Fix purge of code

Ensure that we cannot get any dangling pointers into code that
has been purged. This is done by a two phase purge. At first
phase all fun entries pointing into the code to purge are marked
for purge. All processes trying to call these funs will be suspended
and by this we avoid getting new direct references into the code.
When all processes has been checked, these processes are resumed.

The new purge strategy now also completely ignore the existence of
indirect references to the code (funs). If such exist, they will
cause bad fun exceptions to the caller, but will not prevent a
soft purge or cause a kill of a process having such live references
during a hard purge. This since it is impossible to give any
guarantees that no processes in the system have such indirect
references. Even when the system is completely clean from such
references, new ones can appear via distribution and/or disk.

HOWTO/INSTALL.md

@@ -429,6 +429,10 @@ Some of the available `configure` options are:
     and **not supported**. This functionality **will** be subject to backward
     incompatible changes. Note that you should **not** enable the dirty scheduler
     functionality on production systems. It is only provided for testing.
+    This switch also imply `--enable-new-purge-strategy` (see below).
+*   `--enable-new-purge-strategy` - Enable the purge strategy that will be
+    introduced in ERTS version 9.0 (OTP 20). Note that this switch will be
+    removed in OTP 20.
 
 If you or your system has special requirements please read the `Makefile` for
 additional configuration information.

erts/doc/src/erlang.xml

@@ -764,6 +764,29 @@
             and the operation was requested
             by passing option <c>{allow_gc, false}</c>.</p></item>
         </taglist>
+	<note>
+	<p>
+	  Up until ERTS version 8.*, the check process code operation
+	  checks for all types of references to the old code. That is,
+	  direct references (e.g. return addresses on the process
+	  stack), indirect references (<c>fun</c>s in process
+	  context), and references to literals in the code.
+	</p>
+	<p>
+	  As of ERTS version 9.0, the check process code operation
+	  only checks for direct references to the code. Indirect
+	  references via <c>fun</c>s will be ignored. If such
+	  <c>fun</c>s exist and are used after a purge of the old
+	  code, an exception will be raised upon usage (same as
+	  the case when the <c>fun</c> is received by the process
+	  after the purge). Literals will be taken care of (copied)
+	  at a  later stage. This behavior can as of ERTS version
+	  8.1 be enabled when
+	  <seealso marker="doc/installation_guide:INSTALL#Advanced-configuration-and-build-of-ErlangOTP_Configuring">building OTP</seealso>,
+	  and will automatically be enabled if dirty scheduler
+	  support is enabled.
+	</p>
+	</note>
         <p>See also <seealso marker="kernel:code">code(3)</seealso>.</p>
         <p>Failures:</p>
         <taglist>

erts/emulator/beam/atom.names

@@ -65,6 +65,7 @@ atom undefined_lambda
 atom DOWN='DOWN'
 atom UP='UP'
 atom EXIT='EXIT'
+atom abort
 atom aborted
 atom abs_path
 atom absoluteURI
@@ -165,6 +166,7 @@ atom commandv
 atom compact
 atom compat_rel
 atom compile
+atom complete
 atom compressed
 atom config_h
 atom convert_time_unit
@@ -236,6 +238,7 @@ atom erlang
 atom ERROR='ERROR'
 atom error_handler
 atom error_logger
+atom erts_code_purger
 atom erts_internal
 atom ets
 atom ETS_TRANSFER='ETS-TRANSFER'
@@ -487,6 +490,7 @@ atom pause
 atom pending
 atom pending_driver
 atom pending_process
+atom pending_purge_lambda
 atom pending_reload
 atom permanent
 atom pid
@@ -496,6 +500,7 @@ atom port_count
 atom port_limit
 atom port_op
 atom positive
+atom prepare
 atom print
 atom priority
 atom private