1 /*
2  * Copyright (C) 2011 The Android Open Source Project
3  *
4  * Licensed under the Apache License, Version 2.0 (the "License");
5  * you may not use this file except in compliance with the License.
6  * You may obtain a copy of the License at
7  *
8  *      http://www.apache.org/licenses/LICENSE-2.0
9  *
10  * Unless required by applicable law or agreed to in writing, software
11  * distributed under the License is distributed on an "AS IS" BASIS,
12  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13  * See the License for the specific language governing permissions and
14  * limitations under the License.
15  */
16 
17 #include "reflection-inl.h"
18 
19 #include "class_linker.h"
20 #include "common_throws.h"
21 #include "dex_file-inl.h"
22 #include "jni_internal.h"
23 #include "method_helper-inl.h"
24 #include "mirror/art_field-inl.h"
25 #include "mirror/art_method-inl.h"
26 #include "mirror/class-inl.h"
27 #include "mirror/class.h"
28 #include "mirror/object_array-inl.h"
29 #include "mirror/object_array.h"
30 #include "nth_caller_visitor.h"
31 #include "scoped_thread_state_change.h"
32 #include "stack.h"
33 #include "well_known_classes.h"
34 
35 namespace art {
36 
37 class ArgArray {
38  public:
ArgArray(const char * shorty,uint32_t shorty_len)39   explicit ArgArray(const char* shorty, uint32_t shorty_len)
40       : shorty_(shorty), shorty_len_(shorty_len), num_bytes_(0) {
41     size_t num_slots = shorty_len + 1;  // +1 in case of receiver.
42     if (LIKELY((num_slots * 2) < kSmallArgArraySize)) {
43       // We can trivially use the small arg array.
44       arg_array_ = small_arg_array_;
45     } else {
46       // Analyze shorty to see if we need the large arg array.
47       for (size_t i = 1; i < shorty_len; ++i) {
48         char c = shorty[i];
49         if (c == 'J' || c == 'D') {
50           num_slots++;
51         }
52       }
53       if (num_slots <= kSmallArgArraySize) {
54         arg_array_ = small_arg_array_;
55       } else {
56         large_arg_array_.reset(new uint32_t[num_slots]);
57         arg_array_ = large_arg_array_.get();
58       }
59     }
60   }
61 
GetArray()62   uint32_t* GetArray() {
63     return arg_array_;
64   }
65 
GetNumBytes()66   uint32_t GetNumBytes() {
67     return num_bytes_;
68   }
69 
Append(uint32_t value)70   void Append(uint32_t value) {
71     arg_array_[num_bytes_ / 4] = value;
72     num_bytes_ += 4;
73   }
74 
Append(mirror::Object * obj)75   void Append(mirror::Object* obj) SHARED_LOCKS_REQUIRED(Locks::mutator_lock_) {
76     Append(StackReference<mirror::Object>::FromMirrorPtr(obj).AsVRegValue());
77   }
78 
AppendWide(uint64_t value)79   void AppendWide(uint64_t value) {
80     // For ARM and MIPS portable, align wide values to 8 bytes (ArgArray starts at offset of 4).
81 #if defined(ART_USE_PORTABLE_COMPILER) && (defined(__arm__) || defined(__mips__))
82     if (num_bytes_ % 8 == 0) {
83       num_bytes_ += 4;
84     }
85 #endif
86     arg_array_[num_bytes_ / 4] = value;
87     arg_array_[(num_bytes_ / 4) + 1] = value >> 32;
88     num_bytes_ += 8;
89   }
90 
AppendFloat(float value)91   void AppendFloat(float value) {
92     jvalue jv;
93     jv.f = value;
94     Append(jv.i);
95   }
96 
AppendDouble(double value)97   void AppendDouble(double value) {
98     jvalue jv;
99     jv.d = value;
100     AppendWide(jv.j);
101   }
102 
BuildArgArrayFromVarArgs(const ScopedObjectAccessAlreadyRunnable & soa,mirror::Object * receiver,va_list ap)103   void BuildArgArrayFromVarArgs(const ScopedObjectAccessAlreadyRunnable& soa,
104                                 mirror::Object* receiver, va_list ap)
105       SHARED_LOCKS_REQUIRED(Locks::mutator_lock_) {
106     // Set receiver if non-null (method is not static)
107     if (receiver != nullptr) {
108       Append(receiver);
109     }
110     for (size_t i = 1; i < shorty_len_; ++i) {
111       switch (shorty_[i]) {
112         case 'Z':
113         case 'B':
114         case 'C':
115         case 'S':
116         case 'I':
117           Append(va_arg(ap, jint));
118           break;
119         case 'F':
120           AppendFloat(va_arg(ap, jdouble));
121           break;
122         case 'L':
123           Append(soa.Decode<mirror::Object*>(va_arg(ap, jobject)));
124           break;
125         case 'D':
126           AppendDouble(va_arg(ap, jdouble));
127           break;
128         case 'J':
129           AppendWide(va_arg(ap, jlong));
130           break;
131 #ifndef NDEBUG
132         default:
133           LOG(FATAL) << "Unexpected shorty character: " << shorty_[i];
134 #endif
135       }
136     }
137   }
138 
BuildArgArrayFromJValues(const ScopedObjectAccessAlreadyRunnable & soa,mirror::Object * receiver,jvalue * args)139   void BuildArgArrayFromJValues(const ScopedObjectAccessAlreadyRunnable& soa,
140                                 mirror::Object* receiver, jvalue* args)
141       SHARED_LOCKS_REQUIRED(Locks::mutator_lock_) {
142     // Set receiver if non-null (method is not static)
143     if (receiver != nullptr) {
144       Append(receiver);
145     }
146     for (size_t i = 1, args_offset = 0; i < shorty_len_; ++i, ++args_offset) {
147       switch (shorty_[i]) {
148         case 'Z':
149           Append(args[args_offset].z);
150           break;
151         case 'B':
152           Append(args[args_offset].b);
153           break;
154         case 'C':
155           Append(args[args_offset].c);
156           break;
157         case 'S':
158           Append(args[args_offset].s);
159           break;
160         case 'I':
161         case 'F':
162           Append(args[args_offset].i);
163           break;
164         case 'L':
165           Append(soa.Decode<mirror::Object*>(args[args_offset].l));
166           break;
167         case 'D':
168         case 'J':
169           AppendWide(args[args_offset].j);
170           break;
171 #ifndef NDEBUG
172         default:
173           LOG(FATAL) << "Unexpected shorty character: " << shorty_[i];
174 #endif
175       }
176     }
177   }
178 
BuildArgArrayFromFrame(ShadowFrame * shadow_frame,uint32_t arg_offset)179   void BuildArgArrayFromFrame(ShadowFrame* shadow_frame, uint32_t arg_offset)
180       SHARED_LOCKS_REQUIRED(Locks::mutator_lock_) {
181     // Set receiver if non-null (method is not static)
182     size_t cur_arg = arg_offset;
183     if (!shadow_frame->GetMethod()->IsStatic()) {
184       Append(shadow_frame->GetVReg(cur_arg));
185       cur_arg++;
186     }
187     for (size_t i = 1; i < shorty_len_; ++i) {
188       switch (shorty_[i]) {
189         case 'Z':
190         case 'B':
191         case 'C':
192         case 'S':
193         case 'I':
194         case 'F':
195         case 'L':
196           Append(shadow_frame->GetVReg(cur_arg));
197           cur_arg++;
198           break;
199         case 'D':
200         case 'J':
201           AppendWide(shadow_frame->GetVRegLong(cur_arg));
202           cur_arg++;
203           cur_arg++;
204           break;
205 #ifndef NDEBUG
206         default:
207           LOG(FATAL) << "Unexpected shorty character: " << shorty_[i];
208 #endif
209       }
210     }
211   }
212 
ThrowIllegalPrimitiveArgumentException(const char * expected,const char * found_descriptor)213   static void ThrowIllegalPrimitiveArgumentException(const char* expected,
214                                                      const char* found_descriptor)
215       SHARED_LOCKS_REQUIRED(Locks::mutator_lock_) {
216     ThrowIllegalArgumentException(nullptr,
217         StringPrintf("Invalid primitive conversion from %s to %s", expected,
218                      PrettyDescriptor(found_descriptor).c_str()).c_str());
219   }
220 
BuildArgArrayFromObjectArray(const ScopedObjectAccessAlreadyRunnable & soa,mirror::Object * receiver,mirror::ObjectArray<mirror::Object> * args,MethodHelper & mh)221   bool BuildArgArrayFromObjectArray(const ScopedObjectAccessAlreadyRunnable& soa,
222                                     mirror::Object* receiver,
223                                     mirror::ObjectArray<mirror::Object>* args, MethodHelper& mh)
224       SHARED_LOCKS_REQUIRED(Locks::mutator_lock_) {
225     const DexFile::TypeList* classes = mh.GetMethod()->GetParameterTypeList();
226     // Set receiver if non-null (method is not static)
227     if (receiver != nullptr) {
228       Append(receiver);
229     }
230     for (size_t i = 1, args_offset = 0; i < shorty_len_; ++i, ++args_offset) {
231       mirror::Object* arg = args->Get(args_offset);
232       if (((shorty_[i] == 'L') && (arg != nullptr)) || ((arg == nullptr && shorty_[i] != 'L'))) {
233         mirror::Class* dst_class =
234             mh.GetClassFromTypeIdx(classes->GetTypeItem(args_offset).type_idx_);
235         if (UNLIKELY(arg == nullptr || !arg->InstanceOf(dst_class))) {
236           ThrowIllegalArgumentException(nullptr,
237               StringPrintf("method %s argument %zd has type %s, got %s",
238                   PrettyMethod(mh.GetMethod(), false).c_str(),
239                   args_offset + 1,  // Humans don't count from 0.
240                   PrettyDescriptor(dst_class).c_str(),
241                   PrettyTypeOf(arg).c_str()).c_str());
242           return false;
243         }
244       }
245 
246 #define DO_FIRST_ARG(match_descriptor, get_fn, append) { \
247           if (LIKELY(arg != nullptr && arg->GetClass<>()->DescriptorEquals(match_descriptor))) { \
248             mirror::ArtField* primitive_field = arg->GetClass()->GetIFields()->Get(0); \
249             append(primitive_field-> get_fn(arg));
250 
251 #define DO_ARG(match_descriptor, get_fn, append) \
252           } else if (LIKELY(arg != nullptr && \
253                             arg->GetClass<>()->DescriptorEquals(match_descriptor))) { \
254             mirror::ArtField* primitive_field = arg->GetClass()->GetIFields()->Get(0); \
255             append(primitive_field-> get_fn(arg));
256 
257 #define DO_FAIL(expected) \
258           } else { \
259             if (arg->GetClass<>()->IsPrimitive()) { \
260               std::string temp; \
261               ThrowIllegalPrimitiveArgumentException(expected, \
262                                                      arg->GetClass<>()->GetDescriptor(&temp)); \
263             } else { \
264               ThrowIllegalArgumentException(nullptr, \
265                   StringPrintf("method %s argument %zd has type %s, got %s", \
266                       PrettyMethod(mh.GetMethod(), false).c_str(), \
267                       args_offset + 1, \
268                       expected, \
269                       PrettyTypeOf(arg).c_str()).c_str()); \
270             } \
271             return false; \
272           } }
273 
274       switch (shorty_[i]) {
275         case 'L':
276           Append(arg);
277           break;
278         case 'Z':
279           DO_FIRST_ARG("Ljava/lang/Boolean;", GetBoolean, Append)
280           DO_FAIL("boolean")
281           break;
282         case 'B':
283           DO_FIRST_ARG("Ljava/lang/Byte;", GetByte, Append)
284           DO_FAIL("byte")
285           break;
286         case 'C':
287           DO_FIRST_ARG("Ljava/lang/Character;", GetChar, Append)
288           DO_FAIL("char")
289           break;
290         case 'S':
291           DO_FIRST_ARG("Ljava/lang/Short;", GetShort, Append)
292           DO_ARG("Ljava/lang/Byte;", GetByte, Append)
293           DO_FAIL("short")
294           break;
295         case 'I':
296           DO_FIRST_ARG("Ljava/lang/Integer;", GetInt, Append)
297           DO_ARG("Ljava/lang/Character;", GetChar, Append)
298           DO_ARG("Ljava/lang/Short;", GetShort, Append)
299           DO_ARG("Ljava/lang/Byte;", GetByte, Append)
300           DO_FAIL("int")
301           break;
302         case 'J':
303           DO_FIRST_ARG("Ljava/lang/Long;", GetLong, AppendWide)
304           DO_ARG("Ljava/lang/Integer;", GetInt, AppendWide)
305           DO_ARG("Ljava/lang/Character;", GetChar, AppendWide)
306           DO_ARG("Ljava/lang/Short;", GetShort, AppendWide)
307           DO_ARG("Ljava/lang/Byte;", GetByte, AppendWide)
308           DO_FAIL("long")
309           break;
310         case 'F':
311           DO_FIRST_ARG("Ljava/lang/Float;", GetFloat, AppendFloat)
312           DO_ARG("Ljava/lang/Long;", GetLong, AppendFloat)
313           DO_ARG("Ljava/lang/Integer;", GetInt, AppendFloat)
314           DO_ARG("Ljava/lang/Character;", GetChar, AppendFloat)
315           DO_ARG("Ljava/lang/Short;", GetShort, AppendFloat)
316           DO_ARG("Ljava/lang/Byte;", GetByte, AppendFloat)
317           DO_FAIL("float")
318           break;
319         case 'D':
320           DO_FIRST_ARG("Ljava/lang/Double;", GetDouble, AppendDouble)
321           DO_ARG("Ljava/lang/Float;", GetFloat, AppendDouble)
322           DO_ARG("Ljava/lang/Long;", GetLong, AppendDouble)
323           DO_ARG("Ljava/lang/Integer;", GetInt, AppendDouble)
324           DO_ARG("Ljava/lang/Character;", GetChar, AppendDouble)
325           DO_ARG("Ljava/lang/Short;", GetShort, AppendDouble)
326           DO_ARG("Ljava/lang/Byte;", GetByte, AppendDouble)
327           DO_FAIL("double")
328           break;
329 #ifndef NDEBUG
330         default:
331           LOG(FATAL) << "Unexpected shorty character: " << shorty_[i];
332 #endif
333       }
334 #undef DO_FIRST_ARG
335 #undef DO_ARG
336 #undef DO_FAIL
337     }
338     return true;
339   }
340 
341  private:
342   enum { kSmallArgArraySize = 16 };
343   const char* const shorty_;
344   const uint32_t shorty_len_;
345   uint32_t num_bytes_;
346   uint32_t* arg_array_;
347   uint32_t small_arg_array_[kSmallArgArraySize];
348   std::unique_ptr<uint32_t[]> large_arg_array_;
349 };
350 
CheckMethodArguments(mirror::ArtMethod * m,uint32_t * args)351 static void CheckMethodArguments(mirror::ArtMethod* m, uint32_t* args)
352     SHARED_LOCKS_REQUIRED(Locks::mutator_lock_) {
353   const DexFile::TypeList* params = m->GetParameterTypeList();
354   if (params == nullptr) {
355     return;  // No arguments so nothing to check.
356   }
357   uint32_t offset = 0;
358   uint32_t num_params = params->Size();
359   size_t error_count = 0;
360   if (!m->IsStatic()) {
361     offset = 1;
362   }
363   // TODO: If args contain object references, it may cause problems
364   Thread* self = Thread::Current();
365   StackHandleScope<1> hs(self);
366   Handle<mirror::ArtMethod> h_m(hs.NewHandle(m));
367   MethodHelper mh(h_m);
368   for (uint32_t i = 0; i < num_params; i++) {
369     uint16_t type_idx = params->GetTypeItem(i).type_idx_;
370     mirror::Class* param_type = mh.GetClassFromTypeIdx(type_idx);
371     if (param_type == nullptr) {
372       CHECK(self->IsExceptionPending());
373       LOG(ERROR) << "Internal error: unresolvable type for argument type in JNI invoke: "
374           << h_m->GetTypeDescriptorFromTypeIdx(type_idx) << "\n"
375           << self->GetException(nullptr)->Dump();
376       self->ClearException();
377       ++error_count;
378     } else if (!param_type->IsPrimitive()) {
379       // TODO: check primitives are in range.
380       // TODO: There is a compaction bug here since GetClassFromTypeIdx can cause thread suspension,
381       // this is a hard to fix problem since the args can contain Object*, we need to save and
382       // restore them by using a visitor similar to the ones used in the trampoline entrypoints.
383       mirror::Object* argument = reinterpret_cast<mirror::Object*>(args[i + offset]);
384       if (argument != nullptr && !argument->InstanceOf(param_type)) {
385         LOG(ERROR) << "JNI ERROR (app bug): attempt to pass an instance of "
386                    << PrettyTypeOf(argument) << " as argument " << (i + 1)
387                    << " to " << PrettyMethod(h_m.Get());
388         ++error_count;
389       }
390     } else if (param_type->IsPrimitiveLong() || param_type->IsPrimitiveDouble()) {
391       offset++;
392     }
393   }
394   if (error_count > 0) {
395     // TODO: pass the JNI function name (such as "CallVoidMethodV") through so we can call JniAbort
396     // with an argument.
397     JniAbortF(nullptr, "bad arguments passed to %s (see above for details)",
398               PrettyMethod(h_m.Get()).c_str());
399   }
400 }
401 
FindVirtualMethod(mirror::Object * receiver,mirror::ArtMethod * method)402 static mirror::ArtMethod* FindVirtualMethod(mirror::Object* receiver,
403                                             mirror::ArtMethod* method)
404     SHARED_LOCKS_REQUIRED(Locks::mutator_lock_) {
405   return receiver->GetClass()->FindVirtualMethodForVirtualOrInterface(method);
406 }
407 
408 
InvokeWithArgArray(const ScopedObjectAccessAlreadyRunnable & soa,mirror::ArtMethod * method,ArgArray * arg_array,JValue * result,const char * shorty)409 static void InvokeWithArgArray(const ScopedObjectAccessAlreadyRunnable& soa,
410                                mirror::ArtMethod* method, ArgArray* arg_array, JValue* result,
411                                const char* shorty)
412     SHARED_LOCKS_REQUIRED(Locks::mutator_lock_) {
413   uint32_t* args = arg_array->GetArray();
414   if (UNLIKELY(soa.Env()->check_jni)) {
415     CheckMethodArguments(method, args);
416   }
417   method->Invoke(soa.Self(), args, arg_array->GetNumBytes(), result, shorty);
418 }
419 
InvokeWithVarArgs(const ScopedObjectAccessAlreadyRunnable & soa,jobject obj,jmethodID mid,va_list args)420 JValue InvokeWithVarArgs(const ScopedObjectAccessAlreadyRunnable& soa, jobject obj, jmethodID mid,
421                          va_list args)
422     SHARED_LOCKS_REQUIRED(Locks::mutator_lock_) {
423   // We want to make sure that the stack is not within a small distance from the
424   // protected region in case we are calling into a leaf function whose stack
425   // check has been elided.
426   if (UNLIKELY(__builtin_frame_address(0) < soa.Self()->GetStackEnd())) {
427     ThrowStackOverflowError(soa.Self());
428     return JValue();
429   }
430 
431   mirror::ArtMethod* method = soa.DecodeMethod(mid);
432   mirror::Object* receiver = method->IsStatic() ? nullptr : soa.Decode<mirror::Object*>(obj);
433   uint32_t shorty_len = 0;
434   const char* shorty = method->GetShorty(&shorty_len);
435   JValue result;
436   ArgArray arg_array(shorty, shorty_len);
437   arg_array.BuildArgArrayFromVarArgs(soa, receiver, args);
438   InvokeWithArgArray(soa, method, &arg_array, &result, shorty);
439   return result;
440 }
441 
InvokeWithJValues(const ScopedObjectAccessAlreadyRunnable & soa,mirror::Object * receiver,jmethodID mid,jvalue * args)442 JValue InvokeWithJValues(const ScopedObjectAccessAlreadyRunnable& soa, mirror::Object* receiver,
443                          jmethodID mid, jvalue* args) {
444   // We want to make sure that the stack is not within a small distance from the
445   // protected region in case we are calling into a leaf function whose stack
446   // check has been elided.
447   if (UNLIKELY(__builtin_frame_address(0) < soa.Self()->GetStackEnd())) {
448     ThrowStackOverflowError(soa.Self());
449     return JValue();
450   }
451 
452   mirror::ArtMethod* method = soa.DecodeMethod(mid);
453   uint32_t shorty_len = 0;
454   const char* shorty = method->GetShorty(&shorty_len);
455   JValue result;
456   ArgArray arg_array(shorty, shorty_len);
457   arg_array.BuildArgArrayFromJValues(soa, receiver, args);
458   InvokeWithArgArray(soa, method, &arg_array, &result, shorty);
459   return result;
460 }
461 
InvokeVirtualOrInterfaceWithJValues(const ScopedObjectAccessAlreadyRunnable & soa,mirror::Object * receiver,jmethodID mid,jvalue * args)462 JValue InvokeVirtualOrInterfaceWithJValues(const ScopedObjectAccessAlreadyRunnable& soa,
463                                            mirror::Object* receiver, jmethodID mid, jvalue* args) {
464   // We want to make sure that the stack is not within a small distance from the
465   // protected region in case we are calling into a leaf function whose stack
466   // check has been elided.
467   if (UNLIKELY(__builtin_frame_address(0) < soa.Self()->GetStackEnd())) {
468     ThrowStackOverflowError(soa.Self());
469     return JValue();
470   }
471 
472   mirror::ArtMethod* method = FindVirtualMethod(receiver, soa.DecodeMethod(mid));
473   uint32_t shorty_len = 0;
474   const char* shorty = method->GetShorty(&shorty_len);
475   JValue result;
476   ArgArray arg_array(shorty, shorty_len);
477   arg_array.BuildArgArrayFromJValues(soa, receiver, args);
478   InvokeWithArgArray(soa, method, &arg_array, &result, shorty);
479   return result;
480 }
481 
InvokeVirtualOrInterfaceWithVarArgs(const ScopedObjectAccessAlreadyRunnable & soa,jobject obj,jmethodID mid,va_list args)482 JValue InvokeVirtualOrInterfaceWithVarArgs(const ScopedObjectAccessAlreadyRunnable& soa,
483                                            jobject obj, jmethodID mid, va_list args) {
484   // We want to make sure that the stack is not within a small distance from the
485   // protected region in case we are calling into a leaf function whose stack
486   // check has been elided.
487   if (UNLIKELY(__builtin_frame_address(0) < soa.Self()->GetStackEnd())) {
488     ThrowStackOverflowError(soa.Self());
489     return JValue();
490   }
491 
492   mirror::Object* receiver = soa.Decode<mirror::Object*>(obj);
493   mirror::ArtMethod* method = FindVirtualMethod(receiver, soa.DecodeMethod(mid));
494   uint32_t shorty_len = 0;
495   const char* shorty = method->GetShorty(&shorty_len);
496   JValue result;
497   ArgArray arg_array(shorty, shorty_len);
498   arg_array.BuildArgArrayFromVarArgs(soa, receiver, args);
499   InvokeWithArgArray(soa, method, &arg_array, &result, shorty);
500   return result;
501 }
502 
InvokeWithShadowFrame(Thread * self,ShadowFrame * shadow_frame,uint16_t arg_offset,MethodHelper & mh,JValue * result)503 void InvokeWithShadowFrame(Thread* self, ShadowFrame* shadow_frame, uint16_t arg_offset,
504                            MethodHelper& mh, JValue* result) {
505   // We want to make sure that the stack is not within a small distance from the
506   // protected region in case we are calling into a leaf function whose stack
507   // check has been elided.
508   if (UNLIKELY(__builtin_frame_address(0) < self->GetStackEnd())) {
509     ThrowStackOverflowError(self);
510     return;
511   }
512 
513   ArgArray arg_array(mh.GetShorty(), mh.GetShortyLength());
514   arg_array.BuildArgArrayFromFrame(shadow_frame, arg_offset);
515   shadow_frame->GetMethod()->Invoke(self, arg_array.GetArray(), arg_array.GetNumBytes(), result,
516                                     mh.GetShorty());
517 }
518 
InvokeMethod(const ScopedObjectAccessAlreadyRunnable & soa,jobject javaMethod,jobject javaReceiver,jobject javaArgs,bool accessible)519 jobject InvokeMethod(const ScopedObjectAccessAlreadyRunnable& soa, jobject javaMethod,
520                      jobject javaReceiver, jobject javaArgs, bool accessible) {
521   // We want to make sure that the stack is not within a small distance from the
522   // protected region in case we are calling into a leaf function whose stack
523   // check has been elided.
524   if (UNLIKELY(__builtin_frame_address(0) <
525                soa.Self()->GetStackEndForInterpreter(true))) {
526     ThrowStackOverflowError(soa.Self());
527     return nullptr;
528   }
529 
530   mirror::ArtMethod* m = mirror::ArtMethod::FromReflectedMethod(soa, javaMethod);
531 
532   mirror::Class* declaring_class = m->GetDeclaringClass();
533   if (UNLIKELY(!declaring_class->IsInitialized())) {
534     StackHandleScope<1> hs(soa.Self());
535     Handle<mirror::Class> h_class(hs.NewHandle(declaring_class));
536     if (!Runtime::Current()->GetClassLinker()->EnsureInitialized(h_class, true, true)) {
537       return nullptr;
538     }
539     declaring_class = h_class.Get();
540   }
541 
542   mirror::Object* receiver = nullptr;
543   if (!m->IsStatic()) {
544     // Check that the receiver is non-null and an instance of the field's declaring class.
545     receiver = soa.Decode<mirror::Object*>(javaReceiver);
546     if (!VerifyObjectIsClass(receiver, declaring_class)) {
547       return NULL;
548     }
549 
550     // Find the actual implementation of the virtual method.
551     m = receiver->GetClass()->FindVirtualMethodForVirtualOrInterface(m);
552   }
553 
554   // Get our arrays of arguments and their types, and check they're the same size.
555   mirror::ObjectArray<mirror::Object>* objects =
556       soa.Decode<mirror::ObjectArray<mirror::Object>*>(javaArgs);
557   const DexFile::TypeList* classes = m->GetParameterTypeList();
558   uint32_t classes_size = (classes == nullptr) ? 0 : classes->Size();
559   uint32_t arg_count = (objects != nullptr) ? objects->GetLength() : 0;
560   if (arg_count != classes_size) {
561     ThrowIllegalArgumentException(NULL,
562                                   StringPrintf("Wrong number of arguments; expected %d, got %d",
563                                                classes_size, arg_count).c_str());
564     return NULL;
565   }
566 
567   // If method is not set to be accessible, verify it can be accessed by the caller.
568   if (!accessible && !VerifyAccess(soa.Self(), receiver, declaring_class, m->GetAccessFlags())) {
569     ThrowIllegalAccessException(nullptr, StringPrintf("Cannot access method: %s",
570                                                       PrettyMethod(m).c_str()).c_str());
571     return nullptr;
572   }
573 
574   // Invoke the method.
575   JValue result;
576   uint32_t shorty_len = 0;
577   const char* shorty = m->GetShorty(&shorty_len);
578   ArgArray arg_array(shorty, shorty_len);
579   StackHandleScope<1> hs(soa.Self());
580   MethodHelper mh(hs.NewHandle(m));
581   if (!arg_array.BuildArgArrayFromObjectArray(soa, receiver, objects, mh)) {
582     CHECK(soa.Self()->IsExceptionPending());
583     return nullptr;
584   }
585 
586   InvokeWithArgArray(soa, m, &arg_array, &result, shorty);
587 
588   // Wrap any exception with "Ljava/lang/reflect/InvocationTargetException;" and return early.
589   if (soa.Self()->IsExceptionPending()) {
590     jthrowable th = soa.Env()->ExceptionOccurred();
591     soa.Env()->ExceptionClear();
592     jclass exception_class = soa.Env()->FindClass("java/lang/reflect/InvocationTargetException");
593     jmethodID mid = soa.Env()->GetMethodID(exception_class, "<init>", "(Ljava/lang/Throwable;)V");
594     jobject exception_instance = soa.Env()->NewObject(exception_class, mid, th);
595     soa.Env()->Throw(reinterpret_cast<jthrowable>(exception_instance));
596     return NULL;
597   }
598 
599   // Box if necessary and return.
600   return soa.AddLocalReference<jobject>(BoxPrimitive(mh.GetReturnType()->GetPrimitiveType(),
601                                                      result));
602 }
603 
VerifyObjectIsClass(mirror::Object * o,mirror::Class * c)604 bool VerifyObjectIsClass(mirror::Object* o, mirror::Class* c) {
605   if (o == NULL) {
606     ThrowNullPointerException(NULL, "null receiver");
607     return false;
608   } else if (!o->InstanceOf(c)) {
609     std::string expected_class_name(PrettyDescriptor(c));
610     std::string actual_class_name(PrettyTypeOf(o));
611     ThrowIllegalArgumentException(NULL,
612                                   StringPrintf("Expected receiver of type %s, but got %s",
613                                                expected_class_name.c_str(),
614                                                actual_class_name.c_str()).c_str());
615     return false;
616   }
617   return true;
618 }
619 
BoxPrimitive(Primitive::Type src_class,const JValue & value)620 mirror::Object* BoxPrimitive(Primitive::Type src_class, const JValue& value) {
621   if (src_class == Primitive::kPrimNot) {
622     return value.GetL();
623   }
624   if (src_class == Primitive::kPrimVoid) {
625     // There's no such thing as a void field, and void methods invoked via reflection return null.
626     return nullptr;
627   }
628 
629   jmethodID m = nullptr;
630   const char* shorty;
631   switch (src_class) {
632   case Primitive::kPrimBoolean:
633     m = WellKnownClasses::java_lang_Boolean_valueOf;
634     shorty = "LZ";
635     break;
636   case Primitive::kPrimByte:
637     m = WellKnownClasses::java_lang_Byte_valueOf;
638     shorty = "LB";
639     break;
640   case Primitive::kPrimChar:
641     m = WellKnownClasses::java_lang_Character_valueOf;
642     shorty = "LC";
643     break;
644   case Primitive::kPrimDouble:
645     m = WellKnownClasses::java_lang_Double_valueOf;
646     shorty = "LD";
647     break;
648   case Primitive::kPrimFloat:
649     m = WellKnownClasses::java_lang_Float_valueOf;
650     shorty = "LF";
651     break;
652   case Primitive::kPrimInt:
653     m = WellKnownClasses::java_lang_Integer_valueOf;
654     shorty = "LI";
655     break;
656   case Primitive::kPrimLong:
657     m = WellKnownClasses::java_lang_Long_valueOf;
658     shorty = "LJ";
659     break;
660   case Primitive::kPrimShort:
661     m = WellKnownClasses::java_lang_Short_valueOf;
662     shorty = "LS";
663     break;
664   default:
665     LOG(FATAL) << static_cast<int>(src_class);
666     shorty = nullptr;
667   }
668 
669   ScopedObjectAccessUnchecked soa(Thread::Current());
670   DCHECK_EQ(soa.Self()->GetState(), kRunnable);
671 
672   ArgArray arg_array(shorty, 2);
673   JValue result;
674   if (src_class == Primitive::kPrimDouble || src_class == Primitive::kPrimLong) {
675     arg_array.AppendWide(value.GetJ());
676   } else {
677     arg_array.Append(value.GetI());
678   }
679 
680   soa.DecodeMethod(m)->Invoke(soa.Self(), arg_array.GetArray(), arg_array.GetNumBytes(),
681                               &result, shorty);
682   return result.GetL();
683 }
684 
UnboxingFailureKind(mirror::ArtField * f)685 static std::string UnboxingFailureKind(mirror::ArtField* f)
686     SHARED_LOCKS_REQUIRED(Locks::mutator_lock_) {
687   if (f != nullptr) {
688     return "field " + PrettyField(f, false);
689   }
690   return "result";
691 }
692 
UnboxPrimitive(const ThrowLocation * throw_location,mirror::Object * o,mirror::Class * dst_class,mirror::ArtField * f,JValue * unboxed_value)693 static bool UnboxPrimitive(const ThrowLocation* throw_location, mirror::Object* o,
694                            mirror::Class* dst_class, mirror::ArtField* f,
695                            JValue* unboxed_value)
696     SHARED_LOCKS_REQUIRED(Locks::mutator_lock_) {
697   bool unbox_for_result = (f == nullptr);
698   if (!dst_class->IsPrimitive()) {
699     if (UNLIKELY(o != nullptr && !o->InstanceOf(dst_class))) {
700       if (!unbox_for_result) {
701         ThrowIllegalArgumentException(throw_location,
702                                       StringPrintf("%s has type %s, got %s",
703                                                    UnboxingFailureKind(f).c_str(),
704                                                    PrettyDescriptor(dst_class).c_str(),
705                                                    PrettyTypeOf(o).c_str()).c_str());
706       } else {
707         ThrowClassCastException(throw_location,
708                                 StringPrintf("Couldn't convert result of type %s to %s",
709                                              PrettyTypeOf(o).c_str(),
710                                              PrettyDescriptor(dst_class).c_str()).c_str());
711       }
712       return false;
713     }
714     unboxed_value->SetL(o);
715     return true;
716   }
717   if (UNLIKELY(dst_class->GetPrimitiveType() == Primitive::kPrimVoid)) {
718     ThrowIllegalArgumentException(throw_location,
719                                   StringPrintf("Can't unbox %s to void",
720                                                UnboxingFailureKind(f).c_str()).c_str());
721     return false;
722   }
723   if (UNLIKELY(o == nullptr)) {
724     if (!unbox_for_result) {
725       ThrowIllegalArgumentException(throw_location,
726                                     StringPrintf("%s has type %s, got null",
727                                                  UnboxingFailureKind(f).c_str(),
728                                                  PrettyDescriptor(dst_class).c_str()).c_str());
729     } else {
730       ThrowNullPointerException(throw_location,
731                                 StringPrintf("Expected to unbox a '%s' primitive type but was returned null",
732                                              PrettyDescriptor(dst_class).c_str()).c_str());
733     }
734     return false;
735   }
736 
737   JValue boxed_value;
738   mirror::Class* klass = o->GetClass();
739   mirror::Class* src_class = nullptr;
740   ClassLinker* class_linker = Runtime::Current()->GetClassLinker();
741   mirror::ArtField* primitive_field = o->GetClass()->GetIFields()->Get(0);
742   if (klass->DescriptorEquals("Ljava/lang/Boolean;")) {
743     src_class = class_linker->FindPrimitiveClass('Z');
744     boxed_value.SetZ(primitive_field->GetBoolean(o));
745   } else if (klass->DescriptorEquals("Ljava/lang/Byte;")) {
746     src_class = class_linker->FindPrimitiveClass('B');
747     boxed_value.SetB(primitive_field->GetByte(o));
748   } else if (klass->DescriptorEquals("Ljava/lang/Character;")) {
749     src_class = class_linker->FindPrimitiveClass('C');
750     boxed_value.SetC(primitive_field->GetChar(o));
751   } else if (klass->DescriptorEquals("Ljava/lang/Float;")) {
752     src_class = class_linker->FindPrimitiveClass('F');
753     boxed_value.SetF(primitive_field->GetFloat(o));
754   } else if (klass->DescriptorEquals("Ljava/lang/Double;")) {
755     src_class = class_linker->FindPrimitiveClass('D');
756     boxed_value.SetD(primitive_field->GetDouble(o));
757   } else if (klass->DescriptorEquals("Ljava/lang/Integer;")) {
758     src_class = class_linker->FindPrimitiveClass('I');
759     boxed_value.SetI(primitive_field->GetInt(o));
760   } else if (klass->DescriptorEquals("Ljava/lang/Long;")) {
761     src_class = class_linker->FindPrimitiveClass('J');
762     boxed_value.SetJ(primitive_field->GetLong(o));
763   } else if (klass->DescriptorEquals("Ljava/lang/Short;")) {
764     src_class = class_linker->FindPrimitiveClass('S');
765     boxed_value.SetS(primitive_field->GetShort(o));
766   } else {
767     std::string temp;
768     ThrowIllegalArgumentException(throw_location,
769         StringPrintf("%s has type %s, got %s", UnboxingFailureKind(f).c_str(),
770             PrettyDescriptor(dst_class).c_str(),
771             PrettyDescriptor(o->GetClass()->GetDescriptor(&temp)).c_str()).c_str());
772     return false;
773   }
774 
775   return ConvertPrimitiveValue(throw_location, unbox_for_result,
776                                src_class->GetPrimitiveType(), dst_class->GetPrimitiveType(),
777                                boxed_value, unboxed_value);
778 }
779 
UnboxPrimitiveForField(mirror::Object * o,mirror::Class * dst_class,mirror::ArtField * f,JValue * unboxed_value)780 bool UnboxPrimitiveForField(mirror::Object* o, mirror::Class* dst_class, mirror::ArtField* f,
781                             JValue* unboxed_value) {
782   DCHECK(f != nullptr);
783   return UnboxPrimitive(nullptr, o, dst_class, f, unboxed_value);
784 }
785 
UnboxPrimitiveForResult(const ThrowLocation & throw_location,mirror::Object * o,mirror::Class * dst_class,JValue * unboxed_value)786 bool UnboxPrimitiveForResult(const ThrowLocation& throw_location, mirror::Object* o,
787                              mirror::Class* dst_class, JValue* unboxed_value) {
788   return UnboxPrimitive(&throw_location, o, dst_class, nullptr, unboxed_value);
789 }
790 
VerifyAccess(Thread * self,mirror::Object * obj,mirror::Class * declaring_class,uint32_t access_flags)791 bool VerifyAccess(Thread* self, mirror::Object* obj, mirror::Class* declaring_class, uint32_t access_flags) {
792   if ((access_flags & kAccPublic) != 0) {
793     return true;
794   }
795   NthCallerVisitor visitor(self, 2);
796   visitor.WalkStack();
797   if (UNLIKELY(visitor.caller == nullptr)) {
798     // The caller is an attached native thread.
799     return false;
800   }
801   mirror::Class* caller_class = visitor.caller->GetDeclaringClass();
802   if (caller_class == declaring_class) {
803     return true;
804   }
805   if ((access_flags & kAccPrivate) != 0) {
806     return false;
807   }
808   if ((access_flags & kAccProtected) != 0) {
809     if (obj != nullptr && !obj->InstanceOf(caller_class) &&
810         !declaring_class->IsInSamePackage(caller_class)) {
811       return false;
812     } else if (declaring_class->IsAssignableFrom(caller_class)) {
813       return true;
814     }
815   }
816   return declaring_class->IsInSamePackage(caller_class);
817 }
818 
819 }  // namespace art
820