How 'qdev_realize_and_unref' work?

[Zongyuan Li]

I recently read the following code in hw/openrisc/openrisc_sim.c:

>  if (num_cpus > 1) {
>        DeviceState *splitter = qdev_new(TYPE_SPLIT_IRQ);
>        qdev_prop_set_uint32(splitter, "num-lines", num_cpus);
>        qdev_realize_and_unref(splitter, NULL, &error_fatal);
>        for (i = 0; i < num_cpus; i++) {
>            qdev_connect_gpio_out(splitter, i, get_cpu_irq(cpus, i, irq_pin));
>        }
>        serial_irq = qdev_get_gpio_in(splitter, 0);
>    } else {
>        serial_irq = get_cpu_irq(cpus, 0, irq_pin);
>    }

'splitter' will be used after 'qdev_realize_and_unref', which will
drop the only reference it takes.
But since the memory will be freed, it seems illegal to use
'splitter'. Can anyone explain if I am missing something?

Thanks a lot,
Li