PresentMon icon indicating copy to clipboard operation
PresentMon copied to clipboard

PresentMon memory corruption on Windows 8.1

Open dmex opened this issue 3 years ago • 5 comments

PresentMon crashes on Windows 8.1 when executing these DWM events:

https://github.com/GameTechDev/PresentMon/blob/53a0c153d7bac61c24411fa306219580c6a11186/PresentData/PresentMonTraceConsumer.cpp#L1299-L1307

ulFlipChain and ulSerialNumber are 8 bytes (uint64_t) on Windows 8.1 however they've been defined as uint32_t and GetEventData copies 8-bytes into those 4-byte variables corrupting memory.

https://github.com/GameTechDev/PresentMon/blob/53a0c153d7bac61c24411fa306219580c6a11186/PresentData/PresentMonTraceConsumer.cpp#L1331-L1339

The PresentCount field doesn't exist causing GetEventData to assert the missing field. It seems to be called OutOfFrameDirectFlipPresentCount?

Here's a copy of the etw manifest for dwm-core: microsoft-windows-dwm-core.manifest.txt

dmex avatar Nov 10 '22 15:11 dmex

I'd implemented these events based on Win7. I could believe that Win8.1 has different definitions for some of the data. That's... annoying. The ideal data for fixing this would be an ETW trace captured with GPUView.

jenatali avatar Nov 10 '22 15:11 jenatali

I could believe that Win8.1 has different definitions

Windows 8 likely uses the same as 8.1 but I haven't checked.

ETW trace captured with GPUView

Here's the attached GPUView trace. I ran the log.cmd without parameters so not sure if its the right one? (edit: removed attachment)

dmex avatar Nov 10 '22 17:11 dmex

It would be great to have an ETL for testing, but I don't see any FlipChain or SCHEDULE_SURFACEUPDATE events in the above trace. Maybe these are excluded in your log.cmd, or possibly you weren't running the problem scenario during the capture? For it to be useful, the trace needs to reproduce the issue (e.g., if you run PresentMon with "-etl_file Merged.etl" it should hit these issues).

I attempted a fix on the fix_124 branch. It assumes "OutOfFrameDirectFlipPresentCount" is just a rename and the underlying data is still 32-bits. Let me know if this fixes the issue.

PresentMon-dev-x64_debug_fix_124.zip

@JeffersonMontgomery-Intel

Yep seems to work 👍

dmex avatar Jan 16 '23 12:01 dmex

Great, thanks for testing it for me! I'll merge that into the next release.