深入字节码理解invokeSuper无限循环的原因

来一段简单的cglib代码

 public class SampleClass {
     public void test(){
         System.out.println("hello world");
     }

     public static void main(String[] args) {
         System.setProperty(DebuggingClassWriter.DEBUG_LOCATION_PROPERTY, "D:\\classes");
         Enhancer enhancer = new Enhancer();
         enhancer.setSuperclass(SampleClass.class);
         enhancer.setCallback(new MethodInterceptor() {
             @Override
             public Object intercept(Object obj, Method method, Object[] args, MethodProxy proxy) throws Throwable {
                 System.out.println("before method run...");
                 Object result = proxy.invokeSuper(obj, args);
                 result = proxy.invoke(obj, args);
                 System.out.println("after method run...");
                 return result;
             }
         });
         SampleClass sample = (SampleClass) enhancer.create();
         sample.test();
     }
 }

代码中使用 System.setProperty(DebuggingClassWriter.DEBUG_LOCATION_PROPERTY, "D:\\classes")设置环境变量，此设置可以打印生成的字节码文件。

受影响的方法为：org.springframework.cglib.core.DebuggingClassWriter#toByteArray这里使用了spring的cglib包：spring的cglib包仅仅修改了cglib的类路径，实现完全相同

运行过程中，cglib会生成3个class文件，第一个class文件的生成触发点在测试类第20行，对SampleClass进行增强，生成的关键代码如下：

 public class SampleClass$$EnhancerByCGLIB$$8ed28f extends SampleClass implements Factory {
      private static final Callback[] CGLIB$STATIC_CALLBACKS;
      private MethodInterceptor CGLIB$CALLBACK_0;
      private static final Method CGLIB$test$0$Method;
      private static final MethodProxy CGLIB$test$0$Proxy;
      private static final Object[] CGLIB$emptyArgs;

      static void CGLIB$STATICHOOK1() {
          CGLIB$emptyArgs = new Object[0];
          Class var0 = Class.forName("com.example.demo.proxy.SampleClass$$EnhancerByCGLIB$$8ed28f");
          Class var1;
          CGLIB$test$0$Method = ReflectUtils.findMethods(new String[]{"test", "()V"}, (var1 = Class.forName("com.example.demo.proxy.SampleClass")).getDeclaredMethods())[0];
          CGLIB$test$0$Proxy = MethodProxy.create(var1, var0, "()V", "test", "CGLIB$test$0");
      }

      final void CGLIB$test$0() {
          super.test();
      }

      public final void test() {
          MethodInterceptor var10000 = this.CGLIB$CALLBACK_0;
          if(this.CGLIB$CALLBACK_0 == null) {
              CGLIB$BIND_CALLBACKS(this);
              var10000 = this.CGLIB$CALLBACK_0;
          }

          if(var10000 != null) {
              var10000.intercept(this, CGLIB$test$0$Method, CGLIB$emptyArgs, CGLIB$test$0$Proxy);
          } else {
              super.test();
          }
      }

      private static final void CGLIB$BIND_CALLBACKS(Object var0) {
          SampleClass$$EnhancerByCGLIB$$8ed28f var1 = (SampleClass$$EnhancerByCGLIB$$8ed28f)var0;
          if(!var1.CGLIB$BOUND) {
              var1.CGLIB$BOUND = true;
              Object var10000 = CGLIB$THREAD_CALLBACKS.get();
              if(var10000 == null) {
                  var10000 = CGLIB$STATIC_CALLBACKS;
                  if(CGLIB$STATIC_CALLBACKS == null) {
                      return;
                  }
              }

              var1.CGLIB$CALLBACK_0 = (MethodInterceptor)((Callback[])var10000)[0];
          }

      }

      public void setCallback(int var1, Callback var2) {
          switch(var1) {
          case 0:
              this.CGLIB$CALLBACK_0 = (MethodInterceptor)var2;
          default:
          }
      }

      static {
          CGLIB$STATICHOOK1();
      }
  }

测试代码第10行：enhancer.setCallback（**）将拦截器设置到增强代码中。

执行test()方法，实际上调用的是增强代码的20行test()方法，增强的方法会调用注册的拦截器。方法参数为：

Object obj 增强的SampleClass$$EnhancerByCGLIB$$8ed28f实例
Method method 原生test方法
Object[] args 此处没有参数，为空
MethodProxy proxy 生成的methodProxy

接下来我们看下methodProxy的生成：增强类静态块中调用了CGLIB$test$0$Proxy = MethodProxy.create(var1, var0, "()V", "test", "CGLIB$test$0");

     public static MethodProxy create(Class c1, Class c2, String desc, String name1, String name2) {
         MethodProxy proxy = new MethodProxy();
         proxy.sig1 = new Signature(name1, desc);
         proxy.sig2 = new Signature(name2, desc);
         proxy.createInfo = new CreateInfo(c1, c2);
         return proxy;
     }

只是记录了一些类信息。

测试代码执行：proxy.invokeSuper(obj, args);

     public Object invokeSuper(Object obj, Object[] args) throws Throwable {
         try {
             init();
             FastClassInfo fci = fastClassInfo;
             return fci.f2.invoke(fci.i2, obj, args);
         } catch (InvocationTargetException e) {
             throw e.getTargetException();
         }
     }

展开init方法

 private void init()
     {
         if (fastClassInfo == null)
         {
             synchronized (initLock)
             {
                 if (fastClassInfo == null)
                 {
                     CreateInfo ci = createInfo;

                     FastClassInfo fci = new FastClassInfo();
                     fci.f1 = helper(ci, ci.c1);
                     fci.f2 = helper(ci, ci.c2);
                     fci.i1 = fci.f1.getIndex(sig1);
                     fci.i2 = fci.f2.getIndex(sig2);
                     fastClassInfo = fci;
                     createInfo = null;
                 }
             }
         }
     }

12                     fci.f1 = helper(ci, ci.c1);
13                     fci.f2 = helper(ci, ci.c2);

这2行分别生成的2个fastClass类,通过类的signature快速定位方法

12                     fci.f1 = SampleClass$$FastClassByCGLIB$$4f454a14 

 public class SampleClass$$FastClassByCGLIB$$4f454a14 extends FastClass {

     public int getIndex(Signature var1) {
         String var10000 = var1.toString();
         switch(var10000.hashCode()) {
         case -1422510685:
             if(var10000.equals("test()V")) {
                 return 1;
             }
             break;

         return -1;
     }

     public Object invoke(int var1, Object var2, Object[] var3) throws InvocationTargetException {
         SampleClass var10000 = (SampleClass)var2;
         int var10001 = var1;

         try {
             switch(var10001) {
             case 1:
                 var10000.test();
                 return null;
             }
         } catch (Throwable var4) {
             throw new InvocationTargetException(var4);
         }

         throw new IllegalArgumentException("Cannot find matching method/constructor");
     }
 }

13                     fci.f2 = SampleClass$$EnhancerByCGLIB$$8ed28f$$FastClassByCGLIB$$520b645b

 public class SampleClass$$EnhancerByCGLIB$$8ed28f$$FastClassByCGLIB$$520b645b extends FastClass {

     public int getIndex(Signature var1) {
         String var10000 = var1.toString();
         switch(var10000.hashCode()) {
         case -1659809612:
             if(var10000.equals("CGLIB$test$0()V")) {
                 return 16;
             }
             break;
         case -1422510685:
             if(var10000.equals("test()V")) {
                 return 7;
             }
             break;
         return -1;
     }

     public Object invoke(int var1, Object var2, Object[] var3) throws InvocationTargetException {
         8ed28f var10000 = (8ed28f)var2;
         int var10001 = var1;

         try {
             switch(var10001) {
             case 7:
                 var10000.test();
                 return null;
             case 16:
                 var10000.CGLIB$test$0();
                 return null;
         } catch (Throwable var4) {
             throw new InvocationTargetException(var4);
         }

         throw new IllegalArgumentException("Cannot find matching method/constructor");
     }
 }

invokeSuper调用fci.f2.invoke(fci.i2, obj, args)，使用的是第三个生成类，方法签名是：CGLIB$test$0

通过方法签名的hashcode映射后得到索引为16

 6         case -1659809612:
 7             if(var10000.equals("CGLIB$test$0()V")) {
 8                 return 16;
 9             }
10             break;

invoke调用的时候

28             case 16:
29                 var10000.CGLIB$test$0();
30                 return null;
走的这段逻辑。对比增强类可以得知CGLIB$test$0()是对原生方法的存根，执行的是最原始的逻辑。

invoke调用

     public Object invoke(Object obj, Object[] args) throws Throwable {
         try {
             init();
             FastClassInfo fci = fastClassInfo;
             return fci.f1.invoke(fci.i1, obj, args);
         } catch (InvocationTargetException e) {
             throw e.getTargetException();
         } catch (IllegalArgumentException e) {
             if (fastClassInfo.i1 < 0)
                 throw new IllegalArgumentException("Protected method: " + sig1);
             throw e;
         }
     }

fci.f1.invoke(fci.i1, obj, args)使用的是第二个生成类，方法签名是：test

通过方法签名的hashcode映射后得到索引为1

 6         case -1422510685:
 7             if(var10000.equals("test()V")) {
 8                 return 1;
 9             }
10             break;

invoke调用的时候

21             case 1:
22                 var10000.test();
23                 return null;
24             }

走的这段逻辑。对比增强类可以得知test()是增强方法，注册了拦截调用，所以才会出现循环调用，最终导致栈深操作过大范围，出现内存溢出。