WipeRequesterToken() only reset the screen's token, after CreateViews() had
already handed it to the new views, so nothing was ever forgotten - not even
in ~Screen(), which saw a token of -1. A text input dialog open across a
RecreateViews() (on the RetroAchievements screen, a slow login failing) would
then write through a deleted PopupTextInputChoice, possibly into the field
that took its place: #21708.
Requests made while creating views now get their own token, forgotten
before the views are deleted. Screen-level requests keep the screen's token.
RequestManager: ForgetRequestsWithToken() now locks, and also drops
responses that arrived but weren't processed yet. ProcessRequests() calls
the callbacks one at a time without holding the lock, so a callback that
closes a screen drops the rest of that screen's responses.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Achievement badges and game icons don't change, so re-downloading them
daily was wasted. InsertIcon now takes a max age, and each entry saves
its expiry time. Leaderboard avatars get a day, everything else 30 days.
Bumps the cache version.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Icons were kept in icon.cache indefinitely, so one that changes on the
server (a RetroAchievements user avatar, keyed by username) never
refreshed. The insertion timestamp was process-relative, so it couldn't
be compared across sessions. Store wall-clock time, and skip entries
older than a day when loading. Bumps the cache version.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
GetDimensions only answered once a texture had been created, so the first
MeasureNotice for a new icon (and after the texture was released for being
unused) measured without it, and the icon was then drawn over the text.
Read the size from the PNG header when the icon is inserted or loaded.
Also remove a width adjustment in MeasureNotice that was overwritten
before use.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
- Prune expired failed_ entries, which otherwise grew for the whole
session.
- When CreateTexture fails, wait 5 seconds before decoding and uploading
again, instead of retrying every frame.
- Bind a newly created texture. Callers draw right after BindIconTexture,
and got whatever was bound before for the first frame.
- Make DiskCacheEntry's padding explicit. 32-bit x86 Linux aligns double
to 4, so its icon.cache didn't match other builds. The layout is
unchanged elsewhere.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
The key was resized before its length was checked, and the data length
wasn't checked at all, so a corrupt icon.cache could make a multi-GB
allocation and crash every launch. The cache is only saved at a clean
exit, so a bad file stayed.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Any 200 response went into the cache, and one that didn't decode (a
captive portal's HTML, or a PNG over the 256x128 limit) was marked bad,
saved to icon.cache and never downloaded again. Remove it and mark it
failed, so MarkPending allows another download after the retry delay.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
UWP compiled naett with the WinHTTP backend but never reported
SYSPROP_SUPPORTS_HTTPS, so achievement traffic and badge icons went over
plain http. When the media server redirected to https, icons failed.
A failed icon download also left the URL marked pending, so it was never
retried for the rest of the session. Mark it failed instead, and let
IconCache retry it after 30 seconds.
The set-completed badge also skipped RemoveHttpsIfNeeded.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Choices that are just numbers have no translation, so every lookup got
logged as a missing translation - the Graphics settings screen spammed
the log once per frame as long as Frame Skipping was on.
Fixes#21455
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01JvJR8oJNSCimCM9KXVLjfq
Unlike the directional moves, this doesn't look at where anything ended up on
screen - it walks the hierarchy in the order views were added, flattening nested
groups in place. That's what makes it predictable in the layouts where "what's
to the right of this" has no good answer.
A view is a stop if it's focusable and enabled, the same test the directional
moves apply, so the two agree on what's reachable. Hidden subtrees are skipped
whole, which is what keeps a TabHolder's inactive tabs - V_GONE rather than
removed - out of the order without any special casing. Containers are gated on
visibility only, not enabled, matching Key/Touch/Axis: disabling a container
doesn't stop its children being interactive anywhere else either.
Ctrl+Tab stays with ChoiceStrip, which uses it to switch tabs.
focusMoves now holds FocusMove rather than raw keycodes, so the direction is
decided in one place while the modifiers are still around, and a held key
repeats in the direction it was originally pressed with - the synthesized repeat
has no modifiers of its own. That also retires the keycode switch in
UpdateViewHierarchy and IsScrollKey, which had no other callers.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01SfY7iFJEjmRXf1XGrTs4MF
pngLoadPtr allocated the decoded buffer directly from attacker-controlled
PNG IHDR dimensions with no upper bound, so browsing a crafted game icon
or savedata could trigger a multi-gigabyte allocation.
- Add maxWidth/maxHeight parameters to pngLoadPtr (default 8192x8192)
and reject images larger than the limits.
- Thread the limits through LoadTextureLevelsFromFileData,
CreateTextureFromFileData, and CreateTextureFromFile.
- Limit game icons to 256x128 in GameInfoCache and IconCache.
