Bug 153922 - memory leak in dedicated memory of graphics card (geforce gt1030), can lead to crash
Summary: memory leak in dedicated memory of graphics card (geforce gt1030), can lead t...
Status: RESOLVED WORKSFORME
Alias: None
Product: LibreOffice
Classification: Unclassified
Component: Impress (show other bugs)
Version:
(earliest affected)
7.4.5.1 release
Hardware: x86-64 (AMD64) Windows (All)
: medium critical
Assignee: Not Assigned
URL:
Whiteboard:
Keywords: haveBacktrace, perf
Depends on:
Blocks: Skia Crash
  Show dependency treegraph
 
Reported: 2023-03-02 10:28 UTC by Wolfgang Koenig
Modified: 2024-01-16 09:27 UTC (History)
4 users (show)

See Also:
Crash report or crash signature:


Attachments
used graohics memory with libre-office impress running (33.91 KB, application/pdf)
2023-03-02 10:49 UTC, Wolfgang Koenig
Details
small and large picture. moving small one: memory stays, large one: crash (3.08 MB, application/vnd.oasis.opendocument.presentation)
2023-03-03 18:20 UTC, Wolfgang Koenig
Details
WinDbg stack trace of skia/vulkan buffer overflow on 7.5.1.2 with symbols (33.77 KB, text/plain)
2023-03-18 02:06 UTC, V Stuart Foote
Details

Note You need to log in before you can comment on or make changes to this bug.
Description Wolfgang Koenig 2023-03-02 10:28:27 UTC
when inserting pictures (screen shots) used memory of graphics card increases. Used memory remains even when pictures are deleted. Inserting more pictures used memory increases further until nearly all dedicated graphic-card memory is used . Then libre office crashes.
In case of impress moving picture around with mouse continuously increases used memory of graphics card. Used memory remains after deleting picture. When nearly all dedicated memory of graphics card is used-up libre office crashes. 
Crash does not happen for all graphics-cards e.g. Nvidia GTX 1650 used memory does not continuously increase when picture is moved around in Impress. However used memory is not deallocated when picture is deleted.
Moving pictures around with mouse in Draw or Writer does not increase used graphics memory.
Comment 1 Wolfgang Koenig 2023-03-02 10:49:58 UTC
Created attachment 185693 [details]
used graohics memory with libre-office impress running

shows the increase of used dedicated graphic-card memory when libre-office impress is started, a complex screen shot is inserted and this picture is continuously moved around with the mouse. Graphics card Nvidia GT 1030. Latest driver version (Feb. 28. 2023, older driver versions did the same)
Comment 2 m_a_riosv 2023-03-03 00:47:47 UTC
Please attach a sample file with which to reproduce the problem.
Comment 3 Wolfgang Koenig 2023-03-03 18:20:28 UTC
Created attachment 185733 [details]
small and large picture. moving small one: memory stays, large one: crash

grabbing the small picture with mouse and moving it around: graphic-card memory stays constant. Moving the large picture around via mouse: dedicated graphic-card memory increases continuously until close to max. value, the libre office first freezes then crashes.
Comment 4 m_a_riosv 2023-03-03 21:03:58 UTC
Sorry, I have an integrated graphics card, with no issue, same use of memory, moving any of the graphics.

Let's see if someone with an independent graphics card can test.
Comment 5 Wolfgang Koenig 2023-03-04 12:50:16 UTC
My laptop uses the build-in Intel GPU (in CPU integrated). There the problem does not show up. It does not show up either on a PC with a more fancy Nvidia GTX 1650 graphics-card with 4 GB dedicated memory. Looks like the problem appears only with certain graphics-cards like the Nvidia GT 1030 (2 GB dedicated memory).
Comment 6 Stéphane Guillou (stragu) 2023-03-16 11:00:48 UTC
Thanks Wolfgang.

I couldn't reproduce either with integrated graphics.

Could you please:
- share here the information copied from Help > About LibreOffice (for the configuration that crashes)
- try turning Skia off to see if you can still reproduce the issue (In Tools > Options > LibreOffice > View)
- share with us the Skia log, which should be: AppData\Roaming\LibreOffice\4\cache\skia.log
- just confirming: in you example file, it's moving the chart that causes the issue?

Thank you!
Comment 7 Wolfgang Koenig 2023-03-16 13:47:39 UTC
Stephane Guillou (stragu) asked me to turn off Skia. I disabled 'Skia for Rendering' and the problem dissapeared completely. No increase of used  dedicated graphic-card meory, no crash. Thanks a lot !
I use version 7.5.0.3 (X86_64), Build C21113d003cd3efa8c5318876...;
Environment: CPU Threads:8; Windows 10.0 Build 19045. UI-Render: Standard; VCL:win
Indeed, moving the chart caused the used memory increase until crash.
Comment 8 QA Administrators 2023-03-17 03:26:58 UTC Comment hidden (obsolete)
Comment 9 Stéphane Guillou (stragu) 2023-03-17 22:42:40 UTC
Thank you for confirming this is Skia-related.
Can you please attach here the Skia log, which should be: AppData\Roaming\LibreOffice\4\cache\skia.log ?
Comment 10 V Stuart Foote 2023-03-18 02:04:11 UTC
Confirmed, can watch the "leak" as the embedded chart is grabbed and moved around the slide--usage builds to the 2GB of dedicated memory (16GB shared available) and then the overflow crash.

Version: 7.5.1.2 (X86_64) / LibreOffice Community
Build ID: fcbaee479e84c6cd81291587d2ee68cba099e129
CPU threads: 8; OS: Windows 10.0 Build 19045; UI render: Skia/Vulkan; VCL: win
Locale: en-US (en_US); UI: en-US
Calc: CL threaded

enderMethod: vulkan
Vendor: 0x10de
Device: 0x1380
API: 1.3.224
Driver: 528.196.0
DeviceType: discrete
DeviceName: NVIDIA GeForce GTX 750 Ti
Denylisted: no


This stacktrace on the buffer overflow:
0:000> g
WARNING: Continuing a non-continuable exception
(36a4.3208): Security check failure or stack buffer overrun - code c0000409 (!!! second chance !!!)
Subcode: 0x7 FAST_FAIL_FATAL_APP_EXIT 
ucrtbase!abort+0x4e:
00007ffd`9d9d286e cd29            int     29h
0:000> !analyze -v
*******************************************************************************
*                                                                             *
*                        Exception Analysis                                   *
*                                                                             *
*******************************************************************************


KEY_VALUES_STRING: 1

    Key  : Analysis.CPU.mSec
    Value: 2796

    Key  : Analysis.DebugAnalysisManager
    Value: Create

    Key  : Analysis.Elapsed.mSec
    Value: 63801

    Key  : Analysis.Init.CPU.mSec
    Value: 30764

    Key  : Analysis.Init.Elapsed.mSec
    Value: 721511

    Key  : Analysis.Memory.CommitPeak.Mb
    Value: 900

    Key  : FailFast.Name
    Value: FATAL_APP_EXIT

    Key  : FailFast.Type
    Value: 7

    Key  : Timeline.OS.Boot.DeltaSec
    Value: 45430

    Key  : Timeline.Process.Start.DeltaSec
    Value: 960

    Key  : WER.OS.Branch
    Value: vb_release

    Key  : WER.OS.Timestamp
    Value: 2019-12-06T14:06:00Z

    Key  : WER.OS.Version
    Value: 10.0.19041.1

    Key  : WER.Process.Version
    Value: 7.5.1.2


NTGLOBALFLAG:  0

PROCESS_BAM_CURRENT_THROTTLED: 0

PROCESS_BAM_PREVIOUS_THROTTLED: 0

APPLICATION_VERIFIER_FLAGS:  0

EXCEPTION_RECORD:  (.exr -1)
ExceptionAddress: 00007ffd9d9d286e (ucrtbase!abort+0x000000000000004e)
   ExceptionCode: c0000409 (Security check failure or stack buffer overrun)
  ExceptionFlags: 00000001
NumberParameters: 1
   Parameter[0]: 0000000000000007
Subcode: 0x7 FAST_FAIL_FATAL_APP_EXIT 

FAULTING_THREAD:  00003208

PROCESS_NAME:  soffice.bin

ERROR_CODE: (NTSTATUS) 0xc0000409 - The system detected an overrun of a stack-based buffer in this application. This overrun could potentially allow a malicious user to gain control of this application.

EXCEPTION_CODE_STR:  c0000409

EXCEPTION_PARAMETER1:  0000000000000007

STACK_TEXT:  
00000077`4378d7a0 00007ffd`1d17b789     : fffffffe`00000003 00000000`00000003 00000000`00000054 00007ffd`1d17b70c : ucrtbase!abort+0x4e
00000077`4378d7d0 00007ffd`1d17c736     : 000001af`ea061800 00000077`4378d8d0 00000077`4378d900 00000000`00000053 : mergedlo!SkiaSalGraphicsImpl::postDraw+0x89
00000077`4378d800 00007ffd`1d17c79a     : 00000000`00000000 00000000`00000053 00000000`00000014 00007ffd`1cc8897b : mergedlo!SkiaSalGraphicsImpl::privateDrawAlphaRect+0x2a6
00000077`4378d9a0 00007ffd`1ccc3509     : 000001af`d82af5e0 00000000`00000000 00000000`00000053 00011401`000036a4 : mergedlo!SkiaSalGraphicsImpl::drawRect+0x2a
00000077`4378d9f0 00007ffd`1cccd475     : 000001af`00202020 000001af`d82af5e0 00000000`00000000 00000000`00000000 : mergedlo!OutputDevice::DrawRect+0x259
00000077`4378da70 00007ffd`1cccd57e     : 000001af`00000000 feffffae`00ffffff 000001af`d82af5e0 00000000`00000001 : mergedlo!OutputDevice::DrawColorWallpaper+0xe5
00000077`4378dad0 00007ffd`1ce7532d     : 000001af`d82af5e0 00000000`00000000 00000077`4378dd50 000001af`d82af5e0 : mergedlo!OutputDevice::Erase+0xae
00000077`4378db10 00007ffd`1ce75700     : 00007ffd`1e744ab8 00000000`00000000 000001af`d8ab4aa0 00007ffd`1cb712c5 : mergedlo!VirtualDevice::InnerImplSetOutputSizePixel+0xdd
00000077`4378dbf0 00007ffd`1cb448c0     : 00000000`00000000 00000077`4378dd50 000001af`ea062c00 000001af`e299b2a0 : mergedlo!VirtualDevice::ImplSetOutputSizePixel+0x30
00000077`4378dc50 00007ffd`1cb45d33     : 00000000`000004ff 000001af`d8ab4aa0 00000000`000004ff 00000000`00000000 : mergedlo!StatusBar::ImplDrawItem+0x120
00000077`4378de10 00007ffd`1ca56375     : 00000000`00000000 000001af`e9f62c60 00000000`00000000 000001af`e9f62f18 : mergedlo!StatusBar::Paint+0x293
00000077`4378de80 00007ffd`1ca57202     : 000001af`94844c70 000001af`cbb10000 000001af`ea062c00 00000000`00000000 : mergedlo!PaintHelper::DoPaint+0x265
00000077`4378e050 00007ffd`1ca5a2ed     : 000001af`ea062c00 000001af`ea062c00 00000000`00000000 000001af`948445b0 : mergedlo!vcl::Window::ImplCallPaint+0x142
00000077`4378e110 00007ffd`1cb4734e     : 000001af`ea062c00 00000000`00000000 00000077`4378e280 000001af`ea010320 : mergedlo!vcl::Window::PaintImmediately+0x20d
00000077`4378e1b0 00007ffd`1cb478b5     : 00000000`00000003 00000077`4378e280 000001af`ea010320 000001af`ea062c00 : mergedlo!StatusBar::PaintSelfAndChildrenImmediately+0x2e
00000077`4378e1e0 00007ffd`1c049d10     : 00000077`4378e280 00000000`00000000 000001af`ea062c00 000001af`ea061100 : mergedlo!StatusBar::SetItemData+0xf5
00000077`4378e230 00007ffd`1bb3ae1f     : 000001af`94844c70 000001af`94844c70 00000077`4378e329 fffff826`00000435 : mergedlo!SvxPosSizeStatusBarControl::StateChangedAtStatusBarControl+0x580
00000077`4378e2c0 00007ffd`1b91e1bb     : 000001af`ea061110 00007ffd`00000020 000001af`94844c70 00007ffd`11e297d8 : mergedlo!SfxStatusBarControl::statusChanged+0x60f
00000077`4378e390 00007ffd`1b919b5a     : 000001af`ea061110 00000077`4378e438 00000077`4378e530 000001af`ea099e80 : mergedlo!comphelper::OInterfaceContainerHelper4<com::sun::star::frame::XStatusListener>::forEach<<lambda_0c827e63d585ef0f6aba54468a4303b6> >+0xbb
00000077`4378e3f0 00007ffd`1b8f0475     : 00000077`4378e470 00000000`00000000 000001af`948445e0 000001af`ea0aad30 : mergedlo!SfxDispatchController_Impl::StateChanged+0x46a
00000077`4378e530 00007ffd`1b8cdecc     : 00000000`00000001 000001af`948445e0 00000000`00000002 00000000`00000040 : mergedlo!SfxStateCache::SetState_Impl+0x105
00000077`4378e570 00007ffd`11a74752     : 00000077`4378e639 00000077`4378e6e0 000001af`d8cec9a0 00007ffd`1c451504 : mergedlo!SfxBindings::SetState+0x1bc
00000077`4378e5d0 00007ffd`11a73457     : 000001af`9481c0b0 000001af`d8cb5530 00000077`4378e870 00000000`00000000 : sdlo!sd::DrawViewShell::ShowMousePosInfo+0x232
00000077`4378e6a0 00007ffd`1cb8bad3     : 000001af`d8abd1e0 000001af`d8abd1e0 000001af`d8abd1e0 000001af`d8abd1e0 : sdlo!sd::DrawViewShell::MouseMove+0x257
00000077`4378e790 00007ffd`1cb90e0a     : 00000000`00000001 00000000`00000000 00000077`4378ed40 00007ffd`1ca56eea : mergedlo!ImplHandleMouseEvent+0x12a3
00000077`4378e9d0 00007ffd`1cb91ac5     : 000001af`d6aca740 00000000`00000001 00000000`00000000 00000000`00000000 : mergedlo!ImplHandleSalMouseMove+0x9a
00000077`4378ea20 00007ffd`1d19260c     : 00000000`00000246 00000000`00000001 00000000`00000200 00000000`00000246 : mergedlo!ImplWindowFrameProc+0x85
00000077`4378ec30 00007ffd`1962cdb2     : 00000000`00000001 00000000`00000409 00000000`00000000 00000000`00000246 : mergedlo!SalFrame::CallCallback+0x1c
00000077`4378ec60 00007ffd`19632df8     : 00000000`04c50615 00000000`00000000 00000000`00000002 00000000`000606fa : vclplug_winlo!ImplHandleMouseMsg+0x242
00000077`4378ed50 00007ffd`1963344d     : 000001af`d1522f08 000001af`d19c81b8 00000000`00000000 00000000`00000246 : vclplug_winlo!SalFrameWndProc+0x1148
00000077`4378eeb0 00007ffd`9f4fe7e8     : 00000000`000606fa 00000000`00000200 00000000`00000001 00000000`04c50615 : vclplug_winlo!SalFrameWndProcW+0x4d
00000077`4378ef40 00007ffd`9f4fe47e     : 000001af`d03af5e0 00007ffd`19633400 00000000`000606fa 00007ffd`00000200 : USER32!UserCallWinProcCheckWow+0x2f8
00000077`4378f0d0 00007ffd`1595f0f0     : 000001af`d8597f70 00000000`00000000 00007ffd`19633400 000001af`00000001 : USER32!CallWindowProcW+0x8e
00000077`4378f120 00007ffd`9f4fe7e8     : 00000000`00000001 00000000`00000001 00000000`00000000 00000000`00000000 : opengl32!wglWndProc+0x2a0
00000077`4378f190 00007ffd`9f4fe229     : 00000000`00000001 00007ffd`1595ee50 00000000`000606fa 000001af`00000200 : USER32!UserCallWinProcCheckWow+0x2f8
00000077`4378f320 00007ffd`195c15e6     : 00007ffd`1595ee50 00000077`4378f420 000001af`d0ce6640 00000000`00000000 : USER32!DispatchMessageWorker+0x249
00000077`4378f3a0 00007ffd`195c1855     : 00000000`00000000 00000000`00000000 000001af`d0ce6640 000001af`d6062a60 : vclplug_winlo!ImplSalDispatchMessage+0x46
00000077`4378f3f0 00007ffd`195c1a01     : 00000000`00000001 00000000`00000001 00000000`00000000 00007ffd`195c198a : vclplug_winlo!ImplSalYield+0x95
00000077`4378f470 00007ffd`1cf91d9a     : 00007ffd`00000001 00000000`00000001 00000077`4378f630 00000000`00000000 : vclplug_winlo!WinSalInstance::DoYield+0x91
00000077`4378f4a0 00007ffd`1cf91d05     : 00007ffd`1f685660 00007ffd`98e5369b 00007ffd`1f78a200 00000000`00000000 : mergedlo!ImplYield+0x5a
00000077`4378f4d0 00007ffd`1bbadf95     : 00007ffd`00000000 00007ffd`00000000 00000077`4378f630 000001af`d69c8f80 : mergedlo!Application::Execute+0x175
00000077`4378f530 00007ffd`1cfa0cc2     : 000001af`d0ad6c50 00007ffd`1f76c120 00000000`00000000 00007ffd`1f78a200 : mergedlo!desktop::Desktop::Main+0x1235
00000077`4378f800 00007ffd`1bbd00cd     : 00000077`00000000 000001af`cbbca2b0 00007ffd`1f76c120 000001af`cbb4c8c0 : mergedlo!ImplSVMain+0x62
00000077`4378f840 00007ff6`043c101b     : 000001af`cbbc9aa0 000001af`cbb4c8c0 00000077`4378f910 000001af`cbb4c8c0 : mergedlo!soffice_main+0x26d
00000077`4378f950 00007ff6`043c12d4     : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : soffice!main+0x1b
00000077`4378f980 00007ffd`9e117614     : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : soffice!__scrt_common_main_seh+0x10c
00000077`4378f9c0 00007ffd`9fca26a1     : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : KERNEL32!BaseThreadInitThunk+0x14
00000077`4378f9f0 00000000`00000000     : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : ntdll!RtlUserThreadStart+0x21


STACK_COMMAND:  ~0s ; .cxr ; kb

SYMBOL_NAME:  ucrtbase!abort+4e

MODULE_NAME: ucrtbase

IMAGE_NAME:  ucrtbase.dll

FAILURE_BUCKET_ID:  FAIL_FAST_FATAL_APP_EXIT_c0000409_ucrtbase.dll!abort

OS_VERSION:  10.0.19041.1

BUILDLAB_STR:  vb_release

OSPLATFORM_TYPE:  x64

OSNAME:  Windows 10

IMAGE_VERSION:  10.0.19041.789

FAILURE_ID_HASH:  {e31753ac-c98a-8055-3663-47e707543d20}

Followup:     MachineOwner
---------
Comment 11 V Stuart Foote 2023-03-18 02:06:09 UTC
Created attachment 186041 [details]
WinDbg stack trace of skia/vulkan buffer overflow on 7.5.1.2 with symbols
Comment 12 Stéphane Guillou (stragu) 2023-03-18 08:41:44 UTC
Thanks, Stuart! Upping the severity as it can lead to a crash, and tagging as a perf issue.
Comment 13 Wolfgang Koenig 2023-03-18 08:45:36 UTC
here is skia.log which hopefully helps:

RenderMethod: vulkan
Vendor: 0x10de
Device: 0x1d01
API: 1.3.236
Driver: 531.72.0
DeviceType: discrete
DeviceName: NVIDIA GeForce GT 1030
Denylisted: no
Comment 14 Matt K 2024-01-15 01:05:17 UTC
I'm not able to repro this with the following:

Version: 24.8.0.0.alpha0+ (X86_64) / LibreOffice Community
Build ID: ef6ff2df2e1286974da2f344aa3b8e3ae9093a79
CPU threads: 16; OS: Windows 10.0 Build 22631; UI render: Skia/Vulkan; VCL: win
Locale: en-US (en_US); UI: en-US
Calc: threaded

RenderMethod: vulkan
Vendor: 0x10de
Device: 0x28e1
API: 1.3.260
Driver: 546.132.0
DeviceType: discrete
DeviceName: NVIDIA GeForce RTX 4050 Laptop GPU
Denylisted: no
Comment 15 V Stuart Foote 2024-01-15 15:28:52 UTC
Also, no longer able to reproduce the GPU memory leak. STR of comment 3 working with attachment 185693 [details]

Think we are ok to resolve => WFM

For OP, please check if you still have crash using Skia and your dedicated GPU, you can monitor GPU memory use during usage from the Performance tab of the Windows Task Manager panel. Please reopen if you again experience crash with GPU memory leak.  

=-testing-= 

Version: 7.6.4.1 (X86_64) / LibreOffice Community
Build ID: e19e193f88cd6c0525a17fb7a176ed8e6a3e2aa1
CPU threads: 8; OS: Windows 10.0 Build 19045; UI render: Skia/Vulkan; VCL: win
Locale: en-US (en_US); UI: en-US
Calc: CL threaded

nor with

Version: 24.8.0.0.alpha0+ (X86_64) / LibreOffice Community
Build ID: 3cb1ed4339fc9aec414c0f112a69705a7a4d9cc6
CPU threads: 8; OS: Windows 10.0 Build 19045; UI render: Skia/Vulkan; VCL: win
Locale: en-US (en_US); UI: en-US
Calc: CL threaded


RenderMethod: vulkan
Vendor: 0x10de
Device: 0x1380
API: 1.3.260
Driver: 546.4.0
DeviceType: discrete
DeviceName: NVIDIA GeForce GTX 750 Ti
Denylisted: no
Comment 16 Wolfgang Koenig 2024-01-16 09:27:02 UTC
no memory leak observed with LibreOffice version 7.6.7  Problem fixed.
Wolfgang Koenig