[PATCH 0/1] MR6: vkd3d: Do not store the latch bit in an object that could be overwritten.

[Giovanni Mascellani (＠giomasce)]

Once a event is signaled, the corresponding struct vkd3d_waiting_event
entry is considered dead and could be overwritten, so it's not safe to
keep a pointer to it in d3d12_fence_SetEventOnCompletion(). Instead,
keep the latch bit in d3d12_fence_SetEventOnCompletion() and put a
pointer to it in struct vkd3d_waiting_event.

[PATCH 1/1] vkd3d: Do not store the latch bit in an object that could be overwritten.

[Giovanni Mascellani]

From: Giovanni Mascellani

Once a event is signaled, the corresponding struct vkd3d_waiting_event
entry is considered dead and could be overwritten, so it's not safe to
keep a pointer to it in d3d12_fence_SetEventOnCompletion(). Instead,
keep the latch bit in d3d12_fence_SetEventOnCompletion() and put a
pointer to it in struct vkd3d_waiting_event.
---
 libs/vkd3d/command.c       | 9 ++++-----
 libs/vkd3d/vkd3d_private.h | 2 +-
 2 files changed, 5 insertions(+), 6 deletions(-)

diff --git a/libs/vkd3d/command.c b/libs/vkd3d/command.c
index 82871053..dabd8424 100644
--- a/libs/vkd3d/command.c
+++ b/libs/vkd3d/command.c
@@ -851,7 +851,7 @@ static void d3d12_fence_signal_external_events_locked(struct d3d12_fence *fence)
             }
             else
             {
-                current->latch = true;
+                *current->latch = true;
                 signal_null_event_cond = true;
             }
         }
@@ -1155,7 +1155,7 @@ static HRESULT STDMETHODCALLTYPE d3d12_fence_SetEventOnCompletion(ID3D12Fence *i
 {
     struct d3d12_fence *fence = impl_from_ID3D12Fence(iface);
     unsigned int i;
-    bool *latch;
+    bool latch = false;
     int rc;

TRACE("iface %p, value %#"PRIx64", event %p.\n", iface, value, event);
@@ -1196,8 +1196,7 @@ static HRESULT STDMETHODCALLTYPE d3d12_fence_SetEventOnCompletion(ID3D12Fence *i

fence->events[fence->event_count].value = value;
     fence->events[fence->event_count].event = event;
-    fence->events[fence->event_count].latch = false;
-    latch = &fence->events[fence->event_count].latch;
+    fence->events[fence->event_count].latch = &latch;
     ++fence->event_count;

/* If event is NULL, we need to block until the fence value completes.
@@ -1206,7 +1205,7 @@ static HRESULT STDMETHODCALLTYPE d3d12_fence_SetEventOnCompletion(ID3D12Fence *i
      * and signal a condition variable instead of calling external signal_event callback. */
     if (!event)
     {
-        while (!*latch)
+        while (!latch)
             vkd3d_cond_wait(&fence->null_event_cond, &fence->mutex);
     }

diff --git a/libs/vkd3d/vkd3d_private.h b/libs/vkd3d/vkd3d_private.h
index d2ab8857..0553e9ef 100644
--- a/libs/vkd3d/vkd3d_private.h
+++ b/libs/vkd3d/vkd3d_private.h
@@ -528,7 +528,7 @@ struct d3d12_fence
     {
         uint64_t value;
         HANDLE event;
-        bool latch;
+        bool *latch;
     } *events;
     size_t events_size;
     size_t event_count;

[PATCH 0/1] MR6: vkd3d: Do not store the latch bit in an object that could be overwritten. - approved

[Henri Verbeet (＠hverbeet)]

This merge request was approved by Henri Verbeet.