Panic on pmap_remove_pages by KASSERT when process is exiting..

Hi Alan.

	In recently 7-current, I often had a panic on pmap_remove_pages
	at /usr/src/sys/i386/i386/pmap.c#3072.

	Do you have any idea?

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
panic: Bad link elm 0x82e13da8 prev->next != elm
cpuid = 1
KDB: stack backtrace:
db_trace_self_wrapper(806b9a8d,fa943ba4,804a17c6,806d8b22,1,...) at db_trace_self_wrapper+0x26
kdb_backtrace(806d8b22,1,806ae651,fa943bb0,8753a570,...) at kdb_backtrace+0x2e
panic(806ae651,82e13da8,806d9580,bc7,0,...) at panic+0x126
pmap_remove_pages(877f9bd4,806b601a,ae,0,84aff780,...) at pmap_remove_pages+0x24a
vmspace_exit(8753a570,0,806b3df9,126,1,...) at vmspace_exit+0x90
exit1(8753a570,0,fa943d2c,80690cb3,8753a570,...) at exit1+0x5c7
sys_exit(8753a570,fa943d00,4,c,fa943d38,...) at sys_exit+0x1d
syscall(fa943d38) at syscall+0x2e3
Xint0x80_syscall() at Xint0x80_syscall+0x20
--- syscall (0, FreeBSD ELF32, nosys), eip = 0x2, esp = 0x202, ebp = 0 ---
KDB: enter: panic
Physical memory: 1527 MB
Dumping 284 MB: 269 253 237 221 205 189 173 157 141 125 109 93 77 61 45 29 13

#0  doadump () at pcpu.h:166
166             __asm __volatile("movl %%fs:0,%0" : "=r" (td));
(kgdb) p *0x82e13da8
$1 = 0x40128000
(kgdb) list *pmap_remove_pages+0x24a
0x8068d26a is in pmap_remove_pages (/usr/src/sys/i386/i386/pmap.c:3072).
3067                                    PV_STAT(pv_entry_frees++);
3068                                    PV_STAT(pv_entry_spare++);
3069                                    pv_entry_count--;
3070                                    pc->pc_map[field] |= bitmask;
3071                                    m->md.pv_list_count--;
3072                                    TAILQ_REMOVE(&m->md.pv_list, pv, pv_list);
3073                                    if (TAILQ_EMPTY(&m->md.pv_list))
3074                                            vm_page_flag_clear(m, PG_WRITEABLE);
3075
3076                                    pmap_unuse_pt(pmap, pv->pv_va);
(kgdb) 
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -


- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
panic: Bad link elm 0x82d0cda8 prev->next != elm
cpuid = 1
KDB: stack backtrace:
db_trace_self_wrapper(806b9a8d,fa5cbba4,804a17c6,806d8b22,1,...) at db_trace_self_wrapper+0x26
kdb_backtrace(806d8b22,1,806ae651,fa5cbbb0,b3de83a0,...) at kdb_backtrace+0x2e
panic(806ae651,82d0cda8,806d9580,bc7,0,...) at panic+0x126
pmap_remove_pages(8620ccd8,806b601a,ae,0,84aff780,...) at pmap_remove_pages+0x24a
vmspace_exit(b3de83a0,0,806b3df9,126,0,...) at vmspace_exit+0x90
exit1(b3de83a0,0,fa5cbd2c,80690cb3,b3de83a0,...) at exit1+0x5c7
sys_exit(b3de83a0,fa5cbd00,4,14,0,...) at sys_exit+0x1d
syscall(fa5cbd38) at syscall+0x2e3
Xint0x80_syscall() at Xint0x80_syscall+0x20
--- syscall (0, FreeBSD ELF32, nosys), eip = 0x2, esp = 0x206, ebp = 0x7fbfe6dc ---
KDB: enter: panic
Physical memory: 1527 MB
Dumping 876 MB: 861 845 829 813 797 781 765 749 733 717 701 685 669 653 637 621 605 589 573 557 541 525 509 493 477 461 445 429 413 397 381 365 349 333 317 301 285 269 253 237 221 205 189 173 157 141 125 109 93 77 61 45 29 13

#0  doadump () at pcpu.h:166
166             __asm __volatile("movl %%fs:0,%0" : "=r" (td));
(kgdb) 
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -