--- a/hotspot/src/share/vm/classfile/verifier.cpp	Wed Jul 05 23:44:18 2017 +0200
+++ b/hotspot/src/share/vm/classfile/verifier.cpp	Thu Jun 22 00:51:07 2017 +0200
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 1998, 2016, Oracle and/or its affiliates. All rights reserved.
+ * Copyright (c) 1998, 2017, Oracle and/or its affiliates. All rights reserved.
  * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
  *
  * This code is free software; you can redistribute it and/or modify it
@@ -54,6 +54,7 @@
 #define NOFAILOVER_MAJOR_VERSION                       51
 #define NONZERO_PADDING_BYTES_IN_SWITCH_MAJOR_VERSION  51
 #define STATIC_METHOD_IN_INTERFACE_MAJOR_VERSION       52
+#define MAX_ARRAY_DIMENSIONS 255
 
 // Access to external entry for VerifyClassCodes - old byte code verifier
 
@@ -125,8 +126,8 @@
   st->print_cr("End class verification for: %s", klassName);
 }
 
-bool Verifier::verify(instanceKlassHandle klass, Verifier::Mode mode, bool should_verify_class, TRAPS) {
-  HandleMark hm;
+bool Verifier::verify(InstanceKlass* klass, Verifier::Mode mode, bool should_verify_class, TRAPS) {
+  HandleMark hm(THREAD);
   ResourceMark rm(THREAD);
 
   // Eagerly allocate the identity hash code for a klass. This is a fallout
@@ -203,13 +204,13 @@
     return true; // verifcation succeeded
   } else { // VerifyError or ClassFormatError to be created and thrown
     ResourceMark rm(THREAD);
-    instanceKlassHandle kls =
+    Klass* kls =
       SystemDictionary::resolve_or_fail(exception_name, true, CHECK_false);
     if (log_is_enabled(Debug, class, resolve)) {
-      Verifier::trace_class_resolution(kls(), klass());
+      Verifier::trace_class_resolution(kls, klass);
     }
 
-    while (!kls.is_null()) {
+    while (kls != NULL) {
       if (kls == klass) {
         // If the class being verified is the exception we're creating
         // or one of it's superclasses, we're in trouble and are going
@@ -224,7 +225,7 @@
   }
 }
 
-bool Verifier::is_eligible_for_verification(instanceKlassHandle klass, bool should_verify_class) {
+bool Verifier::is_eligible_for_verification(InstanceKlass* klass, bool should_verify_class) {
   Symbol* name = klass->name();
   Klass* refl_magic_klass = SystemDictionary::reflect_MagicAccessorImpl_klass();
 
@@ -243,7 +244,7 @@
     // already been rewritten to contain constant pool cache indices,
     // which the verifier can't understand.
     // Shared classes shouldn't have stackmaps either.
-    !klass()->is_shared() &&
+    !klass->is_shared() &&
 
     // As of the fix for 4486457 we disable verification for all of the
     // dynamically-generated bytecodes associated with the 1.4
@@ -256,7 +257,7 @@
 }
 
 Symbol* Verifier::inference_verify(
-    instanceKlassHandle klass, char* message, size_t message_len, TRAPS) {
+    InstanceKlass* klass, char* message, size_t message_len, TRAPS) {
   JavaThread* thread = (JavaThread*)THREAD;
   JNIEnv *env = thread->jni_environment();
 
@@ -559,7 +560,7 @@
 // Methods in ClassVerifier
 
 ClassVerifier::ClassVerifier(
-    instanceKlassHandle klass, TRAPS)
+    InstanceKlass* klass, TRAPS)
     : _thread(THREAD), _exception_type(NULL), _message(NULL), _klass(klass) {
   _this_type = VerificationType::reference_type(klass->name());
   // Create list to hold symbols in reference area.
@@ -1991,6 +1992,7 @@
 }
 
 Klass* ClassVerifier::load_class(Symbol* name, TRAPS) {
+  HandleMark hm(THREAD);
   // Get current loader and protection domain first.
   oop loader = current_class()->class_loader();
   oop protection_domain = current_class()->protection_domain();
@@ -2000,13 +2002,13 @@
     true, THREAD);
 
   if (log_is_enabled(Debug, class, resolve)) {
-    instanceKlassHandle cur_class = current_class();
-    Verifier::trace_class_resolution(kls, cur_class());
+    InstanceKlass* cur_class = InstanceKlass::cast(current_class());
+    Verifier::trace_class_resolution(kls, cur_class);
   }
   return kls;
 }
 
-bool ClassVerifier::is_protected_access(instanceKlassHandle this_class,
+bool ClassVerifier::is_protected_access(InstanceKlass* this_class,
                                         Klass* target_class,
                                         Symbol* field_name,
                                         Symbol* field_sig,
@@ -2169,7 +2171,7 @@
 }
 
 bool ClassVerifier::name_in_supers(
-    Symbol* ref_name, instanceKlassHandle current) {
+    Symbol* ref_name, InstanceKlass* current) {
   Klass* super = current->super();
   while (super != NULL) {
     if (super->name() == ref_name) {
@@ -2599,8 +2601,8 @@
         Klass::find_overpass);
       // Do nothing if method is not found.  Let resolution detect the error.
       if (m != NULL) {
-        instanceKlassHandle mh(THREAD, m->method_holder());
-        if (m->is_protected() && !mh->is_same_class_package(_klass())) {
+        InstanceKlass* mh = m->method_holder();
+        if (m->is_protected() && !mh->is_same_class_package(_klass)) {
           bool assignable = current_type().is_assignable_from(
             objectref_type, this, true, CHECK_VERIFY(this));
           if (!assignable) {
@@ -2630,7 +2632,7 @@
 }
 
 bool ClassVerifier::is_same_or_direct_interface(
-    instanceKlassHandle klass,
+    InstanceKlass* klass,
     VerificationType klass_type,
     VerificationType ref_class_type) {
   if (ref_class_type.equals(klass_type)) return true;
@@ -2930,8 +2932,15 @@
   char* arr_sig_str;
   if (component_type.is_array()) {     // it's an array
     const char* component_name = component_type.name()->as_utf8();
+    // Check for more than MAX_ARRAY_DIMENSIONS
+    length = (int)strlen(component_name);
+    if (length > MAX_ARRAY_DIMENSIONS &&
+        component_name[MAX_ARRAY_DIMENSIONS - 1] == '[') {
+      verify_error(ErrorContext::bad_code(bci),
+        "Illegal anewarray instruction, array has more than 255 dimensions");
+    }
     // add one dimension to component
-    length = (int)strlen(component_name) + 1;
+    length++;
     arr_sig_str = NEW_RESOURCE_ARRAY_IN_THREAD(THREAD, char, length);
     arr_sig_str[0] = '[';
     strncpy(&arr_sig_str[1], component_name, length - 1);