9.2PRERELEASE ZFS panic in lzjb_compress

[olivier]

Hi,
Running 9.2-PRERELEASE #19 r253313 I got the following panic

Fatal trap 12: page fault while in kernel mode
cpuid = 22; apic id = 46
fault virtual address   = 0xffffff827ebca30c
fault code              = supervisor read data, page not present
instruction pointer     = 0x20:0xffffffff81983055
stack pointer           = 0x28:0xffffffcf75bd60a0
frame pointer           = 0x28:0xffffffcf75bd68f0
code segment            = base 0x0, limit 0xfffff, type 0x1b
                        = DPL 0, pres 1, long 1, def32 0, gran 1
processor eflags        = interrupt enabled, resume, IOPL = 0
current process         = 0 (zio_write_issue_hig)
trap number             = 12
panic: page fault
cpuid = 22
KDB: stack backtrace:
db_trace_self_wrapper() at db_trace_self_wrapper+0x2a/frame
0xffffffcf75bd5b30
kdb_backtrace() at kdb_backtrace+0x37/frame 0xffffffcf75bd5bf0
panic() at panic+0x1ce/frame 0xffffffcf75bd5cf0
trap_fatal() at trap_fatal+0x290/frame 0xffffffcf75bd5d50
trap_pfault() at trap_pfault+0x211/frame 0xffffffcf75bd5de0
trap() at trap+0x344/frame 0xffffffcf75bd5fe0
calltrap() at calltrap+0x8/frame 0xffffffcf75bd5fe0
--- trap 0xc, rip = 0xffffffff81983055, rsp = 0xffffffcf75bd60a0, rbp =
0xffffffcf75bd68f0 ---
lzjb_compress() at lzjb_compress+0x185/frame 0xffffffcf75bd68f0
zio_compress_data() at zio_compress_data+0x92/frame 0xffffffcf75bd6920
zio_write_bp_init() at zio_write_bp_init+0x24b/frame 0xffffffcf75bd6970
zio_execute() at zio_execute+0xc3/frame 0xffffffcf75bd69b0
taskqueue_run_locked() at taskqueue_run_locked+0x74/frame 0xffffffcf75bd6a00
taskqueue_thread_loop() at taskqueue_thread_loop+0x46/frame
0xffffffcf75bd6a20
fork_exit() at fork_exit+0x11f/frame 0xffffffcf75bd6a70
fork_trampoline() at fork_trampoline+0xe/frame 0xffffffcf75bd6a70
--- trap 0, rip = 0, rsp = 0xffffffcf75bd6b30, rbp = 0 ---

lzjb_compress+0x185 corresponds to line 85 in
80 cpy = src - offset;
81 if (cpy >= (uchar_t *)s_start && cpy != src &&
82    src[0] == cpy[0] && src[1] == cpy[1] && src[2] == cpy[2]) {
83 *copymap |= copymask;
84 for (mlen = MATCH_MIN; mlen < MATCH_MAX; mlen++)
85 if (src[mlen] != cpy[mlen])
86 break;
87 *dst++ = ((mlen - MATCH_MIN) << (NBBY - MATCH_BITS)) |
88    (offset >> NBBY);
89 *dst++ = (uchar_t)offset;

I think it's the first time I've seen this panic. It happened while doing a
send/receive. I have two pools with lzjb compression; I don't know which of
these pools caused the problem, but one of them was the source of the
send/receive.

I only have a textdump but I'm happy to try to provide more information
that could help anyone look into this.
Thanks
Olivier