Case of the .NET Memory Leak via Gfx Driver on Windows 8

Posted on August 21, 2015 by chentiangemalc

A .NET 4 application used to index scanned documents started to fail on Windows 8

clip_image002

Typically the recommendation for Not enough storage is available to process this command might involve:

  • reduce the number of running programs;
  • remove unwanted files from the disk the paging file is on and restart the system;
  • check the paging file disk for an I/O error; or
  • install additional memory in your system

However in this case these options didn’t fix the issue.

Taking a dmp file with ProcDump –ma option (http://live.sysinternals.com/Procdump.exe) we find the following:

Load SOS extensions for debugging .NET process

0:000> .loadby sos clr
0:000> .cordll -ve -u -l

Dumping last CLR exception…

0:000> !pe
Exception object: 07559bb0
Exception type:   System.IO.FileLoadException
Message:          Could not load file or assembly ‘System.ServiceModel, Version=3.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089’ or one of its dependencies. Not enough storage is available to process this command. (Exception from HRESULT: 0x80070008)
InnerException:   <none>
StackTrace (generated):
    SP       IP       Function
    00000000 00000001 UNKNOWN!DocumentAutomation.Common.ServiceAdaptor.ESBV4ServicesAdaptor..ctor(System.String, System.String, System.String[,], System.String, System.TimeSpan)+0x2
    005DE908 04CE30E5 DocumentAutomation_Indexing!DocumentAutomation.Indexing.ViewModels.IndexingViewModel.OnValidateCase()+0x265
StackTraceString: <none>
HResult: 80070008
0:000> lmvm DocumentAutomation*
Browse full module list
start    end        module name
00420000 0045c000   DocumentAutomation_Indexing C (no symbols)          
    Loaded symbol image file: DocumentAutomation.Indexing.exe
    Image path: C:\Program Files (x86)\TIS\eFlow 4.5\Bin\DocumentAutomation.Indexing.exe
    Image name: DocumentAutomation.Indexing.exe
    Browse all global symbols  functions  data
    Has CLR image header, track-debug-data flag not set
    Timestamp:        Wed Mar 25 19:18:50 2015 (55126F6A)
    CheckSum:         00000000
    ImageSize:        0003C000
    File version:     1.0.0.0
    Product version:  1.0.0.0
    File flags:       0 (Mask 3F)
    File OS:          4 Unknown Win32
    File type:        1.0 App
    File date:        00000000.00000000
    Translations:     0000.04b0
    ProductName:      DocumentAutomation.Indexing
    InternalName:     DocumentAutomation.Indexing.exe
    OriginalFilename: DocumentAutomation.Indexing.exe
    ProductVersion:   1.0.0.0
    FileVersion:      1.0.0.0
    FileDescription:  DocumentAutomation.Indexing
LegalCopyright:   Copyright ©  2012

Extracting the EXE in WinDbg, we can then open in .NET reflector to decompile

0:000> !SaveModule 00420000 C:\support\DocumentAutomation.Indexing.exe
3 sections in file
section 0 – VA=2000, VASize=350f4, FileAddr=200, FileSize=35200
section 1 – VA=38000, VASize=5d0, FileAddr=35400, FileSize=600
section 2 – VA=3a000, VASize=c, FileAddr=35a00, FileSize=200

Here we can find the code that threw the error. The issue is initialization of ESBV4ServicesAdaptor is failing when it tries to load System.ServiceModel.dll. You may need to take a few dmp files to confirm if it is always failing in exact same place.

Private Sub OnValidateCase()
    Try
        Dim base2 As CaseValidatorBase
        Me.AutoPopulateDocumentFields
        If Me._globalSettings.PlanValidationConnector(Me.CurrentCase.get_Plan).Equals(“Internal”, StringComparison.OrdinalIgnoreCase) Then
            base2 = New InternalCaseValidator(Me.CurrentCase, Me.eFlow.Collection, Me._globalSettings)
        Else
Dim adaptor As New ESBV4ServicesAdaptor(Me._globalSettings.GetSetting(“AaspireUserID”), Encryption.Decrypt(Me._globalSettings.GetSetting(“AaspirePassword”)), Me._globalSettings.ImagaasPlanIdsPlancodes, Me._globalSettings.GetSetting(“V4RemoteEndPoint”), New TimeSpan(0, Integer.Parse(Me._globalSettings.GetSetting(“ServiceAdaptorSendTimeoutMins”)), 0))
            base2 = New CaseValidator(Me.CurrentCase, adaptor, Me.eFlow.Collection, Me._globalSettings.GetSetting(“AaspireUserID”), Encryption.Decrypt(Me._globalSettings.GetSetting(“AaspirePassword”)))
        End If
        base2.Validate
        Me.AutoPopulateDocumentFields
        Me.SyncCaseFields
        Me.SelectedPageImage.RefreshDocumentField
        Me.Status = IndexingStatus.Validated
        If (base2.get_ValidationMsgs.Count > 0) Then
            MessageBox.Show(base2.GetMassages, “Validation Message”, MessageBoxButton.OK)
        End If
    Catch exception As InvalidCaseException
        Dim nullable As Integer?
        Dim e As InvalidCaseException = exception
        Dim messageBoxText As String = If(e.ValidationMessage.get_PageIndex.HasValue, String.Format(“Page {0}: {1}”, If(nullable = e.ValidationMessage.get_PageIndex.HasValue, New Integer?((nullable.GetValueOrDefault + 1)), Nothing), e.Message), e.Message)
        MessageBox.Show(messageBoxText, e.ValidationMessage.get_Field, MessageBoxButton.OK)
        If e.ValidationMessage.get_PageIndex.HasValue Then
            Dim classf As <>c__DisplayClass5f
            Me.SelectedPageImage = Enumerable.FirstOrDefault(Of PageImage)(Me.PageImages, New Func(Of PageImage, Boolean)(classf, DirectCast(Me.<OnValidateCase>b__5e, IntPtr)))
        End If
    Catch exception2 As Exception
MessageBox.Show(exception2.Message, “Fatal Error”, MessageBoxButton.OK, MessageBoxImage.Hand)
    End Try
End Sub

Because this is failing to initialize an object, a common issue may be out of process address space, and this app is running as 32-bit program:


Looking at memory usage…
0:000> !address -summary
Mapping file section regions…
Mapping module regions…
Mapping PEB regions…
Mapping TEB and stack regions…
Mapping heap regions…
Mapping page heap regions…
Mapping other regions…
Mapping stack trace database regions…
Mapping activation context regions…
— Usage Summary —————- RgnCount ———– Total Size ——– %ofBusy %ofTotal
Heap                                    344          5ad52000 (   1.419 GB)  78.89%   70.97%
Free                                    320           cdd5000 ( 205.832 MB)           10.05%
Image                                  1037           c462000 ( 196.383 MB)  10.66%    9.59%
<unknown>                               757           b053000 ( 176.324 MB)   9.57%    8.61%
Stack                                    55            fc0000 (  15.750 MB)   0.85%    0.77%
Other                                     9             41000 ( 260.000 kB)   0.01%    0.01%
TEB                                      18             12000 (  72.000 kB)   0.00%    0.00%
PEB                                       1              1000 (   4.000 kB)   0.00%    0.00%
— Type Summary (for busy) —— RgnCount ———– Total Size ——– %ofBusy %ofTotal
MEM_PRIVATE                             705          60ec8000 (   1.514 GB)  84.19%   75.72%
MEM_IMAGE                              1467           d1cd000 ( 209.801 MB)  11.39%   10.24%
MEM_MAPPED                               49           5186000 (  81.523 MB)   4.43%    3.98%
— State Summary —————- RgnCount ———– Total Size ——– %ofBusy %ofTotal
MEM_COMMIT                             1686          6e10d000 (   1.720 GB)  95.60%   85.99%
MEM_FREE                                320           cdd5000 ( 205.832 MB)           10.05%
MEM_RESERVE                             535           510e000 (  81.055 MB)   4.40%    3.96%
— Protect Summary (for commit) – RgnCount ———– Total Size ——– %ofBusy %ofTotal
PAGE_READWRITE                          635          5d9f3000 (   1.463 GB)  81.32%   73.14%
PAGE_EXECUTE_READ                       118           8ac2000 ( 138.758 MB)   7.53%    6.78%
PAGE_READONLY                           496           623a000 (  98.227 MB)   5.33%    4.80%
PAGE_WRITECOPY                          252           1681000 (  22.504 MB)   1.22%    1.10%
PAGE_EXECUTE_READWRITE                   97            1f5000 (   1.957 MB)   0.11%    0.10%
PAGE_EXECUTE_WRITECOPY                   50            14c000 (   1.297 MB)   0.07%    0.06%
PAGE_READWRITE|PAGE_GUARD                36             5a000 ( 360.000 kB)   0.02%    0.02%
PAGE_NOACCESS                             2              2000 (   8.000 kB)   0.00%    0.00%
— Largest Region by Usage ———– Base Address ——– Region Size ———-
Heap                                         e570000            fcf000 (  15.809 MB)
Free                                        5e820000            d80000 (  13.500 MB)
Image                                       57388000            f1a000 (  15.102 MB)
<unknown>                                    2120000           1cae000 (  28.680 MB)
Stack                                        2000000             fd000 (1012.000 kB)
Other                                       7ed90000             23000 ( 140.000 kB)
TEB                                         7ebf7000              1000 (   4.000 kB)
PEB                                         7edbe000              1000 (   4.000 kB)
0:000> !heap -stat
_HEAP 006f0000
     Segments            00000004
         Reserved  bytes 007fc000
         Committed bytes 005c5000
     VirtAllocBlocks     0000005d
         VirtAlloc bytes e255b09c
_HEAP 00b80000
     Segments            00000009
         Reserved  bytes 04e47000
         Committed bytes 041cb000
     VirtAllocBlocks     00000000
         VirtAlloc bytes 00000000
_HEAP 09170000
     Segments            00000002
         Reserved  bytes 0010e000
         Committed bytes 00018000
     VirtAllocBlocks     00000000
         VirtAlloc bytes 00000000
_HEAP 00990000
     Segments            00000001
         Reserved  bytes 0000f000
         Committed bytes 0000f000
     VirtAllocBlocks     00000000
         VirtAlloc bytes 00000000
_HEAP 04780000
     Segments            00000001
         Reserved  bytes 0000f000
         Committed bytes 00008000
     VirtAllocBlocks     00000000
         VirtAlloc bytes 00000000
_HEAP 04750000
     Segments            00000001
         Reserved  bytes 0000f000
         Committed bytes 00007000
     VirtAllocBlocks     00000000
         VirtAlloc bytes 00000000
_HEAP 02110000
     Segments            00000001
         Reserved  bytes 0000f000
         Committed bytes 00003000
     VirtAllocBlocks     00000000
         VirtAlloc bytes 00000000
_HEAP 01ff0000
     Segments            00000001
         Reserved  bytes 0000f000
         Committed bytes 00001000
     VirtAllocBlocks     00000000
         VirtAlloc bytes 00000000
0:000> !heap -s
************************************************************************************************************************
                                              NT HEAP STATS BELOW
************************************************************************************************************************
LFH Key                   : 0x271d989d
Termination on corruption : DISABLED
  Heap     Flags   Reserv  Commit  Virt   Free  List   UCR  Virt  Lock  Fast
                    (k)     (k)    (k)     (k) length      blocks cont. heap
—————————————————————————–
006f0000 00000002    8284   5924   8176   1328   202     4   93      1   LFH
    External fragmentation  22 % (202 free blocks)
00990000 00001002     168     64     60      9     7     1    0      0   LFH
00b80000 00001002   80264  67380  80156    294    30     9    0      0   LFH
02110000 00001002      60     12     60      3     6     1    0      0     
01ff0000 00041002      60      4     60      2     1     1    0      0     
04780000 00001002     168     36     60      2     3     1    0      0   LFH
04750000 00041002     168     32     60      1     5     1    0      0   LFH
09170000 00001002    1188    100   1080     50     5     2    0      0   LFH
—————————————————————————–
0:000> !eeheap -gc
Number of GC Heaps: 1
generation 0 starts at 0x07ca8d10
generation 1 starts at 0x07c51000
generation 2 starts at 0x02121000
ephemeral segment allocation context: none
         segment             begin         allocated  size
02120000  02121000  0311ffe4  0xffefe4(16773092)
06ab0000  06ab1000  0757e71c  0xacd71c(11327260)
07c50000  07c51000  0819fca8  0x54eca8(5565608)
Large object heap starts at 0x03121000
         segment             begin         allocated  size
03120000  03121000  03dadaa8  0xc8caa8(13159080)
Total Size:              Size: 0x2ca7e50 (46825040) bytes.
——————————
GC Heap Size:    Size: 0x2ca7e50 (46825040) bytes.

0:000> !dumpheap -stat
    Statistics:

          MT    Count    TotalSize Class Name
etc…

    60f3b340     9234       258552 System.Reflection.Emit.ScopeTree
    60f6b8fc     4647       260232 System.Reflection.RuntimePropertyInfo
    60f642d0     8139       260448 System.EventHandler
    60f70b28     9622       269416 System.Collections.ArrayList+ArrayListEnumeratorSimple
    57501c04     3616       274816 System.Windows.Data.BindingExpression
    06256688     4414       300152 TiS.Core.eFlowAPI.TisROIMiscellaneousParams
    06256160     4414       300152 TiS.Core.eFlowAPI.TisROIPostProcessingParams
    06256b64     4622       314296 TiS.Core.eFlowAPI.TisOCRGroupParamsLinksContainer
    60f7a740     3312       318672 System.Runtime.CompilerServices.ConditionalWeakTable`2+Entry[[System.Object, mscorlib],[System.Object, mscorlib]][]
    574fbd18     1294       320912 System.Windows.Controls.Border
    60f4356c     9234       332424 System.Reflection.Emit.DynamicResolver
    60f763d4    30341       364092 System.WeakReference
    60f75a78     8363       367972 System.Signature
    60f3b1d0    11905       380960 System.Reflection.Emit.SignatureHelper
    60f71238     2920       424800 System.Collections.Hashtable+bucket[]
    009846b0     4196       429232 System.Collections.Generic.Dictionary`2+Entry[[System.Type, mscorlib],[System.Attribute[], mscorlib]][]
    60f6c290     9901       475248 System.RuntimeMethodInfoStub
    062551fc     4414       476712 TiS.Core.eFlowAPI.TisROIParams
    0500b718    15820       506240 TiS.Core.eFlowAPI.NamedObjectListEvent
    60f65af8     9234       517104 System.Reflection.Emit.DynamicMethod
    60f73acc    13901       641256 System.Int32[]
    60f6bed4    10749       644940 System.Reflection.RuntimeMethodInfo
    58eccce8     9114       846936 System.Windows.EffectiveValueEntry[]
    60f433b8     9234       886464 System.Reflection.Emit.DynamicILGenerator
    60f35738   107092      3501976 System.Object[]
    60f75670    51775      5672668 System.Byte[]
    60f721b4    57971      6750108 System.String
    00702bd0      223      8557414      Free
    Total 783513 objects
    Fragmented blocks larger than 0.5 MB:
        Addr     Size      Followed by
    08039088    1.4MB         08194298 System.String

 

From the memory analysis we find heap is large 1.4GB ram, but the managed objects are very small in size, so looks like we have a native memory leak. This can be further researched with

However we already had several dmp files of the process as memory grew, so we took a look at these.

A raw analysis of the dmp file showed 73% of the dmp file was filled with 0xFF – we suspect this was 0xFF 0xFF 0xFF representing white background on the scanned documents.

From !eestack we saw this stack pattern always present in each dmp file, allocating to heap

 

Current frame: ntdll!NtRemoveIoCompletion+0xc
ChildEBP RetAddr  Caller, Callee
05e6e988 748f2dfa KERNELBASE!GetQueuedCompletionStatus+0x2a, calling ntdll!NtRemoveIoCompletion
05e6e9c0 673f94e1 clr!ThreadpoolMgr::CompletionPortThreadStart+0x22f, calling kernel32!GetQueuedCompletionStatusStub
05e6ea54 6734814d clr!Thread::intermediateThreadProc+0x4d
05e6ed20 76fb81b5 ntdll!bsearch+0x6f
05e6ed44 76fb83bb ntdll!RtlpLocateActivationContextSection+0xe3, calling ntdll!bsearch
05e6ed64 76fb882c ntdll!RtlpFindUnicodeStringInSection+0x193, calling ntdll!__security_check_cookie
05e6ed7c 71db107b mscoreei!ShimLog::Log+0x1a4, calling mscoreei!__security_check_cookie
05e6ed9c 76fb8295 ntdll!RtlpFindNextActivationContextSection+0x7a, calling ntdll!RtlpLocateActivationContextSection
05e6edb8 76fb85f2 ntdll!RtlFindActivationContextSectionString+0x146, calling ntdll!RtlpFindUnicodeStringInSection
05e6edf8 76fdb1b7 ntdll!LdrpApplyLookupReference+0x1e, calling ntdll!RtlIsCriticalSectionLockedByThread
05e6ee04 76fb8972 ntdll!LdrpFindLoadedDllByName+0x13d, calling ntdll!RtlReleaseSRWLockExclusive
05e6ee08 76fb8891 ntdll!RtlWow64EnableFsRedirectionEx+0x51, calling ntdll!_SEH_epilog4
05e6ee38 76fb8891 ntdll!RtlWow64EnableFsRedirectionEx+0x51, calling ntdll!_SEH_epilog4
05e6ee3c 76fc53eb ntdll!LdrpFindOrMapDll+0xfd6, calling ntdll!RtlWow64EnableFsRedirectionEx
05e6ee48 76fc544d ntdll!LdrpFindOrMapDll+0xf06, calling ntdll!LdrpFindOrMapDll+0xf40
05e6ee58 76fc54ac ntdll!LdrpFindOrMapDll+0x107e, calling ntdll!__security_check_cookie
05e6eeec 76fb8c78 ntdll!RtlDosApplyFileIsolationRedirection_Ustr+0x2d8, calling ntdll!memset
05e6efb4 76fb83bb ntdll!RtlpLocateActivationContextSection+0xe3, calling ntdll!bsearch
05e6efd4 76fb882c ntdll!RtlpFindUnicodeStringInSection+0x193, calling ntdll!__security_check_cookie
05e6f00c 76fb8295 ntdll!RtlpFindNextActivationContextSection+0x7a, calling ntdll!RtlpLocateActivationContextSection
05e6f028 76fb85f2 ntdll!RtlFindActivationContextSectionString+0x146, calling ntdll!RtlpFindUnicodeStringInSection
05e6f05c 76fb9493 ntdll!LdrpApplyFileNameRedirection+0x96, calling ntdll!RtlDosApplyFileIsolationRedirection_Ustr
05e6f08c 76fb9424 ntdll!LdrpApplyFileNameRedirection+0xac, calling ntdll!__security_check_cookie
05e6f0ac 76fc5c5b ntdll!LdrpFindOrMapDependency+0x209, calling ntdll!LdrpFindOrMapDll
05e6f0c8 76fc5c79 ntdll!LdrpFindOrMapDependency+0x227, calling ntdll!LdrpFindOrMapDependency+0x2d9
05e6f0d8 76fc5cba ntdll!LdrpFindOrMapDependency+0x268, calling ntdll!__security_check_cookie
05e6f15c 76fb8972 ntdll!LdrpFindLoadedDllByName+0x13d, calling ntdll!RtlReleaseSRWLockExclusive
05e6f164 76fb8891 ntdll!RtlWow64EnableFsRedirectionEx+0x51, calling ntdll!_SEH_epilog4
05e6f194 76fb8891 ntdll!RtlWow64EnableFsRedirectionEx+0x51, calling ntdll!_SEH_epilog4
05e6f198 76fcff38 ntdll!LdrpFindLoadedDll+0x2ea, calling ntdll!RtlWow64EnableFsRedirectionEx
05e6f1ac 76fee967 ntdll!LdrpFindLoadedDll+0x342, calling ntdll!__security_check_cookie
05e6f1bc 76fb8891 ntdll!RtlWow64EnableFsRedirectionEx+0x51, calling ntdll!_SEH_epilog4
05e6f304 76fc4d3e ntdll!LdrpGetProcedureAddress+0x3d, calling ntdll!RtlImageNtHeaderEx
05e6f350 76f8e385 ntdll!LdrpResolveNonStaticDependency+0x22f, calling ntdll!LdrpDereferenceNode
05e6f384 76fc5a4d ntdll!LdrpReleaseModuleEnumLock+0x19, calling ntdll!RtlReleaseSRWLockShared
05e6f398 76fc5a0b ntdll!LdrpReleaseLoaderLock+0x1a, calling ntdll!LdrpReleaseModuleEnumLock
05e6f3a8 76f8e47c ntdll!LdrGetProcedureAddressForCaller+0x312, calling ntdll!LdrpReleaseLoaderLock
05e6f3c4 748bf769 KERNELBASE!_KernelBaseBaseDllInitialize+0x313, calling KERNELBASE!RegKrnInitialize
05e6f3d4 748bf77a KERNELBASE!_KernelBaseBaseDllInitialize+0x324, calling KERNELBASE!__security_check_cookie
05e6f45c 76fd04c3 ntdll!RtlpLowFragHeapAllocFromContext+0x34d, calling ntdll!memset
05e6f4d8 76fb10e9 ntdll!RtlAllocateHeap+0xc5, calling ntdll!RtlpLowFragHeapAllocFromContext
05e6f4f0 76fb10e9 ntdll!RtlAllocateHeap+0xc5, calling ntdll!RtlpLowFragHeapAllocFromContext
05e6f518 76fb10e9 ntdll!RtlAllocateHeap+0xc5, calling ntdll!RtlpLowFragHeapAllocFromContext
05e6f528 7479b2e4 msvcrt!_VEC_memzero+0x36, calling msvcrt!fastzero_I
05e6f550 6315ba71 igdumdim32!OpenAdapter+0x15aa71, calling ntdll!RtlLeaveCriticalSection
05e6f55c 631550ef igdumdim32!OpenAdapter+0x1540ef, calling igdumdim32!OpenAdapter+0x15aa5e
05e6f564 631550d8 igdumdim32!OpenAdapter+0x1540d8, calling igdumdim32!OpenAdapter+0x155225
05e6f590 631550d8 igdumdim32!OpenAdapter+0x1540d8, calling igdumdim32!OpenAdapter+0x155225
05e6f594 63151741 igdumdim32!OpenAdapter+0x150741, calling igdumdim32!OpenAdapter+0x15403e
05e6f5a0 681b30a1 msctfui!_CRT_INIT+0x1ea, calling msctfui!__security_check_cookie
05e6f5ac 681a32c6 msctfui!DllMain+0x10, calling kernel32!GetCurrentThreadId
05e6f5bc 681b31f7 msctfui!__DllMainCRTStartup+0x107, calling msctfui!DllMain
05e6f5c4 681b366e msctfui!_SEH_epilog4_GS+0xa, calling msctfui!__security_check_cookie
05e6f5c8 681b3379 msctfui!__DllMainCRTStartup+0x289, calling msctfui!_SEH_epilog4_GS
05e6f608 631518a5 igdumdim32!OpenAdapter+0x1508a5, calling igdumdim32!OpenAdapter+0x155225
05e6f624 76fb96c4 ntdll!RtlDeactivateActivationContextUnsafeFast+0x9c, calling ntdll!__security_check_cookie
05e6f640 76fb9758 ntdll!LdrpCallInitRoutine+0x43, calling ntdll!LdrxCallInitRoutine
05e6f650 76fb9776 ntdll!LdrpCallInitRoutine+0x61, calling ntdll!_SEH_epilog4
05e6f668 76fc5a4d ntdll!LdrpReleaseModuleEnumLock+0x19, calling ntdll!RtlReleaseSRWLockShared
05e6f67c 76fc5a0b ntdll!LdrpReleaseLoaderLock+0x1a, calling ntdll!LdrpReleaseModuleEnumLock
05e6f68c 76fd5b55 ntdll!LdrpInitializeThread+0x1af, calling ntdll!LdrpReleaseLoaderLock
05e6f698 76fd5b43 ntdll!LdrpInitializeThread+0x139, calling ntdll!_SEH_epilog4
05e6f6ec 76fd5ab4 ntdll!LdrpInitializeThread+0xeb, calling ntdll!RtlActivateActivationContextUnsafeFast
05e6f6f0 76fd5b1d ntdll!LdrpInitializeThread+0x1a4, calling ntdll!RtlDeactivateActivationContextUnsafeFast
05e6f72c 76fcaa56 ntdll!_LdrpInitialize+0x80, calling ntdll!_SEH_epilog4
05e6f774 76fca9ca ntdll!LdrInitializeThunk+0x1a, calling ntdll!NtContinue
05e6f9e0 6734813b clr!Thread::intermediateThreadProc+0x3b, calling clr!_alloca_probe_16
05e6f9f4 74cc7c04 kernel32!BaseThreadInitThunk+0x24
05e6fa08 76fcad1f ntdll!__RtlUserThreadStart+0x2f
05e6fa50 76fcacea ntdll!_RtlUserThreadStart+0x1b, calling ntdll!__RtlUserThreadStart

This seemed to be coming from user mode graphics driver. Interestingly on working machines a similar stack pattern was present, minus the user mode graphics driver.

0:000> lmvm igdumdim32
Browse full module list
start    end        module name
62b70000 64249000   igdumdim32   (deferred)            
    Image path: C:\Windows\System32\igdumdim32.dll
    Image name: igdumdim32.dll
    Browse all global symbols  functions  data
    Timestamp:        Wed Mar 04 04:29:18 2015 (54F5EF6E)
    CheckSum:         016F3784
    ImageSize:        016D9000
    File version:     10.18.14.4156
    Product version:  10.18.14.4156
    File flags:       0 (Mask 3F)
    File OS:          40004 NT Win32
    File type:        2.8 Dll
    File date:        00000000.00000000
    Translations:     0409.04b0
    CompanyName:      Intel Corporation
    ProductName:      Intel HD Graphics Drivers for Windows 8(R)
    InternalName:     igdumdim32.dll
    OriginalFilename: igdumdim32.dll
    ProductVersion:   10.18.14.4156
    FileVersion:      10.18.14.4156
    FileDescription:  User Mode Driver for Intel(R) Graphics Technology
    LegalCopyright:   Copyright (c) 1998-2013 Intel Corporation.

 

So I wrote a simple console C# program to test something, to show the RenderCapability ( https://msdn.microsoft.com/en-us/library/system.windows.media.rendercapability(v=vs.110).aspx ) of the device. Added reference PresentationCore

using System;
using System.Windows.Media;

namespace RenderCapabilityConsoleApplication
{
    class Program
    {
        static void Main(string[] args)
        {
            Console.WriteLine("RenderCapability:");
            Console.WriteLine("Tier: {0}", RenderCapability.Tier >> 16);
            switch (RenderCapability.Tier)
            {
                case 0:
                    Console.WriteLine("No graphics hardware acceleration is available for the application on the device.All graphics features use software acceleration.The DirectX version level is less than version 9.0.");
                    break;
                case 0x00010000:
                    Console.WriteLine("Most of the graphics features of WPF will use hardware acceleration if the necessary system resources are available and have not been exhausted. This corresponds to a DirectX version that is greater than or equal to 9.0.");
                    break;
                case 0x00020000:
                    Console.WriteLine("Most of the graphics features of WPF will use hardware acceleration provided the necessary system resources have not been exhausted.This corresponds to a DirectX version that is greater than or equal to 9.0.");
                    break;
            }
            Console.Write("Press <Enter>");
            Console.ReadLine();
        }
    }
}

What we found was this:

  • The broken machine reported capability 0 (No hardware acceleration)
  • The working machines (Windows XP+Windows 7) reported render capability 2 (Most of the features of WPF will use hardware acceleration)

Now a machine can be forced down to capability 0 by remote controlling it. However in this case the machine was not remote controlled.

So we RDP’d to the working Win7/Windows XP machines – they were now breaking too with out of memory error, only when under RDP session:

clip_image002[8]

Running DxDiag on the affected machine, we found no video acceleration capability was available on the affected machine.

Checking device drivers we found a 3rd party video adapter installed which was used by the IT department for remote control ( CA ITCM Remote Control ) 

Unfortunately DxDiag didn’t seem to capture this display adapter in its report, we found it via Device Manager.

Removing this device driver set the machines render capability back to 0, and memory leak was gone, application now worked fine…

About chentiangemalc

specializes in end-user computing technologies. disclaimer 1) use at your own risk. test any solution in your environment. if you do not understand the impact/consequences of what you're doing please stop, and ask advice from somebody who does. 2) views are my own at the time of posting and do not necessarily represent my current view or the view of my employer and family members/relatives. 3) over the years Microsoft/Citrix/VMWare have given me a few free shirts, pens, paper notebooks/etc. despite these gifts i will try to remain unbiased.
This entry was posted in .NET, C#, Debugging, Windows 8 and tagged . Bookmark the permalink.

Leave a comment