v3_core: Fix variable incorrectly unbound after binary match

In the following code:

m(<<Sz:8,_:Sz/binary>>) ->
    Sz = wrong.

the Sz variable is supposed to be bound in the function header and the
matching "Sz = wrong" should cause a badarg exception.  But what
happens is that the Sz variables seems to be unbound and the matching
succeds and the m/1 function returns 'wrong'.

If the Sz variable is used directly (not matched), it will have
the expected value. Thus the following code:

m(<<Sz:8,_:Sz/binary>>) ->
    Sz.

will correctly return the value of Sz that was matched out from
the binary.

Reported-by: Bernard Duggan

1 files changed, 15 insertions, 1 deletions

diff --git a/lib/compiler/src/v3_core.erl b/lib/compiler/src/v3_core.erl
index 54f6834dd5..e1a593fffa 100644
--- a/lib/compiler/src/v3_core.erl
+++ b/lib/compiler/src/v3_core.erl
@@ -1820,7 +1820,21 @@ upattern_list([], _, St) -> {[],[],[],[],St}.
 %% upat_bin([Pat], [KnownVar], State) ->
 %%                        {[Pat],[GuardTest],[NewVar],[UsedVar],State}.
 upat_bin(Es0, Ks, St0) ->
-    upat_bin(Es0, Ks, [], St0).
+    {Es1,Pg,Pv,Pu0,St1} = upat_bin(Es0, Ks, [], St0),
+
+    %% In a clause such as <<Sz:8,V:Sz>> in a function head, Sz will both
+    %% be new and used; a situation that is not handled properly by
+    %% uclause/4.  (Basically, since Sz occurs in two sets that are
+    %% subtracted from each other, Sz will not be added to the list of
+    %% known variables and will seem to be new the next time it is
+    %% used in a match.)
+    %%   Since the variable Sz really is new (it does not use a
+    %% value bound prior to the binary matching), Sz should only be
+    %% included in the set of new variables. Thus we should take it
+    %% out of the set of used variables.
+
+    Pu1 = subtract(Pu0, intersection(Pv, Pu0)),
+    {Es1,Pg,Pv,Pu1,St1}.
 
 %% upat_bin([Pat], [KnownVar], [LocalVar], State) ->
 %%                        {[Pat],[GuardTest],[NewVar],[UsedVar],State}.