Fix stale comments

- hook_guard.hpp top block: described removal as `hook = {}` (destroy/reset); the
  model is now persistent disable_for_removal (never destroyed mid-session, the
  trampoline stays alive). Updated to match.
- input_source.hpp: SteamInputSource is no longer "future" -- it exists and is
  opt-in; reworded.
- audio_ring.hpp: format_generation actually bumps on every set_format (not
  "reserved, v1 sets once"); verify_capture is a 4-byte atomic guarded by the
  version gate (not "repurposed from a reserved byte old builds saw"); and the
  SharedBlock is no longer "20-byte pads".
- audio_format_verifier.cpp: dropped a dead `(void)recover_layout;` with a stale
  "step (a) only" comment -- the parameter is actually used.

Comment-only except the dead (void) cast.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
This commit is contained in:
2026-06-24 02:25:42 +02:00
parent 47be3fa53f
commit 5b2334f6e6
5 changed files with 21 additions and 23 deletions

View File

@@ -7,13 +7,14 @@
// use-after-free -> the game crashes (the "spamming Mirror video crashed Brotato" bug).
//
// The fix mirrors the audio hooks' epoch+drain pattern, generalised for inline hooks:
// 1. Restore/disable the hook FIRST so no NEW detour can start. For a SafetyHook inline hook
// that's `hook = {}` (reset): it restores the original bytes under thread suspension, and
// its mutex-guarded call wrappers make any in-flight trampoline call safe. For a hook the
// game reaches by a cached pointer (Vulkan present, the WNDPROC subclass) it's clearing an
// atomic gate / restoring the window proc.
// 2. drain() -- wait (bounded) for detour BODIES already running to finish, since the reset
// above does NOT wait for the part of the detour that runs before it calls the trampoline.
// 1. Disable the hook FIRST so no NEW detour can start. For a SafetyHook inline hook that's
// `disable_for_removal(hook)` (disable, NOT `= {}` destroy): it restores the original bytes but
// keeps the trampoline alive -- hooks are PERSISTENT, never destroyed mid-session, so an in-flight
// detour about to call the trampoline never finds it freed (see hook_install.hpp). For a hook the
// game reaches by a cached pointer (Vulkan present, the WNDPROC subclass) it's clearing an atomic
// gate / restoring the window proc instead.
// 2. drain() -- wait (bounded) for detour BODIES already running to finish, since the disable above
// does NOT wait for the part of the detour that runs before it calls the trampoline.
// 3. Only THEN free the shared state the detour was reading.
//
// Each detour wraps its whole body in a DetourGate::Guard (an RAII active-count). drain() spins