Type Checking Verifier in Java6

In my previous post I talked about different steps involved in loading a class.

The verification process that happens during linking is a very important part of the java sandbox security model.

The verification process does the following

* Checks that every instruction has a valid operation code;
* Checks every branch instruction branches to the start of some other instruction,rather than into the middle of an instruction;
* Checks every method is provided with a structurally correct signature;
* Checks every instruction obeys the type discipline of the Java virtual machine language.
* Checks accesses to objects are always as what they are (for example, InputStream objects are always used as InputStreams and never as anything else).
* Access restrictions are not violated
* Plus a lot of other things as specified in the JVM specs.

As you can guess this process would be very time intensive. Java 6 has reportedly come with a new 'Type Checking Verifier' that promises to dramatically reduce the run-time computational requirements of the bytecode verifier on Java SE.

How does it manage to do it?

It turns out that much of the program analysis that the verifier performs at run-time may not be necessary, because the type information can also be obtained at compile-time when the class file is generated. The compiler includes type information needed by the verifier in the class file, the job of the verifier at run-time is made much simpler and less memory intensive. The verifier is handed a table of expected program states encoded in the class file, and can validate that those expected states actually occur, and result in safe execution.

More details on it, once i get a chance to read the updated JVM specs for this feature.

Subscribe to comments for this post