Revert "linux-user: un-parent OBJECT(cpu) when closing thread"

This reverts commit 52f0c1607671293afcdb2acc2f83e9bccbfa74bb.

This caused a regression in arm/aarch64.

We are hard-coding ARMCPRegInfo pointers into TranslationBlocks,
for calling into helper_{get,set}cp_reg{,64}.  So we have a race
condition between whichever cpu thread translates the code first
(encoding the pointer), and that cpu thread exiting, so that the
next execution of the TB references a freed data structure.

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>

diff --git a/linux-user/syscall.c b/linux-user/syscall.c
index bfdd60136b0480d1adc676b3d1052e77623e073e..f4091212027c254a19dc871a675d133215fc46c8 100644 (file)
--- a/linux-user/syscall.c
+++ b/linux-user/syscall.c
@@ -8594,13 +8594,7 @@ static abi_long do_syscall1(CPUArchState *cpu_env, int num, abi_long arg1,
         if (CPU_NEXT(first_cpu)) {
             TaskState *ts = cpu->opaque;
 
-            if (ts->child_tidptr) {
-                put_user_u32(0, ts->child_tidptr);
-                do_sys_futex(g2h(cpu, ts->child_tidptr),
-                             FUTEX_WAKE, INT_MAX, NULL, NULL, 0);
-            }
-
-            object_unparent(OBJECT(cpu));
+            object_property_set_bool(OBJECT(cpu), "realized", false, NULL);
             object_unref(OBJECT(cpu));
             /*
              * At this point the CPU should be unrealized and removed
@@ -8610,6 +8604,11 @@ static abi_long do_syscall1(CPUArchState *cpu_env, int num, abi_long arg1,
 
             pthread_mutex_unlock(&clone_lock);
 
+            if (ts->child_tidptr) {
+                put_user_u32(0, ts->child_tidptr);
+                do_sys_futex(g2h(cpu, ts->child_tidptr),
+                             FUTEX_WAKE, INT_MAX, NULL, NULL, 0);
+            }
             thread_cpu = NULL;
             g_free(ts);
             rcu_unregister_thread();