fix: own outfit-fetch pointers so the detached background fetch cannot read a pooled list after release

Sturdiness hardening on the outfit fetch: the detached background provider fetch and the settle predicate now read an owned URN[] snapshot instead of the pooled missingUrns list (released when ExecuteAsync returns), so a future provider that does not copy pointers before its first await cannot turn this into a pooled-list use-after-free. Discriminating EditMode test added; 9/9 green on the rig.

Author: eordano

Explorer/Assets/DCL/Backpack/AvatarSection/Outfits/Commands/CacheOutfitWearablesCommand.cs

@@ -81,28 +81,33 @@ public async UniTask ExecuteAsync(IReadOnlyCollection<URN>? wearableUrns, BodySh
         // whose DTO failed has no metadata to equip and is left out.
         private async UniTask FetchMissingDtosIntoResultAsync(List<URN> missingUrns, BodyShape bodyShape, List<IWearable> result, CancellationToken ct)
         {
+            // The background fetch and the settle-predicate can both run after this scope returns,
+            // once ExecuteAsync has returned missingUrns to the pool (where it may be cleared or
+            // reused). They read an owned snapshot so they never touch the released pooled list.
+            URN[] snapshot = missingUrns.ToArray();
+
             UniTask fullFetch = FullFetchAsync();
 
+            // fullFetch is the termination backstop: AllMissingDtosSettled can stay false forever for
+            // a pointer that never starts loading, but the full fetch always completes and ends the wait.
             await UniTask.WhenAny(fullFetch, UniTask.WaitUntil(AllMissingDtosSettled, cancellationToken: ct));
 
-            foreach (URN urn in missingUrns)
+            foreach (URN urn in snapshot)
                 if (TryGetStored(urn, out IWearable w) && w.DTO != null)
                     result.Add(w);
 
             return;
 
-            // The provider copies the pointers into its intention before its first await, so the
-            // background continuation never touches the pooled list after this scope ends.
             async UniTask FullFetchAsync()
             {
-                try { await wearablesProvider.GetByPointersAsync(missingUrns, bodyShape, ct); }
+                try { await wearablesProvider.GetByPointersAsync(snapshot, bodyShape, ct); }
                 catch (OperationCanceledException) { }
                 catch (Exception e) { ReportHub.LogException(e, ReportCategory.OUTFITS); }
             }
 
             bool AllMissingDtosSettled()
             {
-                foreach (URN urn in missingUrns)
+                foreach (URN urn in snapshot)
                 {
                     if (!TryGetStored(urn, out IWearable w))
                         return false;

Explorer/Assets/DCL/Tests/Editor/CacheOutfitWearablesCommandShould.cs

@@ -161,6 +161,36 @@ public async Task CompleteOnDtoSettleAndApplyRefetchedStorageHitWithoutAwaitingA
             assetFetchNeverCompletes.TrySetCanceled();
         }
 
+        [Test]
+        public async Task DetachedFetchReceivesOwnedSnapshotNotThePooledList()
+        {
+            LogAssert.ignoreFailingMessages = true;
+
+            IReadOnlyCollection<URN>? handedToFetch = null;
+
+            wearablesProvider.GetByPointersAsync(Arg.Any<IReadOnlyCollection<URN>>(), Arg.Any<BodyShape>(), Arg.Any<CancellationToken>(), Arg.Any<List<IWearable>?>())
+                             .Returns(callInfo =>
+                              {
+                                  handedToFetch = callInfo.Arg<IReadOnlyCollection<URN>>();
+                                  return UniTask.FromResult<IReadOnlyCollection<IWearable>?>(null);
+                              });
+
+            var result = new List<IWearable>();
+            var urns = new List<URN> { RESOLVED_URN, UNRESOLVED_URN };
+
+            await command.ExecuteAsync(urns, BodyShape.MALE, CancellationToken.None, result, useFullUrns: true);
+
+            // ExecuteAsync has returned, so its pooled missingUrns list is back in the pool and free to be
+            // cleared or reused by the next command. The detached fetch it launched must therefore read an
+            // owned snapshot (a URN[]), never the pooled List<URN>, so pool reuse cannot corrupt it.
+            Assert.IsNotNull(handedToFetch, "The provider fetch must have been launched for the missing pointer");
+            Assert.IsInstanceOf<URN[]>(handedToFetch, "The detached fetch must receive an owned snapshot, not the pooled List<URN>");
+
+            var handed = new List<URN>(handedToFetch);
+            Assert.AreEqual(1, handed.Count, "The snapshot must carry exactly the missing pointers");
+            Assert.AreEqual(UNRESOLVED_URN, handed[0].ToString(), "The snapshot must carry the unresolved pointer to the provider");
+        }
+
         private static async UniTask PumpAsync()
         {
             for (var i = 0; i < 120; i++)