Merge branch 'sverk/ets-delete-unfix-race/OTP-11892' into maint

* sverk/ets-delete-unfix-race/OTP-11892:
  Fix race between ETS table deletion and unfixation
  erts: Add etp commands for alloc_util block and carrier inspection

2 files changed, 182 insertions, 30 deletions

diff --git a/erts/emulator/beam/erl_db.c b/erts/emulator/beam/erl_db.c
index a5d67571e2..8f246ffa07 100644
--- a/erts/emulator/beam/erl_db.c
+++ b/erts/emulator/beam/erl_db.c
@@ -259,10 +259,11 @@ static void schedule_free_dbtable(DbTable* tb)
     /*
      * NON-SMP case: Caller is *not* allowed to access the *tb
      *               structure after this function has returned!          
-     * SMP case:     Caller is allowed to access the *tb structure
-     *               until the bif has returned (we typically
-     *               need to unlock the table lock after this
-     *               function has returned).
+     * SMP case:     Caller is allowed to access the *common* part of the *tb
+     *  	     structure until the bif has returned (we typically need to
+     *  	     unlock the table lock after this function has returned).
+     *  	     Caller is *not* allowed to access the specialized part
+     *  	     (hash or tree) of *tb after this function has returned.
      */
     ASSERT(erts_refc_read(&tb->common.ref, 0) == 0);
     erts_schedule_thr_prgr_later_cleanup_op(free_dbtable,
@@ -3279,34 +3280,37 @@ erts_db_process_exiting(Process *c_p, ErtsProcLocks c_p_locks)
 		}
 		erts_smp_rwmtx_runlock(mmtl);
 		if (tb) {
-		    int reds;
-		    DbFixation** pp;
+		    int reds = 0;
 
 		    db_lock(tb, LCK_WRITE_REC);
-		    #ifdef ERTS_SMP
-		    erts_smp_mtx_lock(&tb->common.fixlock);
-		    #endif
-		    reds = 10;
-		    
-		    for (pp = &tb->common.fixations; *pp != NULL;
-			  pp = &(*pp)->next) {
-			if ((*pp)->pid == pid) {
-			    DbFixation* fix = *pp;
-			    erts_aint_t diff = -((erts_aint_t) fix->counter);
-			    erts_refc_add(&tb->common.ref,diff,0);
-			    *pp = fix->next;
-			    erts_db_free(ERTS_ALC_T_DB_FIXATION,
-					 tb, fix, sizeof(DbFixation));
-			    ERTS_ETS_MISC_MEM_ADD(-sizeof(DbFixation));
-			    break;
+		    if (!(tb->common.status & DB_DELETE)) {
+			DbFixation** pp;
+
+			#ifdef ERTS_SMP
+			erts_smp_mtx_lock(&tb->common.fixlock);
+			#endif
+			reds = 10;
+
+			for (pp = &tb->common.fixations; *pp != NULL;
+			      pp = &(*pp)->next) {
+			    if ((*pp)->pid == pid) {
+				DbFixation* fix = *pp;
+				erts_aint_t diff = -((erts_aint_t) fix->counter);
+				erts_refc_add(&tb->common.ref,diff,0);
+				*pp = fix->next;
+				erts_db_free(ERTS_ALC_T_DB_FIXATION,
+					     tb, fix, sizeof(DbFixation));
+				ERTS_ETS_MISC_MEM_ADD(-sizeof(DbFixation));
+				break;
+			    }
+			}
+			#ifdef ERTS_SMP
+			erts_smp_mtx_unlock(&tb->common.fixlock);
+			#endif
+			if (!IS_FIXED(tb) && IS_HASH_TABLE(tb->common.status)) {
+			    db_unfix_table_hash(&(tb->hash));
+			    reds += 40;
 			}
-		    }
-		    #ifdef ERTS_SMP
-		    erts_smp_mtx_unlock(&tb->common.fixlock);
-		    #endif
-		    if (!IS_FIXED(tb) && IS_HASH_TABLE(tb->common.status)) {
-			db_unfix_table_hash(&(tb->hash));
-			reds += 40;
 		    }
 		    db_unlock(tb, LCK_WRITE_REC);
 		    BUMP_REDS(c_p, reds);
diff --git a/erts/etc/unix/etp-commands.in b/erts/etc/unix/etp-commands.in
index 77777196a6..ed90e26024 100644
--- a/erts/etc/unix/etp-commands.in
+++ b/erts/etc/unix/etp-commands.in
@@ -1,7 +1,7 @@
 #
 # %CopyrightBegin%
 # 
-# Copyright Ericsson AB 2005-2012. All Rights Reserved.
+# Copyright Ericsson AB 2005-2014. All Rights Reserved.
 # 
 # The contents of this file are subject to the Erlang Public License,
 # Version 1.1, (the "License"); you may not use this file except in
@@ -3258,6 +3258,154 @@ define etp-thr
 end
 
 ############################################################################
+# erl_alloc_util (blocks and carriers)
+#
+
+define etp-block-size-1
+#
+# In:  (Block_t*) in $arg0
+# Out: Byte size in $etp_blk_sz
+#
+  if ($arg0)->bhdr & 1
+      # Free block
+      set $etp_blk_sz = ($arg0)->bhdr & ~7
+  else
+      # Allocated block
+      if !$etp_MBC_ABLK_SZ_MASK
+        if etp_arch_bits == 64
+          set $etp_MBC_ABLK_OFFSET_SHIFT = (64 - 24)
+        else
+          set $etp_MBC_ABLK_OFFSET_SHIFT = (32 - 9)
+        end
+        set $etp_MBC_ABLK_SZ_MASK = ~(~0 << $etp_MBC_ABLK_OFFSET_SHIFT) & ~7
+      end
+      set $etp_blk_sz = ($arg0)->bhdr & $etp_MBC_ABLK_SZ_MASK
+  end
+end
+
+define etp-block2mbc-1
+#
+# In: (Block_t*) in $arg0
+# Out: (Carrier_t*) in $etp-mbc
+#
+  if (($arg0)->bhdr) & 1
+      # Free block
+      set $etp_mbc = ($arg0)->u.carrier
+  else
+      # Allocated block
+      if !$etp_MBC_ABLK_OFFSET_SHIFT
+        if etp_arch_bits == 64
+          set $etp_MBC_ABLK_OFFSET_SHIFT = (64 - 24)
+        else
+          set $etp_MBC_ABLK_OFFSET_SHIFT = (32 - 9)
+        end
+      end
+      set $etp_mbc = (Carrier_t*) ((((UWord)($arg0)) & (~0 << 18)) - ((($arg0)->bhdr >> $etp_MBC_ABLK_OFFSET_SHIFT) << 18))
+  end
+end
+
+define etp-block2mbc
+  etp-block2mbc-1 ((Block_t*)$arg0)
+  print $etp_mbc
+end
+
+document etp-block2mbc
+%---------------------------------------------------------------------------
+% Print pointer to multiblock carrier containing the argument (Block_t*)
+%---------------------------------------------------------------------------
+end
+
+define etp-block
+  etp-block-size-1 ((Block_t*)$arg0)
+  if ((Block_t*)$arg0)->bhdr & 1
+     printf "%#lx: FREE sz=%#x\n", ($arg0), $etp_blk_sz
+  else
+     printf "%#lx: ALLOCATED sz=%#x\n", ($arg0), $etp_blk_sz
+  end
+end
+
+document etp-block
+%---------------------------------------------------------------------------
+% Print memory block (Block_t*)
+%---------------------------------------------------------------------------
+end
+
+define etp-carrier-blocks
+  set $etp_crr = (Carrier_t*) $arg0
+  set $etp_alc = (Allctr_t*)($etp_crr->allctr.counter & ~7)
+  set $etp_blk = (Block_t*) ((char*)$etp_crr + $etp_alc->mbc_header_size)
+  set $etp_prev_blk = 0
+  set $etp_error_cnt = 0
+  set $etp_ablk_cnt = 0
+  set $etp_fblk_cnt = 0
+
+  if $argc == 2
+    set $etp_be_silent = $arg1
+  else
+    set $etp_be_silent = 0
+  end
+
+  while 1
+    if !$etp_be_silent
+      etp-block $etp_blk
+    else
+      etp-block-size-1 $etp_blk
+    end
+    etp-block2mbc-1 $etp_blk
+    if $etp_mbc != $etp_crr
+      printf "ERROR: Invalid carrier pointer %#lx in block at %#lx\n", $etp_mbc, $etp_blk
+      set $etp_error_cnt = $etp_error_cnt + 1
+    end
+    if $etp_prev_blk
+      if ($etp_prev_blk->bhdr & 1)
+        # Prev is FREE
+        if ($etp_blk->bhdr & 1)
+          printf "ERROR: Adjacent FREE blocks at %#lx and %#lx\n", $etp_prev_blk, $etp_blk
+	  set $etp_error_cnt = $etp_error_cnt + 1
+        end
+        if !($etp_blk->bhdr & 2)
+          printf "ERROR: Missing PREV_FREE_BLK_HDR_FLG (2) in block at %#lx\n", $etp_blk
+	  set $etp_error_cnt = $etp_error_cnt + 1
+        end
+      end
+    end
+    if $etp_blk->bhdr & 1
+      set $etp_fblk_cnt = $etp_fblk_cnt + 1
+    else
+      set $etp_ablk_cnt = $etp_ablk_cnt + 1
+    end
+    if $etp_blk->bhdr & 4
+      # Last block
+      loop_break
+    end
+    # All free blocks except the last have a footer
+    if ($etp_blk->bhdr & 1) && ((UWord*)((char*)$etp_blk + $etp_blk_sz))[-1] != $etp_blk_sz
+      printf "ERROR: Invalid footer of free block at %#lx\n", $etp_blk
+    end
+    set $etp_prev_blk = $etp_blk
+    set $etp_blk = (Block_t*) ((char*)$etp_blk + $etp_blk_sz)
+  end
+
+  if ((char*)$etp_blk + $etp_blk_sz) != ((char*)$etp_crr + ($etp_crr->chdr & ~7))
+    printf "ERROR: Last block not at end of carrier\n"
+    set $etp_error_cnt = $etp_error_cnt + 1
+  end
+  printf "Allocated blocks: %u\n", $etp_ablk_cnt
+  printf "Free      blocks: %u\n", $etp_fblk_cnt
+  if $etp_error_cnt
+    printf "%u ERRORs reported above\n", $etp-error-cnt
+  end
+end
+
+document etp-carrier-blocks
+%---------------------------------------------------------------------------
+% Check and (maybe) print all memory blocks in carrier
+% Args: (Carrier_t*) [1=be_silent]
+%---------------------------------------------------------------------------
+end
+
+
+############################################################################
 # Toolbox parameter handling
 #