http://bugs.winehq.org/show_bug.cgi?id=16280
Summary: IDirect3DDevice9::reset() is flawed. Product: Wine Version: 1.1.9 Platform: All OS/Version: other Status: UNCONFIRMED Severity: normal Priority: P2 Component: directx-d3d AssignedTo: wine-bugs@winehq.org ReportedBy: jerome.gardou@laposte.net
I found this bug when tracking down a crash in Supreme commander. This game calls device->reset(), and crashes.
Reading the code there (taken from the line 316 of d3d9/device.c) :
if(pool == WINED3DPOOL_DEFAULT) { IWineD3DResource_GetParent(resource, &parent); if(IUnknown_Release(parent) == 0) { TRACE("Parent %p is an implicit resource with ref 0\n", parent); } else { WARN("Resource %p(wineD3D %p) with pool D3DPOOL_DEFAULT blocks the Reset call\n", parent, resource); ret = S_FALSE; *resources_ok = FALSE; } }
the assumption is made that the ref of parent is 0, which seems correct, but calling getparent calls IUnknown_AddRef, on an already freed object => crash !
http://bugs.winehq.org/show_bug.cgi?id=16280
Vitaliy Margolen vitaliy@kievinfo.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Status|UNCONFIRMED |RESOLVED Resolution| |INVALID
--- Comment #1 from Vitaliy Margolen vitaliy@kievinfo.com 2008-11-30 14:28:29 --- IUnknown_Release() returns _new_ refcount not old. So the function is correct. At least as far as the code goes. You already indicated there is another bug for your game.
Closing invalid.
http://bugs.winehq.org/show_bug.cgi?id=16280
Vitaliy Margolen vitaliy@kievinfo.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Status|RESOLVED |CLOSED
--- Comment #2 from Vitaliy Margolen vitaliy@kievinfo.com 2008-11-30 14:28:43 --- Closing
http://bugs.winehq.org/show_bug.cgi?id=16280
Jérôme Gardou jerome.gardou@laposte.net changed:
What |Removed |Added ---------------------------------------------------------------------------- Status|CLOSED |UNCONFIRMED Resolution|INVALID |
--- Comment #3 from Jérôme Gardou jerome.gardou@laposte.net 2008-11-30 14:42:18 --- I disagree there. GetParent calls parent->addref(), so assuming that parent->release returns 0, leads to assume that refcount BEFORE getparent is 0. Calling addref on it leads to a crash... Sorry, but I reopen this one.
http://bugs.winehq.org/show_bug.cgi?id=16280
Vitaliy Margolen vitaliy@kievinfo.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Status|UNCONFIRMED |RESOLVED Resolution| |INVALID
--- Comment #4 from Vitaliy Margolen vitaliy@kievinfo.com 2008-11-30 15:29:05 --- No not correct. Closing invalid. You already have a bug for your game right?
http://bugs.winehq.org/show_bug.cgi?id=16280
Vitaliy Margolen vitaliy@kievinfo.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Status|RESOLVED |CLOSED
--- Comment #5 from Vitaliy Margolen vitaliy@kievinfo.com 2008-11-30 15:29:19 --- DO NOT reopen!
http://bugs.winehq.org/show_bug.cgi?id=16280
--- Comment #6 from Vitaliy Margolen vitaliy@kievinfo.com 2008-11-30 15:31:17 --- Also don't forget that in dx3d refcounts are all broken courtesy of MS' "great design". So it _is_ possible to have refcounts of 0 and not destroyed object.
http://bugs.winehq.org/show_bug.cgi?id=16280
Dmitry Timoshkov dmitry@codeweavers.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Platform|All |Other
http://bugs.winehq.org/show_bug.cgi?id=16280
--- Comment #7 from Jérôme Gardou jerome.gardou@laposte.net 2008-12-06 06:01:49 --- This bug IS the one that I encounter in my game... Commenting out this piece of code makes it happy and resetting the device properly.
Also, refcounts of zero in undestroyed objects are rare cases, and wine's implementation of d3d should not rely on it.