PANIC: destroying a slab which isn't empty by 'low resource manager'

[kallisti5]

Gcc2 hybrid, hrev36995. 1G memory, freshly rebooted.

Seems to occur on low memory situations... Here is what I was doing when it occured...

Set Background to very large image scaled. (3000x3000+)

Open the background in Wonderbrush, resize the image to 1024x768. (40% memory used now)

save it.

Attempt to change wallpaper, crash.

[kallisti5]

trace of crash

[bonefish]

The slab comes straight out of the cache's empty slab list and the cache is locked at that point. Looks like a structural corruption. The size == count predicate which fails here is also used for adding a slab to the list and count is only decremented after removing the slab from the list (when allocating an object). I don't see locking problems, since slabs are always handled with the cache locked. A double free could cause such a problem; count would become greater than size in this case. A memory dump of the slab structure would have been interesting (dw <slab> 16), information on the cache maybe, too (slab_cache <cache>).

[nielx]

Remove milestone for tickets with status = closed and resolution != fixed