sys/vm/vm_page.c panic with recent CURRENT

Hi all,

It happens always at the same place (recover vi sessions) It's 100% 
reproduible. A dump is available. A kernel from June works fine
and vi recover works there.

The KASSERT from sys/vm/vm_page.c:1087 makes my box
panic:

panic: vm_page_free_toq: freeing mapped page 0xc2f00a70
cpuid = 0
KDB: enter: panic
panic: from debugger
cpuid = 0
Uptime: 24s
Physical memory: 2035 MB

(kgdb) where
#0  doadump () at pcpu.h:166

#11 0xc06a0953 in panic (fmt=0xc0943300 "vm_page_free_toq: freeing mapped page %p") at /usr/src/sys/kern/kern_shutdown.c:549
#12 0xc0803e4e in vm_page_free_toq (m=0xc2f00a70) at /usr/src/sys/vm/vm_page.c:1087
#13 0xc080332d in vm_page_free (m=0xc2f00a70) at /usr/src/sys/vm/vm_page.c:470
#14 0xc0800af9 in vm_object_terminate (object=0xc53bd168) at /usr/src/sys/vm/vm_object.c:657
#15 0xc08009d1 in vm_object_deallocate (object=0xc53bd168) at /usr/src/sys/vm/vm_object.c:590
#16 0xc07fd598 in vm_map_entry_delete (map=0xc14650a8, entry=0xc51b12a8) at /usr/src/sys/vm/vm_map.c:2283
#17 0xc07fd6cc in vm_map_delete (map=0xc14650a8, start=3242610856, end=3792416768) at /usr/src/sys/vm/vm_map.c:2372
#18 0xc07fadf4 in kmem_free_wakeup (map=0xc14650a8, addr=3792146432, size=18) at /usr/src/sys/vm/vm_kern.c:467
#19 0xc0688426 in exec_free_args (args=0xe6361c60) at /usr/src/sys/kern/kern_exec.c:1055
#20 0xc0687dd7 in do_execve (td=0xc4ea56c0, args=0xe6361c60, mac_p=0x0) at /usr/src/sys/kern/kern_exec.c:795
#21 0xc06871e0 in kern_execve (td=0xc4ea56c0, args=0xe6361c60, mac_p=0x0) at /usr/src/sys/kern/kern_exec.c:258
#22 0xc068714b in execve (td=0xc4ea56c0, uap=0x12) at /usr/src/sys/kern/kern_exec.c:188
#23 0xc08a0042 in syscall (frame=
       {tf_fs = 59, tf_es = 59, tf_ds = 59, tf_edi = 0, tf_esi = 0, tf_ebp = 0, 
tf_isp = 0, tf_ebx = 0, tf_edx = 0, tf_ecx = 0, tf_eax = 0, tf_trapno = 0, 
tf_err = 0, tf_eip = 671525076, tf_cs = 51, tf_eflags = 514, tf_esp = 
-1077940540, tf_ss = 59})    at /usr/src/sys/i386/i386/trap.c:1006
#24 0xc088a6cf in Xint0x80_syscall () at /usr/src/sys/i386/i386/exception.s:191

#f 12

(kgdb) p *m
$2 = {pageq = {tqe_next = 0xc2ee83c8, tqe_prev = 0xc2f01370}, listq = {tqe_next 
= 0xc2f01370, tqe_prev = 0xc53bd194}, left = 0x0,
   right = 0xc2f01370, object = 0xc53bd168, pindex = 0, phys_addr = 1579544576, 
md = {pv_list_count = 1, pv_list = {
       tqh_first = 0xc388f064, tqh_last = 0xc388f068}}, queue = 34, flags = 144, 
pc = 31, wire_count = 0, cow = 0, hold_count = 0,
   oflags = 0, act_count = 5 '\005', busy = 0 '\0', valid = 255 'ÿ', dirty = 0 
'\0'}

Any ideas ?

Martin

Martin Blapp, <mb_at_imp.ch> <mbr_at_FreeBSD.org>
------------------------------------------------------------------
ImproWare AG, UNIXSP & ISP, Zurlindenstrasse 29, 4133 Pratteln, CH
Phone: +41 61 826 93 00 Fax: +41 61 826 93 01
PGP: <finger -l mbr_at_freebsd.org>
PGP Fingerprint: B434 53FC C87C FE7B 0A18 B84C 8686 EF22 D300 551E
------------------------------------------------------------------