1 /*
2  * Copyright (C) 2011 The Android Open Source Project
3  *
4  * Licensed under the Apache License, Version 2.0 (the "License");
5  * you may not use this file except in compliance with the License.
6  * You may obtain a copy of the License at
7  *
8  *      http://www.apache.org/licenses/LICENSE-2.0
9  *
10  * Unless required by applicable law or agreed to in writing, software
11  * distributed under the License is distributed on an "AS IS" BASIS,
12  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13  * See the License for the specific language governing permissions and
14  * limitations under the License.
15  */
16 
17 #include "reflection-inl.h"
18 
19 #include "art_field-inl.h"
20 #include "art_method-inl.h"
21 #include "class_linker.h"
22 #include "common_throws.h"
23 #include "dex_file-inl.h"
24 #include "indirect_reference_table-inl.h"
25 #include "jni_internal.h"
26 #include "mirror/abstract_method.h"
27 #include "mirror/class-inl.h"
28 #include "mirror/object_array-inl.h"
29 #include "nth_caller_visitor.h"
30 #include "scoped_thread_state_change.h"
31 #include "stack.h"
32 #include "well_known_classes.h"
33 
34 namespace art {
35 
36 class ArgArray {
37  public:
ArgArray(const char * shorty,uint32_t shorty_len)38   ArgArray(const char* shorty, uint32_t shorty_len)
39       : shorty_(shorty), shorty_len_(shorty_len), num_bytes_(0) {
40     size_t num_slots = shorty_len + 1;  // +1 in case of receiver.
41     if (LIKELY((num_slots * 2) < kSmallArgArraySize)) {
42       // We can trivially use the small arg array.
43       arg_array_ = small_arg_array_;
44     } else {
45       // Analyze shorty to see if we need the large arg array.
46       for (size_t i = 1; i < shorty_len; ++i) {
47         char c = shorty[i];
48         if (c == 'J' || c == 'D') {
49           num_slots++;
50         }
51       }
52       if (num_slots <= kSmallArgArraySize) {
53         arg_array_ = small_arg_array_;
54       } else {
55         large_arg_array_.reset(new uint32_t[num_slots]);
56         arg_array_ = large_arg_array_.get();
57       }
58     }
59   }
60 
GetArray()61   uint32_t* GetArray() {
62     return arg_array_;
63   }
64 
GetNumBytes()65   uint32_t GetNumBytes() {
66     return num_bytes_;
67   }
68 
Append(uint32_t value)69   void Append(uint32_t value) {
70     arg_array_[num_bytes_ / 4] = value;
71     num_bytes_ += 4;
72   }
73 
Append(mirror::Object * obj)74   void Append(mirror::Object* obj) SHARED_REQUIRES(Locks::mutator_lock_) {
75     Append(StackReference<mirror::Object>::FromMirrorPtr(obj).AsVRegValue());
76   }
77 
AppendWide(uint64_t value)78   void AppendWide(uint64_t value) {
79     arg_array_[num_bytes_ / 4] = value;
80     arg_array_[(num_bytes_ / 4) + 1] = value >> 32;
81     num_bytes_ += 8;
82   }
83 
AppendFloat(float value)84   void AppendFloat(float value) {
85     jvalue jv;
86     jv.f = value;
87     Append(jv.i);
88   }
89 
AppendDouble(double value)90   void AppendDouble(double value) {
91     jvalue jv;
92     jv.d = value;
93     AppendWide(jv.j);
94   }
95 
BuildArgArrayFromVarArgs(const ScopedObjectAccessAlreadyRunnable & soa,mirror::Object * receiver,va_list ap)96   void BuildArgArrayFromVarArgs(const ScopedObjectAccessAlreadyRunnable& soa,
97                                 mirror::Object* receiver, va_list ap)
98       SHARED_REQUIRES(Locks::mutator_lock_) {
99     // Set receiver if non-null (method is not static)
100     if (receiver != nullptr) {
101       Append(receiver);
102     }
103     for (size_t i = 1; i < shorty_len_; ++i) {
104       switch (shorty_[i]) {
105         case 'Z':
106         case 'B':
107         case 'C':
108         case 'S':
109         case 'I':
110           Append(va_arg(ap, jint));
111           break;
112         case 'F':
113           AppendFloat(va_arg(ap, jdouble));
114           break;
115         case 'L':
116           Append(soa.Decode<mirror::Object*>(va_arg(ap, jobject)));
117           break;
118         case 'D':
119           AppendDouble(va_arg(ap, jdouble));
120           break;
121         case 'J':
122           AppendWide(va_arg(ap, jlong));
123           break;
124 #ifndef NDEBUG
125         default:
126           LOG(FATAL) << "Unexpected shorty character: " << shorty_[i];
127 #endif
128       }
129     }
130   }
131 
BuildArgArrayFromJValues(const ScopedObjectAccessAlreadyRunnable & soa,mirror::Object * receiver,jvalue * args)132   void BuildArgArrayFromJValues(const ScopedObjectAccessAlreadyRunnable& soa,
133                                 mirror::Object* receiver, jvalue* args)
134       SHARED_REQUIRES(Locks::mutator_lock_) {
135     // Set receiver if non-null (method is not static)
136     if (receiver != nullptr) {
137       Append(receiver);
138     }
139     for (size_t i = 1, args_offset = 0; i < shorty_len_; ++i, ++args_offset) {
140       switch (shorty_[i]) {
141         case 'Z':
142           Append(args[args_offset].z);
143           break;
144         case 'B':
145           Append(args[args_offset].b);
146           break;
147         case 'C':
148           Append(args[args_offset].c);
149           break;
150         case 'S':
151           Append(args[args_offset].s);
152           break;
153         case 'I':
154         case 'F':
155           Append(args[args_offset].i);
156           break;
157         case 'L':
158           Append(soa.Decode<mirror::Object*>(args[args_offset].l));
159           break;
160         case 'D':
161         case 'J':
162           AppendWide(args[args_offset].j);
163           break;
164 #ifndef NDEBUG
165         default:
166           LOG(FATAL) << "Unexpected shorty character: " << shorty_[i];
167 #endif
168       }
169     }
170   }
171 
BuildArgArrayFromFrame(ShadowFrame * shadow_frame,uint32_t arg_offset)172   void BuildArgArrayFromFrame(ShadowFrame* shadow_frame, uint32_t arg_offset)
173       SHARED_REQUIRES(Locks::mutator_lock_) {
174     // Set receiver if non-null (method is not static)
175     size_t cur_arg = arg_offset;
176     if (!shadow_frame->GetMethod()->IsStatic()) {
177       Append(shadow_frame->GetVReg(cur_arg));
178       cur_arg++;
179     }
180     for (size_t i = 1; i < shorty_len_; ++i) {
181       switch (shorty_[i]) {
182         case 'Z':
183         case 'B':
184         case 'C':
185         case 'S':
186         case 'I':
187         case 'F':
188         case 'L':
189           Append(shadow_frame->GetVReg(cur_arg));
190           cur_arg++;
191           break;
192         case 'D':
193         case 'J':
194           AppendWide(shadow_frame->GetVRegLong(cur_arg));
195           cur_arg++;
196           cur_arg++;
197           break;
198 #ifndef NDEBUG
199         default:
200           LOG(FATAL) << "Unexpected shorty character: " << shorty_[i];
201 #endif
202       }
203     }
204   }
205 
ThrowIllegalPrimitiveArgumentException(const char * expected,const char * found_descriptor)206   static void ThrowIllegalPrimitiveArgumentException(const char* expected,
207                                                      const char* found_descriptor)
208       SHARED_REQUIRES(Locks::mutator_lock_) {
209     ThrowIllegalArgumentException(
210         StringPrintf("Invalid primitive conversion from %s to %s", expected,
211                      PrettyDescriptor(found_descriptor).c_str()).c_str());
212   }
213 
BuildArgArrayFromObjectArray(mirror::Object * receiver,mirror::ObjectArray<mirror::Object> * args,ArtMethod * m)214   bool BuildArgArrayFromObjectArray(mirror::Object* receiver,
215                                     mirror::ObjectArray<mirror::Object>* args, ArtMethod* m)
216       SHARED_REQUIRES(Locks::mutator_lock_) {
217     const DexFile::TypeList* classes = m->GetParameterTypeList();
218     // Set receiver if non-null (method is not static)
219     if (receiver != nullptr) {
220       Append(receiver);
221     }
222     for (size_t i = 1, args_offset = 0; i < shorty_len_; ++i, ++args_offset) {
223       mirror::Object* arg = args->Get(args_offset);
224       if (((shorty_[i] == 'L') && (arg != nullptr)) || ((arg == nullptr && shorty_[i] != 'L'))) {
225         size_t pointer_size = Runtime::Current()->GetClassLinker()->GetImagePointerSize();
226         mirror::Class* dst_class =
227             m->GetClassFromTypeIndex(classes->GetTypeItem(args_offset).type_idx_,
228                                      true /* resolve */,
229                                      pointer_size);
230         if (UNLIKELY(arg == nullptr || !arg->InstanceOf(dst_class))) {
231           ThrowIllegalArgumentException(
232               StringPrintf("method %s argument %zd has type %s, got %s",
233                   PrettyMethod(m, false).c_str(),
234                   args_offset + 1,  // Humans don't count from 0.
235                   PrettyDescriptor(dst_class).c_str(),
236                   PrettyTypeOf(arg).c_str()).c_str());
237           return false;
238         }
239       }
240 
241 #define DO_FIRST_ARG(match_descriptor, get_fn, append) { \
242           if (LIKELY(arg != nullptr && arg->GetClass<>()->DescriptorEquals(match_descriptor))) { \
243             ArtField* primitive_field = arg->GetClass()->GetInstanceField(0); \
244             append(primitive_field-> get_fn(arg));
245 
246 #define DO_ARG(match_descriptor, get_fn, append) \
247           } else if (LIKELY(arg != nullptr && \
248                             arg->GetClass<>()->DescriptorEquals(match_descriptor))) { \
249             ArtField* primitive_field = arg->GetClass()->GetInstanceField(0); \
250             append(primitive_field-> get_fn(arg));
251 
252 #define DO_FAIL(expected) \
253           } else { \
254             if (arg->GetClass<>()->IsPrimitive()) { \
255               std::string temp; \
256               ThrowIllegalPrimitiveArgumentException(expected, \
257                                                      arg->GetClass<>()->GetDescriptor(&temp)); \
258             } else { \
259               ThrowIllegalArgumentException(\
260                   StringPrintf("method %s argument %zd has type %s, got %s", \
261                       PrettyMethod(m, false).c_str(), \
262                       args_offset + 1, \
263                       expected, \
264                       PrettyTypeOf(arg).c_str()).c_str()); \
265             } \
266             return false; \
267           } }
268 
269       switch (shorty_[i]) {
270         case 'L':
271           Append(arg);
272           break;
273         case 'Z':
274           DO_FIRST_ARG("Ljava/lang/Boolean;", GetBoolean, Append)
275           DO_FAIL("boolean")
276           break;
277         case 'B':
278           DO_FIRST_ARG("Ljava/lang/Byte;", GetByte, Append)
279           DO_FAIL("byte")
280           break;
281         case 'C':
282           DO_FIRST_ARG("Ljava/lang/Character;", GetChar, Append)
283           DO_FAIL("char")
284           break;
285         case 'S':
286           DO_FIRST_ARG("Ljava/lang/Short;", GetShort, Append)
287           DO_ARG("Ljava/lang/Byte;", GetByte, Append)
288           DO_FAIL("short")
289           break;
290         case 'I':
291           DO_FIRST_ARG("Ljava/lang/Integer;", GetInt, Append)
292           DO_ARG("Ljava/lang/Character;", GetChar, Append)
293           DO_ARG("Ljava/lang/Short;", GetShort, Append)
294           DO_ARG("Ljava/lang/Byte;", GetByte, Append)
295           DO_FAIL("int")
296           break;
297         case 'J':
298           DO_FIRST_ARG("Ljava/lang/Long;", GetLong, AppendWide)
299           DO_ARG("Ljava/lang/Integer;", GetInt, AppendWide)
300           DO_ARG("Ljava/lang/Character;", GetChar, AppendWide)
301           DO_ARG("Ljava/lang/Short;", GetShort, AppendWide)
302           DO_ARG("Ljava/lang/Byte;", GetByte, AppendWide)
303           DO_FAIL("long")
304           break;
305         case 'F':
306           DO_FIRST_ARG("Ljava/lang/Float;", GetFloat, AppendFloat)
307           DO_ARG("Ljava/lang/Long;", GetLong, AppendFloat)
308           DO_ARG("Ljava/lang/Integer;", GetInt, AppendFloat)
309           DO_ARG("Ljava/lang/Character;", GetChar, AppendFloat)
310           DO_ARG("Ljava/lang/Short;", GetShort, AppendFloat)
311           DO_ARG("Ljava/lang/Byte;", GetByte, AppendFloat)
312           DO_FAIL("float")
313           break;
314         case 'D':
315           DO_FIRST_ARG("Ljava/lang/Double;", GetDouble, AppendDouble)
316           DO_ARG("Ljava/lang/Float;", GetFloat, AppendDouble)
317           DO_ARG("Ljava/lang/Long;", GetLong, AppendDouble)
318           DO_ARG("Ljava/lang/Integer;", GetInt, AppendDouble)
319           DO_ARG("Ljava/lang/Character;", GetChar, AppendDouble)
320           DO_ARG("Ljava/lang/Short;", GetShort, AppendDouble)
321           DO_ARG("Ljava/lang/Byte;", GetByte, AppendDouble)
322           DO_FAIL("double")
323           break;
324 #ifndef NDEBUG
325         default:
326           LOG(FATAL) << "Unexpected shorty character: " << shorty_[i];
327           UNREACHABLE();
328 #endif
329       }
330 #undef DO_FIRST_ARG
331 #undef DO_ARG
332 #undef DO_FAIL
333     }
334     return true;
335   }
336 
337  private:
338   enum { kSmallArgArraySize = 16 };
339   const char* const shorty_;
340   const uint32_t shorty_len_;
341   uint32_t num_bytes_;
342   uint32_t* arg_array_;
343   uint32_t small_arg_array_[kSmallArgArraySize];
344   std::unique_ptr<uint32_t[]> large_arg_array_;
345 };
346 
CheckMethodArguments(JavaVMExt * vm,ArtMethod * m,uint32_t * args)347 static void CheckMethodArguments(JavaVMExt* vm, ArtMethod* m, uint32_t* args)
348     SHARED_REQUIRES(Locks::mutator_lock_) {
349   const DexFile::TypeList* params = m->GetParameterTypeList();
350   if (params == nullptr) {
351     return;  // No arguments so nothing to check.
352   }
353   uint32_t offset = 0;
354   uint32_t num_params = params->Size();
355   size_t error_count = 0;
356   if (!m->IsStatic()) {
357     offset = 1;
358   }
359   // TODO: If args contain object references, it may cause problems.
360   Thread* const self = Thread::Current();
361   size_t pointer_size = Runtime::Current()->GetClassLinker()->GetImagePointerSize();
362   for (uint32_t i = 0; i < num_params; i++) {
363     uint16_t type_idx = params->GetTypeItem(i).type_idx_;
364     mirror::Class* param_type = m->GetClassFromTypeIndex(type_idx,
365                                                          true /* resolve*/,
366                                                          pointer_size);
367     if (param_type == nullptr) {
368       CHECK(self->IsExceptionPending());
369       LOG(ERROR) << "Internal error: unresolvable type for argument type in JNI invoke: "
370           << m->GetTypeDescriptorFromTypeIdx(type_idx) << "\n"
371           << self->GetException()->Dump();
372       self->ClearException();
373       ++error_count;
374     } else if (!param_type->IsPrimitive()) {
375       // TODO: There is a compaction bug here since GetClassFromTypeIdx can cause thread suspension,
376       // this is a hard to fix problem since the args can contain Object*, we need to save and
377       // restore them by using a visitor similar to the ones used in the trampoline entrypoints.
378       mirror::Object* argument =
379           (reinterpret_cast<StackReference<mirror::Object>*>(&args[i + offset]))->AsMirrorPtr();
380       if (argument != nullptr && !argument->InstanceOf(param_type)) {
381         LOG(ERROR) << "JNI ERROR (app bug): attempt to pass an instance of "
382                    << PrettyTypeOf(argument) << " as argument " << (i + 1)
383                    << " to " << PrettyMethod(m);
384         ++error_count;
385       }
386     } else if (param_type->IsPrimitiveLong() || param_type->IsPrimitiveDouble()) {
387       offset++;
388     } else {
389       int32_t arg = static_cast<int32_t>(args[i + offset]);
390       if (param_type->IsPrimitiveBoolean()) {
391         if (arg != JNI_TRUE && arg != JNI_FALSE) {
392           LOG(ERROR) << "JNI ERROR (app bug): expected jboolean (0/1) but got value of "
393               << arg << " as argument " << (i + 1) << " to " << PrettyMethod(m);
394           ++error_count;
395         }
396       } else if (param_type->IsPrimitiveByte()) {
397         if (arg < -128 || arg > 127) {
398           LOG(ERROR) << "JNI ERROR (app bug): expected jbyte but got value of "
399               << arg << " as argument " << (i + 1) << " to " << PrettyMethod(m);
400           ++error_count;
401         }
402       } else if (param_type->IsPrimitiveChar()) {
403         if (args[i + offset] > 0xFFFF) {
404           LOG(ERROR) << "JNI ERROR (app bug): expected jchar but got value of "
405               << arg << " as argument " << (i + 1) << " to " << PrettyMethod(m);
406           ++error_count;
407         }
408       } else if (param_type->IsPrimitiveShort()) {
409         if (arg < -32768 || arg > 0x7FFF) {
410           LOG(ERROR) << "JNI ERROR (app bug): expected jshort but got value of "
411               << arg << " as argument " << (i + 1) << " to " << PrettyMethod(m);
412           ++error_count;
413         }
414       }
415     }
416   }
417   if (UNLIKELY(error_count > 0)) {
418     // TODO: pass the JNI function name (such as "CallVoidMethodV") through so we can call JniAbort
419     // with an argument.
420     vm->JniAbortF(nullptr, "bad arguments passed to %s (see above for details)",
421                   PrettyMethod(m).c_str());
422   }
423 }
424 
FindVirtualMethod(mirror::Object * receiver,ArtMethod * method)425 static ArtMethod* FindVirtualMethod(mirror::Object* receiver, ArtMethod* method)
426     SHARED_REQUIRES(Locks::mutator_lock_) {
427   return receiver->GetClass()->FindVirtualMethodForVirtualOrInterface(method, sizeof(void*));
428 }
429 
430 
InvokeWithArgArray(const ScopedObjectAccessAlreadyRunnable & soa,ArtMethod * method,ArgArray * arg_array,JValue * result,const char * shorty)431 static void InvokeWithArgArray(const ScopedObjectAccessAlreadyRunnable& soa,
432                                ArtMethod* method, ArgArray* arg_array, JValue* result,
433                                const char* shorty)
434     SHARED_REQUIRES(Locks::mutator_lock_) {
435   uint32_t* args = arg_array->GetArray();
436   if (UNLIKELY(soa.Env()->check_jni)) {
437     CheckMethodArguments(soa.Vm(), method->GetInterfaceMethodIfProxy(sizeof(void*)), args);
438   }
439   method->Invoke(soa.Self(), args, arg_array->GetNumBytes(), result, shorty);
440 }
441 
InvokeWithVarArgs(const ScopedObjectAccessAlreadyRunnable & soa,jobject obj,jmethodID mid,va_list args)442 JValue InvokeWithVarArgs(const ScopedObjectAccessAlreadyRunnable& soa, jobject obj, jmethodID mid,
443                          va_list args)
444     SHARED_REQUIRES(Locks::mutator_lock_) {
445   // We want to make sure that the stack is not within a small distance from the
446   // protected region in case we are calling into a leaf function whose stack
447   // check has been elided.
448   if (UNLIKELY(__builtin_frame_address(0) < soa.Self()->GetStackEnd())) {
449     ThrowStackOverflowError(soa.Self());
450     return JValue();
451   }
452 
453   ArtMethod* method = soa.DecodeMethod(mid);
454   bool is_string_init = method->GetDeclaringClass()->IsStringClass() && method->IsConstructor();
455   if (is_string_init) {
456     // Replace calls to String.<init> with equivalent StringFactory call.
457     method = soa.DecodeMethod(WellKnownClasses::StringInitToStringFactoryMethodID(mid));
458   }
459   mirror::Object* receiver = method->IsStatic() ? nullptr : soa.Decode<mirror::Object*>(obj);
460   uint32_t shorty_len = 0;
461   const char* shorty = method->GetInterfaceMethodIfProxy(sizeof(void*))->GetShorty(&shorty_len);
462   JValue result;
463   ArgArray arg_array(shorty, shorty_len);
464   arg_array.BuildArgArrayFromVarArgs(soa, receiver, args);
465   InvokeWithArgArray(soa, method, &arg_array, &result, shorty);
466   if (is_string_init) {
467     // For string init, remap original receiver to StringFactory result.
468     UpdateReference(soa.Self(), obj, result.GetL());
469   }
470   return result;
471 }
472 
InvokeWithJValues(const ScopedObjectAccessAlreadyRunnable & soa,jobject obj,jmethodID mid,jvalue * args)473 JValue InvokeWithJValues(const ScopedObjectAccessAlreadyRunnable& soa, jobject obj, jmethodID mid,
474                          jvalue* args) {
475   // We want to make sure that the stack is not within a small distance from the
476   // protected region in case we are calling into a leaf function whose stack
477   // check has been elided.
478   if (UNLIKELY(__builtin_frame_address(0) < soa.Self()->GetStackEnd())) {
479     ThrowStackOverflowError(soa.Self());
480     return JValue();
481   }
482 
483   ArtMethod* method = soa.DecodeMethod(mid);
484   bool is_string_init = method->GetDeclaringClass()->IsStringClass() && method->IsConstructor();
485   if (is_string_init) {
486     // Replace calls to String.<init> with equivalent StringFactory call.
487     method = soa.DecodeMethod(WellKnownClasses::StringInitToStringFactoryMethodID(mid));
488   }
489   mirror::Object* receiver = method->IsStatic() ? nullptr : soa.Decode<mirror::Object*>(obj);
490   uint32_t shorty_len = 0;
491   const char* shorty = method->GetInterfaceMethodIfProxy(sizeof(void*))->GetShorty(&shorty_len);
492   JValue result;
493   ArgArray arg_array(shorty, shorty_len);
494   arg_array.BuildArgArrayFromJValues(soa, receiver, args);
495   InvokeWithArgArray(soa, method, &arg_array, &result, shorty);
496   if (is_string_init) {
497     // For string init, remap original receiver to StringFactory result.
498     UpdateReference(soa.Self(), obj, result.GetL());
499   }
500   return result;
501 }
502 
InvokeVirtualOrInterfaceWithJValues(const ScopedObjectAccessAlreadyRunnable & soa,jobject obj,jmethodID mid,jvalue * args)503 JValue InvokeVirtualOrInterfaceWithJValues(const ScopedObjectAccessAlreadyRunnable& soa,
504                                            jobject obj, jmethodID mid, jvalue* args) {
505   // We want to make sure that the stack is not within a small distance from the
506   // protected region in case we are calling into a leaf function whose stack
507   // check has been elided.
508   if (UNLIKELY(__builtin_frame_address(0) < soa.Self()->GetStackEnd())) {
509     ThrowStackOverflowError(soa.Self());
510     return JValue();
511   }
512 
513   mirror::Object* receiver = soa.Decode<mirror::Object*>(obj);
514   ArtMethod* method = FindVirtualMethod(receiver, soa.DecodeMethod(mid));
515   bool is_string_init = method->GetDeclaringClass()->IsStringClass() && method->IsConstructor();
516   if (is_string_init) {
517     // Replace calls to String.<init> with equivalent StringFactory call.
518     method = soa.DecodeMethod(WellKnownClasses::StringInitToStringFactoryMethodID(mid));
519     receiver = nullptr;
520   }
521   uint32_t shorty_len = 0;
522   const char* shorty = method->GetInterfaceMethodIfProxy(sizeof(void*))->GetShorty(&shorty_len);
523   JValue result;
524   ArgArray arg_array(shorty, shorty_len);
525   arg_array.BuildArgArrayFromJValues(soa, receiver, args);
526   InvokeWithArgArray(soa, method, &arg_array, &result, shorty);
527   if (is_string_init) {
528     // For string init, remap original receiver to StringFactory result.
529     UpdateReference(soa.Self(), obj, result.GetL());
530   }
531   return result;
532 }
533 
InvokeVirtualOrInterfaceWithVarArgs(const ScopedObjectAccessAlreadyRunnable & soa,jobject obj,jmethodID mid,va_list args)534 JValue InvokeVirtualOrInterfaceWithVarArgs(const ScopedObjectAccessAlreadyRunnable& soa,
535                                            jobject obj, jmethodID mid, va_list args) {
536   // We want to make sure that the stack is not within a small distance from the
537   // protected region in case we are calling into a leaf function whose stack
538   // check has been elided.
539   if (UNLIKELY(__builtin_frame_address(0) < soa.Self()->GetStackEnd())) {
540     ThrowStackOverflowError(soa.Self());
541     return JValue();
542   }
543 
544   mirror::Object* receiver = soa.Decode<mirror::Object*>(obj);
545   ArtMethod* method = FindVirtualMethod(receiver, soa.DecodeMethod(mid));
546   bool is_string_init = method->GetDeclaringClass()->IsStringClass() && method->IsConstructor();
547   if (is_string_init) {
548     // Replace calls to String.<init> with equivalent StringFactory call.
549     method = soa.DecodeMethod(WellKnownClasses::StringInitToStringFactoryMethodID(mid));
550     receiver = nullptr;
551   }
552   uint32_t shorty_len = 0;
553   const char* shorty = method->GetInterfaceMethodIfProxy(sizeof(void*))->GetShorty(&shorty_len);
554   JValue result;
555   ArgArray arg_array(shorty, shorty_len);
556   arg_array.BuildArgArrayFromVarArgs(soa, receiver, args);
557   InvokeWithArgArray(soa, method, &arg_array, &result, shorty);
558   if (is_string_init) {
559     // For string init, remap original receiver to StringFactory result.
560     UpdateReference(soa.Self(), obj, result.GetL());
561   }
562   return result;
563 }
564 
InvokeMethod(const ScopedObjectAccessAlreadyRunnable & soa,jobject javaMethod,jobject javaReceiver,jobject javaArgs,size_t num_frames)565 jobject InvokeMethod(const ScopedObjectAccessAlreadyRunnable& soa, jobject javaMethod,
566                      jobject javaReceiver, jobject javaArgs, size_t num_frames) {
567   // We want to make sure that the stack is not within a small distance from the
568   // protected region in case we are calling into a leaf function whose stack
569   // check has been elided.
570   if (UNLIKELY(__builtin_frame_address(0) <
571                soa.Self()->GetStackEndForInterpreter(true))) {
572     ThrowStackOverflowError(soa.Self());
573     return nullptr;
574   }
575 
576   auto* abstract_method = soa.Decode<mirror::AbstractMethod*>(javaMethod);
577   const bool accessible = abstract_method->IsAccessible();
578   ArtMethod* m = abstract_method->GetArtMethod();
579 
580   mirror::Class* declaring_class = m->GetDeclaringClass();
581   if (UNLIKELY(!declaring_class->IsInitialized())) {
582     StackHandleScope<1> hs(soa.Self());
583     Handle<mirror::Class> h_class(hs.NewHandle(declaring_class));
584     if (!Runtime::Current()->GetClassLinker()->EnsureInitialized(soa.Self(), h_class, true, true)) {
585       return nullptr;
586     }
587     declaring_class = h_class.Get();
588   }
589 
590   mirror::Object* receiver = nullptr;
591   if (!m->IsStatic()) {
592     // Replace calls to String.<init> with equivalent StringFactory call.
593     if (declaring_class->IsStringClass() && m->IsConstructor()) {
594       jmethodID mid = soa.EncodeMethod(m);
595       m = soa.DecodeMethod(WellKnownClasses::StringInitToStringFactoryMethodID(mid));
596       CHECK(javaReceiver == nullptr);
597     } else {
598       // Check that the receiver is non-null and an instance of the field's declaring class.
599       receiver = soa.Decode<mirror::Object*>(javaReceiver);
600       if (!VerifyObjectIsClass(receiver, declaring_class)) {
601         return nullptr;
602       }
603 
604       // Find the actual implementation of the virtual method.
605       m = receiver->GetClass()->FindVirtualMethodForVirtualOrInterface(m, sizeof(void*));
606     }
607   }
608 
609   // Get our arrays of arguments and their types, and check they're the same size.
610   auto* objects = soa.Decode<mirror::ObjectArray<mirror::Object>*>(javaArgs);
611   auto* np_method = m->GetInterfaceMethodIfProxy(sizeof(void*));
612   const DexFile::TypeList* classes = np_method->GetParameterTypeList();
613   uint32_t classes_size = (classes == nullptr) ? 0 : classes->Size();
614   uint32_t arg_count = (objects != nullptr) ? objects->GetLength() : 0;
615   if (arg_count != classes_size) {
616     ThrowIllegalArgumentException(StringPrintf("Wrong number of arguments; expected %d, got %d",
617                                                classes_size, arg_count).c_str());
618     return nullptr;
619   }
620 
621   // If method is not set to be accessible, verify it can be accessed by the caller.
622   mirror::Class* calling_class = nullptr;
623   if (!accessible && !VerifyAccess(soa.Self(), receiver, declaring_class, m->GetAccessFlags(),
624                                    &calling_class, num_frames)) {
625     ThrowIllegalAccessException(
626         StringPrintf("Class %s cannot access %s method %s of class %s",
627             calling_class == nullptr ? "null" : PrettyClass(calling_class).c_str(),
628             PrettyJavaAccessFlags(m->GetAccessFlags()).c_str(),
629             PrettyMethod(m).c_str(),
630             m->GetDeclaringClass() == nullptr ? "null" :
631                 PrettyClass(m->GetDeclaringClass()).c_str()).c_str());
632     return nullptr;
633   }
634 
635   // Invoke the method.
636   JValue result;
637   uint32_t shorty_len = 0;
638   const char* shorty = np_method->GetShorty(&shorty_len);
639   ArgArray arg_array(shorty, shorty_len);
640   if (!arg_array.BuildArgArrayFromObjectArray(receiver, objects, np_method)) {
641     CHECK(soa.Self()->IsExceptionPending());
642     return nullptr;
643   }
644 
645   InvokeWithArgArray(soa, m, &arg_array, &result, shorty);
646 
647   // Wrap any exception with "Ljava/lang/reflect/InvocationTargetException;" and return early.
648   if (soa.Self()->IsExceptionPending()) {
649     // If we get another exception when we are trying to wrap, then just use that instead.
650     jthrowable th = soa.Env()->ExceptionOccurred();
651     soa.Self()->ClearException();
652     jclass exception_class = soa.Env()->FindClass("java/lang/reflect/InvocationTargetException");
653     if (exception_class == nullptr) {
654       soa.Self()->AssertPendingOOMException();
655       return nullptr;
656     }
657     jmethodID mid = soa.Env()->GetMethodID(exception_class, "<init>", "(Ljava/lang/Throwable;)V");
658     CHECK(mid != nullptr);
659     jobject exception_instance = soa.Env()->NewObject(exception_class, mid, th);
660     if (exception_instance == nullptr) {
661       soa.Self()->AssertPendingOOMException();
662       return nullptr;
663     }
664     soa.Env()->Throw(reinterpret_cast<jthrowable>(exception_instance));
665     return nullptr;
666   }
667 
668   // Box if necessary and return.
669   return soa.AddLocalReference<jobject>(BoxPrimitive(Primitive::GetType(shorty[0]), result));
670 }
671 
BoxPrimitive(Primitive::Type src_class,const JValue & value)672 mirror::Object* BoxPrimitive(Primitive::Type src_class, const JValue& value) {
673   if (src_class == Primitive::kPrimNot) {
674     return value.GetL();
675   }
676   if (src_class == Primitive::kPrimVoid) {
677     // There's no such thing as a void field, and void methods invoked via reflection return null.
678     return nullptr;
679   }
680 
681   jmethodID m = nullptr;
682   const char* shorty;
683   switch (src_class) {
684   case Primitive::kPrimBoolean:
685     m = WellKnownClasses::java_lang_Boolean_valueOf;
686     shorty = "LZ";
687     break;
688   case Primitive::kPrimByte:
689     m = WellKnownClasses::java_lang_Byte_valueOf;
690     shorty = "LB";
691     break;
692   case Primitive::kPrimChar:
693     m = WellKnownClasses::java_lang_Character_valueOf;
694     shorty = "LC";
695     break;
696   case Primitive::kPrimDouble:
697     m = WellKnownClasses::java_lang_Double_valueOf;
698     shorty = "LD";
699     break;
700   case Primitive::kPrimFloat:
701     m = WellKnownClasses::java_lang_Float_valueOf;
702     shorty = "LF";
703     break;
704   case Primitive::kPrimInt:
705     m = WellKnownClasses::java_lang_Integer_valueOf;
706     shorty = "LI";
707     break;
708   case Primitive::kPrimLong:
709     m = WellKnownClasses::java_lang_Long_valueOf;
710     shorty = "LJ";
711     break;
712   case Primitive::kPrimShort:
713     m = WellKnownClasses::java_lang_Short_valueOf;
714     shorty = "LS";
715     break;
716   default:
717     LOG(FATAL) << static_cast<int>(src_class);
718     shorty = nullptr;
719   }
720 
721   ScopedObjectAccessUnchecked soa(Thread::Current());
722   DCHECK_EQ(soa.Self()->GetState(), kRunnable);
723 
724   ArgArray arg_array(shorty, 2);
725   JValue result;
726   if (src_class == Primitive::kPrimDouble || src_class == Primitive::kPrimLong) {
727     arg_array.AppendWide(value.GetJ());
728   } else {
729     arg_array.Append(value.GetI());
730   }
731 
732   soa.DecodeMethod(m)->Invoke(soa.Self(), arg_array.GetArray(), arg_array.GetNumBytes(),
733                               &result, shorty);
734   return result.GetL();
735 }
736 
UnboxingFailureKind(ArtField * f)737 static std::string UnboxingFailureKind(ArtField* f)
738     SHARED_REQUIRES(Locks::mutator_lock_) {
739   if (f != nullptr) {
740     return "field " + PrettyField(f, false);
741   }
742   return "result";
743 }
744 
UnboxPrimitive(mirror::Object * o,mirror::Class * dst_class,ArtField * f,JValue * unboxed_value)745 static bool UnboxPrimitive(mirror::Object* o,
746                            mirror::Class* dst_class, ArtField* f,
747                            JValue* unboxed_value)
748     SHARED_REQUIRES(Locks::mutator_lock_) {
749   bool unbox_for_result = (f == nullptr);
750   if (!dst_class->IsPrimitive()) {
751     if (UNLIKELY(o != nullptr && !o->InstanceOf(dst_class))) {
752       if (!unbox_for_result) {
753         ThrowIllegalArgumentException(StringPrintf("%s has type %s, got %s",
754                                                    UnboxingFailureKind(f).c_str(),
755                                                    PrettyDescriptor(dst_class).c_str(),
756                                                    PrettyTypeOf(o).c_str()).c_str());
757       } else {
758         ThrowClassCastException(StringPrintf("Couldn't convert result of type %s to %s",
759                                              PrettyTypeOf(o).c_str(),
760                                              PrettyDescriptor(dst_class).c_str()).c_str());
761       }
762       return false;
763     }
764     unboxed_value->SetL(o);
765     return true;
766   }
767   if (UNLIKELY(dst_class->GetPrimitiveType() == Primitive::kPrimVoid)) {
768     ThrowIllegalArgumentException(StringPrintf("Can't unbox %s to void",
769                                                UnboxingFailureKind(f).c_str()).c_str());
770     return false;
771   }
772   if (UNLIKELY(o == nullptr)) {
773     if (!unbox_for_result) {
774       ThrowIllegalArgumentException(StringPrintf("%s has type %s, got null",
775                                                  UnboxingFailureKind(f).c_str(),
776                                                  PrettyDescriptor(dst_class).c_str()).c_str());
777     } else {
778       ThrowNullPointerException(StringPrintf("Expected to unbox a '%s' primitive type but was returned null",
779                                              PrettyDescriptor(dst_class).c_str()).c_str());
780     }
781     return false;
782   }
783 
784   JValue boxed_value;
785   mirror::Class* klass = o->GetClass();
786   mirror::Class* src_class = nullptr;
787   ClassLinker* const class_linker = Runtime::Current()->GetClassLinker();
788   ArtField* primitive_field = &klass->GetIFieldsPtr()->At(0);
789   if (klass->DescriptorEquals("Ljava/lang/Boolean;")) {
790     src_class = class_linker->FindPrimitiveClass('Z');
791     boxed_value.SetZ(primitive_field->GetBoolean(o));
792   } else if (klass->DescriptorEquals("Ljava/lang/Byte;")) {
793     src_class = class_linker->FindPrimitiveClass('B');
794     boxed_value.SetB(primitive_field->GetByte(o));
795   } else if (klass->DescriptorEquals("Ljava/lang/Character;")) {
796     src_class = class_linker->FindPrimitiveClass('C');
797     boxed_value.SetC(primitive_field->GetChar(o));
798   } else if (klass->DescriptorEquals("Ljava/lang/Float;")) {
799     src_class = class_linker->FindPrimitiveClass('F');
800     boxed_value.SetF(primitive_field->GetFloat(o));
801   } else if (klass->DescriptorEquals("Ljava/lang/Double;")) {
802     src_class = class_linker->FindPrimitiveClass('D');
803     boxed_value.SetD(primitive_field->GetDouble(o));
804   } else if (klass->DescriptorEquals("Ljava/lang/Integer;")) {
805     src_class = class_linker->FindPrimitiveClass('I');
806     boxed_value.SetI(primitive_field->GetInt(o));
807   } else if (klass->DescriptorEquals("Ljava/lang/Long;")) {
808     src_class = class_linker->FindPrimitiveClass('J');
809     boxed_value.SetJ(primitive_field->GetLong(o));
810   } else if (klass->DescriptorEquals("Ljava/lang/Short;")) {
811     src_class = class_linker->FindPrimitiveClass('S');
812     boxed_value.SetS(primitive_field->GetShort(o));
813   } else {
814     std::string temp;
815     ThrowIllegalArgumentException(
816         StringPrintf("%s has type %s, got %s", UnboxingFailureKind(f).c_str(),
817             PrettyDescriptor(dst_class).c_str(),
818             PrettyDescriptor(o->GetClass()->GetDescriptor(&temp)).c_str()).c_str());
819     return false;
820   }
821 
822   return ConvertPrimitiveValue(unbox_for_result,
823                                src_class->GetPrimitiveType(), dst_class->GetPrimitiveType(),
824                                boxed_value, unboxed_value);
825 }
826 
UnboxPrimitiveForField(mirror::Object * o,mirror::Class * dst_class,ArtField * f,JValue * unboxed_value)827 bool UnboxPrimitiveForField(mirror::Object* o, mirror::Class* dst_class, ArtField* f,
828                             JValue* unboxed_value) {
829   DCHECK(f != nullptr);
830   return UnboxPrimitive(o, dst_class, f, unboxed_value);
831 }
832 
UnboxPrimitiveForResult(mirror::Object * o,mirror::Class * dst_class,JValue * unboxed_value)833 bool UnboxPrimitiveForResult(mirror::Object* o, mirror::Class* dst_class, JValue* unboxed_value) {
834   return UnboxPrimitive(o, dst_class, nullptr, unboxed_value);
835 }
836 
GetCallingClass(Thread * self,size_t num_frames)837 mirror::Class* GetCallingClass(Thread* self, size_t num_frames) {
838   NthCallerVisitor visitor(self, num_frames);
839   visitor.WalkStack();
840   return visitor.caller != nullptr ? visitor.caller->GetDeclaringClass() : nullptr;
841 }
842 
VerifyAccess(Thread * self,mirror::Object * obj,mirror::Class * declaring_class,uint32_t access_flags,mirror::Class ** calling_class,size_t num_frames)843 bool VerifyAccess(Thread* self, mirror::Object* obj, mirror::Class* declaring_class,
844                   uint32_t access_flags, mirror::Class** calling_class, size_t num_frames) {
845   if ((access_flags & kAccPublic) != 0) {
846     return true;
847   }
848   auto* klass = GetCallingClass(self, num_frames);
849   if (UNLIKELY(klass == nullptr)) {
850     // The caller is an attached native thread.
851     return false;
852   }
853   *calling_class = klass;
854   return VerifyAccess(self, obj, declaring_class, access_flags, klass);
855 }
856 
VerifyAccess(Thread * self,mirror::Object * obj,mirror::Class * declaring_class,uint32_t access_flags,mirror::Class * calling_class)857 bool VerifyAccess(Thread* self, mirror::Object* obj, mirror::Class* declaring_class,
858                   uint32_t access_flags, mirror::Class* calling_class) {
859   if (calling_class == declaring_class) {
860     return true;
861   }
862   ScopedAssertNoThreadSuspension sants(self, "verify-access");
863   if ((access_flags & kAccPrivate) != 0) {
864     return false;
865   }
866   if ((access_flags & kAccProtected) != 0) {
867     if (obj != nullptr && !obj->InstanceOf(calling_class) &&
868         !declaring_class->IsInSamePackage(calling_class)) {
869       return false;
870     } else if (declaring_class->IsAssignableFrom(calling_class)) {
871       return true;
872     }
873   }
874   return declaring_class->IsInSamePackage(calling_class);
875 }
876 
InvalidReceiverError(mirror::Object * o,mirror::Class * c)877 void InvalidReceiverError(mirror::Object* o, mirror::Class* c) {
878   std::string expected_class_name(PrettyDescriptor(c));
879   std::string actual_class_name(PrettyTypeOf(o));
880   ThrowIllegalArgumentException(StringPrintf("Expected receiver of type %s, but got %s",
881                                              expected_class_name.c_str(),
882                                              actual_class_name.c_str()).c_str());
883 }
884 
885 // This only works if there's one reference which points to the object in obj.
886 // Will need to be fixed if there's cases where it's not.
UpdateReference(Thread * self,jobject obj,mirror::Object * result)887 void UpdateReference(Thread* self, jobject obj, mirror::Object* result) {
888   IndirectRef ref = reinterpret_cast<IndirectRef>(obj);
889   IndirectRefKind kind = GetIndirectRefKind(ref);
890   if (kind == kLocal) {
891     self->GetJniEnv()->locals.Update(obj, result);
892   } else if (kind == kHandleScopeOrInvalid) {
893     LOG(FATAL) << "Unsupported UpdateReference for kind kHandleScopeOrInvalid";
894   } else if (kind == kGlobal) {
895     self->GetJniEnv()->vm->UpdateGlobal(self, ref, result);
896   } else {
897     DCHECK_EQ(kind, kWeakGlobal);
898     self->GetJniEnv()->vm->UpdateWeakGlobal(self, ref, result);
899   }
900 }
901 
902 }  // namespace art
903