Description of problem:

qemu-kvm core dumps and disk corrupt during win7_64 installation
Version-Release number of selected component (if applicable):

qemu-kvm-0.12.1.2-2.210.el6.x86_64
How reproducible:

5 / 50
Steps to Reproduce:
1. start a win7_64 installation by:
/home/staf-kvm-devel/autotest-devel/client/tests/kvm/qemu -name 'vm1' -chardev
socket,id=qmp_monitor_id_qmpmonitor1,path=/tmp/monitor-qmpmonitor1-20111122-165744-STUN,server,nowait
-mon chardev=qmp_monitor_id_qmpmonitor1,mode=control \
-chardev
socket,id=serial_id_20111122-165744-STUN,path=/tmp/serial-N,server,nowait \
-device isa-serial,chardev=serial_id_20111122-165744-STUN \
-drive
file='win7-64.qcow2',index=0,if=none,id=drive-ide0-0-0,media=disk,cache=none,format=qcow2,aio=native
\
-device ide-drive,bus=ide.0,unit=0,drive=drive-ide0-0-0,id=ide0-0-0 \
-device
rtl8139,netdev=idvdg4cO,mac=9a:fe:9d:9b:b9:96,id=ndev00idvdg4cO,bus=pci.0,addr=0x3
\
-netdev tap,id=idvdg4cO,fd=21 \
-m 4G -smp 4,cores=2,threads=1,sockets=2 \
-drive
file='en_windows_7_ultimate_with_sp1_x64_dvd_618240.iso',index=1,if=none,id=drive-ide0-0-1,media=cdrom,readonly=on,format=raw
\
-device ide-drive,bus=ide.0,unit=1,drive=drive-ide0-0-1,id=ide0-0-1 \
-drive
file='winutils.iso',index=2,if=none,id=drive-ide0-1-0,media=cdrom,readonly=on,format=raw
\
-device ide-drive,bus=ide.1,unit=0,drive=drive-ide0-1-0,id=ide0-1-0 \
-drive
file='virtio-win.iso',index=3,if=none,id=drive-ide0-1-1,media=cdrom,readonly=on,format=raw
\
-device ide-drive,bus=ide.1,unit=1,drive=drive-ide0-1-1,id=ide0-1-1 \
-cpu cpu64-rhel6,+sse2,+x2apic \
-fda
'/home/staf-kvm-devel/autotest-devel/client/tests/kvm/images/win7-64/answer.vfd'
\
-spice port=8000,disable-ticketing -vga qxl \
-rtc base=localtime,clock=host,driftfix=slew \
-boot order=cdn,once=d,menu=off     -M rhel6.2.0 -usb -device usb-tablet
-enable-kvm 
2.
3.

Actual results:

1) qemu-kvm core dumps during installation.

2) qemu-img check image.qcow2
 22114 internal errors have occurred during the check.

Expected results:

installation finish, both guest and host works well.



Additional info:
   NOTE: bt_full is attached.
#0  0x0000000000496d6a in alloc_refcount_block (bs=0x2e1e010,
offset=4584051076082565690, length=<value optimized out>, addend=-1) at
block/qcow2-refcount.c:334
(gdb) #0  0x0000000000496d6a in alloc_refcount_block (bs=0x2e1e010,
offset=4584051076082565690, length=<value optimized out>, addend=-1) at
block/qcow2-refcount.c:334
#1  update_refcount (bs=0x2e1e010, offset=4584051076082565690, length=<value
optimized out>, addend=-1) at block/qcow2-refcount.c:459
#2  0x00000000004975e0 in qcow2_free_clusters (bs=0x2e1e010,
offset=4584051076082565690, size=65536) at block/qcow2-refcount.c:639
#3  0x0000000000498cee in qcow2_alloc_cluster_link_l2 (bs=0x2e1e010, m=<value
optimized out>) at block/qcow2-cluster.c:672
#4  0x0000000000493ea8 in qcow2_aio_write_cb (opaque=0x2ffff10, ret=0) at
block/qcow2.c:642
#5  0x0000000000485d6a in qemu_laio_process_completion (s=<value optimized
out>, laiocb=0x7f63e0000950) at linux-aio.c:68
#6  0x0000000000485f7f in qemu_laio_enqueue_completed (opaque=0x2e1be80) at
linux-aio.c:107
#7  qemu_laio_completion_cb (opaque=0x2e1be80) at linux-aio.c:144
#8  0x000000000040c46f in main_loop_wait (timeout=1000) at
/usr/src/debug/qemu-kvm-0.12.1.2/vl.c:4024
#9  0x000000000042af2a in kvm_main_loop () at
/usr/src/debug/qemu-kvm-0.12.1.2/qemu-kvm.c:2225
#10 0x000000000040deb5 in main_loop (argc=<value optimized out>, argv=<value
optimized out>, envp=<value optimized out>) at
/usr/src/debug/qemu-kvm-0.12.1.2/vl.c:4234
#11 main (argc=<value optimized out>, argv=<value optimized out>, envp=<value
optimized out>) at /usr/src/debug/qemu-kvm-0.12.1.2/vl.c:6470