// be many `ret' instructions, so a linked list is ok.
subr_entry_info *entry_points;
- // The current top of the stack, in terms of slots.
- int stacktop;
- // The current depth of the stack. This will be larger than
- // STACKTOP when wide types are on the stack.
- int stackdepth;
-
// The bytecode itself.
unsigned char *bytecode;
// The exceptions.
if (target->isPrimitive () || source->isPrimitive ())
return false;
- // Check array case first because we can have an array whose
- // component type is not prepared; _Jv_IsAssignableFrom
- // doesn't handle this correctly.
if (target->isArray ())
{
if (! source->isArray ())
target = target->getComponentType ();
source = source->getComponentType ();
}
- // _Jv_IsAssignableFrom can handle a target which is an
- // interface even if it hasn't been prepared.
- else if ((target->state > JV_STATE_LINKED || target->isInterface ())
- && source->state > JV_STATE_LINKED)
- return _Jv_IsAssignableFrom (target, source);
else if (target->isInterface ())
{
for (int i = 0; i < source->interface_count; ++i)
if (source == NULL)
return false;
}
+ // We must do this check before we check to see if SOURCE is
+ // an interface. This way we know that any interface is
+ // assignable to an Object.
else if (target == &java::lang::Object::class$)
return true;
- else if (source->isInterface ()
- || source == &java::lang::Object::class$)
+ else if (source->isInterface ())
+ {
+ for (int i = 0; i < target->interface_count; ++i)
+ {
+ // We use a recursive call because we also need to
+ // check superinterfaces.
+ if (is_assignable_from_slow (target->interfaces[i], source))
+ return true;
+ }
+ target = target->getSuperclass ();
+ if (target == NULL)
+ return false;
+ }
+ else if (source == &java::lang::Object::class$)
return false;
else
source = source->getSuperclass ();
using namespace java::lang;
java::lang::ClassLoader *loader
- = verifier->current_class->getClassLoader();
+ = verifier->current_class->getClassLoaderInternal();
// We might see either kind of name. Sigh.
if (data.name->data[0] == 'L'
&& data.name->data[data.name->length - 1] == ';')
if (key < reference_type || k.key < reference_type)
return key == k.key;
- // The `null' type is convertible to any reference type.
- // FIXME: is this correct for THIS?
+ // The `null' type is convertible to any initialized reference
+ // type.
if (key == null_type || k.key == null_type)
return true;
return false;
}
+ bool isnull () const
+ {
+ return key == null_type;
+ }
+
bool isinterface (_Jv_BytecodeVerifier *verifier)
{
resolve (verifier);
if (key == reference_type)
return type (_Jv_GetArrayClass (data.klass,
- data.klass->getClassLoader ()));
+ data.klass->getClassLoaderInternal()));
else
verifier->verify_fail ("internal error in type::to_array()");
}
oldk = oldk->getComponentType ();
}
- // This loop will end when we hit Object.
- while (true)
+ // Ordinarily this terminates when we hit Object...
+ while (k != NULL)
{
if (is_assignable_from_slow (k, oldk))
break;
k = k->getSuperclass ();
changed = true;
}
+ // ... but K could have been an interface, in which
+ // case we'll end up here. We just convert this
+ // into Object.
+ if (k == NULL)
+ k = &java::lang::Object::class$;
if (changed)
{
while (arraycount > 0)
{
java::lang::ClassLoader *loader
- = verifier->current_class->getClassLoader();
+ = verifier->current_class->getClassLoaderInternal();
k = _Jv_GetArrayClass (k, loader);
--arraycount;
}
// location.
struct state
{
- // Current top of stack.
+ // The current top of the stack, in terms of slots.
int stacktop;
- // Current stack depth. This is like the top of stack but it
- // includes wide variable information.
+ // The current depth of the stack. This will be larger than
+ // STACKTOP when wide types are on the stack.
int stackdepth;
// The stack.
type *stack;
// NO_NEXT marks the state at the end of the reverification list.
static const int NO_NEXT = -2;
+ // This is used to mark the stack depth at the instruction just
+ // after a `jsr' when we haven't yet processed the corresponding
+ // `ret'. See handle_jsr_insn for more information.
+ static const int NO_STACK = -1;
+
state ()
: this_type ()
{
stack[0] = t;
for (int i = stacktop; i < max_stack; ++i)
stack[i] = unsuitable_type;
+ }
- // FIXME: subroutine handling?
+ // Modify this state to reflect entry into a subroutine.
+ void enter_subroutine (int npc, int max_locals)
+ {
+ subroutine = npc;
+ // Mark all items as unchanged. Each subroutine needs to keep
+ // track of its `changed' state independently. In the case of
+ // nested subroutines, this information will be merged back into
+ // parent by the `ret'.
+ for (int i = 0; i < max_locals; ++i)
+ local_changed[i] = false;
}
// Merge STATE_OLD into this state. Destructively modifies this
changed = true;
}
- // Merge stacks.
- if (state_old->stacktop != stacktop)
+ // Merge stacks. Special handling for NO_STACK case.
+ if (state_old->stacktop == NO_STACK)
+ {
+ // Nothing to do in this case; we don't care about modifying
+ // the old state.
+ }
+ else if (stacktop == NO_STACK)
+ {
+ stacktop = state_old->stacktop;
+ stackdepth = state_old->stackdepth;
+ for (int i = 0; i < stacktop; ++i)
+ stack[i] = state_old->stack[i];
+ changed = true;
+ }
+ else if (state_old->stacktop != stacktop)
verifier->verify_fail ("stack sizes differ");
- for (int i = 0; i < state_old->stacktop; ++i)
+ else
{
- if (stack[i].merge (state_old->stack[i], false, verifier))
- changed = true;
+ for (int i = 0; i < state_old->stacktop; ++i)
+ {
+ if (stack[i].merge (state_old->stack[i], false, verifier))
+ changed = true;
+ }
}
// Merge local variables.
for (int i = 0; i < max_locals; ++i)
{
- if (! ret_semantics || local_changed[i])
+ // If we're not processing a `ret', then we merge every
+ // local variable. If we are processing a `ret', then we
+ // only merge locals which changed in the subroutine. When
+ // processing a `ret', STATE_OLD is the state at the point
+ // of the `ret', and THIS is the state just after the `jsr'.
+ if (! ret_semantics || state_old->local_changed[i])
{
if (locals[i].merge (state_old->locals[i], true, verifier))
{
+ // Note that we don't call `note_variable' here.
+ // This change doesn't represent a real change to a
+ // local, but rather a merge artifact. If we're in
+ // a subroutine which is called with two
+ // incompatible types in a slot that is unused by
+ // the subroutine, then we don't want to mark that
+ // variable as having been modified.
changed = true;
- note_variable (i);
}
}
// Return true if this state is the unmerged result of a `ret'.
bool is_unmerged_ret_state (int max_locals) const
{
+ if (stacktop == NO_STACK)
+ return true;
for (int i = 0; i < max_locals; ++i)
{
if (locals[i].key == unused_by_subroutine_type)
debug_print (".");
debug_print (" [local] ");
for (i = 0; i < max_locals; ++i)
- locals[i].print ();
+ {
+ locals[i].print ();
+ debug_print (local_changed[i] ? "+" : " ");
+ }
if (subroutine == 0)
debug_print (" | None");
else
return t;
}
+ // Pop a reference which is guaranteed to be initialized. MATCH
+ // doesn't have to be a reference type; in this case this acts like
+ // pop_type.
+ type pop_init_ref (type match)
+ {
+ type t = pop_raw ();
+ if (t.isreference () && ! t.isinitialized ())
+ verify_fail ("initialized reference required");
+ else if (! match.compatible (t, this))
+ verify_fail ("incompatible type on stack");
+ return t;
+ }
+
// Pop a reference type or a return address.
type pop_ref_or_return ()
{
// compatible with type ELEMENT. Returns the actual element type.
type require_array_type (type array, type element)
{
+ // An odd case. Here we just pretend that everything went ok. If
+ // the requested element type is some kind of reference, return
+ // the null type instead.
+ if (array.isnull ())
+ return element.isreference () ? type (null_type) : element;
+
if (! array.isarray ())
verify_fail ("array required");
this, true);
state s (current_state, current_method->max_stack,
current_method->max_locals);
+ if (current_method->max_stack < 1)
+ verify_fail ("stack overflow at exception handler");
s.set_exception (t, current_method->max_stack);
push_jump_merge (pc, &s);
}
npc = states[npc]->next;
}
- // If we've skipped states and there is nothing else, that's a
- // bug.
- if (skipped)
- verify_fail ("pop_jump: can't happen");
+ // Note that we might have gotten here even when there are
+ // remaining states to process. That can happen if we find a
+ // `jsr' without a `ret'.
return state::NO_NEXT;
}
current_state->check_no_uninitialized_objects (current_method->max_locals, this);
check_nonrecursive_call (current_state->subroutine, npc);
- // Temporarily modify the current state so that it looks like we are
- // in the subroutine.
+ // Modify our state as appropriate for entry into a subroutine.
push_type (return_address_type);
- int save = current_state->subroutine;
- current_state->subroutine = npc;
-
- // Merge into the subroutine.
push_jump_merge (npc, current_state);
-
- // Undo our modifications.
- current_state->subroutine = save;
+ // Clean up.
pop_type (return_address_type);
+
+ // On entry to the subroutine, the subroutine number must be set
+ // and the locals must be marked as cleared. We do this after
+ // merging state so that we don't erroneously "notice" a variable
+ // change merely on entry.
+ states[npc]->enter_subroutine (npc, current_method->max_locals);
+
+ // Indicate that we don't know the stack depth of the instruction
+ // following the `jsr'. The idea here is that we need to merge
+ // the local variable state across the jsr, but the subroutine
+ // might change the stack depth, so we can't make any assumptions
+ // about it. So we have yet another special case. We know that
+ // at this point PC points to the instruction after the jsr.
+
+ // FIXME: what if we have a jsr at the end of the code, but that
+ // jsr has no corresponding ret? Is this verifiable, or is it
+ // not? If it is then we need a special case here.
+ if (PC >= current_method->code_length)
+ verify_fail ("fell off end");
+
+ current_state->stacktop = state::NO_STACK;
+ push_jump_merge (PC, current_state);
+ invalidate_pc ();
}
jclass construct_primitive_array_type (type_val prim)
case long_type:
k = JvPrimClass (long);
break;
+
+ // These aren't used here but we call them out to avoid
+ // warnings.
+ case void_type:
+ case unsuitable_type:
+ case return_address_type:
+ case continuation_type:
+ case unused_by_subroutine_type:
+ case reference_type:
+ case null_type:
+ case unresolved_reference_type:
+ case uninitialized_reference_type:
+ case uninitialized_unresolved_reference_type:
default:
verify_fail ("unknown type in construct_primitive_array_type");
}
note_branch_target (compute_jump (get_int ()), last_was_jsr);
break;
+ // These are unused here, but we call them out explicitly
+ // so that -Wswitch-enum doesn't complain.
+ case op_putfield_1:
+ case op_putfield_2:
+ case op_putfield_4:
+ case op_putfield_8:
+ case op_putfield_a:
+ case op_putstatic_1:
+ case op_putstatic_2:
+ case op_putstatic_4:
+ case op_putstatic_8:
+ case op_putstatic_a:
+ case op_getfield_1:
+ case op_getfield_2s:
+ case op_getfield_2u:
+ case op_getfield_4:
+ case op_getfield_8:
+ case op_getfield_a:
+ case op_getstatic_1:
+ case op_getstatic_2s:
+ case op_getstatic_2u:
+ case op_getstatic_4:
+ case op_getstatic_8:
+ case op_getstatic_a:
default:
verify_fail ("unrecognized instruction in branch_prepass",
start_PC);
// Verify exception handlers.
for (int i = 0; i < current_method->exc_count; ++i)
{
- if (! (flags[exception[i].handler_pc] & FLAG_INSN_START))
+ if (! (flags[exception[i].handler_pc.i] & FLAG_INSN_START))
verify_fail ("exception handler not at instruction start",
- exception[i].handler_pc);
- if (! (flags[exception[i].start_pc] & FLAG_INSN_START))
+ exception[i].handler_pc.i);
+ if (! (flags[exception[i].start_pc.i] & FLAG_INSN_START))
verify_fail ("exception start not at instruction start",
- exception[i].start_pc);
- if (exception[i].end_pc != current_method->code_length
- && ! (flags[exception[i].end_pc] & FLAG_INSN_START))
+ exception[i].start_pc.i);
+ if (exception[i].end_pc.i != current_method->code_length
+ && ! (flags[exception[i].end_pc.i] & FLAG_INSN_START))
verify_fail ("exception end not at instruction start",
- exception[i].end_pc);
+ exception[i].end_pc.i);
- flags[exception[i].handler_pc] |= FLAG_BRANCH_TARGET;
+ flags[exception[i].handler_pc.i] |= FLAG_BRANCH_TARGET;
}
}
verify_fail ("can't happen: saw state::INVALID");
if (PC == state::NO_NEXT)
break;
+ debug_print ("== State pop from pending list\n");
// Set up the current state.
current_state->copy (states[PC], current_method->max_stack,
current_method->max_locals);
// through them all.
for (int i = 0; i < current_method->exc_count; ++i)
{
- if (PC >= exception[i].start_pc && PC < exception[i].end_pc)
+ if (PC >= exception[i].start_pc.i && PC < exception[i].end_pc.i)
{
type handler (&java::lang::Throwable::class$);
- if (exception[i].handler_type != 0)
- handler = check_class_constant (exception[i].handler_type);
- push_exception_jump (handler, exception[i].handler_pc);
+ if (exception[i].handler_type.i != 0)
+ handler = check_class_constant (exception[i].handler_type.i);
+ push_exception_jump (handler, exception[i].handler_pc.i);
}
}
break;
case op_iaload:
pop_type (int_type);
- push_type (require_array_type (pop_type (reference_type),
+ push_type (require_array_type (pop_init_ref (reference_type),
int_type));
break;
case op_laload:
pop_type (int_type);
- push_type (require_array_type (pop_type (reference_type),
+ push_type (require_array_type (pop_init_ref (reference_type),
long_type));
break;
case op_faload:
pop_type (int_type);
- push_type (require_array_type (pop_type (reference_type),
+ push_type (require_array_type (pop_init_ref (reference_type),
float_type));
break;
case op_daload:
pop_type (int_type);
- push_type (require_array_type (pop_type (reference_type),
+ push_type (require_array_type (pop_init_ref (reference_type),
double_type));
break;
case op_aaload:
pop_type (int_type);
- push_type (require_array_type (pop_type (reference_type),
+ push_type (require_array_type (pop_init_ref (reference_type),
reference_type));
break;
case op_baload:
pop_type (int_type);
- require_array_type (pop_type (reference_type), byte_type);
+ require_array_type (pop_init_ref (reference_type), byte_type);
push_type (int_type);
break;
case op_caload:
pop_type (int_type);
- require_array_type (pop_type (reference_type), char_type);
+ require_array_type (pop_init_ref (reference_type), char_type);
push_type (int_type);
break;
case op_saload:
pop_type (int_type);
- require_array_type (pop_type (reference_type), short_type);
+ require_array_type (pop_init_ref (reference_type), short_type);
push_type (int_type);
break;
case op_istore:
case op_iastore:
pop_type (int_type);
pop_type (int_type);
- require_array_type (pop_type (reference_type), int_type);
+ require_array_type (pop_init_ref (reference_type), int_type);
break;
case op_lastore:
pop_type (long_type);
pop_type (int_type);
- require_array_type (pop_type (reference_type), long_type);
+ require_array_type (pop_init_ref (reference_type), long_type);
break;
case op_fastore:
pop_type (float_type);
pop_type (int_type);
- require_array_type (pop_type (reference_type), float_type);
+ require_array_type (pop_init_ref (reference_type), float_type);
break;
case op_dastore:
pop_type (double_type);
pop_type (int_type);
- require_array_type (pop_type (reference_type), double_type);
+ require_array_type (pop_init_ref (reference_type), double_type);
break;
case op_aastore:
pop_type (reference_type);
pop_type (int_type);
- require_array_type (pop_type (reference_type), reference_type);
+ require_array_type (pop_init_ref (reference_type), reference_type);
break;
case op_bastore:
pop_type (int_type);
pop_type (int_type);
- require_array_type (pop_type (reference_type), byte_type);
+ require_array_type (pop_init_ref (reference_type), byte_type);
break;
case op_castore:
pop_type (int_type);
pop_type (int_type);
- require_array_type (pop_type (reference_type), char_type);
+ require_array_type (pop_init_ref (reference_type), char_type);
break;
case op_sastore:
pop_type (int_type);
pop_type (int_type);
- require_array_type (pop_type (reference_type), short_type);
+ require_array_type (pop_init_ref (reference_type), short_type);
break;
case op_pop:
pop32 ();
push_type (t);
push_type (t2);
}
+ else
+ push_type (t);
push_type (t);
}
break;
invalidate_pc ();
break;
case op_areturn:
- check_return_type (pop_type (reference_type));
+ check_return_type (pop_init_ref (reference_type));
invalidate_pc ();
break;
case op_return:
// This is only used for verifying the byte for
// invokeinterface.
nargs -= arg_types[i].depth ();
- pop_type (arg_types[i]);
+ pop_init_ref (arg_types[i]);
}
if (opcode == op_invokeinterface
// In this case the PC doesn't matter.
t.set_uninitialized (type::UNINIT, this);
}
- t = pop_type (t);
+ type raw = pop_raw ();
+ bool ok = false;
+ if (! is_init && ! raw.isinitialized ())
+ {
+ // This is a failure.
+ }
+ else if (is_init && raw.isnull ())
+ {
+ // Another failure.
+ }
+ else if (t.compatible (raw, this))
+ {
+ ok = true;
+ }
+ else if (opcode == op_invokeinterface)
+ {
+ // This is a hack. We might have merged two
+ // items and gotten `Object'. This can happen
+ // because we don't keep track of where merges
+ // come from. This is safe as long as the
+ // interpreter checks interfaces at runtime.
+ type obj (&java::lang::Object::class$);
+ ok = raw.compatible (obj, this);
+ }
+
+ if (! ok)
+ verify_fail ("incompatible type on stack");
+
if (is_init)
- current_state->set_initialized (t.get_pc (),
+ current_state->set_initialized (raw.get_pc (),
current_method->max_locals);
}
break;
case op_arraylength:
{
- type t = pop_type (reference_type);
- if (! t.isarray ())
+ type t = pop_init_ref (reference_type);
+ if (! t.isarray () && ! t.isnull ())
verify_fail ("array type expected");
push_type (int_type);
}
invalidate_pc ();
break;
case op_checkcast:
- pop_type (reference_type);
+ pop_init_ref (reference_type);
push_type (check_class_constant (get_ushort ()));
break;
case op_instanceof:
- pop_type (reference_type);
+ pop_init_ref (reference_type);
check_class_constant (get_ushort ());
push_type (int_type);
break;
case op_monitorenter:
- pop_type (reference_type);
+ pop_init_ref (reference_type);
break;
case op_monitorexit:
- pop_type (reference_type);
+ pop_init_ref (reference_type);
break;
case op_wide:
{
set_variable (get_ushort (), pop_type (double_type));
break;
case op_astore:
- set_variable (get_ushort (), pop_type (reference_type));
+ set_variable (get_ushort (), pop_init_ref (reference_type));
break;
case op_ret:
handle_ret_insn (get_short ());
handle_jsr_insn (get_int ());
break;
+ // These are unused here, but we call them out explicitly
+ // so that -Wswitch-enum doesn't complain.
+ case op_putfield_1:
+ case op_putfield_2:
+ case op_putfield_4:
+ case op_putfield_8:
+ case op_putfield_a:
+ case op_putstatic_1:
+ case op_putstatic_2:
+ case op_putstatic_4:
+ case op_putstatic_8:
+ case op_putstatic_a:
+ case op_getfield_1:
+ case op_getfield_2s:
+ case op_getfield_2u:
+ case op_getfield_4:
+ case op_getfield_8:
+ case op_getfield_a:
+ case op_getstatic_1:
+ case op_getstatic_2s:
+ case op_getstatic_2u:
+ case op_getstatic_4:
+ case op_getstatic_8:
+ case op_getstatic_a:
default:
// Unrecognized opcode.
verify_fail ("unrecognized instruction in verify_instructions_0",
OSDN Git Service
