1 /*
   2  * Copyright (c) 1994, 2024, Oracle and/or its affiliates. All rights reserved.
   3  * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
   4  *
   5  * This code is free software; you can redistribute it and/or modify it
   6  * under the terms of the GNU General Public License version 2 only, as
   7  * published by the Free Software Foundation.  Oracle designates this
   8  * particular file as subject to the "Classpath" exception as provided
   9  * by Oracle in the LICENSE file that accompanied this code.
  10  *
  11  * This code is distributed in the hope that it will be useful, but WITHOUT
  12  * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
  13  * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
  14  * version 2 for more details (a copy is included in the LICENSE file that
  15  * accompanied this code).
  16  *
  17  * You should have received a copy of the GNU General Public License version
  18  * 2 along with this work; if not, write to the Free Software Foundation,
  19  * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
  20  *
  21  * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
  22  * or visit www.oracle.com if you need additional information or have any
  23  * questions.
  24  */
  25 
  26 /*-
  27  *      Verify that the code within a method block doesn't exploit any
  28  *      security holes.
  29  */
  30 /*
  31    Exported function:
  32 
  33    jboolean
  34    VerifyClassForMajorVersion(JNIEnv *env, jclass cb, char *message_buffer,
  35                               jint buffer_length, jint major_version)
  36 
  37    This file now only uses the standard JNI and the following VM functions
  38    exported in jvm.h:
  39 
  40    JVM_FindClassFromClass
  41    JVM_IsInterface
  42    JVM_GetClassNameUTF
  43    JVM_GetClassCPEntriesCount
  44    JVM_GetClassCPTypes
  45    JVM_GetClassFieldsCount
  46    JVM_GetClassMethodsCount
  47 
  48    JVM_GetFieldIxModifiers
  49 
  50    JVM_GetMethodIxModifiers
  51    JVM_GetMethodIxExceptionTableLength
  52    JVM_GetMethodIxLocalsCount
  53    JVM_GetMethodIxArgsSize
  54    JVM_GetMethodIxMaxStack
  55    JVM_GetMethodIxNameUTF
  56    JVM_GetMethodIxSignatureUTF
  57    JVM_GetMethodIxExceptionsCount
  58    JVM_GetMethodIxExceptionIndexes
  59    JVM_GetMethodIxByteCodeLength
  60    JVM_GetMethodIxByteCode
  61    JVM_GetMethodIxExceptionTableEntry
  62    JVM_IsConstructorIx
  63 
  64    JVM_GetCPClassNameUTF
  65    JVM_GetCPFieldNameUTF
  66    JVM_GetCPMethodNameUTF
  67    JVM_GetCPFieldSignatureUTF
  68    JVM_GetCPMethodSignatureUTF
  69    JVM_GetCPFieldClassNameUTF
  70    JVM_GetCPMethodClassNameUTF
  71    JVM_GetCPFieldModifiers
  72    JVM_GetCPMethodModifiers
  73 
  74    JVM_ReleaseUTF
  75    JVM_IsSameClassPackage
  76 
  77  */
  78 
  79 #include <string.h>
  80 #include <setjmp.h>
  81 #include <assert.h>
  82 #include <limits.h>
  83 #include <stdlib.h>
  84 #include <stdint.h>
  85 
  86 #include "jni.h"
  87 #include "jni_util.h"
  88 #include "jvm.h"
  89 #include "classfile_constants.h"
  90 #include "opcodes.in_out"
  91 
  92 /* On AIX malloc(0) and calloc(0, ...) return a NULL pointer, which is legal,
  93  * but the code here does not handles it. So we wrap the methods and return non-NULL
  94  * pointers even if we allocate 0 bytes.
  95  */
  96 #ifdef _AIX
  97 static int aix_dummy;
  98 static void* aix_malloc(size_t len) {
  99   if (len == 0) {
 100     return &aix_dummy;
 101   }
 102   return malloc(len);
 103 }
 104 
 105 static void* aix_calloc(size_t n, size_t size) {
 106   if (n == 0) {
 107     return &aix_dummy;
 108   }
 109   return calloc(n, size);
 110 }
 111 
 112 static void aix_free(void* p) {
 113   if (p == &aix_dummy) {
 114     return;
 115   }
 116   free(p);
 117 }
 118 
 119 #undef malloc
 120 #undef calloc
 121 #undef free
 122 #define malloc aix_malloc
 123 #define calloc aix_calloc
 124 #define free aix_free
 125 #endif
 126 
 127 #ifdef __APPLE__
 128 /* use setjmp/longjmp versions that do not save/restore the signal mask */
 129 #define setjmp _setjmp
 130 #define longjmp _longjmp
 131 #endif
 132 
 133 #define MAX_ARRAY_DIMENSIONS 255
 134 /* align byte code */
 135 #ifndef ALIGN_UP
 136 #define ALIGN_UP(n,align_grain) (((n) + ((align_grain) - 1)) & ~((align_grain)-1))
 137 #endif /* ALIGN_UP */
 138 #define UCALIGN(n) ((unsigned char *)ALIGN_UP((uintptr_t)(n),sizeof(int)))
 139 
 140 #ifdef DEBUG
 141 
 142 int verify_verbose = 0;
 143 static struct context_type *GlobalContext;
 144 #endif
 145 
 146 enum {
 147     ITEM_Bogus,
 148     ITEM_Void,                  /* only as a function return value */
 149     ITEM_Integer,
 150     ITEM_Float,
 151     ITEM_Double,
 152     ITEM_Double_2,              /* 2nd word of double in register */
 153     ITEM_Long,
 154     ITEM_Long_2,                /* 2nd word of long in register */
 155     ITEM_Array,
 156     ITEM_Object,                /* Extra info field gives name. */
 157     ITEM_NewObject,             /* Like object, but uninitialized. */
 158     ITEM_InitObject,            /* "this" is init method, before call
 159                                     to super() */
 160     ITEM_ReturnAddress,         /* Extra info gives instr # of start pc */
 161     /* The following four are only used within array types.
 162      * Normally, we use ITEM_Integer, instead. */
 163     ITEM_Byte,
 164     ITEM_Short,
 165     ITEM_Char,
 166     ITEM_Boolean
 167 };
 168 
 169 
 170 #define UNKNOWN_STACK_SIZE -1
 171 #define UNKNOWN_REGISTER_COUNT -1
 172 #define UNKNOWN_RET_INSTRUCTION -1
 173 
 174 #undef MAX
 175 #undef MIN
 176 #define MAX(a, b) ((a) > (b) ? (a) : (b))
 177 #define MIN(a, b) ((a) < (b) ? (a) : (b))
 178 
 179 #define BITS_PER_INT   (CHAR_BIT * sizeof(int)/sizeof(char))
 180 #define SET_BIT(flags, i)  (flags[(i)/BITS_PER_INT] |= \
 181                                        ((unsigned)1 << ((i) % BITS_PER_INT)))
 182 #define IS_BIT_SET(flags, i) (flags[(i)/BITS_PER_INT] & \
 183                                        ((unsigned)1 << ((i) % BITS_PER_INT)))
 184 
 185 typedef unsigned int fullinfo_type;
 186 typedef unsigned int *bitvector;
 187 
 188 #define GET_ITEM_TYPE(thing) ((thing) & 0x1F)
 189 #define GET_INDIRECTION(thing) (((thing) & 0xFFFF) >> 5)
 190 #define GET_EXTRA_INFO(thing) ((thing) >> 16)
 191 #define WITH_ZERO_INDIRECTION(thing) ((thing) & ~(0xFFE0))
 192 #define WITH_ZERO_EXTRA_INFO(thing) ((thing) & 0xFFFF)
 193 
 194 #define MAKE_FULLINFO(type, indirect, extra) \
 195      ((type) + ((indirect) << 5) + ((extra) << 16))
 196 
 197 #define MAKE_Object_ARRAY(indirect) \
 198        (context->object_info + ((indirect) << 5))
 199 
 200 #define NULL_FULLINFO MAKE_FULLINFO(ITEM_Object, 0, 0)
 201 
 202 /* JVM_OPC_invokespecial calls to <init> need to be treated special */
 203 #define JVM_OPC_invokeinit 0x100
 204 
 205 /* A hash mechanism used by the verifier.
 206  * Maps class names to unique 16 bit integers.
 207  */
 208 
 209 #define HASH_TABLE_SIZE 503
 210 
 211 /* The buckets are managed as a 256 by 256 matrix. We allocate an entire
 212  * row (256 buckets) at a time to minimize fragmentation. Rows are
 213  * allocated on demand so that we don't waste too much space.
 214  */
 215 
 216 #define MAX_HASH_ENTRIES 65536
 217 #define HASH_ROW_SIZE 256
 218 
 219 typedef struct hash_bucket_type {
 220     char *name;
 221     unsigned int hash;
 222     jclass class;
 223     unsigned short ID;
 224     unsigned short next;
 225     unsigned loadable:1;  /* from context->class loader */
 226 } hash_bucket_type;
 227 
 228 typedef struct {
 229     hash_bucket_type **buckets;
 230     unsigned short *table;
 231     int entries_used;
 232 } hash_table_type;
 233 
 234 #define GET_BUCKET(class_hash, ID)\
 235     (class_hash->buckets[ID / HASH_ROW_SIZE] + ID % HASH_ROW_SIZE)
 236 
 237 /*
 238  * There are currently two types of resources that we need to keep
 239  * track of (in addition to the CCalloc pool).
 240  */
 241 enum {
 242     VM_STRING_UTF, /* VM-allocated UTF strings */
 243     VM_MALLOC_BLK  /* malloc'ed blocks */
 244 };
 245 
 246 #define LDC_CLASS_MAJOR_VERSION 49
 247 
 248 #define LDC_METHOD_HANDLE_MAJOR_VERSION 51
 249 
 250 #define NONZERO_PADDING_BYTES_IN_SWITCH_MAJOR_VERSION 51
 251 
 252 #define STATIC_METHOD_IN_INTERFACE_MAJOR_VERSION  52
 253 
 254 #define ALLOC_STACK_SIZE 16 /* big enough */
 255 
 256 typedef struct alloc_stack_type {
 257     void *ptr;
 258     int kind;
 259     struct alloc_stack_type *next;
 260 } alloc_stack_type;
 261 
 262 /* The context type encapsulates the current invocation of the byte
 263  * code verifier.
 264  */
 265 struct context_type {
 266 
 267     JNIEnv *env;                /* current JNIEnv */
 268 
 269     /* buffers etc. */
 270     char *message;
 271     jint message_buf_len;
 272     jboolean err_code;
 273 
 274     alloc_stack_type *allocated_memory; /* all memory blocks that we have not
 275                                            had a chance to free */
 276     /* Store up to ALLOC_STACK_SIZE number of handles to allocated memory
 277        blocks here, to save mallocs. */
 278     alloc_stack_type alloc_stack[ALLOC_STACK_SIZE];
 279     int alloc_stack_top;
 280 
 281     /* these fields are per class */
 282     jclass class;               /* current class */
 283     jint major_version;
 284     jint nconstants;
 285     unsigned char *constant_types;
 286     hash_table_type class_hash;
 287 
 288     fullinfo_type object_info;  /* fullinfo for java/lang/Object */
 289     fullinfo_type string_info;  /* fullinfo for java/lang/String */
 290     fullinfo_type throwable_info; /* fullinfo for java/lang/Throwable */
 291     fullinfo_type cloneable_info; /* fullinfo for java/lang/Cloneable */
 292     fullinfo_type serializable_info; /* fullinfo for java/io/Serializable */
 293 
 294     fullinfo_type currentclass_info; /* fullinfo for context->class */
 295     fullinfo_type superclass_info;   /* fullinfo for superclass */
 296 
 297     /* these fields are per method */
 298     int method_index;   /* current method */
 299     unsigned short *exceptions; /* exceptions */
 300     unsigned char *code;        /* current code object */
 301     jint code_length;
 302     int *code_data;             /* offset to instruction number */
 303     struct instruction_data_type *instruction_data; /* info about each */
 304     struct handler_info_type *handler_info;
 305     fullinfo_type *superclasses; /* null terminated superclasses */
 306     int instruction_count;      /* number of instructions */
 307     fullinfo_type return_type;  /* function return type */
 308     fullinfo_type swap_table[4]; /* used for passing information */
 309     int bitmask_size;           /* words needed to hold bitmap of arguments */
 310 
 311     /* these fields are per field */
 312     int field_index;
 313 
 314     /* Used by the space allocator */
 315     struct CCpool *CCroot, *CCcurrent;
 316     char *CCfree_ptr;
 317     int CCfree_size;
 318 
 319     /* Jump here on any error. */
 320     jmp_buf jump_buffer;
 321 
 322 #ifdef DEBUG
 323     /* keep track of how many global refs are allocated. */
 324     int n_globalrefs;
 325 #endif
 326 };
 327 
 328 struct stack_info_type {
 329     struct stack_item_type *stack;
 330     int stack_size;
 331 };
 332 
 333 struct register_info_type {
 334     int register_count;         /* number of registers used */
 335     fullinfo_type *registers;
 336     int mask_count;             /* number of masks in the following */
 337     struct mask_type *masks;
 338 };
 339 
 340 struct mask_type {
 341     int entry;
 342     int *modifies;
 343 };
 344 
 345 typedef unsigned short flag_type;
 346 
 347 struct instruction_data_type {
 348     int opcode;         /* may turn into "canonical" opcode */
 349     unsigned changed:1;         /* has it changed */
 350     unsigned protected:1;       /* must accessor be a subclass of "this" */
 351     union {
 352         int i;                  /* operand to the opcode */
 353         int *ip;
 354         fullinfo_type fi;
 355     } operand, operand2;
 356     fullinfo_type p;
 357     struct stack_info_type stack_info;
 358     struct register_info_type register_info;
 359 #define FLAG_REACHED            0x01 /* instruction reached */
 360 #define FLAG_NEED_CONSTRUCTOR   0x02 /* must call this.<init> or super.<init> */
 361 #define FLAG_NO_RETURN          0x04 /* must throw out of method */
 362     flag_type or_flags;         /* true for at least one path to this inst */
 363 #define FLAG_CONSTRUCTED        0x01 /* this.<init> or super.<init> called */
 364     flag_type and_flags;        /* true for all paths to this instruction */
 365 };
 366 
 367 struct handler_info_type {
 368     int start, end, handler;
 369     struct stack_info_type stack_info;
 370 };
 371 
 372 struct stack_item_type {
 373     fullinfo_type item;
 374     struct stack_item_type *next;
 375 };
 376 
 377 typedef struct context_type context_type;
 378 typedef struct instruction_data_type instruction_data_type;
 379 typedef struct stack_item_type stack_item_type;
 380 typedef struct register_info_type register_info_type;
 381 typedef struct stack_info_type stack_info_type;
 382 typedef struct mask_type mask_type;
 383 
 384 static void read_all_code(context_type *context, jclass cb, int num_methods,
 385                           int** code_lengths, unsigned char*** code);
 386 static void verify_method(context_type *context, jclass cb, int index,
 387                           int code_length, unsigned char* code);
 388 static void free_all_code(context_type* context, int num_methods,
 389                           unsigned char** code);
 390 static void verify_field(context_type *context, jclass cb, int index);
 391 
 392 static void verify_opcode_operands (context_type *, unsigned int inumber, int offset);
 393 static void set_protected(context_type *, unsigned int inumber, int key, int);
 394 static jboolean is_superclass(context_type *, fullinfo_type);
 395 
 396 static void initialize_exception_table(context_type *);
 397 static int instruction_length(unsigned char *iptr, unsigned char *end);
 398 static jboolean isLegalOffset(context_type *, int bci, int offset);
 399 static jboolean isLegalTarget(context_type *, int target);
 400 static void verify_constant_pool_type(context_type *, int, unsigned);
 401 
 402 static void initialize_dataflow(context_type *);
 403 static void run_dataflow(context_type *context);
 404 static void check_register_values(context_type *context, unsigned int inumber);
 405 static void check_flags(context_type *context, unsigned int inumber);
 406 static void pop_stack(context_type *, unsigned int inumber, stack_info_type *);
 407 static void update_registers(context_type *, unsigned int inumber, register_info_type *);
 408 static void update_flags(context_type *, unsigned int inumber,
 409                          flag_type *new_and_flags, flag_type *new_or_flags);
 410 static void push_stack(context_type *, unsigned int inumber, stack_info_type *stack);
 411 
 412 static void merge_into_successors(context_type *, unsigned int inumber,
 413                                   register_info_type *register_info,
 414                                   stack_info_type *stack_info,
 415                                   flag_type and_flags, flag_type or_flags);
 416 static void merge_into_one_successor(context_type *context,
 417                                      unsigned int from_inumber,
 418                                      unsigned int inumber,
 419                                      register_info_type *register_info,
 420                                      stack_info_type *stack_info,
 421                                      flag_type and_flags, flag_type or_flags,
 422                                      jboolean isException);
 423 static void merge_stack(context_type *, unsigned int inumber,
 424                         unsigned int to_inumber, stack_info_type *);
 425 static void merge_registers(context_type *, unsigned int inumber,
 426                             unsigned int to_inumber,
 427                             register_info_type *);
 428 static void merge_flags(context_type *context, unsigned int from_inumber,
 429                         unsigned int to_inumber,
 430                         flag_type new_and_flags, flag_type new_or_flags);
 431 
 432 static stack_item_type *copy_stack(context_type *, stack_item_type *);
 433 static mask_type *copy_masks(context_type *, mask_type *masks, int mask_count);
 434 static mask_type *add_to_masks(context_type *, mask_type *, int , int);
 435 
 436 static fullinfo_type decrement_indirection(fullinfo_type);
 437 
 438 static fullinfo_type merge_fullinfo_types(context_type *context,
 439                                           fullinfo_type a,
 440                                           fullinfo_type b,
 441                                           jboolean assignment);
 442 static jboolean isAssignableTo(context_type *,
 443                                fullinfo_type a,
 444                                fullinfo_type b);
 445 
 446 static jclass object_fullinfo_to_classclass(context_type *, fullinfo_type);
 447 
 448 
 449 #define NEW(type, count) \
 450         ((type *)CCalloc(context, (count)*(sizeof(type)), JNI_FALSE))
 451 #define ZNEW(type, count) \
 452         ((type *)CCalloc(context, (count)*(sizeof(type)), JNI_TRUE))
 453 
 454 static void CCinit(context_type *context);
 455 static void CCreinit(context_type *context);
 456 static void CCdestroy(context_type *context);
 457 static void *CCalloc(context_type *context, int size, jboolean zero);
 458 
 459 static fullinfo_type cp_index_to_class_fullinfo(context_type *, int, int);
 460 
 461 static const char* get_result_signature(const char* signature);
 462 
 463 static char signature_to_fieldtype(context_type *context,
 464                                    const char **signature_p, fullinfo_type *info);
 465 
 466 static void CCerror (context_type *, char *format, ...);
 467 static void CFerror (context_type *, char *format, ...);
 468 static void CCout_of_memory (context_type *);
 469 
 470 /* Because we can longjmp any time, we need to be very careful about
 471  * remembering what needs to be freed. */
 472 
 473 static void check_and_push_malloc_block(context_type *context, void *ptr);
 474 static void check_and_push_string_utf(context_type *context, const char *ptr);
 475 static void pop_and_free(context_type *context);
 476 
 477 static int signature_to_args_size(const char *method_signature);
 478 
 479 #ifdef DEBUG
 480 static void print_stack (context_type *, stack_info_type *stack_info);
 481 static void print_registers(context_type *, register_info_type *register_info);
 482 static void print_flags(context_type *, flag_type, flag_type);
 483 static void print_formatted_fieldname(context_type *context, int index);
 484 static void print_formatted_methodname(context_type *context, int index);
 485 #endif
 486 
 487 /*
 488  * Declare library specific JNI_Onload entry if static build
 489  */
 490 DEF_STATIC_JNI_OnLoad
 491 
 492 void initialize_class_hash(context_type *context)
 493 {
 494     hash_table_type *class_hash = &(context->class_hash);
 495     class_hash->buckets = (hash_bucket_type **)
 496         calloc(MAX_HASH_ENTRIES / HASH_ROW_SIZE, sizeof(hash_bucket_type *));
 497     class_hash->table = (unsigned short *)
 498         calloc(HASH_TABLE_SIZE, sizeof(unsigned short));
 499     if (class_hash->buckets == 0 ||
 500         class_hash->table == 0)
 501         CCout_of_memory(context);
 502     class_hash->entries_used = 0;
 503 }
 504 
 505 static void finalize_class_hash(context_type *context)
 506 {
 507     hash_table_type *class_hash = &(context->class_hash);
 508     JNIEnv *env = context->env;
 509     int i;
 510     /* 4296677: bucket index starts from 1. */
 511     for (i=1;i<=class_hash->entries_used;i++) {
 512         hash_bucket_type *bucket = GET_BUCKET(class_hash, i);
 513         assert(bucket != NULL);
 514         free(bucket->name);
 515         if (bucket->class) {
 516             (*env)->DeleteGlobalRef(env, bucket->class);
 517 #ifdef DEBUG
 518             context->n_globalrefs--;
 519 #endif
 520         }
 521     }
 522     if (class_hash->buckets) {
 523         for (i=0;i<MAX_HASH_ENTRIES / HASH_ROW_SIZE; i++) {
 524             if (class_hash->buckets[i] == 0)
 525                 break;
 526             free(class_hash->buckets[i]);
 527         }
 528     }
 529     free(class_hash->buckets);
 530     free(class_hash->table);
 531 }
 532 
 533 static hash_bucket_type *
 534 new_bucket(context_type *context, unsigned short *pID)
 535 {
 536     hash_table_type *class_hash = &(context->class_hash);
 537     int i = *pID = class_hash->entries_used + 1;
 538     int row = i / HASH_ROW_SIZE;
 539     if (i >= MAX_HASH_ENTRIES)
 540         CCerror(context, "Exceeded verifier's limit of 65535 referred classes");
 541     if (class_hash->buckets[row] == 0) {
 542         class_hash->buckets[row] = (hash_bucket_type*)
 543             calloc(HASH_ROW_SIZE, sizeof(hash_bucket_type));
 544         if (class_hash->buckets[row] == 0)
 545             CCout_of_memory(context);
 546     }
 547     class_hash->entries_used++; /* only increment when we are sure there
 548                                    is no overflow. */
 549     return GET_BUCKET(class_hash, i);
 550 }
 551 
 552 static unsigned int
 553 class_hash_fun(const char *s)
 554 {
 555     int i;
 556     unsigned raw_hash;
 557     for (raw_hash = 0; (i = *s) != '\0'; ++s)
 558         raw_hash = raw_hash * 37 + i;
 559     return raw_hash;
 560 }
 561 
 562 /*
 563  * Find a class using the defining loader of the current class
 564  * and return a local reference to it.
 565  */
 566 static jclass load_class_local(context_type *context,const char *classname)
 567 {
 568     jclass cb = JVM_FindClassFromClass(context->env, classname,
 569                                  JNI_FALSE, context->class);
 570     if (cb == 0)
 571          CCerror(context, "Cannot find class %s", classname);
 572     return cb;
 573 }
 574 
 575 /*
 576  * Find a class using the defining loader of the current class
 577  * and return a global reference to it.
 578  */
 579 static jclass load_class_global(context_type *context, const char *classname)
 580 {
 581     JNIEnv *env = context->env;
 582     jclass local, global;
 583 
 584     local = load_class_local(context, classname);
 585     global = (*env)->NewGlobalRef(env, local);
 586     if (global == 0)
 587         CCout_of_memory(context);
 588 #ifdef DEBUG
 589     context->n_globalrefs++;
 590 #endif
 591     (*env)->DeleteLocalRef(env, local);
 592     return global;
 593 }
 594 
 595 /*
 596  * Return a unique ID given a local class reference. The loadable
 597  * flag is true if the defining class loader of context->class
 598  * is known to be capable of loading the class.
 599  */
 600 static unsigned short
 601 class_to_ID(context_type *context, jclass cb, jboolean loadable)
 602 {
 603     JNIEnv *env = context->env;
 604     hash_table_type *class_hash = &(context->class_hash);
 605     unsigned int hash;
 606     hash_bucket_type *bucket;
 607     unsigned short *pID;
 608     const char *name = JVM_GetClassNameUTF(env, cb);
 609 
 610     check_and_push_string_utf(context, name);
 611     hash = class_hash_fun(name);
 612     pID = &(class_hash->table[hash % HASH_TABLE_SIZE]);
 613     while (*pID) {
 614         bucket = GET_BUCKET(class_hash, *pID);
 615         if (bucket->hash == hash && strcmp(name, bucket->name) == 0) {
 616             /*
 617              * There is an unresolved entry with our name
 618              * so we're forced to load it in case it matches us.
 619              */
 620             if (bucket->class == 0) {
 621                 assert(bucket->loadable == JNI_TRUE);
 622                 bucket->class = load_class_global(context, name);
 623             }
 624 
 625             /*
 626              * It's already in the table. Update the loadable
 627              * state if it's known and then we're done.
 628              */
 629             if ((*env)->IsSameObject(env, cb, bucket->class)) {
 630                 if (loadable && !bucket->loadable)
 631                     bucket->loadable = JNI_TRUE;
 632                 goto done;
 633             }
 634         }
 635         pID = &bucket->next;
 636     }
 637     bucket = new_bucket(context, pID);
 638     bucket->next = 0;
 639     bucket->hash = hash;
 640     bucket->name = malloc(strlen(name) + 1);
 641     if (bucket->name == 0)
 642         CCout_of_memory(context);
 643     strcpy(bucket->name, name);
 644     bucket->loadable = loadable;
 645     bucket->class = (*env)->NewGlobalRef(env, cb);
 646     if (bucket->class == 0)
 647         CCout_of_memory(context);
 648 #ifdef DEBUG
 649     context->n_globalrefs++;
 650 #endif
 651 
 652 done:
 653     pop_and_free(context);
 654     return *pID;
 655 }
 656 
 657 /*
 658  * Return a unique ID given a class name from the constant pool.
 659  * All classes are lazily loaded from the defining loader of
 660  * context->class.
 661  */
 662 static unsigned short
 663 class_name_to_ID(context_type *context, const char *name)
 664 {
 665     hash_table_type *class_hash = &(context->class_hash);
 666     unsigned int hash = class_hash_fun(name);
 667     hash_bucket_type *bucket;
 668     unsigned short *pID;
 669     jboolean force_load = JNI_FALSE;
 670 
 671     pID = &(class_hash->table[hash % HASH_TABLE_SIZE]);
 672     while (*pID) {
 673         bucket = GET_BUCKET(class_hash, *pID);
 674         if (bucket->hash == hash && strcmp(name, bucket->name) == 0) {
 675             if (bucket->loadable)
 676                 goto done;
 677             force_load = JNI_TRUE;
 678         }
 679         pID = &bucket->next;
 680     }
 681 
 682     if (force_load) {
 683         /*
 684          * We found at least one matching named entry for a class that
 685          * was not known to be loadable through the defining class loader
 686          * of context->class. We must load our named class and update
 687          * the hash table in case one these entries matches our class.
 688          */
 689         JNIEnv *env = context->env;
 690         jclass cb = load_class_local(context, name);
 691         unsigned short id = class_to_ID(context, cb, JNI_TRUE);
 692         (*env)->DeleteLocalRef(env, cb);
 693         return id;
 694     }
 695 
 696     bucket = new_bucket(context, pID);
 697     bucket->next = 0;
 698     bucket->class = 0;
 699     bucket->loadable = JNI_TRUE; /* name-only IDs are implicitly loadable */
 700     bucket->hash = hash;
 701     bucket->name = malloc(strlen(name) + 1);
 702     if (bucket->name == 0)
 703         CCout_of_memory(context);
 704     strcpy(bucket->name, name);
 705 
 706 done:
 707     return *pID;
 708 }
 709 
 710 #ifdef DEBUG
 711 static const char *
 712 ID_to_class_name(context_type *context, unsigned short ID)
 713 {
 714     hash_table_type *class_hash = &(context->class_hash);
 715     hash_bucket_type *bucket = GET_BUCKET(class_hash, ID);
 716     return bucket->name;
 717 }
 718 #endif
 719 
 720 static jclass
 721 ID_to_class(context_type *context, unsigned short ID)
 722 {
 723     hash_table_type *class_hash = &(context->class_hash);
 724     hash_bucket_type *bucket = GET_BUCKET(class_hash, ID);
 725     if (bucket->class == 0) {
 726         assert(bucket->loadable == JNI_TRUE);
 727         bucket->class = load_class_global(context, bucket->name);
 728     }
 729     return bucket->class;
 730 }
 731 
 732 static fullinfo_type
 733 make_loadable_class_info(context_type *context, jclass cb)
 734 {
 735     return MAKE_FULLINFO(ITEM_Object, 0,
 736                            class_to_ID(context, cb, JNI_TRUE));
 737 }
 738 
 739 static fullinfo_type
 740 make_class_info(context_type *context, jclass cb)
 741 {
 742     return MAKE_FULLINFO(ITEM_Object, 0,
 743                          class_to_ID(context, cb, JNI_FALSE));
 744 }
 745 
 746 static fullinfo_type
 747 make_class_info_from_name(context_type *context, const char *name)
 748 {
 749     return MAKE_FULLINFO(ITEM_Object, 0,
 750                          class_name_to_ID(context, name));
 751 }
 752 
 753 /* RETURNS
 754  * 1: on success       chosen to be consistent with previous VerifyClass
 755  * 0: verify error
 756  * 2: out of memory
 757  * 3: class format error
 758  *
 759  * Called by verify_class.  Verify the code of each of the methods
 760  * in a class.  Note that this function apparently can't be JNICALL,
 761  * because if it is the dynamic linker doesn't appear to be able to
 762  * find it on Win32.
 763  */
 764 
 765 #define CC_OK 1
 766 #define CC_VerifyError 0
 767 #define CC_OutOfMemory 2
 768 #define CC_ClassFormatError 3
 769 
 770 JNIEXPORT jboolean
 771 VerifyClassForMajorVersion(JNIEnv *env, jclass cb, char *buffer, jint len,
 772                            jint major_version)
 773 {
 774     context_type context_structure;
 775     context_type *context = &context_structure;
 776     jboolean result = CC_OK;
 777     int i;
 778     int num_methods;
 779     int* code_lengths;
 780     unsigned char** code;
 781 
 782 #ifdef DEBUG
 783     GlobalContext = context;
 784 #endif
 785 
 786     memset(context, 0, sizeof(context_type));
 787     context->message = buffer;
 788     context->message_buf_len = len;
 789 
 790     context->env = env;
 791     context->class = cb;
 792 
 793     /* Set invalid method/field index of the context, in case anyone
 794        calls CCerror */
 795     context->method_index = -1;
 796     context->field_index = -1;
 797 
 798     /* Don't call CCerror or anything that can call it above the setjmp! */
 799     if (!setjmp(context->jump_buffer)) {
 800         jclass super;
 801 
 802         CCinit(context);                /* initialize heap; may throw */
 803 
 804         initialize_class_hash(context);
 805 
 806         context->major_version = major_version;
 807         context->nconstants = JVM_GetClassCPEntriesCount(env, cb);
 808         context->constant_types = (unsigned char *)
 809             malloc(sizeof(unsigned char) * context->nconstants + 1);
 810 
 811         if (context->constant_types == 0)
 812             CCout_of_memory(context);
 813 
 814         JVM_GetClassCPTypes(env, cb, context->constant_types);
 815 
 816         if (context->constant_types == 0)
 817             CCout_of_memory(context);
 818 
 819         context->object_info =
 820             make_class_info_from_name(context, "java/lang/Object");
 821         context->string_info =
 822             make_class_info_from_name(context, "java/lang/String");
 823         context->throwable_info =
 824             make_class_info_from_name(context, "java/lang/Throwable");
 825         context->cloneable_info =
 826             make_class_info_from_name(context, "java/lang/Cloneable");
 827         context->serializable_info =
 828             make_class_info_from_name(context, "java/io/Serializable");
 829 
 830         context->currentclass_info = make_loadable_class_info(context, cb);
 831 
 832         super = (*env)->GetSuperclass(env, cb);
 833 
 834         if (super != 0) {
 835             fullinfo_type *gptr;
 836             int i = 0;
 837 
 838             context->superclass_info = make_loadable_class_info(context, super);
 839 
 840             while(super != 0) {
 841                 jclass tmp_cb = (*env)->GetSuperclass(env, super);
 842                 (*env)->DeleteLocalRef(env, super);
 843                 super = tmp_cb;
 844                 i++;
 845             }
 846             (*env)->DeleteLocalRef(env, super);
 847             super = 0;
 848 
 849             /* Can't go on context heap since it survives more than
 850                one method */
 851             context->superclasses = gptr =
 852                 malloc(sizeof(fullinfo_type)*(i + 1));
 853             if (gptr == 0) {
 854                 CCout_of_memory(context);
 855             }
 856 
 857             super = (*env)->GetSuperclass(env, context->class);
 858             while(super != 0) {
 859                 jclass tmp_cb;
 860                 *gptr++ = make_class_info(context, super);
 861                 tmp_cb = (*env)->GetSuperclass(env, super);
 862                 (*env)->DeleteLocalRef(env, super);
 863                 super = tmp_cb;
 864             }
 865             *gptr = 0;
 866         } else {
 867             context->superclass_info = 0;
 868         }
 869 
 870         (*env)->DeleteLocalRef(env, super);
 871 
 872         /* Look at each method */
 873         for (i = JVM_GetClassFieldsCount(env, cb); --i >= 0;)
 874             verify_field(context, cb, i);
 875         num_methods = JVM_GetClassMethodsCount(env, cb);
 876         read_all_code(context, cb, num_methods, &code_lengths, &code);
 877         for (i = num_methods - 1; i >= 0; --i)
 878             verify_method(context, cb, i, code_lengths[i], code[i]);
 879         free_all_code(context, num_methods, code);
 880         result = CC_OK;
 881     } else {
 882         result = context->err_code;
 883     }
 884 
 885     /* Cleanup */
 886     finalize_class_hash(context);
 887 
 888     while(context->allocated_memory)
 889         pop_and_free(context);
 890 
 891 #ifdef DEBUG
 892     GlobalContext = 0;
 893 #endif
 894 
 895     if (context->exceptions)
 896         free(context->exceptions);
 897 
 898     if (context->constant_types)
 899         free(context->constant_types);
 900 
 901     if (context->superclasses)
 902         free(context->superclasses);
 903 
 904 #ifdef DEBUG
 905     /* Make sure all global refs created in the verifier are freed */
 906     assert(context->n_globalrefs == 0);
 907 #endif
 908 
 909     CCdestroy(context);         /* destroy heap */
 910     return result;
 911 }
 912 
 913 static void
 914 verify_field(context_type *context, jclass cb, int field_index)
 915 {
 916     JNIEnv *env = context->env;
 917     int access_bits = JVM_GetFieldIxModifiers(env, cb, field_index);
 918     context->field_index = field_index;
 919 
 920     if (  ((access_bits & JVM_ACC_PUBLIC) != 0) &&
 921           ((access_bits & (JVM_ACC_PRIVATE | JVM_ACC_PROTECTED)) != 0)) {
 922         CCerror(context, "Inconsistent access bits.");
 923     }
 924     context->field_index = -1;
 925 }
 926 
 927 
 928 /**
 929  * We read all of the class's methods' code because it is possible that
 930  * the verification of one method could resulting in linking further
 931  * down the stack (due to class loading), which could end up rewriting
 932  * some of the bytecode of methods we haven't verified yet.  Since we
 933  * don't want to see the rewritten bytecode, cache all the code and
 934  * operate only on that.
 935  */
 936 static void
 937 read_all_code(context_type* context, jclass cb, int num_methods,
 938               int** lengths_addr, unsigned char*** code_addr)
 939 {
 940     int* lengths;
 941     unsigned char** code;
 942     int i;
 943 
 944     lengths = malloc(sizeof(int) * num_methods);
 945     check_and_push_malloc_block(context, lengths);
 946 
 947     code = malloc(sizeof(unsigned char*) * num_methods);
 948     check_and_push_malloc_block(context, code);
 949 
 950     *(lengths_addr) = lengths;
 951     *(code_addr) = code;
 952 
 953     for (i = 0; i < num_methods; ++i) {
 954         lengths[i] = JVM_GetMethodIxByteCodeLength(context->env, cb, i);
 955         if (lengths[i] > 0) {
 956             code[i] = malloc(sizeof(unsigned char) * (lengths[i] + 1));
 957             check_and_push_malloc_block(context, code[i]);
 958             JVM_GetMethodIxByteCode(context->env, cb, i, code[i]);
 959         } else {
 960             code[i] = NULL;
 961         }
 962     }
 963 }
 964 
 965 static void
 966 free_all_code(context_type* context, int num_methods, unsigned char** code)
 967 {
 968   int i;
 969   for (i = 0; i < num_methods; ++i) {
 970       if (code[i] != NULL) {
 971           pop_and_free(context);
 972       }
 973   }
 974   pop_and_free(context); /* code */
 975   pop_and_free(context); /* lengths */
 976 }
 977 
 978 /* Verify the code of one method */
 979 static void
 980 verify_method(context_type *context, jclass cb, int method_index,
 981               int code_length, unsigned char* code)
 982 {
 983     JNIEnv *env = context->env;
 984     int access_bits = JVM_GetMethodIxModifiers(env, cb, method_index);
 985     int *code_data;
 986     instruction_data_type *idata = 0;
 987     int instruction_count;
 988     int i, offset;
 989     unsigned int inumber;
 990     jint nexceptions;
 991 
 992     if ((access_bits & (JVM_ACC_NATIVE | JVM_ACC_ABSTRACT)) != 0) {
 993         /* not much to do for abstract and native methods */
 994         return;
 995     }
 996 
 997     context->code_length = code_length;
 998     context->code = code;
 999 
1000     /* CCerror can give method-specific info once this is set */
1001     context->method_index = method_index;
1002 
1003     CCreinit(context);          /* initial heap */
1004     code_data = NEW(int, code_length);
1005 
1006 #ifdef DEBUG
1007     if (verify_verbose) {
1008         const char *classname = JVM_GetClassNameUTF(env, cb);
1009         const char *methodname =
1010             JVM_GetMethodIxNameUTF(env, cb, method_index);
1011         const char *signature =
1012             JVM_GetMethodIxSignatureUTF(env, cb, method_index);
1013         jio_fprintf(stdout, "Looking at %s.%s%s\n",
1014                     (classname ? classname : ""),
1015                     (methodname ? methodname : ""),
1016                     (signature ? signature : ""));
1017         JVM_ReleaseUTF(classname);
1018         JVM_ReleaseUTF(methodname);
1019         JVM_ReleaseUTF(signature);
1020     }
1021 #endif
1022 
1023     if (((access_bits & JVM_ACC_PUBLIC) != 0) &&
1024         ((access_bits & (JVM_ACC_PRIVATE | JVM_ACC_PROTECTED)) != 0)) {
1025         CCerror(context, "Inconsistent access bits.");
1026     }
1027 
1028     // If this method is an overpass method, which is generated by the VM,
1029     // we trust the code and no check needs to be done.
1030     if (JVM_IsVMGeneratedMethodIx(env, cb, method_index)) {
1031       return;
1032     }
1033 
1034     /* Run through the code.  Mark the start of each instruction, and give
1035      * the instruction a number */
1036     for (i = 0, offset = 0; offset < code_length; i++) {
1037         int length = instruction_length(&code[offset], code + code_length);
1038         int next_offset = offset + length;
1039         if (length <= 0)
1040             CCerror(context, "Illegal instruction found at offset %d", offset);
1041         if (next_offset > code_length)
1042             CCerror(context, "Code stops in the middle of instruction "
1043                     " starting at offset %d", offset);
1044         code_data[offset] = i;
1045         while (++offset < next_offset)
1046             code_data[offset] = -1; /* illegal location */
1047     }
1048     instruction_count = i;      /* number of instructions in code */
1049 
1050     /* Allocate a structure to hold info about each instruction. */
1051     idata = NEW(instruction_data_type, instruction_count);
1052 
1053     /* Initialize the heap, and other info in the context structure. */
1054     context->code = code;
1055     context->instruction_data = idata;
1056     context->code_data = code_data;
1057     context->instruction_count = instruction_count;
1058     context->handler_info =
1059         NEW(struct handler_info_type,
1060             JVM_GetMethodIxExceptionTableLength(env, cb, method_index));
1061     context->bitmask_size =
1062         (JVM_GetMethodIxLocalsCount(env, cb, method_index)
1063          + (BITS_PER_INT - 1))/BITS_PER_INT;
1064 
1065     if (instruction_count == 0)
1066         CCerror(context, "Empty code");
1067 
1068     for (inumber = 0, offset = 0; offset < code_length; inumber++) {
1069         int length = instruction_length(&code[offset], code + code_length);
1070         instruction_data_type *this_idata = &idata[inumber];
1071         this_idata->opcode = code[offset];
1072         this_idata->stack_info.stack = NULL;
1073         this_idata->stack_info.stack_size  = UNKNOWN_STACK_SIZE;
1074         this_idata->register_info.register_count = UNKNOWN_REGISTER_COUNT;
1075         this_idata->changed = JNI_FALSE;  /* no need to look at it yet. */
1076         this_idata->protected = JNI_FALSE;  /* no need to look at it yet. */
1077         this_idata->and_flags = (flag_type) -1; /* "bottom" and value */
1078         this_idata->or_flags = 0; /* "bottom" or value*/
1079         /* This also sets up this_data->operand.  It also makes the
1080          * xload_x and xstore_x instructions look like the generic form. */
1081         verify_opcode_operands(context, inumber, offset);
1082         offset += length;
1083     }
1084 
1085 
1086     /* make sure exception table is reasonable. */
1087     initialize_exception_table(context);
1088     /* Set up first instruction, and start of exception handlers. */
1089     initialize_dataflow(context);
1090     /* Run data flow analysis on the instructions. */
1091     run_dataflow(context);
1092 
1093     /* verify checked exceptions, if any */
1094     nexceptions = JVM_GetMethodIxExceptionsCount(env, cb, method_index);
1095     context->exceptions = (unsigned short *)
1096         malloc(sizeof(unsigned short) * nexceptions + 1);
1097     if (context->exceptions == 0)
1098         CCout_of_memory(context);
1099     JVM_GetMethodIxExceptionIndexes(env, cb, method_index,
1100                                     context->exceptions);
1101     for (i = 0; i < nexceptions; i++) {
1102         /* Make sure the constant pool item is JVM_CONSTANT_Class */
1103         verify_constant_pool_type(context, (int)context->exceptions[i],
1104                                   1 << JVM_CONSTANT_Class);
1105     }
1106     free(context->exceptions);
1107     context->exceptions = 0;
1108     context->code = 0;
1109     context->method_index = -1;
1110 }
1111 
1112 
1113 /* Look at a single instruction, and verify its operands.  Also, for
1114  * simplicity, move the operand into the ->operand field.
1115  * Make sure that branches don't go into the middle of nowhere.
1116  */
1117 
1118 static jint _ck_ntohl(jint n)
1119 {
1120     unsigned char *p = (unsigned char *)&n;
1121     return (p[0] << 24) | (p[1] << 16) | (p[2] << 8) | p[3];
1122 }
1123 
1124 static void
1125 verify_opcode_operands(context_type *context, unsigned int inumber, int offset)
1126 {
1127     JNIEnv *env = context->env;
1128     instruction_data_type *idata = context->instruction_data;
1129     instruction_data_type *this_idata = &idata[inumber];
1130     int *code_data = context->code_data;
1131     int mi = context->method_index;
1132     unsigned char *code = context->code;
1133     int opcode = this_idata->opcode;
1134     int var;
1135 
1136     /*
1137      * Set the ip fields to 0 not the i fields because the ip fields
1138      * are 64 bits on 64 bit architectures, the i field is only 32
1139      */
1140     this_idata->operand.ip = 0;
1141     this_idata->operand2.ip = 0;
1142 
1143     switch (opcode) {
1144 
1145     case JVM_OPC_jsr:
1146         /* instruction of ret statement */
1147         this_idata->operand2.i = UNKNOWN_RET_INSTRUCTION;
1148         /* FALLTHROUGH */
1149     case JVM_OPC_ifeq: case JVM_OPC_ifne: case JVM_OPC_iflt:
1150     case JVM_OPC_ifge: case JVM_OPC_ifgt: case JVM_OPC_ifle:
1151     case JVM_OPC_ifnull: case JVM_OPC_ifnonnull:
1152     case JVM_OPC_if_icmpeq: case JVM_OPC_if_icmpne: case JVM_OPC_if_icmplt:
1153     case JVM_OPC_if_icmpge: case JVM_OPC_if_icmpgt: case JVM_OPC_if_icmple:
1154     case JVM_OPC_if_acmpeq: case JVM_OPC_if_acmpne:
1155     case JVM_OPC_goto: {
1156         /* Set the ->operand to be the instruction number of the target. */
1157         int jump = (((signed char)(code[offset+1])) << 8) + code[offset+2];
1158         if (!isLegalOffset(context, offset, jump))
1159             CCerror(context, "Illegal target of jump or branch");
1160         int target = offset + jump;
1161         this_idata->operand.i = code_data[target];
1162         break;
1163     }
1164 
1165     case JVM_OPC_jsr_w:
1166         /* instruction of ret statement */
1167         this_idata->operand2.i = UNKNOWN_RET_INSTRUCTION;
1168         /* FALLTHROUGH */
1169     case JVM_OPC_goto_w: {
1170         /* Set the ->operand to be the instruction number of the target. */
1171         int jump = (((signed char)(code[offset+1])) << 24) +
1172                      (code[offset+2] << 16) + (code[offset+3] << 8) +
1173                      (code[offset + 4]);
1174         if (!isLegalOffset(context, offset, jump))
1175             CCerror(context, "Illegal target of jump or branch");
1176         int target = offset + jump;
1177         this_idata->operand.i = code_data[target];
1178         break;
1179     }
1180 
1181     case JVM_OPC_tableswitch:
1182     case JVM_OPC_lookupswitch: {
1183         /* Set the ->operand to be a table of possible instruction targets. */
1184         int *lpc = (int *) UCALIGN(code + offset + 1);
1185         int *lptr;
1186         int *saved_operand;
1187         int keys;
1188         int k, delta;
1189 
1190         if (context->major_version < NONZERO_PADDING_BYTES_IN_SWITCH_MAJOR_VERSION) {
1191             /* 4639449, 4647081: Padding bytes must be zero. */
1192             unsigned char* bptr = (unsigned char*) (code + offset + 1);
1193             for (; bptr < (unsigned char*)lpc; bptr++) {
1194                 if (*bptr != 0) {
1195                     CCerror(context, "Non zero padding bytes in switch");
1196                 }
1197             }
1198         }
1199         if (opcode == JVM_OPC_tableswitch) {
1200             keys = _ck_ntohl(lpc[2]) - _ck_ntohl(lpc[1]) + 1;
1201             delta = 1;
1202         } else {
1203             keys = _ck_ntohl(lpc[1]); /* number of pairs */
1204             delta = 2;
1205             /* Make sure that the tableswitch items are sorted */
1206             for (k = keys - 1, lptr = &lpc[2]; --k >= 0; lptr += 2) {
1207                 int this_key = _ck_ntohl(lptr[0]);  /* NB: ntohl may be unsigned */
1208                 int next_key = _ck_ntohl(lptr[2]);
1209                 if (this_key >= next_key) {
1210                     CCerror(context, "Unsorted lookup switch");
1211                 }
1212             }
1213         }
1214         saved_operand = NEW(int, keys + 2);
1215         int jump = _ck_ntohl(lpc[0]);
1216         if (!isLegalOffset(context, offset, jump))
1217             CCerror(context, "Illegal default target in switch");
1218         int target = offset + jump;
1219         saved_operand[keys + 1] = code_data[target];
1220         for (k = keys, lptr = &lpc[3]; --k >= 0; lptr += delta) {
1221             jump = _ck_ntohl(lptr[0]);
1222             if (!isLegalOffset(context, offset, jump))
1223                 CCerror(context, "Illegal branch in tableswitch");
1224             target = offset + jump;
1225             saved_operand[k + 1] = code_data[target];
1226         }
1227         saved_operand[0] = keys + 1; /* number of successors */
1228         this_idata->operand.ip = saved_operand;
1229         break;
1230     }
1231 
1232     case JVM_OPC_ldc: {
1233         /* Make sure the constant pool item is the right type. */
1234         int key = code[offset + 1];
1235         int types = (1 << JVM_CONSTANT_Integer) | (1 << JVM_CONSTANT_Float) |
1236                     (1 << JVM_CONSTANT_String);
1237         if (context->major_version >= LDC_CLASS_MAJOR_VERSION) {
1238             types |= 1 << JVM_CONSTANT_Class;
1239         }
1240         if (context->major_version >= LDC_METHOD_HANDLE_MAJOR_VERSION) {
1241             types |= (1 << JVM_CONSTANT_MethodHandle) |
1242                      (1 << JVM_CONSTANT_MethodType);
1243         }
1244         this_idata->operand.i = key;
1245         verify_constant_pool_type(context, key, types);
1246         break;
1247     }
1248 
1249     case JVM_OPC_ldc_w: {
1250         /* Make sure the constant pool item is the right type. */
1251         int key = (code[offset + 1] << 8) + code[offset + 2];
1252         int types = (1 << JVM_CONSTANT_Integer) | (1 << JVM_CONSTANT_Float) |
1253                     (1 << JVM_CONSTANT_String);
1254         if (context->major_version >= LDC_CLASS_MAJOR_VERSION) {
1255             types |= 1 << JVM_CONSTANT_Class;
1256         }
1257         if (context->major_version >= LDC_METHOD_HANDLE_MAJOR_VERSION) {
1258             types |= (1 << JVM_CONSTANT_MethodHandle) |
1259                      (1 << JVM_CONSTANT_MethodType);
1260         }
1261         this_idata->operand.i = key;
1262         verify_constant_pool_type(context, key, types);
1263         break;
1264     }
1265 
1266     case JVM_OPC_ldc2_w: {
1267         /* Make sure the constant pool item is the right type. */
1268         int key = (code[offset + 1] << 8) + code[offset + 2];
1269         int types = (1 << JVM_CONSTANT_Double) | (1 << JVM_CONSTANT_Long);
1270         this_idata->operand.i = key;
1271         verify_constant_pool_type(context, key, types);
1272         break;
1273     }
1274 
1275     case JVM_OPC_getfield: case JVM_OPC_putfield:
1276     case JVM_OPC_getstatic: case JVM_OPC_putstatic: {
1277         /* Make sure the constant pool item is the right type. */
1278         int key = (code[offset + 1] << 8) + code[offset + 2];
1279         this_idata->operand.i = key;
1280         verify_constant_pool_type(context, key, 1 << JVM_CONSTANT_Fieldref);
1281         if (opcode == JVM_OPC_getfield || opcode == JVM_OPC_putfield)
1282             set_protected(context, inumber, key, opcode);
1283         break;
1284     }
1285 
1286     case JVM_OPC_invokevirtual:
1287     case JVM_OPC_invokespecial:
1288     case JVM_OPC_invokestatic:
1289     case JVM_OPC_invokeinterface: {
1290         /* Make sure the constant pool item is the right type. */
1291         int key = (code[offset + 1] << 8) + code[offset + 2];
1292         const char *methodname;
1293         jclass cb = context->class;
1294         fullinfo_type clazz_info;
1295         int is_constructor, is_internal;
1296         int kind;
1297 
1298         switch (opcode ) {
1299         case JVM_OPC_invokestatic:
1300             kind = ((context->major_version < STATIC_METHOD_IN_INTERFACE_MAJOR_VERSION)
1301                        ? (1 << JVM_CONSTANT_Methodref)
1302                        : ((1 << JVM_CONSTANT_InterfaceMethodref) | (1 << JVM_CONSTANT_Methodref)));
1303             break;
1304         case JVM_OPC_invokeinterface:
1305             kind = 1 << JVM_CONSTANT_InterfaceMethodref;
1306             break;
1307         default:
1308             kind = 1 << JVM_CONSTANT_Methodref;
1309         }
1310 
1311         /* Make sure the constant pool item is the right type. */
1312         verify_constant_pool_type(context, key, kind);
1313         methodname = JVM_GetCPMethodNameUTF(env, cb, key);
1314         check_and_push_string_utf(context, methodname);
1315         is_constructor = !strcmp(methodname, "<init>");
1316         is_internal = methodname[0] == '<';
1317         pop_and_free(context);
1318 
1319         clazz_info = cp_index_to_class_fullinfo(context, key,
1320                                                 JVM_CONSTANT_Methodref);
1321         this_idata->operand.i = key;
1322         this_idata->operand2.fi = clazz_info;
1323         if (is_constructor) {
1324             if (opcode != JVM_OPC_invokespecial) {
1325                 CCerror(context,
1326                         "Must call initializers using invokespecial");
1327             }
1328             this_idata->opcode = JVM_OPC_invokeinit;
1329         } else {
1330             if (is_internal) {
1331                 CCerror(context, "Illegal call to internal method");
1332             }
1333             if (opcode == JVM_OPC_invokespecial
1334                    && clazz_info != context->currentclass_info
1335                    && clazz_info != context->superclass_info) {
1336                 int not_found = 1;
1337 
1338                 jclass super = (*env)->GetSuperclass(env, context->class);
1339                 while(super != 0) {
1340                     jclass tmp_cb;
1341                     fullinfo_type new_info = make_class_info(context, super);
1342                     if (clazz_info == new_info) {
1343                         not_found = 0;
1344                         break;
1345                     }
1346                     tmp_cb = (*env)->GetSuperclass(env, super);
1347                     (*env)->DeleteLocalRef(env, super);
1348                     super = tmp_cb;
1349                 }
1350                 (*env)->DeleteLocalRef(env, super);
1351 
1352                 /* The optimizer may cause this to happen on local code */
1353                 if (not_found) {
1354                     CCerror(context, "Illegal use of nonvirtual function call");
1355                 }
1356             }
1357         }
1358         if (opcode == JVM_OPC_invokeinterface) {
1359             unsigned int args1;
1360             unsigned int args2;
1361             const char *signature =
1362                 JVM_GetCPMethodSignatureUTF(env, context->class, key);
1363             check_and_push_string_utf(context, signature);
1364             args1 = signature_to_args_size(signature) + 1;
1365             args2 = code[offset + 3];
1366             if (args1 != args2) {
1367                 CCerror(context,
1368                         "Inconsistent args_size for invokeinterface");
1369             }
1370             if (code[offset + 4] != 0) {
1371                 CCerror(context,
1372                         "Fourth operand byte of invokeinterface must be zero");
1373             }
1374             pop_and_free(context);
1375         } else if (opcode == JVM_OPC_invokevirtual
1376                       || opcode == JVM_OPC_invokespecial)
1377             set_protected(context, inumber, key, opcode);
1378         break;
1379     }
1380 
1381     case JVM_OPC_invokedynamic:
1382         CCerror(context,
1383                 "invokedynamic bytecode is not supported in this class file version");
1384         break;
1385     case JVM_OPC_instanceof:
1386     case JVM_OPC_checkcast:
1387     case JVM_OPC_new:
1388     case JVM_OPC_anewarray:
1389     case JVM_OPC_multianewarray: {
1390         /* Make sure the constant pool item is a class */
1391         int key = (code[offset + 1] << 8) + code[offset + 2];
1392         fullinfo_type target;
1393         verify_constant_pool_type(context, key, 1 << JVM_CONSTANT_Class);
1394         target = cp_index_to_class_fullinfo(context, key, JVM_CONSTANT_Class);
1395         if (GET_ITEM_TYPE(target) == ITEM_Bogus)
1396             CCerror(context, "Illegal type");
1397         switch(opcode) {
1398         case JVM_OPC_anewarray:
1399             if ((GET_INDIRECTION(target)) >= MAX_ARRAY_DIMENSIONS)
1400                 CCerror(context, "Array with too many dimensions");
1401             this_idata->operand.fi = MAKE_FULLINFO(GET_ITEM_TYPE(target),
1402                                                    GET_INDIRECTION(target) + 1,
1403                                                    GET_EXTRA_INFO(target));
1404             break;
1405         case JVM_OPC_new:
1406             if (WITH_ZERO_EXTRA_INFO(target) !=
1407                              MAKE_FULLINFO(ITEM_Object, 0, 0))
1408                 CCerror(context, "Illegal creation of multi-dimensional array");
1409             /* operand gets set to the "uninitialized object".  operand2 gets
1410              * set to what the value will be after it's initialized. */
1411             this_idata->operand.fi = MAKE_FULLINFO(ITEM_NewObject, 0, inumber);
1412             this_idata->operand2.fi = target;
1413             break;
1414         case JVM_OPC_multianewarray:
1415             this_idata->operand.fi = target;
1416             this_idata->operand2.i = code[offset + 3];
1417             if (    (this_idata->operand2.i > (int)GET_INDIRECTION(target))
1418                  || (this_idata->operand2.i == 0))
1419                 CCerror(context, "Illegal dimension argument");
1420             break;
1421         default:
1422             this_idata->operand.fi = target;
1423         }
1424         break;
1425     }
1426 
1427     case JVM_OPC_newarray: {
1428         /* Cache the result of the JVM_OPC_newarray into the operand slot */
1429         fullinfo_type full_info;
1430         switch (code[offset + 1]) {
1431             case JVM_T_INT:
1432                 full_info = MAKE_FULLINFO(ITEM_Integer, 1, 0); break;
1433             case JVM_T_LONG:
1434                 full_info = MAKE_FULLINFO(ITEM_Long, 1, 0); break;
1435             case JVM_T_FLOAT:
1436                 full_info = MAKE_FULLINFO(ITEM_Float, 1, 0); break;
1437             case JVM_T_DOUBLE:
1438                 full_info = MAKE_FULLINFO(ITEM_Double, 1, 0); break;
1439             case JVM_T_BOOLEAN:
1440                 full_info = MAKE_FULLINFO(ITEM_Boolean, 1, 0); break;
1441             case JVM_T_BYTE:
1442                 full_info = MAKE_FULLINFO(ITEM_Byte, 1, 0); break;
1443             case JVM_T_CHAR:
1444                 full_info = MAKE_FULLINFO(ITEM_Char, 1, 0); break;
1445             case JVM_T_SHORT:
1446                 full_info = MAKE_FULLINFO(ITEM_Short, 1, 0); break;
1447             default:
1448                 full_info = 0;          /* Keep lint happy */
1449                 CCerror(context, "Bad type passed to newarray");
1450         }
1451         this_idata->operand.fi = full_info;
1452         break;
1453     }
1454 
1455     /* Fudge iload_x, aload_x, etc to look like their generic cousin. */
1456     case JVM_OPC_iload_0: case JVM_OPC_iload_1: case JVM_OPC_iload_2: case JVM_OPC_iload_3:
1457         this_idata->opcode = JVM_OPC_iload;
1458         var = opcode - JVM_OPC_iload_0;
1459         goto check_local_variable;
1460 
1461     case JVM_OPC_fload_0: case JVM_OPC_fload_1: case JVM_OPC_fload_2: case JVM_OPC_fload_3:
1462         this_idata->opcode = JVM_OPC_fload;
1463         var = opcode - JVM_OPC_fload_0;
1464         goto check_local_variable;
1465 
1466     case JVM_OPC_aload_0: case JVM_OPC_aload_1: case JVM_OPC_aload_2: case JVM_OPC_aload_3:
1467         this_idata->opcode = JVM_OPC_aload;
1468         var = opcode - JVM_OPC_aload_0;
1469         goto check_local_variable;
1470 
1471     case JVM_OPC_lload_0: case JVM_OPC_lload_1: case JVM_OPC_lload_2: case JVM_OPC_lload_3:
1472         this_idata->opcode = JVM_OPC_lload;
1473         var = opcode - JVM_OPC_lload_0;
1474         goto check_local_variable2;
1475 
1476     case JVM_OPC_dload_0: case JVM_OPC_dload_1: case JVM_OPC_dload_2: case JVM_OPC_dload_3:
1477         this_idata->opcode = JVM_OPC_dload;
1478         var = opcode - JVM_OPC_dload_0;
1479         goto check_local_variable2;
1480 
1481     case JVM_OPC_istore_0: case JVM_OPC_istore_1: case JVM_OPC_istore_2: case JVM_OPC_istore_3:
1482         this_idata->opcode = JVM_OPC_istore;
1483         var = opcode - JVM_OPC_istore_0;
1484         goto check_local_variable;
1485 
1486     case JVM_OPC_fstore_0: case JVM_OPC_fstore_1: case JVM_OPC_fstore_2: case JVM_OPC_fstore_3:
1487         this_idata->opcode = JVM_OPC_fstore;
1488         var = opcode - JVM_OPC_fstore_0;
1489         goto check_local_variable;
1490 
1491     case JVM_OPC_astore_0: case JVM_OPC_astore_1: case JVM_OPC_astore_2: case JVM_OPC_astore_3:
1492         this_idata->opcode = JVM_OPC_astore;
1493         var = opcode - JVM_OPC_astore_0;
1494         goto check_local_variable;
1495 
1496     case JVM_OPC_lstore_0: case JVM_OPC_lstore_1: case JVM_OPC_lstore_2: case JVM_OPC_lstore_3:
1497         this_idata->opcode = JVM_OPC_lstore;
1498         var = opcode - JVM_OPC_lstore_0;
1499         goto check_local_variable2;
1500 
1501     case JVM_OPC_dstore_0: case JVM_OPC_dstore_1: case JVM_OPC_dstore_2: case JVM_OPC_dstore_3:
1502         this_idata->opcode = JVM_OPC_dstore;
1503         var = opcode - JVM_OPC_dstore_0;
1504         goto check_local_variable2;
1505 
1506     case JVM_OPC_wide:
1507         this_idata->opcode = code[offset + 1];
1508         var = (code[offset + 2] << 8) + code[offset + 3];
1509         switch(this_idata->opcode) {
1510             case JVM_OPC_lload:  case JVM_OPC_dload:
1511             case JVM_OPC_lstore: case JVM_OPC_dstore:
1512                 goto check_local_variable2;
1513             default:
1514                 goto check_local_variable;
1515         }
1516 
1517     case JVM_OPC_iinc:              /* the increment amount doesn't matter */
1518     case JVM_OPC_ret:
1519     case JVM_OPC_aload: case JVM_OPC_iload: case JVM_OPC_fload:
1520     case JVM_OPC_astore: case JVM_OPC_istore: case JVM_OPC_fstore:
1521         var = code[offset + 1];
1522     check_local_variable:
1523         /* Make sure that the variable number isn't illegal. */
1524         this_idata->operand.i = var;
1525         if (var >= JVM_GetMethodIxLocalsCount(env, context->class, mi))
1526             CCerror(context, "Illegal local variable number");
1527         break;
1528 
1529     case JVM_OPC_lload: case JVM_OPC_dload: case JVM_OPC_lstore: case JVM_OPC_dstore:
1530         var = code[offset + 1];
1531     check_local_variable2:
1532         /* Make sure that the variable number isn't illegal. */
1533         this_idata->operand.i = var;
1534         if ((var + 1) >= JVM_GetMethodIxLocalsCount(env, context->class, mi))
1535             CCerror(context, "Illegal local variable number");
1536         break;
1537 
1538     default:
1539         if (opcode > JVM_OPC_MAX)
1540             CCerror(context, "Quick instructions shouldn't appear yet.");
1541         break;
1542     } /* of switch */
1543 }
1544 
1545 
1546 static void
1547 set_protected(context_type *context, unsigned int inumber, int key, int opcode)
1548 {
1549     JNIEnv *env = context->env;
1550     fullinfo_type clazz_info;
1551     if (opcode != JVM_OPC_invokevirtual && opcode != JVM_OPC_invokespecial) {
1552         clazz_info = cp_index_to_class_fullinfo(context, key,
1553                                                 JVM_CONSTANT_Fieldref);
1554     } else {
1555         clazz_info = cp_index_to_class_fullinfo(context, key,
1556                                                 JVM_CONSTANT_Methodref);
1557     }
1558     if (is_superclass(context, clazz_info)) {
1559         jclass calledClass =
1560             object_fullinfo_to_classclass(context, clazz_info);
1561         int access;
1562         /* 4734966: JVM_GetCPFieldModifiers() or JVM_GetCPMethodModifiers() only
1563            searches the referenced field or method in calledClass. The following
1564            while loop is added to search up the superclass chain to make this
1565            symbolic resolution consistent with the field/method resolution
1566            specified in VM spec 5.4.3. */
1567         calledClass = (*env)->NewLocalRef(env, calledClass);
1568         do {
1569             jclass tmp_cb;
1570             if (opcode != JVM_OPC_invokevirtual && opcode != JVM_OPC_invokespecial) {
1571                 access = JVM_GetCPFieldModifiers
1572                     (env, context->class, key, calledClass);
1573             } else {
1574                 access = JVM_GetCPMethodModifiers
1575                     (env, context->class, key, calledClass);
1576             }
1577             if (access != -1) {
1578                 break;
1579             }
1580             tmp_cb = (*env)->GetSuperclass(env, calledClass);
1581             (*env)->DeleteLocalRef(env, calledClass);
1582             calledClass = tmp_cb;
1583         } while (calledClass != 0);
1584 
1585         if (access == -1) {
1586             /* field/method not found, detected at runtime. */
1587         } else if (access & JVM_ACC_PROTECTED) {
1588             if (!JVM_IsSameClassPackage(env, calledClass, context->class))
1589                 context->instruction_data[inumber].protected = JNI_TRUE;
1590         }
1591         (*env)->DeleteLocalRef(env, calledClass);
1592     }
1593 }
1594 
1595 
1596 static jboolean
1597 is_superclass(context_type *context, fullinfo_type clazz_info) {
1598     fullinfo_type *fptr = context->superclasses;
1599 
1600     if (fptr == 0)
1601         return JNI_FALSE;
1602     for (; *fptr != 0; fptr++) {
1603         if (*fptr == clazz_info)
1604             return JNI_TRUE;
1605     }
1606     return JNI_FALSE;
1607 }
1608 
1609 
1610 /* Look through each item on the exception table.  Each of the fields must
1611  * refer to a legal instruction.
1612  */
1613 static void
1614 initialize_exception_table(context_type *context)
1615 {
1616     JNIEnv *env = context->env;
1617     int mi = context->method_index;
1618     struct handler_info_type *handler_info = context->handler_info;
1619     int *code_data = context->code_data;
1620     int code_length = context->code_length;
1621     int max_stack_size = JVM_GetMethodIxMaxStack(env, context->class, mi);
1622     int i = JVM_GetMethodIxExceptionTableLength(env, context->class, mi);
1623     if (max_stack_size < 1 && i > 0) {
1624         // If the method contains exception handlers, it must have room
1625         // on the expression stack for the exception that the VM could push
1626         CCerror(context, "Stack size too large");
1627     }
1628     for (; --i >= 0; handler_info++) {
1629         JVM_ExceptionTableEntryType einfo;
1630         stack_item_type *stack_item = NEW(stack_item_type, 1);
1631 
1632         JVM_GetMethodIxExceptionTableEntry(env, context->class, mi,
1633                                            i, &einfo);
1634 
1635         if (!(einfo.start_pc < einfo.end_pc &&
1636               einfo.start_pc >= 0 &&
1637               isLegalTarget(context, einfo.start_pc) &&
1638               (einfo.end_pc ==  code_length ||
1639                isLegalTarget(context, einfo.end_pc)))) {
1640             CFerror(context, "Illegal exception table range");
1641         }
1642         if (!((einfo.handler_pc > 0) &&
1643               isLegalTarget(context, einfo.handler_pc))) {
1644             CFerror(context, "Illegal exception table handler");
1645         }
1646 
1647         handler_info->start = code_data[einfo.start_pc];
1648         /* einfo.end_pc may point to one byte beyond the end of bytecodes. */
1649         handler_info->end = (einfo.end_pc == context->code_length) ?
1650             context->instruction_count : code_data[einfo.end_pc];
1651         handler_info->handler = code_data[einfo.handler_pc];
1652         handler_info->stack_info.stack = stack_item;
1653         handler_info->stack_info.stack_size = 1;
1654         stack_item->next = NULL;
1655         if (einfo.catchType != 0) {
1656             const char *classname;
1657             /* Constant pool entry type has been checked in format checker */
1658             classname = JVM_GetCPClassNameUTF(env,
1659                                               context->class,
1660                                               einfo.catchType);
1661             check_and_push_string_utf(context, classname);
1662             stack_item->item = make_class_info_from_name(context, classname);
1663             if (!isAssignableTo(context,
1664                                 stack_item->item,
1665                                 context->throwable_info))
1666                 CCerror(context, "catch_type not a subclass of Throwable");
1667             pop_and_free(context);
1668         } else {
1669             stack_item->item = context->throwable_info;
1670         }
1671     }
1672 }
1673 
1674 
1675 /* Given a pointer to an instruction, return its length.  Use the table
1676  * opcode_length[] which is automatically built.
1677  */
1678 static int instruction_length(unsigned char *iptr, unsigned char *end)
1679 {
1680     static unsigned char opcode_length[] = JVM_OPCODE_LENGTH_INITIALIZER;
1681     int instruction = *iptr;
1682     switch (instruction) {
1683         case JVM_OPC_tableswitch: {
1684             int *lpc = (int *)UCALIGN(iptr + 1);
1685             int64_t low, high, index;
1686             if (lpc + 2 >= (int *)end) {
1687                 return -1; /* do not read pass the end */
1688             }
1689             low  = _ck_ntohl(lpc[1]);
1690             high = _ck_ntohl(lpc[2]);
1691             index = high - low;
1692             // The value of low must be less than or equal to high - i.e. index >= 0
1693             if ((index < 0) || (index > 65535)) {
1694                 return -1;      /* illegal */
1695             } else {
1696                 unsigned char *finish = (unsigned char *)(&lpc[index + 4]);
1697                 assert(finish >= iptr);
1698                 return (int)(finish - iptr);
1699             }
1700         }
1701 
1702         case JVM_OPC_lookupswitch: {
1703             int *lpc = (int *) UCALIGN(iptr + 1);
1704             int npairs;
1705             if (lpc + 1 >= (int *)end)
1706                 return -1; /* do not read pass the end */
1707             npairs = _ck_ntohl(lpc[1]);
1708             /* There can't be more than 64K labels because of the limit
1709              * on per-method byte code length.
1710              */
1711             if (npairs < 0 || npairs >= 65536)
1712                 return  -1;
1713             else {
1714                 unsigned char *finish = (unsigned char *)(&lpc[2 * (npairs + 1)]);
1715                 assert(finish >= iptr);
1716                 return (int)(finish - iptr);
1717             }
1718         }
1719 
1720         case JVM_OPC_wide:
1721             if (iptr + 1 >= end)
1722                 return -1; /* do not read pass the end */
1723             switch(iptr[1]) {
1724                 case JVM_OPC_ret:
1725                 case JVM_OPC_iload: case JVM_OPC_istore:
1726                 case JVM_OPC_fload: case JVM_OPC_fstore:
1727                 case JVM_OPC_aload: case JVM_OPC_astore:
1728                 case JVM_OPC_lload: case JVM_OPC_lstore:
1729                 case JVM_OPC_dload: case JVM_OPC_dstore:
1730                     return 4;
1731                 case JVM_OPC_iinc:
1732                     return 6;
1733                 default:
1734                     return -1;
1735             }
1736 
1737         default: {
1738             if (instruction < 0 || instruction > JVM_OPC_MAX)
1739                 return -1;
1740 
1741             /* A length of 0 indicates an error. */
1742             if (opcode_length[instruction] <= 0)
1743                 return -1;
1744 
1745             return opcode_length[instruction];
1746         }
1747     }
1748 }
1749 
1750 
1751 /* Given the target of a branch, make sure that it's a legal target. */
1752 static jboolean
1753 isLegalTarget(context_type *context, int target)
1754 {
1755     int code_length = context->code_length;
1756     int *code_data = context->code_data;
1757     return (target >= 0 && target < code_length && code_data[target] >= 0);
1758 }
1759 
1760 /* Given a bci and offset, make sure the offset is valid and the target is legal */
1761 static jboolean
1762 isLegalOffset(context_type *context, int bci, int offset)
1763 {
1764     int code_length = context->code_length;
1765     int *code_data = context->code_data;
1766     int max_offset = 65535; // JVMS 4.11
1767     int min_offset = -65535;
1768     if (offset < min_offset || offset > max_offset) return JNI_FALSE;
1769     int target = bci + offset;
1770     return (target >= 0 && target < code_length && code_data[target] >= 0);
1771 }
1772 
1773 
1774 /* Make sure that an element of the constant pool really is of the indicated
1775  * type.
1776  */
1777 static void
1778 verify_constant_pool_type(context_type *context, int index, unsigned mask)
1779 {
1780     int nconstants = context->nconstants;
1781     unsigned char *type_table = context->constant_types;
1782     unsigned type;
1783 
1784     if ((index <= 0) || (index >= nconstants))
1785         CCerror(context, "Illegal constant pool index");
1786 
1787     type = type_table[index];
1788     if ((mask & (1 << type)) == 0)
1789         CCerror(context, "Illegal type in constant pool");
1790 }
1791 
1792 
1793 static void
1794 initialize_dataflow(context_type *context)
1795 {
1796     JNIEnv *env = context->env;
1797     instruction_data_type *idata = context->instruction_data;
1798     int mi = context->method_index;
1799     jclass cb = context->class;
1800     int args_size = JVM_GetMethodIxArgsSize(env, cb, mi);
1801     fullinfo_type *reg_ptr;
1802     fullinfo_type full_info;
1803     const char *p;
1804     const char *signature;
1805 
1806     /* Initialize the function entry, since we know everything about it. */
1807     idata[0].stack_info.stack_size = 0;
1808     idata[0].stack_info.stack = NULL;
1809     idata[0].register_info.register_count = args_size;
1810     idata[0].register_info.registers = NEW(fullinfo_type, args_size);
1811     idata[0].register_info.mask_count = 0;
1812     idata[0].register_info.masks = NULL;
1813     idata[0].and_flags = 0;     /* nothing needed */
1814     idata[0].or_flags = FLAG_REACHED; /* instruction reached */
1815     reg_ptr = idata[0].register_info.registers;
1816 
1817     if ((JVM_GetMethodIxModifiers(env, cb, mi) & JVM_ACC_STATIC) == 0) {
1818         /* A non static method.  If this is an <init> method, the first
1819          * argument is an uninitialized object.  Otherwise it is an object of
1820          * the given class type.  java.lang.Object.<init> is special since
1821          * we don't call its superclass <init> method.
1822          */
1823         if (JVM_IsConstructorIx(env, cb, mi)
1824                 && context->currentclass_info != context->object_info) {
1825             *reg_ptr++ = MAKE_FULLINFO(ITEM_InitObject, 0, 0);
1826             idata[0].or_flags |= FLAG_NEED_CONSTRUCTOR;
1827         } else {
1828             *reg_ptr++ = context->currentclass_info;
1829         }
1830     }
1831     signature = JVM_GetMethodIxSignatureUTF(env, cb, mi);
1832     check_and_push_string_utf(context, signature);
1833     /* Fill in each of the arguments into the registers. */
1834     for (p = signature + 1; *p != JVM_SIGNATURE_ENDFUNC; ) {
1835         char fieldchar = signature_to_fieldtype(context, &p, &full_info);
1836         switch (fieldchar) {
1837             case 'D': case 'L':
1838                 *reg_ptr++ = full_info;
1839                 *reg_ptr++ = full_info + 1;
1840                 break;
1841             default:
1842                 *reg_ptr++ = full_info;
1843                 break;
1844         }
1845     }
1846     p++;                        /* skip over right parenthesis */
1847     if (*p == 'V') {
1848         context->return_type = MAKE_FULLINFO(ITEM_Void, 0, 0);
1849     } else {
1850         signature_to_fieldtype(context, &p, &full_info);
1851         context->return_type = full_info;
1852     }
1853     pop_and_free(context);
1854     /* Indicate that we need to look at the first instruction. */
1855     idata[0].changed = JNI_TRUE;
1856 }
1857 
1858 
1859 /* Run the data flow analysis, as long as there are things to change. */
1860 static void
1861 run_dataflow(context_type *context) {
1862     JNIEnv *env = context->env;
1863     int mi = context->method_index;
1864     jclass cb = context->class;
1865     int max_stack_size = JVM_GetMethodIxMaxStack(env, cb, mi);
1866     instruction_data_type *idata = context->instruction_data;
1867     unsigned int icount = context->instruction_count;
1868     jboolean work_to_do = JNI_TRUE;
1869     unsigned int inumber;
1870 
1871     /* Run through the loop, until there is nothing left to do. */
1872     while (work_to_do) {
1873         work_to_do = JNI_FALSE;
1874         for (inumber = 0; inumber < icount; inumber++) {
1875             instruction_data_type *this_idata = &idata[inumber];
1876             if (this_idata->changed) {
1877                 register_info_type new_register_info;
1878                 stack_info_type new_stack_info;
1879                 flag_type new_and_flags, new_or_flags;
1880 
1881                 this_idata->changed = JNI_FALSE;
1882                 work_to_do = JNI_TRUE;
1883 #ifdef DEBUG
1884                 if (verify_verbose) {
1885                     jio_fprintf(stdout, "Instruction %d: ", inumber);
1886                     print_stack(context, &this_idata->stack_info);
1887                     print_registers(context, &this_idata->register_info);
1888                     print_flags(context,
1889                                 this_idata->and_flags, this_idata->or_flags);
1890                     fflush(stdout);
1891                 }
1892 #endif
1893                 /* Make sure the registers and flags are appropriate */
1894                 check_register_values(context, inumber);
1895                 check_flags(context, inumber);
1896 
1897                 /* Make sure the stack can deal with this instruction */
1898                 pop_stack(context, inumber, &new_stack_info);
1899 
1900                 /* Update the registers  and flags */
1901                 update_registers(context, inumber, &new_register_info);
1902                 update_flags(context, inumber, &new_and_flags, &new_or_flags);
1903 
1904                 /* Update the stack. */
1905                 push_stack(context, inumber, &new_stack_info);
1906 
1907                 if (new_stack_info.stack_size > max_stack_size)
1908                     CCerror(context, "Stack size too large");
1909 #ifdef DEBUG
1910                 if (verify_verbose) {
1911                     jio_fprintf(stdout, "  ");
1912                     print_stack(context, &new_stack_info);
1913                     print_registers(context, &new_register_info);
1914                     print_flags(context, new_and_flags, new_or_flags);
1915                     fflush(stdout);
1916                 }
1917 #endif
1918                 /* Add the new stack and register information to any
1919                  * instructions that can follow this instruction.     */
1920                 merge_into_successors(context, inumber,
1921                                       &new_register_info, &new_stack_info,
1922                                       new_and_flags, new_or_flags);
1923             }
1924         }
1925     }
1926 }
1927 
1928 
1929 /* Make sure that the registers contain a legitimate value for the given
1930  * instruction.
1931 */
1932 
1933 static void
1934 check_register_values(context_type *context, unsigned int inumber)
1935 {
1936     instruction_data_type *idata = context->instruction_data;
1937     instruction_data_type *this_idata = &idata[inumber];
1938     int opcode = this_idata->opcode;
1939     int operand = this_idata->operand.i;
1940     int register_count = this_idata->register_info.register_count;
1941     fullinfo_type *registers = this_idata->register_info.registers;
1942     jboolean double_word = JNI_FALSE;   /* default value */
1943     int type;
1944 
1945     switch (opcode) {
1946         default:
1947             return;
1948         case JVM_OPC_iload: case JVM_OPC_iinc:
1949             type = ITEM_Integer; break;
1950         case JVM_OPC_fload:
1951             type = ITEM_Float; break;
1952         case JVM_OPC_aload:
1953             type = ITEM_Object; break;
1954         case JVM_OPC_ret:
1955             type = ITEM_ReturnAddress; break;
1956         case JVM_OPC_lload:
1957             type = ITEM_Long; double_word = JNI_TRUE; break;
1958         case JVM_OPC_dload:
1959             type = ITEM_Double; double_word = JNI_TRUE; break;
1960     }
1961     if (!double_word) {
1962         fullinfo_type reg;
1963         /* Make sure we don't have an illegal register or one with wrong type */
1964         if (operand >= register_count) {
1965             CCerror(context,
1966                     "Accessing value from uninitialized register %d", operand);
1967         }
1968         reg = registers[operand];
1969 
1970         if (WITH_ZERO_EXTRA_INFO(reg) == (unsigned)MAKE_FULLINFO(type, 0, 0)) {
1971             /* the register is obviously of the given type */
1972             return;
1973         } else if (GET_INDIRECTION(reg) > 0 && type == ITEM_Object) {
1974             /* address type stuff be used on all arrays */
1975             return;
1976         } else if (GET_ITEM_TYPE(reg) == ITEM_ReturnAddress) {
1977             CCerror(context, "Cannot load return address from register %d",
1978                               operand);
1979             /* alternatively
1980                       (GET_ITEM_TYPE(reg) == ITEM_ReturnAddress)
1981                    && (opcode == JVM_OPC_iload)
1982                    && (type == ITEM_Object || type == ITEM_Integer)
1983                but this never occurs
1984             */
1985         } else if (reg == ITEM_InitObject && type == ITEM_Object) {
1986             return;
1987         } else if (WITH_ZERO_EXTRA_INFO(reg) ==
1988                         MAKE_FULLINFO(ITEM_NewObject, 0, 0) &&
1989                    type == ITEM_Object) {
1990             return;
1991         } else {
1992             CCerror(context, "Register %d contains wrong type", operand);
1993         }
1994     } else {
1995         /* Make sure we don't have an illegal register or one with wrong type */
1996         if ((operand + 1) >= register_count) {
1997             CCerror(context,
1998                     "Accessing value from uninitialized register pair %d/%d",
1999                     operand, operand+1);
2000         } else {
2001             if ((registers[operand] == (unsigned)MAKE_FULLINFO(type, 0, 0)) &&
2002                 (registers[operand + 1] == (unsigned)MAKE_FULLINFO(type + 1, 0, 0))) {
2003                 return;
2004             } else {
2005                 CCerror(context, "Register pair %d/%d contains wrong type",
2006                         operand, operand+1);
2007             }
2008         }
2009     }
2010 }
2011 
2012 
2013 /* Make sure the flags contain legitimate values for this instruction.
2014 */
2015 
2016 static void
2017 check_flags(context_type *context, unsigned int inumber)
2018 {
2019     instruction_data_type *idata = context->instruction_data;
2020     instruction_data_type *this_idata = &idata[inumber];
2021     int opcode = this_idata->opcode;
2022     switch (opcode) {
2023         case JVM_OPC_return:
2024             /* We need a constructor, but we aren't guaranteed it's called */
2025             if ((this_idata->or_flags & FLAG_NEED_CONSTRUCTOR) &&
2026                    !(this_idata->and_flags & FLAG_CONSTRUCTED))
2027                 CCerror(context, "Constructor must call super() or this()");
2028             /* fall through */
2029         case JVM_OPC_ireturn: case JVM_OPC_lreturn:
2030         case JVM_OPC_freturn: case JVM_OPC_dreturn: case JVM_OPC_areturn:
2031             if (this_idata->or_flags & FLAG_NO_RETURN)
2032                 /* This method cannot exit normally */
2033                 CCerror(context, "Cannot return normally");
2034         default:
2035             break; /* nothing to do. */
2036     }
2037 }
2038 
2039 /* Make sure that the top of the stack contains reasonable values for the
2040  * given instruction.  The post-pop values of the stack and its size are
2041  * returned in *new_stack_info.
2042  */
2043 
2044 static void
2045 pop_stack(context_type *context, unsigned int inumber, stack_info_type *new_stack_info)
2046 {
2047     instruction_data_type *idata = context->instruction_data;
2048     instruction_data_type *this_idata = &idata[inumber];
2049     int opcode = this_idata->opcode;
2050     stack_item_type *stack = this_idata->stack_info.stack;
2051     int stack_size = this_idata->stack_info.stack_size;
2052     char *stack_operands, *p;
2053     char buffer[257];           /* for holding manufactured argument lists */
2054     fullinfo_type stack_extra_info_buffer[256]; /* save info popped off stack */
2055     fullinfo_type *stack_extra_info = &stack_extra_info_buffer[256];
2056     fullinfo_type full_info;    /* only used in case of invoke instructions */
2057     fullinfo_type put_full_info; /* only used in case JVM_OPC_putstatic and JVM_OPC_putfield */
2058 
2059     switch(opcode) {
2060         default:
2061             /* For most instructions, we just use a built-in table */
2062             stack_operands = opcode_in_out[opcode][0];
2063             break;
2064 
2065         case JVM_OPC_putstatic: case JVM_OPC_putfield: {
2066             /* The top thing on the stack depends on the signature of
2067              * the object.                         */
2068             int operand = this_idata->operand.i;
2069             const char *signature =
2070                 JVM_GetCPFieldSignatureUTF(context->env,
2071                                            context->class,
2072                                            operand);
2073             char *ip = buffer;
2074             check_and_push_string_utf(context, signature);
2075 #ifdef DEBUG
2076             if (verify_verbose) {
2077                 print_formatted_fieldname(context, operand);
2078             }
2079 #endif
2080             if (opcode == JVM_OPC_putfield)
2081                 *ip++ = 'A';    /* object for putfield */
2082             *ip++ = signature_to_fieldtype(context, &signature, &put_full_info);
2083             *ip = '\0';
2084             stack_operands = buffer;
2085             pop_and_free(context);
2086             break;
2087         }
2088 
2089         case JVM_OPC_invokevirtual: case JVM_OPC_invokespecial:
2090         case JVM_OPC_invokeinit:    /* invokespecial call to <init> */
2091         case JVM_OPC_invokestatic: case JVM_OPC_invokeinterface: {
2092             /* The top stuff on the stack depends on the method signature */
2093             int operand = this_idata->operand.i;
2094             const char *signature =
2095                 JVM_GetCPMethodSignatureUTF(context->env,
2096                                             context->class,
2097                                             operand);
2098             char *ip = buffer;
2099             const char *p;
2100             check_and_push_string_utf(context, signature);
2101 #ifdef DEBUG
2102             if (verify_verbose) {
2103                 print_formatted_methodname(context, operand);
2104             }
2105 #endif
2106             if (opcode != JVM_OPC_invokestatic)
2107                 /* First, push the object */
2108                 *ip++ = (opcode == JVM_OPC_invokeinit ? '@' : 'A');
2109             for (p = signature + 1; *p != JVM_SIGNATURE_ENDFUNC; ) {
2110                 *ip++ = signature_to_fieldtype(context, &p, &full_info);
2111                 if (ip >= buffer + sizeof(buffer) - 1)
2112                     CCerror(context, "Signature %s has too many arguments",
2113                             signature);
2114             }
2115             *ip = 0;
2116             stack_operands = buffer;
2117             pop_and_free(context);
2118             break;
2119         }
2120 
2121         case JVM_OPC_multianewarray: {
2122             /* Count can't be larger than 255. So can't overflow buffer */
2123             int count = this_idata->operand2.i; /* number of ints on stack */
2124             memset(buffer, 'I', count);
2125             buffer[count] = '\0';
2126             stack_operands = buffer;
2127             break;
2128         }
2129 
2130     } /* of switch */
2131 
2132     /* Run through the list of operands >>backwards<< */
2133     for (   p = stack_operands + strlen(stack_operands);
2134             p > stack_operands;
2135             stack = stack->next) {
2136         int type = *--p;
2137         fullinfo_type top_type = stack ? stack->item : 0;
2138         int size = (type == 'D' || type == 'L') ? 2 : 1;
2139         *--stack_extra_info = top_type;
2140         if (stack == NULL)
2141             CCerror(context, "Unable to pop operand off an empty stack");
2142 
2143         switch (type) {
2144             case 'I':
2145                 if (top_type != MAKE_FULLINFO(ITEM_Integer, 0, 0))
2146                     CCerror(context, "Expecting to find integer on stack");
2147                 break;
2148 
2149             case 'F':
2150                 if (top_type != MAKE_FULLINFO(ITEM_Float, 0, 0))
2151                     CCerror(context, "Expecting to find float on stack");
2152                 break;
2153 
2154             case 'A':           /* object or array */
2155                 if (   (GET_ITEM_TYPE(top_type) != ITEM_Object)
2156                     && (GET_INDIRECTION(top_type) == 0)) {
2157                     /* The thing isn't an object or an array.  Let's see if it's
2158                      * one of the special cases  */
2159                     if (  (WITH_ZERO_EXTRA_INFO(top_type) ==
2160                                 MAKE_FULLINFO(ITEM_ReturnAddress, 0, 0))
2161                         && (opcode == JVM_OPC_astore))
2162                         break;
2163                     if (   (GET_ITEM_TYPE(top_type) == ITEM_NewObject
2164                             || (GET_ITEM_TYPE(top_type) == ITEM_InitObject))
2165                         && ((opcode == JVM_OPC_astore) || (opcode == JVM_OPC_aload)))
2166                         break;
2167                     /* The 2nd edition VM of the specification allows field
2168                      * initializations before the superclass initializer,
2169                      * if the field is defined within the current class.
2170                      */
2171                      if (   (GET_ITEM_TYPE(top_type) == ITEM_InitObject)
2172                          && (opcode == JVM_OPC_putfield)) {
2173                         int operand = this_idata->operand.i;
2174                         int access_bits = JVM_GetCPFieldModifiers(context->env,
2175                                                                   context->class,
2176                                                                   operand,
2177                                                                   context->class);
2178                         /* Note: This relies on the fact that
2179                          * JVM_GetCPFieldModifiers retrieves only local fields,
2180                          * and does not respect inheritance.
2181                          */
2182                         if (access_bits != -1) {
2183                             if ( cp_index_to_class_fullinfo(context, operand, JVM_CONSTANT_Fieldref) ==
2184                                  context->currentclass_info ) {
2185                                 top_type = context->currentclass_info;
2186                                 *stack_extra_info = top_type;
2187                                 break;
2188                             }
2189                         }
2190                     }
2191                     CCerror(context, "Expecting to find object/array on stack");
2192                 }
2193                 break;
2194 
2195             case '@': {         /* uninitialized object, for call to <init> */
2196                 int item_type = GET_ITEM_TYPE(top_type);
2197                 if (item_type != ITEM_NewObject && item_type != ITEM_InitObject)
2198                     CCerror(context,
2199                             "Expecting to find uninitialized object on stack");
2200                 break;
2201             }
2202 
2203             case 'O':           /* object, not array */
2204                 if (WITH_ZERO_EXTRA_INFO(top_type) !=
2205                        MAKE_FULLINFO(ITEM_Object, 0, 0))
2206                     CCerror(context, "Expecting to find object on stack");
2207                 break;
2208 
2209             case 'a':           /* integer, object, or array */
2210                 if (      (top_type != MAKE_FULLINFO(ITEM_Integer, 0, 0))
2211                        && (GET_ITEM_TYPE(top_type) != ITEM_Object)
2212                        && (GET_INDIRECTION(top_type) == 0))
2213                     CCerror(context,
2214                             "Expecting to find object, array, or int on stack");
2215                 break;
2216 
2217             case 'D':           /* double */
2218                 if (top_type != MAKE_FULLINFO(ITEM_Double, 0, 0))
2219                     CCerror(context, "Expecting to find double on stack");
2220                 break;
2221 
2222             case 'L':           /* long */
2223                 if (top_type != MAKE_FULLINFO(ITEM_Long, 0, 0))
2224                     CCerror(context, "Expecting to find long on stack");
2225                 break;
2226 
2227             case ']':           /* array of some type */
2228                 if (top_type == NULL_FULLINFO) {
2229                     /* do nothing */
2230                 } else switch(p[-1]) {
2231                     case 'I':   /* array of integers */
2232                         if (top_type != MAKE_FULLINFO(ITEM_Integer, 1, 0) &&
2233                             top_type != NULL_FULLINFO)
2234                             CCerror(context,
2235                                     "Expecting to find array of ints on stack");
2236                         break;
2237 
2238                     case 'L':   /* array of longs */
2239                         if (top_type != MAKE_FULLINFO(ITEM_Long, 1, 0))
2240                             CCerror(context,
2241                                    "Expecting to find array of longs on stack");
2242                         break;
2243 
2244                     case 'F':   /* array of floats */
2245                         if (top_type != MAKE_FULLINFO(ITEM_Float, 1, 0))
2246                             CCerror(context,
2247                                  "Expecting to find array of floats on stack");
2248                         break;
2249 
2250                     case 'D':   /* array of doubles */
2251                         if (top_type != MAKE_FULLINFO(ITEM_Double, 1, 0))
2252                             CCerror(context,
2253                                 "Expecting to find array of doubles on stack");
2254                         break;
2255 
2256                     case 'A': { /* array of addresses (arrays or objects) */
2257                         int indirection = GET_INDIRECTION(top_type);
2258                         if ((indirection == 0) ||
2259                             ((indirection == 1) &&
2260                                 (GET_ITEM_TYPE(top_type) != ITEM_Object)))
2261                             CCerror(context,
2262                                 "Expecting to find array of objects or arrays "
2263                                     "on stack");
2264                         break;
2265                     }
2266 
2267                     case 'B':    /* array of bytes or booleans */
2268                         if (top_type != MAKE_FULLINFO(ITEM_Byte, 1, 0) &&
2269                             top_type != MAKE_FULLINFO(ITEM_Boolean, 1, 0))
2270                             CCerror(context,
2271                                   "Expecting to find array of bytes or Booleans on stack");
2272                         break;
2273 
2274                     case 'C':   /* array of characters */
2275                         if (top_type != MAKE_FULLINFO(ITEM_Char, 1, 0))
2276                             CCerror(context,
2277                                   "Expecting to find array of chars on stack");
2278                         break;
2279 
2280                     case 'S':   /* array of shorts */
2281                         if (top_type != MAKE_FULLINFO(ITEM_Short, 1, 0))
2282                             CCerror(context,
2283                                  "Expecting to find array of shorts on stack");
2284                         break;
2285 
2286                     case '?':   /* any type of array is okay */
2287                         if (GET_INDIRECTION(top_type) == 0)
2288                             CCerror(context,
2289                                     "Expecting to find array on stack");
2290                         break;
2291 
2292                     default:
2293                         CCerror(context, "Internal error #1");
2294                         break;
2295                 }
2296                 p -= 2;         /* skip over [ <char> */
2297                 break;
2298 
2299             case '1': case '2': case '3': case '4': /* stack swapping */
2300                 if (top_type == MAKE_FULLINFO(ITEM_Double, 0, 0)
2301                     || top_type == MAKE_FULLINFO(ITEM_Long, 0, 0)) {
2302                     if ((p > stack_operands) && (p[-1] == '+')) {
2303                         context->swap_table[type - '1'] = top_type + 1;
2304                         context->swap_table[p[-2] - '1'] = top_type;
2305                         size = 2;
2306                         p -= 2;
2307                     } else {
2308                         CCerror(context,
2309                                 "Attempt to split long or double on the stack");
2310                     }
2311                 } else {
2312                     context->swap_table[type - '1'] = stack->item;
2313                     if ((p > stack_operands) && (p[-1] == '+'))
2314                         p--;    /* ignore */
2315                 }
2316                 break;
2317             case '+':           /* these should have been caught. */
2318             default:
2319                 CCerror(context, "Internal error #2");
2320         }
2321         stack_size -= size;
2322     }
2323 
2324     /* For many of the opcodes that had an "A" in their field, we really
2325      * need to go back and do a little bit more accurate testing.  We can, of
2326      * course, assume that the minimal type checking has already been done.
2327      */
2328     switch (opcode) {
2329         default: break;
2330         case JVM_OPC_aastore: {     /* array index object  */
2331             fullinfo_type array_type = stack_extra_info[0];
2332             fullinfo_type object_type = stack_extra_info[2];
2333             fullinfo_type target_type = decrement_indirection(array_type);
2334             if ((GET_ITEM_TYPE(object_type) != ITEM_Object)
2335                     && (GET_INDIRECTION(object_type) == 0)) {
2336                 CCerror(context, "Expecting reference type on operand stack in aastore");
2337             }
2338             if ((GET_ITEM_TYPE(target_type) != ITEM_Object)
2339                     && (GET_INDIRECTION(target_type) == 0)) {
2340                 CCerror(context, "Component type of the array must be reference type in aastore");
2341             }
2342             break;
2343         }
2344 
2345         case JVM_OPC_putfield:
2346         case JVM_OPC_getfield:
2347         case JVM_OPC_putstatic: {
2348             int operand = this_idata->operand.i;
2349             fullinfo_type stack_object = stack_extra_info[0];
2350             if (opcode == JVM_OPC_putfield || opcode == JVM_OPC_getfield) {
2351                 if (!isAssignableTo
2352                         (context,
2353                          stack_object,
2354                          cp_index_to_class_fullinfo
2355                              (context, operand, JVM_CONSTANT_Fieldref))) {
2356                     CCerror(context,
2357                             "Incompatible type for getting or setting field");
2358                 }
2359                 if (this_idata->protected &&
2360                     !isAssignableTo(context, stack_object,
2361                                     context->currentclass_info)) {
2362                     CCerror(context, "Bad access to protected data");
2363                 }
2364             }
2365             if (opcode == JVM_OPC_putfield || opcode == JVM_OPC_putstatic) {
2366                 int item = (opcode == JVM_OPC_putfield ? 1 : 0);
2367                 if (!isAssignableTo(context,
2368                                     stack_extra_info[item], put_full_info)) {
2369                     CCerror(context, "Bad type in putfield/putstatic");
2370                 }
2371             }
2372             break;
2373         }
2374 
2375         case JVM_OPC_athrow:
2376             if (!isAssignableTo(context, stack_extra_info[0],
2377                                 context->throwable_info)) {
2378                 CCerror(context, "Can only throw Throwable objects");
2379             }
2380             break;
2381 
2382         case JVM_OPC_aaload: {      /* array index */
2383             /* We need to pass the information to the stack updater */
2384             fullinfo_type array_type = stack_extra_info[0];
2385             context->swap_table[0] = decrement_indirection(array_type);
2386             break;
2387         }
2388 
2389         case JVM_OPC_invokevirtual: case JVM_OPC_invokespecial:
2390         case JVM_OPC_invokeinit:
2391         case JVM_OPC_invokeinterface: case JVM_OPC_invokestatic: {
2392             int operand = this_idata->operand.i;
2393             const char *signature =
2394                 JVM_GetCPMethodSignatureUTF(context->env,
2395                                             context->class,
2396                                             operand);
2397             int item;
2398             const char *p;
2399             check_and_push_string_utf(context, signature);
2400             if (opcode == JVM_OPC_invokestatic) {
2401                 item = 0;
2402             } else if (opcode == JVM_OPC_invokeinit) {
2403                 fullinfo_type init_type = this_idata->operand2.fi;
2404                 fullinfo_type object_type = stack_extra_info[0];
2405                 context->swap_table[0] = object_type; /* save value */
2406                 if (GET_ITEM_TYPE(stack_extra_info[0]) == ITEM_NewObject) {
2407                     /* We better be calling the appropriate init.  Find the
2408                      * inumber of the "JVM_OPC_new" instruction", and figure
2409                      * out what the type really is.
2410                      */
2411                     unsigned int new_inumber = GET_EXTRA_INFO(stack_extra_info[0]);
2412                     fullinfo_type target_type = idata[new_inumber].operand2.fi;
2413                     context->swap_table[1] = target_type;
2414 
2415                     if (target_type != init_type) {
2416                         CCerror(context, "Call to wrong initialization method");
2417                     }
2418                     if (this_idata->protected
2419                         && !isAssignableTo(context, object_type,
2420                                            context->currentclass_info)) {
2421                       CCerror(context, "Bad access to protected data");
2422                     }
2423                 } else {
2424                     /* We better be calling super() or this(). */
2425                     if (init_type != context->superclass_info &&
2426                         init_type != context->currentclass_info) {
2427                         CCerror(context, "Call to wrong initialization method");
2428                     }
2429                     context->swap_table[1] = context->currentclass_info;
2430                 }
2431                 item = 1;
2432             } else {
2433                 fullinfo_type target_type = this_idata->operand2.fi;
2434                 fullinfo_type object_type = stack_extra_info[0];
2435                 if (!isAssignableTo(context, object_type, target_type)){
2436                     CCerror(context,
2437                             "Incompatible object argument for function call");
2438                 }
2439                 if (opcode == JVM_OPC_invokespecial
2440                     && !isAssignableTo(context, object_type,
2441                                        context->currentclass_info)) {
2442                     /* Make sure object argument is assignment compatible to current class */
2443                     CCerror(context,
2444                             "Incompatible object argument for invokespecial");
2445                 }
2446                 if (this_idata->protected
2447                     && !isAssignableTo(context, object_type,
2448                                        context->currentclass_info)) {
2449                     /* This is ugly. Special dispensation.  Arrays pretend to
2450                        implement public Object clone() even though they don't */
2451                     const char *utfName =
2452                         JVM_GetCPMethodNameUTF(context->env,
2453                                                context->class,
2454                                                this_idata->operand.i);
2455                     int is_clone = utfName && (strcmp(utfName, "clone") == 0);
2456                     JVM_ReleaseUTF(utfName);
2457 
2458                     if ((target_type == context->object_info) &&
2459                         (GET_INDIRECTION(object_type) > 0) &&
2460                         is_clone) {
2461                     } else {
2462                         CCerror(context, "Bad access to protected data");
2463                     }
2464                 }
2465                 item = 1;
2466             }
2467             for (p = signature + 1; *p != JVM_SIGNATURE_ENDFUNC; item++)
2468                 if (signature_to_fieldtype(context, &p, &full_info) == 'A') {
2469                     if (!isAssignableTo(context,
2470                                         stack_extra_info[item], full_info)) {
2471                         CCerror(context, "Incompatible argument to function");
2472                     }
2473                 }
2474 
2475             pop_and_free(context);
2476             break;
2477         }
2478 
2479         case JVM_OPC_return:
2480             if (context->return_type != MAKE_FULLINFO(ITEM_Void, 0, 0))
2481                 CCerror(context, "Wrong return type in function");
2482             break;
2483 
2484         case JVM_OPC_ireturn: case JVM_OPC_lreturn: case JVM_OPC_freturn:
2485         case JVM_OPC_dreturn: case JVM_OPC_areturn: {
2486             fullinfo_type target_type = context->return_type;
2487             fullinfo_type object_type = stack_extra_info[0];
2488             if (!isAssignableTo(context, object_type, target_type)) {
2489                 CCerror(context, "Wrong return type in function");
2490             }
2491             break;
2492         }
2493 
2494         case JVM_OPC_new: {
2495             /* Make sure that nothing on the stack already looks like what
2496              * we want to create.  I can't image how this could possibly happen
2497              * but we should test for it anyway, since if it could happen, the
2498              * result would be an uninitialized object being able to masquerade
2499              * as an initialized one.
2500              */
2501             stack_item_type *item;
2502             for (item = stack; item != NULL; item = item->next) {
2503                 if (item->item == this_idata->operand.fi) {
2504                     CCerror(context,
2505                             "Uninitialized object on stack at creating point");
2506                 }
2507             }
2508             /* Info for update_registers */
2509             context->swap_table[0] = this_idata->operand.fi;
2510             context->swap_table[1] = MAKE_FULLINFO(ITEM_Bogus, 0, 0);
2511 
2512             break;
2513         }
2514     }
2515     new_stack_info->stack = stack;
2516     new_stack_info->stack_size = stack_size;
2517 }
2518 
2519 
2520 /* We've already determined that the instruction is legal.  Perform the
2521  * operation on the registers, and return the updated results in
2522  * new_register_count_p and new_registers.
2523  */
2524 
2525 static void
2526 update_registers(context_type *context, unsigned int inumber,
2527                  register_info_type *new_register_info)
2528 {
2529     instruction_data_type *idata = context->instruction_data;
2530     instruction_data_type *this_idata = &idata[inumber];
2531     int opcode = this_idata->opcode;
2532     int operand = this_idata->operand.i;
2533     int register_count = this_idata->register_info.register_count;
2534     fullinfo_type *registers = this_idata->register_info.registers;
2535     stack_item_type *stack = this_idata->stack_info.stack;
2536     int mask_count = this_idata->register_info.mask_count;
2537     mask_type *masks = this_idata->register_info.masks;
2538 
2539     /* Use these as default new values. */
2540     int            new_register_count = register_count;
2541     int            new_mask_count = mask_count;
2542     fullinfo_type *new_registers = registers;
2543     mask_type     *new_masks = masks;
2544 
2545     enum { ACCESS_NONE, ACCESS_SINGLE, ACCESS_DOUBLE } access = ACCESS_NONE;
2546     int i;
2547 
2548     /* Remember, we've already verified the type at the top of the stack. */
2549     switch (opcode) {
2550         default: break;
2551         case JVM_OPC_istore: case JVM_OPC_fstore: case JVM_OPC_astore:
2552             access = ACCESS_SINGLE;
2553             goto continue_store;
2554 
2555         case JVM_OPC_lstore: case JVM_OPC_dstore:
2556             access = ACCESS_DOUBLE;
2557             goto continue_store;
2558 
2559         continue_store: {
2560             /* We have a modification to the registers.  Copy them if needed. */
2561             fullinfo_type stack_top_type = stack->item;
2562             int max_operand = operand + ((access == ACCESS_DOUBLE) ? 1 : 0);
2563 
2564             if (     max_operand < register_count
2565                   && registers[operand] == stack_top_type
2566                   && ((access == ACCESS_SINGLE) ||
2567                          (registers[operand + 1]== stack_top_type + 1)))
2568                 /* No changes have been made to the registers. */
2569                 break;
2570             new_register_count = MAX(max_operand + 1, register_count);
2571             new_registers = NEW(fullinfo_type, new_register_count);
2572             for (i = 0; i < register_count; i++)
2573                 new_registers[i] = registers[i];
2574             for (i = register_count; i < new_register_count; i++)
2575                 new_registers[i] = MAKE_FULLINFO(ITEM_Bogus, 0, 0);
2576             new_registers[operand] = stack_top_type;
2577             if (access == ACCESS_DOUBLE)
2578                 new_registers[operand + 1] = stack_top_type + 1;
2579             break;
2580         }
2581 
2582         case JVM_OPC_iload: case JVM_OPC_fload: case JVM_OPC_aload:
2583         case JVM_OPC_iinc: case JVM_OPC_ret:
2584             access = ACCESS_SINGLE;
2585             break;
2586 
2587         case JVM_OPC_lload: case JVM_OPC_dload:
2588             access = ACCESS_DOUBLE;
2589             break;
2590 
2591         case JVM_OPC_jsr: case JVM_OPC_jsr_w:
2592             for (i = 0; i < new_mask_count; i++)
2593                 if (new_masks[i].entry == operand)
2594                     CCerror(context, "Recursive call to jsr entry");
2595             new_masks = add_to_masks(context, masks, mask_count, operand);
2596             new_mask_count++;
2597             break;
2598 
2599         case JVM_OPC_invokeinit:
2600         case JVM_OPC_new: {
2601             /* For invokeinit, an uninitialized object has been initialized.
2602              * For new, all previous occurrences of an uninitialized object
2603              * from the same instruction must be made bogus.
2604              * We find all occurrences of swap_table[0] in the registers, and
2605              * replace them with swap_table[1];
2606              */
2607             fullinfo_type from = context->swap_table[0];
2608             fullinfo_type to = context->swap_table[1];
2609 
2610             int i;
2611             for (i = 0; i < register_count; i++) {
2612                 if (new_registers[i] == from) {
2613                     /* Found a match */
2614                     break;
2615                 }
2616             }
2617             if (i < register_count) { /* We broke out loop for match */
2618                 /* We have to change registers, and possibly a mask */
2619                 jboolean copied_mask = JNI_FALSE;
2620                 int k;
2621                 new_registers = NEW(fullinfo_type, register_count);
2622                 memcpy(new_registers, registers,
2623                        register_count * sizeof(registers[0]));
2624                 for ( ; i < register_count; i++) {
2625                     if (new_registers[i] == from) {
2626                         new_registers[i] = to;
2627                         for (k = 0; k < new_mask_count; k++) {
2628                             if (!IS_BIT_SET(new_masks[k].modifies, i)) {
2629                                 if (!copied_mask) {
2630                                     new_masks = copy_masks(context, new_masks,
2631                                                            mask_count);
2632                                     copied_mask = JNI_TRUE;
2633                                 }
2634                                 SET_BIT(new_masks[k].modifies, i);
2635                             }
2636                         }
2637                     }
2638                 }
2639             }
2640             break;
2641         }
2642     } /* of switch */
2643 
2644     if ((access != ACCESS_NONE) && (new_mask_count > 0)) {
2645         int i, j;
2646         for (i = 0; i < new_mask_count; i++) {
2647             int *mask = new_masks[i].modifies;
2648             if ((!IS_BIT_SET(mask, operand)) ||
2649                   ((access == ACCESS_DOUBLE) &&
2650                    !IS_BIT_SET(mask, operand + 1))) {
2651                 new_masks = copy_masks(context, new_masks, mask_count);
2652                 for (j = i; j < new_mask_count; j++) {
2653                     SET_BIT(new_masks[j].modifies, operand);
2654                     if (access == ACCESS_DOUBLE)
2655                         SET_BIT(new_masks[j].modifies, operand + 1);
2656                 }
2657                 break;
2658             }
2659         }
2660     }
2661 
2662     new_register_info->register_count = new_register_count;
2663     new_register_info->registers = new_registers;
2664     new_register_info->masks = new_masks;
2665     new_register_info->mask_count = new_mask_count;
2666 }
2667 
2668 
2669 
2670 /* We've already determined that the instruction is legal, and have updated
2671  * the registers.  Update the flags, too.
2672  */
2673 
2674 
2675 static void
2676 update_flags(context_type *context, unsigned int inumber,
2677              flag_type *new_and_flags, flag_type *new_or_flags)
2678 
2679 {
2680     instruction_data_type *idata = context->instruction_data;
2681     instruction_data_type *this_idata = &idata[inumber];
2682     flag_type and_flags = this_idata->and_flags;
2683     flag_type or_flags = this_idata->or_flags;
2684 
2685     /* Set the "we've done a constructor" flag */
2686     if (this_idata->opcode == JVM_OPC_invokeinit) {
2687         fullinfo_type from = context->swap_table[0];
2688         if (from == MAKE_FULLINFO(ITEM_InitObject, 0, 0))
2689             and_flags |= FLAG_CONSTRUCTED;
2690     }
2691     *new_and_flags = and_flags;
2692     *new_or_flags = or_flags;
2693 }
2694 
2695 
2696 
2697 /* We've already determined that the instruction is legal.  Perform the
2698  * operation on the stack;
2699  *
2700  * new_stack_size_p and new_stack_p point to the results after the pops have
2701  * already been done.  Do the pushes, and then put the results back there.
2702  */
2703 
2704 static void
2705 push_stack(context_type *context, unsigned int inumber, stack_info_type *new_stack_info)
2706 {
2707     instruction_data_type *idata = context->instruction_data;
2708     instruction_data_type *this_idata = &idata[inumber];
2709     int opcode = this_idata->opcode;
2710     int operand = this_idata->operand.i;
2711 
2712     int stack_size = new_stack_info->stack_size;
2713     stack_item_type *stack = new_stack_info->stack;
2714     char *stack_results;
2715 
2716     fullinfo_type full_info = 0;
2717     char buffer[5], *p;         /* actually [2] is big enough */
2718 
2719     /* We need to look at all those opcodes in which either we can't tell the
2720      * value pushed onto the stack from the opcode, or in which the value
2721      * pushed onto the stack is an object or array.  For the latter, we need
2722      * to make sure that full_info is set to the right value.
2723      */
2724     switch(opcode) {
2725         default:
2726             stack_results = opcode_in_out[opcode][1];
2727             break;
2728 
2729         case JVM_OPC_ldc: case JVM_OPC_ldc_w: case JVM_OPC_ldc2_w: {
2730             /* Look to constant pool to determine correct result. */
2731             unsigned char *type_table = context->constant_types;
2732             switch (type_table[operand]) {
2733                 case JVM_CONSTANT_Integer:
2734                     stack_results = "I"; break;
2735                 case JVM_CONSTANT_Float:
2736                     stack_results = "F"; break;
2737                 case JVM_CONSTANT_Double:
2738                     stack_results = "D"; break;
2739                 case JVM_CONSTANT_Long:
2740                     stack_results = "L"; break;
2741                 case JVM_CONSTANT_String:
2742                     stack_results = "A";
2743                     full_info = context->string_info;
2744                     break;
2745                 case JVM_CONSTANT_Class:
2746                     if (context->major_version < LDC_CLASS_MAJOR_VERSION)
2747                         CCerror(context, "Internal error #3");
2748                     stack_results = "A";
2749                     full_info = make_class_info_from_name(context,
2750                                                           "java/lang/Class");
2751                     break;
2752                 case JVM_CONSTANT_MethodHandle:
2753                 case JVM_CONSTANT_MethodType:
2754                     if (context->major_version < LDC_METHOD_HANDLE_MAJOR_VERSION)
2755                         CCerror(context, "Internal error #3");
2756                     stack_results = "A";
2757                     switch (type_table[operand]) {
2758                     case JVM_CONSTANT_MethodType:
2759                       full_info = make_class_info_from_name(context,
2760                                                             "java/lang/invoke/MethodType");
2761                       break;
2762                     default: //JVM_CONSTANT_MethodHandle
2763                       full_info = make_class_info_from_name(context,
2764                                                             "java/lang/invoke/MethodHandle");
2765                       break;
2766                     }
2767                     break;
2768                 default:
2769                     CCerror(context, "Internal error #3");
2770                     stack_results = ""; /* Never reached: keep lint happy */
2771             }
2772             break;
2773         }
2774 
2775         case JVM_OPC_getstatic: case JVM_OPC_getfield: {
2776             /* Look to signature to determine correct result. */
2777             int operand = this_idata->operand.i;
2778             const char *signature = JVM_GetCPFieldSignatureUTF(context->env,
2779                                                                context->class,
2780                                                                operand);
2781             check_and_push_string_utf(context, signature);
2782 #ifdef DEBUG
2783             if (verify_verbose) {
2784                 print_formatted_fieldname(context, operand);
2785             }
2786 #endif
2787             buffer[0] = signature_to_fieldtype(context, &signature, &full_info);
2788             buffer[1] = '\0';
2789             stack_results = buffer;
2790             pop_and_free(context);
2791             break;
2792         }
2793 
2794         case JVM_OPC_invokevirtual: case JVM_OPC_invokespecial:
2795         case JVM_OPC_invokeinit:
2796         case JVM_OPC_invokestatic: case JVM_OPC_invokeinterface: {
2797             /* Look to signature to determine correct result. */
2798             int operand = this_idata->operand.i;
2799             const char *signature = JVM_GetCPMethodSignatureUTF(context->env,
2800                                                                 context->class,
2801                                                                 operand);
2802             const char *result_signature;
2803             check_and_push_string_utf(context, signature);
2804             result_signature = get_result_signature(signature);
2805             if (result_signature++ == NULL) {
2806                 CCerror(context, "Illegal signature %s", signature);
2807             }
2808             if (result_signature[0] == JVM_SIGNATURE_VOID) {
2809                 stack_results = "";
2810             } else {
2811                 buffer[0] = signature_to_fieldtype(context, &result_signature,
2812                                                    &full_info);
2813                 buffer[1] = '\0';
2814                 stack_results = buffer;
2815             }
2816             pop_and_free(context);
2817             break;
2818         }
2819 
2820         case JVM_OPC_aconst_null:
2821             stack_results = opcode_in_out[opcode][1];
2822             full_info = NULL_FULLINFO; /* special NULL */
2823             break;
2824 
2825         case JVM_OPC_new:
2826         case JVM_OPC_checkcast:
2827         case JVM_OPC_newarray:
2828         case JVM_OPC_anewarray:
2829         case JVM_OPC_multianewarray:
2830             stack_results = opcode_in_out[opcode][1];
2831             /* Conveniently, this result type is stored here */
2832             full_info = this_idata->operand.fi;
2833             break;
2834 
2835         case JVM_OPC_aaload:
2836             stack_results = opcode_in_out[opcode][1];
2837             /* pop_stack() saved value for us. */
2838             full_info = context->swap_table[0];
2839             break;
2840 
2841         case JVM_OPC_aload:
2842             stack_results = opcode_in_out[opcode][1];
2843             /* The register hasn't been modified, so we can use its value. */
2844             full_info = this_idata->register_info.registers[operand];
2845             break;
2846     } /* of switch */
2847 
2848     for (p = stack_results; *p != 0; p++) {
2849         int type = *p;
2850         stack_item_type *new_item = NEW(stack_item_type, 1);
2851         new_item->next = stack;
2852         stack = new_item;
2853         switch (type) {
2854             case 'I':
2855                 stack->item = MAKE_FULLINFO(ITEM_Integer, 0, 0); break;
2856             case 'F':
2857                 stack->item = MAKE_FULLINFO(ITEM_Float, 0, 0); break;
2858             case 'D':
2859                 stack->item = MAKE_FULLINFO(ITEM_Double, 0, 0);
2860                 stack_size++; break;
2861             case 'L':
2862                 stack->item = MAKE_FULLINFO(ITEM_Long, 0, 0);
2863                 stack_size++; break;
2864             case 'R':
2865                 stack->item = MAKE_FULLINFO(ITEM_ReturnAddress, 0, operand);
2866                 break;
2867             case '1': case '2': case '3': case '4': {
2868                 /* Get the info saved in the swap_table */
2869                 fullinfo_type stype = context->swap_table[type - '1'];
2870                 stack->item = stype;
2871                 if (stype == MAKE_FULLINFO(ITEM_Long, 0, 0) ||
2872                     stype == MAKE_FULLINFO(ITEM_Double, 0, 0)) {
2873                     stack_size++; p++;
2874                 }
2875                 break;
2876             }
2877             case 'A':
2878                 /* full_info should have the appropriate value. */
2879                 assert(full_info != 0);
2880                 stack->item = full_info;
2881                 break;
2882             default:
2883                 CCerror(context, "Internal error #4");
2884 
2885             } /* switch type */
2886         stack_size++;
2887     } /* outer for loop */
2888 
2889     if (opcode == JVM_OPC_invokeinit) {
2890         /* If there are any instances of "from" on the stack, we need to
2891          * replace it with "to", since calling <init> initializes all versions
2892          * of the object, obviously.     */
2893         fullinfo_type from = context->swap_table[0];
2894         stack_item_type *ptr;
2895         for (ptr = stack; ptr != NULL; ptr = ptr->next) {
2896             if (ptr->item == from) {
2897                 fullinfo_type to = context->swap_table[1];
2898                 stack = copy_stack(context, stack);
2899                 for (ptr = stack; ptr != NULL; ptr = ptr->next)
2900                     if (ptr->item == from) ptr->item = to;
2901                 break;
2902             }
2903         }
2904     }
2905 
2906     new_stack_info->stack_size = stack_size;
2907     new_stack_info->stack = stack;
2908 }
2909 
2910 
2911 /* We've performed an instruction, and determined the new registers and stack
2912  * value.  Look at all of the possibly subsequent instructions, and merge
2913  * this stack value into theirs.
2914  */
2915 
2916 static void
2917 merge_into_successors(context_type *context, unsigned int inumber,
2918                       register_info_type *register_info,
2919                       stack_info_type *stack_info,
2920                       flag_type and_flags, flag_type or_flags)
2921 {
2922     instruction_data_type *idata = context->instruction_data;
2923     instruction_data_type *this_idata = &idata[inumber];
2924     int opcode = this_idata->opcode;
2925     int operand = this_idata->operand.i;
2926     struct handler_info_type *handler_info = context->handler_info;
2927     int handler_info_length =
2928         JVM_GetMethodIxExceptionTableLength(context->env,
2929                                             context->class,
2930                                             context->method_index);
2931 
2932 
2933     int buffer[2];              /* default value for successors */
2934     int *successors = buffer;   /* table of successors */
2935     int successors_count;
2936     int i;
2937 
2938     switch (opcode) {
2939     default:
2940         successors_count = 1;
2941         buffer[0] = inumber + 1;
2942         break;
2943 
2944     case JVM_OPC_ifeq: case JVM_OPC_ifne: case JVM_OPC_ifgt:
2945     case JVM_OPC_ifge: case JVM_OPC_iflt: case JVM_OPC_ifle:
2946     case JVM_OPC_ifnull: case JVM_OPC_ifnonnull:
2947     case JVM_OPC_if_icmpeq: case JVM_OPC_if_icmpne: case JVM_OPC_if_icmpgt:
2948     case JVM_OPC_if_icmpge: case JVM_OPC_if_icmplt: case JVM_OPC_if_icmple:
2949     case JVM_OPC_if_acmpeq: case JVM_OPC_if_acmpne:
2950         successors_count = 2;
2951         buffer[0] = inumber + 1;
2952         buffer[1] = operand;
2953         break;
2954 
2955     case JVM_OPC_jsr: case JVM_OPC_jsr_w:
2956         if (this_idata->operand2.i != UNKNOWN_RET_INSTRUCTION)
2957             idata[this_idata->operand2.i].changed = JNI_TRUE;
2958         /* FALLTHROUGH */
2959     case JVM_OPC_goto: case JVM_OPC_goto_w:
2960         successors_count = 1;
2961         buffer[0] = operand;
2962         break;
2963 
2964 
2965     case JVM_OPC_ireturn: case JVM_OPC_lreturn: case JVM_OPC_return:
2966     case JVM_OPC_freturn: case JVM_OPC_dreturn: case JVM_OPC_areturn:
2967     case JVM_OPC_athrow:
2968         /* The testing for the returns is handled in pop_stack() */
2969         successors_count = 0;
2970         break;
2971 
2972     case JVM_OPC_ret: {
2973         /* This is slightly slow, but good enough for a seldom used instruction.
2974          * The EXTRA_ITEM_INFO of the ITEM_ReturnAddress indicates the
2975          * address of the first instruction of the subroutine.  We can return
2976          * to 1 after any instruction that jsr's to that instruction.
2977          */
2978         if (this_idata->operand2.ip == NULL) {
2979             fullinfo_type *registers = this_idata->register_info.registers;
2980             int called_instruction = GET_EXTRA_INFO(registers[operand]);
2981             int i, count, *ptr;;
2982             for (i = context->instruction_count, count = 0; --i >= 0; ) {
2983                 if (((idata[i].opcode == JVM_OPC_jsr) ||
2984                      (idata[i].opcode == JVM_OPC_jsr_w)) &&
2985                     (idata[i].operand.i == called_instruction))
2986                     count++;
2987             }
2988             this_idata->operand2.ip = ptr = NEW(int, count + 1);
2989             *ptr++ = count;
2990             for (i = context->instruction_count, count = 0; --i >= 0; ) {
2991                 if (((idata[i].opcode == JVM_OPC_jsr) ||
2992                      (idata[i].opcode == JVM_OPC_jsr_w)) &&
2993                     (idata[i].operand.i == called_instruction))
2994                     *ptr++ = i + 1;
2995             }
2996         }
2997         successors = this_idata->operand2.ip; /* use this instead */
2998         successors_count = *successors++;
2999         break;
3000 
3001     }
3002 
3003     case JVM_OPC_tableswitch:
3004     case JVM_OPC_lookupswitch:
3005         successors = this_idata->operand.ip; /* use this instead */
3006         successors_count = *successors++;
3007         break;
3008     }
3009 
3010 #ifdef DEBUG
3011     if (verify_verbose) {
3012         jio_fprintf(stdout, " [");
3013         for (i = handler_info_length; --i >= 0; handler_info++)
3014             if (handler_info->start <= (int)inumber && handler_info->end > (int)inumber)
3015                 jio_fprintf(stdout, "%d* ", handler_info->handler);
3016         for (i = 0; i < successors_count; i++)
3017             jio_fprintf(stdout, "%d ", successors[i]);
3018         jio_fprintf(stdout,   "]\n");
3019     }
3020 #endif
3021 
3022     handler_info = context->handler_info;
3023     for (i = handler_info_length; --i >= 0; handler_info++) {
3024         if (handler_info->start <= (int)inumber && handler_info->end > (int)inumber) {
3025             int handler = handler_info->handler;
3026             if (opcode != JVM_OPC_invokeinit) {
3027                 merge_into_one_successor(context, inumber, handler,
3028                                          &this_idata->register_info, /* old */
3029                                          &handler_info->stack_info,
3030                                          (flag_type) (and_flags
3031                                                       & this_idata->and_flags),
3032                                          (flag_type) (or_flags
3033                                                       | this_idata->or_flags),
3034                                          JNI_TRUE);
3035             } else {
3036                 /* We need to be a little bit more careful with this
3037                  * instruction.  Things could either be in the state before
3038                  * the instruction or in the state afterwards */
3039                 fullinfo_type from = context->swap_table[0];
3040                 flag_type temp_or_flags = or_flags;
3041                 if (from == MAKE_FULLINFO(ITEM_InitObject, 0, 0))
3042                     temp_or_flags |= FLAG_NO_RETURN;
3043                 merge_into_one_successor(context, inumber, handler,
3044                                          &this_idata->register_info, /* old */
3045                                          &handler_info->stack_info,
3046                                          this_idata->and_flags,
3047                                          this_idata->or_flags,
3048                                          JNI_TRUE);
3049                 merge_into_one_successor(context, inumber, handler,
3050                                          register_info,
3051                                          &handler_info->stack_info,
3052                                          and_flags, temp_or_flags, JNI_TRUE);
3053             }
3054         }
3055     }
3056     for (i = 0; i < successors_count; i++) {
3057         int target = successors[i];
3058         if (target >= context->instruction_count)
3059             CCerror(context, "Falling off the end of the code");
3060         merge_into_one_successor(context, inumber, target,
3061                                  register_info, stack_info, and_flags, or_flags,
3062                                  JNI_FALSE);
3063     }
3064 }
3065 
3066 /* We have a new set of registers and stack values for a given instruction.
3067  * Merge this new set into the values that are already there.
3068  */
3069 
3070 static void
3071 merge_into_one_successor(context_type *context,
3072                          unsigned int from_inumber, unsigned int to_inumber,
3073                          register_info_type *new_register_info,
3074                          stack_info_type *new_stack_info,
3075                          flag_type new_and_flags, flag_type new_or_flags,
3076                          jboolean isException)
3077 {
3078     instruction_data_type *idata = context->instruction_data;
3079     register_info_type register_info_buf;
3080     stack_info_type stack_info_buf;
3081 #ifdef DEBUG
3082     instruction_data_type *this_idata = &idata[to_inumber];
3083     register_info_type old_reg_info;
3084     stack_info_type old_stack_info;
3085     flag_type old_and_flags = 0;
3086     flag_type old_or_flags = 0;
3087 #endif
3088 
3089 #ifdef DEBUG
3090     if (verify_verbose) {
3091         old_reg_info = this_idata->register_info;
3092         old_stack_info = this_idata->stack_info;
3093         old_and_flags = this_idata->and_flags;
3094         old_or_flags = this_idata->or_flags;
3095     }
3096 #endif
3097 
3098     /* All uninitialized objects are set to "bogus" when jsr and
3099      * ret are executed. Thus uninitialized objects can't propagate
3100      * into or out of a subroutine.
3101      */
3102     if (idata[from_inumber].opcode == JVM_OPC_ret ||
3103         idata[from_inumber].opcode == JVM_OPC_jsr ||
3104         idata[from_inumber].opcode == JVM_OPC_jsr_w) {
3105         int new_register_count = new_register_info->register_count;
3106         fullinfo_type *new_registers = new_register_info->registers;
3107         int i;
3108         stack_item_type *item;
3109 
3110         for (item = new_stack_info->stack; item != NULL; item = item->next) {
3111             if (GET_ITEM_TYPE(item->item) == ITEM_NewObject) {
3112                 /* This check only succeeds for hand-contrived code.
3113                  * Efficiency is not an issue.
3114                  */
3115                 stack_info_buf.stack = copy_stack(context,
3116                                                   new_stack_info->stack);
3117                 stack_info_buf.stack_size = new_stack_info->stack_size;
3118                 new_stack_info = &stack_info_buf;
3119                 for (item = new_stack_info->stack; item != NULL;
3120                      item = item->next) {
3121                     if (GET_ITEM_TYPE(item->item) == ITEM_NewObject) {
3122                         item->item = MAKE_FULLINFO(ITEM_Bogus, 0, 0);
3123                     }
3124                 }
3125                 break;
3126             }
3127         }
3128         for (i = 0; i < new_register_count; i++) {
3129             if (GET_ITEM_TYPE(new_registers[i]) == ITEM_NewObject) {
3130                 /* This check only succeeds for hand-contrived code.
3131                  * Efficiency is not an issue.
3132                  */
3133                 fullinfo_type *new_set = NEW(fullinfo_type,
3134                                              new_register_count);
3135                 for (i = 0; i < new_register_count; i++) {
3136                     fullinfo_type t = new_registers[i];
3137                     new_set[i] = GET_ITEM_TYPE(t) != ITEM_NewObject ?
3138                         t : MAKE_FULLINFO(ITEM_Bogus, 0, 0);
3139                 }
3140                 register_info_buf.register_count = new_register_count;
3141                 register_info_buf.registers = new_set;
3142                 register_info_buf.mask_count = new_register_info->mask_count;
3143                 register_info_buf.masks = new_register_info->masks;
3144                 new_register_info = &register_info_buf;
3145                 break;
3146             }
3147         }
3148     }
3149 
3150     /* Returning from a subroutine is somewhat ugly.  The actual thing
3151      * that needs to get merged into the new instruction is a joining
3152      * of info from the ret instruction with stuff in the jsr instruction
3153      */
3154     if (idata[from_inumber].opcode == JVM_OPC_ret && !isException) {
3155         int new_register_count = new_register_info->register_count;
3156         fullinfo_type *new_registers = new_register_info->registers;
3157         int new_mask_count = new_register_info->mask_count;
3158         mask_type *new_masks = new_register_info->masks;
3159         int operand = idata[from_inumber].operand.i;
3160         int called_instruction = GET_EXTRA_INFO(new_registers[operand]);
3161         instruction_data_type *jsr_idata = &idata[to_inumber - 1];
3162         register_info_type *jsr_reginfo = &jsr_idata->register_info;
3163         if (jsr_idata->operand2.i != (int)from_inumber) {
3164             if (jsr_idata->operand2.i != UNKNOWN_RET_INSTRUCTION)
3165                 CCerror(context, "Multiple returns to single jsr");
3166             jsr_idata->operand2.i = from_inumber;
3167         }
3168         if (jsr_reginfo->register_count == UNKNOWN_REGISTER_COUNT) {
3169             /* We don't want to handle the returned-to instruction until
3170              * we've dealt with the jsr instruction.   When we get to the
3171              * jsr instruction (if ever), we'll re-mark the ret instruction
3172              */
3173             ;
3174         } else {
3175             int register_count = jsr_reginfo->register_count;
3176             fullinfo_type *registers = jsr_reginfo->registers;
3177             int max_registers = MAX(register_count, new_register_count);
3178             fullinfo_type *new_set = NEW(fullinfo_type, max_registers);
3179             int *return_mask;
3180             struct register_info_type new_new_register_info;
3181             int i;
3182             /* Make sure the place we're returning from is legal! */
3183             for (i = new_mask_count; --i >= 0; )
3184                 if (new_masks[i].entry == called_instruction)
3185                     break;
3186             if (i < 0)
3187                 CCerror(context, "Illegal return from subroutine");
3188             /* pop the masks down to the indicated one.  Remember the mask
3189              * we're popping off. */
3190             return_mask = new_masks[i].modifies;
3191             new_mask_count = i;
3192             for (i = 0; i < max_registers; i++) {
3193                 if (IS_BIT_SET(return_mask, i))
3194                     new_set[i] = i < new_register_count ?
3195                           new_registers[i] : MAKE_FULLINFO(ITEM_Bogus, 0, 0);
3196                 else
3197                     new_set[i] = i < register_count ?
3198                         registers[i] : MAKE_FULLINFO(ITEM_Bogus, 0, 0);
3199             }
3200             new_new_register_info.register_count = max_registers;
3201             new_new_register_info.registers      = new_set;
3202             new_new_register_info.mask_count     = new_mask_count;
3203             new_new_register_info.masks          = new_masks;
3204 
3205 
3206             merge_stack(context, from_inumber, to_inumber, new_stack_info);
3207             merge_registers(context, to_inumber - 1, to_inumber,
3208                             &new_new_register_info);
3209             merge_flags(context, from_inumber, to_inumber, new_and_flags, new_or_flags);
3210         }
3211     } else {
3212         merge_stack(context, from_inumber, to_inumber, new_stack_info);
3213         merge_registers(context, from_inumber, to_inumber, new_register_info);
3214         merge_flags(context, from_inumber, to_inumber,
3215                     new_and_flags, new_or_flags);
3216     }
3217 
3218 #ifdef DEBUG
3219     if (verify_verbose && idata[to_inumber].changed) {
3220         register_info_type *register_info = &this_idata->register_info;
3221         stack_info_type *stack_info = &this_idata->stack_info;
3222         if (memcmp(&old_reg_info, register_info, sizeof(old_reg_info)) ||
3223             memcmp(&old_stack_info, stack_info, sizeof(old_stack_info)) ||
3224             (old_and_flags != this_idata->and_flags) ||
3225             (old_or_flags != this_idata->or_flags)) {
3226             jio_fprintf(stdout, "   %2d:", to_inumber);
3227             print_stack(context, &old_stack_info);
3228             print_registers(context, &old_reg_info);
3229             print_flags(context, old_and_flags, old_or_flags);
3230             jio_fprintf(stdout, " => ");
3231             print_stack(context, &this_idata->stack_info);
3232             print_registers(context, &this_idata->register_info);
3233             print_flags(context, this_idata->and_flags, this_idata->or_flags);
3234             jio_fprintf(stdout, "\n");
3235         }
3236     }
3237 #endif
3238 
3239 }
3240 
3241 static void
3242 merge_stack(context_type *context, unsigned int from_inumber,
3243             unsigned int to_inumber, stack_info_type *new_stack_info)
3244 {
3245     instruction_data_type *idata = context->instruction_data;
3246     instruction_data_type *this_idata = &idata[to_inumber];
3247 
3248     int new_stack_size =  new_stack_info->stack_size;
3249     stack_item_type *new_stack = new_stack_info->stack;
3250 
3251     int stack_size = this_idata->stack_info.stack_size;
3252 
3253     if (stack_size == UNKNOWN_STACK_SIZE) {
3254         /* First time at this instruction.  Just copy. */
3255         this_idata->stack_info.stack_size = new_stack_size;
3256         this_idata->stack_info.stack = new_stack;
3257         this_idata->changed = JNI_TRUE;
3258     } else if (new_stack_size != stack_size) {
3259         CCerror(context, "Inconsistent stack height %d != %d",
3260                 new_stack_size, stack_size);
3261     } else {
3262         stack_item_type *stack = this_idata->stack_info.stack;
3263         stack_item_type *old, *new;
3264         jboolean change = JNI_FALSE;
3265         for (old = stack, new = new_stack; old != NULL;
3266                    old = old->next, new = new->next) {
3267             assert(new != NULL);
3268             if (!isAssignableTo(context, new->item, old->item)) {
3269                 change = JNI_TRUE;
3270                 break;
3271             }
3272         }
3273         if (change) {
3274             stack = copy_stack(context, stack);
3275             for (old = stack, new = new_stack; old != NULL;
3276                           old = old->next, new = new->next) {
3277                 if (new == NULL) {
3278                     break;
3279                 }
3280                 old->item = merge_fullinfo_types(context, old->item, new->item,
3281                                                  JNI_FALSE);
3282                 if (GET_ITEM_TYPE(old->item) == ITEM_Bogus) {
3283                         CCerror(context, "Mismatched stack types");
3284                 }
3285             }
3286             if (old != NULL || new != NULL) {
3287                 CCerror(context, "Mismatched stack types");
3288             }
3289             this_idata->stack_info.stack = stack;
3290             this_idata->changed = JNI_TRUE;
3291         }
3292     }
3293 }
3294 
3295 static void
3296 merge_registers(context_type *context, unsigned int from_inumber,
3297                 unsigned int to_inumber, register_info_type *new_register_info)
3298 {
3299     instruction_data_type *idata = context->instruction_data;
3300     instruction_data_type *this_idata = &idata[to_inumber];
3301     register_info_type    *this_reginfo = &this_idata->register_info;
3302 
3303     int            new_register_count = new_register_info->register_count;
3304     fullinfo_type *new_registers = new_register_info->registers;
3305     int            new_mask_count = new_register_info->mask_count;
3306     mask_type     *new_masks = new_register_info->masks;
3307 
3308 
3309     if (this_reginfo->register_count == UNKNOWN_REGISTER_COUNT) {
3310         this_reginfo->register_count = new_register_count;
3311         this_reginfo->registers = new_registers;
3312         this_reginfo->mask_count = new_mask_count;
3313         this_reginfo->masks = new_masks;
3314         this_idata->changed = JNI_TRUE;
3315     } else {
3316         /* See if we've got new information on the register set. */
3317         int register_count = this_reginfo->register_count;
3318         fullinfo_type *registers = this_reginfo->registers;
3319         int mask_count = this_reginfo->mask_count;
3320         mask_type *masks = this_reginfo->masks;
3321 
3322         jboolean copy = JNI_FALSE;
3323         int i, j;
3324         if (register_count > new_register_count) {
3325             /* Any register larger than new_register_count is now bogus */
3326             this_reginfo->register_count = new_register_count;
3327             register_count = new_register_count;
3328             this_idata->changed = JNI_TRUE;
3329         }
3330         for (i = 0; i < register_count; i++) {
3331             fullinfo_type prev_value = registers[i];
3332             if ((i < new_register_count)
3333                   ? (!isAssignableTo(context, new_registers[i], prev_value))
3334                   : (prev_value != MAKE_FULLINFO(ITEM_Bogus, 0, 0))) {
3335                 copy = JNI_TRUE;
3336                 break;
3337             }
3338         }
3339 
3340         if (copy) {
3341             /* We need a copy.  So do it. */
3342             fullinfo_type *new_set = NEW(fullinfo_type, register_count);
3343             for (j = 0; j < i; j++)
3344                 new_set[j] =  registers[j];
3345             for (j = i; j < register_count; j++) {
3346                 if (i >= new_register_count)
3347                     new_set[j] = MAKE_FULLINFO(ITEM_Bogus, 0, 0);
3348                 else
3349                     new_set[j] = merge_fullinfo_types(context,
3350                                                       new_registers[j],
3351                                                       registers[j], JNI_FALSE);
3352             }
3353             /* Some of the end items might now be bogus. This step isn't
3354              * necessary, but it may save work later. */
3355             while (   register_count > 0
3356                    && GET_ITEM_TYPE(new_set[register_count-1]) == ITEM_Bogus)
3357                 register_count--;
3358             this_reginfo->register_count = register_count;
3359             this_reginfo->registers = new_set;
3360             this_idata->changed = JNI_TRUE;
3361         }
3362         if (mask_count > 0) {
3363             /* If the target instruction already has a sequence of masks, then
3364              * we need to merge new_masks into it.  We want the entries on
3365              * the mask to be the longest common substring of the two.
3366              *   (e.g.   a->b->d merged with a->c->d should give a->d)
3367              * The bits set in the mask should be the or of the corresponding
3368              * entries in each of the original masks.
3369              */
3370             int i, j, k;
3371             int matches = 0;
3372             int last_match = -1;
3373             jboolean copy_needed = JNI_FALSE;
3374             for (i = 0; i < mask_count; i++) {
3375                 int entry = masks[i].entry;
3376                 for (j = last_match + 1; j < new_mask_count; j++) {
3377                     if (new_masks[j].entry == entry) {
3378                         /* We have a match */
3379                         int *prev = masks[i].modifies;
3380                         int *new = new_masks[j].modifies;
3381                         matches++;
3382                         /* See if new_mask has bits set for "entry" that
3383                          * weren't set for mask.  If so, need to copy. */
3384                         for (k = context->bitmask_size - 1;
3385                                !copy_needed && k >= 0;
3386                                k--)
3387                             if (~prev[k] & new[k])
3388                                 copy_needed = JNI_TRUE;
3389                         last_match = j;
3390                         break;
3391                     }
3392                 }
3393             }
3394             if ((matches < mask_count) || copy_needed) {
3395                 /* We need to make a copy for the new item, since either the
3396                  * size has decreased, or new bits are set. */
3397                 mask_type *copy = NEW(mask_type, matches);
3398                 for (i = 0; i < matches; i++) {
3399                     copy[i].modifies = NEW(int, context->bitmask_size);
3400                 }
3401                 this_reginfo->masks = copy;
3402                 this_reginfo->mask_count = matches;
3403                 this_idata->changed = JNI_TRUE;
3404                 matches = 0;
3405                 last_match = -1;
3406                 for (i = 0; i < mask_count; i++) {
3407                     int entry = masks[i].entry;
3408                     for (j = last_match + 1; j < new_mask_count; j++) {
3409                         if (new_masks[j].entry == entry) {
3410                             int *prev1 = masks[i].modifies;
3411                             int *prev2 = new_masks[j].modifies;
3412                             int *new = copy[matches].modifies;
3413                             copy[matches].entry = entry;
3414                             for (k = context->bitmask_size - 1; k >= 0; k--)
3415                                 new[k] = prev1[k] | prev2[k];
3416                             matches++;
3417                             last_match = j;
3418                             break;
3419                         }
3420                     }
3421                 }
3422             }
3423         }
3424     }
3425 }
3426 
3427 
3428 static void
3429 merge_flags(context_type *context, unsigned int from_inumber,
3430             unsigned int to_inumber,
3431             flag_type new_and_flags, flag_type new_or_flags)
3432 {
3433     /* Set this_idata->and_flags &= new_and_flags
3434            this_idata->or_flags |= new_or_flags
3435      */
3436     instruction_data_type *idata = context->instruction_data;
3437     instruction_data_type *this_idata = &idata[to_inumber];
3438     flag_type this_and_flags = this_idata->and_flags;
3439     flag_type this_or_flags = this_idata->or_flags;
3440     flag_type merged_and = this_and_flags & new_and_flags;
3441     flag_type merged_or = this_or_flags | new_or_flags;
3442 
3443     if ((merged_and != this_and_flags) || (merged_or != this_or_flags)) {
3444         this_idata->and_flags = merged_and;
3445         this_idata->or_flags = merged_or;
3446         this_idata->changed = JNI_TRUE;
3447     }
3448 }
3449 
3450 
3451 /* Make a copy of a stack */
3452 
3453 static stack_item_type *
3454 copy_stack(context_type *context, stack_item_type *stack)
3455 {
3456     int length;
3457     stack_item_type *ptr;
3458 
3459     /* Find the length */
3460     for (ptr = stack, length = 0; ptr != NULL; ptr = ptr->next, length++);
3461 
3462     if (length > 0) {
3463         stack_item_type *new_stack = NEW(stack_item_type, length);
3464         stack_item_type *new_ptr;
3465         for (    ptr = stack, new_ptr = new_stack;
3466                  ptr != NULL;
3467                  ptr = ptr->next, new_ptr++) {
3468             new_ptr->item = ptr->item;
3469             new_ptr->next = new_ptr + 1;
3470         }
3471         new_stack[length - 1].next = NULL;
3472         return new_stack;
3473     } else {
3474         return NULL;
3475     }
3476 }
3477 
3478 
3479 static mask_type *
3480 copy_masks(context_type *context, mask_type *masks, int mask_count)
3481 {
3482     mask_type *result = NEW(mask_type, mask_count);
3483     int bitmask_size = context->bitmask_size;
3484     int *bitmaps = NEW(int, mask_count * bitmask_size);
3485     int i;
3486     for (i = 0; i < mask_count; i++) {
3487         result[i].entry = masks[i].entry;
3488         result[i].modifies = &bitmaps[i * bitmask_size];
3489         memcpy(result[i].modifies, masks[i].modifies, bitmask_size * sizeof(int));
3490     }
3491     return result;
3492 }
3493 
3494 
3495 static mask_type *
3496 add_to_masks(context_type *context, mask_type *masks, int mask_count, int d)
3497 {
3498     mask_type *result = NEW(mask_type, mask_count + 1);
3499     int bitmask_size = context->bitmask_size;
3500     int *bitmaps = NEW(int, (mask_count + 1) * bitmask_size);
3501     int i;
3502     for (i = 0; i < mask_count; i++) {
3503         result[i].entry = masks[i].entry;
3504         result[i].modifies = &bitmaps[i * bitmask_size];
3505         memcpy(result[i].modifies, masks[i].modifies, bitmask_size * sizeof(int));
3506     }
3507     result[mask_count].entry = d;
3508     result[mask_count].modifies = &bitmaps[mask_count * bitmask_size];
3509     memset(result[mask_count].modifies, 0, bitmask_size * sizeof(int));
3510     return result;
3511 }
3512 
3513 
3514 
3515 /* We create our own storage manager, since we malloc lots of little items,
3516  * and I don't want to keep trace of when they become free.  I sure wish that
3517  * we had heaps, and I could just free the heap when done.
3518  */
3519 
3520 #define CCSegSize 2000
3521 
3522 struct CCpool {                 /* a segment of allocated memory in the pool */
3523     struct CCpool *next;
3524     int segSize;                /* almost always CCSegSize */
3525     int poolPad;
3526     char space[CCSegSize];
3527 };
3528 
3529 /* Initialize the context's heap. */
3530 static void CCinit(context_type *context)
3531 {
3532     struct CCpool *new = (struct CCpool *) malloc(sizeof(struct CCpool));
3533     /* Set context->CCroot to 0 if new == 0 to tell CCdestroy to lay off */
3534     context->CCroot = context->CCcurrent = new;
3535     if (new == 0) {
3536         CCout_of_memory(context);
3537     }
3538     new->next = NULL;
3539     new->segSize = CCSegSize;
3540     context->CCfree_size = CCSegSize;
3541     context->CCfree_ptr = &new->space[0];
3542 }
3543 
3544 
3545 /* Reuse all the space that we have in the context's heap. */
3546 static void CCreinit(context_type *context)
3547 {
3548     struct CCpool *first = context->CCroot;
3549     context->CCcurrent = first;
3550     context->CCfree_size = CCSegSize;
3551     context->CCfree_ptr = &first->space[0];
3552 }
3553 
3554 /* Destroy the context's heap. */
3555 static void CCdestroy(context_type *context)
3556 {
3557     struct CCpool *this = context->CCroot;
3558     while (this) {
3559         struct CCpool *next = this->next;
3560         free(this);
3561         this = next;
3562     }
3563     /* These two aren't necessary.  But can't hurt either */
3564     context->CCroot = context->CCcurrent = NULL;
3565     context->CCfree_ptr = 0;
3566 }
3567 
3568 /* Allocate an object of the given size from the context's heap. */
3569 static void *
3570 CCalloc(context_type *context, int size, jboolean zero)
3571 {
3572 
3573     register char *p;
3574     /* Round CC to the size of a pointer */
3575     size = (size + (sizeof(void *) - 1)) & ~(sizeof(void *) - 1);
3576 
3577     if (context->CCfree_size <  size) {
3578         struct CCpool *current = context->CCcurrent;
3579         struct CCpool *new;
3580         if (size > CCSegSize) { /* we need to allocate a special block */
3581             new = (struct CCpool *)malloc(sizeof(struct CCpool) +
3582                                           (size - CCSegSize));
3583             if (new == 0) {
3584                 CCout_of_memory(context);
3585             }
3586             new->next = current->next;
3587             new->segSize = size;
3588             current->next = new;
3589         } else {
3590             new = current->next;
3591             if (new == NULL) {
3592                 new = (struct CCpool *) malloc(sizeof(struct CCpool));
3593                 if (new == 0) {
3594                     CCout_of_memory(context);
3595                 }
3596                 current->next = new;
3597                 new->next = NULL;
3598                 new->segSize = CCSegSize;
3599             }
3600         }
3601         context->CCcurrent = new;
3602         context->CCfree_ptr = &new->space[0];
3603         context->CCfree_size = new->segSize;
3604     }
3605     p = context->CCfree_ptr;
3606     context->CCfree_ptr += size;
3607     context->CCfree_size -= size;
3608     if (zero)
3609         memset(p, 0, size);
3610     return p;
3611 }
3612 
3613 /* Get the class associated with a particular field or method or class in the
3614  * constant pool.  If is_field is true, we've got a field or method.  If
3615  * false, we've got a class.
3616  */
3617 static fullinfo_type
3618 cp_index_to_class_fullinfo(context_type *context, int cp_index, int kind)
3619 {
3620     JNIEnv *env = context->env;
3621     fullinfo_type result;
3622     const char *classname;
3623     switch (kind) {
3624     case JVM_CONSTANT_Class:
3625         classname = JVM_GetCPClassNameUTF(env,
3626                                           context->class,
3627                                           cp_index);
3628         break;
3629     case JVM_CONSTANT_Methodref:
3630         classname = JVM_GetCPMethodClassNameUTF(env,
3631                                                 context->class,
3632                                                 cp_index);
3633         break;
3634     case JVM_CONSTANT_Fieldref:
3635         classname = JVM_GetCPFieldClassNameUTF(env,
3636                                                context->class,
3637                                                cp_index);
3638         break;
3639     default:
3640         classname = NULL;
3641         CCerror(context, "Internal error #5");
3642     }
3643 
3644     check_and_push_string_utf(context, classname);
3645     if (classname[0] == JVM_SIGNATURE_ARRAY) {
3646         /* This make recursively call us, in case of a class array */
3647         signature_to_fieldtype(context, &classname, &result);
3648     } else {
3649         result = make_class_info_from_name(context, classname);
3650     }
3651     pop_and_free(context);
3652     return result;
3653 }
3654 
3655 
3656 static int
3657 print_CCerror_info(context_type *context)
3658 {
3659     JNIEnv *env = context->env;
3660     jclass cb = context->class;
3661     const char *classname = JVM_GetClassNameUTF(env, cb);
3662     const char *name = 0;
3663     const char *signature = 0;
3664     int n = 0;
3665     if (context->method_index != -1) {
3666         name = JVM_GetMethodIxNameUTF(env, cb, context->method_index);
3667         signature =
3668             JVM_GetMethodIxSignatureUTF(env, cb, context->method_index);
3669         n += jio_snprintf(context->message, context->message_buf_len,
3670                           "(class: %s, method: %s signature: %s) ",
3671                           (classname ? classname : ""),
3672                           (name ? name : ""),
3673                           (signature ? signature : ""));
3674     } else if (context->field_index != -1 ) {
3675         name = JVM_GetMethodIxNameUTF(env, cb, context->field_index);
3676         n += jio_snprintf(context->message, context->message_buf_len,
3677                           "(class: %s, field: %s) ",
3678                           (classname ? classname : 0),
3679                           (name ? name : 0));
3680     } else {
3681         n += jio_snprintf(context->message, context->message_buf_len,
3682                           "(class: %s) ", classname ? classname : "");
3683     }
3684     JVM_ReleaseUTF(classname);
3685     JVM_ReleaseUTF(name);
3686     JVM_ReleaseUTF(signature);
3687     return n;
3688 }
3689 
3690 static void
3691 CCerror (context_type *context, char *format, ...)
3692 {
3693     int n = print_CCerror_info(context);
3694     va_list args;
3695     if (n >= 0 && n < context->message_buf_len) {
3696         va_start(args, format);
3697         jio_vsnprintf(context->message + n, context->message_buf_len - n,
3698                       format, args);
3699         va_end(args);
3700     }
3701     context->err_code = CC_VerifyError;
3702     longjmp(context->jump_buffer, 1);
3703 }
3704 
3705 static void
3706 CCout_of_memory(context_type *context)
3707 {
3708     int n = print_CCerror_info(context);
3709     context->err_code = CC_OutOfMemory;
3710     longjmp(context->jump_buffer, 1);
3711 }
3712 
3713 static void
3714 CFerror(context_type *context, char *format, ...)
3715 {
3716     int n = print_CCerror_info(context);
3717     va_list args;
3718     if (n >= 0 && n < context->message_buf_len) {
3719         va_start(args, format);
3720         jio_vsnprintf(context->message + n, context->message_buf_len - n,
3721                       format, args);
3722         va_end(args);
3723     }
3724     context->err_code = CC_ClassFormatError;
3725     longjmp(context->jump_buffer, 1);
3726 }
3727 
3728 /*
3729  * Need to scan the entire signature to find the result type because
3730  * types in the arg list and the result type could contain embedded ')'s.
3731  */
3732 static const char* get_result_signature(const char* signature) {
3733     const char *p;
3734     for (p = signature; *p != JVM_SIGNATURE_ENDFUNC; p++) {
3735         switch (*p) {
3736           case JVM_SIGNATURE_BOOLEAN:
3737           case JVM_SIGNATURE_BYTE:
3738           case JVM_SIGNATURE_CHAR:
3739           case JVM_SIGNATURE_SHORT:
3740           case JVM_SIGNATURE_INT:
3741           case JVM_SIGNATURE_FLOAT:
3742           case JVM_SIGNATURE_DOUBLE:
3743           case JVM_SIGNATURE_LONG:
3744           case JVM_SIGNATURE_FUNC:  /* ignore initial (, if given */
3745             break;
3746           case JVM_SIGNATURE_CLASS:
3747             while (*p != JVM_SIGNATURE_ENDCLASS) p++;
3748             break;
3749           case JVM_SIGNATURE_ARRAY:
3750             while (*p == JVM_SIGNATURE_ARRAY) p++;
3751             /* If an array of classes, skip over class name, too. */
3752             if (*p == JVM_SIGNATURE_CLASS) {
3753                 while (*p != JVM_SIGNATURE_ENDCLASS) p++;
3754             }
3755             break;
3756           default:
3757             /* Indicate an error. */
3758             return NULL;
3759         }
3760     }
3761     return p++; /* skip over ')'. */
3762 }
3763 
3764 static char
3765 signature_to_fieldtype(context_type *context,
3766                        const char **signature_p, fullinfo_type *full_info_p)
3767 {
3768     const char *p = *signature_p;
3769     fullinfo_type full_info = MAKE_FULLINFO(ITEM_Bogus, 0, 0);
3770     char result;
3771     int array_depth = 0;
3772 
3773     for (;;) {
3774         switch(*p++) {
3775             default:
3776                 result = 0;
3777                 break;
3778 
3779             case JVM_SIGNATURE_BOOLEAN:
3780                 full_info = (array_depth > 0)
3781                               ? MAKE_FULLINFO(ITEM_Boolean, 0, 0)
3782                               : MAKE_FULLINFO(ITEM_Integer, 0, 0);
3783                 result = 'I';
3784                 break;
3785 
3786             case JVM_SIGNATURE_BYTE:
3787                 full_info = (array_depth > 0)
3788                               ? MAKE_FULLINFO(ITEM_Byte, 0, 0)
3789                               : MAKE_FULLINFO(ITEM_Integer, 0, 0);
3790                 result = 'I';
3791                 break;
3792 
3793             case JVM_SIGNATURE_CHAR:
3794                 full_info = (array_depth > 0)
3795                               ? MAKE_FULLINFO(ITEM_Char, 0, 0)
3796                               : MAKE_FULLINFO(ITEM_Integer, 0, 0);
3797                 result = 'I';
3798                 break;
3799 
3800             case JVM_SIGNATURE_SHORT:
3801                 full_info = (array_depth > 0)
3802                               ? MAKE_FULLINFO(ITEM_Short, 0, 0)
3803                               : MAKE_FULLINFO(ITEM_Integer, 0, 0);
3804                 result = 'I';
3805                 break;
3806 
3807             case JVM_SIGNATURE_INT:
3808                 full_info = MAKE_FULLINFO(ITEM_Integer, 0, 0);
3809                 result = 'I';
3810                 break;
3811 
3812             case JVM_SIGNATURE_FLOAT:
3813                 full_info = MAKE_FULLINFO(ITEM_Float, 0, 0);
3814                 result = 'F';
3815                 break;
3816 
3817             case JVM_SIGNATURE_DOUBLE:
3818                 full_info = MAKE_FULLINFO(ITEM_Double, 0, 0);
3819                 result = 'D';
3820                 break;
3821 
3822             case JVM_SIGNATURE_LONG:
3823                 full_info = MAKE_FULLINFO(ITEM_Long, 0, 0);
3824                 result = 'L';
3825                 break;
3826 
3827             case JVM_SIGNATURE_ARRAY:
3828                 array_depth++;
3829                 continue;       /* only time we ever do the loop > 1 */
3830 
3831             case JVM_SIGNATURE_CLASS: {
3832                 char buffer_space[256];
3833                 char *buffer = buffer_space;
3834                 char *finish = strchr(p, JVM_SIGNATURE_ENDCLASS);
3835                 int length;
3836                 if (finish == NULL) {
3837                     /* Signature must have ';' after the class name.
3838                      * If it does not, return 0 and ITEM_Bogus in full_info. */
3839                     result = 0;
3840                     break;
3841                 }
3842                 assert(finish >= p);
3843                 length = (int)(finish - p);
3844                 if (length + 1 > (int)sizeof(buffer_space)) {
3845                     buffer = malloc(length + 1);
3846                     check_and_push_malloc_block(context, buffer);
3847                 }
3848                 memcpy(buffer, p, length);
3849                 buffer[length] = '\0';
3850                 full_info = make_class_info_from_name(context, buffer);
3851                 result = 'A';
3852                 p = finish + 1;
3853                 if (buffer != buffer_space)
3854                     pop_and_free(context);
3855                 break;
3856             }
3857         } /* end of switch */
3858         break;
3859     }
3860     *signature_p = p;
3861     if (array_depth == 0 || result == 0) {
3862         /* either not an array, or result is bogus */
3863         *full_info_p = full_info;
3864         return result;
3865     } else {
3866         if (array_depth > MAX_ARRAY_DIMENSIONS)
3867             CCerror(context, "Array with too many dimensions");
3868         *full_info_p = MAKE_FULLINFO(GET_ITEM_TYPE(full_info),
3869                                      array_depth,
3870                                      GET_EXTRA_INFO(full_info));
3871         return 'A';
3872     }
3873 }
3874 
3875 
3876 /* Given an array type, create the type that has one less level of
3877  * indirection.
3878  */
3879 
3880 static fullinfo_type
3881 decrement_indirection(fullinfo_type array_info)
3882 {
3883     if (array_info == NULL_FULLINFO) {
3884         return NULL_FULLINFO;
3885     } else {
3886         int type = GET_ITEM_TYPE(array_info);
3887         int indirection = GET_INDIRECTION(array_info) - 1;
3888         int extra_info = GET_EXTRA_INFO(array_info);
3889         if (   (indirection == 0)
3890                && ((type == ITEM_Short || type == ITEM_Byte || type == ITEM_Boolean || type == ITEM_Char)))
3891             type = ITEM_Integer;
3892         return MAKE_FULLINFO(type, indirection, extra_info);
3893     }
3894 }
3895 
3896 
3897 /* See if we can assign an object of the "from" type to an object
3898  * of the "to" type.
3899  */
3900 
3901 static jboolean isAssignableTo(context_type *context,
3902                              fullinfo_type from, fullinfo_type to)
3903 {
3904     return (merge_fullinfo_types(context, from, to, JNI_TRUE) == to);
3905 }
3906 
3907 /* Given two fullinfo_type's, find their lowest common denominator.  If
3908  * the assignable_p argument is non-null, we're really just calling to find
3909  * out if "<target> := <value>" is a legitimate assignment.
3910  *
3911  * We treat all interfaces as if they were of type java/lang/Object, since the
3912  * runtime will do the full checking.
3913  */
3914 static fullinfo_type
3915 merge_fullinfo_types(context_type *context,
3916                      fullinfo_type value, fullinfo_type target,
3917                      jboolean for_assignment)
3918 {
3919     JNIEnv *env = context->env;
3920     if (value == target) {
3921         /* If they're identical, clearly just return what we've got */
3922         return value;
3923     }
3924 
3925     /* Both must be either arrays or objects to go further */
3926     if (GET_INDIRECTION(value) == 0 && GET_ITEM_TYPE(value) != ITEM_Object)
3927         return MAKE_FULLINFO(ITEM_Bogus, 0, 0);
3928     if (GET_INDIRECTION(target) == 0 && GET_ITEM_TYPE(target) != ITEM_Object)
3929         return MAKE_FULLINFO(ITEM_Bogus, 0, 0);
3930 
3931     /* If either is NULL, return the other. */
3932     if (value == NULL_FULLINFO)
3933         return target;
3934     else if (target == NULL_FULLINFO)
3935         return value;
3936 
3937     /* If either is java/lang/Object, that's the result. */
3938     if (target == context->object_info)
3939         return target;
3940     else if (value == context->object_info) {
3941         /* Minor hack.  For assignments, Interface := Object, return Interface
3942          * rather than Object, so that isAssignableTo() will get the right
3943          * result.      */
3944         if (for_assignment && (WITH_ZERO_EXTRA_INFO(target) ==
3945                                   MAKE_FULLINFO(ITEM_Object, 0, 0))) {
3946             jclass cb = object_fullinfo_to_classclass(context,
3947                                                       target);
3948             int is_interface = cb && JVM_IsInterface(env, cb);
3949             if (is_interface)
3950                 return target;
3951         }
3952         return value;
3953     }
3954     if (GET_INDIRECTION(value) > 0 || GET_INDIRECTION(target) > 0) {
3955         /* At least one is an array.  Neither is java/lang/Object or NULL.
3956          * Moreover, the types are not identical.
3957          * The result must either be Object, or an array of some object type.
3958          */
3959         fullinfo_type value_base, target_base;
3960         int dimen_value = GET_INDIRECTION(value);
3961         int dimen_target = GET_INDIRECTION(target);
3962 
3963         if (target == context->cloneable_info ||
3964             target == context->serializable_info) {
3965             return target;
3966         }
3967 
3968         if (value == context->cloneable_info ||
3969             value == context->serializable_info) {
3970             return value;
3971         }
3972 
3973         /* First, if either item's base type isn't ITEM_Object, promote it up
3974          * to an object or array of object.  If either is elemental, we can
3975          * punt.
3976          */
3977         if (GET_ITEM_TYPE(value) != ITEM_Object) {
3978             if (dimen_value == 0)
3979                 return MAKE_FULLINFO(ITEM_Bogus, 0, 0);
3980             dimen_value--;
3981             value = MAKE_Object_ARRAY(dimen_value);
3982 
3983         }
3984         if (GET_ITEM_TYPE(target) != ITEM_Object) {
3985             if (dimen_target == 0)
3986                 return MAKE_FULLINFO(ITEM_Bogus, 0, 0);
3987             dimen_target--;
3988             target = MAKE_Object_ARRAY(dimen_target);
3989         }
3990         /* Both are now objects or arrays of some sort of object type */
3991         value_base = WITH_ZERO_INDIRECTION(value);
3992         target_base = WITH_ZERO_INDIRECTION(target);
3993         if (dimen_value == dimen_target) {
3994             /* Arrays of the same dimension.  Merge their base types. */
3995             fullinfo_type  result_base =
3996                 merge_fullinfo_types(context, value_base, target_base,
3997                                             for_assignment);
3998             if (result_base == MAKE_FULLINFO(ITEM_Bogus, 0, 0))
3999                 /* bogus in, bogus out */
4000                 return result_base;
4001             return MAKE_FULLINFO(ITEM_Object, dimen_value,
4002                                  GET_EXTRA_INFO(result_base));
4003         } else {
4004             /* Arrays of different sizes. If the smaller dimension array's base
4005              * type is java/lang/Cloneable or java/io/Serializable, return it.
4006              * Otherwise return java/lang/Object with a dimension of the smaller
4007              * of the two */
4008             if (dimen_value < dimen_target) {
4009                 if (value_base == context->cloneable_info ||
4010                     value_base == context ->serializable_info) {
4011                     return value;
4012                 }
4013                 return MAKE_Object_ARRAY(dimen_value);
4014             } else {
4015                 if (target_base == context->cloneable_info ||
4016                     target_base == context->serializable_info) {
4017                     return target;
4018                 }
4019                 return MAKE_Object_ARRAY(dimen_target);
4020             }
4021         }
4022     } else {
4023         /* Both are non-array objects. Neither is java/lang/Object or NULL */
4024         jclass cb_value, cb_target, cb_super_value, cb_super_target;
4025         fullinfo_type result_info;
4026 
4027         /* Let's get the classes corresponding to each of these.  Treat
4028          * interfaces as if they were java/lang/Object.  See hack note above. */
4029         cb_target = object_fullinfo_to_classclass(context, target);
4030         if (cb_target == 0)
4031             return MAKE_FULLINFO(ITEM_Bogus, 0, 0);
4032         if (JVM_IsInterface(env, cb_target))
4033             return for_assignment ? target : context->object_info;
4034         cb_value = object_fullinfo_to_classclass(context, value);
4035         if (cb_value == 0)
4036             return MAKE_FULLINFO(ITEM_Bogus, 0, 0);
4037         if (JVM_IsInterface(env, cb_value))
4038             return context->object_info;
4039 
4040         /* If this is for assignment of target := value, we just need to see if
4041          * cb_target is a superclass of cb_value.  Save ourselves a lot of
4042          * work.
4043          */
4044         if (for_assignment) {
4045             cb_super_value = (*env)->GetSuperclass(env, cb_value);
4046             while (cb_super_value != 0) {
4047                 jclass tmp_cb;
4048                 if ((*env)->IsSameObject(env, cb_super_value, cb_target)) {
4049                     (*env)->DeleteLocalRef(env, cb_super_value);
4050                     return target;
4051                 }
4052                 tmp_cb =  (*env)->GetSuperclass(env, cb_super_value);
4053                 (*env)->DeleteLocalRef(env, cb_super_value);
4054                 cb_super_value = tmp_cb;
4055             }
4056             (*env)->DeleteLocalRef(env, cb_super_value);
4057             return context->object_info;
4058         }
4059 
4060         /* Find out whether cb_value or cb_target is deeper in the class
4061          * tree by moving both toward the root, and seeing who gets there
4062          * first.                                                          */
4063         cb_super_value = (*env)->GetSuperclass(env, cb_value);
4064         cb_super_target = (*env)->GetSuperclass(env, cb_target);
4065         while((cb_super_value != 0) &&
4066               (cb_super_target != 0)) {
4067             jclass tmp_cb;
4068             /* Optimization.  If either hits the other when going up looking
4069              * for a parent, then might as well return the parent immediately */
4070             if ((*env)->IsSameObject(env, cb_super_value, cb_target)) {
4071                 (*env)->DeleteLocalRef(env, cb_super_value);
4072                 (*env)->DeleteLocalRef(env, cb_super_target);
4073                 return target;
4074             }
4075             if ((*env)->IsSameObject(env, cb_super_target, cb_value)) {
4076                 (*env)->DeleteLocalRef(env, cb_super_value);
4077                 (*env)->DeleteLocalRef(env, cb_super_target);
4078                 return value;
4079             }
4080             tmp_cb = (*env)->GetSuperclass(env, cb_super_value);
4081             (*env)->DeleteLocalRef(env, cb_super_value);
4082             cb_super_value = tmp_cb;
4083 
4084             tmp_cb = (*env)->GetSuperclass(env, cb_super_target);
4085             (*env)->DeleteLocalRef(env, cb_super_target);
4086             cb_super_target = tmp_cb;
4087         }
4088         cb_value = (*env)->NewLocalRef(env, cb_value);
4089         cb_target = (*env)->NewLocalRef(env, cb_target);
4090         /* At most one of the following two while clauses will be executed.
4091          * Bring the deeper of cb_target and cb_value to the depth of the
4092          * shallower one.
4093          */
4094         while (cb_super_value != 0) {
4095           /* cb_value is deeper */
4096             jclass cb_tmp;
4097 
4098             cb_tmp = (*env)->GetSuperclass(env, cb_super_value);
4099             (*env)->DeleteLocalRef(env, cb_super_value);
4100             cb_super_value = cb_tmp;
4101 
4102             cb_tmp = (*env)->GetSuperclass(env, cb_value);
4103             (*env)->DeleteLocalRef(env, cb_value);
4104             cb_value = cb_tmp;
4105         }
4106         while (cb_super_target != 0) {
4107           /* cb_target is deeper */
4108             jclass cb_tmp;
4109 
4110             cb_tmp = (*env)->GetSuperclass(env, cb_super_target);
4111             (*env)->DeleteLocalRef(env, cb_super_target);
4112             cb_super_target = cb_tmp;
4113 
4114             cb_tmp = (*env)->GetSuperclass(env, cb_target);
4115             (*env)->DeleteLocalRef(env, cb_target);
4116             cb_target = cb_tmp;
4117         }
4118 
4119         /* Walk both up, maintaining equal depth, until a join is found.  We
4120          * know that we will find one.  */
4121         while (!(*env)->IsSameObject(env, cb_value, cb_target)) {
4122             jclass cb_tmp;
4123             cb_tmp = (*env)->GetSuperclass(env, cb_value);
4124             (*env)->DeleteLocalRef(env, cb_value);
4125             cb_value = cb_tmp;
4126             cb_tmp = (*env)->GetSuperclass(env, cb_target);
4127             (*env)->DeleteLocalRef(env, cb_target);
4128             cb_target = cb_tmp;
4129         }
4130         result_info = make_class_info(context, cb_value);
4131         (*env)->DeleteLocalRef(env, cb_value);
4132         (*env)->DeleteLocalRef(env, cb_super_value);
4133         (*env)->DeleteLocalRef(env, cb_target);
4134         (*env)->DeleteLocalRef(env, cb_super_target);
4135         return result_info;
4136     } /* both items are classes */
4137 }
4138 
4139 
4140 /* Given a fullinfo_type corresponding to an Object, return the jclass
4141  * of that type.
4142  *
4143  * This function always returns a global reference!
4144  */
4145 
4146 static jclass
4147 object_fullinfo_to_classclass(context_type *context, fullinfo_type classinfo)
4148 {
4149     unsigned short info = GET_EXTRA_INFO(classinfo);
4150     return ID_to_class(context, info);
4151 }
4152 
4153 static void free_block(void *ptr, int kind)
4154 {
4155     switch (kind) {
4156     case VM_STRING_UTF:
4157         JVM_ReleaseUTF(ptr);
4158         break;
4159     case VM_MALLOC_BLK:
4160         free(ptr);
4161         break;
4162     }
4163 }
4164 
4165 static void check_and_push_common(context_type *context, void *ptr, int kind)
4166 {
4167     alloc_stack_type *p;
4168     if (ptr == 0)
4169         CCout_of_memory(context);
4170     if (context->alloc_stack_top < ALLOC_STACK_SIZE)
4171         p = &(context->alloc_stack[context->alloc_stack_top++]);
4172     else {
4173         /* Otherwise we have to malloc */
4174         p = malloc(sizeof(alloc_stack_type));
4175         if (p == 0) {
4176             /* Make sure we clean up. */
4177             free_block(ptr, kind);
4178             CCout_of_memory(context);
4179         }
4180     }
4181     p->kind = kind;
4182     p->ptr = ptr;
4183     p->next = context->allocated_memory;
4184     context->allocated_memory = p;
4185 }
4186 
4187 static void check_and_push_malloc_block(context_type *context, void *ptr) {
4188   check_and_push_common(context, ptr, VM_MALLOC_BLK);
4189 }
4190 
4191 static void check_and_push_string_utf(context_type *context, const char *ptr) {
4192   check_and_push_common(context, (void *)ptr, VM_STRING_UTF);
4193 }
4194 
4195 static void pop_and_free(context_type *context)
4196 {
4197     alloc_stack_type *p = context->allocated_memory;
4198     context->allocated_memory = p->next;
4199     free_block(p->ptr, p->kind);
4200     if (p < context->alloc_stack + ALLOC_STACK_SIZE &&
4201         p >= context->alloc_stack)
4202         context->alloc_stack_top--;
4203     else
4204         free(p);
4205 }
4206 
4207 static int signature_to_args_size(const char *method_signature)
4208 {
4209     const char *p;
4210     int args_size = 0;
4211     for (p = method_signature; *p != JVM_SIGNATURE_ENDFUNC; p++) {
4212         switch (*p) {
4213           case JVM_SIGNATURE_BOOLEAN:
4214           case JVM_SIGNATURE_BYTE:
4215           case JVM_SIGNATURE_CHAR:
4216           case JVM_SIGNATURE_SHORT:
4217           case JVM_SIGNATURE_INT:
4218           case JVM_SIGNATURE_FLOAT:
4219             args_size += 1;
4220             break;
4221           case JVM_SIGNATURE_CLASS:
4222             args_size += 1;
4223             while (*p != JVM_SIGNATURE_ENDCLASS) p++;
4224             break;
4225           case JVM_SIGNATURE_ARRAY:
4226             args_size += 1;
4227             while ((*p == JVM_SIGNATURE_ARRAY)) p++;
4228             /* If an array of classes, skip over class name, too. */
4229             if (*p == JVM_SIGNATURE_CLASS) {
4230                 while (*p != JVM_SIGNATURE_ENDCLASS)
4231                   p++;
4232             }
4233             break;
4234           case JVM_SIGNATURE_DOUBLE:
4235           case JVM_SIGNATURE_LONG:
4236             args_size += 2;
4237             break;
4238           case JVM_SIGNATURE_FUNC:  /* ignore initial (, if given */
4239             break;
4240           default:
4241             /* Indicate an error. */
4242             return 0;
4243         }
4244     }
4245     return args_size;
4246 }
4247 
4248 #ifdef DEBUG
4249 
4250 /* Below are for debugging. */
4251 
4252 static void print_fullinfo_type(context_type *, fullinfo_type, jboolean);
4253 
4254 static void
4255 print_stack(context_type *context, stack_info_type *stack_info)
4256 {
4257     stack_item_type *stack = stack_info->stack;
4258     if (stack_info->stack_size == UNKNOWN_STACK_SIZE) {
4259         jio_fprintf(stdout, "x");
4260     } else {
4261         jio_fprintf(stdout, "(");
4262         for ( ; stack != 0; stack = stack->next)
4263             print_fullinfo_type(context, stack->item,
4264                 (jboolean)(verify_verbose > 1 ? JNI_TRUE : JNI_FALSE));
4265         jio_fprintf(stdout, ")");
4266     }
4267 }
4268 
4269 static void
4270 print_registers(context_type *context, register_info_type *register_info)
4271 {
4272     int register_count = register_info->register_count;
4273     if (register_count == UNKNOWN_REGISTER_COUNT) {
4274         jio_fprintf(stdout, "x");
4275     } else {
4276         fullinfo_type *registers = register_info->registers;
4277         int mask_count = register_info->mask_count;
4278         mask_type *masks = register_info->masks;
4279         int i, j;
4280 
4281         jio_fprintf(stdout, "{");
4282         for (i = 0; i < register_count; i++)
4283             print_fullinfo_type(context, registers[i],
4284                 (jboolean)(verify_verbose > 1 ? JNI_TRUE : JNI_FALSE));
4285         jio_fprintf(stdout, "}");
4286         for (i = 0; i < mask_count; i++) {
4287             char *separator = "";
4288             int *modifies = masks[i].modifies;
4289             jio_fprintf(stdout, "<%d: ", masks[i].entry);
4290             for (j = 0;
4291                  j < JVM_GetMethodIxLocalsCount(context->env,
4292                                                 context->class,
4293                                                 context->method_index);
4294                  j++)
4295                 if (IS_BIT_SET(modifies, j)) {
4296                     jio_fprintf(stdout, "%s%d", separator, j);
4297                     separator = ",";
4298                 }
4299             jio_fprintf(stdout, ">");
4300         }
4301     }
4302 }
4303 
4304 
4305 static void
4306 print_flags(context_type *context, flag_type and_flags, flag_type or_flags)
4307 {
4308     if (and_flags != ((flag_type)-1) || or_flags != 0) {
4309         jio_fprintf(stdout, "<%x %x>", and_flags, or_flags);
4310     }
4311 }
4312 
4313 static void
4314 print_fullinfo_type(context_type *context, fullinfo_type type, jboolean verbose)
4315 {
4316     int i;
4317     int indirection = GET_INDIRECTION(type);
4318     for (i = indirection; i-- > 0; )
4319         jio_fprintf(stdout, "[");
4320     switch (GET_ITEM_TYPE(type)) {
4321         case ITEM_Integer:
4322             jio_fprintf(stdout, "I"); break;
4323         case ITEM_Float:
4324             jio_fprintf(stdout, "F"); break;
4325         case ITEM_Double:
4326             jio_fprintf(stdout, "D"); break;
4327         case ITEM_Double_2:
4328             jio_fprintf(stdout, "d"); break;
4329         case ITEM_Long:
4330             jio_fprintf(stdout, "L"); break;
4331         case ITEM_Long_2:
4332             jio_fprintf(stdout, "l"); break;
4333         case ITEM_ReturnAddress:
4334             jio_fprintf(stdout, "a"); break;
4335         case ITEM_Object:
4336             if (!verbose) {
4337                 jio_fprintf(stdout, "A");
4338             } else {
4339                 unsigned short extra = GET_EXTRA_INFO(type);
4340                 if (extra == 0) {
4341                     jio_fprintf(stdout, "/Null/");
4342                 } else {
4343                     const char *name = ID_to_class_name(context, extra);
4344                     const char *name2 = strrchr(name, '/');
4345                     jio_fprintf(stdout, "/%s/", name2 ? name2 + 1 : name);
4346                 }
4347             }
4348             break;
4349         case ITEM_Char:
4350             jio_fprintf(stdout, "C"); break;
4351         case ITEM_Short:
4352             jio_fprintf(stdout, "S"); break;
4353         case ITEM_Boolean:
4354             jio_fprintf(stdout, "Z"); break;
4355         case ITEM_Byte:
4356             jio_fprintf(stdout, "B"); break;
4357         case ITEM_NewObject:
4358             if (!verbose) {
4359                 jio_fprintf(stdout, "@");
4360             } else {
4361                 int inum = GET_EXTRA_INFO(type);
4362                 fullinfo_type real_type =
4363                     context->instruction_data[inum].operand2.fi;
4364                 jio_fprintf(stdout, ">");
4365                 print_fullinfo_type(context, real_type, JNI_TRUE);
4366                 jio_fprintf(stdout, "<");
4367             }
4368             break;
4369         case ITEM_InitObject:
4370             jio_fprintf(stdout, verbose ? ">/this/<" : "@");
4371             break;
4372 
4373         default:
4374             jio_fprintf(stdout, "?"); break;
4375     }
4376     for (i = indirection; i-- > 0; )
4377         jio_fprintf(stdout, "]");
4378 }
4379 
4380 
4381 static void
4382 print_formatted_fieldname(context_type *context, int index)
4383 {
4384     JNIEnv *env = context->env;
4385     jclass cb = context->class;
4386     const char *classname = JVM_GetCPFieldClassNameUTF(env, cb, index);
4387     const char *fieldname = JVM_GetCPFieldNameUTF(env, cb, index);
4388     jio_fprintf(stdout, "  <%s.%s>",
4389                 classname ? classname : "", fieldname ? fieldname : "");
4390     JVM_ReleaseUTF(classname);
4391     JVM_ReleaseUTF(fieldname);
4392 }
4393 
4394 static void
4395 print_formatted_methodname(context_type *context, int index)
4396 {
4397     JNIEnv *env = context->env;
4398     jclass cb = context->class;
4399     const char *classname = JVM_GetCPMethodClassNameUTF(env, cb, index);
4400     const char *methodname = JVM_GetCPMethodNameUTF(env, cb, index);
4401     jio_fprintf(stdout, "  <%s.%s>",
4402                 classname ? classname : "", methodname ? methodname : "");
4403     JVM_ReleaseUTF(classname);
4404     JVM_ReleaseUTF(methodname);
4405 }
4406 
4407 #endif /*DEBUG*/