Panic with RACCT on a jailed process

Hi,

I've been bit by a panic three times over the last month.

I'm currently running:
    FreeBSD obiwan.piupiu.local 10.0-CURRENT FreeBSD 10.0-CURRENT #7 r251519: Sun Jun  9 22:37:09 CEST 2013 root_at_obiwan.piupiu.local:/usr/obj/usr/src/sys/OBIWAN  amd64

The panic message is:
    panic: destroying non-empty racct: 1007616 allocated for resource 4

I quicky tried to track this down, but in half an hour I didn't get very
far.  Resource 4 is RACCT_RSS.  The faulty process seems to be 66555
which looks like a 32-bits cron(8) running in a jail.

This is the call trace:

    kdb_enter() at kdb_enter+0x3e/frame 0xffffff80e63b3610
    vpanic() at vpanic+0x146/frame 0xffffff80e63b3650
    kassert_panic() at kassert_panic+0x136/frame 0xffffff80e63b36c0
    racct_destroy() at racct_destroy+0x8e/frame 0xffffff80e63b36f0
    uifree() at uifree+0x5e/frame 0xffffff80e63b3710
    crfree() at crfree+0x48/frame 0xffffff80e63b3730
    thread_wait() at thread_wait+0xac/frame 0xffffff80e63b3750
    proc_reap() at proc_reap+0x43f/frame 0xffffff80e63b37a0
    proc_to_reap() at proc_to_reap+0x340/frame 0xffffff80e63b37f0
    kern_wait6() at kern_wait6+0x1fa/frame 0xffffff80e63b3890
    kern_wait() at kern_wait+0x5a/frame 0xffffff80e63b39e0
    freebsd32_wait4() at freebsd32_wait4+0x2e/frame 0xffffff80e63b3ae0
    ia32_syscall() at ia32_syscall+0x26c/frame 0xffffff80e63b3bf0

The panic happened each three times because of cron(8), but both with
32-bits and 64-bits versions.


crashinfo + ddb textdump available here:
    http://people.freebsd.org/~jlh/crash/core.txt.9.txt

Note that the dmesg included in the core contains another panic I got
with ZFS.  I usually wait to see it twice before reporting, but if you
want I still have the core and the crashinfo around.

-- 
Jeremie Le Hen

Scientists say the world is made up of Protons, Neutrons and Electrons.
They forgot to mention Morons.