Merge branch 'kjell/stdlib/ets/fix_crash_update_counter_bad_pos_22/ERL-1125/OTP-16378' into maint-22

* kjell/stdlib/ets/fix_crash_update_counter_bad_pos_22/ERL-1125/OTP-16378:
  Fix ERL-1125: ordered_set ets:update_counter/4 bad position crash

3 files changed, 17 insertions, 5 deletions

diff --git a/erts/emulator/beam/erl_db_catree.c b/erts/emulator/beam/erl_db_catree.c
index 176966edb5..4e08f89692 100644
--- a/erts/emulator/beam/erl_db_catree.c
+++ b/erts/emulator/beam/erl_db_catree.c
@@ -2289,7 +2289,10 @@ static int db_lookup_dbterm_catree(Process *p, DbTable *tbl, Eterm key, Eterm ob
 static void db_finalize_dbterm_catree(int cret, DbUpdateHandle *handle)
 {
     DbTableCATree *tb = &(handle->tb->catree);
-    db_finalize_dbterm_tree_common(cret, handle, NULL);
+    db_finalize_dbterm_tree_common(cret,
+                                   handle,
+                                   &handle->u.catree.base_node->u.base.root,
+                                   NULL);
     wunlock_adapt_base_node(tb, handle->u.catree.base_node,
                             handle->u.catree.parent,
                             handle->u.catree.current_level);
diff --git a/erts/emulator/beam/erl_db_tree.c b/erts/emulator/beam/erl_db_tree.c
index 723b3c5d29..49158108a2 100644
--- a/erts/emulator/beam/erl_db_tree.c
+++ b/erts/emulator/beam/erl_db_tree.c
@@ -3287,7 +3287,9 @@ db_lookup_dbterm_tree(Process *p, DbTable *tbl, Eterm key, Eterm obj,
     return db_lookup_dbterm_tree_common(p, tbl, &tb->root, key, obj, handle, tb);
 }
 
-void db_finalize_dbterm_tree_common(int cret, DbUpdateHandle *handle,
+void db_finalize_dbterm_tree_common(int cret,
+                                    DbUpdateHandle *handle,
+                                    TreeDbTerm **root,
                                     DbTableTree *stack_container)
 {
     DbTable *tbl = handle->tb;
@@ -3295,7 +3297,12 @@ void db_finalize_dbterm_tree_common(int cret, DbUpdateHandle *handle,
 
     if (handle->flags & DB_NEW_OBJECT && cret != DB_ERROR_NONE) {
         Eterm ret;
-        db_erase_tree(tbl, GETKEY(&tbl->common, bp->dbterm.tpl), &ret);
+        db_erase_tree_common(tbl,
+                             root,
+                             GETKEY(&tbl->common, bp->dbterm.tpl),
+                             &ret,
+                             (stack_container == NULL ?
+                              NULL : &stack_container->static_stack));
     } else if (handle->flags & DB_MUST_RESIZE) {
 	db_finalize_resize(handle, offsetof(TreeDbTerm,dbterm));
         reset_static_stack(stack_container);
@@ -3313,7 +3320,7 @@ db_finalize_dbterm_tree(int cret, DbUpdateHandle *handle)
 {
     DbTable *tbl = handle->tb;
     DbTableTree *tb = &tbl->tree;
-    db_finalize_dbterm_tree_common(cret, handle, tb);
+    db_finalize_dbterm_tree_common(cret, handle, &tb->root, tb);
 }
 
 static int db_get_binary_info_tree(Process *p, DbTable *tbl, Eterm key, Eterm *ret)
diff --git a/erts/emulator/beam/erl_db_tree_util.h b/erts/emulator/beam/erl_db_tree_util.h
index 14afbd56f7..90ac8c7ba7 100644
--- a/erts/emulator/beam/erl_db_tree_util.h
+++ b/erts/emulator/beam/erl_db_tree_util.h
@@ -167,7 +167,9 @@ void db_foreach_offheap_tree_common(TreeDbTerm *root,
 int db_lookup_dbterm_tree_common(Process *p, DbTable *tbl, TreeDbTerm **root,
                                  Eterm key, Eterm obj, DbUpdateHandle* handle,
                                  DbTableTree *stack_container);
-void db_finalize_dbterm_tree_common(int cret, DbUpdateHandle *handle,
+void db_finalize_dbterm_tree_common(int cret,
+                                    DbUpdateHandle *handle,
+                                    TreeDbTerm **root,
                                     DbTableTree *stack_container);
 Sint cmp_partly_bound(Eterm partly_bound_key, Eterm bound_key);