In wined3d_swapchain_cleanup, before decrementing the reference counts of each of the back/front
buffers, we first set their swapchain to NULL, presumably to stop the current under-destruction
swapchain from being used through them. But there is an oversight.
When we call wined3d_texture_decref on the front_buffer, the back_buffers still have their
swapchains pointing to the swapchain being destroyed. In texture_resource_unload, we call
context_acquire(device, NULL, 0), note the NULL texture parameter here. When the texture parameter
is NULL, wined3d_context_gl_acquire (in turn called by context_acquire) will default to using the
first back buffer from the implicit swapchain of "device", which, as previously stated, has not had
their swapchain set to NULL yet. From here, we reach wined3d_context_gl_activate with a texture
whose swapchain is currently being destroyed. This swapchain is then assigned to "context_gl" here
before being freed, leaving a dangling pointer.
When this context_gl is acquired again later, we will try to access
context_gl->c.swapchain->win_handle, thus complete the use-after-free cycle.
This commit makes sure the swapchain pointer of ALL front and back buffers are set to NULL before
decrementing their reference counts.
Wine-Bug: https://bugs.winehq.org/show_bug.cgi?id=58325
--
https://gitlab.winehq.org/wine/wine/-/merge_requests/8406
If a session is shutdown when its command_state is already COMPLETE,
session_handle_source_shutdown calls session_set_stopped, which calls
session_command_complete which will submit the op at the head of commands again,
despite it having already been submitted.
Given that only the op at the head of commands can be in the submitted state,
tracking it as a command state makes more sense to me. And if the command state
is SUBMITTED we know not to submit the op again.
* * *
Superceded !8270
--
v3: mf: Add a SUBMITTED command state to avoid multiple submission of the same op.
https://gitlab.winehq.org/wine/wine/-/merge_requests/8722
I split the implementations into 2 parts to make it looks easier to review. So plz first review this MR and make sure it's good so that we don't have to rebase. The follwing patches is in !7571.
--
v3: mfreadwrite: Implement sink_writer_SetInputMediaType.
mfreadwrite: Implement IMFSinkWriterEx.
mfreadwrite: Add converter transform to stream.
mfreadwrite: Add attributes member to writer struct.
https://gitlab.winehq.org/wine/wine/-/merge_requests/7570
WaitCompletionPacket is a kernel object that, when associated with a target object and a completion object and when the target object is signaled, adds the completion information stored in itself to the completion object.
For React Native.
--
v3: ntdll: Implement NtCancelWaitCompletionPacket().
ntdll: Implement NtAssociateWaitCompletionPacket().
ntdll: Implement NtCreateWaitCompletionPacket().
ntdll/tests: Add NtCancelWaitCompletionPacket() tests.
ntdll/tests: Add NtAssociateWaitCompletionPacket() tests.
ntdll/tests: Add NtCreateWaitCompletionPacket() tests.
ntdll/tests: Add WaitCompletionPacket object tests.
https://gitlab.winehq.org/wine/wine/-/merge_requests/6911
These patches make a test case attached to the bug https://bugs.winehq.org/show_bug.cgi?id=33190 work.
--
v8: win32u: NtGdiExtTextOutW() should translate x,y from logical to device units at the last step.
win32u: Fix device<->world width/height converters.
win32u: Use slightly more readable names for DP/LP converters.
win32u: Use correct helper for converting width to device units.
gdi32/tests: Add some tests for rotated font metrics.
https://gitlab.winehq.org/wine/wine/-/merge_requests/5068
This format is used for video output with a depth of 10 bits per channel. Decoding at 10-bit quality is not currently supported, but this patch makes video playable.
--
v4: mfmediaengine: Support video output in format R10G10B10A2.
mfmediaengine: Rename media_engine_transfer_to_d3d11_texture() helper function.
mfmediaengine/tests: Test output to format R10G10B10A2 from H.264.
https://gitlab.winehq.org/wine/wine/-/merge_requests/8531