From: Yuxuan Shui yshui@codeweavers.com
IDirectMusicPerformance8 holds references to music ports in channel_blocks. These ports must outlive their parent IDirectMusic, because in synth_port_Release, they remove themselves from their parent.
performance_CloseDown releases the IDirectMusic, but doesn't release its ports. So when these ports are later released in performance_Release, they uses the already freed IDirectMusic.
Found by ASan. --- dlls/dmime/performance.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/dlls/dmime/performance.c b/dlls/dmime/performance.c index 500bc8b536f..3c67fbcadb4 100644 --- a/dlls/dmime/performance.c +++ b/dlls/dmime/performance.c @@ -447,7 +447,8 @@ static ULONG WINAPI performance_Release(IDirectMusicPerformance8 *iface) TRACE("(%p): ref=%ld\n", This, ref);
if (ref == 0) { - wine_rb_destroy(&This->channel_blocks, channel_block_free, NULL); + if (This->channel_blocks.root) + WARN("(%p): CloseDown was not called on this performance.\n", This); This->safe.DebugInfo->Spare[0] = 0; DeleteCriticalSection(&This->safe); free(This); @@ -1454,6 +1455,7 @@ static HRESULT WINAPI performance_CloseDown(IDirectMusicPerformance8 *iface)
performance_set_primary_segment(This, NULL); performance_set_control_segment(This, NULL); + wine_rb_destroy(&This->channel_blocks, channel_block_free, NULL);
if (This->master_clock) {