Fix message queue update on replacement and removal of message

3 files changed, 39 insertions, 20 deletions

diff --git a/erts/emulator/beam/erl_gc.c b/erts/emulator/beam/erl_gc.c
index 374da9407c..c7bbbd5ca0 100644
--- a/erts/emulator/beam/erl_gc.c
+++ b/erts/emulator/beam/erl_gc.c
@@ -2293,18 +2293,13 @@ move_msgq_to_heap(Process *p)
 		    free_message_buffer(bp);
 		}
 		else {
-		    ErtsMessage *tmp = erts_alloc_message(0, NULL);
-		    sys_memcpy((void *) tmp->m, (void *) mp->m,
-			       sizeof(Eterm)*ERL_MESSAGE_REF_ARRAY_SZ); 
-		    tmp->next = mp->next;
-		    if (p->msg.save == &mp->next)
-			p->msg.save = &tmp->next;
-		    if (p->msg.last == &mp->next)
-			p->msg.last = &tmp->next;
-		    *mpp = tmp;
+		    ErtsMessage *new_mp = erts_alloc_message(0, NULL);
+		    sys_memcpy((void *) new_mp->m, (void *) mp->m,
+			       sizeof(Eterm)*ERL_MESSAGE_REF_ARRAY_SZ);
+		    erts_msgq_replace_msg_ref(&p->msg, new_mp, mpp);
 		    mp->next = NULL;
 		    erts_cleanup_messages(mp);
-		    mp = tmp;
+		    mp = new_mp;
 		}
 	    }
 
diff --git a/erts/emulator/beam/erl_message.c b/erts/emulator/beam/erl_message.c
index 579f6e427d..b761522d91 100644
--- a/erts/emulator/beam/erl_message.c
+++ b/erts/emulator/beam/erl_message.c
@@ -1371,10 +1371,10 @@ erts_prep_msgq_for_inspection(Process *c_p, Process *rp,
 
 		mpp = i == 0 ? &rp->msg.first : &mip[i-1].msgp->next;
 
-		if (rp->msg.save == &bad_mp->next)
-		    rp->msg.save = mpp;
-		if (rp->msg.last == &bad_mp->next)
-		    rp->msg.last = mpp;
+		ASSERT((*mpp)->next == bad_mp);
+
+		erts_msgq_update_internal_pointers(&rp->msg, mpp, &bad_mp->next);
+
 		mp = mp->next;
 		*mpp = mp;
 		rp->msg.len--;
@@ -1411,12 +1411,7 @@ erts_prep_msgq_for_inspection(Process *c_p, Process *rp,
 		    sys_memcpy((void *) tmp->m, (void *) mp->m,
 			       sizeof(Eterm)*ERL_MESSAGE_REF_ARRAY_SZ); 
 		    mpp = i == 0 ? &rp->msg.first : &mip[i-1].msgp->next;
-		    tmp->next = mp->next;
-		    if (rp->msg.save == &mp->next)
-			rp->msg.save = &tmp->next;
-		    if (rp->msg.last == &mp->next)
-			rp->msg.last = &tmp->next;
-		    *mpp = tmp;
+		    erts_msgq_replace_msg_ref(&rp->msg, tmp, mpp);
 		    erts_save_message_in_proc(rp, mp);
 		    mp = tmp;
 		}
diff --git a/erts/emulator/beam/erl_message.h b/erts/emulator/beam/erl_message.h
index 46063ea0c2..6df969367b 100644
--- a/erts/emulator/beam/erl_message.h
+++ b/erts/emulator/beam/erl_message.h
@@ -366,6 +366,12 @@ ERTS_GLB_FORCE_INLINE ErtsMessage *erts_shrink_message(ErtsMessage *mp, Uint sz,
 ERTS_GLB_FORCE_INLINE void erts_free_message(ErtsMessage *mp);
 ERTS_GLB_INLINE Uint erts_used_frag_sz(const ErlHeapFragment*);
 ERTS_GLB_INLINE Uint erts_msg_attached_data_size(ErtsMessage *msg);
+ERTS_GLB_INLINE void erts_msgq_update_internal_pointers(ErlMessageQueue *msgq,
+							ErtsMessage **newpp,
+							ErtsMessage **oldpp);
+ERTS_GLB_INLINE void erts_msgq_replace_msg_ref(ErlMessageQueue *msgq,
+					       ErtsMessage *newp,
+					       ErtsMessage **oldpp);
 
 #define ERTS_MSG_COMBINED_HFRAG ((void *) 0x1)
 
@@ -468,6 +474,29 @@ ERTS_GLB_INLINE Uint erts_msg_attached_data_size(ErtsMessage *msg)
 	return sz;
     }
 }
+
+ERTS_GLB_INLINE void
+erts_msgq_update_internal_pointers(ErlMessageQueue *msgq,
+				   ErtsMessage **newpp,
+				   ErtsMessage **oldpp)
+{
+    if (msgq->save == oldpp)
+	msgq->save = newpp;
+    if (msgq->last == oldpp)
+	msgq->last = newpp;
+    if (msgq->saved_last == oldpp)
+	msgq->saved_last = newpp;
+}
+
+ERTS_GLB_INLINE void
+erts_msgq_replace_msg_ref(ErlMessageQueue *msgq, ErtsMessage *newp, ErtsMessage **oldpp)
+{
+    ErtsMessage *oldp = *oldpp;
+    newp->next = oldp->next;
+    erts_msgq_update_internal_pointers(msgq, &newp->next, &oldp->next);
+    *oldpp = newp;
+}
+
 #endif
 
 #endif