erts: Fix race between setup_bif_timer and suspending process

Symptom: SEGV seen one time in process_SUITE:suspend_process_pausing_bif_timer_mass

Scenario:

A1. Process A calls setup_bif_timer()
A2. Create BIF timer
A2. Lock ERTS_PROC_LOCK_BTM for receiving process B (proc)
A3. Read proc->paused_bif_timers to be NULL
A4. Insert timer into proc->bif_timers tree
A5. Unlock ERTS_PROC_LOCK_BTM for B

B6. Suspending process B calls erts_pause_bif_timers()
B7. Lock ERTS_PROC_LOCK_BTM
B8. Set c_p->paused_bif_timers
B9. Cancel timer in c_p->bif_timers and free message buffer

A10. Process A continues in setup_bif_timer()
A11. Read proc->paused_bif_timers AGAIN, now set as != NULL
A12. Cancel timer and crash on double free of message buffer


Fix: Don't read proc->paused_bif_timers again without lock

Author: sverker

erts/emulator/beam/erl_hl_timer.c

@@ -1834,16 +1834,18 @@ setup_bif_timer(Process *c_p, int twheel, ErtsMonotonicTime timeout_pos,
 	Process *proc = erts_pid2proc_opt(c_p, ERTS_PROC_LOCK_MAIN,
 					  rcvr, ERTS_PROC_LOCK_BTM,
 					  ERTS_P2P_FLG_INC_REFC);
-        if (proc) {
+
+        if (proc && !proc->paused_bif_timers) {
             tmr->type.head.receiver.proc = proc;
-            if (proc->paused_bif_timers) {
-                create_paused_bif_timer(tmr, proc, esdp);
-            } else {
-                proc_btm_rbt_insert(&proc->bif_timers, tmr);
-            }
+            proc_btm_rbt_insert(&proc->bif_timers, tmr);
             erts_proc_unlock(proc, ERTS_PROC_LOCK_BTM);
         }
-        if (!proc || proc->paused_bif_timers) {
+        else {
+            if (proc) {
+                create_paused_bif_timer(tmr, proc, esdp);
+                erts_proc_unlock(proc, ERTS_PROC_LOCK_BTM);
+                erts_proc_dec_refc(proc);
+            }
             if (tmr->btm.tree.parent != ERTS_HLT_PFIELD_NOT_IN_TABLE) {
                 btm_rbt_delete(&esdp->timer_service->btm_tree, tmr);
                 tmr->btm.tree.parent = ERTS_HLT_PFIELD_NOT_IN_TABLE;
@@ -1855,9 +1857,6 @@ setup_bif_timer(Process *c_p, int twheel, ErtsMonotonicTime timeout_pos,
             else
                 hlt_delete_timer(esdp, &tmr->type.hlt);
             timer_destroy((ErtsTimer *) tmr, twheel, 1);
-            if (proc) {
-                erts_proc_dec_refc(proc);
-            }
 	}
     }