Merge branch 'bjorn/compiler/applying-binary-crash/OTP-11672'

* bjorn/compiler/applying-binary-crash/OTP-11672:
  beam_bsm: Eliminate emulator crash when a binary is called
  beam_validator: Validate the "fun" argument for a call_fun/1 instruction

3 files changed, 15 insertions, 2 deletions

diff --git a/lib/compiler/src/beam_bsm.erl b/lib/compiler/src/beam_bsm.erl
index fdfcb08125..d54c2a9fde 100644
--- a/lib/compiler/src/beam_bsm.erl
+++ b/lib/compiler/src/beam_bsm.erl
@@ -209,6 +209,7 @@ btb_reaches_match_2([{call,Arity,{f,Lbl}}|Is], Regs, D) ->
 btb_reaches_match_2([{apply,Arity}|Is], Regs, D) ->
     btb_call(Arity+2, apply, Regs, Is, D);
 btb_reaches_match_2([{call_fun,Live}=I|Is], Regs, D) ->
+    btb_ensure_not_used([{x,Live}], I, Regs),
     btb_call(Live, I, Regs, Is, D);
 btb_reaches_match_2([{make_fun2,_,_,_,Live}|Is], Regs, D) ->
     btb_call(Live, make_fun2, Regs, Is, D);
diff --git a/lib/compiler/src/beam_validator.erl b/lib/compiler/src/beam_validator.erl
index 97f84da08f..682f7adbc2 100644
--- a/lib/compiler/src/beam_validator.erl
+++ b/lib/compiler/src/beam_validator.erl
@@ -574,6 +574,7 @@ valfun_4({apply,Live}, Vst) ->
 valfun_4({apply_last,Live,_}, Vst) ->
     tail_call(apply, Live+2, Vst);
 valfun_4({call_fun,Live}, Vst) ->
+    validate_src([{x,Live}], Vst),
     call('fun', Live+1, Vst);
 valfun_4({call,Live,Func}, Vst) ->
     call(Func, Live, Vst);
diff --git a/lib/compiler/test/bs_match_SUITE.erl b/lib/compiler/test/bs_match_SUITE.erl
index 9f15845d33..149b9bbb8f 100644
--- a/lib/compiler/test/bs_match_SUITE.erl
+++ b/lib/compiler/test/bs_match_SUITE.erl
@@ -34,7 +34,7 @@
 	 otp_7188/1,otp_7233/1,otp_7240/1,otp_7498/1,
 	 match_string/1,zero_width/1,bad_size/1,haystack/1,
 	 cover_beam_bool/1,matched_out_size/1,follow_fail_branch/1,
-	 no_partition/1]).
+	 no_partition/1,calling_a_binary/1]).
 
 -export([coverage_id/1,coverage_external_ignore/2]).
 
@@ -59,7 +59,7 @@ groups() ->
        matching_and_andalso,otp_7188,otp_7233,otp_7240,
        otp_7498,match_string,zero_width,bad_size,haystack,
        cover_beam_bool,matched_out_size,follow_fail_branch,
-       no_partition]}].
+       no_partition,calling_a_binary]}].
 
 
 init_per_suite(Config) ->
@@ -1178,6 +1178,17 @@ no_partition_2([], a5) ->
 no_partition_2(42.0, a6) ->
     six.
 
+calling_a_binary(Config) when is_list(Config) ->
+    [] = call_binary(<<>>, []),
+    {'EXIT',{badarg,_}} = (catch call_binary(<<1>>, [])),
+    {'EXIT',{badarg,_}} = (catch call_binary(<<1,2,3>>, [])),
+    ok.
+
+call_binary(<<>>, Acc) ->
+    Acc;
+call_binary(<<H,T/bits>>, Acc) ->
+    T(<<Acc/binary,H>>).
+
 check(F, R) ->
     R = F().