[BCEL-41] JustIce - array store type checks stricter than native verifier

• Type: Bug
• Status: In Progress
• Priority: Major
• Resolution: Unresolved
• Component/s: Verifier
• External issue URL: https://issues.apache.org/bugzilla/show_bug.cgi?id=26839
• External issue ID: 26839
• Assignee: Apache Commons Developers
• Reporter: Peter Taylor
• Created: 10/Feb/04 19:56
• Updated: 24/Apr/14 13:56

Description

Consider the class

public class Demo
{
    public static void main(String[] args)
    {
        Object[] objs = new Integer[1];
        objs[0] = o();
    }

    private static Object o()
    {
        return null;
    }
}

It compiles fine, and

java -verify Demo

executes without errors. However,
java org.apache.bcel.verifier.Verifier Demo
complains:

Pass 3b, method number 1 ['public static void main(String[] arg0)']:
VERIFIED_REJECTED
Constraint violated in method 'public static void main(String[] arg0)':
Instruction AASTORE constraint violated: The type of 'value' ('java.lang.Object') is not assignment 
compatible to the components of the array 'arrayref' refers to. ('java.lang.Integer')

etc.

The problem is that while the vmspec2 says "The type of every value stored into an array of type reference by an aastore instruction must be assignment compatible (§2.6.7) with the component type of the array", the class file doesn't contain information on the compile-time component type of the array. I suspect the native verifier does nothing about this requirement, leaving the VM to throw an ArrayStoreException if problems arise.

Enver Haase asked me to mention in this report that while the error message says "assignment compatible to" and the vmspec2 says "assignment compatible with", it's not a case of doing the check the wrong way round.