beam_validator: Disallow jumps to try_case handlers

By keeping track of the tag types in the exception handler list,
we can reject direct jumps to try_case handlers such as those
provoked by OTP-15945.

2 files changed, 63 insertions, 2 deletions

diff --git a/lib/compiler/test/beam_validator_SUITE.erl b/lib/compiler/test/beam_validator_SUITE.erl
index 685e1a95a7..68b665fbc3 100644
--- a/lib/compiler/test/beam_validator_SUITE.erl
+++ b/lib/compiler/test/beam_validator_SUITE.erl
@@ -35,7 +35,8 @@
 	 map_field_lists/1,cover_bin_opt/1,
 	 val_dsetel/1,bad_tuples/1,bad_try_catch_nesting/1,
          receive_stacked/1,aliased_types/1,type_conflict/1,
-         infer_on_eq/1,infer_dead_value/1,infer_on_ne/1]).
+         infer_on_eq/1,infer_dead_value/1,infer_on_ne/1,
+         branch_to_try_handler/1]).
 
 -include_lib("common_test/include/ct.hrl").
 
@@ -65,7 +66,8 @@ groups() ->
        map_field_lists,cover_bin_opt,val_dsetel,
        bad_tuples,bad_try_catch_nesting,
        receive_stacked,aliased_types,type_conflict,
-       infer_on_eq,infer_dead_value,infer_on_ne]}].
+       infer_on_eq,infer_dead_value,infer_on_ne,
+       branch_to_try_handler]}].
 
 init_per_suite(Config) ->
     test_lib:recompile(?MODULE),
@@ -741,6 +743,17 @@ idv_2(State) ->
 
 idv_called_once(_State) -> ok.
 
+%% Direct jumps to try/catch handlers crash the emulator and must fail
+%% validation. This is provoked by OTP-15945.
+
+branch_to_try_handler(Config) ->
+    Errors = do_val(branch_to_try_handler, Config),
+    [{{branch_to_try_handler,main,1},
+      {{bif,tuple_size,{f,3},[{y,0}],{x,0}},
+       12,
+       {illegal_branch,try_handler,3}}}] = Errors,
+    ok.
+
 %%%-------------------------------------------------------------------------
 
 transform_remove(Remove, Module) ->
diff --git a/lib/compiler/test/beam_validator_SUITE_data/branch_to_try_handler.S b/lib/compiler/test/beam_validator_SUITE_data/branch_to_try_handler.S
new file mode 100644
index 0000000000..6d43ec7b54
--- /dev/null
+++ b/lib/compiler/test/beam_validator_SUITE_data/branch_to_try_handler.S
@@ -0,0 +1,48 @@
+{module, branch_to_try_handler}.  %% version = 0
+
+{exports, [{main,1}]}.
+
+{attributes, []}.
+
+{labels, 11}.
+
+{function, main, 1, 2}.
+  {label,1}.
+    {line,[{location,"t.erl",4}]}.
+    {func_info,{atom,branch_to_try_handler},{atom,main},1}.
+  {label,2}.
+    {allocate,2,1}.
+    {move,{x,0},{y,0}}.
+    {'try',{y,1},{f,3}}.
+    {move,{atom,ignored},{x,0}}.
+    {line,[{location,"t.erl",6}]}.
+    {call,1,{f,6}}.
+    {'%',{type_info,{x,0},{t_atom,[ignored]}}}.
+    {line,[{location,"t.erl",7}]}.
+    %%
+    %% Fail directly to the try handler instead of throwing an exception; this
+    %% will crash the emulator.
+    %%
+    {bif,tuple_size,{f,3},[{y,0}],{x,0}}.
+    %%
+    {test,is_eq_exact,{f,4},[{x,0},{integer,1}]}.
+    {move,{atom,error},{x,0}}.
+    {try_end,{y,1}}.
+    {deallocate,2}.
+    return.
+  {label,3}.
+    {try_case,{y,1}}.
+    {move,{atom,ok},{x,0}}.
+    {deallocate,2}.
+    return.
+  {label,4}.
+    {line,[{location,"t.erl",7}]}.
+    {badmatch,{x,0}}.
+
+{function, id, 1, 6}.
+  {label,5}.
+    {line,[{location,"t.erl",13}]}.
+    {func_info,{atom,branch_to_try_handler},{atom,id},1}.
+  {label,6}.
+    {'%',{type_info,{x,0},{t_atom,[ignored]}}}.
+    return.