qom: object_delete should unparent the object first

object_deinit is only called when the reference count goes to zero,
and yet tries to do an object_unparent.  Now, object_unparent
either does nothing or it will decrease the reference count.
Because we know the reference count is zero, the object_unparent
call in object_deinit is useless.

Instead, we need to disconnect the object from its parent just
before we remove the last reference apart from the parent's.  This
happens in object_delete.  Once we do this, all calls to
object_unparent peppered through QEMU can go away.

Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>
(cherry picked from commit da5a44e8b0b727681fc33e8d94832d1cae48a788)

Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>

diff --git a/hw/acpi_piix4.c b/hw/acpi_piix4.c
index 0345490ee095d0184954b8a462eaf3e96fdf36cf..585da4e3eb937ee4583c40c72102da1a42dcc265 100644 (file)
--- a/hw/acpi_piix4.c
+++ b/hw/acpi_piix4.c
@@ -299,7 +299,6 @@ static void acpi_piix_eject_slot(PIIX4PMState *s, unsigned slots)
             if (pc->no_hotplug) {
                 slot_free = false;
             } else {
-                object_unparent(OBJECT(dev));
                 qdev_free(qdev);
             }
         }

diff --git a/hw/qdev.c b/hw/qdev.c
index 8e8ca3ff9af1619ec8ae27dd4cf1dc3559bc837b..37c72c559659c5c686021c95b249ee6a3aa06ab4 100644 (file)
--- a/hw/qdev.c
+++ b/hw/qdev.c
@@ -150,7 +150,6 @@ int qdev_init(DeviceState *dev)
 
     rc = dc->init(dev);
     if (rc < 0) {
-        object_unparent(OBJECT(dev));
         qdev_free(dev);
         return rc;
     }
@@ -241,7 +240,6 @@ void qbus_reset_all_fn(void *opaque)
 int qdev_simple_unplug_cb(DeviceState *dev)
 {
     /* just zap it */
-    object_unparent(OBJECT(dev));
     qdev_free(dev);
     return 0;
 }

diff --git a/hw/xen_platform.c b/hw/xen_platform.c
index 0214f370b219b231eff2c5cc69f298a18aff8d63..84221df1c8003a4f4ddbf5b53efb5774cc298030 100644 (file)
--- a/hw/xen_platform.c
+++ b/hw/xen_platform.c
@@ -87,9 +87,6 @@ static void unplug_nic(PCIBus *b, PCIDevice *d)
 {
     if (pci_get_word(d->config + PCI_CLASS_DEVICE) ==
             PCI_CLASS_NETWORK_ETHERNET) {
-        /* Until qdev_free includes a call to object_unparent, we call it here
-         */
-        object_unparent(&d->qdev.parent_obj);
         qdev_free(&d->qdev);
     }
 }

diff --git a/qom/object.c b/qom/object.c
index 6f839ad8c950a6dd2b6e75adc3704545660a72b3..58dd8862e4dcb45ee3d835f6629be0a85c1b27df 100644 (file)
--- a/qom/object.c
+++ b/qom/object.c
@@ -347,8 +347,6 @@ static void object_deinit(Object *obj, TypeImpl *type)
     if (type_has_parent(type)) {
         object_deinit(obj, type_get_parent(type));
     }
-
-    object_unparent(obj);
 }
 
 void object_finalize(void *data)
@@ -385,8 +383,9 @@ Object *object_new(const char *typename)
 
 void object_delete(Object *obj)
 {
+    object_unparent(obj);
+    g_assert(obj->ref == 1);
     object_unref(obj);
-    g_assert(obj->ref == 0);
     g_free(obj);
 }