[Upstream] Huge memory allocation on zoom in Impress / xorg crashes

[David Bruant]

Binary package hint: openoffice.org

1) lsb_release -rd
Description: Ubuntu natty (development branch)
Release: 11.04

2) apt-cache policy libreoffice-impress
libreoffice-impress:
  Installed: 1:3.3.0-1ubuntu1
  Candidate: 1:3.3.0-1ubuntu1
  Version table:
 *** 1:3.3.0-1ubuntu1 0
        500 http://us.archive.ubuntu.com/ubuntu/ natty/main i386 Packages 100

3) What is expected to happen in LibreOffice Impress via the Terminal:

cd ~/Desktop && wget https://bugs.launchpad.net/ubuntu/+source/openoffice.org/+bug/481030/+attachment/1458993/+files/buggy.odp && loimpress -nologo buggy.odp

Click and slide zoom bar on bottom right all the way to the right quickly and efficiently.

4) What happens instead is xorg crashes. For a backtrace in a Xubuntu Precise VirtualBox VM please see: https://bugs.launchpad.net/ubuntu/+source/xorg/+bug/481030/+attachment/2704570/+files/Xorg.0.log.old

lsb_release -rd
Description: Ubuntu precise (development branch)
Release: 12.04

apt-cache policy libreoffice-impress
libreoffice-impress:
  Installed: 1:3.5.0~beta2-2ubuntu4
  Candidate: 1:3.5.0~beta2-2ubuntu4
  Version table:
 *** 1:3.5.0~beta2-2ubuntu4 0
        500 http://us.archive.ubuntu.com/ubuntu/ precise/main i386 Packages
        100 /var/lib/dpkg/status

apt-cache policy xorg
xorg:
  Installed: 1:7.6+10ubuntu1
  Candidate: 1:7.6+10ubuntu1
  Version table:
 *** 1:7.6+10ubuntu1 0
        500 http://us.archive.ubuntu.com/ubuntu/ precise/main i386 Packages
        100 /var/lib/dpkg/status

ProblemType: Bug
Architecture: i386
Date: Wed Nov 11 15:36:52 2009
DistroRelease: Ubuntu 9.10
Package: openoffice.org-core 1:3.1.1-5ubuntu1
ProcEnviron:
 PATH=(custom, no user)
 LANG=fr_FR.UTF-8
 SHELL=/bin/bash
ProcVersionSignature: Ubuntu 2.6.31-14.48-generic
SourcePackage: openoffice.org
Uname: Linux 2.6.31-14-generic i686

[Chris Cheney (ccheney)]

[This is an automatic notification.]

This bug was reported against an earlier version of Ubuntu, can you test if it still occurs on Ubuntu 10.04 LTS (Lucid Lynx)?

Please note we also provide technical support for older versions of Ubuntu, but not in the bug tracker. Instead, to raise the issue through normal support channels, please see:

    http://www.ubuntu.com/support

If you are the original reporter and can still reproduce the issue on Lucid, please run the following command to refresh the report:

  apport-collect 481030

Bear in mind that you may need to install the python-launchpadlib package from the universe repository. Additionally, when prompted to give apport-collect permissions for Launchpad you will need to give it at least the ability to "Change Non-Private" data as it will be adding information to your bug report.

If you are not the original reporter, please file a new bug report, so we can work with you as the original reporter instead (you can reference bug 481030 in your report if you think it may be related):

  ubuntu-bug openoffice.org

If by chance you can no longer reproduce the issue on Lucid or if you feel it is no longer relevant, please mark the bug report 'Fix Released' or 'Invalid' as appropriate, at the following URL:

  https://bugs.launchpad.net/ubuntu/+bug/481030

[David Bruant (bruant)]

Still the same. Ridiculous memory allocation when zooming by clicking on the bottom-right corner (I haven't tried another way of zooming). For what it worth, my kernel is : 2.6.34-020634rc7-generic #020634rc7 (even though it's very unlikely to be helpful in any way)

[Chris Cheney (ccheney)]

Do you still have this problem on Ubuntu 10.04 LTS? I can't reproduce this problem on that version.

[David Bruant (bruant)]

Yes still on 10.04. Sorry for not telling earlier.

[Chris Cheney (ccheney)]

Please attach an example document exhibiting this issue, my simple test document wasn't able to reproduce this. Also does this happen for you every time you try to do it, or just on certain documents?

[Chris Cheney (ccheney)]

We're closing this bug since it is has been some time with no response from the original reporter. However, if the issue still exists please feel free to reopen with the requested information. Also, if you could, please test against the latest development version of Ubuntu, since this confirms the bug is one we may be able to pass upstream for help.

[David Bruant (bruant)]

I have simplified a file on which the bug occurs. It still occurs.
To be more accurate about my first description regarding memory allocaton, I have noticed that if the zoom isn't too big, there is a big allocation, the zoom is performed and the memory is freed in a decent amount of time.

To answer the question "does this happen for you every time you try to do it, or just on certain documents?", the bug doesn't occur on a blank .odt (created thanks to the assistant without any theme or model).
The bug occurs if I create a presentation from a model (at least Blue or Human, the attachement is created from Human).

[penalvch (penalvch)]

Reproduced in Ubuntu 11.04, LibreOffice Impress at the Terminal:

cd ~/Desktop && wget https://bugs.launchpad.net/ubuntu/+source/openoffice.org/+bug/481030/+attachment/1458993/+files/buggy.odp && loimpress -nologo buggy.odp

Click and slide zoom all the way to the right, OS grinds to a halt.

lsb_release -rd
Description: Ubuntu natty (development branch)
Release: 11.04

apt-cache policy libreoffice-impress
libreoffice-impress:
  Installed: 1:3.3.0-1ubuntu1
  Candidate: 1:3.3.0-1ubuntu1
  Version table:
 *** 1:3.3.0-1ubuntu1 0
        500 http://us.archive.ubuntu.com/ubuntu/ natty/main i386 Packages 100

[Andrea-turrini (andrea-turrini)]

User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:2.0.0) Gecko/20100101 Firefox/4.0

I am using openSUSE 11.4 completely updated, KDE 4.6.2 from repo K:R:46 and LibreOffice from repo LibreOffice:/Stable.

My video card is identified by lspci as:
00:02.0 VGA compatible controller: Intel Corporation Mobile 4 Series Chipset Integrated Graphics Controller (rev 07)
and by X as: Intel(R) GM45.
In ~/.xsession-error sometimes I find:
OpenGL vendor string: Tungsten Graphics, Inc
OpenGL renderer string: Mesa DRI Mobile Intel® GM45 Express Chipset GEM 20100330 DEVELOPMENT
OpenGL version string: 2.1 Mesa 7.10
OpenGL shading language version string: 1.20
Driver: Intel
GPU class: i965
OpenGL version: 2.1
GLSL version: 1.20
Mesa version: 7.10
X server version: 1.9.3
Linux kernel version: 2.6.37
Direct rendering: yes
Requires strict binding: yes
GLSL shaders: yes
Texture NPOT support: yes

If I use the intel driver (from package xorg-x11-driver-video-7.6-52.4) sometimes the cpu goes to 100% and then X crashes. This event is quite rare and it is very difficult to reproduce and even to understand what induces it.

However using libreoffice I am able to induce probably the same crash, creating an empty presentation and then changing the zoom to at least 1200% using the slider or typing it after a double click on the zoom factor. The same happens using libreoffice draw (with the same zoom factor).
If I change the Xorg driver from intel to intellegacy (from package xorg-x11-driver-video-intel-legacy-2.9.1-8.1) the above procedure does not induce a crash of X.

The crash occurs also with a fresh user with all desktop effects disabled.

Before submitting this report, I asked in a forum to reproduce the bug

Reproducible: Always

Steps to Reproduce:
1. Start X using the intel driver on a GM45 video card
2. Launch libreoffice impress and create an empty presentation
3. Change zoom to at least 1200%
Actual Results:
X crashes and the login screen comes up

Expected Results:
X does not crash, as happens using intellegacy driver

In the Xorg.0.log file there is the following backtrace of the crash:

Backtrace:
[ 23062.651] 0: /usr/bin/Xorg (xorg_backtrace+0x28) [0x463678]
[ 23062.651] 1: /usr/bin/Xorg (0x400000+0x6ae89) [0x46ae89]
[ 23062.651] 2: /lib64/libc.so.6 (0x7f157045c000+0x32b30) [0x7f157048eb30]
[ 23062.652] 3: /usr/lib64/xorg/modules/drivers/intel_drv.so (0x7f156e87d000+0x12696) [0x7f156e88f696]
[ 23062.652] 4: /usr/lib64/xorg/modules/drivers/intel_drv.so (0x7f156e87d000+0x30614) [0x7f156e8ad614]
[ 23062.652] 5: /usr/bin/Xorg (0x400000+0xd8861) [0x4d8861]
[ 23062.652] 6: /usr/bin/Xorg (0x400000+0x2f6b1) [0x42f6b1]
[ 23062.652] 7: /usr/bin/Xorg (0x400000+0x25ace) [0x425ace]
[ 23062.652] 8: /lib64/libc.so.6 (__libc_start_main+0xfd) [0x7f157047abfd]
[ 23062.652] 9: /usr/bin/Xorg (0x400000+0x25679) [0x425679]
[ 23062.652] Segmentation fault at address ...

[Andrea-turrini (andrea-turrini)]

I forgot to say that I asked in a forum to try to reproduce the crash, but noone using an ATI or a NVidia card is able to induce the crash following the above steps.
If I try in VirtualBox with the same configuration of KDE e libreoffice, no crash occurs.

[penalvch (penalvch)]

Marking Confirmed based on LO duplicate 781954.

[Sndirsch-u (sndirsch-u)]

Unfortunately we do not have the ressources to address that issue
still for openSUSE 11.4. Could you please test again with
a current Milestone of openSUSE 12.1, whether the issue still
exists and give me feedback about the result? Thanks.

[Andrea-turrini (andrea-turrini)]

The crash still occurs in openSUSE 12.1 (installed using DVD Build 250, x86_64, without performin online updates) but not so deterministically.

The only way I found to induce it again is to move quite fast the zoom slider in loimpress.

I'll attach the .xsession-errors, the output of dmesg and the Xorg.0.log.old relative to the crash.
I can not attach /var/log/messages since it is empty (after installation and a reboot).

[Andrea-turrini (andrea-turrini)]

Created an attachment (id=449130)
.xsession-errors relative to the induced crash

[Andrea-turrini (andrea-turrini)]

Created an attachment (id=449131)
Output of "dmesg" after the crash

[Andrea-turrini (andrea-turrini)]

Created an attachment (id=449132)
Xorg.log relative to the induced crash

[Björn Michaelsen (bjoern-michaelsen)]

[This is an automated message.]
There are no new official OpenOffice.org releases in Ubuntu packaging anymore => Won't Fix

If the problem persists, please mark this bug as "also affects project Libreoffice" or "also affects distribution Libreoffice (Ubuntu)" if that has not happened already.

Please leave references to upstream OpenOffice.org bugs in place to allow cross pollination.

[Bryce Harrington (bryce)]

According to the upstream intel bug report, this issue got resolved earlier this year. Could you retest for this issue on oneiric? Sounds like it should be resolved there. If it isn't, it might be worth it to reopen https://bugs.freedesktop.org/show_bug.cgi?id=38292

[Robert Roth (evfool)]

I have just tried and successfully reproduced on oneiric, with the latest libreoffice impress.

[penalvch (penalvch)]

Reproducible in Xubuntu Precise. See attachment Xorg.0.log.old for backtrace. I had to move the slider back and forth a few times before xorg would crash.

lsb_release -rd
Description: Ubuntu precise (development branch)
Release: 12.04

apt-cache policy libreoffice-writer
libreoffice-writer:
  Installed: 1:3.5.0~beta2-2ubuntu4
  Candidate: 1:3.5.0~beta2-2ubuntu4
  Version table:
 *** 1:3.5.0~beta2-2ubuntu4 0
        500 http://us.archive.ubuntu.com/ubuntu/ precise/main i386 Packages
        100 /var/lib/dpkg/status

[Bryce Harrington (bryce)]

The crash from Christopher's log:

[ 463.522] (II) VBoxVideo(0): Modeline "1366x606"x0.0 50.37 1366 1368 1370 1372 606 608 610 612 -hsync -vsync (36.7 kHz)
[ 3771.137] (II) XKB: reuse xkmfile /var/lib/xkb/server-03AF3717FF3AB439A4BAABA686CCB40771CDF520.xkm
[ 3850.449]
Backtrace:
[ 3850.520] 0: /usr/bin/X (xorg_backtrace+0x37) [0xb76bd957]
[ 3850.520] 1: /usr/bin/X (0xb7536000+0x18b4ba) [0xb76c14ba]
[ 3850.520] 2: (vdso) (__kernel_rt_sigreturn+0x0) [0xb751540c]
[ 3850.520] 3: /usr/lib/i386-linux-gnu/libpixman-1.so.0 (pixman_rasterize_trapezoid+0x30) [0xb7407dd0]
[ 3850.520] 4: /usr/lib/i386-linux-gnu/libpixman-1.so.0 (pixman_composite_trapezoids+0x400) [0xb7408430]
[ 3850.520] 5: /usr/lib/xorg/modules/libfb.so (0xb6f54000+0x1d464) [0xb6f71464]
[ 3850.520] 6: /usr/bin/X (CompositeTrapezoids+0xb5) [0xb7635885]
[ 3850.520] 7: /usr/bin/X (0xb7536000+0x105178) [0xb763b178]
[ 3850.520] 8: /usr/bin/X (0xb7536000+0xffe01) [0xb7635e01]
[ 3850.520] 9: /usr/bin/X (0xb7536000+0x376a5) [0xb756d6a5]
[ 3850.520] 10: /usr/bin/X (0xb7536000+0x250fa) [0xb755b0fa]
[ 3850.520] 11: /lib/i386-linux-gnu/libc.so.6 (__libc_start_main+0xf3) [0xb71cb113]
[ 3850.520] 12: /usr/bin/X (0xb7536000+0x25439) [0xb755b439]
[ 3850.520] Segmentation fault at address (nil)
[ 3850.520]
Caught signal 11 (Segmentation fault). Server aborting

[Bryce Harrington (bryce)]

Christopher, thanks for posting your Xorg.0.log. The stack trace there is quite different from the original crash. Since the patch on the upstream bug report is already deployed and the bug set as fixed, there's not much point reopening it, which means this bug report is stale. Let's close it out and have you open a new bug report.

Please file a new bug report after reproducing the crash via this command:

  ubuntu-bug xorg

Also, we will need a full stacktrace from the crash - see http://wiki.ubuntu.com/X/Backtracing for guidance on how to do that.

[penalvch (penalvch)]

Bryce Harrington (bryce), thank you for checking into this. I agree completely with you as the situation improved from:
Slide once fast to the right -> crash

to

Slide back and forth quickly quite a few times -> different crash (and also corrupts the install but different issue for a different bug).

I was personally not affected by the original bug, nor the improved situation. So, I won't take up any more of your time on this or creating a new bug. I was merely triaging it as I attempt to do for LibreOffice bugs.

However, those affected by this bug and need a fix for it in previous versions of Ubuntu, please do steps 1 and 2 of the SRU Procedure [1] to bring the need to a developer's attention.

[1]: https://wiki.ubuntu.com/StableReleaseUpdates#Procedure

[Sndirsch-u (sndirsch-u)]

openSUSE 12.1 is no longer supported. Hence the issue won't be fixed for this product. In case the issue still is reproducable with a supported product (openSUSE 12.3/13.1 at the moment) or with openSUSE:Factory, please feel free to reopen. Thanks.