[PATCH v2 0/1] MR2063: dinput/tests: Dynamically allocate async operation handlers.

[Rémi Bernon]

Instead of passing them from the stack. The async operation is executed
in a thread pool, which might Release its reference asynchronously and
call a stale function pointer if it is sequenced after the stack
invalidation.

--
  v2: dinput/tests: Dynamically allocate async operation handlers.
 
https://gitlab.winehq.org/wine/wine/-/merge_requests/2063

[PATCH v2 1/1] dinput/tests: Dynamically allocate async operation handlers.

[Rémi Bernon]

From: Rémi Bernon <rbernon(a)codeweavers.com>

Instead of passing them from the stack. The async operation is executed
in a thread pool, which might Release its reference asynchronously and
call a stale function pointer if it is sequenced after the stack
invalidation.
---
 dlls/dinput/tests/force_feedback.c | 120 +++++++++++++++++++++--------
 1 file changed, 86 insertions(+), 34 deletions(-)

diff --git a/dlls/dinput/tests/force_feedback.c b/dlls/dinput/tests/force_feedback.c
index 5ffc6a43471..52afccf6db1 100644
--- a/dlls/dinput/tests/force_feedback.c
+++ b/dlls/dinput/tests/force_feedback.c
@@ -4726,6 +4726,8 @@ static void check_result_async_( int line, IAsyncOperation_ForceFeedbackLoadEffe
 struct bool_async_handler
 {
     IAsyncOperationCompletedHandler_boolean IAsyncOperationCompletedHandler_boolean_iface;
+    LONG refcount;
+
     IAsyncOperation_boolean *async;
     AsyncStatus status;
     BOOL invoked;
@@ -4755,12 +4757,16 @@ static HRESULT WINAPI bool_async_handler_QueryInterface( IAsyncOperationComplete
 
 static ULONG WINAPI bool_async_handler_AddRef( IAsyncOperationCompletedHandler_boolean *iface )
 {
-    return 2;
+    struct bool_async_handler *impl = impl_from_IAsyncOperationCompletedHandler_boolean( iface );
+    return InterlockedIncrement( &impl->refcount );
 }
 
 static ULONG WINAPI bool_async_handler_Release( IAsyncOperationCompletedHandler_boolean *iface )
 {
-    return 1;
+    struct bool_async_handler *impl = impl_from_IAsyncOperationCompletedHandler_boolean( iface );
+    ULONG ref = InterlockedDecrement( &impl->refcount );
+    if (!ref) free( impl );
+    return ref;
 }
 
 static HRESULT WINAPI bool_async_handler_Invoke( IAsyncOperationCompletedHandler_boolean *iface,
@@ -4789,28 +4795,46 @@ static IAsyncOperationCompletedHandler_booleanVtbl bool_async_handler_vtbl =
     bool_async_handler_Invoke,
 };
 
-static struct bool_async_handler default_bool_async_handler = {{&bool_async_handler_vtbl}};
+static IAsyncOperationCompletedHandler_boolean *bool_async_handler_create( HANDLE event )
+{
+    struct bool_async_handler *impl;
+
+    if (!(impl = calloc( 1, sizeof(*impl) ))) return NULL;
+    impl->IAsyncOperationCompletedHandler_boolean_iface.lpVtbl = &bool_async_handler_vtbl;
+    impl->event = event;
+    impl->refcount = 1;
+
+    return &impl->IAsyncOperationCompletedHandler_boolean_iface;
+}
 
 #define await_bool( a ) await_bool_( __LINE__, a )
 static void await_bool_( int line, IAsyncOperation_boolean *async )
 {
-    struct bool_async_handler handler = default_bool_async_handler;
+    IAsyncOperationCompletedHandler_boolean *handler;
+    HANDLE event;
     HRESULT hr;
     DWORD ret;
 
-    handler.event = CreateEventW( NULL, FALSE, FALSE, NULL );
-    ok_(__FILE__, line)( !!handler.event, "CreateEventW failed, error %lu\n", GetLastError() );
-    hr = IAsyncOperation_boolean_put_Completed( async, &handler.IAsyncOperationCompletedHandler_boolean_iface );
+    event = CreateEventW( NULL, FALSE, FALSE, NULL );
+    ok_(__FILE__, line)( !!event, "CreateEventW failed, error %lu\n", GetLastError() );
+
+    handler = bool_async_handler_create( event );
+    ok_(__FILE__, line)( !!handler, "bool_async_handler_create failed\n" );
+    hr = IAsyncOperation_boolean_put_Completed( async, handler );
     ok_(__FILE__, line)( hr == S_OK, "put_Completed returned %#lx\n", hr );
-    ret = WaitForSingleObject( handler.event, 5000 );
+    IAsyncOperationCompletedHandler_boolean_Release( handler );
+
+    ret = WaitForSingleObject( event, 5000 );
     ok_(__FILE__, line)( !ret, "WaitForSingleObject returned %#lx\n", ret );
-    ret = CloseHandle( handler.event );
+    ret = CloseHandle( event );
     ok_(__FILE__, line)( ret, "CloseHandle failed, error %lu\n", GetLastError() );
 }
 
 struct result_async_handler
 {
     IAsyncOperationCompletedHandler_ForceFeedbackLoadEffectResult IAsyncOperationCompletedHandler_ForceFeedbackLoadEffectResult_iface;
+    LONG refcount;
+
     IAsyncOperation_ForceFeedbackLoadEffectResult *async;
     AsyncStatus status;
     BOOL invoked;
@@ -4840,12 +4864,16 @@ static HRESULT WINAPI result_async_handler_QueryInterface( IAsyncOperationComple
 
 static ULONG WINAPI result_async_handler_AddRef( IAsyncOperationCompletedHandler_ForceFeedbackLoadEffectResult *iface )
 {
-    return 2;
+    struct result_async_handler *impl = impl_from_IAsyncOperationCompletedHandler_ForceFeedbackLoadEffectResult( iface );
+    return InterlockedIncrement( &impl->refcount );
 }
 
 static ULONG WINAPI result_async_handler_Release( IAsyncOperationCompletedHandler_ForceFeedbackLoadEffectResult *iface )
 {
-    return 1;
+    struct result_async_handler *impl = impl_from_IAsyncOperationCompletedHandler_ForceFeedbackLoadEffectResult( iface );
+    ULONG ref = InterlockedDecrement( &impl->refcount );
+    if (!ref) free( impl );
+    return ref;
 }
 
 static HRESULT WINAPI result_async_handler_Invoke( IAsyncOperationCompletedHandler_ForceFeedbackLoadEffectResult *iface,
@@ -4874,22 +4902,38 @@ static IAsyncOperationCompletedHandler_ForceFeedbackLoadEffectResultVtbl result_
     result_async_handler_Invoke,
 };
 
-static struct result_async_handler default_result_async_handler = {{&result_async_handler_vtbl}};
+static IAsyncOperationCompletedHandler_ForceFeedbackLoadEffectResult *result_async_handler_create( HANDLE event )
+{
+    struct result_async_handler *impl;
+
+    if (!(impl = calloc( 1, sizeof(*impl) ))) return NULL;
+    impl->IAsyncOperationCompletedHandler_ForceFeedbackLoadEffectResult_iface.lpVtbl = &result_async_handler_vtbl;
+    impl->event = event;
+    impl->refcount = 1;
+
+    return &impl->IAsyncOperationCompletedHandler_ForceFeedbackLoadEffectResult_iface;
+}
 
 #define await_result( a ) await_result_( __LINE__, a )
 static void await_result_( int line, IAsyncOperation_ForceFeedbackLoadEffectResult *async )
 {
-    struct result_async_handler handler = default_result_async_handler;
+    IAsyncOperationCompletedHandler_ForceFeedbackLoadEffectResult *handler;
+    HANDLE event;
     HRESULT hr;
     DWORD ret;
 
-    handler.event = CreateEventW( NULL, FALSE, FALSE, NULL );
-    ok_(__FILE__, line)( !!handler.event, "CreateEventW failed, error %lu\n", GetLastError() );
-    hr = IAsyncOperation_ForceFeedbackLoadEffectResult_put_Completed( async, &handler.IAsyncOperationCompletedHandler_ForceFeedbackLoadEffectResult_iface );
+    event = CreateEventW( NULL, FALSE, FALSE, NULL );
+    ok_(__FILE__, line)( !!event, "CreateEventW failed, error %lu\n", GetLastError() );
+
+    handler = result_async_handler_create( event );
+    ok_(__FILE__, line)( !!handler, "result_async_handler_create failed\n" );
+    hr = IAsyncOperation_ForceFeedbackLoadEffectResult_put_Completed( async, handler );
     ok_(__FILE__, line)( hr == S_OK, "put_Completed returned %#lx\n", hr );
-    ret = WaitForSingleObject( handler.event, 5000 );
+    IAsyncOperationCompletedHandler_ForceFeedbackLoadEffectResult_Release( handler );
+
+    ret = WaitForSingleObject( event, 5000 );
     ok_(__FILE__, line)( !ret, "WaitForSingleObject returned %#lx\n", ret );
-    ret = CloseHandle( handler.event );
+    ret = CloseHandle( event );
     ok_(__FILE__, line)( ret, "CloseHandle failed, error %lu\n", GetLastError() );
 }
 
@@ -5971,7 +6015,7 @@ static void test_windows_gaming_input(void)
     IRawGameControllerStatics *controller_statics;
     EventRegistrationToken controller_added_token;
     IPeriodicForceEffectFactory *periodic_factory;
-    struct bool_async_handler bool_async_handler;
+    struct bool_async_handler *bool_async_handler;
     ForceFeedbackEffectAxes supported_axes, axes;
     IVectorView_ForceFeedbackMotor *motors_view;
     IConditionForceEffect *condition_effect;
@@ -6134,21 +6178,27 @@ static void test_windows_gaming_input(void)
     hr = IAsyncOperation_boolean_get_Completed( bool_async, &tmp_handler );
     ok( hr == S_OK, "get_Completed returned %#lx\n", hr );
     ok( tmp_handler == NULL, "got handler %p\n", tmp_handler );
-    bool_async_handler = default_bool_async_handler;
-    hr = IAsyncOperation_boolean_put_Completed( bool_async, &bool_async_handler.IAsyncOperationCompletedHandler_boolean_iface );
+
+    bool_async_handler = impl_from_IAsyncOperationCompletedHandler_boolean( bool_async_handler_create( NULL ) );
+    ok( !!bool_async_handler, "bool_async_handler_create failed\n" );
+    hr = IAsyncOperation_boolean_put_Completed( bool_async, &bool_async_handler->IAsyncOperationCompletedHandler_boolean_iface );
     ok( hr == S_OK, "put_Completed returned %#lx\n", hr );
-    ok( bool_async_handler.invoked, "handler not invoked\n" );
-    ok( bool_async_handler.async == bool_async, "got async %p\n", bool_async_handler.async );
-    ok( bool_async_handler.status == Completed, "got status %u\n", bool_async_handler.status );
+    ok( bool_async_handler->invoked, "handler not invoked\n" );
+    ok( bool_async_handler->async == bool_async, "got async %p\n", bool_async_handler->async );
+    ok( bool_async_handler->status == Completed, "got status %u\n", bool_async_handler->status );
     hr = IAsyncOperation_boolean_get_Completed( bool_async, &tmp_handler );
     ok( hr == S_OK, "get_Completed returned %#lx\n", hr );
     ok( tmp_handler == NULL, "got handler %p\n", tmp_handler );
-    bool_async_handler = default_bool_async_handler;
-    hr = IAsyncOperation_boolean_put_Completed( bool_async, &bool_async_handler.IAsyncOperationCompletedHandler_boolean_iface );
+    IAsyncOperationCompletedHandler_boolean_Release( &bool_async_handler->IAsyncOperationCompletedHandler_boolean_iface );
+
+    bool_async_handler = impl_from_IAsyncOperationCompletedHandler_boolean( bool_async_handler_create( NULL ) );
+    ok( !!bool_async_handler, "bool_async_handler_create failed\n" );
+    hr = IAsyncOperation_boolean_put_Completed( bool_async, &bool_async_handler->IAsyncOperationCompletedHandler_boolean_iface );
     ok( hr == E_ILLEGAL_DELEGATE_ASSIGNMENT, "put_Completed returned %#lx\n", hr );
-    ok( !bool_async_handler.invoked, "handler invoked\n" );
-    ok( bool_async_handler.async == NULL, "got async %p\n", bool_async_handler.async );
-    ok( bool_async_handler.status == Started, "got status %u\n", bool_async_handler.status );
+    ok( !bool_async_handler->invoked, "handler invoked\n" );
+    ok( bool_async_handler->async == NULL, "got async %p\n", bool_async_handler->async );
+    ok( bool_async_handler->status == Started, "got status %u\n", bool_async_handler->status );
+    IAsyncOperationCompletedHandler_boolean_Release( &bool_async_handler->IAsyncOperationCompletedHandler_boolean_iface );
 
     hr = IAsyncOperation_boolean_QueryInterface( bool_async, &IID_IAsyncInfo, (void **)&async_info );
     ok( hr == S_OK, "QueryInterface returned %#lx\n", hr );
@@ -6169,12 +6219,14 @@ static void test_windows_gaming_input(void)
     wait_hid_expect( file, 100 );
     check_bool_async( bool_async, 1, Error, 0x8685400d, FALSE );
 
-    bool_async_handler = default_bool_async_handler;
-    hr = IAsyncOperation_boolean_put_Completed( bool_async, &bool_async_handler.IAsyncOperationCompletedHandler_boolean_iface );
+    bool_async_handler = impl_from_IAsyncOperationCompletedHandler_boolean( bool_async_handler_create( NULL ) );
+    ok( !!bool_async_handler, "bool_async_handler_create failed\n" );
+    hr = IAsyncOperation_boolean_put_Completed( bool_async, &bool_async_handler->IAsyncOperationCompletedHandler_boolean_iface );
     ok( hr == S_OK, "put_Completed returned %#lx\n", hr );
-    ok( bool_async_handler.invoked, "handler not invoked\n" );
-    ok( bool_async_handler.async == bool_async, "got async %p\n", bool_async_handler.async );
-    ok( bool_async_handler.status == Error, "got status %u\n", bool_async_handler.status );
+    ok( bool_async_handler->invoked, "handler not invoked\n" );
+    ok( bool_async_handler->async == bool_async, "got async %p\n", bool_async_handler->async );
+    ok( bool_async_handler->status == Error, "got status %u\n", bool_async_handler->status );
+    IAsyncOperationCompletedHandler_boolean_Release( &bool_async_handler->IAsyncOperationCompletedHandler_boolean_iface );
 
     hr = IAsyncOperation_boolean_QueryInterface( bool_async, &IID_IAsyncInfo, (void **)&async_info );
     ok( hr == S_OK, "QueryInterface returned %#lx\n", hr );
-- 
GitLab

https://gitlab.winehq.org/wine/wine/-/merge_requests/2063