[dxvk] Fix barrier refcounting issueasan2

Before this commit, imgslices stored a raw pointer to a DXVK image.

Needs to be ref-counted otherwise we can end up with a use after free here in the pointer comparison:
 - operator == in Rc with a raw pointer will cast the raw to a Rc
 - Because it was a raw pointer, and not ref-tracked it may have already been freed
 - Comparing with a raw pointer directly would be bad as we could get another image allocated at the same address so we must ref track for barrier lists

2 files changed, 4 insertions, 4 deletions

diff --git a/src/dxvk/dxvk_barrier.cpp b/src/dxvk/dxvk_barrier.cpp
index 00cb5c70..dc062466 100644
--- a/src/dxvk/dxvk_barrier.cpp
+++ b/src/dxvk/dxvk_barrier.cpp
@@ -73,7 +73,7 @@ namespace dxvk {
       m_imgBarriers.push_back(barrier);
     }
 
-    m_imgSlices.push_back({ image.ptr(), subresources, access });
+    m_imgSlices.push_back({ image, subresources, access });
   }
 
 
@@ -152,8 +152,8 @@ namespace dxvk {
     acquire.m_imgBarriers.push_back(barrier);
 
     DxvkAccessFlags access(DxvkAccess::Read, DxvkAccess::Write);
-    release.m_imgSlices.push_back({ image.ptr(), subresources, access });
-    acquire.m_imgSlices.push_back({ image.ptr(), subresources, access });
+    release.m_imgSlices.push_back({ image, subresources, access });
+    acquire.m_imgSlices.push_back({ image, subresources, access });
   }
 
 
diff --git a/src/dxvk/dxvk_barrier.h b/src/dxvk/dxvk_barrier.h
index e97669c6..91b63e49 100644
--- a/src/dxvk/dxvk_barrier.h
+++ b/src/dxvk/dxvk_barrier.h
@@ -93,7 +93,7 @@ namespace dxvk {
     };
 
     struct ImgSlice {
-      DxvkImage*              image;
+      Rc<DxvkImage>           image;
       VkImageSubresourceRange subres;
       DxvkAccessFlags         access;
     };