Freeing page with rmap entries (random kernel crash)

This sometimes happens when browsing in FF2. See also old CORE-1775.

(ntoskrnl/mm/freelist.c:596) Freeing page with rmap entries.

<NTOSKRNL.EXE:9611 (ntoskrnl/ke/bug.c:1402 (KeBugCheck@4))>
<NTOSKRNL.EXE:b43d0 (ntoskrnl/mm/freelist.c:607 (MmDereferencePage@4))>
<NTOSKRNL.EXE:b0da0 (ntoskrnl/mm/balance.c:121 (MmReleasePageMemoryConsumer@8))>
<NTOSKRNL.EXE:ad0e8 (ntoskrnl/mm/anonmem.c:855 (MmFreeVirtualMemoryPage))>
<NTOSKRNL.EXE:b5c38 (ntoskrnl/mm/marea.c:748 (MmFreeMemoryArea@16))>
<NTOSKRNL.EXE:ad70a (ntoskrnl/mm/anonmem.c:918 (MmFreeVirtualMemory@8))>
<NTOSKRNL.EXE:adbdb (ntoskrnl/mm/anonmem.c:998 (NtFreeVirtualMemory@16))>
<NTOSKRNL.EXE:108014 (ntoskrnl/ke/i386/trap.s:244 (KiFastCallEntry))>
<NTOSKRNL.EXE:10c8a5 (/home/build/reactos-build/obj/ntoskrnl/ex/zw.S:803 (ZwFreeVirtualMemory))>
<win32k.sys:4dc38 (subsystems/win32/win32k/eng/surface.c:124 (SURFACE_Cleanup@4))>
<win32k.sys:cd580 (subsystems/win32/win32k/objects/gdiobj.c:567 (GDIOBJ_FreeObjByHandle@8))>
<win32k.sys:cdd04 (subsystems/win32/win32k/objects/gdiobj.c:670 (@GreDeleteObject@4))>
<win32k.sys:b1c8c (subsystems/win32/win32k/objects/dclife.c:675 (NtGdiDeleteObjectApp@4))>