[Bug 7054] Pure Pinball game crashes trying to access freed texture objects

http://bugs.winehq.org/show_bug.cgi?id=7054

--- Comment #12 from Henri Verbeet  2012-02-26 09:23:40 CST ---
(In reply to comment #11)
> 0024:trace:d3d8:IDirect3DDevice8Impl_SetTexture iface 0x154280, stage 0,
> texture 0x123bb8. 
> ...
> 0024:trace:d3d8:IDirect3DDevice8Impl_Release 0x154280 decreasing refcount to 3.
> 0024:trace:d3d8:IDirect3DTexture8Impl_Release 0x123bb8 decreasing refcount to
> 0. 
> ...
> 0024:Call ntdll.RtlFreeHeap(00110000,00000000,00123bb8) ret=7e7d9228
> 0024:trace:heap:RtlFreeHeap (0x110000,70000062,0x123bb8): returning TRUE 
> ...
> 0024:Call wined3d.wined3d_texture_decref(002115a0) ret=7e7d8565 
> ...
> 0024:trace:d3d8:IDirect3DDevice8Impl_Release 0x154280 decreasing refcount to 2.
>
> I'm not sure if d3d8 is at fault here (reference counting?).

Is a different texture set on stage 0 before the texture is actually freed?
Resources are kept alive as long as they're referenced by the device /
stateblock, even though the refcount may fall to 0. A
IDirect3DDevice8Impl_GetTexture() call for example would bump it up to 1 again
in that case.

If I'm reading the disassembly there correctly though, it's trying to call
IDirect3DTexture8_Release() on the texture, which would only make sense if the
application is still supposed to hold a reference to the texture at the point.