Created attachment 653862 [details]
File: backtrace

Created attachment 653864 [details]
File: cgroup

Created attachment 653865 [details]
File: core_backtrace

Created attachment 653866 [details]
File: dso_list

Created attachment 653867 [details]
File: environ

Created attachment 653868 [details]
File: limits

Created attachment 653869 [details]
File: maps

Created attachment 653870 [details]
File: open_fds

Created attachment 653871 [details]
File: proc_pid_status

Created attachment 653872 [details]
File: smolt_data

Created attachment 653873 [details]
File: var_log_messages

I was running the virtualization test suite, during a sequence of device add a virtio serial device, followed by its removal about 12 seconse later.

13:08:56 INFO | Context: Executing test: test_hotplug_virtio_pci
13:08:56 DEBUG| (monitor hmp1) Sending command 'device_add virtio-serial-pci,id=virtio_serial_pci1' 
13:09:06 DEBUG| (monitor hmp1) Sending command 'device_del virtio_serial_pci1' 
13:09:06 INFO | [qemu output] **
13:09:06 INFO | [qemu output] ERROR:qom/object.c:386:object_finalize: assertion failed: (obj->ref == 0)
13:09:09 INFO | [qemu output] /bin/sh: line 1: 16358 Aborted                 (core dumped) /bin/qemu-kvm -S -name 'vm1' -nodefaults -chardev socket,id=hmp_id_hmp1,path=/tmp/monitor-hmp1-20121210-125737-7qOH7IXP,server,nowait -mon chardev=hmp_id_hmp1,mode=readline -chardev socket,id=serial_id_serial1,path=/tmp/serial-serial1-20121210-125737-7qOH7IXP,server,nowait -device isa-serial,chardev=serial_id_serial1 -device virtio-serial-pci,id=virtio_serial_pci0 -chardev socket,id=devvc1,path=/tmp/virtio_port-vc1-20121210-125737-7qOH7IXP,server,nowait -device virtconsole,chardev=devvc1,name=vc1,id=vc1 -chardev socket,id=devvc2,path=/tmp/virtio_port-vc2-20121210-125737-7qOH7IXP,server,nowait -device virtconsole,chardev=devvc2,name=vc2,id=vc2 -chardev socket,id=devvc3,path=/tmp/virtio_port-vc3-20121210-125737-7qOH7IXP,server,nowait -device virtconsole,chardev=devvc3,name=vc3,id=vc3 -chardev socket,id=devvc4,path=/tmp/virtio_port-vc4-20121210-125737-7qOH7IXP,server,nowait -device virtconsole,chardev=devvc4,name=vc4,id=vc4 -chardev socket,id=devvs1,path=/tmp/virtio_port-vs1-20121210-125737-7qOH7IXP,server,nowait -device virtserialport,chardev=devvs1,name=vs1,id=vs1 -chardev socket,id=devvs2,path=/tmp/virtio_port-vs2-20121210-125737-7qOH7IXP,server,nowait -device virtserialport,chardev=devvs2,name=vs2,id=vs2 -chardev socket,id=devvs3,path=/tmp/virtio_port-vs3-20121210-125737-7qOH7IXP,server,nowait -device virtserialport,chardev=devvs3,name=vs3,id=vs3 -chardev socket,id=devvs4,path=/tmp/virtio_port-vs4-20121210-125737-7qOH7IXP,server,nowait -device virtserialport,chardev=devvs4,name=vs4,id=vs4 -chardev socket,id=seabioslog_id_20121210-125737-7qOH7IXP,path=/tmp/seabios-20121210-125737-7qOH7IXP,server,nowait -device isa-debugcon,chardev=seabioslog_id_20121210-125737-7qOH7IXP,iobase=0x402 -device ich9-usb-uhci1,id=usb1 -drive file='/home/lmr/Code/virt-test.git/shared/data/images/jeos-17-64.qcow2',if=none,cache=none,id=virtio0 -device virtio-blk-pci,drive=virtio0 -device virtio-net-pci,netdev=idyeh55u,mac='9a:a4:a5:a6:a7:a8',id='idBCG9j1' -netdev user,id=idyeh55u,hostfwd=tcp::5002-:22 -m 512 -smp 2,cores=1,threads=1,sockets=2 -cpu 'SandyBridge' -device usb-tablet,id=usb-tablet1,bus=usb1.0,port=1 -vnc :0 -vga std -rtc base=utc,clock=host,driftfix=none -boot order=cdn,once=c,menu=off -enable-kvm
13:09:09 INFO | [qemu output] (Process terminated with status 134)


backtrace_rating: 4
Package: qemu-system-x86-1.2.0-24.fc18
OS Release: Fedora release 18 (Spherical Cow)

I think this might be fixed by

commit f05a3da4e00d24c4540811e6fff2c4f0484771bd
Author: Paolo Bonzini <pbonzini>
Date:   Fri Nov 23 09:47:12 2012 +0100

    qom: fix refcount of non-heap-allocated objects
    
    The reference count for embedded objects is always one too low, because
    object_initialize_with_type returns with zero references to the object.
    This causes premature finalization of the object (or an assertion failure)
    after calling object_ref to add an extra reference and object_unref to
    remove it.
    
    The fix is to move the initial object_ref call from object_new_with_type
    to object_initialize_with_type.
    
    Acked-by: Andreas Färber <afaerber>
    Signed-off-by: Paolo Bonzini <pbonzini>
    Signed-off-by: Anthony Liguori <aliguori.com>
    (cherry picked from commit 764b63125a77dab54ed405d493452a4e05679c2e)
    
    Signed-off-by: Michael Roth <mdroth.ibm.com>

Which is in 1.2.2 stable

qemu-1.2.2-1.fc18 has been submitted as an update for Fedora 18.
https://admin.fedoraproject.org/updates/qemu-1.2.2-1.fc18

I agree, either that or another patch later in the same series.

Executing the test case mentioned in the current 1.2.0 shipped on F18 gives the error reported:

$ ./run -t kvm --tests virtio_console.spread_linear.unspecifiable.hotplug_virtio_pci
SETUP: PASS (1.20 s)
DATA DIR: /path/to/virt_test/
DEBUG LOG: /path/to/Code/virt-test.git/logs/run-2012-12-17-11.59.17/debug.log
TESTS: 1
(1/1) virtio_console.spread_linear.unspecifiable.hotplug_virtio_pci: FAIL (26.49 s)

The updated 1.2.2 did not get to the updates-testing repos yet. What I did was to download a clean copy of 1.2.2, build it and repeat the test. The test still fails, with the same segmentation fault:

$ ./run -t kvm --tests virtio_console.spread_linear.unspecifiable.hotplug_virtio_pci --qemu-bin /path/to/Code/qemu-1.2.2/x86_64-softmmu/qemu-system-x86_64 
SETUP: PASS (1.31 s)
DATA DIR: /path/to/virt_test/
DEBUG LOG: /path/to/Code/virt-test.git/logs/run-2012-12-17-12.10.07/debug.log
TESTS: 1
(1/1) virtio_console.spread_linear.unspecifiable.hotplug_virtio_pci: FAIL (25.81 s)

... in the debug log ...

12:10:08 INFO | Context: Executing test: test_hotplug_virtio_pci
12:10:08 DEBUG| (monitor hmp1) Sending command 'device_add virtio-serial-pci,id=virtio_serial_pci1' 
12:10:18 DEBUG| (monitor hmp1) Sending command 'device_del virtio_serial_pci1' 
12:10:18 INFO | [qemu output] **
12:10:18 INFO | [qemu output] ERROR:qom/object.c:387:object_finalize: assertion failed: (obj->ref == 0)
12:10:21 INFO | [qemu output] /bin/sh: line 1:  7962 Aborted                 (core dumped) /path/to/Code/qemu-1.2.2/x86_64-softmmu/qemu-system-x86_64 -S -name 'vm1' -n
odefaults -chardev socket,id=hmp_id_hmp1,path=/tmp/monitor-hmp1-20121217-121007-bptwZQCu,server,nowait -mon chardev=hmp_id_hmp1,mode=readline -chardev socket,id=serial_
id_serial1,path=/tmp/serial-serial1-20121217-121007-bptwZQCu,server,nowait -device isa-serial,chardev=serial_id_serial1 -device virtio-serial-pci,id=virtio_serial_pci0 
-chardev socket,id=devvc1,path=/tmp/virtio_port-vc1-20121217-121007-bptwZQCu,server,nowait -device virtconsole,chardev=devvc1,name=vc1,id=vc1 -chardev socket,id=devvc2,
path=/tmp/virtio_port-vc2-20121217-121007-bptwZQCu,server,nowait -device virtconsole,chardev=devvc2,name=vc2,id=vc2 -chardev socket,id=devvc3,path=/tmp/virtio_port-vc3-
20121217-121007-bptwZQCu,server,nowait -device virtconsole,chardev=devvc3,name=vc3,id=vc3 -chardev socket,id=devvc4,path=/tmp/virtio_port-vc4-20121217-121007-bptwZQCu,s
erver,nowait -device virtconsole,chardev=devvc4,name=vc4,id=vc4 -chardev socket,id=devvs1,path=/tmp/virtio_port-vs1-20121217-121007-bptwZQCu,server,nowait -device virts
erialport,chardev=devvs1,name=vs1,id=vs1 -chardev socket,id=devvs2,path=/tmp/virtio_port-vs2-20121217-121007-bptwZQCu,server,nowait -device virtserialport,chardev=devvs
2,name=vs2,id=vs2 -chardev socket,id=devvs3,path=/tmp/virtio_port-vs3-20121217-121007-bptwZQCu,server,nowait -device virtserialport,chardev=devvs3,name=vs3,id=vs3 -char
dev socket,id=devvs4,path=/tmp/virtio_port-vs4-20121217-121007-bptwZQCu,server,nowait -device virtserialport,chardev=devvs4,name=vs4,id=vs4 -chardev socket,id=seabioslo
g_id_20121217-121007-bptwZQCu,path=/tmp/seabios-20121217-121007-bptwZQCu,server,nowait -device isa-debugcon,chardev=seabioslog_id_20121217-121007-bptwZQCu,iobase=0x402 
-device ich9-usb-uhci1,id=usb1 -drive file='/home/lmr/Code/virt-test.git/shared/data/images/jeos-17-64.qcow2',if=none,id=virtio0 -device virtio-blk-pci,drive=virtio0,bo
otindex=1 -device virtio-net-pci,netdev=id8G6KnY,mac='9a:46:47:48:49:4a',id='idFlU8hb' -netdev user,id=id8G6KnY,hostfwd=tcp::5000-:22 -m 512 -smp 2,cores=1,threads=1,so
ckets=2 -device usb-tablet,id=usb-tablet1,bus=usb1.0,port=1 -vnc :0 -vga std -rtc base=utc,clock=host,driftfix=none -boot order=cdn,once=c,menu=off -enable-kvm
12:10:21 INFO | [qemu output] (Process terminated with status 134)

So, this problem is quite reproducible, if you wish to use the test suite to reproduce it so you can work on it, please git clone what's specified in

https://github.com/autotest/virt-test

The README.rst file at the top of the suite contains info on how to bootstrap the tests.

FWIW, I tried just these two commands

device_add virtio-serial-pci,id=virtio_serial_pci1
device_del virtio_serial_pci1

with QEMU origin/master and it worked.  I'll try autotest tomorrow.

Ok Paolo, indeed, I just updated my local qemu tree and ran the test against origin master, the test passed:

$ ./run -t kvm --tests virtio_console.spread_linear.unspecifiable.hotplug_virtio_pci --qemu-bin /path/to/qemu/x86_64-softmmu/qemu-system-x86_64 
SETUP: PASS (1.60 s)
DATA DIR: /path/to/virt_test/
DEBUG LOG: /path/to/Code/virt-test.git/logs/run-2012-12-17-14.50.24/debug.log
TESTS: 1
(1/1) virtio_console.spread_linear.unspecifiable.hotplug_virtio_pci: PASS (48.04 s)

So this issue is fixed in origin/master, pending a backport to the 1.2 series, I suppose.

qemu-1.2.2-1.fc18 has been pushed to the Fedora 18 stable repository.  If problems still persist, please make note of it in this bug report.