• Home
  • Line#
  • Scopes#
  • Navigate#
  • Raw
  • Download
1 /*
2  * Copyright (C) 2011 The Android Open Source Project
3  *
4  * Licensed under the Apache License, Version 2.0 (the "License");
5  * you may not use this file except in compliance with the License.
6  * You may obtain a copy of the License at
7  *
8  *      http://www.apache.org/licenses/LICENSE-2.0
9  *
10  * Unless required by applicable law or agreed to in writing, software
11  * distributed under the License is distributed on an "AS IS" BASIS,
12  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13  * See the License for the specific language governing permissions and
14  * limitations under the License.
15  */
16 
17 #include "reflection-inl.h"
18 
19 #include "art_field-inl.h"
20 #include "art_method-inl.h"
21 #include "base/enums.h"
22 #include "class_linker.h"
23 #include "common_throws.h"
24 #include "dex/dex_file-inl.h"
25 #include "indirect_reference_table-inl.h"
26 #include "jni/java_vm_ext.h"
27 #include "jni/jni_internal.h"
28 #include "jvalue-inl.h"
29 #include "mirror/class-inl.h"
30 #include "mirror/executable.h"
31 #include "mirror/object_array-inl.h"
32 #include "nativehelper/scoped_local_ref.h"
33 #include "nth_caller_visitor.h"
34 #include "scoped_thread_state_change-inl.h"
35 #include "stack_reference.h"
36 #include "thread-inl.h"
37 #include "well_known_classes.h"
38 
39 namespace art {
40 namespace {
41 
42 using android::base::StringPrintf;
43 
44 class ArgArray {
45  public:
ArgArray(const char * shorty,uint32_t shorty_len)46   ArgArray(const char* shorty, uint32_t shorty_len)
47       : shorty_(shorty), shorty_len_(shorty_len), num_bytes_(0) {
48     size_t num_slots = shorty_len + 1;  // +1 in case of receiver.
49     if (LIKELY((num_slots * 2) < kSmallArgArraySize)) {
50       // We can trivially use the small arg array.
51       arg_array_ = small_arg_array_;
52     } else {
53       // Analyze shorty to see if we need the large arg array.
54       for (size_t i = 1; i < shorty_len; ++i) {
55         char c = shorty[i];
56         if (c == 'J' || c == 'D') {
57           num_slots++;
58         }
59       }
60       if (num_slots <= kSmallArgArraySize) {
61         arg_array_ = small_arg_array_;
62       } else {
63         large_arg_array_.reset(new uint32_t[num_slots]);
64         arg_array_ = large_arg_array_.get();
65       }
66     }
67   }
68 
GetArray()69   uint32_t* GetArray() {
70     return arg_array_;
71   }
72 
GetNumBytes()73   uint32_t GetNumBytes() {
74     return num_bytes_;
75   }
76 
Append(uint32_t value)77   void Append(uint32_t value) {
78     arg_array_[num_bytes_ / 4] = value;
79     num_bytes_ += 4;
80   }
81 
Append(ObjPtr<mirror::Object> obj)82   void Append(ObjPtr<mirror::Object> obj) REQUIRES_SHARED(Locks::mutator_lock_) {
83     Append(StackReference<mirror::Object>::FromMirrorPtr(obj.Ptr()).AsVRegValue());
84   }
85 
AppendWide(uint64_t value)86   void AppendWide(uint64_t value) {
87     arg_array_[num_bytes_ / 4] = value;
88     arg_array_[(num_bytes_ / 4) + 1] = value >> 32;
89     num_bytes_ += 8;
90   }
91 
AppendFloat(float value)92   void AppendFloat(float value) {
93     jvalue jv;
94     jv.f = value;
95     Append(jv.i);
96   }
97 
AppendDouble(double value)98   void AppendDouble(double value) {
99     jvalue jv;
100     jv.d = value;
101     AppendWide(jv.j);
102   }
103 
BuildArgArrayFromVarArgs(const ScopedObjectAccessAlreadyRunnable & soa,ObjPtr<mirror::Object> receiver,va_list ap)104   void BuildArgArrayFromVarArgs(const ScopedObjectAccessAlreadyRunnable& soa,
105                                 ObjPtr<mirror::Object> receiver,
106                                 va_list ap)
107       REQUIRES_SHARED(Locks::mutator_lock_) {
108     // Set receiver if non-null (method is not static)
109     if (receiver != nullptr) {
110       Append(receiver);
111     }
112     for (size_t i = 1; i < shorty_len_; ++i) {
113       switch (shorty_[i]) {
114         case 'Z':
115         case 'B':
116         case 'C':
117         case 'S':
118         case 'I':
119           Append(va_arg(ap, jint));
120           break;
121         case 'F':
122           AppendFloat(va_arg(ap, jdouble));
123           break;
124         case 'L':
125           Append(soa.Decode<mirror::Object>(va_arg(ap, jobject)));
126           break;
127         case 'D':
128           AppendDouble(va_arg(ap, jdouble));
129           break;
130         case 'J':
131           AppendWide(va_arg(ap, jlong));
132           break;
133 #ifndef NDEBUG
134         default:
135           LOG(FATAL) << "Unexpected shorty character: " << shorty_[i];
136 #endif
137       }
138     }
139   }
140 
BuildArgArrayFromJValues(const ScopedObjectAccessAlreadyRunnable & soa,ObjPtr<mirror::Object> receiver,const jvalue * args)141   void BuildArgArrayFromJValues(const ScopedObjectAccessAlreadyRunnable& soa,
142                                 ObjPtr<mirror::Object> receiver, const jvalue* args)
143       REQUIRES_SHARED(Locks::mutator_lock_) {
144     // Set receiver if non-null (method is not static)
145     if (receiver != nullptr) {
146       Append(receiver);
147     }
148     for (size_t i = 1, args_offset = 0; i < shorty_len_; ++i, ++args_offset) {
149       switch (shorty_[i]) {
150         case 'Z':
151           Append(args[args_offset].z);
152           break;
153         case 'B':
154           Append(args[args_offset].b);
155           break;
156         case 'C':
157           Append(args[args_offset].c);
158           break;
159         case 'S':
160           Append(args[args_offset].s);
161           break;
162         case 'I':
163           FALLTHROUGH_INTENDED;
164         case 'F':
165           Append(args[args_offset].i);
166           break;
167         case 'L':
168           Append(soa.Decode<mirror::Object>(args[args_offset].l));
169           break;
170         case 'D':
171           FALLTHROUGH_INTENDED;
172         case 'J':
173           AppendWide(args[args_offset].j);
174           break;
175 #ifndef NDEBUG
176         default:
177           LOG(FATAL) << "Unexpected shorty character: " << shorty_[i];
178 #endif
179       }
180     }
181   }
182 
BuildArgArrayFromFrame(ShadowFrame * shadow_frame,uint32_t arg_offset)183   void BuildArgArrayFromFrame(ShadowFrame* shadow_frame, uint32_t arg_offset)
184       REQUIRES_SHARED(Locks::mutator_lock_) {
185     // Set receiver if non-null (method is not static)
186     size_t cur_arg = arg_offset;
187     if (!shadow_frame->GetMethod()->IsStatic()) {
188       Append(shadow_frame->GetVReg(cur_arg));
189       cur_arg++;
190     }
191     for (size_t i = 1; i < shorty_len_; ++i) {
192       switch (shorty_[i]) {
193         case 'Z':
194         case 'B':
195         case 'C':
196         case 'S':
197         case 'I':
198         case 'F':
199         case 'L':
200           Append(shadow_frame->GetVReg(cur_arg));
201           cur_arg++;
202           break;
203         case 'D':
204         case 'J':
205           AppendWide(shadow_frame->GetVRegLong(cur_arg));
206           cur_arg++;
207           cur_arg++;
208           break;
209 #ifndef NDEBUG
210         default:
211           LOG(FATAL) << "Unexpected shorty character: " << shorty_[i];
212 #endif
213       }
214     }
215   }
216 
ThrowIllegalPrimitiveArgumentException(const char * expected,const char * found_descriptor)217   static void ThrowIllegalPrimitiveArgumentException(const char* expected,
218                                                      const char* found_descriptor)
219       REQUIRES_SHARED(Locks::mutator_lock_) {
220     ThrowIllegalArgumentException(
221         StringPrintf("Invalid primitive conversion from %s to %s", expected,
222                      PrettyDescriptor(found_descriptor).c_str()).c_str());
223   }
224 
BuildArgArrayFromObjectArray(ObjPtr<mirror::Object> receiver,ObjPtr<mirror::ObjectArray<mirror::Object>> raw_args,ArtMethod * m,Thread * self)225   bool BuildArgArrayFromObjectArray(ObjPtr<mirror::Object> receiver,
226                                     ObjPtr<mirror::ObjectArray<mirror::Object>> raw_args,
227                                     ArtMethod* m,
228                                     Thread* self)
229       REQUIRES_SHARED(Locks::mutator_lock_) {
230     const dex::TypeList* classes = m->GetParameterTypeList();
231     // Set receiver if non-null (method is not static)
232     if (receiver != nullptr) {
233       Append(receiver);
234     }
235     StackHandleScope<2> hs(self);
236     MutableHandle<mirror::Object> arg(hs.NewHandle<mirror::Object>(nullptr));
237     Handle<mirror::ObjectArray<mirror::Object>> args(
238         hs.NewHandle<mirror::ObjectArray<mirror::Object>>(raw_args));
239     for (size_t i = 1, args_offset = 0; i < shorty_len_; ++i, ++args_offset) {
240       arg.Assign(args->Get(args_offset));
241       if (((shorty_[i] == 'L') && (arg != nullptr)) ||
242           ((arg == nullptr && shorty_[i] != 'L'))) {
243         // TODO: The method's parameter's type must have been previously resolved, yet
244         // we've seen cases where it's not b/34440020.
245         ObjPtr<mirror::Class> dst_class(
246             m->ResolveClassFromTypeIndex(classes->GetTypeItem(args_offset).type_idx_));
247         if (dst_class == nullptr) {
248           CHECK(self->IsExceptionPending());
249           return false;
250         }
251         if (UNLIKELY(arg == nullptr || !arg->InstanceOf(dst_class))) {
252           ThrowIllegalArgumentException(
253               StringPrintf("method %s argument %zd has type %s, got %s",
254                   m->PrettyMethod(false).c_str(),
255                   args_offset + 1,  // Humans don't count from 0.
256                   mirror::Class::PrettyDescriptor(dst_class).c_str(),
257                   mirror::Object::PrettyTypeOf(arg.Get()).c_str()).c_str());
258           return false;
259         }
260       }
261 
262 #define DO_FIRST_ARG(match_descriptor, get_fn, append) { \
263           if (LIKELY(arg != nullptr && \
264               arg->GetClass()->DescriptorEquals(match_descriptor))) { \
265             ArtField* primitive_field = arg->GetClass()->GetInstanceField(0); \
266             append(primitive_field-> get_fn(arg.Get()));
267 
268 #define DO_ARG(match_descriptor, get_fn, append) \
269           } else if (LIKELY(arg != nullptr && \
270                             arg->GetClass<>()->DescriptorEquals(match_descriptor))) { \
271             ArtField* primitive_field = arg->GetClass()->GetInstanceField(0); \
272             append(primitive_field-> get_fn(arg.Get()));
273 
274 #define DO_FAIL(expected) \
275           } else { \
276             if (arg->GetClass<>()->IsPrimitive()) { \
277               std::string temp; \
278               ThrowIllegalPrimitiveArgumentException(expected, \
279                                                      arg->GetClass<>()->GetDescriptor(&temp)); \
280             } else { \
281               ThrowIllegalArgumentException(\
282                   StringPrintf("method %s argument %zd has type %s, got %s", \
283                       ArtMethod::PrettyMethod(m, false).c_str(), \
284                       args_offset + 1, \
285                       expected, \
286                       mirror::Object::PrettyTypeOf(arg.Get()).c_str()).c_str()); \
287             } \
288             return false; \
289           } }
290 
291       switch (shorty_[i]) {
292         case 'L':
293           Append(arg.Get());
294           break;
295         case 'Z':
296           DO_FIRST_ARG("Ljava/lang/Boolean;", GetBoolean, Append)
297           DO_FAIL("boolean")
298           break;
299         case 'B':
300           DO_FIRST_ARG("Ljava/lang/Byte;", GetByte, Append)
301           DO_FAIL("byte")
302           break;
303         case 'C':
304           DO_FIRST_ARG("Ljava/lang/Character;", GetChar, Append)
305           DO_FAIL("char")
306           break;
307         case 'S':
308           DO_FIRST_ARG("Ljava/lang/Short;", GetShort, Append)
309           DO_ARG("Ljava/lang/Byte;", GetByte, Append)
310           DO_FAIL("short")
311           break;
312         case 'I':
313           DO_FIRST_ARG("Ljava/lang/Integer;", GetInt, Append)
314           DO_ARG("Ljava/lang/Character;", GetChar, Append)
315           DO_ARG("Ljava/lang/Short;", GetShort, Append)
316           DO_ARG("Ljava/lang/Byte;", GetByte, Append)
317           DO_FAIL("int")
318           break;
319         case 'J':
320           DO_FIRST_ARG("Ljava/lang/Long;", GetLong, AppendWide)
321           DO_ARG("Ljava/lang/Integer;", GetInt, AppendWide)
322           DO_ARG("Ljava/lang/Character;", GetChar, AppendWide)
323           DO_ARG("Ljava/lang/Short;", GetShort, AppendWide)
324           DO_ARG("Ljava/lang/Byte;", GetByte, AppendWide)
325           DO_FAIL("long")
326           break;
327         case 'F':
328           DO_FIRST_ARG("Ljava/lang/Float;", GetFloat, AppendFloat)
329           DO_ARG("Ljava/lang/Long;", GetLong, AppendFloat)
330           DO_ARG("Ljava/lang/Integer;", GetInt, AppendFloat)
331           DO_ARG("Ljava/lang/Character;", GetChar, AppendFloat)
332           DO_ARG("Ljava/lang/Short;", GetShort, AppendFloat)
333           DO_ARG("Ljava/lang/Byte;", GetByte, AppendFloat)
334           DO_FAIL("float")
335           break;
336         case 'D':
337           DO_FIRST_ARG("Ljava/lang/Double;", GetDouble, AppendDouble)
338           DO_ARG("Ljava/lang/Float;", GetFloat, AppendDouble)
339           DO_ARG("Ljava/lang/Long;", GetLong, AppendDouble)
340           DO_ARG("Ljava/lang/Integer;", GetInt, AppendDouble)
341           DO_ARG("Ljava/lang/Character;", GetChar, AppendDouble)
342           DO_ARG("Ljava/lang/Short;", GetShort, AppendDouble)
343           DO_ARG("Ljava/lang/Byte;", GetByte, AppendDouble)
344           DO_FAIL("double")
345           break;
346 #ifndef NDEBUG
347         default:
348           LOG(FATAL) << "Unexpected shorty character: " << shorty_[i];
349           UNREACHABLE();
350 #endif
351       }
352 #undef DO_FIRST_ARG
353 #undef DO_ARG
354 #undef DO_FAIL
355     }
356     return true;
357   }
358 
359  private:
360   enum { kSmallArgArraySize = 16 };
361   const char* const shorty_;
362   const uint32_t shorty_len_;
363   uint32_t num_bytes_;
364   uint32_t* arg_array_;
365   uint32_t small_arg_array_[kSmallArgArraySize];
366   std::unique_ptr<uint32_t[]> large_arg_array_;
367 };
368 
CheckMethodArguments(JavaVMExt * vm,ArtMethod * m,uint32_t * args)369 void CheckMethodArguments(JavaVMExt* vm, ArtMethod* m, uint32_t* args)
370     REQUIRES_SHARED(Locks::mutator_lock_) {
371   const dex::TypeList* params = m->GetParameterTypeList();
372   if (params == nullptr) {
373     return;  // No arguments so nothing to check.
374   }
375   uint32_t offset = 0;
376   uint32_t num_params = params->Size();
377   size_t error_count = 0;
378   if (!m->IsStatic()) {
379     offset = 1;
380   }
381   // TODO: If args contain object references, it may cause problems.
382   Thread* const self = Thread::Current();
383   for (uint32_t i = 0; i < num_params; i++) {
384     dex::TypeIndex type_idx = params->GetTypeItem(i).type_idx_;
385     ObjPtr<mirror::Class> param_type(m->ResolveClassFromTypeIndex(type_idx));
386     if (param_type == nullptr) {
387       CHECK(self->IsExceptionPending());
388       LOG(ERROR) << "Internal error: unresolvable type for argument type in JNI invoke: "
389           << m->GetTypeDescriptorFromTypeIdx(type_idx) << "\n"
390           << self->GetException()->Dump();
391       self->ClearException();
392       ++error_count;
393     } else if (!param_type->IsPrimitive()) {
394       // TODO: There is a compaction bug here since GetClassFromTypeIdx can cause thread suspension,
395       // this is a hard to fix problem since the args can contain Object*, we need to save and
396       // restore them by using a visitor similar to the ones used in the trampoline entrypoints.
397       ObjPtr<mirror::Object> argument =
398           (reinterpret_cast<StackReference<mirror::Object>*>(&args[i + offset]))->AsMirrorPtr();
399       if (argument != nullptr && !argument->InstanceOf(param_type)) {
400         LOG(ERROR) << "JNI ERROR (app bug): attempt to pass an instance of "
401                    << argument->PrettyTypeOf() << " as argument " << (i + 1)
402                    << " to " << m->PrettyMethod();
403         ++error_count;
404       }
405     } else if (param_type->IsPrimitiveLong() || param_type->IsPrimitiveDouble()) {
406       offset++;
407     } else {
408       int32_t arg = static_cast<int32_t>(args[i + offset]);
409       if (param_type->IsPrimitiveBoolean()) {
410         if (arg != JNI_TRUE && arg != JNI_FALSE) {
411           LOG(ERROR) << "JNI ERROR (app bug): expected jboolean (0/1) but got value of "
412               << arg << " as argument " << (i + 1) << " to " << m->PrettyMethod();
413           ++error_count;
414         }
415       } else if (param_type->IsPrimitiveByte()) {
416         if (arg < -128 || arg > 127) {
417           LOG(ERROR) << "JNI ERROR (app bug): expected jbyte but got value of "
418               << arg << " as argument " << (i + 1) << " to " << m->PrettyMethod();
419           ++error_count;
420         }
421       } else if (param_type->IsPrimitiveChar()) {
422         if (args[i + offset] > 0xFFFF) {
423           LOG(ERROR) << "JNI ERROR (app bug): expected jchar but got value of "
424               << arg << " as argument " << (i + 1) << " to " << m->PrettyMethod();
425           ++error_count;
426         }
427       } else if (param_type->IsPrimitiveShort()) {
428         if (arg < -32768 || arg > 0x7FFF) {
429           LOG(ERROR) << "JNI ERROR (app bug): expected jshort but got value of "
430               << arg << " as argument " << (i + 1) << " to " << m->PrettyMethod();
431           ++error_count;
432         }
433       }
434     }
435   }
436   if (UNLIKELY(error_count > 0)) {
437     // TODO: pass the JNI function name (such as "CallVoidMethodV") through so we can call JniAbort
438     // with an argument.
439     vm->JniAbortF(nullptr, "bad arguments passed to %s (see above for details)",
440                   m->PrettyMethod().c_str());
441   }
442 }
443 
FindVirtualMethod(ObjPtr<mirror::Object> receiver,ArtMethod * method)444 ArtMethod* FindVirtualMethod(ObjPtr<mirror::Object> receiver, ArtMethod* method)
445     REQUIRES_SHARED(Locks::mutator_lock_) {
446   return receiver->GetClass()->FindVirtualMethodForVirtualOrInterface(method, kRuntimePointerSize);
447 }
448 
449 
InvokeWithArgArray(const ScopedObjectAccessAlreadyRunnable & soa,ArtMethod * method,ArgArray * arg_array,JValue * result,const char * shorty)450 void InvokeWithArgArray(const ScopedObjectAccessAlreadyRunnable& soa,
451                                ArtMethod* method, ArgArray* arg_array, JValue* result,
452                                const char* shorty)
453     REQUIRES_SHARED(Locks::mutator_lock_) {
454   uint32_t* args = arg_array->GetArray();
455   if (UNLIKELY(soa.Env()->IsCheckJniEnabled())) {
456     CheckMethodArguments(soa.Vm(), method->GetInterfaceMethodIfProxy(kRuntimePointerSize), args);
457   }
458   method->Invoke(soa.Self(), args, arg_array->GetNumBytes(), result, shorty);
459 }
460 
461 ALWAYS_INLINE
CheckArgsForInvokeMethod(ArtMethod * np_method,ObjPtr<mirror::ObjectArray<mirror::Object>> objects)462 bool CheckArgsForInvokeMethod(ArtMethod* np_method,
463                               ObjPtr<mirror::ObjectArray<mirror::Object>> objects)
464     REQUIRES_SHARED(Locks::mutator_lock_) {
465   const dex::TypeList* classes = np_method->GetParameterTypeList();
466   uint32_t classes_size = (classes == nullptr) ? 0 : classes->Size();
467   uint32_t arg_count = (objects == nullptr) ? 0 : objects->GetLength();
468   if (UNLIKELY(arg_count != classes_size)) {
469     ThrowIllegalArgumentException(StringPrintf("Wrong number of arguments; expected %d, got %d",
470                                                classes_size, arg_count).c_str());
471     return false;
472   }
473   return true;
474 }
475 
476 ALWAYS_INLINE
InvokeMethodImpl(const ScopedObjectAccessAlreadyRunnable & soa,ArtMethod * m,ArtMethod * np_method,ObjPtr<mirror::Object> receiver,ObjPtr<mirror::ObjectArray<mirror::Object>> objects,const char ** shorty,JValue * result)477 bool InvokeMethodImpl(const ScopedObjectAccessAlreadyRunnable& soa,
478                       ArtMethod* m,
479                       ArtMethod* np_method,
480                       ObjPtr<mirror::Object> receiver,
481                       ObjPtr<mirror::ObjectArray<mirror::Object>> objects,
482                       const char** shorty,
483                       JValue* result) REQUIRES_SHARED(Locks::mutator_lock_) {
484   // Invoke the method.
485   uint32_t shorty_len = 0;
486   *shorty = np_method->GetShorty(&shorty_len);
487   ArgArray arg_array(*shorty, shorty_len);
488   if (!arg_array.BuildArgArrayFromObjectArray(receiver, objects, np_method, soa.Self())) {
489     CHECK(soa.Self()->IsExceptionPending());
490     return false;
491   }
492 
493   InvokeWithArgArray(soa, m, &arg_array, result, *shorty);
494 
495   // Wrap any exception with "Ljava/lang/reflect/InvocationTargetException;" and return early.
496   if (soa.Self()->IsExceptionPending()) {
497     // If we get another exception when we are trying to wrap, then just use that instead.
498     ScopedLocalRef<jthrowable> th(soa.Env(), soa.Env()->ExceptionOccurred());
499     soa.Self()->ClearException();
500     jclass exception_class = soa.Env()->FindClass("java/lang/reflect/InvocationTargetException");
501     if (exception_class == nullptr) {
502       soa.Self()->AssertPendingException();
503       return false;
504     }
505     jmethodID mid = soa.Env()->GetMethodID(exception_class, "<init>", "(Ljava/lang/Throwable;)V");
506     CHECK(mid != nullptr);
507     jobject exception_instance = soa.Env()->NewObject(exception_class, mid, th.get());
508     if (exception_instance == nullptr) {
509       soa.Self()->AssertPendingException();
510       return false;
511     }
512     soa.Env()->Throw(reinterpret_cast<jthrowable>(exception_instance));
513     return false;
514   }
515 
516   return true;
517 }
518 
519 }  // anonymous namespace
520 
InvokeWithVarArgs(const ScopedObjectAccessAlreadyRunnable & soa,jobject obj,jmethodID mid,va_list args)521 JValue InvokeWithVarArgs(const ScopedObjectAccessAlreadyRunnable& soa, jobject obj, jmethodID mid,
522                          va_list args)
523     REQUIRES_SHARED(Locks::mutator_lock_) {
524   // We want to make sure that the stack is not within a small distance from the
525   // protected region in case we are calling into a leaf function whose stack
526   // check has been elided.
527   if (UNLIKELY(__builtin_frame_address(0) < soa.Self()->GetStackEnd())) {
528     ThrowStackOverflowError(soa.Self());
529     return JValue();
530   }
531 
532   ArtMethod* method = jni::DecodeArtMethod(mid);
533   bool is_string_init = method->GetDeclaringClass()->IsStringClass() && method->IsConstructor();
534   if (is_string_init) {
535     // Replace calls to String.<init> with equivalent StringFactory call.
536     method = WellKnownClasses::StringInitToStringFactory(method);
537   }
538   ObjPtr<mirror::Object> receiver = method->IsStatic() ? nullptr : soa.Decode<mirror::Object>(obj);
539   uint32_t shorty_len = 0;
540   const char* shorty =
541       method->GetInterfaceMethodIfProxy(kRuntimePointerSize)->GetShorty(&shorty_len);
542   JValue result;
543   ArgArray arg_array(shorty, shorty_len);
544   arg_array.BuildArgArrayFromVarArgs(soa, receiver, args);
545   InvokeWithArgArray(soa, method, &arg_array, &result, shorty);
546   if (is_string_init) {
547     // For string init, remap original receiver to StringFactory result.
548     UpdateReference(soa.Self(), obj, result.GetL());
549   }
550   return result;
551 }
552 
InvokeWithJValues(const ScopedObjectAccessAlreadyRunnable & soa,jobject obj,jmethodID mid,const jvalue * args)553 JValue InvokeWithJValues(const ScopedObjectAccessAlreadyRunnable& soa, jobject obj, jmethodID mid,
554                          const jvalue* args) {
555   // We want to make sure that the stack is not within a small distance from the
556   // protected region in case we are calling into a leaf function whose stack
557   // check has been elided.
558   if (UNLIKELY(__builtin_frame_address(0) < soa.Self()->GetStackEnd())) {
559     ThrowStackOverflowError(soa.Self());
560     return JValue();
561   }
562 
563   ArtMethod* method = jni::DecodeArtMethod(mid);
564   bool is_string_init = method->GetDeclaringClass()->IsStringClass() && method->IsConstructor();
565   if (is_string_init) {
566     // Replace calls to String.<init> with equivalent StringFactory call.
567     method = WellKnownClasses::StringInitToStringFactory(method);
568   }
569   ObjPtr<mirror::Object> receiver = method->IsStatic() ? nullptr : soa.Decode<mirror::Object>(obj);
570   uint32_t shorty_len = 0;
571   const char* shorty =
572       method->GetInterfaceMethodIfProxy(kRuntimePointerSize)->GetShorty(&shorty_len);
573   JValue result;
574   ArgArray arg_array(shorty, shorty_len);
575   arg_array.BuildArgArrayFromJValues(soa, receiver, args);
576   InvokeWithArgArray(soa, method, &arg_array, &result, shorty);
577   if (is_string_init) {
578     // For string init, remap original receiver to StringFactory result.
579     UpdateReference(soa.Self(), obj, result.GetL());
580   }
581   return result;
582 }
583 
InvokeVirtualOrInterfaceWithJValues(const ScopedObjectAccessAlreadyRunnable & soa,jobject obj,jmethodID mid,const jvalue * args)584 JValue InvokeVirtualOrInterfaceWithJValues(const ScopedObjectAccessAlreadyRunnable& soa,
585                                            jobject obj, jmethodID mid, const jvalue* args) {
586   // We want to make sure that the stack is not within a small distance from the
587   // protected region in case we are calling into a leaf function whose stack
588   // check has been elided.
589   if (UNLIKELY(__builtin_frame_address(0) < soa.Self()->GetStackEnd())) {
590     ThrowStackOverflowError(soa.Self());
591     return JValue();
592   }
593 
594   ObjPtr<mirror::Object> receiver = soa.Decode<mirror::Object>(obj);
595   ArtMethod* method = FindVirtualMethod(receiver, jni::DecodeArtMethod(mid));
596   bool is_string_init = method->GetDeclaringClass()->IsStringClass() && method->IsConstructor();
597   if (is_string_init) {
598     // Replace calls to String.<init> with equivalent StringFactory call.
599     method = WellKnownClasses::StringInitToStringFactory(method);
600     receiver = nullptr;
601   }
602   uint32_t shorty_len = 0;
603   const char* shorty =
604       method->GetInterfaceMethodIfProxy(kRuntimePointerSize)->GetShorty(&shorty_len);
605   JValue result;
606   ArgArray arg_array(shorty, shorty_len);
607   arg_array.BuildArgArrayFromJValues(soa, receiver, args);
608   InvokeWithArgArray(soa, method, &arg_array, &result, shorty);
609   if (is_string_init) {
610     // For string init, remap original receiver to StringFactory result.
611     UpdateReference(soa.Self(), obj, result.GetL());
612   }
613   return result;
614 }
615 
InvokeVirtualOrInterfaceWithVarArgs(const ScopedObjectAccessAlreadyRunnable & soa,jobject obj,jmethodID mid,va_list args)616 JValue InvokeVirtualOrInterfaceWithVarArgs(const ScopedObjectAccessAlreadyRunnable& soa,
617                                            jobject obj, jmethodID mid, va_list args) {
618   // We want to make sure that the stack is not within a small distance from the
619   // protected region in case we are calling into a leaf function whose stack
620   // check has been elided.
621   if (UNLIKELY(__builtin_frame_address(0) < soa.Self()->GetStackEnd())) {
622     ThrowStackOverflowError(soa.Self());
623     return JValue();
624   }
625 
626   ObjPtr<mirror::Object> receiver = soa.Decode<mirror::Object>(obj);
627   ArtMethod* method = FindVirtualMethod(receiver, jni::DecodeArtMethod(mid));
628   bool is_string_init = method->GetDeclaringClass()->IsStringClass() && method->IsConstructor();
629   if (is_string_init) {
630     // Replace calls to String.<init> with equivalent StringFactory call.
631     method = WellKnownClasses::StringInitToStringFactory(method);
632     receiver = nullptr;
633   }
634   uint32_t shorty_len = 0;
635   const char* shorty =
636       method->GetInterfaceMethodIfProxy(kRuntimePointerSize)->GetShorty(&shorty_len);
637   JValue result;
638   ArgArray arg_array(shorty, shorty_len);
639   arg_array.BuildArgArrayFromVarArgs(soa, receiver, args);
640   InvokeWithArgArray(soa, method, &arg_array, &result, shorty);
641   if (is_string_init) {
642     // For string init, remap original receiver to StringFactory result.
643     UpdateReference(soa.Self(), obj, result.GetL());
644   }
645   return result;
646 }
647 
InvokeMethod(const ScopedObjectAccessAlreadyRunnable & soa,jobject javaMethod,jobject javaReceiver,jobject javaArgs,size_t num_frames)648 jobject InvokeMethod(const ScopedObjectAccessAlreadyRunnable& soa, jobject javaMethod,
649                      jobject javaReceiver, jobject javaArgs, size_t num_frames) {
650   // We want to make sure that the stack is not within a small distance from the
651   // protected region in case we are calling into a leaf function whose stack
652   // check has been elided.
653   if (UNLIKELY(__builtin_frame_address(0) <
654                soa.Self()->GetStackEndForInterpreter(true))) {
655     ThrowStackOverflowError(soa.Self());
656     return nullptr;
657   }
658 
659   ObjPtr<mirror::Executable> executable = soa.Decode<mirror::Executable>(javaMethod);
660   const bool accessible = executable->IsAccessible();
661   ArtMethod* m = executable->GetArtMethod();
662 
663   ObjPtr<mirror::Class> declaring_class = m->GetDeclaringClass();
664   if (UNLIKELY(!declaring_class->IsInitialized())) {
665     StackHandleScope<1> hs(soa.Self());
666     HandleWrapperObjPtr<mirror::Class> h_class(hs.NewHandleWrapper(&declaring_class));
667     if (!Runtime::Current()->GetClassLinker()->EnsureInitialized(soa.Self(), h_class, true, true)) {
668       return nullptr;
669     }
670   }
671 
672   ObjPtr<mirror::Object> receiver;
673   if (!m->IsStatic()) {
674     // Replace calls to String.<init> with equivalent StringFactory call.
675     if (declaring_class->IsStringClass() && m->IsConstructor()) {
676       m = WellKnownClasses::StringInitToStringFactory(m);
677       CHECK(javaReceiver == nullptr);
678     } else {
679       // Check that the receiver is non-null and an instance of the field's declaring class.
680       receiver = soa.Decode<mirror::Object>(javaReceiver);
681       if (!VerifyObjectIsClass(receiver, declaring_class)) {
682         return nullptr;
683       }
684 
685       // Find the actual implementation of the virtual method.
686       m = receiver->GetClass()->FindVirtualMethodForVirtualOrInterface(m, kRuntimePointerSize);
687     }
688   }
689 
690   // Get our arrays of arguments and their types, and check they're the same size.
691   ObjPtr<mirror::ObjectArray<mirror::Object>> objects =
692       soa.Decode<mirror::ObjectArray<mirror::Object>>(javaArgs);
693   auto* np_method = m->GetInterfaceMethodIfProxy(kRuntimePointerSize);
694   if (!CheckArgsForInvokeMethod(np_method, objects)) {
695     return nullptr;
696   }
697 
698   // If method is not set to be accessible, verify it can be accessed by the caller.
699   ObjPtr<mirror::Class> calling_class;
700   if (!accessible && !VerifyAccess(soa.Self(),
701                                    receiver,
702                                    declaring_class,
703                                    m->GetAccessFlags(),
704                                    &calling_class,
705                                    num_frames)) {
706     ThrowIllegalAccessException(
707         StringPrintf("Class %s cannot access %s method %s of class %s",
708             calling_class == nullptr ? "null" : calling_class->PrettyClass().c_str(),
709             PrettyJavaAccessFlags(m->GetAccessFlags()).c_str(),
710             m->PrettyMethod().c_str(),
711             m->GetDeclaringClass() == nullptr ? "null" :
712                 m->GetDeclaringClass()->PrettyClass().c_str()).c_str());
713     return nullptr;
714   }
715 
716   // Invoke the method.
717   JValue result;
718   const char* shorty;
719   if (!InvokeMethodImpl(soa, m, np_method, receiver, objects, &shorty, &result)) {
720     return nullptr;
721   }
722   return soa.AddLocalReference<jobject>(BoxPrimitive(Primitive::GetType(shorty[0]), result));
723 }
724 
InvokeConstructor(const ScopedObjectAccessAlreadyRunnable & soa,ArtMethod * constructor,ObjPtr<mirror::Object> receiver,jobject javaArgs)725 void InvokeConstructor(const ScopedObjectAccessAlreadyRunnable& soa,
726                        ArtMethod* constructor,
727                        ObjPtr<mirror::Object> receiver,
728                        jobject javaArgs) {
729   // We want to make sure that the stack is not within a small distance from the
730   // protected region in case we are calling into a leaf function whose stack
731   // check has been elided.
732   if (UNLIKELY(__builtin_frame_address(0) < soa.Self()->GetStackEndForInterpreter(true))) {
733     ThrowStackOverflowError(soa.Self());
734     return;
735   }
736 
737   if (kIsDebugBuild) {
738     CHECK(constructor->IsConstructor());
739 
740     ObjPtr<mirror::Class> declaring_class = constructor->GetDeclaringClass();
741     CHECK(declaring_class->IsInitialized());
742 
743     // Calls to String.<init> should have been repplaced with with equivalent StringFactory calls.
744     CHECK(!declaring_class->IsStringClass());
745 
746     // Check that the receiver is non-null and an instance of the field's declaring class.
747     CHECK(receiver != nullptr);
748     CHECK(VerifyObjectIsClass(receiver, declaring_class));
749     CHECK_EQ(constructor,
750              receiver->GetClass()->FindVirtualMethodForVirtualOrInterface(constructor,
751                                                                           kRuntimePointerSize));
752   }
753 
754   // Get our arrays of arguments and their types, and check they're the same size.
755   ObjPtr<mirror::ObjectArray<mirror::Object>> objects =
756       soa.Decode<mirror::ObjectArray<mirror::Object>>(javaArgs);
757   ArtMethod* np_method = constructor->GetInterfaceMethodIfProxy(kRuntimePointerSize);
758   if (!CheckArgsForInvokeMethod(np_method, objects)) {
759     return;
760   }
761 
762   // Invoke the constructor.
763   JValue result;
764   const char* shorty;
765   InvokeMethodImpl(soa, constructor, np_method, receiver, objects, &shorty, &result);
766 }
767 
BoxPrimitive(Primitive::Type src_class,const JValue & value)768 ObjPtr<mirror::Object> BoxPrimitive(Primitive::Type src_class, const JValue& value) {
769   if (src_class == Primitive::kPrimNot) {
770     return value.GetL();
771   }
772   if (src_class == Primitive::kPrimVoid) {
773     // There's no such thing as a void field, and void methods invoked via reflection return null.
774     return nullptr;
775   }
776 
777   jmethodID m = nullptr;
778   const char* shorty;
779   switch (src_class) {
780   case Primitive::kPrimBoolean:
781     m = WellKnownClasses::java_lang_Boolean_valueOf;
782     shorty = "LZ";
783     break;
784   case Primitive::kPrimByte:
785     m = WellKnownClasses::java_lang_Byte_valueOf;
786     shorty = "LB";
787     break;
788   case Primitive::kPrimChar:
789     m = WellKnownClasses::java_lang_Character_valueOf;
790     shorty = "LC";
791     break;
792   case Primitive::kPrimDouble:
793     m = WellKnownClasses::java_lang_Double_valueOf;
794     shorty = "LD";
795     break;
796   case Primitive::kPrimFloat:
797     m = WellKnownClasses::java_lang_Float_valueOf;
798     shorty = "LF";
799     break;
800   case Primitive::kPrimInt:
801     m = WellKnownClasses::java_lang_Integer_valueOf;
802     shorty = "LI";
803     break;
804   case Primitive::kPrimLong:
805     m = WellKnownClasses::java_lang_Long_valueOf;
806     shorty = "LJ";
807     break;
808   case Primitive::kPrimShort:
809     m = WellKnownClasses::java_lang_Short_valueOf;
810     shorty = "LS";
811     break;
812   default:
813     LOG(FATAL) << static_cast<int>(src_class);
814     shorty = nullptr;
815   }
816 
817   ScopedObjectAccessUnchecked soa(Thread::Current());
818   DCHECK_EQ(soa.Self()->GetState(), kRunnable);
819 
820   ArgArray arg_array(shorty, 2);
821   JValue result;
822   if (src_class == Primitive::kPrimDouble || src_class == Primitive::kPrimLong) {
823     arg_array.AppendWide(value.GetJ());
824   } else {
825     arg_array.Append(value.GetI());
826   }
827 
828   jni::DecodeArtMethod(m)->Invoke(soa.Self(),
829                                   arg_array.GetArray(),
830                                   arg_array.GetNumBytes(),
831                                   &result,
832                                   shorty);
833   return result.GetL();
834 }
835 
UnboxingFailureKind(ArtField * f)836 static std::string UnboxingFailureKind(ArtField* f)
837     REQUIRES_SHARED(Locks::mutator_lock_) {
838   if (f != nullptr) {
839     return "field " + f->PrettyField(false);
840   }
841   return "result";
842 }
843 
UnboxPrimitive(ObjPtr<mirror::Object> o,ObjPtr<mirror::Class> dst_class,ArtField * f,JValue * unboxed_value)844 static bool UnboxPrimitive(ObjPtr<mirror::Object> o,
845                            ObjPtr<mirror::Class> dst_class,
846                            ArtField* f,
847                            JValue* unboxed_value)
848     REQUIRES_SHARED(Locks::mutator_lock_) {
849   bool unbox_for_result = (f == nullptr);
850   if (!dst_class->IsPrimitive()) {
851     if (UNLIKELY(o != nullptr && !o->InstanceOf(dst_class))) {
852       if (!unbox_for_result) {
853         ThrowIllegalArgumentException(
854             StringPrintf("%s has type %s, got %s",
855                          UnboxingFailureKind(f).c_str(),
856                          dst_class->PrettyDescriptor().c_str(),
857                          o->PrettyTypeOf().c_str()).c_str());
858       } else {
859         ThrowClassCastException(
860             StringPrintf("Couldn't convert result of type %s to %s",
861                          o->PrettyTypeOf().c_str(),
862                          dst_class->PrettyDescriptor().c_str()).c_str());
863       }
864       return false;
865     }
866     unboxed_value->SetL(o);
867     return true;
868   }
869   if (UNLIKELY(dst_class->GetPrimitiveType() == Primitive::kPrimVoid)) {
870     ThrowIllegalArgumentException(StringPrintf("Can't unbox %s to void",
871                                                UnboxingFailureKind(f).c_str()).c_str());
872     return false;
873   }
874   if (UNLIKELY(o == nullptr)) {
875     if (!unbox_for_result) {
876       ThrowIllegalArgumentException(
877           StringPrintf("%s has type %s, got null",
878                        UnboxingFailureKind(f).c_str(),
879                        dst_class->PrettyDescriptor().c_str()).c_str());
880     } else {
881       ThrowNullPointerException(
882           StringPrintf("Expected to unbox a '%s' primitive type but was returned null",
883                        dst_class->PrettyDescriptor().c_str()).c_str());
884     }
885     return false;
886   }
887 
888   JValue boxed_value;
889   ObjPtr<mirror::Class> klass = o->GetClass();
890   Primitive::Type primitive_type;
891   ArtField* primitive_field = &klass->GetIFieldsPtr()->At(0);
892   if (klass->DescriptorEquals("Ljava/lang/Boolean;")) {
893     primitive_type = Primitive::kPrimBoolean;
894     boxed_value.SetZ(primitive_field->GetBoolean(o));
895   } else if (klass->DescriptorEquals("Ljava/lang/Byte;")) {
896     primitive_type = Primitive::kPrimByte;
897     boxed_value.SetB(primitive_field->GetByte(o));
898   } else if (klass->DescriptorEquals("Ljava/lang/Character;")) {
899     primitive_type = Primitive::kPrimChar;
900     boxed_value.SetC(primitive_field->GetChar(o));
901   } else if (klass->DescriptorEquals("Ljava/lang/Float;")) {
902     primitive_type = Primitive::kPrimFloat;
903     boxed_value.SetF(primitive_field->GetFloat(o));
904   } else if (klass->DescriptorEquals("Ljava/lang/Double;")) {
905     primitive_type = Primitive::kPrimDouble;
906     boxed_value.SetD(primitive_field->GetDouble(o));
907   } else if (klass->DescriptorEquals("Ljava/lang/Integer;")) {
908     primitive_type = Primitive::kPrimInt;
909     boxed_value.SetI(primitive_field->GetInt(o));
910   } else if (klass->DescriptorEquals("Ljava/lang/Long;")) {
911     primitive_type = Primitive::kPrimLong;
912     boxed_value.SetJ(primitive_field->GetLong(o));
913   } else if (klass->DescriptorEquals("Ljava/lang/Short;")) {
914     primitive_type = Primitive::kPrimShort;
915     boxed_value.SetS(primitive_field->GetShort(o));
916   } else {
917     std::string temp;
918     ThrowIllegalArgumentException(
919         StringPrintf("%s has type %s, got %s", UnboxingFailureKind(f).c_str(),
920             dst_class->PrettyDescriptor().c_str(),
921             PrettyDescriptor(o->GetClass()->GetDescriptor(&temp)).c_str()).c_str());
922     return false;
923   }
924 
925   return ConvertPrimitiveValue(unbox_for_result,
926                                primitive_type,
927                                dst_class->GetPrimitiveType(),
928                                boxed_value, unboxed_value);
929 }
930 
UnboxPrimitiveForField(ObjPtr<mirror::Object> o,ObjPtr<mirror::Class> dst_class,ArtField * f,JValue * unboxed_value)931 bool UnboxPrimitiveForField(ObjPtr<mirror::Object> o,
932                             ObjPtr<mirror::Class> dst_class,
933                             ArtField* f,
934                             JValue* unboxed_value) {
935   DCHECK(f != nullptr);
936   return UnboxPrimitive(o, dst_class, f, unboxed_value);
937 }
938 
UnboxPrimitiveForResult(ObjPtr<mirror::Object> o,ObjPtr<mirror::Class> dst_class,JValue * unboxed_value)939 bool UnboxPrimitiveForResult(ObjPtr<mirror::Object> o,
940                              ObjPtr<mirror::Class> dst_class,
941                              JValue* unboxed_value) {
942   return UnboxPrimitive(o, dst_class, nullptr, unboxed_value);
943 }
944 
GetCallingClass(Thread * self,size_t num_frames)945 ObjPtr<mirror::Class> GetCallingClass(Thread* self, size_t num_frames) {
946   NthCallerVisitor visitor(self, num_frames);
947   visitor.WalkStack();
948   return visitor.caller != nullptr ? visitor.caller->GetDeclaringClass() : nullptr;
949 }
950 
VerifyAccess(Thread * self,ObjPtr<mirror::Object> obj,ObjPtr<mirror::Class> declaring_class,uint32_t access_flags,ObjPtr<mirror::Class> * calling_class,size_t num_frames)951 bool VerifyAccess(Thread* self,
952                   ObjPtr<mirror::Object> obj,
953                   ObjPtr<mirror::Class> declaring_class,
954                   uint32_t access_flags,
955                   ObjPtr<mirror::Class>* calling_class,
956                   size_t num_frames) {
957   if ((access_flags & kAccPublic) != 0) {
958     return true;
959   }
960   ObjPtr<mirror::Class> klass = GetCallingClass(self, num_frames);
961   if (UNLIKELY(klass == nullptr)) {
962     // The caller is an attached native thread.
963     return false;
964   }
965   *calling_class = klass;
966   return VerifyAccess(obj, declaring_class, access_flags, klass);
967 }
968 
VerifyAccess(ObjPtr<mirror::Object> obj,ObjPtr<mirror::Class> declaring_class,uint32_t access_flags,ObjPtr<mirror::Class> calling_class)969 bool VerifyAccess(ObjPtr<mirror::Object> obj,
970                   ObjPtr<mirror::Class> declaring_class,
971                   uint32_t access_flags,
972                   ObjPtr<mirror::Class> calling_class) {
973   if (calling_class == declaring_class) {
974     return true;
975   }
976   ScopedAssertNoThreadSuspension sants("verify-access");
977   if ((access_flags & kAccPrivate) != 0) {
978     return false;
979   }
980   if ((access_flags & kAccProtected) != 0) {
981     if (obj != nullptr && !obj->InstanceOf(calling_class) &&
982         !declaring_class->IsInSamePackage(calling_class)) {
983       return false;
984     } else if (declaring_class->IsAssignableFrom(calling_class)) {
985       return true;
986     }
987   }
988   return declaring_class->IsInSamePackage(calling_class);
989 }
990 
InvalidReceiverError(ObjPtr<mirror::Object> o,ObjPtr<mirror::Class> c)991 void InvalidReceiverError(ObjPtr<mirror::Object> o, ObjPtr<mirror::Class> c) {
992   std::string expected_class_name(mirror::Class::PrettyDescriptor(c));
993   std::string actual_class_name(mirror::Object::PrettyTypeOf(o));
994   ThrowIllegalArgumentException(StringPrintf("Expected receiver of type %s, but got %s",
995                                              expected_class_name.c_str(),
996                                              actual_class_name.c_str()).c_str());
997 }
998 
999 // This only works if there's one reference which points to the object in obj.
1000 // Will need to be fixed if there's cases where it's not.
UpdateReference(Thread * self,jobject obj,ObjPtr<mirror::Object> result)1001 void UpdateReference(Thread* self, jobject obj, ObjPtr<mirror::Object> result) {
1002   IndirectRef ref = reinterpret_cast<IndirectRef>(obj);
1003   IndirectRefKind kind = IndirectReferenceTable::GetIndirectRefKind(ref);
1004   if (kind == kLocal) {
1005     self->GetJniEnv()->UpdateLocal(obj, result);
1006   } else if (kind == kHandleScopeOrInvalid) {
1007     LOG(FATAL) << "Unsupported UpdateReference for kind kHandleScopeOrInvalid";
1008   } else if (kind == kGlobal) {
1009     self->GetJniEnv()->GetVm()->UpdateGlobal(self, ref, result);
1010   } else {
1011     DCHECK_EQ(kind, kWeakGlobal);
1012     self->GetJniEnv()->GetVm()->UpdateWeakGlobal(self, ref, result);
1013   }
1014 }
1015 
1016 }  // namespace art
1017