Issue | Fix Version | Assignee | Priority | Status | Resolution | Resolved In Build |
---|---|---|---|---|---|---|
JDK-2170548 | 7 | Coleen Phillimore | P4 | Closed | Fixed | b42 |
JDK-2172857 | 6u14 | Coleen Phillimore | P3 | Resolved | Fixed | b01 |
from ###@###.###
I was working on the ppc port and I came across some suspicious jvmdi
code so I looked at mustang and I see some suspicious jvmti code. Take a look
at TemplateTable::jvmti_post_field_access() here's the suspicious code:
if (has_tos) {
// save object pointer before call_VM() clobbers it
__ mov(Otos_i, Lscratch);
} else {
// Load top of stack (do not pop the value off the stack);
__ ld_ptr(Lesp, Interpreter::expr_offset_in_bytes(0), Otos_i);
}
__ verify_oop(Otos_i);
}
// Otos_i: object pointer or NULL if static
// Rcache: cache entry pointer
__ call_VM(noreg, CAST_FROM_FN_PTR(address, InterpreterRuntime::post_field_access),
Otos_i, Rcache);
if (!is_static && has_tos) {
__ mov(Lscratch, Otos_i); // restore object pointer
It would appear to be hiding an oop in Lscratch. Hope it doesn't move. :-) It also
isn't clear if it really needs to be pushed on the expression stack so that
a gc will have the correct number of items on the stack.
--
Steve
Delete comment from another bug.
I was working on the ppc port and I came across some suspicious jvmdi
code so I looked at mustang and I see some suspicious jvmti code. Take a look
at TemplateTable::jvmti_post_field_access() here's the suspicious code:
if (has_tos) {
// save object pointer before call_VM() clobbers it
__ mov(Otos_i, Lscratch);
} else {
// Load top of stack (do not pop the value off the stack);
__ ld_ptr(Lesp, Interpreter::expr_offset_in_bytes(0), Otos_i);
}
__ verify_oop(Otos_i);
}
// Otos_i: object pointer or NULL if static
// Rcache: cache entry pointer
__ call_VM(noreg, CAST_FROM_FN_PTR(address, InterpreterRuntime::post_field_access),
Otos_i, Rcache);
if (!is_static && has_tos) {
__ mov(Lscratch, Otos_i); // restore object pointer
It would appear to be hiding an oop in Lscratch. Hope it doesn't move. :-) It also
isn't clear if it really needs to be pushed on the expression stack so that
a gc will have the correct number of items on the stack.
--
Steve
Delete comment from another bug.
- backported by
-
JDK-2172857 suspicious jvmti code that uses oop unsafely across GC point
-
- Resolved
-
-
JDK-2170548 suspicious jvmti code that uses oop unsafely across GC point
-
- Closed
-