Eliminate crash for map updates in guards

beam_validator would complain that x(1) is uninitialized
in a test_heap instruction when attempting to compile
the following code with sys_core_fold turned off:

  foo(M) when not (M#{true := 0}); [M] ->
    ok.

Simplified, the generated BEAM assembly code looked like
this:

    test is_map BadMap x(0)
    put_map_exact Fail x(0) => x(1) ...
    jump BooleanStuff

  BadMap:
    move ok => x(1)
    jump Fail

  BooleanStuff:
    ...
    move Boolean => x(2)
    jump Build

  Fail:
    move false => x(2)

  Build:
    test_heap 2 3  %% x(0), x(1), x(2) must be live.
    ...

That is, if put_map_exact failed, control would transfer
to the label Fail without initializing x(1).

Fix that by making sure that x(1) is initilized even if
put_map_exact fails:

    test is_map BadMap x(0)
    put_map_exact BadLbl x(0) => x(1) ...
    jump OkLbl

  BadLbl:
    move ok => x(1)
    jump Fail

  OkLbl:
    jump BooleanStuff

  BadMap:
    move ok => x(1)
    jump Fail

  BooleanStuff:
    ...
    move Boolean => x(2)
    jump Build

  Fail:
    move false => x(2)

  Build:
    test_heap 2 3  %% x(0), x(1), x(2) must be live.
    ...

Note that this situation is rare, and that other optimization passes
(beam_dead and beam_jump in particular) will clean up this mess.

1 files changed, 3 insertions, 1 deletions

diff --git a/lib/compiler/src/beam_validator.erl b/lib/compiler/src/beam_validator.erl
index 13aa31b7c9..4c0cb6780a 100644
--- a/lib/compiler/src/beam_validator.erl
+++ b/lib/compiler/src/beam_validator.erl
@@ -658,8 +658,10 @@ valfun_4({test,is_map,{f,Lbl},[Src]}, Vst0) ->
     case Src of
 	{Tag,_} when Tag =:= x; Tag =:= y ->
 	    set_type_reg(map, Src, Vst);
+	{literal,Map} when is_map(Map) ->
+	    Vst;
 	_ ->
-	    Vst
+	    kill_state(Vst)
     end;
 valfun_4({test,_Op,{f,Lbl},Src}, Vst) ->
     validate_src(Src, Vst),