Crash Dump Analysis Patterns (Part 60b)
This is a .NET counterpart to unmanaged and native code execution residue pattern. Here we can use SOS extension !DumpStack command for call level execution residue (see Caller-n-Callee pattern example) and !DumpStackObjects (!dso) for managed object references found on a raw stack:
0:011> !DumpStackObjects
OS Thread Id: 0x8e0 (11)
ESP/REG Object Name
09efe4b8 0a2571bc System.Threading.Thread
09efe538 0a1ffddc System.Threading.Thread
09efe844 0a1ffba8 UserQuery
09efe974 0a1ffce0 System.Signature
09efea20 0a1ffd10 System.RuntimeTypeHandle[]
09efeae8 08985e14 System.Object[] (System.Reflection.AssemblyName[])
09efeaec 0a1ffa78 System.Diagnostics.Stopwatch
09efeaf0 0a1ffa6c LINQPad.Extensibility.DataContext.QueryExecutionManager
09efeafc 0a1ffba8 UserQuery
09efeb00 0a1ffa58 System.RuntimeType
09efeb04 08995474 LINQPad.ObjectGraph.Formatters.XhtmlWriter
09efeb08 08985dfc System.Reflection.Assembly
09efeb0c 08985dc8 LINQPad.ExecutionModel.ResultData
09efeb10 08984548 LINQPad.ExecutionModel.Server
09efebdc 0a1ffbe8 System.Reflection.RuntimeMethodInfo
09efebe0 0a1fcfc4 LINQPad.ExecutionModel.ConsoleTextReader
09efebe4 0a1fcddc System.IO.StreamReader+NullStreamReader
09efebe8 0899544c System.IO.TextWriter+SyncTextWriter
09efebec 08985efc System.Reflection.AssemblyName
09efebf0 08985d4c System.String C:\Users\Training\AppData\Local\Temp\LINQPad\fcamvgpa
09efec30 08984548 LINQPad.ExecutionModel.Server
09efeedc 08985910 System.Threading.ThreadStart
0:011> !DumpObj 0a2571bc
Name: System.Threading.Thread
MethodTable: 790fe704
EEClass: 790fe694
Size: 56(0×38) bytes
(C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\mscorlib.dll)
Fields:
MT Field Offset Type VT Attr Value Name
7910a5c4 4000634 4 ….Contexts.Context 0 instance 08980ee4 m_Context
79104de8 4000635 8 ….ExecutionContext 0 instance 00000000 m_ExecutionContext
790fd8c4 4000636 c System.String 0 instance 00000000 m_Name
790fe3b0 4000637 10 System.Delegate 0 instance 00000000 m_Delegate
79130084 4000638 14 System.Object[][] 0 instance 00000000 m_ThreadStaticsBuckets
7912d7c0 4000639 18 System.Int32[] 0 instance 00000000 m_ThreadStaticsBits
791028f4 400063a 1c …ation.CultureInfo 0 instance 00000000 m_CurrentCulture
791028f4 400063b 20 …ation.CultureInfo 0 instance 00000000 m_CurrentUICulture
790fd0f0 400063c 24 System.Object 0 instance 00000000 m_ThreadStartArg
791016bc 400063d 28 System.IntPtr 1 instance 8f69280 DONT_USE_InternalThread
79102290 400063e 2c System.Int32 1 instance 2 m_Priority
79102290 400063f 30 System.Int32 1 instance 11 m_ManagedThreadId
7910a7a8 4000640 168 …LocalDataStoreMgr 0 shared static s_LocalDataStoreMgr
>> Domain:Value 000710a8:06c42ef4 08e65d48:00000000 <<
790fd0f0 4000641 16c System.Object 0 shared static s_SyncObject
>> Domain:Value 000710a8:017b25d8 08e65d48:0898381c <<
Although unmanaged, CLR and JIT-code residue is useful for analysis, for example, as shown in Handled Exception pattern examples.
- Dmitry Vostokov @ DumpAnalysis.org + TraceAnalysis.org -
February 10th, 2012 at 11:43 am
Sometimes if no exceptions are found on raw stack we can search all runtime types, for example:
0:000> !DumpRuntimeTypes
[…]
098b93e8 05179888 05622254 CustomException
[…]
09bcd368 ? 6969470c System.NullReferenceException
[…]
August 2nd, 2018 at 2:28 pm
!DumpStackObjects can also accept the range, for example, full stack region from !teb command (similar to dps or dpS).