runtime: fix non-in-use span check

Lazy mcache flushing (golang.org/cl/134783) introduced a second value
for sweepgen that indicates a span has been swept. I missed adding
this case to a sanity check in sweepone, so it can now panic if it
finds a non-in-use spans that's been swept *and* put in an mcache.

Fix this by adding the second sweepgen case to this check.

Fixes #27997.

Change-Id: I568d9f2cc8923396ca897a37d154cd2c859c7bef
Reviewed-on: https://go-review.googlesource.com/c/140697
Run-TryBot: Austin Clements <austin@google.com>
TryBot-Result: Gobot Gobot <gobot@golang.org>
Reviewed-by: Brad Fitzpatrick <bradfitz@golang.org>

src/runtime/mgcsweep.go

@@ -101,7 +101,7 @@ func sweepone() uintptr {
 			// This can happen if direct sweeping already
 			// swept this span, but in that case the sweep
 			// generation should always be up-to-date.
-			if s.sweepgen != sg {
+			if !(s.sweepgen == sg || s.sweepgen == sg+3) {
 				print("runtime: bad span s.state=", s.state, " s.sweepgen=", s.sweepgen, " sweepgen=", sg, "\n")
 				throw("non in-use span in unswept list")
 			}