Repository navigation
clear icd debug list slot after destroying messenger or callback - #2080
Merged
charles-lunarg merged 1 commit intoOct 23, 2026
Merged
Conversation
terminator_DestroyDebugUtilsMessengerEXT and terminator_DestroyDebugReportCallbackEXT call the driver destroy on the per-ICD list slot and release the used-object slot, but leave the destroyed driver handle in the list. The next create is handed the same index, and its error rollback treats a non-NULL slot as a handle this call created, so a driver create failing on a reused slot passes the driver a handle it already destroyed. The rollback loops left their own destroyed handle behind in the same way. Reset the slot to VK_NULL_HANDLE after each driver destroy, matching terminator_DestroySurfaceKHR. The test ICD now returns VK_ERROR_OUT_OF_HOST_MEMORY when the application allocator refuses its handle allocation, and two regression tests cover the reused slot path.
|
User aizu-m not on autobuild list. Waiting for curator authorization before starting CI build. |
1 similar comment
|
User aizu-m not on autobuild list. Waiting for curator authorization before starting CI build. |
|
CI Vulkan-Loader build queued with queue ID 169433. |
|
CI Vulkan-Loader build # 3903 running. |
charles-lunarg
approved these changes
Oct 23, 2026
|
CI Vulkan-Loader build # 3903 passed. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Found while auditing the debug messenger create rollback against terminator_DestroySurfaceKHR, which resets its per-ICD slot after the driver destroy. The debug utils and debug report destroy terminators do not. Reproduced by creating and destroying a messenger, then failing the driver's allocation on the next create into the same slot. The test driver reports:
terminator_DestroyDebugUtilsMessengerEXT calls the driver destroy on debug_utils_messenger_list.list[index] and releases the used-object slot, but leaves the destroyed handle in the list. loader_get_next_available_entry hands that index to the next vkCreateDebugUtilsMessengerEXT. The create rollback treats a non-NULL list[next_index] as a handle this call created. So a driver create that fails with VK_ERROR_OUT_OF_HOST_MEMORY on a reused slot, or a second driver failing after the first succeeded, sends the driver a handle it already destroyed. The rollback left its own destroyed handle behind in the same way.
Reset the slot to VK_NULL_HANDLE after each driver destroy, in both destroy terminators and in both create rollbacks. terminator_DestroyDebugReportCallbackEXT has the same defect and the same fix.
The test ICD now returns VK_ERROR_OUT_OF_HOST_MEMORY when the application allocator refuses its handle allocation, as a conformant driver does. Two regression tests under Allocation create and destroy a messenger or callback, then sweep allocation failures over a second create into the same slot. Both abort in the test driver before the change and pass after.