[Windows] App crash (use-after-free) in DirectXDeviceManager::DiscardDeviceResources — raw Release() on com_ptr-owned D2D device/context

Description

On Windows, react-native-svg can crash with an ACCESS_VIOLATION inside d2d1.dll during rendering (e.g. d2d1!...DrawRectangle) shortly after an SvgView is loaded.

Root cause is in the Windows native code, in DirectXDeviceManager::DiscardDeviceResources():

if (m_device.as<...D2DDevice>()->Get() != nullptr) {
  m_device.as<...D2DDevice>()->Get()->Release();          // over-release
}
if (m_deviceContext.as<...D2DDeviceContext>()->Get() != nullptr) {
  m_deviceContext.as<...D2DDeviceContext>()->Get()->Release();  // over-release
}

These members are com_ptr-owned. Calling raw Release() via Get() drops a reference the com_ptr still owns and will release again on destruction/reassignment. Because the D2D device and device context are shared across all SvgViews, this decrements the refcount below the true number of owners, freeing the object while it is still in use. The next draw tick then dereferences a freed ID2D1DeviceContext and faults inside d2d1.dll.

This is not a Direct2D (OS) defect and not a defect in the host framework — d2d1.dll is the victim of the over-release, not the cause.

Expected: DiscardDeviceResources() should release the resources exactly once (by resetting the com_ptrs) without corrupting the shared device refcount, and rendering should continue safely (including on device-lost).

Actual: The shared D2D device context is over-released, leading to a use-after-free and an access violation in d2d1.dll on the next draw.

Steps to reproduce

1. Build a react-native-svg app for Windows (Paper/native module renderer using the shared DirectXDeviceManager).
2. Render an SvgView with drawable content (e.g. a Rect/Path) so DrawRectangle/draw is exercised.
3. Trigger a path that calls DiscardDeviceResources() (e.g. a device-lost / D2DERR_RECREATE_TARGET, or repeated mount/unmount/reload of Svg content that recreates device resources).
4. Observe an intermittent ACCESS_VIOLATION (0xC0000005) inside d2d1.dll (e.g. d2d1!...DrawRectangle) on the next render tick.

Snack or a link to a repository

Not reproducible via Snack (Windows-only native crash). A minimal Windows repro can be provided as a small RNW app that mounts/unmounts an SvgView repeatedly (or forces device-lost). The relevant code path is in windows/RNSVG/DirectXDeviceManager.cpp (DiscardDeviceResources) and SvgView.cpp (Invalidate).

SVG version

15.14.0

React Native version

0.77.0

Platforms

Web

JavaScript runtime

None

Workflow

None

Architecture

None

Build type

None

Device

None

Device model

No response

Acknowledgements

Yes