hotspot throws VerifyError while J9 executes normally

[lochnagarr]

Java -version output

j9 version:

openjdk version "1.8.0_332"
IBM Semeru Runtime Open Edition (build 1.8.0_332-b09)
Eclipse OpenJ9 VM (build openj9-0.32.0, JRE 1.8.0 Linux amd64-64-Bit Compressed References 20220422_370 (JIT enabled, AOT enabled)
OpenJ9   - 9a84ec34e
OMR      - ab24b6666
JCL      - 0b8b8af39a based on jdk8u332-b09)

openjdk version "11.0.15" 2022-04-19
IBM Semeru Runtime Open Edition 11.0.15.0 (build 11.0.15+10)
Eclipse OpenJ9 VM 11.0.15.0 (build openj9-0.32.0, JRE 11 Linux amd64-64-Bit Compressed References 20220422_425 (JIT enabled, AOT enabled)
OpenJ9   - 9a84ec34e
OMR      - ab24b6666
JCL      - b7b5b42ea6 based on jdk-11.0.15+10)

openjdk version "17.0.4-internal" 2022-07-19
OpenJDK Runtime Environment (build 17.0.4-internal+0-adhoc.minghai.openj9-openjdk-jdk17)
Eclipse OpenJ9 VM (build master-901107c29, JRE 17 Linux amd64-64-Bit Compressed References 20220722_000000 (JIT enabled, AOT enabled)
OpenJ9   - 901107c29
OMR      - 6061e7ce4
JCL      - f8088584b1b based on jdk-17.0.4+8)

hotspot version:

openjdk version "20-ea" 2023-03-21
OpenJDK Runtime Environment (build 20-ea+6-304)
OpenJDK 64-Bit Server VM (build 20-ea+6-304, mixed mode, sharing)

Summary of problem

When running a buggy classfile generated by a fuzzer, openj9 accepts the classfile and executes it normally, while hotspot throws a VerifyError:

ava.lang.VerifyError: Expecting a stackmap frame at branch target 193
Exception Details:
  Location:
    org/apache/rocketmq/remoting/netty/NettyRemotingClient.<init>(Lorg/apache/rocketmq/remoting/netty/NettyClientConfig;Lorg/apache/rocketmq/remoting/ChannelEventListener;)V @152: ifge
  Reason:
    Expected stackmap frame at this location.
  Bytecode:
...

How to reproduce

We have collected the related classes and dependencies in diff.zip: diff.zip

Extract diff.zip and enter diff.

run the following command:

java -cp ./bug_file:./util:./classes:./test-classes:./junit-4.13.2.jar:./hamcrest-2.1.jar:./assertj-core-2.6.0.jar:./byte-buddy-1.11.0.jar:./mockito-core-3.10.0.jar:./netty-all-4.1.65.Final.jar org.junit.runner.JUnitCore org.apache.rocketmq.remoting.netty.NettyRemotingClientTest

[pshipton]

@tajila @ChengJin01 fyi

[tajila]

@ChengJin01 please take a look

[ChengJin01]

Looking at the problematic class & method at diff/bug_file/org/apache/rocketmq/remoting/netty/NettyRemotingClient.class

  Last modified Jul. 31, 2022; size 60296 bytes
  SHA-256 checksum 81c5192448bff29c7dcdf42b44961056af7dd09177dcc554281b3b3b17f83207
  Compiled from "NettyRemotingClient.java"
public class org.apache.rocketmq.remoting.netty.NettyRemotingClient extends org.apache.rocketmq.remoting.netty.NettyRemotingAbstract implements org.apache.rocketmq.remoting.RemotingClient
  minor version: 0
  major version: 50 <-----------------------
  flags: (0x0021) ACC_PUBLIC, ACC_SUPER
  this_class: #696                        // org/apache/rocketmq/remoting/netty/NettyRemotingClient
  super_class: #475                       // org/apache/rocketmq/remoting/netty/NettyRemotingAbstract
  interfaces: 1, fields: 18, methods: 26, attributes: 1
...
  public org.apache.rocketmq.remoting.netty.NettyRemotingClient(org.apache.rocketmq.remoting.netty.NettyClientConfig, org.apache.rocketmq.remoting.ChannelEventListener);
    descriptor: (Lorg/apache/rocketmq/remoting/netty/NettyClientConfig;Lorg/apache/rocketmq/remoting/ChannelEventListener;)V
    flags: (0x0001) ACC_PUBLIC
    Code:
      stack=4, locals=100, args_size=3
         0: iconst_0
...
       150: iload         11
       152: ifge          193
       155: iconst_0
       156: istore        32
...
      4828: athrow
      4829: return
      Exception table:
         from    to  target type
          3136  3467  3470   Class java/io/IOException
          3136  3467  3807   Class java/security/cert/CertificateException
      LineNumberTable:
        line 87: 155
        line 87: 158
...

For any class file with version <= 50 (Java 6), there is no stackmap in the class file, in which case the stackmaps will be created in OpenJ9 and verified in the fallback status by default. So the Verifier need to be specified with -Xverify:nofallback to trigger the same error as Hotspot.

jdk17_openj9_x64/bin/java -Xverify:nofallback -cp ./bug_file:./util:./classes:./test-classes:./junit-4.13.2.jar:./hamcrest-2.1.jar:./assertj-core-2.6.0.jar:./byte-buddy-1.11.0.jar:./mockito-core-3.10.0.jar:./netty-all-4.1.65.Final.jar org.junit.runner.JUnitCore org.apache.rocketmq.remoting.netty.NettyRemotingClientTest
JUnit version 4.13.2
.E
Time: 0.03
There was 1 failure:
1) testSetCallbackExecutor(org.apache.rocketmq.remoting.netty.NettyRemotingClientTest)
java.lang.VerifyError: JVMVRFY021 thrown object not throwable; class=org/apache/rocketmq/remoting/netty/NettyRemotingClient, method=<init>(Lorg/apache/rocketmq/remoting/netty/NettyClientConfig;Lorg/apache/rocketmq/remoting/ChannelEventListener;)V, pc=152
Exception Details:
  Location:
    org/apache/rocketmq/remoting/netty/NettyRemotingClient.<init>(Lorg/apache/rocketmq/remoting/netty/NettyClientConfig;Lorg/apache/rocketmq/remoting/ChannelEventListener;)V @152: JBifge
  Reason:
    A stackmap frame is expected at branch target 193.
  Exception Handler Table:
    bci [3136, 3467] => handler: 3470
    bci [3136, 3467] => handler: 3807
	at org.apache.rocketmq.remoting.netty.NettyRemotingClientTest.<init>(NettyRemotingClientTest.java:29)

FAILURES!!!
Tests run: 1,  Failures: 1

against the Hotspot's output:

jdk17_hotspot_openjdk_x64/bin/java -cp ./bug_file:./util:./classes:./test-classes:./junit-4.13.2.jar:./hamcrest-2.1.jar:./assertj-core-2.6.0.jar:./byte-buddy-1.11.0.jar:./mockito-core-3.10.0.jar:./netty-all-4.1.65.Final.jar org.junit.runner.JUnitCore org.apache.rocketmq.remoting.netty.NettyRemotingClientTest
JUnit version 4.13.2
.E
Time: 0.042
There was 1 failure:
1) testSetCallbackExecutor(org.apache.rocketmq.remoting.netty.NettyRemotingClientTest)
java.lang.VerifyError: Expecting a stackmap frame at branch target 193
Exception Details:
  Location:
    org/apache/rocketmq/remoting/netty/NettyRemotingClient.<init>(Lorg/apache/rocketmq/remoting/netty/NettyClientConfig;Lorg/apache/rocketmq/remoting/ChannelEventListener;)V @152: ifge
  Reason:
    Expected stackmap frame at this location.
  Bytecode:
    0000000: 0336 6303 3662 0336 6103 3660 0336 5f03
...
  Exception Handler Table:
    bci [3136, 3467] => handler: 3470
    bci [3136, 3467] => handler: 3807

	at org.apache.rocketmq.remoting.netty.NettyRemotingClientTest.<init>(NettyRemotingClientTest.java:29)

FAILURES!!!
Tests run: 1,  Failures: 1

[ChengJin01]

Hi @lochnagarr, please specify -Xverify:nofallback on the command line to ensure the class is verified by the current Verifier (rather than the old Verifier) so as to trigger the same VerifyError as Hotspot due to different implementation in such case.

[lochnagarr]

Thanks for your works!

[ChengJin01]

Close this issue as it has nothing to do with code but the Verifier specific command-line option.