Fix memory corruption SpirvShaderKey::SpecializationInfo

SpecializationInfo was default copy-constructed / assigned, and held a raw pointer to the copy of the VkSpecializationInfo. This struct was deleted in the destructor, trashing any other copies. Fixes undefined behavior and crashes of a few Vulkan samples. Bug b/123588002 Change-Id: I7adcec2d51bc357ef5bcee1ec6bdafe9ecd208a7 Reviewed-on: https://swiftshader-review.googlesource.com/c/SwiftShader/+/34454 Kokoro-Presubmit: kokoro <noreply+kokoro@google.com> Reviewed-by: Alexis Hétu <sugoi@google.com> Tested-by: Ben Clayton <bclayton@google.com>

Fix memory corruption SpirvShaderKey::SpecializationInfo
e6092f3b · Ben Clayton · 03c2aea0 · e6092f3b · e6092f3b
Commit e6092f3b authored Jul 29, 2019 by Ben Clayton
Show whitespace changes
Inline Side-by-side

Showing with 15 additions and 5 deletions

VkPipelineCache.cpp src/Vulkan/VkPipelineCache.cpp +8 -2

VkPipelineCache.hpp src/Vulkan/VkPipelineCache.hpp +7 -3

No files found.
--- a/src/Vulkan/VkPipelineCache.cpp
+++ b/src/Vulkan/VkPipelineCache.cpp
@@ -22,9 +22,11 @@ PipelineCache::SpirvShaderKey::SpecializationInfo::SpecializationInfo(const VkSp
 {
 	if(specializationInfo)
 	{
-		info = reinterpret_cast<VkSpecializationInfo*>(
+		auto ptr = reinterpret_cast<VkSpecializationInfo*>(
 			allocate(sizeof(VkSpecializationInfo), REQUIRED_MEMORY_ALIGNMENT, DEVICE_MEMORY));

+		info = std::shared_ptr<VkSpecializationInfo>(ptr, Deleter());
+
 		info->mapEntryCount = specializationInfo->mapEntryCount;
 		if(specializationInfo->mapEntryCount > 0)
 		{
@@ -42,10 +44,14 @@ PipelineCache::SpirvShaderKey::SpecializationInfo::SpecializationInfo(const VkSp
 			memcpy(data, specializationInfo->pData, specializationInfo->dataSize);
 			info->pData = data;
 		}
+		else
+		{
+			info->pData = nullptr;
+		}
 	}
 }

-PipelineCache::SpirvShaderKey::SpecializationInfo::~SpecializationInfo()
+void PipelineCache::SpirvShaderKey::SpecializationInfo::Deleter::operator() (VkSpecializationInfo* info) const
 {
 	if(info)
 	{

--- a/src/Vulkan/VkPipelineCache.hpp
+++ b/src/Vulkan/VkPipelineCache.hpp
@@ -52,14 +52,18 @@ public:
 		struct SpecializationInfo
 		{
 			SpecializationInfo(const VkSpecializationInfo* specializationInfo);
-			~SpecializationInfo();

 			bool operator<(const SpecializationInfo& specializationInfo) const;

-			VkSpecializationInfo* get() const { return info; }
+			const VkSpecializationInfo* get() const { return info.get(); }

 		private:
-			VkSpecializationInfo* info = nullptr;
+			struct Deleter
+			{
+				void operator()(VkSpecializationInfo*) const;
+			};
+
+			std::shared_ptr<VkSpecializationInfo> info;
 		};

 		SpirvShaderKey(const VkShaderStageFlagBits pipelineStage,