From a6a5db436431a7b6835ce0e7cdcad44099a21e26 Mon Sep 17 00:00:00 2001 From: Icenowy Zheng Date: Fri, 19 Dec 2025 23:52:33 +0800 Subject: [PATCH] vulkan/wsi/headless: do not destroy images that are never created Currently the image creation failure handling codepath of wsi_headless_surface_create_swapchain() just calls wsi_headless_swapchain_destroy() , which will try to destroy all `image_count` of images. However, some of these images might never be successfully created because of the failure, which leads to double-free. Set image_count to the number of successfully created images before calling wsi_headless_swapchin_destroy() to prevent over-destroying. Fixes dEQP-VK.wsi.headless.swapchain.simulate_oom.* on lavapipe and pvr, although some of the tests got QualityWarning saying "Creating swapchain did not succeed, callback limit exceeded" on lavapipe (Pass on pvr). Signed-off-by: Icenowy Zheng --- src/vulkan/wsi/wsi_common_headless.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/src/vulkan/wsi/wsi_common_headless.c b/src/vulkan/wsi/wsi_common_headless.c index 46db5a49f09..236e092c522 100644 --- a/src/vulkan/wsi/wsi_common_headless.c +++ b/src/vulkan/wsi/wsi_common_headless.c @@ -406,8 +406,11 @@ wsi_headless_surface_create_swapchain(VkIcdSurfaceBase *icd_surface, for (uint32_t i = 0; i < chain->base.image_count; i++) { result = wsi_create_image(&chain->base, &chain->base.image_info, &chain->images[i].base); - if (result != VK_SUCCESS) + if (result != VK_SUCCESS) { + /* Record how many images need to be torn down */ + chain->base.image_count = i; goto fail; + } chain->images[i].busy_on_host = false; chain->images[i].busy_on_device = false;