Bug 107023 - Crash in: SalFrame::SetCallback(vcl::Window *,bool (*)(vcl::Window *,SalEvent,void const *))
Summary: Crash in: SalFrame::SetCallback(vcl::Window *,bool (*)(vcl::Window *,SalEvent...
Status: RESOLVED DUPLICATE of bug 106265
Alias: None
Product: LibreOffice
Classification: Unclassified
Component: Impress (show other bugs)
Version:
(earliest affected)
5.3.2.2 release
Hardware: All All
: highest critical
Assignee: Not Assigned
URL:
Whiteboard:
Keywords:
Depends on:
Blocks: GDI-Limit
  Show dependency treegraph
 
Reported: 2017-04-08 01:11 UTC by Peter Beurle
Modified: 2017-09-01 17:27 UTC (History)
7 users (show)

See Also:
Crash report or crash signature: ["SalFrame::SetCallback(vcl::Window *,bool (*)(vcl::Window *,SalEvent,void const *))"]


Attachments
sample (448.50 KB, application/vnd.openxmlformats-officedocument.presentationml.presentation)
2017-05-12 08:08 UTC, Xisco Faulí
Details
DrMemory log (deleted)
2017-05-12 12:31 UTC, Xisco Faulí
Details
sample2 (23.30 KB, application/vnd.openxmlformats-officedocument.presentationml.presentation)
2017-05-12 12:54 UTC, Xisco Faulí
Details
DrMemory log (1.27 MB, text/plain)
2017-05-12 15:38 UTC, Xisco Faulí
Details
sample3 (54.00 KB, application/msword)
2017-05-13 11:03 UTC, Xisco Faulí
Details

Note You need to log in before you can comment on or make changes to this bug.
Description Peter Beurle 2017-04-08 01:11:30 UTC
This bug was filed from the crash reporting server and is br-236f2a8b-8303-4876-9aac-d06932dcd3e7.
=========================================
Moving an image around on a slide
Comment 1 Xisco Faulí 2017-04-08 10:51:07 UTC Comment hidden (obsolete)
Comment 2 Markus Mohrhard 2017-04-10 22:47:34 UTC
This is once again an out of GDI handles crash.

I thought we fixed that issue for 5.3.1.2 but apparently we still see these issues in 5.3.2.2
Comment 3 Michael Meeks 2017-04-25 11:18:59 UTC
Peter - we're really eager to get some reproduction steps for this - since it is the most frequently reported issue type =) can you provide some more details on how this happened ?

Thanks !
Comment 4 Peter Beurle 2017-05-01 11:39:26 UTC
I have tried on a couple of occasions to unsuccessfully reproduce this. Unfortunately I didn't save the recovery file, sorry.
Comment 5 Xisco Faulí 2017-05-02 10:58:04 UTC
Hi Peter,
Do you remember if at the time the crash happened you had many fonts installed in your system?
Comment 6 Peter Beurle 2017-05-03 10:19:17 UTC
I have subsequently reproduced another crash. This time it silently died, no crash report. I will send you two files offline, I am not prepared to share them with the world and sanitising them may strip out info you are looking for.

The only fonts that are non standard are Heuristica and Fira Sans
Comment 7 Xisco Faulí 2017-05-03 10:21:44 UTC
(In reply to Peter Beurle from comment #6)
> I have subsequently reproduced another crash. This time it silently died, no
> crash report. I will send you two files offline, I am not prepared to share
> them with the world and sanitising them may strip out info you are looking
> for.
> 
> The only fonts that are non standard are Heuristica and Fira Sans

Hi Peter,
Yes, please. You can send the files to me and I can take a look.
Regards
Comment 8 Xisco Faulí 2017-05-12 07:56:26 UTC
Issue reproduced in

Versión: 5.3.2.2
Id. de compilación: 6cd4f1ef626f15116896b1d8e1398b56da0d0ee1
Subproc. CPU: 1; SO: Windows 6.1; Repr. de IU: predet.; Motor de trazado: HarfBuzz; 
Configuración regional: ro-RO (es_ES); Calc: group

and

Version: 5.4.0.0.alpha1+
Build ID: 9d320ec4d818f86e58a15fd46248026502b1cc94
CPU threads: 1; OS: Windows 6.1; UI render: default; 
TinderBox: Win-x86@62-TDF, Branch:MASTER, Time: 2017-05-09_01:27:12
Locale: es-ES (es_ES); Calc: grou
Comment 9 Xisco Faulí 2017-05-12 08:08:47 UTC
Created attachment 133258 [details]
sample

File shared by Peter and minimized by me.

Using GDIView, I found that LibreOffice leaks when the file is opened, the OLE objects in the file are copied/pasted or dragged/dropped and when the file is saved, however, it not always crashes, sometimes it just freezes when 10.000 objects are reached.

For the time being, I found a couple of ways to reproduce the crash:
1. Reduce the limit of GDI objects as explained here: https://msdn.microsoft.com/es-es/library/windows/desktop/ms724291(v=vs.85).aspx and play around with the document copying or dragging things around.

2. Make three new copies of the document in your disk and open them one after the other with LibreOffice. LibreOffice will crash when the 10.000 limit is reached
Comment 10 Xisco Faulí 2017-05-12 12:29:26 UTC
Ok, I got a DrMemory log with

Version: 5.4.0.0.alpha1+
Build ID: 970b431f1a7b6b96c4c9536657ce4fe9d8f5b585
CPU threads: 1; OS: Windows 6.1; UI render: default; 
TinderBox: Win-x86@62-TDF, Branch:MASTER, Time: 2017-05-11_23:07:53
Locale: es-ES (es_ES); Calc: group

and this is the crashreport: crashreport.libreoffice.org/stats/crash_details/735862df-fd8b-4c10-b706-2fcd5361a5e0

Steps to reproduce:
1. Reduce GDI limits to 5000
2. Restart the OS
3. Open the attached document -> GDI objects go up to 4000
4. Copy one OLE object from the document and paste it many times until LibreOffice crashes.

This is the first time I use DrMemory, so let me know if i'm uploading the correct log and if more traces are needed.
Comment 11 Xisco Faulí 2017-05-12 12:31:05 UTC
Created attachment 133260 [details]
DrMemory log
Comment 12 Xisco Faulí 2017-05-12 12:54:05 UTC
Created attachment 133261 [details]
sample2

Another way to reproduce the crash ( this time with a limit of 10.000 GDI objects).

1. Open sample2
2. Copy the 3 OLE objects
3. Paste them until LibreOffice crashes. You can just hold Crtl+V for a while until it crashes.
Comment 13 Michael Meeks 2017-05-12 13:54:49 UTC
Hi Xisco - are you running drmemory on the soffice.exe (which is a trivial wrapper binary) - or on the soffice.bin (which needs renaming to soffice_real.exe or somesuch) ? =) The latter is really preferred. Sadly not much in the log.

Also - I think we may require a patch to drmemory to dump where the gdi handlers were allocated from on exit - since we'll crash before they can be really 'leaked' - but then; perhaps exiting before we crash will show some leaks - although it could be that we just allocate way too many handles but don't per-se leak them =)

Thanks !
Comment 14 Xisco Faulí 2017-05-12 15:38:14 UTC
Created attachment 133270 [details]
DrMemory log

ok, let's try again. Attaching 'results' file from DrMemory
Comment 15 Xisco Faulí 2017-05-12 15:38:42 UTC Comment hidden (obsolete)
Comment 16 Xisco Faulí 2017-05-13 11:03:34 UTC
Created attachment 133291 [details]
sample3

This file also crashes if the OLE object in it is copied/pasted many times.

Steps:
1. Open the document
2. Copy the OLE object
3. Hold Ctrl+V until LibreOffice crashes
Comment 17 Aron Budea 2017-05-15 01:02:16 UTC
At first I could reproduce a leak when selecting/deselecting shapes.
That leak went away over the weekend, thanks to this commit:

https://cgit.freedesktop.org/libreoffice/core/commit/?id=289711c2a469bfbe06aef3b3870b65f9c788f56d
author		Markus Mohrhard <markus.mohrhard@googlemail.com>	2017-05-13 21:39:16 (GMT)
committer	Markus Mohrhard <markus.mohrhard@googlemail.com>	2017-05-13 22:27:09 (GMT)
"fix gdi resource leak with unreleased virtual device"

Now, copy/pasting the objects in attachment 133261 [details] (sample2) does increase DC count, so it's theoretically possible to reach the limit (I haven't tried), but deleting them reduces the count to the original value (~30).
Comment 18 Xisco Faulí 2017-05-15 07:53:56 UTC
Julien Nabet also did a couple of similar commits: 11c4cc15fdd491e15ffd4e7d9fb5d4082898f926 and 68a1cb23ede1d4ae6195850190fca6953c30417f

However, it's still crashing while copying/pasting successively

Tested in

Version: 5.4.0.0.alpha1+
Build ID: 8c0be54a7da6262dffe04357121814dd22b5d7fe
CPU threads: 1; OS: Windows 6.1; UI render: default; 
TinderBox: Win-x86@62-TDF, Branch:MASTER, Time: 2017-05-15_01:35:45
Locale: es-ES (es_ES); Calc: group
Comment 19 Michael Meeks 2017-05-18 18:28:18 UTC
Interestingly; can't reproduce the copy/paste GDI issue in OpenGL mode - which is interesting; in GDI mode as I copy/paste the embedded objects - I do get more and more handles allocated - but using 5.3.0.0.alpha0 (which I happen to have).

Xisco - when you say 'many' times - are you talking several thousand ? ;-) if so, something of a corner-case methinks. Will trigger a new build on this machine to see what's up there though I guess.
Comment 20 Xisco Faulí 2017-05-19 12:11:09 UTC
> Xisco - when you say 'many' times - are you talking several thousand ? ;-)
> if so, something of a corner-case methinks. Will trigger a new build on this
> machine to see what's up there though I guess.

So, the first time I open sample3 document, I have ~45 gdi objects, and if I copy paste the OLE object once, I have ~95, so it needs to be copied 200 times approximately. Indeed, it sound a bit like a corner-case, however, I think there might be other objects that create more GDI objects every time they're copied/pasted, and thus, easier to reproduce.
Comment 21 Julien Nabet 2017-05-19 12:31:25 UTC
(In reply to Xisco Faulí from comment #20)
> > Xisco - when you say 'many' times - are you talking several thousand ? ;-)
> > if so, something of a corner-case methinks. Will trigger a new build on this
> > machine to see what's up there though I guess.
> 
> So, the first time I open sample3 document, I have ~45 gdi objects, and if I
> copy paste the OLE object once, I have ~95, so it needs to be copied 200
> times approximately. Indeed, it sound a bit like a corner-case, however, I
> think there might be other objects that create more GDI objects every time
> they're copied/pasted, and thus, easier to reproduce.

Xisco: could you give another try with a build including https://cgit.freedesktop.org/libreoffice/core/commit/?id=ba9b44270b56dfc6c416a55686d855a5b3c3c866
?
Indeed, searching in Opengrok about VirtualDevice, I stumbled upon this case.

(as advised by Markus, I'll use with std::unique_ptr at this place later)
Comment 22 Xisco Faulí 2017-05-20 11:06:14 UTC
(In reply to Julien Nabet from comment #21)
> (In reply to Xisco Faulí from comment #20)
> > > Xisco - when you say 'many' times - are you talking several thousand ? ;-)
> > > if so, something of a corner-case methinks. Will trigger a new build on this
> > > machine to see what's up there though I guess.
> > 
> > So, the first time I open sample3 document, I have ~45 gdi objects, and if I
> > copy paste the OLE object once, I have ~95, so it needs to be copied 200
> > times approximately. Indeed, it sound a bit like a corner-case, however, I
> > think there might be other objects that create more GDI objects every time
> > they're copied/pasted, and thus, easier to reproduce.
> 
> Xisco: could you give another try with a build including
> https://cgit.freedesktop.org/libreoffice/core/commit/
> ?id=ba9b44270b56dfc6c416a55686d855a5b3c3c866
> ?
> Indeed, searching in Opengrok about VirtualDevice, I stumbled upon this case.
> 
> (as advised by Markus, I'll use with std::unique_ptr at this place later)

Hi Julien,

it's still crashing in

Version: 5.5.0.0.alpha0+
Build ID: 7662b11cad6105d56fb9acc9c431c89d3b68dc89
CPU threads: 1; OS: Windows 6.1; UI render: default; 
TinderBox: Win-x86@39, Branch:master, Time: 2017-05-20_10:09:09
Locale: es-ES (es_ES); Calc: group
Comment 23 stefan.elsen 2017-06-19 14:24:41 UTC
(In reply to Michael Meeks from comment #19)
> Interestingly; can't reproduce the copy/paste GDI issue in OpenGL mode -
> which is interesting; in GDI mode as I copy/paste the embedded objects - I
> do get more and more handles allocated - but using 5.3.0.0.alpha0 (which I
> happen to have).

This also happens in OpenGL-mode (you are referring to LibreOffice->View->Graphics Output->Use OpenGL for all rendering, I assume).

It is also not necessary to copy-paste. I frequently have this crash when just moving/resizing images (albeit with some copying or cut-pasting in-between).
The system crashes very frequently. Three times today alone, and I definitely do not have to copy-paste 1k+ times.

I noticed Impress gets quite slow to react before ultimately crashing, but that might be an unrelated performance issue.
Comment 24 stefan.elsen 2017-06-27 08:54:49 UTC
It also just happend when done editing the content of a text field, with no other graphical effect active.
I get the impression the problem occurs frequently when using a lot of inter-connecting elements like arrows.
Doesn't seem inherently related to images.
Just elements. Maybe they need a new GDI context each time they are changed, which would multiply with the number of connected arrows that also need updating in this case...
Comment 25 stefan.elsen 2017-06-27 08:57:26 UTC
Wait, wrong. I was done editing, realized the box wasn't wide enough, and resized it to the left. kaboom
Comment 26 Xisco Faulí 2017-06-27 08:59:18 UTC
(In reply to stefan.elsen from comment #25)
> Wait, wrong. I was done editing, realized the box wasn't wide enough, and
> resized it to the left. kaboom

Could you please try to reproduce it with LibreOffice  5.3.4 from https://www.libreoffice.org/download/libreoffice-fresh/ ?
Comment 27 Peter Beurle 2017-07-02 02:25:24 UTC
I haven't been able to reproduce this with 5.3.4
Comment 28 Xisco Faulí 2017-07-11 08:27:28 UTC
*** Bug 108303 has been marked as a duplicate of this bug. ***
Comment 29 Xisco Faulí 2017-09-01 17:27:41 UTC
It seems we don't have more reports from this crash since 5.3.4 -> http://crashreport.libreoffice.org/stats/signature/SalFrame::SetCallback(vcl::Window%20*,bool%20(*)(vcl::Window%20*,SalEvent,void%20const%20*))

I think it's save to close it...

*** This bug has been marked as a duplicate of bug 106265 ***