panic: vm_page_alloc: pindex already allocated

Hi,

I've just managed to panic an amd64 host, running HEAD r252161 from June
24th.  Filesystem is fully ZFS, no UFS or NFS is involved.  The panic is
fully reproducible, and is also reproduceable with r251861, so has not
been introduced in the last week.

The host machine runs several jails.  Inside one of them Apache is used
to serve a SVN repository though mod_svn.  At the time of the panic, two
machines were checking out the same (FreeBSD ports) tree over IPv4
https.  Apache will have been writing significant amounts of data to
to /var/log/httpd-access.log at the time.

Within the jail, I ran "tail -f /var/log/httpd-access.log".  The machine
immediately paniced:

panic: vm_page_alloc: pindex already allocated
cpuid = 3
KDB: enter: panic
[ thread pid 29345 tid 100408 ]
Stopped at      kdb_enter+0x3b: movq    $0,0xabcab2(%rip)
db> bt
Tracing pid 29345 tid 100408 td 0xfffffe00cd564000
kdb_enter() at kdb_enter+0x3b/frame 0xffffff895d48e340
vpanic() at vpanic+0xe1/frame 0xffffff895d48e380
kassert_panic() at kassert_panic+0xd3/frame 0xffffff895d48e470
vm_page_alloc() at vm_page_alloc+0x4ce/frame 0xffffff895d48e4b0
zfs_freebsd_write() at zfs_freebsd_write+0x89c/frame 0xffffff895d48e6c0
VOP_WRITE_APV() at VOP_WRITE_APV+0x113/frame 0xffffff895d48e7d0
vn_write() at vn_write+0x281/frame 0xffffff895d48e860
vn_io_fault() at vn_io_fault+0x94/frame 0xffffff895d48e9f0
dofilewrite() at dofilewrite+0x85/frame 0xffffff895d48ea40
kern_writev() at kern_writev+0x6c/frame 0xffffff895d48ea80
sys_write() at sys_write+0x64/frame 0xffffff895d48ead0
amd64_syscall() at amd64_syscall+0x389/frame 0xffffff895d48ebf0
Xfast_syscall() at Xfast_syscall+0xf7/frame 0xffffff895d48ebf0
--- syscall (4, FreeBSD ELF64, sys_write), rip = 0x8020cd7aa, rsp = 0x7fffffffd798, rbp = 0x13 ---


Reproducing the panic is easy.  While the machine is being accessed (and
so Apache is busy writing lots to /var/log/httpd-access.log), running
the following as root will panic the machine, usually within 10 seconds:

#!/bin/sh
while [ 1 ]
do
 tail /var/log/httpd-access.log > /dev/null
done

I have core files available.  I've also put a dump of the implicated
mpred and object structures at 
https://svnmir.bme.freebsd.org/core.1.gdb.txt (gdb output)
https://svnmir.bme.freebsd.org/core.txt.1 (dumpinfo)

Thanks,

Gavin