Index: sys/vm/vm_map.c
===================================================================
--- sys/vm/vm_map.c
+++ sys/vm/vm_map.c
@@ -917,36 +917,46 @@
 	entry->max_free = MAX(max_left, max_right);
 }
 
-#define SPLAY_LEFT_STEP(root, y, rlist, test) do {	\
-	y = root->left;					\
-	if (y != NULL && (test)) {			\
-		/* Rotate right and make y root. */	\
-		root->left = y->right;			\
-		y->right = root;			\
-		vm_map_entry_set_max_free(root);	\
-		root = y;				\
-		y = root->left;				\
-	}						\
-	/* Put root on rlist. */			\
-	root->left = rlist;				\
-	rlist = root;					\
-	root = y;					\
+#define SPLAY_LEFT_STEP(root, y, rlist, test) do {			\
+	y = root->left;							\
+	if (y != NULL && (test)) {					\
+		/* Rotate right and make y root. */			\
+		root->left = y->right;					\
+		y->right = root;					\
+		if (root->max_free == y->max_free)			\
+			vm_map_entry_set_max_free(root);		\
+		root = y;						\
+		y = root->left;						\
+	}								\
+	/* Put root on rlist. */					\
+	root->left = rlist;						\
+	rlist = root;							\
+	root = y;							\
+	/* Make rlist->max_free match max_free for its right child. */	\
+	y = rlist->right;						\
+	rlist->max_free = (y != NULL) ?					\
+	    y->max_free : rlist->next->start - rlist->end;		\
 } while (0)
 
-#define SPLAY_RIGHT_STEP(root, y, llist, test) do {	\
-	y = root->right;				\
-	if (y != NULL && (test)) {			\
-		/* Rotate left and make y root. */	\
-		root->right = y->left;			\
-		y->left = root;				\
-		vm_map_entry_set_max_free(root);	\
-		root = y;				\
-		y = root->right;			\
-	}						\
-	/* Put root on llist. */			\
-	root->right = llist;				\
-	llist = root;					\
-	root = y;					\
+#define SPLAY_RIGHT_STEP(root, y, llist, test) do {			\
+	y = root->right;						\
+	if (y != NULL && (test)) {					\
+		/* Rotate left and make y root. */			\
+		root->right = y->left;					\
+		y->left = root;						\
+		if (root->max_free == y->max_free)			\
+			vm_map_entry_set_max_free(root);		\
+		root = y;						\
+		y = root->right;					\
+	}								\
+	/* Put root on llist. */					\
+	root->right = llist;						\
+	llist = root;							\
+	root = y;							\
+	/* Make llist->max_free match max_free for its left child. */	\
+	y = llist->left;						\
+	llist->max_free = (y != NULL) ?					\
+	    y->max_free : llist->start - llist->prev->end;		\
 } while (0)
 
 /*
@@ -1015,18 +1025,31 @@
     vm_map_entry_t ltree, vm_map_entry_t rtree)
 {
 	vm_map_entry_t y;
+	vm_size_t max_free;
 
+	if (llist != NULL)
+		max_free = (ltree != NULL) ? ltree->max_free :
+		    llist->next->start - llist->end;
 	while (llist != NULL) {
 		y = llist->right;
 		llist->right = ltree;
-		vm_map_entry_set_max_free(llist);
+		if (llist->max_free < max_free)
+			llist->max_free = max_free;
+		else
+			max_free = llist->max_free;
 		ltree = llist;
 		llist = y;
 	}
+	if (rlist != NULL)
+		max_free = (rtree != NULL) ? rtree->max_free :
+		    rlist->start - rlist->prev->end;
 	while (rlist != NULL) {
 		y = rlist->left;
 		rlist->left = rtree;
-		vm_map_entry_set_max_free(rlist);
+		if (rlist->max_free < max_free)
+			rlist->max_free = max_free;
+		else
+			max_free = rlist->max_free;
 		rtree = rlist;
 		rlist = y;
 	}
@@ -1105,6 +1128,7 @@
 	    "vm_map_entry_link: map %p, nentries %d, entry %p", map,
 	    map->nentries, entry);
 	VM_MAP_ASSERT_LOCKED(map);
+//	VM_MAP_ASSERT_CONSISTENT(map);
 	map->nentries++;
 	root = map->root;
 	root = vm_map_splay_split(entry->start, 0, root, &llist, &rlist);
@@ -1132,10 +1156,6 @@
 	vm_map_entry_t llist, rlist, root, y;
 
 	VM_MAP_ASSERT_LOCKED(map);
-	llist = entry->prev;
-	rlist = entry->next;
-	llist->next = rlist;
-	rlist->prev = llist;
 	root = map->root;
 	root = vm_map_splay_split(entry->start, 0, root, &llist, &rlist);
 	KASSERT(root != NULL,
@@ -1174,6 +1194,9 @@
 			root = NULL;
 		break;
 	}
+	y = entry->next;
+	y->prev = entry->prev;
+	y->prev->next = y;
 	if (root != NULL)
 		root = vm_map_splay_merge(root, llist, rlist,
 		    root->left, root->right);
@@ -1187,15 +1210,16 @@
 /*
  *	vm_map_entry_resize_free:
  *
- *	Recompute the amount of free space following a modified vm_map_entry
- *	and propagate those values up the tree.  Call this function after
- *	resizing a map entry in-place by changing the end value, without a
+ *	Recompute the amount of free space around a modified vm_map_entry and
+ *	propagate those values up the tree.  Call this function to resizing a
+ *	map entry in-place by changing the start and end values, without a
  *	call to vm_map_entry_link() or _unlink().
  *
  *	The map must be locked, and leaves it so.
  */
 static void
-vm_map_entry_resize_free(vm_map_t map, vm_map_entry_t entry)
+vm_map_entry_resize_free(vm_map_t map, vm_map_entry_t entry,
+    vm_offset_t start, vm_map_offset end)
 {
 	vm_map_entry_t llist, rlist, root;
 
@@ -1204,8 +1228,16 @@
 	root = vm_map_splay_split(entry->start, 0, root, &llist, &rlist);
 	KASSERT(root != NULL,
 	    ("vm_map_entry_resize_free: resize_free object not mapped"));
-	vm_map_splay_findnext(root, &rlist);
-	root->right = NULL;
+	if (entry->start != start) {
+		vm_map_splay_findprev(root, &llist);
+		root->left = NULL;
+		entry->start = start;
+	}
+	if (entry->end != end) {
+		vm_map_splay_findnext(root, &rlist);
+		root->right = NULL;
+		entry->end = end;
+	}
 	map->root = vm_map_splay_merge(root, llist, rlist,
 	    root->left, root->right);
 	VM_MAP_ASSERT_CONSISTENT(map);
@@ -1253,6 +1285,7 @@
 		 * change the map.  Thus, the map's timestamp need not change
 		 * on a temporary upgrade.
 		 */
+		VM_MAP_ASSERT_CONSISTENT(map);
 		map->root = cur = vm_map_entry_splay(address, cur);
 		VM_MAP_ASSERT_CONSISTENT(map);
 		if (!locked)
@@ -1427,8 +1460,8 @@
 			    prev_entry));
 			if ((prev_entry->eflags & MAP_ENTRY_GUARD) == 0)
 				map->size += end - prev_entry->end;
-			prev_entry->end = end;
-			vm_map_entry_resize_free(map, prev_entry);
+			vm_map_entry_resize_free(map, prev_entry,
+			    prev_entry->start, end);
 			vm_map_simplify_entry(map, prev_entry);
 			return (KERN_SUCCESS);
 		}
@@ -2069,7 +2102,7 @@
 
 	new_entry->end = start;
 	entry->offset += (start - entry->start);
-	entry->start = start;
+	vm_map_entry_resize_free(map, entry, start, entry->end);
 	if (new_entry->cred != NULL)
 		crhold(entry->cred);
 
@@ -2150,7 +2183,8 @@
 	new_entry = vm_map_entry_create(map);
 	*new_entry = *entry;
 
-	new_entry->start = entry->end = end;
+	vm_map_entry_resize_free(map, entry, entry->start, end);
+	new_entry->start = end;
 	new_entry->offset += (end - entry->start);
 	if (new_entry->cred != NULL)
 		crhold(entry->cred);
@@ -4181,25 +4215,22 @@
 			gap_deleted = true;
 		} else {
 			MPASS(gap_entry->start < gap_entry->end - grow_amount);
-			gap_entry->end -= grow_amount;
-			vm_map_entry_resize_free(map, gap_entry);
+			vm_map_entry_resize_free(map, gap_entry,
+			     gap_entry->start, gap_entry->end - grow_amount);
 			gap_deleted = false;
 		}
 		rv = vm_map_insert(map, NULL, 0, grow_start,
 		    grow_start + grow_amount,
 		    stack_entry->protection, stack_entry->max_protection,
 		    MAP_STACK_GROWS_DOWN);
-		if (rv != KERN_SUCCESS) {
-			if (gap_deleted) {
-				rv1 = vm_map_insert(map, NULL, 0, gap_start,
-				    gap_end, VM_PROT_NONE, VM_PROT_NONE,
-				    MAP_CREATE_GUARD | MAP_CREATE_STACK_GAP_DN);
-				MPASS(rv1 == KERN_SUCCESS);
-			} else {
-				gap_entry->end += grow_amount;
-				vm_map_entry_resize_free(map, gap_entry);
-			}
-		}
+		if (rv != KERN_SUCCESS && gap_deleted) {
+			rv1 = vm_map_insert(map, NULL, 0, gap_start,
+			    gap_end, VM_PROT_NONE, VM_PROT_NONE,
+			    MAP_CREATE_GUARD | MAP_CREATE_STACK_GAP_DN);
+			MPASS(rv1 == KERN_SUCCESS);
+		} else if (rv != KERN_SUCCESS)
+			vm_map_entry_resize_free(map, gap_entry,
+			    gap_entry->start, gap_entry->end + grow_amount);
 	} else {
 		grow_start = stack_entry->end;
 		cred = stack_entry->cred;
@@ -4213,13 +4244,16 @@
 		    stack_entry->offset,
 		    (vm_size_t)(stack_entry->end - stack_entry->start),
 		    (vm_size_t)grow_amount, cred != NULL)) {
-			if (gap_entry->start + grow_amount == gap_entry->end)
+			if (gap_entry->start + grow_amount == gap_entry->end) {
 				vm_map_entry_delete(map, gap_entry);
-			else
+				vm_map_entry_resize_free(map, stack_entry,
+				    stack_entry->start,
+				    stack_entry->end + grow_amount);
+			} else {
 				gap_entry->start += grow_amount;
-			stack_entry->end += grow_amount;
+				stack_entry->end += grow_amount;
+			}
 			map->size += grow_amount;
-			vm_map_entry_resize_free(map, stack_entry);
 			rv = KERN_SUCCESS;
 		} else
 			rv = KERN_FAILURE;