Fix unsafe use of 'allocate' where 'allocate_zero' should be used

The more aggressive optimizations of 'allocate_zero' introduced
in cb6fc15c35c7e could produce unsafe code such as the following:

    {allocate,0,1}.
    {bif,element,{f,0},[{integer,1},{x,0}],{x,0}}.

The code is not safe because if element/2 fails, the runtime
system may scan the stack and find garbage that looks like a
catch tag, and would most probably crash.

Fix the problem by making beam_utils:is_killed/3 be more conservative
when asked whether a Y register will be killed.

Also fix an unsafe move upwards of an allocation instruction
in beam_block.

1 files changed, 17 insertions, 7 deletions

diff --git a/lib/compiler/src/beam_utils.erl b/lib/compiler/src/beam_utils.erl
index 4dcce30583..a57dbbbc2f 100644
--- a/lib/compiler/src/beam_utils.erl
+++ b/lib/compiler/src/beam_utils.erl
@@ -440,8 +440,11 @@ check_liveness(R, [{bs_init,_,_,Live,Ss,Dst}|Is], St) ->
 	    case member(R, Ss) of
 		true -> {used,St};
 		false ->
+                    %% If the exception is taken, the stack may
+                    %% be scanned. Therefore the register is not
+                    %% guaranteed to be killed.
 		    if
-			R =:= Dst -> {killed,St};
+                        R =:= Dst -> {not_used,St};
 			true -> not_used(check_liveness(R, Is, St))
 		    end
 	    end
@@ -735,8 +738,8 @@ check_liveness_block_1(R, Ss, Ds, Op, Is, St0) ->
 	    end
     end.
 
-check_liveness_block_2(R, {gc_bif,_Op,{f,Lbl}}, _Ss, St) ->
-    check_liveness_block_3(R, Lbl, St);
+check_liveness_block_2(R, {gc_bif,Op,{f,Lbl}}, Ss, St) ->
+    check_liveness_block_3(R, Lbl, {Op,length(Ss)}, St);
 check_liveness_block_2(R, {bif,Op,{f,Lbl}}, Ss, St) ->
     Arity = length(Ss),
     case erl_internal:comp_op(Op, Arity) orelse
@@ -744,16 +747,23 @@ check_liveness_block_2(R, {bif,Op,{f,Lbl}}, Ss, St) ->
 	true ->
 	    {killed,St};
 	false ->
-	    check_liveness_block_3(R, Lbl, St)
+	    check_liveness_block_3(R, Lbl, {Op,length(Ss)}, St)
     end;
 check_liveness_block_2(R, {put_map,_Op,{f,Lbl}}, _Ss, St) ->
-    check_liveness_block_3(R, Lbl, St);
+    check_liveness_block_3(R, Lbl, {unsafe,0}, St);
 check_liveness_block_2(_, _, _, St) ->
     {killed,St}.
 
-check_liveness_block_3(_, 0, St) ->
+check_liveness_block_3({x,_}, 0, _FA, St) ->
     {killed,St};
-check_liveness_block_3(R, Lbl, St0) ->
+check_liveness_block_3({y,_}, 0, {F,A}, St) ->
+    %% If the exception is thrown, the stack may be scanned,
+    %% thus implicitly using the y register.
+    case erl_bifs:is_safe(erlang, F, A) of
+        true -> {killed,St};
+        false -> {used,St}
+    end;
+check_liveness_block_3(R, Lbl, _FA, St0) ->
     check_liveness_at(R, Lbl, St0).
 
 index_labels_1([{label,Lbl}|Is0], Acc) ->