Bug 1029646

Description of problem:
Qemu guest crashes when resolution is changed on the guest with using xrandr repeatedly - three tries within 3 seconds are enough to crash the qemu in spice-server.

Version-Release number of selected component (if applicable):
All (client/host/guest) RHEL7 PreBeta
# rpm -qa | egrep "qemu|kernel|spice"libvirt-daemon-driver-qemu-1.1.1-11.el7.x86_64
qemu-img-1.5.3-19.el7.x86_64
kernel-3.10.0-42.el7.x86_64
qemu-guest-agent-1.5.3-17.el7.x86_64
qemu-kvm-common-1.5.3-19.el7.x86_64
spice-server-0.12.4-3.el7.x86_64
spice-glib-0.20-6.el7.x86_64
qemu-kvm-debuginfo-1.5.3-19.el7.x86_64
spice-debuginfo-0.12.4-3.el7.x86_64
qemu-kvm-1.5.3-19.el7.x86_64
spice-vdagent-0.14.0-5.el7.x86_64
kernel-3.10.0-44.el7.x86_64
spice-gtk3-0.20-6.el7.x86_64

How reproducible:
Always

Steps to Reproduce:
1. Start RHEL7 guest on RHEL7 host and connect to it with remote-viewer.
2. Change resolution in loop, i.e.:
for ((i=0;$i<2000;i++)); do echo ${i}; if [ "x$((i%3))" == "x0" ]; then MODE="1280x800"; elif [ "x$((i%3))" == "x1" ]; then MODE="1440x900"; else MODE="1680x1050"; fi ; xrandr --output Virtual-0 --mode "${MODE}" 2> /dev/null; sleep 1; done
3.

Actual results:
Segmentation fault received in qemu-kvm process

Expected results:


Additional info:
Bt from qemu-kvm process
Program received signal SIGSEGV, Segmentation fault.
[Switching to Thread 0x7faf08dff700 (LWP 6820)]
0x00007faf1369dfcb in __memset_sse2 () from /lib64/libc.so.6
(gdb) thread apply all bt

Thread 4 (Thread 0x7faf0b457700 (LWP 6925)):
#0  0x00007faf165caab3 in pread64 () from /lib64/libpthread.so.0
#1  0x00007faf1864e47b in pread (__offset=<optimized out>, __nbytes=<optimized out>, 
    __buf=0x7faedf34a000, __fd=<optimized out>) at /usr/include/bits/unistd.h:99
#2  handle_aiocb_rw_linear (aiocb=0x7faf19c1e400, buf=0x7faedf34a000 "GVariant")
    at block/raw-posix.c:588
#3  0x00007faf1864e6ba in handle_aiocb_rw (aiocb=<optimized out>) at block/raw-posix.c:618
#4  0x00007faf1864f09d in aio_worker (arg=0x7faf19c1e400) at block/raw-posix.c:751
#5  0x00007faf1875ab6b in worker_thread (opaque=0x7faf19a84c00) at thread-pool.c:109
#6  0x00007faf165c3de3 in start_thread () from /lib64/libpthread.so.0
#7  0x00007faf1370a1ad in clone () from /lib64/libc.so.6

Thread 3 (Thread 0x7faf0aa55700 (LWP 6819)):
#0  0x00007faf13701297 in ioctl () from /lib64/libc.so.6
#1  0x00007faf187d8aa5 in kvm_vcpu_ioctl (cpu=cpu@entry=0x7faf19becbe0, 
    type=type@entry=44672) at /usr/src/debug/qemu-1.5.3/kvm-all.c:1744
#2  0x00007faf187d8bdc in kvm_cpu_exec (env=env@entry=0x7faf19beccf0)
    at /usr/src/debug/qemu-1.5.3/kvm-all.c:1629
#3  0x00007faf18784225 in qemu_kvm_cpu_thread_fn (arg=0x7faf19beccf0)
    at /usr/src/debug/qemu-1.5.3/cpus.c:793
#4  0x00007faf165c3de3 in start_thread () from /lib64/libpthread.so.0
#5  0x00007faf1370a1ad in clone () from /lib64/libc.so.6

Thread 2 (Thread 0x7faf08dff700 (LWP 6820)):
#0  0x00007faf1369dfcb in __memset_sse2 () from /lib64/libc.so.6
#1  0x00007faf143d91e5 in memset (__len=5184000, __ch=0, __dest=<optimized out>)
    at /usr/include/bits/string3.h:84
#2  red_create_surface (send_client=1, data_is_valid=0, line_0=<optimized out>, format=32, 
    stride=5760, height=900, width=1440, surface_id=5, worker=0x7faeb00008c0)
    at red_worker.c:9659
#3  red_process_surface (loadvm=0, group_id=1, surface=0x7faeb02421e0, 
    worker=0x7faeb00008c0) at red_worker.c:4288
#4  red_process_commands (worker=worker@entry=0x7faeb00008c0, 
    ring_is_empty=ring_is_empty@entry=0x7faf08dfebf0, max_pipe_size=50)
    at red_worker.c:5243
#5  0x00007faf143de30a in red_worker_main (arg=<optimized out>) at red_worker.c:12292
#6  0x00007faf165c3de3 in start_thread () from /lib64/libpthread.so.0
#7  0x00007faf1370a1ad in clone () from /lib64/libc.so.6

Thread 1 (Thread 0x7faf18532a00 (LWP 6816)):
#0  0x00007faf136ffbdd in poll () from /lib64/libc.so.6
#1  0x00007faf17a66d57 in poll (__timeout=<optimized out>, __nfds=<optimized out>, 
    __fds=<optimized out>) at /usr/include/bits/poll2.h:46
#2  g_poll (fds=<optimized out>, nfds=<optimized out>, timeout=<optimized out>)
---Type <return> to continue, or q <return> to quit---
    at gpoll.c:132
#3  0x00007faf1870ef86 in os_host_main_loop_wait (timeout=<optimized out>)
    at main-loop.c:226
#4  main_loop_wait (nonblocking=<optimized out>) at main-loop.c:464
#5  0x00007faf18618488 in main_loop () at vl.c:1986
#6  main (argc=<optimized out>, argv=<optimized out>, envp=<optimized out>) at vl.c:4343