GENERIC current from Jan 5 12:28 UTC + bmilekic@'s uma_core patch, vmcore.137
Double panic after "0+20:24:19" of stress testing.
GDB: no debug ports present
KDB: debugger backends: ddb
KDB: current backend: ddb
Copyright (c) 1992-2005 The FreeBSD Project.
Copyright (c) 1979, 1980, 1983, 1986, 1988, 1989, 1991, 1992, 1993, 1994
The Regents of the University of California. All rights reserved.
FreeBSD 6.0-CURRENT #1: Wed Jan 5 15:40:35 CET 2005
pho@current.osted.lan:/usr/src/sys/i386/compile/PHO
WARNING: WITNESS option enabled, expect reduced performance.
ACPI APIC Table: <A M I OEMAPIC >
Timecounter "i8254" frequency 1193182 Hz quality 0
CPU: Intel(R) Celeron(R) CPU 1.80GHz (1799.14-MHz 686-class CPU)
Origin = "GenuineIntel" Id = 0xf13 Stepping = 3
Features=0x3febfbff<FPU,VME,DE,PSE,TSC,MSR,PAE,MCE,CX8,APIC,SEP,MTRR,PGE,MCA,CMOV,PAT,PSE36,CLFLUSH,DTS,ACPI,MMX,FXSR,SSE,SSE2,SS,HTT,TM>
real memory = 267583488 (255 MB)
avail memory = 252448768 (240 MB)
:
mount root from ufs:/dev/ad0s1a
WARNING: / was not properly dismounted
ppanic: bremfree: buffer not on a queue.
cpuid = 0
KDB: enter: panic
[thread pid 56 tid 100077 ]
Stopped at kdb_enter+0x2c: leave
db> where
Tracing pid 56 tid 100077 td 0xc1759a10
kdb_enter(c082b11c,104,c1759a10,c660dd58,2090022) at kdb_enter+0x2c
panic(c083217e,c660dd58,ce7698ec,c0657a87,c660dd58) at panic+0x190
bremfree(c660dd58,c08fecc8,ce7698c4,c06337a5,c08fec00) at bremfree+0x62
getblk(c1792000,5cb80,0,4000,0) at getblk+0x123
breadn(c1792000,5cb80,0,4000,0) at breadn+0x2e
bread(c1792000,5cb80,0,4000,0,ce769a24) at bread+0x20
softdep_setup_freeblocks(c2461604,0,0,800,c08ed570) at softdep_setup_freeblocks+0x20f
ffs_truncate(c1e1b9b4,0,0,800,c1515300,c1759a10) at ffs_truncate+0x1116
handle_workitem_remove(0,0,0,f2,0) at handle_workitem_remove+0xb7
process_worklist_item(41de1f13,0,0,c17b5564,ce769d00) at process_worklist_item+0x172
softdep_process_worklist(0,14d,41de1f13,1,0) at softdep_process_worklist+0x6a
sched_sync(0,ce769d48,0,c06646ac,0) at sched_sync+0x3b2
fork_exit(c06646ac,0,ce769d48) at fork_exit+0x7e
fork_trampoline() at fork_trampoline+0x8
--- trap 0x1, eip = 0, esp = 0xce769d7c, ebp = 0 ---
db> show alllocks
Process 5974 (thr1) thread 0xc2a82450 (100843)
exclusive sleep mutex vm object (standard object) r = 0 (0xc28114a4) locked @ vm/swap_pager.c:834
exclusive sleep mutex vm object (standard object) r = 0 (0xc2a098c4) locked @ vm/vm_object.c:479
exclusive sx user map r = 0 (0xc27b7bfc) locked @ vm/vm_map.c:2313
Process 5973 (thr1) thread 0xc2d458a0 (101121)
exclusive sx user map r = 0 (0xc27069a4) locked @ vm/vm_map.c:2313
db> show pcpu
cpuid = 0
curthread = 0xc1759a10: pid 56 "syncer"
curpcb = 0xce769da0
fpcurthread = none
idlethread = 0xc151f5c0: pid 11 "idle: cpu0"
APIC ID = 0
currentldt = 0x28
spin locks held:
db> where 5974
Tracing pid 5974 tid 100843 td 0xc2a82450
sched_switch(c2a82450,0,0) at sched_switch+0xeb
mi_switch(2,0,c08ecce0,8,c082c627) at mi_switch+0x1b1
critical_exit(c08ceec0,c2a82450,0,c2a82450,3f8) at critical_exit+0xa2
intr_execute_handlers(c08ceec0,cfa4aa1c,c2a82450,3f8,2580) at intr_execute_handlers+0xd0
atpic_handle_intr(0) at atpic_handle_intr+0x39
Xatpic_intr0() at Xatpic_intr0+0x20
--- interrupt, eip = 0xc0622339, esp = 0xcfa4aa60, ebp = 0xcfa4aa64 ---
critical_exit(c09560a0,0,c0848e2f,a23) at critical_exit+0x61
siocnputc(c08ca2c0,70,5,70,cfa4abb0) at siocnputc+0x82
cnputc(70,c062b674,c082b2ba,c0844f31,cfa4ab94) at cnputc+0x4c
putchar(70,cfa4abb0,c062ba1e,0,2062b86b) at putchar+0x96
kvprintf(c082b2b9,c062b674,cfa4abb0,a,cfa4abd0) at kvprintf+0x5f
printf(c082b2b9,c08ee1c0,c08ee1c0,100,c0844f31,cfa4ac04) at printf+0x43
panic(c0844f31,c28114a4,c28114a4,c2a098c4,c2b6794c) at panic+0xd8
vm_object_collapse(c2a098c4,c1c18000,c2bb0b6c,cfa4ac60,c076af7b) at vm_object_collapse+0x2ce
vm_object_deallocate(c1c18000,e,0,e,0) at vm_object_deallocate+0x270
vm_map_delete(c27b7bb8,0,bfc00000,c27b7bb8,0) at vm_map_delete+0x24f
vm_map_remove(c27b7bb8,0,bfc00000) at vm_map_remove+0x42
exit1(c2a82450,0,cfa4ad40,c07c0bf0,c2a82450) at exit1+0xb28
sysctl_kern_randompid(c2a82450,cfa4ad14,1,1,296) at sysctl_kern_randompid
syscall(2f,2f,2f,2804f6c0,0) at syscall+0x128
Xint0x80_syscall() at Xint0x80_syscall+0x1f
--- syscall (1, FreeBSD ELF32, sys_exit), eip = 0x280e3943, esp = 0xbfbfea7c, ebp = 0xbfbfea98 ---
db> call doadump
Dumping 255 MB
16 32 48 64 80 96 112 128 144 160 176 192 208 224 240
Dump complete
0x19
db> reset
1) panic: backing_object 0xc28114a4 was somehow re-referenced during collapse!
2) panic: bremfree: buffer not on a queue.
(kgdb) p *(vm_object_t)0xc2a098c4
$1 = {mtx = {mtx_object = {lo_class = 0xc088a1a4, lo_name = 0xc0844d02 "vm object", lo_type = 0xc0844cf2 "standard object",
lo_flags = 0x430000, lo_list = {tqe_next = 0xc2a09948, tqe_prev = 0xc2a09850}, lo_witness = 0xc08fec00}, mtx_lock = 0xc2a82450,
mtx_recurse = 0x0}, object_list = {tqe_next = 0xc26ed108, tqe_prev = 0xc28f4654}, shadow_head = {lh_first = 0x0}, shadow_list = {
le_next = 0x0, le_prev = 0xc260c134}, memq = {tqh_first = 0xc12f6af0, tqh_last = 0xc116ec38}, root = 0xc12f6af0, size = 0xe,
generation = 0xd, ref_count = 0x2, shadow_count = 0x0, type = 0x1, flags = 0x2180, pg_color = 0xe, paging_in_progress = 0x0,
resident_page_count = 0x4, backing_object = 0xc260c108, backing_object_offset = 0x0, pager_object_list = {tqe_next = 0x0,
tqe_prev = 0x0}, handle = 0x0, un_pager = {vnp = {vnp_size = 0x1}, devp = {devp_pglist = {tqh_first = 0x1, tqh_last = 0x0}}, swp = {
swp_bcount = 0x1}}}
(kgdb) p *(vm_object_t)0xc28114a4
$3 = {mtx = {mtx_object = {lo_class = 0xc088a1a4, lo_name = 0xc0844d02 "vm object", lo_type = 0xc0844cf2 "standard object",
lo_flags = 0x430000, lo_list = {tqe_next = 0xc2811528, tqe_prev = 0xc2811430}, lo_witness = 0xc08fec00}, mtx_lock = 0xc2a82450,
mtx_recurse = 0x0}, object_list = {tqe_next = 0xc1d597bc, tqe_prev = 0xc296fe10}, shadow_head = {lh_first = 0x0}, shadow_list = {
le_next = 0x0, le_prev = 0xc260c134}, memq = {tqh_first = 0x0, tqh_last = 0xc28114dc}, root = 0x0, size = 0xe, generation = 0x13,
ref_count = 0x2, shadow_count = 0x0, type = 0x0, flags = 0x188, pg_color = 0x15, paging_in_progress = 0x0, resident_page_count = 0x0,
backing_object = 0xc260c108, backing_object_offset = 0x0, pager_object_list = {tqe_next = 0x0, tqe_prev = 0x0}, handle = 0x0, un_pager = {
vnp = {vnp_size = 0x0}, devp = {devp_pglist = {tqh_first = 0x0, tqh_last = 0x0}}, swp = {swp_bcount = 0x0}}}
(kgdb) p *(vm_map_t)0xc27b7bb8
$5 = {header = {prev = 0xc1ae2ae4, next = 0xc2b6794c, left = 0x0, right = 0x0, start = 0x0, end = 0xbfc00000, avail_ssize = 0x0,
adj_free = 0x0, max_free = 0x0, object = {vm_object = 0x0, sub_map = 0x0}, offset = 0x0, eflags = 0x0, protection = 0x0,
max_protection = 0x0, inheritance = 0x0, wired_count = 0x0, lastr = 0x0}, lock = {sx_object = {lo_class = 0xc088b58c,
lo_name = 0xc084437f "user map", lo_type = 0xc084437f "user map", lo_flags = 0x3b0000, lo_list = {tqe_next = 0xc27b7c78,
tqe_prev = 0xc27b7c4c}, lo_witness = 0xc08feb88}, sx_lock = 0xc08eced4, sx_cnt = 0xffffffff, sx_shrd_cv = {
cv_description = 0xc084437f "user map", cv_waiters = 0x0}, sx_shrd_wcnt = 0x0, sx_excl_cv = {cv_description = 0xc084437f "user map",
cv_waiters = 0x0}, sx_excl_wcnt = 0x0, sx_xholder = 0xc2a82450}, system_mtx = {mtx_object = {lo_class = 0xc088a1a4,
lo_name = 0xc0843f55 "system map", lo_type = 0xc0843f55 "system map", lo_flags = 0x430000, lo_list = {tqe_next = 0xc27b7bfc,
tqe_prev = 0xc27b7b5c}, lo_witness = 0xc08febb0}, mtx_lock = 0x4, mtx_recurse = 0x0}, nentries = 0x113, size = 0x1496000,
timestamp = 0xcee, needs_wakeup = 0x0, system_map = 0x0, flags = 0x0, root = 0xc2b6794c, pmap = 0xc27b7c78}