[PATCH] d3d11: Fix freed memory access when releasing device context (Coverity).

[Nikolay Sivov]

Signed-off-by: Nikolay Sivov <nsivov(a)codeweavers.com>
---
 dlls/d3d11/device.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/dlls/d3d11/device.c b/dlls/d3d11/device.c
index d3e49879676..fd2f75327e2 100644
--- a/dlls/d3d11/device.c
+++ b/dlls/d3d11/device.c
@@ -521,13 +521,13 @@ static ULONG STDMETHODCALLTYPE d3d11_device_context_Release(ID3D11DeviceContext1
 
     if (!refcount)
     {
+        ID3D11Device2_Release(&context->device->ID3D11Device2_iface);
         if (context->type != D3D11_DEVICE_CONTEXT_IMMEDIATE)
         {
             wined3d_deferred_context_destroy(context->wined3d_context);
             d3d11_device_context_cleanup(context);
             heap_free(context);
         }
-        ID3D11Device2_Release(&context->device->ID3D11Device2_iface);
     }
 
     return refcount;
-- 
2.30.2

[Marvin]

Hi,

While running your changed tests, I think I found new failures.
Being a bot and all I'm not very good at pattern recognition, so I might be
wrong, but could you please double-check?

Full results can be found at:
https://testbot.winehq.org/JobDetails.pl?Key=92085

Your paranoid android.


=== debiant2 (32 bit WoW report) ===

d3d11:
d3d11.c:9766: Test failed: d3d11.c:15386: Test marked todo: Got unexpected hr 0 for typeless format (feature level 0x9300).

[Henri Verbeet]

On Tue, 8 Jun 2021 at 17:08, Nikolay Sivov <nsivov(a)codeweavers.com> wrote:
> if (!refcount)
>      {
> +        ID3D11Device2_Release(&context->device->ID3D11Device2_iface);
>          if (context->type != D3D11_DEVICE_CONTEXT_IMMEDIATE)
>          {
>              wined3d_deferred_context_destroy(context->wined3d_context);
>              d3d11_device_context_cleanup(context);
>              heap_free(context);
>          }
> -        ID3D11Device2_Release(&context->device->ID3D11Device2_iface);
>      }

That's not much better though; in case of an immediate context,
"context" may be freed by releasing the device reference.

[Nikolay Sivov]

On 6/8/21 11:16 PM, Henri Verbeet wrote:
> On Tue, 8 Jun 2021 at 17:08, Nikolay Sivov <nsivov(a)codeweavers.com> wrote:
> > if (!refcount)
> >      {
> > +        ID3D11Device2_Release(&context->device->ID3D11Device2_iface);
> >          if (context->type != D3D11_DEVICE_CONTEXT_IMMEDIATE)
> >          {
> >              wined3d_deferred_context_destroy(context->wined3d_context);
> >              d3d11_device_context_cleanup(context);
> >              heap_free(context);
> >          }
> > -        ID3D11Device2_Release(&context->device->ID3D11Device2_iface);
> >      }
>
> That's not much better though; in case of an immediate context,
> "context" may be freed by releasing the device reference.
> Right, sorry. I sent another version.