1 /*
2 * Copyright (c) 2000, 2026, Oracle and/or its affiliates. All rights reserved.
3 * Copyright (c) 2012, 2025 SAP SE. All rights reserved.
4 * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
5 *
6 * This code is free software; you can redistribute it and/or modify it
7 * under the terms of the GNU General Public License version 2 only, as
8 * published by the Free Software Foundation.
9 *
10 * This code is distributed in the hope that it will be useful, but WITHOUT
11 * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
12 * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
13 * version 2 for more details (a copy is included in the LICENSE file that
14 * accompanied this code).
15 *
16 * You should have received a copy of the GNU General Public License version
17 * 2 along with this work; if not, write to the Free Software Foundation,
18 * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
19 *
20 * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
21 * or visit www.oracle.com if you need additional information or have any
22 * questions.
23 *
24 */
25
26 #include "compiler/oopMap.hpp"
27 #include "interpreter/interpreter.hpp"
28 #include "memory/resourceArea.hpp"
29 #include "memory/universe.hpp"
30 #include "oops/markWord.hpp"
31 #include "oops/method.hpp"
32 #include "oops/oop.inline.hpp"
33 #include "runtime/frame.inline.hpp"
34 #include "runtime/handles.inline.hpp"
35 #include "runtime/javaCalls.hpp"
36 #include "runtime/jniHandles.inline.hpp"
37 #include "runtime/monitorChunk.hpp"
38 #include "runtime/os.inline.hpp"
39 #include "runtime/signature.hpp"
40 #include "runtime/stackWatermarkSet.hpp"
41 #include "runtime/stubCodeGenerator.hpp"
42 #include "runtime/stubRoutines.hpp"
43 #ifdef COMPILER1
44 #include "c1/c1_Runtime1.hpp"
45 #include "runtime/vframeArray.hpp"
46 #endif
47
48 #ifdef ASSERT
49 void RegisterMap::check_location_valid() {
50 }
51 #endif // ASSERT
52
53 bool frame::safe_for_sender(JavaThread *thread) {
54 if (is_heap_frame()) {
55 return true;
56 }
57 address sp = (address)_sp;
58 address fp = (address)_fp;
59 address unextended_sp = (address)_unextended_sp;
60
61 // consider stack guards when trying to determine "safe" stack pointers
62 // sp must be within the usable part of the stack (not in guards)
63 if (!thread->is_in_usable_stack(sp)) {
64 return false;
65 }
66
67 // Unextended sp must be within the stack
68 if (!thread->is_in_full_stack_checked(unextended_sp)) {
69 return false;
70 }
71
72 // An fp must be within the stack and above (but not equal) sp.
73 bool fp_safe = thread->is_in_stack_range_excl(fp, sp);
74 // An interpreter fp must be fp_safe.
75 // Moreover, it must be at a distance at least the size of the ijava_state structure.
76 bool fp_interp_safe = fp_safe && ((fp - sp) >= ijava_state_size);
77
78 // We know sp/unextended_sp are safe, only fp is questionable here
79
80 // If the current frame is known to the code cache then we can attempt to
81 // construct the sender and do some validation of it. This goes a long way
82 // toward eliminating issues when we get in frame construction code
83
84 if (_cb != nullptr) {
85
86 // First check if the frame is complete and the test is reliable.
87 // Unfortunately we can only check frame completeness for runtime stubs
88 // and nmethods. Other generic buffer blobs are more problematic
89 // so we just assume they are OK.
90 // Adapter blobs never have a complete frame and are never OK
91 if (!_cb->is_frame_complete_at(_pc)) {
92 if (_cb->is_nmethod() || _cb->is_adapter_blob() || _cb->is_runtime_stub()) {
93 return false;
94 }
95 }
96
97 // Could just be some random pointer within the codeBlob.
98 if (!_cb->code_contains(_pc)) {
99 return false;
100 }
101
102 // Entry frame checks
103 if (is_entry_frame()) {
104 // An entry frame must have a valid fp.
105 return fp_safe && is_entry_frame_valid(thread);
106 }
107
108 if (is_interpreted_frame() && !fp_interp_safe) {
109 return false;
110 }
111
112 // At this point, there still is a chance that fp_safe is false.
113 // In particular, fp might be null. So let's check and
114 // bail out before we actually dereference from fp.
115 if (!fp_safe) {
116 return false;
117 }
118
119 volatile common_abi* sender_abi = (common_abi*) fp; // May get updated concurrently by deoptimization!
120 intptr_t* sender_sp = (intptr_t*) fp;
121 address sender_pc = (address) sender_abi->lr;
122
123 if (Continuation::is_return_barrier_entry(sender_pc)) {
124 // sender_pc might be invalid so check that the frame
125 // actually belongs to a Continuation.
126 if (!Continuation::is_frame_in_continuation(thread, *this)) {
127 return false;
128 }
129 // If our sender_pc is the return barrier, then our "real" sender is the continuation entry
130 frame s = Continuation::continuation_bottom_sender(thread, *this, sender_sp);
131 sender_sp = s.sp();
132 sender_pc = s.pc();
133 }
134
135 // We must always be able to find a recognizable pc.
136 CodeBlob* sender_blob = CodeCache::find_blob(sender_pc);
137 if (sender_blob == nullptr) {
138 return false;
139 }
140
141 intptr_t* unextended_sender_sp = is_interpreted_frame() ? interpreter_frame_sender_sp() : sender_sp;
142
143 // If the sender is a deoptimized nmethod we need to check if the original pc is valid.
144 nmethod* sender_nm = sender_blob->as_nmethod_or_null();
145 if (sender_nm != nullptr && sender_nm->is_deopt_pc(sender_pc)) {
146 address orig_pc = *(address*)((address)unextended_sender_sp + sender_nm->orig_pc_offset());
147 if (!sender_nm->insts_contains_inclusive(orig_pc)) return false;
148 }
149
150 // It should be safe to construct the sender though it might not be valid.
151
152 frame sender(sender_sp, sender_pc, unextended_sender_sp, nullptr /* fp */, sender_blob);
153
154 // Do we have a valid fp?
155 address sender_fp = (address) sender.fp();
156
157 // sender_fp must be within the stack and above (but not
158 // equal) current frame's fp.
159 if (!thread->is_in_stack_range_excl(sender_fp, fp)) {
160 return false;
161 }
162
163 // If the potential sender is the interpreter then we can do some more checking.
164 if (Interpreter::contains(sender_pc)) {
165 return sender.is_interpreted_frame_valid(thread);
166 }
167
168 // Could just be some random pointer within the codeBlob.
169 if (!sender.cb()->code_contains(sender_pc)) {
170 return false;
171 }
172
173 // We should never be able to see an adapter if the current frame is something from code cache.
174 if (sender_blob->is_adapter_blob()) {
175 return false;
176 }
177
178 if (sender.is_entry_frame()) {
179 return sender.is_entry_frame_valid(thread);
180 }
181
182 // Frame size is always greater than zero. If the sender frame size is zero or less,
183 // something is really weird and we better give up.
184 if (sender_blob->frame_size() <= 0) {
185 return false;
186 }
187
188 return true;
189 }
190
191 // Must be native-compiled frame. Since sender will try and use fp to find
192 // linkages it must be safe
193
194 if (!fp_safe) {
195 return false;
196 }
197
198 if (sender_pc() == nullptr) {
199 // Likely the return pc was not yet stored to stack. We rather discard this
200 // sample also because we would hit an assertion in frame::setup(). We can
201 // find any other random value if the return pc was not yet stored to
202 // stack. We rely on consistency checks to handle this (see
203 // e.g. find_initial_Java_frame())
204 return false;
205 }
206
207 return true;
208 }
209
210 frame frame::sender_for_entry_frame(RegisterMap *map) const {
211 assert(map != nullptr, "map must be set");
212 // Java frame called from C; skip all C frames and return top C
213 // frame of that chunk as the sender.
214 JavaFrameAnchor* jfa = entry_frame_call_wrapper()->anchor();
215 assert(!entry_frame_is_first(), "next Java fp must be non zero");
216 assert(jfa->last_Java_sp() > _sp, "must be above this frame on stack");
217 map->clear();
218 assert(map->include_argument_oops(), "should be set by clear");
219
220 if (jfa->last_Java_pc() != nullptr) {
221 frame fr(jfa->last_Java_sp(), jfa->last_Java_pc(), kind::code_blob);
222 return fr;
223 }
224 // Last_java_pc is not set, if we come here from compiled code. The
225 // constructor retrieves the PC from the stack.
226 frame fr(jfa->last_Java_sp(), nullptr, kind::code_blob);
227 return fr;
228 }
229
230 UpcallStub::FrameData* UpcallStub::frame_data_for_frame(const frame& frame) const {
231 assert(frame.is_upcall_stub_frame(), "wrong frame");
232 // need unextended_sp here, since normal sp is wrong for interpreter callees
233 return reinterpret_cast<UpcallStub::FrameData*>(
234 reinterpret_cast<address>(frame.unextended_sp()) + in_bytes(_frame_data_offset));
235 }
236
237 bool frame::upcall_stub_frame_is_first() const {
238 assert(is_upcall_stub_frame(), "must be optimzed entry frame");
239 UpcallStub* blob = _cb->as_upcall_stub();
240 JavaFrameAnchor* jfa = blob->jfa_for_frame(*this);
241 return jfa->last_Java_sp() == nullptr;
242 }
243
244 frame frame::sender_for_upcall_stub_frame(RegisterMap* map) const {
245 assert(map != nullptr, "map must be set");
246 UpcallStub* blob = _cb->as_upcall_stub();
247 // Java frame called from C; skip all C frames and return top C
248 // frame of that chunk as the sender
249 JavaFrameAnchor* jfa = blob->jfa_for_frame(*this);
250 assert(!upcall_stub_frame_is_first(), "must have a frame anchor to go back to");
251 assert(jfa->last_Java_sp() > sp(), "must be above this frame on stack");
252 map->clear();
253 assert(map->include_argument_oops(), "should be set by clear");
254 frame fr(jfa->last_Java_sp(), jfa->last_Java_pc(), kind::code_blob);
255
256 return fr;
257 }
258
259 JavaThread** frame::saved_thread_address(const frame& f) {
260 // The current thread (JavaThread*) is never stored on the stack
261 return nullptr;
262 }
263
264 frame frame::sender_for_interpreter_frame(RegisterMap *map) const {
265 // This is the sp before any possible extension (adapter/locals).
266 intptr_t* unextended_sp = interpreter_frame_sender_sp();
267 address sender_pc = this->sender_pc();
268 if (Continuation::is_return_barrier_entry(sender_pc)) {
269 if (map->walk_cont()) { // about to walk into an h-stack
270 return Continuation::top_frame(*this, map);
271 } else {
272 return Continuation::continuation_bottom_sender(map->thread(), *this, sender_sp());
273 }
274 }
275
276 return frame(sender_sp(), sender_pc, unextended_sp);
277 }
278
279 // locals
280
281 void frame::interpreter_frame_set_locals(intptr_t* locs) {
282 assert(is_interpreted_frame(), "interpreted frame expected");
283 // set relativized locals
284 *addr_at(ijava_idx(locals)) = (intptr_t) (locs - fp());
285 }
286
287 // sender_sp
288
289 intptr_t* frame::interpreter_frame_sender_sp() const {
290 assert(is_interpreted_frame(), "interpreted frame expected");
291 return (intptr_t*)at(ijava_idx(sender_sp));
292 }
293
294 void frame::patch_pc(Thread* thread, address pc) {
295 assert(_cb == CodeCache::find_blob(pc), "unexpected pc");
296 address* pc_addr = (address*)&(own_abi()->lr);
297
298 if (TracePcPatching) {
299 tty->print_cr("patch_pc at address " PTR_FORMAT " [" PTR_FORMAT " -> " PTR_FORMAT "]",
300 p2i(&((address*) _sp)[-1]), p2i(((address*) _sp)[-1]), p2i(pc));
301 }
302 assert(!Continuation::is_return_barrier_entry(*pc_addr), "return barrier");
303 assert(_pc == *pc_addr || pc == *pc_addr || nullptr == *pc_addr,
304 "must be (pc: " INTPTR_FORMAT " _pc: " INTPTR_FORMAT " pc_addr: " INTPTR_FORMAT
305 " *pc_addr: " INTPTR_FORMAT " sp: " INTPTR_FORMAT ")",
306 p2i(pc), p2i(_pc), p2i(pc_addr), p2i(*pc_addr), p2i(sp()));
307 DEBUG_ONLY(address old_pc = _pc;)
308 own_abi()->lr = (uint64_t)pc;
309 _pc = pc; // must be set before call to get_deopt_original_pc
310 address original_pc = get_deopt_original_pc();
311 if (original_pc != nullptr) {
312 assert(original_pc == old_pc, "expected original PC to be stored before patching");
313 _deopt_state = is_deoptimized;
314 _pc = original_pc;
315 } else {
316 _deopt_state = not_deoptimized;
317 }
318 assert(!is_compiled_frame() || !_cb->as_nmethod()->is_deopt_entry(_pc), "must be");
319
320 #ifdef ASSERT
321 {
322 frame f(this->sp(), pc, this->unextended_sp());
323 assert(f.is_deoptimized_frame() == this->is_deoptimized_frame() && f.pc() == this->pc() && f.raw_pc() == this->raw_pc(),
324 "must be (f.is_deoptimized_frame(): %d this->is_deoptimized_frame(): %d "
325 "f.pc(): " INTPTR_FORMAT " this->pc(): " INTPTR_FORMAT " f.raw_pc(): " INTPTR_FORMAT " this->raw_pc(): " INTPTR_FORMAT ")",
326 f.is_deoptimized_frame(), this->is_deoptimized_frame(), p2i(f.pc()), p2i(this->pc()), p2i(f.raw_pc()), p2i(this->raw_pc()));
327 }
328 #endif
329 }
330
331 bool frame::is_interpreted_frame_valid(JavaThread* thread) const {
332 assert(is_interpreted_frame(), "Not an interpreted frame");
333 // These are reasonable sanity checks
334 if (fp() == nullptr || (intptr_t(fp()) & (wordSize-1)) != 0) {
335 return false;
336 }
337 if (sp() == nullptr || (intptr_t(sp()) & (wordSize-1)) != 0) {
338 return false;
339 }
340 int min_frame_slots = (parent_ijava_frame_abi_size + ijava_state_size) / sizeof(intptr_t);
341 if (fp() - min_frame_slots < sp()) {
342 return false;
343 }
344 // These are hacks to keep us out of trouble.
345 // The problem with these is that they mask other problems
346 if (fp() <= sp()) { // this attempts to deal with unsigned comparison above
347 return false;
348 }
349
350 // do some validation of frame elements
351
352 // first the method
353
354 Method* m = safe_interpreter_frame_method();
355
356 // validate the method we'd find in this potential sender
357 if (!Method::is_valid_method(m)) return false;
358
359 // stack frames shouldn't be much larger than max_stack elements
360 // this test requires the use of unextended_sp which is the sp as seen by
361 // the current frame, and not sp which is the "raw" pc which could point
362 // further because of local variables of the callee method inserted after
363 // method arguments
364 if (fp() - unextended_sp() > 1024 + m->max_stack()*Interpreter::stackElementSize) {
365 return false;
366 }
367
368 // validate bci/bcx
369
370 address bcp = interpreter_frame_bcp();
371 if (m->validate_bci_from_bcp(bcp) < 0) {
372 return false;
373 }
374
375 // validate constantPoolCache*
376 ConstantPoolCache* cp = *interpreter_frame_cache_addr();
377 if (MetaspaceObj::is_valid(cp) == false) return false;
378
379 // validate locals
380
381 address locals = (address)interpreter_frame_locals();
382 return thread->is_in_stack_range_incl(locals, (address)fp());
383 }
384
385 BasicType frame::interpreter_frame_result(oop* oop_result, jvalue* value_result) {
386 assert(is_interpreted_frame(), "interpreted frame expected");
387 Method* method = interpreter_frame_method();
388 BasicType type = method->result_type();
389
390 if (method->is_native()) {
391 // Prior to calling into the runtime to notify the method exit the possible
392 // result value is saved into the interpreter frame.
393 address lresult = (address)&(get_ijava_state()->lresult);
394 address fresult = (address)&(get_ijava_state()->fresult);
395
396 switch (method->result_type()) {
397 case T_OBJECT:
398 case T_ARRAY: {
399 *oop_result = JNIHandles::resolve(*(jobject*)lresult);
400 break;
401 }
402 // We use std/stfd to store the values.
403 case T_BOOLEAN : value_result->z = (jboolean) *(unsigned long*)lresult; break;
404 case T_INT : value_result->i = (jint) *(long*)lresult; break;
405 case T_CHAR : value_result->c = (jchar) *(unsigned long*)lresult; break;
406 case T_SHORT : value_result->s = (jshort) *(long*)lresult; break;
407 case T_BYTE : value_result->z = (jbyte) *(long*)lresult; break;
408 case T_LONG : value_result->j = (jlong) *(long*)lresult; break;
409 case T_FLOAT : value_result->f = (jfloat) *(double*)fresult; break;
410 case T_DOUBLE : value_result->d = (jdouble) *(double*)fresult; break;
411 case T_VOID : /* Nothing to do */ break;
412 default : ShouldNotReachHere();
413 }
414 } else {
415 intptr_t* tos_addr = interpreter_frame_tos_address();
416 switch (method->result_type()) {
417 case T_OBJECT:
418 case T_ARRAY: {
419 oop obj = *(oop*)tos_addr;
420 assert(Universe::is_in_heap_or_null(obj), "sanity check");
421 *oop_result = obj;
422 }
423 case T_BOOLEAN : value_result->z = (jboolean) *(jint*)tos_addr; break;
424 case T_BYTE : value_result->b = (jbyte) *(jint*)tos_addr; break;
425 case T_CHAR : value_result->c = (jchar) *(jint*)tos_addr; break;
426 case T_SHORT : value_result->s = (jshort) *(jint*)tos_addr; break;
427 case T_INT : value_result->i = *(jint*)tos_addr; break;
428 case T_LONG : value_result->j = *(jlong*)tos_addr; break;
429 case T_FLOAT : value_result->f = *(jfloat*)tos_addr; break;
430 case T_DOUBLE : value_result->d = *(jdouble*)tos_addr; break;
431 case T_VOID : /* Nothing to do */ break;
432 default : ShouldNotReachHere();
433 }
434 }
435 return type;
436 }
437
438 #ifndef PRODUCT
439
440 void frame::describe_pd(FrameValues& values, int frame_no) {
441 if (is_interpreted_frame()) {
442 #define DESCRIBE_ADDRESS(name) \
443 values.describe(frame_no, (intptr_t*)&(get_ijava_state()->name), #name);
444
445 DESCRIBE_ADDRESS(method);
446 DESCRIBE_ADDRESS(mirror);
447 DESCRIBE_ADDRESS(locals);
448 DESCRIBE_ADDRESS(monitors);
449 DESCRIBE_ADDRESS(cpoolCache);
450 DESCRIBE_ADDRESS(bcp);
451 DESCRIBE_ADDRESS(esp);
452 DESCRIBE_ADDRESS(mdx);
453 DESCRIBE_ADDRESS(top_frame_sp);
454 DESCRIBE_ADDRESS(sender_sp);
455 DESCRIBE_ADDRESS(oop_tmp);
456 DESCRIBE_ADDRESS(lresult);
457 DESCRIBE_ADDRESS(fresult);
458 }
459
460 if (is_java_frame() || Continuation::is_continuation_enterSpecial(*this)) {
461 intptr_t* ret_pc_loc = (intptr_t*)&own_abi()->lr;
462 address ret_pc = *(address*)ret_pc_loc;
463 values.describe(frame_no, ret_pc_loc,
464 Continuation::is_return_barrier_entry(ret_pc) ? "return address (return barrier)" : "return address");
465 }
466 }
467 #endif
468
469 intptr_t *frame::initial_deoptimization_info() {
470 // `this` is the caller of the deoptee. We want to trim it, if compiled, to
471 // unextended_sp. This is necessary if the deoptee frame is the bottom frame
472 // of a continuation on stack (more frames could be in a StackChunk) as it
473 // will pop its stack args. Otherwise the recursion in
474 // FreezeBase::recurse_freeze_java_frame() would not stop at the bottom frame.
475 return is_compiled_frame() ? unextended_sp() : sp();
476 }
477
478 #ifndef PRODUCT
479 // This is a generic constructor which is only used by pns() in debug.cpp.
480 // fp is dropped and gets determined by backlink.
481 frame::frame(void* sp, void* fp, void* pc) : frame((intptr_t*)sp, (address)pc, kind::unknown) {}
482 #endif
483
484 BasicObjectLock* frame::interpreter_frame_monitor_end() const {
485 BasicObjectLock* result = (BasicObjectLock*) at_relative(ijava_idx(monitors));
486 // make sure the pointer points inside the frame
487 assert(sp() <= (intptr_t*) result, "monitor end should be above the stack pointer");
488 assert((intptr_t*) result < fp(), "monitor end should be strictly below the frame pointer: result: " INTPTR_FORMAT " fp: " INTPTR_FORMAT, p2i(result), p2i(fp()));
489 return result;
490 }
491
492 intptr_t* frame::interpreter_frame_tos_at(jint offset) const {
493 return &interpreter_frame_tos_address()[offset];
494 }
495
496 intptr_t* frame::repair_sender_sp(intptr_t* sender_sp, intptr_t** saved_fp_addr) const {
497 Unimplemented();
498 return nullptr;
499 }
500
501 intptr_t* frame::repair_sender_sp(nmethod* nm, intptr_t* sp, intptr_t** saved_fp_addr) {
502 Unimplemented();
503 return nullptr;
504 }
505
506 bool frame::was_augmented_on_entry(int& real_size) const {
507 Unimplemented();
508 return false;
509 }