fix(gpu-d3d12): don't sentinel-0 a slot whose command list was already submitted

[mledour]

Finding #4 (code review): D3D12 failed-Signal use-after-free

RecordTimestamp runs ExecuteCommandLists (work now in flight on the GPU), then on a failed Signal stored the "never submitted" sentinel (slot.fenceValue = 0) and returned. The next ring wrap's pre-check —

if (slot.fenceValue > 0 && m_fence->GetCompletedValue() < slot.fenceValue) { /* skip, GPU busy */ }

— treats fenceValue == 0 as free, so it Reset()s the slot's command allocator while the GPU may still be executing that command list. That's a use-after-free the D3D12 debug layer flags and release builds can TDR the host over. (Trigger is narrow: a transient Signal failure — E_OUTOFMEMORY — without device removal, then a wrap before the GPU drains.)

Fix

Tag the slot with nextFenceValue unconditionally and gate reuse on the fence (the queue is in-order):

Case	Outcome
Transient Signal failure	a later frame's Signal advances the fence past nextFenceValue → GetCompletedValue() >= nextFenceValue proves the work is done → safe reuse, and PollResolved can still resolve the already-written timestamp
Device removed (TDR)	GetCompletedValue() returns UINT64_MAX → reuse allowed, allocator Reset fails harmlessly on the dead device
No later Signal ever lands	slot stays Pending, counted as a drop when the ring overwrites it — never a Reset() of in-flight work

This is the same invariant Reset() already relies on (it deliberately keeps non-zero fence values when its bounded drain times out — lines 577-586). The other slot.fenceValue = 0 sites stay correct: init, the pre-submit Reset/Close failure paths, the drain-succeeded branch of Reset(), and shutdown.

Verification

• The D3D12 backend has no unit test (it needs a real device); covered by the CI build + review, like the rest of gpu_timer.cpp.
• No lines >120 cols; diff is one file (+27/−13).

🤖 Generated with Claude Code