memory: allow destroying a non-empty MemoryRegion

This is legal; the MemoryRegion will simply unreference all the
existing subregions and possibly bring them down with it as well.
However, it requires a bit of care to avoid an infinite loop.
Finalizing a memory region cannot trigger an address space update,
but memory_region_del_subregion errs on the side of caution and
might trigger a spurious update: avoid that by resetting mr->enabled
first.

Backports commit 91232d98da2bfe042d4c5744076b488880de3040 from qemu

qemu/memory.c

@@ -1215,8 +1215,22 @@ static void memory_region_finalize(struct uc_struct *uc, Object *obj, void *opaq
 {
     MemoryRegion *mr = MEMORY_REGION(uc, obj);
 
-    assert(QTAILQ_EMPTY(&mr->subregions));
+    assert(!mr->container);
-    // assert(memory_region_transaction_depth == 0);
+
+    /* We know the region is not visible in any address space (it
+     * does not have a container and cannot be a root either because
+     * it has no references, so we can blindly clear mr->enabled.
+     * memory_region_set_enabled instead could trigger a transaction
+     * and cause an infinite loop.
+     */
+    mr->enabled = false;
+    memory_region_transaction_begin(uc);
+    while (!QTAILQ_EMPTY(&mr->subregions)) {
+        MemoryRegion *subregion = QTAILQ_FIRST(&mr->subregions);
+        memory_region_del_subregion(mr, subregion);
+    }
+    memory_region_transaction_commit(uc);
+
     mr->destructor(mr);
     g_free((char *)mr->name);
 }