aarch64, sites calling method handle intrinsics and lambda forms are treated
485   // as any other call site. Therefore, no special action is needed when we are
486   // returning to any of these call sites.
487 
488   if (_cb != nullptr) {
489     nmethod* sender_nm = _cb->as_nmethod_or_null();
490     if (sender_nm != nullptr) {
491       // If the sender PC is a deoptimization point, get the original PC.
492       if (sender_nm->is_deopt_entry(_pc) ||
493           sender_nm->is_deopt_mh_entry(_pc)) {
494         verify_deopt_original_pc(sender_nm, _unextended_sp);
495       }
496     }
497   }
498 }
499 #endif
500 
501 
502 //------------------------------------------------------------------------------
503 // frame::sender_for_interpreter_frame
504 frame frame::sender_for_interpreter_frame(RegisterMap* map) const {
505   // SP is the raw SP from the sender after adapter or interpreter
506   // extension.
507   intptr_t* sender_sp = this->sender_sp();
508 
509   // This is the sp before any possible extension (adapter/locals).
510   intptr_t* unextended_sp = interpreter_frame_sender_sp();
511   intptr_t* sender_fp = link();
512 
513 #if COMPILER2_OR_JVMCI
514   if (map->update_map()) {
515     update_map_with_saved_link(map, (intptr_t**) addr_at(link_offset));
516   }
517 #endif // COMPILER2_OR_JVMCI
518 
519   // For ROP protection, Interpreter will have signed the sender_pc,
520   // but there is no requirement to authenticate it here.
521   address sender_pc = pauth_strip_verifiable(sender_pc_maybe_signed());
522 
523   if (Continuation::is_return_barrier_entry(sender_pc)) {
524     if (map->walk_cont()) { // about to walk into an h-stack
525       return Continuation::top_frame(*this, map);
526     } else {
527       return Continuation::continuation_bottom_sender(map->thread(), *this, sender_sp);
528     }
529   }
530 
531   return frame(sender_sp, unextended_sp, sender_fp, sender_pc);
532 }
533 
534 bool frame::is_interpreted_frame_valid(JavaThread* thread) const {
535   assert(is_interpreted_frame(), "Not an interpreted frame");
536   // These are reasonable sanity checks
537   if (fp() == nullptr || (intptr_t(fp()) & (wordSize-1)) != 0) {
538     return false;
539   }
540   if (sp() == nullptr || (intptr_t(sp()) & (wordSize-1)) != 0) {
541     return false;
542   }
543   if (fp() + interpreter_frame_initial_sp_offset < sp()) {
544     return false;
545   }
546   // These are hacks to keep us out of trouble.
547   // The problem with these is that they mask other problems
548   if (fp() <= sp()) {        // this attempts to deal with unsigned comparison above
549     return false;
550   }
551 
552   // do some validation of frame elements
553 
554   // first the method
555 
556   Method* m = safe_interpreter_frame_method();
557 
558   // validate the method we'd find in this potential sender
559   if (!Method::is_valid_method(m)) return false;
560 
561   // stack frames shouldn't be much larger than max_stack elements
562   // this test requires the use of unextended_sp which is the sp as seen by
563   // the current frame, and not sp which is the "raw" pc which could point
564   // further because of local variables of the callee method inserted after
565   // method arguments
566   if (fp() - unextended_sp() > 1024 + m->max_stack()*Interpreter::stackElementSize) {
567     return false;
568   }
569 
570   // validate bci/bcx
571 
572   address  bcp    = interpreter_frame_bcp();
573   if (m->validate_bci_from_bcp(bcp) < 0) {
574     return false;
575   }
576 
577   // validate constantPoolCache*
578   ConstantPoolCache* cp = *interpreter_frame_cache_addr();
579   if (MetaspaceObj::is_valid(cp) == false) return false;
580 
581   // validate locals
582 
583   address locals =  (address)interpreter_frame_locals();
584   return thread->is_in_stack_range_incl(locals, (address)fp());
585 }
586 
587 BasicType frame::interpreter_frame_result(oop* oop_result, jvalue* value_result) {
588   assert(is_interpreted_frame(), "interpreted frame expected");
589   Method* method = interpreter_frame_method();
590   BasicType type = method->result_type();
591 
592   intptr_t* tos_addr;
593   if (method->is_native()) {
594     // TODO : ensure AARCH64 does the same as Intel here i.e. push v0 then r0
595     // Prior to calling into the runtime to report the method_exit the possible
596     // return value is pushed to the native stack. If the result is a jfloat/jdouble
597     // then ST0 is saved before EAX/EDX. See the note in generate_native_result
598     tos_addr = (intptr_t*)sp();
599     if (type == T_FLOAT || type == T_DOUBLE) {
600       // This is times two because we do a push(ltos) after pushing XMM0
601       // and that takes two interpreter stack slots.
602       tos_addr += 2 * Interpreter::stackElementWords;
603     }
604   } else {
605     tos_addr = (intptr_t*)interpreter_frame_tos_address();
606   }
607 
608   switch (type) {
609     case T_OBJECT  :
610     case T_ARRAY   : {
611       oop obj;
612       if (method->is_native()) {
613         obj = cast_to_oop(at(interpreter_frame_oop_temp_offset));
614       } else {
615         oop* obj_p = (oop*)tos_addr;
616         obj = (obj_p == nullptr) ? (oop)nullptr : *obj_p;
617       }
618       assert(Universe::is_in_heap_or_null(obj), "sanity check");
619       *oop_result = obj;
620       break;
621     }
622     case T_BOOLEAN : value_result->z = *(jboolean*)tos_addr; break;
623     case T_BYTE    : value_result->b = *(jbyte*)tos_addr; break;
624     case T_CHAR    : value_result->c = *(jchar*)tos_addr; break;
625     case T_SHORT   : value_result->s = *(jshort*)tos_addr; break;
626     case T_INT     : value_result->i = *(jint*)tos_addr; break;
627     case T_LONG    : value_result->j = *(jlong*)tos_addr; break;
628     case T_FLOAT   : {
629         value_result->f = *(jfloat*)tos_addr;
630       break;
631     }
632     case T_DOUBLE  : value_result->d = *(jdouble*)tos_addr; break;
633     case T_VOID    : /* Nothing to do */ break;
634     default        : ShouldNotReachHere();
635   }
636 
637   return type;
638 }
639 
640 intptr_t* frame::interpreter_frame_tos_at(jint offset) const {
641   int index = (Interpreter::expr_offset_in_bytes(offset)/wordSize);
642   return &interpreter_frame_tos_address()[index];
643 }
644 
645 #ifndef PRODUCT
646 
647 #define DESCRIBE_FP_OFFSET(name) \
648   values.describe(frame_no, fp() + frame::name##_offset, #name)
649 
650 void frame::describe_pd(FrameValues& values, int frame_no) {
651   if (is_interpreted_frame()) {
652     DESCRIBE_FP_OFFSET(interpreter_frame_sender_sp);
653     DESCRIBE_FP_OFFSET(interpreter_frame_last_sp);
654     DESCRIBE_FP_OFFSET(interpreter_frame_method);
655     DESCRIBE_FP_OFFSET(interpreter_frame_mdp);
656     DESCRIBE_FP_OFFSET(interpreter_frame_extended_sp);
657     DESCRIBE_FP_OFFSET(interpreter_frame_mirror);
658     DESCRIBE_FP_OFFSET(interpreter_frame_cache);
659     DESCRIBE_FP_OFFSET(interpreter_frame_locals);
660     DESCRIBE_FP_OFFSET(interpreter_frame_bcp);
661     DESCRIBE_FP_OFFSET(interpreter_frame_initial_sp);
662   }
663 
664   if (is_java_frame() || Continuation::is_continuation_enterSpecial(*this)) {
665     intptr_t* ret_pc_loc;
666     intptr_t* fp_loc;
667     if (is_interpreted_frame()) {
668       ret_pc_loc = fp() + return_addr_offset;
669       fp_loc = fp();
670     } else {
671       ret_pc_loc = real_fp() - return_addr_offset;
672       fp_loc = real_fp() - sender_sp_offset;
673     }
674     address ret_pc = *(address*)ret_pc_loc;
675     values.describe(frame_no, ret_pc_loc,
676       Continuation::is_return_barrier_entry(ret_pc) ? "return address (return barrier)" : "return address");
677     values.describe(-1, fp_loc, "saved fp", 0); // "unowned" as value belongs to sender
678   }
679 }
680 #endif
681 
682 intptr_t *frame::initial_deoptimization_info() {
683   // Not used on aarch64, but we must return something.
684   return nullptr;
685 }
686 
687 #undef DESCRIBE_FP_OFFSET
688 
689 #define DESCRIBE_FP_OFFSET(name)                     \
690   {                                                  \
691     uintptr_t *p = (uintptr_t *)fp;                  \
692     printf(INTPTR_FORMAT " " INTPTR_FORMAT " %s\n",  \
693            (uintptr_t)(p + frame::name##_offset),    \
694            p[frame::name##_offset], #name);          \
695   }
696 
697 static THREAD_LOCAL uintptr_t nextfp;
698 static THREAD_LOCAL uintptr_t nextpc;
699 static THREAD_LOCAL uintptr_t nextsp;
700 static THREAD_LOCAL RegisterMap *reg_map;
701 
702 static void printbc(Method *m, intptr_t bcx) {
703   const char *name;
704   char buf[16];
705   if (m->validate_bci_from_bcp((address)bcx) < 0
706       || !m->contains((address)bcx)) {
707     name = "???";
708     snprintf(buf, sizeof buf, "(bad)");
709   } else {
710     int bci = m->bci_from((address)bcx);
711     snprintf(buf, sizeof buf, "%d", bci);
712     name = Bytecodes::name(m->code_at(bci));
713   }
714   ResourceMark rm;
715   printf("%s : %s ==> %s\n", m->name_and_sig_as_C_string(), buf, name);
716 }
717 
718 static void internal_pf(uintptr_t sp, uintptr_t fp, uintptr_t pc, uintptr_t bcx) {
719   if (! fp)
720     return;
721 
722   DESCRIBE_FP_OFFSET(return_addr);
723   DESCRIBE_FP_OFFSET(link);
724   DESCRIBE_FP_OFFSET(interpreter_frame_sender_sp);
725   DESCRIBE_FP_OFFSET(interpreter_frame_last_sp);
726   DESCRIBE_FP_OFFSET(interpreter_frame_method);
727   DESCRIBE_FP_OFFSET(interpreter_frame_mdp);
728   DESCRIBE_FP_OFFSET(interpreter_frame_extended_sp);
729   DESCRIBE_FP_OFFSET(interpreter_frame_mirror);
730   DESCRIBE_FP_OFFSET(interpreter_frame_cache);
731   DESCRIBE_FP_OFFSET(interpreter_frame_locals);
732   DESCRIBE_FP_OFFSET(interpreter_frame_bcp);
733   DESCRIBE_FP_OFFSET(interpreter_frame_initial_sp);
734   uintptr_t *p = (uintptr_t *)fp;
735 
736   // We want to see all frames, native and Java.  For compiled and
737   // interpreted frames we have special information that allows us to
738   // unwind them; for everything else we assume that the native frame
739   // pointer chain is intact.
740   frame this_frame((intptr_t*)sp, (intptr_t*)fp, (address)pc);
741   if (this_frame.is_compiled_frame() ||
742       this_frame.is_interpreted_frame()) {
743     frame sender = this_frame.sender(reg_map);
744     nextfp = (uintptr_t)sender.fp();
745     nextpc = (uintptr_t)sender.pc();
746     nextsp = (uintptr_t)sender.unextended_sp();
747   } else {
748     nextfp = p[frame::link_offset];
749     nextpc = p[frame::return_addr_offset];
750     nextsp = (uintptr_t)&p[frame::sender_sp_offset];
751   }
752 
753   if (bcx == -1ULL)
754     bcx = p[frame::interpreter_frame_bcp_offset];
755 
756   if (Interpreter::contains((address)pc)) {
757     Method* m = (Method*)p[frame::interpreter_frame_method_offset];
758     if(m && m->is_method()) {
759       printbc(m, bcx);
760     } else
761       printf("not a Method\n");
762   } else {
763     CodeBlob *cb = CodeCache::find_blob((address)pc);
764     if (cb != nullptr) {
765       if (cb->is_nmethod()) {
766         ResourceMark rm;
767         nmethod* nm = (nmethod*)cb;
768         printf("nmethod %s\n", nm->method()->name_and_sig_as_C_string());
769       } else if (cb->name()) {
770         printf("CodeBlob %s\n", cb->name());
771       }
772     }
773   }
774 }
775 
776 extern "C" void npf() {
777   CodeBlob *cb = CodeCache::find_blob((address)nextpc);
778   // C2 does not always chain the frame pointers when it can, instead
779   // preferring to use fixed offsets from SP, so a simple leave() does
780   // not work.  Instead, it adds the frame size to SP then pops FP and
781   // LR.  We have to do the same thing to get a good call chain.
782   if (cb && cb->frame_size())
783     nextfp = nextsp + wordSize * (cb->frame_size() - 2);
784   internal_pf (nextsp, nextfp, nextpc, -1);
785 }
786 
787 extern "C" void pf(uintptr_t sp, uintptr_t fp, uintptr_t pc,
788                    uintptr_t bcx, uintptr_t thread) {
789   if (!reg_map) {
790     reg_map = NEW_C_HEAP_OBJ(RegisterMap, mtInternal);
791     ::new (reg_map) RegisterMap(reinterpret_cast<JavaThread*>(thread),
792                                 RegisterMap::UpdateMap::skip,
793                                 RegisterMap::ProcessFrames::include,
794                                 RegisterMap::WalkContinuation::skip);
795   } else {
796     *reg_map = RegisterMap(reinterpret_cast<JavaThread*>(thread),
797                            RegisterMap::UpdateMap::skip,
798                            RegisterMap::ProcessFrames::include,
799                            RegisterMap::WalkContinuation::skip);
800   }
801 
802   {
803     CodeBlob *cb = CodeCache::find_blob((address)pc);
804     if (cb && cb->frame_size())
805       fp = sp + wordSize * (cb->frame_size() - 2);
806   }
807   internal_pf(sp, fp, pc, bcx);
808 }
809 
810 // support for printing out where we are in a Java method
811 // needs to be passed current fp and bcp register values
812 // prints method name, bc index and bytecode name
813 extern "C" void pm(uintptr_t fp, uintptr_t bcx) {
814   DESCRIBE_FP_OFFSET(interpreter_frame_method);
815   uintptr_t *p = (uintptr_t *)fp;
816   Method* m = (Method*)p[frame::interpreter_frame_method_offset];
817   printbc(m, bcx);
818 }
819 
820 #ifndef PRODUCT
821 // This is a generic constructor which is only used by pns() in debug.cpp.
822 frame::frame(void* sp, void* fp, void* pc) {
823   init((intptr_t*)sp, (intptr_t*)fp, (address)pc);
824 }
825 
826 #endif
827 
828 // Check for a method with scalarized inline type arguments that needs
829 // a stack repair and return the repaired sender stack pointer.
830 intptr_t* frame::repair_sender_sp(intptr_t* sender_sp, intptr_t** saved_fp_addr) const {
831   nmethod* nm = _cb->as_nmethod_or_null();
832   if (nm != nullptr && nm->needs_stack_repair()) {
833     // The stack increment resides just below the saved FP on the stack and
834     // records the total frame size excluding the two words for saving FP and LR.
835     intptr_t* sp_inc_addr = (intptr_t*) (saved_fp_addr - 1);
836     assert(*sp_inc_addr % StackAlignmentInBytes == 0, "sp_inc not aligned");
837     int real_frame_size = (*sp_inc_addr / wordSize) + 2;
838     assert(real_frame_size >= _cb->frame_size() && real_frame_size <= 1000000, "invalid frame size");
839     sender_sp = unextended_sp() + real_frame_size;
840   }
841   return sender_sp;
842 }
843 
844 void JavaFrameAnchor::make_walkable() {
845   // last frame set?
846   if (last_Java_sp() == nullptr) return;
847   // already walkable?
848   if (walkable()) return;
849   vmassert(last_Java_sp() != nullptr, "not called from Java code?");
850   vmassert(last_Java_pc() == nullptr, "already walkable");
851   _last_Java_pc = (address)_last_Java_sp[-1];
852   vmassert(walkable(), "something went wrong");
853 }