From: Michael Stefaniuc <mstefani@redhat.de>
Subject: dsound: Fix refcounting for the secondary buffer object.
Message-Id: <20110825214244.GA985@redhat.com>
Date: Thu, 25 Aug 2011 23:42:44 +0200

This fixes a regression introduced in 6b64e0090cb7.

The SecondaryBufferImpl had a use after all as as a convoluted object
refcount. IDirectSoundBuffer8 and IDirectSound3DBuffer have independent refcounts; the
other ifaces of this object use the IDirectSoundBuffer8 refcount.
---
Thanks to GyB for reporting this in bug #28180.



 dlls/dsound/buffer.c         |   57 +++++++++++++++++++++++++-----------------
 dlls/dsound/dsound_private.h |    2 +
 dlls/dsound/sound3d.c        |    8 +++++-
 3 files changed, 43 insertions(+), 24 deletions(-)

diff --git a/dlls/dsound/buffer.c b/dlls/dsound/buffer.c
index 7399015..5c8fbba 100644
--- a/dlls/dsound/buffer.c
+++ b/dlls/dsound/buffer.c
@@ -374,6 +374,10 @@ static ULONG WINAPI IDirectSoundBufferImpl_AddRef(IDirectSoundBuffer8 *iface)
     ULONG ref = InterlockedIncrement(&This->ref);
 
     TRACE("(%p) ref was %d\n", This, ref - 1);
+
+    if(ref == 1)
+        InterlockedIncrement(&This->numIfaces);
+
     return ref;
 }
 
@@ -384,28 +388,9 @@ static ULONG WINAPI IDirectSoundBufferImpl_Release(IDirectSoundBuffer8 *iface)
 
     TRACE("(%p) ref was %d\n", This, ref + 1);
 
-    if (!ref) {
-	DirectSoundDevice_RemoveBuffer(This->device, This);
-	RtlDeleteResource(&This->lock);
-
-	if (This->hwbuf)
-		IDsDriverBuffer_Release(This->hwbuf);
-	if (!This->hwbuf || (This->device->drvdesc.dwFlags & DSDDESC_USESYSTEMMEMORY)) {
-		This->buffer->ref--;
-		list_remove(&This->entry);
-		if (This->buffer->ref==0) {
-			HeapFree(GetProcessHeap(),0,This->buffer->memory);
-			HeapFree(GetProcessHeap(),0,This->buffer);
-		}
-	}
-
-	HeapFree(GetProcessHeap(), 0, This->tmp_buffer);
-	HeapFree(GetProcessHeap(), 0, This->notifies);
-	HeapFree(GetProcessHeap(), 0, This->pwfx);
-	HeapFree(GetProcessHeap(), 0, This);
+    if (!ref && !InterlockedDecrement(&This->numIfaces))
+        secondarybuffer_destroy(This);
 
-	TRACE("(%p) released\n", This);
-    }
     return ref;
 }
 
@@ -971,6 +956,7 @@ HRESULT IDirectSoundBufferImpl_Create(
 	TRACE("Created buffer at %p\n", dsb);
 
         dsb->ref = 1;
+        dsb->numIfaces = 1;
 	dsb->device = device;
         dsb->IDirectSoundBuffer8_iface.lpVtbl = &dsbvt;
 	dsb->iks = NULL;
@@ -1123,6 +1109,30 @@ HRESULT IDirectSoundBufferImpl_Create(
 	return err;
 }
 
+void secondarybuffer_destroy(IDirectSoundBufferImpl *This)
+{
+    DirectSoundDevice_RemoveBuffer(This->device, This);
+    RtlDeleteResource(&This->lock);
+
+    if (This->hwbuf)
+        IDsDriverBuffer_Release(This->hwbuf);
+    if (!This->hwbuf || (This->device->drvdesc.dwFlags & DSDDESC_USESYSTEMMEMORY)) {
+        This->buffer->ref--;
+        list_remove(&This->entry);
+        if (This->buffer->ref == 0) {
+            HeapFree(GetProcessHeap(), 0, This->buffer->memory);
+            HeapFree(GetProcessHeap(), 0, This->buffer);
+        }
+    }
+
+    HeapFree(GetProcessHeap(), 0, This->tmp_buffer);
+    HeapFree(GetProcessHeap(), 0, This->notifies);
+    HeapFree(GetProcessHeap(), 0, This->pwfx);
+    HeapFree(GetProcessHeap(), 0, This);
+
+    TRACE("(%p) released\n", This);
+}
+
 HRESULT IDirectSoundBufferImpl_Destroy(
     IDirectSoundBufferImpl *pdsb)
 {
@@ -1130,7 +1140,7 @@ HRESULT IDirectSoundBufferImpl_Destroy(
 
     /* This keeps the *_Destroy functions from possibly deleting
      * this object until it is ready to be deleted */
-    IDirectSoundBufferImpl_AddRef(&pdsb->IDirectSoundBuffer8_iface);
+    InterlockedIncrement(&pdsb->numIfaces);
 
     if (pdsb->iks) {
         WARN("iks not NULL\n");
@@ -1150,7 +1160,7 @@ HRESULT IDirectSoundBufferImpl_Destroy(
         pdsb->notify = NULL;
     }
 
-    while (IDirectSoundBuffer8_Release(&pdsb->IDirectSoundBuffer8_iface) > 0);
+    secondarybuffer_destroy(pdsb);
 
     return S_OK;
 }
@@ -1196,6 +1206,7 @@ HRESULT IDirectSoundBufferImpl_Duplicate(
     dsb->buffer->ref++;
     list_add_head(&dsb->buffer->buffers, &dsb->entry);
     dsb->ref = 1;
+    dsb->numIfaces = 1;
     dsb->state = STATE_STOPPED;
     dsb->buf_mixpos = dsb->sec_mixpos = 0;
     dsb->notify = NULL;
diff --git a/dlls/dsound/dsound_private.h b/dlls/dsound/dsound_private.h
index fb02495..1410a9c 100644
--- a/dlls/dsound/dsound_private.h
+++ b/dlls/dsound/dsound_private.h
@@ -159,6 +159,7 @@ HRESULT DirectSoundDevice_VerifyCertification(DirectSoundDevice * device,
 struct IDirectSoundBufferImpl
 {
     IDirectSoundBuffer8         IDirectSoundBuffer8_iface;
+    LONG                        numIfaces; /* "in use interfaces" refcount */
     LONG                        ref;
     /* IDirectSoundBufferImpl fields */
     DirectSoundDevice*          device;
@@ -206,6 +207,7 @@ HRESULT IDirectSoundBufferImpl_Duplicate(
     DirectSoundDevice *device,
     IDirectSoundBufferImpl **ppdsb,
     IDirectSoundBufferImpl *pdsb) DECLSPEC_HIDDEN;
+void secondarybuffer_destroy(IDirectSoundBufferImpl *This) DECLSPEC_HIDDEN;
 
 /*****************************************************************************
  * PrimaryBuffer implementation structure
diff --git a/dlls/dsound/sound3d.c b/dlls/dsound/sound3d.c
index 956013d..48b49bc 100644
--- a/dlls/dsound/sound3d.c
+++ b/dlls/dsound/sound3d.c
@@ -335,7 +335,12 @@ static ULONG WINAPI IDirectSound3DBufferImpl_AddRef(LPDIRECTSOUND3DBUFFER iface)
 {
     IDirectSound3DBufferImpl *This = (IDirectSound3DBufferImpl *)iface;
     ULONG ref = InterlockedIncrement(&(This->ref));
+
     TRACE("(%p) ref was %d\n", This, ref - 1);
+
+    if(ref == 1)
+        InterlockedIncrement(&This->dsb->numIfaces);
+
     return ref;
 }
 
@@ -347,7 +352,8 @@ static ULONG WINAPI IDirectSound3DBufferImpl_Release(LPDIRECTSOUND3DBUFFER iface
 
     if (!ref) {
         This->dsb->ds3db = NULL;
-        IDirectSoundBuffer_Release((LPDIRECTSOUNDBUFFER8)This->dsb);
+        if (!InterlockedDecrement(&This->dsb->numIfaces))
+            secondarybuffer_destroy(This->dsb);
         HeapFree(GetProcessHeap(), 0, This);
         TRACE("(%p) released\n", This);
     }
-- 
1.7.6