Why won't this bytecode verify

Question

EDIT: The solution is that I was using aastore, when I should have been using iastore, because I wanted to store an item in an array of ints, while aastore is only for arrays of Objects.

I have the following method I'm generating as a constructor in bytecode

aload_0
invokespecial java/lang/Object/<init>()V
aload_0
new java/lang/StringBuilder
dup
invokespecial java/lang/StringBuilder/<init>()V
putfield com/js/interpreter/custom_types/1e9ebd0/s Ljava/lang/StringBuilder;
aload_0
iconst_0
putfield com/js/interpreter/custom_types/1e9ebd0/l I
aload_0
iconst_0
multianewarray [I 1
astore_1
iconst_0
istore_2
goto 23
18:aload_1
iload_2
iconst_0
aastore
iinc 2 1
23:iload_2
iconst_0
if_icmplt 18
aload_1
putfield com/js/interpreter/custom_types/1e9ebd0/a [I
return

However, it fails to verify, giving method: signature: ()V) Expecting to find object/array on stack

However, I can go through and know precisely the number of items on the stack at all times:

    aload_0
1
    invokespecial java/lang/Object/<init>()V
0
    aload_0
1
    new java/lang/StringBuilder
2
    dup
3
    invokespecial java/lang/StringBuilder/<init>()V
2
    putfield com/js/interpreter/custom_types/1e9ebd0/s Ljava/lang/StringBuilder;
0
    aload_0
1
    iconst_0
2
    putfield com/js/interpreter/custom_types/1e9ebd0/l I
0
    aload_0
1
    iconst_0
2
    multianewarray [I 1
2
    astore_1
1
    iconst_0
2
    istore_2
1
    goto 23
    18:aload_1
2
    iload_2
3
    iconst_0
4
    aastore
1
    iinc 2 1
1
    23:iload_2
2
    iconst_0
3
    if_icmplt 18
1
    aload_1
2
    putfield com/js/interpreter/custom_types/1e9ebd0/a [I
0
    return

When I run it through the Justice verifier, it doesn't give me any useful messages (and it even fails to verify classes generated by javac).

What could be going on here? What's the problem?

Answer 1

I don't see the problem, but here's what I do when I get sucked into the bytecode-debugging hell:

• Omit unnecessary code. currently it seems that the loop is a nop (you never enter into the body loop because you initialize local variable 2 with zero, right?). So I would just make the body of the loop be empty and see if the verification bug persists.
• Then, I will start removing other pieces (the initialization of the various fields), until the bug disappears.

Answer 2

Perhaps i'm confused but you do

1
jsr 23

...

23: iload_2
2

but after 23, i'd think there'd be 3 on the stack

A0
<return address>
I2