类的连接之重写（1）

调用InstanceKlass类的rewrite_class()函数重写字节码，实现如下：

// Rewrite the byte codes of all of the methods of a class.
// The rewriter must be called exactly once. Rewriting must happen after
// verification but before the first method of the class is executed.
void InstanceKlass::rewrite_class(TRAPS) {
  assert(is_loaded(), "must be loaded");
  instanceKlassHandle this_oop(THREAD, this);
  // ...
  Rewriter::rewrite(this_oop, CHECK);
  this_oop->set_rewritten();
}

如上方法在类验证之后，方法执行之前进行字节码重写，并且保证任何一个类对于此方法都只会被调用一次。调用Rewriter::rewrite()函数进行字节码重写，重写完成后设置这个类已经被重写，这样就不会重复重写这个类了。

调用的Rewriter::rewrite()函数的实现如下：

void Rewriter::rewrite(instanceKlassHandle klass, TRAPS) {
  ResourceMark     rm(THREAD);
  Array*  mds = klass->methods();
  ConstantPool*    cp  = klass->constants();
  Rewriter         rw(klass, cp, mds, CHECK);
}

Rewriter类的构造函数的实现如下：

// bcp是bytecode pointer，是某条字节码在内存中的地址；bci是bytecode index，是某条字节码相对该方法的字节码起始位置的偏移量
Rewriter::Rewriter(instanceKlassHandle klass, constantPoolHandle cpool, Array* methods, TRAPS)
  : _klass(klass),_pool(cpool),_methods(methods) {
  assert(_pool->cache() == NULL, "constant pool cache must not be set yet");

  // 第1部分：determine index maps for Method* rewriting
  compute_index_maps();

  // 第2部分
  // RegisterFinalizersAtInit命令解释：先执行new分配好对象空间，然后再执行invokespecial调用构造函数，
  // jvm里其实可以让用户选择在这两个时机中的任意一个将当前对象传递给Finalizer.register方法来注册到Finalizer对象链里，
  // 这个选择依赖于RegisterFinalizersAtInit这个vm参数是否被设置，默认值为true，也就是在调用构造函数返回之前调用
  // Finalizer.register方法，如果通过-XX:-RegisterFinalizersAtInit关闭了该参数，那将在对象空间分配好之后就将这个对象注册进去。
  if (RegisterFinalizersAtInit && _klass->name() == vmSymbols::java_lang_Object()) {
    bool did_rewrite = false;
    int i = _methods->length();
    while (i-- > 0) {
      Method* method = _methods->at(i);
      if (method->intrinsic_id() == vmIntrinsics::_Object_init) {
        // rewrite the return bytecodes of Object. to register the
        // object for finalization if needed.
        methodHandle m(THREAD, method);
        rewrite_Object_init(m, CHECK);
        did_rewrite = true;
        break;
      }
    }
    assert(did_rewrite, "must find Object:: to rewrite it");
  }

  // 第3部分
  // rewrite methods, in two passes
  int len = _methods->length();
  bool invokespecial_error = false;
  for (int i = len-1; i >= 0; i--) {
    Method* method = _methods->at(i);
    scan_method(method, false, &invokespecial_error);
    // ...
  }


  // ...

  // 第4部分
  // allocate constant pool cache, now that we've seen all the bytecodes
  make_constant_pool_cache(THREAD);

  // ...
}

这个方法实现的逻辑比较多，我们分4个部分来介绍。

1、compute_index_maps()函数

首先调用compute_index_maps()函数，如下：

// Computes a CPC map (new_index -> original_index) for constant pool entries
// that are referred to by the interpreter at runtime via the constant pool cache.
// Also computes a CP map (original_index -> new_index).
// Marks entries in CP which require additional processing.
void Rewriter::compute_index_maps() {
  const int length  = _pool->length();
  init_maps(length);
  bool saw_mh_symbol = false;
  // 通过循环一次性将常量池中的项处理完毕
  for (int i = 0; i < length; i++) {
    constantTag ct = _pool->tag_at(i);
    int tag = ct.value();
    switch (tag) {
      case JVM_CONSTANT_InterfaceMethodref:
      case JVM_CONSTANT_Fieldref          : // fall through
      case JVM_CONSTANT_Methodref         : // fall through
        add_cp_cache_entry(i);
        break;
      case JVM_CONSTANT_String:
      case JVM_CONSTANT_MethodHandle      : // fall through
      case JVM_CONSTANT_MethodType        : // fall through
        add_resolved_references_entry(i);
        break;
      // ...
    }
  }

  // Record limits of resolved reference map for constant pool cache indices
  record_map_limits();
  // ...
}

调用的init_maps()函数会初始化Rewriter类中如下的一些重要变量：

// _cp_map与_cap_cache_map是一对
intArray            _cp_map;
// for Methodref, Fieldref,InterfaceMethodref and InvokeDynamic
intStack            _cp_cache_map; 

intArray            _reference_map;    // maps from cp index to resolved_refs index (or -1)
intStack            _resolved_references_map; // for strings, methodHandle, methodType

int                 _resolved_reference_limit;
int                 _first_iteration_cp_cache_limit;

init_maps()函数的实现如下：

void init_maps(int length) {
    _cp_map.initialize(length, -1);       // _cp_map是整数类型数组
    // Choose an initial value large enough that we don't get frequent calls to grow().
    _cp_cache_map.initialize(length/2);   // _cp_cache_map是整数类型栈

    // Also cache resolved objects, in another different cache.
    _reference_map.initialize(length, -1);         // _reference_map是整数类型数组
    _resolved_references_map.initialize(length/2); // _resolved_references_map是整数类型的栈

    _resolved_reference_limit = -1;
    _first_iteration_cp_cache_limit = -1;
} 

首先来认识一下JVM_CONSTANT_InterfaceMethodref、JVM_CONSTANT_Fieldref与JVM_CONSTANT_Methodref。Java虚拟机规范规定的格式如下：

CONSTANT_Fieldref_info {
    u1 tag;
    u2 class_index;
    u2 name_and_type_index;
}
 
CONSTANT_Methodref_info {
    u1 tag;
    u2 class_index;
    u2 name_and_type_index;
}
 
CONSTANT_InterfaceMethodref_info {
    u1 tag;
    u2 class_index;
    u2 name_and_type_index;
}

举个例子如下：

interface Computable {
	void calculate();
}

class Computer implements Computable {
	public void calculate() { }
}

public class Test {

	public static Computable x1 = new Computer();
	public static Computer   x2 = new Computer();
	public static String     x3 = "mz";

	public static void main(String[] args) {
		x1.calculate();
		x2.calculate();
		System.out.println(x3);
	}
}

反编译后如下：

public class com.test.Test
// ...
Constant pool:
   #1 = Class              #2             // com/test/Test
   #2 = Utf8               com/test/Test
   #3 = Class              #4             // java/lang/Object
   #4 = Utf8               java/lang/Object
   #5 = Utf8               x1
   #6 = Utf8               Lcom/test/Computable;
   #7 = Utf8               x2
   #8 = Utf8               Lcom/test/Computer;
   #9 = Utf8               x3
  #10 = Utf8               Ljava/lang/String;
  #11 = Utf8               
  #12 = Utf8               ()V
  #13 = Utf8               Code
  #14 = Class              #15            // com/test/Computer
  #15 = Utf8               com/test/Computer
  #16 = Methodref          #14.#17        // com/test/Computer."":()V
  #17 = NameAndType        #18:#12        // "":()V
  #18 = Utf8               
  #19 = Fieldref           #1.#20         // com/test/Test.x1:Lcom/test/Computable;
  #20 = NameAndType        #5:#6          // x1:Lcom/test/Computable;
  #21 = Fieldref           #1.#22         // com/test/Test.x2:Lcom/test/Computer;
  #22 = NameAndType        #7:#8          // x2:Lcom/test/Computer;
  #23 = String             #24            // mz
  #24 = Utf8               mz
  #25 = Fieldref           #1.#26         // com/test/Test.x3:Ljava/lang/String;
  #26 = NameAndType        #9:#10         // x3:Ljava/lang/String;
  #27 = Utf8               LineNumberTable
  #28 = Utf8               LocalVariableTable
  #29 = Methodref          #3.#17         // java/lang/Object."":()V
  #30 = Utf8               this
  #31 = Utf8               Lcom/test/Test;
  #32 = Utf8               main
  #33 = Utf8               ([Ljava/lang/String;)V
  #34 = InterfaceMethodref #35.#37        // com/test/Computable.calculate:()V
  #35 = Class              #36            // com/test/Computable
  #36 = Utf8               com/test/Computable
  #37 = NameAndType        #38:#12        // calculate:()V
  #38 = Utf8               calculate
  #39 = Methodref          #14.#37        // com/test/Computer.calculate:()V
  #40 = Fieldref           #41.#43        // java/lang/System.out:Ljava/io/PrintStream;
  #41 = Class              #42            // java/lang/System
  #42 = Utf8               java/lang/System
  #43 = NameAndType        #44:#45        // out:Ljava/io/PrintStream;
  #44 = Utf8               out
  #45 = Utf8               Ljava/io/PrintStream;
  #46 = Methodref          #47.#49        // java/io/PrintStream.println:(Ljava/lang/String;)V
  #47 = Class              #48            // java/io/PrintStream
  #48 = Utf8               java/io/PrintStream
  #49 = NameAndType        #50:#51        // println:(Ljava/lang/String;)V
  #50 = Utf8               println
  #51 = Utf8               (Ljava/lang/String;)V
  #52 = Utf8               args
  #53 = Utf8               [Ljava/lang/String;
  #54 = Utf8               SourceFile
  #55 = Utf8               Test.java
{
  public static com.test.Computable x1;
    descriptor: Lcom/test/Computable;
    flags: ACC_PUBLIC, ACC_STATIC

  public static com.test.Computer x2;
    descriptor: Lcom/test/Computer;
    flags: ACC_PUBLIC, ACC_STATIC

  public static java.lang.String x3;
    descriptor: Ljava/lang/String;
    flags: ACC_PUBLIC, ACC_STATIC

  static {};
    descriptor: ()V
    flags: ACC_STATIC
    Code:
      stack=2, locals=0, args_size=0
         0: new           #14                 // class com/test/Computer
         3: dup
         4: invokespecial #16                 // Method com/test/Computer."":()V
         7: putstatic     #19                 // Field x1:Lcom/test/Computable;
        10: new           #14                 // class com/test/Computer
        13: dup
        14: invokespecial #16                 // Method com/test/Computer."":()V
        17: putstatic     #21                 // Field x2:Lcom/test/Computer;
        20: ldc           #23                 // String mz
        22: putstatic     #25                 // Field x3:Ljava/lang/String;
        25: return

  public com.test.Test();
    descriptor: ()V
    flags: ACC_PUBLIC
    Code:
      stack=1, locals=1, args_size=1
         0: aload_0
         1: invokespecial #29                 // Method java/lang/Object."":()V
         4: return

  public static void main(java.lang.String[]);
    descriptor: ([Ljava/lang/String;)V
    flags: ACC_PUBLIC, ACC_STATIC
    Code:
      stack=2, locals=1, args_size=1
         0: getstatic     #19                 // Field x1:Lcom/test/Computable;
         3: invokeinterface #34,  1           // InterfaceMethod com/test/Computable.calculate:()V
         8: getstatic     #21                 // Field x2:Lcom/test/Computer;
        11: invokevirtual #39                 // Method com/test/Computer.calculate:()V
        14: getstatic     #40                 // Field java/lang/System.out:Ljava/io/PrintStream;
        17: getstatic     #25                 // Field x3:Ljava/lang/String;
        20: invokevirtual #46                 // Method java/io/PrintStream.println:(Ljava/lang/String;)V
        23: return
}

对于这3个常量池项来说，在Rewriter::compute_index_maps()方法中调用add_cp_cache_entry()方法进行处理。其实方法还会处理JVM_CONSTANT_MethodHandle与JVM_CONSTANT_MethodType，这2个常量池项是为了让Java语言支持动态语言特性而在Java 7 版本中新增的常量池项，只会在极其特别的情况能用到它，在Class文件中几乎不会生成这三个常量池项，暂时不介绍。 

在Rewriter::compute_index_maps()函数中调用的add_cp_cache_entry()函数的实现如下：

int add_cp_cache_entry(int cp_index) {
    int cache_index = add_map_entry(cp_index, &_cp_map, &_cp_cache_map);
    return cache_index;
}
int add_map_entry(int cp_index, intArray* cp_map, intStack* cp_cache_map) {
    int cache_index = cp_cache_map->append(cp_index); // cp_cache_map是整数类型的栈
    cp_map->at_put(cp_index, cache_index);            //cp_map是整数类型的数组
    return cache_index;
}

通过cp_cache_map和cp_map建立了cp_index与 cache_index的对应关系，这在后面中会有重要应用。

在Rewriter::compute_index_maps()函数中调用的add_resolved_references_entry()函数的实现与如上方法的实现类似，如下： 

// add a new entry to the resolved_references map
int add_resolved_references_entry(int cp_index) {
    int ref_index = add_map_entry(cp_index, &_reference_map, &_resolved_references_map);
    assert(cp_entry_to_resolved_references(cp_index) == ref_index, "");
    return ref_index;
}
int add_map_entry(int cp_index, intArray* cp_map, intStack* cp_cache_map) {
    assert(cp_map->at(cp_index) == -1, "not twice on same cp_index");
    int cache_index = cp_cache_map->append(cp_index);
    cp_map->at_put(cp_index, cache_index);
    return cache_index;
}

在Rewriter::compute_index_maps()函数中调用的record_map_limits()函数如下：

void record_map_limits() {
    // Record initial size of the two arrays generated for the CP cache
    // relative to walking the constant pool.
    _first_iteration_cp_cache_limit = _cp_cache_map.length();      // _cp_cache_map是整数类型的栈
    _resolved_reference_limit = _resolved_references_map.length(); // _resolved_references_map是整数类型的数组
}

更新变量_resolved_reference_limit与_first_iteration_cp_cache_limit的值，现在还看不到对这些变量的应用，后面就会使用这些变量的值。  

2、Rewriter::scan_method()函数　

有些字节码指令的操作数在Class文件里跟在运行时看起来不同，因为HotSpot 在加连接类的时候会对字节码进行重写， 把某些指令的操作数从常量池下标（就是之前接触到的cp_index）改写为常量池缓存下标（就是之前介绍的cp_cache_index）。因为这些指令所需要引用的信息无法使用一个constant pool entry slot来表示，需要使用一个更大的数据结构表示常量池项的内容。在Rewriter::scan_method()中就对部分字节码进行了重写，如下：

// Rewrites a method given the index_map information
void Rewriter::scan_method(Method* method, bool reverse, bool* invokespecial_error) {

  int   nof_jsrs = 0;
  bool  has_monitor_bytecodes = false;
  //////////////////////////////////////////////////////////////////////
  {
    // We cannot tolerate a GC in this block, because we've
    // cached the bytecodes in 'code_base'. If the Method*
    // moves, the bytecodes will also move.
    No_Safepoint_Verifier nsv;
    Bytecodes::Code c;

    // Bytecodes and their length
    const address code_base = method->code_base();
    const int code_length = method->code_size();

    int bc_length;
    for (int bci = 0; bci < code_length; bci += bc_length) {
      address bcp = code_base + bci;
      int prefix_length = 0;
      c = (Bytecodes::Code)(*bcp);

      // Since we have the code, see if we can get the length
      // directly. Some more complicated bytecodes will report
      // a length of zero, meaning we need to make another method
      // call to calculate the length.
      bc_length = Bytecodes::length_for(c);
      if (bc_length == 0) {
        bc_length = Bytecodes::length_at(method, bcp);
        // length_at will put us at the bytecode after the one modified
        // by 'wide'. We don't currently examine any of the bytecodes
        // modified by wide, but in case we do in the future...
        if (c == Bytecodes::_wide) {
          prefix_length = 1;
          c = (Bytecodes::Code)bcp[1];
        }
      }

      switch (c) {
        case Bytecodes::_lookupswitch   : {
          #ifndef CC_INTERP
			  Bytecode_lookupswitch bc(method, bcp);
			  (*bcp) = (
					bc.number_of_pairs() < BinarySwitchThreshold
					? Bytecodes::_fast_linearswitch
					: Bytecodes::_fast_binaryswitch
			  );
          #endif
          break;
        }
        case Bytecodes::_fast_linearswitch:
        case Bytecodes::_fast_binaryswitch: {
          #ifndef CC_INTERP
             (*bcp) = Bytecodes::_lookupswitch;
          #endif
          break;
        }
        case Bytecodes::_invokespecial  : {
          rewrite_invokespecial(bcp, prefix_length+1, reverse, invokespecial_error);
          break;
        }
        case Bytecodes::_getstatic      : // fall through
        case Bytecodes::_putstatic      : // fall through
        case Bytecodes::_getfield       : // fall through
        case Bytecodes::_putfield       : // fall through
        case Bytecodes::_invokevirtual  : // fall through
        case Bytecodes::_invokestatic   :
        case Bytecodes::_invokeinterface:
        case Bytecodes::_invokehandle   : // if reverse=true
          rewrite_member_reference(bcp, prefix_length+1, reverse);
          break;
        // ...
        case Bytecodes::_ldc:
        case Bytecodes::_fast_aldc:  // if reverse=true
          maybe_rewrite_ldc(bcp, prefix_length+1, false, reverse);
          break;
        case Bytecodes::_ldc_w:
        case Bytecodes::_fast_aldc_w:  // if reverse=true
          maybe_rewrite_ldc(bcp, prefix_length+1, true, reverse);
          break;
        // ...
        case Bytecodes::_monitorenter : // fall through
        case Bytecodes::_monitorexit :
        	has_monitor_bytecodes = true;
        	break;
      }
    }
  }
  //////////////////////////////////////////////////////////////////////
  // Update access flags
  if (has_monitor_bytecodes) {
    method->set_has_monitor_bytecodes();
  }

  // ...
}

如上代码的逻辑非常清晰，方法会对字节码指令进行改写，需要改写的指令以及改写时调用的方法都很清楚，不做过多介绍。

（1）Rewriter::rewrite_invokespecial()

// invokerspecial是作为对private和构造方法的调用，绕过了virtual dispatch;
// If the constant pool entry for invokespecial is InterfaceMethodref,
// we need to add a separate cpCache entry for its resolution, because it is
// different than the resolution for invokeinterface with InterfaceMethodref.
// These cannot share cpCache entries.  It's unclear（不确定的） if all invokespecial to
// InterfaceMethodrefs would resolve to the same thing so a new cpCache entry
// is created for each one.  This was added with lambda.
void Rewriter::rewrite_invokespecial(address bcp, int offset, bool reverse, bool* invokespecial_error) {
  address p = bcp + offset;
  if (!reverse) {
	// 获取常量池中要调用方法的索引
    int cp_index = Bytes::get_Java_u2(p);
    if (_pool->tag_at(cp_index).is_interface_method()) {
		int cache_index = add_invokespecial_cp_cache_entry(cp_index);
		if (cache_index != (int)(jushort) cache_index) {
		    *invokespecial_error = true;
		}
		Bytes::put_native_u2(p, cache_index);
    } else {
        rewrite_member_reference(bcp, offset, reverse);
    }
  }
  // ...
}

当reverse为true时，表示出错，需要逆写回去，也就是将字节码中已经替换为cache_index的值替换回原来的cp_index。这里假设不会出错，所以省略了逆写回去的相关代码实现，后续类似的方法也会省略。

调用add_invokespecial_cp_cache_entry()方法根据cp_index来获取cache_index，方法的实现如下：

// add a new CP cache entry beyond the normal cache for the special case of
// invokespecial with InterfaceMethodref as cpool operand.
int add_invokespecial_cp_cache_entry(int cp_index) {
    assert(_first_iteration_cp_cache_limit >= 0, "add these special cache entries after first iteration");
    // Don't add InterfaceMethodref if it already exists at the end.
    for (int i = _first_iteration_cp_cache_limit; i < _cp_cache_map.length(); i++) {
     if (cp_cache_entry_pool_index(i) == cp_index) {
       return i;
     }
    }
    int cache_index = _cp_cache_map.append(cp_index);
    assert(cache_index >= _first_iteration_cp_cache_limit, "");
    // do not update _cp_map, since the mapping is one-to-many
    assert(cp_cache_entry_pool_index(cache_index) == cp_index, "");
    return cache_index;
  }

这会利用之前的_cp_map与_cp_cache_map变量等信息来获取对应cp_index的cache_index。

（2）Rewriter::rewrite_member_reference()

调用的rewrite_member_reference()函数的实现如下：

// Rewrite a classfile-order CP index into a native-order CPC index.
void Rewriter::rewrite_member_reference(address bcp, int offset, bool reverse) {
  address p = bcp + offset;
  if (!reverse) {
    int  cp_index    = Bytes::get_Java_u2(p);
    int  cache_index = cp_entry_to_cp_cache(cp_index);
    Bytes::put_native_u2(p, cache_index);
    
  }
  // ...
}

调用的cp_entry_to_cp_cache()方法的实现如下：

int  cp_entry_to_cp_cache(int i) {
	  assert(has_cp_cache(i), "oob");
	  return _cp_map[i];
  }

方法的实现比较简单，这里不做过多介绍。

（3）Rewriter::maybe_rewrite_ldc()

// ldc指令从常量池中取值然后压入栈中
// Rewrite some ldc bytecodes to _fast_aldc
void Rewriter::maybe_rewrite_ldc(address bcp, int offset, bool is_wide,bool reverse) {
  if (!reverse) {
    assert((*bcp) == (is_wide ? Bytecodes::_ldc_w : Bytecodes::_ldc), "not ldc bytecode");
    address p = bcp + offset;
    int cp_index = is_wide ? Bytes::get_Java_u2(p) : (u1)(*p);
    constantTag tag = _pool->tag_at(cp_index).value();
    if (tag.is_method_handle() || tag.is_method_type() || tag.is_string()) { 
      int ref_index = cp_entry_to_resolved_references(cp_index);
      if (is_wide) {
        (*bcp) = Bytecodes::_fast_aldc_w;
        assert(ref_index == (u2)ref_index, "index overflow");
        Bytes::put_native_u2(p, ref_index);
      } else {
        (*bcp) = Bytecodes::_fast_aldc;
        assert(ref_index == (u1)ref_index, "index overflow");
        (*p) = (u1)ref_index;
      }
    }
  }
  // ...
}

方法不但会替换指令，还会替换指令的常量池索引。

调用的cp_entry_to_resolved_references()函数的实现如下：

int  cp_entry_to_resolved_references(int cp_index) const {
    assert(has_entry_in_resolved_references(cp_index), "oob");
    return _reference_map[cp_index];
}

方法的实现比较简单，这里不做过多介绍。

这一篇介绍了对方法字节码的重写，可能会重写字节码，也可能会重写字节码中指向常量池的索引，但是重写后的字节码到底如何处理，以及新的常量池索引到底索引到了什么信息都还没有介绍，后面会详细介绍。　

相关文章的链接如下：

1、在Ubuntu 16.04上编译OpenJDK8的源代码 

2、调试HotSpot源代码

3、HotSpot项目结构　

4、HotSpot的启动过程 

5、HotSpot二分模型（1）

6、HotSpot的类模型（2）  

7、HotSpot的类模型（3） 

8、HotSpot的类模型（4）

9、HotSpot的对象模型（5）  

10、HotSpot的对象模型（6） 

11、操作句柄Handle（7）

12、句柄Handle的释放（8）

13、类加载器 

14、类的双亲委派机制 

15、核心类的预装载

16、Java主类的装载  

17、触发类的装载  

18、类文件介绍 

19、文件流 

20、解析Class文件 

21、常量池解析（1） 

22、常量池解析（2）

23、字段解析（1）

24、字段解析之伪共享（2） 

25、字段解析（3）  

26、字段解析之OopMapBlock（4）

27、方法解析之Method与ConstMethod介绍  

28、方法解析

29、klassVtable与klassItable类的介绍  

30、计算vtable的大小 

31、计算itable的大小 

32、解析Class文件之创建InstanceKlass对象 

33、字段解析之字段注入 

34、类的连接  

35、类的连接之验证 

作者持续维护的个人博客  classloading.com。

关注公众号，有HotSpot源码剖析系列文章！