1 /*
   2  * Copyright (c) 1994, 2024, Oracle and/or its affiliates. All rights reserved.
   3  * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
   4  *
   5  * This code is free software; you can redistribute it and/or modify it
   6  * under the terms of the GNU General Public License version 2 only, as
   7  * published by the Free Software Foundation.  Oracle designates this
   8  * particular file as subject to the "Classpath" exception as provided
   9  * by Oracle in the LICENSE file that accompanied this code.
  10  *
  11  * This code is distributed in the hope that it will be useful, but WITHOUT
  12  * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
  13  * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
  14  * version 2 for more details (a copy is included in the LICENSE file that
  15  * accompanied this code).
  16  *
  17  * You should have received a copy of the GNU General Public License version
  18  * 2 along with this work; if not, write to the Free Software Foundation,
  19  * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
  20  *
  21  * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
  22  * or visit www.oracle.com if you need additional information or have any
  23  * questions.
  24  */
  25 
  26 /*-
  27  *      Verify that the code within a method block doesn't exploit any
  28  *      security holes.
  29  */
  30 /*
  31    Exported function:
  32 
  33    jboolean
  34    VerifyClassForMajorVersion(JNIEnv *env, jclass cb, char *message_buffer,
  35                               jint buffer_length, jint major_version)
  36 
  37    This file now only uses the standard JNI and the following VM functions
  38    exported in jvm.h:
  39 
  40    JVM_FindClassFromClass
  41    JVM_IsInterface
  42    JVM_GetClassNameUTF
  43    JVM_GetClassCPEntriesCount
  44    JVM_GetClassCPTypes
  45    JVM_GetClassFieldsCount
  46    JVM_GetClassMethodsCount
  47 
  48    JVM_GetFieldIxModifiers
  49 
  50    JVM_GetMethodIxModifiers
  51    JVM_GetMethodIxExceptionTableLength
  52    JVM_GetMethodIxLocalsCount
  53    JVM_GetMethodIxArgsSize
  54    JVM_GetMethodIxMaxStack
  55    JVM_GetMethodIxNameUTF
  56    JVM_GetMethodIxSignatureUTF
  57    JVM_GetMethodIxExceptionsCount
  58    JVM_GetMethodIxExceptionIndexes
  59    JVM_GetMethodIxByteCodeLength
  60    JVM_GetMethodIxByteCode
  61    JVM_GetMethodIxExceptionTableEntry
  62    JVM_IsConstructorIx
  63 
  64    JVM_GetCPClassNameUTF
  65    JVM_GetCPFieldNameUTF
  66    JVM_GetCPMethodNameUTF
  67    JVM_GetCPFieldSignatureUTF
  68    JVM_GetCPMethodSignatureUTF
  69    JVM_GetCPFieldClassNameUTF
  70    JVM_GetCPMethodClassNameUTF
  71    JVM_GetCPFieldModifiers
  72    JVM_GetCPMethodModifiers
  73 
  74    JVM_ReleaseUTF
  75    JVM_IsSameClassPackage
  76 
  77  */
  78 
  79 #include <string.h>
  80 #include <setjmp.h>
  81 #include <assert.h>
  82 #include <limits.h>
  83 #include <stdlib.h>
  84 #include <stdint.h>
  85 
  86 #include "jni.h"
  87 #include "jni_util.h"
  88 #include "jvm.h"
  89 #include "classfile_constants.h"
  90 #include "opcodes.in_out"
  91 
  92 /* On AIX malloc(0) and calloc(0, ...) return a NULL pointer, which is legal,
  93  * but the code here does not handles it. So we wrap the methods and return non-NULL
  94  * pointers even if we allocate 0 bytes.
  95  */
  96 #ifdef _AIX
  97 static int aix_dummy;
  98 static void* aix_malloc(size_t len) {
  99   if (len == 0) {
 100     return &aix_dummy;
 101   }
 102   return malloc(len);
 103 }
 104 
 105 static void* aix_calloc(size_t n, size_t size) {
 106   if (n == 0) {
 107     return &aix_dummy;
 108   }
 109   return calloc(n, size);
 110 }
 111 
 112 static void aix_free(void* p) {
 113   if (p == &aix_dummy) {
 114     return;
 115   }
 116   free(p);
 117 }
 118 
 119 #undef malloc
 120 #undef calloc
 121 #undef free
 122 #define malloc aix_malloc
 123 #define calloc aix_calloc
 124 #define free aix_free
 125 #endif
 126 
 127 #ifdef __APPLE__
 128 /* use setjmp/longjmp versions that do not save/restore the signal mask */
 129 #define setjmp _setjmp
 130 #define longjmp _longjmp
 131 #endif
 132 
 133 #define MAX_ARRAY_DIMENSIONS 255
 134 /* align byte code */
 135 #ifndef ALIGN_UP
 136 #define ALIGN_UP(n,align_grain) (((n) + ((align_grain) - 1)) & ~((align_grain)-1))
 137 #endif /* ALIGN_UP */
 138 #define UCALIGN(n) ((unsigned char *)ALIGN_UP((uintptr_t)(n),sizeof(int)))
 139 
 140 #ifdef DEBUG
 141 
 142 int verify_verbose = 0;
 143 static struct context_type *GlobalContext;
 144 #endif
 145 
 146 enum {
 147     ITEM_Bogus,
 148     ITEM_Void,                  /* only as a function return value */
 149     ITEM_Integer,
 150     ITEM_Float,
 151     ITEM_Double,
 152     ITEM_Double_2,              /* 2nd word of double in register */
 153     ITEM_Long,
 154     ITEM_Long_2,                /* 2nd word of long in register */
 155     ITEM_Array,
 156     ITEM_Object,                /* Extra info field gives name. */
 157     ITEM_NewObject,             /* Like object, but uninitialized. */
 158     ITEM_InitObject,            /* "this" is init method, before call
 159                                     to super() */
 160     ITEM_ReturnAddress,         /* Extra info gives instr # of start pc */
 161     /* The following four are only used within array types.
 162      * Normally, we use ITEM_Integer, instead. */
 163     ITEM_Byte,
 164     ITEM_Short,
 165     ITEM_Char,
 166     ITEM_Boolean
 167 };
 168 
 169 
 170 #define UNKNOWN_STACK_SIZE -1
 171 #define UNKNOWN_REGISTER_COUNT -1
 172 #define UNKNOWN_RET_INSTRUCTION -1
 173 
 174 #undef MAX
 175 #undef MIN
 176 #define MAX(a, b) ((a) > (b) ? (a) : (b))
 177 #define MIN(a, b) ((a) < (b) ? (a) : (b))
 178 
 179 #define BITS_PER_INT   (CHAR_BIT * sizeof(int)/sizeof(char))
 180 #define SET_BIT(flags, i)  (flags[(i)/BITS_PER_INT] |= \
 181                                        ((unsigned)1 << ((i) % BITS_PER_INT)))
 182 #define IS_BIT_SET(flags, i) (flags[(i)/BITS_PER_INT] & \
 183                                        ((unsigned)1 << ((i) % BITS_PER_INT)))
 184 
 185 typedef unsigned int fullinfo_type;
 186 typedef unsigned int *bitvector;
 187 
 188 #define GET_ITEM_TYPE(thing) ((thing) & 0x1F)
 189 #define GET_INDIRECTION(thing) (((thing) & 0xFFFF) >> 5)
 190 #define GET_EXTRA_INFO(thing) ((thing) >> 16)
 191 #define WITH_ZERO_INDIRECTION(thing) ((thing) & ~(0xFFE0))
 192 #define WITH_ZERO_EXTRA_INFO(thing) ((thing) & 0xFFFF)
 193 
 194 #define MAKE_FULLINFO(type, indirect, extra) \
 195      ((type) + ((indirect) << 5) + ((extra) << 16))
 196 
 197 #define MAKE_Object_ARRAY(indirect) \
 198        (context->object_info + ((indirect) << 5))
 199 
 200 #define NULL_FULLINFO MAKE_FULLINFO(ITEM_Object, 0, 0)
 201 
 202 /* JVM_OPC_invokespecial calls to <init> need to be treated special */
 203 #define JVM_OPC_invokeinit 0x100
 204 
 205 /* A hash mechanism used by the verifier.
 206  * Maps class names to unique 16 bit integers.
 207  */
 208 
 209 #define HASH_TABLE_SIZE 503
 210 
 211 /* The buckets are managed as a 256 by 256 matrix. We allocate an entire
 212  * row (256 buckets) at a time to minimize fragmentation. Rows are
 213  * allocated on demand so that we don't waste too much space.
 214  */
 215 
 216 #define MAX_HASH_ENTRIES 65536
 217 #define HASH_ROW_SIZE 256
 218 
 219 typedef struct hash_bucket_type {
 220     char *name;
 221     unsigned int hash;
 222     jclass class;
 223     unsigned short ID;
 224     unsigned short next;
 225     unsigned loadable:1;  /* from context->class loader */
 226 } hash_bucket_type;
 227 
 228 typedef struct {
 229     hash_bucket_type **buckets;
 230     unsigned short *table;
 231     int entries_used;
 232 } hash_table_type;
 233 
 234 #define GET_BUCKET(class_hash, ID)\
 235     (class_hash->buckets[ID / HASH_ROW_SIZE] + ID % HASH_ROW_SIZE)
 236 
 237 /*
 238  * There are currently two types of resources that we need to keep
 239  * track of (in addition to the CCalloc pool).
 240  */
 241 enum {
 242     VM_STRING_UTF, /* VM-allocated UTF strings */
 243     VM_MALLOC_BLK  /* malloc'ed blocks */
 244 };
 245 
 246 #define LDC_CLASS_MAJOR_VERSION 49
 247 
 248 #define LDC_METHOD_HANDLE_MAJOR_VERSION 51
 249 
 250 #define NONZERO_PADDING_BYTES_IN_SWITCH_MAJOR_VERSION 51
 251 
 252 #define STATIC_METHOD_IN_INTERFACE_MAJOR_VERSION  52
 253 
 254 #define ALLOC_STACK_SIZE 16 /* big enough */
 255 
 256 typedef struct alloc_stack_type {
 257     void *ptr;
 258     int kind;
 259     struct alloc_stack_type *next;
 260 } alloc_stack_type;
 261 
 262 /* The context type encapsulates the current invocation of the byte
 263  * code verifier.
 264  */
 265 struct context_type {
 266 
 267     JNIEnv *env;                /* current JNIEnv */
 268 
 269     /* buffers etc. */
 270     char *message;
 271     jint message_buf_len;
 272     jboolean err_code;
 273 
 274     alloc_stack_type *allocated_memory; /* all memory blocks that we have not
 275                                            had a chance to free */
 276     /* Store up to ALLOC_STACK_SIZE number of handles to allocated memory
 277        blocks here, to save mallocs. */
 278     alloc_stack_type alloc_stack[ALLOC_STACK_SIZE];
 279     int alloc_stack_top;
 280 
 281     /* these fields are per class */
 282     jclass class;               /* current class */
 283     jint major_version;
 284     jint nconstants;
 285     unsigned char *constant_types;
 286     hash_table_type class_hash;
 287 
 288     fullinfo_type object_info;  /* fullinfo for java/lang/Object */
 289     fullinfo_type string_info;  /* fullinfo for java/lang/String */
 290     fullinfo_type throwable_info; /* fullinfo for java/lang/Throwable */
 291     fullinfo_type cloneable_info; /* fullinfo for java/lang/Cloneable */
 292     fullinfo_type serializable_info; /* fullinfo for java/io/Serializable */
 293 
 294     fullinfo_type currentclass_info; /* fullinfo for context->class */
 295     fullinfo_type superclass_info;   /* fullinfo for superclass */
 296 
 297     /* these fields are per method */
 298     int method_index;   /* current method */
 299     unsigned short *exceptions; /* exceptions */
 300     unsigned char *code;        /* current code object */
 301     jint code_length;
 302     int *code_data;             /* offset to instruction number */
 303     struct instruction_data_type *instruction_data; /* info about each */
 304     struct handler_info_type *handler_info;
 305     fullinfo_type *superclasses; /* null terminated superclasses */
 306     int instruction_count;      /* number of instructions */
 307     fullinfo_type return_type;  /* function return type */
 308     fullinfo_type swap_table[4]; /* used for passing information */
 309     int bitmask_size;           /* words needed to hold bitmap of arguments */
 310 
 311     /* these fields are per field */
 312     int field_index;
 313 
 314     /* Used by the space allocator */
 315     struct CCpool *CCroot, *CCcurrent;
 316     char *CCfree_ptr;
 317     int CCfree_size;
 318 
 319     /* Jump here on any error. */
 320     jmp_buf jump_buffer;
 321 
 322 #ifdef DEBUG
 323     /* keep track of how many global refs are allocated. */
 324     int n_globalrefs;
 325 #endif
 326 };
 327 
 328 struct stack_info_type {
 329     struct stack_item_type *stack;
 330     int stack_size;
 331 };
 332 
 333 struct register_info_type {
 334     int register_count;         /* number of registers used */
 335     fullinfo_type *registers;
 336     int mask_count;             /* number of masks in the following */
 337     struct mask_type *masks;
 338 };
 339 
 340 struct mask_type {
 341     int entry;
 342     int *modifies;
 343 };
 344 
 345 typedef unsigned short flag_type;
 346 
 347 struct instruction_data_type {
 348     int opcode;         /* may turn into "canonical" opcode */
 349     unsigned changed:1;         /* has it changed */
 350     unsigned protected:1;       /* must accessor be a subclass of "this" */
 351     union {
 352         int i;                  /* operand to the opcode */
 353         int *ip;
 354         fullinfo_type fi;
 355     } operand, operand2;
 356     fullinfo_type p;
 357     struct stack_info_type stack_info;
 358     struct register_info_type register_info;
 359 #define FLAG_REACHED            0x01 /* instruction reached */
 360 #define FLAG_NEED_CONSTRUCTOR   0x02 /* must call this.<init> or super.<init> */
 361 #define FLAG_NO_RETURN          0x04 /* must throw out of method */
 362     flag_type or_flags;         /* true for at least one path to this inst */
 363 #define FLAG_CONSTRUCTED        0x01 /* this.<init> or super.<init> called */
 364     flag_type and_flags;        /* true for all paths to this instruction */
 365 };
 366 
 367 struct handler_info_type {
 368     int start, end, handler;
 369     struct stack_info_type stack_info;
 370 };
 371 
 372 struct stack_item_type {
 373     fullinfo_type item;
 374     struct stack_item_type *next;
 375 };
 376 
 377 typedef struct context_type context_type;
 378 typedef struct instruction_data_type instruction_data_type;
 379 typedef struct stack_item_type stack_item_type;
 380 typedef struct register_info_type register_info_type;
 381 typedef struct stack_info_type stack_info_type;
 382 typedef struct mask_type mask_type;
 383 
 384 static void read_all_code(context_type *context, jclass cb, int num_methods,
 385                           int** code_lengths, unsigned char*** code);
 386 static void verify_method(context_type *context, jclass cb, int index,
 387                           int code_length, unsigned char* code);
 388 static void free_all_code(context_type* context, int num_methods,
 389                           unsigned char** code);
 390 static void verify_field(context_type *context, jclass cb, int index);
 391 
 392 static void verify_opcode_operands (context_type *, unsigned int inumber, int offset);
 393 static void set_protected(context_type *, unsigned int inumber, int key, int);
 394 static jboolean is_superclass(context_type *, fullinfo_type);
 395 
 396 static void initialize_exception_table(context_type *);
 397 static int instruction_length(unsigned char *iptr, unsigned char *end);
 398 static jboolean isLegalOffset(context_type *, int bci, int offset);
 399 static jboolean isLegalTarget(context_type *, int target);
 400 static void verify_constant_pool_type(context_type *, int, unsigned);
 401 
 402 static void initialize_dataflow(context_type *);
 403 static void run_dataflow(context_type *context);
 404 static void check_register_values(context_type *context, unsigned int inumber);
 405 static void check_flags(context_type *context, unsigned int inumber);
 406 static void pop_stack(context_type *, unsigned int inumber, stack_info_type *);
 407 static void update_registers(context_type *, unsigned int inumber, register_info_type *);
 408 static void update_flags(context_type *, unsigned int inumber,
 409                          flag_type *new_and_flags, flag_type *new_or_flags);
 410 static void push_stack(context_type *, unsigned int inumber, stack_info_type *stack);
 411 
 412 static void merge_into_successors(context_type *, unsigned int inumber,
 413                                   register_info_type *register_info,
 414                                   stack_info_type *stack_info,
 415                                   flag_type and_flags, flag_type or_flags);
 416 static void merge_into_one_successor(context_type *context,
 417                                      unsigned int from_inumber,
 418                                      unsigned int inumber,
 419                                      register_info_type *register_info,
 420                                      stack_info_type *stack_info,
 421                                      flag_type and_flags, flag_type or_flags,
 422                                      jboolean isException);
 423 static void merge_stack(context_type *, unsigned int inumber,
 424                         unsigned int to_inumber, stack_info_type *);
 425 static void merge_registers(context_type *, unsigned int inumber,
 426                             unsigned int to_inumber,
 427                             register_info_type *);
 428 static void merge_flags(context_type *context, unsigned int from_inumber,
 429                         unsigned int to_inumber,
 430                         flag_type new_and_flags, flag_type new_or_flags);
 431 
 432 static stack_item_type *copy_stack(context_type *, stack_item_type *);
 433 static mask_type *copy_masks(context_type *, mask_type *masks, int mask_count);
 434 static mask_type *add_to_masks(context_type *, mask_type *, int , int);
 435 
 436 static fullinfo_type decrement_indirection(fullinfo_type);
 437 
 438 static fullinfo_type merge_fullinfo_types(context_type *context,
 439                                           fullinfo_type a,
 440                                           fullinfo_type b,
 441                                           jboolean assignment);
 442 static jboolean isAssignableTo(context_type *,
 443                                fullinfo_type a,
 444                                fullinfo_type b);
 445 
 446 static jclass object_fullinfo_to_classclass(context_type *, fullinfo_type);
 447 
 448 
 449 #define NEW(type, count) \
 450         ((type *)CCalloc(context, (count)*(sizeof(type)), JNI_FALSE))
 451 #define ZNEW(type, count) \
 452         ((type *)CCalloc(context, (count)*(sizeof(type)), JNI_TRUE))
 453 
 454 static void CCinit(context_type *context);
 455 static void CCreinit(context_type *context);
 456 static void CCdestroy(context_type *context);
 457 static void *CCalloc(context_type *context, int size, jboolean zero);
 458 
 459 static fullinfo_type cp_index_to_class_fullinfo(context_type *, int, int);
 460 
 461 static const char* get_result_signature(const char* signature);
 462 
 463 static char signature_to_fieldtype(context_type *context,
 464                                    const char **signature_p, fullinfo_type *info);
 465 
 466 static void CCerror (context_type *, char *format, ...);
 467 static void CFerror (context_type *, char *format, ...);
 468 static void CCout_of_memory (context_type *);
 469 
 470 /* Because we can longjmp any time, we need to be very careful about
 471  * remembering what needs to be freed. */
 472 
 473 static void check_and_push_malloc_block(context_type *context, void *ptr);
 474 static void check_and_push_string_utf(context_type *context, const char *ptr);
 475 static void pop_and_free(context_type *context);
 476 
 477 static int signature_to_args_size(const char *method_signature);
 478 
 479 #ifdef DEBUG
 480 static void print_stack (context_type *, stack_info_type *stack_info);
 481 static void print_registers(context_type *, register_info_type *register_info);
 482 static void print_flags(context_type *, flag_type, flag_type);
 483 static void print_formatted_fieldname(context_type *context, int index);
 484 static void print_formatted_methodname(context_type *context, int index);
 485 #endif
 486 
 487 /*
 488  * Declare library specific JNI_Onload entry if static build
 489  */
 490 DEF_STATIC_JNI_OnLoad
 491 
 492 void initialize_class_hash(context_type *context)
 493 {
 494     hash_table_type *class_hash = &(context->class_hash);
 495     class_hash->buckets = (hash_bucket_type **)
 496         calloc(MAX_HASH_ENTRIES / HASH_ROW_SIZE, sizeof(hash_bucket_type *));
 497     class_hash->table = (unsigned short *)
 498         calloc(HASH_TABLE_SIZE, sizeof(unsigned short));
 499     if (class_hash->buckets == 0 ||
 500         class_hash->table == 0)
 501         CCout_of_memory(context);
 502     class_hash->entries_used = 0;
 503 }
 504 
 505 static void finalize_class_hash(context_type *context)
 506 {
 507     hash_table_type *class_hash = &(context->class_hash);
 508     JNIEnv *env = context->env;
 509     int i;
 510     /* 4296677: bucket index starts from 1. */
 511     for (i=1;i<=class_hash->entries_used;i++) {
 512         hash_bucket_type *bucket = GET_BUCKET(class_hash, i);
 513         assert(bucket != NULL);
 514         free(bucket->name);
 515         if (bucket->class) {
 516             (*env)->DeleteGlobalRef(env, bucket->class);
 517 #ifdef DEBUG
 518             context->n_globalrefs--;
 519 #endif
 520         }
 521     }
 522     if (class_hash->buckets) {
 523         for (i=0;i<MAX_HASH_ENTRIES / HASH_ROW_SIZE; i++) {
 524             if (class_hash->buckets[i] == 0)
 525                 break;
 526             free(class_hash->buckets[i]);
 527         }
 528     }
 529     free(class_hash->buckets);
 530     free(class_hash->table);
 531 }
 532 
 533 static hash_bucket_type *
 534 new_bucket(context_type *context, unsigned short *pID)
 535 {
 536     hash_table_type *class_hash = &(context->class_hash);
 537     int i = *pID = class_hash->entries_used + 1;
 538     int row = i / HASH_ROW_SIZE;
 539     if (i >= MAX_HASH_ENTRIES)
 540         CCerror(context, "Exceeded verifier's limit of 65535 referred classes");
 541     if (class_hash->buckets[row] == 0) {
 542         class_hash->buckets[row] = (hash_bucket_type*)
 543             calloc(HASH_ROW_SIZE, sizeof(hash_bucket_type));
 544         if (class_hash->buckets[row] == 0)
 545             CCout_of_memory(context);
 546     }
 547     class_hash->entries_used++; /* only increment when we are sure there
 548                                    is no overflow. */
 549     return GET_BUCKET(class_hash, i);
 550 }
 551 
 552 static unsigned int
 553 class_hash_fun(const char *s)
 554 {
 555     int i;
 556     unsigned raw_hash;
 557     for (raw_hash = 0; (i = *s) != '\0'; ++s)
 558         raw_hash = raw_hash * 37 + i;
 559     return raw_hash;
 560 }
 561 
 562 /*
 563  * Find a class using the defining loader of the current class
 564  * and return a local reference to it.
 565  */
 566 static jclass load_class_local(context_type *context,const char *classname)
 567 {
 568     jclass cb = JVM_FindClassFromClass(context->env, classname,
 569                                  JNI_FALSE, context->class);
 570     if (cb == 0)
 571          CCerror(context, "Cannot find class %s", classname);
 572     return cb;
 573 }
 574 
 575 /*
 576  * Find a class using the defining loader of the current class
 577  * and return a global reference to it.
 578  */
 579 static jclass load_class_global(context_type *context, const char *classname)
 580 {
 581     JNIEnv *env = context->env;
 582     jclass local, global;
 583 
 584     local = load_class_local(context, classname);
 585     global = (*env)->NewGlobalRef(env, local);
 586     if (global == 0)
 587         CCout_of_memory(context);
 588 #ifdef DEBUG
 589     context->n_globalrefs++;
 590 #endif
 591     (*env)->DeleteLocalRef(env, local);
 592     return global;
 593 }
 594 
 595 /*
 596  * Return a unique ID given a local class reference. The loadable
 597  * flag is true if the defining class loader of context->class
 598  * is known to be capable of loading the class.
 599  */
 600 static unsigned short
 601 class_to_ID(context_type *context, jclass cb, jboolean loadable)
 602 {
 603     JNIEnv *env = context->env;
 604     hash_table_type *class_hash = &(context->class_hash);
 605     unsigned int hash;
 606     hash_bucket_type *bucket;
 607     unsigned short *pID;
 608     const char *name = JVM_GetClassNameUTF(env, cb);
 609 
 610     check_and_push_string_utf(context, name);
 611     hash = class_hash_fun(name);
 612     pID = &(class_hash->table[hash % HASH_TABLE_SIZE]);
 613     while (*pID) {
 614         bucket = GET_BUCKET(class_hash, *pID);
 615         if (bucket->hash == hash && strcmp(name, bucket->name) == 0) {
 616             /*
 617              * There is an unresolved entry with our name
 618              * so we're forced to load it in case it matches us.
 619              */
 620             if (bucket->class == 0) {
 621                 assert(bucket->loadable == JNI_TRUE);
 622                 bucket->class = load_class_global(context, name);
 623             }
 624 
 625             /*
 626              * It's already in the table. Update the loadable
 627              * state if it's known and then we're done.
 628              */
 629             if ((*env)->IsSameObject(env, cb, bucket->class)) {
 630                 if (loadable && !bucket->loadable)
 631                     bucket->loadable = JNI_TRUE;
 632                 goto done;
 633             }
 634         }
 635         pID = &bucket->next;
 636     }
 637     bucket = new_bucket(context, pID);
 638     bucket->next = 0;
 639     bucket->hash = hash;
 640     bucket->name = malloc(strlen(name) + 1);
 641     if (bucket->name == 0)
 642         CCout_of_memory(context);
 643     strcpy(bucket->name, name);
 644     bucket->loadable = loadable;
 645     bucket->class = (*env)->NewGlobalRef(env, cb);
 646     if (bucket->class == 0)
 647         CCout_of_memory(context);
 648 #ifdef DEBUG
 649     context->n_globalrefs++;
 650 #endif
 651 
 652 done:
 653     pop_and_free(context);
 654     return *pID;
 655 }
 656 
 657 /*
 658  * Return a unique ID given a class name from the constant pool.
 659  * All classes are lazily loaded from the defining loader of
 660  * context->class.
 661  */
 662 static unsigned short
 663 class_name_to_ID(context_type *context, const char *name)
 664 {
 665     hash_table_type *class_hash = &(context->class_hash);
 666     unsigned int hash = class_hash_fun(name);
 667     hash_bucket_type *bucket;
 668     unsigned short *pID;
 669     jboolean force_load = JNI_FALSE;
 670 
 671     pID = &(class_hash->table[hash % HASH_TABLE_SIZE]);
 672     while (*pID) {
 673         bucket = GET_BUCKET(class_hash, *pID);
 674         if (bucket->hash == hash && strcmp(name, bucket->name) == 0) {
 675             if (bucket->loadable)
 676                 goto done;
 677             force_load = JNI_TRUE;
 678         }
 679         pID = &bucket->next;
 680     }
 681 
 682     if (force_load) {
 683         /*
 684          * We found at least one matching named entry for a class that
 685          * was not known to be loadable through the defining class loader
 686          * of context->class. We must load our named class and update
 687          * the hash table in case one these entries matches our class.
 688          */
 689         JNIEnv *env = context->env;
 690         jclass cb = load_class_local(context, name);
 691         unsigned short id = class_to_ID(context, cb, JNI_TRUE);
 692         (*env)->DeleteLocalRef(env, cb);
 693         return id;
 694     }
 695 
 696     bucket = new_bucket(context, pID);
 697     bucket->next = 0;
 698     bucket->class = 0;
 699     bucket->loadable = JNI_TRUE; /* name-only IDs are implicitly loadable */
 700     bucket->hash = hash;
 701     bucket->name = malloc(strlen(name) + 1);
 702     if (bucket->name == 0)
 703         CCout_of_memory(context);
 704     strcpy(bucket->name, name);
 705 
 706 done:
 707     return *pID;
 708 }
 709 
 710 #ifdef DEBUG
 711 static const char *
 712 ID_to_class_name(context_type *context, unsigned short ID)
 713 {
 714     hash_table_type *class_hash = &(context->class_hash);
 715     hash_bucket_type *bucket = GET_BUCKET(class_hash, ID);
 716     return bucket->name;
 717 }
 718 #endif
 719 
 720 static jclass
 721 ID_to_class(context_type *context, unsigned short ID)
 722 {
 723     hash_table_type *class_hash = &(context->class_hash);
 724     hash_bucket_type *bucket = GET_BUCKET(class_hash, ID);
 725     if (bucket->class == 0) {
 726         assert(bucket->loadable == JNI_TRUE);
 727         bucket->class = load_class_global(context, bucket->name);
 728     }
 729     return bucket->class;
 730 }
 731 
 732 static fullinfo_type
 733 make_loadable_class_info(context_type *context, jclass cb)
 734 {
 735     return MAKE_FULLINFO(ITEM_Object, 0,
 736                            class_to_ID(context, cb, JNI_TRUE));
 737 }
 738 
 739 static fullinfo_type
 740 make_class_info(context_type *context, jclass cb)
 741 {
 742     return MAKE_FULLINFO(ITEM_Object, 0,
 743                          class_to_ID(context, cb, JNI_FALSE));
 744 }
 745 
 746 static fullinfo_type
 747 make_class_info_from_name(context_type *context, const char *name)
 748 {
 749     return MAKE_FULLINFO(ITEM_Object, 0,
 750                          class_name_to_ID(context, name));
 751 }
 752 
 753 /* RETURNS
 754  * 1: on success       chosen to be consistent with previous VerifyClass
 755  * 0: verify error
 756  * 2: out of memory
 757  * 3: class format error
 758  *
 759  * Called by verify_class.  Verify the code of each of the methods
 760  * in a class.  Note that this function apparently can't be JNICALL,
 761  * because if it is the dynamic linker doesn't appear to be able to
 762  * find it on Win32.
 763  */
 764 
 765 #define CC_OK 1
 766 #define CC_VerifyError 0
 767 #define CC_OutOfMemory 2
 768 #define CC_ClassFormatError 3
 769 
 770 JNIEXPORT jboolean
 771 VerifyClassForMajorVersion(JNIEnv *env, jclass cb, char *buffer, jint len,
 772                            jint major_version)
 773 {
 774     context_type context_structure;
 775     context_type *context = &context_structure;
 776     jboolean result = CC_OK;
 777     int i;
 778     int num_methods;
 779     int* code_lengths;
 780     unsigned char** code;
 781 
 782 #ifdef DEBUG
 783     GlobalContext = context;
 784 #endif
 785 
 786     memset(context, 0, sizeof(context_type));
 787     context->message = buffer;
 788     context->message_buf_len = len;
 789 
 790     context->env = env;
 791     context->class = cb;
 792 
 793     /* Set invalid method/field index of the context, in case anyone
 794        calls CCerror */
 795     context->method_index = -1;
 796     context->field_index = -1;
 797 
 798     /* Don't call CCerror or anything that can call it above the setjmp! */
 799     if (!setjmp(context->jump_buffer)) {
 800         jclass super;
 801 
 802         CCinit(context);                /* initialize heap; may throw */
 803 
 804         initialize_class_hash(context);
 805 
 806         context->major_version = major_version;
 807         context->nconstants = JVM_GetClassCPEntriesCount(env, cb);
 808         context->constant_types = (unsigned char *)
 809             malloc(sizeof(unsigned char) * context->nconstants + 1);
 810 
 811         if (context->constant_types == 0)
 812             CCout_of_memory(context);
 813 
 814         JVM_GetClassCPTypes(env, cb, context->constant_types);
 815 
 816         if (context->constant_types == 0)
 817             CCout_of_memory(context);
 818 
 819         context->object_info =
 820             make_class_info_from_name(context, "java/lang/Object");
 821         context->string_info =
 822             make_class_info_from_name(context, "java/lang/String");
 823         context->throwable_info =
 824             make_class_info_from_name(context, "java/lang/Throwable");
 825         context->cloneable_info =
 826             make_class_info_from_name(context, "java/lang/Cloneable");
 827         context->serializable_info =
 828             make_class_info_from_name(context, "java/io/Serializable");
 829 
 830         context->currentclass_info = make_loadable_class_info(context, cb);
 831 
 832         super = (*env)->GetSuperclass(env, cb);
 833 
 834         if (super != 0) {
 835             fullinfo_type *gptr;
 836             int i = 0;
 837 
 838             context->superclass_info = make_loadable_class_info(context, super);
 839 
 840             while(super != 0) {
 841                 jclass tmp_cb = (*env)->GetSuperclass(env, super);
 842                 (*env)->DeleteLocalRef(env, super);
 843                 super = tmp_cb;
 844                 i++;
 845             }
 846             (*env)->DeleteLocalRef(env, super);
 847             super = 0;
 848 
 849             /* Can't go on context heap since it survives more than
 850                one method */
 851             context->superclasses = gptr =
 852                 malloc(sizeof(fullinfo_type)*(i + 1));
 853             if (gptr == 0) {
 854                 CCout_of_memory(context);
 855             }
 856 
 857             super = (*env)->GetSuperclass(env, context->class);
 858             while(super != 0) {
 859                 jclass tmp_cb;
 860                 *gptr++ = make_class_info(context, super);
 861                 tmp_cb = (*env)->GetSuperclass(env, super);
 862                 (*env)->DeleteLocalRef(env, super);
 863                 super = tmp_cb;
 864             }
 865             *gptr = 0;
 866         } else {
 867             context->superclass_info = 0;
 868         }
 869 
 870         (*env)->DeleteLocalRef(env, super);
 871 
 872         /* Look at each method */
 873         for (i = JVM_GetClassFieldsCount(env, cb); --i >= 0;)
 874             verify_field(context, cb, i);
 875         num_methods = JVM_GetClassMethodsCount(env, cb);
 876         read_all_code(context, cb, num_methods, &code_lengths, &code);
 877         for (i = num_methods - 1; i >= 0; --i)
 878             verify_method(context, cb, i, code_lengths[i], code[i]);
 879         free_all_code(context, num_methods, code);
 880         result = CC_OK;
 881     } else {
 882         result = context->err_code;
 883     }
 884 
 885     /* Cleanup */
 886     finalize_class_hash(context);
 887 
 888     while(context->allocated_memory)
 889         pop_and_free(context);
 890 
 891 #ifdef DEBUG
 892     GlobalContext = 0;
 893 #endif
 894 
 895     if (context->exceptions)
 896         free(context->exceptions);
 897 
 898     if (context->constant_types)
 899         free(context->constant_types);
 900 
 901     if (context->superclasses)
 902         free(context->superclasses);
 903 
 904 #ifdef DEBUG
 905     /* Make sure all global refs created in the verifier are freed */
 906     assert(context->n_globalrefs == 0);
 907 #endif
 908 
 909     CCdestroy(context);         /* destroy heap */
 910     return result;
 911 }
 912 
 913 static void
 914 verify_field(context_type *context, jclass cb, int field_index)
 915 {
 916     JNIEnv *env = context->env;
 917     int access_bits = JVM_GetFieldIxModifiers(env, cb, field_index);
 918     context->field_index = field_index;
 919 
 920     if (  ((access_bits & JVM_ACC_PUBLIC) != 0) &&
 921           ((access_bits & (JVM_ACC_PRIVATE | JVM_ACC_PROTECTED)) != 0)) {
 922         CCerror(context, "Inconsistent access bits.");
 923     }
 924     context->field_index = -1;
 925 }
 926 
 927 
 928 /**
 929  * We read all of the class's methods' code because it is possible that
 930  * the verification of one method could resulting in linking further
 931  * down the stack (due to class loading), which could end up rewriting
 932  * some of the bytecode of methods we haven't verified yet.  Since we
 933  * don't want to see the rewritten bytecode, cache all the code and
 934  * operate only on that.
 935  */
 936 static void
 937 read_all_code(context_type* context, jclass cb, int num_methods,
 938               int** lengths_addr, unsigned char*** code_addr)
 939 {
 940     int* lengths;
 941     unsigned char** code;
 942     int i;
 943 
 944     lengths = malloc(sizeof(int) * num_methods);
 945     check_and_push_malloc_block(context, lengths);
 946 
 947     code = malloc(sizeof(unsigned char*) * num_methods);
 948     check_and_push_malloc_block(context, code);
 949 
 950     *(lengths_addr) = lengths;
 951     *(code_addr) = code;
 952 
 953     for (i = 0; i < num_methods; ++i) {
 954         lengths[i] = JVM_GetMethodIxByteCodeLength(context->env, cb, i);
 955         if (lengths[i] > 0) {
 956             code[i] = malloc(sizeof(unsigned char) * (lengths[i] + 1));
 957             check_and_push_malloc_block(context, code[i]);
 958             JVM_GetMethodIxByteCode(context->env, cb, i, code[i]);
 959         } else {
 960             code[i] = NULL;
 961         }
 962     }
 963 }
 964 
 965 static void
 966 free_all_code(context_type* context, int num_methods, unsigned char** code)
 967 {
 968   int i;
 969   for (i = 0; i < num_methods; ++i) {
 970       if (code[i] != NULL) {
 971           pop_and_free(context);
 972       }
 973   }
 974   pop_and_free(context); /* code */
 975   pop_and_free(context); /* lengths */
 976 }
 977 
 978 /* Verify the code of one method */
 979 static void
 980 verify_method(context_type *context, jclass cb, int method_index,
 981               int code_length, unsigned char* code)
 982 {
 983     JNIEnv *env = context->env;
 984     int access_bits = JVM_GetMethodIxModifiers(env, cb, method_index);
 985     int *code_data;
 986     instruction_data_type *idata = 0;
 987     int instruction_count;
 988     int i, offset;
 989     unsigned int inumber;
 990     jint nexceptions;
 991 
 992     if ((access_bits & (JVM_ACC_NATIVE | JVM_ACC_ABSTRACT)) != 0) {
 993         /* not much to do for abstract and native methods */
 994         return;
 995     }
 996 
 997     context->code_length = code_length;
 998     context->code = code;
 999 
1000     /* CCerror can give method-specific info once this is set */
1001     context->method_index = method_index;
1002 
1003     CCreinit(context);          /* initial heap */
1004     code_data = NEW(int, code_length);
1005 
1006 #ifdef DEBUG
1007     if (verify_verbose) {
1008         const char *classname = JVM_GetClassNameUTF(env, cb);
1009         const char *methodname =
1010             JVM_GetMethodIxNameUTF(env, cb, method_index);
1011         const char *signature =
1012             JVM_GetMethodIxSignatureUTF(env, cb, method_index);
1013         jio_fprintf(stdout, "Looking at %s.%s%s\n",
1014                     (classname ? classname : ""),
1015                     (methodname ? methodname : ""),
1016                     (signature ? signature : ""));
1017         JVM_ReleaseUTF(classname);
1018         JVM_ReleaseUTF(methodname);
1019         JVM_ReleaseUTF(signature);
1020     }
1021 #endif
1022 
1023     if (((access_bits & JVM_ACC_PUBLIC) != 0) &&
1024         ((access_bits & (JVM_ACC_PRIVATE | JVM_ACC_PROTECTED)) != 0)) {
1025         CCerror(context, "Inconsistent access bits.");
1026     }
1027 
1028     // If this method is an overpass method, which is generated by the VM,
1029     // we trust the code and no check needs to be done.
1030     if (JVM_IsVMGeneratedMethodIx(env, cb, method_index)) {
1031       return;
1032     }
1033 
1034     /* Run through the code.  Mark the start of each instruction, and give
1035      * the instruction a number */
1036     for (i = 0, offset = 0; offset < code_length; i++) {
1037         int length = instruction_length(&code[offset], code + code_length);
1038         int next_offset = offset + length;
1039         if (length <= 0)
1040             CCerror(context, "Illegal instruction found at offset %d", offset);
1041         if (next_offset > code_length)
1042             CCerror(context, "Code stops in the middle of instruction "
1043                     " starting at offset %d", offset);
1044         code_data[offset] = i;
1045         while (++offset < next_offset)
1046             code_data[offset] = -1; /* illegal location */
1047     }
1048     instruction_count = i;      /* number of instructions in code */
1049 
1050     /* Allocate a structure to hold info about each instruction. */
1051     idata = NEW(instruction_data_type, instruction_count);
1052 
1053     /* Initialize the heap, and other info in the context structure. */
1054     context->code = code;
1055     context->instruction_data = idata;
1056     context->code_data = code_data;
1057     context->instruction_count = instruction_count;
1058     context->handler_info =
1059         NEW(struct handler_info_type,
1060             JVM_GetMethodIxExceptionTableLength(env, cb, method_index));
1061     context->bitmask_size =
1062         (JVM_GetMethodIxLocalsCount(env, cb, method_index)
1063          + (BITS_PER_INT - 1))/BITS_PER_INT;
1064 
1065     if (instruction_count == 0)
1066         CCerror(context, "Empty code");
1067 
1068     for (inumber = 0, offset = 0; offset < code_length; inumber++) {
1069         int length = instruction_length(&code[offset], code + code_length);
1070         instruction_data_type *this_idata = &idata[inumber];
1071         this_idata->opcode = code[offset];
1072         this_idata->stack_info.stack = NULL;
1073         this_idata->stack_info.stack_size  = UNKNOWN_STACK_SIZE;
1074         this_idata->register_info.register_count = UNKNOWN_REGISTER_COUNT;
1075         this_idata->changed = JNI_FALSE;  /* no need to look at it yet. */
1076         this_idata->protected = JNI_FALSE;  /* no need to look at it yet. */
1077         this_idata->and_flags = (flag_type) -1; /* "bottom" and value */
1078         this_idata->or_flags = 0; /* "bottom" or value*/
1079         /* This also sets up this_data->operand.  It also makes the
1080          * xload_x and xstore_x instructions look like the generic form. */
1081         verify_opcode_operands(context, inumber, offset);
1082         offset += length;
1083     }
1084 
1085 
1086     /* make sure exception table is reasonable. */
1087     initialize_exception_table(context);
1088     /* Set up first instruction, and start of exception handlers. */
1089     initialize_dataflow(context);
1090     /* Run data flow analysis on the instructions. */
1091     run_dataflow(context);
1092 
1093     /* verify checked exceptions, if any */
1094     nexceptions = JVM_GetMethodIxExceptionsCount(env, cb, method_index);
1095     context->exceptions = (unsigned short *)
1096         malloc(sizeof(unsigned short) * nexceptions + 1);
1097     if (context->exceptions == 0)
1098         CCout_of_memory(context);
1099     JVM_GetMethodIxExceptionIndexes(env, cb, method_index,
1100                                     context->exceptions);
1101     for (i = 0; i < nexceptions; i++) {
1102         /* Make sure the constant pool item is JVM_CONSTANT_Class */
1103         verify_constant_pool_type(context, (int)context->exceptions[i],
1104                                   1 << JVM_CONSTANT_Class);
1105     }
1106     free(context->exceptions);
1107     context->exceptions = 0;
1108     context->code = 0;
1109     context->method_index = -1;
1110 }
1111 
1112 
1113 /* Look at a single instruction, and verify its operands.  Also, for
1114  * simplicity, move the operand into the ->operand field.
1115  * Make sure that branches don't go into the middle of nowhere.
1116  */
1117 
1118 static jint _ck_ntohl(jint n)
1119 {
1120     unsigned char *p = (unsigned char *)&n;
1121     return (p[0] << 24) | (p[1] << 16) | (p[2] << 8) | p[3];
1122 }
1123 
1124 static void
1125 verify_opcode_operands(context_type *context, unsigned int inumber, int offset)
1126 {
1127     JNIEnv *env = context->env;
1128     instruction_data_type *idata = context->instruction_data;
1129     instruction_data_type *this_idata = &idata[inumber];
1130     int *code_data = context->code_data;
1131     int mi = context->method_index;
1132     unsigned char *code = context->code;
1133     int opcode = this_idata->opcode;
1134     int var;
1135 
1136     /*
1137      * Set the ip fields to 0 not the i fields because the ip fields
1138      * are 64 bits on 64 bit architectures, the i field is only 32
1139      */
1140     this_idata->operand.ip = 0;
1141     this_idata->operand2.ip = 0;
1142 
1143     switch (opcode) {
1144 
1145     case JVM_OPC_jsr:
1146         /* instruction of ret statement */
1147         this_idata->operand2.i = UNKNOWN_RET_INSTRUCTION;
1148         /* FALLTHROUGH */
1149     case JVM_OPC_ifeq: case JVM_OPC_ifne: case JVM_OPC_iflt:
1150     case JVM_OPC_ifge: case JVM_OPC_ifgt: case JVM_OPC_ifle:
1151     case JVM_OPC_ifnull: case JVM_OPC_ifnonnull:
1152     case JVM_OPC_if_icmpeq: case JVM_OPC_if_icmpne: case JVM_OPC_if_icmplt:
1153     case JVM_OPC_if_icmpge: case JVM_OPC_if_icmpgt: case JVM_OPC_if_icmple:
1154     case JVM_OPC_if_acmpeq: case JVM_OPC_if_acmpne:
1155     case JVM_OPC_goto: {
1156         /* Set the ->operand to be the instruction number of the target. */
1157         int jump = (((signed char)(code[offset+1])) << 8) + code[offset+2];
1158         if (!isLegalOffset(context, offset, jump))
1159             CCerror(context, "Illegal target of jump or branch");
1160         int target = offset + jump;
1161         this_idata->operand.i = code_data[target];
1162         break;
1163     }
1164 
1165     case JVM_OPC_jsr_w:
1166         /* instruction of ret statement */
1167         this_idata->operand2.i = UNKNOWN_RET_INSTRUCTION;
1168         /* FALLTHROUGH */
1169     case JVM_OPC_goto_w: {
1170         /* Set the ->operand to be the instruction number of the target. */
1171         int jump = (((signed char)(code[offset+1])) << 24) +
1172                      (code[offset+2] << 16) + (code[offset+3] << 8) +
1173                      (code[offset + 4]);
1174         if (!isLegalOffset(context, offset, jump))
1175             CCerror(context, "Illegal target of jump or branch");
1176         int target = offset + jump;
1177         this_idata->operand.i = code_data[target];
1178         break;
1179     }
1180 
1181     case JVM_OPC_tableswitch:
1182     case JVM_OPC_lookupswitch: {
1183         /* Set the ->operand to be a table of possible instruction targets. */
1184         int *lpc = (int *) UCALIGN(code + offset + 1);
1185         int *lptr;
1186         int *saved_operand;
1187         int keys;
1188         int k, delta;
1189 
1190         if (context->major_version < NONZERO_PADDING_BYTES_IN_SWITCH_MAJOR_VERSION) {
1191             /* 4639449, 4647081: Padding bytes must be zero. */
1192             unsigned char* bptr = (unsigned char*) (code + offset + 1);
1193             for (; bptr < (unsigned char*)lpc; bptr++) {
1194                 if (*bptr != 0) {
1195                     CCerror(context, "Non zero padding bytes in switch");
1196                 }
1197             }
1198         }
1199         if (opcode == JVM_OPC_tableswitch) {
1200             keys = _ck_ntohl(lpc[2]) - _ck_ntohl(lpc[1]) + 1;
1201             delta = 1;
1202         } else {
1203             keys = _ck_ntohl(lpc[1]); /* number of pairs */
1204             delta = 2;
1205             /* Make sure that the tableswitch items are sorted */
1206             for (k = keys - 1, lptr = &lpc[2]; --k >= 0; lptr += 2) {
1207                 int this_key = _ck_ntohl(lptr[0]);  /* NB: ntohl may be unsigned */
1208                 int next_key = _ck_ntohl(lptr[2]);
1209                 if (this_key >= next_key) {
1210                     CCerror(context, "Unsorted lookup switch");
1211                 }
1212             }
1213         }
1214         saved_operand = NEW(int, keys + 2);
1215         int jump = _ck_ntohl(lpc[0]);
1216         if (!isLegalOffset(context, offset, jump))
1217             CCerror(context, "Illegal default target in switch");
1218         int target = offset + jump;
1219         saved_operand[keys + 1] = code_data[target];
1220         for (k = keys, lptr = &lpc[3]; --k >= 0; lptr += delta) {
1221             jump = _ck_ntohl(lptr[0]);
1222             if (!isLegalOffset(context, offset, jump))
1223                 CCerror(context, "Illegal branch in tableswitch");
1224             target = offset + jump;
1225             saved_operand[k + 1] = code_data[target];
1226         }
1227         saved_operand[0] = keys + 1; /* number of successors */
1228         this_idata->operand.ip = saved_operand;
1229         break;
1230     }
1231 
1232     case JVM_OPC_ldc: {
1233         /* Make sure the constant pool item is the right type. */
1234         int key = code[offset + 1];
1235         int types = (1 << JVM_CONSTANT_Integer) | (1 << JVM_CONSTANT_Float) |
1236                     (1 << JVM_CONSTANT_String);
1237         if (context->major_version >= LDC_CLASS_MAJOR_VERSION) {
1238             types |= 1 << JVM_CONSTANT_Class;
1239         }
1240         if (context->major_version >= LDC_METHOD_HANDLE_MAJOR_VERSION) {
1241             types |= (1 << JVM_CONSTANT_MethodHandle) |
1242                      (1 << JVM_CONSTANT_MethodType);
1243         }
1244         this_idata->operand.i = key;
1245         verify_constant_pool_type(context, key, types);
1246         break;
1247     }
1248 
1249     case JVM_OPC_ldc_w: {
1250         /* Make sure the constant pool item is the right type. */
1251         int key = (code[offset + 1] << 8) + code[offset + 2];
1252         int types = (1 << JVM_CONSTANT_Integer) | (1 << JVM_CONSTANT_Float) |
1253                     (1 << JVM_CONSTANT_String);
1254         if (context->major_version >= LDC_CLASS_MAJOR_VERSION) {
1255             types |= 1 << JVM_CONSTANT_Class;
1256         }
1257         if (context->major_version >= LDC_METHOD_HANDLE_MAJOR_VERSION) {
1258             types |= (1 << JVM_CONSTANT_MethodHandle) |
1259                      (1 << JVM_CONSTANT_MethodType);
1260         }
1261         this_idata->operand.i = key;
1262         verify_constant_pool_type(context, key, types);
1263         break;
1264     }
1265 
1266     case JVM_OPC_ldc2_w: {
1267         /* Make sure the constant pool item is the right type. */
1268         int key = (code[offset + 1] << 8) + code[offset + 2];
1269         int types = (1 << JVM_CONSTANT_Double) | (1 << JVM_CONSTANT_Long);
1270         this_idata->operand.i = key;
1271         verify_constant_pool_type(context, key, types);
1272         break;
1273     }
1274 
1275     case JVM_OPC_getfield: case JVM_OPC_putfield:
1276     case JVM_OPC_getstatic: case JVM_OPC_putstatic: {
1277         /* Make sure the constant pool item is the right type. */
1278         int key = (code[offset + 1] << 8) + code[offset + 2];
1279         this_idata->operand.i = key;
1280         verify_constant_pool_type(context, key, 1 << JVM_CONSTANT_Fieldref);
1281         if (opcode == JVM_OPC_getfield || opcode == JVM_OPC_putfield)
1282             set_protected(context, inumber, key, opcode);
1283         break;
1284     }
1285 
1286     case JVM_OPC_invokevirtual:
1287     case JVM_OPC_invokespecial:
1288     case JVM_OPC_invokestatic:
1289     case JVM_OPC_invokeinterface: {
1290         /* Make sure the constant pool item is the right type. */
1291         int key = (code[offset + 1] << 8) + code[offset + 2];
1292         const char *methodname;
1293         jclass cb = context->class;
1294         fullinfo_type clazz_info;
1295         int is_constructor, is_internal;
1296         int kind;
1297 
1298         switch (opcode ) {
1299         case JVM_OPC_invokestatic:
1300             kind = ((context->major_version < STATIC_METHOD_IN_INTERFACE_MAJOR_VERSION)
1301                        ? (1 << JVM_CONSTANT_Methodref)
1302                        : ((1 << JVM_CONSTANT_InterfaceMethodref) | (1 << JVM_CONSTANT_Methodref)));
1303             break;
1304         case JVM_OPC_invokeinterface:
1305             kind = 1 << JVM_CONSTANT_InterfaceMethodref;
1306             break;
1307         default:
1308             kind = 1 << JVM_CONSTANT_Methodref;
1309         }
1310 
1311         /* Make sure the constant pool item is the right type. */
1312         verify_constant_pool_type(context, key, kind);
1313         methodname = JVM_GetCPMethodNameUTF(env, cb, key);
1314         check_and_push_string_utf(context, methodname);
1315         is_constructor = !strcmp(methodname, "<init>");
1316         is_internal = methodname[0] == '<';
1317         pop_and_free(context);
1318 
1319         clazz_info = cp_index_to_class_fullinfo(context, key,
1320                                                 JVM_CONSTANT_Methodref);
1321         this_idata->operand.i = key;
1322         this_idata->operand2.fi = clazz_info;
1323         if (is_constructor) {
1324             if (opcode != JVM_OPC_invokespecial) {
1325                 CCerror(context,
1326                         "Must call initializers using invokespecial");
1327             }
1328             this_idata->opcode = JVM_OPC_invokeinit;
1329         } else {
1330             if (is_internal) {
1331                 CCerror(context, "Illegal call to internal method");
1332             }
1333             if (opcode == JVM_OPC_invokespecial
1334                    && clazz_info != context->currentclass_info
1335                    && clazz_info != context->superclass_info) {
1336                 int not_found = 1;
1337 
1338                 jclass super = (*env)->GetSuperclass(env, context->class);
1339                 while(super != 0) {
1340                     jclass tmp_cb;
1341                     fullinfo_type new_info = make_class_info(context, super);
1342                     if (clazz_info == new_info) {
1343                         not_found = 0;
1344                         break;
1345                     }
1346                     tmp_cb = (*env)->GetSuperclass(env, super);
1347                     (*env)->DeleteLocalRef(env, super);
1348                     super = tmp_cb;
1349                 }
1350                 (*env)->DeleteLocalRef(env, super);
1351 
1352                 /* The optimizer may cause this to happen on local code */
1353                 if (not_found) {
1354                     CCerror(context, "Illegal use of nonvirtual function call");
1355                 }
1356             }
1357         }
1358         if (opcode == JVM_OPC_invokeinterface) {
1359             unsigned int args1;
1360             unsigned int args2;
1361             const char *signature =
1362                 JVM_GetCPMethodSignatureUTF(env, context->class, key);
1363             check_and_push_string_utf(context, signature);
1364             args1 = signature_to_args_size(signature) + 1;
1365             args2 = code[offset + 3];
1366             if (args1 != args2) {
1367                 CCerror(context,
1368                         "Inconsistent args_size for invokeinterface");
1369             }
1370             if (code[offset + 4] != 0) {
1371                 CCerror(context,
1372                         "Fourth operand byte of invokeinterface must be zero");
1373             }
1374             pop_and_free(context);
1375         } else if (opcode == JVM_OPC_invokevirtual
1376                       || opcode == JVM_OPC_invokespecial)
1377             set_protected(context, inumber, key, opcode);
1378         break;
1379     }
1380 
1381     case JVM_OPC_invokedynamic:
1382         CCerror(context,
1383                 "invokedynamic bytecode is not supported in this class file version");
1384         break;
1385     case JVM_OPC_instanceof:
1386     case JVM_OPC_checkcast:
1387     case JVM_OPC_new:
1388     case JVM_OPC_anewarray:
1389     case JVM_OPC_multianewarray: {
1390         /* Make sure the constant pool item is a class */
1391         int key = (code[offset + 1] << 8) + code[offset + 2];
1392         fullinfo_type target;
1393         verify_constant_pool_type(context, key, 1 << JVM_CONSTANT_Class);
1394         target = cp_index_to_class_fullinfo(context, key, JVM_CONSTANT_Class);
1395         if (GET_ITEM_TYPE(target) == ITEM_Bogus)
1396             CCerror(context, "Illegal type");
1397         switch(opcode) {
1398         case JVM_OPC_anewarray:
1399             if ((GET_INDIRECTION(target)) >= MAX_ARRAY_DIMENSIONS)
1400                 CCerror(context, "Array with too many dimensions");
1401             this_idata->operand.fi = MAKE_FULLINFO(GET_ITEM_TYPE(target),
1402                                                    GET_INDIRECTION(target) + 1,
1403                                                    GET_EXTRA_INFO(target));
1404             break;
1405         case JVM_OPC_new:
1406             if (WITH_ZERO_EXTRA_INFO(target) !=
1407                              MAKE_FULLINFO(ITEM_Object, 0, 0))
1408                 CCerror(context, "Illegal creation of multi-dimensional array");
1409             /* operand gets set to the "uninitialized object".  operand2 gets
1410              * set to what the value will be after it's initialized. */
1411             this_idata->operand.fi = MAKE_FULLINFO(ITEM_NewObject, 0, inumber);
1412             this_idata->operand2.fi = target;
1413             break;
1414         case JVM_OPC_multianewarray:
1415             this_idata->operand.fi = target;
1416             this_idata->operand2.i = code[offset + 3];
1417             if (    (this_idata->operand2.i > (int)GET_INDIRECTION(target))
1418                  || (this_idata->operand2.i == 0))
1419                 CCerror(context, "Illegal dimension argument");
1420             break;
1421         default:
1422             this_idata->operand.fi = target;
1423         }
1424         break;
1425     }
1426 
1427     case JVM_OPC_newarray: {
1428         /* Cache the result of the JVM_OPC_newarray into the operand slot */
1429         fullinfo_type full_info;
1430         switch (code[offset + 1]) {
1431             case JVM_T_INT:
1432                 full_info = MAKE_FULLINFO(ITEM_Integer, 1, 0); break;
1433             case JVM_T_LONG:
1434                 full_info = MAKE_FULLINFO(ITEM_Long, 1, 0); break;
1435             case JVM_T_FLOAT:
1436                 full_info = MAKE_FULLINFO(ITEM_Float, 1, 0); break;
1437             case JVM_T_DOUBLE:
1438                 full_info = MAKE_FULLINFO(ITEM_Double, 1, 0); break;
1439             case JVM_T_BOOLEAN:
1440                 full_info = MAKE_FULLINFO(ITEM_Boolean, 1, 0); break;
1441             case JVM_T_BYTE:
1442                 full_info = MAKE_FULLINFO(ITEM_Byte, 1, 0); break;
1443             case JVM_T_CHAR:
1444                 full_info = MAKE_FULLINFO(ITEM_Char, 1, 0); break;
1445             case JVM_T_SHORT:
1446                 full_info = MAKE_FULLINFO(ITEM_Short, 1, 0); break;
1447             default:
1448                 full_info = 0;          /* Keep lint happy */
1449                 CCerror(context, "Bad type passed to newarray");
1450         }
1451         this_idata->operand.fi = full_info;
1452         break;
1453     }
1454 
1455     /* Fudge iload_x, aload_x, etc to look like their generic cousin. */
1456     case JVM_OPC_iload_0: case JVM_OPC_iload_1: case JVM_OPC_iload_2: case JVM_OPC_iload_3:
1457         this_idata->opcode = JVM_OPC_iload;
1458         var = opcode - JVM_OPC_iload_0;
1459         goto check_local_variable;
1460 
1461     case JVM_OPC_fload_0: case JVM_OPC_fload_1: case JVM_OPC_fload_2: case JVM_OPC_fload_3:
1462         this_idata->opcode = JVM_OPC_fload;
1463         var = opcode - JVM_OPC_fload_0;
1464         goto check_local_variable;
1465 
1466     case JVM_OPC_aload_0: case JVM_OPC_aload_1: case JVM_OPC_aload_2: case JVM_OPC_aload_3:
1467         this_idata->opcode = JVM_OPC_aload;
1468         var = opcode - JVM_OPC_aload_0;
1469         goto check_local_variable;
1470 
1471     case JVM_OPC_lload_0: case JVM_OPC_lload_1: case JVM_OPC_lload_2: case JVM_OPC_lload_3:
1472         this_idata->opcode = JVM_OPC_lload;
1473         var = opcode - JVM_OPC_lload_0;
1474         goto check_local_variable2;
1475 
1476     case JVM_OPC_dload_0: case JVM_OPC_dload_1: case JVM_OPC_dload_2: case JVM_OPC_dload_3:
1477         this_idata->opcode = JVM_OPC_dload;
1478         var = opcode - JVM_OPC_dload_0;
1479         goto check_local_variable2;
1480 
1481     case JVM_OPC_istore_0: case JVM_OPC_istore_1: case JVM_OPC_istore_2: case JVM_OPC_istore_3:
1482         this_idata->opcode = JVM_OPC_istore;
1483         var = opcode - JVM_OPC_istore_0;
1484         goto check_local_variable;
1485 
1486     case JVM_OPC_fstore_0: case JVM_OPC_fstore_1: case JVM_OPC_fstore_2: case JVM_OPC_fstore_3:
1487         this_idata->opcode = JVM_OPC_fstore;
1488         var = opcode - JVM_OPC_fstore_0;
1489         goto check_local_variable;
1490 
1491     case JVM_OPC_astore_0: case JVM_OPC_astore_1: case JVM_OPC_astore_2: case JVM_OPC_astore_3:
1492         this_idata->opcode = JVM_OPC_astore;
1493         var = opcode - JVM_OPC_astore_0;
1494         goto check_local_variable;
1495 
1496     case JVM_OPC_lstore_0: case JVM_OPC_lstore_1: case JVM_OPC_lstore_2: case JVM_OPC_lstore_3:
1497         this_idata->opcode = JVM_OPC_lstore;
1498         var = opcode - JVM_OPC_lstore_0;
1499         goto check_local_variable2;
1500 
1501     case JVM_OPC_dstore_0: case JVM_OPC_dstore_1: case JVM_OPC_dstore_2: case JVM_OPC_dstore_3:
1502         this_idata->opcode = JVM_OPC_dstore;
1503         var = opcode - JVM_OPC_dstore_0;
1504         goto check_local_variable2;
1505 
1506     case JVM_OPC_wide:
1507         this_idata->opcode = code[offset + 1];
1508         var = (code[offset + 2] << 8) + code[offset + 3];
1509         switch(this_idata->opcode) {
1510             case JVM_OPC_lload:  case JVM_OPC_dload:
1511             case JVM_OPC_lstore: case JVM_OPC_dstore:
1512                 goto check_local_variable2;
1513             default:
1514                 goto check_local_variable;
1515         }
1516 
1517     case JVM_OPC_iinc:              /* the increment amount doesn't matter */
1518     case JVM_OPC_ret:
1519     case JVM_OPC_aload: case JVM_OPC_iload: case JVM_OPC_fload:
1520     case JVM_OPC_astore: case JVM_OPC_istore: case JVM_OPC_fstore:
1521         var = code[offset + 1];
1522     check_local_variable:
1523         /* Make sure that the variable number isn't illegal. */
1524         this_idata->operand.i = var;
1525         if (var >= JVM_GetMethodIxLocalsCount(env, context->class, mi))
1526             CCerror(context, "Illegal local variable number");
1527         break;
1528 
1529     case JVM_OPC_lload: case JVM_OPC_dload: case JVM_OPC_lstore: case JVM_OPC_dstore:
1530         var = code[offset + 1];
1531     check_local_variable2:
1532         /* Make sure that the variable number isn't illegal. */
1533         this_idata->operand.i = var;
1534         if ((var + 1) >= JVM_GetMethodIxLocalsCount(env, context->class, mi))
1535             CCerror(context, "Illegal local variable number");
1536         break;
1537 
1538     default:
1539         if (opcode > JVM_OPC_MAX)
1540             CCerror(context, "Quick instructions shouldn't appear yet.");
1541         break;
1542     } /* of switch */
1543 }
1544 
1545 
1546 static void
1547 set_protected(context_type *context, unsigned int inumber, int key, int opcode)
1548 {
1549     JNIEnv *env = context->env;
1550     fullinfo_type clazz_info;
1551     if (opcode != JVM_OPC_invokevirtual && opcode != JVM_OPC_invokespecial) {
1552         clazz_info = cp_index_to_class_fullinfo(context, key,
1553                                                 JVM_CONSTANT_Fieldref);
1554     } else {
1555         clazz_info = cp_index_to_class_fullinfo(context, key,
1556                                                 JVM_CONSTANT_Methodref);
1557     }
1558     if (is_superclass(context, clazz_info)) {
1559         jclass calledClass =
1560             object_fullinfo_to_classclass(context, clazz_info);
1561         int access;
1562         /* 4734966: JVM_GetCPFieldModifiers() or JVM_GetCPMethodModifiers() only
1563            searches the referenced field or method in calledClass. The following
1564            while loop is added to search up the superclass chain to make this
1565            symbolic resolution consistent with the field/method resolution
1566            specified in VM spec 5.4.3. */
1567         calledClass = (*env)->NewLocalRef(env, calledClass);
1568         do {
1569             jclass tmp_cb;
1570             if (opcode != JVM_OPC_invokevirtual && opcode != JVM_OPC_invokespecial) {
1571                 access = JVM_GetCPFieldModifiers
1572                     (env, context->class, key, calledClass);
1573             } else {
1574                 access = JVM_GetCPMethodModifiers
1575                     (env, context->class, key, calledClass);
1576             }
1577             if (access != -1) {
1578                 break;
1579             }
1580             tmp_cb = (*env)->GetSuperclass(env, calledClass);
1581             (*env)->DeleteLocalRef(env, calledClass);
1582             calledClass = tmp_cb;
1583         } while (calledClass != 0);
1584 
1585         if (access == -1) {
1586             /* field/method not found, detected at runtime. */
1587         } else if (access & JVM_ACC_PROTECTED) {
1588             if (!JVM_IsSameClassPackage(env, calledClass, context->class))
1589                 context->instruction_data[inumber].protected = JNI_TRUE;
1590         }
1591         (*env)->DeleteLocalRef(env, calledClass);
1592     }
1593 }
1594 
1595 
1596 static jboolean
1597 is_superclass(context_type *context, fullinfo_type clazz_info) {
1598     fullinfo_type *fptr = context->superclasses;
1599 
1600     if (fptr == 0)
1601         return JNI_FALSE;
1602     for (; *fptr != 0; fptr++) {
1603         if (*fptr == clazz_info)
1604             return JNI_TRUE;
1605     }
1606     return JNI_FALSE;
1607 }
1608 
1609 
1610 /* Look through each item on the exception table.  Each of the fields must
1611  * refer to a legal instruction.
1612  */
1613 static void
1614 initialize_exception_table(context_type *context)
1615 {
1616     JNIEnv *env = context->env;
1617     int mi = context->method_index;
1618     struct handler_info_type *handler_info = context->handler_info;
1619     int *code_data = context->code_data;
1620     int code_length = context->code_length;
1621     int max_stack_size = JVM_GetMethodIxMaxStack(env, context->class, mi);
1622     int i = JVM_GetMethodIxExceptionTableLength(env, context->class, mi);
1623     if (max_stack_size < 1 && i > 0) {
1624         // If the method contains exception handlers, it must have room
1625         // on the expression stack for the exception that the VM could push
1626         CCerror(context, "Stack size too large");
1627     }
1628     for (; --i >= 0; handler_info++) {
1629         JVM_ExceptionTableEntryType einfo;
1630         stack_item_type *stack_item = NEW(stack_item_type, 1);
1631 
1632         JVM_GetMethodIxExceptionTableEntry(env, context->class, mi,
1633                                            i, &einfo);
1634 
1635         if (!(einfo.start_pc < einfo.end_pc &&
1636               einfo.start_pc >= 0 &&
1637               isLegalTarget(context, einfo.start_pc) &&
1638               (einfo.end_pc ==  code_length ||
1639                isLegalTarget(context, einfo.end_pc)))) {
1640             CFerror(context, "Illegal exception table range");
1641         }
1642         if (!((einfo.handler_pc > 0) &&
1643               isLegalTarget(context, einfo.handler_pc))) {
1644             CFerror(context, "Illegal exception table handler");
1645         }
1646 
1647         handler_info->start = code_data[einfo.start_pc];
1648         /* einfo.end_pc may point to one byte beyond the end of bytecodes. */
1649         handler_info->end = (einfo.end_pc == context->code_length) ?
1650             context->instruction_count : code_data[einfo.end_pc];
1651         handler_info->handler = code_data[einfo.handler_pc];
1652         handler_info->stack_info.stack = stack_item;
1653         handler_info->stack_info.stack_size = 1;
1654         stack_item->next = NULL;
1655         if (einfo.catchType != 0) {
1656             const char *classname;
1657             /* Constant pool entry type has been checked in format checker */
1658             classname = JVM_GetCPClassNameUTF(env,
1659                                               context->class,
1660                                               einfo.catchType);
1661             check_and_push_string_utf(context, classname);
1662             stack_item->item = make_class_info_from_name(context, classname);
1663             if (!isAssignableTo(context,
1664                                 stack_item->item,
1665                                 context->throwable_info))
1666                 CCerror(context, "catch_type not a subclass of Throwable");
1667             pop_and_free(context);
1668         } else {
1669             stack_item->item = context->throwable_info;
1670         }
1671     }
1672 }
1673 
1674 
1675 /* Given a pointer to an instruction, return its length.  Use the table
1676  * opcode_length[] which is automatically built.
1677  */
1678 static int instruction_length(unsigned char *iptr, unsigned char *end)
1679 {
1680     static unsigned char opcode_length[] = JVM_OPCODE_LENGTH_INITIALIZER;
1681     int instruction = *iptr;
1682     switch (instruction) {
1683         case JVM_OPC_tableswitch: {
1684             int *lpc = (int *)UCALIGN(iptr + 1);
1685             int64_t low, high, index;
1686             if (lpc + 2 >= (int *)end) {
1687                 return -1; /* do not read pass the end */
1688             }
1689             low  = _ck_ntohl(lpc[1]);
1690             high = _ck_ntohl(lpc[2]);
1691             index = high - low;
1692             // The value of low must be less than or equal to high - i.e. index >= 0
1693             if ((index < 0) || (index > 65535)) {
1694                 return -1;      /* illegal */
1695             } else {
1696                 unsigned char *finish = (unsigned char *)(&lpc[index + 4]);
1697                 assert(finish >= iptr);
1698                 return (int)(finish - iptr);
1699             }
1700         }
1701 
1702         case JVM_OPC_lookupswitch: {
1703             int *lpc = (int *) UCALIGN(iptr + 1);
1704             int npairs;
1705             if (lpc + 1 >= (int *)end)
1706                 return -1; /* do not read pass the end */
1707             npairs = _ck_ntohl(lpc[1]);
1708             /* There can't be more than 64K labels because of the limit
1709              * on per-method byte code length.
1710              */
1711             if (npairs < 0 || npairs >= 65536)
1712                 return  -1;
1713             else {
1714                 unsigned char *finish = (unsigned char *)(&lpc[2 * (npairs + 1)]);
1715                 assert(finish >= iptr);
1716                 return (int)(finish - iptr);
1717             }
1718         }
1719 
1720         case JVM_OPC_wide:
1721             if (iptr + 1 >= end)
1722                 return -1; /* do not read pass the end */
1723             switch(iptr[1]) {
1724                 case JVM_OPC_ret:
1725                 case JVM_OPC_iload: case JVM_OPC_istore:
1726                 case JVM_OPC_fload: case JVM_OPC_fstore:
1727                 case JVM_OPC_aload: case JVM_OPC_astore:
1728                 case JVM_OPC_lload: case JVM_OPC_lstore:
1729                 case JVM_OPC_dload: case JVM_OPC_dstore:
1730                     return 4;
1731                 case JVM_OPC_iinc:
1732                     return 6;
1733                 default:
1734                     return -1;
1735             }
1736 
1737         default: {
1738             if (instruction < 0 || instruction > JVM_OPC_MAX)
1739                 return -1;
1740 
1741             /* A length of 0 indicates an error. */
1742             if (opcode_length[instruction] <= 0)
1743                 return -1;
1744 
1745             return opcode_length[instruction];
1746         }
1747     }
1748 }
1749 
1750 
1751 /* Given the target of a branch, make sure that it's a legal target. */
1752 static jboolean
1753 isLegalTarget(context_type *context, int target)
1754 {
1755     int code_length = context->code_length;
1756     int *code_data = context->code_data;
1757     return (target >= 0 && target < code_length && code_data[target] >= 0);
1758 }
1759 
1760 /* Given a bci and offset, make sure the offset is valid and the target is legal */
1761 static jboolean
1762 isLegalOffset(context_type *context, int bci, int offset)
1763 {
1764     int code_length = context->code_length;
1765     int *code_data = context->code_data;
1766     int max_offset = 65535; // JVMS 4.11
1767     int min_offset = -65535;
1768     if (offset < min_offset || offset > max_offset) return JNI_FALSE;
1769     int target = bci + offset;
1770     return (target >= 0 && target < code_length && code_data[target] >= 0);
1771 }
1772 
1773 
1774 /* Make sure that an element of the constant pool really is of the indicated
1775  * type.
1776  */
1777 static void
1778 verify_constant_pool_type(context_type *context, int index, unsigned mask)
1779 {
1780     int nconstants = context->nconstants;
1781     unsigned char *type_table = context->constant_types;
1782     unsigned type;
1783 
1784     if ((index <= 0) || (index >= nconstants))
1785         CCerror(context, "Illegal constant pool index");
1786 
1787     type = type_table[index];
1788     if ((mask & (1 << type)) == 0)
1789         CCerror(context, "Illegal type in constant pool");
1790 }
1791 
1792 
1793 static void
1794 initialize_dataflow(context_type *context)
1795 {
1796     JNIEnv *env = context->env;
1797     instruction_data_type *idata = context->instruction_data;
1798     int mi = context->method_index;
1799     jclass cb = context->class;
1800     int args_size = JVM_GetMethodIxArgsSize(env, cb, mi);
1801     fullinfo_type *reg_ptr;
1802     fullinfo_type full_info;
1803     const char *p;
1804     const char *signature;
1805 
1806     /* Initialize the function entry, since we know everything about it. */
1807     idata[0].stack_info.stack_size = 0;
1808     idata[0].stack_info.stack = NULL;
1809     idata[0].register_info.register_count = args_size;
1810     idata[0].register_info.registers = NEW(fullinfo_type, args_size);
1811     idata[0].register_info.mask_count = 0;
1812     idata[0].register_info.masks = NULL;
1813     idata[0].and_flags = 0;     /* nothing needed */
1814     idata[0].or_flags = FLAG_REACHED; /* instruction reached */
1815     reg_ptr = idata[0].register_info.registers;
1816 
1817     if ((JVM_GetMethodIxModifiers(env, cb, mi) & JVM_ACC_STATIC) == 0) {
1818         /* A non static method.  If this is an <init> method, the first
1819          * argument is an uninitialized object.  Otherwise it is an object of
1820          * the given class type.  java.lang.Object.<init> is special since
1821          * we don't call its superclass <init> method.
1822          */
1823         if (JVM_IsConstructorIx(env, cb, mi)
1824                 && context->currentclass_info != context->object_info) {
1825             *reg_ptr++ = MAKE_FULLINFO(ITEM_InitObject, 0, 0);
1826             idata[0].or_flags |= FLAG_NEED_CONSTRUCTOR;
1827         } else {
1828             *reg_ptr++ = context->currentclass_info;
1829         }
1830     }
1831     signature = JVM_GetMethodIxSignatureUTF(env, cb, mi);
1832     check_and_push_string_utf(context, signature);
1833     /* Fill in each of the arguments into the registers. */
1834     for (p = signature + 1; *p != JVM_SIGNATURE_ENDFUNC; ) {
1835         char fieldchar = signature_to_fieldtype(context, &p, &full_info);
1836         switch (fieldchar) {
1837             case 'D': case 'L':
1838                 *reg_ptr++ = full_info;
1839                 *reg_ptr++ = full_info + 1;
1840                 break;
1841             default:
1842                 *reg_ptr++ = full_info;
1843                 break;
1844         }
1845     }
1846     p++;                        /* skip over right parenthesis */
1847     if (*p == 'V') {
1848         context->return_type = MAKE_FULLINFO(ITEM_Void, 0, 0);
1849     } else {
1850         signature_to_fieldtype(context, &p, &full_info);
1851         context->return_type = full_info;
1852     }
1853     pop_and_free(context);
1854     /* Indicate that we need to look at the first instruction. */
1855     idata[0].changed = JNI_TRUE;
1856 }
1857 
1858 
1859 /* Run the data flow analysis, as long as there are things to change. */
1860 static void
1861 run_dataflow(context_type *context) {
1862     JNIEnv *env = context->env;
1863     int mi = context->method_index;
1864     jclass cb = context->class;
1865     int max_stack_size = JVM_GetMethodIxMaxStack(env, cb, mi);
1866     instruction_data_type *idata = context->instruction_data;
1867     unsigned int icount = context->instruction_count;
1868     jboolean work_to_do = JNI_TRUE;
1869     unsigned int inumber;
1870 
1871     /* Run through the loop, until there is nothing left to do. */
1872     while (work_to_do) {
1873         work_to_do = JNI_FALSE;
1874         for (inumber = 0; inumber < icount; inumber++) {
1875             instruction_data_type *this_idata = &idata[inumber];
1876             if (this_idata->changed) {
1877                 register_info_type new_register_info;
1878                 stack_info_type new_stack_info;
1879                 flag_type new_and_flags, new_or_flags;
1880 
1881                 this_idata->changed = JNI_FALSE;
1882                 work_to_do = JNI_TRUE;
1883 #ifdef DEBUG
1884                 if (verify_verbose) {
1885                     jio_fprintf(stdout, "Instruction %d: ", inumber);
1886                     print_stack(context, &this_idata->stack_info);
1887                     print_registers(context, &this_idata->register_info);
1888                     print_flags(context,
1889                                 this_idata->and_flags, this_idata->or_flags);
1890                     fflush(stdout);
1891                 }
1892 #endif
1893                 /* Make sure the registers and flags are appropriate */
1894                 check_register_values(context, inumber);
1895                 check_flags(context, inumber);
1896 
1897                 /* Make sure the stack can deal with this instruction */
1898                 pop_stack(context, inumber, &new_stack_info);
1899 
1900                 /* Update the registers  and flags */
1901                 update_registers(context, inumber, &new_register_info);
1902                 update_flags(context, inumber, &new_and_flags, &new_or_flags);
1903 
1904                 /* Update the stack. */
1905                 push_stack(context, inumber, &new_stack_info);
1906 
1907                 if (new_stack_info.stack_size > max_stack_size)
1908                     CCerror(context, "Stack size too large");
1909 #ifdef DEBUG
1910                 if (verify_verbose) {
1911                     jio_fprintf(stdout, "  ");
1912                     print_stack(context, &new_stack_info);
1913                     print_registers(context, &new_register_info);
1914                     print_flags(context, new_and_flags, new_or_flags);
1915                     fflush(stdout);
1916                 }
1917 #endif
1918                 /* Add the new stack and register information to any
1919                  * instructions that can follow this instruction.     */
1920                 merge_into_successors(context, inumber,
1921                                       &new_register_info, &new_stack_info,
1922                                       new_and_flags, new_or_flags);
1923             }
1924         }
1925     }
1926 }
1927 
1928 
1929 /* Make sure that the registers contain a legitimate value for the given
1930  * instruction.
1931 */
1932 
1933 static void
1934 check_register_values(context_type *context, unsigned int inumber)
1935 {
1936     instruction_data_type *idata = context->instruction_data;
1937     instruction_data_type *this_idata = &idata[inumber];
1938     int opcode = this_idata->opcode;
1939     int operand = this_idata->operand.i;
1940     int register_count = this_idata->register_info.register_count;
1941     fullinfo_type *registers = this_idata->register_info.registers;
1942     jboolean double_word = JNI_FALSE;   /* default value */
1943     int type;
1944 
1945     switch (opcode) {
1946         default:
1947             return;
1948         case JVM_OPC_iload: case JVM_OPC_iinc:
1949             type = ITEM_Integer; break;
1950         case JVM_OPC_fload:
1951             type = ITEM_Float; break;
1952         case JVM_OPC_aload:
1953             type = ITEM_Object; break;
1954         case JVM_OPC_ret:
1955             type = ITEM_ReturnAddress; break;
1956         case JVM_OPC_lload:
1957             type = ITEM_Long; double_word = JNI_TRUE; break;
1958         case JVM_OPC_dload:
1959             type = ITEM_Double; double_word = JNI_TRUE; break;
1960     }
1961     if (!double_word) {
1962         fullinfo_type reg;
1963         /* Make sure we don't have an illegal register or one with wrong type */
1964         if (operand >= register_count) {
1965             CCerror(context,
1966                     "Accessing value from uninitialized register %d", operand);
1967         }
1968         reg = registers[operand];
1969 
1970         if (WITH_ZERO_EXTRA_INFO(reg) == (unsigned)MAKE_FULLINFO(type, 0, 0)) {
1971             /* the register is obviously of the given type */
1972             return;
1973         } else if (GET_INDIRECTION(reg) > 0 && type == ITEM_Object) {
1974             /* address type stuff be used on all arrays */
1975             return;
1976         } else if (GET_ITEM_TYPE(reg) == ITEM_ReturnAddress) {
1977             CCerror(context, "Cannot load return address from register %d",
1978                               operand);
1979             /* alternatively
1980                       (GET_ITEM_TYPE(reg) == ITEM_ReturnAddress)
1981                    && (opcode == JVM_OPC_iload)
1982                    && (type == ITEM_Object || type == ITEM_Integer)
1983                but this never occurs
1984             */
1985         } else if (reg == ITEM_InitObject && type == ITEM_Object) {
1986             return;
1987         } else if (WITH_ZERO_EXTRA_INFO(reg) ==
1988                         MAKE_FULLINFO(ITEM_NewObject, 0, 0) &&
1989                    type == ITEM_Object) {
1990             return;
1991         } else {
1992             CCerror(context, "Register %d contains wrong type", operand);
1993         }
1994     } else {
1995         /* Make sure we don't have an illegal register or one with wrong type */
1996         if ((operand + 1) >= register_count) {
1997             CCerror(context,
1998                     "Accessing value from uninitialized register pair %d/%d",
1999                     operand, operand+1);
2000         } else {
2001             if ((registers[operand] == (unsigned)MAKE_FULLINFO(type, 0, 0)) &&
2002                 (registers[operand + 1] == (unsigned)MAKE_FULLINFO(type + 1, 0, 0))) {
2003                 return;
2004             } else {
2005                 CCerror(context, "Register pair %d/%d contains wrong type",
2006                         operand, operand+1);
2007             }
2008         }
2009     }
2010 }
2011 
2012 
2013 /* Make sure the flags contain legitimate values for this instruction.
2014 */
2015 
2016 static void
2017 check_flags(context_type *context, unsigned int inumber)
2018 {
2019     instruction_data_type *idata = context->instruction_data;
2020     instruction_data_type *this_idata = &idata[inumber];
2021     int opcode = this_idata->opcode;
2022     switch (opcode) {
2023         case JVM_OPC_return:
2024             /* We need a constructor, but we aren't guaranteed it's called */
2025             if ((this_idata->or_flags & FLAG_NEED_CONSTRUCTOR) &&
2026                    !(this_idata->and_flags & FLAG_CONSTRUCTED))
2027                 CCerror(context, "Constructor must call super() or this()");
2028             /* fall through */
2029         case JVM_OPC_ireturn: case JVM_OPC_lreturn:
2030         case JVM_OPC_freturn: case JVM_OPC_dreturn: case JVM_OPC_areturn:
2031             if (this_idata->or_flags & FLAG_NO_RETURN)
2032                 /* This method cannot exit normally */
2033                 CCerror(context, "Cannot return normally");
2034         default:
2035             break; /* nothing to do. */
2036     }
2037 }
2038 
2039 /* Make sure that the top of the stack contains reasonable values for the
2040  * given instruction.  The post-pop values of the stack and its size are
2041  * returned in *new_stack_info.
2042  */
2043 
2044 static void
2045 pop_stack(context_type *context, unsigned int inumber, stack_info_type *new_stack_info)
2046 {
2047     instruction_data_type *idata = context->instruction_data;
2048     instruction_data_type *this_idata = &idata[inumber];
2049     int opcode = this_idata->opcode;
2050     stack_item_type *stack = this_idata->stack_info.stack;
2051     int stack_size = this_idata->stack_info.stack_size;
2052     char *stack_operands, *p;
2053     char buffer[257];           /* for holding manufactured argument lists */
2054     fullinfo_type stack_extra_info_buffer[256]; /* save info popped off stack */
2055     fullinfo_type *stack_extra_info = &stack_extra_info_buffer[256];
2056     fullinfo_type full_info;    /* only used in case of invoke instructions */
2057     fullinfo_type put_full_info; /* only used in case JVM_OPC_putstatic and JVM_OPC_putfield */
2058 
2059     switch(opcode) {
2060         default:
2061             /* For most instructions, we just use a built-in table */
2062             stack_operands = opcode_in_out[opcode][0];
2063             break;
2064 
2065         case JVM_OPC_putstatic: case JVM_OPC_putfield: {
2066             /* The top thing on the stack depends on the signature of
2067              * the object.                         */
2068             int operand = this_idata->operand.i;
2069             const char *signature =
2070                 JVM_GetCPFieldSignatureUTF(context->env,
2071                                            context->class,
2072                                            operand);
2073             char *ip = buffer;
2074             check_and_push_string_utf(context, signature);
2075 #ifdef DEBUG
2076             if (verify_verbose) {
2077                 print_formatted_fieldname(context, operand);
2078             }
2079 #endif
2080             if (opcode == JVM_OPC_putfield)
2081                 *ip++ = 'A';    /* object for putfield */
2082             *ip++ = signature_to_fieldtype(context, &signature, &put_full_info);
2083             *ip = '\0';
2084             stack_operands = buffer;
2085             pop_and_free(context);
2086             break;
2087         }
2088 
2089         case JVM_OPC_invokevirtual: case JVM_OPC_invokespecial:
2090         case JVM_OPC_invokeinit:    /* invokespecial call to <init> */
2091         case JVM_OPC_invokestatic: case JVM_OPC_invokeinterface: {
2092             /* The top stuff on the stack depends on the method signature */
2093             int operand = this_idata->operand.i;
2094             const char *signature =
2095                 JVM_GetCPMethodSignatureUTF(context->env,
2096                                             context->class,
2097                                             operand);
2098             char *ip = buffer;
2099             const char *p;
2100             check_and_push_string_utf(context, signature);
2101 #ifdef DEBUG
2102             if (verify_verbose) {
2103                 print_formatted_methodname(context, operand);
2104             }
2105 #endif
2106             if (opcode != JVM_OPC_invokestatic)
2107                 /* First, push the object */
2108                 *ip++ = (opcode == JVM_OPC_invokeinit ? '@' : 'A');
2109             for (p = signature + 1; *p != JVM_SIGNATURE_ENDFUNC; ) {
2110                 *ip++ = signature_to_fieldtype(context, &p, &full_info);
2111                 if (ip >= buffer + sizeof(buffer) - 1)
2112                     CCerror(context, "Signature %s has too many arguments",
2113                             signature);
2114             }
2115             *ip = 0;
2116             stack_operands = buffer;
2117             pop_and_free(context);
2118             break;
2119         }
2120 
2121         case JVM_OPC_multianewarray: {
2122             /* Count can't be larger than 255. So can't overflow buffer */
2123             int count = this_idata->operand2.i; /* number of ints on stack */
2124             memset(buffer, 'I', count);
2125             buffer[count] = '\0';
2126             stack_operands = buffer;
2127             break;
2128         }
2129 
2130     } /* of switch */
2131 
2132     /* Run through the list of operands >>backwards<< */
2133     for (   p = stack_operands + strlen(stack_operands);
2134             p > stack_operands;
2135             stack = stack->next) {
2136         int type = *--p;
2137         fullinfo_type top_type = stack ? stack->item : 0;
2138         int size = (type == 'D' || type == 'L') ? 2 : 1;
2139         *--stack_extra_info = top_type;
2140         if (stack == NULL)
2141             CCerror(context, "Unable to pop operand off an empty stack");
2142 
2143         switch (type) {
2144             case 'I':
2145                 if (top_type != MAKE_FULLINFO(ITEM_Integer, 0, 0))
2146                     CCerror(context, "Expecting to find integer on stack");
2147                 break;
2148 
2149             case 'F':
2150                 if (top_type != MAKE_FULLINFO(ITEM_Float, 0, 0))
2151                     CCerror(context, "Expecting to find float on stack");
2152                 break;
2153 
2154             case 'A':           /* object or array */
2155                 if (   (GET_ITEM_TYPE(top_type) != ITEM_Object)
2156                     && (GET_INDIRECTION(top_type) == 0)) {
2157                     /* The thing isn't an object or an array.  Let's see if it's
2158                      * one of the special cases  */
2159                     if (  (WITH_ZERO_EXTRA_INFO(top_type) ==
2160                                 MAKE_FULLINFO(ITEM_ReturnAddress, 0, 0))
2161                         && (opcode == JVM_OPC_astore))
2162                         break;
2163                     if (   (GET_ITEM_TYPE(top_type) == ITEM_NewObject
2164                             || (GET_ITEM_TYPE(top_type) == ITEM_InitObject))
2165                         && ((opcode == JVM_OPC_astore) || (opcode == JVM_OPC_aload)
2166                             || (opcode == JVM_OPC_ifnull) || (opcode == JVM_OPC_ifnonnull)))
2167                         break;
2168                     /* The 2nd edition VM of the specification allows field
2169                      * initializations before the superclass initializer,
2170                      * if the field is defined within the current class.
2171                      */
2172                      if (   (GET_ITEM_TYPE(top_type) == ITEM_InitObject)
2173                          && (opcode == JVM_OPC_putfield)) {
2174                         int operand = this_idata->operand.i;
2175                         int access_bits = JVM_GetCPFieldModifiers(context->env,
2176                                                                   context->class,
2177                                                                   operand,
2178                                                                   context->class);
2179                         /* Note: This relies on the fact that
2180                          * JVM_GetCPFieldModifiers retrieves only local fields,
2181                          * and does not respect inheritance.
2182                          */
2183                         if (access_bits != -1) {
2184                             if ( cp_index_to_class_fullinfo(context, operand, JVM_CONSTANT_Fieldref) ==
2185                                  context->currentclass_info ) {
2186                                 top_type = context->currentclass_info;
2187                                 *stack_extra_info = top_type;
2188                                 break;
2189                             }
2190                         }
2191                     }
2192                     CCerror(context, "Expecting to find object/array on stack");
2193                 }
2194                 break;
2195 
2196             case '@': {         /* uninitialized object, for call to <init> */
2197                 int item_type = GET_ITEM_TYPE(top_type);
2198                 if (item_type != ITEM_NewObject && item_type != ITEM_InitObject)
2199                     CCerror(context,
2200                             "Expecting to find uninitialized object on stack");
2201                 break;
2202             }
2203 
2204             case 'O':           /* object, not array */
2205                 if (WITH_ZERO_EXTRA_INFO(top_type) !=
2206                        MAKE_FULLINFO(ITEM_Object, 0, 0))
2207                     CCerror(context, "Expecting to find object on stack");
2208                 break;
2209 
2210             case 'a':           /* integer, object, or array */
2211                 if (      (top_type != MAKE_FULLINFO(ITEM_Integer, 0, 0))
2212                        && (GET_ITEM_TYPE(top_type) != ITEM_Object)
2213                        && (GET_INDIRECTION(top_type) == 0))
2214                     CCerror(context,
2215                             "Expecting to find object, array, or int on stack");
2216                 break;
2217 
2218             case 'D':           /* double */
2219                 if (top_type != MAKE_FULLINFO(ITEM_Double, 0, 0))
2220                     CCerror(context, "Expecting to find double on stack");
2221                 break;
2222 
2223             case 'L':           /* long */
2224                 if (top_type != MAKE_FULLINFO(ITEM_Long, 0, 0))
2225                     CCerror(context, "Expecting to find long on stack");
2226                 break;
2227 
2228             case ']':           /* array of some type */
2229                 if (top_type == NULL_FULLINFO) {
2230                     /* do nothing */
2231                 } else switch(p[-1]) {
2232                     case 'I':   /* array of integers */
2233                         if (top_type != MAKE_FULLINFO(ITEM_Integer, 1, 0) &&
2234                             top_type != NULL_FULLINFO)
2235                             CCerror(context,
2236                                     "Expecting to find array of ints on stack");
2237                         break;
2238 
2239                     case 'L':   /* array of longs */
2240                         if (top_type != MAKE_FULLINFO(ITEM_Long, 1, 0))
2241                             CCerror(context,
2242                                    "Expecting to find array of longs on stack");
2243                         break;
2244 
2245                     case 'F':   /* array of floats */
2246                         if (top_type != MAKE_FULLINFO(ITEM_Float, 1, 0))
2247                             CCerror(context,
2248                                  "Expecting to find array of floats on stack");
2249                         break;
2250 
2251                     case 'D':   /* array of doubles */
2252                         if (top_type != MAKE_FULLINFO(ITEM_Double, 1, 0))
2253                             CCerror(context,
2254                                 "Expecting to find array of doubles on stack");
2255                         break;
2256 
2257                     case 'A': { /* array of addresses (arrays or objects) */
2258                         int indirection = GET_INDIRECTION(top_type);
2259                         if ((indirection == 0) ||
2260                             ((indirection == 1) &&
2261                                 (GET_ITEM_TYPE(top_type) != ITEM_Object)))
2262                             CCerror(context,
2263                                 "Expecting to find array of objects or arrays "
2264                                     "on stack");
2265                         break;
2266                     }
2267 
2268                     case 'B':    /* array of bytes or booleans */
2269                         if (top_type != MAKE_FULLINFO(ITEM_Byte, 1, 0) &&
2270                             top_type != MAKE_FULLINFO(ITEM_Boolean, 1, 0))
2271                             CCerror(context,
2272                                   "Expecting to find array of bytes or Booleans on stack");
2273                         break;
2274 
2275                     case 'C':   /* array of characters */
2276                         if (top_type != MAKE_FULLINFO(ITEM_Char, 1, 0))
2277                             CCerror(context,
2278                                   "Expecting to find array of chars on stack");
2279                         break;
2280 
2281                     case 'S':   /* array of shorts */
2282                         if (top_type != MAKE_FULLINFO(ITEM_Short, 1, 0))
2283                             CCerror(context,
2284                                  "Expecting to find array of shorts on stack");
2285                         break;
2286 
2287                     case '?':   /* any type of array is okay */
2288                         if (GET_INDIRECTION(top_type) == 0)
2289                             CCerror(context,
2290                                     "Expecting to find array on stack");
2291                         break;
2292 
2293                     default:
2294                         CCerror(context, "Internal error #1");
2295                         break;
2296                 }
2297                 p -= 2;         /* skip over [ <char> */
2298                 break;
2299 
2300             case '1': case '2': case '3': case '4': /* stack swapping */
2301                 if (top_type == MAKE_FULLINFO(ITEM_Double, 0, 0)
2302                     || top_type == MAKE_FULLINFO(ITEM_Long, 0, 0)) {
2303                     if ((p > stack_operands) && (p[-1] == '+')) {
2304                         context->swap_table[type - '1'] = top_type + 1;
2305                         context->swap_table[p[-2] - '1'] = top_type;
2306                         size = 2;
2307                         p -= 2;
2308                     } else {
2309                         CCerror(context,
2310                                 "Attempt to split long or double on the stack");
2311                     }
2312                 } else {
2313                     context->swap_table[type - '1'] = stack->item;
2314                     if ((p > stack_operands) && (p[-1] == '+'))
2315                         p--;    /* ignore */
2316                 }
2317                 break;
2318             case '+':           /* these should have been caught. */
2319             default:
2320                 CCerror(context, "Internal error #2");
2321         }
2322         stack_size -= size;
2323     }
2324 
2325     /* For many of the opcodes that had an "A" in their field, we really
2326      * need to go back and do a little bit more accurate testing.  We can, of
2327      * course, assume that the minimal type checking has already been done.
2328      */
2329     switch (opcode) {
2330         default: break;
2331         case JVM_OPC_aastore: {     /* array index object  */
2332             fullinfo_type array_type = stack_extra_info[0];
2333             fullinfo_type object_type = stack_extra_info[2];
2334             fullinfo_type target_type = decrement_indirection(array_type);
2335             if ((GET_ITEM_TYPE(object_type) != ITEM_Object)
2336                     && (GET_INDIRECTION(object_type) == 0)) {
2337                 CCerror(context, "Expecting reference type on operand stack in aastore");
2338             }
2339             if ((GET_ITEM_TYPE(target_type) != ITEM_Object)
2340                     && (GET_INDIRECTION(target_type) == 0)) {
2341                 CCerror(context, "Component type of the array must be reference type in aastore");
2342             }
2343             break;
2344         }
2345 
2346         case JVM_OPC_putfield:
2347         case JVM_OPC_getfield:
2348         case JVM_OPC_putstatic: {
2349             int operand = this_idata->operand.i;
2350             fullinfo_type stack_object = stack_extra_info[0];
2351             if (opcode == JVM_OPC_putfield || opcode == JVM_OPC_getfield) {
2352                 if (!isAssignableTo
2353                         (context,
2354                          stack_object,
2355                          cp_index_to_class_fullinfo
2356                              (context, operand, JVM_CONSTANT_Fieldref))) {
2357                     CCerror(context,
2358                             "Incompatible type for getting or setting field");
2359                 }
2360                 if (this_idata->protected &&
2361                     !isAssignableTo(context, stack_object,
2362                                     context->currentclass_info)) {
2363                     CCerror(context, "Bad access to protected data");
2364                 }
2365             }
2366             if (opcode == JVM_OPC_putfield || opcode == JVM_OPC_putstatic) {
2367                 int item = (opcode == JVM_OPC_putfield ? 1 : 0);
2368                 if (!isAssignableTo(context,
2369                                     stack_extra_info[item], put_full_info)) {
2370                     CCerror(context, "Bad type in putfield/putstatic");
2371                 }
2372             }
2373             break;
2374         }
2375 
2376         case JVM_OPC_athrow:
2377             if (!isAssignableTo(context, stack_extra_info[0],
2378                                 context->throwable_info)) {
2379                 CCerror(context, "Can only throw Throwable objects");
2380             }
2381             break;
2382 
2383         case JVM_OPC_aaload: {      /* array index */
2384             /* We need to pass the information to the stack updater */
2385             fullinfo_type array_type = stack_extra_info[0];
2386             context->swap_table[0] = decrement_indirection(array_type);
2387             break;
2388         }
2389 
2390         case JVM_OPC_invokevirtual: case JVM_OPC_invokespecial:
2391         case JVM_OPC_invokeinit:
2392         case JVM_OPC_invokeinterface: case JVM_OPC_invokestatic: {
2393             int operand = this_idata->operand.i;
2394             const char *signature =
2395                 JVM_GetCPMethodSignatureUTF(context->env,
2396                                             context->class,
2397                                             operand);
2398             int item;
2399             const char *p;
2400             check_and_push_string_utf(context, signature);
2401             if (opcode == JVM_OPC_invokestatic) {
2402                 item = 0;
2403             } else if (opcode == JVM_OPC_invokeinit) {
2404                 fullinfo_type init_type = this_idata->operand2.fi;
2405                 fullinfo_type object_type = stack_extra_info[0];
2406                 context->swap_table[0] = object_type; /* save value */
2407                 if (GET_ITEM_TYPE(stack_extra_info[0]) == ITEM_NewObject) {
2408                     /* We better be calling the appropriate init.  Find the
2409                      * inumber of the "JVM_OPC_new" instruction", and figure
2410                      * out what the type really is.
2411                      */
2412                     unsigned int new_inumber = GET_EXTRA_INFO(stack_extra_info[0]);
2413                     fullinfo_type target_type = idata[new_inumber].operand2.fi;
2414                     context->swap_table[1] = target_type;
2415 
2416                     if (target_type != init_type) {
2417                         CCerror(context, "Call to wrong initialization method");
2418                     }
2419                     if (this_idata->protected
2420                         && !isAssignableTo(context, object_type,
2421                                            context->currentclass_info)) {
2422                       CCerror(context, "Bad access to protected data");
2423                     }
2424                 } else {
2425                     /* We better be calling super() or this(). */
2426                     if (init_type != context->superclass_info &&
2427                         init_type != context->currentclass_info) {
2428                         CCerror(context, "Call to wrong initialization method");
2429                     }
2430                     context->swap_table[1] = context->currentclass_info;
2431                 }
2432                 item = 1;
2433             } else {
2434                 fullinfo_type target_type = this_idata->operand2.fi;
2435                 fullinfo_type object_type = stack_extra_info[0];
2436                 if (!isAssignableTo(context, object_type, target_type)){
2437                     CCerror(context,
2438                             "Incompatible object argument for function call");
2439                 }
2440                 if (opcode == JVM_OPC_invokespecial
2441                     && !isAssignableTo(context, object_type,
2442                                        context->currentclass_info)) {
2443                     /* Make sure object argument is assignment compatible to current class */
2444                     CCerror(context,
2445                             "Incompatible object argument for invokespecial");
2446                 }
2447                 if (this_idata->protected
2448                     && !isAssignableTo(context, object_type,
2449                                        context->currentclass_info)) {
2450                     /* This is ugly. Special dispensation.  Arrays pretend to
2451                        implement public Object clone() even though they don't */
2452                     const char *utfName =
2453                         JVM_GetCPMethodNameUTF(context->env,
2454                                                context->class,
2455                                                this_idata->operand.i);
2456                     int is_clone = utfName && (strcmp(utfName, "clone") == 0);
2457                     JVM_ReleaseUTF(utfName);
2458 
2459                     if ((target_type == context->object_info) &&
2460                         (GET_INDIRECTION(object_type) > 0) &&
2461                         is_clone) {
2462                     } else {
2463                         CCerror(context, "Bad access to protected data");
2464                     }
2465                 }
2466                 item = 1;
2467             }
2468             for (p = signature + 1; *p != JVM_SIGNATURE_ENDFUNC; item++)
2469                 if (signature_to_fieldtype(context, &p, &full_info) == 'A') {
2470                     if (!isAssignableTo(context,
2471                                         stack_extra_info[item], full_info)) {
2472                         CCerror(context, "Incompatible argument to function");
2473                     }
2474                 }
2475 
2476             pop_and_free(context);
2477             break;
2478         }
2479 
2480         case JVM_OPC_return:
2481             if (context->return_type != MAKE_FULLINFO(ITEM_Void, 0, 0))
2482                 CCerror(context, "Wrong return type in function");
2483             break;
2484 
2485         case JVM_OPC_ireturn: case JVM_OPC_lreturn: case JVM_OPC_freturn:
2486         case JVM_OPC_dreturn: case JVM_OPC_areturn: {
2487             fullinfo_type target_type = context->return_type;
2488             fullinfo_type object_type = stack_extra_info[0];
2489             if (!isAssignableTo(context, object_type, target_type)) {
2490                 CCerror(context, "Wrong return type in function");
2491             }
2492             break;
2493         }
2494 
2495         case JVM_OPC_new: {
2496             /* Make sure that nothing on the stack already looks like what
2497              * we want to create.  I can't image how this could possibly happen
2498              * but we should test for it anyway, since if it could happen, the
2499              * result would be an uninitialized object being able to masquerade
2500              * as an initialized one.
2501              */
2502             stack_item_type *item;
2503             for (item = stack; item != NULL; item = item->next) {
2504                 if (item->item == this_idata->operand.fi) {
2505                     CCerror(context,
2506                             "Uninitialized object on stack at creating point");
2507                 }
2508             }
2509             /* Info for update_registers */
2510             context->swap_table[0] = this_idata->operand.fi;
2511             context->swap_table[1] = MAKE_FULLINFO(ITEM_Bogus, 0, 0);
2512 
2513             break;
2514         }
2515     }
2516     new_stack_info->stack = stack;
2517     new_stack_info->stack_size = stack_size;
2518 }
2519 
2520 
2521 /* We've already determined that the instruction is legal.  Perform the
2522  * operation on the registers, and return the updated results in
2523  * new_register_count_p and new_registers.
2524  */
2525 
2526 static void
2527 update_registers(context_type *context, unsigned int inumber,
2528                  register_info_type *new_register_info)
2529 {
2530     instruction_data_type *idata = context->instruction_data;
2531     instruction_data_type *this_idata = &idata[inumber];
2532     int opcode = this_idata->opcode;
2533     int operand = this_idata->operand.i;
2534     int register_count = this_idata->register_info.register_count;
2535     fullinfo_type *registers = this_idata->register_info.registers;
2536     stack_item_type *stack = this_idata->stack_info.stack;
2537     int mask_count = this_idata->register_info.mask_count;
2538     mask_type *masks = this_idata->register_info.masks;
2539 
2540     /* Use these as default new values. */
2541     int            new_register_count = register_count;
2542     int            new_mask_count = mask_count;
2543     fullinfo_type *new_registers = registers;
2544     mask_type     *new_masks = masks;
2545 
2546     enum { ACCESS_NONE, ACCESS_SINGLE, ACCESS_DOUBLE } access = ACCESS_NONE;
2547     int i;
2548 
2549     /* Remember, we've already verified the type at the top of the stack. */
2550     switch (opcode) {
2551         default: break;
2552         case JVM_OPC_istore: case JVM_OPC_fstore: case JVM_OPC_astore:
2553             access = ACCESS_SINGLE;
2554             goto continue_store;
2555 
2556         case JVM_OPC_lstore: case JVM_OPC_dstore:
2557             access = ACCESS_DOUBLE;
2558             goto continue_store;
2559 
2560         continue_store: {
2561             /* We have a modification to the registers.  Copy them if needed. */
2562             fullinfo_type stack_top_type = stack->item;
2563             int max_operand = operand + ((access == ACCESS_DOUBLE) ? 1 : 0);
2564 
2565             if (     max_operand < register_count
2566                   && registers[operand] == stack_top_type
2567                   && ((access == ACCESS_SINGLE) ||
2568                          (registers[operand + 1]== stack_top_type + 1)))
2569                 /* No changes have been made to the registers. */
2570                 break;
2571             new_register_count = MAX(max_operand + 1, register_count);
2572             new_registers = NEW(fullinfo_type, new_register_count);
2573             for (i = 0; i < register_count; i++)
2574                 new_registers[i] = registers[i];
2575             for (i = register_count; i < new_register_count; i++)
2576                 new_registers[i] = MAKE_FULLINFO(ITEM_Bogus, 0, 0);
2577             new_registers[operand] = stack_top_type;
2578             if (access == ACCESS_DOUBLE)
2579                 new_registers[operand + 1] = stack_top_type + 1;
2580             break;
2581         }
2582 
2583         case JVM_OPC_iload: case JVM_OPC_fload: case JVM_OPC_aload:
2584         case JVM_OPC_iinc: case JVM_OPC_ret:
2585             access = ACCESS_SINGLE;
2586             break;
2587 
2588         case JVM_OPC_lload: case JVM_OPC_dload:
2589             access = ACCESS_DOUBLE;
2590             break;
2591 
2592         case JVM_OPC_jsr: case JVM_OPC_jsr_w:
2593             for (i = 0; i < new_mask_count; i++)
2594                 if (new_masks[i].entry == operand)
2595                     CCerror(context, "Recursive call to jsr entry");
2596             new_masks = add_to_masks(context, masks, mask_count, operand);
2597             new_mask_count++;
2598             break;
2599 
2600         case JVM_OPC_invokeinit:
2601         case JVM_OPC_new: {
2602             /* For invokeinit, an uninitialized object has been initialized.
2603              * For new, all previous occurrences of an uninitialized object
2604              * from the same instruction must be made bogus.
2605              * We find all occurrences of swap_table[0] in the registers, and
2606              * replace them with swap_table[1];
2607              */
2608             fullinfo_type from = context->swap_table[0];
2609             fullinfo_type to = context->swap_table[1];
2610 
2611             int i;
2612             for (i = 0; i < register_count; i++) {
2613                 if (new_registers[i] == from) {
2614                     /* Found a match */
2615                     break;
2616                 }
2617             }
2618             if (i < register_count) { /* We broke out loop for match */
2619                 /* We have to change registers, and possibly a mask */
2620                 jboolean copied_mask = JNI_FALSE;
2621                 int k;
2622                 new_registers = NEW(fullinfo_type, register_count);
2623                 memcpy(new_registers, registers,
2624                        register_count * sizeof(registers[0]));
2625                 for ( ; i < register_count; i++) {
2626                     if (new_registers[i] == from) {
2627                         new_registers[i] = to;
2628                         for (k = 0; k < new_mask_count; k++) {
2629                             if (!IS_BIT_SET(new_masks[k].modifies, i)) {
2630                                 if (!copied_mask) {
2631                                     new_masks = copy_masks(context, new_masks,
2632                                                            mask_count);
2633                                     copied_mask = JNI_TRUE;
2634                                 }
2635                                 SET_BIT(new_masks[k].modifies, i);
2636                             }
2637                         }
2638                     }
2639                 }
2640             }
2641             break;
2642         }
2643     } /* of switch */
2644 
2645     if ((access != ACCESS_NONE) && (new_mask_count > 0)) {
2646         int i, j;
2647         for (i = 0; i < new_mask_count; i++) {
2648             int *mask = new_masks[i].modifies;
2649             if ((!IS_BIT_SET(mask, operand)) ||
2650                   ((access == ACCESS_DOUBLE) &&
2651                    !IS_BIT_SET(mask, operand + 1))) {
2652                 new_masks = copy_masks(context, new_masks, mask_count);
2653                 for (j = i; j < new_mask_count; j++) {
2654                     SET_BIT(new_masks[j].modifies, operand);
2655                     if (access == ACCESS_DOUBLE)
2656                         SET_BIT(new_masks[j].modifies, operand + 1);
2657                 }
2658                 break;
2659             }
2660         }
2661     }
2662 
2663     new_register_info->register_count = new_register_count;
2664     new_register_info->registers = new_registers;
2665     new_register_info->masks = new_masks;
2666     new_register_info->mask_count = new_mask_count;
2667 }
2668 
2669 
2670 
2671 /* We've already determined that the instruction is legal, and have updated
2672  * the registers.  Update the flags, too.
2673  */
2674 
2675 
2676 static void
2677 update_flags(context_type *context, unsigned int inumber,
2678              flag_type *new_and_flags, flag_type *new_or_flags)
2679 
2680 {
2681     instruction_data_type *idata = context->instruction_data;
2682     instruction_data_type *this_idata = &idata[inumber];
2683     flag_type and_flags = this_idata->and_flags;
2684     flag_type or_flags = this_idata->or_flags;
2685 
2686     /* Set the "we've done a constructor" flag */
2687     if (this_idata->opcode == JVM_OPC_invokeinit) {
2688         fullinfo_type from = context->swap_table[0];
2689         if (from == MAKE_FULLINFO(ITEM_InitObject, 0, 0))
2690             and_flags |= FLAG_CONSTRUCTED;
2691     }
2692     *new_and_flags = and_flags;
2693     *new_or_flags = or_flags;
2694 }
2695 
2696 
2697 
2698 /* We've already determined that the instruction is legal.  Perform the
2699  * operation on the stack;
2700  *
2701  * new_stack_size_p and new_stack_p point to the results after the pops have
2702  * already been done.  Do the pushes, and then put the results back there.
2703  */
2704 
2705 static void
2706 push_stack(context_type *context, unsigned int inumber, stack_info_type *new_stack_info)
2707 {
2708     instruction_data_type *idata = context->instruction_data;
2709     instruction_data_type *this_idata = &idata[inumber];
2710     int opcode = this_idata->opcode;
2711     int operand = this_idata->operand.i;
2712 
2713     int stack_size = new_stack_info->stack_size;
2714     stack_item_type *stack = new_stack_info->stack;
2715     char *stack_results;
2716 
2717     fullinfo_type full_info = 0;
2718     char buffer[5], *p;         /* actually [2] is big enough */
2719 
2720     /* We need to look at all those opcodes in which either we can't tell the
2721      * value pushed onto the stack from the opcode, or in which the value
2722      * pushed onto the stack is an object or array.  For the latter, we need
2723      * to make sure that full_info is set to the right value.
2724      */
2725     switch(opcode) {
2726         default:
2727             stack_results = opcode_in_out[opcode][1];
2728             break;
2729 
2730         case JVM_OPC_ldc: case JVM_OPC_ldc_w: case JVM_OPC_ldc2_w: {
2731             /* Look to constant pool to determine correct result. */
2732             unsigned char *type_table = context->constant_types;
2733             switch (type_table[operand]) {
2734                 case JVM_CONSTANT_Integer:
2735                     stack_results = "I"; break;
2736                 case JVM_CONSTANT_Float:
2737                     stack_results = "F"; break;
2738                 case JVM_CONSTANT_Double:
2739                     stack_results = "D"; break;
2740                 case JVM_CONSTANT_Long:
2741                     stack_results = "L"; break;
2742                 case JVM_CONSTANT_String:
2743                     stack_results = "A";
2744                     full_info = context->string_info;
2745                     break;
2746                 case JVM_CONSTANT_Class:
2747                     if (context->major_version < LDC_CLASS_MAJOR_VERSION)
2748                         CCerror(context, "Internal error #3");
2749                     stack_results = "A";
2750                     full_info = make_class_info_from_name(context,
2751                                                           "java/lang/Class");
2752                     break;
2753                 case JVM_CONSTANT_MethodHandle:
2754                 case JVM_CONSTANT_MethodType:
2755                     if (context->major_version < LDC_METHOD_HANDLE_MAJOR_VERSION)
2756                         CCerror(context, "Internal error #3");
2757                     stack_results = "A";
2758                     switch (type_table[operand]) {
2759                     case JVM_CONSTANT_MethodType:
2760                       full_info = make_class_info_from_name(context,
2761                                                             "java/lang/invoke/MethodType");
2762                       break;
2763                     default: //JVM_CONSTANT_MethodHandle
2764                       full_info = make_class_info_from_name(context,
2765                                                             "java/lang/invoke/MethodHandle");
2766                       break;
2767                     }
2768                     break;
2769                 default:
2770                     CCerror(context, "Internal error #3");
2771                     stack_results = ""; /* Never reached: keep lint happy */
2772             }
2773             break;
2774         }
2775 
2776         case JVM_OPC_getstatic: case JVM_OPC_getfield: {
2777             /* Look to signature to determine correct result. */
2778             int operand = this_idata->operand.i;
2779             const char *signature = JVM_GetCPFieldSignatureUTF(context->env,
2780                                                                context->class,
2781                                                                operand);
2782             check_and_push_string_utf(context, signature);
2783 #ifdef DEBUG
2784             if (verify_verbose) {
2785                 print_formatted_fieldname(context, operand);
2786             }
2787 #endif
2788             buffer[0] = signature_to_fieldtype(context, &signature, &full_info);
2789             buffer[1] = '\0';
2790             stack_results = buffer;
2791             pop_and_free(context);
2792             break;
2793         }
2794 
2795         case JVM_OPC_invokevirtual: case JVM_OPC_invokespecial:
2796         case JVM_OPC_invokeinit:
2797         case JVM_OPC_invokestatic: case JVM_OPC_invokeinterface: {
2798             /* Look to signature to determine correct result. */
2799             int operand = this_idata->operand.i;
2800             const char *signature = JVM_GetCPMethodSignatureUTF(context->env,
2801                                                                 context->class,
2802                                                                 operand);
2803             const char *result_signature;
2804             check_and_push_string_utf(context, signature);
2805             result_signature = get_result_signature(signature);
2806             if (result_signature++ == NULL) {
2807                 CCerror(context, "Illegal signature %s", signature);
2808             }
2809             if (result_signature[0] == JVM_SIGNATURE_VOID) {
2810                 stack_results = "";
2811             } else {
2812                 buffer[0] = signature_to_fieldtype(context, &result_signature,
2813                                                    &full_info);
2814                 buffer[1] = '\0';
2815                 stack_results = buffer;
2816             }
2817             pop_and_free(context);
2818             break;
2819         }
2820 
2821         case JVM_OPC_aconst_null:
2822             stack_results = opcode_in_out[opcode][1];
2823             full_info = NULL_FULLINFO; /* special NULL */
2824             break;
2825 
2826         case JVM_OPC_new:
2827         case JVM_OPC_checkcast:
2828         case JVM_OPC_newarray:
2829         case JVM_OPC_anewarray:
2830         case JVM_OPC_multianewarray:
2831             stack_results = opcode_in_out[opcode][1];
2832             /* Conveniently, this result type is stored here */
2833             full_info = this_idata->operand.fi;
2834             break;
2835 
2836         case JVM_OPC_aaload:
2837             stack_results = opcode_in_out[opcode][1];
2838             /* pop_stack() saved value for us. */
2839             full_info = context->swap_table[0];
2840             break;
2841 
2842         case JVM_OPC_aload:
2843             stack_results = opcode_in_out[opcode][1];
2844             /* The register hasn't been modified, so we can use its value. */
2845             full_info = this_idata->register_info.registers[operand];
2846             break;
2847     } /* of switch */
2848 
2849     for (p = stack_results; *p != 0; p++) {
2850         int type = *p;
2851         stack_item_type *new_item = NEW(stack_item_type, 1);
2852         new_item->next = stack;
2853         stack = new_item;
2854         switch (type) {
2855             case 'I':
2856                 stack->item = MAKE_FULLINFO(ITEM_Integer, 0, 0); break;
2857             case 'F':
2858                 stack->item = MAKE_FULLINFO(ITEM_Float, 0, 0); break;
2859             case 'D':
2860                 stack->item = MAKE_FULLINFO(ITEM_Double, 0, 0);
2861                 stack_size++; break;
2862             case 'L':
2863                 stack->item = MAKE_FULLINFO(ITEM_Long, 0, 0);
2864                 stack_size++; break;
2865             case 'R':
2866                 stack->item = MAKE_FULLINFO(ITEM_ReturnAddress, 0, operand);
2867                 break;
2868             case '1': case '2': case '3': case '4': {
2869                 /* Get the info saved in the swap_table */
2870                 fullinfo_type stype = context->swap_table[type - '1'];
2871                 stack->item = stype;
2872                 if (stype == MAKE_FULLINFO(ITEM_Long, 0, 0) ||
2873                     stype == MAKE_FULLINFO(ITEM_Double, 0, 0)) {
2874                     stack_size++; p++;
2875                 }
2876                 break;
2877             }
2878             case 'A':
2879                 /* full_info should have the appropriate value. */
2880                 assert(full_info != 0);
2881                 stack->item = full_info;
2882                 break;
2883             default:
2884                 CCerror(context, "Internal error #4");
2885 
2886             } /* switch type */
2887         stack_size++;
2888     } /* outer for loop */
2889 
2890     if (opcode == JVM_OPC_invokeinit) {
2891         /* If there are any instances of "from" on the stack, we need to
2892          * replace it with "to", since calling <init> initializes all versions
2893          * of the object, obviously.     */
2894         fullinfo_type from = context->swap_table[0];
2895         stack_item_type *ptr;
2896         for (ptr = stack; ptr != NULL; ptr = ptr->next) {
2897             if (ptr->item == from) {
2898                 fullinfo_type to = context->swap_table[1];
2899                 stack = copy_stack(context, stack);
2900                 for (ptr = stack; ptr != NULL; ptr = ptr->next)
2901                     if (ptr->item == from) ptr->item = to;
2902                 break;
2903             }
2904         }
2905     }
2906 
2907     new_stack_info->stack_size = stack_size;
2908     new_stack_info->stack = stack;
2909 }
2910 
2911 
2912 /* We've performed an instruction, and determined the new registers and stack
2913  * value.  Look at all of the possibly subsequent instructions, and merge
2914  * this stack value into theirs.
2915  */
2916 
2917 static void
2918 merge_into_successors(context_type *context, unsigned int inumber,
2919                       register_info_type *register_info,
2920                       stack_info_type *stack_info,
2921                       flag_type and_flags, flag_type or_flags)
2922 {
2923     instruction_data_type *idata = context->instruction_data;
2924     instruction_data_type *this_idata = &idata[inumber];
2925     int opcode = this_idata->opcode;
2926     int operand = this_idata->operand.i;
2927     struct handler_info_type *handler_info = context->handler_info;
2928     int handler_info_length =
2929         JVM_GetMethodIxExceptionTableLength(context->env,
2930                                             context->class,
2931                                             context->method_index);
2932 
2933 
2934     int buffer[2];              /* default value for successors */
2935     int *successors = buffer;   /* table of successors */
2936     int successors_count;
2937     int i;
2938 
2939     switch (opcode) {
2940     default:
2941         successors_count = 1;
2942         buffer[0] = inumber + 1;
2943         break;
2944 
2945     case JVM_OPC_ifeq: case JVM_OPC_ifne: case JVM_OPC_ifgt:
2946     case JVM_OPC_ifge: case JVM_OPC_iflt: case JVM_OPC_ifle:
2947     case JVM_OPC_ifnull: case JVM_OPC_ifnonnull:
2948     case JVM_OPC_if_icmpeq: case JVM_OPC_if_icmpne: case JVM_OPC_if_icmpgt:
2949     case JVM_OPC_if_icmpge: case JVM_OPC_if_icmplt: case JVM_OPC_if_icmple:
2950     case JVM_OPC_if_acmpeq: case JVM_OPC_if_acmpne:
2951         successors_count = 2;
2952         buffer[0] = inumber + 1;
2953         buffer[1] = operand;
2954         break;
2955 
2956     case JVM_OPC_jsr: case JVM_OPC_jsr_w:
2957         if (this_idata->operand2.i != UNKNOWN_RET_INSTRUCTION)
2958             idata[this_idata->operand2.i].changed = JNI_TRUE;
2959         /* FALLTHROUGH */
2960     case JVM_OPC_goto: case JVM_OPC_goto_w:
2961         successors_count = 1;
2962         buffer[0] = operand;
2963         break;
2964 
2965 
2966     case JVM_OPC_ireturn: case JVM_OPC_lreturn: case JVM_OPC_return:
2967     case JVM_OPC_freturn: case JVM_OPC_dreturn: case JVM_OPC_areturn:
2968     case JVM_OPC_athrow:
2969         /* The testing for the returns is handled in pop_stack() */
2970         successors_count = 0;
2971         break;
2972 
2973     case JVM_OPC_ret: {
2974         /* This is slightly slow, but good enough for a seldom used instruction.
2975          * The EXTRA_ITEM_INFO of the ITEM_ReturnAddress indicates the
2976          * address of the first instruction of the subroutine.  We can return
2977          * to 1 after any instruction that jsr's to that instruction.
2978          */
2979         if (this_idata->operand2.ip == NULL) {
2980             fullinfo_type *registers = this_idata->register_info.registers;
2981             int called_instruction = GET_EXTRA_INFO(registers[operand]);
2982             int i, count, *ptr;;
2983             for (i = context->instruction_count, count = 0; --i >= 0; ) {
2984                 if (((idata[i].opcode == JVM_OPC_jsr) ||
2985                      (idata[i].opcode == JVM_OPC_jsr_w)) &&
2986                     (idata[i].operand.i == called_instruction))
2987                     count++;
2988             }
2989             this_idata->operand2.ip = ptr = NEW(int, count + 1);
2990             *ptr++ = count;
2991             for (i = context->instruction_count, count = 0; --i >= 0; ) {
2992                 if (((idata[i].opcode == JVM_OPC_jsr) ||
2993                      (idata[i].opcode == JVM_OPC_jsr_w)) &&
2994                     (idata[i].operand.i == called_instruction))
2995                     *ptr++ = i + 1;
2996             }
2997         }
2998         successors = this_idata->operand2.ip; /* use this instead */
2999         successors_count = *successors++;
3000         break;
3001 
3002     }
3003 
3004     case JVM_OPC_tableswitch:
3005     case JVM_OPC_lookupswitch:
3006         successors = this_idata->operand.ip; /* use this instead */
3007         successors_count = *successors++;
3008         break;
3009     }
3010 
3011 #ifdef DEBUG
3012     if (verify_verbose) {
3013         jio_fprintf(stdout, " [");
3014         for (i = handler_info_length; --i >= 0; handler_info++)
3015             if (handler_info->start <= (int)inumber && handler_info->end > (int)inumber)
3016                 jio_fprintf(stdout, "%d* ", handler_info->handler);
3017         for (i = 0; i < successors_count; i++)
3018             jio_fprintf(stdout, "%d ", successors[i]);
3019         jio_fprintf(stdout,   "]\n");
3020     }
3021 #endif
3022 
3023     handler_info = context->handler_info;
3024     for (i = handler_info_length; --i >= 0; handler_info++) {
3025         if (handler_info->start <= (int)inumber && handler_info->end > (int)inumber) {
3026             int handler = handler_info->handler;
3027             if (opcode != JVM_OPC_invokeinit) {
3028                 merge_into_one_successor(context, inumber, handler,
3029                                          &this_idata->register_info, /* old */
3030                                          &handler_info->stack_info,
3031                                          (flag_type) (and_flags
3032                                                       & this_idata->and_flags),
3033                                          (flag_type) (or_flags
3034                                                       | this_idata->or_flags),
3035                                          JNI_TRUE);
3036             } else {
3037                 /* We need to be a little bit more careful with this
3038                  * instruction.  Things could either be in the state before
3039                  * the instruction or in the state afterwards */
3040                 fullinfo_type from = context->swap_table[0];
3041                 flag_type temp_or_flags = or_flags;
3042                 if (from == MAKE_FULLINFO(ITEM_InitObject, 0, 0))
3043                     temp_or_flags |= FLAG_NO_RETURN;
3044                 merge_into_one_successor(context, inumber, handler,
3045                                          &this_idata->register_info, /* old */
3046                                          &handler_info->stack_info,
3047                                          this_idata->and_flags,
3048                                          this_idata->or_flags,
3049                                          JNI_TRUE);
3050                 merge_into_one_successor(context, inumber, handler,
3051                                          register_info,
3052                                          &handler_info->stack_info,
3053                                          and_flags, temp_or_flags, JNI_TRUE);
3054             }
3055         }
3056     }
3057     for (i = 0; i < successors_count; i++) {
3058         int target = successors[i];
3059         if (target >= context->instruction_count)
3060             CCerror(context, "Falling off the end of the code");
3061         merge_into_one_successor(context, inumber, target,
3062                                  register_info, stack_info, and_flags, or_flags,
3063                                  JNI_FALSE);
3064     }
3065 }
3066 
3067 /* We have a new set of registers and stack values for a given instruction.
3068  * Merge this new set into the values that are already there.
3069  */
3070 
3071 static void
3072 merge_into_one_successor(context_type *context,
3073                          unsigned int from_inumber, unsigned int to_inumber,
3074                          register_info_type *new_register_info,
3075                          stack_info_type *new_stack_info,
3076                          flag_type new_and_flags, flag_type new_or_flags,
3077                          jboolean isException)
3078 {
3079     instruction_data_type *idata = context->instruction_data;
3080     register_info_type register_info_buf;
3081     stack_info_type stack_info_buf;
3082 #ifdef DEBUG
3083     instruction_data_type *this_idata = &idata[to_inumber];
3084     register_info_type old_reg_info;
3085     stack_info_type old_stack_info;
3086     flag_type old_and_flags = 0;
3087     flag_type old_or_flags = 0;
3088 #endif
3089 
3090 #ifdef DEBUG
3091     if (verify_verbose) {
3092         old_reg_info = this_idata->register_info;
3093         old_stack_info = this_idata->stack_info;
3094         old_and_flags = this_idata->and_flags;
3095         old_or_flags = this_idata->or_flags;
3096     }
3097 #endif
3098 
3099     /* All uninitialized objects are set to "bogus" when jsr and
3100      * ret are executed. Thus uninitialized objects can't propagate
3101      * into or out of a subroutine.
3102      */
3103     if (idata[from_inumber].opcode == JVM_OPC_ret ||
3104         idata[from_inumber].opcode == JVM_OPC_jsr ||
3105         idata[from_inumber].opcode == JVM_OPC_jsr_w) {
3106         int new_register_count = new_register_info->register_count;
3107         fullinfo_type *new_registers = new_register_info->registers;
3108         int i;
3109         stack_item_type *item;
3110 
3111         for (item = new_stack_info->stack; item != NULL; item = item->next) {
3112             if (GET_ITEM_TYPE(item->item) == ITEM_NewObject) {
3113                 /* This check only succeeds for hand-contrived code.
3114                  * Efficiency is not an issue.
3115                  */
3116                 stack_info_buf.stack = copy_stack(context,
3117                                                   new_stack_info->stack);
3118                 stack_info_buf.stack_size = new_stack_info->stack_size;
3119                 new_stack_info = &stack_info_buf;
3120                 for (item = new_stack_info->stack; item != NULL;
3121                      item = item->next) {
3122                     if (GET_ITEM_TYPE(item->item) == ITEM_NewObject) {
3123                         item->item = MAKE_FULLINFO(ITEM_Bogus, 0, 0);
3124                     }
3125                 }
3126                 break;
3127             }
3128         }
3129         for (i = 0; i < new_register_count; i++) {
3130             if (GET_ITEM_TYPE(new_registers[i]) == ITEM_NewObject) {
3131                 /* This check only succeeds for hand-contrived code.
3132                  * Efficiency is not an issue.
3133                  */
3134                 fullinfo_type *new_set = NEW(fullinfo_type,
3135                                              new_register_count);
3136                 for (i = 0; i < new_register_count; i++) {
3137                     fullinfo_type t = new_registers[i];
3138                     new_set[i] = GET_ITEM_TYPE(t) != ITEM_NewObject ?
3139                         t : MAKE_FULLINFO(ITEM_Bogus, 0, 0);
3140                 }
3141                 register_info_buf.register_count = new_register_count;
3142                 register_info_buf.registers = new_set;
3143                 register_info_buf.mask_count = new_register_info->mask_count;
3144                 register_info_buf.masks = new_register_info->masks;
3145                 new_register_info = &register_info_buf;
3146                 break;
3147             }
3148         }
3149     }
3150 
3151     /* Returning from a subroutine is somewhat ugly.  The actual thing
3152      * that needs to get merged into the new instruction is a joining
3153      * of info from the ret instruction with stuff in the jsr instruction
3154      */
3155     if (idata[from_inumber].opcode == JVM_OPC_ret && !isException) {
3156         int new_register_count = new_register_info->register_count;
3157         fullinfo_type *new_registers = new_register_info->registers;
3158         int new_mask_count = new_register_info->mask_count;
3159         mask_type *new_masks = new_register_info->masks;
3160         int operand = idata[from_inumber].operand.i;
3161         int called_instruction = GET_EXTRA_INFO(new_registers[operand]);
3162         instruction_data_type *jsr_idata = &idata[to_inumber - 1];
3163         register_info_type *jsr_reginfo = &jsr_idata->register_info;
3164         if (jsr_idata->operand2.i != (int)from_inumber) {
3165             if (jsr_idata->operand2.i != UNKNOWN_RET_INSTRUCTION)
3166                 CCerror(context, "Multiple returns to single jsr");
3167             jsr_idata->operand2.i = from_inumber;
3168         }
3169         if (jsr_reginfo->register_count == UNKNOWN_REGISTER_COUNT) {
3170             /* We don't want to handle the returned-to instruction until
3171              * we've dealt with the jsr instruction.   When we get to the
3172              * jsr instruction (if ever), we'll re-mark the ret instruction
3173              */
3174             ;
3175         } else {
3176             int register_count = jsr_reginfo->register_count;
3177             fullinfo_type *registers = jsr_reginfo->registers;
3178             int max_registers = MAX(register_count, new_register_count);
3179             fullinfo_type *new_set = NEW(fullinfo_type, max_registers);
3180             int *return_mask;
3181             struct register_info_type new_new_register_info;
3182             int i;
3183             /* Make sure the place we're returning from is legal! */
3184             for (i = new_mask_count; --i >= 0; )
3185                 if (new_masks[i].entry == called_instruction)
3186                     break;
3187             if (i < 0)
3188                 CCerror(context, "Illegal return from subroutine");
3189             /* pop the masks down to the indicated one.  Remember the mask
3190              * we're popping off. */
3191             return_mask = new_masks[i].modifies;
3192             new_mask_count = i;
3193             for (i = 0; i < max_registers; i++) {
3194                 if (IS_BIT_SET(return_mask, i))
3195                     new_set[i] = i < new_register_count ?
3196                           new_registers[i] : MAKE_FULLINFO(ITEM_Bogus, 0, 0);
3197                 else
3198                     new_set[i] = i < register_count ?
3199                         registers[i] : MAKE_FULLINFO(ITEM_Bogus, 0, 0);
3200             }
3201             new_new_register_info.register_count = max_registers;
3202             new_new_register_info.registers      = new_set;
3203             new_new_register_info.mask_count     = new_mask_count;
3204             new_new_register_info.masks          = new_masks;
3205 
3206 
3207             merge_stack(context, from_inumber, to_inumber, new_stack_info);
3208             merge_registers(context, to_inumber - 1, to_inumber,
3209                             &new_new_register_info);
3210             merge_flags(context, from_inumber, to_inumber, new_and_flags, new_or_flags);
3211         }
3212     } else {
3213         merge_stack(context, from_inumber, to_inumber, new_stack_info);
3214         merge_registers(context, from_inumber, to_inumber, new_register_info);
3215         merge_flags(context, from_inumber, to_inumber,
3216                     new_and_flags, new_or_flags);
3217     }
3218 
3219 #ifdef DEBUG
3220     if (verify_verbose && idata[to_inumber].changed) {
3221         register_info_type *register_info = &this_idata->register_info;
3222         stack_info_type *stack_info = &this_idata->stack_info;
3223         if (memcmp(&old_reg_info, register_info, sizeof(old_reg_info)) ||
3224             memcmp(&old_stack_info, stack_info, sizeof(old_stack_info)) ||
3225             (old_and_flags != this_idata->and_flags) ||
3226             (old_or_flags != this_idata->or_flags)) {
3227             jio_fprintf(stdout, "   %2d:", to_inumber);
3228             print_stack(context, &old_stack_info);
3229             print_registers(context, &old_reg_info);
3230             print_flags(context, old_and_flags, old_or_flags);
3231             jio_fprintf(stdout, " => ");
3232             print_stack(context, &this_idata->stack_info);
3233             print_registers(context, &this_idata->register_info);
3234             print_flags(context, this_idata->and_flags, this_idata->or_flags);
3235             jio_fprintf(stdout, "\n");
3236         }
3237     }
3238 #endif
3239 
3240 }
3241 
3242 static void
3243 merge_stack(context_type *context, unsigned int from_inumber,
3244             unsigned int to_inumber, stack_info_type *new_stack_info)
3245 {
3246     instruction_data_type *idata = context->instruction_data;
3247     instruction_data_type *this_idata = &idata[to_inumber];
3248 
3249     int new_stack_size =  new_stack_info->stack_size;
3250     stack_item_type *new_stack = new_stack_info->stack;
3251 
3252     int stack_size = this_idata->stack_info.stack_size;
3253 
3254     if (stack_size == UNKNOWN_STACK_SIZE) {
3255         /* First time at this instruction.  Just copy. */
3256         this_idata->stack_info.stack_size = new_stack_size;
3257         this_idata->stack_info.stack = new_stack;
3258         this_idata->changed = JNI_TRUE;
3259     } else if (new_stack_size != stack_size) {
3260         CCerror(context, "Inconsistent stack height %d != %d",
3261                 new_stack_size, stack_size);
3262     } else {
3263         stack_item_type *stack = this_idata->stack_info.stack;
3264         stack_item_type *old, *new;
3265         jboolean change = JNI_FALSE;
3266         for (old = stack, new = new_stack; old != NULL;
3267                    old = old->next, new = new->next) {
3268             assert(new != NULL);
3269             if (!isAssignableTo(context, new->item, old->item)) {
3270                 change = JNI_TRUE;
3271                 break;
3272             }
3273         }
3274         if (change) {
3275             stack = copy_stack(context, stack);
3276             for (old = stack, new = new_stack; old != NULL;
3277                           old = old->next, new = new->next) {
3278                 if (new == NULL) {
3279                     break;
3280                 }
3281                 old->item = merge_fullinfo_types(context, old->item, new->item,
3282                                                  JNI_FALSE);
3283                 if (GET_ITEM_TYPE(old->item) == ITEM_Bogus) {
3284                         CCerror(context, "Mismatched stack types");
3285                 }
3286             }
3287             if (old != NULL || new != NULL) {
3288                 CCerror(context, "Mismatched stack types");
3289             }
3290             this_idata->stack_info.stack = stack;
3291             this_idata->changed = JNI_TRUE;
3292         }
3293     }
3294 }
3295 
3296 static void
3297 merge_registers(context_type *context, unsigned int from_inumber,
3298                 unsigned int to_inumber, register_info_type *new_register_info)
3299 {
3300     instruction_data_type *idata = context->instruction_data;
3301     instruction_data_type *this_idata = &idata[to_inumber];
3302     register_info_type    *this_reginfo = &this_idata->register_info;
3303 
3304     int            new_register_count = new_register_info->register_count;
3305     fullinfo_type *new_registers = new_register_info->registers;
3306     int            new_mask_count = new_register_info->mask_count;
3307     mask_type     *new_masks = new_register_info->masks;
3308 
3309 
3310     if (this_reginfo->register_count == UNKNOWN_REGISTER_COUNT) {
3311         this_reginfo->register_count = new_register_count;
3312         this_reginfo->registers = new_registers;
3313         this_reginfo->mask_count = new_mask_count;
3314         this_reginfo->masks = new_masks;
3315         this_idata->changed = JNI_TRUE;
3316     } else {
3317         /* See if we've got new information on the register set. */
3318         int register_count = this_reginfo->register_count;
3319         fullinfo_type *registers = this_reginfo->registers;
3320         int mask_count = this_reginfo->mask_count;
3321         mask_type *masks = this_reginfo->masks;
3322 
3323         jboolean copy = JNI_FALSE;
3324         int i, j;
3325         if (register_count > new_register_count) {
3326             /* Any register larger than new_register_count is now bogus */
3327             this_reginfo->register_count = new_register_count;
3328             register_count = new_register_count;
3329             this_idata->changed = JNI_TRUE;
3330         }
3331         for (i = 0; i < register_count; i++) {
3332             fullinfo_type prev_value = registers[i];
3333             if ((i < new_register_count)
3334                   ? (!isAssignableTo(context, new_registers[i], prev_value))
3335                   : (prev_value != MAKE_FULLINFO(ITEM_Bogus, 0, 0))) {
3336                 copy = JNI_TRUE;
3337                 break;
3338             }
3339         }
3340 
3341         if (copy) {
3342             /* We need a copy.  So do it. */
3343             fullinfo_type *new_set = NEW(fullinfo_type, register_count);
3344             for (j = 0; j < i; j++)
3345                 new_set[j] =  registers[j];
3346             for (j = i; j < register_count; j++) {
3347                 if (i >= new_register_count)
3348                     new_set[j] = MAKE_FULLINFO(ITEM_Bogus, 0, 0);
3349                 else
3350                     new_set[j] = merge_fullinfo_types(context,
3351                                                       new_registers[j],
3352                                                       registers[j], JNI_FALSE);
3353             }
3354             /* Some of the end items might now be bogus. This step isn't
3355              * necessary, but it may save work later. */
3356             while (   register_count > 0
3357                    && GET_ITEM_TYPE(new_set[register_count-1]) == ITEM_Bogus)
3358                 register_count--;
3359             this_reginfo->register_count = register_count;
3360             this_reginfo->registers = new_set;
3361             this_idata->changed = JNI_TRUE;
3362         }
3363         if (mask_count > 0) {
3364             /* If the target instruction already has a sequence of masks, then
3365              * we need to merge new_masks into it.  We want the entries on
3366              * the mask to be the longest common substring of the two.
3367              *   (e.g.   a->b->d merged with a->c->d should give a->d)
3368              * The bits set in the mask should be the or of the corresponding
3369              * entries in each of the original masks.
3370              */
3371             int i, j, k;
3372             int matches = 0;
3373             int last_match = -1;
3374             jboolean copy_needed = JNI_FALSE;
3375             for (i = 0; i < mask_count; i++) {
3376                 int entry = masks[i].entry;
3377                 for (j = last_match + 1; j < new_mask_count; j++) {
3378                     if (new_masks[j].entry == entry) {
3379                         /* We have a match */
3380                         int *prev = masks[i].modifies;
3381                         int *new = new_masks[j].modifies;
3382                         matches++;
3383                         /* See if new_mask has bits set for "entry" that
3384                          * weren't set for mask.  If so, need to copy. */
3385                         for (k = context->bitmask_size - 1;
3386                                !copy_needed && k >= 0;
3387                                k--)
3388                             if (~prev[k] & new[k])
3389                                 copy_needed = JNI_TRUE;
3390                         last_match = j;
3391                         break;
3392                     }
3393                 }
3394             }
3395             if ((matches < mask_count) || copy_needed) {
3396                 /* We need to make a copy for the new item, since either the
3397                  * size has decreased, or new bits are set. */
3398                 mask_type *copy = NEW(mask_type, matches);
3399                 for (i = 0; i < matches; i++) {
3400                     copy[i].modifies = NEW(int, context->bitmask_size);
3401                 }
3402                 this_reginfo->masks = copy;
3403                 this_reginfo->mask_count = matches;
3404                 this_idata->changed = JNI_TRUE;
3405                 matches = 0;
3406                 last_match = -1;
3407                 for (i = 0; i < mask_count; i++) {
3408                     int entry = masks[i].entry;
3409                     for (j = last_match + 1; j < new_mask_count; j++) {
3410                         if (new_masks[j].entry == entry) {
3411                             int *prev1 = masks[i].modifies;
3412                             int *prev2 = new_masks[j].modifies;
3413                             int *new = copy[matches].modifies;
3414                             copy[matches].entry = entry;
3415                             for (k = context->bitmask_size - 1; k >= 0; k--)
3416                                 new[k] = prev1[k] | prev2[k];
3417                             matches++;
3418                             last_match = j;
3419                             break;
3420                         }
3421                     }
3422                 }
3423             }
3424         }
3425     }
3426 }
3427 
3428 
3429 static void
3430 merge_flags(context_type *context, unsigned int from_inumber,
3431             unsigned int to_inumber,
3432             flag_type new_and_flags, flag_type new_or_flags)
3433 {
3434     /* Set this_idata->and_flags &= new_and_flags
3435            this_idata->or_flags |= new_or_flags
3436      */
3437     instruction_data_type *idata = context->instruction_data;
3438     instruction_data_type *this_idata = &idata[to_inumber];
3439     flag_type this_and_flags = this_idata->and_flags;
3440     flag_type this_or_flags = this_idata->or_flags;
3441     flag_type merged_and = this_and_flags & new_and_flags;
3442     flag_type merged_or = this_or_flags | new_or_flags;
3443 
3444     if ((merged_and != this_and_flags) || (merged_or != this_or_flags)) {
3445         this_idata->and_flags = merged_and;
3446         this_idata->or_flags = merged_or;
3447         this_idata->changed = JNI_TRUE;
3448     }
3449 }
3450 
3451 
3452 /* Make a copy of a stack */
3453 
3454 static stack_item_type *
3455 copy_stack(context_type *context, stack_item_type *stack)
3456 {
3457     int length;
3458     stack_item_type *ptr;
3459 
3460     /* Find the length */
3461     for (ptr = stack, length = 0; ptr != NULL; ptr = ptr->next, length++);
3462 
3463     if (length > 0) {
3464         stack_item_type *new_stack = NEW(stack_item_type, length);
3465         stack_item_type *new_ptr;
3466         for (    ptr = stack, new_ptr = new_stack;
3467                  ptr != NULL;
3468                  ptr = ptr->next, new_ptr++) {
3469             new_ptr->item = ptr->item;
3470             new_ptr->next = new_ptr + 1;
3471         }
3472         new_stack[length - 1].next = NULL;
3473         return new_stack;
3474     } else {
3475         return NULL;
3476     }
3477 }
3478 
3479 
3480 static mask_type *
3481 copy_masks(context_type *context, mask_type *masks, int mask_count)
3482 {
3483     mask_type *result = NEW(mask_type, mask_count);
3484     int bitmask_size = context->bitmask_size;
3485     int *bitmaps = NEW(int, mask_count * bitmask_size);
3486     int i;
3487     for (i = 0; i < mask_count; i++) {
3488         result[i].entry = masks[i].entry;
3489         result[i].modifies = &bitmaps[i * bitmask_size];
3490         memcpy(result[i].modifies, masks[i].modifies, bitmask_size * sizeof(int));
3491     }
3492     return result;
3493 }
3494 
3495 
3496 static mask_type *
3497 add_to_masks(context_type *context, mask_type *masks, int mask_count, int d)
3498 {
3499     mask_type *result = NEW(mask_type, mask_count + 1);
3500     int bitmask_size = context->bitmask_size;
3501     int *bitmaps = NEW(int, (mask_count + 1) * bitmask_size);
3502     int i;
3503     for (i = 0; i < mask_count; i++) {
3504         result[i].entry = masks[i].entry;
3505         result[i].modifies = &bitmaps[i * bitmask_size];
3506         memcpy(result[i].modifies, masks[i].modifies, bitmask_size * sizeof(int));
3507     }
3508     result[mask_count].entry = d;
3509     result[mask_count].modifies = &bitmaps[mask_count * bitmask_size];
3510     memset(result[mask_count].modifies, 0, bitmask_size * sizeof(int));
3511     return result;
3512 }
3513 
3514 
3515 
3516 /* We create our own storage manager, since we malloc lots of little items,
3517  * and I don't want to keep trace of when they become free.  I sure wish that
3518  * we had heaps, and I could just free the heap when done.
3519  */
3520 
3521 #define CCSegSize 2000
3522 
3523 struct CCpool {                 /* a segment of allocated memory in the pool */
3524     struct CCpool *next;
3525     int segSize;                /* almost always CCSegSize */
3526     int poolPad;
3527     char space[CCSegSize];
3528 };
3529 
3530 /* Initialize the context's heap. */
3531 static void CCinit(context_type *context)
3532 {
3533     struct CCpool *new = (struct CCpool *) malloc(sizeof(struct CCpool));
3534     /* Set context->CCroot to 0 if new == 0 to tell CCdestroy to lay off */
3535     context->CCroot = context->CCcurrent = new;
3536     if (new == 0) {
3537         CCout_of_memory(context);
3538     }
3539     new->next = NULL;
3540     new->segSize = CCSegSize;
3541     context->CCfree_size = CCSegSize;
3542     context->CCfree_ptr = &new->space[0];
3543 }
3544 
3545 
3546 /* Reuse all the space that we have in the context's heap. */
3547 static void CCreinit(context_type *context)
3548 {
3549     struct CCpool *first = context->CCroot;
3550     context->CCcurrent = first;
3551     context->CCfree_size = CCSegSize;
3552     context->CCfree_ptr = &first->space[0];
3553 }
3554 
3555 /* Destroy the context's heap. */
3556 static void CCdestroy(context_type *context)
3557 {
3558     struct CCpool *this = context->CCroot;
3559     while (this) {
3560         struct CCpool *next = this->next;
3561         free(this);
3562         this = next;
3563     }
3564     /* These two aren't necessary.  But can't hurt either */
3565     context->CCroot = context->CCcurrent = NULL;
3566     context->CCfree_ptr = 0;
3567 }
3568 
3569 /* Allocate an object of the given size from the context's heap. */
3570 static void *
3571 CCalloc(context_type *context, int size, jboolean zero)
3572 {
3573 
3574     register char *p;
3575     /* Round CC to the size of a pointer */
3576     size = (size + (sizeof(void *) - 1)) & ~(sizeof(void *) - 1);
3577 
3578     if (context->CCfree_size <  size) {
3579         struct CCpool *current = context->CCcurrent;
3580         struct CCpool *new;
3581         if (size > CCSegSize) { /* we need to allocate a special block */
3582             new = (struct CCpool *)malloc(sizeof(struct CCpool) +
3583                                           (size - CCSegSize));
3584             if (new == 0) {
3585                 CCout_of_memory(context);
3586             }
3587             new->next = current->next;
3588             new->segSize = size;
3589             current->next = new;
3590         } else {
3591             new = current->next;
3592             if (new == NULL) {
3593                 new = (struct CCpool *) malloc(sizeof(struct CCpool));
3594                 if (new == 0) {
3595                     CCout_of_memory(context);
3596                 }
3597                 current->next = new;
3598                 new->next = NULL;
3599                 new->segSize = CCSegSize;
3600             }
3601         }
3602         context->CCcurrent = new;
3603         context->CCfree_ptr = &new->space[0];
3604         context->CCfree_size = new->segSize;
3605     }
3606     p = context->CCfree_ptr;
3607     context->CCfree_ptr += size;
3608     context->CCfree_size -= size;
3609     if (zero)
3610         memset(p, 0, size);
3611     return p;
3612 }
3613 
3614 /* Get the class associated with a particular field or method or class in the
3615  * constant pool.  If is_field is true, we've got a field or method.  If
3616  * false, we've got a class.
3617  */
3618 static fullinfo_type
3619 cp_index_to_class_fullinfo(context_type *context, int cp_index, int kind)
3620 {
3621     JNIEnv *env = context->env;
3622     fullinfo_type result;
3623     const char *classname;
3624     switch (kind) {
3625     case JVM_CONSTANT_Class:
3626         classname = JVM_GetCPClassNameUTF(env,
3627                                           context->class,
3628                                           cp_index);
3629         break;
3630     case JVM_CONSTANT_Methodref:
3631         classname = JVM_GetCPMethodClassNameUTF(env,
3632                                                 context->class,
3633                                                 cp_index);
3634         break;
3635     case JVM_CONSTANT_Fieldref:
3636         classname = JVM_GetCPFieldClassNameUTF(env,
3637                                                context->class,
3638                                                cp_index);
3639         break;
3640     default:
3641         classname = NULL;
3642         CCerror(context, "Internal error #5");
3643     }
3644 
3645     check_and_push_string_utf(context, classname);
3646     if (classname[0] == JVM_SIGNATURE_ARRAY) {
3647         /* This make recursively call us, in case of a class array */
3648         signature_to_fieldtype(context, &classname, &result);
3649     } else {
3650         result = make_class_info_from_name(context, classname);
3651     }
3652     pop_and_free(context);
3653     return result;
3654 }
3655 
3656 
3657 static int
3658 print_CCerror_info(context_type *context)
3659 {
3660     JNIEnv *env = context->env;
3661     jclass cb = context->class;
3662     const char *classname = JVM_GetClassNameUTF(env, cb);
3663     const char *name = 0;
3664     const char *signature = 0;
3665     int n = 0;
3666     if (context->method_index != -1) {
3667         name = JVM_GetMethodIxNameUTF(env, cb, context->method_index);
3668         signature =
3669             JVM_GetMethodIxSignatureUTF(env, cb, context->method_index);
3670         n += jio_snprintf(context->message, context->message_buf_len,
3671                           "(class: %s, method: %s signature: %s) ",
3672                           (classname ? classname : ""),
3673                           (name ? name : ""),
3674                           (signature ? signature : ""));
3675     } else if (context->field_index != -1 ) {
3676         name = JVM_GetMethodIxNameUTF(env, cb, context->field_index);
3677         n += jio_snprintf(context->message, context->message_buf_len,
3678                           "(class: %s, field: %s) ",
3679                           (classname ? classname : 0),
3680                           (name ? name : 0));
3681     } else {
3682         n += jio_snprintf(context->message, context->message_buf_len,
3683                           "(class: %s) ", classname ? classname : "");
3684     }
3685     JVM_ReleaseUTF(classname);
3686     JVM_ReleaseUTF(name);
3687     JVM_ReleaseUTF(signature);
3688     return n;
3689 }
3690 
3691 static void
3692 CCerror (context_type *context, char *format, ...)
3693 {
3694     int n = print_CCerror_info(context);
3695     va_list args;
3696     if (n >= 0 && n < context->message_buf_len) {
3697         va_start(args, format);
3698         jio_vsnprintf(context->message + n, context->message_buf_len - n,
3699                       format, args);
3700         va_end(args);
3701     }
3702     context->err_code = CC_VerifyError;
3703     longjmp(context->jump_buffer, 1);
3704 }
3705 
3706 static void
3707 CCout_of_memory(context_type *context)
3708 {
3709     int n = print_CCerror_info(context);
3710     context->err_code = CC_OutOfMemory;
3711     longjmp(context->jump_buffer, 1);
3712 }
3713 
3714 static void
3715 CFerror(context_type *context, char *format, ...)
3716 {
3717     int n = print_CCerror_info(context);
3718     va_list args;
3719     if (n >= 0 && n < context->message_buf_len) {
3720         va_start(args, format);
3721         jio_vsnprintf(context->message + n, context->message_buf_len - n,
3722                       format, args);
3723         va_end(args);
3724     }
3725     context->err_code = CC_ClassFormatError;
3726     longjmp(context->jump_buffer, 1);
3727 }
3728 
3729 /*
3730  * Need to scan the entire signature to find the result type because
3731  * types in the arg list and the result type could contain embedded ')'s.
3732  */
3733 static const char* get_result_signature(const char* signature) {
3734     const char *p;
3735     for (p = signature; *p != JVM_SIGNATURE_ENDFUNC; p++) {
3736         switch (*p) {
3737           case JVM_SIGNATURE_BOOLEAN:
3738           case JVM_SIGNATURE_BYTE:
3739           case JVM_SIGNATURE_CHAR:
3740           case JVM_SIGNATURE_SHORT:
3741           case JVM_SIGNATURE_INT:
3742           case JVM_SIGNATURE_FLOAT:
3743           case JVM_SIGNATURE_DOUBLE:
3744           case JVM_SIGNATURE_LONG:
3745           case JVM_SIGNATURE_FUNC:  /* ignore initial (, if given */
3746             break;
3747           case JVM_SIGNATURE_CLASS:
3748             while (*p != JVM_SIGNATURE_ENDCLASS) p++;
3749             break;
3750           case JVM_SIGNATURE_ARRAY:
3751             while (*p == JVM_SIGNATURE_ARRAY) p++;
3752             /* If an array of classes, skip over class name, too. */
3753             if (*p == JVM_SIGNATURE_CLASS) {
3754                 while (*p != JVM_SIGNATURE_ENDCLASS) p++;
3755             }
3756             break;
3757           default:
3758             /* Indicate an error. */
3759             return NULL;
3760         }
3761     }
3762     return p++; /* skip over ')'. */
3763 }
3764 
3765 static char
3766 signature_to_fieldtype(context_type *context,
3767                        const char **signature_p, fullinfo_type *full_info_p)
3768 {
3769     const char *p = *signature_p;
3770     fullinfo_type full_info = MAKE_FULLINFO(ITEM_Bogus, 0, 0);
3771     char result;
3772     int array_depth = 0;
3773 
3774     for (;;) {
3775         switch(*p++) {
3776             default:
3777                 result = 0;
3778                 break;
3779 
3780             case JVM_SIGNATURE_BOOLEAN:
3781                 full_info = (array_depth > 0)
3782                               ? MAKE_FULLINFO(ITEM_Boolean, 0, 0)
3783                               : MAKE_FULLINFO(ITEM_Integer, 0, 0);
3784                 result = 'I';
3785                 break;
3786 
3787             case JVM_SIGNATURE_BYTE:
3788                 full_info = (array_depth > 0)
3789                               ? MAKE_FULLINFO(ITEM_Byte, 0, 0)
3790                               : MAKE_FULLINFO(ITEM_Integer, 0, 0);
3791                 result = 'I';
3792                 break;
3793 
3794             case JVM_SIGNATURE_CHAR:
3795                 full_info = (array_depth > 0)
3796                               ? MAKE_FULLINFO(ITEM_Char, 0, 0)
3797                               : MAKE_FULLINFO(ITEM_Integer, 0, 0);
3798                 result = 'I';
3799                 break;
3800 
3801             case JVM_SIGNATURE_SHORT:
3802                 full_info = (array_depth > 0)
3803                               ? MAKE_FULLINFO(ITEM_Short, 0, 0)
3804                               : MAKE_FULLINFO(ITEM_Integer, 0, 0);
3805                 result = 'I';
3806                 break;
3807 
3808             case JVM_SIGNATURE_INT:
3809                 full_info = MAKE_FULLINFO(ITEM_Integer, 0, 0);
3810                 result = 'I';
3811                 break;
3812 
3813             case JVM_SIGNATURE_FLOAT:
3814                 full_info = MAKE_FULLINFO(ITEM_Float, 0, 0);
3815                 result = 'F';
3816                 break;
3817 
3818             case JVM_SIGNATURE_DOUBLE:
3819                 full_info = MAKE_FULLINFO(ITEM_Double, 0, 0);
3820                 result = 'D';
3821                 break;
3822 
3823             case JVM_SIGNATURE_LONG:
3824                 full_info = MAKE_FULLINFO(ITEM_Long, 0, 0);
3825                 result = 'L';
3826                 break;
3827 
3828             case JVM_SIGNATURE_ARRAY:
3829                 array_depth++;
3830                 continue;       /* only time we ever do the loop > 1 */
3831 
3832             case JVM_SIGNATURE_CLASS: {
3833                 char buffer_space[256];
3834                 char *buffer = buffer_space;
3835                 char *finish = strchr(p, JVM_SIGNATURE_ENDCLASS);
3836                 int length;
3837                 if (finish == NULL) {
3838                     /* Signature must have ';' after the class name.
3839                      * If it does not, return 0 and ITEM_Bogus in full_info. */
3840                     result = 0;
3841                     break;
3842                 }
3843                 assert(finish >= p);
3844                 length = (int)(finish - p);
3845                 if (length + 1 > (int)sizeof(buffer_space)) {
3846                     buffer = malloc(length + 1);
3847                     check_and_push_malloc_block(context, buffer);
3848                 }
3849                 memcpy(buffer, p, length);
3850                 buffer[length] = '\0';
3851                 full_info = make_class_info_from_name(context, buffer);
3852                 result = 'A';
3853                 p = finish + 1;
3854                 if (buffer != buffer_space)
3855                     pop_and_free(context);
3856                 break;
3857             }
3858         } /* end of switch */
3859         break;
3860     }
3861     *signature_p = p;
3862     if (array_depth == 0 || result == 0) {
3863         /* either not an array, or result is bogus */
3864         *full_info_p = full_info;
3865         return result;
3866     } else {
3867         if (array_depth > MAX_ARRAY_DIMENSIONS)
3868             CCerror(context, "Array with too many dimensions");
3869         *full_info_p = MAKE_FULLINFO(GET_ITEM_TYPE(full_info),
3870                                      array_depth,
3871                                      GET_EXTRA_INFO(full_info));
3872         return 'A';
3873     }
3874 }
3875 
3876 
3877 /* Given an array type, create the type that has one less level of
3878  * indirection.
3879  */
3880 
3881 static fullinfo_type
3882 decrement_indirection(fullinfo_type array_info)
3883 {
3884     if (array_info == NULL_FULLINFO) {
3885         return NULL_FULLINFO;
3886     } else {
3887         int type = GET_ITEM_TYPE(array_info);
3888         int indirection = GET_INDIRECTION(array_info) - 1;
3889         int extra_info = GET_EXTRA_INFO(array_info);
3890         if (   (indirection == 0)
3891                && ((type == ITEM_Short || type == ITEM_Byte || type == ITEM_Boolean || type == ITEM_Char)))
3892             type = ITEM_Integer;
3893         return MAKE_FULLINFO(type, indirection, extra_info);
3894     }
3895 }
3896 
3897 
3898 /* See if we can assign an object of the "from" type to an object
3899  * of the "to" type.
3900  */
3901 
3902 static jboolean isAssignableTo(context_type *context,
3903                              fullinfo_type from, fullinfo_type to)
3904 {
3905     return (merge_fullinfo_types(context, from, to, JNI_TRUE) == to);
3906 }
3907 
3908 /* Given two fullinfo_type's, find their lowest common denominator.  If
3909  * the assignable_p argument is non-null, we're really just calling to find
3910  * out if "<target> := <value>" is a legitimate assignment.
3911  *
3912  * We treat all interfaces as if they were of type java/lang/Object, since the
3913  * runtime will do the full checking.
3914  */
3915 static fullinfo_type
3916 merge_fullinfo_types(context_type *context,
3917                      fullinfo_type value, fullinfo_type target,
3918                      jboolean for_assignment)
3919 {
3920     JNIEnv *env = context->env;
3921     if (value == target) {
3922         /* If they're identical, clearly just return what we've got */
3923         return value;
3924     }
3925 
3926     /* Both must be either arrays or objects to go further */
3927     if (GET_INDIRECTION(value) == 0 && GET_ITEM_TYPE(value) != ITEM_Object)
3928         return MAKE_FULLINFO(ITEM_Bogus, 0, 0);
3929     if (GET_INDIRECTION(target) == 0 && GET_ITEM_TYPE(target) != ITEM_Object)
3930         return MAKE_FULLINFO(ITEM_Bogus, 0, 0);
3931 
3932     /* If either is NULL, return the other. */
3933     if (value == NULL_FULLINFO)
3934         return target;
3935     else if (target == NULL_FULLINFO)
3936         return value;
3937 
3938     /* If either is java/lang/Object, that's the result. */
3939     if (target == context->object_info)
3940         return target;
3941     else if (value == context->object_info) {
3942         /* Minor hack.  For assignments, Interface := Object, return Interface
3943          * rather than Object, so that isAssignableTo() will get the right
3944          * result.      */
3945         if (for_assignment && (WITH_ZERO_EXTRA_INFO(target) ==
3946                                   MAKE_FULLINFO(ITEM_Object, 0, 0))) {
3947             jclass cb = object_fullinfo_to_classclass(context,
3948                                                       target);
3949             int is_interface = cb && JVM_IsInterface(env, cb);
3950             if (is_interface)
3951                 return target;
3952         }
3953         return value;
3954     }
3955     if (GET_INDIRECTION(value) > 0 || GET_INDIRECTION(target) > 0) {
3956         /* At least one is an array.  Neither is java/lang/Object or NULL.
3957          * Moreover, the types are not identical.
3958          * The result must either be Object, or an array of some object type.
3959          */
3960         fullinfo_type value_base, target_base;
3961         int dimen_value = GET_INDIRECTION(value);
3962         int dimen_target = GET_INDIRECTION(target);
3963 
3964         if (target == context->cloneable_info ||
3965             target == context->serializable_info) {
3966             return target;
3967         }
3968 
3969         if (value == context->cloneable_info ||
3970             value == context->serializable_info) {
3971             return value;
3972         }
3973 
3974         /* First, if either item's base type isn't ITEM_Object, promote it up
3975          * to an object or array of object.  If either is elemental, we can
3976          * punt.
3977          */
3978         if (GET_ITEM_TYPE(value) != ITEM_Object) {
3979             if (dimen_value == 0)
3980                 return MAKE_FULLINFO(ITEM_Bogus, 0, 0);
3981             dimen_value--;
3982             value = MAKE_Object_ARRAY(dimen_value);
3983 
3984         }
3985         if (GET_ITEM_TYPE(target) != ITEM_Object) {
3986             if (dimen_target == 0)
3987                 return MAKE_FULLINFO(ITEM_Bogus, 0, 0);
3988             dimen_target--;
3989             target = MAKE_Object_ARRAY(dimen_target);
3990         }
3991         /* Both are now objects or arrays of some sort of object type */
3992         value_base = WITH_ZERO_INDIRECTION(value);
3993         target_base = WITH_ZERO_INDIRECTION(target);
3994         if (dimen_value == dimen_target) {
3995             /* Arrays of the same dimension.  Merge their base types. */
3996             fullinfo_type  result_base =
3997                 merge_fullinfo_types(context, value_base, target_base,
3998                                             for_assignment);
3999             if (result_base == MAKE_FULLINFO(ITEM_Bogus, 0, 0))
4000                 /* bogus in, bogus out */
4001                 return result_base;
4002             return MAKE_FULLINFO(ITEM_Object, dimen_value,
4003                                  GET_EXTRA_INFO(result_base));
4004         } else {
4005             /* Arrays of different sizes. If the smaller dimension array's base
4006              * type is java/lang/Cloneable or java/io/Serializable, return it.
4007              * Otherwise return java/lang/Object with a dimension of the smaller
4008              * of the two */
4009             if (dimen_value < dimen_target) {
4010                 if (value_base == context->cloneable_info ||
4011                     value_base == context ->serializable_info) {
4012                     return value;
4013                 }
4014                 return MAKE_Object_ARRAY(dimen_value);
4015             } else {
4016                 if (target_base == context->cloneable_info ||
4017                     target_base == context->serializable_info) {
4018                     return target;
4019                 }
4020                 return MAKE_Object_ARRAY(dimen_target);
4021             }
4022         }
4023     } else {
4024         /* Both are non-array objects. Neither is java/lang/Object or NULL */
4025         jclass cb_value, cb_target, cb_super_value, cb_super_target;
4026         fullinfo_type result_info;
4027 
4028         /* Let's get the classes corresponding to each of these.  Treat
4029          * interfaces as if they were java/lang/Object.  See hack note above. */
4030         cb_target = object_fullinfo_to_classclass(context, target);
4031         if (cb_target == 0)
4032             return MAKE_FULLINFO(ITEM_Bogus, 0, 0);
4033         if (JVM_IsInterface(env, cb_target))
4034             return for_assignment ? target : context->object_info;
4035         cb_value = object_fullinfo_to_classclass(context, value);
4036         if (cb_value == 0)
4037             return MAKE_FULLINFO(ITEM_Bogus, 0, 0);
4038         if (JVM_IsInterface(env, cb_value))
4039             return context->object_info;
4040 
4041         /* If this is for assignment of target := value, we just need to see if
4042          * cb_target is a superclass of cb_value.  Save ourselves a lot of
4043          * work.
4044          */
4045         if (for_assignment) {
4046             cb_super_value = (*env)->GetSuperclass(env, cb_value);
4047             while (cb_super_value != 0) {
4048                 jclass tmp_cb;
4049                 if ((*env)->IsSameObject(env, cb_super_value, cb_target)) {
4050                     (*env)->DeleteLocalRef(env, cb_super_value);
4051                     return target;
4052                 }
4053                 tmp_cb =  (*env)->GetSuperclass(env, cb_super_value);
4054                 (*env)->DeleteLocalRef(env, cb_super_value);
4055                 cb_super_value = tmp_cb;
4056             }
4057             (*env)->DeleteLocalRef(env, cb_super_value);
4058             return context->object_info;
4059         }
4060 
4061         /* Find out whether cb_value or cb_target is deeper in the class
4062          * tree by moving both toward the root, and seeing who gets there
4063          * first.                                                          */
4064         cb_super_value = (*env)->GetSuperclass(env, cb_value);
4065         cb_super_target = (*env)->GetSuperclass(env, cb_target);
4066         while((cb_super_value != 0) &&
4067               (cb_super_target != 0)) {
4068             jclass tmp_cb;
4069             /* Optimization.  If either hits the other when going up looking
4070              * for a parent, then might as well return the parent immediately */
4071             if ((*env)->IsSameObject(env, cb_super_value, cb_target)) {
4072                 (*env)->DeleteLocalRef(env, cb_super_value);
4073                 (*env)->DeleteLocalRef(env, cb_super_target);
4074                 return target;
4075             }
4076             if ((*env)->IsSameObject(env, cb_super_target, cb_value)) {
4077                 (*env)->DeleteLocalRef(env, cb_super_value);
4078                 (*env)->DeleteLocalRef(env, cb_super_target);
4079                 return value;
4080             }
4081             tmp_cb = (*env)->GetSuperclass(env, cb_super_value);
4082             (*env)->DeleteLocalRef(env, cb_super_value);
4083             cb_super_value = tmp_cb;
4084 
4085             tmp_cb = (*env)->GetSuperclass(env, cb_super_target);
4086             (*env)->DeleteLocalRef(env, cb_super_target);
4087             cb_super_target = tmp_cb;
4088         }
4089         cb_value = (*env)->NewLocalRef(env, cb_value);
4090         cb_target = (*env)->NewLocalRef(env, cb_target);
4091         /* At most one of the following two while clauses will be executed.
4092          * Bring the deeper of cb_target and cb_value to the depth of the
4093          * shallower one.
4094          */
4095         while (cb_super_value != 0) {
4096           /* cb_value is deeper */
4097             jclass cb_tmp;
4098 
4099             cb_tmp = (*env)->GetSuperclass(env, cb_super_value);
4100             (*env)->DeleteLocalRef(env, cb_super_value);
4101             cb_super_value = cb_tmp;
4102 
4103             cb_tmp = (*env)->GetSuperclass(env, cb_value);
4104             (*env)->DeleteLocalRef(env, cb_value);
4105             cb_value = cb_tmp;
4106         }
4107         while (cb_super_target != 0) {
4108           /* cb_target is deeper */
4109             jclass cb_tmp;
4110 
4111             cb_tmp = (*env)->GetSuperclass(env, cb_super_target);
4112             (*env)->DeleteLocalRef(env, cb_super_target);
4113             cb_super_target = cb_tmp;
4114 
4115             cb_tmp = (*env)->GetSuperclass(env, cb_target);
4116             (*env)->DeleteLocalRef(env, cb_target);
4117             cb_target = cb_tmp;
4118         }
4119 
4120         /* Walk both up, maintaining equal depth, until a join is found.  We
4121          * know that we will find one.  */
4122         while (!(*env)->IsSameObject(env, cb_value, cb_target)) {
4123             jclass cb_tmp;
4124             cb_tmp = (*env)->GetSuperclass(env, cb_value);
4125             (*env)->DeleteLocalRef(env, cb_value);
4126             cb_value = cb_tmp;
4127             cb_tmp = (*env)->GetSuperclass(env, cb_target);
4128             (*env)->DeleteLocalRef(env, cb_target);
4129             cb_target = cb_tmp;
4130         }
4131         result_info = make_class_info(context, cb_value);
4132         (*env)->DeleteLocalRef(env, cb_value);
4133         (*env)->DeleteLocalRef(env, cb_super_value);
4134         (*env)->DeleteLocalRef(env, cb_target);
4135         (*env)->DeleteLocalRef(env, cb_super_target);
4136         return result_info;
4137     } /* both items are classes */
4138 }
4139 
4140 
4141 /* Given a fullinfo_type corresponding to an Object, return the jclass
4142  * of that type.
4143  *
4144  * This function always returns a global reference!
4145  */
4146 
4147 static jclass
4148 object_fullinfo_to_classclass(context_type *context, fullinfo_type classinfo)
4149 {
4150     unsigned short info = GET_EXTRA_INFO(classinfo);
4151     return ID_to_class(context, info);
4152 }
4153 
4154 static void free_block(void *ptr, int kind)
4155 {
4156     switch (kind) {
4157     case VM_STRING_UTF:
4158         JVM_ReleaseUTF(ptr);
4159         break;
4160     case VM_MALLOC_BLK:
4161         free(ptr);
4162         break;
4163     }
4164 }
4165 
4166 static void check_and_push_common(context_type *context, void *ptr, int kind)
4167 {
4168     alloc_stack_type *p;
4169     if (ptr == 0)
4170         CCout_of_memory(context);
4171     if (context->alloc_stack_top < ALLOC_STACK_SIZE)
4172         p = &(context->alloc_stack[context->alloc_stack_top++]);
4173     else {
4174         /* Otherwise we have to malloc */
4175         p = malloc(sizeof(alloc_stack_type));
4176         if (p == 0) {
4177             /* Make sure we clean up. */
4178             free_block(ptr, kind);
4179             CCout_of_memory(context);
4180         }
4181     }
4182     p->kind = kind;
4183     p->ptr = ptr;
4184     p->next = context->allocated_memory;
4185     context->allocated_memory = p;
4186 }
4187 
4188 static void check_and_push_malloc_block(context_type *context, void *ptr) {
4189   check_and_push_common(context, ptr, VM_MALLOC_BLK);
4190 }
4191 
4192 static void check_and_push_string_utf(context_type *context, const char *ptr) {
4193   check_and_push_common(context, (void *)ptr, VM_STRING_UTF);
4194 }
4195 
4196 static void pop_and_free(context_type *context)
4197 {
4198     alloc_stack_type *p = context->allocated_memory;
4199     context->allocated_memory = p->next;
4200     free_block(p->ptr, p->kind);
4201     if (p < context->alloc_stack + ALLOC_STACK_SIZE &&
4202         p >= context->alloc_stack)
4203         context->alloc_stack_top--;
4204     else
4205         free(p);
4206 }
4207 
4208 static int signature_to_args_size(const char *method_signature)
4209 {
4210     const char *p;
4211     int args_size = 0;
4212     for (p = method_signature; *p != JVM_SIGNATURE_ENDFUNC; p++) {
4213         switch (*p) {
4214           case JVM_SIGNATURE_BOOLEAN:
4215           case JVM_SIGNATURE_BYTE:
4216           case JVM_SIGNATURE_CHAR:
4217           case JVM_SIGNATURE_SHORT:
4218           case JVM_SIGNATURE_INT:
4219           case JVM_SIGNATURE_FLOAT:
4220             args_size += 1;
4221             break;
4222           case JVM_SIGNATURE_CLASS:
4223             args_size += 1;
4224             while (*p != JVM_SIGNATURE_ENDCLASS) p++;
4225             break;
4226           case JVM_SIGNATURE_ARRAY:
4227             args_size += 1;
4228             while ((*p == JVM_SIGNATURE_ARRAY)) p++;
4229             /* If an array of classes, skip over class name, too. */
4230             if (*p == JVM_SIGNATURE_CLASS) {
4231                 while (*p != JVM_SIGNATURE_ENDCLASS)
4232                   p++;
4233             }
4234             break;
4235           case JVM_SIGNATURE_DOUBLE:
4236           case JVM_SIGNATURE_LONG:
4237             args_size += 2;
4238             break;
4239           case JVM_SIGNATURE_FUNC:  /* ignore initial (, if given */
4240             break;
4241           default:
4242             /* Indicate an error. */
4243             return 0;
4244         }
4245     }
4246     return args_size;
4247 }
4248 
4249 #ifdef DEBUG
4250 
4251 /* Below are for debugging. */
4252 
4253 static void print_fullinfo_type(context_type *, fullinfo_type, jboolean);
4254 
4255 static void
4256 print_stack(context_type *context, stack_info_type *stack_info)
4257 {
4258     stack_item_type *stack = stack_info->stack;
4259     if (stack_info->stack_size == UNKNOWN_STACK_SIZE) {
4260         jio_fprintf(stdout, "x");
4261     } else {
4262         jio_fprintf(stdout, "(");
4263         for ( ; stack != 0; stack = stack->next)
4264             print_fullinfo_type(context, stack->item,
4265                 (jboolean)(verify_verbose > 1 ? JNI_TRUE : JNI_FALSE));
4266         jio_fprintf(stdout, ")");
4267     }
4268 }
4269 
4270 static void
4271 print_registers(context_type *context, register_info_type *register_info)
4272 {
4273     int register_count = register_info->register_count;
4274     if (register_count == UNKNOWN_REGISTER_COUNT) {
4275         jio_fprintf(stdout, "x");
4276     } else {
4277         fullinfo_type *registers = register_info->registers;
4278         int mask_count = register_info->mask_count;
4279         mask_type *masks = register_info->masks;
4280         int i, j;
4281 
4282         jio_fprintf(stdout, "{");
4283         for (i = 0; i < register_count; i++)
4284             print_fullinfo_type(context, registers[i],
4285                 (jboolean)(verify_verbose > 1 ? JNI_TRUE : JNI_FALSE));
4286         jio_fprintf(stdout, "}");
4287         for (i = 0; i < mask_count; i++) {
4288             char *separator = "";
4289             int *modifies = masks[i].modifies;
4290             jio_fprintf(stdout, "<%d: ", masks[i].entry);
4291             for (j = 0;
4292                  j < JVM_GetMethodIxLocalsCount(context->env,
4293                                                 context->class,
4294                                                 context->method_index);
4295                  j++)
4296                 if (IS_BIT_SET(modifies, j)) {
4297                     jio_fprintf(stdout, "%s%d", separator, j);
4298                     separator = ",";
4299                 }
4300             jio_fprintf(stdout, ">");
4301         }
4302     }
4303 }
4304 
4305 
4306 static void
4307 print_flags(context_type *context, flag_type and_flags, flag_type or_flags)
4308 {
4309     if (and_flags != ((flag_type)-1) || or_flags != 0) {
4310         jio_fprintf(stdout, "<%x %x>", and_flags, or_flags);
4311     }
4312 }
4313 
4314 static void
4315 print_fullinfo_type(context_type *context, fullinfo_type type, jboolean verbose)
4316 {
4317     int i;
4318     int indirection = GET_INDIRECTION(type);
4319     for (i = indirection; i-- > 0; )
4320         jio_fprintf(stdout, "[");
4321     switch (GET_ITEM_TYPE(type)) {
4322         case ITEM_Integer:
4323             jio_fprintf(stdout, "I"); break;
4324         case ITEM_Float:
4325             jio_fprintf(stdout, "F"); break;
4326         case ITEM_Double:
4327             jio_fprintf(stdout, "D"); break;
4328         case ITEM_Double_2:
4329             jio_fprintf(stdout, "d"); break;
4330         case ITEM_Long:
4331             jio_fprintf(stdout, "L"); break;
4332         case ITEM_Long_2:
4333             jio_fprintf(stdout, "l"); break;
4334         case ITEM_ReturnAddress:
4335             jio_fprintf(stdout, "a"); break;
4336         case ITEM_Object:
4337             if (!verbose) {
4338                 jio_fprintf(stdout, "A");
4339             } else {
4340                 unsigned short extra = GET_EXTRA_INFO(type);
4341                 if (extra == 0) {
4342                     jio_fprintf(stdout, "/Null/");
4343                 } else {
4344                     const char *name = ID_to_class_name(context, extra);
4345                     const char *name2 = strrchr(name, '/');
4346                     jio_fprintf(stdout, "/%s/", name2 ? name2 + 1 : name);
4347                 }
4348             }
4349             break;
4350         case ITEM_Char:
4351             jio_fprintf(stdout, "C"); break;
4352         case ITEM_Short:
4353             jio_fprintf(stdout, "S"); break;
4354         case ITEM_Boolean:
4355             jio_fprintf(stdout, "Z"); break;
4356         case ITEM_Byte:
4357             jio_fprintf(stdout, "B"); break;
4358         case ITEM_NewObject:
4359             if (!verbose) {
4360                 jio_fprintf(stdout, "@");
4361             } else {
4362                 int inum = GET_EXTRA_INFO(type);
4363                 fullinfo_type real_type =
4364                     context->instruction_data[inum].operand2.fi;
4365                 jio_fprintf(stdout, ">");
4366                 print_fullinfo_type(context, real_type, JNI_TRUE);
4367                 jio_fprintf(stdout, "<");
4368             }
4369             break;
4370         case ITEM_InitObject:
4371             jio_fprintf(stdout, verbose ? ">/this/<" : "@");
4372             break;
4373 
4374         default:
4375             jio_fprintf(stdout, "?"); break;
4376     }
4377     for (i = indirection; i-- > 0; )
4378         jio_fprintf(stdout, "]");
4379 }
4380 
4381 
4382 static void
4383 print_formatted_fieldname(context_type *context, int index)
4384 {
4385     JNIEnv *env = context->env;
4386     jclass cb = context->class;
4387     const char *classname = JVM_GetCPFieldClassNameUTF(env, cb, index);
4388     const char *fieldname = JVM_GetCPFieldNameUTF(env, cb, index);
4389     jio_fprintf(stdout, "  <%s.%s>",
4390                 classname ? classname : "", fieldname ? fieldname : "");
4391     JVM_ReleaseUTF(classname);
4392     JVM_ReleaseUTF(fieldname);
4393 }
4394 
4395 static void
4396 print_formatted_methodname(context_type *context, int index)
4397 {
4398     JNIEnv *env = context->env;
4399     jclass cb = context->class;
4400     const char *classname = JVM_GetCPMethodClassNameUTF(env, cb, index);
4401     const char *methodname = JVM_GetCPMethodNameUTF(env, cb, index);
4402     jio_fprintf(stdout, "  <%s.%s>",
4403                 classname ? classname : "", methodname ? methodname : "");
4404     JVM_ReleaseUTF(classname);
4405     JVM_ReleaseUTF(methodname);
4406 }
4407 
4408 #endif /*DEBUG*/