Prevent glDeleteQueries from deleting a live Query
glDeleteQueries() instantly deletes all the es2::Query objects
passed as arguments to this function. If some of these queries
are still being used by the renderer, this will result in a use
after free error. To solve this issue, sw::Query is now a also
ref counted object.
Bug chromium:904714
Change-Id: Ic1d5781bbf1724d8d07936fd49c8a172dc3d9fd4
Reviewed-on: https://swiftshader-review.googlesource.com/c/22548
Tested-by: Alexis Hétu <sugoi@google.com>
Reviewed-by: Nicolas Capens <nicolascapens@google.com>
diff --git a/src/D3D9/Direct3DQuery9.cpp b/src/D3D9/Direct3DQuery9.cpp
index 31d249e..b6a3b2d 100644
--- a/src/D3D9/Direct3DQuery9.cpp
+++ b/src/D3D9/Direct3DQuery9.cpp
@@ -41,7 +41,7 @@
{
device->removeQuery(query);
- delete query;
+ query->release();
}
}
@@ -202,7 +202,7 @@
return INVALIDCALL();
}
- bool signaled = !query || query->reference == 0;
+ bool signaled = !query || query->isReady();
if(size && signaled)
{
