Skip to content

D3D9On12: pass nullptr to transient ResidencySet::Open#112

Closed
vdwtanner wants to merge 1 commit into
mainfrom
user/tvandewalle/residencyset_dangling_53802456
Closed

D3D9On12: pass nullptr to transient ResidencySet::Open#112
vdwtanner wants to merge 1 commit into
mainfrom
user/tvandewalle/residencyset_dangling_53802456

Conversation

@vdwtanner

@vdwtanner vdwtanner commented Jun 6, 2026

Copy link
Copy Markdown
Collaborator

Problem

Consumer-side update to track the breaking signature change for D3D12TranslationLayer::ResidencySet::Open() introduced in:

See that PR for full root-cause analysis.

Change

D3D9on12::Device::UnwrapResource (9on12Device.cpp:308) constructs a transient ResidencySet, opens it on the MAX_VALID (transient) command-list slot, inserts one residency handle, closes, and submits — all in a single call frame on the same thread. The set is never visible to EndTrackingObject, so manager registration is pure overhead.

Passing nullptr for the new ResidencyManager* parameter opts this call site into the "no tracking, no locking" mode, matching its actual lifetime.

-            pResidencySet->Open((UINT)D3D12TranslationLayer::COMMAND_LIST_TYPE::MAX_VALID);

+            // Transient set: lifetime is bounded to this call frame, so it cannot race with a destroyed

+            // Resource via ResidencyManager::EndTrackingObject. Pass nullptr to skip manager registration.

+            pResidencySet->Open((UINT)D3D12TranslationLayer::COMMAND_LIST_TYPE::MAX_VALID, nullptr);

Dependencies

Verification

Compile-clean build of d3d9on12.dll (Debug x64) against the updated D3D12TranslationLayer branch. Same d3d9on12.dll was used for the end-to-end TAEF repro in the D3D12TranslationLayer PR's verification section (the test that exercises the underlying UAF runs through this DLL).

Pre-empted review questions

  • Behavior change at this call site? None — the transient set never had a real concurrent-destroy exposure; nullptr just removes the overhead the new tracking would otherwise add.

  • Regression risk? None — mechanical 1-line change, same lock-free fast path as before.

@vdwtanner

Copy link
Copy Markdown
Collaborator Author

Closing -- D3D12TranslationLayer PR #114 pivoted to a no-API-change design per Jesse's review (microsoft/D3D12TranslationLayer#114 (comment)), so no consumer-side update is needed. The dependency this PR existed to track no longer exists.

@vdwtanner vdwtanner closed this Jun 7, 2026
@vdwtanner vdwtanner deleted the user/tvandewalle/residencyset_dangling_53802456 branch June 7, 2026 07:56
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant