How dvm calls native method

1 ***********************************************************************************************************************************

We dig more about the native method call processing flow of dvm with source code.
When a transmit from java to native occurs, dvm sets up a native stack.
In dvmCallJNIMethod(), dvmPlatformInvoke is used to call the native method(signature in Method.insns).

1181   dvmPlatformInvoke(env,
1182            (ClassObject*) staticMethodClass,
1183            method->jniArgInfo, method->insSize, modArgs, method->shorty,
1184            (void*) method->insns, pResult);


(gdb) disass dvmPlatformInvoke
Dump of assembler code for function dvmPlatformInvoke:
   0x40c8b2c0 <+0>: push {r6, r7, r8, r9, r11, lr}
   0x40c8b2c4 <+4>: add r11, sp, #20
   0x40c8b2c8 <+8>: ldr r9, [r11, #4]
   0x40c8b2cc <+12>: cmp r1, #0
   0x40c8b2d0 <+16>: subeq r3, r3, #1
   0x40c8b2d4 <+20>: ldreq r1, [r9], #4
   0x40c8b2d8 <+24>: teq r2, #0
   0x40c8b2dc <+28>: bmi 0x40c8b348 <dvmPlatformInvoke+136>
   0x40c8b2e0 <+32>: and r12, r2, #251658240 ; 0xf000000
   0x40c8b2e4 <+36>: lsr r6, r2, #28
   0x40c8b2e8 <+40>: sub sp, sp, r12, lsr #21
   0x40c8b2ec <+44>: mov r8, sp
   0x40c8b2f0 <+48>: mov r7, r9
   0x40c8b2f4 <+52>: lsrs r2, r2, #2
   0x40c8b2f8 <+56>: addcc r7, r7, #8
   0x40c8b2fc <+60>: subcc r3, r3, #2
   0x40c8b300 <+64>: addcs r7, r7, #4
   0x40c8b304 <+68>: subcs r3, r3, #1
   0x40c8b308 <+72>: subs r3, r3, #1
   0x40c8b30c <+76>: bmi 0x40c8b328 <dvmPlatformInvoke+104>
   0x40c8b310 <+80>: lsrs r2, r2, #1
   0x40c8b314 <+84>: ldrcc r12, [r7], #4
   0x40c8b318 <+88>: strcc r12, [r8], #4
   0x40c8b31c <+92>: bcc 0x40c8b308 <dvmPlatformInvoke+72>
   0x40c8b320 <+96>: add r8, r8, #4
   0x40c8b324 <+100>: b 0x40c8b310 <dvmPlatformInvoke+80>
   0x40c8b328 <+104>: ldm r9, {r2, r3}
   0x40c8b32c <+108>: ldr r12, [r11, #12]
   0x40c8b330 <+112>: blx r12
=> 0x40c8b334 <+116>: cmp r6, #0


dvmPlatformInvoke()  @  CallEABI.S

37Function prototype:
38
39void dvmPlatformInvoke(void* pEnv, ClassObject* clazz, int argInfo, int argc,
40    const u4* argv, const char* signature, void* func, JValue* pReturn)


88 * On entry:
89 *   r0  JNIEnv (can be left alone)
90 *   r1  clazz (NULL for virtual method calls, non-NULL for static)
91 *   r2  arg info
92 *   r3  argc (number of 32-bit values in argv)
93 *   [sp]     argv
94 *   [sp,#4]  short signature
95 *   [sp,#8]  func
96 *   [sp,#12] pReturn

134     * stack looks like:
135     *
136     *  pReturn
137     *  func
138     *  shorty
139     *  argv        <-- sp on entry
140     *  lr          <-- fp
141     *  fp
142     *  r9...r7
143     *  r6          <-- sp after reg save

236.Lcopy_done:
237    /*
238     * Currently:
239     *  r0-r3  args (JNIEnv*, thisOrClass, arg0, arg1)
240     *  r6  return type (enum DalvikJniReturnType)
241     *  r9  original argv
242     *  fp  frame pointer
243     *
244     * The stack copy is complete.  Grab the first two words off of argv
245     * and tuck them into r2/r3.  If the first arg is 32-bit and the second
246     * arg is 64-bit, then r3 "holds" a pad word and the load is unnecessary
247     * but harmless.
248     *
249     * If there are 0 or 1 arg words in argv, we will be loading uninitialized
250     * data into the registers, but since nothing tries to use it it's also
251     * harmless (assuming argv[0] and argv[1] point to valid memory, which
252     * is a reasonable assumption for Dalvik's interpreted stacks).
253     */
254    ldmia   r9, {r2-r3}                 @ r2/r3<- argv[0]/argv[1]
255
256    ldr     ip, [fp, #8+FP_ADJ]         @ ip<- func
257#ifdef __ARM_HAVE_BLX
258    blx     ip                          @ call func  ******* call the jni function ********
259#else
260    mov     lr, pc                      @ call func the old-fashioned way
261    bx      ip
262#endif


The args for jni function are passed in args[1-(argc-1)].
agrs[0] is the java object on which to call the method, it is use to refer object and lock object if the method is synchronized.

dalvik_mterp () at dalvik/vm/mterp/out/InterpAsm-armv7-a-neon.S
(gdb) disass dalvik_mterp
Dump of assembler code for function dalvik_mterp:
   0x40c947cc <+0>: push {r4, r5, r6, r7, r8, r9, r10, r11, lr}
   0x40c947d0 <+4>: sub sp, sp, #4
   0x40c947d4 <+8>: cmp lr, #0
   0x40c947d8 <+12>: bne 0x40c94808 <dalvik_mterp+60>
   0x40c947dc <+16>: mov lr, pc
   0x40c947e0 <+20>: ldr pc, [r2, #40] ; 0x28     ** call dvmCallJNIMethod
=> 0x40c947e4 <+24>: ldr r0, [r10, #12]


called in <-----------
dvmInterpret(Thread*, Method const*, JValue*)  @ dalvik/vm/interp/Interp.cpp:1964

On initilizing....... meth->nativeFunc and meth->jniArgInfo are assigned with dvmResolveNativeMethod and computeJniArgInfo(&meth->prototype) separately.
After name resolved via dvmResolveNativeMethod, meth->nativeFunc is assigned with new MethodCallBridge dvmCallJNIMethod.
So, only resolve once for one native method.

2150 * Pull the interesting pieces out of a DexMethod.
2151 *
2152 * The DEX file isn't going anywhere, so we don't need to make copies of
2153 * the code area.
2154 */
2155static void loadMethodFromDex(ClassObject* clazz, const DexMethod* pDexMethod, @ dalvik/vm/oo/Class.cpp
2156    Method* meth)
2157{
2158    DexFile* pDexFile = clazz->pDvmDex->pDexFile;
2159    const DexMethodId* pMethodId;
2160    const DexCode* pDexCode;
2161
2162    pMethodId = dexGetMethodId(pDexFile, pDexMethod->methodIdx);
2163
2164    meth->name = dexStringById(pDexFile, pMethodId->nameIdx);
2165    dexProtoSetFromMethodId(&meth->prototype, pDexFile, pMethodId);
2166    meth->shorty = dexProtoGetShorty(&meth->prototype);
2167    meth->accessFlags = pDexMethod->accessFlags;
2168    meth->clazz = clazz;
2169    meth->jniArgInfo = 0;
2170
2171    if (dvmCompareNameDescriptorAndMethod("finalize", "()V", meth) == 0) {
2172        /*
2173         * The Enum class declares a "final" finalize() method to
2174         * prevent subclasses from introducing a finalizer.  We don't
2175         * want to set the finalizable flag for Enum or its subclasses,
2176         * so we check for it here.
2177         *
2178         * We also want to avoid setting it on Object, but it's easier
2179         * to just strip that out later.
2180         */
2181        if (clazz->classLoader != NULL ||
2182            strcmp(clazz->descriptor, "Ljava/lang/Enum;") != 0)
2183        {
2184            SET_CLASS_FLAG(clazz, CLASS_ISFINALIZABLE);
2185        }
2186    }
2187
2188    pDexCode = dexGetCode(pDexFile, pDexMethod);
2189    if (pDexCode != NULL) {
2190        /* integer constants, copy over for faster access */
2191        meth->registersSize = pDexCode->registersSize;
2192        meth->insSize = pDexCode->insSize;
2193        meth->outsSize = pDexCode->outsSize;
2194
2195        /* pointer to code area */
2196        meth->insns = pDexCode->insns;
2197    } else {
2198        /*
2199         * We don't have a DexCode block, but we still want to know how
2200         * much space is needed for the arguments (so we don't have to
2201         * compute it later).  We also take this opportunity to compute
2202         * JNI argument info.
2203         *
2204         * We do this for abstract methods as well, because we want to
2205         * be able to substitute our exception-throwing "stub" in.
2206         */
2207        int argsSize = dvmComputeMethodArgsSize(meth);
2208        if (!dvmIsStaticMethod(meth))
2209            argsSize++;
2210        meth->registersSize = meth->insSize = argsSize;
2211        assert(meth->outsSize == 0);
2212        assert(meth->insns == NULL);
2213
2214        if (dvmIsNativeMethod(meth)) {    *****************
2215            meth->nativeFunc = dvmResolveNativeMethod;  *****************
2216            meth->jniArgInfo = computeJniArgInfo(&meth->prototype); *****************
2217        }
2218    }
2219}


On running, dvmCallMethodV is used to transfer execution from java to native.

/*
434 * Issue a method call with a variable number of arguments.  We process
435 * the contents of "args" by scanning the method signature.
436 *
437 * Pass in NULL for "obj" on calls to static methods.
438 *
439 * We don't need to take the class as an argument because, in Dalvik,
440 * we don't need to worry about static synchronized methods.
441 */
442void dvmCallMethodV(Thread* self, const Method* method, Object* obj, @ dalvik/vm/interp/Stack.cpp
443    bool fromJni, JValue* pResult, va_list args)
444{
445    const char* desc = &(method->shorty[1]); // [0] is the return type.
446    int verifyCount = 0;
447    ClassObject* clazz;
448    u4* ins;
449
450    clazz = callPrep(self, method, obj, false);
451    if (clazz == NULL)
452        return;
453
454    /* "ins" for new frame start at frame pointer plus locals */
455    ins = ((u4*)self->interpSave.curFrame) +
456           (method->registersSize - method->insSize);
457
458    //ALOGD("  FP is %p, INs live at >= %p", self->interpSave.curFrame, ins);
459
460    /* put "this" pointer into in0 if appropriate */
461    if (!dvmIsStaticMethod(method)) {
462#ifdef WITH_EXTRA_OBJECT_VALIDATION
463        assert(obj != NULL && dvmIsHeapAddress(obj));
464#endif
465        *ins++ = (u4) obj;
466        verifyCount++;
467    }
468
469    while (*desc != '\0') {
470        switch (*(desc++)) {
471            case 'D': case 'J': {
472                u8 val = va_arg(args, u8);
473                memcpy(ins, &val, 8);       // EABI prevents direct store
474                ins += 2;
475                verifyCount += 2;
476                break;
477            }
478            case 'F': {
479                /* floats were normalized to doubles; convert back */
480                float f = (float) va_arg(args, double);
481                *ins++ = dvmFloatToU4(f);
482                verifyCount++;
483                break;
484            }
485            case 'L': {     /* 'shorty' descr uses L for all refs, incl array */
486                void* arg = va_arg(args, void*);
487                assert(obj == NULL || dvmIsHeapAddress(obj));
488                jobject argObj = reinterpret_cast<jobject>(arg);
489                if (fromJni)
490                    *ins++ = (u4) dvmDecodeIndirectRef(self, argObj);
491                else
492                    *ins++ = (u4) argObj;
493                verifyCount++;
494                break;
495            }
496            default: {
497                /* Z B C S I -- all passed as 32-bit integers */
498                *ins++ = va_arg(args, u4);
499                verifyCount++;
500                break;
501            }
502        }
503    }
504
505#ifndef NDEBUG
506    if (verifyCount != method->insSize) {
507        ALOGE("Got vfycount=%d insSize=%d for %s.%s", verifyCount,
508            method->insSize, clazz->descriptor, method->name);
509        assert(false);
510        goto bail;
511    }
512#endif
513
514    //dvmDumpThreadStack(dvmThreadSelf());
515
516    if (dvmIsNativeMethod(method)) {      ***************
517        TRACE_METHOD_ENTER(self, method);
518        /*
519         * Because we leave no space for local variables, "curFrame" points
520         * directly at the method arguments.
521         */
522        (*method->nativeFunc)((u4*)self->interpSave.curFrame, pResult, ***************
523                              method, self);
524        TRACE_METHOD_EXIT(self, method);
525    } else {
526        dvmInterpret(self, method, pResult);     ***************
527    }
528
529#ifndef NDEBUG
530bail:
531#endif
532    dvmPopFrame(self);
533}


Like dynamic symbol resolve, resolver function as native function slot entry. resolve once!!!

70void dvmResolveNativeMethod(const u4* args, JValue* pResult,
71    const Method* method, Thread* self)
72{
73    ClassObject* clazz = method->clazz;
74
75    /*
76     * If this is a static method, it could be called before the class
77     * has been initialized.
78     */
79    if (dvmIsStaticMethod(method)) {
80        if (!dvmIsClassInitialized(clazz) && !dvmInitClass(clazz)) {
81            assert(dvmCheckException(dvmThreadSelf()));
82            return;
83        }
84    } else {
85        assert(dvmIsClassInitialized(clazz) ||
86               dvmIsClassInitializing(clazz));
87    }
88
89    /* start with our internal-native methods */
90    DalvikNativeFunc infunc = dvmLookupInternalNativeMethod(method);
91    if (infunc != NULL) {
92        /* resolution always gets the same answer, so no race here */
93        IF_LOGVV() {
94            char* desc = dexProtoCopyMethodDescriptor(&method->prototype);
95            LOGVV("+++ resolved native %s.%s %s, invoking",
96                clazz->descriptor, method->name, desc);
97            free(desc);
98        }
99        if (dvmIsSynchronizedMethod(method)) {
100            ALOGE("ERROR: internal-native can't be declared 'synchronized'");
101            ALOGE("Failing on %s.%s", method->clazz->descriptor, method->name);
102            dvmAbort();     // harsh, but this is VM-internal problem
103        }
104        DalvikBridgeFunc dfunc = (DalvikBridgeFunc) infunc;
105        dvmSetNativeFunc((Method*) method, dfunc, NULL);   ********************
106        dfunc(args, pResult, method, self);
107        return;
108    }
109
110    /* now scan any DLLs we have loaded for JNI signatures */
111    void* func = lookupSharedLibMethod(method);
112    if (func != NULL) {
113        /* found it, point it at the JNI bridge and then call it */
114        dvmUseJNIBridge((Method*) method, func);    ********************
115        (*method->nativeFunc)(args, pResult, method, self);
116        return;
117    }
118
119    IF_ALOGW() {
120        char* desc = dexProtoCopyMethodDescriptor(&method->prototype);
121        ALOGW("No implementation found for native %s.%s:%s",
122            clazz->descriptor, method->name, desc);
123        free(desc);
124    }
125
126    dvmThrowUnsatisfiedLinkError("Native method not found", method);
127}


827/*
828 * Point "method->nativeFunc" at the JNI bridge, and overload "method->insns"
829 * to point at the actual function.
830 */
831void dvmUseJNIBridge(Method* method, void* func) {
832    method->shouldTrace = shouldTrace(method);
833
834    // Does the method take any reference arguments?
835    method->noRef = true;
836    const char* cp = method->shorty;
837    while (*++cp != '\0') { // Pre-increment to skip return type.
838        if (*cp == 'L') {
839            method->noRef = false;
840            break;
841        }
842    }
843
844    DalvikBridgeFunc bridge = gDvmJni.useCheckJni ? dvmCheckCallJNIMethod : dvmCallJNIMethod;
845    dvmSetNativeFunc(method, bridge, (const u2*) func);
846}


/*
4532 * Replace method->nativeFunc and method->insns with new values.  This is
4533 * commonly performed after successful resolution of a native method.
4534 *
4535 * There are three basic states:
4536 *  (1) (initial) nativeFunc = dvmResolveNativeMethod, insns = NULL
4537 *  (2) (internal native) nativeFunc = <impl>, insns = NULL
4538 *  (3) (JNI) nativeFunc = JNI call bridge, insns = <impl>
4539 *
4540 * nativeFunc must never be NULL for a native method.
4541 *
4542 * The most common transitions are (1)->(2) and (1)->(3).  The former is
4543 * atomic, since only one field is updated; the latter is not, but since
4544 * dvmResolveNativeMethod ignores the "insns" field we just need to make
4545 * sure the update happens in the correct order.
4546 *
4547 * A transition from (2)->(1) would work fine, but (3)->(1) will not,
4548 * because both fields change.  If we did this while a thread was executing
4549 * in the call bridge, we could null out the "insns" field right before
4550 * the bridge tried to call through it.  So, once "insns" is set, we do
4551 * not allow it to be cleared.  A NULL value for the "insns" argument is
4552 * treated as "do not change existing value".
4553 */
4554void dvmSetNativeFunc(Method* method, DalvikBridgeFunc func,
4555    const u2* insns)
4556{
4557    ClassObject* clazz = method->clazz;
4558
4559    assert(func != NULL);
4560
4561    /* just open up both; easier that way */
4562    dvmLinearReadWrite(clazz->classLoader, clazz->virtualMethods);
4563    dvmLinearReadWrite(clazz->classLoader, clazz->directMethods);
4564
4565    if (insns != NULL) {
4566        /* update both, ensuring that "insns" is observed first */
4567        method->insns = insns;
4568        android_atomic_release_store((int32_t) func,
4569            (volatile int32_t*)(void*) &method->nativeFunc);
4570    } else {
4571        /* only update nativeFunc */
4572        method->nativeFunc = func;
4573    }
4574
4575    dvmLinearReadOnly(clazz->classLoader, clazz->virtualMethods);
4576    dvmLinearReadOnly(clazz->classLoader, clazz->directMethods);
4577}


/*
1117 * General form, handles all cases.
1118 */
1119void dvmCallJNIMethod(const u4* args, JValue* pResult, const Method* method, Thread* self) {
1120    u4* modArgs = (u4*) args;
1121    jclass staticMethodClass = NULL;
1122
1123    u4 accessFlags = method->accessFlags;
1124    bool isSynchronized = (accessFlags & ACC_SYNCHRONIZED) != 0;
1125
1126    //ALOGI("JNI calling %p (%s.%s:%s):", method->insns,
1127    //    method->clazz->descriptor, method->name, method->shorty);
1128
1129    /*
1130     * Walk the argument list, creating local references for appropriate
1131     * arguments.
1132     */
1133    int idx = 0;
1134    Object* lockObj;
1135    if ((accessFlags & ACC_STATIC) != 0) {
1136        lockObj = (Object*) method->clazz;
1137        /* add the class object we pass in */
1138        staticMethodClass = (jclass) addLocalReference(self, (Object*) method->clazz);
1139    } else {
1140        lockObj = (Object*) args[0];
1141        /* add "this" */
1142        modArgs[idx++] = (u4) addLocalReference(self, (Object*) modArgs[0]);
1143    }
1144
1145    if (!method->noRef) {
1146        const char* shorty = &method->shorty[1];        /* skip return type */
1147        while (*shorty != '\0') {
1148            switch (*shorty++) {
1149            case 'L':
1150                //ALOGI("  local %d: 0x%08x", idx, modArgs[idx]);
1151                if (modArgs[idx] != 0) {
1152                    modArgs[idx] = (u4) addLocalReference(self, (Object*) modArgs[idx]);
1153                }
1154                break;
1155            case 'D':
1156            case 'J':
1157                idx++;
1158                break;
1159            default:
1160                /* Z B C S I -- do nothing */
1161                break;
1162            }
1163            idx++;
1164        }
1165    }
1166
1167    if (UNLIKELY(method->shouldTrace)) {
1168        logNativeMethodEntry(method, args);
1169    }
1170    if (UNLIKELY(isSynchronized)) {
1171        dvmLockObject(self, lockObj);
1172    }
1173
1174    ThreadStatus oldStatus = dvmChangeStatus(self, THREAD_NATIVE);
1175
1176    ANDROID_MEMBAR_FULL();      /* guarantee ordering on method->insns */
1177    assert(method->insns != NULL);
1178
1179    JNIEnv* env = self->jniEnv;
1180    COMPUTE_STACK_SUM(self);
1181    dvmPlatformInvoke(env,
1182            (ClassObject*) staticMethodClass,
1183            method->jniArgInfo, method->insSize, modArgs, method->shorty,
1184            (void*) method->insns, pResult);
1185    CHECK_STACK_SUM(self);
1186
1187    dvmChangeStatus(self, oldStatus);
1188
1189    convertReferenceResult(env, pResult, method, self);
1190
1191    if (UNLIKELY(isSynchronized)) {
1192        dvmUnlockObject(self, lockObj);
1193    }
1194    if (UNLIKELY(method->shouldTrace)) {
1195        logNativeMethodExit(method, self, *pResult);
1196    }
1197}


======================================================================================

2 **********************************************************************************************************************
More things about reflect invoke. This is to invoke 'main' in the case.
We dig more to get a view of the start of an activity via logcat.

506    public Object invoke(Object receiver, Object... args) @ libcore/luni/src/main/java/java/lang/reflect/Method.java
507            throws IllegalAccessException, IllegalArgumentException, InvocationTargetException {
508        if (args == null) {
509            args = EmptyArray.OBJECT;
510        }
511        return invokeNative(receiver, args, declaringClass, parameterTypes, returnType, slot, flag);
512    }

41/*
42 * private Object invokeNative(Object obj, Object[] args, Class declaringClass,
43 *   Class[] parameterTypes, Class returnType, int slot, boolean noAccessCheck)
44 *
45 * Invoke a static or virtual method via reflection.
46 */
47static void Dalvik_java_lang_reflect_Method_invokeNative(const u4* args,
48    JValue* pResult)
49{
50    // ignore thisPtr in args[0]
51    Object* methObj = (Object*) args[1];        // null for static methods
52    ArrayObject* argList = (ArrayObject*) args[2];
53    ClassObject* declaringClass = (ClassObject*) args[3];
54    ArrayObject* params = (ArrayObject*) args[4];
55    ClassObject* returnType = (ClassObject*) args[5];
56    int slot = args[6];
57    bool noAccessCheck = (args[7] != 0);
58    const Method* meth;
59    Object* result;
60
61    /*
62     * "If the underlying method is static, the class that declared the
63     * method is initialized if it has not already been initialized."
64     */
65    meth = dvmSlotToMethod(declaringClass, slot);
66    assert(meth != NULL);
67
68    if (dvmIsStaticMethod(meth)) {
69        if (!dvmIsClassInitialized(declaringClass)) {
70            if (!dvmInitClass(declaringClass))
71                goto init_failed;
72        }
73    } else {
74        /* looks like interfaces need this too? */
75        if (dvmIsInterfaceClass(declaringClass) &&
76            !dvmIsClassInitialized(declaringClass))
77        {
78            if (!dvmInitClass(declaringClass))
79                goto init_failed;
80        }
81
82        /* make sure the object is an instance of the expected class */
83        if (!dvmVerifyObjectInClass(methObj, declaringClass)) {
84            assert(dvmCheckException(dvmThreadSelf()));
85            RETURN_VOID();
86        }
87
88        /* do the virtual table lookup for the method */
89        meth = dvmGetVirtualizedMethod(methObj->clazz, meth);
90        if (meth == NULL) {
91            assert(dvmCheckException(dvmThreadSelf()));
92            RETURN_VOID();
93        }
94    }
95
96    /*
97     * If the method has a return value, "result" will be an object or
98     * a boxed primitive.
99     */
100    result = dvmInvokeMethod(methObj, meth, argList, params, returnType,
101                noAccessCheck);
102
103    RETURN_PTR(result);
104
105init_failed:
106    /*
107     * If initialization failed, an exception will be raised.
108     */
109    ALOGD("Method.invoke() on bad class %s failed",
110        declaringClass->descriptor);
111    assert(dvmCheckException(dvmThreadSelf()));
112    RETURN_VOID();
113}

645/*
646 * Invoke a method, using the specified arguments and return type, through
647 * one of the reflection interfaces.  Could be a virtual or direct method
648 * (including constructors).  Used for reflection.
649 *
650 * Deals with boxing/unboxing primitives and performs widening conversions.
651 *
652 * "invokeObj" will be null for a static method.
653 *
654 * If the invocation returns with an exception raised, we have to wrap it.
655 */
656Object* dvmInvokeMethod(Object* obj, const Method* method,
657    ArrayObject* argList, ArrayObject* params, ClassObject* returnType,
658    bool noAccessCheck)
659{
660    ClassObject* clazz;
661    Object* retObj = NULL;
662    Thread* self = dvmThreadSelf();
663    s4* ins;
664    int verifyCount, argListLength;
665    JValue retval;
666    bool needPop = false;
667
668    /* verify arg count */
669    if (argList != NULL)
670        argListLength = argList->length;
671    else
672        argListLength = 0;
673    if (argListLength != (int) params->length) {
674        dvmThrowExceptionFmt(gDvm.exIllegalArgumentException,
675            "wrong number of arguments; expected %d, got %d",
676            params->length, argListLength);
677        return NULL;
678    }
679
680    clazz = callPrep(self, method, obj, !noAccessCheck);
681    if (clazz == NULL)
682        return NULL;
683    needPop = true;
684
685    /* "ins" for new frame start at frame pointer plus locals */
686    ins = ((s4*)self->interpSave.curFrame) +
687        (method->registersSize - method->insSize);
688    verifyCount = 0;
689
690    //ALOGD("  FP is %p, INs live at >= %p", self->interpSave.curFrame, ins);
691
692    /* put "this" pointer into in0 if appropriate */
693    if (!dvmIsStaticMethod(method)) {
694        assert(obj != NULL);
695        *ins++ = (s4) obj;
696        verifyCount++;
697    }
698
699    /*
700     * Copy the args onto the stack.  Primitive types are converted when
701     * necessary, and object types are verified.
702     */
703    DataObject** args = (DataObject**)(void*)argList->contents;
704    ClassObject** types = (ClassObject**)(void*)params->contents;
705    for (int i = 0; i < argListLength; i++) {
706        int width = dvmConvertArgument(*args++, *types++, ins);
707        if (width < 0) {
708            dvmPopFrame(self);      // throw wants to pull PC out of stack
709            needPop = false;
710            throwArgumentTypeMismatch(i, *(types-1), *(args-1));
711            goto bail;
712        }
713
714        ins += width;
715        verifyCount += width;
716    }
717
718#ifndef NDEBUG
719    if (verifyCount != method->insSize) {
720        ALOGE("Got vfycount=%d insSize=%d for %s.%s", verifyCount,
721            method->insSize, clazz->descriptor, method->name);
722        assert(false);
723        goto bail;
724    }
725#endif
726
727    if (dvmIsNativeMethod(method)) {      **********************
728        TRACE_METHOD_ENTER(self, method);
729        /*
730         * Because we leave no space for local variables, "curFrame" points
731         * directly at the method arguments.
732         */
733        (*method->nativeFunc)((u4*)self->interpSave.curFrame, &retval, **********************
734                              method, self);
735        TRACE_METHOD_EXIT(self, method);
736    } else {
737        dvmInterpret(self, method, &retval);     **********************
738    }
739
740    /*
741     * Pop the frame immediately.  The "wrap" calls below can cause
742     * allocations, and we don't want the GC to walk the now-dead frame.
743     */
744    dvmPopFrame(self);
745    needPop = false;
746
747    /*
748     * If an exception is raised, wrap and replace.  This is necessary
749     * because the invoked method could have thrown a checked exception
750     * that the caller wasn't prepared for.
751     *
752     * We might be able to do this up in the interpreted code, but that will
753     * leave us with a shortened stack trace in the top-level exception.
754     */
755    if (dvmCheckException(self)) {
756        dvmWrapException("Ljava/lang/reflect/InvocationTargetException;");
757    } else {
758        /*
759         * If this isn't a void method or constructor, convert the return type
760         * to an appropriate object.
761         *
762         * We don't do this when an exception is raised because the value
763         * in "retval" is undefined.
764         */
765        if (returnType != NULL) {
766            retObj = (Object*)dvmBoxPrimitive(retval, returnType);
767            dvmReleaseTrackedAlloc(retObj, NULL);
768        }
769    }
770
771bail:
772    if (needPop) {
773        dvmPopFrame(self);
774    }
775    return retObj;
776}


Why it is for main? In the Dalvik_java_lang_reflect_Method_invokeNative call stage.
(gdb) disass Dalvik_java_lang_reflect_Method_invokeNative
Dump of assembler code for function Dalvik_java_lang_reflect_Method_invokeNative(u4 const*, JValue*):
   0x40cd2866 <+0>: stmdb sp!, {r0, r1, r2, r4, r5, r6, r7, r8, r9, r10, r11, lr}
   0x40cd286a <+4>: mov r2, r0
   0x40cd286c <+6>: ldr r6, [r0, #12]
   0x40cd286e <+8>: mov r4, r1
   0x40cd2870 <+10>: ldr.w r8, [r0, #4]
   0x40cd2874 <+14>: ldr.w r9, [r0, #8]
   0x40cd2878 <+18>: ldr r5, [r0, #16]
   0x40cd287a <+20>: ldr.w r11, [r0, #20]
   0x40cd287e <+24>: ldr.w r10, [r0, #28]
   0x40cd2882 <+28>: mov r0, r6
   0x40cd2884 <+30>: ldr r1, [r2, #24]
   0x40cd2886 <+32>: bl 0x40cd897c <dvmSlotToMethod(ClassObject*, int)>
   0x40cd288a <+36>: ldr r3, [r0, #4]
   0x40cd288c <+38>: mov r7, r0
   0x40cd288e <+40>: lsls r2, r3, #28
   0x40cd2890 <+42>: bpl.n 0x40cd28a2 <Dalvik_java_lang_reflect_Method_invokeNative(u4 const*, JValue*)+60>
   0x40cd2892 <+44>: ldr r0, [r6, #44] ; 0x2c
   0x40cd2894 <+46>: cmp r0, #7
   0x40cd2896 <+48>: beq.n 0x40cd28ce <Dalvik_java_lang_reflect_Method_invokeNative(u4 const*, JValue*)+104>
   0x40cd2898 <+50>: mov r0, r6
   0x40cd289a <+52>: bl 0x40cd562c <dvmInitClass(ClassObject*)>
   0x40cd289e <+56>: cbnz r0, 0x40cd28ce <Dalvik_java_lang_reflect_Method_invokeNative(u4 const*, JValue*)+104>
   0x40cd28a0 <+58>: b.n 0x40cd28ea <Dalvik_java_lang_reflect_Method_invokeNative(u4 const*, JValue*)+132>
   0x40cd28a2 <+60>: ldr r1, [r6, #32]
   0x40cd28a4 <+62>: lsls r3, r1, #22
   0x40cd28a6 <+64>: bpl.n 0x40cd28b6 <Dalvik_java_lang_reflect_Method_invokeNative(u4 const*, JValue*)+80>
   0x40cd28a8 <+66>: ldr r3, [r6, #44] ; 0x2c
   0x40cd28aa <+68>: cmp r3, #7
   0x40cd28ac <+70>: beq.n 0x40cd28b6 <Dalvik_java_lang_reflect_Method_invokeNative(u4 const*, JValue*)+80>
   0x40cd28ae <+72>: mov r0, r6
   0x40cd28b0 <+74>: bl 0x40cd562c <dvmInitClass(ClassObject*)>
   0x40cd28b4 <+78>: cbz r0, 0x40cd28ea <Dalvik_java_lang_reflect_Method_invokeNative(u4 const*, JValue*)+132>
   0x40cd28b6 <+80>: mov r0, r8
   0x40cd28b8 <+82>: mov r1, r6
   0x40cd28ba <+84>: bl 0x40ccfb38 <dvmVerifyObjectInClass(Object*, ClassObject*)>
   0x40cd28be <+88>: cbz r0, 0x40cd28ea <Dalvik_java_lang_reflect_Method_invokeNative(u4 const*, JValue*)+132>
   0x40cd28c0 <+90>: mov r1, r7
   0x40cd28c2 <+92>: ldr.w r0, [r8]
   0x40cd28c6 <+96>: bl 0x40cd5f44 <dvmGetVirtualizedMethod(ClassObject const*, Method const*)>
   0x40cd28ca <+100>: mov r7, r0
   0x40cd28cc <+102>: cbz r0, 0x40cd28ea <Dalvik_java_lang_reflect_Method_invokeNative(u4 const*, JValue*)+132>
   0x40cd28ce <+104>: adds.w r2, r10, #0
   0x40cd28d2 <+108>: mov r0, r8
   0x40cd28d4 <+110>: mov r1, r7
   0x40cd28d6 <+112>: mov r3, r5
   0x40cd28d8 <+114>: it ne
   0x40cd28da <+116>: movne r2, #1
   0x40cd28dc <+118>: str r2, [sp, #4]
   0x40cd28de <+120>: mov r2, r9
   0x40cd28e0 <+122>: str.w r11, [sp]
   0x40cd28e4 <+126>: bl 0x40ccb7c8 <dvmInvokeMethod(Object*, Method const*, ArrayObject*, ArrayObject*, ClassObject*, bool)>
=> 0x40cd28e8 <+130>: str r0, [r4, #0]
   0x40cd28ea <+132>: ldmia.w sp!, {r1, r2, r3, r4, r5, r6, r7, r8, r9, r10, r11, pc}

and source code

/*
42 * private Object invokeNative(Object obj, Object[] args, Class declaringClass,
43 *   Class[] parameterTypes, Class returnType, int slot, boolean noAccessCheck)
44 *
45 * Invoke a static or virtual method via reflection.
46 */
47static void Dalvik_java_lang_reflect_Method_invokeNative(const u4* args,
48    JValue* pResult)
49{
50    // ignore thisPtr in args[0]
51    Object* methObj = (Object*) args[1];        // null for static methods
52    ArrayObject* argList = (ArrayObject*) args[2];
53    ClassObject* declaringClass = (ClassObject*) args[3];
54    ArrayObject* params = (ArrayObject*) args[4];
55    ClassObject* returnType = (ClassObject*) args[5];
56    int slot = args[6];
57    bool noAccessCheck = (args[7] != 0);
58    const Method* meth;
59    Object* result;
60
61    /*
62     * "If the underlying method is static, the class that declared the
63     * method is initialized if it has not already been initialized."
64     */
65    meth = dvmSlotToMethod(declaringClass, slot);
66    assert(meth != NULL);
67
68    if (dvmIsStaticMethod(meth)) {
69        if (!dvmIsClassInitialized(declaringClass)) {
70            if (!dvmInitClass(declaringClass))
71                goto init_failed;
72        }
73    } else {
74        /* looks like interfaces need this too? */
75        if (dvmIsInterfaceClass(declaringClass) &&
76            !dvmIsClassInitialized(declaringClass))
77        {
78            if (!dvmInitClass(declaringClass))
79                goto init_failed;
80        }
81
82        /* make sure the object is an instance of the expected class */
83        if (!dvmVerifyObjectInClass(methObj, declaringClass)) {
84            assert(dvmCheckException(dvmThreadSelf()));
85            RETURN_VOID();
86        }
87
88        /* do the virtual table lookup for the method */
89        meth = dvmGetVirtualizedMethod(methObj->clazz, meth);
90        if (meth == NULL) {
91            assert(dvmCheckException(dvmThreadSelf()));
92            RETURN_VOID();
93        }
94    }
95
96    /*
97     * If the method has a return value, "result" will be an object or
98     * a boxed primitive.
99     */
100    result = dvmInvokeMethod(methObj, meth, argList, params, returnType,
101                noAccessCheck);
102
103    RETURN_PTR(result);
104
105init_failed:
106    /*
107     * If initialization failed, an exception will be raised.
108     */
109    ALOGD("Method.invoke() on bad class %s failed",
110        declaringClass->descriptor);
111    assert(dvmCheckException(dvmThreadSelf()));
112    RETURN_VOID();
113}


Though the arg meth in calling dvmInvokeMethod is optimized out, but it can be seen in register r7 or r1 before calling it.
Using the value of r7 and r1, try to get method content.
With the field name and shorty, it can be concluded that r7 maybe the correct Mothod var, while r1 maybe has been corrupted.
(gdb) print *(Method*)0x40e1cc38  ---- r1
$9 = {clazz = 0x40d10d34 <gNativeInterface>, accessFlags = 0, methodIndex = 1, registersSize = 0, outsSize = 12304, insSize = 16397, name = 0x0, prototype = {
    dexFile = 0x5c46cc80, protoIdx = 0}, shorty = 0x12b "", insns = 0x7379732f, jniArgInfo = 795698548, nativeFunc = 0x6d617266, fastJni = 101, noRef = 119, shouldTrace = 111,
  registerMap = 0x6f632f6b, inProfile = 114}

(gdb) print *(Method*)0x570782b8   ---- r7
$10 = {clazz = 0x40e77390, accessFlags = 9, methodIndex = 0, registersSize = 4, outsSize = 2, insSize = 1,name = 0x58ceaed3 "main",prototype = {dexFile = 0x400d3f78,
    protoIdx = 10543}, shorty = 0x58c5520c "VL", insns = 0x58736098, jniArgInfo = 0, nativeFunc = 0x0, fastJni = false, noRef = false, shouldTrace = false, registerMap = 0x0,
  inProfile = false}
(gdb) print *(ClassObject*)0x40e77390  ---- obj->clazz
$15 = {<Object> = {clazz = 0x40e1d1e8, lock = 0}, instanceData = {0, 0, 0, 0}, descriptor = 0x58bc0812 "Landroid/app/ActivityThread;", descriptorAlloc = 0x0,
  accessFlags = 196625, serialNumber = 1342177820, pDvmDex = 0x5128a000, status = CLASS_INITIALIZED, verifyErrorClass = 0x0, initThreadId = 1, objectSize = 180,
  elementClass = 0x0, arrayDim = 0, primitiveType = PRIM_NOT, super = 0x40e1d890, classLoader = 0x0, initiatingLoaderList = {initiatingLoaders = 0x0, initiatingLoaderCount = 0},
  interfaceCount = 0, interfaces = 0x0, directMethodCount = 83, directMethods = 0x57077330, virtualMethodCount = 59, virtualMethods = 0x57078560, vtableCount = 70,
  vtable = 0x57079250, iftableCount = 0, iftable = 0x0, ifviPoolCount = 0, ifviPool = 0x0, ifieldCount = 43, ifieldRefCount = 37, ifields = 0x57076fd0, refOffsets = 3,
  sourceFile = 0x58b79596 "ActivityThread.java", sfieldCount = 21, sfields = 0x40e77430}

Frame #9 is "main" of ZygoteInit.
(gdb) up
#9  0x40ccb698 in dvmCallMethodV (self=0x400d3010, method=0x5705cb88, obj=<optimized out>, fromJni=<optimized out>, pResult=0xbeb30aa8, args=...)
    at dalvik/vm/interp/Stack.cpp:526
526 dalvik/vm/interp/Stack.cpp: No such file or directory.
(gdb) print method
$11 = (const Method *) 0x5705cb88
(gdb) print *method
$12 = {clazz = 0x40e6ce48, accessFlags = 9, methodIndex = 0, registersSize = 6, outsSize = 3, insSize = 1,name = 0x58ceaed3 "main", prototype = {dexFile = 0x400d3f78,
    protoIdx = 10543}, shorty = 0x58c5520c "VL", insns = 0x58a59484, jniArgInfo = 0, nativeFunc = 0x0, fastJni = false, noRef = false, shouldTrace = false, registerMap = 0x0,
  inProfile = false}
(gdb) disass 0x58a59484
No function contains specified address.
(gdb) print *(ClassObject*)0x40e6ce48 ---- obj->clazz
$13 = {<Object> = {clazz = 0x40e1d1e8, lock = 0}, instanceData = {0, 0, 0, 0}, descriptor = 0x58bf0c5a "Lcom/android/internal/os/ZygoteInit;", descriptorAlloc = 0x0,
  accessFlags = 196609, serialNumber = 1342177773, pDvmDex = 0x5128a000, status = CLASS_INITIALIZED, verifyErrorClass = 0x0, initThreadId = 1, objectSize = 8,
  elementClass = 0x0, arrayDim = 0, primitiveType = PRIM_NOT, super = 0x40e1d890, classLoader = 0x0, initiatingLoaderList = {initiatingLoaders = 0x0, initiatingLoaderCount = 0},
  interfaceCount = 0, interfaces = 0x0, directMethodCount = 29, directMethods = 0x5705c958, virtualMethodCount = 0, virtualMethods = 0x0, vtableCount = 11, vtable = 0x5705cfb8,
  iftableCount = 0, iftable = 0x0, ifviPoolCount = 0, ifviPool = 0x0, ifieldCount = 0, ifieldRefCount = 0, ifields = 0x0, refOffsets = 0,
  sourceFile = 0x58c5e5af "ZygoteInit.java", sfieldCount = 17, sfields = 0x40e6cee8}
(gdb)
===============================================================================================

评论
添加红包

请填写红包祝福语或标题

红包个数最小为10个

红包金额最低5元

当前余额3.43前往充值 >
需支付:10.00
成就一亿技术人!
领取后你会自动成为博主和红包主的粉丝 规则
hope_wisdom
发出的红包
实付
使用余额支付
点击重新获取
扫码支付
钱包余额 0

抵扣说明:

1.余额是钱包充值的虚拟货币,按照1:1的比例进行支付金额的抵扣。
2.余额无法直接购买下载,可以购买VIP、付费专栏及课程。

余额充值