Giovanni Mascellani : vkd3d: Do not store the latch bit in an object that could be overwritten.

[Alexandre Julliard]

Module: vkd3d
Branch: master
Commit: 4112c3607610b6e5df5de8356535eae20f4fe046
URL:    https://gitlab.winehq.org/wine/vkd3d/-/commit/4112c3607610b6e5df5de8356535ea...

Author: Giovanni Mascellani 
Date:   Tue Aug  9 14:05:24 2022 +0200

vkd3d: Do not store the latch bit in an object that could be overwritten.

Once a event is signaled, the corresponding struct vkd3d_waiting_event
entry is considered dead and could be overwritten, so it's not safe to
keep a pointer to it in d3d12_fence_SetEventOnCompletion(). Instead,
keep the latch bit in d3d12_fence_SetEventOnCompletion() and put a
pointer to it in struct vkd3d_waiting_event.

---

libs/vkd3d/command.c       | 9 ++++-----
 libs/vkd3d/vkd3d_private.h | 2 +-
 2 files changed, 5 insertions(+), 6 deletions(-)

diff --git a/libs/vkd3d/command.c b/libs/vkd3d/command.c
index 82871053..dabd8424 100644
--- a/libs/vkd3d/command.c
+++ b/libs/vkd3d/command.c
@@ -851,7 +851,7 @@ static void d3d12_fence_signal_external_events_locked(struct d3d12_fence *fence)
             }
             else
             {
-                current->latch = true;
+                *current->latch = true;
                 signal_null_event_cond = true;
             }
         }
@@ -1155,7 +1155,7 @@ static HRESULT STDMETHODCALLTYPE d3d12_fence_SetEventOnCompletion(ID3D12Fence *i
 {
     struct d3d12_fence *fence = impl_from_ID3D12Fence(iface);
     unsigned int i;
-    bool *latch;
+    bool latch = false;
     int rc;

TRACE("iface %p, value %#"PRIx64", event %p.\n", iface, value, event);
@@ -1196,8 +1196,7 @@ static HRESULT STDMETHODCALLTYPE d3d12_fence_SetEventOnCompletion(ID3D12Fence *i

fence->events[fence->event_count].value = value;
     fence->events[fence->event_count].event = event;
-    fence->events[fence->event_count].latch = false;
-    latch = &fence->events[fence->event_count].latch;
+    fence->events[fence->event_count].latch = &latch;
     ++fence->event_count;

/* If event is NULL, we need to block until the fence value completes.
@@ -1206,7 +1205,7 @@ static HRESULT STDMETHODCALLTYPE d3d12_fence_SetEventOnCompletion(ID3D12Fence *i
      * and signal a condition variable instead of calling external signal_event callback. */
     if (!event)
     {
-        while (!*latch)
+        while (!latch)
             vkd3d_cond_wait(&fence->null_event_cond, &fence->mutex);
     }

diff --git a/libs/vkd3d/vkd3d_private.h b/libs/vkd3d/vkd3d_private.h
index 8bbb4838..c9b70d9c 100644
--- a/libs/vkd3d/vkd3d_private.h
+++ b/libs/vkd3d/vkd3d_private.h
@@ -530,7 +530,7 @@ struct d3d12_fence
     {
         uint64_t value;
         HANDLE event;
-        bool latch;
+        bool *latch;
     } *events;
     size_t events_size;
     size_t event_count;