- Wine-devel - list.winehq.org

[PATCH] mfplat/sample: Fix use-after-free of a critical section.
by Nikolay Sivov 10 May '22

10 May '22

Signed-off-by: Nikolay Sivov <nsivov(a)codeweavers.com> --- dlls/mfplat/sample.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/dlls/mfplat/sample.c b/dlls/mfplat/sample.c index ed39b5f7297..687ada1a477 100644 --- a/dlls/mfplat/sample.c +++ b/dlls/mfplat/sample.c @@ -183,22 +183,25 @@ static ULONG WINAPI sample_tracked_Release(IMFSample *iface) { struct sample *sample = impl_from_IMFSample(iface); ULONG refcount = InterlockedDecrement(&sample->attributes.ref); + IRtwqAsyncResult *tracked_result = NULL; HRESULT hr; EnterCriticalSection(&sample->attributes.cs); if (sample->tracked_result && sample->tracked_refcount == refcount) { - IRtwqAsyncResult *tracked_result = sample->tracked_result; + tracked_result = sample->tracked_result; sample->tracked_result = NULL; sample->tracked_refcount = 0; /* Call could fail if queue system is not initialized, it's not critical. */ if (FAILED(hr = RtwqInvokeCallback(tracked_result))) WARN("Failed to invoke tracking callback, hr %#lx.\n", hr); - IRtwqAsyncResult_Release(tracked_result); } LeaveCriticalSection(&sample->attributes.cs); + if (tracked_result) + IRtwqAsyncResult_Release(tracked_result); + TRACE("%p, refcount %lu.\n", iface, refcount); if (!refcount) -- 2.35.1

1 0

[PATCH] mf/session: Do not request more samples when SA sample becomes available.
by Nikolay Sivov 10 May '22

10 May '22

The issue here is that upstream nodes get their request counters increased while sink hasn't requested any. This causes desync between sink request counters and upstream node counters, potentially causing sample drops and sink waiting forever for samples that will never come. Case like that is easy to reproduce with mfplay-based player, where occasionally end-of-presentation condition does not trigger, but new samples are coming in. Signed-off-by: Nikolay Sivov <nsivov(a)codeweavers.com> --- dlls/mf/session.c | 71 +++++++++++++++++++++++++++++++++++++++++------ 1 file changed, 62 insertions(+), 9 deletions(-) diff --git a/dlls/mf/session.c b/dlls/mf/session.c index 85b63f767fe..a78e7cfc473 100644 --- a/dlls/mf/session.c +++ b/dlls/mf/session.c @@ -2369,6 +2369,8 @@ static HRESULT WINAPI session_commands_callback_GetParameters(IMFAsyncCallback * return E_NOTIMPL; } +static void session_deliver_pending_samples(struct media_session *session, IMFTopologyNode *node); + static HRESULT WINAPI session_commands_callback_Invoke(IMFAsyncCallback *iface, IMFAsyncResult *result) { struct session_op *op = impl_op_from_IUnknown(IMFAsyncResult_GetStateNoAddRef(result)); @@ -2411,7 +2413,7 @@ static HRESULT WINAPI session_commands_callback_Invoke(IMFAsyncCallback *iface, { if (SUCCEEDED(IMFTopologyNode_GetInput(topo_node->node, 0, &upstream_node, &upstream_output))) { - session_request_sample_from_node(session, upstream_node, upstream_output); + session_deliver_pending_samples(session, upstream_node); IMFTopologyNode_Release(upstream_node); } } @@ -2952,19 +2954,19 @@ static void session_deliver_sample_to_node(struct media_session *session, IMFTop switch (node_type) { case MF_TOPOLOGY_OUTPUT_NODE: - if (sample) + if (topo_node->u.sink.requests) { - if (topo_node->u.sink.requests) + if (sample) { if (FAILED(hr = IMFStreamSink_ProcessSample(topo_node->object.sink_stream, sample))) WARN("Stream sink failed to process sample, hr %#lx.\n", hr); - topo_node->u.sink.requests--; } - } - else if (FAILED(hr = IMFStreamSink_PlaceMarker(topo_node->object.sink_stream, MFSTREAMSINK_MARKER_ENDOFSEGMENT, - NULL, NULL))) - { - WARN("Failed to place sink marker, hr %#lx.\n", hr); + else if (FAILED(hr = IMFStreamSink_PlaceMarker(topo_node->object.sink_stream, MFSTREAMSINK_MARKER_ENDOFSEGMENT, + NULL, NULL))) + { + WARN("Failed to place sink marker, hr %#lx.\n", hr); + } + topo_node->u.sink.requests--; } break; case MF_TOPOLOGY_TRANSFORM_NODE: @@ -3048,6 +3050,57 @@ static void session_deliver_sample_to_node(struct media_session *session, IMFTop } } +static void session_deliver_pending_samples(struct media_session *session, IMFTopologyNode *node) +{ + struct sample *sample_entry, *sample_entry2; + IMFTopologyNode *downstream_node; + struct topo_node *topo_node; + MF_TOPOLOGY_TYPE node_type; + DWORD downstream_input; + TOPOID node_id; + unsigned int i; + + IMFTopologyNode_GetNodeType(node, &node_type); + IMFTopologyNode_GetTopoNodeID(node, &node_id); + + topo_node = session_get_node_by_id(session, node_id); + + switch (node_type) + { + case MF_TOPOLOGY_TRANSFORM_NODE: + + transform_node_pull_samples(session, topo_node); + + /* Push down all available output. */ + for (i = 0; i < topo_node->u.transform.output_count; ++i) + { + if (FAILED(IMFTopologyNode_GetOutput(node, i, &downstream_node, &downstream_input))) + { + WARN("Failed to get connected node for output %u.\n", i); + continue; + } + + LIST_FOR_EACH_ENTRY_SAFE(sample_entry, sample_entry2, &topo_node->u.transform.outputs[i].samples, + struct sample, entry) + { + if (!topo_node->u.transform.outputs[i].requests) + break; + + session_deliver_sample_to_node(session, downstream_node, downstream_input, sample_entry->sample); + topo_node->u.transform.outputs[i].requests--; + + transform_release_sample(sample_entry); + } + + IMFTopologyNode_Release(downstream_node); + } + break; + default: + FIXME("Unexpected node type %u.\n", node_type); + } +} + + static HRESULT session_request_sample_from_node(struct media_session *session, IMFTopologyNode *node, DWORD output) { IMFTopologyNode *downstream_node, *upstream_node; -- 2.35.1

1 0

[PATCH 0/5] MR51: Fix handling of dbghelp's basic type
by eric pouech (＠epo) 10 May '22

10 May '22

Wine's dbghelp's implementation differ from native regarding basic types' handling (the basic types like char, int, long...) - Wine's dbghelp exposes a name for such a type, while native doesn't - parsing of basic type from dwarf & pdb don't always exactly return the correct information. Two examples (among others) of discrepancies: - in C, under Windows assumption, char, signed char and unsigned char are mapped to 2 types (as char = signed char); while in C++, they are mapped to three different types (char and signed char are two different types). Wine's dbhelp doesn't report correctly the C++ char types, and the char/signed char is broken too. - MS compiler shamelessly maps WCHAR to btWChar (basic type), while it's a typedef to unsigned short (which is mapped to btInt of size 2) This series's result is that Wine dbghelp's now returns the same basic types as native. (Tested with most of the C & C++ basic types) This requires: - to implement the re-generation of the basic types' name in WineDbg. This is done by adding data model tables (ILP32, LP64 and LLP64), and picking up the right one depending on current executable. Option is also added in WineDbg to force a(nother) data model. This is only used when printing types, not when reading/writing integer values as this (mostly) relies on the size of the integer. - fixing the pdb and dwarf backends in dbghelp to retarget the correct base types (for C and C++ basic types) - removing the name field from dbghelp's struct symt_basic allowed some simplification inside dbghelp: + all basic types are now only allocated once across every compilation unit and module) (small speed and memory consumption gain) + dwarf's backend used a basic type cache which is also removed Note: when using a basic type in WineDbg (like casting an integral value to another integral value), this serie doesn't change the data model used for getting the type's size. The data model used is currently ILP32 on 32 bit, and always LP64 on 64 bit. Yet to come serie shall use the current data model instead. -- https://gitlab.winehq.org/wine/wine/-/merge_requests/51

2 5

Re: [PATCH v2 0/1] MR29: mfplat: Avoid a race condition when releasing a tracked sample.
by Nikolay Sivov (＠nsivov) 10 May '22

10 May '22

On Tue May 10 13:43:09 2022 +0000, Giovanni Mascellani wrote: > That patch looks sensible to me. Did you actually manage to get a crash > out of that? It's always reproducible if you run e.g. test_sample_allocator_sysmem() alone, without initializing queues. I'll send something for this. -- https://gitlab.winehq.org/wine/wine/-/merge_requests/29#note_755

1 0

Re: [PATCH v2 0/1] MR29: mfplat: Avoid a race condition when releasing a tracked sample.
by Giovanni Mascellani (＠giomasce) 10 May '22

10 May '22

On Tue May 10 13:43:09 2022 +0000, Nikolay Sivov wrote: > Turns out I missed a problem with this. When queues are shut down, > releasing result object reenters sample release method, and potentially > destroys it. On return original call continues, and uses critical > section that has been just destroyed. > Attaching a possible fix for this. > [2.diff](/uploads/94a959648e483587b11172a6cc34b015/2.diff) That patch looks sensible to me. Did you actually manage to get a crash out of that? -- https://gitlab.winehq.org/wine/wine/-/merge_requests/29#note_754

1 0

Wine on Windows
by Игорь Чебаненко 10 May '22

10 May '22

I want to compile Wine in 64 bit Windows (Windows Vista and later). I want to compile it with Open Watcom (Win32 C/C++ Installer): http://openwatcom.org/download.php How to do that? Any ideas?

2 1

[PATCH] vulkan-1/tests: Fix test failures on llvmpipe.
by Zhiyi Zhang 10 May '22

10 May '22

This happens because the llvmpipe virtual GPU is not in the RandR provider list when there is a hardware GPU driving the screen. So LUID for the llvmpipe is not generated in such cases. Wine-Bug: https://bugs.winehq.org/show_bug.cgi?id=52931 Signed-off-by: Zhiyi Zhang <zzhang(a)codeweavers.com> --- Another way of handling this is hiding the llvmpipe Vulkan device when there is a hardware GPU. dlls/vulkan-1/tests/vulkan.c | 13 +++++++++---- 1 file changed, 9 insertions(+), 4 deletions(-) diff --git a/dlls/vulkan-1/tests/vulkan.c b/dlls/vulkan-1/tests/vulkan.c index 11d20120d1d..b9a36a55653 100644 --- a/dlls/vulkan-1/tests/vulkan.c +++ b/dlls/vulkan-1/tests/vulkan.c @@ -212,11 +212,16 @@ static void test_enumerate_physical_device2(void) trace("Device '%s', device UUID: %s, driver UUID: %s, device LUID: %08lx:%08lx.\n", properties2.properties.deviceName, wine_dbgstr_guid((const GUID *)id.deviceUUID), wine_dbgstr_guid((const GUID *)id.driverUUID), luid->HighPart, luid->LowPart); + todo_wine_if(!id.deviceLUIDValid && strstr(properties2.properties.deviceName, "llvmpipe")) ok(id.deviceLUIDValid == VK_TRUE, "Expected valid device LUID.\n"); - /* If deviceLUIDValid is VK_TRUE, deviceNodeMask must contain exactly one bit according - * to the Vulkan specification */ - ok(id.deviceNodeMask && !(id.deviceNodeMask & (id.deviceNodeMask - 1)), - "Expect deviceNodeMask to have only one bit set, got %#x.\n", id.deviceNodeMask); + if (id.deviceLUIDValid == VK_TRUE) + { + /* If deviceLUIDValid is VK_TRUE, deviceNodeMask must contain exactly one bit + * according to the Vulkan specification */ + ok(id.deviceNodeMask && !(id.deviceNodeMask & (id.deviceNodeMask - 1)), + "Expect deviceNodeMask to have only one bit set, got %#x.\n", + id.deviceNodeMask); + } } } -- 2.34.1

1 0

[PATCH 0/4] MR41: mf: Register video processor transform and fix a few broken tests.
by Rémi Bernon 10 May '22

10 May '22

-- https://gitlab.winehq.org/wine/wine/-/merge_requests/41

2 5

[PATCH 0/1] MR50: mfplat: Allow NULL length pointer in IMFAttributes::GetAllocatedString
by Andrew Eikum (＠aeikum) 10 May '22

10 May '22

Signed-off-by: Andrew Eikum <aeikum(a)codeweavers.com> -- https://gitlab.winehq.org/wine/wine/-/merge_requests/50

3 2

[PATCH vkd3d 1/8] tests: Add additional subtests to implicit array initialization.
by Giovanni Mascellani 09 May '22

09 May '22

From: Francisco Casas <fcasas(a)codeweavers.com> Signed-off-by: Francisco Casas <fcasas(a)codeweavers.com> --- v3: - Simplified tests that are expected to fail. - Addeed a tests for implicit arrays in a typedef. - Added a test for an array of complex elements. - Moved all tests not expected to fail to the top. - Removed the 'Implicit array of elements of size 0 with broadcast initialization' test. Replaced with a simple 'Broadcast to an implicit array' test from zf. - Calling 'implicit arrays' as 'implicit size arrays' now. --- ...lsl-initializer-implicit-array.shader_test | 223 +++++++++++++++++- 1 file changed, 222 insertions(+), 1 deletion(-) diff --git a/tests/hlsl-initializer-implicit-array.shader_test b/tests/hlsl-initializer-implicit-array.shader_test index d2b94da4..648825eb 100644 --- a/tests/hlsl-initializer-implicit-array.shader_test +++ b/tests/hlsl-initializer-implicit-array.shader_test @@ -2,6 +2,7 @@ float4 main() : SV_TARGET { float4 arr[] = {10, 20, 30, 40, 50, 60, 70, 80}; + return arr[1]; } @@ -10,9 +11,229 @@ todo draw quad todo probe all rgba (50, 60, 70, 80) +[pixel shader] +float4 main() : sv_target +{ + float4 arr1[2] = {1, 2, 3, 4, 5, 6, 7, 8}; + float4 arr2[] = arr1; + + return arr2[1]; +} + +[test] +todo draw quad +todo probe all rgba (5.0, 6.0, 7.0, 8.0) + + +[pixel shader] +float4 main() : sv_target +{ + float2 arr[][3] = {1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12}; + + return float4(arr[1][0], arr[1][1]); +} + +[test] +todo draw quad +todo probe all rgba (7.0, 8.0, 9.0, 10.0) + + +[pixel shader] +struct foo +{ + float3 foo1; + float4 foo2; +}; + +struct bar +{ + struct foo aa; + int2 bb; + float4 cc[2]; +}; + +float4 main() : SV_TARGET +{ + struct bar p[] = { + 101, 102, 103, 104, 105, 106, 107, 108, 109, 110, 111, 112, 113, 114, 115, 116, 117, + 201, 202, 203, 204, 205, 206, 207, 208, 209, 210, 211, 212, 213, 214, 215, 216, 217, + }; + return p[0].aa.foo2 + p[1].cc[1]; +} + +[test] +todo draw quad +todo probe all rgba (318.0, 320.0, 322.0, 324.0) + + [pixel shader fail] +// Incompatible number of arguments in implicit size array initializer float4 main() : SV_TARGET { float4 arr[] = {10, 20, 30, 40, 50, 60, 70}; - return arr[0]; + + return 0.0; +} + + +[pixel shader fail] +// Incompatible number of arguments in implicit size array initializer +float4 main() : SV_TARGET +{ + float4 arr[] = {10, 20, 30, 40, 50, 60, 70, 80, 90}; + + return 0.0; +} + +[pixel shader fail] +// Implicit size inner array +float4 main() : sv_target +{ + float2 arr[3][] = {1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12}; + + return 0.0; +} + + +[pixel shader fail] +// Implicit size array without initializer +float4 main() : sv_target +{ + float4 arr[]; + + return 0.0; +} + + +[pixel shader fail] +// Implicit size array as struct member +struct foobar +{ + int a; + float4 arr[]; +}; + +float4 main() : sv_target +{ + struct foobar s; + + return 0.0; +} + + +[pixel shader fail] +// Implicit size array as function argument +float4 fun(float4 arr[]) +{ + return 1.0; +} +float4 main() : sv_target +{ + float4 arr[3] = {1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12}; + return fun(arr); +} + + +[pixel shader fail] +// Implicit size array as function return type +// Note: explicit size arrays are not allowed either. +float4[] fun() +{ + float4 ret[2] = {1, 2, 3, 4, 5, 6, 7, 8}; + + return ret; +} + +float4 main() : sv_target +{ fun(); + return 0.0; +} + + +[pixel shader fail] +// Implicit size array as a cast +float4 main() : sv_target +{ + float2 arr1[4] = {1, 2, 3, 4, 5, 6, 7, 8}; + float4 arr2[2] = (float4 []) arr1; + + return 0.0; +} + + +[pixel shader fail] +// Implicit size array as a typedef +typedef float4 arrtype[]; + +float4 main() : sv_target +{ + arrtype arr1 = {1, 2, 3, 4, 5, 6, 7, 8}; + + return 0.0; +} + + +[pixel shader fail] +// Implicit size array of elements of size 0 +struct emp +{ +}; + +float4 main() : sv_target +{ + struct emp arr[] = {1, 2, 3, 4}; + + return 0.0; +} + + +[pixel shader fail] +// Implicit size array of elements of size 0, without initializer +struct emp +{ +}; + +float4 main() : sv_target +{ + struct emp arr[]; + + return 0.0; +} + + +[pixel shader fail] +// Broadcast to an implicit size array +float4 main() : sv_target +{ + int a[4] = (int[]) 0; + + return 0.0; +} + + +[pixel shader fail] +// Implicit size array with an initializer of size 0 +struct emp +{ +}; + +float4 main() : sv_target +{ + float4 arr[] = (struct emp) 42; + + return 0.0; +} + + +[pixel shader fail] +// Implicit size array of elements of size 0 with initializer of size 0 +struct emp +{ +}; + +float4 main() : sv_target +{ + struct emp arr[] = (struct emp) 42; + + return 0.0; } -- 2.36.0

2 16