Fix purge of code

Ensure that we cannot get any dangling pointers into code that
has been purged. This is done by a two phase purge. At first
phase all fun entries pointing into the code to purge are marked
for purge. All processes trying to call these funs will be suspended
and by this we avoid getting new direct references into the code.
When all processes has been checked, these processes are resumed.

The new purge strategy now also completely ignore the existence of
indirect references to the code (funs). If such exist, they will
cause bad fun exceptions to the caller, but will not prevent a
soft purge or cause a kill of a process having such live references
during a hard purge. This since it is impossible to give any
guarantees that no processes in the system have such indirect
references. Even when the system is completely clean from such
references, new ones can appear via distribution and/or disk.

4 files changed, 33 insertions, 39 deletions

diff --git a/lib/kernel/doc/src/code.xml b/lib/kernel/doc/src/code.xml
index d3611d6a03..21f8a2d54a 100644
--- a/lib/kernel/doc/src/code.xml
+++ b/lib/kernel/doc/src/code.xml
@@ -651,6 +651,11 @@ ok = code:finish_loading(Prepared),
         <p>Purges the code for <c><anno>Module</anno></c>, that is, removes code
           marked as old. If some processes still linger in the old code,
           these processes are killed before the code is removed.</p>
+	<note><p>As of ERTS version 9.0, a process is only considered
+	to be lingering in the code if it has direct references to the code.
+	For more information see documentation of
+	<seealso marker="erts:erlang#check_process_code/3"><c>erlang:check_process_code/3</c></seealso>,
+	which is used in order to determine this.</p></note>
         <p>Returns <c>true</c> if successful and any process is needed to
           be killed, otherwise <c>false</c>.</p>
       </desc>
@@ -661,6 +666,11 @@ ok = code:finish_loading(Prepared),
       <desc>
         <p>Purges the code for <c><anno>Module</anno></c>, that is, removes code
           marked as old, but only if no processes linger in it.</p>
+	<note><p>As of ERTS version 9.0, a process is only considered
+	to be lingering in the code if it has direct references to the code.
+	For more information see documentation of
+	<seealso marker="erts:erlang#check_process_code/3"><c>erlang:check_process_code/3</c></seealso>,
+	which is used in order to determine this.</p></note>
         <p>Returns <c>false</c> if the module cannot be purged because
           of processes lingering in old code, otherwise <c>true</c>.</p>
       </desc>
diff --git a/lib/tools/test/cover_SUITE.erl b/lib/tools/test/cover_SUITE.erl
index b4c9264b30..90e113c178 100644
--- a/lib/tools/test/cover_SUITE.erl
+++ b/lib/tools/test/cover_SUITE.erl
@@ -1001,41 +1001,40 @@ otp_6115(Config) when is_list(Config) ->
     %% Cover compile f1, but not f2
     {ok, f1} = cover:compile(f1),
 
+    %% This test used to ensure that a process containing a
+    %% fun refering to cover compiled code was killed.
+    %% check_process_code may however ignore funs as of ERTS
+    %% version 8.1. The test has therefore been rewritten to
+    %% check that a process with a direct reference (in this
+    %% case a return address) to the code is killed.
+    %% 
     %% If f1 is cover compiled, a process P is started with a
-    %% reference to the fun created in start_fail/0, and cover:stop() is
-    %% called, then P should be killed.
-    %% This is because (the fun held by P) references the cover
+    %% direct reference to the f1, and cover:stop() is called,
+    %% then P should be killed.
+    %% This is because of the return address to the cover
     %% compiled code which should be *unloaded* when cover:stop() is
     %% called -- running cover compiled code when there is no cover
     %% server and thus no ets tables to bump counters in, makes no
     %% sense.
-    Pid1 = f1:start_a(),
-    Pid2 = f1:start_b(),
+    Pid = spawn(fun () -> f1:non_tail_call_f2_wait() end),
 
     %% Now stop cover
     cover:stop(),
 
     %% Ensure that f1 is loaded (and not cover compiled), and that
-    %% both Pid1 and Pid2 are dead.
+    %% both Pid is dead.
     case code:which(f1) of
         Beam when is_list(Beam) ->
             ok;
         Other ->
             ct:fail({"f1 is not reloaded", Other})
     end,
-    case process_info(Pid1) of
+    case process_info(Pid) of
         undefined ->
             ok;
-        _PI1 ->
-            RefToOldP1 = erlang:check_process_code(Pid1, f1),
-            ct:fail({"Pid1 still alive", RefToOldP1})
-    end,
-    case process_info(Pid2) of
-        undefined ->
-            ok;
-        _PI2 ->
-            RefToOldP2 = erlang:check_process_code(Pid1, f2),
-            ct:fail({"Pid2 still alive", RefToOldP2})
+        _PI ->
+            RefToOldP = erlang:check_process_code(Pid, f1),
+            ct:fail({"Pid still alive", RefToOldP})
     end,
 
     file:set_cwd(CWD),
diff --git a/lib/tools/test/cover_SUITE_data/otp_6115/f1.erl b/lib/tools/test/cover_SUITE_data/otp_6115/f1.erl
index 5399b33f19..fc4a62e70e 100644
--- a/lib/tools/test/cover_SUITE_data/otp_6115/f1.erl
+++ b/lib/tools/test/cover_SUITE_data/otp_6115/f1.erl
@@ -1,13 +1,6 @@
 -module(f1).
--export([start_a/0, start_b/0]).
+-export([non_tail_call_f2_wait/0]).
 
-start_a() ->
-    f2:start(fun() -> 
-		     ok
-	     end).
-
-start_b() ->
-    f2:start(fun fun1/0).
-
-fun1() ->
-    ok.
+non_tail_call_f2_wait() ->
+    f2:wait(),
+    im_back.
diff --git a/lib/tools/test/cover_SUITE_data/otp_6115/f2.erl b/lib/tools/test/cover_SUITE_data/otp_6115/f2.erl
index 72a6a64c4d..4bc88035c7 100644
--- a/lib/tools/test/cover_SUITE_data/otp_6115/f2.erl
+++ b/lib/tools/test/cover_SUITE_data/otp_6115/f2.erl
@@ -1,13 +1,5 @@
 -module(f2).
--export([start/1]).
+-export([wait/0]).
 
-start(Fun) ->
-    spawn(fun() ->
-		  wait(Fun)
-	  end).
-
-wait(Fun) ->
-    receive
-	go ->
-	    Fun()
-    end.
+wait() ->
+    receive after infinity -> ok end.