1 /*
   2  * Copyright (c) 1994, 2021, Oracle and/or its affiliates. All rights reserved.
   3  * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
   4  *
   5  * This code is free software; you can redistribute it and/or modify it
   6  * under the terms of the GNU General Public License version 2 only, as
   7  * published by the Free Software Foundation.  Oracle designates this
   8  * particular file as subject to the "Classpath" exception as provided
   9  * by Oracle in the LICENSE file that accompanied this code.
  10  *
  11  * This code is distributed in the hope that it will be useful, but WITHOUT
  12  * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
  13  * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
  14  * version 2 for more details (a copy is included in the LICENSE file that
  15  * accompanied this code).
  16  *
  17  * You should have received a copy of the GNU General Public License version
  18  * 2 along with this work; if not, write to the Free Software Foundation,
  19  * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
  20  *
  21  * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
  22  * or visit www.oracle.com if you need additional information or have any
  23  * questions.
  24  */
  25 
  26 /*-
  27  *      Verify that the code within a method block doesn't exploit any
  28  *      security holes.
  29  */
  30 /*
  31    Exported function:
  32 
  33    jboolean
  34    VerifyClassForMajorVersion(JNIEnv *env, jclass cb, char *message_buffer,
  35                               jint buffer_length, jint major_version)
  36 
  37    This file now only uses the standard JNI and the following VM functions
  38    exported in jvm.h:
  39 
  40    JVM_FindClassFromClass
  41    JVM_IsInterface
  42    JVM_GetClassNameUTF
  43    JVM_GetClassCPEntriesCount
  44    JVM_GetClassCPTypes
  45    JVM_GetClassFieldsCount
  46    JVM_GetClassMethodsCount
  47 
  48    JVM_GetFieldIxModifiers
  49 
  50    JVM_GetMethodIxModifiers
  51    JVM_GetMethodIxExceptionTableLength
  52    JVM_GetMethodIxLocalsCount
  53    JVM_GetMethodIxArgsSize
  54    JVM_GetMethodIxMaxStack
  55    JVM_GetMethodIxNameUTF
  56    JVM_GetMethodIxSignatureUTF
  57    JVM_GetMethodIxExceptionsCount
  58    JVM_GetMethodIxExceptionIndexes
  59    JVM_GetMethodIxByteCodeLength
  60    JVM_GetMethodIxByteCode
  61    JVM_GetMethodIxExceptionTableEntry
  62    JVM_IsConstructorIx
  63 
  64    JVM_GetCPClassNameUTF
  65    JVM_GetCPFieldNameUTF
  66    JVM_GetCPMethodNameUTF
  67    JVM_GetCPFieldSignatureUTF
  68    JVM_GetCPMethodSignatureUTF
  69    JVM_GetCPFieldClassNameUTF
  70    JVM_GetCPMethodClassNameUTF
  71    JVM_GetCPFieldModifiers
  72    JVM_GetCPMethodModifiers
  73 
  74    JVM_ReleaseUTF
  75    JVM_IsSameClassPackage
  76 
  77  */
  78 
  79 #include <string.h>
  80 #include <setjmp.h>
  81 #include <assert.h>
  82 #include <limits.h>
  83 #include <stdlib.h>
  84 
  85 #include "jni.h"
  86 #include "jni_util.h"
  87 #include "jvm.h"
  88 #include "classfile_constants.h"
  89 #include "opcodes.in_out"
  90 
  91 /* On AIX malloc(0) and calloc(0, ...) return a NULL pointer, which is legal,
  92  * but the code here does not handles it. So we wrap the methods and return non-NULL
  93  * pointers even if we allocate 0 bytes.
  94  */
  95 #ifdef _AIX
  96 static int aix_dummy;
  97 static void* aix_malloc(size_t len) {
  98   if (len == 0) {
  99     return &aix_dummy;
 100   }
 101   return malloc(len);
 102 }
 103 
 104 static void* aix_calloc(size_t n, size_t size) {
 105   if (n == 0) {
 106     return &aix_dummy;
 107   }
 108   return calloc(n, size);
 109 }
 110 
 111 static void aix_free(void* p) {
 112   if (p == &aix_dummy) {
 113     return;
 114   }
 115   free(p);
 116 }
 117 
 118 #undef malloc
 119 #undef calloc
 120 #undef free
 121 #define malloc aix_malloc
 122 #define calloc aix_calloc
 123 #define free aix_free
 124 #endif
 125 
 126 #ifdef __APPLE__
 127 /* use setjmp/longjmp versions that do not save/restore the signal mask */
 128 #define setjmp _setjmp
 129 #define longjmp _longjmp
 130 #endif
 131 
 132 #define MAX_ARRAY_DIMENSIONS 255
 133 /* align byte code */
 134 #ifndef ALIGN_UP
 135 #define ALIGN_UP(n,align_grain) (((n) + ((align_grain) - 1)) & ~((align_grain)-1))
 136 #endif /* ALIGN_UP */
 137 #define UCALIGN(n) ((unsigned char *)ALIGN_UP((uintptr_t)(n),sizeof(int)))
 138 
 139 #ifdef DEBUG
 140 
 141 int verify_verbose = 0;
 142 static struct context_type *GlobalContext;
 143 #endif
 144 
 145 enum {
 146     ITEM_Bogus,
 147     ITEM_Void,                  /* only as a function return value */
 148     ITEM_Integer,
 149     ITEM_Float,
 150     ITEM_Double,
 151     ITEM_Double_2,              /* 2nd word of double in register */
 152     ITEM_Long,
 153     ITEM_Long_2,                /* 2nd word of long in register */
 154     ITEM_Array,
 155     ITEM_Object,                /* Extra info field gives name. */
 156     ITEM_NewObject,             /* Like object, but uninitialized. */
 157     ITEM_InitObject,            /* "this" is init method, before call
 158                                     to super() */
 159     ITEM_ReturnAddress,         /* Extra info gives instr # of start pc */
 160     /* The following four are only used within array types.
 161      * Normally, we use ITEM_Integer, instead. */
 162     ITEM_Byte,
 163     ITEM_Short,
 164     ITEM_Char,
 165     ITEM_Boolean
 166 };
 167 
 168 
 169 #define UNKNOWN_STACK_SIZE -1
 170 #define UNKNOWN_REGISTER_COUNT -1
 171 #define UNKNOWN_RET_INSTRUCTION -1
 172 
 173 #undef MAX
 174 #undef MIN
 175 #define MAX(a, b) ((a) > (b) ? (a) : (b))
 176 #define MIN(a, b) ((a) < (b) ? (a) : (b))
 177 
 178 #define BITS_PER_INT   (CHAR_BIT * sizeof(int)/sizeof(char))
 179 #define SET_BIT(flags, i)  (flags[(i)/BITS_PER_INT] |= \
 180                                        ((unsigned)1 << ((i) % BITS_PER_INT)))
 181 #define IS_BIT_SET(flags, i) (flags[(i)/BITS_PER_INT] & \
 182                                        ((unsigned)1 << ((i) % BITS_PER_INT)))
 183 
 184 typedef unsigned int fullinfo_type;
 185 typedef unsigned int *bitvector;
 186 
 187 #define GET_ITEM_TYPE(thing) ((thing) & 0x1F)
 188 #define GET_INDIRECTION(thing) (((thing) & 0xFFFF) >> 5)
 189 #define GET_EXTRA_INFO(thing) ((thing) >> 16)
 190 #define WITH_ZERO_INDIRECTION(thing) ((thing) & ~(0xFFE0))
 191 #define WITH_ZERO_EXTRA_INFO(thing) ((thing) & 0xFFFF)
 192 
 193 #define MAKE_FULLINFO(type, indirect, extra) \
 194      ((type) + ((indirect) << 5) + ((extra) << 16))
 195 
 196 #define MAKE_Object_ARRAY(indirect) \
 197        (context->object_info + ((indirect) << 5))
 198 
 199 #define NULL_FULLINFO MAKE_FULLINFO(ITEM_Object, 0, 0)
 200 
 201 /* JVM_OPC_invokespecial calls to <init> need to be treated special */
 202 #define JVM_OPC_invokeinit 0x100
 203 
 204 /* A hash mechanism used by the verifier.
 205  * Maps class names to unique 16 bit integers.
 206  */
 207 
 208 #define HASH_TABLE_SIZE 503
 209 
 210 /* The buckets are managed as a 256 by 256 matrix. We allocate an entire
 211  * row (256 buckets) at a time to minimize fragmentation. Rows are
 212  * allocated on demand so that we don't waste too much space.
 213  */
 214 
 215 #define MAX_HASH_ENTRIES 65536
 216 #define HASH_ROW_SIZE 256
 217 
 218 typedef struct hash_bucket_type {
 219     char *name;
 220     unsigned int hash;
 221     jclass class;
 222     unsigned short ID;
 223     unsigned short next;
 224     unsigned loadable:1;  /* from context->class loader */
 225 } hash_bucket_type;
 226 
 227 typedef struct {
 228     hash_bucket_type **buckets;
 229     unsigned short *table;
 230     int entries_used;
 231 } hash_table_type;
 232 
 233 #define GET_BUCKET(class_hash, ID)\
 234     (class_hash->buckets[ID / HASH_ROW_SIZE] + ID % HASH_ROW_SIZE)
 235 
 236 /*
 237  * There are currently two types of resources that we need to keep
 238  * track of (in addition to the CCalloc pool).
 239  */
 240 enum {
 241     VM_STRING_UTF, /* VM-allocated UTF strings */
 242     VM_MALLOC_BLK  /* malloc'ed blocks */
 243 };
 244 
 245 #define LDC_CLASS_MAJOR_VERSION 49
 246 
 247 #define LDC_METHOD_HANDLE_MAJOR_VERSION 51
 248 
 249 #define NONZERO_PADDING_BYTES_IN_SWITCH_MAJOR_VERSION 51
 250 
 251 #define STATIC_METHOD_IN_INTERFACE_MAJOR_VERSION  52
 252 
 253 #define ALLOC_STACK_SIZE 16 /* big enough */
 254 
 255 typedef struct alloc_stack_type {
 256     void *ptr;
 257     int kind;
 258     struct alloc_stack_type *next;
 259 } alloc_stack_type;
 260 
 261 /* The context type encapsulates the current invocation of the byte
 262  * code verifier.
 263  */
 264 struct context_type {
 265 
 266     JNIEnv *env;                /* current JNIEnv */
 267 
 268     /* buffers etc. */
 269     char *message;
 270     jint message_buf_len;
 271     jboolean err_code;
 272 
 273     alloc_stack_type *allocated_memory; /* all memory blocks that we have not
 274                                            had a chance to free */
 275     /* Store up to ALLOC_STACK_SIZE number of handles to allocated memory
 276        blocks here, to save mallocs. */
 277     alloc_stack_type alloc_stack[ALLOC_STACK_SIZE];
 278     int alloc_stack_top;
 279 
 280     /* these fields are per class */
 281     jclass class;               /* current class */
 282     jint major_version;
 283     jint nconstants;
 284     unsigned char *constant_types;
 285     hash_table_type class_hash;
 286 
 287     fullinfo_type object_info;  /* fullinfo for java/lang/Object */
 288     fullinfo_type string_info;  /* fullinfo for java/lang/String */
 289     fullinfo_type throwable_info; /* fullinfo for java/lang/Throwable */
 290     fullinfo_type cloneable_info; /* fullinfo for java/lang/Cloneable */
 291     fullinfo_type serializable_info; /* fullinfo for java/io/Serializable */
 292 
 293     fullinfo_type currentclass_info; /* fullinfo for context->class */
 294     fullinfo_type superclass_info;   /* fullinfo for superclass */
 295 
 296     /* these fields are per method */
 297     int method_index;   /* current method */
 298     unsigned short *exceptions; /* exceptions */
 299     unsigned char *code;        /* current code object */
 300     jint code_length;
 301     int *code_data;             /* offset to instruction number */
 302     struct instruction_data_type *instruction_data; /* info about each */
 303     struct handler_info_type *handler_info;
 304     fullinfo_type *superclasses; /* null terminated superclasses */
 305     int instruction_count;      /* number of instructions */
 306     fullinfo_type return_type;  /* function return type */
 307     fullinfo_type swap_table[4]; /* used for passing information */
 308     int bitmask_size;           /* words needed to hold bitmap of arguments */
 309 
 310     /* these fields are per field */
 311     int field_index;
 312 
 313     /* Used by the space allocator */
 314     struct CCpool *CCroot, *CCcurrent;
 315     char *CCfree_ptr;
 316     int CCfree_size;
 317 
 318     /* Jump here on any error. */
 319     jmp_buf jump_buffer;
 320 
 321 #ifdef DEBUG
 322     /* keep track of how many global refs are allocated. */
 323     int n_globalrefs;
 324 #endif
 325 };
 326 
 327 struct stack_info_type {
 328     struct stack_item_type *stack;
 329     int stack_size;
 330 };
 331 
 332 struct register_info_type {
 333     int register_count;         /* number of registers used */
 334     fullinfo_type *registers;
 335     int mask_count;             /* number of masks in the following */
 336     struct mask_type *masks;
 337 };
 338 
 339 struct mask_type {
 340     int entry;
 341     int *modifies;
 342 };
 343 
 344 typedef unsigned short flag_type;
 345 
 346 struct instruction_data_type {
 347     int opcode;         /* may turn into "canonical" opcode */
 348     unsigned changed:1;         /* has it changed */
 349     unsigned protected:1;       /* must accessor be a subclass of "this" */
 350     union {
 351         int i;                  /* operand to the opcode */
 352         int *ip;
 353         fullinfo_type fi;
 354     } operand, operand2;
 355     fullinfo_type p;
 356     struct stack_info_type stack_info;
 357     struct register_info_type register_info;
 358 #define FLAG_REACHED            0x01 /* instruction reached */
 359 #define FLAG_NEED_CONSTRUCTOR   0x02 /* must call this.<init> or super.<init> */
 360 #define FLAG_NO_RETURN          0x04 /* must throw out of method */
 361     flag_type or_flags;         /* true for at least one path to this inst */
 362 #define FLAG_CONSTRUCTED        0x01 /* this.<init> or super.<init> called */
 363     flag_type and_flags;        /* true for all paths to this instruction */
 364 };
 365 
 366 struct handler_info_type {
 367     int start, end, handler;
 368     struct stack_info_type stack_info;
 369 };
 370 
 371 struct stack_item_type {
 372     fullinfo_type item;
 373     struct stack_item_type *next;
 374 };
 375 
 376 typedef struct context_type context_type;
 377 typedef struct instruction_data_type instruction_data_type;
 378 typedef struct stack_item_type stack_item_type;
 379 typedef struct register_info_type register_info_type;
 380 typedef struct stack_info_type stack_info_type;
 381 typedef struct mask_type mask_type;
 382 
 383 static void read_all_code(context_type *context, jclass cb, int num_methods,
 384                           int** code_lengths, unsigned char*** code);
 385 static void verify_method(context_type *context, jclass cb, int index,
 386                           int code_length, unsigned char* code);
 387 static void free_all_code(context_type* context, int num_methods,
 388                           unsigned char** code);
 389 static void verify_field(context_type *context, jclass cb, int index);
 390 
 391 static void verify_opcode_operands (context_type *, unsigned int inumber, int offset);
 392 static void set_protected(context_type *, unsigned int inumber, int key, int);
 393 static jboolean is_superclass(context_type *, fullinfo_type);
 394 
 395 static void initialize_exception_table(context_type *);
 396 static int instruction_length(unsigned char *iptr, unsigned char *end);
 397 static jboolean isLegalTarget(context_type *, int offset);
 398 static void verify_constant_pool_type(context_type *, int, unsigned);
 399 
 400 static void initialize_dataflow(context_type *);
 401 static void run_dataflow(context_type *context);
 402 static void check_register_values(context_type *context, unsigned int inumber);
 403 static void check_flags(context_type *context, unsigned int inumber);
 404 static void pop_stack(context_type *, unsigned int inumber, stack_info_type *);
 405 static void update_registers(context_type *, unsigned int inumber, register_info_type *);
 406 static void update_flags(context_type *, unsigned int inumber,
 407                          flag_type *new_and_flags, flag_type *new_or_flags);
 408 static void push_stack(context_type *, unsigned int inumber, stack_info_type *stack);
 409 
 410 static void merge_into_successors(context_type *, unsigned int inumber,
 411                                   register_info_type *register_info,
 412                                   stack_info_type *stack_info,
 413                                   flag_type and_flags, flag_type or_flags);
 414 static void merge_into_one_successor(context_type *context,
 415                                      unsigned int from_inumber,
 416                                      unsigned int inumber,
 417                                      register_info_type *register_info,
 418                                      stack_info_type *stack_info,
 419                                      flag_type and_flags, flag_type or_flags,
 420                                      jboolean isException);
 421 static void merge_stack(context_type *, unsigned int inumber,
 422                         unsigned int to_inumber, stack_info_type *);
 423 static void merge_registers(context_type *, unsigned int inumber,
 424                             unsigned int to_inumber,
 425                             register_info_type *);
 426 static void merge_flags(context_type *context, unsigned int from_inumber,
 427                         unsigned int to_inumber,
 428                         flag_type new_and_flags, flag_type new_or_flags);
 429 
 430 static stack_item_type *copy_stack(context_type *, stack_item_type *);
 431 static mask_type *copy_masks(context_type *, mask_type *masks, int mask_count);
 432 static mask_type *add_to_masks(context_type *, mask_type *, int , int);
 433 
 434 static fullinfo_type decrement_indirection(fullinfo_type);
 435 
 436 static fullinfo_type merge_fullinfo_types(context_type *context,
 437                                           fullinfo_type a,
 438                                           fullinfo_type b,
 439                                           jboolean assignment);
 440 static jboolean isAssignableTo(context_type *,
 441                                fullinfo_type a,
 442                                fullinfo_type b);
 443 
 444 static jclass object_fullinfo_to_classclass(context_type *, fullinfo_type);
 445 
 446 
 447 #define NEW(type, count) \
 448         ((type *)CCalloc(context, (count)*(sizeof(type)), JNI_FALSE))
 449 #define ZNEW(type, count) \
 450         ((type *)CCalloc(context, (count)*(sizeof(type)), JNI_TRUE))
 451 
 452 static void CCinit(context_type *context);
 453 static void CCreinit(context_type *context);
 454 static void CCdestroy(context_type *context);
 455 static void *CCalloc(context_type *context, int size, jboolean zero);
 456 
 457 static fullinfo_type cp_index_to_class_fullinfo(context_type *, int, int);
 458 
 459 static const char* get_result_signature(const char* signature);
 460 
 461 static char signature_to_fieldtype(context_type *context,
 462                                    const char **signature_p, fullinfo_type *info);
 463 
 464 static void CCerror (context_type *, char *format, ...);
 465 static void CFerror (context_type *, char *format, ...);
 466 static void CCout_of_memory (context_type *);
 467 
 468 /* Because we can longjmp any time, we need to be very careful about
 469  * remembering what needs to be freed. */
 470 
 471 static void check_and_push(context_type *context, const void *ptr, int kind);
 472 static void pop_and_free(context_type *context);
 473 
 474 static int signature_to_args_size(const char *method_signature);
 475 
 476 #ifdef DEBUG
 477 static void print_stack (context_type *, stack_info_type *stack_info);
 478 static void print_registers(context_type *, register_info_type *register_info);
 479 static void print_flags(context_type *, flag_type, flag_type);
 480 static void print_formatted_fieldname(context_type *context, int index);
 481 static void print_formatted_methodname(context_type *context, int index);
 482 #endif
 483 
 484 /*
 485  * Declare library specific JNI_Onload entry if static build
 486  */
 487 DEF_STATIC_JNI_OnLoad
 488 
 489 void initialize_class_hash(context_type *context)
 490 {
 491     hash_table_type *class_hash = &(context->class_hash);
 492     class_hash->buckets = (hash_bucket_type **)
 493         calloc(MAX_HASH_ENTRIES / HASH_ROW_SIZE, sizeof(hash_bucket_type *));
 494     class_hash->table = (unsigned short *)
 495         calloc(HASH_TABLE_SIZE, sizeof(unsigned short));
 496     if (class_hash->buckets == 0 ||
 497         class_hash->table == 0)
 498         CCout_of_memory(context);
 499     class_hash->entries_used = 0;
 500 }
 501 
 502 static void finalize_class_hash(context_type *context)
 503 {
 504     hash_table_type *class_hash = &(context->class_hash);
 505     JNIEnv *env = context->env;
 506     int i;
 507     /* 4296677: bucket index starts from 1. */
 508     for (i=1;i<=class_hash->entries_used;i++) {
 509         hash_bucket_type *bucket = GET_BUCKET(class_hash, i);
 510         assert(bucket != NULL);
 511         free(bucket->name);
 512         if (bucket->class) {
 513             (*env)->DeleteGlobalRef(env, bucket->class);
 514 #ifdef DEBUG
 515             context->n_globalrefs--;
 516 #endif
 517         }
 518     }
 519     if (class_hash->buckets) {
 520         for (i=0;i<MAX_HASH_ENTRIES / HASH_ROW_SIZE; i++) {
 521             if (class_hash->buckets[i] == 0)
 522                 break;
 523             free(class_hash->buckets[i]);
 524         }
 525     }
 526     free(class_hash->buckets);
 527     free(class_hash->table);
 528 }
 529 
 530 static hash_bucket_type *
 531 new_bucket(context_type *context, unsigned short *pID)
 532 {
 533     hash_table_type *class_hash = &(context->class_hash);
 534     int i = *pID = class_hash->entries_used + 1;
 535     int row = i / HASH_ROW_SIZE;
 536     if (i >= MAX_HASH_ENTRIES)
 537         CCerror(context, "Exceeded verifier's limit of 65535 referred classes");
 538     if (class_hash->buckets[row] == 0) {
 539         class_hash->buckets[row] = (hash_bucket_type*)
 540             calloc(HASH_ROW_SIZE, sizeof(hash_bucket_type));
 541         if (class_hash->buckets[row] == 0)
 542             CCout_of_memory(context);
 543     }
 544     class_hash->entries_used++; /* only increment when we are sure there
 545                                    is no overflow. */
 546     return GET_BUCKET(class_hash, i);
 547 }
 548 
 549 static unsigned int
 550 class_hash_fun(const char *s)
 551 {
 552     int i;
 553     unsigned raw_hash;
 554     for (raw_hash = 0; (i = *s) != '\0'; ++s)
 555         raw_hash = raw_hash * 37 + i;
 556     return raw_hash;
 557 }
 558 
 559 /*
 560  * Find a class using the defining loader of the current class
 561  * and return a local reference to it.
 562  */
 563 static jclass load_class_local(context_type *context,const char *classname)
 564 {
 565     jclass cb = JVM_FindClassFromClass(context->env, classname,
 566                                  JNI_FALSE, context->class);
 567     if (cb == 0)
 568          CCerror(context, "Cannot find class %s", classname);
 569     return cb;
 570 }
 571 
 572 /*
 573  * Find a class using the defining loader of the current class
 574  * and return a global reference to it.
 575  */
 576 static jclass load_class_global(context_type *context, const char *classname)
 577 {
 578     JNIEnv *env = context->env;
 579     jclass local, global;
 580 
 581     local = load_class_local(context, classname);
 582     global = (*env)->NewGlobalRef(env, local);
 583     if (global == 0)
 584         CCout_of_memory(context);
 585 #ifdef DEBUG
 586     context->n_globalrefs++;
 587 #endif
 588     (*env)->DeleteLocalRef(env, local);
 589     return global;
 590 }
 591 
 592 /*
 593  * Return a unique ID given a local class reference. The loadable
 594  * flag is true if the defining class loader of context->class
 595  * is known to be capable of loading the class.
 596  */
 597 static unsigned short
 598 class_to_ID(context_type *context, jclass cb, jboolean loadable)
 599 {
 600     JNIEnv *env = context->env;
 601     hash_table_type *class_hash = &(context->class_hash);
 602     unsigned int hash;
 603     hash_bucket_type *bucket;
 604     unsigned short *pID;
 605     const char *name = JVM_GetClassNameUTF(env, cb);
 606 
 607     check_and_push(context, name, VM_STRING_UTF);
 608     hash = class_hash_fun(name);
 609     pID = &(class_hash->table[hash % HASH_TABLE_SIZE]);
 610     while (*pID) {
 611         bucket = GET_BUCKET(class_hash, *pID);
 612         if (bucket->hash == hash && strcmp(name, bucket->name) == 0) {
 613             /*
 614              * There is an unresolved entry with our name
 615              * so we're forced to load it in case it matches us.
 616              */
 617             if (bucket->class == 0) {
 618                 assert(bucket->loadable == JNI_TRUE);
 619                 bucket->class = load_class_global(context, name);
 620             }
 621 
 622             /*
 623              * It's already in the table. Update the loadable
 624              * state if it's known and then we're done.
 625              */
 626             if ((*env)->IsSameObject(env, cb, bucket->class)) {
 627                 if (loadable && !bucket->loadable)
 628                     bucket->loadable = JNI_TRUE;
 629                 goto done;
 630             }
 631         }
 632         pID = &bucket->next;
 633     }
 634     bucket = new_bucket(context, pID);
 635     bucket->next = 0;
 636     bucket->hash = hash;
 637     bucket->name = malloc(strlen(name) + 1);
 638     if (bucket->name == 0)
 639         CCout_of_memory(context);
 640     strcpy(bucket->name, name);
 641     bucket->loadable = loadable;
 642     bucket->class = (*env)->NewGlobalRef(env, cb);
 643     if (bucket->class == 0)
 644         CCout_of_memory(context);
 645 #ifdef DEBUG
 646     context->n_globalrefs++;
 647 #endif
 648 
 649 done:
 650     pop_and_free(context);
 651     return *pID;
 652 }
 653 
 654 /*
 655  * Return a unique ID given a class name from the constant pool.
 656  * All classes are lazily loaded from the defining loader of
 657  * context->class.
 658  */
 659 static unsigned short
 660 class_name_to_ID(context_type *context, const char *name)
 661 {
 662     hash_table_type *class_hash = &(context->class_hash);
 663     unsigned int hash = class_hash_fun(name);
 664     hash_bucket_type *bucket;
 665     unsigned short *pID;
 666     jboolean force_load = JNI_FALSE;
 667 
 668     pID = &(class_hash->table[hash % HASH_TABLE_SIZE]);
 669     while (*pID) {
 670         bucket = GET_BUCKET(class_hash, *pID);
 671         if (bucket->hash == hash && strcmp(name, bucket->name) == 0) {
 672             if (bucket->loadable)
 673                 goto done;
 674             force_load = JNI_TRUE;
 675         }
 676         pID = &bucket->next;
 677     }
 678 
 679     if (force_load) {
 680         /*
 681          * We found at least one matching named entry for a class that
 682          * was not known to be loadable through the defining class loader
 683          * of context->class. We must load our named class and update
 684          * the hash table in case one these entries matches our class.
 685          */
 686         JNIEnv *env = context->env;
 687         jclass cb = load_class_local(context, name);
 688         unsigned short id = class_to_ID(context, cb, JNI_TRUE);
 689         (*env)->DeleteLocalRef(env, cb);
 690         return id;
 691     }
 692 
 693     bucket = new_bucket(context, pID);
 694     bucket->next = 0;
 695     bucket->class = 0;
 696     bucket->loadable = JNI_TRUE; /* name-only IDs are implicitly loadable */
 697     bucket->hash = hash;
 698     bucket->name = malloc(strlen(name) + 1);
 699     if (bucket->name == 0)
 700         CCout_of_memory(context);
 701     strcpy(bucket->name, name);
 702 
 703 done:
 704     return *pID;
 705 }
 706 
 707 #ifdef DEBUG
 708 static const char *
 709 ID_to_class_name(context_type *context, unsigned short ID)
 710 {
 711     hash_table_type *class_hash = &(context->class_hash);
 712     hash_bucket_type *bucket = GET_BUCKET(class_hash, ID);
 713     return bucket->name;
 714 }
 715 #endif
 716 
 717 static jclass
 718 ID_to_class(context_type *context, unsigned short ID)
 719 {
 720     hash_table_type *class_hash = &(context->class_hash);
 721     hash_bucket_type *bucket = GET_BUCKET(class_hash, ID);
 722     if (bucket->class == 0) {
 723         assert(bucket->loadable == JNI_TRUE);
 724         bucket->class = load_class_global(context, bucket->name);
 725     }
 726     return bucket->class;
 727 }
 728 
 729 static fullinfo_type
 730 make_loadable_class_info(context_type *context, jclass cb)
 731 {
 732     return MAKE_FULLINFO(ITEM_Object, 0,
 733                            class_to_ID(context, cb, JNI_TRUE));
 734 }
 735 
 736 static fullinfo_type
 737 make_class_info(context_type *context, jclass cb)
 738 {
 739     return MAKE_FULLINFO(ITEM_Object, 0,
 740                          class_to_ID(context, cb, JNI_FALSE));
 741 }
 742 
 743 static fullinfo_type
 744 make_class_info_from_name(context_type *context, const char *name)
 745 {
 746     return MAKE_FULLINFO(ITEM_Object, 0,
 747                          class_name_to_ID(context, name));
 748 }
 749 
 750 /* RETURNS
 751  * 1: on success       chosen to be consistent with previous VerifyClass
 752  * 0: verify error
 753  * 2: out of memory
 754  * 3: class format error
 755  *
 756  * Called by verify_class.  Verify the code of each of the methods
 757  * in a class.  Note that this function apparently can't be JNICALL,
 758  * because if it is the dynamic linker doesn't appear to be able to
 759  * find it on Win32.
 760  */
 761 
 762 #define CC_OK 1
 763 #define CC_VerifyError 0
 764 #define CC_OutOfMemory 2
 765 #define CC_ClassFormatError 3
 766 
 767 JNIEXPORT jboolean
 768 VerifyClassForMajorVersion(JNIEnv *env, jclass cb, char *buffer, jint len,
 769                            jint major_version)
 770 {
 771     context_type context_structure;
 772     context_type *context = &context_structure;
 773     jboolean result = CC_OK;
 774     int i;
 775     int num_methods;
 776     int* code_lengths;
 777     unsigned char** code;
 778 
 779 #ifdef DEBUG
 780     GlobalContext = context;
 781 #endif
 782 
 783     memset(context, 0, sizeof(context_type));
 784     context->message = buffer;
 785     context->message_buf_len = len;
 786 
 787     context->env = env;
 788     context->class = cb;
 789 
 790     /* Set invalid method/field index of the context, in case anyone
 791        calls CCerror */
 792     context->method_index = -1;
 793     context->field_index = -1;
 794 
 795     /* Don't call CCerror or anything that can call it above the setjmp! */
 796     if (!setjmp(context->jump_buffer)) {
 797         jclass super;
 798 
 799         CCinit(context);                /* initialize heap; may throw */
 800 
 801         initialize_class_hash(context);
 802 
 803         context->major_version = major_version;
 804         context->nconstants = JVM_GetClassCPEntriesCount(env, cb);
 805         context->constant_types = (unsigned char *)
 806             malloc(sizeof(unsigned char) * context->nconstants + 1);
 807 
 808         if (context->constant_types == 0)
 809             CCout_of_memory(context);
 810 
 811         JVM_GetClassCPTypes(env, cb, context->constant_types);
 812 
 813         if (context->constant_types == 0)
 814             CCout_of_memory(context);
 815 
 816         context->object_info =
 817             make_class_info_from_name(context, "java/lang/Object");
 818         context->string_info =
 819             make_class_info_from_name(context, "java/lang/String");
 820         context->throwable_info =
 821             make_class_info_from_name(context, "java/lang/Throwable");
 822         context->cloneable_info =
 823             make_class_info_from_name(context, "java/lang/Cloneable");
 824         context->serializable_info =
 825             make_class_info_from_name(context, "java/io/Serializable");
 826 
 827         context->currentclass_info = make_loadable_class_info(context, cb);
 828 
 829         super = (*env)->GetSuperclass(env, cb);
 830 
 831         if (super != 0) {
 832             fullinfo_type *gptr;
 833             int i = 0;
 834 
 835             context->superclass_info = make_loadable_class_info(context, super);
 836 
 837             while(super != 0) {
 838                 jclass tmp_cb = (*env)->GetSuperclass(env, super);
 839                 (*env)->DeleteLocalRef(env, super);
 840                 super = tmp_cb;
 841                 i++;
 842             }
 843             (*env)->DeleteLocalRef(env, super);
 844             super = 0;
 845 
 846             /* Can't go on context heap since it survives more than
 847                one method */
 848             context->superclasses = gptr =
 849                 malloc(sizeof(fullinfo_type)*(i + 1));
 850             if (gptr == 0) {
 851                 CCout_of_memory(context);
 852             }
 853 
 854             super = (*env)->GetSuperclass(env, context->class);
 855             while(super != 0) {
 856                 jclass tmp_cb;
 857                 *gptr++ = make_class_info(context, super);
 858                 tmp_cb = (*env)->GetSuperclass(env, super);
 859                 (*env)->DeleteLocalRef(env, super);
 860                 super = tmp_cb;
 861             }
 862             *gptr = 0;
 863         } else {
 864             context->superclass_info = 0;
 865         }
 866 
 867         (*env)->DeleteLocalRef(env, super);
 868 
 869         /* Look at each method */
 870         for (i = JVM_GetClassFieldsCount(env, cb); --i >= 0;)
 871             verify_field(context, cb, i);
 872         num_methods = JVM_GetClassMethodsCount(env, cb);
 873         read_all_code(context, cb, num_methods, &code_lengths, &code);
 874         for (i = num_methods - 1; i >= 0; --i)
 875             verify_method(context, cb, i, code_lengths[i], code[i]);
 876         free_all_code(context, num_methods, code);
 877         result = CC_OK;
 878     } else {
 879         result = context->err_code;
 880     }
 881 
 882     /* Cleanup */
 883     finalize_class_hash(context);
 884 
 885     while(context->allocated_memory)
 886         pop_and_free(context);
 887 
 888 #ifdef DEBUG
 889     GlobalContext = 0;
 890 #endif
 891 
 892     if (context->exceptions)
 893         free(context->exceptions);
 894 
 895     if (context->constant_types)
 896         free(context->constant_types);
 897 
 898     if (context->superclasses)
 899         free(context->superclasses);
 900 
 901 #ifdef DEBUG
 902     /* Make sure all global refs created in the verifier are freed */
 903     assert(context->n_globalrefs == 0);
 904 #endif
 905 
 906     CCdestroy(context);         /* destroy heap */
 907     return result;
 908 }
 909 
 910 static void
 911 verify_field(context_type *context, jclass cb, int field_index)
 912 {
 913     JNIEnv *env = context->env;
 914     int access_bits = JVM_GetFieldIxModifiers(env, cb, field_index);
 915     context->field_index = field_index;
 916 
 917     if (  ((access_bits & JVM_ACC_PUBLIC) != 0) &&
 918           ((access_bits & (JVM_ACC_PRIVATE | JVM_ACC_PROTECTED)) != 0)) {
 919         CCerror(context, "Inconsistent access bits.");
 920     }
 921     context->field_index = -1;
 922 }
 923 
 924 
 925 /**
 926  * We read all of the class's methods' code because it is possible that
 927  * the verification of one method could resulting in linking further
 928  * down the stack (due to class loading), which could end up rewriting
 929  * some of the bytecode of methods we haven't verified yet.  Since we
 930  * don't want to see the rewritten bytecode, cache all the code and
 931  * operate only on that.
 932  */
 933 static void
 934 read_all_code(context_type* context, jclass cb, int num_methods,
 935               int** lengths_addr, unsigned char*** code_addr)
 936 {
 937     int* lengths;
 938     unsigned char** code;
 939     int i;
 940 
 941     lengths = malloc(sizeof(int) * num_methods);
 942     check_and_push(context, lengths, VM_MALLOC_BLK);
 943 
 944     code = malloc(sizeof(unsigned char*) * num_methods);
 945     check_and_push(context, code, VM_MALLOC_BLK);
 946 
 947     *(lengths_addr) = lengths;
 948     *(code_addr) = code;
 949 
 950     for (i = 0; i < num_methods; ++i) {
 951         lengths[i] = JVM_GetMethodIxByteCodeLength(context->env, cb, i);
 952         if (lengths[i] > 0) {
 953             code[i] = malloc(sizeof(unsigned char) * (lengths[i] + 1));
 954             check_and_push(context, code[i], VM_MALLOC_BLK);
 955             JVM_GetMethodIxByteCode(context->env, cb, i, code[i]);
 956         } else {
 957             code[i] = NULL;
 958         }
 959     }
 960 }
 961 
 962 static void
 963 free_all_code(context_type* context, int num_methods, unsigned char** code)
 964 {
 965   int i;
 966   for (i = 0; i < num_methods; ++i) {
 967       if (code[i] != NULL) {
 968           pop_and_free(context);
 969       }
 970   }
 971   pop_and_free(context); /* code */
 972   pop_and_free(context); /* lengths */
 973 }
 974 
 975 /* Verify the code of one method */
 976 static void
 977 verify_method(context_type *context, jclass cb, int method_index,
 978               int code_length, unsigned char* code)
 979 {
 980     JNIEnv *env = context->env;
 981     int access_bits = JVM_GetMethodIxModifiers(env, cb, method_index);
 982     int *code_data;
 983     instruction_data_type *idata = 0;
 984     int instruction_count;
 985     int i, offset;
 986     unsigned int inumber;
 987     jint nexceptions;
 988 
 989     if ((access_bits & (JVM_ACC_NATIVE | JVM_ACC_ABSTRACT)) != 0) {
 990         /* not much to do for abstract and native methods */
 991         return;
 992     }
 993 
 994     context->code_length = code_length;
 995     context->code = code;
 996 
 997     /* CCerror can give method-specific info once this is set */
 998     context->method_index = method_index;
 999 
1000     CCreinit(context);          /* initial heap */
1001     code_data = NEW(int, code_length);
1002 
1003 #ifdef DEBUG
1004     if (verify_verbose) {
1005         const char *classname = JVM_GetClassNameUTF(env, cb);
1006         const char *methodname =
1007             JVM_GetMethodIxNameUTF(env, cb, method_index);
1008         const char *signature =
1009             JVM_GetMethodIxSignatureUTF(env, cb, method_index);
1010         jio_fprintf(stdout, "Looking at %s.%s%s\n",
1011                     (classname ? classname : ""),
1012                     (methodname ? methodname : ""),
1013                     (signature ? signature : ""));
1014         JVM_ReleaseUTF(classname);
1015         JVM_ReleaseUTF(methodname);
1016         JVM_ReleaseUTF(signature);
1017     }
1018 #endif
1019 
1020     if (((access_bits & JVM_ACC_PUBLIC) != 0) &&
1021         ((access_bits & (JVM_ACC_PRIVATE | JVM_ACC_PROTECTED)) != 0)) {
1022         CCerror(context, "Inconsistent access bits.");
1023     }
1024 
1025     // If this method is an overpass method, which is generated by the VM,
1026     // we trust the code and no check needs to be done.
1027     if (JVM_IsVMGeneratedMethodIx(env, cb, method_index)) {
1028       return;
1029     }
1030 
1031     /* Run through the code.  Mark the start of each instruction, and give
1032      * the instruction a number */
1033     for (i = 0, offset = 0; offset < code_length; i++) {
1034         int length = instruction_length(&code[offset], code + code_length);
1035         int next_offset = offset + length;
1036         if (length <= 0)
1037             CCerror(context, "Illegal instruction found at offset %d", offset);
1038         if (next_offset > code_length)
1039             CCerror(context, "Code stops in the middle of instruction "
1040                     " starting at offset %d", offset);
1041         code_data[offset] = i;
1042         while (++offset < next_offset)
1043             code_data[offset] = -1; /* illegal location */
1044     }
1045     instruction_count = i;      /* number of instructions in code */
1046 
1047     /* Allocate a structure to hold info about each instruction. */
1048     idata = NEW(instruction_data_type, instruction_count);
1049 
1050     /* Initialize the heap, and other info in the context structure. */
1051     context->code = code;
1052     context->instruction_data = idata;
1053     context->code_data = code_data;
1054     context->instruction_count = instruction_count;
1055     context->handler_info =
1056         NEW(struct handler_info_type,
1057             JVM_GetMethodIxExceptionTableLength(env, cb, method_index));
1058     context->bitmask_size =
1059         (JVM_GetMethodIxLocalsCount(env, cb, method_index)
1060          + (BITS_PER_INT - 1))/BITS_PER_INT;
1061 
1062     if (instruction_count == 0)
1063         CCerror(context, "Empty code");
1064 
1065     for (inumber = 0, offset = 0; offset < code_length; inumber++) {
1066         int length = instruction_length(&code[offset], code + code_length);
1067         instruction_data_type *this_idata = &idata[inumber];
1068         this_idata->opcode = code[offset];
1069         this_idata->stack_info.stack = NULL;
1070         this_idata->stack_info.stack_size  = UNKNOWN_STACK_SIZE;
1071         this_idata->register_info.register_count = UNKNOWN_REGISTER_COUNT;
1072         this_idata->changed = JNI_FALSE;  /* no need to look at it yet. */
1073         this_idata->protected = JNI_FALSE;  /* no need to look at it yet. */
1074         this_idata->and_flags = (flag_type) -1; /* "bottom" and value */
1075         this_idata->or_flags = 0; /* "bottom" or value*/
1076         /* This also sets up this_data->operand.  It also makes the
1077          * xload_x and xstore_x instructions look like the generic form. */
1078         verify_opcode_operands(context, inumber, offset);
1079         offset += length;
1080     }
1081 
1082 
1083     /* make sure exception table is reasonable. */
1084     initialize_exception_table(context);
1085     /* Set up first instruction, and start of exception handlers. */
1086     initialize_dataflow(context);
1087     /* Run data flow analysis on the instructions. */
1088     run_dataflow(context);
1089 
1090     /* verify checked exceptions, if any */
1091     nexceptions = JVM_GetMethodIxExceptionsCount(env, cb, method_index);
1092     context->exceptions = (unsigned short *)
1093         malloc(sizeof(unsigned short) * nexceptions + 1);
1094     if (context->exceptions == 0)
1095         CCout_of_memory(context);
1096     JVM_GetMethodIxExceptionIndexes(env, cb, method_index,
1097                                     context->exceptions);
1098     for (i = 0; i < nexceptions; i++) {
1099         /* Make sure the constant pool item is JVM_CONSTANT_Class */
1100         verify_constant_pool_type(context, (int)context->exceptions[i],
1101                                   1 << JVM_CONSTANT_Class);
1102     }
1103     free(context->exceptions);
1104     context->exceptions = 0;
1105     context->code = 0;
1106     context->method_index = -1;
1107 }
1108 
1109 
1110 /* Look at a single instruction, and verify its operands.  Also, for
1111  * simplicity, move the operand into the ->operand field.
1112  * Make sure that branches don't go into the middle of nowhere.
1113  */
1114 
1115 static jint _ck_ntohl(jint n)
1116 {
1117     unsigned char *p = (unsigned char *)&n;
1118     return (p[0] << 24) | (p[1] << 16) | (p[2] << 8) | p[3];
1119 }
1120 
1121 static void
1122 verify_opcode_operands(context_type *context, unsigned int inumber, int offset)
1123 {
1124     JNIEnv *env = context->env;
1125     instruction_data_type *idata = context->instruction_data;
1126     instruction_data_type *this_idata = &idata[inumber];
1127     int *code_data = context->code_data;
1128     int mi = context->method_index;
1129     unsigned char *code = context->code;
1130     int opcode = this_idata->opcode;
1131     int var;
1132 
1133     /*
1134      * Set the ip fields to 0 not the i fields because the ip fields
1135      * are 64 bits on 64 bit architectures, the i field is only 32
1136      */
1137     this_idata->operand.ip = 0;
1138     this_idata->operand2.ip = 0;
1139 
1140     switch (opcode) {
1141 
1142     case JVM_OPC_jsr:
1143         /* instruction of ret statement */
1144         this_idata->operand2.i = UNKNOWN_RET_INSTRUCTION;
1145         /* FALLTHROUGH */
1146     case JVM_OPC_ifeq: case JVM_OPC_ifne: case JVM_OPC_iflt:
1147     case JVM_OPC_ifge: case JVM_OPC_ifgt: case JVM_OPC_ifle:
1148     case JVM_OPC_ifnull: case JVM_OPC_ifnonnull:
1149     case JVM_OPC_if_icmpeq: case JVM_OPC_if_icmpne: case JVM_OPC_if_icmplt:
1150     case JVM_OPC_if_icmpge: case JVM_OPC_if_icmpgt: case JVM_OPC_if_icmple:
1151     case JVM_OPC_if_acmpeq: case JVM_OPC_if_acmpne:
1152     case JVM_OPC_goto: {
1153         /* Set the ->operand to be the instruction number of the target. */
1154         int jump = (((signed char)(code[offset+1])) << 8) + code[offset+2];
1155         int target = offset + jump;
1156         if (!isLegalTarget(context, target))
1157             CCerror(context, "Illegal target of jump or branch");
1158         this_idata->operand.i = code_data[target];
1159         break;
1160     }
1161 
1162     case JVM_OPC_jsr_w:
1163         /* instruction of ret statement */
1164         this_idata->operand2.i = UNKNOWN_RET_INSTRUCTION;
1165         /* FALLTHROUGH */
1166     case JVM_OPC_goto_w: {
1167         /* Set the ->operand to be the instruction number of the target. */
1168         int jump = (((signed char)(code[offset+1])) << 24) +
1169                      (code[offset+2] << 16) + (code[offset+3] << 8) +
1170                      (code[offset + 4]);
1171         int target = offset + jump;
1172         if (!isLegalTarget(context, target))
1173             CCerror(context, "Illegal target of jump or branch");
1174         this_idata->operand.i = code_data[target];
1175         break;
1176     }
1177 
1178     case JVM_OPC_tableswitch:
1179     case JVM_OPC_lookupswitch: {
1180         /* Set the ->operand to be a table of possible instruction targets. */
1181         int *lpc = (int *) UCALIGN(code + offset + 1);
1182         int *lptr;
1183         int *saved_operand;
1184         int keys;
1185         int k, delta;
1186 
1187         if (context->major_version < NONZERO_PADDING_BYTES_IN_SWITCH_MAJOR_VERSION) {
1188             /* 4639449, 4647081: Padding bytes must be zero. */
1189             unsigned char* bptr = (unsigned char*) (code + offset + 1);
1190             for (; bptr < (unsigned char*)lpc; bptr++) {
1191                 if (*bptr != 0) {
1192                     CCerror(context, "Non zero padding bytes in switch");
1193                 }
1194             }
1195         }
1196         if (opcode == JVM_OPC_tableswitch) {
1197             keys = _ck_ntohl(lpc[2]) -  _ck_ntohl(lpc[1]) + 1;
1198             delta = 1;
1199         } else {
1200             keys = _ck_ntohl(lpc[1]); /* number of pairs */
1201             delta = 2;
1202             /* Make sure that the tableswitch items are sorted */
1203             for (k = keys - 1, lptr = &lpc[2]; --k >= 0; lptr += 2) {
1204                 int this_key = _ck_ntohl(lptr[0]);  /* NB: ntohl may be unsigned */
1205                 int next_key = _ck_ntohl(lptr[2]);
1206                 if (this_key >= next_key) {
1207                     CCerror(context, "Unsorted lookup switch");
1208                 }
1209             }
1210         }
1211         saved_operand = NEW(int, keys + 2);
1212         if (!isLegalTarget(context, offset + _ck_ntohl(lpc[0])))
1213             CCerror(context, "Illegal default target in switch");
1214         saved_operand[keys + 1] = code_data[offset + _ck_ntohl(lpc[0])];
1215         for (k = keys, lptr = &lpc[3]; --k >= 0; lptr += delta) {
1216             int target = offset + _ck_ntohl(lptr[0]);
1217             if (!isLegalTarget(context, target))
1218                 CCerror(context, "Illegal branch in tableswitch");
1219             saved_operand[k + 1] = code_data[target];
1220         }
1221         saved_operand[0] = keys + 1; /* number of successors */
1222         this_idata->operand.ip = saved_operand;
1223         break;
1224     }
1225 
1226     case JVM_OPC_ldc: {
1227         /* Make sure the constant pool item is the right type. */
1228         int key = code[offset + 1];
1229         int types = (1 << JVM_CONSTANT_Integer) | (1 << JVM_CONSTANT_Float) |
1230                     (1 << JVM_CONSTANT_String);
1231         if (context->major_version >= LDC_CLASS_MAJOR_VERSION) {
1232             types |= 1 << JVM_CONSTANT_Class;
1233         }
1234         if (context->major_version >= LDC_METHOD_HANDLE_MAJOR_VERSION) {
1235             types |= (1 << JVM_CONSTANT_MethodHandle) |
1236                      (1 << JVM_CONSTANT_MethodType);
1237         }
1238         this_idata->operand.i = key;
1239         verify_constant_pool_type(context, key, types);
1240         break;
1241     }
1242 
1243     case JVM_OPC_ldc_w: {
1244         /* Make sure the constant pool item is the right type. */
1245         int key = (code[offset + 1] << 8) + code[offset + 2];
1246         int types = (1 << JVM_CONSTANT_Integer) | (1 << JVM_CONSTANT_Float) |
1247                     (1 << JVM_CONSTANT_String);
1248         if (context->major_version >= LDC_CLASS_MAJOR_VERSION) {
1249             types |= 1 << JVM_CONSTANT_Class;
1250         }
1251         if (context->major_version >= LDC_METHOD_HANDLE_MAJOR_VERSION) {
1252             types |= (1 << JVM_CONSTANT_MethodHandle) |
1253                      (1 << JVM_CONSTANT_MethodType);
1254         }
1255         this_idata->operand.i = key;
1256         verify_constant_pool_type(context, key, types);
1257         break;
1258     }
1259 
1260     case JVM_OPC_ldc2_w: {
1261         /* Make sure the constant pool item is the right type. */
1262         int key = (code[offset + 1] << 8) + code[offset + 2];
1263         int types = (1 << JVM_CONSTANT_Double) | (1 << JVM_CONSTANT_Long);
1264         this_idata->operand.i = key;
1265         verify_constant_pool_type(context, key, types);
1266         break;
1267     }
1268 
1269     case JVM_OPC_getfield: case JVM_OPC_putfield:
1270     case JVM_OPC_getstatic: case JVM_OPC_putstatic: {
1271         /* Make sure the constant pool item is the right type. */
1272         int key = (code[offset + 1] << 8) + code[offset + 2];
1273         this_idata->operand.i = key;
1274         verify_constant_pool_type(context, key, 1 << JVM_CONSTANT_Fieldref);
1275         if (opcode == JVM_OPC_getfield || opcode == JVM_OPC_putfield)
1276             set_protected(context, inumber, key, opcode);
1277         break;
1278     }
1279 
1280     case JVM_OPC_invokevirtual:
1281     case JVM_OPC_invokespecial:
1282     case JVM_OPC_invokestatic:
1283     case JVM_OPC_invokeinterface: {
1284         /* Make sure the constant pool item is the right type. */
1285         int key = (code[offset + 1] << 8) + code[offset + 2];
1286         const char *methodname;
1287         jclass cb = context->class;
1288         fullinfo_type clazz_info;
1289         int is_constructor, is_internal;
1290         int kind;
1291 
1292         switch (opcode ) {
1293         case JVM_OPC_invokestatic:
1294             kind = ((context->major_version < STATIC_METHOD_IN_INTERFACE_MAJOR_VERSION)
1295                        ? (1 << JVM_CONSTANT_Methodref)
1296                        : ((1 << JVM_CONSTANT_InterfaceMethodref) | (1 << JVM_CONSTANT_Methodref)));
1297             break;
1298         case JVM_OPC_invokeinterface:
1299             kind = 1 << JVM_CONSTANT_InterfaceMethodref;
1300             break;
1301         default:
1302             kind = 1 << JVM_CONSTANT_Methodref;
1303         }
1304 
1305         /* Make sure the constant pool item is the right type. */
1306         verify_constant_pool_type(context, key, kind);
1307         methodname = JVM_GetCPMethodNameUTF(env, cb, key);
1308         check_and_push(context, methodname, VM_STRING_UTF);
1309         is_constructor = !strcmp(methodname, "<init>");
1310         is_internal = methodname[0] == '<';
1311         pop_and_free(context);
1312 
1313         clazz_info = cp_index_to_class_fullinfo(context, key,
1314                                                 JVM_CONSTANT_Methodref);
1315         this_idata->operand.i = key;
1316         this_idata->operand2.fi = clazz_info;
1317         if (is_constructor) {
1318             if (opcode != JVM_OPC_invokespecial) {
1319                 CCerror(context,
1320                         "Must call initializers using invokespecial");
1321             }
1322             this_idata->opcode = JVM_OPC_invokeinit;
1323         } else {
1324             if (is_internal) {
1325                 CCerror(context, "Illegal call to internal method");
1326             }
1327             if (opcode == JVM_OPC_invokespecial
1328                    && clazz_info != context->currentclass_info
1329                    && clazz_info != context->superclass_info) {
1330                 int not_found = 1;
1331 
1332                 jclass super = (*env)->GetSuperclass(env, context->class);
1333                 while(super != 0) {
1334                     jclass tmp_cb;
1335                     fullinfo_type new_info = make_class_info(context, super);
1336                     if (clazz_info == new_info) {
1337                         not_found = 0;
1338                         break;
1339                     }
1340                     tmp_cb = (*env)->GetSuperclass(env, super);
1341                     (*env)->DeleteLocalRef(env, super);
1342                     super = tmp_cb;
1343                 }
1344                 (*env)->DeleteLocalRef(env, super);
1345 
1346                 /* The optimizer may cause this to happen on local code */
1347                 if (not_found) {
1348                     CCerror(context, "Illegal use of nonvirtual function call");
1349                 }
1350             }
1351         }
1352         if (opcode == JVM_OPC_invokeinterface) {
1353             unsigned int args1;
1354             unsigned int args2;
1355             const char *signature =
1356                 JVM_GetCPMethodSignatureUTF(env, context->class, key);
1357             check_and_push(context, signature, VM_STRING_UTF);
1358             args1 = signature_to_args_size(signature) + 1;
1359             args2 = code[offset + 3];
1360             if (args1 != args2) {
1361                 CCerror(context,
1362                         "Inconsistent args_size for invokeinterface");
1363             }
1364             if (code[offset + 4] != 0) {
1365                 CCerror(context,
1366                         "Fourth operand byte of invokeinterface must be zero");
1367             }
1368             pop_and_free(context);
1369         } else if (opcode == JVM_OPC_invokevirtual
1370                       || opcode == JVM_OPC_invokespecial)
1371             set_protected(context, inumber, key, opcode);
1372         break;
1373     }
1374 
1375     case JVM_OPC_invokedynamic:
1376         CCerror(context,
1377                 "invokedynamic bytecode is not supported in this class file version");
1378         break;
1379     case JVM_OPC_instanceof:
1380     case JVM_OPC_checkcast:
1381     case JVM_OPC_new:
1382     case JVM_OPC_anewarray:
1383     case JVM_OPC_multianewarray: {
1384         /* Make sure the constant pool item is a class */
1385         int key = (code[offset + 1] << 8) + code[offset + 2];
1386         fullinfo_type target;
1387         verify_constant_pool_type(context, key, 1 << JVM_CONSTANT_Class);
1388         target = cp_index_to_class_fullinfo(context, key, JVM_CONSTANT_Class);
1389         if (GET_ITEM_TYPE(target) == ITEM_Bogus)
1390             CCerror(context, "Illegal type");
1391         switch(opcode) {
1392         case JVM_OPC_anewarray:
1393             if ((GET_INDIRECTION(target)) >= MAX_ARRAY_DIMENSIONS)
1394                 CCerror(context, "Array with too many dimensions");
1395             this_idata->operand.fi = MAKE_FULLINFO(GET_ITEM_TYPE(target),
1396                                                    GET_INDIRECTION(target) + 1,
1397                                                    GET_EXTRA_INFO(target));
1398             break;
1399         case JVM_OPC_new:
1400             if (WITH_ZERO_EXTRA_INFO(target) !=
1401                              MAKE_FULLINFO(ITEM_Object, 0, 0))
1402                 CCerror(context, "Illegal creation of multi-dimensional array");
1403             /* operand gets set to the "unitialized object".  operand2 gets
1404              * set to what the value will be after it's initialized. */
1405             this_idata->operand.fi = MAKE_FULLINFO(ITEM_NewObject, 0, inumber);
1406             this_idata->operand2.fi = target;
1407             break;
1408         case JVM_OPC_multianewarray:
1409             this_idata->operand.fi = target;
1410             this_idata->operand2.i = code[offset + 3];
1411             if (    (this_idata->operand2.i > (int)GET_INDIRECTION(target))
1412                  || (this_idata->operand2.i == 0))
1413                 CCerror(context, "Illegal dimension argument");
1414             break;
1415         default:
1416             this_idata->operand.fi = target;
1417         }
1418         break;
1419     }
1420 
1421     case JVM_OPC_newarray: {
1422         /* Cache the result of the JVM_OPC_newarray into the operand slot */
1423         fullinfo_type full_info;
1424         switch (code[offset + 1]) {
1425             case JVM_T_INT:
1426                 full_info = MAKE_FULLINFO(ITEM_Integer, 1, 0); break;
1427             case JVM_T_LONG:
1428                 full_info = MAKE_FULLINFO(ITEM_Long, 1, 0); break;
1429             case JVM_T_FLOAT:
1430                 full_info = MAKE_FULLINFO(ITEM_Float, 1, 0); break;
1431             case JVM_T_DOUBLE:
1432                 full_info = MAKE_FULLINFO(ITEM_Double, 1, 0); break;
1433             case JVM_T_BOOLEAN:
1434                 full_info = MAKE_FULLINFO(ITEM_Boolean, 1, 0); break;
1435             case JVM_T_BYTE:
1436                 full_info = MAKE_FULLINFO(ITEM_Byte, 1, 0); break;
1437             case JVM_T_CHAR:
1438                 full_info = MAKE_FULLINFO(ITEM_Char, 1, 0); break;
1439             case JVM_T_SHORT:
1440                 full_info = MAKE_FULLINFO(ITEM_Short, 1, 0); break;
1441             default:
1442                 full_info = 0;          /* Keep lint happy */
1443                 CCerror(context, "Bad type passed to newarray");
1444         }
1445         this_idata->operand.fi = full_info;
1446         break;
1447     }
1448 
1449     /* Fudge iload_x, aload_x, etc to look like their generic cousin. */
1450     case JVM_OPC_iload_0: case JVM_OPC_iload_1: case JVM_OPC_iload_2: case JVM_OPC_iload_3:
1451         this_idata->opcode = JVM_OPC_iload;
1452         var = opcode - JVM_OPC_iload_0;
1453         goto check_local_variable;
1454 
1455     case JVM_OPC_fload_0: case JVM_OPC_fload_1: case JVM_OPC_fload_2: case JVM_OPC_fload_3:
1456         this_idata->opcode = JVM_OPC_fload;
1457         var = opcode - JVM_OPC_fload_0;
1458         goto check_local_variable;
1459 
1460     case JVM_OPC_aload_0: case JVM_OPC_aload_1: case JVM_OPC_aload_2: case JVM_OPC_aload_3:
1461         this_idata->opcode = JVM_OPC_aload;
1462         var = opcode - JVM_OPC_aload_0;
1463         goto check_local_variable;
1464 
1465     case JVM_OPC_lload_0: case JVM_OPC_lload_1: case JVM_OPC_lload_2: case JVM_OPC_lload_3:
1466         this_idata->opcode = JVM_OPC_lload;
1467         var = opcode - JVM_OPC_lload_0;
1468         goto check_local_variable2;
1469 
1470     case JVM_OPC_dload_0: case JVM_OPC_dload_1: case JVM_OPC_dload_2: case JVM_OPC_dload_3:
1471         this_idata->opcode = JVM_OPC_dload;
1472         var = opcode - JVM_OPC_dload_0;
1473         goto check_local_variable2;
1474 
1475     case JVM_OPC_istore_0: case JVM_OPC_istore_1: case JVM_OPC_istore_2: case JVM_OPC_istore_3:
1476         this_idata->opcode = JVM_OPC_istore;
1477         var = opcode - JVM_OPC_istore_0;
1478         goto check_local_variable;
1479 
1480     case JVM_OPC_fstore_0: case JVM_OPC_fstore_1: case JVM_OPC_fstore_2: case JVM_OPC_fstore_3:
1481         this_idata->opcode = JVM_OPC_fstore;
1482         var = opcode - JVM_OPC_fstore_0;
1483         goto check_local_variable;
1484 
1485     case JVM_OPC_astore_0: case JVM_OPC_astore_1: case JVM_OPC_astore_2: case JVM_OPC_astore_3:
1486         this_idata->opcode = JVM_OPC_astore;
1487         var = opcode - JVM_OPC_astore_0;
1488         goto check_local_variable;
1489 
1490     case JVM_OPC_lstore_0: case JVM_OPC_lstore_1: case JVM_OPC_lstore_2: case JVM_OPC_lstore_3:
1491         this_idata->opcode = JVM_OPC_lstore;
1492         var = opcode - JVM_OPC_lstore_0;
1493         goto check_local_variable2;
1494 
1495     case JVM_OPC_dstore_0: case JVM_OPC_dstore_1: case JVM_OPC_dstore_2: case JVM_OPC_dstore_3:
1496         this_idata->opcode = JVM_OPC_dstore;
1497         var = opcode - JVM_OPC_dstore_0;
1498         goto check_local_variable2;
1499 
1500     case JVM_OPC_wide:
1501         this_idata->opcode = code[offset + 1];
1502         var = (code[offset + 2] << 8) + code[offset + 3];
1503         switch(this_idata->opcode) {
1504             case JVM_OPC_lload:  case JVM_OPC_dload:
1505             case JVM_OPC_lstore: case JVM_OPC_dstore:
1506                 goto check_local_variable2;
1507             default:
1508                 goto check_local_variable;
1509         }
1510 
1511     case JVM_OPC_iinc:              /* the increment amount doesn't matter */
1512     case JVM_OPC_ret:
1513     case JVM_OPC_aload: case JVM_OPC_iload: case JVM_OPC_fload:
1514     case JVM_OPC_astore: case JVM_OPC_istore: case JVM_OPC_fstore:
1515         var = code[offset + 1];
1516     check_local_variable:
1517         /* Make sure that the variable number isn't illegal. */
1518         this_idata->operand.i = var;
1519         if (var >= JVM_GetMethodIxLocalsCount(env, context->class, mi))
1520             CCerror(context, "Illegal local variable number");
1521         break;
1522 
1523     case JVM_OPC_lload: case JVM_OPC_dload: case JVM_OPC_lstore: case JVM_OPC_dstore:
1524         var = code[offset + 1];
1525     check_local_variable2:
1526         /* Make sure that the variable number isn't illegal. */
1527         this_idata->operand.i = var;
1528         if ((var + 1) >= JVM_GetMethodIxLocalsCount(env, context->class, mi))
1529             CCerror(context, "Illegal local variable number");
1530         break;
1531 
1532     default:
1533         if (opcode > JVM_OPC_MAX)
1534             CCerror(context, "Quick instructions shouldn't appear yet.");
1535         break;
1536     } /* of switch */
1537 }
1538 
1539 
1540 static void
1541 set_protected(context_type *context, unsigned int inumber, int key, int opcode)
1542 {
1543     JNIEnv *env = context->env;
1544     fullinfo_type clazz_info;
1545     if (opcode != JVM_OPC_invokevirtual && opcode != JVM_OPC_invokespecial) {
1546         clazz_info = cp_index_to_class_fullinfo(context, key,
1547                                                 JVM_CONSTANT_Fieldref);
1548     } else {
1549         clazz_info = cp_index_to_class_fullinfo(context, key,
1550                                                 JVM_CONSTANT_Methodref);
1551     }
1552     if (is_superclass(context, clazz_info)) {
1553         jclass calledClass =
1554             object_fullinfo_to_classclass(context, clazz_info);
1555         int access;
1556         /* 4734966: JVM_GetCPFieldModifiers() or JVM_GetCPMethodModifiers() only
1557            searches the referenced field or method in calledClass. The following
1558            while loop is added to search up the superclass chain to make this
1559            symbolic resolution consistent with the field/method resolution
1560            specified in VM spec 5.4.3. */
1561         calledClass = (*env)->NewLocalRef(env, calledClass);
1562         do {
1563             jclass tmp_cb;
1564             if (opcode != JVM_OPC_invokevirtual && opcode != JVM_OPC_invokespecial) {
1565                 access = JVM_GetCPFieldModifiers
1566                     (env, context->class, key, calledClass);
1567             } else {
1568                 access = JVM_GetCPMethodModifiers
1569                     (env, context->class, key, calledClass);
1570             }
1571             if (access != -1) {
1572                 break;
1573             }
1574             tmp_cb = (*env)->GetSuperclass(env, calledClass);
1575             (*env)->DeleteLocalRef(env, calledClass);
1576             calledClass = tmp_cb;
1577         } while (calledClass != 0);
1578 
1579         if (access == -1) {
1580             /* field/method not found, detected at runtime. */
1581         } else if (access & JVM_ACC_PROTECTED) {
1582             if (!JVM_IsSameClassPackage(env, calledClass, context->class))
1583                 context->instruction_data[inumber].protected = JNI_TRUE;
1584         }
1585         (*env)->DeleteLocalRef(env, calledClass);
1586     }
1587 }
1588 
1589 
1590 static jboolean
1591 is_superclass(context_type *context, fullinfo_type clazz_info) {
1592     fullinfo_type *fptr = context->superclasses;
1593 
1594     if (fptr == 0)
1595         return JNI_FALSE;
1596     for (; *fptr != 0; fptr++) {
1597         if (*fptr == clazz_info)
1598             return JNI_TRUE;
1599     }
1600     return JNI_FALSE;
1601 }
1602 
1603 
1604 /* Look through each item on the exception table.  Each of the fields must
1605  * refer to a legal instruction.
1606  */
1607 static void
1608 initialize_exception_table(context_type *context)
1609 {
1610     JNIEnv *env = context->env;
1611     int mi = context->method_index;
1612     struct handler_info_type *handler_info = context->handler_info;
1613     int *code_data = context->code_data;
1614     int code_length = context->code_length;
1615     int max_stack_size = JVM_GetMethodIxMaxStack(env, context->class, mi);
1616     int i = JVM_GetMethodIxExceptionTableLength(env, context->class, mi);
1617     if (max_stack_size < 1 && i > 0) {
1618         // If the method contains exception handlers, it must have room
1619         // on the expression stack for the exception that the VM could push
1620         CCerror(context, "Stack size too large");
1621     }
1622     for (; --i >= 0; handler_info++) {
1623         JVM_ExceptionTableEntryType einfo;
1624         stack_item_type *stack_item = NEW(stack_item_type, 1);
1625 
1626         JVM_GetMethodIxExceptionTableEntry(env, context->class, mi,
1627                                            i, &einfo);
1628 
1629         if (!(einfo.start_pc < einfo.end_pc &&
1630               einfo.start_pc >= 0 &&
1631               isLegalTarget(context, einfo.start_pc) &&
1632               (einfo.end_pc ==  code_length ||
1633                isLegalTarget(context, einfo.end_pc)))) {
1634             CFerror(context, "Illegal exception table range");
1635         }
1636         if (!((einfo.handler_pc > 0) &&
1637               isLegalTarget(context, einfo.handler_pc))) {
1638             CFerror(context, "Illegal exception table handler");
1639         }
1640 
1641         handler_info->start = code_data[einfo.start_pc];
1642         /* einfo.end_pc may point to one byte beyond the end of bytecodes. */
1643         handler_info->end = (einfo.end_pc == context->code_length) ?
1644             context->instruction_count : code_data[einfo.end_pc];
1645         handler_info->handler = code_data[einfo.handler_pc];
1646         handler_info->stack_info.stack = stack_item;
1647         handler_info->stack_info.stack_size = 1;
1648         stack_item->next = NULL;
1649         if (einfo.catchType != 0) {
1650             const char *classname;
1651             /* Constant pool entry type has been checked in format checker */
1652             classname = JVM_GetCPClassNameUTF(env,
1653                                               context->class,
1654                                               einfo.catchType);
1655             check_and_push(context, classname, VM_STRING_UTF);
1656             stack_item->item = make_class_info_from_name(context, classname);
1657             if (!isAssignableTo(context,
1658                                 stack_item->item,
1659                                 context->throwable_info))
1660                 CCerror(context, "catch_type not a subclass of Throwable");
1661             pop_and_free(context);
1662         } else {
1663             stack_item->item = context->throwable_info;
1664         }
1665     }
1666 }
1667 
1668 
1669 /* Given a pointer to an instruction, return its length.  Use the table
1670  * opcode_length[] which is automatically built.
1671  */
1672 static int instruction_length(unsigned char *iptr, unsigned char *end)
1673 {
1674     static unsigned char opcode_length[] = JVM_OPCODE_LENGTH_INITIALIZER;
1675     int instruction = *iptr;
1676     switch (instruction) {
1677         case JVM_OPC_tableswitch: {
1678             int *lpc = (int *)UCALIGN(iptr + 1);
1679             int index;
1680             if (lpc + 2 >= (int *)end) {
1681                 return -1; /* do not read pass the end */
1682             }
1683             index = _ck_ntohl(lpc[2]) - _ck_ntohl(lpc[1]);
1684             if ((index < 0) || (index > 65535)) {
1685                 return -1;      /* illegal */
1686             } else {
1687                 unsigned char *finish = (unsigned char *)(&lpc[index + 4]);
1688                 assert(finish >= iptr);
1689                 return (int)(finish - iptr);
1690             }
1691         }
1692 
1693         case JVM_OPC_lookupswitch: {
1694             int *lpc = (int *) UCALIGN(iptr + 1);
1695             int npairs;
1696             if (lpc + 1 >= (int *)end)
1697                 return -1; /* do not read pass the end */
1698             npairs = _ck_ntohl(lpc[1]);
1699             /* There can't be more than 64K labels because of the limit
1700              * on per-method byte code length.
1701              */
1702             if (npairs < 0 || npairs >= 65536)
1703                 return  -1;
1704             else {
1705                 unsigned char *finish = (unsigned char *)(&lpc[2 * (npairs + 1)]);
1706                 assert(finish >= iptr);
1707                 return (int)(finish - iptr);
1708             }
1709         }
1710 
1711         case JVM_OPC_wide:
1712             if (iptr + 1 >= end)
1713                 return -1; /* do not read pass the end */
1714             switch(iptr[1]) {
1715                 case JVM_OPC_ret:
1716                 case JVM_OPC_iload: case JVM_OPC_istore:
1717                 case JVM_OPC_fload: case JVM_OPC_fstore:
1718                 case JVM_OPC_aload: case JVM_OPC_astore:
1719                 case JVM_OPC_lload: case JVM_OPC_lstore:
1720                 case JVM_OPC_dload: case JVM_OPC_dstore:
1721                     return 4;
1722                 case JVM_OPC_iinc:
1723                     return 6;
1724                 default:
1725                     return -1;
1726             }
1727 
1728         default: {
1729             if (instruction < 0 || instruction > JVM_OPC_MAX)
1730                 return -1;
1731 
1732             /* A length of 0 indicates an error. */
1733             if (opcode_length[instruction] <= 0)
1734                 return -1;
1735 
1736             return opcode_length[instruction];
1737         }
1738     }
1739 }
1740 
1741 
1742 /* Given the target of a branch, make sure that it's a legal target. */
1743 static jboolean
1744 isLegalTarget(context_type *context, int offset)
1745 {
1746     int code_length = context->code_length;
1747     int *code_data = context->code_data;
1748     return (offset >= 0 && offset < code_length && code_data[offset] >= 0);
1749 }
1750 
1751 
1752 /* Make sure that an element of the constant pool really is of the indicated
1753  * type.
1754  */
1755 static void
1756 verify_constant_pool_type(context_type *context, int index, unsigned mask)
1757 {
1758     int nconstants = context->nconstants;
1759     unsigned char *type_table = context->constant_types;
1760     unsigned type;
1761 
1762     if ((index <= 0) || (index >= nconstants))
1763         CCerror(context, "Illegal constant pool index");
1764 
1765     type = type_table[index];
1766     if ((mask & (1 << type)) == 0)
1767         CCerror(context, "Illegal type in constant pool");
1768 }
1769 
1770 
1771 static void
1772 initialize_dataflow(context_type *context)
1773 {
1774     JNIEnv *env = context->env;
1775     instruction_data_type *idata = context->instruction_data;
1776     int mi = context->method_index;
1777     jclass cb = context->class;
1778     int args_size = JVM_GetMethodIxArgsSize(env, cb, mi);
1779     fullinfo_type *reg_ptr;
1780     fullinfo_type full_info;
1781     const char *p;
1782     const char *signature;
1783 
1784     /* Initialize the function entry, since we know everything about it. */
1785     idata[0].stack_info.stack_size = 0;
1786     idata[0].stack_info.stack = NULL;
1787     idata[0].register_info.register_count = args_size;
1788     idata[0].register_info.registers = NEW(fullinfo_type, args_size);
1789     idata[0].register_info.mask_count = 0;
1790     idata[0].register_info.masks = NULL;
1791     idata[0].and_flags = 0;     /* nothing needed */
1792     idata[0].or_flags = FLAG_REACHED; /* instruction reached */
1793     reg_ptr = idata[0].register_info.registers;
1794 
1795     if ((JVM_GetMethodIxModifiers(env, cb, mi) & JVM_ACC_STATIC) == 0) {
1796         /* A non static method.  If this is an <init> method, the first
1797          * argument is an uninitialized object.  Otherwise it is an object of
1798          * the given class type.  java.lang.Object.<init> is special since
1799          * we don't call its superclass <init> method.
1800          */
1801         if (JVM_IsConstructorIx(env, cb, mi)
1802                 && context->currentclass_info != context->object_info) {
1803             *reg_ptr++ = MAKE_FULLINFO(ITEM_InitObject, 0, 0);
1804             idata[0].or_flags |= FLAG_NEED_CONSTRUCTOR;
1805         } else {
1806             *reg_ptr++ = context->currentclass_info;
1807         }
1808     }
1809     signature = JVM_GetMethodIxSignatureUTF(env, cb, mi);
1810     check_and_push(context, signature, VM_STRING_UTF);
1811     /* Fill in each of the arguments into the registers. */
1812     for (p = signature + 1; *p != JVM_SIGNATURE_ENDFUNC; ) {
1813         char fieldchar = signature_to_fieldtype(context, &p, &full_info);
1814         switch (fieldchar) {
1815             case 'D': case 'L':
1816                 *reg_ptr++ = full_info;
1817                 *reg_ptr++ = full_info + 1;
1818                 break;
1819             default:
1820                 *reg_ptr++ = full_info;
1821                 break;
1822         }
1823     }
1824     p++;                        /* skip over right parenthesis */
1825     if (*p == 'V') {
1826         context->return_type = MAKE_FULLINFO(ITEM_Void, 0, 0);
1827     } else {
1828         signature_to_fieldtype(context, &p, &full_info);
1829         context->return_type = full_info;
1830     }
1831     pop_and_free(context);
1832     /* Indicate that we need to look at the first instruction. */
1833     idata[0].changed = JNI_TRUE;
1834 }
1835 
1836 
1837 /* Run the data flow analysis, as long as there are things to change. */
1838 static void
1839 run_dataflow(context_type *context) {
1840     JNIEnv *env = context->env;
1841     int mi = context->method_index;
1842     jclass cb = context->class;
1843     int max_stack_size = JVM_GetMethodIxMaxStack(env, cb, mi);
1844     instruction_data_type *idata = context->instruction_data;
1845     unsigned int icount = context->instruction_count;
1846     jboolean work_to_do = JNI_TRUE;
1847     unsigned int inumber;
1848 
1849     /* Run through the loop, until there is nothing left to do. */
1850     while (work_to_do) {
1851         work_to_do = JNI_FALSE;
1852         for (inumber = 0; inumber < icount; inumber++) {
1853             instruction_data_type *this_idata = &idata[inumber];
1854             if (this_idata->changed) {
1855                 register_info_type new_register_info;
1856                 stack_info_type new_stack_info;
1857                 flag_type new_and_flags, new_or_flags;
1858 
1859                 this_idata->changed = JNI_FALSE;
1860                 work_to_do = JNI_TRUE;
1861 #ifdef DEBUG
1862                 if (verify_verbose) {
1863                     int opcode = this_idata->opcode;
1864                     jio_fprintf(stdout, "Instruction %d: ", inumber);
1865                     print_stack(context, &this_idata->stack_info);
1866                     print_registers(context, &this_idata->register_info);
1867                     print_flags(context,
1868                                 this_idata->and_flags, this_idata->or_flags);
1869                     fflush(stdout);
1870                 }
1871 #endif
1872                 /* Make sure the registers and flags are appropriate */
1873                 check_register_values(context, inumber);
1874                 check_flags(context, inumber);
1875 
1876                 /* Make sure the stack can deal with this instruction */
1877                 pop_stack(context, inumber, &new_stack_info);
1878 
1879                 /* Update the registers  and flags */
1880                 update_registers(context, inumber, &new_register_info);
1881                 update_flags(context, inumber, &new_and_flags, &new_or_flags);
1882 
1883                 /* Update the stack. */
1884                 push_stack(context, inumber, &new_stack_info);
1885 
1886                 if (new_stack_info.stack_size > max_stack_size)
1887                     CCerror(context, "Stack size too large");
1888 #ifdef DEBUG
1889                 if (verify_verbose) {
1890                     jio_fprintf(stdout, "  ");
1891                     print_stack(context, &new_stack_info);
1892                     print_registers(context, &new_register_info);
1893                     print_flags(context, new_and_flags, new_or_flags);
1894                     fflush(stdout);
1895                 }
1896 #endif
1897                 /* Add the new stack and register information to any
1898                  * instructions that can follow this instruction.     */
1899                 merge_into_successors(context, inumber,
1900                                       &new_register_info, &new_stack_info,
1901                                       new_and_flags, new_or_flags);
1902             }
1903         }
1904     }
1905 }
1906 
1907 
1908 /* Make sure that the registers contain a legitimate value for the given
1909  * instruction.
1910 */
1911 
1912 static void
1913 check_register_values(context_type *context, unsigned int inumber)
1914 {
1915     instruction_data_type *idata = context->instruction_data;
1916     instruction_data_type *this_idata = &idata[inumber];
1917     int opcode = this_idata->opcode;
1918     int operand = this_idata->operand.i;
1919     int register_count = this_idata->register_info.register_count;
1920     fullinfo_type *registers = this_idata->register_info.registers;
1921     jboolean double_word = JNI_FALSE;   /* default value */
1922     int type;
1923 
1924     switch (opcode) {
1925         default:
1926             return;
1927         case JVM_OPC_iload: case JVM_OPC_iinc:
1928             type = ITEM_Integer; break;
1929         case JVM_OPC_fload:
1930             type = ITEM_Float; break;
1931         case JVM_OPC_aload:
1932             type = ITEM_Object; break;
1933         case JVM_OPC_ret:
1934             type = ITEM_ReturnAddress; break;
1935         case JVM_OPC_lload:
1936             type = ITEM_Long; double_word = JNI_TRUE; break;
1937         case JVM_OPC_dload:
1938             type = ITEM_Double; double_word = JNI_TRUE; break;
1939     }
1940     if (!double_word) {
1941         fullinfo_type reg;
1942         /* Make sure we don't have an illegal register or one with wrong type */
1943         if (operand >= register_count) {
1944             CCerror(context,
1945                     "Accessing value from uninitialized register %d", operand);
1946         }
1947         reg = registers[operand];
1948 
1949         if (WITH_ZERO_EXTRA_INFO(reg) == (unsigned)MAKE_FULLINFO(type, 0, 0)) {
1950             /* the register is obviously of the given type */
1951             return;
1952         } else if (GET_INDIRECTION(reg) > 0 && type == ITEM_Object) {
1953             /* address type stuff be used on all arrays */
1954             return;
1955         } else if (GET_ITEM_TYPE(reg) == ITEM_ReturnAddress) {
1956             CCerror(context, "Cannot load return address from register %d",
1957                               operand);
1958             /* alternatively
1959                       (GET_ITEM_TYPE(reg) == ITEM_ReturnAddress)
1960                    && (opcode == JVM_OPC_iload)
1961                    && (type == ITEM_Object || type == ITEM_Integer)
1962                but this never occurs
1963             */
1964         } else if (reg == ITEM_InitObject && type == ITEM_Object) {
1965             return;
1966         } else if (WITH_ZERO_EXTRA_INFO(reg) ==
1967                         MAKE_FULLINFO(ITEM_NewObject, 0, 0) &&
1968                    type == ITEM_Object) {
1969             return;
1970         } else {
1971             CCerror(context, "Register %d contains wrong type", operand);
1972         }
1973     } else {
1974         /* Make sure we don't have an illegal register or one with wrong type */
1975         if ((operand + 1) >= register_count) {
1976             CCerror(context,
1977                     "Accessing value from uninitialized register pair %d/%d",
1978                     operand, operand+1);
1979         } else {
1980             if ((registers[operand] == (unsigned)MAKE_FULLINFO(type, 0, 0)) &&
1981                 (registers[operand + 1] == (unsigned)MAKE_FULLINFO(type + 1, 0, 0))) {
1982                 return;
1983             } else {
1984                 CCerror(context, "Register pair %d/%d contains wrong type",
1985                         operand, operand+1);
1986             }
1987         }
1988     }
1989 }
1990 
1991 
1992 /* Make sure the flags contain legitimate values for this instruction.
1993 */
1994 
1995 static void
1996 check_flags(context_type *context, unsigned int inumber)
1997 {
1998     instruction_data_type *idata = context->instruction_data;
1999     instruction_data_type *this_idata = &idata[inumber];
2000     int opcode = this_idata->opcode;
2001     switch (opcode) {
2002         case JVM_OPC_return:
2003             /* We need a constructor, but we aren't guaranteed it's called */
2004             if ((this_idata->or_flags & FLAG_NEED_CONSTRUCTOR) &&
2005                    !(this_idata->and_flags & FLAG_CONSTRUCTED))
2006                 CCerror(context, "Constructor must call super() or this()");
2007             /* fall through */
2008         case JVM_OPC_ireturn: case JVM_OPC_lreturn:
2009         case JVM_OPC_freturn: case JVM_OPC_dreturn: case JVM_OPC_areturn:
2010             if (this_idata->or_flags & FLAG_NO_RETURN)
2011                 /* This method cannot exit normally */
2012                 CCerror(context, "Cannot return normally");
2013         default:
2014             break; /* nothing to do. */
2015     }
2016 }
2017 
2018 /* Make sure that the top of the stack contains reasonable values for the
2019  * given instruction.  The post-pop values of the stack and its size are
2020  * returned in *new_stack_info.
2021  */
2022 
2023 static void
2024 pop_stack(context_type *context, unsigned int inumber, stack_info_type *new_stack_info)
2025 {
2026     instruction_data_type *idata = context->instruction_data;
2027     instruction_data_type *this_idata = &idata[inumber];
2028     int opcode = this_idata->opcode;
2029     stack_item_type *stack = this_idata->stack_info.stack;
2030     int stack_size = this_idata->stack_info.stack_size;
2031     char *stack_operands, *p;
2032     char buffer[257];           /* for holding manufactured argument lists */
2033     fullinfo_type stack_extra_info_buffer[256]; /* save info popped off stack */
2034     fullinfo_type *stack_extra_info = &stack_extra_info_buffer[256];
2035     fullinfo_type full_info;    /* only used in case of invoke instructions */
2036     fullinfo_type put_full_info; /* only used in case JVM_OPC_putstatic and JVM_OPC_putfield */
2037 
2038     switch(opcode) {
2039         default:
2040             /* For most instructions, we just use a built-in table */
2041             stack_operands = opcode_in_out[opcode][0];
2042             break;
2043 
2044         case JVM_OPC_putstatic: case JVM_OPC_putfield: {
2045             /* The top thing on the stack depends on the signature of
2046              * the object.                         */
2047             int operand = this_idata->operand.i;
2048             const char *signature =
2049                 JVM_GetCPFieldSignatureUTF(context->env,
2050                                            context->class,
2051                                            operand);
2052             char *ip = buffer;
2053             check_and_push(context, signature, VM_STRING_UTF);
2054 #ifdef DEBUG
2055             if (verify_verbose) {
2056                 print_formatted_fieldname(context, operand);
2057             }
2058 #endif
2059             if (opcode == JVM_OPC_putfield)
2060                 *ip++ = 'A';    /* object for putfield */
2061             *ip++ = signature_to_fieldtype(context, &signature, &put_full_info);
2062             *ip = '\0';
2063             stack_operands = buffer;
2064             pop_and_free(context);
2065             break;
2066         }
2067 
2068         case JVM_OPC_invokevirtual: case JVM_OPC_invokespecial:
2069         case JVM_OPC_invokeinit:    /* invokespecial call to <init> */
2070         case JVM_OPC_invokestatic: case JVM_OPC_invokeinterface: {
2071             /* The top stuff on the stack depends on the method signature */
2072             int operand = this_idata->operand.i;
2073             const char *signature =
2074                 JVM_GetCPMethodSignatureUTF(context->env,
2075                                             context->class,
2076                                             operand);
2077             char *ip = buffer;
2078             const char *p;
2079             check_and_push(context, signature, VM_STRING_UTF);
2080 #ifdef DEBUG
2081             if (verify_verbose) {
2082                 print_formatted_methodname(context, operand);
2083             }
2084 #endif
2085             if (opcode != JVM_OPC_invokestatic)
2086                 /* First, push the object */
2087                 *ip++ = (opcode == JVM_OPC_invokeinit ? '@' : 'A');
2088             for (p = signature + 1; *p != JVM_SIGNATURE_ENDFUNC; ) {
2089                 *ip++ = signature_to_fieldtype(context, &p, &full_info);
2090                 if (ip >= buffer + sizeof(buffer) - 1)
2091                     CCerror(context, "Signature %s has too many arguments",
2092                             signature);
2093             }
2094             *ip = 0;
2095             stack_operands = buffer;
2096             pop_and_free(context);
2097             break;
2098         }
2099 
2100         case JVM_OPC_multianewarray: {
2101             /* Count can't be larger than 255. So can't overflow buffer */
2102             int count = this_idata->operand2.i; /* number of ints on stack */
2103             memset(buffer, 'I', count);
2104             buffer[count] = '\0';
2105             stack_operands = buffer;
2106             break;
2107         }
2108 
2109     } /* of switch */
2110 
2111     /* Run through the list of operands >>backwards<< */
2112     for (   p = stack_operands + strlen(stack_operands);
2113             p > stack_operands;
2114             stack = stack->next) {
2115         int type = *--p;
2116         fullinfo_type top_type = stack ? stack->item : 0;
2117         int size = (type == 'D' || type == 'L') ? 2 : 1;
2118         *--stack_extra_info = top_type;
2119         if (stack == NULL)
2120             CCerror(context, "Unable to pop operand off an empty stack");
2121 
2122         switch (type) {
2123             case 'I':
2124                 if (top_type != MAKE_FULLINFO(ITEM_Integer, 0, 0))
2125                     CCerror(context, "Expecting to find integer on stack");
2126                 break;
2127 
2128             case 'F':
2129                 if (top_type != MAKE_FULLINFO(ITEM_Float, 0, 0))
2130                     CCerror(context, "Expecting to find float on stack");
2131                 break;
2132 
2133             case 'A':           /* object or array */
2134                 if (   (GET_ITEM_TYPE(top_type) != ITEM_Object)
2135                     && (GET_INDIRECTION(top_type) == 0)) {
2136                     /* The thing isn't an object or an array.  Let's see if it's
2137                      * one of the special cases  */
2138                     if (  (WITH_ZERO_EXTRA_INFO(top_type) ==
2139                                 MAKE_FULLINFO(ITEM_ReturnAddress, 0, 0))
2140                         && (opcode == JVM_OPC_astore))
2141                         break;
2142                     if (   (GET_ITEM_TYPE(top_type) == ITEM_NewObject
2143                             || (GET_ITEM_TYPE(top_type) == ITEM_InitObject))
2144                         && ((opcode == JVM_OPC_astore) || (opcode == JVM_OPC_aload)
2145                             || (opcode == JVM_OPC_ifnull) || (opcode == JVM_OPC_ifnonnull)))
2146                         break;
2147                     /* The 2nd edition VM of the specification allows field
2148                      * initializations before the superclass initializer,
2149                      * if the field is defined within the current class.
2150                      */
2151                      if (   (GET_ITEM_TYPE(top_type) == ITEM_InitObject)
2152                          && (opcode == JVM_OPC_putfield)) {
2153                         int operand = this_idata->operand.i;
2154                         int access_bits = JVM_GetCPFieldModifiers(context->env,
2155                                                                   context->class,
2156                                                                   operand,
2157                                                                   context->class);
2158                         /* Note: This relies on the fact that
2159                          * JVM_GetCPFieldModifiers retrieves only local fields,
2160                          * and does not respect inheritance.
2161                          */
2162                         if (access_bits != -1) {
2163                             if ( cp_index_to_class_fullinfo(context, operand, JVM_CONSTANT_Fieldref) ==
2164                                  context->currentclass_info ) {
2165                                 top_type = context->currentclass_info;
2166                                 *stack_extra_info = top_type;
2167                                 break;
2168                             }
2169                         }
2170                     }
2171                     CCerror(context, "Expecting to find object/array on stack");
2172                 }
2173                 break;
2174 
2175             case '@': {         /* unitialized object, for call to <init> */
2176                 int item_type = GET_ITEM_TYPE(top_type);
2177                 if (item_type != ITEM_NewObject && item_type != ITEM_InitObject)
2178                     CCerror(context,
2179                             "Expecting to find unitialized object on stack");
2180                 break;
2181             }
2182 
2183             case 'O':           /* object, not array */
2184                 if (WITH_ZERO_EXTRA_INFO(top_type) !=
2185                        MAKE_FULLINFO(ITEM_Object, 0, 0))
2186                     CCerror(context, "Expecting to find object on stack");
2187                 break;
2188 
2189             case 'a':           /* integer, object, or array */
2190                 if (      (top_type != MAKE_FULLINFO(ITEM_Integer, 0, 0))
2191                        && (GET_ITEM_TYPE(top_type) != ITEM_Object)
2192                        && (GET_INDIRECTION(top_type) == 0))
2193                     CCerror(context,
2194                             "Expecting to find object, array, or int on stack");
2195                 break;
2196 
2197             case 'D':           /* double */
2198                 if (top_type != MAKE_FULLINFO(ITEM_Double, 0, 0))
2199                     CCerror(context, "Expecting to find double on stack");
2200                 break;
2201 
2202             case 'L':           /* long */
2203                 if (top_type != MAKE_FULLINFO(ITEM_Long, 0, 0))
2204                     CCerror(context, "Expecting to find long on stack");
2205                 break;
2206 
2207             case ']':           /* array of some type */
2208                 if (top_type == NULL_FULLINFO) {
2209                     /* do nothing */
2210                 } else switch(p[-1]) {
2211                     case 'I':   /* array of integers */
2212                         if (top_type != MAKE_FULLINFO(ITEM_Integer, 1, 0) &&
2213                             top_type != NULL_FULLINFO)
2214                             CCerror(context,
2215                                     "Expecting to find array of ints on stack");
2216                         break;
2217 
2218                     case 'L':   /* array of longs */
2219                         if (top_type != MAKE_FULLINFO(ITEM_Long, 1, 0))
2220                             CCerror(context,
2221                                    "Expecting to find array of longs on stack");
2222                         break;
2223 
2224                     case 'F':   /* array of floats */
2225                         if (top_type != MAKE_FULLINFO(ITEM_Float, 1, 0))
2226                             CCerror(context,
2227                                  "Expecting to find array of floats on stack");
2228                         break;
2229 
2230                     case 'D':   /* array of doubles */
2231                         if (top_type != MAKE_FULLINFO(ITEM_Double, 1, 0))
2232                             CCerror(context,
2233                                 "Expecting to find array of doubles on stack");
2234                         break;
2235 
2236                     case 'A': { /* array of addresses (arrays or objects) */
2237                         int indirection = GET_INDIRECTION(top_type);
2238                         if ((indirection == 0) ||
2239                             ((indirection == 1) &&
2240                                 (GET_ITEM_TYPE(top_type) != ITEM_Object)))
2241                             CCerror(context,
2242                                 "Expecting to find array of objects or arrays "
2243                                     "on stack");
2244                         break;
2245                     }
2246 
2247                     case 'B':    /* array of bytes or booleans */
2248                         if (top_type != MAKE_FULLINFO(ITEM_Byte, 1, 0) &&
2249                             top_type != MAKE_FULLINFO(ITEM_Boolean, 1, 0))
2250                             CCerror(context,
2251                                   "Expecting to find array of bytes or Booleans on stack");
2252                         break;
2253 
2254                     case 'C':   /* array of characters */
2255                         if (top_type != MAKE_FULLINFO(ITEM_Char, 1, 0))
2256                             CCerror(context,
2257                                   "Expecting to find array of chars on stack");
2258                         break;
2259 
2260                     case 'S':   /* array of shorts */
2261                         if (top_type != MAKE_FULLINFO(ITEM_Short, 1, 0))
2262                             CCerror(context,
2263                                  "Expecting to find array of shorts on stack");
2264                         break;
2265 
2266                     case '?':   /* any type of array is okay */
2267                         if (GET_INDIRECTION(top_type) == 0)
2268                             CCerror(context,
2269                                     "Expecting to find array on stack");
2270                         break;
2271 
2272                     default:
2273                         CCerror(context, "Internal error #1");
2274                         break;
2275                 }
2276                 p -= 2;         /* skip over [ <char> */
2277                 break;
2278 
2279             case '1': case '2': case '3': case '4': /* stack swapping */
2280                 if (top_type == MAKE_FULLINFO(ITEM_Double, 0, 0)
2281                     || top_type == MAKE_FULLINFO(ITEM_Long, 0, 0)) {
2282                     if ((p > stack_operands) && (p[-1] == '+')) {
2283                         context->swap_table[type - '1'] = top_type + 1;
2284                         context->swap_table[p[-2] - '1'] = top_type;
2285                         size = 2;
2286                         p -= 2;
2287                     } else {
2288                         CCerror(context,
2289                                 "Attempt to split long or double on the stack");
2290                     }
2291                 } else {
2292                     context->swap_table[type - '1'] = stack->item;
2293                     if ((p > stack_operands) && (p[-1] == '+'))
2294                         p--;    /* ignore */
2295                 }
2296                 break;
2297             case '+':           /* these should have been caught. */
2298             default:
2299                 CCerror(context, "Internal error #2");
2300         }
2301         stack_size -= size;
2302     }
2303 
2304     /* For many of the opcodes that had an "A" in their field, we really
2305      * need to go back and do a little bit more accurate testing.  We can, of
2306      * course, assume that the minimal type checking has already been done.
2307      */
2308     switch (opcode) {
2309         default: break;
2310         case JVM_OPC_aastore: {     /* array index object  */
2311             fullinfo_type array_type = stack_extra_info[0];
2312             fullinfo_type object_type = stack_extra_info[2];
2313             fullinfo_type target_type = decrement_indirection(array_type);
2314             if ((GET_ITEM_TYPE(object_type) != ITEM_Object)
2315                     && (GET_INDIRECTION(object_type) == 0)) {
2316                 CCerror(context, "Expecting reference type on operand stack in aastore");
2317             }
2318             if ((GET_ITEM_TYPE(target_type) != ITEM_Object)
2319                     && (GET_INDIRECTION(target_type) == 0)) {
2320                 CCerror(context, "Component type of the array must be reference type in aastore");
2321             }
2322             break;
2323         }
2324 
2325         case JVM_OPC_putfield:
2326         case JVM_OPC_getfield:
2327         case JVM_OPC_putstatic: {
2328             int operand = this_idata->operand.i;
2329             fullinfo_type stack_object = stack_extra_info[0];
2330             if (opcode == JVM_OPC_putfield || opcode == JVM_OPC_getfield) {
2331                 if (!isAssignableTo
2332                         (context,
2333                          stack_object,
2334                          cp_index_to_class_fullinfo
2335                              (context, operand, JVM_CONSTANT_Fieldref))) {
2336                     CCerror(context,
2337                             "Incompatible type for getting or setting field");
2338                 }
2339                 if (this_idata->protected &&
2340                     !isAssignableTo(context, stack_object,
2341                                     context->currentclass_info)) {
2342                     CCerror(context, "Bad access to protected data");
2343                 }
2344             }
2345             if (opcode == JVM_OPC_putfield || opcode == JVM_OPC_putstatic) {
2346                 int item = (opcode == JVM_OPC_putfield ? 1 : 0);
2347                 if (!isAssignableTo(context,
2348                                     stack_extra_info[item], put_full_info)) {
2349                     CCerror(context, "Bad type in putfield/putstatic");
2350                 }
2351             }
2352             break;
2353         }
2354 
2355         case JVM_OPC_athrow:
2356             if (!isAssignableTo(context, stack_extra_info[0],
2357                                 context->throwable_info)) {
2358                 CCerror(context, "Can only throw Throwable objects");
2359             }
2360             break;
2361 
2362         case JVM_OPC_aaload: {      /* array index */
2363             /* We need to pass the information to the stack updater */
2364             fullinfo_type array_type = stack_extra_info[0];
2365             context->swap_table[0] = decrement_indirection(array_type);
2366             break;
2367         }
2368 
2369         case JVM_OPC_invokevirtual: case JVM_OPC_invokespecial:
2370         case JVM_OPC_invokeinit:
2371         case JVM_OPC_invokeinterface: case JVM_OPC_invokestatic: {
2372             int operand = this_idata->operand.i;
2373             const char *signature =
2374                 JVM_GetCPMethodSignatureUTF(context->env,
2375                                             context->class,
2376                                             operand);
2377             int item;
2378             const char *p;
2379             check_and_push(context, signature, VM_STRING_UTF);
2380             if (opcode == JVM_OPC_invokestatic) {
2381                 item = 0;
2382             } else if (opcode == JVM_OPC_invokeinit) {
2383                 fullinfo_type init_type = this_idata->operand2.fi;
2384                 fullinfo_type object_type = stack_extra_info[0];
2385                 context->swap_table[0] = object_type; /* save value */
2386                 if (GET_ITEM_TYPE(stack_extra_info[0]) == ITEM_NewObject) {
2387                     /* We better be calling the appropriate init.  Find the
2388                      * inumber of the "JVM_OPC_new" instruction", and figure
2389                      * out what the type really is.
2390                      */
2391                     unsigned int new_inumber = GET_EXTRA_INFO(stack_extra_info[0]);
2392                     fullinfo_type target_type = idata[new_inumber].operand2.fi;
2393                     context->swap_table[1] = target_type;
2394 
2395                     if (target_type != init_type) {
2396                         CCerror(context, "Call to wrong initialization method");
2397                     }
2398                     if (this_idata->protected
2399                         && !isAssignableTo(context, object_type,
2400                                            context->currentclass_info)) {
2401                       CCerror(context, "Bad access to protected data");
2402                     }
2403                 } else {
2404                     /* We better be calling super() or this(). */
2405                     if (init_type != context->superclass_info &&
2406                         init_type != context->currentclass_info) {
2407                         CCerror(context, "Call to wrong initialization method");
2408                     }
2409                     context->swap_table[1] = context->currentclass_info;
2410                 }
2411                 item = 1;
2412             } else {
2413                 fullinfo_type target_type = this_idata->operand2.fi;
2414                 fullinfo_type object_type = stack_extra_info[0];
2415                 if (!isAssignableTo(context, object_type, target_type)){
2416                     CCerror(context,
2417                             "Incompatible object argument for function call");
2418                 }
2419                 if (opcode == JVM_OPC_invokespecial
2420                     && !isAssignableTo(context, object_type,
2421                                        context->currentclass_info)) {
2422                     /* Make sure object argument is assignment compatible to current class */
2423                     CCerror(context,
2424                             "Incompatible object argument for invokespecial");
2425                 }
2426                 if (this_idata->protected
2427                     && !isAssignableTo(context, object_type,
2428                                        context->currentclass_info)) {
2429                     /* This is ugly. Special dispensation.  Arrays pretend to
2430                        implement public Object clone() even though they don't */
2431                     const char *utfName =
2432                         JVM_GetCPMethodNameUTF(context->env,
2433                                                context->class,
2434                                                this_idata->operand.i);
2435                     int is_clone = utfName && (strcmp(utfName, "clone") == 0);
2436                     JVM_ReleaseUTF(utfName);
2437 
2438                     if ((target_type == context->object_info) &&
2439                         (GET_INDIRECTION(object_type) > 0) &&
2440                         is_clone) {
2441                     } else {
2442                         CCerror(context, "Bad access to protected data");
2443                     }
2444                 }
2445                 item = 1;
2446             }
2447             for (p = signature + 1; *p != JVM_SIGNATURE_ENDFUNC; item++)
2448                 if (signature_to_fieldtype(context, &p, &full_info) == 'A') {
2449                     if (!isAssignableTo(context,
2450                                         stack_extra_info[item], full_info)) {
2451                         CCerror(context, "Incompatible argument to function");
2452                     }
2453                 }
2454 
2455             pop_and_free(context);
2456             break;
2457         }
2458 
2459         case JVM_OPC_return:
2460             if (context->return_type != MAKE_FULLINFO(ITEM_Void, 0, 0))
2461                 CCerror(context, "Wrong return type in function");
2462             break;
2463 
2464         case JVM_OPC_ireturn: case JVM_OPC_lreturn: case JVM_OPC_freturn:
2465         case JVM_OPC_dreturn: case JVM_OPC_areturn: {
2466             fullinfo_type target_type = context->return_type;
2467             fullinfo_type object_type = stack_extra_info[0];
2468             if (!isAssignableTo(context, object_type, target_type)) {
2469                 CCerror(context, "Wrong return type in function");
2470             }
2471             break;
2472         }
2473 
2474         case JVM_OPC_new: {
2475             /* Make sure that nothing on the stack already looks like what
2476              * we want to create.  I can't image how this could possibly happen
2477              * but we should test for it anyway, since if it could happen, the
2478              * result would be an unitialized object being able to masquerade
2479              * as an initialized one.
2480              */
2481             stack_item_type *item;
2482             for (item = stack; item != NULL; item = item->next) {
2483                 if (item->item == this_idata->operand.fi) {
2484                     CCerror(context,
2485                             "Uninitialized object on stack at creating point");
2486                 }
2487             }
2488             /* Info for update_registers */
2489             context->swap_table[0] = this_idata->operand.fi;
2490             context->swap_table[1] = MAKE_FULLINFO(ITEM_Bogus, 0, 0);
2491 
2492             break;
2493         }
2494     }
2495     new_stack_info->stack = stack;
2496     new_stack_info->stack_size = stack_size;
2497 }
2498 
2499 
2500 /* We've already determined that the instruction is legal.  Perform the
2501  * operation on the registers, and return the updated results in
2502  * new_register_count_p and new_registers.
2503  */
2504 
2505 static void
2506 update_registers(context_type *context, unsigned int inumber,
2507                  register_info_type *new_register_info)
2508 {
2509     instruction_data_type *idata = context->instruction_data;
2510     instruction_data_type *this_idata = &idata[inumber];
2511     int opcode = this_idata->opcode;
2512     int operand = this_idata->operand.i;
2513     int register_count = this_idata->register_info.register_count;
2514     fullinfo_type *registers = this_idata->register_info.registers;
2515     stack_item_type *stack = this_idata->stack_info.stack;
2516     int mask_count = this_idata->register_info.mask_count;
2517     mask_type *masks = this_idata->register_info.masks;
2518 
2519     /* Use these as default new values. */
2520     int            new_register_count = register_count;
2521     int            new_mask_count = mask_count;
2522     fullinfo_type *new_registers = registers;
2523     mask_type     *new_masks = masks;
2524 
2525     enum { ACCESS_NONE, ACCESS_SINGLE, ACCESS_DOUBLE } access = ACCESS_NONE;
2526     int i;
2527 
2528     /* Remember, we've already verified the type at the top of the stack. */
2529     switch (opcode) {
2530         default: break;
2531         case JVM_OPC_istore: case JVM_OPC_fstore: case JVM_OPC_astore:
2532             access = ACCESS_SINGLE;
2533             goto continue_store;
2534 
2535         case JVM_OPC_lstore: case JVM_OPC_dstore:
2536             access = ACCESS_DOUBLE;
2537             goto continue_store;
2538 
2539         continue_store: {
2540             /* We have a modification to the registers.  Copy them if needed. */
2541             fullinfo_type stack_top_type = stack->item;
2542             int max_operand = operand + ((access == ACCESS_DOUBLE) ? 1 : 0);
2543 
2544             if (     max_operand < register_count
2545                   && registers[operand] == stack_top_type
2546                   && ((access == ACCESS_SINGLE) ||
2547                          (registers[operand + 1]== stack_top_type + 1)))
2548                 /* No changes have been made to the registers. */
2549                 break;
2550             new_register_count = MAX(max_operand + 1, register_count);
2551             new_registers = NEW(fullinfo_type, new_register_count);
2552             for (i = 0; i < register_count; i++)
2553                 new_registers[i] = registers[i];
2554             for (i = register_count; i < new_register_count; i++)
2555                 new_registers[i] = MAKE_FULLINFO(ITEM_Bogus, 0, 0);
2556             new_registers[operand] = stack_top_type;
2557             if (access == ACCESS_DOUBLE)
2558                 new_registers[operand + 1] = stack_top_type + 1;
2559             break;
2560         }
2561 
2562         case JVM_OPC_iload: case JVM_OPC_fload: case JVM_OPC_aload:
2563         case JVM_OPC_iinc: case JVM_OPC_ret:
2564             access = ACCESS_SINGLE;
2565             break;
2566 
2567         case JVM_OPC_lload: case JVM_OPC_dload:
2568             access = ACCESS_DOUBLE;
2569             break;
2570 
2571         case JVM_OPC_jsr: case JVM_OPC_jsr_w:
2572             for (i = 0; i < new_mask_count; i++)
2573                 if (new_masks[i].entry == operand)
2574                     CCerror(context, "Recursive call to jsr entry");
2575             new_masks = add_to_masks(context, masks, mask_count, operand);
2576             new_mask_count++;
2577             break;
2578 
2579         case JVM_OPC_invokeinit:
2580         case JVM_OPC_new: {
2581             /* For invokeinit, an uninitialized object has been initialized.
2582              * For new, all previous occurrences of an uninitialized object
2583              * from the same instruction must be made bogus.
2584              * We find all occurrences of swap_table[0] in the registers, and
2585              * replace them with swap_table[1];
2586              */
2587             fullinfo_type from = context->swap_table[0];
2588             fullinfo_type to = context->swap_table[1];
2589 
2590             int i;
2591             for (i = 0; i < register_count; i++) {
2592                 if (new_registers[i] == from) {
2593                     /* Found a match */
2594                     break;
2595                 }
2596             }
2597             if (i < register_count) { /* We broke out loop for match */
2598                 /* We have to change registers, and possibly a mask */
2599                 jboolean copied_mask = JNI_FALSE;
2600                 int k;
2601                 new_registers = NEW(fullinfo_type, register_count);
2602                 memcpy(new_registers, registers,
2603                        register_count * sizeof(registers[0]));
2604                 for ( ; i < register_count; i++) {
2605                     if (new_registers[i] == from) {
2606                         new_registers[i] = to;
2607                         for (k = 0; k < new_mask_count; k++) {
2608                             if (!IS_BIT_SET(new_masks[k].modifies, i)) {
2609                                 if (!copied_mask) {
2610                                     new_masks = copy_masks(context, new_masks,
2611                                                            mask_count);
2612                                     copied_mask = JNI_TRUE;
2613                                 }
2614                                 SET_BIT(new_masks[k].modifies, i);
2615                             }
2616                         }
2617                     }
2618                 }
2619             }
2620             break;
2621         }
2622     } /* of switch */
2623 
2624     if ((access != ACCESS_NONE) && (new_mask_count > 0)) {
2625         int i, j;
2626         for (i = 0; i < new_mask_count; i++) {
2627             int *mask = new_masks[i].modifies;
2628             if ((!IS_BIT_SET(mask, operand)) ||
2629                   ((access == ACCESS_DOUBLE) &&
2630                    !IS_BIT_SET(mask, operand + 1))) {
2631                 new_masks = copy_masks(context, new_masks, mask_count);
2632                 for (j = i; j < new_mask_count; j++) {
2633                     SET_BIT(new_masks[j].modifies, operand);
2634                     if (access == ACCESS_DOUBLE)
2635                         SET_BIT(new_masks[j].modifies, operand + 1);
2636                 }
2637                 break;
2638             }
2639         }
2640     }
2641 
2642     new_register_info->register_count = new_register_count;
2643     new_register_info->registers = new_registers;
2644     new_register_info->masks = new_masks;
2645     new_register_info->mask_count = new_mask_count;
2646 }
2647 
2648 
2649 
2650 /* We've already determined that the instruction is legal, and have updated
2651  * the registers.  Update the flags, too.
2652  */
2653 
2654 
2655 static void
2656 update_flags(context_type *context, unsigned int inumber,
2657              flag_type *new_and_flags, flag_type *new_or_flags)
2658 
2659 {
2660     instruction_data_type *idata = context->instruction_data;
2661     instruction_data_type *this_idata = &idata[inumber];
2662     flag_type and_flags = this_idata->and_flags;
2663     flag_type or_flags = this_idata->or_flags;
2664 
2665     /* Set the "we've done a constructor" flag */
2666     if (this_idata->opcode == JVM_OPC_invokeinit) {
2667         fullinfo_type from = context->swap_table[0];
2668         if (from == MAKE_FULLINFO(ITEM_InitObject, 0, 0))
2669             and_flags |= FLAG_CONSTRUCTED;
2670     }
2671     *new_and_flags = and_flags;
2672     *new_or_flags = or_flags;
2673 }
2674 
2675 
2676 
2677 /* We've already determined that the instruction is legal.  Perform the
2678  * operation on the stack;
2679  *
2680  * new_stack_size_p and new_stack_p point to the results after the pops have
2681  * already been done.  Do the pushes, and then put the results back there.
2682  */
2683 
2684 static void
2685 push_stack(context_type *context, unsigned int inumber, stack_info_type *new_stack_info)
2686 {
2687     instruction_data_type *idata = context->instruction_data;
2688     instruction_data_type *this_idata = &idata[inumber];
2689     int opcode = this_idata->opcode;
2690     int operand = this_idata->operand.i;
2691 
2692     int stack_size = new_stack_info->stack_size;
2693     stack_item_type *stack = new_stack_info->stack;
2694     char *stack_results;
2695 
2696     fullinfo_type full_info = 0;
2697     char buffer[5], *p;         /* actually [2] is big enough */
2698 
2699     /* We need to look at all those opcodes in which either we can't tell the
2700      * value pushed onto the stack from the opcode, or in which the value
2701      * pushed onto the stack is an object or array.  For the latter, we need
2702      * to make sure that full_info is set to the right value.
2703      */
2704     switch(opcode) {
2705         default:
2706             stack_results = opcode_in_out[opcode][1];
2707             break;
2708 
2709         case JVM_OPC_ldc: case JVM_OPC_ldc_w: case JVM_OPC_ldc2_w: {
2710             /* Look to constant pool to determine correct result. */
2711             unsigned char *type_table = context->constant_types;
2712             switch (type_table[operand]) {
2713                 case JVM_CONSTANT_Integer:
2714                     stack_results = "I"; break;
2715                 case JVM_CONSTANT_Float:
2716                     stack_results = "F"; break;
2717                 case JVM_CONSTANT_Double:
2718                     stack_results = "D"; break;
2719                 case JVM_CONSTANT_Long:
2720                     stack_results = "L"; break;
2721                 case JVM_CONSTANT_String:
2722                     stack_results = "A";
2723                     full_info = context->string_info;
2724                     break;
2725                 case JVM_CONSTANT_Class:
2726                     if (context->major_version < LDC_CLASS_MAJOR_VERSION)
2727                         CCerror(context, "Internal error #3");
2728                     stack_results = "A";
2729                     full_info = make_class_info_from_name(context,
2730                                                           "java/lang/Class");
2731                     break;
2732                 case JVM_CONSTANT_MethodHandle:
2733                 case JVM_CONSTANT_MethodType:
2734                     if (context->major_version < LDC_METHOD_HANDLE_MAJOR_VERSION)
2735                         CCerror(context, "Internal error #3");
2736                     stack_results = "A";
2737                     switch (type_table[operand]) {
2738                     case JVM_CONSTANT_MethodType:
2739                       full_info = make_class_info_from_name(context,
2740                                                             "java/lang/invoke/MethodType");
2741                       break;
2742                     default: //JVM_CONSTANT_MethodHandle
2743                       full_info = make_class_info_from_name(context,
2744                                                             "java/lang/invoke/MethodHandle");
2745                       break;
2746                     }
2747                     break;
2748                 default:
2749                     CCerror(context, "Internal error #3");
2750                     stack_results = ""; /* Never reached: keep lint happy */
2751             }
2752             break;
2753         }
2754 
2755         case JVM_OPC_getstatic: case JVM_OPC_getfield: {
2756             /* Look to signature to determine correct result. */
2757             int operand = this_idata->operand.i;
2758             const char *signature = JVM_GetCPFieldSignatureUTF(context->env,
2759                                                                context->class,
2760                                                                operand);
2761             check_and_push(context, signature, VM_STRING_UTF);
2762 #ifdef DEBUG
2763             if (verify_verbose) {
2764                 print_formatted_fieldname(context, operand);
2765             }
2766 #endif
2767             buffer[0] = signature_to_fieldtype(context, &signature, &full_info);
2768             buffer[1] = '\0';
2769             stack_results = buffer;
2770             pop_and_free(context);
2771             break;
2772         }
2773 
2774         case JVM_OPC_invokevirtual: case JVM_OPC_invokespecial:
2775         case JVM_OPC_invokeinit:
2776         case JVM_OPC_invokestatic: case JVM_OPC_invokeinterface: {
2777             /* Look to signature to determine correct result. */
2778             int operand = this_idata->operand.i;
2779             const char *signature = JVM_GetCPMethodSignatureUTF(context->env,
2780                                                                 context->class,
2781                                                                 operand);
2782             const char *result_signature;
2783             check_and_push(context, signature, VM_STRING_UTF);
2784             result_signature = get_result_signature(signature);
2785             if (result_signature++ == NULL) {
2786                 CCerror(context, "Illegal signature %s", signature);
2787             }
2788             if (result_signature[0] == JVM_SIGNATURE_VOID) {
2789                 stack_results = "";
2790             } else {
2791                 buffer[0] = signature_to_fieldtype(context, &result_signature,
2792                                                    &full_info);
2793                 buffer[1] = '\0';
2794                 stack_results = buffer;
2795             }
2796             pop_and_free(context);
2797             break;
2798         }
2799 
2800         case JVM_OPC_aconst_null:
2801             stack_results = opcode_in_out[opcode][1];
2802             full_info = NULL_FULLINFO; /* special NULL */
2803             break;
2804 
2805         case JVM_OPC_new:
2806         case JVM_OPC_checkcast:
2807         case JVM_OPC_newarray:
2808         case JVM_OPC_anewarray:
2809         case JVM_OPC_multianewarray:
2810             stack_results = opcode_in_out[opcode][1];
2811             /* Conveniently, this result type is stored here */
2812             full_info = this_idata->operand.fi;
2813             break;
2814 
2815         case JVM_OPC_aaload:
2816             stack_results = opcode_in_out[opcode][1];
2817             /* pop_stack() saved value for us. */
2818             full_info = context->swap_table[0];
2819             break;
2820 
2821         case JVM_OPC_aload:
2822             stack_results = opcode_in_out[opcode][1];
2823             /* The register hasn't been modified, so we can use its value. */
2824             full_info = this_idata->register_info.registers[operand];
2825             break;
2826     } /* of switch */
2827 
2828     for (p = stack_results; *p != 0; p++) {
2829         int type = *p;
2830         stack_item_type *new_item = NEW(stack_item_type, 1);
2831         new_item->next = stack;
2832         stack = new_item;
2833         switch (type) {
2834             case 'I':
2835                 stack->item = MAKE_FULLINFO(ITEM_Integer, 0, 0); break;
2836             case 'F':
2837                 stack->item = MAKE_FULLINFO(ITEM_Float, 0, 0); break;
2838             case 'D':
2839                 stack->item = MAKE_FULLINFO(ITEM_Double, 0, 0);
2840                 stack_size++; break;
2841             case 'L':
2842                 stack->item = MAKE_FULLINFO(ITEM_Long, 0, 0);
2843                 stack_size++; break;
2844             case 'R':
2845                 stack->item = MAKE_FULLINFO(ITEM_ReturnAddress, 0, operand);
2846                 break;
2847             case '1': case '2': case '3': case '4': {
2848                 /* Get the info saved in the swap_table */
2849                 fullinfo_type stype = context->swap_table[type - '1'];
2850                 stack->item = stype;
2851                 if (stype == MAKE_FULLINFO(ITEM_Long, 0, 0) ||
2852                     stype == MAKE_FULLINFO(ITEM_Double, 0, 0)) {
2853                     stack_size++; p++;
2854                 }
2855                 break;
2856             }
2857             case 'A':
2858                 /* full_info should have the appropriate value. */
2859                 assert(full_info != 0);
2860                 stack->item = full_info;
2861                 break;
2862             default:
2863                 CCerror(context, "Internal error #4");
2864 
2865             } /* switch type */
2866         stack_size++;
2867     } /* outer for loop */
2868 
2869     if (opcode == JVM_OPC_invokeinit) {
2870         /* If there are any instances of "from" on the stack, we need to
2871          * replace it with "to", since calling <init> initializes all versions
2872          * of the object, obviously.     */
2873         fullinfo_type from = context->swap_table[0];
2874         stack_item_type *ptr;
2875         for (ptr = stack; ptr != NULL; ptr = ptr->next) {
2876             if (ptr->item == from) {
2877                 fullinfo_type to = context->swap_table[1];
2878                 stack = copy_stack(context, stack);
2879                 for (ptr = stack; ptr != NULL; ptr = ptr->next)
2880                     if (ptr->item == from) ptr->item = to;
2881                 break;
2882             }
2883         }
2884     }
2885 
2886     new_stack_info->stack_size = stack_size;
2887     new_stack_info->stack = stack;
2888 }
2889 
2890 
2891 /* We've performed an instruction, and determined the new registers and stack
2892  * value.  Look at all of the possibly subsequent instructions, and merge
2893  * this stack value into theirs.
2894  */
2895 
2896 static void
2897 merge_into_successors(context_type *context, unsigned int inumber,
2898                       register_info_type *register_info,
2899                       stack_info_type *stack_info,
2900                       flag_type and_flags, flag_type or_flags)
2901 {
2902     instruction_data_type *idata = context->instruction_data;
2903     instruction_data_type *this_idata = &idata[inumber];
2904     int opcode = this_idata->opcode;
2905     int operand = this_idata->operand.i;
2906     struct handler_info_type *handler_info = context->handler_info;
2907     int handler_info_length =
2908         JVM_GetMethodIxExceptionTableLength(context->env,
2909                                             context->class,
2910                                             context->method_index);
2911 
2912 
2913     int buffer[2];              /* default value for successors */
2914     int *successors = buffer;   /* table of successors */
2915     int successors_count;
2916     int i;
2917 
2918     switch (opcode) {
2919     default:
2920         successors_count = 1;
2921         buffer[0] = inumber + 1;
2922         break;
2923 
2924     case JVM_OPC_ifeq: case JVM_OPC_ifne: case JVM_OPC_ifgt:
2925     case JVM_OPC_ifge: case JVM_OPC_iflt: case JVM_OPC_ifle:
2926     case JVM_OPC_ifnull: case JVM_OPC_ifnonnull:
2927     case JVM_OPC_if_icmpeq: case JVM_OPC_if_icmpne: case JVM_OPC_if_icmpgt:
2928     case JVM_OPC_if_icmpge: case JVM_OPC_if_icmplt: case JVM_OPC_if_icmple:
2929     case JVM_OPC_if_acmpeq: case JVM_OPC_if_acmpne:
2930         successors_count = 2;
2931         buffer[0] = inumber + 1;
2932         buffer[1] = operand;
2933         break;
2934 
2935     case JVM_OPC_jsr: case JVM_OPC_jsr_w:
2936         if (this_idata->operand2.i != UNKNOWN_RET_INSTRUCTION)
2937             idata[this_idata->operand2.i].changed = JNI_TRUE;
2938         /* FALLTHROUGH */
2939     case JVM_OPC_goto: case JVM_OPC_goto_w:
2940         successors_count = 1;
2941         buffer[0] = operand;
2942         break;
2943 
2944 
2945     case JVM_OPC_ireturn: case JVM_OPC_lreturn: case JVM_OPC_return:
2946     case JVM_OPC_freturn: case JVM_OPC_dreturn: case JVM_OPC_areturn:
2947     case JVM_OPC_athrow:
2948         /* The testing for the returns is handled in pop_stack() */
2949         successors_count = 0;
2950         break;
2951 
2952     case JVM_OPC_ret: {
2953         /* This is slightly slow, but good enough for a seldom used instruction.
2954          * The EXTRA_ITEM_INFO of the ITEM_ReturnAddress indicates the
2955          * address of the first instruction of the subroutine.  We can return
2956          * to 1 after any instruction that jsr's to that instruction.
2957          */
2958         if (this_idata->operand2.ip == NULL) {
2959             fullinfo_type *registers = this_idata->register_info.registers;
2960             int called_instruction = GET_EXTRA_INFO(registers[operand]);
2961             int i, count, *ptr;;
2962             for (i = context->instruction_count, count = 0; --i >= 0; ) {
2963                 if (((idata[i].opcode == JVM_OPC_jsr) ||
2964                      (idata[i].opcode == JVM_OPC_jsr_w)) &&
2965                     (idata[i].operand.i == called_instruction))
2966                     count++;
2967             }
2968             this_idata->operand2.ip = ptr = NEW(int, count + 1);
2969             *ptr++ = count;
2970             for (i = context->instruction_count, count = 0; --i >= 0; ) {
2971                 if (((idata[i].opcode == JVM_OPC_jsr) ||
2972                      (idata[i].opcode == JVM_OPC_jsr_w)) &&
2973                     (idata[i].operand.i == called_instruction))
2974                     *ptr++ = i + 1;
2975             }
2976         }
2977         successors = this_idata->operand2.ip; /* use this instead */
2978         successors_count = *successors++;
2979         break;
2980 
2981     }
2982 
2983     case JVM_OPC_tableswitch:
2984     case JVM_OPC_lookupswitch:
2985         successors = this_idata->operand.ip; /* use this instead */
2986         successors_count = *successors++;
2987         break;
2988     }
2989 
2990 #ifdef DEBUG
2991     if (verify_verbose) {
2992         jio_fprintf(stdout, " [");
2993         for (i = handler_info_length; --i >= 0; handler_info++)
2994             if (handler_info->start <= (int)inumber && handler_info->end > (int)inumber)
2995                 jio_fprintf(stdout, "%d* ", handler_info->handler);
2996         for (i = 0; i < successors_count; i++)
2997             jio_fprintf(stdout, "%d ", successors[i]);
2998         jio_fprintf(stdout,   "]\n");
2999     }
3000 #endif
3001 
3002     handler_info = context->handler_info;
3003     for (i = handler_info_length; --i >= 0; handler_info++) {
3004         if (handler_info->start <= (int)inumber && handler_info->end > (int)inumber) {
3005             int handler = handler_info->handler;
3006             if (opcode != JVM_OPC_invokeinit) {
3007                 merge_into_one_successor(context, inumber, handler,
3008                                          &this_idata->register_info, /* old */
3009                                          &handler_info->stack_info,
3010                                          (flag_type) (and_flags
3011                                                       & this_idata->and_flags),
3012                                          (flag_type) (or_flags
3013                                                       | this_idata->or_flags),
3014                                          JNI_TRUE);
3015             } else {
3016                 /* We need to be a little bit more careful with this
3017                  * instruction.  Things could either be in the state before
3018                  * the instruction or in the state afterwards */
3019                 fullinfo_type from = context->swap_table[0];
3020                 flag_type temp_or_flags = or_flags;
3021                 if (from == MAKE_FULLINFO(ITEM_InitObject, 0, 0))
3022                     temp_or_flags |= FLAG_NO_RETURN;
3023                 merge_into_one_successor(context, inumber, handler,
3024                                          &this_idata->register_info, /* old */
3025                                          &handler_info->stack_info,
3026                                          this_idata->and_flags,
3027                                          this_idata->or_flags,
3028                                          JNI_TRUE);
3029                 merge_into_one_successor(context, inumber, handler,
3030                                          register_info,
3031                                          &handler_info->stack_info,
3032                                          and_flags, temp_or_flags, JNI_TRUE);
3033             }
3034         }
3035     }
3036     for (i = 0; i < successors_count; i++) {
3037         int target = successors[i];
3038         if (target >= context->instruction_count)
3039             CCerror(context, "Falling off the end of the code");
3040         merge_into_one_successor(context, inumber, target,
3041                                  register_info, stack_info, and_flags, or_flags,
3042                                  JNI_FALSE);
3043     }
3044 }
3045 
3046 /* We have a new set of registers and stack values for a given instruction.
3047  * Merge this new set into the values that are already there.
3048  */
3049 
3050 static void
3051 merge_into_one_successor(context_type *context,
3052                          unsigned int from_inumber, unsigned int to_inumber,
3053                          register_info_type *new_register_info,
3054                          stack_info_type *new_stack_info,
3055                          flag_type new_and_flags, flag_type new_or_flags,
3056                          jboolean isException)
3057 {
3058     instruction_data_type *idata = context->instruction_data;
3059     register_info_type register_info_buf;
3060     stack_info_type stack_info_buf;
3061 #ifdef DEBUG
3062     instruction_data_type *this_idata = &idata[to_inumber];
3063     register_info_type old_reg_info;
3064     stack_info_type old_stack_info;
3065     flag_type old_and_flags = 0;
3066     flag_type old_or_flags = 0;
3067 #endif
3068 
3069 #ifdef DEBUG
3070     if (verify_verbose) {
3071         old_reg_info = this_idata->register_info;
3072         old_stack_info = this_idata->stack_info;
3073         old_and_flags = this_idata->and_flags;
3074         old_or_flags = this_idata->or_flags;
3075     }
3076 #endif
3077 
3078     /* All uninitialized objects are set to "bogus" when jsr and
3079      * ret are executed. Thus uninitialized objects can't propagate
3080      * into or out of a subroutine.
3081      */
3082     if (idata[from_inumber].opcode == JVM_OPC_ret ||
3083         idata[from_inumber].opcode == JVM_OPC_jsr ||
3084         idata[from_inumber].opcode == JVM_OPC_jsr_w) {
3085         int new_register_count = new_register_info->register_count;
3086         fullinfo_type *new_registers = new_register_info->registers;
3087         int i;
3088         stack_item_type *item;
3089 
3090         for (item = new_stack_info->stack; item != NULL; item = item->next) {
3091             if (GET_ITEM_TYPE(item->item) == ITEM_NewObject) {
3092                 /* This check only succeeds for hand-contrived code.
3093                  * Efficiency is not an issue.
3094                  */
3095                 stack_info_buf.stack = copy_stack(context,
3096                                                   new_stack_info->stack);
3097                 stack_info_buf.stack_size = new_stack_info->stack_size;
3098                 new_stack_info = &stack_info_buf;
3099                 for (item = new_stack_info->stack; item != NULL;
3100                      item = item->next) {
3101                     if (GET_ITEM_TYPE(item->item) == ITEM_NewObject) {
3102                         item->item = MAKE_FULLINFO(ITEM_Bogus, 0, 0);
3103                     }
3104                 }
3105                 break;
3106             }
3107         }
3108         for (i = 0; i < new_register_count; i++) {
3109             if (GET_ITEM_TYPE(new_registers[i]) == ITEM_NewObject) {
3110                 /* This check only succeeds for hand-contrived code.
3111                  * Efficiency is not an issue.
3112                  */
3113                 fullinfo_type *new_set = NEW(fullinfo_type,
3114                                              new_register_count);
3115                 for (i = 0; i < new_register_count; i++) {
3116                     fullinfo_type t = new_registers[i];
3117                     new_set[i] = GET_ITEM_TYPE(t) != ITEM_NewObject ?
3118                         t : MAKE_FULLINFO(ITEM_Bogus, 0, 0);
3119                 }
3120                 register_info_buf.register_count = new_register_count;
3121                 register_info_buf.registers = new_set;
3122                 register_info_buf.mask_count = new_register_info->mask_count;
3123                 register_info_buf.masks = new_register_info->masks;
3124                 new_register_info = &register_info_buf;
3125                 break;
3126             }
3127         }
3128     }
3129 
3130     /* Returning from a subroutine is somewhat ugly.  The actual thing
3131      * that needs to get merged into the new instruction is a joining
3132      * of info from the ret instruction with stuff in the jsr instruction
3133      */
3134     if (idata[from_inumber].opcode == JVM_OPC_ret && !isException) {
3135         int new_register_count = new_register_info->register_count;
3136         fullinfo_type *new_registers = new_register_info->registers;
3137         int new_mask_count = new_register_info->mask_count;
3138         mask_type *new_masks = new_register_info->masks;
3139         int operand = idata[from_inumber].operand.i;
3140         int called_instruction = GET_EXTRA_INFO(new_registers[operand]);
3141         instruction_data_type *jsr_idata = &idata[to_inumber - 1];
3142         register_info_type *jsr_reginfo = &jsr_idata->register_info;
3143         if (jsr_idata->operand2.i != (int)from_inumber) {
3144             if (jsr_idata->operand2.i != UNKNOWN_RET_INSTRUCTION)
3145                 CCerror(context, "Multiple returns to single jsr");
3146             jsr_idata->operand2.i = from_inumber;
3147         }
3148         if (jsr_reginfo->register_count == UNKNOWN_REGISTER_COUNT) {
3149             /* We don't want to handle the returned-to instruction until
3150              * we've dealt with the jsr instruction.   When we get to the
3151              * jsr instruction (if ever), we'll re-mark the ret instruction
3152              */
3153             ;
3154         } else {
3155             int register_count = jsr_reginfo->register_count;
3156             fullinfo_type *registers = jsr_reginfo->registers;
3157             int max_registers = MAX(register_count, new_register_count);
3158             fullinfo_type *new_set = NEW(fullinfo_type, max_registers);
3159             int *return_mask;
3160             struct register_info_type new_new_register_info;
3161             int i;
3162             /* Make sure the place we're returning from is legal! */
3163             for (i = new_mask_count; --i >= 0; )
3164                 if (new_masks[i].entry == called_instruction)
3165                     break;
3166             if (i < 0)
3167                 CCerror(context, "Illegal return from subroutine");
3168             /* pop the masks down to the indicated one.  Remember the mask
3169              * we're popping off. */
3170             return_mask = new_masks[i].modifies;
3171             new_mask_count = i;
3172             for (i = 0; i < max_registers; i++) {
3173                 if (IS_BIT_SET(return_mask, i))
3174                     new_set[i] = i < new_register_count ?
3175                           new_registers[i] : MAKE_FULLINFO(ITEM_Bogus, 0, 0);
3176                 else
3177                     new_set[i] = i < register_count ?
3178                         registers[i] : MAKE_FULLINFO(ITEM_Bogus, 0, 0);
3179             }
3180             new_new_register_info.register_count = max_registers;
3181             new_new_register_info.registers      = new_set;
3182             new_new_register_info.mask_count     = new_mask_count;
3183             new_new_register_info.masks          = new_masks;
3184 
3185 
3186             merge_stack(context, from_inumber, to_inumber, new_stack_info);
3187             merge_registers(context, to_inumber - 1, to_inumber,
3188                             &new_new_register_info);
3189             merge_flags(context, from_inumber, to_inumber, new_and_flags, new_or_flags);
3190         }
3191     } else {
3192         merge_stack(context, from_inumber, to_inumber, new_stack_info);
3193         merge_registers(context, from_inumber, to_inumber, new_register_info);
3194         merge_flags(context, from_inumber, to_inumber,
3195                     new_and_flags, new_or_flags);
3196     }
3197 
3198 #ifdef DEBUG
3199     if (verify_verbose && idata[to_inumber].changed) {
3200         register_info_type *register_info = &this_idata->register_info;
3201         stack_info_type *stack_info = &this_idata->stack_info;
3202         if (memcmp(&old_reg_info, register_info, sizeof(old_reg_info)) ||
3203             memcmp(&old_stack_info, stack_info, sizeof(old_stack_info)) ||
3204             (old_and_flags != this_idata->and_flags) ||
3205             (old_or_flags != this_idata->or_flags)) {
3206             jio_fprintf(stdout, "   %2d:", to_inumber);
3207             print_stack(context, &old_stack_info);
3208             print_registers(context, &old_reg_info);
3209             print_flags(context, old_and_flags, old_or_flags);
3210             jio_fprintf(stdout, " => ");
3211             print_stack(context, &this_idata->stack_info);
3212             print_registers(context, &this_idata->register_info);
3213             print_flags(context, this_idata->and_flags, this_idata->or_flags);
3214             jio_fprintf(stdout, "\n");
3215         }
3216     }
3217 #endif
3218 
3219 }
3220 
3221 static void
3222 merge_stack(context_type *context, unsigned int from_inumber,
3223             unsigned int to_inumber, stack_info_type *new_stack_info)
3224 {
3225     instruction_data_type *idata = context->instruction_data;
3226     instruction_data_type *this_idata = &idata[to_inumber];
3227 
3228     int new_stack_size =  new_stack_info->stack_size;
3229     stack_item_type *new_stack = new_stack_info->stack;
3230 
3231     int stack_size = this_idata->stack_info.stack_size;
3232 
3233     if (stack_size == UNKNOWN_STACK_SIZE) {
3234         /* First time at this instruction.  Just copy. */
3235         this_idata->stack_info.stack_size = new_stack_size;
3236         this_idata->stack_info.stack = new_stack;
3237         this_idata->changed = JNI_TRUE;
3238     } else if (new_stack_size != stack_size) {
3239         CCerror(context, "Inconsistent stack height %d != %d",
3240                 new_stack_size, stack_size);
3241     } else {
3242         stack_item_type *stack = this_idata->stack_info.stack;
3243         stack_item_type *old, *new;
3244         jboolean change = JNI_FALSE;
3245         for (old = stack, new = new_stack; old != NULL;
3246                    old = old->next, new = new->next) {
3247             assert(new != NULL);
3248             if (!isAssignableTo(context, new->item, old->item)) {
3249                 change = JNI_TRUE;
3250                 break;
3251             }
3252         }
3253         if (change) {
3254             stack = copy_stack(context, stack);
3255             for (old = stack, new = new_stack; old != NULL;
3256                           old = old->next, new = new->next) {
3257                 if (new == NULL) {
3258                     break;
3259                 }
3260                 old->item = merge_fullinfo_types(context, old->item, new->item,
3261                                                  JNI_FALSE);
3262                 if (GET_ITEM_TYPE(old->item) == ITEM_Bogus) {
3263                         CCerror(context, "Mismatched stack types");
3264                 }
3265             }
3266             if (old != NULL || new != NULL) {
3267                 CCerror(context, "Mismatched stack types");
3268             }
3269             this_idata->stack_info.stack = stack;
3270             this_idata->changed = JNI_TRUE;
3271         }
3272     }
3273 }
3274 
3275 static void
3276 merge_registers(context_type *context, unsigned int from_inumber,
3277                 unsigned int to_inumber, register_info_type *new_register_info)
3278 {
3279     instruction_data_type *idata = context->instruction_data;
3280     instruction_data_type *this_idata = &idata[to_inumber];
3281     register_info_type    *this_reginfo = &this_idata->register_info;
3282 
3283     int            new_register_count = new_register_info->register_count;
3284     fullinfo_type *new_registers = new_register_info->registers;
3285     int            new_mask_count = new_register_info->mask_count;
3286     mask_type     *new_masks = new_register_info->masks;
3287 
3288 
3289     if (this_reginfo->register_count == UNKNOWN_REGISTER_COUNT) {
3290         this_reginfo->register_count = new_register_count;
3291         this_reginfo->registers = new_registers;
3292         this_reginfo->mask_count = new_mask_count;
3293         this_reginfo->masks = new_masks;
3294         this_idata->changed = JNI_TRUE;
3295     } else {
3296         /* See if we've got new information on the register set. */
3297         int register_count = this_reginfo->register_count;
3298         fullinfo_type *registers = this_reginfo->registers;
3299         int mask_count = this_reginfo->mask_count;
3300         mask_type *masks = this_reginfo->masks;
3301 
3302         jboolean copy = JNI_FALSE;
3303         int i, j;
3304         if (register_count > new_register_count) {
3305             /* Any register larger than new_register_count is now bogus */
3306             this_reginfo->register_count = new_register_count;
3307             register_count = new_register_count;
3308             this_idata->changed = JNI_TRUE;
3309         }
3310         for (i = 0; i < register_count; i++) {
3311             fullinfo_type prev_value = registers[i];
3312             if ((i < new_register_count)
3313                   ? (!isAssignableTo(context, new_registers[i], prev_value))
3314                   : (prev_value != MAKE_FULLINFO(ITEM_Bogus, 0, 0))) {
3315                 copy = JNI_TRUE;
3316                 break;
3317             }
3318         }
3319 
3320         if (copy) {
3321             /* We need a copy.  So do it. */
3322             fullinfo_type *new_set = NEW(fullinfo_type, register_count);
3323             for (j = 0; j < i; j++)
3324                 new_set[j] =  registers[j];
3325             for (j = i; j < register_count; j++) {
3326                 if (i >= new_register_count)
3327                     new_set[j] = MAKE_FULLINFO(ITEM_Bogus, 0, 0);
3328                 else
3329                     new_set[j] = merge_fullinfo_types(context,
3330                                                       new_registers[j],
3331                                                       registers[j], JNI_FALSE);
3332             }
3333             /* Some of the end items might now be bogus. This step isn't
3334              * necessary, but it may save work later. */
3335             while (   register_count > 0
3336                    && GET_ITEM_TYPE(new_set[register_count-1]) == ITEM_Bogus)
3337                 register_count--;
3338             this_reginfo->register_count = register_count;
3339             this_reginfo->registers = new_set;
3340             this_idata->changed = JNI_TRUE;
3341         }
3342         if (mask_count > 0) {
3343             /* If the target instruction already has a sequence of masks, then
3344              * we need to merge new_masks into it.  We want the entries on
3345              * the mask to be the longest common substring of the two.
3346              *   (e.g.   a->b->d merged with a->c->d should give a->d)
3347              * The bits set in the mask should be the or of the corresponding
3348              * entries in each of the original masks.
3349              */
3350             int i, j, k;
3351             int matches = 0;
3352             int last_match = -1;
3353             jboolean copy_needed = JNI_FALSE;
3354             for (i = 0; i < mask_count; i++) {
3355                 int entry = masks[i].entry;
3356                 for (j = last_match + 1; j < new_mask_count; j++) {
3357                     if (new_masks[j].entry == entry) {
3358                         /* We have a match */
3359                         int *prev = masks[i].modifies;
3360                         int *new = new_masks[j].modifies;
3361                         matches++;
3362                         /* See if new_mask has bits set for "entry" that
3363                          * weren't set for mask.  If so, need to copy. */
3364                         for (k = context->bitmask_size - 1;
3365                                !copy_needed && k >= 0;
3366                                k--)
3367                             if (~prev[k] & new[k])
3368                                 copy_needed = JNI_TRUE;
3369                         last_match = j;
3370                         break;
3371                     }
3372                 }
3373             }
3374             if ((matches < mask_count) || copy_needed) {
3375                 /* We need to make a copy for the new item, since either the
3376                  * size has decreased, or new bits are set. */
3377                 mask_type *copy = NEW(mask_type, matches);
3378                 for (i = 0; i < matches; i++) {
3379                     copy[i].modifies = NEW(int, context->bitmask_size);
3380                 }
3381                 this_reginfo->masks = copy;
3382                 this_reginfo->mask_count = matches;
3383                 this_idata->changed = JNI_TRUE;
3384                 matches = 0;
3385                 last_match = -1;
3386                 for (i = 0; i < mask_count; i++) {
3387                     int entry = masks[i].entry;
3388                     for (j = last_match + 1; j < new_mask_count; j++) {
3389                         if (new_masks[j].entry == entry) {
3390                             int *prev1 = masks[i].modifies;
3391                             int *prev2 = new_masks[j].modifies;
3392                             int *new = copy[matches].modifies;
3393                             copy[matches].entry = entry;
3394                             for (k = context->bitmask_size - 1; k >= 0; k--)
3395                                 new[k] = prev1[k] | prev2[k];
3396                             matches++;
3397                             last_match = j;
3398                             break;
3399                         }
3400                     }
3401                 }
3402             }
3403         }
3404     }
3405 }
3406 
3407 
3408 static void
3409 merge_flags(context_type *context, unsigned int from_inumber,
3410             unsigned int to_inumber,
3411             flag_type new_and_flags, flag_type new_or_flags)
3412 {
3413     /* Set this_idata->and_flags &= new_and_flags
3414            this_idata->or_flags |= new_or_flags
3415      */
3416     instruction_data_type *idata = context->instruction_data;
3417     instruction_data_type *this_idata = &idata[to_inumber];
3418     flag_type this_and_flags = this_idata->and_flags;
3419     flag_type this_or_flags = this_idata->or_flags;
3420     flag_type merged_and = this_and_flags & new_and_flags;
3421     flag_type merged_or = this_or_flags | new_or_flags;
3422 
3423     if ((merged_and != this_and_flags) || (merged_or != this_or_flags)) {
3424         this_idata->and_flags = merged_and;
3425         this_idata->or_flags = merged_or;
3426         this_idata->changed = JNI_TRUE;
3427     }
3428 }
3429 
3430 
3431 /* Make a copy of a stack */
3432 
3433 static stack_item_type *
3434 copy_stack(context_type *context, stack_item_type *stack)
3435 {
3436     int length;
3437     stack_item_type *ptr;
3438 
3439     /* Find the length */
3440     for (ptr = stack, length = 0; ptr != NULL; ptr = ptr->next, length++);
3441 
3442     if (length > 0) {
3443         stack_item_type *new_stack = NEW(stack_item_type, length);
3444         stack_item_type *new_ptr;
3445         for (    ptr = stack, new_ptr = new_stack;
3446                  ptr != NULL;
3447                  ptr = ptr->next, new_ptr++) {
3448             new_ptr->item = ptr->item;
3449             new_ptr->next = new_ptr + 1;
3450         }
3451         new_stack[length - 1].next = NULL;
3452         return new_stack;
3453     } else {
3454         return NULL;
3455     }
3456 }
3457 
3458 
3459 static mask_type *
3460 copy_masks(context_type *context, mask_type *masks, int mask_count)
3461 {
3462     mask_type *result = NEW(mask_type, mask_count);
3463     int bitmask_size = context->bitmask_size;
3464     int *bitmaps = NEW(int, mask_count * bitmask_size);
3465     int i;
3466     for (i = 0; i < mask_count; i++) {
3467         result[i].entry = masks[i].entry;
3468         result[i].modifies = &bitmaps[i * bitmask_size];
3469         memcpy(result[i].modifies, masks[i].modifies, bitmask_size * sizeof(int));
3470     }
3471     return result;
3472 }
3473 
3474 
3475 static mask_type *
3476 add_to_masks(context_type *context, mask_type *masks, int mask_count, int d)
3477 {
3478     mask_type *result = NEW(mask_type, mask_count + 1);
3479     int bitmask_size = context->bitmask_size;
3480     int *bitmaps = NEW(int, (mask_count + 1) * bitmask_size);
3481     int i;
3482     for (i = 0; i < mask_count; i++) {
3483         result[i].entry = masks[i].entry;
3484         result[i].modifies = &bitmaps[i * bitmask_size];
3485         memcpy(result[i].modifies, masks[i].modifies, bitmask_size * sizeof(int));
3486     }
3487     result[mask_count].entry = d;
3488     result[mask_count].modifies = &bitmaps[mask_count * bitmask_size];
3489     memset(result[mask_count].modifies, 0, bitmask_size * sizeof(int));
3490     return result;
3491 }
3492 
3493 
3494 
3495 /* We create our own storage manager, since we malloc lots of little items,
3496  * and I don't want to keep trace of when they become free.  I sure wish that
3497  * we had heaps, and I could just free the heap when done.
3498  */
3499 
3500 #define CCSegSize 2000
3501 
3502 struct CCpool {                 /* a segment of allocated memory in the pool */
3503     struct CCpool *next;
3504     int segSize;                /* almost always CCSegSize */
3505     int poolPad;
3506     char space[CCSegSize];
3507 };
3508 
3509 /* Initialize the context's heap. */
3510 static void CCinit(context_type *context)
3511 {
3512     struct CCpool *new = (struct CCpool *) malloc(sizeof(struct CCpool));
3513     /* Set context->CCroot to 0 if new == 0 to tell CCdestroy to lay off */
3514     context->CCroot = context->CCcurrent = new;
3515     if (new == 0) {
3516         CCout_of_memory(context);
3517     }
3518     new->next = NULL;
3519     new->segSize = CCSegSize;
3520     context->CCfree_size = CCSegSize;
3521     context->CCfree_ptr = &new->space[0];
3522 }
3523 
3524 
3525 /* Reuse all the space that we have in the context's heap. */
3526 static void CCreinit(context_type *context)
3527 {
3528     struct CCpool *first = context->CCroot;
3529     context->CCcurrent = first;
3530     context->CCfree_size = CCSegSize;
3531     context->CCfree_ptr = &first->space[0];
3532 }
3533 
3534 /* Destroy the context's heap. */
3535 static void CCdestroy(context_type *context)
3536 {
3537     struct CCpool *this = context->CCroot;
3538     while (this) {
3539         struct CCpool *next = this->next;
3540         free(this);
3541         this = next;
3542     }
3543     /* These two aren't necessary.  But can't hurt either */
3544     context->CCroot = context->CCcurrent = NULL;
3545     context->CCfree_ptr = 0;
3546 }
3547 
3548 /* Allocate an object of the given size from the context's heap. */
3549 static void *
3550 CCalloc(context_type *context, int size, jboolean zero)
3551 {
3552 
3553     register char *p;
3554     /* Round CC to the size of a pointer */
3555     size = (size + (sizeof(void *) - 1)) & ~(sizeof(void *) - 1);
3556 
3557     if (context->CCfree_size <  size) {
3558         struct CCpool *current = context->CCcurrent;
3559         struct CCpool *new;
3560         if (size > CCSegSize) { /* we need to allocate a special block */
3561             new = (struct CCpool *)malloc(sizeof(struct CCpool) +
3562                                           (size - CCSegSize));
3563             if (new == 0) {
3564                 CCout_of_memory(context);
3565             }
3566             new->next = current->next;
3567             new->segSize = size;
3568             current->next = new;
3569         } else {
3570             new = current->next;
3571             if (new == NULL) {
3572                 new = (struct CCpool *) malloc(sizeof(struct CCpool));
3573                 if (new == 0) {
3574                     CCout_of_memory(context);
3575                 }
3576                 current->next = new;
3577                 new->next = NULL;
3578                 new->segSize = CCSegSize;
3579             }
3580         }
3581         context->CCcurrent = new;
3582         context->CCfree_ptr = &new->space[0];
3583         context->CCfree_size = new->segSize;
3584     }
3585     p = context->CCfree_ptr;
3586     context->CCfree_ptr += size;
3587     context->CCfree_size -= size;
3588     if (zero)
3589         memset(p, 0, size);
3590     return p;
3591 }
3592 
3593 /* Get the class associated with a particular field or method or class in the
3594  * constant pool.  If is_field is true, we've got a field or method.  If
3595  * false, we've got a class.
3596  */
3597 static fullinfo_type
3598 cp_index_to_class_fullinfo(context_type *context, int cp_index, int kind)
3599 {
3600     JNIEnv *env = context->env;
3601     fullinfo_type result;
3602     const char *classname;
3603     switch (kind) {
3604     case JVM_CONSTANT_Class:
3605         classname = JVM_GetCPClassNameUTF(env,
3606                                           context->class,
3607                                           cp_index);
3608         break;
3609     case JVM_CONSTANT_Methodref:
3610         classname = JVM_GetCPMethodClassNameUTF(env,
3611                                                 context->class,
3612                                                 cp_index);
3613         break;
3614     case JVM_CONSTANT_Fieldref:
3615         classname = JVM_GetCPFieldClassNameUTF(env,
3616                                                context->class,
3617                                                cp_index);
3618         break;
3619     default:
3620         classname = NULL;
3621         CCerror(context, "Internal error #5");
3622     }
3623 
3624     check_and_push(context, classname, VM_STRING_UTF);
3625     if (classname[0] == JVM_SIGNATURE_ARRAY) {
3626         /* This make recursively call us, in case of a class array */
3627         signature_to_fieldtype(context, &classname, &result);
3628     } else {
3629         result = make_class_info_from_name(context, classname);
3630     }
3631     pop_and_free(context);
3632     return result;
3633 }
3634 
3635 
3636 static int
3637 print_CCerror_info(context_type *context)
3638 {
3639     JNIEnv *env = context->env;
3640     jclass cb = context->class;
3641     const char *classname = JVM_GetClassNameUTF(env, cb);
3642     const char *name = 0;
3643     const char *signature = 0;
3644     int n = 0;
3645     if (context->method_index != -1) {
3646         name = JVM_GetMethodIxNameUTF(env, cb, context->method_index);
3647         signature =
3648             JVM_GetMethodIxSignatureUTF(env, cb, context->method_index);
3649         n += jio_snprintf(context->message, context->message_buf_len,
3650                           "(class: %s, method: %s signature: %s) ",
3651                           (classname ? classname : ""),
3652                           (name ? name : ""),
3653                           (signature ? signature : ""));
3654     } else if (context->field_index != -1 ) {
3655         name = JVM_GetMethodIxNameUTF(env, cb, context->field_index);
3656         n += jio_snprintf(context->message, context->message_buf_len,
3657                           "(class: %s, field: %s) ",
3658                           (classname ? classname : 0),
3659                           (name ? name : 0));
3660     } else {
3661         n += jio_snprintf(context->message, context->message_buf_len,
3662                           "(class: %s) ", classname ? classname : "");
3663     }
3664     JVM_ReleaseUTF(classname);
3665     JVM_ReleaseUTF(name);
3666     JVM_ReleaseUTF(signature);
3667     return n;
3668 }
3669 
3670 static void
3671 CCerror (context_type *context, char *format, ...)
3672 {
3673     int n = print_CCerror_info(context);
3674     va_list args;
3675     if (n >= 0 && n < context->message_buf_len) {
3676         va_start(args, format);
3677         jio_vsnprintf(context->message + n, context->message_buf_len - n,
3678                       format, args);
3679         va_end(args);
3680     }
3681     context->err_code = CC_VerifyError;
3682     longjmp(context->jump_buffer, 1);
3683 }
3684 
3685 static void
3686 CCout_of_memory(context_type *context)
3687 {
3688     int n = print_CCerror_info(context);
3689     context->err_code = CC_OutOfMemory;
3690     longjmp(context->jump_buffer, 1);
3691 }
3692 
3693 static void
3694 CFerror(context_type *context, char *format, ...)
3695 {
3696     int n = print_CCerror_info(context);
3697     va_list args;
3698     if (n >= 0 && n < context->message_buf_len) {
3699         va_start(args, format);
3700         jio_vsnprintf(context->message + n, context->message_buf_len - n,
3701                       format, args);
3702         va_end(args);
3703     }
3704     context->err_code = CC_ClassFormatError;
3705     longjmp(context->jump_buffer, 1);
3706 }
3707 
3708 /*
3709  * Need to scan the entire signature to find the result type because
3710  * types in the arg list and the result type could contain embedded ')'s.
3711  */
3712 static const char* get_result_signature(const char* signature) {
3713     const char *p;
3714     for (p = signature; *p != JVM_SIGNATURE_ENDFUNC; p++) {
3715         switch (*p) {
3716           case JVM_SIGNATURE_BOOLEAN:
3717           case JVM_SIGNATURE_BYTE:
3718           case JVM_SIGNATURE_CHAR:
3719           case JVM_SIGNATURE_SHORT:
3720           case JVM_SIGNATURE_INT:
3721           case JVM_SIGNATURE_FLOAT:
3722           case JVM_SIGNATURE_DOUBLE:
3723           case JVM_SIGNATURE_LONG:
3724           case JVM_SIGNATURE_FUNC:  /* ignore initial (, if given */
3725             break;
3726           case JVM_SIGNATURE_CLASS:
3727           case JVM_SIGNATURE_INLINE_TYPE:
3728             while (*p != JVM_SIGNATURE_ENDCLASS) p++;
3729             break;
3730           case JVM_SIGNATURE_ARRAY:
3731             while (*p == JVM_SIGNATURE_ARRAY) p++;
3732             /* If an array of classes, skip over class name, too. */
3733             if (*p == JVM_SIGNATURE_CLASS || *p == JVM_SIGNATURE_INLINE_TYPE) {
3734                 while (*p != JVM_SIGNATURE_ENDCLASS) p++;
3735             }
3736             break;
3737           default:
3738             /* Indicate an error. */
3739             return NULL;
3740         }
3741     }
3742     return p++; /* skip over ')'. */
3743 }
3744 
3745 static char
3746 signature_to_fieldtype(context_type *context,
3747                        const char **signature_p, fullinfo_type *full_info_p)
3748 {
3749     const char *p = *signature_p;
3750     fullinfo_type full_info = MAKE_FULLINFO(ITEM_Bogus, 0, 0);
3751     char result;
3752     int array_depth = 0;
3753 
3754     for (;;) {
3755         switch(*p++) {
3756             default:
3757                 result = 0;
3758                 break;
3759 
3760             case JVM_SIGNATURE_BOOLEAN:
3761                 full_info = (array_depth > 0)
3762                               ? MAKE_FULLINFO(ITEM_Boolean, 0, 0)
3763                               : MAKE_FULLINFO(ITEM_Integer, 0, 0);
3764                 result = 'I';
3765                 break;
3766 
3767             case JVM_SIGNATURE_BYTE:
3768                 full_info = (array_depth > 0)
3769                               ? MAKE_FULLINFO(ITEM_Byte, 0, 0)
3770                               : MAKE_FULLINFO(ITEM_Integer, 0, 0);
3771                 result = 'I';
3772                 break;
3773 
3774             case JVM_SIGNATURE_CHAR:
3775                 full_info = (array_depth > 0)
3776                               ? MAKE_FULLINFO(ITEM_Char, 0, 0)
3777                               : MAKE_FULLINFO(ITEM_Integer, 0, 0);
3778                 result = 'I';
3779                 break;
3780 
3781             case JVM_SIGNATURE_SHORT:
3782                 full_info = (array_depth > 0)
3783                               ? MAKE_FULLINFO(ITEM_Short, 0, 0)
3784                               : MAKE_FULLINFO(ITEM_Integer, 0, 0);
3785                 result = 'I';
3786                 break;
3787 
3788             case JVM_SIGNATURE_INT:
3789                 full_info = MAKE_FULLINFO(ITEM_Integer, 0, 0);
3790                 result = 'I';
3791                 break;
3792 
3793             case JVM_SIGNATURE_FLOAT:
3794                 full_info = MAKE_FULLINFO(ITEM_Float, 0, 0);
3795                 result = 'F';
3796                 break;
3797 
3798             case JVM_SIGNATURE_DOUBLE:
3799                 full_info = MAKE_FULLINFO(ITEM_Double, 0, 0);
3800                 result = 'D';
3801                 break;
3802 
3803             case JVM_SIGNATURE_LONG:
3804                 full_info = MAKE_FULLINFO(ITEM_Long, 0, 0);
3805                 result = 'L';
3806                 break;
3807 
3808             case JVM_SIGNATURE_ARRAY:
3809                 array_depth++;
3810                 continue;       /* only time we ever do the loop > 1 */
3811 
3812             case JVM_SIGNATURE_CLASS:
3813             case JVM_SIGNATURE_INLINE_TYPE: {
3814                 char buffer_space[256];
3815                 char *buffer = buffer_space;
3816                 char *finish = strchr(p, JVM_SIGNATURE_ENDCLASS);
3817                 int length;
3818                 if (finish == NULL) {
3819                     /* Signature must have ';' after the class name.
3820                      * If it does not, return 0 and ITEM_Bogus in full_info. */
3821                     result = 0;
3822                     break;
3823                 }
3824                 assert(finish >= p);
3825                 length = (int)(finish - p);
3826                 if (length + 1 > (int)sizeof(buffer_space)) {
3827                     buffer = calloc(length + 1, sizeof(char));
3828                     check_and_push(context, buffer, VM_MALLOC_BLK);
3829                 }
3830                 memcpy(buffer, p, length);
3831                 buffer[length] = '\0';
3832                 full_info = make_class_info_from_name(context, buffer);
3833                 result = 'A';
3834                 p = finish + 1;
3835                 if (buffer != buffer_space)
3836                     pop_and_free(context);
3837                 break;
3838             }
3839         } /* end of switch */
3840         break;
3841     }
3842     *signature_p = p;
3843     if (array_depth == 0 || result == 0) {
3844         /* either not an array, or result is bogus */
3845         *full_info_p = full_info;
3846         return result;
3847     } else {
3848         if (array_depth > MAX_ARRAY_DIMENSIONS)
3849             CCerror(context, "Array with too many dimensions");
3850         *full_info_p = MAKE_FULLINFO(GET_ITEM_TYPE(full_info),
3851                                      array_depth,
3852                                      GET_EXTRA_INFO(full_info));
3853         return 'A';
3854     }
3855 }
3856 
3857 
3858 /* Given an array type, create the type that has one less level of
3859  * indirection.
3860  */
3861 
3862 static fullinfo_type
3863 decrement_indirection(fullinfo_type array_info)
3864 {
3865     if (array_info == NULL_FULLINFO) {
3866         return NULL_FULLINFO;
3867     } else {
3868         int type = GET_ITEM_TYPE(array_info);
3869         int indirection = GET_INDIRECTION(array_info) - 1;
3870         int extra_info = GET_EXTRA_INFO(array_info);
3871         if (   (indirection == 0)
3872                && ((type == ITEM_Short || type == ITEM_Byte || type == ITEM_Boolean || type == ITEM_Char)))
3873             type = ITEM_Integer;
3874         return MAKE_FULLINFO(type, indirection, extra_info);
3875     }
3876 }
3877 
3878 
3879 /* See if we can assign an object of the "from" type to an object
3880  * of the "to" type.
3881  */
3882 
3883 static jboolean isAssignableTo(context_type *context,
3884                              fullinfo_type from, fullinfo_type to)
3885 {
3886     return (merge_fullinfo_types(context, from, to, JNI_TRUE) == to);
3887 }
3888 
3889 /* Given two fullinfo_type's, find their lowest common denominator.  If
3890  * the assignable_p argument is non-null, we're really just calling to find
3891  * out if "<target> := <value>" is a legitimate assignment.
3892  *
3893  * We treat all interfaces as if they were of type java/lang/Object, since the
3894  * runtime will do the full checking.
3895  */
3896 static fullinfo_type
3897 merge_fullinfo_types(context_type *context,
3898                      fullinfo_type value, fullinfo_type target,
3899                      jboolean for_assignment)
3900 {
3901     JNIEnv *env = context->env;
3902     if (value == target) {
3903         /* If they're identical, clearly just return what we've got */
3904         return value;
3905     }
3906 
3907     /* Both must be either arrays or objects to go further */
3908     if (GET_INDIRECTION(value) == 0 && GET_ITEM_TYPE(value) != ITEM_Object)
3909         return MAKE_FULLINFO(ITEM_Bogus, 0, 0);
3910     if (GET_INDIRECTION(target) == 0 && GET_ITEM_TYPE(target) != ITEM_Object)
3911         return MAKE_FULLINFO(ITEM_Bogus, 0, 0);
3912 
3913     /* If either is NULL, return the other. */
3914     if (value == NULL_FULLINFO)
3915         return target;
3916     else if (target == NULL_FULLINFO)
3917         return value;
3918 
3919     /* If either is java/lang/Object, that's the result. */
3920     if (target == context->object_info)
3921         return target;
3922     else if (value == context->object_info) {
3923         /* Minor hack.  For assignments, Interface := Object, return Interface
3924          * rather than Object, so that isAssignableTo() will get the right
3925          * result.      */
3926         if (for_assignment && (WITH_ZERO_EXTRA_INFO(target) ==
3927                                   MAKE_FULLINFO(ITEM_Object, 0, 0))) {
3928             jclass cb = object_fullinfo_to_classclass(context,
3929                                                       target);
3930             int is_interface = cb && JVM_IsInterface(env, cb);
3931             if (is_interface)
3932                 return target;
3933         }
3934         return value;
3935     }
3936     if (GET_INDIRECTION(value) > 0 || GET_INDIRECTION(target) > 0) {
3937         /* At least one is an array.  Neither is java/lang/Object or NULL.
3938          * Moreover, the types are not identical.
3939          * The result must either be Object, or an array of some object type.
3940          */
3941         fullinfo_type value_base, target_base;
3942         int dimen_value = GET_INDIRECTION(value);
3943         int dimen_target = GET_INDIRECTION(target);
3944 
3945         if (target == context->cloneable_info ||
3946             target == context->serializable_info) {
3947             return target;
3948         }
3949 
3950         if (value == context->cloneable_info ||
3951             value == context->serializable_info) {
3952             return value;
3953         }
3954 
3955         /* First, if either item's base type isn't ITEM_Object, promote it up
3956          * to an object or array of object.  If either is elemental, we can
3957          * punt.
3958          */
3959         if (GET_ITEM_TYPE(value) != ITEM_Object) {
3960             if (dimen_value == 0)
3961                 return MAKE_FULLINFO(ITEM_Bogus, 0, 0);
3962             dimen_value--;
3963             value = MAKE_Object_ARRAY(dimen_value);
3964 
3965         }
3966         if (GET_ITEM_TYPE(target) != ITEM_Object) {
3967             if (dimen_target == 0)
3968                 return MAKE_FULLINFO(ITEM_Bogus, 0, 0);
3969             dimen_target--;
3970             target = MAKE_Object_ARRAY(dimen_target);
3971         }
3972         /* Both are now objects or arrays of some sort of object type */
3973         value_base = WITH_ZERO_INDIRECTION(value);
3974         target_base = WITH_ZERO_INDIRECTION(target);
3975         if (dimen_value == dimen_target) {
3976             /* Arrays of the same dimension.  Merge their base types. */
3977             fullinfo_type  result_base =
3978                 merge_fullinfo_types(context, value_base, target_base,
3979                                             for_assignment);
3980             if (result_base == MAKE_FULLINFO(ITEM_Bogus, 0, 0))
3981                 /* bogus in, bogus out */
3982                 return result_base;
3983             return MAKE_FULLINFO(ITEM_Object, dimen_value,
3984                                  GET_EXTRA_INFO(result_base));
3985         } else {
3986             /* Arrays of different sizes. If the smaller dimension array's base
3987              * type is java/lang/Cloneable or java/io/Serializable, return it.
3988              * Otherwise return java/lang/Object with a dimension of the smaller
3989              * of the two */
3990             if (dimen_value < dimen_target) {
3991                 if (value_base == context->cloneable_info ||
3992                     value_base == context ->serializable_info) {
3993                     return value;
3994                 }
3995                 return MAKE_Object_ARRAY(dimen_value);
3996             } else {
3997                 if (target_base == context->cloneable_info ||
3998                     target_base == context->serializable_info) {
3999                     return target;
4000                 }
4001                 return MAKE_Object_ARRAY(dimen_target);
4002             }
4003         }
4004     } else {
4005         /* Both are non-array objects. Neither is java/lang/Object or NULL */
4006         jclass cb_value, cb_target, cb_super_value, cb_super_target;
4007         fullinfo_type result_info;
4008 
4009         /* Let's get the classes corresponding to each of these.  Treat
4010          * interfaces as if they were java/lang/Object.  See hack note above. */
4011         cb_target = object_fullinfo_to_classclass(context, target);
4012         if (cb_target == 0)
4013             return MAKE_FULLINFO(ITEM_Bogus, 0, 0);
4014         if (JVM_IsInterface(env, cb_target))
4015             return for_assignment ? target : context->object_info;
4016         cb_value = object_fullinfo_to_classclass(context, value);
4017         if (cb_value == 0)
4018             return MAKE_FULLINFO(ITEM_Bogus, 0, 0);
4019         if (JVM_IsInterface(env, cb_value))
4020             return context->object_info;
4021 
4022         /* If this is for assignment of target := value, we just need to see if
4023          * cb_target is a superclass of cb_value.  Save ourselves a lot of
4024          * work.
4025          */
4026         if (for_assignment) {
4027             cb_super_value = (*env)->GetSuperclass(env, cb_value);
4028             while (cb_super_value != 0) {
4029                 jclass tmp_cb;
4030                 if ((*env)->IsSameObject(env, cb_super_value, cb_target)) {
4031                     (*env)->DeleteLocalRef(env, cb_super_value);
4032                     return target;
4033                 }
4034                 tmp_cb =  (*env)->GetSuperclass(env, cb_super_value);
4035                 (*env)->DeleteLocalRef(env, cb_super_value);
4036                 cb_super_value = tmp_cb;
4037             }
4038             (*env)->DeleteLocalRef(env, cb_super_value);
4039             return context->object_info;
4040         }
4041 
4042         /* Find out whether cb_value or cb_target is deeper in the class
4043          * tree by moving both toward the root, and seeing who gets there
4044          * first.                                                          */
4045         cb_super_value = (*env)->GetSuperclass(env, cb_value);
4046         cb_super_target = (*env)->GetSuperclass(env, cb_target);
4047         while((cb_super_value != 0) &&
4048               (cb_super_target != 0)) {
4049             jclass tmp_cb;
4050             /* Optimization.  If either hits the other when going up looking
4051              * for a parent, then might as well return the parent immediately */
4052             if ((*env)->IsSameObject(env, cb_super_value, cb_target)) {
4053                 (*env)->DeleteLocalRef(env, cb_super_value);
4054                 (*env)->DeleteLocalRef(env, cb_super_target);
4055                 return target;
4056             }
4057             if ((*env)->IsSameObject(env, cb_super_target, cb_value)) {
4058                 (*env)->DeleteLocalRef(env, cb_super_value);
4059                 (*env)->DeleteLocalRef(env, cb_super_target);
4060                 return value;
4061             }
4062             tmp_cb = (*env)->GetSuperclass(env, cb_super_value);
4063             (*env)->DeleteLocalRef(env, cb_super_value);
4064             cb_super_value = tmp_cb;
4065 
4066             tmp_cb = (*env)->GetSuperclass(env, cb_super_target);
4067             (*env)->DeleteLocalRef(env, cb_super_target);
4068             cb_super_target = tmp_cb;
4069         }
4070         cb_value = (*env)->NewLocalRef(env, cb_value);
4071         cb_target = (*env)->NewLocalRef(env, cb_target);
4072         /* At most one of the following two while clauses will be executed.
4073          * Bring the deeper of cb_target and cb_value to the depth of the
4074          * shallower one.
4075          */
4076         while (cb_super_value != 0) {
4077           /* cb_value is deeper */
4078             jclass cb_tmp;
4079 
4080             cb_tmp = (*env)->GetSuperclass(env, cb_super_value);
4081             (*env)->DeleteLocalRef(env, cb_super_value);
4082             cb_super_value = cb_tmp;
4083 
4084             cb_tmp = (*env)->GetSuperclass(env, cb_value);
4085             (*env)->DeleteLocalRef(env, cb_value);
4086             cb_value = cb_tmp;
4087         }
4088         while (cb_super_target != 0) {
4089           /* cb_target is deeper */
4090             jclass cb_tmp;
4091 
4092             cb_tmp = (*env)->GetSuperclass(env, cb_super_target);
4093             (*env)->DeleteLocalRef(env, cb_super_target);
4094             cb_super_target = cb_tmp;
4095 
4096             cb_tmp = (*env)->GetSuperclass(env, cb_target);
4097             (*env)->DeleteLocalRef(env, cb_target);
4098             cb_target = cb_tmp;
4099         }
4100 
4101         /* Walk both up, maintaining equal depth, until a join is found.  We
4102          * know that we will find one.  */
4103         while (!(*env)->IsSameObject(env, cb_value, cb_target)) {
4104             jclass cb_tmp;
4105             cb_tmp = (*env)->GetSuperclass(env, cb_value);
4106             (*env)->DeleteLocalRef(env, cb_value);
4107             cb_value = cb_tmp;
4108             cb_tmp = (*env)->GetSuperclass(env, cb_target);
4109             (*env)->DeleteLocalRef(env, cb_target);
4110             cb_target = cb_tmp;
4111         }
4112         result_info = make_class_info(context, cb_value);
4113         (*env)->DeleteLocalRef(env, cb_value);
4114         (*env)->DeleteLocalRef(env, cb_super_value);
4115         (*env)->DeleteLocalRef(env, cb_target);
4116         (*env)->DeleteLocalRef(env, cb_super_target);
4117         return result_info;
4118     } /* both items are classes */
4119 }
4120 
4121 
4122 /* Given a fullinfo_type corresponding to an Object, return the jclass
4123  * of that type.
4124  *
4125  * This function always returns a global reference!
4126  */
4127 
4128 static jclass
4129 object_fullinfo_to_classclass(context_type *context, fullinfo_type classinfo)
4130 {
4131     unsigned short info = GET_EXTRA_INFO(classinfo);
4132     return ID_to_class(context, info);
4133 }
4134 
4135 static void free_block(void *ptr, int kind)
4136 {
4137     switch (kind) {
4138     case VM_STRING_UTF:
4139         JVM_ReleaseUTF(ptr);
4140         break;
4141     case VM_MALLOC_BLK:
4142         free(ptr);
4143         break;
4144     }
4145 }
4146 
4147 static void check_and_push(context_type *context, const void *ptr, int kind)
4148 {
4149     alloc_stack_type *p;
4150     if (ptr == 0)
4151         CCout_of_memory(context);
4152     if (context->alloc_stack_top < ALLOC_STACK_SIZE)
4153         p = &(context->alloc_stack[context->alloc_stack_top++]);
4154     else {
4155         /* Otherwise we have to malloc */
4156         p = malloc(sizeof(alloc_stack_type));
4157         if (p == 0) {
4158             /* Make sure we clean up. */
4159             free_block((void *)ptr, kind);
4160             CCout_of_memory(context);
4161         }
4162     }
4163     p->kind = kind;
4164     p->ptr = (void *)ptr;
4165     p->next = context->allocated_memory;
4166     context->allocated_memory = p;
4167 }
4168 
4169 static void pop_and_free(context_type *context)
4170 {
4171     alloc_stack_type *p = context->allocated_memory;
4172     context->allocated_memory = p->next;
4173     free_block(p->ptr, p->kind);
4174     if (p < context->alloc_stack + ALLOC_STACK_SIZE &&
4175         p >= context->alloc_stack)
4176         context->alloc_stack_top--;
4177     else
4178         free(p);
4179 }
4180 
4181 static int signature_to_args_size(const char *method_signature)
4182 {
4183     const char *p;
4184     int args_size = 0;
4185     for (p = method_signature; *p != JVM_SIGNATURE_ENDFUNC; p++) {
4186         switch (*p) {
4187           case JVM_SIGNATURE_BOOLEAN:
4188           case JVM_SIGNATURE_BYTE:
4189           case JVM_SIGNATURE_CHAR:
4190           case JVM_SIGNATURE_SHORT:
4191           case JVM_SIGNATURE_INT:
4192           case JVM_SIGNATURE_FLOAT:
4193             args_size += 1;
4194             break;
4195           case JVM_SIGNATURE_CLASS:
4196           case JVM_SIGNATURE_INLINE_TYPE:
4197             args_size += 1;
4198             while (*p != JVM_SIGNATURE_ENDCLASS) p++;
4199             break;
4200           case JVM_SIGNATURE_ARRAY:
4201             args_size += 1;
4202             while ((*p == JVM_SIGNATURE_ARRAY)) p++;
4203             /* If an array of classes, skip over class name, too. */
4204             if (*p == JVM_SIGNATURE_CLASS || *p == JVM_SIGNATURE_INLINE_TYPE) {
4205                 while (*p != JVM_SIGNATURE_ENDCLASS)
4206                   p++;
4207             }
4208             break;
4209           case JVM_SIGNATURE_DOUBLE:
4210           case JVM_SIGNATURE_LONG:
4211             args_size += 2;
4212             break;
4213           case JVM_SIGNATURE_FUNC:  /* ignore initial (, if given */
4214             break;
4215           default:
4216             /* Indicate an error. */
4217             return 0;
4218         }
4219     }
4220     return args_size;
4221 }
4222 
4223 #ifdef DEBUG
4224 
4225 /* Below are for debugging. */
4226 
4227 static void print_fullinfo_type(context_type *, fullinfo_type, jboolean);
4228 
4229 static void
4230 print_stack(context_type *context, stack_info_type *stack_info)
4231 {
4232     stack_item_type *stack = stack_info->stack;
4233     if (stack_info->stack_size == UNKNOWN_STACK_SIZE) {
4234         jio_fprintf(stdout, "x");
4235     } else {
4236         jio_fprintf(stdout, "(");
4237         for ( ; stack != 0; stack = stack->next)
4238             print_fullinfo_type(context, stack->item,
4239                 (jboolean)(verify_verbose > 1 ? JNI_TRUE : JNI_FALSE));
4240         jio_fprintf(stdout, ")");
4241     }
4242 }
4243 
4244 static void
4245 print_registers(context_type *context, register_info_type *register_info)
4246 {
4247     int register_count = register_info->register_count;
4248     if (register_count == UNKNOWN_REGISTER_COUNT) {
4249         jio_fprintf(stdout, "x");
4250     } else {
4251         fullinfo_type *registers = register_info->registers;
4252         int mask_count = register_info->mask_count;
4253         mask_type *masks = register_info->masks;
4254         int i, j;
4255 
4256         jio_fprintf(stdout, "{");
4257         for (i = 0; i < register_count; i++)
4258             print_fullinfo_type(context, registers[i],
4259                 (jboolean)(verify_verbose > 1 ? JNI_TRUE : JNI_FALSE));
4260         jio_fprintf(stdout, "}");
4261         for (i = 0; i < mask_count; i++) {
4262             char *separator = "";
4263             int *modifies = masks[i].modifies;
4264             jio_fprintf(stdout, "<%d: ", masks[i].entry);
4265             for (j = 0;
4266                  j < JVM_GetMethodIxLocalsCount(context->env,
4267                                                 context->class,
4268                                                 context->method_index);
4269                  j++)
4270                 if (IS_BIT_SET(modifies, j)) {
4271                     jio_fprintf(stdout, "%s%d", separator, j);
4272                     separator = ",";
4273                 }
4274             jio_fprintf(stdout, ">");
4275         }
4276     }
4277 }
4278 
4279 
4280 static void
4281 print_flags(context_type *context, flag_type and_flags, flag_type or_flags)
4282 {
4283     if (and_flags != ((flag_type)-1) || or_flags != 0) {
4284         jio_fprintf(stdout, "<%x %x>", and_flags, or_flags);
4285     }
4286 }
4287 
4288 static void
4289 print_fullinfo_type(context_type *context, fullinfo_type type, jboolean verbose)
4290 {
4291     int i;
4292     int indirection = GET_INDIRECTION(type);
4293     for (i = indirection; i-- > 0; )
4294         jio_fprintf(stdout, "[");
4295     switch (GET_ITEM_TYPE(type)) {
4296         case ITEM_Integer:
4297             jio_fprintf(stdout, "I"); break;
4298         case ITEM_Float:
4299             jio_fprintf(stdout, "F"); break;
4300         case ITEM_Double:
4301             jio_fprintf(stdout, "D"); break;
4302         case ITEM_Double_2:
4303             jio_fprintf(stdout, "d"); break;
4304         case ITEM_Long:
4305             jio_fprintf(stdout, "L"); break;
4306         case ITEM_Long_2:
4307             jio_fprintf(stdout, "l"); break;
4308         case ITEM_ReturnAddress:
4309             jio_fprintf(stdout, "a"); break;
4310         case ITEM_Object:
4311             if (!verbose) {
4312                 jio_fprintf(stdout, "A");
4313             } else {
4314                 unsigned short extra = GET_EXTRA_INFO(type);
4315                 if (extra == 0) {
4316                     jio_fprintf(stdout, "/Null/");
4317                 } else {
4318                     const char *name = ID_to_class_name(context, extra);
4319                     const char *name2 = strrchr(name, '/');
4320                     jio_fprintf(stdout, "/%s/", name2 ? name2 + 1 : name);
4321                 }
4322             }
4323             break;
4324         case ITEM_Char:
4325             jio_fprintf(stdout, "C"); break;
4326         case ITEM_Short:
4327             jio_fprintf(stdout, "S"); break;
4328         case ITEM_Boolean:
4329             jio_fprintf(stdout, "Z"); break;
4330         case ITEM_Byte:
4331             jio_fprintf(stdout, "B"); break;
4332         case ITEM_NewObject:
4333             if (!verbose) {
4334                 jio_fprintf(stdout, "@");
4335             } else {
4336                 int inum = GET_EXTRA_INFO(type);
4337                 fullinfo_type real_type =
4338                     context->instruction_data[inum].operand2.fi;
4339                 jio_fprintf(stdout, ">");
4340                 print_fullinfo_type(context, real_type, JNI_TRUE);
4341                 jio_fprintf(stdout, "<");
4342             }
4343             break;
4344         case ITEM_InitObject:
4345             jio_fprintf(stdout, verbose ? ">/this/<" : "@");
4346             break;
4347 
4348         default:
4349             jio_fprintf(stdout, "?"); break;
4350     }
4351     for (i = indirection; i-- > 0; )
4352         jio_fprintf(stdout, "]");
4353 }
4354 
4355 
4356 static void
4357 print_formatted_fieldname(context_type *context, int index)
4358 {
4359     JNIEnv *env = context->env;
4360     jclass cb = context->class;
4361     const char *classname = JVM_GetCPFieldClassNameUTF(env, cb, index);
4362     const char *fieldname = JVM_GetCPFieldNameUTF(env, cb, index);
4363     jio_fprintf(stdout, "  <%s.%s>",
4364                 classname ? classname : "", fieldname ? fieldname : "");
4365     JVM_ReleaseUTF(classname);
4366     JVM_ReleaseUTF(fieldname);
4367 }
4368 
4369 static void
4370 print_formatted_methodname(context_type *context, int index)
4371 {
4372     JNIEnv *env = context->env;
4373     jclass cb = context->class;
4374     const char *classname = JVM_GetCPMethodClassNameUTF(env, cb, index);
4375     const char *methodname = JVM_GetCPMethodNameUTF(env, cb, index);
4376     jio_fprintf(stdout, "  <%s.%s>",
4377                 classname ? classname : "", methodname ? methodname : "");
4378     JVM_ReleaseUTF(classname);
4379     JVM_ReleaseUTF(methodname);
4380 }
4381 
4382 #endif /*DEBUG*/