Mercurial > hg > truffle
annotate src/share/vm/classfile/stackMapTable.cpp @ 1769:1ab9e2cbfa0e
6870851: Bad frame_chop in StackMapTable crashes JVM
Summary: Must check locals for null when processing chop frame
Reviewed-by: dholmes, dcubed
| author | kamg |
|---|---|
| date | Fri, 03 Sep 2010 14:47:05 -0400 |
| parents | c18cbe5936b8 |
| children | f95d63e2154a |
| rev | line source |
|---|---|
| 0 | 1 /* |
| 1769 | 2 * Copyright (c) 2003, 2010, Oracle and/or its affiliates. All rights reserved. |
| 0 | 3 * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER. |
| 4 * | |
| 5 * This code is free software; you can redistribute it and/or modify it | |
| 6 * under the terms of the GNU General Public License version 2 only, as | |
| 7 * published by the Free Software Foundation. | |
| 8 * | |
| 9 * This code is distributed in the hope that it will be useful, but WITHOUT | |
| 10 * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or | |
| 11 * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License | |
| 12 * version 2 for more details (a copy is included in the LICENSE file that | |
| 13 * accompanied this code). | |
| 14 * | |
| 15 * You should have received a copy of the GNU General Public License version | |
| 16 * 2 along with this work; if not, write to the Free Software Foundation, | |
| 17 * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA. | |
| 18 * | |
|
1552
c18cbe5936b8
6941466: Oracle rebranding changes for Hotspot repositories
trims
parents:
0
diff
changeset
|
19 * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA |
|
c18cbe5936b8
6941466: Oracle rebranding changes for Hotspot repositories
trims
parents:
0
diff
changeset
|
20 * or visit www.oracle.com if you need additional information or have any |
|
c18cbe5936b8
6941466: Oracle rebranding changes for Hotspot repositories
trims
parents:
0
diff
changeset
|
21 * questions. |
| 0 | 22 * |
| 23 */ | |
| 24 | |
| 25 # include "incls/_precompiled.incl" | |
| 26 # include "incls/_stackMapTable.cpp.incl" | |
| 27 | |
| 28 StackMapTable::StackMapTable(StackMapReader* reader, StackMapFrame* init_frame, | |
| 29 u2 max_locals, u2 max_stack, | |
| 30 char* code_data, int code_len, TRAPS) { | |
| 31 _code_length = code_len; | |
| 32 _frame_count = reader->get_frame_count(); | |
| 33 if (_frame_count > 0) { | |
| 34 _frame_array = NEW_RESOURCE_ARRAY_IN_THREAD(THREAD, | |
| 35 StackMapFrame*, _frame_count); | |
| 36 StackMapFrame* pre_frame = init_frame; | |
| 37 for (int32_t i = 0; i < _frame_count; i++) { | |
| 38 StackMapFrame* frame = reader->next( | |
| 39 pre_frame, i == 0, max_locals, max_stack, | |
| 40 CHECK_VERIFY(pre_frame->verifier())); | |
| 41 _frame_array[i] = frame; | |
| 42 int offset = frame->offset(); | |
| 43 if (offset >= code_len || code_data[offset] == 0) { | |
| 44 frame->verifier()->verify_error("StackMapTable error: bad offset"); | |
| 45 return; | |
| 46 } | |
| 47 pre_frame = frame; | |
| 48 } | |
| 49 } | |
| 50 reader->check_end(CHECK); | |
| 51 } | |
| 52 | |
| 53 // This method is only called by method in StackMapTable. | |
| 54 int StackMapTable::get_index_from_offset(int32_t offset) const { | |
| 55 int i = 0; | |
| 56 for (; i < _frame_count; i++) { | |
| 57 if (_frame_array[i]->offset() == offset) { | |
| 58 return i; | |
| 59 } | |
| 60 } | |
| 61 return i; // frame with offset doesn't exist in the array | |
| 62 } | |
| 63 | |
| 64 bool StackMapTable::match_stackmap( | |
| 65 StackMapFrame* frame, int32_t target, | |
| 66 bool match, bool update, TRAPS) const { | |
| 67 int index = get_index_from_offset(target); | |
| 68 | |
| 69 return match_stackmap( | |
| 70 frame, target, index, match, | |
| 71 update, CHECK_VERIFY_(frame->verifier(), false)); | |
| 72 } | |
| 73 | |
| 74 // Match and/or update current_frame to the frame in stackmap table with | |
| 75 // specified offset and frame index. Return true if the two frames match. | |
| 76 // | |
| 77 // The values of match and update are: _match__update_ | |
| 78 // | |
| 79 // checking a branch target/exception handler: true false | |
| 80 // linear bytecode verification following an | |
| 81 // unconditional branch: false true | |
| 82 // linear bytecode verification not following an | |
| 83 // unconditional branch: true true | |
| 84 bool StackMapTable::match_stackmap( | |
| 85 StackMapFrame* frame, int32_t target, int32_t frame_index, | |
| 86 bool match, bool update, TRAPS) const { | |
| 87 if (frame_index < 0 || frame_index >= _frame_count) { | |
| 88 frame->verifier()->verify_error(frame->offset(), | |
| 89 "Expecting a stackmap frame at branch target %d", target); | |
| 90 return false; | |
| 91 } | |
| 92 | |
| 93 bool result = true; | |
| 94 StackMapFrame *stackmap_frame = _frame_array[frame_index]; | |
| 95 if (match) { | |
| 96 // Has direct control flow from last instruction, need to match the two | |
| 97 // frames. | |
| 98 result = frame->is_assignable_to( | |
| 99 stackmap_frame, CHECK_VERIFY_(frame->verifier(), false)); | |
| 100 } | |
| 101 if (update) { | |
| 102 // Use the frame in stackmap table as current frame | |
| 103 int lsize = stackmap_frame->locals_size(); | |
| 104 int ssize = stackmap_frame->stack_size(); | |
| 105 if (frame->locals_size() > lsize || frame->stack_size() > ssize) { | |
| 106 // Make sure unused type array items are all _bogus_type. | |
| 107 frame->reset(); | |
| 108 } | |
| 109 frame->set_locals_size(lsize); | |
| 110 frame->copy_locals(stackmap_frame); | |
| 111 frame->set_stack_size(ssize); | |
| 112 frame->copy_stack(stackmap_frame); | |
| 113 frame->set_flags(stackmap_frame->flags()); | |
| 114 } | |
| 115 return result; | |
| 116 } | |
| 117 | |
| 118 void StackMapTable::check_jump_target( | |
| 119 StackMapFrame* frame, int32_t target, TRAPS) const { | |
| 120 bool match = match_stackmap( | |
| 121 frame, target, true, false, CHECK_VERIFY(frame->verifier())); | |
| 122 if (!match || (target < 0 || target >= _code_length)) { | |
| 123 frame->verifier()->verify_error(frame->offset(), | |
| 124 "Inconsistent stackmap frames at branch target %d", target); | |
| 125 return; | |
| 126 } | |
| 127 // check if uninitialized objects exist on backward branches | |
| 128 check_new_object(frame, target, CHECK_VERIFY(frame->verifier())); | |
| 129 } | |
| 130 | |
| 131 void StackMapTable::check_new_object( | |
| 132 const StackMapFrame* frame, int32_t target, TRAPS) const { | |
| 133 if (frame->offset() > target && frame->has_new_object()) { | |
| 134 frame->verifier()->verify_error(frame->offset(), | |
| 135 "Uninitialized object exists on backward branch %d", target); | |
| 136 return; | |
| 137 } | |
| 138 } | |
| 139 | |
| 140 #ifndef PRODUCT | |
| 141 | |
| 142 void StackMapTable::print() const { | |
| 143 tty->print_cr("StackMapTable: frame_count = %d", _frame_count); | |
| 144 tty->print_cr("table = { "); | |
| 145 for (int32_t i = 0; i < _frame_count; i++) { | |
| 146 _frame_array[i]->print(); | |
| 147 } | |
| 148 tty->print_cr(" }"); | |
| 149 } | |
| 150 | |
| 151 #endif | |
| 152 | |
| 153 int32_t StackMapReader::chop( | |
| 154 VerificationType* locals, int32_t length, int32_t chops) { | |
| 1769 | 155 if (locals == NULL) return -1; |
| 0 | 156 int32_t pos = length - 1; |
| 157 for (int32_t i=0; i<chops; i++) { | |
| 158 if (locals[pos].is_category2_2nd()) { | |
| 159 pos -= 2; | |
| 160 } else { | |
| 161 pos --; | |
| 162 } | |
| 163 if (pos<0 && i<(chops-1)) return -1; | |
| 164 } | |
| 165 return pos+1; | |
| 166 } | |
| 167 | |
| 168 VerificationType StackMapReader::parse_verification_type(u1* flags, TRAPS) { | |
| 169 u1 tag = _stream->get_u1(THREAD); | |
| 170 if (tag < (u1)ITEM_UninitializedThis) { | |
| 171 return VerificationType::from_tag(tag); | |
| 172 } | |
| 173 if (tag == ITEM_Object) { | |
| 174 u2 class_index = _stream->get_u2(THREAD); | |
| 175 int nconstants = _cp->length(); | |
| 176 if ((class_index <= 0 || class_index >= nconstants) || | |
| 177 (!_cp->tag_at(class_index).is_klass() && | |
| 178 !_cp->tag_at(class_index).is_unresolved_klass())) { | |
| 179 _stream->stackmap_format_error("bad class index", THREAD); | |
| 180 return VerificationType::bogus_type(); | |
| 181 } | |
| 182 return VerificationType::reference_type( | |
| 183 symbolHandle(THREAD, _cp->klass_name_at(class_index))); | |
| 184 } | |
| 185 if (tag == ITEM_UninitializedThis) { | |
| 186 if (flags != NULL) { | |
| 187 *flags |= FLAG_THIS_UNINIT; | |
| 188 } | |
| 189 return VerificationType::uninitialized_this_type(); | |
| 190 } | |
| 191 if (tag == ITEM_Uninitialized) { | |
| 192 u2 offset = _stream->get_u2(THREAD); | |
| 193 if (offset >= _code_length || | |
| 194 _code_data[offset] != ClassVerifier::NEW_OFFSET) { | |
| 195 ResourceMark rm(THREAD); | |
| 196 _verifier->class_format_error( | |
| 197 "StackMapTable format error: bad offset for Uninitialized"); | |
| 198 return VerificationType::bogus_type(); | |
| 199 } | |
| 200 return VerificationType::uninitialized_type(offset); | |
| 201 } | |
| 202 _stream->stackmap_format_error("bad verification type", THREAD); | |
| 203 return VerificationType::bogus_type(); | |
| 204 } | |
| 205 | |
| 206 StackMapFrame* StackMapReader::next( | |
| 207 StackMapFrame* pre_frame, bool first, u2 max_locals, u2 max_stack, TRAPS) { | |
| 208 StackMapFrame* frame; | |
| 209 int offset; | |
| 210 VerificationType* locals = NULL; | |
| 211 u1 frame_type = _stream->get_u1(THREAD); | |
| 212 if (frame_type < 64) { | |
| 213 // same_frame | |
| 214 if (first) { | |
| 215 offset = frame_type; | |
| 216 // Can't share the locals array since that is updated by the verifier. | |
| 217 if (pre_frame->locals_size() > 0) { | |
| 218 locals = NEW_RESOURCE_ARRAY_IN_THREAD( | |
| 219 THREAD, VerificationType, pre_frame->locals_size()); | |
| 220 } | |
| 221 } else { | |
| 222 offset = pre_frame->offset() + frame_type + 1; | |
| 223 locals = pre_frame->locals(); | |
| 224 } | |
| 225 frame = new StackMapFrame( | |
| 226 offset, pre_frame->flags(), pre_frame->locals_size(), 0, | |
| 227 max_locals, max_stack, locals, NULL, _verifier); | |
| 228 if (first && locals != NULL) { | |
| 229 frame->copy_locals(pre_frame); | |
| 230 } | |
| 231 return frame; | |
| 232 } | |
| 233 if (frame_type < 128) { | |
| 234 // same_locals_1_stack_item_frame | |
| 235 if (first) { | |
| 236 offset = frame_type - 64; | |
| 237 // Can't share the locals array since that is updated by the verifier. | |
| 238 if (pre_frame->locals_size() > 0) { | |
| 239 locals = NEW_RESOURCE_ARRAY_IN_THREAD( | |
| 240 THREAD, VerificationType, pre_frame->locals_size()); | |
| 241 } | |
| 242 } else { | |
| 243 offset = pre_frame->offset() + frame_type - 63; | |
| 244 locals = pre_frame->locals(); | |
| 245 } | |
| 246 VerificationType* stack = NEW_RESOURCE_ARRAY_IN_THREAD( | |
| 247 THREAD, VerificationType, 2); | |
| 248 u2 stack_size = 1; | |
| 249 stack[0] = parse_verification_type(NULL, CHECK_VERIFY_(_verifier, NULL)); | |
| 250 if (stack[0].is_category2()) { | |
| 251 stack[1] = stack[0].to_category2_2nd(); | |
| 252 stack_size = 2; | |
| 253 } | |
| 254 check_verification_type_array_size( | |
| 255 stack_size, max_stack, CHECK_VERIFY_(_verifier, NULL)); | |
| 256 frame = new StackMapFrame( | |
| 257 offset, pre_frame->flags(), pre_frame->locals_size(), stack_size, | |
| 258 max_locals, max_stack, locals, stack, _verifier); | |
| 259 if (first && locals != NULL) { | |
| 260 frame->copy_locals(pre_frame); | |
| 261 } | |
| 262 return frame; | |
| 263 } | |
| 264 | |
| 265 u2 offset_delta = _stream->get_u2(THREAD); | |
| 266 | |
| 267 if (frame_type < SAME_LOCALS_1_STACK_ITEM_EXTENDED) { | |
| 268 // reserved frame types | |
| 269 _stream->stackmap_format_error( | |
| 270 "reserved frame type", CHECK_VERIFY_(_verifier, NULL)); | |
| 271 } | |
| 272 | |
| 273 if (frame_type == SAME_LOCALS_1_STACK_ITEM_EXTENDED) { | |
| 274 // same_locals_1_stack_item_frame_extended | |
| 275 if (first) { | |
| 276 offset = offset_delta; | |
| 277 // Can't share the locals array since that is updated by the verifier. | |
| 278 if (pre_frame->locals_size() > 0) { | |
| 279 locals = NEW_RESOURCE_ARRAY_IN_THREAD( | |
| 280 THREAD, VerificationType, pre_frame->locals_size()); | |
| 281 } | |
| 282 } else { | |
| 283 offset = pre_frame->offset() + offset_delta + 1; | |
| 284 locals = pre_frame->locals(); | |
| 285 } | |
| 286 VerificationType* stack = NEW_RESOURCE_ARRAY_IN_THREAD( | |
| 287 THREAD, VerificationType, 2); | |
| 288 u2 stack_size = 1; | |
| 289 stack[0] = parse_verification_type(NULL, CHECK_VERIFY_(_verifier, NULL)); | |
| 290 if (stack[0].is_category2()) { | |
| 291 stack[1] = stack[0].to_category2_2nd(); | |
| 292 stack_size = 2; | |
| 293 } | |
| 294 check_verification_type_array_size( | |
| 295 stack_size, max_stack, CHECK_VERIFY_(_verifier, NULL)); | |
| 296 frame = new StackMapFrame( | |
| 297 offset, pre_frame->flags(), pre_frame->locals_size(), stack_size, | |
| 298 max_locals, max_stack, locals, stack, _verifier); | |
| 299 if (first && locals != NULL) { | |
| 300 frame->copy_locals(pre_frame); | |
| 301 } | |
| 302 return frame; | |
| 303 } | |
| 304 | |
| 305 if (frame_type <= SAME_EXTENDED) { | |
| 306 // chop_frame or same_frame_extended | |
| 307 locals = pre_frame->locals(); | |
| 308 int length = pre_frame->locals_size(); | |
| 309 int chops = SAME_EXTENDED - frame_type; | |
| 310 int new_length = length; | |
| 311 u1 flags = pre_frame->flags(); | |
| 312 if (chops != 0) { | |
| 313 new_length = chop(locals, length, chops); | |
| 314 check_verification_type_array_size( | |
| 315 new_length, max_locals, CHECK_VERIFY_(_verifier, NULL)); | |
| 316 // Recompute flags since uninitializedThis could have been chopped. | |
| 317 flags = 0; | |
| 318 for (int i=0; i<new_length; i++) { | |
| 319 if (locals[i].is_uninitialized_this()) { | |
| 320 flags |= FLAG_THIS_UNINIT; | |
| 321 break; | |
| 322 } | |
| 323 } | |
| 324 } | |
| 325 if (first) { | |
| 326 offset = offset_delta; | |
| 327 // Can't share the locals array since that is updated by the verifier. | |
| 328 if (new_length > 0) { | |
| 329 locals = NEW_RESOURCE_ARRAY_IN_THREAD( | |
| 330 THREAD, VerificationType, new_length); | |
| 331 } else { | |
| 332 locals = NULL; | |
| 333 } | |
| 334 } else { | |
| 335 offset = pre_frame->offset() + offset_delta + 1; | |
| 336 } | |
| 337 frame = new StackMapFrame( | |
| 338 offset, flags, new_length, 0, max_locals, max_stack, | |
| 339 locals, NULL, _verifier); | |
| 340 if (first && locals != NULL) { | |
| 341 frame->copy_locals(pre_frame); | |
| 342 } | |
| 343 return frame; | |
| 344 } else if (frame_type < SAME_EXTENDED + 4) { | |
| 345 // append_frame | |
| 346 int appends = frame_type - SAME_EXTENDED; | |
| 347 int real_length = pre_frame->locals_size(); | |
| 348 int new_length = real_length + appends*2; | |
| 349 locals = NEW_RESOURCE_ARRAY_IN_THREAD(THREAD, VerificationType, new_length); | |
| 350 VerificationType* pre_locals = pre_frame->locals(); | |
| 351 int i; | |
| 352 for (i=0; i<pre_frame->locals_size(); i++) { | |
| 353 locals[i] = pre_locals[i]; | |
| 354 } | |
| 355 u1 flags = pre_frame->flags(); | |
| 356 for (i=0; i<appends; i++) { | |
| 357 locals[real_length] = parse_verification_type(&flags, THREAD); | |
| 358 if (locals[real_length].is_category2()) { | |
| 359 locals[real_length + 1] = locals[real_length].to_category2_2nd(); | |
| 360 ++real_length; | |
| 361 } | |
| 362 ++real_length; | |
| 363 } | |
| 364 check_verification_type_array_size( | |
| 365 real_length, max_locals, CHECK_VERIFY_(_verifier, NULL)); | |
| 366 if (first) { | |
| 367 offset = offset_delta; | |
| 368 } else { | |
| 369 offset = pre_frame->offset() + offset_delta + 1; | |
| 370 } | |
| 371 frame = new StackMapFrame( | |
| 372 offset, flags, real_length, 0, max_locals, | |
| 373 max_stack, locals, NULL, _verifier); | |
| 374 return frame; | |
| 375 } | |
| 376 if (frame_type == FULL) { | |
| 377 // full_frame | |
| 378 u1 flags = 0; | |
| 379 u2 locals_size = _stream->get_u2(THREAD); | |
| 380 int real_locals_size = 0; | |
| 381 if (locals_size > 0) { | |
| 382 locals = NEW_RESOURCE_ARRAY_IN_THREAD( | |
| 383 THREAD, VerificationType, locals_size*2); | |
| 384 } | |
| 385 int i; | |
| 386 for (i=0; i<locals_size; i++) { | |
| 387 locals[real_locals_size] = parse_verification_type(&flags, THREAD); | |
| 388 if (locals[real_locals_size].is_category2()) { | |
| 389 locals[real_locals_size + 1] = | |
| 390 locals[real_locals_size].to_category2_2nd(); | |
| 391 ++real_locals_size; | |
| 392 } | |
| 393 ++real_locals_size; | |
| 394 } | |
| 395 check_verification_type_array_size( | |
| 396 real_locals_size, max_locals, CHECK_VERIFY_(_verifier, NULL)); | |
| 397 u2 stack_size = _stream->get_u2(THREAD); | |
| 398 int real_stack_size = 0; | |
| 399 VerificationType* stack = NULL; | |
| 400 if (stack_size > 0) { | |
| 401 stack = NEW_RESOURCE_ARRAY_IN_THREAD( | |
| 402 THREAD, VerificationType, stack_size*2); | |
| 403 } | |
| 404 for (i=0; i<stack_size; i++) { | |
| 405 stack[real_stack_size] = parse_verification_type(NULL, THREAD); | |
| 406 if (stack[real_stack_size].is_category2()) { | |
| 407 stack[real_stack_size + 1] = stack[real_stack_size].to_category2_2nd(); | |
| 408 ++real_stack_size; | |
| 409 } | |
| 410 ++real_stack_size; | |
| 411 } | |
| 412 check_verification_type_array_size( | |
| 413 real_stack_size, max_stack, CHECK_VERIFY_(_verifier, NULL)); | |
| 414 if (first) { | |
| 415 offset = offset_delta; | |
| 416 } else { | |
| 417 offset = pre_frame->offset() + offset_delta + 1; | |
| 418 } | |
| 419 frame = new StackMapFrame( | |
| 420 offset, flags, real_locals_size, real_stack_size, | |
| 421 max_locals, max_stack, locals, stack, _verifier); | |
| 422 return frame; | |
| 423 } | |
| 424 | |
| 425 _stream->stackmap_format_error( | |
| 426 "reserved frame type", CHECK_VERIFY_(pre_frame->verifier(), NULL)); | |
| 427 return NULL; | |
| 428 } |