Fix dereference after NULL check.

CID:		1234607
Sponsored by:	Nginx, Inc.


git-svn-id: svn+ssh://svn.freebsd.org/base/head@270999 ccf9f872-aa2e-dd11-9fc8-001c23d0bc1f
Right now, thread_single(SINGLE_EXIT) returns after the p_numthreads
reaches 1. The p_numthreads counter is decremented in thread_exit() by
a call to thread_unlink(). This means that the exiting threads may
still execute on other CPUs when thread_single(SINGLE_EXIT) returns.
As result, vmspace could be destroyed while paging structures are
still used on other CPUs by exiting threads.

Delay the return from thread_single(SINGLE_EXIT) until all threads are
really destroyed by thread_stash() after the last switch out. The
p_exitthreads counter already provides the required mechanism, move
the wait from the thread_wait() (which is called from wait(2) code)
into thread_single().

Reported by:	many (as "panic: pmap active <addr>")
Reviewed by:	alc, jhb
Tested by:	pho
Sponsored by:	The FreeBSD Foundation
MFC after:	1 week


git-svn-id: svn+ssh://svn.freebsd.org/base/head@271000 ccf9f872-aa2e-dd11-9fc8-001c23d0bc1f