Skip to content

Commit a76918c

Browse files
authored
Merge pull request #199 from kdroidFilter/fix/skia-bitmap-use-after-free
fix(windows): prevent use-after-free crash in Skia bitmap during dispose
2 parents f161bb7 + 2b81261 commit a76918c

1 file changed

Lines changed: 8 additions & 20 deletions

File tree

mediaplayer/src/jvmMain/kotlin/io/github/kdroidfilter/composemediaplayer/windows/WindowsVideoPlayerState.kt

Lines changed: 8 additions & 20 deletions
Original file line numberDiff line numberDiff line change
@@ -346,19 +346,10 @@ class WindowsVideoPlayerState : VideoPlayerState {
346346

347347
// Free bitmaps and frame buffers
348348
bitmapLock.write {
349-
val currentFrame = _currentFrame
350-
if (currentFrame != null &&
351-
currentFrame !== skiaBitmapA &&
352-
currentFrame !== skiaBitmapB
353-
) {
354-
currentFrame.close()
355-
}
356349
_currentFrame = null
357350
currentFrameState.value = null
358351

359-
// Clean up double-buffering bitmaps
360-
skiaBitmapA?.close()
361-
skiaBitmapB?.close()
352+
// Don't close bitmaps — see comment in releaseAllResources().
362353
skiaBitmapA = null
363354
skiaBitmapB = null
364355
skiaBitmapWidth = 0
@@ -391,19 +382,16 @@ class WindowsVideoPlayerState : VideoPlayerState {
391382

392383
// Free bitmaps and frame buffers
393384
bitmapLock.write {
394-
val currentFrame = _currentFrame
395-
if (currentFrame != null &&
396-
currentFrame !== skiaBitmapA &&
397-
currentFrame !== skiaBitmapB
398-
) {
399-
currentFrame.close()
400-
}
401385
_currentFrame = null
402386
currentFrameState.value = null
403387

404-
// Clean up double-buffering bitmaps
405-
skiaBitmapA?.close()
406-
skiaBitmapB?.close()
388+
// Do NOT close the double-buffer bitmaps here: the ImageBitmap
389+
// exposed via currentFrameState shares the same native pixel memory
390+
// (asComposeImageBitmap is zero-copy). Compose may still be rendering
391+
// the last frame on the AWT-EventQueue thread. Closing now would free
392+
// the native memory while Skia reads it, causing an access violation.
393+
// Nullifying the references lets the Skia Managed cleaner release them
394+
// once Compose (and any other holder) drops its reference.
407395
skiaBitmapA = null
408396
skiaBitmapB = null
409397
skiaBitmapWidth = 0

0 commit comments

Comments
 (0)