Merge branch 'maint-20' into maint

* maint-20:
  Updated OTP version
  Prepare release
  inets: Gracefully handle bad headers
  [erl_docgen] Update version
  [erl_docgen] Add missing file db_funcs.xsl to file list
  erts: Fix bug in system_profile
  erts: Fix bug in enif_binary_to_term for immediates

7 files changed, 106 insertions, 54 deletions

diff --git a/erts/doc/src/notes.xml b/erts/doc/src/notes.xml
index 8bd8e6c7b8..31411cc1a2 100644
--- a/erts/doc/src/notes.xml
+++ b/erts/doc/src/notes.xml
@@ -31,6 +31,31 @@
   </header>
   <p>This document describes the changes made to the ERTS application.</p>
 
+<section><title>Erts 9.3.2</title>
+
+    <section><title>Fixed Bugs and Malfunctions</title>
+      <list>
+        <item>
+          <p>
+	    Fixed bug in <c>enif_binary_to_term</c> which could cause
+	    memory corruption for immediate terms (atoms, small
+	    integers, pids, ports, empty lists).</p>
+          <p>
+	    Own Id: OTP-15080</p>
+        </item>
+        <item>
+          <p>
+	    Fixed bug in <c>erlang:system_profile/2</c> that could
+	    cause superfluous <c>{profile,_,active,_,_}</c> messages
+	    for terminating processes.</p>
+          <p>
+	    Own Id: OTP-15085</p>
+        </item>
+      </list>
+    </section>
+
+</section>
+
 <section><title>Erts 9.3.1</title>
 
     <section><title>Fixed Bugs and Malfunctions</title>
diff --git a/erts/emulator/beam/erl_nif.c b/erts/emulator/beam/erl_nif.c
index b96db5d054..4e479c26ef 100644
--- a/erts/emulator/beam/erl_nif.c
+++ b/erts/emulator/beam/erl_nif.c
@@ -1251,8 +1251,10 @@ size_t enif_binary_to_term(ErlNifEnv *dst_env,
     if (is_non_value(*term)) {
         return 0;
     }
-    erts_factory_close(&factory);
-    cache_env(dst_env);
+    if (size > 0) {
+        erts_factory_close(&factory);
+        cache_env(dst_env);
+    }
 
     ASSERT(bp > data);
     return bp - data;
diff --git a/erts/emulator/beam/erl_process.c b/erts/emulator/beam/erl_process.c
index 9b22f024b0..9f6adb03d0 100644
--- a/erts/emulator/beam/erl_process.c
+++ b/erts/emulator/beam/erl_process.c
@@ -7117,13 +7117,13 @@ change_proc_schedule_state(Process *p,
 
 	if (((n & (ERTS_PSFLG_SUSPENDED
 		   | ERTS_PSFLG_ACTIVE)) == ERTS_PSFLG_ACTIVE)
-	    && (!(a & (ERTS_PSFLG_ACTIVE_SYS
-		       | ERTS_PSFLG_RUNNING
-		       | ERTS_PSFLG_RUNNING_SYS
-		       | ERTS_PSFLG_DIRTY_RUNNING
-		       | ERTS_PSFLG_DIRTY_RUNNING_SYS)
-		  && (!(a & ERTS_PSFLG_ACTIVE)
-		      || (a & ERTS_PSFLG_SUSPENDED))))) {
+            & ((a & (ERTS_PSFLG_SUSPENDED
+                     | ERTS_PSFLG_ACTIVE)) != ERTS_PSFLG_ACTIVE)
+	    & !(a & (ERTS_PSFLG_ACTIVE_SYS
+                     | ERTS_PSFLG_RUNNING
+                     | ERTS_PSFLG_RUNNING_SYS
+                     | ERTS_PSFLG_DIRTY_RUNNING
+                     | ERTS_PSFLG_DIRTY_RUNNING_SYS))) {
 	    /* We activated a prevously inactive process */
 	    profile_runnable_proc(p, am_active);
 	}
diff --git a/erts/emulator/test/nif_SUITE.erl b/erts/emulator/test/nif_SUITE.erl
index ac2b136a38..4237715c4b 100644
--- a/erts/emulator/test/nif_SUITE.erl
+++ b/erts/emulator/test/nif_SUITE.erl
@@ -2594,16 +2594,23 @@ nif_term_to_binary(Config) ->
 
 nif_binary_to_term(Config) ->
     ensure_lib_loaded(Config),
-    T = {#{ok => nok}, <<0:8096>>, lists:seq(1,100)},
+    BigMap = maps:from_list([{I,-I} || I <- lists:seq(1,100)]),
+    [nif_binary_to_term_do(T)
+     || T <- [{#{ok => nok}, <<0:8096>>, lists:seq(1,100)},
+              atom, 42, self(), BigMap]],
+    ok.
+
+nif_binary_to_term_do(T) ->
+    Dummy = [true|false],
     Bin = term_to_binary(T),
     Len = byte_size(Bin),
-    {Len,T} = binary_to_term_nif(Bin, undefined, 0),
+    {Len,T,Dummy} = binary_to_term_nif(Bin, undefined, 0),
     Len = binary_to_term_nif(Bin, self(), 0),
-    T = receive M -> M after 1000 -> timeout end,
+    {T,Dummy} = receive M -> M after 1000 -> timeout end,
 
-    {Len, T} = binary_to_term_nif(Bin, undefined, ?ERL_NIF_BIN2TERM_SAFE),
+    {Len,T,Dummy} = binary_to_term_nif(Bin, undefined, ?ERL_NIF_BIN2TERM_SAFE),
     false = binary_to_term_nif(<<131,100,0,14,"undefined_atom">>,
-			   undefined, ?ERL_NIF_BIN2TERM_SAFE),
+                               undefined, ?ERL_NIF_BIN2TERM_SAFE),
     false = binary_to_term_nif(Bin, undefined, 1),
     ok.
 
diff --git a/erts/emulator/test/nif_SUITE_data/nif_SUITE.c b/erts/emulator/test/nif_SUITE_data/nif_SUITE.c
index b47d013bd2..87cd3650ff 100644
--- a/erts/emulator/test/nif_SUITE_data/nif_SUITE.c
+++ b/erts/emulator/test/nif_SUITE_data/nif_SUITE.c
@@ -2384,7 +2384,7 @@ static ERL_NIF_TERM term_to_binary(ErlNifEnv* env, int argc, const ERL_NIF_TERM
 static ERL_NIF_TERM binary_to_term(ErlNifEnv* env, int argc, const ERL_NIF_TERM argv[])
 {
     ErlNifBinary bin;
-    ERL_NIF_TERM term, ret_term;
+    ERL_NIF_TERM term, dummy, ret_term;
     ErlNifPid pid;
     ErlNifEnv *msg_env = env;
     unsigned int opts;
@@ -2397,6 +2397,9 @@ static ERL_NIF_TERM binary_to_term(ErlNifEnv* env, int argc, const ERL_NIF_TERM
 	|| !enif_get_uint(env, argv[2], &opts))
         return enif_make_badarg(env);
 
+    /* build dummy heap term first to provoke OTP-15080 */
+    dummy = enif_make_list_cell(msg_env, atom_true, atom_false);
+
     ret = enif_binary_to_term(msg_env, bin.data, bin.size, &term,
 			      (ErlNifBinaryToTerm)opts);
     if (!ret)
@@ -2404,11 +2407,12 @@ static ERL_NIF_TERM binary_to_term(ErlNifEnv* env, int argc, const ERL_NIF_TERM
 
     ret_term = enif_make_uint64(env, ret);
     if (msg_env != env) {
-        enif_send(env, &pid, msg_env, term);
+        enif_send(env, &pid, msg_env,
+                  enif_make_tuple2(msg_env, term, dummy));
         enif_free_env(msg_env);
         return ret_term;
     } else {
-        return enif_make_tuple2(env, ret_term, term);
+        return enif_make_tuple3(env, ret_term, term, dummy);
     }
 }
 
diff --git a/erts/emulator/test/system_profile_SUITE.erl b/erts/emulator/test/system_profile_SUITE.erl
index 9b678fcff9..00237c329c 100644
--- a/erts/emulator/test/system_profile_SUITE.erl
+++ b/erts/emulator/test/system_profile_SUITE.erl
@@ -95,18 +95,20 @@ do_runnable_procs({TsType, TsTypeFlag}) ->
     % FIXME: Set #laps and #nodes in config file
     Nodes = 10,
     Laps = 10,
-    Master = ring(Nodes),
+    All = ring(Nodes, [link,monitor]),
+    [Master | _] = All,
     undefined = erlang:system_profile(Pid, [runnable_procs]++TsTypeFlag),
     % loop a message
     ok = ring_message(Master, message, Laps),
+    ok = kill_ring(Master),
+    [receive {'DOWN', _, process, P, _} -> ok end || P <- All],
     Events = get_profiler_events(),
-    kill_em_all = kill_ring(Master),
     erlang:system_profile(undefined, []),
     put(master, Master),
     put(laps, Laps),
     true = has_runnable_event(TsType, Events),
     Pids = sort_events_by_pid(Events),
-    ok = check_events(TsType, Pids),
+    ok = check_events(TsType, Pids, (Laps+1)*2+2, (Laps+1)*2),
     erase(),
     exit(Pid,kill),
     ok.
@@ -139,7 +141,7 @@ do_runnable_ports({TsType, TsTypeFlag}, Config) ->
     erlang:system_profile(undefined, []),
     true = has_runnable_event(TsType, Events),
     Pids = sort_events_by_pid(Events),
-    ok = check_events(TsType, Pids),
+    ok = check_events(TsType, Pids, Laps*2+2, Laps*2),
     erase(),
     exit(Pid,kill),
     ok.
@@ -172,12 +174,12 @@ dont_profile_profiler(Config) when is_list(Config) ->
 
     Nodes = 10,
     Laps = 10,
-    Master = ring(Nodes),
+    [Master|_] = ring(Nodes, [link]),
     undefined = erlang:system_profile(Pid, [runnable_procs]),
     % loop a message
     ok = ring_message(Master, message, Laps),
     erlang:system_profile(undefined, []),
-    kill_em_all = kill_ring(Master),
+    ok = kill_ring(Master),
     Events = get_profiler_events(),
     false  = has_profiler_pid_event(Events, Pid),
 
@@ -249,27 +251,28 @@ check_block_system({TsType, TsTypeFlag}, Nodes) ->
 
 %%% Check events
 
-check_events(_TsType, []) -> ok;
-check_events(TsType, [Pid | Pids]) ->
+check_events(_TsType, [], _, _) -> ok;
+check_events(TsType, [Pid | Pids], ExpMaster, ExpMember) ->
     Master = get(master),
-    Laps = get(laps),
     CheckPids = get(pids),
     {Events, N} = get_pid_events(Pid),
     ok = check_event_flow(Events),
     ok = check_event_ts(TsType, Events),
     IsMember = lists:member(Pid, CheckPids),
-    case Pid of
-    	Master ->
-	    io:format("Expected ~p and got ~p profile events from ~p: ok~n", [Laps*2+2, N, Pid]),
-	    N = Laps*2 + 2,
-    	    check_events(TsType, Pids);
-	Pid when IsMember == true ->
-	    io:format("Expected ~p and got ~p profile events from ~p: ok~n", [Laps*2, N, Pid]),
-	    N = Laps*2,
-    	    check_events(TsType, Pids);
-	Pid ->
-	    check_events(TsType, Pids)
-    end.
+    {Title,Exp} = case Pid of
+                      Master -> {master,ExpMaster};
+                      Pid when IsMember == true -> {member,ExpMember};
+                      _ -> {other,N}
+                  end,
+    ok = case N of
+             Exp -> ok;
+             _ ->
+                 io:format("Expected ~p and got ~p profile events from ~p ~p:~n~p~n",
+                           [Exp, N, Title, Pid, Events]),
+                 error
+         end,
+    check_events(TsType, Pids, ExpMaster, ExpMember).
+
 
 %% timestamp consistency check for descending timestamps
 
@@ -297,7 +300,13 @@ check_event_ts(TsType, [{Pid, _, _, TS1}=Event | Events], {Pid,_,_,TS0}) ->
 %% consistency check for active vs. inactive activity (runnable)
 
 check_event_flow(Events) ->
-    check_event_flow(Events, undefined).
+    case check_event_flow(Events, undefined) of
+        ok -> ok;
+        Error ->
+            io:format("Events = ~p\n", [Events]),
+            Error
+    end.
+
 check_event_flow([], _) -> ok;
 check_event_flow([Event | PidEvents], undefined) ->
     check_event_flow(PidEvents, Event);
@@ -337,10 +346,11 @@ sort_events_by_pid([Event | Events],Pids) ->
 %% API
 
 % Returns master pid
-ring(N) -> 
-    Pids = build_ring(N, []),
+ring(N, SpawnOpt) -> 
+    Pids = build_ring(N, [], SpawnOpt),
     put(pids, Pids),
-    setup_ring(Pids).
+    setup_ring(Pids),
+    Pids.
 
 ring_message(Master, Message, Laps) ->
     Master ! {message, Master, Laps, Message},
@@ -348,13 +358,19 @@ ring_message(Master, Message, Laps) ->
     	{laps_complete, Master} -> ok
     end.
 
-kill_ring(Master) -> Master ! kill_em_all.
+kill_ring(Master) ->
+    Master ! kill_em_all,
+    ok.
 
 %% Process ring helpers
 
-build_ring(0, Pids) -> Pids;
-build_ring(N, Pids) ->
-    build_ring(N - 1, [spawn_link(?MODULE, ring_loop, [undefined]) | Pids]).
+build_ring(0, Pids, _) -> Pids;
+build_ring(N, Pids, SpawnOpt) ->
+    Pid = case spawn_opt(?MODULE, ring_loop, [undefined], SpawnOpt) of
+              {P,_} -> P;
+              P -> P
+          end,
+    build_ring(N-1, [Pid | Pids], SpawnOpt).
 
 setup_ring([Master | Relayers]) ->
     % Relayers may not include the master pid
@@ -383,15 +399,13 @@ ring_loop(RelayTo) ->
         {message, Master, Lap, Msg}=Message ->
             case {self(), Lap} of
                 {Master, 0} ->
-                    get(supervisor) ! {laps_complete, self()},
-                    ring_loop(RelayTo);
+                    get(supervisor) ! {laps_complete, self()};
                 {Master, Lap} ->
-                    RelayTo ! {message, Master, Lap - 1, Msg},
-                    ring_loop(RelayTo);
+                    RelayTo ! {message, Master, Lap - 1, Msg};
                 _ ->
-                    RelayTo ! Message,
-                    ring_loop(RelayTo)
-            end
+                    RelayTo ! Message
+            end,
+            ring_loop(RelayTo)
     end.
 
 %%%
diff --git a/erts/vsn.mk b/erts/vsn.mk
index 25acd9cc34..687c62343e 100644
--- a/erts/vsn.mk
+++ b/erts/vsn.mk
@@ -18,7 +18,7 @@
 # %CopyrightEnd%
 # 
 
-VSN = 9.3.1
+VSN = 9.3.2
 
 # Port number 4365 in 4.2
 # Port number 4366 in 4.3