From b1b27719d713c0e62d3242bbf1da0600ea0a651f Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Bj=C3=B6rn=20Gustavsson?= <bjorn@erlang.org>
Date: Mon, 23 May 2016 20:13:48 +0200
Subject: Eliminate unsafe use of Y registers

If the Core Erlang optimization were turned off (using no_copt),
the optimization passes for Beam assembly could generate unsafe
code that did not initialize all Y registers before (for example)
a call instruction.

To fix this, beam_dead should not attempt to remove stores to Y
registers. That is not safe if there is an exception-generating
instruction inside a try...catch block.
---
 lib/compiler/src/beam_dead.erl         | 18 ++++++++++++--
 lib/compiler/test/beam_utils_SUITE.erl | 45 ++++++++++++++++++++++++++++++++--
 2 files changed, 59 insertions(+), 4 deletions(-)

diff --git a/lib/compiler/src/beam_dead.erl b/lib/compiler/src/beam_dead.erl
index dd42add433..b01f58f683 100644
--- a/lib/compiler/src/beam_dead.erl
+++ b/lib/compiler/src/beam_dead.erl
@@ -262,7 +262,7 @@ backward([{select,select_val,Reg,{f,Fail0},List0}|Is], D, Acc) ->
 backward([{jump,{f,To0}},{move,Src,Reg}=Move|Is], D, Acc) ->
     To = shortcut_select_label(To0, Reg, Src, D),
     Jump = {jump,{f,To}},
-    case beam_utils:is_killed_at(Reg, To, D) of
+    case is_killed_at(Reg, To, D) of
 	false -> backward([Move|Is], D, [Jump|Acc]);
 	true -> backward([Jump|Is], D, Acc)
     end;
@@ -420,7 +420,7 @@ comp_op_find_shortcut(To0, Reg, Val, D) ->
 	To0 ->
 	    not_possible();
 	To ->
-	    case beam_utils:is_killed_at(Reg, To, D) of
+	    case is_killed_at(Reg, To, D) of
 		false -> not_possible();
 		true -> To
 	    end
@@ -863,3 +863,17 @@ get_literal(nil) ->
 get_literal({literal,_}=Lit) ->
     Lit;
 get_literal({_,_}) -> error.
+
+
+%%%
+%%% Removing stores to Y registers is not always safe
+%%% if there is an instruction that causes an exception
+%%% within a catch. In practice, there are few or no
+%%% opportunities for removing stores to Y registers anyway
+%%% if sys_core_fold has been run.
+%%%
+
+is_killed_at({x,_}=Reg, Lbl, D) ->
+    beam_utils:is_killed_at(Reg, Lbl, D);
+is_killed_at({y,_}, _, _) ->
+    false.
diff --git a/lib/compiler/test/beam_utils_SUITE.erl b/lib/compiler/test/beam_utils_SUITE.erl
index ae813d563b..f6d4a311bb 100644
--- a/lib/compiler/test/beam_utils_SUITE.erl
+++ b/lib/compiler/test/beam_utils_SUITE.erl
@@ -23,7 +23,8 @@
 	 init_per_group/2,end_per_group/2,
 	 apply_fun/1,apply_mf/1,bs_init/1,bs_save/1,
 	 is_not_killed/1,is_not_used_at/1,
-	 select/1,y_catch/1,otp_8949_b/1,liveopt/1,coverage/1]).
+	 select/1,y_catch/1,otp_8949_b/1,liveopt/1,coverage/1,
+	 y_registers/1]).
 -export([id/1]).
 
 suite() -> [{ct_hooks,[ts_install_cth]}].
@@ -44,7 +45,8 @@ groups() ->
        y_catch,
        otp_8949_b,
        liveopt,
-       coverage
+       coverage,
+       y_registers
       ]}].
 
 init_per_suite(Config) ->
@@ -311,6 +313,45 @@ clinic(Damage) ->
     end,
     carefully.
 
+y_registers(_Config) ->
+    {'EXIT',{{badfun,0},_}} = (catch economic(0.0, jim)),
+    {'EXIT',{{badmatch,apartments},_}} = (catch louisiana()),
+    {a,b} = (boxes(true))({a,b}),
+    {'EXIT',{{case_clause,webmaster},_}} = (catch yellow(true)),
+    ok.
+
+economic(0.0 = Serves, Existence) ->
+    case Serves of
+	Serves -> 0
+    end,
+    Existence = jim,
+    0(),
+    Serves,
+    Existence.
+
+louisiana() ->
+    {catch necessarily,
+     try
+	 [] == reg,
+	 true = apartments
+     catch [] -> barbara
+     end}.
+
+boxes(Call) ->
+    case Call of
+	Call -> approval
+    end,
+    Call,
+    fun id/1.
+
+yellow(Hill) ->
+    case webmaster of
+	station -> eyes; Hill ->
+	    "under"
+    end,
+    Hill,
+    id(42).
+
 
 %% The identity function.
 id(I) -> I.
-- 
cgit v1.2.3