深入字节码理解invokeSuper无限循环的原因

来一段简单的cglib代码

public class SampleClass {
    public void test(){
        System.out.println("hello world");
    }

    public static void main(String[] args) {
        System.setProperty(DebuggingClassWriter.DEBUG_LOCATION_PROPERTY, "D:\classes");
        Enhancer enhancer = new Enhancer();
        enhancer.setSuperclass(SampleClass.class);
        enhancer.setCallback(new MethodInterceptor() {
            @Override
            public Object intercept(Object obj, Method method, Object[] args, MethodProxy proxy) throws Throwable {
                System.out.println("before method run...");
                Object result = proxy.invokeSuper(obj, args);
                result = proxy.invoke(obj, args);
                System.out.println("after method run...");
                return result;
            }
        });
        SampleClass sample = (SampleClass) enhancer.create();
        sample.test();
    }
}

 代码中使用 System.setProperty(DebuggingClassWriter.DEBUG_LOCATION_PROPERTY, "D:\classes")设置环境变量，此设置可以打印生成的字节码文件。

受影响的方法为：org.springframework.cglib.core.DebuggingClassWriter#toByteArray这里使用了spring的cglib包：spring的cglib包仅仅修改了cglib的类路径，实现完全相同

运行过程中，cglib会生成3个class文件，第一个class文件的生成触发点在测试类第20行，对SampleClass进行增强，生成的关键代码如下：

public class SampleClass$$EnhancerByCGLIB$$8ed28f extends SampleClass implements Factory {
     private static final Callback[] CGLIB$STATIC_CALLBACKS;
     private MethodInterceptor CGLIB$CALLBACK_0;
     private static final Method CGLIB$test$0$Method;
     private static final MethodProxy CGLIB$test$0$Proxy;
     private static final Object[] CGLIB$emptyArgs;
 
     static void CGLIB$STATICHOOK1() {
         CGLIB$emptyArgs = new Object[0];
         Class var0 = Class.forName("com.example.demo.proxy.SampleClass$$EnhancerByCGLIB$$8ed28f");
         Class var1;
         CGLIB$test$0$Method = ReflectUtils.findMethods(new String[]{"test", "()V"}, (var1 = Class.forName("com.example.demo.proxy.SampleClass")).getDeclaredMethods())[0];
         CGLIB$test$0$Proxy = MethodProxy.create(var1, var0, "()V", "test", "CGLIB$test$0");
     }
 
     final void CGLIB$test$0() {
         super.test();
     }
 
     public final void test() {
         MethodInterceptor var10000 = this.CGLIB$CALLBACK_0;
         if(this.CGLIB$CALLBACK_0 == null) {
             CGLIB$BIND_CALLBACKS(this);
             var10000 = this.CGLIB$CALLBACK_0;
         }
 
         if(var10000 != null) {
             var10000.intercept(this, CGLIB$test$0$Method, CGLIB$emptyArgs, CGLIB$test$0$Proxy);
         } else {
             super.test();
         }
     }
 
     private static final void CGLIB$BIND_CALLBACKS(Object var0) {
         SampleClass$$EnhancerByCGLIB$$8ed28f var1 = (SampleClass$$EnhancerByCGLIB$$8ed28f)var0;
         if(!var1.CGLIB$BOUND) {
             var1.CGLIB$BOUND = true;
             Object var10000 = CGLIB$THREAD_CALLBACKS.get();
             if(var10000 == null) {
                 var10000 = CGLIB$STATIC_CALLBACKS;
                 if(CGLIB$STATIC_CALLBACKS == null) {
                     return;
                 }
             }
 
             var1.CGLIB$CALLBACK_0 = (MethodInterceptor)((Callback[])var10000)[0];
         }
 
     }
 
     public void setCallback(int var1, Callback var2) {
         switch(var1) {
         case 0:
             this.CGLIB$CALLBACK_0 = (MethodInterceptor)var2;
         default:
         }
     }
 
     static {
         CGLIB$STATICHOOK1();
     }
 }

测试代码第10行：enhancer.setCallback（**）将拦截器设置到增强代码中。

执行test()方法，实际上调用的是增强代码的20行test()方法，增强的方法会调用注册的拦截器。方法参数为：

Object obj 增强的SampleClass$$EnhancerByCGLIB$$8ed28f实例
Method method 原生test方法
Object[] args 此处没有参数，为空
MethodProxy proxy 生成的methodProxy

接下来我们看下methodProxy的生成：增强类静态块中调用了CGLIB$test$0$Proxy = MethodProxy.create(var1, var0, "()V", "test", "CGLIB$test$0");

    public static MethodProxy create(Class c1, Class c2, String desc, String name1, String name2) {
        MethodProxy proxy = new MethodProxy();
        proxy.sig1 = new Signature(name1, desc);
        proxy.sig2 = new Signature(name2, desc);
        proxy.createInfo = new CreateInfo(c1, c2);
        return proxy;
    }

只是记录了一些类信息。

测试代码执行：proxy.invokeSuper(obj, args);

    public Object invokeSuper(Object obj, Object[] args) throws Throwable {
        try {
            init();
            FastClassInfo fci = fastClassInfo;
            return fci.f2.invoke(fci.i2, obj, args);
        } catch (InvocationTargetException e) {
            throw e.getTargetException();
        }
    }

展开init方法

private void init()
    {
        if (fastClassInfo == null)
        {
            synchronized (initLock)
            {
                if (fastClassInfo == null)
                {
                    CreateInfo ci = createInfo;

                    FastClassInfo fci = new FastClassInfo();
                    fci.f1 = helper(ci, ci.c1);
                    fci.f2 = helper(ci, ci.c2);
                    fci.i1 = fci.f1.getIndex(sig1);
                    fci.i2 = fci.f2.getIndex(sig2);
                    fastClassInfo = fci;
                    createInfo = null;
                }
            }
        }
    }

12                     fci.f1 = helper(ci, ci.c1);
13                     fci.f2 = helper(ci, ci.c2);

这2行分别生成的2个fastClass类,通过类的signature快速定位方法

12                     fci.f1 = SampleClass$$FastClassByCGLIB$$4f454a14 

public class SampleClass$$FastClassByCGLIB$$4f454a14 extends FastClass {

    public int getIndex(Signature var1) {
        String var10000 = var1.toString();
        switch(var10000.hashCode()) {
        case -1422510685:
            if(var10000.equals("test()V")) {
                return 1;
            }
            break;
        
        return -1;
    }

    public Object invoke(int var1, Object var2, Object[] var3) throws InvocationTargetException {
        SampleClass var10000 = (SampleClass)var2;
        int var10001 = var1;

        try {
            switch(var10001) {
            case 1:
                var10000.test();
                return null;
            }
        } catch (Throwable var4) {
            throw new InvocationTargetException(var4);
        }

        throw new IllegalArgumentException("Cannot find matching method/constructor");
    }
}

13                     fci.f2 = SampleClass$$EnhancerByCGLIB$$8ed28f$$FastClassByCGLIB$$520b645b

public class SampleClass$$EnhancerByCGLIB$$8ed28f$$FastClassByCGLIB$$520b645b extends FastClass {

    public int getIndex(Signature var1) {
        String var10000 = var1.toString();
        switch(var10000.hashCode()) {
        case -1659809612:
            if(var10000.equals("CGLIB$test$0()V")) {
                return 16;
            }
            break;
        case -1422510685:
            if(var10000.equals("test()V")) {
                return 7;
            }
            break;
        return -1;
    }

    public Object invoke(int var1, Object var2, Object[] var3) throws InvocationTargetException {
        8ed28f var10000 = (8ed28f)var2;
        int var10001 = var1;

        try {
            switch(var10001) {
            case 7:
                var10000.test();
                return null;
            case 16:
                var10000.CGLIB$test$0();
                return null;
        } catch (Throwable var4) {
            throw new InvocationTargetException(var4);
        }

        throw new IllegalArgumentException("Cannot find matching method/constructor");
    }
}

invokeSuper调用fci.f2.invoke(fci.i2, obj, args)，使用的是第三个生成类，方法签名是：CGLIB$test$0

通过方法签名的hashcode映射后得到索引为16

 6         case -1659809612:
 7             if(var10000.equals("CGLIB$test$0()V")) {
 8                 return 16;
 9             }
10             break;

invoke调用的时候

28             case 16:
29                 var10000.CGLIB$test$0();
30                 return null;
走的这段逻辑。对比增强类可以得知CGLIB$test$0()是对原生方法的存根，执行的是最原始的逻辑。


invoke调用

    public Object invoke(Object obj, Object[] args) throws Throwable {
        try {
            init();
            FastClassInfo fci = fastClassInfo;
            return fci.f1.invoke(fci.i1, obj, args);
        } catch (InvocationTargetException e) {
            throw e.getTargetException();
        } catch (IllegalArgumentException e) {
            if (fastClassInfo.i1 < 0)
                throw new IllegalArgumentException("Protected method: " + sig1);
            throw e;
        }
    }

fci.f1.invoke(fci.i1, obj, args)使用的是第二个生成类，方法签名是：test

通过方法签名的hashcode映射后得到索引为1

 6         case -1422510685:
 7             if(var10000.equals("test()V")) {
 8                 return 1;
 9             }
10             break;

invoke调用的时候

21             case 1:
22                 var10000.test();
23                 return null;
24             }

走的这段逻辑。对比增强类可以得知test()是增强方法，注册了拦截调用，所以才会出现循环调用，最终导致栈深操作过大范围，出现内存溢出。