1838888 - crash at [@ atidxx64.dll | CContext::TID3D11DeviceContext_ClearRenderTargetView_<T> ]

Status: NEW

(Core :: Graphics, defect)

Description

[Kang Ali]

Attachment: firefox.png

Crash report:
https://crash-stats.mozilla.org/report/index/0888fe14-6a0f-4407-9721-7031b0230616#tab-bugzilla

in Asan Error :
JavaScript error: resource://devtools/server/actors/resources/parent-process-document-event.js, line 90: TypeError: can't access property "innerWindowId", webProgress.browsingContext.currentWindowGlobal is null

Comment 1

[Andrew McCreight [:mccr8]]

The crash report is a null deref crash inside the graphics drivers, in the GPU process.

Do you have a test case that can be used to reproduce the issue?

Comment 2

[Kang Ali]

Attachment: memtest.html

Comment 3

[Kang Ali]

yes im testing with script
script in attachment

Thanks

Comment 4

[Kang Ali]

Filing as security sensitive exploitable since the address indicates UAF:

Crash Reason EXCEPTION_ACCESS_VIOLATION_READ
Crash Address 0x0000000000000060

Thanks

Comment 5

[Glenn Watson [:gw]]

Could you attach the output of about:support for your machine?

Comment 6

[Kang Ali]

Attachment: Application Basics

Comment 7

[Kang Ali]

im attach file output about:support in attachment

Thanks

Comment 8

[Glenn Watson [:gw]]

Thanks. I see that the driver is from 2022:

Driver Version: 31.0.12042.4
Driver Date: 10-19-2022

Would it be possible to try update the driver and see if the bug is still reproducible?

Comment 9

[Kang Ali]

im testing in update driver
the bug not reproducible
But not all user update driver in PC/laptop

Thanks

Comment 10

[Kang Ali]

im check in second laptop driver is 2022 but not notification update driver in laptop
if default BYOD Laptop many driver amd or nvidia 2021 or 2022 which is still active

Comment 11

[Kang Ali]

Attachment: poc_nightly.mp4

Im testing in

Nightly Version : 116.0a1 (2023-06-18) (64-bit)
Eror : Crash Tab

Poc In Attachment

Comment 12

[Kang Ali]

Any update for this report ?
This finding is valid ?

Comment 13

[Kelsey Gilbert [:jgilbert]]

The memtest.html is just exhausting memory, and something has to give on the system. It sounds like the new driver is different (maybe possibly better-behaved in this case), but that overall this is just something crashing in response to OOM, which is just a known DOS vector.