panic: assertion: leaf->base.obj_id == ip->obj_id in hammer_ip_delete_range

[YONETANI Tomokazu]

On Wed, Oct 21, 2009 at 10:36:36AM -0700, Matthew Dillon wrote:
> 	fetch http://apollo.backplane.com/DFlyMisc/hammer05.patch
> 
>     It survived my bulk build tests so now the question is whether it
>     will survive yours.

It survived 7.5 hours before crashing in a different place.
The kernel and the vmcore are at ~y0etan1/crash/{kernel,vmcore}.10.

panic: assertion: s <= 0 in hammer_btree_iterate
mp_lock = 00000000; cpuid = 0
boot() called on cpu#0
Uptime: 7h24m33s

(kgdb) bt
#0  _get_mycpu () at ./machine/thread.h:83
#1  dumpsys () at /usr/src/sys/kern/kern_shutdown.c:657
#2  0xc01a0cbd in boot (howto=260) at /usr/src/sys/kern/kern_shutdown.c:378
#3  0xc01a0f82 in panic (fmt=0xc02ff03e "assertion: %s in %s")
    at /usr/src/sys/kern/kern_shutdown.c:813
#4  0xc02719d5 in hammer_btree_iterate (cursor=0xd88b4c9c)
    at /usr/src/sys/vfs/hammer/hammer_btree.c:240
#5  0xc02804eb in hammer_ip_next (cursor=0xd88b4c9c)
    at /usr/src/sys/vfs/hammer/hammer_object.c:1589
#6  0xc0281ed3 in hammer_ip_delete_range (cursor=0xd88b4c9c, ip=0xe310bc50,
    ran_beg=0, ran_end=9223372036854775807, truncating=2)
    at /usr/src/sys/vfs/hammer/hammer_object.c:2022
#7  0xc0278a63 in hammer_sync_inode (trans=0xd818a114, ip=0xe310bc50)
    at /usr/src/sys/vfs/hammer/hammer_inode.c:2714
#8  0xc0276bdb in hammer_flusher_flush_inode (arg=0xd6e78510)
    at /usr/src/sys/vfs/hammer/hammer_flusher.c:496
#9  hammer_flusher_slave_thread (arg=0xd6e78510)
    at /usr/src/sys/vfs/hammer/hammer_flusher.c:440
#10 0xc01a985e in lwkt_deschedule_self (td=Cannot access memory at address 0x8
)
    at /usr/src/sys/kern/lwkt_thread.c:271
Backtrace stopped: previous frame inner to this frame (corrupt stack?)
(kgdb) fr 4
#4  0xc02719d5 in hammer_btree_iterate (cursor=0xd88b4c9c)
    at /usr/src/sys/vfs/hammer/hammer_btree.c:240
240                             KKASSERT(s <= 0);
(kgdb) list
235                             if (r == 0 && (cursor->flags &
236                                            HAMMER_CURSOR_END_INCLUSIVE) == 0) {
237                                     error = ENOENT;
238                                     break;
239                             }
240                             KKASSERT(s <= 0);
241
242                             /*
243                              * Better not be zero
244                              */
(kgdb) p s
$1 = 4