1 /*
   2  * Copyright (c) 1994, 2024, Oracle and/or its affiliates. All rights reserved.
   3  * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
   4  *
   5  * This code is free software; you can redistribute it and/or modify it
   6  * under the terms of the GNU General Public License version 2 only, as
   7  * published by the Free Software Foundation.  Oracle designates this
   8  * particular file as subject to the "Classpath" exception as provided
   9  * by Oracle in the LICENSE file that accompanied this code.
  10  *
  11  * This code is distributed in the hope that it will be useful, but WITHOUT
  12  * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
  13  * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
  14  * version 2 for more details (a copy is included in the LICENSE file that
  15  * accompanied this code).
  16  *
  17  * You should have received a copy of the GNU General Public License version
  18  * 2 along with this work; if not, write to the Free Software Foundation,
  19  * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
  20  *
  21  * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
  22  * or visit www.oracle.com if you need additional information or have any
  23  * questions.
  24  */
  25 
  26 /*-
  27  *      Verify that the code within a method block doesn't exploit any
  28  *      security holes.
  29  */
  30 /*
  31    Exported function:
  32 
  33    jboolean
  34    VerifyClassForMajorVersion(JNIEnv *env, jclass cb, char *message_buffer,
  35                               jint buffer_length, jint major_version)
  36 
  37    This file now only uses the standard JNI and the following VM functions
  38    exported in jvm.h:
  39 
  40    JVM_FindClassFromClass
  41    JVM_IsInterface
  42    JVM_GetClassNameUTF
  43    JVM_GetClassCPEntriesCount
  44    JVM_GetClassCPTypes
  45    JVM_GetClassFieldsCount
  46    JVM_GetClassMethodsCount
  47 
  48    JVM_GetFieldIxModifiers
  49 
  50    JVM_GetMethodIxModifiers
  51    JVM_GetMethodIxExceptionTableLength
  52    JVM_GetMethodIxLocalsCount
  53    JVM_GetMethodIxArgsSize
  54    JVM_GetMethodIxMaxStack
  55    JVM_GetMethodIxNameUTF
  56    JVM_GetMethodIxSignatureUTF
  57    JVM_GetMethodIxExceptionsCount
  58    JVM_GetMethodIxExceptionIndexes
  59    JVM_GetMethodIxByteCodeLength
  60    JVM_GetMethodIxByteCode
  61    JVM_GetMethodIxExceptionTableEntry
  62    JVM_IsConstructorIx
  63 
  64    JVM_GetCPClassNameUTF
  65    JVM_GetCPFieldNameUTF
  66    JVM_GetCPMethodNameUTF
  67    JVM_GetCPFieldSignatureUTF
  68    JVM_GetCPMethodSignatureUTF
  69    JVM_GetCPFieldClassNameUTF
  70    JVM_GetCPMethodClassNameUTF
  71    JVM_GetCPFieldModifiers
  72    JVM_GetCPMethodModifiers
  73 
  74    JVM_ReleaseUTF
  75    JVM_IsSameClassPackage
  76 
  77  */
  78 
  79 #include <string.h>
  80 #include <setjmp.h>
  81 #include <assert.h>
  82 #include <limits.h>
  83 #include <stdlib.h>
  84 #include <stdint.h>
  85 
  86 #include "jni.h"
  87 #include "jni_util.h"
  88 #include "jvm.h"
  89 #include "classfile_constants.h"
  90 #include "opcodes.in_out"
  91 
  92 /* On AIX malloc(0) and calloc(0, ...) return a NULL pointer, which is legal,
  93  * but the code here does not handles it. So we wrap the methods and return non-NULL
  94  * pointers even if we allocate 0 bytes.
  95  */
  96 #ifdef _AIX
  97 static int aix_dummy;
  98 static void* aix_malloc(size_t len) {
  99   if (len == 0) {
 100     return &aix_dummy;
 101   }
 102   return malloc(len);
 103 }
 104 
 105 static void* aix_calloc(size_t n, size_t size) {
 106   if (n == 0) {
 107     return &aix_dummy;
 108   }
 109   return calloc(n, size);
 110 }
 111 
 112 static void aix_free(void* p) {
 113   if (p == &aix_dummy) {
 114     return;
 115   }
 116   free(p);
 117 }
 118 
 119 #undef malloc
 120 #undef calloc
 121 #undef free
 122 #define malloc aix_malloc
 123 #define calloc aix_calloc
 124 #define free aix_free
 125 #endif
 126 
 127 #ifdef __APPLE__
 128 /* use setjmp/longjmp versions that do not save/restore the signal mask */
 129 #define setjmp _setjmp
 130 #define longjmp _longjmp
 131 #endif
 132 
 133 #define MAX_ARRAY_DIMENSIONS 255
 134 /* align byte code */
 135 #ifndef ALIGN_UP
 136 #define ALIGN_UP(n,align_grain) (((n) + ((align_grain) - 1)) & ~((align_grain)-1))
 137 #endif /* ALIGN_UP */
 138 #define UCALIGN(n) ((unsigned char *)ALIGN_UP((uintptr_t)(n),sizeof(int)))
 139 
 140 #ifdef DEBUG
 141 
 142 int verify_verbose = 0;
 143 static struct context_type *GlobalContext;
 144 #endif
 145 
 146 enum {
 147     ITEM_Bogus,
 148     ITEM_Void,                  /* only as a function return value */
 149     ITEM_Integer,
 150     ITEM_Float,
 151     ITEM_Double,
 152     ITEM_Double_2,              /* 2nd word of double in register */
 153     ITEM_Long,
 154     ITEM_Long_2,                /* 2nd word of long in register */
 155     ITEM_Array,
 156     ITEM_Object,                /* Extra info field gives name. */
 157     ITEM_NewObject,             /* Like object, but uninitialized. */
 158     ITEM_InitObject,            /* "this" is init method, before call
 159                                     to super() */
 160     ITEM_ReturnAddress,         /* Extra info gives instr # of start pc */
 161     /* The following four are only used within array types.
 162      * Normally, we use ITEM_Integer, instead. */
 163     ITEM_Byte,
 164     ITEM_Short,
 165     ITEM_Char,
 166     ITEM_Boolean
 167 };
 168 
 169 
 170 #define UNKNOWN_STACK_SIZE -1
 171 #define UNKNOWN_REGISTER_COUNT -1
 172 #define UNKNOWN_RET_INSTRUCTION -1
 173 
 174 #undef MAX
 175 #undef MIN
 176 #define MAX(a, b) ((a) > (b) ? (a) : (b))
 177 #define MIN(a, b) ((a) < (b) ? (a) : (b))
 178 
 179 #define BITS_PER_INT   (CHAR_BIT * sizeof(int)/sizeof(char))
 180 #define SET_BIT(flags, i)  (flags[(i)/BITS_PER_INT] |= \
 181                                        ((unsigned)1 << ((i) % BITS_PER_INT)))
 182 #define IS_BIT_SET(flags, i) (flags[(i)/BITS_PER_INT] & \
 183                                        ((unsigned)1 << ((i) % BITS_PER_INT)))
 184 
 185 typedef unsigned int fullinfo_type;
 186 typedef unsigned int *bitvector;
 187 
 188 #define GET_ITEM_TYPE(thing) ((thing) & 0x1F)
 189 #define GET_INDIRECTION(thing) (((thing) & 0xFFFF) >> 5)
 190 #define GET_EXTRA_INFO(thing) ((thing) >> 16)
 191 #define WITH_ZERO_INDIRECTION(thing) ((thing) & ~(0xFFE0))
 192 #define WITH_ZERO_EXTRA_INFO(thing) ((thing) & 0xFFFF)
 193 
 194 #define MAKE_FULLINFO(type, indirect, extra) \
 195      ((type) + ((indirect) << 5) + ((extra) << 16))
 196 
 197 #define MAKE_Object_ARRAY(indirect) \
 198        (context->object_info + ((indirect) << 5))
 199 
 200 #define NULL_FULLINFO MAKE_FULLINFO(ITEM_Object, 0, 0)
 201 
 202 /* JVM_OPC_invokespecial calls to <init> need to be treated special */
 203 #define JVM_OPC_invokeinit 0x100
 204 
 205 /* A hash mechanism used by the verifier.
 206  * Maps class names to unique 16 bit integers.
 207  */
 208 
 209 #define HASH_TABLE_SIZE 503
 210 
 211 /* The buckets are managed as a 256 by 256 matrix. We allocate an entire
 212  * row (256 buckets) at a time to minimize fragmentation. Rows are
 213  * allocated on demand so that we don't waste too much space.
 214  */
 215 
 216 #define MAX_HASH_ENTRIES 65536
 217 #define HASH_ROW_SIZE 256
 218 
 219 typedef struct hash_bucket_type {
 220     char *name;
 221     unsigned int hash;
 222     jclass class;
 223     unsigned short ID;
 224     unsigned short next;
 225     unsigned loadable:1;  /* from context->class loader */
 226 } hash_bucket_type;
 227 
 228 typedef struct {
 229     hash_bucket_type **buckets;
 230     unsigned short *table;
 231     int entries_used;
 232 } hash_table_type;
 233 
 234 #define GET_BUCKET(class_hash, ID)\
 235     (class_hash->buckets[ID / HASH_ROW_SIZE] + ID % HASH_ROW_SIZE)
 236 
 237 /*
 238  * There are currently two types of resources that we need to keep
 239  * track of (in addition to the CCalloc pool).
 240  */
 241 enum {
 242     VM_STRING_UTF, /* VM-allocated UTF strings */
 243     VM_MALLOC_BLK  /* malloc'ed blocks */
 244 };
 245 
 246 #define LDC_CLASS_MAJOR_VERSION 49
 247 
 248 #define LDC_METHOD_HANDLE_MAJOR_VERSION 51
 249 
 250 #define NONZERO_PADDING_BYTES_IN_SWITCH_MAJOR_VERSION 51
 251 
 252 #define STATIC_METHOD_IN_INTERFACE_MAJOR_VERSION  52
 253 
 254 #define ALLOC_STACK_SIZE 16 /* big enough */
 255 
 256 typedef struct alloc_stack_type {
 257     void *ptr;
 258     int kind;
 259     struct alloc_stack_type *next;
 260 } alloc_stack_type;
 261 
 262 /* The context type encapsulates the current invocation of the byte
 263  * code verifier.
 264  */
 265 struct context_type {
 266 
 267     JNIEnv *env;                /* current JNIEnv */
 268 
 269     /* buffers etc. */
 270     char *message;
 271     jint message_buf_len;
 272     jboolean err_code;
 273 
 274     alloc_stack_type *allocated_memory; /* all memory blocks that we have not
 275                                            had a chance to free */
 276     /* Store up to ALLOC_STACK_SIZE number of handles to allocated memory
 277        blocks here, to save mallocs. */
 278     alloc_stack_type alloc_stack[ALLOC_STACK_SIZE];
 279     int alloc_stack_top;
 280 
 281     /* these fields are per class */
 282     jclass class;               /* current class */
 283     jint major_version;
 284     jint nconstants;
 285     unsigned char *constant_types;
 286     hash_table_type class_hash;
 287 
 288     fullinfo_type object_info;  /* fullinfo for java/lang/Object */
 289     fullinfo_type string_info;  /* fullinfo for java/lang/String */
 290     fullinfo_type throwable_info; /* fullinfo for java/lang/Throwable */
 291     fullinfo_type cloneable_info; /* fullinfo for java/lang/Cloneable */
 292     fullinfo_type serializable_info; /* fullinfo for java/io/Serializable */
 293 
 294     fullinfo_type currentclass_info; /* fullinfo for context->class */
 295     fullinfo_type superclass_info;   /* fullinfo for superclass */
 296 
 297     /* these fields are per method */
 298     int method_index;   /* current method */
 299     unsigned short *exceptions; /* exceptions */
 300     unsigned char *code;        /* current code object */
 301     jint code_length;
 302     int *code_data;             /* offset to instruction number */
 303     struct instruction_data_type *instruction_data; /* info about each */
 304     struct handler_info_type *handler_info;
 305     fullinfo_type *superclasses; /* null terminated superclasses */
 306     int instruction_count;      /* number of instructions */
 307     fullinfo_type return_type;  /* function return type */
 308     fullinfo_type swap_table[4]; /* used for passing information */
 309     int bitmask_size;           /* words needed to hold bitmap of arguments */
 310 
 311     /* these fields are per field */
 312     int field_index;
 313 
 314     /* Used by the space allocator */
 315     struct CCpool *CCroot, *CCcurrent;
 316     char *CCfree_ptr;
 317     int CCfree_size;
 318 
 319     /* Jump here on any error. */
 320     jmp_buf jump_buffer;
 321 
 322 #ifdef DEBUG
 323     /* keep track of how many global refs are allocated. */
 324     int n_globalrefs;
 325 #endif
 326 };
 327 
 328 struct stack_info_type {
 329     struct stack_item_type *stack;
 330     int stack_size;
 331 };
 332 
 333 struct register_info_type {
 334     int register_count;         /* number of registers used */
 335     fullinfo_type *registers;
 336     int mask_count;             /* number of masks in the following */
 337     struct mask_type *masks;
 338 };
 339 
 340 struct mask_type {
 341     int entry;
 342     int *modifies;
 343 };
 344 
 345 typedef unsigned short flag_type;
 346 
 347 struct instruction_data_type {
 348     int opcode;         /* may turn into "canonical" opcode */
 349     unsigned changed:1;         /* has it changed */
 350     unsigned protected:1;       /* must accessor be a subclass of "this" */
 351     union {
 352         int i;                  /* operand to the opcode */
 353         int *ip;
 354         fullinfo_type fi;
 355     } operand, operand2;
 356     fullinfo_type p;
 357     struct stack_info_type stack_info;
 358     struct register_info_type register_info;
 359 #define FLAG_REACHED            0x01 /* instruction reached */
 360 #define FLAG_NEED_CONSTRUCTOR   0x02 /* must call this.<init> or super.<init> */
 361 #define FLAG_NO_RETURN          0x04 /* must throw out of method */
 362     flag_type or_flags;         /* true for at least one path to this inst */
 363 #define FLAG_CONSTRUCTED        0x01 /* this.<init> or super.<init> called */
 364     flag_type and_flags;        /* true for all paths to this instruction */
 365 };
 366 
 367 struct handler_info_type {
 368     int start, end, handler;
 369     struct stack_info_type stack_info;
 370 };
 371 
 372 struct stack_item_type {
 373     fullinfo_type item;
 374     struct stack_item_type *next;
 375 };
 376 
 377 typedef struct context_type context_type;
 378 typedef struct instruction_data_type instruction_data_type;
 379 typedef struct stack_item_type stack_item_type;
 380 typedef struct register_info_type register_info_type;
 381 typedef struct stack_info_type stack_info_type;
 382 typedef struct mask_type mask_type;
 383 
 384 static void read_all_code(context_type *context, jclass cb, int num_methods,
 385                           int** code_lengths, unsigned char*** code);
 386 static void verify_method(context_type *context, jclass cb, int index,
 387                           int code_length, unsigned char* code);
 388 static void free_all_code(context_type* context, int num_methods,
 389                           unsigned char** code);
 390 static void verify_field(context_type *context, jclass cb, int index);
 391 
 392 static void verify_opcode_operands (context_type *, unsigned int inumber, int offset);
 393 static void set_protected(context_type *, unsigned int inumber, int key, int);
 394 static jboolean is_superclass(context_type *, fullinfo_type);
 395 
 396 static void initialize_exception_table(context_type *);
 397 static int instruction_length(unsigned char *iptr, unsigned char *end);
 398 static jboolean isLegalTarget(context_type *, int offset);
 399 static void verify_constant_pool_type(context_type *, int, unsigned);
 400 
 401 static void initialize_dataflow(context_type *);
 402 static void run_dataflow(context_type *context);
 403 static void check_register_values(context_type *context, unsigned int inumber);
 404 static void check_flags(context_type *context, unsigned int inumber);
 405 static void pop_stack(context_type *, unsigned int inumber, stack_info_type *);
 406 static void update_registers(context_type *, unsigned int inumber, register_info_type *);
 407 static void update_flags(context_type *, unsigned int inumber,
 408                          flag_type *new_and_flags, flag_type *new_or_flags);
 409 static void push_stack(context_type *, unsigned int inumber, stack_info_type *stack);
 410 
 411 static void merge_into_successors(context_type *, unsigned int inumber,
 412                                   register_info_type *register_info,
 413                                   stack_info_type *stack_info,
 414                                   flag_type and_flags, flag_type or_flags);
 415 static void merge_into_one_successor(context_type *context,
 416                                      unsigned int from_inumber,
 417                                      unsigned int inumber,
 418                                      register_info_type *register_info,
 419                                      stack_info_type *stack_info,
 420                                      flag_type and_flags, flag_type or_flags,
 421                                      jboolean isException);
 422 static void merge_stack(context_type *, unsigned int inumber,
 423                         unsigned int to_inumber, stack_info_type *);
 424 static void merge_registers(context_type *, unsigned int inumber,
 425                             unsigned int to_inumber,
 426                             register_info_type *);
 427 static void merge_flags(context_type *context, unsigned int from_inumber,
 428                         unsigned int to_inumber,
 429                         flag_type new_and_flags, flag_type new_or_flags);
 430 
 431 static stack_item_type *copy_stack(context_type *, stack_item_type *);
 432 static mask_type *copy_masks(context_type *, mask_type *masks, int mask_count);
 433 static mask_type *add_to_masks(context_type *, mask_type *, int , int);
 434 
 435 static fullinfo_type decrement_indirection(fullinfo_type);
 436 
 437 static fullinfo_type merge_fullinfo_types(context_type *context,
 438                                           fullinfo_type a,
 439                                           fullinfo_type b,
 440                                           jboolean assignment);
 441 static jboolean isAssignableTo(context_type *,
 442                                fullinfo_type a,
 443                                fullinfo_type b);
 444 
 445 static jclass object_fullinfo_to_classclass(context_type *, fullinfo_type);
 446 
 447 
 448 #define NEW(type, count) \
 449         ((type *)CCalloc(context, (count)*(sizeof(type)), JNI_FALSE))
 450 #define ZNEW(type, count) \
 451         ((type *)CCalloc(context, (count)*(sizeof(type)), JNI_TRUE))
 452 
 453 static void CCinit(context_type *context);
 454 static void CCreinit(context_type *context);
 455 static void CCdestroy(context_type *context);
 456 static void *CCalloc(context_type *context, int size, jboolean zero);
 457 
 458 static fullinfo_type cp_index_to_class_fullinfo(context_type *, int, int);
 459 
 460 static const char* get_result_signature(const char* signature);
 461 
 462 static char signature_to_fieldtype(context_type *context,
 463                                    const char **signature_p, fullinfo_type *info);
 464 
 465 static void CCerror (context_type *, char *format, ...);
 466 static void CFerror (context_type *, char *format, ...);
 467 static void CCout_of_memory (context_type *);
 468 
 469 /* Because we can longjmp any time, we need to be very careful about
 470  * remembering what needs to be freed. */
 471 
 472 static void check_and_push_malloc_block(context_type *context, void *ptr);
 473 static void check_and_push_string_utf(context_type *context, const char *ptr);
 474 static void pop_and_free(context_type *context);
 475 
 476 static int signature_to_args_size(const char *method_signature);
 477 
 478 #ifdef DEBUG
 479 static void print_stack (context_type *, stack_info_type *stack_info);
 480 static void print_registers(context_type *, register_info_type *register_info);
 481 static void print_flags(context_type *, flag_type, flag_type);
 482 static void print_formatted_fieldname(context_type *context, int index);
 483 static void print_formatted_methodname(context_type *context, int index);
 484 #endif
 485 
 486 /*
 487  * Declare library specific JNI_Onload entry if static build
 488  */
 489 DEF_STATIC_JNI_OnLoad
 490 
 491 void initialize_class_hash(context_type *context)
 492 {
 493     hash_table_type *class_hash = &(context->class_hash);
 494     class_hash->buckets = (hash_bucket_type **)
 495         calloc(MAX_HASH_ENTRIES / HASH_ROW_SIZE, sizeof(hash_bucket_type *));
 496     class_hash->table = (unsigned short *)
 497         calloc(HASH_TABLE_SIZE, sizeof(unsigned short));
 498     if (class_hash->buckets == 0 ||
 499         class_hash->table == 0)
 500         CCout_of_memory(context);
 501     class_hash->entries_used = 0;
 502 }
 503 
 504 static void finalize_class_hash(context_type *context)
 505 {
 506     hash_table_type *class_hash = &(context->class_hash);
 507     JNIEnv *env = context->env;
 508     int i;
 509     /* 4296677: bucket index starts from 1. */
 510     for (i=1;i<=class_hash->entries_used;i++) {
 511         hash_bucket_type *bucket = GET_BUCKET(class_hash, i);
 512         assert(bucket != NULL);
 513         free(bucket->name);
 514         if (bucket->class) {
 515             (*env)->DeleteGlobalRef(env, bucket->class);
 516 #ifdef DEBUG
 517             context->n_globalrefs--;
 518 #endif
 519         }
 520     }
 521     if (class_hash->buckets) {
 522         for (i=0;i<MAX_HASH_ENTRIES / HASH_ROW_SIZE; i++) {
 523             if (class_hash->buckets[i] == 0)
 524                 break;
 525             free(class_hash->buckets[i]);
 526         }
 527     }
 528     free(class_hash->buckets);
 529     free(class_hash->table);
 530 }
 531 
 532 static hash_bucket_type *
 533 new_bucket(context_type *context, unsigned short *pID)
 534 {
 535     hash_table_type *class_hash = &(context->class_hash);
 536     int i = *pID = class_hash->entries_used + 1;
 537     int row = i / HASH_ROW_SIZE;
 538     if (i >= MAX_HASH_ENTRIES)
 539         CCerror(context, "Exceeded verifier's limit of 65535 referred classes");
 540     if (class_hash->buckets[row] == 0) {
 541         class_hash->buckets[row] = (hash_bucket_type*)
 542             calloc(HASH_ROW_SIZE, sizeof(hash_bucket_type));
 543         if (class_hash->buckets[row] == 0)
 544             CCout_of_memory(context);
 545     }
 546     class_hash->entries_used++; /* only increment when we are sure there
 547                                    is no overflow. */
 548     return GET_BUCKET(class_hash, i);
 549 }
 550 
 551 static unsigned int
 552 class_hash_fun(const char *s)
 553 {
 554     int i;
 555     unsigned raw_hash;
 556     for (raw_hash = 0; (i = *s) != '\0'; ++s)
 557         raw_hash = raw_hash * 37 + i;
 558     return raw_hash;
 559 }
 560 
 561 /*
 562  * Find a class using the defining loader of the current class
 563  * and return a local reference to it.
 564  */
 565 static jclass load_class_local(context_type *context,const char *classname)
 566 {
 567     jclass cb = JVM_FindClassFromClass(context->env, classname,
 568                                  JNI_FALSE, context->class);
 569     if (cb == 0)
 570          CCerror(context, "Cannot find class %s", classname);
 571     return cb;
 572 }
 573 
 574 /*
 575  * Find a class using the defining loader of the current class
 576  * and return a global reference to it.
 577  */
 578 static jclass load_class_global(context_type *context, const char *classname)
 579 {
 580     JNIEnv *env = context->env;
 581     jclass local, global;
 582 
 583     local = load_class_local(context, classname);
 584     global = (*env)->NewGlobalRef(env, local);
 585     if (global == 0)
 586         CCout_of_memory(context);
 587 #ifdef DEBUG
 588     context->n_globalrefs++;
 589 #endif
 590     (*env)->DeleteLocalRef(env, local);
 591     return global;
 592 }
 593 
 594 /*
 595  * Return a unique ID given a local class reference. The loadable
 596  * flag is true if the defining class loader of context->class
 597  * is known to be capable of loading the class.
 598  */
 599 static unsigned short
 600 class_to_ID(context_type *context, jclass cb, jboolean loadable)
 601 {
 602     JNIEnv *env = context->env;
 603     hash_table_type *class_hash = &(context->class_hash);
 604     unsigned int hash;
 605     hash_bucket_type *bucket;
 606     unsigned short *pID;
 607     const char *name = JVM_GetClassNameUTF(env, cb);
 608 
 609     check_and_push_string_utf(context, name);
 610     hash = class_hash_fun(name);
 611     pID = &(class_hash->table[hash % HASH_TABLE_SIZE]);
 612     while (*pID) {
 613         bucket = GET_BUCKET(class_hash, *pID);
 614         if (bucket->hash == hash && strcmp(name, bucket->name) == 0) {
 615             /*
 616              * There is an unresolved entry with our name
 617              * so we're forced to load it in case it matches us.
 618              */
 619             if (bucket->class == 0) {
 620                 assert(bucket->loadable == JNI_TRUE);
 621                 bucket->class = load_class_global(context, name);
 622             }
 623 
 624             /*
 625              * It's already in the table. Update the loadable
 626              * state if it's known and then we're done.
 627              */
 628             if ((*env)->IsSameObject(env, cb, bucket->class)) {
 629                 if (loadable && !bucket->loadable)
 630                     bucket->loadable = JNI_TRUE;
 631                 goto done;
 632             }
 633         }
 634         pID = &bucket->next;
 635     }
 636     bucket = new_bucket(context, pID);
 637     bucket->next = 0;
 638     bucket->hash = hash;
 639     bucket->name = malloc(strlen(name) + 1);
 640     if (bucket->name == 0)
 641         CCout_of_memory(context);
 642     strcpy(bucket->name, name);
 643     bucket->loadable = loadable;
 644     bucket->class = (*env)->NewGlobalRef(env, cb);
 645     if (bucket->class == 0)
 646         CCout_of_memory(context);
 647 #ifdef DEBUG
 648     context->n_globalrefs++;
 649 #endif
 650 
 651 done:
 652     pop_and_free(context);
 653     return *pID;
 654 }
 655 
 656 /*
 657  * Return a unique ID given a class name from the constant pool.
 658  * All classes are lazily loaded from the defining loader of
 659  * context->class.
 660  */
 661 static unsigned short
 662 class_name_to_ID(context_type *context, const char *name)
 663 {
 664     hash_table_type *class_hash = &(context->class_hash);
 665     unsigned int hash = class_hash_fun(name);
 666     hash_bucket_type *bucket;
 667     unsigned short *pID;
 668     jboolean force_load = JNI_FALSE;
 669 
 670     pID = &(class_hash->table[hash % HASH_TABLE_SIZE]);
 671     while (*pID) {
 672         bucket = GET_BUCKET(class_hash, *pID);
 673         if (bucket->hash == hash && strcmp(name, bucket->name) == 0) {
 674             if (bucket->loadable)
 675                 goto done;
 676             force_load = JNI_TRUE;
 677         }
 678         pID = &bucket->next;
 679     }
 680 
 681     if (force_load) {
 682         /*
 683          * We found at least one matching named entry for a class that
 684          * was not known to be loadable through the defining class loader
 685          * of context->class. We must load our named class and update
 686          * the hash table in case one these entries matches our class.
 687          */
 688         JNIEnv *env = context->env;
 689         jclass cb = load_class_local(context, name);
 690         unsigned short id = class_to_ID(context, cb, JNI_TRUE);
 691         (*env)->DeleteLocalRef(env, cb);
 692         return id;
 693     }
 694 
 695     bucket = new_bucket(context, pID);
 696     bucket->next = 0;
 697     bucket->class = 0;
 698     bucket->loadable = JNI_TRUE; /* name-only IDs are implicitly loadable */
 699     bucket->hash = hash;
 700     bucket->name = malloc(strlen(name) + 1);
 701     if (bucket->name == 0)
 702         CCout_of_memory(context);
 703     strcpy(bucket->name, name);
 704 
 705 done:
 706     return *pID;
 707 }
 708 
 709 #ifdef DEBUG
 710 static const char *
 711 ID_to_class_name(context_type *context, unsigned short ID)
 712 {
 713     hash_table_type *class_hash = &(context->class_hash);
 714     hash_bucket_type *bucket = GET_BUCKET(class_hash, ID);
 715     return bucket->name;
 716 }
 717 #endif
 718 
 719 static jclass
 720 ID_to_class(context_type *context, unsigned short ID)
 721 {
 722     hash_table_type *class_hash = &(context->class_hash);
 723     hash_bucket_type *bucket = GET_BUCKET(class_hash, ID);
 724     if (bucket->class == 0) {
 725         assert(bucket->loadable == JNI_TRUE);
 726         bucket->class = load_class_global(context, bucket->name);
 727     }
 728     return bucket->class;
 729 }
 730 
 731 static fullinfo_type
 732 make_loadable_class_info(context_type *context, jclass cb)
 733 {
 734     return MAKE_FULLINFO(ITEM_Object, 0,
 735                            class_to_ID(context, cb, JNI_TRUE));
 736 }
 737 
 738 static fullinfo_type
 739 make_class_info(context_type *context, jclass cb)
 740 {
 741     return MAKE_FULLINFO(ITEM_Object, 0,
 742                          class_to_ID(context, cb, JNI_FALSE));
 743 }
 744 
 745 static fullinfo_type
 746 make_class_info_from_name(context_type *context, const char *name)
 747 {
 748     return MAKE_FULLINFO(ITEM_Object, 0,
 749                          class_name_to_ID(context, name));
 750 }
 751 
 752 /* RETURNS
 753  * 1: on success       chosen to be consistent with previous VerifyClass
 754  * 0: verify error
 755  * 2: out of memory
 756  * 3: class format error
 757  *
 758  * Called by verify_class.  Verify the code of each of the methods
 759  * in a class.  Note that this function apparently can't be JNICALL,
 760  * because if it is the dynamic linker doesn't appear to be able to
 761  * find it on Win32.
 762  */
 763 
 764 #define CC_OK 1
 765 #define CC_VerifyError 0
 766 #define CC_OutOfMemory 2
 767 #define CC_ClassFormatError 3
 768 
 769 JNIEXPORT jboolean
 770 VerifyClassForMajorVersion(JNIEnv *env, jclass cb, char *buffer, jint len,
 771                            jint major_version)
 772 {
 773     context_type context_structure;
 774     context_type *context = &context_structure;
 775     jboolean result = CC_OK;
 776     int i;
 777     int num_methods;
 778     int* code_lengths;
 779     unsigned char** code;
 780 
 781 #ifdef DEBUG
 782     GlobalContext = context;
 783 #endif
 784 
 785     memset(context, 0, sizeof(context_type));
 786     context->message = buffer;
 787     context->message_buf_len = len;
 788 
 789     context->env = env;
 790     context->class = cb;
 791 
 792     /* Set invalid method/field index of the context, in case anyone
 793        calls CCerror */
 794     context->method_index = -1;
 795     context->field_index = -1;
 796 
 797     /* Don't call CCerror or anything that can call it above the setjmp! */
 798     if (!setjmp(context->jump_buffer)) {
 799         jclass super;
 800 
 801         CCinit(context);                /* initialize heap; may throw */
 802 
 803         initialize_class_hash(context);
 804 
 805         context->major_version = major_version;
 806         context->nconstants = JVM_GetClassCPEntriesCount(env, cb);
 807         context->constant_types = (unsigned char *)
 808             malloc(sizeof(unsigned char) * context->nconstants + 1);
 809 
 810         if (context->constant_types == 0)
 811             CCout_of_memory(context);
 812 
 813         JVM_GetClassCPTypes(env, cb, context->constant_types);
 814 
 815         if (context->constant_types == 0)
 816             CCout_of_memory(context);
 817 
 818         context->object_info =
 819             make_class_info_from_name(context, "java/lang/Object");
 820         context->string_info =
 821             make_class_info_from_name(context, "java/lang/String");
 822         context->throwable_info =
 823             make_class_info_from_name(context, "java/lang/Throwable");
 824         context->cloneable_info =
 825             make_class_info_from_name(context, "java/lang/Cloneable");
 826         context->serializable_info =
 827             make_class_info_from_name(context, "java/io/Serializable");
 828 
 829         context->currentclass_info = make_loadable_class_info(context, cb);
 830 
 831         super = (*env)->GetSuperclass(env, cb);
 832 
 833         if (super != 0) {
 834             fullinfo_type *gptr;
 835             int i = 0;
 836 
 837             context->superclass_info = make_loadable_class_info(context, super);
 838 
 839             while(super != 0) {
 840                 jclass tmp_cb = (*env)->GetSuperclass(env, super);
 841                 (*env)->DeleteLocalRef(env, super);
 842                 super = tmp_cb;
 843                 i++;
 844             }
 845             (*env)->DeleteLocalRef(env, super);
 846             super = 0;
 847 
 848             /* Can't go on context heap since it survives more than
 849                one method */
 850             context->superclasses = gptr =
 851                 malloc(sizeof(fullinfo_type)*(i + 1));
 852             if (gptr == 0) {
 853                 CCout_of_memory(context);
 854             }
 855 
 856             super = (*env)->GetSuperclass(env, context->class);
 857             while(super != 0) {
 858                 jclass tmp_cb;
 859                 *gptr++ = make_class_info(context, super);
 860                 tmp_cb = (*env)->GetSuperclass(env, super);
 861                 (*env)->DeleteLocalRef(env, super);
 862                 super = tmp_cb;
 863             }
 864             *gptr = 0;
 865         } else {
 866             context->superclass_info = 0;
 867         }
 868 
 869         (*env)->DeleteLocalRef(env, super);
 870 
 871         /* Look at each method */
 872         for (i = JVM_GetClassFieldsCount(env, cb); --i >= 0;)
 873             verify_field(context, cb, i);
 874         num_methods = JVM_GetClassMethodsCount(env, cb);
 875         read_all_code(context, cb, num_methods, &code_lengths, &code);
 876         for (i = num_methods - 1; i >= 0; --i)
 877             verify_method(context, cb, i, code_lengths[i], code[i]);
 878         free_all_code(context, num_methods, code);
 879         result = CC_OK;
 880     } else {
 881         result = context->err_code;
 882     }
 883 
 884     /* Cleanup */
 885     finalize_class_hash(context);
 886 
 887     while(context->allocated_memory)
 888         pop_and_free(context);
 889 
 890 #ifdef DEBUG
 891     GlobalContext = 0;
 892 #endif
 893 
 894     if (context->exceptions)
 895         free(context->exceptions);
 896 
 897     if (context->constant_types)
 898         free(context->constant_types);
 899 
 900     if (context->superclasses)
 901         free(context->superclasses);
 902 
 903 #ifdef DEBUG
 904     /* Make sure all global refs created in the verifier are freed */
 905     assert(context->n_globalrefs == 0);
 906 #endif
 907 
 908     CCdestroy(context);         /* destroy heap */
 909     return result;
 910 }
 911 
 912 static void
 913 verify_field(context_type *context, jclass cb, int field_index)
 914 {
 915     JNIEnv *env = context->env;
 916     int access_bits = JVM_GetFieldIxModifiers(env, cb, field_index);
 917     context->field_index = field_index;
 918 
 919     if (  ((access_bits & JVM_ACC_PUBLIC) != 0) &&
 920           ((access_bits & (JVM_ACC_PRIVATE | JVM_ACC_PROTECTED)) != 0)) {
 921         CCerror(context, "Inconsistent access bits.");
 922     }
 923     context->field_index = -1;
 924 }
 925 
 926 
 927 /**
 928  * We read all of the class's methods' code because it is possible that
 929  * the verification of one method could resulting in linking further
 930  * down the stack (due to class loading), which could end up rewriting
 931  * some of the bytecode of methods we haven't verified yet.  Since we
 932  * don't want to see the rewritten bytecode, cache all the code and
 933  * operate only on that.
 934  */
 935 static void
 936 read_all_code(context_type* context, jclass cb, int num_methods,
 937               int** lengths_addr, unsigned char*** code_addr)
 938 {
 939     int* lengths;
 940     unsigned char** code;
 941     int i;
 942 
 943     lengths = malloc(sizeof(int) * num_methods);
 944     check_and_push_malloc_block(context, lengths);
 945 
 946     code = malloc(sizeof(unsigned char*) * num_methods);
 947     check_and_push_malloc_block(context, code);
 948 
 949     *(lengths_addr) = lengths;
 950     *(code_addr) = code;
 951 
 952     for (i = 0; i < num_methods; ++i) {
 953         lengths[i] = JVM_GetMethodIxByteCodeLength(context->env, cb, i);
 954         if (lengths[i] > 0) {
 955             code[i] = malloc(sizeof(unsigned char) * (lengths[i] + 1));
 956             check_and_push_malloc_block(context, code[i]);
 957             JVM_GetMethodIxByteCode(context->env, cb, i, code[i]);
 958         } else {
 959             code[i] = NULL;
 960         }
 961     }
 962 }
 963 
 964 static void
 965 free_all_code(context_type* context, int num_methods, unsigned char** code)
 966 {
 967   int i;
 968   for (i = 0; i < num_methods; ++i) {
 969       if (code[i] != NULL) {
 970           pop_and_free(context);
 971       }
 972   }
 973   pop_and_free(context); /* code */
 974   pop_and_free(context); /* lengths */
 975 }
 976 
 977 /* Verify the code of one method */
 978 static void
 979 verify_method(context_type *context, jclass cb, int method_index,
 980               int code_length, unsigned char* code)
 981 {
 982     JNIEnv *env = context->env;
 983     int access_bits = JVM_GetMethodIxModifiers(env, cb, method_index);
 984     int *code_data;
 985     instruction_data_type *idata = 0;
 986     int instruction_count;
 987     int i, offset;
 988     unsigned int inumber;
 989     jint nexceptions;
 990 
 991     if ((access_bits & (JVM_ACC_NATIVE | JVM_ACC_ABSTRACT)) != 0) {
 992         /* not much to do for abstract and native methods */
 993         return;
 994     }
 995 
 996     context->code_length = code_length;
 997     context->code = code;
 998 
 999     /* CCerror can give method-specific info once this is set */
1000     context->method_index = method_index;
1001 
1002     CCreinit(context);          /* initial heap */
1003     code_data = NEW(int, code_length);
1004 
1005 #ifdef DEBUG
1006     if (verify_verbose) {
1007         const char *classname = JVM_GetClassNameUTF(env, cb);
1008         const char *methodname =
1009             JVM_GetMethodIxNameUTF(env, cb, method_index);
1010         const char *signature =
1011             JVM_GetMethodIxSignatureUTF(env, cb, method_index);
1012         jio_fprintf(stdout, "Looking at %s.%s%s\n",
1013                     (classname ? classname : ""),
1014                     (methodname ? methodname : ""),
1015                     (signature ? signature : ""));
1016         JVM_ReleaseUTF(classname);
1017         JVM_ReleaseUTF(methodname);
1018         JVM_ReleaseUTF(signature);
1019     }
1020 #endif
1021 
1022     if (((access_bits & JVM_ACC_PUBLIC) != 0) &&
1023         ((access_bits & (JVM_ACC_PRIVATE | JVM_ACC_PROTECTED)) != 0)) {
1024         CCerror(context, "Inconsistent access bits.");
1025     }
1026 
1027     // If this method is an overpass method, which is generated by the VM,
1028     // we trust the code and no check needs to be done.
1029     if (JVM_IsVMGeneratedMethodIx(env, cb, method_index)) {
1030       return;
1031     }
1032 
1033     /* Run through the code.  Mark the start of each instruction, and give
1034      * the instruction a number */
1035     for (i = 0, offset = 0; offset < code_length; i++) {
1036         int length = instruction_length(&code[offset], code + code_length);
1037         int next_offset = offset + length;
1038         if (length <= 0)
1039             CCerror(context, "Illegal instruction found at offset %d", offset);
1040         if (next_offset > code_length)
1041             CCerror(context, "Code stops in the middle of instruction "
1042                     " starting at offset %d", offset);
1043         code_data[offset] = i;
1044         while (++offset < next_offset)
1045             code_data[offset] = -1; /* illegal location */
1046     }
1047     instruction_count = i;      /* number of instructions in code */
1048 
1049     /* Allocate a structure to hold info about each instruction. */
1050     idata = NEW(instruction_data_type, instruction_count);
1051 
1052     /* Initialize the heap, and other info in the context structure. */
1053     context->code = code;
1054     context->instruction_data = idata;
1055     context->code_data = code_data;
1056     context->instruction_count = instruction_count;
1057     context->handler_info =
1058         NEW(struct handler_info_type,
1059             JVM_GetMethodIxExceptionTableLength(env, cb, method_index));
1060     context->bitmask_size =
1061         (JVM_GetMethodIxLocalsCount(env, cb, method_index)
1062          + (BITS_PER_INT - 1))/BITS_PER_INT;
1063 
1064     if (instruction_count == 0)
1065         CCerror(context, "Empty code");
1066 
1067     for (inumber = 0, offset = 0; offset < code_length; inumber++) {
1068         int length = instruction_length(&code[offset], code + code_length);
1069         instruction_data_type *this_idata = &idata[inumber];
1070         this_idata->opcode = code[offset];
1071         this_idata->stack_info.stack = NULL;
1072         this_idata->stack_info.stack_size  = UNKNOWN_STACK_SIZE;
1073         this_idata->register_info.register_count = UNKNOWN_REGISTER_COUNT;
1074         this_idata->changed = JNI_FALSE;  /* no need to look at it yet. */
1075         this_idata->protected = JNI_FALSE;  /* no need to look at it yet. */
1076         this_idata->and_flags = (flag_type) -1; /* "bottom" and value */
1077         this_idata->or_flags = 0; /* "bottom" or value*/
1078         /* This also sets up this_data->operand.  It also makes the
1079          * xload_x and xstore_x instructions look like the generic form. */
1080         verify_opcode_operands(context, inumber, offset);
1081         offset += length;
1082     }
1083 
1084 
1085     /* make sure exception table is reasonable. */
1086     initialize_exception_table(context);
1087     /* Set up first instruction, and start of exception handlers. */
1088     initialize_dataflow(context);
1089     /* Run data flow analysis on the instructions. */
1090     run_dataflow(context);
1091 
1092     /* verify checked exceptions, if any */
1093     nexceptions = JVM_GetMethodIxExceptionsCount(env, cb, method_index);
1094     context->exceptions = (unsigned short *)
1095         malloc(sizeof(unsigned short) * nexceptions + 1);
1096     if (context->exceptions == 0)
1097         CCout_of_memory(context);
1098     JVM_GetMethodIxExceptionIndexes(env, cb, method_index,
1099                                     context->exceptions);
1100     for (i = 0; i < nexceptions; i++) {
1101         /* Make sure the constant pool item is JVM_CONSTANT_Class */
1102         verify_constant_pool_type(context, (int)context->exceptions[i],
1103                                   1 << JVM_CONSTANT_Class);
1104     }
1105     free(context->exceptions);
1106     context->exceptions = 0;
1107     context->code = 0;
1108     context->method_index = -1;
1109 }
1110 
1111 
1112 /* Look at a single instruction, and verify its operands.  Also, for
1113  * simplicity, move the operand into the ->operand field.
1114  * Make sure that branches don't go into the middle of nowhere.
1115  */
1116 
1117 static jint _ck_ntohl(jint n)
1118 {
1119     unsigned char *p = (unsigned char *)&n;
1120     return (p[0] << 24) | (p[1] << 16) | (p[2] << 8) | p[3];
1121 }
1122 
1123 static void
1124 verify_opcode_operands(context_type *context, unsigned int inumber, int offset)
1125 {
1126     JNIEnv *env = context->env;
1127     instruction_data_type *idata = context->instruction_data;
1128     instruction_data_type *this_idata = &idata[inumber];
1129     int *code_data = context->code_data;
1130     int mi = context->method_index;
1131     unsigned char *code = context->code;
1132     int opcode = this_idata->opcode;
1133     int var;
1134 
1135     /*
1136      * Set the ip fields to 0 not the i fields because the ip fields
1137      * are 64 bits on 64 bit architectures, the i field is only 32
1138      */
1139     this_idata->operand.ip = 0;
1140     this_idata->operand2.ip = 0;
1141 
1142     switch (opcode) {
1143 
1144     case JVM_OPC_jsr:
1145         /* instruction of ret statement */
1146         this_idata->operand2.i = UNKNOWN_RET_INSTRUCTION;
1147         /* FALLTHROUGH */
1148     case JVM_OPC_ifeq: case JVM_OPC_ifne: case JVM_OPC_iflt:
1149     case JVM_OPC_ifge: case JVM_OPC_ifgt: case JVM_OPC_ifle:
1150     case JVM_OPC_ifnull: case JVM_OPC_ifnonnull:
1151     case JVM_OPC_if_icmpeq: case JVM_OPC_if_icmpne: case JVM_OPC_if_icmplt:
1152     case JVM_OPC_if_icmpge: case JVM_OPC_if_icmpgt: case JVM_OPC_if_icmple:
1153     case JVM_OPC_if_acmpeq: case JVM_OPC_if_acmpne:
1154     case JVM_OPC_goto: {
1155         /* Set the ->operand to be the instruction number of the target. */
1156         int jump = (((signed char)(code[offset+1])) << 8) + code[offset+2];
1157         int target = offset + jump;
1158         if (!isLegalTarget(context, target))
1159             CCerror(context, "Illegal target of jump or branch");
1160         this_idata->operand.i = code_data[target];
1161         break;
1162     }
1163 
1164     case JVM_OPC_jsr_w:
1165         /* instruction of ret statement */
1166         this_idata->operand2.i = UNKNOWN_RET_INSTRUCTION;
1167         /* FALLTHROUGH */
1168     case JVM_OPC_goto_w: {
1169         /* Set the ->operand to be the instruction number of the target. */
1170         int jump = (((signed char)(code[offset+1])) << 24) +
1171                      (code[offset+2] << 16) + (code[offset+3] << 8) +
1172                      (code[offset + 4]);
1173         int target = offset + jump;
1174         if (!isLegalTarget(context, target))
1175             CCerror(context, "Illegal target of jump or branch");
1176         this_idata->operand.i = code_data[target];
1177         break;
1178     }
1179 
1180     case JVM_OPC_tableswitch:
1181     case JVM_OPC_lookupswitch: {
1182         /* Set the ->operand to be a table of possible instruction targets. */
1183         int *lpc = (int *) UCALIGN(code + offset + 1);
1184         int *lptr;
1185         int *saved_operand;
1186         int keys;
1187         int k, delta;
1188 
1189         if (context->major_version < NONZERO_PADDING_BYTES_IN_SWITCH_MAJOR_VERSION) {
1190             /* 4639449, 4647081: Padding bytes must be zero. */
1191             unsigned char* bptr = (unsigned char*) (code + offset + 1);
1192             for (; bptr < (unsigned char*)lpc; bptr++) {
1193                 if (*bptr != 0) {
1194                     CCerror(context, "Non zero padding bytes in switch");
1195                 }
1196             }
1197         }
1198         if (opcode == JVM_OPC_tableswitch) {
1199             keys = _ck_ntohl(lpc[2]) - _ck_ntohl(lpc[1]) + 1;
1200             delta = 1;
1201         } else {
1202             keys = _ck_ntohl(lpc[1]); /* number of pairs */
1203             delta = 2;
1204             /* Make sure that the tableswitch items are sorted */
1205             for (k = keys - 1, lptr = &lpc[2]; --k >= 0; lptr += 2) {
1206                 int this_key = _ck_ntohl(lptr[0]);  /* NB: ntohl may be unsigned */
1207                 int next_key = _ck_ntohl(lptr[2]);
1208                 if (this_key >= next_key) {
1209                     CCerror(context, "Unsorted lookup switch");
1210                 }
1211             }
1212         }
1213         saved_operand = NEW(int, keys + 2);
1214         if (!isLegalTarget(context, offset + _ck_ntohl(lpc[0])))
1215             CCerror(context, "Illegal default target in switch");
1216         saved_operand[keys + 1] = code_data[offset + _ck_ntohl(lpc[0])];
1217         for (k = keys, lptr = &lpc[3]; --k >= 0; lptr += delta) {
1218             int target = offset + _ck_ntohl(lptr[0]);
1219             if (!isLegalTarget(context, target))
1220                 CCerror(context, "Illegal branch in tableswitch");
1221             saved_operand[k + 1] = code_data[target];
1222         }
1223         saved_operand[0] = keys + 1; /* number of successors */
1224         this_idata->operand.ip = saved_operand;
1225         break;
1226     }
1227 
1228     case JVM_OPC_ldc: {
1229         /* Make sure the constant pool item is the right type. */
1230         int key = code[offset + 1];
1231         int types = (1 << JVM_CONSTANT_Integer) | (1 << JVM_CONSTANT_Float) |
1232                     (1 << JVM_CONSTANT_String);
1233         if (context->major_version >= LDC_CLASS_MAJOR_VERSION) {
1234             types |= 1 << JVM_CONSTANT_Class;
1235         }
1236         if (context->major_version >= LDC_METHOD_HANDLE_MAJOR_VERSION) {
1237             types |= (1 << JVM_CONSTANT_MethodHandle) |
1238                      (1 << JVM_CONSTANT_MethodType);
1239         }
1240         this_idata->operand.i = key;
1241         verify_constant_pool_type(context, key, types);
1242         break;
1243     }
1244 
1245     case JVM_OPC_ldc_w: {
1246         /* Make sure the constant pool item is the right type. */
1247         int key = (code[offset + 1] << 8) + code[offset + 2];
1248         int types = (1 << JVM_CONSTANT_Integer) | (1 << JVM_CONSTANT_Float) |
1249                     (1 << JVM_CONSTANT_String);
1250         if (context->major_version >= LDC_CLASS_MAJOR_VERSION) {
1251             types |= 1 << JVM_CONSTANT_Class;
1252         }
1253         if (context->major_version >= LDC_METHOD_HANDLE_MAJOR_VERSION) {
1254             types |= (1 << JVM_CONSTANT_MethodHandle) |
1255                      (1 << JVM_CONSTANT_MethodType);
1256         }
1257         this_idata->operand.i = key;
1258         verify_constant_pool_type(context, key, types);
1259         break;
1260     }
1261 
1262     case JVM_OPC_ldc2_w: {
1263         /* Make sure the constant pool item is the right type. */
1264         int key = (code[offset + 1] << 8) + code[offset + 2];
1265         int types = (1 << JVM_CONSTANT_Double) | (1 << JVM_CONSTANT_Long);
1266         this_idata->operand.i = key;
1267         verify_constant_pool_type(context, key, types);
1268         break;
1269     }
1270 
1271     case JVM_OPC_getfield: case JVM_OPC_putfield:
1272     case JVM_OPC_getstatic: case JVM_OPC_putstatic: {
1273         /* Make sure the constant pool item is the right type. */
1274         int key = (code[offset + 1] << 8) + code[offset + 2];
1275         this_idata->operand.i = key;
1276         verify_constant_pool_type(context, key, 1 << JVM_CONSTANT_Fieldref);
1277         if (opcode == JVM_OPC_getfield || opcode == JVM_OPC_putfield)
1278             set_protected(context, inumber, key, opcode);
1279         break;
1280     }
1281 
1282     case JVM_OPC_invokevirtual:
1283     case JVM_OPC_invokespecial:
1284     case JVM_OPC_invokestatic:
1285     case JVM_OPC_invokeinterface: {
1286         /* Make sure the constant pool item is the right type. */
1287         int key = (code[offset + 1] << 8) + code[offset + 2];
1288         const char *methodname;
1289         jclass cb = context->class;
1290         fullinfo_type clazz_info;
1291         int is_constructor, is_internal;
1292         int kind;
1293 
1294         switch (opcode ) {
1295         case JVM_OPC_invokestatic:
1296             kind = ((context->major_version < STATIC_METHOD_IN_INTERFACE_MAJOR_VERSION)
1297                        ? (1 << JVM_CONSTANT_Methodref)
1298                        : ((1 << JVM_CONSTANT_InterfaceMethodref) | (1 << JVM_CONSTANT_Methodref)));
1299             break;
1300         case JVM_OPC_invokeinterface:
1301             kind = 1 << JVM_CONSTANT_InterfaceMethodref;
1302             break;
1303         default:
1304             kind = 1 << JVM_CONSTANT_Methodref;
1305         }
1306 
1307         /* Make sure the constant pool item is the right type. */
1308         verify_constant_pool_type(context, key, kind);
1309         methodname = JVM_GetCPMethodNameUTF(env, cb, key);
1310         check_and_push_string_utf(context, methodname);
1311         is_constructor = !strcmp(methodname, "<init>");
1312         is_internal = methodname[0] == '<';
1313         pop_and_free(context);
1314 
1315         clazz_info = cp_index_to_class_fullinfo(context, key,
1316                                                 JVM_CONSTANT_Methodref);
1317         this_idata->operand.i = key;
1318         this_idata->operand2.fi = clazz_info;
1319         if (is_constructor) {
1320             if (opcode != JVM_OPC_invokespecial) {
1321                 CCerror(context,
1322                         "Must call initializers using invokespecial");
1323             }
1324             this_idata->opcode = JVM_OPC_invokeinit;
1325         } else {
1326             if (is_internal) {
1327                 CCerror(context, "Illegal call to internal method");
1328             }
1329             if (opcode == JVM_OPC_invokespecial
1330                    && clazz_info != context->currentclass_info
1331                    && clazz_info != context->superclass_info) {
1332                 int not_found = 1;
1333 
1334                 jclass super = (*env)->GetSuperclass(env, context->class);
1335                 while(super != 0) {
1336                     jclass tmp_cb;
1337                     fullinfo_type new_info = make_class_info(context, super);
1338                     if (clazz_info == new_info) {
1339                         not_found = 0;
1340                         break;
1341                     }
1342                     tmp_cb = (*env)->GetSuperclass(env, super);
1343                     (*env)->DeleteLocalRef(env, super);
1344                     super = tmp_cb;
1345                 }
1346                 (*env)->DeleteLocalRef(env, super);
1347 
1348                 /* The optimizer may cause this to happen on local code */
1349                 if (not_found) {
1350                     CCerror(context, "Illegal use of nonvirtual function call");
1351                 }
1352             }
1353         }
1354         if (opcode == JVM_OPC_invokeinterface) {
1355             unsigned int args1;
1356             unsigned int args2;
1357             const char *signature =
1358                 JVM_GetCPMethodSignatureUTF(env, context->class, key);
1359             check_and_push_string_utf(context, signature);
1360             args1 = signature_to_args_size(signature) + 1;
1361             args2 = code[offset + 3];
1362             if (args1 != args2) {
1363                 CCerror(context,
1364                         "Inconsistent args_size for invokeinterface");
1365             }
1366             if (code[offset + 4] != 0) {
1367                 CCerror(context,
1368                         "Fourth operand byte of invokeinterface must be zero");
1369             }
1370             pop_and_free(context);
1371         } else if (opcode == JVM_OPC_invokevirtual
1372                       || opcode == JVM_OPC_invokespecial)
1373             set_protected(context, inumber, key, opcode);
1374         break;
1375     }
1376 
1377     case JVM_OPC_invokedynamic:
1378         CCerror(context,
1379                 "invokedynamic bytecode is not supported in this class file version");
1380         break;
1381     case JVM_OPC_instanceof:
1382     case JVM_OPC_checkcast:
1383     case JVM_OPC_new:
1384     case JVM_OPC_anewarray:
1385     case JVM_OPC_multianewarray: {
1386         /* Make sure the constant pool item is a class */
1387         int key = (code[offset + 1] << 8) + code[offset + 2];
1388         fullinfo_type target;
1389         verify_constant_pool_type(context, key, 1 << JVM_CONSTANT_Class);
1390         target = cp_index_to_class_fullinfo(context, key, JVM_CONSTANT_Class);
1391         if (GET_ITEM_TYPE(target) == ITEM_Bogus)
1392             CCerror(context, "Illegal type");
1393         switch(opcode) {
1394         case JVM_OPC_anewarray:
1395             if ((GET_INDIRECTION(target)) >= MAX_ARRAY_DIMENSIONS)
1396                 CCerror(context, "Array with too many dimensions");
1397             this_idata->operand.fi = MAKE_FULLINFO(GET_ITEM_TYPE(target),
1398                                                    GET_INDIRECTION(target) + 1,
1399                                                    GET_EXTRA_INFO(target));
1400             break;
1401         case JVM_OPC_new:
1402             if (WITH_ZERO_EXTRA_INFO(target) !=
1403                              MAKE_FULLINFO(ITEM_Object, 0, 0))
1404                 CCerror(context, "Illegal creation of multi-dimensional array");
1405             /* operand gets set to the "uninitialized object".  operand2 gets
1406              * set to what the value will be after it's initialized. */
1407             this_idata->operand.fi = MAKE_FULLINFO(ITEM_NewObject, 0, inumber);
1408             this_idata->operand2.fi = target;
1409             break;
1410         case JVM_OPC_multianewarray:
1411             this_idata->operand.fi = target;
1412             this_idata->operand2.i = code[offset + 3];
1413             if (    (this_idata->operand2.i > (int)GET_INDIRECTION(target))
1414                  || (this_idata->operand2.i == 0))
1415                 CCerror(context, "Illegal dimension argument");
1416             break;
1417         default:
1418             this_idata->operand.fi = target;
1419         }
1420         break;
1421     }
1422 
1423     case JVM_OPC_newarray: {
1424         /* Cache the result of the JVM_OPC_newarray into the operand slot */
1425         fullinfo_type full_info;
1426         switch (code[offset + 1]) {
1427             case JVM_T_INT:
1428                 full_info = MAKE_FULLINFO(ITEM_Integer, 1, 0); break;
1429             case JVM_T_LONG:
1430                 full_info = MAKE_FULLINFO(ITEM_Long, 1, 0); break;
1431             case JVM_T_FLOAT:
1432                 full_info = MAKE_FULLINFO(ITEM_Float, 1, 0); break;
1433             case JVM_T_DOUBLE:
1434                 full_info = MAKE_FULLINFO(ITEM_Double, 1, 0); break;
1435             case JVM_T_BOOLEAN:
1436                 full_info = MAKE_FULLINFO(ITEM_Boolean, 1, 0); break;
1437             case JVM_T_BYTE:
1438                 full_info = MAKE_FULLINFO(ITEM_Byte, 1, 0); break;
1439             case JVM_T_CHAR:
1440                 full_info = MAKE_FULLINFO(ITEM_Char, 1, 0); break;
1441             case JVM_T_SHORT:
1442                 full_info = MAKE_FULLINFO(ITEM_Short, 1, 0); break;
1443             default:
1444                 full_info = 0;          /* Keep lint happy */
1445                 CCerror(context, "Bad type passed to newarray");
1446         }
1447         this_idata->operand.fi = full_info;
1448         break;
1449     }
1450 
1451     /* Fudge iload_x, aload_x, etc to look like their generic cousin. */
1452     case JVM_OPC_iload_0: case JVM_OPC_iload_1: case JVM_OPC_iload_2: case JVM_OPC_iload_3:
1453         this_idata->opcode = JVM_OPC_iload;
1454         var = opcode - JVM_OPC_iload_0;
1455         goto check_local_variable;
1456 
1457     case JVM_OPC_fload_0: case JVM_OPC_fload_1: case JVM_OPC_fload_2: case JVM_OPC_fload_3:
1458         this_idata->opcode = JVM_OPC_fload;
1459         var = opcode - JVM_OPC_fload_0;
1460         goto check_local_variable;
1461 
1462     case JVM_OPC_aload_0: case JVM_OPC_aload_1: case JVM_OPC_aload_2: case JVM_OPC_aload_3:
1463         this_idata->opcode = JVM_OPC_aload;
1464         var = opcode - JVM_OPC_aload_0;
1465         goto check_local_variable;
1466 
1467     case JVM_OPC_lload_0: case JVM_OPC_lload_1: case JVM_OPC_lload_2: case JVM_OPC_lload_3:
1468         this_idata->opcode = JVM_OPC_lload;
1469         var = opcode - JVM_OPC_lload_0;
1470         goto check_local_variable2;
1471 
1472     case JVM_OPC_dload_0: case JVM_OPC_dload_1: case JVM_OPC_dload_2: case JVM_OPC_dload_3:
1473         this_idata->opcode = JVM_OPC_dload;
1474         var = opcode - JVM_OPC_dload_0;
1475         goto check_local_variable2;
1476 
1477     case JVM_OPC_istore_0: case JVM_OPC_istore_1: case JVM_OPC_istore_2: case JVM_OPC_istore_3:
1478         this_idata->opcode = JVM_OPC_istore;
1479         var = opcode - JVM_OPC_istore_0;
1480         goto check_local_variable;
1481 
1482     case JVM_OPC_fstore_0: case JVM_OPC_fstore_1: case JVM_OPC_fstore_2: case JVM_OPC_fstore_3:
1483         this_idata->opcode = JVM_OPC_fstore;
1484         var = opcode - JVM_OPC_fstore_0;
1485         goto check_local_variable;
1486 
1487     case JVM_OPC_astore_0: case JVM_OPC_astore_1: case JVM_OPC_astore_2: case JVM_OPC_astore_3:
1488         this_idata->opcode = JVM_OPC_astore;
1489         var = opcode - JVM_OPC_astore_0;
1490         goto check_local_variable;
1491 
1492     case JVM_OPC_lstore_0: case JVM_OPC_lstore_1: case JVM_OPC_lstore_2: case JVM_OPC_lstore_3:
1493         this_idata->opcode = JVM_OPC_lstore;
1494         var = opcode - JVM_OPC_lstore_0;
1495         goto check_local_variable2;
1496 
1497     case JVM_OPC_dstore_0: case JVM_OPC_dstore_1: case JVM_OPC_dstore_2: case JVM_OPC_dstore_3:
1498         this_idata->opcode = JVM_OPC_dstore;
1499         var = opcode - JVM_OPC_dstore_0;
1500         goto check_local_variable2;
1501 
1502     case JVM_OPC_wide:
1503         this_idata->opcode = code[offset + 1];
1504         var = (code[offset + 2] << 8) + code[offset + 3];
1505         switch(this_idata->opcode) {
1506             case JVM_OPC_lload:  case JVM_OPC_dload:
1507             case JVM_OPC_lstore: case JVM_OPC_dstore:
1508                 goto check_local_variable2;
1509             default:
1510                 goto check_local_variable;
1511         }
1512 
1513     case JVM_OPC_iinc:              /* the increment amount doesn't matter */
1514     case JVM_OPC_ret:
1515     case JVM_OPC_aload: case JVM_OPC_iload: case JVM_OPC_fload:
1516     case JVM_OPC_astore: case JVM_OPC_istore: case JVM_OPC_fstore:
1517         var = code[offset + 1];
1518     check_local_variable:
1519         /* Make sure that the variable number isn't illegal. */
1520         this_idata->operand.i = var;
1521         if (var >= JVM_GetMethodIxLocalsCount(env, context->class, mi))
1522             CCerror(context, "Illegal local variable number");
1523         break;
1524 
1525     case JVM_OPC_lload: case JVM_OPC_dload: case JVM_OPC_lstore: case JVM_OPC_dstore:
1526         var = code[offset + 1];
1527     check_local_variable2:
1528         /* Make sure that the variable number isn't illegal. */
1529         this_idata->operand.i = var;
1530         if ((var + 1) >= JVM_GetMethodIxLocalsCount(env, context->class, mi))
1531             CCerror(context, "Illegal local variable number");
1532         break;
1533 
1534     default:
1535         if (opcode > JVM_OPC_MAX)
1536             CCerror(context, "Quick instructions shouldn't appear yet.");
1537         break;
1538     } /* of switch */
1539 }
1540 
1541 
1542 static void
1543 set_protected(context_type *context, unsigned int inumber, int key, int opcode)
1544 {
1545     JNIEnv *env = context->env;
1546     fullinfo_type clazz_info;
1547     if (opcode != JVM_OPC_invokevirtual && opcode != JVM_OPC_invokespecial) {
1548         clazz_info = cp_index_to_class_fullinfo(context, key,
1549                                                 JVM_CONSTANT_Fieldref);
1550     } else {
1551         clazz_info = cp_index_to_class_fullinfo(context, key,
1552                                                 JVM_CONSTANT_Methodref);
1553     }
1554     if (is_superclass(context, clazz_info)) {
1555         jclass calledClass =
1556             object_fullinfo_to_classclass(context, clazz_info);
1557         int access;
1558         /* 4734966: JVM_GetCPFieldModifiers() or JVM_GetCPMethodModifiers() only
1559            searches the referenced field or method in calledClass. The following
1560            while loop is added to search up the superclass chain to make this
1561            symbolic resolution consistent with the field/method resolution
1562            specified in VM spec 5.4.3. */
1563         calledClass = (*env)->NewLocalRef(env, calledClass);
1564         do {
1565             jclass tmp_cb;
1566             if (opcode != JVM_OPC_invokevirtual && opcode != JVM_OPC_invokespecial) {
1567                 access = JVM_GetCPFieldModifiers
1568                     (env, context->class, key, calledClass);
1569             } else {
1570                 access = JVM_GetCPMethodModifiers
1571                     (env, context->class, key, calledClass);
1572             }
1573             if (access != -1) {
1574                 break;
1575             }
1576             tmp_cb = (*env)->GetSuperclass(env, calledClass);
1577             (*env)->DeleteLocalRef(env, calledClass);
1578             calledClass = tmp_cb;
1579         } while (calledClass != 0);
1580 
1581         if (access == -1) {
1582             /* field/method not found, detected at runtime. */
1583         } else if (access & JVM_ACC_PROTECTED) {
1584             if (!JVM_IsSameClassPackage(env, calledClass, context->class))
1585                 context->instruction_data[inumber].protected = JNI_TRUE;
1586         }
1587         (*env)->DeleteLocalRef(env, calledClass);
1588     }
1589 }
1590 
1591 
1592 static jboolean
1593 is_superclass(context_type *context, fullinfo_type clazz_info) {
1594     fullinfo_type *fptr = context->superclasses;
1595 
1596     if (fptr == 0)
1597         return JNI_FALSE;
1598     for (; *fptr != 0; fptr++) {
1599         if (*fptr == clazz_info)
1600             return JNI_TRUE;
1601     }
1602     return JNI_FALSE;
1603 }
1604 
1605 
1606 /* Look through each item on the exception table.  Each of the fields must
1607  * refer to a legal instruction.
1608  */
1609 static void
1610 initialize_exception_table(context_type *context)
1611 {
1612     JNIEnv *env = context->env;
1613     int mi = context->method_index;
1614     struct handler_info_type *handler_info = context->handler_info;
1615     int *code_data = context->code_data;
1616     int code_length = context->code_length;
1617     int max_stack_size = JVM_GetMethodIxMaxStack(env, context->class, mi);
1618     int i = JVM_GetMethodIxExceptionTableLength(env, context->class, mi);
1619     if (max_stack_size < 1 && i > 0) {
1620         // If the method contains exception handlers, it must have room
1621         // on the expression stack for the exception that the VM could push
1622         CCerror(context, "Stack size too large");
1623     }
1624     for (; --i >= 0; handler_info++) {
1625         JVM_ExceptionTableEntryType einfo;
1626         stack_item_type *stack_item = NEW(stack_item_type, 1);
1627 
1628         JVM_GetMethodIxExceptionTableEntry(env, context->class, mi,
1629                                            i, &einfo);
1630 
1631         if (!(einfo.start_pc < einfo.end_pc &&
1632               einfo.start_pc >= 0 &&
1633               isLegalTarget(context, einfo.start_pc) &&
1634               (einfo.end_pc ==  code_length ||
1635                isLegalTarget(context, einfo.end_pc)))) {
1636             CFerror(context, "Illegal exception table range");
1637         }
1638         if (!((einfo.handler_pc > 0) &&
1639               isLegalTarget(context, einfo.handler_pc))) {
1640             CFerror(context, "Illegal exception table handler");
1641         }
1642 
1643         handler_info->start = code_data[einfo.start_pc];
1644         /* einfo.end_pc may point to one byte beyond the end of bytecodes. */
1645         handler_info->end = (einfo.end_pc == context->code_length) ?
1646             context->instruction_count : code_data[einfo.end_pc];
1647         handler_info->handler = code_data[einfo.handler_pc];
1648         handler_info->stack_info.stack = stack_item;
1649         handler_info->stack_info.stack_size = 1;
1650         stack_item->next = NULL;
1651         if (einfo.catchType != 0) {
1652             const char *classname;
1653             /* Constant pool entry type has been checked in format checker */
1654             classname = JVM_GetCPClassNameUTF(env,
1655                                               context->class,
1656                                               einfo.catchType);
1657             check_and_push_string_utf(context, classname);
1658             stack_item->item = make_class_info_from_name(context, classname);
1659             if (!isAssignableTo(context,
1660                                 stack_item->item,
1661                                 context->throwable_info))
1662                 CCerror(context, "catch_type not a subclass of Throwable");
1663             pop_and_free(context);
1664         } else {
1665             stack_item->item = context->throwable_info;
1666         }
1667     }
1668 }
1669 
1670 
1671 /* Given a pointer to an instruction, return its length.  Use the table
1672  * opcode_length[] which is automatically built.
1673  */
1674 static int instruction_length(unsigned char *iptr, unsigned char *end)
1675 {
1676     static unsigned char opcode_length[] = JVM_OPCODE_LENGTH_INITIALIZER;
1677     int instruction = *iptr;
1678     switch (instruction) {
1679         case JVM_OPC_tableswitch: {
1680             int *lpc = (int *)UCALIGN(iptr + 1);
1681             int64_t low, high, index;
1682             if (lpc + 2 >= (int *)end) {
1683                 return -1; /* do not read pass the end */
1684             }
1685             low  = _ck_ntohl(lpc[1]);
1686             high = _ck_ntohl(lpc[2]);
1687             index = high - low;
1688             // The value of low must be less than or equal to high - i.e. index >= 0
1689             if ((index < 0) || (index > 65535)) {
1690                 return -1;      /* illegal */
1691             } else {
1692                 unsigned char *finish = (unsigned char *)(&lpc[index + 4]);
1693                 assert(finish >= iptr);
1694                 return (int)(finish - iptr);
1695             }
1696         }
1697 
1698         case JVM_OPC_lookupswitch: {
1699             int *lpc = (int *) UCALIGN(iptr + 1);
1700             int npairs;
1701             if (lpc + 1 >= (int *)end)
1702                 return -1; /* do not read pass the end */
1703             npairs = _ck_ntohl(lpc[1]);
1704             /* There can't be more than 64K labels because of the limit
1705              * on per-method byte code length.
1706              */
1707             if (npairs < 0 || npairs >= 65536)
1708                 return  -1;
1709             else {
1710                 unsigned char *finish = (unsigned char *)(&lpc[2 * (npairs + 1)]);
1711                 assert(finish >= iptr);
1712                 return (int)(finish - iptr);
1713             }
1714         }
1715 
1716         case JVM_OPC_wide:
1717             if (iptr + 1 >= end)
1718                 return -1; /* do not read pass the end */
1719             switch(iptr[1]) {
1720                 case JVM_OPC_ret:
1721                 case JVM_OPC_iload: case JVM_OPC_istore:
1722                 case JVM_OPC_fload: case JVM_OPC_fstore:
1723                 case JVM_OPC_aload: case JVM_OPC_astore:
1724                 case JVM_OPC_lload: case JVM_OPC_lstore:
1725                 case JVM_OPC_dload: case JVM_OPC_dstore:
1726                     return 4;
1727                 case JVM_OPC_iinc:
1728                     return 6;
1729                 default:
1730                     return -1;
1731             }
1732 
1733         default: {
1734             if (instruction < 0 || instruction > JVM_OPC_MAX)
1735                 return -1;
1736 
1737             /* A length of 0 indicates an error. */
1738             if (opcode_length[instruction] <= 0)
1739                 return -1;
1740 
1741             return opcode_length[instruction];
1742         }
1743     }
1744 }
1745 
1746 
1747 /* Given the target of a branch, make sure that it's a legal target. */
1748 static jboolean
1749 isLegalTarget(context_type *context, int offset)
1750 {
1751     int code_length = context->code_length;
1752     int *code_data = context->code_data;
1753     return (offset >= 0 && offset < code_length && code_data[offset] >= 0);
1754 }
1755 
1756 
1757 /* Make sure that an element of the constant pool really is of the indicated
1758  * type.
1759  */
1760 static void
1761 verify_constant_pool_type(context_type *context, int index, unsigned mask)
1762 {
1763     int nconstants = context->nconstants;
1764     unsigned char *type_table = context->constant_types;
1765     unsigned type;
1766 
1767     if ((index <= 0) || (index >= nconstants))
1768         CCerror(context, "Illegal constant pool index");
1769 
1770     type = type_table[index];
1771     if ((mask & (1 << type)) == 0)
1772         CCerror(context, "Illegal type in constant pool");
1773 }
1774 
1775 
1776 static void
1777 initialize_dataflow(context_type *context)
1778 {
1779     JNIEnv *env = context->env;
1780     instruction_data_type *idata = context->instruction_data;
1781     int mi = context->method_index;
1782     jclass cb = context->class;
1783     int args_size = JVM_GetMethodIxArgsSize(env, cb, mi);
1784     fullinfo_type *reg_ptr;
1785     fullinfo_type full_info;
1786     const char *p;
1787     const char *signature;
1788 
1789     /* Initialize the function entry, since we know everything about it. */
1790     idata[0].stack_info.stack_size = 0;
1791     idata[0].stack_info.stack = NULL;
1792     idata[0].register_info.register_count = args_size;
1793     idata[0].register_info.registers = NEW(fullinfo_type, args_size);
1794     idata[0].register_info.mask_count = 0;
1795     idata[0].register_info.masks = NULL;
1796     idata[0].and_flags = 0;     /* nothing needed */
1797     idata[0].or_flags = FLAG_REACHED; /* instruction reached */
1798     reg_ptr = idata[0].register_info.registers;
1799 
1800     if ((JVM_GetMethodIxModifiers(env, cb, mi) & JVM_ACC_STATIC) == 0) {
1801         /* A non static method.  If this is an <init> method, the first
1802          * argument is an uninitialized object.  Otherwise it is an object of
1803          * the given class type.  java.lang.Object.<init> is special since
1804          * we don't call its superclass <init> method.
1805          */
1806         if (JVM_IsConstructorIx(env, cb, mi)
1807                 && context->currentclass_info != context->object_info) {
1808             *reg_ptr++ = MAKE_FULLINFO(ITEM_InitObject, 0, 0);
1809             idata[0].or_flags |= FLAG_NEED_CONSTRUCTOR;
1810         } else {
1811             *reg_ptr++ = context->currentclass_info;
1812         }
1813     }
1814     signature = JVM_GetMethodIxSignatureUTF(env, cb, mi);
1815     check_and_push_string_utf(context, signature);
1816     /* Fill in each of the arguments into the registers. */
1817     for (p = signature + 1; *p != JVM_SIGNATURE_ENDFUNC; ) {
1818         char fieldchar = signature_to_fieldtype(context, &p, &full_info);
1819         switch (fieldchar) {
1820             case 'D': case 'L':
1821                 *reg_ptr++ = full_info;
1822                 *reg_ptr++ = full_info + 1;
1823                 break;
1824             default:
1825                 *reg_ptr++ = full_info;
1826                 break;
1827         }
1828     }
1829     p++;                        /* skip over right parenthesis */
1830     if (*p == 'V') {
1831         context->return_type = MAKE_FULLINFO(ITEM_Void, 0, 0);
1832     } else {
1833         signature_to_fieldtype(context, &p, &full_info);
1834         context->return_type = full_info;
1835     }
1836     pop_and_free(context);
1837     /* Indicate that we need to look at the first instruction. */
1838     idata[0].changed = JNI_TRUE;
1839 }
1840 
1841 
1842 /* Run the data flow analysis, as long as there are things to change. */
1843 static void
1844 run_dataflow(context_type *context) {
1845     JNIEnv *env = context->env;
1846     int mi = context->method_index;
1847     jclass cb = context->class;
1848     int max_stack_size = JVM_GetMethodIxMaxStack(env, cb, mi);
1849     instruction_data_type *idata = context->instruction_data;
1850     unsigned int icount = context->instruction_count;
1851     jboolean work_to_do = JNI_TRUE;
1852     unsigned int inumber;
1853 
1854     /* Run through the loop, until there is nothing left to do. */
1855     while (work_to_do) {
1856         work_to_do = JNI_FALSE;
1857         for (inumber = 0; inumber < icount; inumber++) {
1858             instruction_data_type *this_idata = &idata[inumber];
1859             if (this_idata->changed) {
1860                 register_info_type new_register_info;
1861                 stack_info_type new_stack_info;
1862                 flag_type new_and_flags, new_or_flags;
1863 
1864                 this_idata->changed = JNI_FALSE;
1865                 work_to_do = JNI_TRUE;
1866 #ifdef DEBUG
1867                 if (verify_verbose) {
1868                     jio_fprintf(stdout, "Instruction %d: ", inumber);
1869                     print_stack(context, &this_idata->stack_info);
1870                     print_registers(context, &this_idata->register_info);
1871                     print_flags(context,
1872                                 this_idata->and_flags, this_idata->or_flags);
1873                     fflush(stdout);
1874                 }
1875 #endif
1876                 /* Make sure the registers and flags are appropriate */
1877                 check_register_values(context, inumber);
1878                 check_flags(context, inumber);
1879 
1880                 /* Make sure the stack can deal with this instruction */
1881                 pop_stack(context, inumber, &new_stack_info);
1882 
1883                 /* Update the registers  and flags */
1884                 update_registers(context, inumber, &new_register_info);
1885                 update_flags(context, inumber, &new_and_flags, &new_or_flags);
1886 
1887                 /* Update the stack. */
1888                 push_stack(context, inumber, &new_stack_info);
1889 
1890                 if (new_stack_info.stack_size > max_stack_size)
1891                     CCerror(context, "Stack size too large");
1892 #ifdef DEBUG
1893                 if (verify_verbose) {
1894                     jio_fprintf(stdout, "  ");
1895                     print_stack(context, &new_stack_info);
1896                     print_registers(context, &new_register_info);
1897                     print_flags(context, new_and_flags, new_or_flags);
1898                     fflush(stdout);
1899                 }
1900 #endif
1901                 /* Add the new stack and register information to any
1902                  * instructions that can follow this instruction.     */
1903                 merge_into_successors(context, inumber,
1904                                       &new_register_info, &new_stack_info,
1905                                       new_and_flags, new_or_flags);
1906             }
1907         }
1908     }
1909 }
1910 
1911 
1912 /* Make sure that the registers contain a legitimate value for the given
1913  * instruction.
1914 */
1915 
1916 static void
1917 check_register_values(context_type *context, unsigned int inumber)
1918 {
1919     instruction_data_type *idata = context->instruction_data;
1920     instruction_data_type *this_idata = &idata[inumber];
1921     int opcode = this_idata->opcode;
1922     int operand = this_idata->operand.i;
1923     int register_count = this_idata->register_info.register_count;
1924     fullinfo_type *registers = this_idata->register_info.registers;
1925     jboolean double_word = JNI_FALSE;   /* default value */
1926     int type;
1927 
1928     switch (opcode) {
1929         default:
1930             return;
1931         case JVM_OPC_iload: case JVM_OPC_iinc:
1932             type = ITEM_Integer; break;
1933         case JVM_OPC_fload:
1934             type = ITEM_Float; break;
1935         case JVM_OPC_aload:
1936             type = ITEM_Object; break;
1937         case JVM_OPC_ret:
1938             type = ITEM_ReturnAddress; break;
1939         case JVM_OPC_lload:
1940             type = ITEM_Long; double_word = JNI_TRUE; break;
1941         case JVM_OPC_dload:
1942             type = ITEM_Double; double_word = JNI_TRUE; break;
1943     }
1944     if (!double_word) {
1945         fullinfo_type reg;
1946         /* Make sure we don't have an illegal register or one with wrong type */
1947         if (operand >= register_count) {
1948             CCerror(context,
1949                     "Accessing value from uninitialized register %d", operand);
1950         }
1951         reg = registers[operand];
1952 
1953         if (WITH_ZERO_EXTRA_INFO(reg) == (unsigned)MAKE_FULLINFO(type, 0, 0)) {
1954             /* the register is obviously of the given type */
1955             return;
1956         } else if (GET_INDIRECTION(reg) > 0 && type == ITEM_Object) {
1957             /* address type stuff be used on all arrays */
1958             return;
1959         } else if (GET_ITEM_TYPE(reg) == ITEM_ReturnAddress) {
1960             CCerror(context, "Cannot load return address from register %d",
1961                               operand);
1962             /* alternatively
1963                       (GET_ITEM_TYPE(reg) == ITEM_ReturnAddress)
1964                    && (opcode == JVM_OPC_iload)
1965                    && (type == ITEM_Object || type == ITEM_Integer)
1966                but this never occurs
1967             */
1968         } else if (reg == ITEM_InitObject && type == ITEM_Object) {
1969             return;
1970         } else if (WITH_ZERO_EXTRA_INFO(reg) ==
1971                         MAKE_FULLINFO(ITEM_NewObject, 0, 0) &&
1972                    type == ITEM_Object) {
1973             return;
1974         } else {
1975             CCerror(context, "Register %d contains wrong type", operand);
1976         }
1977     } else {
1978         /* Make sure we don't have an illegal register or one with wrong type */
1979         if ((operand + 1) >= register_count) {
1980             CCerror(context,
1981                     "Accessing value from uninitialized register pair %d/%d",
1982                     operand, operand+1);
1983         } else {
1984             if ((registers[operand] == (unsigned)MAKE_FULLINFO(type, 0, 0)) &&
1985                 (registers[operand + 1] == (unsigned)MAKE_FULLINFO(type + 1, 0, 0))) {
1986                 return;
1987             } else {
1988                 CCerror(context, "Register pair %d/%d contains wrong type",
1989                         operand, operand+1);
1990             }
1991         }
1992     }
1993 }
1994 
1995 
1996 /* Make sure the flags contain legitimate values for this instruction.
1997 */
1998 
1999 static void
2000 check_flags(context_type *context, unsigned int inumber)
2001 {
2002     instruction_data_type *idata = context->instruction_data;
2003     instruction_data_type *this_idata = &idata[inumber];
2004     int opcode = this_idata->opcode;
2005     switch (opcode) {
2006         case JVM_OPC_return:
2007             /* We need a constructor, but we aren't guaranteed it's called */
2008             if ((this_idata->or_flags & FLAG_NEED_CONSTRUCTOR) &&
2009                    !(this_idata->and_flags & FLAG_CONSTRUCTED))
2010                 CCerror(context, "Constructor must call super() or this()");
2011             /* fall through */
2012         case JVM_OPC_ireturn: case JVM_OPC_lreturn:
2013         case JVM_OPC_freturn: case JVM_OPC_dreturn: case JVM_OPC_areturn:
2014             if (this_idata->or_flags & FLAG_NO_RETURN)
2015                 /* This method cannot exit normally */
2016                 CCerror(context, "Cannot return normally");
2017         default:
2018             break; /* nothing to do. */
2019     }
2020 }
2021 
2022 /* Make sure that the top of the stack contains reasonable values for the
2023  * given instruction.  The post-pop values of the stack and its size are
2024  * returned in *new_stack_info.
2025  */
2026 
2027 static void
2028 pop_stack(context_type *context, unsigned int inumber, stack_info_type *new_stack_info)
2029 {
2030     instruction_data_type *idata = context->instruction_data;
2031     instruction_data_type *this_idata = &idata[inumber];
2032     int opcode = this_idata->opcode;
2033     stack_item_type *stack = this_idata->stack_info.stack;
2034     int stack_size = this_idata->stack_info.stack_size;
2035     char *stack_operands, *p;
2036     char buffer[257];           /* for holding manufactured argument lists */
2037     fullinfo_type stack_extra_info_buffer[256]; /* save info popped off stack */
2038     fullinfo_type *stack_extra_info = &stack_extra_info_buffer[256];
2039     fullinfo_type full_info;    /* only used in case of invoke instructions */
2040     fullinfo_type put_full_info; /* only used in case JVM_OPC_putstatic and JVM_OPC_putfield */
2041 
2042     switch(opcode) {
2043         default:
2044             /* For most instructions, we just use a built-in table */
2045             stack_operands = opcode_in_out[opcode][0];
2046             break;
2047 
2048         case JVM_OPC_putstatic: case JVM_OPC_putfield: {
2049             /* The top thing on the stack depends on the signature of
2050              * the object.                         */
2051             int operand = this_idata->operand.i;
2052             const char *signature =
2053                 JVM_GetCPFieldSignatureUTF(context->env,
2054                                            context->class,
2055                                            operand);
2056             char *ip = buffer;
2057             check_and_push_string_utf(context, signature);
2058 #ifdef DEBUG
2059             if (verify_verbose) {
2060                 print_formatted_fieldname(context, operand);
2061             }
2062 #endif
2063             if (opcode == JVM_OPC_putfield)
2064                 *ip++ = 'A';    /* object for putfield */
2065             *ip++ = signature_to_fieldtype(context, &signature, &put_full_info);
2066             *ip = '\0';
2067             stack_operands = buffer;
2068             pop_and_free(context);
2069             break;
2070         }
2071 
2072         case JVM_OPC_invokevirtual: case JVM_OPC_invokespecial:
2073         case JVM_OPC_invokeinit:    /* invokespecial call to <init> */
2074         case JVM_OPC_invokestatic: case JVM_OPC_invokeinterface: {
2075             /* The top stuff on the stack depends on the method signature */
2076             int operand = this_idata->operand.i;
2077             const char *signature =
2078                 JVM_GetCPMethodSignatureUTF(context->env,
2079                                             context->class,
2080                                             operand);
2081             char *ip = buffer;
2082             const char *p;
2083             check_and_push_string_utf(context, signature);
2084 #ifdef DEBUG
2085             if (verify_verbose) {
2086                 print_formatted_methodname(context, operand);
2087             }
2088 #endif
2089             if (opcode != JVM_OPC_invokestatic)
2090                 /* First, push the object */
2091                 *ip++ = (opcode == JVM_OPC_invokeinit ? '@' : 'A');
2092             for (p = signature + 1; *p != JVM_SIGNATURE_ENDFUNC; ) {
2093                 *ip++ = signature_to_fieldtype(context, &p, &full_info);
2094                 if (ip >= buffer + sizeof(buffer) - 1)
2095                     CCerror(context, "Signature %s has too many arguments",
2096                             signature);
2097             }
2098             *ip = 0;
2099             stack_operands = buffer;
2100             pop_and_free(context);
2101             break;
2102         }
2103 
2104         case JVM_OPC_multianewarray: {
2105             /* Count can't be larger than 255. So can't overflow buffer */
2106             int count = this_idata->operand2.i; /* number of ints on stack */
2107             memset(buffer, 'I', count);
2108             buffer[count] = '\0';
2109             stack_operands = buffer;
2110             break;
2111         }
2112 
2113     } /* of switch */
2114 
2115     /* Run through the list of operands >>backwards<< */
2116     for (   p = stack_operands + strlen(stack_operands);
2117             p > stack_operands;
2118             stack = stack->next) {
2119         int type = *--p;
2120         fullinfo_type top_type = stack ? stack->item : 0;
2121         int size = (type == 'D' || type == 'L') ? 2 : 1;
2122         *--stack_extra_info = top_type;
2123         if (stack == NULL)
2124             CCerror(context, "Unable to pop operand off an empty stack");
2125 
2126         switch (type) {
2127             case 'I':
2128                 if (top_type != MAKE_FULLINFO(ITEM_Integer, 0, 0))
2129                     CCerror(context, "Expecting to find integer on stack");
2130                 break;
2131 
2132             case 'F':
2133                 if (top_type != MAKE_FULLINFO(ITEM_Float, 0, 0))
2134                     CCerror(context, "Expecting to find float on stack");
2135                 break;
2136 
2137             case 'A':           /* object or array */
2138                 if (   (GET_ITEM_TYPE(top_type) != ITEM_Object)
2139                     && (GET_INDIRECTION(top_type) == 0)) {
2140                     /* The thing isn't an object or an array.  Let's see if it's
2141                      * one of the special cases  */
2142                     if (  (WITH_ZERO_EXTRA_INFO(top_type) ==
2143                                 MAKE_FULLINFO(ITEM_ReturnAddress, 0, 0))
2144                         && (opcode == JVM_OPC_astore))
2145                         break;
2146                     if (   (GET_ITEM_TYPE(top_type) == ITEM_NewObject
2147                             || (GET_ITEM_TYPE(top_type) == ITEM_InitObject))
2148                         && ((opcode == JVM_OPC_astore) || (opcode == JVM_OPC_aload)
2149                             || (opcode == JVM_OPC_ifnull) || (opcode == JVM_OPC_ifnonnull)))
2150                         break;
2151                     /* The 2nd edition VM of the specification allows field
2152                      * initializations before the superclass initializer,
2153                      * if the field is defined within the current class.
2154                      */
2155                      if (   (GET_ITEM_TYPE(top_type) == ITEM_InitObject)
2156                          && (opcode == JVM_OPC_putfield)) {
2157                         int operand = this_idata->operand.i;
2158                         int access_bits = JVM_GetCPFieldModifiers(context->env,
2159                                                                   context->class,
2160                                                                   operand,
2161                                                                   context->class);
2162                         /* Note: This relies on the fact that
2163                          * JVM_GetCPFieldModifiers retrieves only local fields,
2164                          * and does not respect inheritance.
2165                          */
2166                         if (access_bits != -1) {
2167                             if ( cp_index_to_class_fullinfo(context, operand, JVM_CONSTANT_Fieldref) ==
2168                                  context->currentclass_info ) {
2169                                 top_type = context->currentclass_info;
2170                                 *stack_extra_info = top_type;
2171                                 break;
2172                             }
2173                         }
2174                     }
2175                     CCerror(context, "Expecting to find object/array on stack");
2176                 }
2177                 break;
2178 
2179             case '@': {         /* uninitialized object, for call to <init> */
2180                 int item_type = GET_ITEM_TYPE(top_type);
2181                 if (item_type != ITEM_NewObject && item_type != ITEM_InitObject)
2182                     CCerror(context,
2183                             "Expecting to find uninitialized object on stack");
2184                 break;
2185             }
2186 
2187             case 'O':           /* object, not array */
2188                 if (WITH_ZERO_EXTRA_INFO(top_type) !=
2189                        MAKE_FULLINFO(ITEM_Object, 0, 0))
2190                     CCerror(context, "Expecting to find object on stack");
2191                 break;
2192 
2193             case 'a':           /* integer, object, or array */
2194                 if (      (top_type != MAKE_FULLINFO(ITEM_Integer, 0, 0))
2195                        && (GET_ITEM_TYPE(top_type) != ITEM_Object)
2196                        && (GET_INDIRECTION(top_type) == 0))
2197                     CCerror(context,
2198                             "Expecting to find object, array, or int on stack");
2199                 break;
2200 
2201             case 'D':           /* double */
2202                 if (top_type != MAKE_FULLINFO(ITEM_Double, 0, 0))
2203                     CCerror(context, "Expecting to find double on stack");
2204                 break;
2205 
2206             case 'L':           /* long */
2207                 if (top_type != MAKE_FULLINFO(ITEM_Long, 0, 0))
2208                     CCerror(context, "Expecting to find long on stack");
2209                 break;
2210 
2211             case ']':           /* array of some type */
2212                 if (top_type == NULL_FULLINFO) {
2213                     /* do nothing */
2214                 } else switch(p[-1]) {
2215                     case 'I':   /* array of integers */
2216                         if (top_type != MAKE_FULLINFO(ITEM_Integer, 1, 0) &&
2217                             top_type != NULL_FULLINFO)
2218                             CCerror(context,
2219                                     "Expecting to find array of ints on stack");
2220                         break;
2221 
2222                     case 'L':   /* array of longs */
2223                         if (top_type != MAKE_FULLINFO(ITEM_Long, 1, 0))
2224                             CCerror(context,
2225                                    "Expecting to find array of longs on stack");
2226                         break;
2227 
2228                     case 'F':   /* array of floats */
2229                         if (top_type != MAKE_FULLINFO(ITEM_Float, 1, 0))
2230                             CCerror(context,
2231                                  "Expecting to find array of floats on stack");
2232                         break;
2233 
2234                     case 'D':   /* array of doubles */
2235                         if (top_type != MAKE_FULLINFO(ITEM_Double, 1, 0))
2236                             CCerror(context,
2237                                 "Expecting to find array of doubles on stack");
2238                         break;
2239 
2240                     case 'A': { /* array of addresses (arrays or objects) */
2241                         int indirection = GET_INDIRECTION(top_type);
2242                         if ((indirection == 0) ||
2243                             ((indirection == 1) &&
2244                                 (GET_ITEM_TYPE(top_type) != ITEM_Object)))
2245                             CCerror(context,
2246                                 "Expecting to find array of objects or arrays "
2247                                     "on stack");
2248                         break;
2249                     }
2250 
2251                     case 'B':    /* array of bytes or booleans */
2252                         if (top_type != MAKE_FULLINFO(ITEM_Byte, 1, 0) &&
2253                             top_type != MAKE_FULLINFO(ITEM_Boolean, 1, 0))
2254                             CCerror(context,
2255                                   "Expecting to find array of bytes or Booleans on stack");
2256                         break;
2257 
2258                     case 'C':   /* array of characters */
2259                         if (top_type != MAKE_FULLINFO(ITEM_Char, 1, 0))
2260                             CCerror(context,
2261                                   "Expecting to find array of chars on stack");
2262                         break;
2263 
2264                     case 'S':   /* array of shorts */
2265                         if (top_type != MAKE_FULLINFO(ITEM_Short, 1, 0))
2266                             CCerror(context,
2267                                  "Expecting to find array of shorts on stack");
2268                         break;
2269 
2270                     case '?':   /* any type of array is okay */
2271                         if (GET_INDIRECTION(top_type) == 0)
2272                             CCerror(context,
2273                                     "Expecting to find array on stack");
2274                         break;
2275 
2276                     default:
2277                         CCerror(context, "Internal error #1");
2278                         break;
2279                 }
2280                 p -= 2;         /* skip over [ <char> */
2281                 break;
2282 
2283             case '1': case '2': case '3': case '4': /* stack swapping */
2284                 if (top_type == MAKE_FULLINFO(ITEM_Double, 0, 0)
2285                     || top_type == MAKE_FULLINFO(ITEM_Long, 0, 0)) {
2286                     if ((p > stack_operands) && (p[-1] == '+')) {
2287                         context->swap_table[type - '1'] = top_type + 1;
2288                         context->swap_table[p[-2] - '1'] = top_type;
2289                         size = 2;
2290                         p -= 2;
2291                     } else {
2292                         CCerror(context,
2293                                 "Attempt to split long or double on the stack");
2294                     }
2295                 } else {
2296                     context->swap_table[type - '1'] = stack->item;
2297                     if ((p > stack_operands) && (p[-1] == '+'))
2298                         p--;    /* ignore */
2299                 }
2300                 break;
2301             case '+':           /* these should have been caught. */
2302             default:
2303                 CCerror(context, "Internal error #2");
2304         }
2305         stack_size -= size;
2306     }
2307 
2308     /* For many of the opcodes that had an "A" in their field, we really
2309      * need to go back and do a little bit more accurate testing.  We can, of
2310      * course, assume that the minimal type checking has already been done.
2311      */
2312     switch (opcode) {
2313         default: break;
2314         case JVM_OPC_aastore: {     /* array index object  */
2315             fullinfo_type array_type = stack_extra_info[0];
2316             fullinfo_type object_type = stack_extra_info[2];
2317             fullinfo_type target_type = decrement_indirection(array_type);
2318             if ((GET_ITEM_TYPE(object_type) != ITEM_Object)
2319                     && (GET_INDIRECTION(object_type) == 0)) {
2320                 CCerror(context, "Expecting reference type on operand stack in aastore");
2321             }
2322             if ((GET_ITEM_TYPE(target_type) != ITEM_Object)
2323                     && (GET_INDIRECTION(target_type) == 0)) {
2324                 CCerror(context, "Component type of the array must be reference type in aastore");
2325             }
2326             break;
2327         }
2328 
2329         case JVM_OPC_putfield:
2330         case JVM_OPC_getfield:
2331         case JVM_OPC_putstatic: {
2332             int operand = this_idata->operand.i;
2333             fullinfo_type stack_object = stack_extra_info[0];
2334             if (opcode == JVM_OPC_putfield || opcode == JVM_OPC_getfield) {
2335                 if (!isAssignableTo
2336                         (context,
2337                          stack_object,
2338                          cp_index_to_class_fullinfo
2339                              (context, operand, JVM_CONSTANT_Fieldref))) {
2340                     CCerror(context,
2341                             "Incompatible type for getting or setting field");
2342                 }
2343                 if (this_idata->protected &&
2344                     !isAssignableTo(context, stack_object,
2345                                     context->currentclass_info)) {
2346                     CCerror(context, "Bad access to protected data");
2347                 }
2348             }
2349             if (opcode == JVM_OPC_putfield || opcode == JVM_OPC_putstatic) {
2350                 int item = (opcode == JVM_OPC_putfield ? 1 : 0);
2351                 if (!isAssignableTo(context,
2352                                     stack_extra_info[item], put_full_info)) {
2353                     CCerror(context, "Bad type in putfield/putstatic");
2354                 }
2355             }
2356             break;
2357         }
2358 
2359         case JVM_OPC_athrow:
2360             if (!isAssignableTo(context, stack_extra_info[0],
2361                                 context->throwable_info)) {
2362                 CCerror(context, "Can only throw Throwable objects");
2363             }
2364             break;
2365 
2366         case JVM_OPC_aaload: {      /* array index */
2367             /* We need to pass the information to the stack updater */
2368             fullinfo_type array_type = stack_extra_info[0];
2369             context->swap_table[0] = decrement_indirection(array_type);
2370             break;
2371         }
2372 
2373         case JVM_OPC_invokevirtual: case JVM_OPC_invokespecial:
2374         case JVM_OPC_invokeinit:
2375         case JVM_OPC_invokeinterface: case JVM_OPC_invokestatic: {
2376             int operand = this_idata->operand.i;
2377             const char *signature =
2378                 JVM_GetCPMethodSignatureUTF(context->env,
2379                                             context->class,
2380                                             operand);
2381             int item;
2382             const char *p;
2383             check_and_push_string_utf(context, signature);
2384             if (opcode == JVM_OPC_invokestatic) {
2385                 item = 0;
2386             } else if (opcode == JVM_OPC_invokeinit) {
2387                 fullinfo_type init_type = this_idata->operand2.fi;
2388                 fullinfo_type object_type = stack_extra_info[0];
2389                 context->swap_table[0] = object_type; /* save value */
2390                 if (GET_ITEM_TYPE(stack_extra_info[0]) == ITEM_NewObject) {
2391                     /* We better be calling the appropriate init.  Find the
2392                      * inumber of the "JVM_OPC_new" instruction", and figure
2393                      * out what the type really is.
2394                      */
2395                     unsigned int new_inumber = GET_EXTRA_INFO(stack_extra_info[0]);
2396                     fullinfo_type target_type = idata[new_inumber].operand2.fi;
2397                     context->swap_table[1] = target_type;
2398 
2399                     if (target_type != init_type) {
2400                         CCerror(context, "Call to wrong initialization method");
2401                     }
2402                     if (this_idata->protected
2403                         && !isAssignableTo(context, object_type,
2404                                            context->currentclass_info)) {
2405                       CCerror(context, "Bad access to protected data");
2406                     }
2407                 } else {
2408                     /* We better be calling super() or this(). */
2409                     if (init_type != context->superclass_info &&
2410                         init_type != context->currentclass_info) {
2411                         CCerror(context, "Call to wrong initialization method");
2412                     }
2413                     context->swap_table[1] = context->currentclass_info;
2414                 }
2415                 item = 1;
2416             } else {
2417                 fullinfo_type target_type = this_idata->operand2.fi;
2418                 fullinfo_type object_type = stack_extra_info[0];
2419                 if (!isAssignableTo(context, object_type, target_type)){
2420                     CCerror(context,
2421                             "Incompatible object argument for function call");
2422                 }
2423                 if (opcode == JVM_OPC_invokespecial
2424                     && !isAssignableTo(context, object_type,
2425                                        context->currentclass_info)) {
2426                     /* Make sure object argument is assignment compatible to current class */
2427                     CCerror(context,
2428                             "Incompatible object argument for invokespecial");
2429                 }
2430                 if (this_idata->protected
2431                     && !isAssignableTo(context, object_type,
2432                                        context->currentclass_info)) {
2433                     /* This is ugly. Special dispensation.  Arrays pretend to
2434                        implement public Object clone() even though they don't */
2435                     const char *utfName =
2436                         JVM_GetCPMethodNameUTF(context->env,
2437                                                context->class,
2438                                                this_idata->operand.i);
2439                     int is_clone = utfName && (strcmp(utfName, "clone") == 0);
2440                     JVM_ReleaseUTF(utfName);
2441 
2442                     if ((target_type == context->object_info) &&
2443                         (GET_INDIRECTION(object_type) > 0) &&
2444                         is_clone) {
2445                     } else {
2446                         CCerror(context, "Bad access to protected data");
2447                     }
2448                 }
2449                 item = 1;
2450             }
2451             for (p = signature + 1; *p != JVM_SIGNATURE_ENDFUNC; item++)
2452                 if (signature_to_fieldtype(context, &p, &full_info) == 'A') {
2453                     if (!isAssignableTo(context,
2454                                         stack_extra_info[item], full_info)) {
2455                         CCerror(context, "Incompatible argument to function");
2456                     }
2457                 }
2458 
2459             pop_and_free(context);
2460             break;
2461         }
2462 
2463         case JVM_OPC_return:
2464             if (context->return_type != MAKE_FULLINFO(ITEM_Void, 0, 0))
2465                 CCerror(context, "Wrong return type in function");
2466             break;
2467 
2468         case JVM_OPC_ireturn: case JVM_OPC_lreturn: case JVM_OPC_freturn:
2469         case JVM_OPC_dreturn: case JVM_OPC_areturn: {
2470             fullinfo_type target_type = context->return_type;
2471             fullinfo_type object_type = stack_extra_info[0];
2472             if (!isAssignableTo(context, object_type, target_type)) {
2473                 CCerror(context, "Wrong return type in function");
2474             }
2475             break;
2476         }
2477 
2478         case JVM_OPC_new: {
2479             /* Make sure that nothing on the stack already looks like what
2480              * we want to create.  I can't image how this could possibly happen
2481              * but we should test for it anyway, since if it could happen, the
2482              * result would be an uninitialized object being able to masquerade
2483              * as an initialized one.
2484              */
2485             stack_item_type *item;
2486             for (item = stack; item != NULL; item = item->next) {
2487                 if (item->item == this_idata->operand.fi) {
2488                     CCerror(context,
2489                             "Uninitialized object on stack at creating point");
2490                 }
2491             }
2492             /* Info for update_registers */
2493             context->swap_table[0] = this_idata->operand.fi;
2494             context->swap_table[1] = MAKE_FULLINFO(ITEM_Bogus, 0, 0);
2495 
2496             break;
2497         }
2498     }
2499     new_stack_info->stack = stack;
2500     new_stack_info->stack_size = stack_size;
2501 }
2502 
2503 
2504 /* We've already determined that the instruction is legal.  Perform the
2505  * operation on the registers, and return the updated results in
2506  * new_register_count_p and new_registers.
2507  */
2508 
2509 static void
2510 update_registers(context_type *context, unsigned int inumber,
2511                  register_info_type *new_register_info)
2512 {
2513     instruction_data_type *idata = context->instruction_data;
2514     instruction_data_type *this_idata = &idata[inumber];
2515     int opcode = this_idata->opcode;
2516     int operand = this_idata->operand.i;
2517     int register_count = this_idata->register_info.register_count;
2518     fullinfo_type *registers = this_idata->register_info.registers;
2519     stack_item_type *stack = this_idata->stack_info.stack;
2520     int mask_count = this_idata->register_info.mask_count;
2521     mask_type *masks = this_idata->register_info.masks;
2522 
2523     /* Use these as default new values. */
2524     int            new_register_count = register_count;
2525     int            new_mask_count = mask_count;
2526     fullinfo_type *new_registers = registers;
2527     mask_type     *new_masks = masks;
2528 
2529     enum { ACCESS_NONE, ACCESS_SINGLE, ACCESS_DOUBLE } access = ACCESS_NONE;
2530     int i;
2531 
2532     /* Remember, we've already verified the type at the top of the stack. */
2533     switch (opcode) {
2534         default: break;
2535         case JVM_OPC_istore: case JVM_OPC_fstore: case JVM_OPC_astore:
2536             access = ACCESS_SINGLE;
2537             goto continue_store;
2538 
2539         case JVM_OPC_lstore: case JVM_OPC_dstore:
2540             access = ACCESS_DOUBLE;
2541             goto continue_store;
2542 
2543         continue_store: {
2544             /* We have a modification to the registers.  Copy them if needed. */
2545             fullinfo_type stack_top_type = stack->item;
2546             int max_operand = operand + ((access == ACCESS_DOUBLE) ? 1 : 0);
2547 
2548             if (     max_operand < register_count
2549                   && registers[operand] == stack_top_type
2550                   && ((access == ACCESS_SINGLE) ||
2551                          (registers[operand + 1]== stack_top_type + 1)))
2552                 /* No changes have been made to the registers. */
2553                 break;
2554             new_register_count = MAX(max_operand + 1, register_count);
2555             new_registers = NEW(fullinfo_type, new_register_count);
2556             for (i = 0; i < register_count; i++)
2557                 new_registers[i] = registers[i];
2558             for (i = register_count; i < new_register_count; i++)
2559                 new_registers[i] = MAKE_FULLINFO(ITEM_Bogus, 0, 0);
2560             new_registers[operand] = stack_top_type;
2561             if (access == ACCESS_DOUBLE)
2562                 new_registers[operand + 1] = stack_top_type + 1;
2563             break;
2564         }
2565 
2566         case JVM_OPC_iload: case JVM_OPC_fload: case JVM_OPC_aload:
2567         case JVM_OPC_iinc: case JVM_OPC_ret:
2568             access = ACCESS_SINGLE;
2569             break;
2570 
2571         case JVM_OPC_lload: case JVM_OPC_dload:
2572             access = ACCESS_DOUBLE;
2573             break;
2574 
2575         case JVM_OPC_jsr: case JVM_OPC_jsr_w:
2576             for (i = 0; i < new_mask_count; i++)
2577                 if (new_masks[i].entry == operand)
2578                     CCerror(context, "Recursive call to jsr entry");
2579             new_masks = add_to_masks(context, masks, mask_count, operand);
2580             new_mask_count++;
2581             break;
2582 
2583         case JVM_OPC_invokeinit:
2584         case JVM_OPC_new: {
2585             /* For invokeinit, an uninitialized object has been initialized.
2586              * For new, all previous occurrences of an uninitialized object
2587              * from the same instruction must be made bogus.
2588              * We find all occurrences of swap_table[0] in the registers, and
2589              * replace them with swap_table[1];
2590              */
2591             fullinfo_type from = context->swap_table[0];
2592             fullinfo_type to = context->swap_table[1];
2593 
2594             int i;
2595             for (i = 0; i < register_count; i++) {
2596                 if (new_registers[i] == from) {
2597                     /* Found a match */
2598                     break;
2599                 }
2600             }
2601             if (i < register_count) { /* We broke out loop for match */
2602                 /* We have to change registers, and possibly a mask */
2603                 jboolean copied_mask = JNI_FALSE;
2604                 int k;
2605                 new_registers = NEW(fullinfo_type, register_count);
2606                 memcpy(new_registers, registers,
2607                        register_count * sizeof(registers[0]));
2608                 for ( ; i < register_count; i++) {
2609                     if (new_registers[i] == from) {
2610                         new_registers[i] = to;
2611                         for (k = 0; k < new_mask_count; k++) {
2612                             if (!IS_BIT_SET(new_masks[k].modifies, i)) {
2613                                 if (!copied_mask) {
2614                                     new_masks = copy_masks(context, new_masks,
2615                                                            mask_count);
2616                                     copied_mask = JNI_TRUE;
2617                                 }
2618                                 SET_BIT(new_masks[k].modifies, i);
2619                             }
2620                         }
2621                     }
2622                 }
2623             }
2624             break;
2625         }
2626     } /* of switch */
2627 
2628     if ((access != ACCESS_NONE) && (new_mask_count > 0)) {
2629         int i, j;
2630         for (i = 0; i < new_mask_count; i++) {
2631             int *mask = new_masks[i].modifies;
2632             if ((!IS_BIT_SET(mask, operand)) ||
2633                   ((access == ACCESS_DOUBLE) &&
2634                    !IS_BIT_SET(mask, operand + 1))) {
2635                 new_masks = copy_masks(context, new_masks, mask_count);
2636                 for (j = i; j < new_mask_count; j++) {
2637                     SET_BIT(new_masks[j].modifies, operand);
2638                     if (access == ACCESS_DOUBLE)
2639                         SET_BIT(new_masks[j].modifies, operand + 1);
2640                 }
2641                 break;
2642             }
2643         }
2644     }
2645 
2646     new_register_info->register_count = new_register_count;
2647     new_register_info->registers = new_registers;
2648     new_register_info->masks = new_masks;
2649     new_register_info->mask_count = new_mask_count;
2650 }
2651 
2652 
2653 
2654 /* We've already determined that the instruction is legal, and have updated
2655  * the registers.  Update the flags, too.
2656  */
2657 
2658 
2659 static void
2660 update_flags(context_type *context, unsigned int inumber,
2661              flag_type *new_and_flags, flag_type *new_or_flags)
2662 
2663 {
2664     instruction_data_type *idata = context->instruction_data;
2665     instruction_data_type *this_idata = &idata[inumber];
2666     flag_type and_flags = this_idata->and_flags;
2667     flag_type or_flags = this_idata->or_flags;
2668 
2669     /* Set the "we've done a constructor" flag */
2670     if (this_idata->opcode == JVM_OPC_invokeinit) {
2671         fullinfo_type from = context->swap_table[0];
2672         if (from == MAKE_FULLINFO(ITEM_InitObject, 0, 0))
2673             and_flags |= FLAG_CONSTRUCTED;
2674     }
2675     *new_and_flags = and_flags;
2676     *new_or_flags = or_flags;
2677 }
2678 
2679 
2680 
2681 /* We've already determined that the instruction is legal.  Perform the
2682  * operation on the stack;
2683  *
2684  * new_stack_size_p and new_stack_p point to the results after the pops have
2685  * already been done.  Do the pushes, and then put the results back there.
2686  */
2687 
2688 static void
2689 push_stack(context_type *context, unsigned int inumber, stack_info_type *new_stack_info)
2690 {
2691     instruction_data_type *idata = context->instruction_data;
2692     instruction_data_type *this_idata = &idata[inumber];
2693     int opcode = this_idata->opcode;
2694     int operand = this_idata->operand.i;
2695 
2696     int stack_size = new_stack_info->stack_size;
2697     stack_item_type *stack = new_stack_info->stack;
2698     char *stack_results;
2699 
2700     fullinfo_type full_info = 0;
2701     char buffer[5], *p;         /* actually [2] is big enough */
2702 
2703     /* We need to look at all those opcodes in which either we can't tell the
2704      * value pushed onto the stack from the opcode, or in which the value
2705      * pushed onto the stack is an object or array.  For the latter, we need
2706      * to make sure that full_info is set to the right value.
2707      */
2708     switch(opcode) {
2709         default:
2710             stack_results = opcode_in_out[opcode][1];
2711             break;
2712 
2713         case JVM_OPC_ldc: case JVM_OPC_ldc_w: case JVM_OPC_ldc2_w: {
2714             /* Look to constant pool to determine correct result. */
2715             unsigned char *type_table = context->constant_types;
2716             switch (type_table[operand]) {
2717                 case JVM_CONSTANT_Integer:
2718                     stack_results = "I"; break;
2719                 case JVM_CONSTANT_Float:
2720                     stack_results = "F"; break;
2721                 case JVM_CONSTANT_Double:
2722                     stack_results = "D"; break;
2723                 case JVM_CONSTANT_Long:
2724                     stack_results = "L"; break;
2725                 case JVM_CONSTANT_String:
2726                     stack_results = "A";
2727                     full_info = context->string_info;
2728                     break;
2729                 case JVM_CONSTANT_Class:
2730                     if (context->major_version < LDC_CLASS_MAJOR_VERSION)
2731                         CCerror(context, "Internal error #3");
2732                     stack_results = "A";
2733                     full_info = make_class_info_from_name(context,
2734                                                           "java/lang/Class");
2735                     break;
2736                 case JVM_CONSTANT_MethodHandle:
2737                 case JVM_CONSTANT_MethodType:
2738                     if (context->major_version < LDC_METHOD_HANDLE_MAJOR_VERSION)
2739                         CCerror(context, "Internal error #3");
2740                     stack_results = "A";
2741                     switch (type_table[operand]) {
2742                     case JVM_CONSTANT_MethodType:
2743                       full_info = make_class_info_from_name(context,
2744                                                             "java/lang/invoke/MethodType");
2745                       break;
2746                     default: //JVM_CONSTANT_MethodHandle
2747                       full_info = make_class_info_from_name(context,
2748                                                             "java/lang/invoke/MethodHandle");
2749                       break;
2750                     }
2751                     break;
2752                 default:
2753                     CCerror(context, "Internal error #3");
2754                     stack_results = ""; /* Never reached: keep lint happy */
2755             }
2756             break;
2757         }
2758 
2759         case JVM_OPC_getstatic: case JVM_OPC_getfield: {
2760             /* Look to signature to determine correct result. */
2761             int operand = this_idata->operand.i;
2762             const char *signature = JVM_GetCPFieldSignatureUTF(context->env,
2763                                                                context->class,
2764                                                                operand);
2765             check_and_push_string_utf(context, signature);
2766 #ifdef DEBUG
2767             if (verify_verbose) {
2768                 print_formatted_fieldname(context, operand);
2769             }
2770 #endif
2771             buffer[0] = signature_to_fieldtype(context, &signature, &full_info);
2772             buffer[1] = '\0';
2773             stack_results = buffer;
2774             pop_and_free(context);
2775             break;
2776         }
2777 
2778         case JVM_OPC_invokevirtual: case JVM_OPC_invokespecial:
2779         case JVM_OPC_invokeinit:
2780         case JVM_OPC_invokestatic: case JVM_OPC_invokeinterface: {
2781             /* Look to signature to determine correct result. */
2782             int operand = this_idata->operand.i;
2783             const char *signature = JVM_GetCPMethodSignatureUTF(context->env,
2784                                                                 context->class,
2785                                                                 operand);
2786             const char *result_signature;
2787             check_and_push_string_utf(context, signature);
2788             result_signature = get_result_signature(signature);
2789             if (result_signature++ == NULL) {
2790                 CCerror(context, "Illegal signature %s", signature);
2791             }
2792             if (result_signature[0] == JVM_SIGNATURE_VOID) {
2793                 stack_results = "";
2794             } else {
2795                 buffer[0] = signature_to_fieldtype(context, &result_signature,
2796                                                    &full_info);
2797                 buffer[1] = '\0';
2798                 stack_results = buffer;
2799             }
2800             pop_and_free(context);
2801             break;
2802         }
2803 
2804         case JVM_OPC_aconst_null:
2805             stack_results = opcode_in_out[opcode][1];
2806             full_info = NULL_FULLINFO; /* special NULL */
2807             break;
2808 
2809         case JVM_OPC_new:
2810         case JVM_OPC_checkcast:
2811         case JVM_OPC_newarray:
2812         case JVM_OPC_anewarray:
2813         case JVM_OPC_multianewarray:
2814             stack_results = opcode_in_out[opcode][1];
2815             /* Conveniently, this result type is stored here */
2816             full_info = this_idata->operand.fi;
2817             break;
2818 
2819         case JVM_OPC_aaload:
2820             stack_results = opcode_in_out[opcode][1];
2821             /* pop_stack() saved value for us. */
2822             full_info = context->swap_table[0];
2823             break;
2824 
2825         case JVM_OPC_aload:
2826             stack_results = opcode_in_out[opcode][1];
2827             /* The register hasn't been modified, so we can use its value. */
2828             full_info = this_idata->register_info.registers[operand];
2829             break;
2830     } /* of switch */
2831 
2832     for (p = stack_results; *p != 0; p++) {
2833         int type = *p;
2834         stack_item_type *new_item = NEW(stack_item_type, 1);
2835         new_item->next = stack;
2836         stack = new_item;
2837         switch (type) {
2838             case 'I':
2839                 stack->item = MAKE_FULLINFO(ITEM_Integer, 0, 0); break;
2840             case 'F':
2841                 stack->item = MAKE_FULLINFO(ITEM_Float, 0, 0); break;
2842             case 'D':
2843                 stack->item = MAKE_FULLINFO(ITEM_Double, 0, 0);
2844                 stack_size++; break;
2845             case 'L':
2846                 stack->item = MAKE_FULLINFO(ITEM_Long, 0, 0);
2847                 stack_size++; break;
2848             case 'R':
2849                 stack->item = MAKE_FULLINFO(ITEM_ReturnAddress, 0, operand);
2850                 break;
2851             case '1': case '2': case '3': case '4': {
2852                 /* Get the info saved in the swap_table */
2853                 fullinfo_type stype = context->swap_table[type - '1'];
2854                 stack->item = stype;
2855                 if (stype == MAKE_FULLINFO(ITEM_Long, 0, 0) ||
2856                     stype == MAKE_FULLINFO(ITEM_Double, 0, 0)) {
2857                     stack_size++; p++;
2858                 }
2859                 break;
2860             }
2861             case 'A':
2862                 /* full_info should have the appropriate value. */
2863                 assert(full_info != 0);
2864                 stack->item = full_info;
2865                 break;
2866             default:
2867                 CCerror(context, "Internal error #4");
2868 
2869             } /* switch type */
2870         stack_size++;
2871     } /* outer for loop */
2872 
2873     if (opcode == JVM_OPC_invokeinit) {
2874         /* If there are any instances of "from" on the stack, we need to
2875          * replace it with "to", since calling <init> initializes all versions
2876          * of the object, obviously.     */
2877         fullinfo_type from = context->swap_table[0];
2878         stack_item_type *ptr;
2879         for (ptr = stack; ptr != NULL; ptr = ptr->next) {
2880             if (ptr->item == from) {
2881                 fullinfo_type to = context->swap_table[1];
2882                 stack = copy_stack(context, stack);
2883                 for (ptr = stack; ptr != NULL; ptr = ptr->next)
2884                     if (ptr->item == from) ptr->item = to;
2885                 break;
2886             }
2887         }
2888     }
2889 
2890     new_stack_info->stack_size = stack_size;
2891     new_stack_info->stack = stack;
2892 }
2893 
2894 
2895 /* We've performed an instruction, and determined the new registers and stack
2896  * value.  Look at all of the possibly subsequent instructions, and merge
2897  * this stack value into theirs.
2898  */
2899 
2900 static void
2901 merge_into_successors(context_type *context, unsigned int inumber,
2902                       register_info_type *register_info,
2903                       stack_info_type *stack_info,
2904                       flag_type and_flags, flag_type or_flags)
2905 {
2906     instruction_data_type *idata = context->instruction_data;
2907     instruction_data_type *this_idata = &idata[inumber];
2908     int opcode = this_idata->opcode;
2909     int operand = this_idata->operand.i;
2910     struct handler_info_type *handler_info = context->handler_info;
2911     int handler_info_length =
2912         JVM_GetMethodIxExceptionTableLength(context->env,
2913                                             context->class,
2914                                             context->method_index);
2915 
2916 
2917     int buffer[2];              /* default value for successors */
2918     int *successors = buffer;   /* table of successors */
2919     int successors_count;
2920     int i;
2921 
2922     switch (opcode) {
2923     default:
2924         successors_count = 1;
2925         buffer[0] = inumber + 1;
2926         break;
2927 
2928     case JVM_OPC_ifeq: case JVM_OPC_ifne: case JVM_OPC_ifgt:
2929     case JVM_OPC_ifge: case JVM_OPC_iflt: case JVM_OPC_ifle:
2930     case JVM_OPC_ifnull: case JVM_OPC_ifnonnull:
2931     case JVM_OPC_if_icmpeq: case JVM_OPC_if_icmpne: case JVM_OPC_if_icmpgt:
2932     case JVM_OPC_if_icmpge: case JVM_OPC_if_icmplt: case JVM_OPC_if_icmple:
2933     case JVM_OPC_if_acmpeq: case JVM_OPC_if_acmpne:
2934         successors_count = 2;
2935         buffer[0] = inumber + 1;
2936         buffer[1] = operand;
2937         break;
2938 
2939     case JVM_OPC_jsr: case JVM_OPC_jsr_w:
2940         if (this_idata->operand2.i != UNKNOWN_RET_INSTRUCTION)
2941             idata[this_idata->operand2.i].changed = JNI_TRUE;
2942         /* FALLTHROUGH */
2943     case JVM_OPC_goto: case JVM_OPC_goto_w:
2944         successors_count = 1;
2945         buffer[0] = operand;
2946         break;
2947 
2948 
2949     case JVM_OPC_ireturn: case JVM_OPC_lreturn: case JVM_OPC_return:
2950     case JVM_OPC_freturn: case JVM_OPC_dreturn: case JVM_OPC_areturn:
2951     case JVM_OPC_athrow:
2952         /* The testing for the returns is handled in pop_stack() */
2953         successors_count = 0;
2954         break;
2955 
2956     case JVM_OPC_ret: {
2957         /* This is slightly slow, but good enough for a seldom used instruction.
2958          * The EXTRA_ITEM_INFO of the ITEM_ReturnAddress indicates the
2959          * address of the first instruction of the subroutine.  We can return
2960          * to 1 after any instruction that jsr's to that instruction.
2961          */
2962         if (this_idata->operand2.ip == NULL) {
2963             fullinfo_type *registers = this_idata->register_info.registers;
2964             int called_instruction = GET_EXTRA_INFO(registers[operand]);
2965             int i, count, *ptr;;
2966             for (i = context->instruction_count, count = 0; --i >= 0; ) {
2967                 if (((idata[i].opcode == JVM_OPC_jsr) ||
2968                      (idata[i].opcode == JVM_OPC_jsr_w)) &&
2969                     (idata[i].operand.i == called_instruction))
2970                     count++;
2971             }
2972             this_idata->operand2.ip = ptr = NEW(int, count + 1);
2973             *ptr++ = count;
2974             for (i = context->instruction_count, count = 0; --i >= 0; ) {
2975                 if (((idata[i].opcode == JVM_OPC_jsr) ||
2976                      (idata[i].opcode == JVM_OPC_jsr_w)) &&
2977                     (idata[i].operand.i == called_instruction))
2978                     *ptr++ = i + 1;
2979             }
2980         }
2981         successors = this_idata->operand2.ip; /* use this instead */
2982         successors_count = *successors++;
2983         break;
2984 
2985     }
2986 
2987     case JVM_OPC_tableswitch:
2988     case JVM_OPC_lookupswitch:
2989         successors = this_idata->operand.ip; /* use this instead */
2990         successors_count = *successors++;
2991         break;
2992     }
2993 
2994 #ifdef DEBUG
2995     if (verify_verbose) {
2996         jio_fprintf(stdout, " [");
2997         for (i = handler_info_length; --i >= 0; handler_info++)
2998             if (handler_info->start <= (int)inumber && handler_info->end > (int)inumber)
2999                 jio_fprintf(stdout, "%d* ", handler_info->handler);
3000         for (i = 0; i < successors_count; i++)
3001             jio_fprintf(stdout, "%d ", successors[i]);
3002         jio_fprintf(stdout,   "]\n");
3003     }
3004 #endif
3005 
3006     handler_info = context->handler_info;
3007     for (i = handler_info_length; --i >= 0; handler_info++) {
3008         if (handler_info->start <= (int)inumber && handler_info->end > (int)inumber) {
3009             int handler = handler_info->handler;
3010             if (opcode != JVM_OPC_invokeinit) {
3011                 merge_into_one_successor(context, inumber, handler,
3012                                          &this_idata->register_info, /* old */
3013                                          &handler_info->stack_info,
3014                                          (flag_type) (and_flags
3015                                                       & this_idata->and_flags),
3016                                          (flag_type) (or_flags
3017                                                       | this_idata->or_flags),
3018                                          JNI_TRUE);
3019             } else {
3020                 /* We need to be a little bit more careful with this
3021                  * instruction.  Things could either be in the state before
3022                  * the instruction or in the state afterwards */
3023                 fullinfo_type from = context->swap_table[0];
3024                 flag_type temp_or_flags = or_flags;
3025                 if (from == MAKE_FULLINFO(ITEM_InitObject, 0, 0))
3026                     temp_or_flags |= FLAG_NO_RETURN;
3027                 merge_into_one_successor(context, inumber, handler,
3028                                          &this_idata->register_info, /* old */
3029                                          &handler_info->stack_info,
3030                                          this_idata->and_flags,
3031                                          this_idata->or_flags,
3032                                          JNI_TRUE);
3033                 merge_into_one_successor(context, inumber, handler,
3034                                          register_info,
3035                                          &handler_info->stack_info,
3036                                          and_flags, temp_or_flags, JNI_TRUE);
3037             }
3038         }
3039     }
3040     for (i = 0; i < successors_count; i++) {
3041         int target = successors[i];
3042         if (target >= context->instruction_count)
3043             CCerror(context, "Falling off the end of the code");
3044         merge_into_one_successor(context, inumber, target,
3045                                  register_info, stack_info, and_flags, or_flags,
3046                                  JNI_FALSE);
3047     }
3048 }
3049 
3050 /* We have a new set of registers and stack values for a given instruction.
3051  * Merge this new set into the values that are already there.
3052  */
3053 
3054 static void
3055 merge_into_one_successor(context_type *context,
3056                          unsigned int from_inumber, unsigned int to_inumber,
3057                          register_info_type *new_register_info,
3058                          stack_info_type *new_stack_info,
3059                          flag_type new_and_flags, flag_type new_or_flags,
3060                          jboolean isException)
3061 {
3062     instruction_data_type *idata = context->instruction_data;
3063     register_info_type register_info_buf;
3064     stack_info_type stack_info_buf;
3065 #ifdef DEBUG
3066     instruction_data_type *this_idata = &idata[to_inumber];
3067     register_info_type old_reg_info;
3068     stack_info_type old_stack_info;
3069     flag_type old_and_flags = 0;
3070     flag_type old_or_flags = 0;
3071 #endif
3072 
3073 #ifdef DEBUG
3074     if (verify_verbose) {
3075         old_reg_info = this_idata->register_info;
3076         old_stack_info = this_idata->stack_info;
3077         old_and_flags = this_idata->and_flags;
3078         old_or_flags = this_idata->or_flags;
3079     }
3080 #endif
3081 
3082     /* All uninitialized objects are set to "bogus" when jsr and
3083      * ret are executed. Thus uninitialized objects can't propagate
3084      * into or out of a subroutine.
3085      */
3086     if (idata[from_inumber].opcode == JVM_OPC_ret ||
3087         idata[from_inumber].opcode == JVM_OPC_jsr ||
3088         idata[from_inumber].opcode == JVM_OPC_jsr_w) {
3089         int new_register_count = new_register_info->register_count;
3090         fullinfo_type *new_registers = new_register_info->registers;
3091         int i;
3092         stack_item_type *item;
3093 
3094         for (item = new_stack_info->stack; item != NULL; item = item->next) {
3095             if (GET_ITEM_TYPE(item->item) == ITEM_NewObject) {
3096                 /* This check only succeeds for hand-contrived code.
3097                  * Efficiency is not an issue.
3098                  */
3099                 stack_info_buf.stack = copy_stack(context,
3100                                                   new_stack_info->stack);
3101                 stack_info_buf.stack_size = new_stack_info->stack_size;
3102                 new_stack_info = &stack_info_buf;
3103                 for (item = new_stack_info->stack; item != NULL;
3104                      item = item->next) {
3105                     if (GET_ITEM_TYPE(item->item) == ITEM_NewObject) {
3106                         item->item = MAKE_FULLINFO(ITEM_Bogus, 0, 0);
3107                     }
3108                 }
3109                 break;
3110             }
3111         }
3112         for (i = 0; i < new_register_count; i++) {
3113             if (GET_ITEM_TYPE(new_registers[i]) == ITEM_NewObject) {
3114                 /* This check only succeeds for hand-contrived code.
3115                  * Efficiency is not an issue.
3116                  */
3117                 fullinfo_type *new_set = NEW(fullinfo_type,
3118                                              new_register_count);
3119                 for (i = 0; i < new_register_count; i++) {
3120                     fullinfo_type t = new_registers[i];
3121                     new_set[i] = GET_ITEM_TYPE(t) != ITEM_NewObject ?
3122                         t : MAKE_FULLINFO(ITEM_Bogus, 0, 0);
3123                 }
3124                 register_info_buf.register_count = new_register_count;
3125                 register_info_buf.registers = new_set;
3126                 register_info_buf.mask_count = new_register_info->mask_count;
3127                 register_info_buf.masks = new_register_info->masks;
3128                 new_register_info = &register_info_buf;
3129                 break;
3130             }
3131         }
3132     }
3133 
3134     /* Returning from a subroutine is somewhat ugly.  The actual thing
3135      * that needs to get merged into the new instruction is a joining
3136      * of info from the ret instruction with stuff in the jsr instruction
3137      */
3138     if (idata[from_inumber].opcode == JVM_OPC_ret && !isException) {
3139         int new_register_count = new_register_info->register_count;
3140         fullinfo_type *new_registers = new_register_info->registers;
3141         int new_mask_count = new_register_info->mask_count;
3142         mask_type *new_masks = new_register_info->masks;
3143         int operand = idata[from_inumber].operand.i;
3144         int called_instruction = GET_EXTRA_INFO(new_registers[operand]);
3145         instruction_data_type *jsr_idata = &idata[to_inumber - 1];
3146         register_info_type *jsr_reginfo = &jsr_idata->register_info;
3147         if (jsr_idata->operand2.i != (int)from_inumber) {
3148             if (jsr_idata->operand2.i != UNKNOWN_RET_INSTRUCTION)
3149                 CCerror(context, "Multiple returns to single jsr");
3150             jsr_idata->operand2.i = from_inumber;
3151         }
3152         if (jsr_reginfo->register_count == UNKNOWN_REGISTER_COUNT) {
3153             /* We don't want to handle the returned-to instruction until
3154              * we've dealt with the jsr instruction.   When we get to the
3155              * jsr instruction (if ever), we'll re-mark the ret instruction
3156              */
3157             ;
3158         } else {
3159             int register_count = jsr_reginfo->register_count;
3160             fullinfo_type *registers = jsr_reginfo->registers;
3161             int max_registers = MAX(register_count, new_register_count);
3162             fullinfo_type *new_set = NEW(fullinfo_type, max_registers);
3163             int *return_mask;
3164             struct register_info_type new_new_register_info;
3165             int i;
3166             /* Make sure the place we're returning from is legal! */
3167             for (i = new_mask_count; --i >= 0; )
3168                 if (new_masks[i].entry == called_instruction)
3169                     break;
3170             if (i < 0)
3171                 CCerror(context, "Illegal return from subroutine");
3172             /* pop the masks down to the indicated one.  Remember the mask
3173              * we're popping off. */
3174             return_mask = new_masks[i].modifies;
3175             new_mask_count = i;
3176             for (i = 0; i < max_registers; i++) {
3177                 if (IS_BIT_SET(return_mask, i))
3178                     new_set[i] = i < new_register_count ?
3179                           new_registers[i] : MAKE_FULLINFO(ITEM_Bogus, 0, 0);
3180                 else
3181                     new_set[i] = i < register_count ?
3182                         registers[i] : MAKE_FULLINFO(ITEM_Bogus, 0, 0);
3183             }
3184             new_new_register_info.register_count = max_registers;
3185             new_new_register_info.registers      = new_set;
3186             new_new_register_info.mask_count     = new_mask_count;
3187             new_new_register_info.masks          = new_masks;
3188 
3189 
3190             merge_stack(context, from_inumber, to_inumber, new_stack_info);
3191             merge_registers(context, to_inumber - 1, to_inumber,
3192                             &new_new_register_info);
3193             merge_flags(context, from_inumber, to_inumber, new_and_flags, new_or_flags);
3194         }
3195     } else {
3196         merge_stack(context, from_inumber, to_inumber, new_stack_info);
3197         merge_registers(context, from_inumber, to_inumber, new_register_info);
3198         merge_flags(context, from_inumber, to_inumber,
3199                     new_and_flags, new_or_flags);
3200     }
3201 
3202 #ifdef DEBUG
3203     if (verify_verbose && idata[to_inumber].changed) {
3204         register_info_type *register_info = &this_idata->register_info;
3205         stack_info_type *stack_info = &this_idata->stack_info;
3206         if (memcmp(&old_reg_info, register_info, sizeof(old_reg_info)) ||
3207             memcmp(&old_stack_info, stack_info, sizeof(old_stack_info)) ||
3208             (old_and_flags != this_idata->and_flags) ||
3209             (old_or_flags != this_idata->or_flags)) {
3210             jio_fprintf(stdout, "   %2d:", to_inumber);
3211             print_stack(context, &old_stack_info);
3212             print_registers(context, &old_reg_info);
3213             print_flags(context, old_and_flags, old_or_flags);
3214             jio_fprintf(stdout, " => ");
3215             print_stack(context, &this_idata->stack_info);
3216             print_registers(context, &this_idata->register_info);
3217             print_flags(context, this_idata->and_flags, this_idata->or_flags);
3218             jio_fprintf(stdout, "\n");
3219         }
3220     }
3221 #endif
3222 
3223 }
3224 
3225 static void
3226 merge_stack(context_type *context, unsigned int from_inumber,
3227             unsigned int to_inumber, stack_info_type *new_stack_info)
3228 {
3229     instruction_data_type *idata = context->instruction_data;
3230     instruction_data_type *this_idata = &idata[to_inumber];
3231 
3232     int new_stack_size =  new_stack_info->stack_size;
3233     stack_item_type *new_stack = new_stack_info->stack;
3234 
3235     int stack_size = this_idata->stack_info.stack_size;
3236 
3237     if (stack_size == UNKNOWN_STACK_SIZE) {
3238         /* First time at this instruction.  Just copy. */
3239         this_idata->stack_info.stack_size = new_stack_size;
3240         this_idata->stack_info.stack = new_stack;
3241         this_idata->changed = JNI_TRUE;
3242     } else if (new_stack_size != stack_size) {
3243         CCerror(context, "Inconsistent stack height %d != %d",
3244                 new_stack_size, stack_size);
3245     } else {
3246         stack_item_type *stack = this_idata->stack_info.stack;
3247         stack_item_type *old, *new;
3248         jboolean change = JNI_FALSE;
3249         for (old = stack, new = new_stack; old != NULL;
3250                    old = old->next, new = new->next) {
3251             assert(new != NULL);
3252             if (!isAssignableTo(context, new->item, old->item)) {
3253                 change = JNI_TRUE;
3254                 break;
3255             }
3256         }
3257         if (change) {
3258             stack = copy_stack(context, stack);
3259             for (old = stack, new = new_stack; old != NULL;
3260                           old = old->next, new = new->next) {
3261                 if (new == NULL) {
3262                     break;
3263                 }
3264                 old->item = merge_fullinfo_types(context, old->item, new->item,
3265                                                  JNI_FALSE);
3266                 if (GET_ITEM_TYPE(old->item) == ITEM_Bogus) {
3267                         CCerror(context, "Mismatched stack types");
3268                 }
3269             }
3270             if (old != NULL || new != NULL) {
3271                 CCerror(context, "Mismatched stack types");
3272             }
3273             this_idata->stack_info.stack = stack;
3274             this_idata->changed = JNI_TRUE;
3275         }
3276     }
3277 }
3278 
3279 static void
3280 merge_registers(context_type *context, unsigned int from_inumber,
3281                 unsigned int to_inumber, register_info_type *new_register_info)
3282 {
3283     instruction_data_type *idata = context->instruction_data;
3284     instruction_data_type *this_idata = &idata[to_inumber];
3285     register_info_type    *this_reginfo = &this_idata->register_info;
3286 
3287     int            new_register_count = new_register_info->register_count;
3288     fullinfo_type *new_registers = new_register_info->registers;
3289     int            new_mask_count = new_register_info->mask_count;
3290     mask_type     *new_masks = new_register_info->masks;
3291 
3292 
3293     if (this_reginfo->register_count == UNKNOWN_REGISTER_COUNT) {
3294         this_reginfo->register_count = new_register_count;
3295         this_reginfo->registers = new_registers;
3296         this_reginfo->mask_count = new_mask_count;
3297         this_reginfo->masks = new_masks;
3298         this_idata->changed = JNI_TRUE;
3299     } else {
3300         /* See if we've got new information on the register set. */
3301         int register_count = this_reginfo->register_count;
3302         fullinfo_type *registers = this_reginfo->registers;
3303         int mask_count = this_reginfo->mask_count;
3304         mask_type *masks = this_reginfo->masks;
3305 
3306         jboolean copy = JNI_FALSE;
3307         int i, j;
3308         if (register_count > new_register_count) {
3309             /* Any register larger than new_register_count is now bogus */
3310             this_reginfo->register_count = new_register_count;
3311             register_count = new_register_count;
3312             this_idata->changed = JNI_TRUE;
3313         }
3314         for (i = 0; i < register_count; i++) {
3315             fullinfo_type prev_value = registers[i];
3316             if ((i < new_register_count)
3317                   ? (!isAssignableTo(context, new_registers[i], prev_value))
3318                   : (prev_value != MAKE_FULLINFO(ITEM_Bogus, 0, 0))) {
3319                 copy = JNI_TRUE;
3320                 break;
3321             }
3322         }
3323 
3324         if (copy) {
3325             /* We need a copy.  So do it. */
3326             fullinfo_type *new_set = NEW(fullinfo_type, register_count);
3327             for (j = 0; j < i; j++)
3328                 new_set[j] =  registers[j];
3329             for (j = i; j < register_count; j++) {
3330                 if (i >= new_register_count)
3331                     new_set[j] = MAKE_FULLINFO(ITEM_Bogus, 0, 0);
3332                 else
3333                     new_set[j] = merge_fullinfo_types(context,
3334                                                       new_registers[j],
3335                                                       registers[j], JNI_FALSE);
3336             }
3337             /* Some of the end items might now be bogus. This step isn't
3338              * necessary, but it may save work later. */
3339             while (   register_count > 0
3340                    && GET_ITEM_TYPE(new_set[register_count-1]) == ITEM_Bogus)
3341                 register_count--;
3342             this_reginfo->register_count = register_count;
3343             this_reginfo->registers = new_set;
3344             this_idata->changed = JNI_TRUE;
3345         }
3346         if (mask_count > 0) {
3347             /* If the target instruction already has a sequence of masks, then
3348              * we need to merge new_masks into it.  We want the entries on
3349              * the mask to be the longest common substring of the two.
3350              *   (e.g.   a->b->d merged with a->c->d should give a->d)
3351              * The bits set in the mask should be the or of the corresponding
3352              * entries in each of the original masks.
3353              */
3354             int i, j, k;
3355             int matches = 0;
3356             int last_match = -1;
3357             jboolean copy_needed = JNI_FALSE;
3358             for (i = 0; i < mask_count; i++) {
3359                 int entry = masks[i].entry;
3360                 for (j = last_match + 1; j < new_mask_count; j++) {
3361                     if (new_masks[j].entry == entry) {
3362                         /* We have a match */
3363                         int *prev = masks[i].modifies;
3364                         int *new = new_masks[j].modifies;
3365                         matches++;
3366                         /* See if new_mask has bits set for "entry" that
3367                          * weren't set for mask.  If so, need to copy. */
3368                         for (k = context->bitmask_size - 1;
3369                                !copy_needed && k >= 0;
3370                                k--)
3371                             if (~prev[k] & new[k])
3372                                 copy_needed = JNI_TRUE;
3373                         last_match = j;
3374                         break;
3375                     }
3376                 }
3377             }
3378             if ((matches < mask_count) || copy_needed) {
3379                 /* We need to make a copy for the new item, since either the
3380                  * size has decreased, or new bits are set. */
3381                 mask_type *copy = NEW(mask_type, matches);
3382                 for (i = 0; i < matches; i++) {
3383                     copy[i].modifies = NEW(int, context->bitmask_size);
3384                 }
3385                 this_reginfo->masks = copy;
3386                 this_reginfo->mask_count = matches;
3387                 this_idata->changed = JNI_TRUE;
3388                 matches = 0;
3389                 last_match = -1;
3390                 for (i = 0; i < mask_count; i++) {
3391                     int entry = masks[i].entry;
3392                     for (j = last_match + 1; j < new_mask_count; j++) {
3393                         if (new_masks[j].entry == entry) {
3394                             int *prev1 = masks[i].modifies;
3395                             int *prev2 = new_masks[j].modifies;
3396                             int *new = copy[matches].modifies;
3397                             copy[matches].entry = entry;
3398                             for (k = context->bitmask_size - 1; k >= 0; k--)
3399                                 new[k] = prev1[k] | prev2[k];
3400                             matches++;
3401                             last_match = j;
3402                             break;
3403                         }
3404                     }
3405                 }
3406             }
3407         }
3408     }
3409 }
3410 
3411 
3412 static void
3413 merge_flags(context_type *context, unsigned int from_inumber,
3414             unsigned int to_inumber,
3415             flag_type new_and_flags, flag_type new_or_flags)
3416 {
3417     /* Set this_idata->and_flags &= new_and_flags
3418            this_idata->or_flags |= new_or_flags
3419      */
3420     instruction_data_type *idata = context->instruction_data;
3421     instruction_data_type *this_idata = &idata[to_inumber];
3422     flag_type this_and_flags = this_idata->and_flags;
3423     flag_type this_or_flags = this_idata->or_flags;
3424     flag_type merged_and = this_and_flags & new_and_flags;
3425     flag_type merged_or = this_or_flags | new_or_flags;
3426 
3427     if ((merged_and != this_and_flags) || (merged_or != this_or_flags)) {
3428         this_idata->and_flags = merged_and;
3429         this_idata->or_flags = merged_or;
3430         this_idata->changed = JNI_TRUE;
3431     }
3432 }
3433 
3434 
3435 /* Make a copy of a stack */
3436 
3437 static stack_item_type *
3438 copy_stack(context_type *context, stack_item_type *stack)
3439 {
3440     int length;
3441     stack_item_type *ptr;
3442 
3443     /* Find the length */
3444     for (ptr = stack, length = 0; ptr != NULL; ptr = ptr->next, length++);
3445 
3446     if (length > 0) {
3447         stack_item_type *new_stack = NEW(stack_item_type, length);
3448         stack_item_type *new_ptr;
3449         for (    ptr = stack, new_ptr = new_stack;
3450                  ptr != NULL;
3451                  ptr = ptr->next, new_ptr++) {
3452             new_ptr->item = ptr->item;
3453             new_ptr->next = new_ptr + 1;
3454         }
3455         new_stack[length - 1].next = NULL;
3456         return new_stack;
3457     } else {
3458         return NULL;
3459     }
3460 }
3461 
3462 
3463 static mask_type *
3464 copy_masks(context_type *context, mask_type *masks, int mask_count)
3465 {
3466     mask_type *result = NEW(mask_type, mask_count);
3467     int bitmask_size = context->bitmask_size;
3468     int *bitmaps = NEW(int, mask_count * bitmask_size);
3469     int i;
3470     for (i = 0; i < mask_count; i++) {
3471         result[i].entry = masks[i].entry;
3472         result[i].modifies = &bitmaps[i * bitmask_size];
3473         memcpy(result[i].modifies, masks[i].modifies, bitmask_size * sizeof(int));
3474     }
3475     return result;
3476 }
3477 
3478 
3479 static mask_type *
3480 add_to_masks(context_type *context, mask_type *masks, int mask_count, int d)
3481 {
3482     mask_type *result = NEW(mask_type, mask_count + 1);
3483     int bitmask_size = context->bitmask_size;
3484     int *bitmaps = NEW(int, (mask_count + 1) * bitmask_size);
3485     int i;
3486     for (i = 0; i < mask_count; i++) {
3487         result[i].entry = masks[i].entry;
3488         result[i].modifies = &bitmaps[i * bitmask_size];
3489         memcpy(result[i].modifies, masks[i].modifies, bitmask_size * sizeof(int));
3490     }
3491     result[mask_count].entry = d;
3492     result[mask_count].modifies = &bitmaps[mask_count * bitmask_size];
3493     memset(result[mask_count].modifies, 0, bitmask_size * sizeof(int));
3494     return result;
3495 }
3496 
3497 
3498 
3499 /* We create our own storage manager, since we malloc lots of little items,
3500  * and I don't want to keep trace of when they become free.  I sure wish that
3501  * we had heaps, and I could just free the heap when done.
3502  */
3503 
3504 #define CCSegSize 2000
3505 
3506 struct CCpool {                 /* a segment of allocated memory in the pool */
3507     struct CCpool *next;
3508     int segSize;                /* almost always CCSegSize */
3509     int poolPad;
3510     char space[CCSegSize];
3511 };
3512 
3513 /* Initialize the context's heap. */
3514 static void CCinit(context_type *context)
3515 {
3516     struct CCpool *new = (struct CCpool *) malloc(sizeof(struct CCpool));
3517     /* Set context->CCroot to 0 if new == 0 to tell CCdestroy to lay off */
3518     context->CCroot = context->CCcurrent = new;
3519     if (new == 0) {
3520         CCout_of_memory(context);
3521     }
3522     new->next = NULL;
3523     new->segSize = CCSegSize;
3524     context->CCfree_size = CCSegSize;
3525     context->CCfree_ptr = &new->space[0];
3526 }
3527 
3528 
3529 /* Reuse all the space that we have in the context's heap. */
3530 static void CCreinit(context_type *context)
3531 {
3532     struct CCpool *first = context->CCroot;
3533     context->CCcurrent = first;
3534     context->CCfree_size = CCSegSize;
3535     context->CCfree_ptr = &first->space[0];
3536 }
3537 
3538 /* Destroy the context's heap. */
3539 static void CCdestroy(context_type *context)
3540 {
3541     struct CCpool *this = context->CCroot;
3542     while (this) {
3543         struct CCpool *next = this->next;
3544         free(this);
3545         this = next;
3546     }
3547     /* These two aren't necessary.  But can't hurt either */
3548     context->CCroot = context->CCcurrent = NULL;
3549     context->CCfree_ptr = 0;
3550 }
3551 
3552 /* Allocate an object of the given size from the context's heap. */
3553 static void *
3554 CCalloc(context_type *context, int size, jboolean zero)
3555 {
3556 
3557     register char *p;
3558     /* Round CC to the size of a pointer */
3559     size = (size + (sizeof(void *) - 1)) & ~(sizeof(void *) - 1);
3560 
3561     if (context->CCfree_size <  size) {
3562         struct CCpool *current = context->CCcurrent;
3563         struct CCpool *new;
3564         if (size > CCSegSize) { /* we need to allocate a special block */
3565             new = (struct CCpool *)malloc(sizeof(struct CCpool) +
3566                                           (size - CCSegSize));
3567             if (new == 0) {
3568                 CCout_of_memory(context);
3569             }
3570             new->next = current->next;
3571             new->segSize = size;
3572             current->next = new;
3573         } else {
3574             new = current->next;
3575             if (new == NULL) {
3576                 new = (struct CCpool *) malloc(sizeof(struct CCpool));
3577                 if (new == 0) {
3578                     CCout_of_memory(context);
3579                 }
3580                 current->next = new;
3581                 new->next = NULL;
3582                 new->segSize = CCSegSize;
3583             }
3584         }
3585         context->CCcurrent = new;
3586         context->CCfree_ptr = &new->space[0];
3587         context->CCfree_size = new->segSize;
3588     }
3589     p = context->CCfree_ptr;
3590     context->CCfree_ptr += size;
3591     context->CCfree_size -= size;
3592     if (zero)
3593         memset(p, 0, size);
3594     return p;
3595 }
3596 
3597 /* Get the class associated with a particular field or method or class in the
3598  * constant pool.  If is_field is true, we've got a field or method.  If
3599  * false, we've got a class.
3600  */
3601 static fullinfo_type
3602 cp_index_to_class_fullinfo(context_type *context, int cp_index, int kind)
3603 {
3604     JNIEnv *env = context->env;
3605     fullinfo_type result;
3606     const char *classname;
3607     switch (kind) {
3608     case JVM_CONSTANT_Class:
3609         classname = JVM_GetCPClassNameUTF(env,
3610                                           context->class,
3611                                           cp_index);
3612         break;
3613     case JVM_CONSTANT_Methodref:
3614         classname = JVM_GetCPMethodClassNameUTF(env,
3615                                                 context->class,
3616                                                 cp_index);
3617         break;
3618     case JVM_CONSTANT_Fieldref:
3619         classname = JVM_GetCPFieldClassNameUTF(env,
3620                                                context->class,
3621                                                cp_index);
3622         break;
3623     default:
3624         classname = NULL;
3625         CCerror(context, "Internal error #5");
3626     }
3627 
3628     check_and_push_string_utf(context, classname);
3629     if (classname[0] == JVM_SIGNATURE_ARRAY) {
3630         /* This make recursively call us, in case of a class array */
3631         signature_to_fieldtype(context, &classname, &result);
3632     } else {
3633         result = make_class_info_from_name(context, classname);
3634     }
3635     pop_and_free(context);
3636     return result;
3637 }
3638 
3639 
3640 static int
3641 print_CCerror_info(context_type *context)
3642 {
3643     JNIEnv *env = context->env;
3644     jclass cb = context->class;
3645     const char *classname = JVM_GetClassNameUTF(env, cb);
3646     const char *name = 0;
3647     const char *signature = 0;
3648     int n = 0;
3649     if (context->method_index != -1) {
3650         name = JVM_GetMethodIxNameUTF(env, cb, context->method_index);
3651         signature =
3652             JVM_GetMethodIxSignatureUTF(env, cb, context->method_index);
3653         n += jio_snprintf(context->message, context->message_buf_len,
3654                           "(class: %s, method: %s signature: %s) ",
3655                           (classname ? classname : ""),
3656                           (name ? name : ""),
3657                           (signature ? signature : ""));
3658     } else if (context->field_index != -1 ) {
3659         name = JVM_GetMethodIxNameUTF(env, cb, context->field_index);
3660         n += jio_snprintf(context->message, context->message_buf_len,
3661                           "(class: %s, field: %s) ",
3662                           (classname ? classname : 0),
3663                           (name ? name : 0));
3664     } else {
3665         n += jio_snprintf(context->message, context->message_buf_len,
3666                           "(class: %s) ", classname ? classname : "");
3667     }
3668     JVM_ReleaseUTF(classname);
3669     JVM_ReleaseUTF(name);
3670     JVM_ReleaseUTF(signature);
3671     return n;
3672 }
3673 
3674 static void
3675 CCerror (context_type *context, char *format, ...)
3676 {
3677     int n = print_CCerror_info(context);
3678     va_list args;
3679     if (n >= 0 && n < context->message_buf_len) {
3680         va_start(args, format);
3681         jio_vsnprintf(context->message + n, context->message_buf_len - n,
3682                       format, args);
3683         va_end(args);
3684     }
3685     context->err_code = CC_VerifyError;
3686     longjmp(context->jump_buffer, 1);
3687 }
3688 
3689 static void
3690 CCout_of_memory(context_type *context)
3691 {
3692     int n = print_CCerror_info(context);
3693     context->err_code = CC_OutOfMemory;
3694     longjmp(context->jump_buffer, 1);
3695 }
3696 
3697 static void
3698 CFerror(context_type *context, char *format, ...)
3699 {
3700     int n = print_CCerror_info(context);
3701     va_list args;
3702     if (n >= 0 && n < context->message_buf_len) {
3703         va_start(args, format);
3704         jio_vsnprintf(context->message + n, context->message_buf_len - n,
3705                       format, args);
3706         va_end(args);
3707     }
3708     context->err_code = CC_ClassFormatError;
3709     longjmp(context->jump_buffer, 1);
3710 }
3711 
3712 /*
3713  * Need to scan the entire signature to find the result type because
3714  * types in the arg list and the result type could contain embedded ')'s.
3715  */
3716 static const char* get_result_signature(const char* signature) {
3717     const char *p;
3718     for (p = signature; *p != JVM_SIGNATURE_ENDFUNC; p++) {
3719         switch (*p) {
3720           case JVM_SIGNATURE_BOOLEAN:
3721           case JVM_SIGNATURE_BYTE:
3722           case JVM_SIGNATURE_CHAR:
3723           case JVM_SIGNATURE_SHORT:
3724           case JVM_SIGNATURE_INT:
3725           case JVM_SIGNATURE_FLOAT:
3726           case JVM_SIGNATURE_DOUBLE:
3727           case JVM_SIGNATURE_LONG:
3728           case JVM_SIGNATURE_FUNC:  /* ignore initial (, if given */
3729             break;
3730           case JVM_SIGNATURE_CLASS:
3731             while (*p != JVM_SIGNATURE_ENDCLASS) p++;
3732             break;
3733           case JVM_SIGNATURE_ARRAY:
3734             while (*p == JVM_SIGNATURE_ARRAY) p++;
3735             /* If an array of classes, skip over class name, too. */
3736             if (*p == JVM_SIGNATURE_CLASS) {
3737                 while (*p != JVM_SIGNATURE_ENDCLASS) p++;
3738             }
3739             break;
3740           default:
3741             /* Indicate an error. */
3742             return NULL;
3743         }
3744     }
3745     return p++; /* skip over ')'. */
3746 }
3747 
3748 static char
3749 signature_to_fieldtype(context_type *context,
3750                        const char **signature_p, fullinfo_type *full_info_p)
3751 {
3752     const char *p = *signature_p;
3753     fullinfo_type full_info = MAKE_FULLINFO(ITEM_Bogus, 0, 0);
3754     char result;
3755     int array_depth = 0;
3756 
3757     for (;;) {
3758         switch(*p++) {
3759             default:
3760                 result = 0;
3761                 break;
3762 
3763             case JVM_SIGNATURE_BOOLEAN:
3764                 full_info = (array_depth > 0)
3765                               ? MAKE_FULLINFO(ITEM_Boolean, 0, 0)
3766                               : MAKE_FULLINFO(ITEM_Integer, 0, 0);
3767                 result = 'I';
3768                 break;
3769 
3770             case JVM_SIGNATURE_BYTE:
3771                 full_info = (array_depth > 0)
3772                               ? MAKE_FULLINFO(ITEM_Byte, 0, 0)
3773                               : MAKE_FULLINFO(ITEM_Integer, 0, 0);
3774                 result = 'I';
3775                 break;
3776 
3777             case JVM_SIGNATURE_CHAR:
3778                 full_info = (array_depth > 0)
3779                               ? MAKE_FULLINFO(ITEM_Char, 0, 0)
3780                               : MAKE_FULLINFO(ITEM_Integer, 0, 0);
3781                 result = 'I';
3782                 break;
3783 
3784             case JVM_SIGNATURE_SHORT:
3785                 full_info = (array_depth > 0)
3786                               ? MAKE_FULLINFO(ITEM_Short, 0, 0)
3787                               : MAKE_FULLINFO(ITEM_Integer, 0, 0);
3788                 result = 'I';
3789                 break;
3790 
3791             case JVM_SIGNATURE_INT:
3792                 full_info = MAKE_FULLINFO(ITEM_Integer, 0, 0);
3793                 result = 'I';
3794                 break;
3795 
3796             case JVM_SIGNATURE_FLOAT:
3797                 full_info = MAKE_FULLINFO(ITEM_Float, 0, 0);
3798                 result = 'F';
3799                 break;
3800 
3801             case JVM_SIGNATURE_DOUBLE:
3802                 full_info = MAKE_FULLINFO(ITEM_Double, 0, 0);
3803                 result = 'D';
3804                 break;
3805 
3806             case JVM_SIGNATURE_LONG:
3807                 full_info = MAKE_FULLINFO(ITEM_Long, 0, 0);
3808                 result = 'L';
3809                 break;
3810 
3811             case JVM_SIGNATURE_ARRAY:
3812                 array_depth++;
3813                 continue;       /* only time we ever do the loop > 1 */
3814 
3815             case JVM_SIGNATURE_CLASS: {
3816                 char buffer_space[256];
3817                 char *buffer = buffer_space;
3818                 char *finish = strchr(p, JVM_SIGNATURE_ENDCLASS);
3819                 int length;
3820                 if (finish == NULL) {
3821                     /* Signature must have ';' after the class name.
3822                      * If it does not, return 0 and ITEM_Bogus in full_info. */
3823                     result = 0;
3824                     break;
3825                 }
3826                 assert(finish >= p);
3827                 length = (int)(finish - p);
3828                 if (length + 1 > (int)sizeof(buffer_space)) {
3829                     buffer = malloc(length + 1);
3830                     check_and_push_malloc_block(context, buffer);
3831                 }
3832                 memcpy(buffer, p, length);
3833                 buffer[length] = '\0';
3834                 full_info = make_class_info_from_name(context, buffer);
3835                 result = 'A';
3836                 p = finish + 1;
3837                 if (buffer != buffer_space)
3838                     pop_and_free(context);
3839                 break;
3840             }
3841         } /* end of switch */
3842         break;
3843     }
3844     *signature_p = p;
3845     if (array_depth == 0 || result == 0) {
3846         /* either not an array, or result is bogus */
3847         *full_info_p = full_info;
3848         return result;
3849     } else {
3850         if (array_depth > MAX_ARRAY_DIMENSIONS)
3851             CCerror(context, "Array with too many dimensions");
3852         *full_info_p = MAKE_FULLINFO(GET_ITEM_TYPE(full_info),
3853                                      array_depth,
3854                                      GET_EXTRA_INFO(full_info));
3855         return 'A';
3856     }
3857 }
3858 
3859 
3860 /* Given an array type, create the type that has one less level of
3861  * indirection.
3862  */
3863 
3864 static fullinfo_type
3865 decrement_indirection(fullinfo_type array_info)
3866 {
3867     if (array_info == NULL_FULLINFO) {
3868         return NULL_FULLINFO;
3869     } else {
3870         int type = GET_ITEM_TYPE(array_info);
3871         int indirection = GET_INDIRECTION(array_info) - 1;
3872         int extra_info = GET_EXTRA_INFO(array_info);
3873         if (   (indirection == 0)
3874                && ((type == ITEM_Short || type == ITEM_Byte || type == ITEM_Boolean || type == ITEM_Char)))
3875             type = ITEM_Integer;
3876         return MAKE_FULLINFO(type, indirection, extra_info);
3877     }
3878 }
3879 
3880 
3881 /* See if we can assign an object of the "from" type to an object
3882  * of the "to" type.
3883  */
3884 
3885 static jboolean isAssignableTo(context_type *context,
3886                              fullinfo_type from, fullinfo_type to)
3887 {
3888     return (merge_fullinfo_types(context, from, to, JNI_TRUE) == to);
3889 }
3890 
3891 /* Given two fullinfo_type's, find their lowest common denominator.  If
3892  * the assignable_p argument is non-null, we're really just calling to find
3893  * out if "<target> := <value>" is a legitimate assignment.
3894  *
3895  * We treat all interfaces as if they were of type java/lang/Object, since the
3896  * runtime will do the full checking.
3897  */
3898 static fullinfo_type
3899 merge_fullinfo_types(context_type *context,
3900                      fullinfo_type value, fullinfo_type target,
3901                      jboolean for_assignment)
3902 {
3903     JNIEnv *env = context->env;
3904     if (value == target) {
3905         /* If they're identical, clearly just return what we've got */
3906         return value;
3907     }
3908 
3909     /* Both must be either arrays or objects to go further */
3910     if (GET_INDIRECTION(value) == 0 && GET_ITEM_TYPE(value) != ITEM_Object)
3911         return MAKE_FULLINFO(ITEM_Bogus, 0, 0);
3912     if (GET_INDIRECTION(target) == 0 && GET_ITEM_TYPE(target) != ITEM_Object)
3913         return MAKE_FULLINFO(ITEM_Bogus, 0, 0);
3914 
3915     /* If either is NULL, return the other. */
3916     if (value == NULL_FULLINFO)
3917         return target;
3918     else if (target == NULL_FULLINFO)
3919         return value;
3920 
3921     /* If either is java/lang/Object, that's the result. */
3922     if (target == context->object_info)
3923         return target;
3924     else if (value == context->object_info) {
3925         /* Minor hack.  For assignments, Interface := Object, return Interface
3926          * rather than Object, so that isAssignableTo() will get the right
3927          * result.      */
3928         if (for_assignment && (WITH_ZERO_EXTRA_INFO(target) ==
3929                                   MAKE_FULLINFO(ITEM_Object, 0, 0))) {
3930             jclass cb = object_fullinfo_to_classclass(context,
3931                                                       target);
3932             int is_interface = cb && JVM_IsInterface(env, cb);
3933             if (is_interface)
3934                 return target;
3935         }
3936         return value;
3937     }
3938     if (GET_INDIRECTION(value) > 0 || GET_INDIRECTION(target) > 0) {
3939         /* At least one is an array.  Neither is java/lang/Object or NULL.
3940          * Moreover, the types are not identical.
3941          * The result must either be Object, or an array of some object type.
3942          */
3943         fullinfo_type value_base, target_base;
3944         int dimen_value = GET_INDIRECTION(value);
3945         int dimen_target = GET_INDIRECTION(target);
3946 
3947         if (target == context->cloneable_info ||
3948             target == context->serializable_info) {
3949             return target;
3950         }
3951 
3952         if (value == context->cloneable_info ||
3953             value == context->serializable_info) {
3954             return value;
3955         }
3956 
3957         /* First, if either item's base type isn't ITEM_Object, promote it up
3958          * to an object or array of object.  If either is elemental, we can
3959          * punt.
3960          */
3961         if (GET_ITEM_TYPE(value) != ITEM_Object) {
3962             if (dimen_value == 0)
3963                 return MAKE_FULLINFO(ITEM_Bogus, 0, 0);
3964             dimen_value--;
3965             value = MAKE_Object_ARRAY(dimen_value);
3966 
3967         }
3968         if (GET_ITEM_TYPE(target) != ITEM_Object) {
3969             if (dimen_target == 0)
3970                 return MAKE_FULLINFO(ITEM_Bogus, 0, 0);
3971             dimen_target--;
3972             target = MAKE_Object_ARRAY(dimen_target);
3973         }
3974         /* Both are now objects or arrays of some sort of object type */
3975         value_base = WITH_ZERO_INDIRECTION(value);
3976         target_base = WITH_ZERO_INDIRECTION(target);
3977         if (dimen_value == dimen_target) {
3978             /* Arrays of the same dimension.  Merge their base types. */
3979             fullinfo_type  result_base =
3980                 merge_fullinfo_types(context, value_base, target_base,
3981                                             for_assignment);
3982             if (result_base == MAKE_FULLINFO(ITEM_Bogus, 0, 0))
3983                 /* bogus in, bogus out */
3984                 return result_base;
3985             return MAKE_FULLINFO(ITEM_Object, dimen_value,
3986                                  GET_EXTRA_INFO(result_base));
3987         } else {
3988             /* Arrays of different sizes. If the smaller dimension array's base
3989              * type is java/lang/Cloneable or java/io/Serializable, return it.
3990              * Otherwise return java/lang/Object with a dimension of the smaller
3991              * of the two */
3992             if (dimen_value < dimen_target) {
3993                 if (value_base == context->cloneable_info ||
3994                     value_base == context ->serializable_info) {
3995                     return value;
3996                 }
3997                 return MAKE_Object_ARRAY(dimen_value);
3998             } else {
3999                 if (target_base == context->cloneable_info ||
4000                     target_base == context->serializable_info) {
4001                     return target;
4002                 }
4003                 return MAKE_Object_ARRAY(dimen_target);
4004             }
4005         }
4006     } else {
4007         /* Both are non-array objects. Neither is java/lang/Object or NULL */
4008         jclass cb_value, cb_target, cb_super_value, cb_super_target;
4009         fullinfo_type result_info;
4010 
4011         /* Let's get the classes corresponding to each of these.  Treat
4012          * interfaces as if they were java/lang/Object.  See hack note above. */
4013         cb_target = object_fullinfo_to_classclass(context, target);
4014         if (cb_target == 0)
4015             return MAKE_FULLINFO(ITEM_Bogus, 0, 0);
4016         if (JVM_IsInterface(env, cb_target))
4017             return for_assignment ? target : context->object_info;
4018         cb_value = object_fullinfo_to_classclass(context, value);
4019         if (cb_value == 0)
4020             return MAKE_FULLINFO(ITEM_Bogus, 0, 0);
4021         if (JVM_IsInterface(env, cb_value))
4022             return context->object_info;
4023 
4024         /* If this is for assignment of target := value, we just need to see if
4025          * cb_target is a superclass of cb_value.  Save ourselves a lot of
4026          * work.
4027          */
4028         if (for_assignment) {
4029             cb_super_value = (*env)->GetSuperclass(env, cb_value);
4030             while (cb_super_value != 0) {
4031                 jclass tmp_cb;
4032                 if ((*env)->IsSameObject(env, cb_super_value, cb_target)) {
4033                     (*env)->DeleteLocalRef(env, cb_super_value);
4034                     return target;
4035                 }
4036                 tmp_cb =  (*env)->GetSuperclass(env, cb_super_value);
4037                 (*env)->DeleteLocalRef(env, cb_super_value);
4038                 cb_super_value = tmp_cb;
4039             }
4040             (*env)->DeleteLocalRef(env, cb_super_value);
4041             return context->object_info;
4042         }
4043 
4044         /* Find out whether cb_value or cb_target is deeper in the class
4045          * tree by moving both toward the root, and seeing who gets there
4046          * first.                                                          */
4047         cb_super_value = (*env)->GetSuperclass(env, cb_value);
4048         cb_super_target = (*env)->GetSuperclass(env, cb_target);
4049         while((cb_super_value != 0) &&
4050               (cb_super_target != 0)) {
4051             jclass tmp_cb;
4052             /* Optimization.  If either hits the other when going up looking
4053              * for a parent, then might as well return the parent immediately */
4054             if ((*env)->IsSameObject(env, cb_super_value, cb_target)) {
4055                 (*env)->DeleteLocalRef(env, cb_super_value);
4056                 (*env)->DeleteLocalRef(env, cb_super_target);
4057                 return target;
4058             }
4059             if ((*env)->IsSameObject(env, cb_super_target, cb_value)) {
4060                 (*env)->DeleteLocalRef(env, cb_super_value);
4061                 (*env)->DeleteLocalRef(env, cb_super_target);
4062                 return value;
4063             }
4064             tmp_cb = (*env)->GetSuperclass(env, cb_super_value);
4065             (*env)->DeleteLocalRef(env, cb_super_value);
4066             cb_super_value = tmp_cb;
4067 
4068             tmp_cb = (*env)->GetSuperclass(env, cb_super_target);
4069             (*env)->DeleteLocalRef(env, cb_super_target);
4070             cb_super_target = tmp_cb;
4071         }
4072         cb_value = (*env)->NewLocalRef(env, cb_value);
4073         cb_target = (*env)->NewLocalRef(env, cb_target);
4074         /* At most one of the following two while clauses will be executed.
4075          * Bring the deeper of cb_target and cb_value to the depth of the
4076          * shallower one.
4077          */
4078         while (cb_super_value != 0) {
4079           /* cb_value is deeper */
4080             jclass cb_tmp;
4081 
4082             cb_tmp = (*env)->GetSuperclass(env, cb_super_value);
4083             (*env)->DeleteLocalRef(env, cb_super_value);
4084             cb_super_value = cb_tmp;
4085 
4086             cb_tmp = (*env)->GetSuperclass(env, cb_value);
4087             (*env)->DeleteLocalRef(env, cb_value);
4088             cb_value = cb_tmp;
4089         }
4090         while (cb_super_target != 0) {
4091           /* cb_target is deeper */
4092             jclass cb_tmp;
4093 
4094             cb_tmp = (*env)->GetSuperclass(env, cb_super_target);
4095             (*env)->DeleteLocalRef(env, cb_super_target);
4096             cb_super_target = cb_tmp;
4097 
4098             cb_tmp = (*env)->GetSuperclass(env, cb_target);
4099             (*env)->DeleteLocalRef(env, cb_target);
4100             cb_target = cb_tmp;
4101         }
4102 
4103         /* Walk both up, maintaining equal depth, until a join is found.  We
4104          * know that we will find one.  */
4105         while (!(*env)->IsSameObject(env, cb_value, cb_target)) {
4106             jclass cb_tmp;
4107             cb_tmp = (*env)->GetSuperclass(env, cb_value);
4108             (*env)->DeleteLocalRef(env, cb_value);
4109             cb_value = cb_tmp;
4110             cb_tmp = (*env)->GetSuperclass(env, cb_target);
4111             (*env)->DeleteLocalRef(env, cb_target);
4112             cb_target = cb_tmp;
4113         }
4114         result_info = make_class_info(context, cb_value);
4115         (*env)->DeleteLocalRef(env, cb_value);
4116         (*env)->DeleteLocalRef(env, cb_super_value);
4117         (*env)->DeleteLocalRef(env, cb_target);
4118         (*env)->DeleteLocalRef(env, cb_super_target);
4119         return result_info;
4120     } /* both items are classes */
4121 }
4122 
4123 
4124 /* Given a fullinfo_type corresponding to an Object, return the jclass
4125  * of that type.
4126  *
4127  * This function always returns a global reference!
4128  */
4129 
4130 static jclass
4131 object_fullinfo_to_classclass(context_type *context, fullinfo_type classinfo)
4132 {
4133     unsigned short info = GET_EXTRA_INFO(classinfo);
4134     return ID_to_class(context, info);
4135 }
4136 
4137 static void free_block(void *ptr, int kind)
4138 {
4139     switch (kind) {
4140     case VM_STRING_UTF:
4141         JVM_ReleaseUTF(ptr);
4142         break;
4143     case VM_MALLOC_BLK:
4144         free(ptr);
4145         break;
4146     }
4147 }
4148 
4149 static void check_and_push_common(context_type *context, void *ptr, int kind)
4150 {
4151     alloc_stack_type *p;
4152     if (ptr == 0)
4153         CCout_of_memory(context);
4154     if (context->alloc_stack_top < ALLOC_STACK_SIZE)
4155         p = &(context->alloc_stack[context->alloc_stack_top++]);
4156     else {
4157         /* Otherwise we have to malloc */
4158         p = malloc(sizeof(alloc_stack_type));
4159         if (p == 0) {
4160             /* Make sure we clean up. */
4161             free_block(ptr, kind);
4162             CCout_of_memory(context);
4163         }
4164     }
4165     p->kind = kind;
4166     p->ptr = ptr;
4167     p->next = context->allocated_memory;
4168     context->allocated_memory = p;
4169 }
4170 
4171 static void check_and_push_malloc_block(context_type *context, void *ptr) {
4172   check_and_push_common(context, ptr, VM_MALLOC_BLK);
4173 }
4174 
4175 static void check_and_push_string_utf(context_type *context, const char *ptr) {
4176   check_and_push_common(context, (void *)ptr, VM_STRING_UTF);
4177 }
4178 
4179 static void pop_and_free(context_type *context)
4180 {
4181     alloc_stack_type *p = context->allocated_memory;
4182     context->allocated_memory = p->next;
4183     free_block(p->ptr, p->kind);
4184     if (p < context->alloc_stack + ALLOC_STACK_SIZE &&
4185         p >= context->alloc_stack)
4186         context->alloc_stack_top--;
4187     else
4188         free(p);
4189 }
4190 
4191 static int signature_to_args_size(const char *method_signature)
4192 {
4193     const char *p;
4194     int args_size = 0;
4195     for (p = method_signature; *p != JVM_SIGNATURE_ENDFUNC; p++) {
4196         switch (*p) {
4197           case JVM_SIGNATURE_BOOLEAN:
4198           case JVM_SIGNATURE_BYTE:
4199           case JVM_SIGNATURE_CHAR:
4200           case JVM_SIGNATURE_SHORT:
4201           case JVM_SIGNATURE_INT:
4202           case JVM_SIGNATURE_FLOAT:
4203             args_size += 1;
4204             break;
4205           case JVM_SIGNATURE_CLASS:
4206             args_size += 1;
4207             while (*p != JVM_SIGNATURE_ENDCLASS) p++;
4208             break;
4209           case JVM_SIGNATURE_ARRAY:
4210             args_size += 1;
4211             while ((*p == JVM_SIGNATURE_ARRAY)) p++;
4212             /* If an array of classes, skip over class name, too. */
4213             if (*p == JVM_SIGNATURE_CLASS) {
4214                 while (*p != JVM_SIGNATURE_ENDCLASS)
4215                   p++;
4216             }
4217             break;
4218           case JVM_SIGNATURE_DOUBLE:
4219           case JVM_SIGNATURE_LONG:
4220             args_size += 2;
4221             break;
4222           case JVM_SIGNATURE_FUNC:  /* ignore initial (, if given */
4223             break;
4224           default:
4225             /* Indicate an error. */
4226             return 0;
4227         }
4228     }
4229     return args_size;
4230 }
4231 
4232 #ifdef DEBUG
4233 
4234 /* Below are for debugging. */
4235 
4236 static void print_fullinfo_type(context_type *, fullinfo_type, jboolean);
4237 
4238 static void
4239 print_stack(context_type *context, stack_info_type *stack_info)
4240 {
4241     stack_item_type *stack = stack_info->stack;
4242     if (stack_info->stack_size == UNKNOWN_STACK_SIZE) {
4243         jio_fprintf(stdout, "x");
4244     } else {
4245         jio_fprintf(stdout, "(");
4246         for ( ; stack != 0; stack = stack->next)
4247             print_fullinfo_type(context, stack->item,
4248                 (jboolean)(verify_verbose > 1 ? JNI_TRUE : JNI_FALSE));
4249         jio_fprintf(stdout, ")");
4250     }
4251 }
4252 
4253 static void
4254 print_registers(context_type *context, register_info_type *register_info)
4255 {
4256     int register_count = register_info->register_count;
4257     if (register_count == UNKNOWN_REGISTER_COUNT) {
4258         jio_fprintf(stdout, "x");
4259     } else {
4260         fullinfo_type *registers = register_info->registers;
4261         int mask_count = register_info->mask_count;
4262         mask_type *masks = register_info->masks;
4263         int i, j;
4264 
4265         jio_fprintf(stdout, "{");
4266         for (i = 0; i < register_count; i++)
4267             print_fullinfo_type(context, registers[i],
4268                 (jboolean)(verify_verbose > 1 ? JNI_TRUE : JNI_FALSE));
4269         jio_fprintf(stdout, "}");
4270         for (i = 0; i < mask_count; i++) {
4271             char *separator = "";
4272             int *modifies = masks[i].modifies;
4273             jio_fprintf(stdout, "<%d: ", masks[i].entry);
4274             for (j = 0;
4275                  j < JVM_GetMethodIxLocalsCount(context->env,
4276                                                 context->class,
4277                                                 context->method_index);
4278                  j++)
4279                 if (IS_BIT_SET(modifies, j)) {
4280                     jio_fprintf(stdout, "%s%d", separator, j);
4281                     separator = ",";
4282                 }
4283             jio_fprintf(stdout, ">");
4284         }
4285     }
4286 }
4287 
4288 
4289 static void
4290 print_flags(context_type *context, flag_type and_flags, flag_type or_flags)
4291 {
4292     if (and_flags != ((flag_type)-1) || or_flags != 0) {
4293         jio_fprintf(stdout, "<%x %x>", and_flags, or_flags);
4294     }
4295 }
4296 
4297 static void
4298 print_fullinfo_type(context_type *context, fullinfo_type type, jboolean verbose)
4299 {
4300     int i;
4301     int indirection = GET_INDIRECTION(type);
4302     for (i = indirection; i-- > 0; )
4303         jio_fprintf(stdout, "[");
4304     switch (GET_ITEM_TYPE(type)) {
4305         case ITEM_Integer:
4306             jio_fprintf(stdout, "I"); break;
4307         case ITEM_Float:
4308             jio_fprintf(stdout, "F"); break;
4309         case ITEM_Double:
4310             jio_fprintf(stdout, "D"); break;
4311         case ITEM_Double_2:
4312             jio_fprintf(stdout, "d"); break;
4313         case ITEM_Long:
4314             jio_fprintf(stdout, "L"); break;
4315         case ITEM_Long_2:
4316             jio_fprintf(stdout, "l"); break;
4317         case ITEM_ReturnAddress:
4318             jio_fprintf(stdout, "a"); break;
4319         case ITEM_Object:
4320             if (!verbose) {
4321                 jio_fprintf(stdout, "A");
4322             } else {
4323                 unsigned short extra = GET_EXTRA_INFO(type);
4324                 if (extra == 0) {
4325                     jio_fprintf(stdout, "/Null/");
4326                 } else {
4327                     const char *name = ID_to_class_name(context, extra);
4328                     const char *name2 = strrchr(name, '/');
4329                     jio_fprintf(stdout, "/%s/", name2 ? name2 + 1 : name);
4330                 }
4331             }
4332             break;
4333         case ITEM_Char:
4334             jio_fprintf(stdout, "C"); break;
4335         case ITEM_Short:
4336             jio_fprintf(stdout, "S"); break;
4337         case ITEM_Boolean:
4338             jio_fprintf(stdout, "Z"); break;
4339         case ITEM_Byte:
4340             jio_fprintf(stdout, "B"); break;
4341         case ITEM_NewObject:
4342             if (!verbose) {
4343                 jio_fprintf(stdout, "@");
4344             } else {
4345                 int inum = GET_EXTRA_INFO(type);
4346                 fullinfo_type real_type =
4347                     context->instruction_data[inum].operand2.fi;
4348                 jio_fprintf(stdout, ">");
4349                 print_fullinfo_type(context, real_type, JNI_TRUE);
4350                 jio_fprintf(stdout, "<");
4351             }
4352             break;
4353         case ITEM_InitObject:
4354             jio_fprintf(stdout, verbose ? ">/this/<" : "@");
4355             break;
4356 
4357         default:
4358             jio_fprintf(stdout, "?"); break;
4359     }
4360     for (i = indirection; i-- > 0; )
4361         jio_fprintf(stdout, "]");
4362 }
4363 
4364 
4365 static void
4366 print_formatted_fieldname(context_type *context, int index)
4367 {
4368     JNIEnv *env = context->env;
4369     jclass cb = context->class;
4370     const char *classname = JVM_GetCPFieldClassNameUTF(env, cb, index);
4371     const char *fieldname = JVM_GetCPFieldNameUTF(env, cb, index);
4372     jio_fprintf(stdout, "  <%s.%s>",
4373                 classname ? classname : "", fieldname ? fieldname : "");
4374     JVM_ReleaseUTF(classname);
4375     JVM_ReleaseUTF(fieldname);
4376 }
4377 
4378 static void
4379 print_formatted_methodname(context_type *context, int index)
4380 {
4381     JNIEnv *env = context->env;
4382     jclass cb = context->class;
4383     const char *classname = JVM_GetCPMethodClassNameUTF(env, cb, index);
4384     const char *methodname = JVM_GetCPMethodNameUTF(env, cb, index);
4385     jio_fprintf(stdout, "  <%s.%s>",
4386                 classname ? classname : "", methodname ? methodname : "");
4387     JVM_ReleaseUTF(classname);
4388     JVM_ReleaseUTF(methodname);
4389 }
4390 
4391 #endif /*DEBUG*/