Re: [Qemu-devel] [PATCH 1.3 1/5] qom: fix refcount of non-heap-allocated objects

[Anthony Liguori <aliguori@us.ibm.com>]

Paolo Bonzini <pbonzini@redhat.com> writes:

> The reference count for embedded objects is always one too low, because
> object_initialize_with_type returns with zero references to the object.
> This causes premature finalization of the object (or an assertion failure)
> after calling object_ref to add an extra reference and object_unref to
> remove it.
>
> The fix is to move the initial object_ref call from object_new_with_type
> to object_initialize_with_type.
>
> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
> ---
>  qom/object.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/qom/object.c b/qom/object.c
> index d7092b0..6a8c02a 100644
> --- a/qom/object.c
> +++ b/qom/object.c
> @@ -307,6 +307,7 @@ void object_initialize_with_type(void *data, TypeImpl *type)
>  
>      memset(obj, 0, type->instance_size);
>      obj->class = type->class;
> +    object_ref(obj);
>      QTAILQ_INIT(&obj->properties);
>      object_init_with_type(obj, type);
>  }

But object_property_add_child() will take a reference.

When the parent object goes away, this will cause that reference to get
dropped and ultimately the child object to be destroyed.

IOW, this change causes embedded objects to get leaked AFAICT.

Regards,

Anthony Liguori

> @@ -395,7 +396,6 @@ Object *object_new_with_type(Type type)
>  
>      obj = g_malloc(type->instance_size);
>      object_initialize_with_type(obj, type);
> -    object_ref(obj);
>  
>      return obj;
>  }
> -- 
> 1.8.0