On Wed 24 Jun 2015 10:02:03 AM CEST, Alberto Garcia wrote: > [A] <- [B] <- [C] <- [D] <- [E] <- [F] <- [G] > > [...] > > The way it works is that stream_start() reopens the destination image > in read-write mode (if needed), creates the stream_run() coroutine to > copy the data, and finally stream_complete() puts it back in read-only > mode and closes the images that are removed from the chain.
There's more. If I perform a single streaming operation [A] => [D] this also crashes, although in a different way. block.c:1764: bdrv_reopen_prepare: Assertion `reopen_state->bs->drv != ((void *)0)' failed. What happens is that in stream_complete() all images that have been removed from the chain ([A], [B] and [C]) are closed, and then [D] is reopened in read-only mode. The reopen queue contains [C], that is still listed as a child of [D] although it's no longer a valid pointer. [C] is opened using bdrv_open_backing_file() and attached to [D] with bdrv_attach_child(), but never detached afterwards. Berto