How can the JVM verify there's no potential operand stack overflow when loading a class?

Question

Going over some presentation, I've come across the following claim: When the JVM loads a class, it can analyze its content and make sure there's no overflow or underflow of the operand stack. I've found a lot of sources that make the same claim, but without specifying how it's done.

It is unclear to me how such verification can be made using static analysis. Say I have a (malicious) method that gets some value as an argument, and uses it to perform a series of pops. At load time, the number of iterations is not known, as it depends on the argument given by the method's caller. Therefore, it seems to me that only at runtime should it be possible to determined whether there will be an underflow or not. What am I missing here?

Answer 1

You can find basic description of the Bytecode Verifier in Java Virtual Machine specification.

To put it simple, stack depth is known at every branching point, and two execution paths merging at the same merge point must also have the same stack depth. So, the verifier won't allow you to perform series of pops without corresponding puts.

Answer 2

The code of the method is split into execution blocks. A "block" is a sequence of instructions that can be executed without jumping out or into. The blocks build a directed graph of all possible execution paths.

A block always expects a certain stack size at its beginning and has a fixed stack size at its end (beginning + all the pushes - all the pops). The verifier checks that for all blocks 'a' that can be reached from a given block 'b', the end stack-size of b matches the beginning stack-size of a.