erts: Fix bug in heap_factory_undo for FACTORY_HEAP_FRAGS mode

Make sure a heap fragment is not deallocated before all off_heap
terms have been cleared.

The fix assumes/asserts that the off_heap-lists of all additional
heap fragments are empty.

I think this bug has been harmless as hashmap nodes, which is only
ones (?) that can cause a factory to produce more heap,
are not linked in off_heap-list.

1 files changed, 5 insertions, 2 deletions

diff --git a/erts/emulator/beam/erl_message.c b/erts/emulator/beam/erl_message.c
index ef52823287..2a703fb102 100644
--- a/erts/emulator/beam/erl_message.c
+++ b/erts/emulator/beam/erl_message.c
@@ -1372,13 +1372,16 @@ void erts_factory_undo(ErtsHeapFactory* factory)
         break;
 
     case FACTORY_HEAP_FRAGS:
+	erts_cleanup_offheap(factory->off_heap);
+	factory->off_heap->first = NULL;
+
         bp = factory->heap_frags;
         do {
             ErlHeapFragment* next_bp = bp->next;
 
-            erts_cleanup_offheap(&bp->off_heap);
+            ASSERT(bp->off_heap.first == NULL);
             ERTS_HEAP_FREE(factory->alloc_type, (void *) bp,
-                           ERTS_HEAP_FRAG_SIZE(bp->size));
+                           ERTS_HEAP_FRAG_SIZE(bp->alloc_size));
             bp = next_bp;
         }while (bp != NULL);
 	break;