Index: lucene/test-framework/src/java/org/apache/lucene/util/ThrottledIndexOutput.java
===================================================================
--- lucene/test-framework/src/java/org/apache/lucene/util/ThrottledIndexOutput.java	(revision 1530072)
+++ lucene/test-framework/src/java/org/apache/lucene/util/ThrottledIndexOutput.java	(working copy)
@@ -102,11 +102,13 @@
   @Override
   public void writeBytes(byte[] b, int offset, int length) throws IOException {
     final long before = System.nanoTime();
+    // TODO: sometimes, write only half the bytes, then
+    // sleep, then 2nd half, then sleep, so we sometimes
+    // interrupt having only written not all bytes
     delegate.writeBytes(b, offset, length);
     timeElapsed += System.nanoTime() - before;
     pendingBytes += length;
     sleep(getDelay(false));
-
   }
 
   protected long getDelay(boolean closing) {
Index: lucene/core/src/test/org/apache/lucene/index/TestIndexWriterDelete.java
===================================================================
--- lucene/core/src/test/org/apache/lucene/index/TestIndexWriterDelete.java	(revision 1530072)
+++ lucene/core/src/test/org/apache/lucene/index/TestIndexWriterDelete.java	(working copy)
@@ -322,7 +322,7 @@
           int value = 100;
           try {
             latch.await();
-            for (int i = 0; i < 1000; i++) {
+            for (int j = 0; j < 1000; j++) {
               Document doc = new Document();
               doc.add(newTextField("content", "aaa", Field.Store.NO));
               doc.add(newStringField("id", String.valueOf(id++), Field.Store.YES));
@@ -1221,10 +1221,11 @@
   private static class FakeIOException extends IOException {
   }
 
-  // Make sure if we hit disk full, and then later disk
-  // frees up, and we successfully close IW or open an NRT
+  // Make sure if we hit a transient IOException (e.g., disk
+  // full), and then the exception stops (e.g., disk frees
+  // up), so we successfully close IW or open an NRT
   // reader, we don't lose any deletes:
-  public void testNoLostDeletesOnDiskFull() throws Exception {
+  public void testNoLostDeletesOnIOException() throws Exception {
 
     int deleteCount = 0;
     int docBase = 0;
@@ -1237,35 +1238,60 @@
           @Override
           public void eval(MockDirectoryWrapper dir) throws IOException {
             StackTraceElement[] trace = new Exception().getStackTrace();
-            if (shouldFail.get()) {
-              for (int i = 0; i < trace.length; i++) {
-                if ("writeLiveDocs".equals(trace[i].getMethodName())) {
-                  // Only sometimes throw the exc, so we get
-                  // it sometimes on creating the file, on
-                  // flushing buffer, on closing the file:
-                  if (random().nextInt(3) == 2) {
-                    if (VERBOSE) {
-                      System.out.println("TEST: now fail; exc:");
-                      new Throwable().printStackTrace(System.out);
-                    }
-                    shouldFail.set(false);
-                    throw new FakeIOException();
-                  } else {
-                    break;
-                  }
-                }
+            if (shouldFail.get() == false) {
+              return;
+            }
+
+            boolean sawSeal = false;
+            boolean sawWrite = false;
+            for (int i = 0; i < trace.length; i++) {
+              if ("sealFlushedSegment".equals(trace[i].getMethodName())) {
+                sawSeal = true;
+                break;
               }
+              if ("writeLiveDocs".equals(trace[i].getMethodName())) {
+                sawWrite = true;
+              }
             }
+
+            // Don't throw exc if we are "flushing", else
+            // the segment is aborted and docs are lost:
+            if (sawWrite && sawSeal == false && random().nextInt(3) == 2) {
+              // Only sometimes throw the exc, so we get
+              // it sometimes on creating the file, on
+              // flushing buffer, on closing the file:
+              if (VERBOSE) {
+                System.out.println("TEST: now fail; thread=" + Thread.currentThread().getName() + " exc:");
+                new Throwable().printStackTrace(System.out);
+              }
+              shouldFail.set(false);
+              throw new FakeIOException();
+            }
           }
       });
 
+    RandomIndexWriter w = null;
+
     for(int iter=0;iter<10*RANDOM_MULTIPLIER;iter++) {
       int numDocs = atLeast(100);
       if (VERBOSE) {
-        System.out.println("\nTEST: iter=" + iter + " numDocs=" + numDocs + " docBase=" + docBase);
+        System.out.println("\nTEST: iter=" + iter + " numDocs=" + numDocs + " docBase=" + docBase + " delCount=" + deleteCount);
       }
       IndexWriterConfig iwc = newIndexWriterConfig(TEST_VERSION_CURRENT, new MockAnalyzer(random()));
-      IndexWriter w = new IndexWriter(dir, iwc);
+      MergeScheduler ms = iwc.getMergeScheduler();
+      if (ms instanceof ConcurrentMergeScheduler) {
+        // TODO: better to subclass CMS, carry over all
+        // settigns that newIWC set, and ONLY suppress
+        // FakeIOExc:
+        ((ConcurrentMergeScheduler) ms).setSuppressExceptions();
+      }
+      if (w == null) {
+        w = new RandomIndexWriter(random(), dir, iwc);
+        // Since we hit exc during merging, a partial
+        // forceMerge can easily return when there are still
+        // too many segments in the index:
+        w.setDoRandomForceMergeAssert(false);
+      }
       for(int i=0;i<numDocs;i++) {
         Document doc = new Document();
         doc.add(new StringField("id", ""+(docBase+i), Field.Store.NO));
@@ -1273,9 +1299,8 @@
       }
       docCount += numDocs;
 
-      IndexReader r = w.getReader();
-      assertEquals(docCount-deleteCount, r.numDocs());
-      r.close();
+      // TODO: we could make the test more evil, by letting
+      // it throw more than one exc, randomly, before "recovering"
 
       // TODO: we could also install an infoStream and try
       // to fail in "more evil" places inside BDS
@@ -1286,29 +1311,74 @@
 
         for(int i=0;i<numDocs;i++) {
           if (random().nextInt(10) == 7) {
+            if (VERBOSE) {
+              System.out.println("  delete id=" + (docBase+i));
+            }
             deleteCount++;
             w.deleteDocuments(new Term("id", ""+(docBase+i)));
           }
         }
 
-        w.close();
+        // Trigger writeLiveDocs so we hit fake exc:
+        IndexReader r = w.getReader(true);
+
+        // Sometimes we will make it here (we only randomly
+        // throw the exc):
+        assertEquals(docCount-deleteCount, r.numDocs());
+        r.close();
+
+        // TODO: also call w.close() in here, sometimes,
+        // so we sometimes get a fail via dropAll
+
       } catch (FakeIOException ioe) {
         // expected
         if (VERBOSE) {
           System.out.println("TEST: w.close() hit expected IOE");
         }
         // No exception should happen here (we only fail once):
-        w.close();
       }
       shouldFail.set(false);
 
-      r = DirectoryReader.open(dir);
+      IndexReader r;
+
+      if (random().nextBoolean()) {
+        // Open non-NRT reader, to make sure the "on
+        // disk" bits are good:
+        if (VERBOSE) {
+          System.out.println("TEST: verify against non-NRT reader");
+        }
+        w.commit();
+        r = DirectoryReader.open(dir);
+      } else {
+        if (VERBOSE) {
+          System.out.println("TEST: verify against NRT reader");
+        }
+        r = w.getReader();
+      }
       assertEquals(docCount-deleteCount, r.numDocs());
       r.close();
 
+      // Sometimes re-use RIW, other times open new one:
+      if (random().nextBoolean()) {
+        if (VERBOSE) {
+          System.out.println("TEST: close writer");
+        }
+        w.close();
+        w = null;
+      }
+
       docBase += numDocs;
     }
 
+    if (w != null) {
+      w.close();
+    }
+
+    // Final verify:
+    IndexReader r = DirectoryReader.open(dir);
+    assertEquals(docCount-deleteCount, r.numDocs());
+    r.close();
+
     dir.close();
   }
 }
Index: lucene/core/src/test/org/apache/lucene/index/TestIndexWriterReader.java
===================================================================
--- lucene/core/src/test/org/apache/lucene/index/TestIndexWriterReader.java	(revision 1530072)
+++ lucene/core/src/test/org/apache/lucene/index/TestIndexWriterReader.java	(working copy)
@@ -157,6 +157,7 @@
     assertEquals(1, count(new Term("id", Integer.toString(8000)), r2));
     
     r1.close();
+    assertTrue(r2.isCurrent());
     writer.close();
     assertTrue(r2.isCurrent());
     
Index: lucene/core/src/test/org/apache/lucene/index/TestIndexWriter.java
===================================================================
--- lucene/core/src/test/org/apache/lucene/index/TestIndexWriter.java	(revision 1530072)
+++ lucene/core/src/test/org/apache/lucene/index/TestIndexWriter.java	(working copy)
@@ -1025,13 +1025,23 @@
     @Override
     public void run() {
       // LUCENE-2239: won't work with NIOFS/MMAP
-      Directory dir = new MockDirectoryWrapper(random, new RAMDirectory());
+      MockDirectoryWrapper dir = new MockDirectoryWrapper(random, new RAMDirectory());
+
+      // When interrupt arrives in w.close(), when it's
+      // writing liveDocs, this can lead to double-write of
+      // _X_N.del:
+      dir.setPreventDoubleWrite(false);
       IndexWriter w = null;
       while(!finish) {
         try {
 
           while(!finish) {
             if (w != null) {
+              // If interrupt arrives inside here, it's
+              // fine: we will cycle back and the first
+              // thing we do is try to close again,
+              // i.e. we'll never try to open a new writer
+              // until this one successfully closes:
               w.close();
               w = null;
             }
Index: lucene/core/src/java/org/apache/lucene/index/IndexWriter.java
===================================================================
--- lucene/core/src/java/org/apache/lucene/index/IndexWriter.java	(revision 1530072)
+++ lucene/core/src/java/org/apache/lucene/index/IndexWriter.java	(working copy)
@@ -450,7 +450,11 @@
     }
 
     public synchronized void release(ReadersAndLiveDocs rld) throws IOException {
+      release(rld, true);
+    }
 
+    public synchronized void release(ReadersAndLiveDocs rld, boolean assertInfoLive) throws IOException {
+
       // Matches incRef in get:
       rld.decRef();
 
@@ -463,11 +467,13 @@
 //        System.out.println("[" + Thread.currentThread().getName() + "] ReaderPool.release: " + rld.info);
         if (rld.writeLiveDocs(directory)) {
           // Make sure we only write del docs and field updates for a live segment:
-          assert infoIsLive(rld.info);
-          // Must checkpoint w/ deleter, because we just
+          assert assertInfoLive == false || infoIsLive(rld.info);
+          // Must checkpoint because we just
           // created new _X_N.del and field updates files.
+          changeCount++;
           deleter.checkpoint(segmentInfos, false);
         }
+        //System.out.println("IW: done writeLiveDocs for info=" + rld.info);
 
 //        System.out.println("[" + Thread.currentThread().getName() + "] ReaderPool.release: drop readers " + rld.info);
         rld.dropReaders();
@@ -487,12 +493,14 @@
           if (doSave && rld.writeLiveDocs(directory)) {
             // Make sure we only write del docs and field updates for a live segment:
             assert infoIsLive(rld.info);
-            // Must checkpoint w/ deleter, because we just
+            // Must checkpoint, because we just
             // created created new _X_N.del and field updates files.
+
+            changeCount++;
             deleter.checkpoint(segmentInfos, false);
           }
         } catch (Throwable t) {
-          if (priorE != null) {
+          if (priorE == null) {
             priorE = t;
           }
         }
@@ -510,13 +518,16 @@
         try {
           rld.dropReaders();
         } catch (Throwable t) {
-          if (priorE != null) {
+          if (priorE == null) {
             priorE = t;
           }
         }
       }
       assert readerMap.size() == 0;
       if (priorE != null) {
+        if (priorE instanceof IOException) throw (IOException) priorE;
+        if (priorE instanceof RuntimeException) throw (RuntimeException) priorE;
+        if (priorE instanceof Error) throw (Error) priorE;
         throw new RuntimeException(priorE);
       }
     }
@@ -537,9 +548,10 @@
             // Make sure we only write del docs and updates for a live segment:
             assert infoIsLive(info);
 
-            // Must checkpoint w/ deleter, because we just
+            // Must checkpoint, because we just
             // created new _X_N.del and field updates files.
             deleter.checkpoint(segmentInfos, false);
+            changeCount++;
             
             // we wrote field updates, reopen the reader
             if (hasFieldUpdates) {
@@ -1005,21 +1017,32 @@
         infoStream.message("IW", "now call final commit()");
       }
 
+      // Must do this before commitInternal, in case any of
+      // the dropped readers in the pool wrote a new live
+      // docs: 
+      synchronized(this) {
+        readerPool.dropAll(true);
+      }
+
       if (doFlush) {
         commitInternal();
       }
 
-      if (infoStream.isEnabled("IW")) {
-        infoStream.message("IW", "at close: " + segString());
+      synchronized(this) {
+        deleter.close();
       }
+
       // used by assert below
       final DocumentsWriter oldWriter = docWriter;
-      synchronized(this) {
-        readerPool.dropAll(true);
+
+      synchronized (this) {
         docWriter = null;
-        deleter.close();
       }
 
+      if (infoStream.isEnabled("IW")) {
+        infoStream.message("IW", "at close: " + segString());
+      }
+
       if (writeLock != null) {
         writeLock.release();                          // release write lock
         writeLock = null;
@@ -2911,6 +2934,8 @@
         segmentInfos.updateGeneration(pendingCommit);
         lastCommitChangeCount = pendingCommitChangeCount;
         rollbackSegments = pendingCommit.createBackupSegmentInfos();
+        // NOTE: don't use this.checkpoint() here, because
+        // we do not want to increment changeCount:
         deleter.checkpoint(pendingCommit, true);
       } finally {
         // Matches the incRef done in prepareCommit:
@@ -3334,16 +3359,22 @@
 
     assert merge.info.info.getDocCount() != 0 || keepFullyDeletedSegments || dropSegment;
 
-    segmentInfos.applyMergeChanges(merge, dropSegment);
-
     if (mergedDeletes != null) {
       if (dropSegment) {
-//        System.out.println("[" + Thread.currentThread().getName() + "] IW.commitMerge: dropChanges " + merge.info);
         mergedDeletes.dropChanges();
       }
-      readerPool.release(mergedDeletes);
+      // Pass false for assertInfoLive because the merged
+      // segment is not yet live (only below do we commit it
+      // to the segmentInfos):
+      readerPool.release(mergedDeletes, false);
     }
 
+    // Must do this after readerPool.release, in case an
+    // exception is hit e.g. writing the live docs for the
+    // merge segment, in which case we need to abort the
+    // merge:
+    segmentInfos.applyMergeChanges(merge, dropSegment);
+
     if (dropSegment) {
       assert !segmentInfos.contains(merge.info);
       readerPool.drop(merge.info);
Index: lucene/core/src/java/org/apache/lucene/index/SegmentInfoPerCommit.java
===================================================================
--- lucene/core/src/java/org/apache/lucene/index/SegmentInfoPerCommit.java	(revision 1530072)
+++ lucene/core/src/java/org/apache/lucene/index/SegmentInfoPerCommit.java	(working copy)
@@ -230,12 +230,7 @@
 
   /** Returns a description of this segment. */
   public String toString(Directory dir, int pendingDelCount) {
-    return info.toString(dir, delCount + pendingDelCount);
-  }
-
-  @Override
-  public String toString() {
-    String s = info.toString(info.dir, delCount);
+    String s = info.toString(dir, delCount + pendingDelCount);
     if (delGen != -1) {
       s += ":delGen=" + delGen;
     }
@@ -246,6 +241,11 @@
   }
 
   @Override
+  public String toString() {
+    return toString(info.dir, 0);
+  }
+
+  @Override
   public SegmentInfoPerCommit clone() {
     SegmentInfoPerCommit other = new SegmentInfoPerCommit(info, delCount, delGen, fieldInfosGen);
     // Not clear that we need to carry over nextWriteDelGen