layers: Fix DestDescPool data race

Data was destroyed after the down-chain call, which left the
possibility that before the items could be removed from the data
structure that they might be reused which would corrupt validation.
Fixed by destroying inside the lock before the down-chain call.

Change-Id: Icbc994ef043a1108c84474879617d4ada694b74b

1 files changed, 13 insertions, 13 deletions

diff --git a/layers/core_validation.cpp b/layers/core_validation.cpp
index a3dd9915..9ea19d17 100644
--- a/layers/core_validation.cpp
+++ b/layers/core_validation.cpp
@@ -4354,16 +4354,18 @@ static bool PreCallValidateDestroyDescriptorPool(layer_data *dev_data, VkDescrip
     return skip;
 }
 
-static void PostCallRecordDestroyDescriptorPool(layer_data *dev_data, VkDescriptorPool descriptorPool,
-                                                DESCRIPTOR_POOL_STATE *desc_pool_state, VK_OBJECT obj_struct) {
-    // Any bound cmd buffers are now invalid
-    invalidateCommandBuffers(dev_data, desc_pool_state->cb_bindings, obj_struct);
-    // Free sets that were in this pool
-    for (auto ds : desc_pool_state->sets) {
-        freeDescriptorSet(dev_data, ds);
+static void PreCallRecordDestroyDescriptorPool(layer_data *dev_data, VkDescriptorPool descriptorPool,
+                                               DESCRIPTOR_POOL_STATE *desc_pool_state, VK_OBJECT obj_struct) {
+    if (desc_pool_state) {
+        // Any bound cmd buffers are now invalid
+        invalidateCommandBuffers(dev_data, desc_pool_state->cb_bindings, obj_struct);
+        // Free sets that were in this pool
+        for (auto ds : desc_pool_state->sets) {
+            freeDescriptorSet(dev_data, ds);
+        }
+        dev_data->descriptorPoolMap.erase(descriptorPool);
+        delete desc_pool_state;
     }
-    dev_data->descriptorPoolMap.erase(descriptorPool);
-    delete desc_pool_state;
 }
 
 VKAPI_ATTR void VKAPI_CALL DestroyDescriptorPool(VkDevice device, VkDescriptorPool descriptorPool,
@@ -4374,14 +4376,12 @@ VKAPI_ATTR void VKAPI_CALL DestroyDescriptorPool(VkDevice device, VkDescriptorPo
     unique_lock_t lock(global_lock);
     bool skip = PreCallValidateDestroyDescriptorPool(dev_data, descriptorPool, &desc_pool_state, &obj_struct);
     if (!skip) {
+        PreCallRecordDestroyDescriptorPool(dev_data, descriptorPool, desc_pool_state, obj_struct);
         lock.unlock();
         dev_data->dispatch_table.DestroyDescriptorPool(device, descriptorPool, pAllocator);
-        lock.lock();
-        if (descriptorPool != VK_NULL_HANDLE) {
-            PostCallRecordDestroyDescriptorPool(dev_data, descriptorPool, desc_pool_state, obj_struct);
-        }
     }
 }
+
 // Verify cmdBuffer in given cb_node is not in global in-flight set, and return skip result
 //  If this is a secondary command buffer, then make sure its primary is also in-flight
 //  If primary is not in-flight, then remove secondary from global in-flight set