Bug 888677

Description of problem:
Boot a guest, then hotadd virtio-serial-pci device, then hot-unplug this device. The qemu-kvm process quit with core dump

Version-Release number of selected component (if applicable):
Host Kernel
#uname -r
3.6.0-0.29.el7.x86_64
qemu-kvm version
qemu-kvm-1.2.0-20.el7.x86_64

How reproducible:
100%

Steps to Reproduce:
1.Boot guest
#/usr/libexec/qemu-kvm -cpu Opteron_G3 -m 2048 -smp 2,sockets=1,cores=2,threads=1 -enable-kvm -name rhel64 -smbios type=1,manufacturer='Red Hat',product='RHEV Hypervisor',version=el6,serial=koTUXQrb,uuid=feebc8fd-f8b0-4e75-abc3-e63fcdb67171 -k en-us -rtc base=localtime,clock=host,driftfix=slew  -monitor stdio -qmp tcp:0:5555,server,nowait -boot menu=on -bios /usr/share/seabios/bios.bin -drive file=/home/rhel6u4_mazhang.qcow2,if=none,id=drive-scsi-disk,format=qcow2,cache=none,werror=stop,rerror=stop -device virtio-scsi-pci,id=scsi0,addr=0x5 -device scsi-disk,drive=drive-scsi-disk,bus=scsi0.0,scsi-id=0,lun=0,id=scsi-disk,bootindex=1 -netdev tap,id=hostnet0,downscript=no -device e1000,netdev=hostnet0,id=net0,mac=00:1a:4a:2e:28:1b,bus=pci.0,addr=0x4,bootindex=2 -chardev socket,path=/tmp/isa-serial1,server,nowait,id=isa1 -device isa-serial,chardev=isa1,id=isa-serial1 -vnc :9  -drive file=/root/zhangjunyi/virtio_12G.qcow2,format=qcow2,if=none,id=ide1,cache=none,werror=stop,rerror=stop  -device ide-drive,drive=ide1,id=ide2 -device sga
2. Hot add a virtio-serial-pci
(qemu) device_add virtio-serial-pci,id=virtio_serial_pci1
3.Hot remove this device
(qemu) device_del virtio_serial_pci1
  
Actual results:
qemu-kvm process quit with core dump
(gdb) bt
#0  0x00007ffff2d7aba5 in raise () from /lib64/libc.so.6
#1  0x00007ffff2d7c358 in abort () from /lib64/libc.so.6
#2  0x00007ffff7718b37 in g_assertion_message () from /lib64/libglib-2.0.so.0
#3  0x00007ffff7719054 in g_assertion_message_expr () from /lib64/libglib-2.0.so.0
#4  0x0000555555728004 in object_finalize (data=data@entry=0x55555682c018) at qom/object.c:386
#5  0x0000555555631453 in qbus_free (bus=0x55555682c018) at hw/qdev.c:476
#6  0x00005555556315b1 in device_finalize (obj=<optimized out>) at hw/qdev.c:701
#7  0x0000555555727fc2 in object_deinit (type=0x555556499490, obj=0x55555682e020) at qom/object.c:370
#8  object_finalize (data=0x55555682e020) at qom/object.c:383
#9  0x0000555555728b90 in object_delete (obj=0x55555682e020) at qom/object.c:414
#10 0x0000555555630d1d in qdev_free (dev=<optimized out>) at hw/qdev.c:270
#11 0x000055555577d840 in acpi_piix_eject_slot (s=0x555556812e50, slots=<optimized out>) at /usr/src/debug/qemu-kvm-1.2.0/hw/acpi_piix4.c:314
#12 0x00005555557abddd in kvm_handle_io (count=1, size=4, direction=1, data=<optimized out>, port=44552) at /usr/src/debug/qemu-kvm-1.2.0/kvm-all.c:1459
#13 kvm_cpu_exec (env=env@entry=0x555556795070) at /usr/src/debug/qemu-kvm-1.2.0/kvm-all.c:1601
#14 0x000055555575c1f1 in qemu_kvm_cpu_thread_fn (arg=0x555556795070) at /usr/src/debug/qemu-kvm-1.2.0/cpus.c:757
#15 0x00007ffff626ad15 in start_thread () from /lib64/libpthread.so.0
#16 0x00007ffff2e3727d in clone () from /lib64/libc.so.6

Expected results:
Hot plug/unplug works well

Additional info:
(gdb) bt full
#0  0x00007ffff2d7aba5 in raise () from /lib64/libc.so.6
No symbol table info available.
#1  0x00007ffff2d7c358 in abort () from /lib64/libc.so.6
No symbol table info available.
#2  0x00007ffff7718b37 in g_assertion_message () from /lib64/libglib-2.0.so.0
No symbol table info available.
#3  0x00007ffff7719054 in g_assertion_message_expr () from /lib64/libglib-2.0.so.0
No symbol table info available.
#4  0x0000555555728004 in object_finalize (data=data@entry=0x55555682c018) at qom/object.c:386
        obj = 0x55555682c018
        ti = <optimized out>
        __PRETTY_FUNCTION__ = "object_finalize"
#5  0x0000555555631453 in qbus_free (bus=0x55555682c018) at hw/qdev.c:476
No locals.
#6  0x00005555556315b1 in device_finalize (obj=<optimized out>) at hw/qdev.c:701
        dev = 0x55555682e020
        bus = <optimized out>
        dc = <optimized out>
#7  0x0000555555727fc2 in object_deinit (type=0x555556499490, obj=0x55555682e020) at qom/object.c:370
No locals.
#8  object_finalize (data=0x55555682e020) at qom/object.c:383
        obj = 0x55555682e020
        ti = 0x555556499490
        __PRETTY_FUNCTION__ = "object_finalize"
#9  0x0000555555728b90 in object_delete (obj=0x55555682e020) at qom/object.c:414
        __PRETTY_FUNCTION__ = "object_delete"
#10 0x0000555555630d1d in qdev_free (dev=<optimized out>) at hw/qdev.c:270
No locals.
#11 0x000055555577d840 in acpi_piix_eject_slot (s=0x555556812e50, slots=<optimized out>) at /usr/src/debug/qemu-kvm-1.2.0/hw/acpi_piix4.c:314
        qdev = 0x55555682e020
        dev = 0x55555682e020
        pc = <optimized out>
        kid = <optimized out>
        next = 0x555556817c00
        bus = <optimized out>
        slot = 3
        slot_free = true
#12 0x00005555557abddd in kvm_handle_io (count=1, size=4, direction=1, data=<optimized out>, port=44552) at /usr/src/debug/qemu-kvm-1.2.0/kvm-all.c:1459
        i = 0
        ptr = 0x7fffe73fb000 "\b"
#13 kvm_cpu_exec (env=env@entry=0x555556795070) at /usr/src/debug/qemu-kvm-1.2.0/kvm-all.c:1601
        run = 0x7fffe73fa000
        ret = <optimized out>
        run_ret = <optimized out>
#14 0x000055555575c1f1 in qemu_kvm_cpu_thread_fn (arg=0x555556795070) at /usr/src/debug/qemu-kvm-1.2.0/cpus.c:757
        cpu = 0x555556795030
        r = <optimized out>
#15 0x00007ffff626ad15 in start_thread () from /lib64/libpthread.so.0
No symbol table info available.
#16 0x00007ffff2e3727d in clone () from /lib64/libc.so.6