Description of problem:

When reboot the win7 guest, qemu-kvm crash. 

bt
#0  0x00007f931ce75979 in raise () from /lib64/libc.so.6
#1  0x00007f931ce77088 in abort () from /lib64/libc.so.6
#2  0x00007f931dc3190c in spice_logv (log_domain=0x7f931dca7f86 "Spice", log_level=SPICE_LOG_LEVEL_ERROR, strloc=0x7f931dcad312 "red_parse_qxl.c:489", function=0x7f931dcad8e2 <__FUNCTION__.19719> "red_get_image", 
    format=0x7f931dcad302 "unknown type %d", args=args@entry=0x7f9283ffe800) at log.c:109
#3  0x00007f931dc31a65 in spice_log (log_domain=log_domain@entry=0x7f931dca7f86 "Spice", log_level=log_level@entry=SPICE_LOG_LEVEL_ERROR, strloc=strloc@entry=0x7f931dcad312 "red_parse_qxl.c:489", 
    function=function@entry=0x7f931dcad8e2 <__FUNCTION__.19719> "red_get_image", format=format@entry=0x7f931dcad302 "unknown type %d") at log.c:123
#4  0x00007f931dbf05d5 in red_get_image (slots=slots@entry=0x7f927c1d5e58, group_id=group_id@entry=1, addr=72057594055084504, flags=flags@entry=0, is_mask=is_mask@entry=0) at red_parse_qxl.c:489
#5  0x00007f931dbf1bd5 in red_get_copy_ptr (flags=0, qxl=0x7f9285665c63, red=0x7f927c2214d0, group_id=1, slots=0x7f927c1d5e58) at red_parse_qxl.c:590
#6  red_get_native_drawable (flags=0, addr=<optimized out>, red=0x7f927c221440, group_id=1, slots=0x7f927c1d5e58) at red_parse_qxl.c:967
#7  red_get_drawable (slots=0x7f927c1d5e58, group_id=1, red=0x7f927c221440, addr=<optimized out>, flags=0) at red_parse_qxl.c:1105
#8  0x00007f931dc0ac12 in red_process_commands (worker=<optimized out>, ring_is_empty=<optimized out>, max_pipe_size=50) at red_worker.c:5190
#9  0x00007f931dc10bda in red_worker_main (arg=<optimized out>) at red_worker.c:12292
#10 0x00007f9320228de3 in start_thread () from /lib64/libpthread.so.0
#11 0x00007f931cf3625d in clone () from /lib64/libc.so.6


Version-Release number of selected component (if applicable):
qemu-kvm-rhev-1.5.3-36.el7.x86_64
kernel-3.10.0-69.el7.x86_64

How reproducible:
once

Steps to Reproduce:
1. boot vm 
  /usr/libexec/qemu-kvm \
    -S  \
    -name 'virt-tests-vm1'  \
    -sandbox off  \
    -M pc-q35-rhel7.0.0  \
    -nodefaults  \
    -vga qxl  \
    -global qxl-vga.vram_size=33554432 \
    -device intel-hda,bus=pcie.0,addr=02 \
    -device hda-duplex  \
    -device nec-usb-xhci,id=usb1,bus=pcie.0,addr=04 \
    -device virtio-scsi-pci,id=virtio_scsi_pci0,bus=pcie.0,addr=05 \
    -drive id=drive_image1,if=none,cache=none,snapshot=off,aio=native,file=images/win7-64-virtio.qcow2 \
    -device scsi-hd,id=image1,drive=drive_image1 \
    -device virtio-net-pci,mac=9a:8e:8f:90:91:92,id=idoZEhC9,netdev=idPThVd4,bus=pcie.0,addr=06  \
    -netdev tap,id=idPThVd4,vhost=on,script=/etc/qemu-ifup  \
    -m 2048  \
    -smp 1,maxcpus=1,cores=1,threads=1,sockets=2  \
    -cpu 'Opteron_G2',+kvm_pv_unhalt,hv_relaxed,hv_spinlocks=0x1fff,hv_vapic \
    -device usb-tablet,id=usb-tablet1,bus=usb1.0,port=1  \
    -spice port=3000,password=123456,addr=0,tls-port=3200,x509-dir=/tmp/spice_x509d,tls-channel=main,tls-channel=inputs,image-compression=auto_glz,zlib-glz-wan-compression=auto,streaming-video=all,agent-mouse=on,playback-compression=on,ipv4  \
    -rtc base=localtime,clock=host,driftfix=slew  \
    -boot order=cdn,once=c,menu=off \
    -enable-kvm
2. wait to login vm
3. reboot guest and repeat step 2 and step3.

Actual results:
qemu crash

Expected results:
qemu and guest can work without crash.

Additional info:
cat /proc/cpuinfo 
processor	: 0
vendor_id	: AuthenticAMD
cpu family	: 15
model		: 107
model name	: AMD Athlon(tm) 64 X2 Dual Core Processor 5600+
stepping	: 2
cpu MHz		: 1000.000
cache size	: 512 KB
physical id	: 0
siblings	: 2
core id		: 0
cpu cores	: 2
apicid		: 0
initial apicid	: 0
fpu		: yes
fpu_exception	: yes
cpuid level	: 1
wp		: yes
flags		: fpu vme de pse tsc msr pae mce cx8 apic sep mtrr pge mca cmov pat pse36 clflush mmx fxsr sse sse2 ht syscall nx mmxext fxsr_opt rdtscp lm 3dnowext 3dnow rep_good nopl extd_apicid pni cx16 lahf_lm cmp_legacy svm extapic cr8_legacy 3dnowprefetch lbrv
bogomips	: 2004.29
TLB size	: 1024 4K pages
clflush size	: 64
cache_alignment	: 64
address sizes	: 40 bits physical, 48 bits virtual
power management: ts fid vid ttp tm stc 100mhzsteps


The core dump:
bt full
#0  0x00007f931ce75979 in raise () from /lib64/libc.so.6
No symbol table info available.
#1  0x00007f931ce77088 in abort () from /lib64/libc.so.6
No symbol table info available.
#2  0x00007f931dc3190c in spice_logv (log_domain=0x7f931dca7f86 "Spice", 
    log_level=SPICE_LOG_LEVEL_ERROR, strloc=0x7f931dcad312 "red_parse_qxl.c:489", 
    function=0x7f931dcad8e2 <__FUNCTION__.19719> "red_get_image", 
    format=0x7f931dcad302 "unknown type %d", args=args@entry=0x7f9283ffe800) at log.c:109
        level = 0x7f931dcb82f8 "ERROR"
#3  0x00007f931dc31a65 in spice_log (log_domain=log_domain@entry=0x7f931dca7f86 "Spice", 
    log_level=log_level@entry=SPICE_LOG_LEVEL_ERROR, 
    strloc=strloc@entry=0x7f931dcad312 "red_parse_qxl.c:489", 
    function=function@entry=0x7f931dcad8e2 <__FUNCTION__.19719> "red_get_image", 
    format=format@entry=0x7f931dcad302 "unknown type %d") at log.c:123
        args = {{gp_offset = 48, fp_offset = 48, overflow_arg_area = 0x7f9283ffe8e0, 
            reg_save_area = 0x7f9283ffe820}}
#4  0x00007f931dbf05d5 in red_get_image (slots=slots@entry=0x7f927c1d5e58, 
    group_id=group_id@entry=1, addr=72057594055084504, flags=flags@entry=0, is_mask=is_mask@entry=0)
    at red_parse_qxl.c:489
        chunks = {data_size = 1, prev_chunk = 0x7f9283ffe9a4, next_chunk = 0x7f9285665be8, 
          data = 0x7f931dbefa6b <get_virt+203> "\211\302L\211\360\205\322u\316A\307E"}
        qxl = 0x7f928505c9d8
        red = 0x7f927c221530
        rp = 0x0
        bitmap_size = <optimized out>
---Type <return> to continue, or q <return> to quit---
        size = <optimized out>
        qxl_flags = <optimized out>
        error = 0
        __FUNCTION__ = "red_get_image"
#5  0x00007f931dbf1bd5 in red_get_copy_ptr (flags=0, qxl=0x7f9285665c63, red=0x7f927c2214d0, 
    group_id=1, slots=0x7f927c1d5e58) at red_parse_qxl.c:590
No locals.
#6  red_get_native_drawable (flags=0, addr=<optimized out>, red=0x7f927c221440, group_id=1, 
    slots=0x7f927c1d5e58) at red_parse_qxl.c:967
        qxl = 0x7f9285665be8
        i = <optimized out>
        error = <optimized out>
#7  red_get_drawable (slots=0x7f927c1d5e58, group_id=1, red=0x7f927c221440, addr=<optimized out>, 
    flags=0) at red_parse_qxl.c:1105
        ret = <optimized out>
#8  0x00007f931dc0ac12 in red_process_commands (worker=<optimized out>, 
    ring_is_empty=<optimized out>, max_pipe_size=50) at red_worker.c:5190
        ext_cmd = {cmd = {data = 72057594061413352, type = 1, padding = 0}, group_id = 1, flags = 0}
        n = 15
        start = <optimized out>
#9  0x00007f931dc10bda in red_worker_main (arg=<optimized out>) at red_worker.c:12292
        worker = <optimized out>
        __FUNCTION__ = "red_worker_main"
#10 0x00007f9320228de3 in start_thread () from /lib64/libpthread.so.0
No symbol table info available.
---Type <return> to continue, or q <return> to quit---
#11 0x00007f931cf3625d in clone () from /lib64/libc.so.6
No symbol table info available.