another panic: ffs_blkfree: freeing free block

This panic happened when  I am running some threaded program:

GNU gdb 5.2.1 (FreeBSD)
Copyright 2002 Free Software Foundation, Inc.
GDB is free software, covered by the GNU General Public License, and you are
welcome to change it and/or distribute copies of it under certain conditions.
Type "show copying" to see the conditions.
There is absolutely no warranty for GDB.  Type "show warranty" for details.
This GDB was configured as "i386-undermydesk-freebsd"...
(no debugging symbols found)...
(kgdb) core vmcore.7
panic: absolutely cannot call smp_ipi_shootdown with interrupts already disabled
panic messages:
---
panic: ffs_blkfree: freeing free block
cpuid = 1; lapic.id = 01000000
boot() called on cpu#1

syncing disks, buffers remaining... panic: absolutely cannot call smp_ipi_shootdown with interrupts already disabled
cpuid = 1; lapic.id = 01000000
boot() called on cpu#1
Uptime: 1h25m6s
Dumping 255 MB
ata0: resetting devices ..
done
 16 32 48 64 80 96 112 128 144 160 176 192 208 224 240
---
Reading symbols from /home/davidxu/src/sys/i386/compile/xu/modules/home/davidxu/src/sys/modules/vesa/vesa.ko.debug...done.
Loaded symbols for /home/davidxu/src/sys/i386/compile/xu/modules/home/davidxu/src/sys/modules/vesa/vesa.ko.debug
Reading symbols from /home/davidxu/src/sys/i386/compile/xu/modules/home/davidxu/src/sys/modules/acpi/acpi.ko.debug...done.
Loaded symbols for /home/davidxu/src/sys/i386/compile/xu/modules/home/davidxu/src/sys/modules/acpi/acpi.ko.debug
(kgdb) symbol /home/davidxu/src/sys/i386/compile/xu/kernel.debug
Load new symbol table from "/home/davidxu/src/sys/i386/compile/xu/kernel.debug"? (y or n) 
Reading symbols from /home/davidxu/src/sys/i386/compile/xu/kernel.debug...done.
(kgdb) bt
#0  doadump () at ../../../kern/kern_shutdown.c:238
#1  0xc01f16f3 in boot (howto=260) at ../../../kern/kern_shutdown.c:370
#2  0xc01f1aaf in panic () at ../../../kern/kern_shutdown.c:543
#3  0xc031a4eb in smp_tlb_shootdown (vector=0, addr1=0, addr2=0)
    at ../../../i386/i386/mp_machdep.c:2351
#4  0xc031a789 in smp_invlpg_range (addr1=0, addr2=0)
    at ../../../i386/i386/mp_machdep.c:2483
#5  0xc031c8b8 in pmap_invalidate_range (pmap=0xc040e100, sva=3357540352, 
    eva=1) at ../../../i386/i386/pmap.c:719
#6  0xc031cc11 in pmap_qremove (sva=3357540352, count=0)
    at ../../../i386/i386/pmap.c:964
#7  0xc0237c7b in vfs_vmio_release (bp=0xc7776c70)
    at ../../../kern/vfs_bio.c:1591
#8  0xc0237306 in brelse (bp=0xc7776c70) at ../../../kern/vfs_bio.c:1376
#9  0xc02b76be in softdep_disk_io_initiation (bp=0xc7820d38)
    at ../../../ufs/ffs/ffs_softdep.c:3474
#10 0xc01b8f72 in spec_xstrategy (vp=0xc26f8920, bp=0xc7820d38) at buf.h:422
#11 0xc01b92ab in spec_specstrategy (ap=0x0)
    at ../../../fs/specfs/spec_vnops.c:550
#12 0xc01b8248 in spec_vnoperate (ap=0x0)
    at ../../../fs/specfs/spec_vnops.c:123
#13 0xc02cb39d in ufs_strategy (ap=0x0) at vnode_if.h:1114
#14 0xc02cbe98 in ufs_vnoperate (ap=0x0) at ../../../ufs/ufs/ufs_vnops.c:2787
#15 0xc02363c7 in bwrite (bp=0xc26f8920) at vnode_if.h:1089
#16 0xc0238021 in vfs_bio_awrite (bp=0xc7820d38)
    at ../../../kern/vfs_bio.c:1711
#17 0xc02befa2 in ffs_fsync (ap=0xcdcec890) at ../../../ufs/ffs/ffs_vnops.c:258
#18 0xc02be16e in ffs_sync (mp=0xc26b6e00, waitfor=2, cred=0xc0eb6e80, 
    td=0xc03b52a0) at vnode_if.h:612
#19 0xc024b72b in sync (td=0xc03b52a0, uap=0x0)
    at ../../../kern/vfs_syscalls.c:137
#20 0xc01f1252 in boot (howto=0) at ../../../kern/kern_shutdown.c:279
#21 0xc0146b95 in db_fncall (dummy1=0, dummy2=0, dummy3=1999, 
    dummy4=0xcdcec9c0 "\200b:?\213_at_???r") at ../../../ddb/db_command.c:546
#22 0xc0146912 in db_command (last_cmdp=0xc037cc60, cmd_table=0x0, 
    aux_cmd_tablep=0xc0376d70, aux_cmd_tablep_end=0xc0376d74)
    at ../../../ddb/db_command.c:346
#23 0xc0146a26 in db_command_loop () at ../../../ddb/db_command.c:470
#24 0xc01497ba in db_trap (type=3, code=0) at ../../../ddb/db_trap.c:72
#25 0xc0308c63 in kdb_trap (type=3, code=0, regs=0xcdcecb20)
    at ../../../i386/i386/db_interface.c:170
#26 0xc0321c6c in trap (frame=
      {tf_fs = 24, tf_es = 16, tf_ds = 16, tf_edi = -1034046576, tf_esi = 256, tf_ebp = -842085524, tf_isp = -842085556, tf_ebx = 0, tf_edx = 0, tf_ecx = 32, tf_eax = 18, tf_trapno = 3, tf_err = 0, tf_eip = -1070559403, tf_cs = 8, tf_eflags = 662, tf_esp = -1070138054, tf_ss = -1070211574})
    at ../../../i386/i386/trap.c:593
#27 0xc030a608 in calltrap () at {standard input}:97
#28 0xc01f1a4f in panic (fmt=0x0) at ../../../kern/kern_shutdown.c:527
#29 0xc02a627a in ffs_blkfree (fs=0xc2611000, devvp=0xc26f8920, bno=97744, 
    size=16384, inum=3656) at ../../../ufs/ffs/ffs_alloc.c:1768
#30 0xc02b41c3 in handle_workitem_freefrag (freefrag=0xc26904c0)
    at ../../../ufs/ffs/ffs_softdep.c:1587
#31 0xc02b2eb3 in process_worklist_item (matchmnt=0x0, flags=0)
    at ../../../ufs/ffs/ffs_softdep.c:767
#32 0xc02b2b90 in softdep_process_worklist (matchmnt=0x0)
    at ../../../ufs/ffs/ffs_softdep.c:622
#33 0xc0247dee in sched_sync () at ../../../kern/vfs_subr.c:1761
#34 0xc01dd350 in fork_exit (callout=0xc0247b00 <sched_sync>, arg=0x0, 
    frame=0x0) at ../../../kern/kern_fork.c:792
(kgdb) 

--
David Xu