Access violation in ig75icd64.dll, ig9icd64.dll when calling DestroyWindow

[Mathias_B_]

We have received numerous crash reports (thousands) through Microsoft's WER (sysdev) for crashes in:

File:             Version:
ig75icd64.dll     20.19.15.4531
ig9icd64.dll      20.19.15.4483
not limited to the one above. It seems all versions are affected.
Crash dump: https://1drv.ms/u/s!AiD5dUDFw4XRnDIHuU-HzVbqb-lF

The crashes are reported in WER as following:
null_class_ptr_write_c0000005_ig75icd64.dll!wglmonitorchangesinternal
Unhandled exception at 0x00007FFB18290BDD (ntdll.dll) in triagedump.dmp: 0xC0000005: Access violation writing location 0x0000000000000008. occurred

The problem happens when DestroyWindow is called in DLL_PROCESS_DETACH. The graphic driver seems to be trying to enter (access) a CRITICAL_SECTION which is already destroyed:
     ntdll.dll!RtlEnterCriticalSection()    Unknown
     ig75icd64.dll!00007ffac3ade9bf()    Unknown
     ig75icd64.dll!00007ffac3ade39c()    Unknown
     user32.dll!DispatchHookA()    Unknown

Stack traces:

ig75icd64.dll (version: 20.19.15.4531)
--------------------------------------
Stack
     ntdll.dll!RtlEnterCriticalSection()    Unknown
     ig75icd64.dll!00007ffac3ade9bf()    Unknown
     ig75icd64.dll!00007ffac3ade39c()    Unknown
     user32.dll!DispatchHookA()    Unknown
     user32.dll!fnHkINLPCWPSTRUCTA()    Unknown
     user32.dll!__fnDWORD()    Unknown
     ntdll.dll!KiUserCallbackDispatcherContinue()    Unknown
     win32u.dll!NtUserDestroyWindow()    Unknown
>    [Inline Frame] FTPShellExtension.dll!ATL::CWindowImplBaseT<ATL::CWindow,ATL::CWinTraits<1442840576,0> >::DestroyWindow() Line 3458    C++
     FTPShellExtension.dll!CFTPShellExtensionModule::~CFTPShellExtensionModule() Line 64    C++
     ucrtbase.dll!_malloc_base()    Unknown
     ucrtbase.dll!__crt_seh_guarded_call<int>::operator()<class <lambda_7777bce6b2f8c936911f934f8298dc43>,class <lambda_f03950bc5685219e0bcd2087efbe011e> &,class <lambda_3883c3dff614d5e0c5f61bb1ac94921c> >(class <lambda_7777bce6b2f8c936911f934f8298dc43> &&,class <lambda_f03950bc5685219e0bcd2087efbe011e> &,class <lambda_3883c3dff614d5e0c5f61bb1ac94921c> &&)    Unknown
     ucrtbase.dll!_execute_onexit_table()    Unknown
     FTPShellExtension.dll!dllmain_crt_process_detach(const bool is_terminating) Line 107    C++
     FTPShellExtension.dll!dllmain_dispatch(HINSTANCE__ * const instance, const unsigned long reason, void * const reserved) Line 211    C++
     ntdll.dll!LdrpCallInitRoutine()    Unknown
     ntdll.dll!LdrShutdownProcess()    Unknown
     ntdll.dll!RtlExitUserProcess()    Unknown
     kernel32.dll!ExitProcessImplementation()    Unknown
     ucrtbase.dll!exit()    Unknown
     ucrtbase.dll!exit()    Unknown
     SmartFTP.exe!__scrt_common_main_seh() Line 268    C++
     kernel32.dll!BaseThreadInitThunk()    Unknown
     ntdll.dll!RtlUserThreadStart()    Unknown

ig9icd64.dll 20.19.15.4483
--------------------------
ntdll.dll!RtlEnterCriticalSection    Unknown
ig9icd64.dll!00007ffbc13859af()    Unknown
ig9icd64.dll!00007ffbc13853cc()    Unknown
user32.dll!DispatchHookA()    Unknown
user32.dll!fnHkINLPCWPSTRUCTA()    Unknown
user32.dll!__fnDWORD()    Unknown
ntdll.dll!KiUserCallbackDispatcherContinue()    Unknown
win32u.dll!NtUserDestroyWindow()    Unknown
[Inline Frame] FTPShellExtension.dll!ATL::CWindowImplBaseT<ATL::CWindow,ATL::CWinTraits<1442840576,0> >::DestroyWindow() Line 3446    C++

Pseudo code to reproduce:

HWND g_hwnd = NULL;

LRESULT CALLBACK MainWProc(HWND hWnd, UINT uMsg, WPARAM wParam, LPARAM lParam)
{
	return DefWindowProc(hWnd, uMsg, wParam, lParam);
}

BOOLEAN WINAPI DllMain(IN HINSTANCE hDllHandle,
	IN DWORD     nReason,
	IN LPVOID    Reserved)
{
	BOOLEAN bSuccess = TRUE;

	//  Perform global initialization.

	switch (nReason)
	{
	case DLL_PROCESS_ATTACH:
	{
		DisableThreadLibraryCalls(hDllHandle);
		static const TCHAR* class_name = _T("DUMMY_CLASS");
		WNDCLASSEX wx = {};
		wx.cbSize = sizeof(wx);
		wx.lpfnWndProc = MainWProc;
		wx.hInstance = hDllHandle;
		wx.lpszClassName = class_name;
		RegisterClassEx(&wx);

		g_hwnd = CreateWindowEx(0, class_name, NULL, 0, 0, 0, 0, 0, HWND_MESSAGE, (HMENU)0x100, hDllHandle, NULL);
	}
	break;

	case DLL_PROCESS_DETACH:
		if (g_hwnd)
		{
			// this triggers the access violation
			DestroyWindow(g_hwnd);
		}
		break;
	}

	return TRUE;
}

We are aware that calling DestroyWindow in DLL_PROCESS_DETACH is not exactly the best idea but an access violation in the graphic driver is not expected.

[Michael_C_Intel2]

Hi,

Can you fill in the template below with the details of the issue? We use the info in that format to report and debug. Also a sample binary would be helpful to reproduce the issue. That will be the first thing I am asked by the the debug team. 

System Setup Information:
-----------------------------------------

System Used: (Manufacturer/Model)
CPU SKU: (i3, i5, Pentium, Celeron, etc.)
GPU SKU: (HD4400, HD5100, etc.)
Processor Line: (Y-Series, U-Series, etc.)
System BIOS Version:
CMOS settings:
Graphics Driver Version:
GOP/VBIOS Version:
Operating System:
OS Version:
API:
Occurs on non-Intel GPUs?:

Steps to Reproduce:
-------------------------------
1.
2.
3.
4.
5.
6.
7.
8.
9.
10.

Expected Results:
-------------------------------

Actual Results:
-------------------------------

Additional Information:
-------------------------------

[Salvador_M_1]

Hello Michael, has there been any follow-up on this issue by Intel? Just wondering if a fix is forthcoming. Thanks.

[EBopp]

I am seeing a similar issue using the recently released driver version 21.20.16.4678.  Are there any updates on this issue?  Thanks.

[Michael_C_Intel2]

Hi Salvador,

As per my previous post I need additional information before we can investigate. I need that template filled. 

-Michael 

[Gabriele_S_]

We have received crash reports in Firefox which match exactly the DLL version, type of error and stack trace in comment #1. See this bug:

https://bugzilla.mozilla.org/show_bug.cgi?id=1384142

[Welles__Rubin]

i have a problem with a program named Djuced it needs to work and i did find this post after the hercules custimer service did send me this i don't know how this al works an sombody explain me everything a bout this?

[dimaano__mike]

I have this problem with Djuced also. It was working then crashed, now will not open again

What is the fix?