Crash Dump Analysis

Crash Dump Analysis Patterns (Part 27b)

Forthcoming Webinar on Pattern-Driven Software Diagnostics

2012 - The Year of Software Trace Analysis

Accelerated Memory Dump Analysis Training

Sponsored link: Memory Dump Analysis Services

Here’s a managed space counterpart to unmanaged Stack Trace Collection pattern. When looking at crash dumps from a different than a postmortem analysis machine we might need the appropriate version-specific SOS extension. To list all managed stack traces we use this combined command:

0:000> ~*e !CLRStack OS Thread Id: 0×36f0 (0) Child SP IP Call Site 0031cf84 779b0f34 [HelperMethodFrame: 0031cf84] 0031cfd8 6b65665e System.Collections.ArrayList.GetEnumerator() 0031cfe4 059f4c92 ActiproSoftware.SyntaxEditor.EditorView.a(System.Windows.Forms.PaintEventArgs, System.Drawing.Rectangle, ActiproSoftware.SyntaxEditor.DocumentLine, ActiproSoftware.SyntaxEditor.DisplayLine, ActiproSoftware.SyntaxEditor.EditPositionRange, Int32 ByRef) 0031e158 05a01798 ActiproSoftware.SyntaxEditor.EditorView.OnRender(System.Windows.Forms.PaintEventArgs) 0031e748 04c5f888 ActiproSoftware.WinUICore.UIElement.Render(System.Windows.Forms.PaintEventArgs) 0031e758 04c5f602 ActiproSoftware.WinUICore.UIControl.OnRenderChildElements(System.Windows.Forms.PaintEventArgs) 0031e80c 04c5f1ac ActiproSoftware.WinUICore.UIControl.Render(System.Windows.Forms.PaintEventArgs) 0031e81c 04c5e6fe ActiproSoftware.WinUICore.UIControl.a(System.Windows.Forms.PaintEventArgs) 0031e9a4 04c5e415 ActiproSoftware.WinUICore.UIControl.OnPaint(System.Windows.Forms.PaintEventArgs) 0031e9b4 69f156f5 System.Windows.Forms.Control.PaintWithErrorHandling(System.Windows.Forms.PaintEventArgs, Int16) 0031e9e8 69f1809e System.Windows.Forms.Control.WmPaint(System.Windows.Forms.Message ByRef) 0031ead4 69f073b1 System.Windows.Forms.Control.WndProc(System.Windows.Forms.Message ByRef) 0031ead8 69f102aa [InlinedCallFrame: 0031ead8] 0031eb2c 69f102aa System.Windows.Forms.ScrollableControl.WndProc(System.Windows.Forms.Message ByRef) 0031eb38 048269c3 ActiproSoftware.SyntaxEditor.SyntaxEditor.WndProc(System.Windows.Forms.Message ByRef) 0031ebe8 69f070f3 System.Windows.Forms.Control+ControlNativeWindow.OnMessage(System.Windows.Forms.Message ByRef) 0031ebf0 69f07071 System.Windows.Forms.Control+ControlNativeWindow.WndProc(System.Windows.Forms.Message ByRef) 0031ec04 69f06fb6 System.Windows.Forms.NativeWindow.Callback(IntPtr, Int32, IntPtr, IntPtr) 0031ee44 00e71365 [InlinedCallFrame: 0031ee44] 0031ee40 69f22eec DomainNeutralILStubClass.IL_STUB_PInvoke(MSG ByRef) 0031ee44 69f171ff [InlinedCallFrame: 0031ee44] System.Windows.Forms.UnsafeNativeMethods.DispatchMessageW(MSG ByRef) 0031ee88 69f171ff System.Windows.Forms.Application+ComponentManager.System.Windows.Forms. UnsafeNativeMethods.IMsoComponentManager.FPushMessageLoop(IntPtr, Int32, Int32) 0031ee8c 69f16e2c [InlinedCallFrame: 0031ee8c] 0031ef24 69f16e2c System.Windows.Forms.Application+ThreadContext.RunMessageLoopInner(Int32, System.Windows.Forms.ApplicationContext) 0031ef7c 69f16c81 System.Windows.Forms.Application+ThreadContext.RunMessageLoop(Int32, System.Windows.Forms.ApplicationContext) 0031efac 69ea366d System.Windows.Forms.Application.Run(System.Windows.Forms.Form) 0031efc0 003c3f0d LINQPad.Program.Run(System.String, Boolean, System.String, Boolean, Boolean, System.String) 0031f0b4 003c1515 LINQPad.Program.Go(System.String[]) 0031f2e4 003c0584 LINQPad.Program.Start(System.String[]) 0031f324 003c034f LINQPad.ProgramStarter.Run(System.String[]) 0031f330 003c00f5 LINQPad.Loader.Main(System.String[]) 0031f570 6c1721db [GCFrame: 0031f570] OS Thread Id: 0×36f8 (1) Unable to walk the managed stack. The current thread is likely not a managed thread. You can run !threads to get a list of managed threads in the process OS Thread Id: 0×36fc (2) Child SP IP Call Site 03c2fb78 779b0f34 [DebuggerU2MCatchHandlerFrame: 03c2fb78] OS Thread Id: 0×3700 (3) Child SP IP Call Site 0470f0cc 779b0f34 [InlinedCallFrame: 0470f0cc] 0470f0c8 699380b7 DomainNeutralILStubClass.IL_STUB_PInvoke(Microsoft.Win32.SafeHandles.SafePipeHandle, IntPtr) 0470f0cc 699cc07c [InlinedCallFrame: 0470f0cc] Microsoft.Win32.UnsafeNativeMethods.ConnectNamedPipe(Microsoft.Win32.SafeHandles.SafePipeHandle, IntPtr) 0470f130 699cc07c System.IO.Pipes.NamedPipeServerStream.WaitForConnection() 0470f140 003c31ed LINQPad.Program.Listen() 0470f1d8 6b64ae5b System.Threading.ThreadHelper.ThreadStart_Context(System.Object) 0470f1e8 6b5d7ff4 System.Threading.ExecutionContext.Run(System.Threading.ExecutionContext, System.Threading.ContextCallback, System.Object, Boolean) 0470f20c 6b5d7f34 System.Threading.ExecutionContext.Run(System.Threading.ExecutionContext, System.Threading.ContextCallback, System.Object) 0470f228 6b64ade8 System.Threading.ThreadHelper.ThreadStart() 0470f44c 6c1721db [GCFrame: 0470f44c] 0470f710 6c1721db [DebuggerU2MCatchHandlerFrame: 0470f710] OS Thread Id: 0×3704 (4) Unable to walk the managed stack. The current thread is likely not a managed thread. You can run !threads to get a list of managed threads in the process OS Thread Id: 0×3710 (5) Unable to walk the managed stack. The current thread is likely not a managed thread. You can run !threads to get a list of managed threads in the process OS Thread Id: 0×3714 (6) Unable to walk the managed stack. The current thread is likely not a managed thread. You can run !threads to get a list of managed threads in the process OS Thread Id: 0×3718 (7) Child SP IP Call Site 0596ee40 779b0f34 [GCFrame: 0596ee40] 0596ef34 779b0f34 [HelperMethodFrame_1OBJ: 0596ef34] System.Threading.Monitor.ObjWait(Boolean, Int32, System.Object) 0596ef90 6b5d9140 System.Threading.Monitor.Wait(System.Object, Int32, Boolean) 0596efa0 6bb9428a System.Threading.Monitor.Wait(System.Object) 0596efa4 003cb55a ActiproSoftware.SyntaxEditor.SemanticParserService.c() 0596f068 6b64ae5b System.Threading.ThreadHelper.ThreadStart_Context(System.Object) 0596f078 6b5d7ff4 System.Threading.ExecutionContext.Run(System.Threading.ExecutionContext, System.Threading.ContextCallback, System.Object, Boolean) 0596f09c 6b5d7f34 System.Threading.ExecutionContext.Run(System.Threading.ExecutionContext, System.Threading.ContextCallback, System.Object) 0596f0b8 6b64ade8 System.Threading.ThreadHelper.ThreadStart() 0596f2dc 6c1721db [GCFrame: 0596f2dc] 0596f5a0 6c1721db [DebuggerU2MCatchHandlerFrame: 0596f5a0] OS Thread Id: 0×3764 (8) Child SP IP Call Site 0564f148 779b0f34 [HelperMethodFrame_1OBJ: 0564f148] System.Threading.WaitHandle.WaitOneNative(System.Runtime.InteropServices.SafeHandle, UInt32, Boolean, Boolean) 0564f1f0 6b64b5ef System.Threading.WaitHandle.InternalWaitOne(System.Runtime.InteropServices.SafeHandle, Int64, Boolean, Boolean) 0564f20c 6b64b5ad System.Threading.WaitHandle.WaitOne(Int32, Boolean) 0564f224 6b64b570 System.Threading.WaitHandle.WaitOne() 0564f22c 04b607d4 ActiproBridge.ReferenceManager+?15?.<StartAdvanceFeeder>b__4() 0564f268 6b64ae5b System.Threading.ThreadHelper.ThreadStart_Context(System.Object) 0564f278 6b5d7ff4 System.Threading.ExecutionContext.Run(System.Threading.ExecutionContext, System.Threading.ContextCallback, System.Object, Boolean) 0564f29c 6b5d7f34 System.Threading.ExecutionContext.Run(System.Threading.ExecutionContext, System.Threading.ContextCallback, System.Object) 0564f2b8 6b64ade8 System.Threading.ThreadHelper.ThreadStart() 0564f4dc 6c1721db [GCFrame: 0564f4dc] 0564f7a0 6c1721db [DebuggerU2MCatchHandlerFrame: 0564f7a0] OS Thread Id: 0×3768 (9) Unable to walk the managed stack. The current thread is likely not a managed thread. You can run !threads to get a list of managed threads in the process OS Thread Id: 0×376c (10) Child SP IP Call Site GetFrameContext failed: 1 OS Thread Id: 0×3798 (11) Child SP IP Call Site GetFrameContext failed: 1 OS Thread Id: 0×37e0 (12) Unable to walk the managed stack. The current thread is likely not a managed thread. You can run !threads to get a list of managed threads in the process OS Thread Id: 0×37f8 (13) Unable to walk the managed stack. The current thread is likely not a managed thread. You can run !threads to get a list of managed threads in the process

- Dmitry Vostokov @ DumpAnalysis.org + TraceAnalysis.org -

Sponsored link: Professional Software Debugging Services

/* Malware and Software Defects -> Victimware.org */

Citrix and Microsoft Customer Forum

Museum of Debugging and Memory Dumps

7/7/2011 - 8/8/2011 Annual Competition: Tell Your Windows Debugging Story

Crash and Hang Analysis Audit Service

CARE: Crash Analysis Report Environment

Crash Dump and Software Trace Analysis Training and Seminars

Access OpenTask Titles on Safari Books Online

DATA (Dump Analysis + Trace Analysis) Facebook group
Please join the community of memory (dump) and trace analysis engineers. This group promotes scientific methods and memory dump-based worldview.

Twitter @ DumpAnalysis
You can now follow portal and blog news at DumpAnalysis on Twitter

LinkedIn Group Dr. Watson Enthusiasts
All about Dr. Watson errors and more. Get news, excerpts and progress reports about the forthcoming book The Science of Dr. Watson: An Illustrated History of Debugging (ISBN 978-1906717070)

2010 (0x7DA) - The Year of Dump Analysis
2011 (0x7DB) - 2020 (0x7E4) The Debugging Decade

International Memory Analysts and Debuggers Day:
07.07 and/or 08.08 starting from The Year of Dump Analysis, 2010, 7DA

Announcements

Coming Soon:

Resume and CV: As a Book