On 29/09/15 14:37, Paolo Bonzini wrote: > This causes the region to outlive the object, because it attaches the > region to /machine. This is not nice for the "realize" method, but > much worse for "instance_init" because it can cause dangling pointers > after a simple object_new/object_unref pair. > > Reported-by: Markus Armbruster <arm...@redhat.com> > Signed-off-by: Paolo Bonzini <pbonz...@redhat.com> ... > diff --git a/hw/display/tcx.c b/hw/display/tcx.c > index 4635800..bf119bc 100644 > --- a/hw/display/tcx.c > +++ b/hw/display/tcx.c > @@ -944,7 +944,7 @@ static void tcx_initfn(Object *obj) > SysBusDevice *sbd = SYS_BUS_DEVICE(obj); > TCXState *s = TCX(obj); > > - memory_region_init_ram(&s->rom, NULL, "tcx.prom", FCODE_MAX_ROM_SIZE, > + memory_region_init_ram(&s->rom, OBJECT(s), "tcx.prom", > FCODE_MAX_ROM_SIZE, > &error_fatal);
Why "OBJECT(s)" and not simply "obj" ? Thomas
