Crash Dump Analysis Patterns (Part 213b)

Previously we introduced Rough Stack Trace analysis pattern for unmanaged space. However, similar collection of symbolic references is possible for managed space (without included unmanaged references we see in Caller-n-Callee). Although the output is noisy, it can be filtered by external tools. The simple WinDbg script outputs managed method descriptors from a stack segment where boundaries were taken from the output of !teb command (this works even for complete memory dumps with .NET Core SOS extension after switching to the appropriate process context):

1: kd> .for (r $t0=000000a7d4d9c000; @$t0 < 000000a7d4db0000; r $t0=@$t0+@$ptrsize) {.if (poi(@$t0) > 7ff000000000) { .printf "---\n"; !IP2MD poi(@$t0) }}
[...]
Failed to request MethodData, not in JIT code range
---
MethodDesc:   00007ff8f7da4fd8
Method Name:          System.Windows.Forms.Application.Run(System.Windows.Forms.Form)
Class:                00007ff8f7d9c1f0
MethodTable:          00007ff8f7da50b0
mdToken:              0000000006000AB8
Module:               00007ff8f7c599a0
IsJitted:             yes
Current CodeAddr:     00007ff953059310
Version History:
ILCodeVersion:      0000000000000000
ReJIT ID:           0
IL Addr:            00007ff952a055d7
CodeAddr:           00007ff953059310  (ReadyToRun)
NativeCodeVersion:  0000000000000000

MethodDesc:   00007ff8f7c26d98
Method Name:          LINQPad.UIProgram.Run()
Class:                00007ff8f7c32d30
MethodTable:          00007ff8f7c28280
mdToken:              00000000060001AF
Module:               00007ff8f7bc2780
IsJitted:             yes
Current CodeAddr:     00007ff8f8328c50
Version History:
ILCodeVersion:      0000000000000000
ReJIT ID:           0
IL Addr:            000002316969a53c
CodeAddr:           00007ff8f8328c50  (MinOptJitted)
NativeCodeVersion:  0000000000000000

MethodDesc:   00007ff8f7c26c60
Method Name:          LINQPad.UIProgram.Go(System.String[])
Class:                00007ff8f7c32d30
MethodTable:          00007ff8f7c28280
mdToken:              00000000060001A4
Module:               00007ff8f7bc2780
IsJitted:             yes
Current CodeAddr:     00007ff8f7f23890
Version History:
ILCodeVersion:      0000000000000000
ReJIT ID:
IL Addr:            0000023169699840
CodeAddr:           00007ff8f7f23890  (MinOptJitted)
NativeCodeVersion:  0000000000000000

Failed to request MethodData, not in JIT code range

MethodDesc:   00007ff8f7c26c00
Method Name:          LINQPad.UIProgram.Start(System.String[])
Class:                00007ff8f7c32d30
MethodTable:          00007ff8f7c28280
mdToken:              00000000060001A0
Module:               00007ff8f7bc2780
IsJitted:             yes
Current CodeAddr:     00007ff8f7b2fce0
Version History:
ILCodeVersion:      0000000000000000
ReJIT ID:           0
IL Addr:            00000231696996fc
CodeAddr:           00007ff8f7b2fce0  (MinOptJitted)
NativeCodeVersion:  0000000000000000

MethodDesc:   00007ff8f7bc64d8
Method Name:          LINQPad.UI.Loader.Main(System.String[])
Class:                00007ff8f7c09508
MethodTable:          00007ff8f7bc64f0
mdToken:              0000000006000346
Module:               00007ff8f7bc2780
IsJitted:             yes
Current CodeAddr:     00007ff8f7b26400
Version History:
ILCodeVersion:      0000000000000000
ReJIT ID:           0
IL Addr:            00000231696ab048
CodeAddr:           00007ff8f7b26400  (MinOptJitted)
NativeCodeVersion:  0000000000000000

Failed to request MethodData, not in JIT code range

Failed to request MethodData, not in JIT code range

Failed to request MethodData, not in JIT code range

Failed to request MethodData, not in JIT code range

[…]

- Dmitry Vostokov @ DumpAnalysis.org + TraceAnalysis.org -

Comments are closed.