How do you track down winform ntGetContextThread + 0xc crash

1

What is my next step to track down my app crash?

I have a c# winforms app which seems to randomly close without warning. I have run a dump file though winDbg but it hasn't narrowed down my search. Here's what it has given me.

0:000> !analyze -v
*******************************************************************************
*                                                                             *
*                        Exception Analysis                                   *
*                                                                             *
*******************************************************************************

Unable to load image C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\225759bb87c854c0fff27b1d84858c21\mscorlib.ni.dll, Win32 error 0n2
*** WARNING: Unable to verify checksum for mscorlib.ni.dll
*** WARNING: Unable to verify checksum for System.ni.dll
Failed to request MethodData, not in JIT code range

KEY_VALUES_STRING: 1

    Key  : Analysis.CPU.mSec
    Value: 39186

    Key  : Analysis.DebugAnalysisProvider.CPP
    Value: Create: 8007007e on IT21023

    Key  : Analysis.DebugData
    Value: CreateObject

    Key  : Analysis.DebugModel
    Value: CreateObject

    Key  : Analysis.Elapsed.mSec
    Value: 61046

    Key  : Analysis.Memory.CommitPeak.Mb
    Value: 162

    Key  : Analysis.System
    Value: CreateObject

    Key  : CLR.BuiltBy
    Value: NETFXREL2

    Key  : CLR.Engine
    Value: CLR

    Key  : CLR.Version
    Value: 4.6.1055.0

    Key  : Timeline.Process.Start.DeltaSec
    Value: 230

    Key  : WER.OS.Branch
    Value: win8_rtm

    Key  : WER.OS.Timestamp
    Value: 2012-07-25T12:47:00Z

    Key  : WER.OS.Version
    Value: 6.2.9200.16384

    Key  : WER.Process.Version
    Value: 1.0.0.0


ADDITIONAL_XML: 1

OS_BUILD_LAYERS: 1

EXCEPTION_RECORD:  (.exr -1)
ExceptionAddress: 00000000
   ExceptionCode: 80000003 (Break instruction exception)
  ExceptionFlags: 00000000
NumberParameters: 0

FAULTING_THREAD:  00000970

PROCESS_NAME:  app.exe

ERROR_CODE: (NTSTATUS) 0x80000003 - {EXCEPTION}  Breakpoint  A breakpoint has been reached.

EXCEPTION_CODE_STR:  80000003

MISSING_CLR_SYMBOL: 0

STACK_TEXT:  
0074e4d4 772b28a2     772b9f60 0012020e 753bca8a ntdll!NtGetContextThread+0xc
0074e4e0 753bca8a     0074e5c4 0074e5b0 74a7bd90 ntdll!_SEH_epilog4_GS+0xa
0074e5a8 772b214f     0e990248 772b2128 fe9c0cf3 KERNELBASE!CheckSpecialLocales+0xd7
0074e628 772b24cc     00000000 0f27fc30 0e9905c0 ntdll!RtlpFreeHeap+0x667
0074e64c 746026cd     0e990000 00000000 0f27fc30 ntdll!RtlFreeHeap+0x206
0074e660 74600aa1     0f27fc30 0074ed58 0f250048 dbghelp!Win32LiveAllocationProvider::Free+0x19
0074e8a0 0f276660     0074e8c0 00000340 0074ed58 dbghelp!Win32LiveSystemProvider::QueryBuildString+0x1e4
WARNING: Frame IP not in any known module. Following frames may be wrong.
00000000 00000000     00000000 00000000 00000000 0xf276660


STACK_COMMAND:  ~0s; .ecxr ; kb

SYMBOL_NAME:  dbghelp!Win32LiveAllocationProvider::Free+19

MODULE_NAME: dbghelp

IMAGE_NAME:  dbghelp.dll

FAILURE_BUCKET_ID:  BREAKPOINT_80000003_dbghelp.dll!Win32LiveAllocationProvider::Free

OS_VERSION:  6.2.9200.16384

BUILDLAB_STR:  win8_rtm

OSPLATFORM_TYPE:  x86

OSNAME:  Windows 8

IMAGE_VERSION:  6.2.9200.16384

FAILURE_ID_HASH:  {0bbdb302-68ba-7226-fd2a-f9b8c4d5b299}

Followup:     MachineOwner
---------

It doesn't seem to throw any clues which link it back to the app.

The dump file it self came from bugsplat would this be the cause? I tried it in WinDbg as bugsplat also couldn't offer any help, the active thread looks like this.

ntdll!NtGetContextThread
ntdll!_SEH_epilog4_GS
KERNELBASE!CheckSpecialLocales
ntdll!RtlpFreeHeap
ntdll!RtlFreeHeap
dbghelp!Win32LiveAllocationProvider::Free
dbghelp!Win32LiveSystemProvider::QueryBuildString
0xf276660
[InlinedCallFrame: 0074ee98]
08068e3e
08068bf1
08068bf1
080683d3
08067aef
6b8d9eda
System.Windows.Forms.Control.InvokeMarshaledCallbacks()
System.Windows.Forms.Control.WndProc(System.Windows.Forms.Message ByRef)
[InlinedCallFrame: 0074f074]
System.Windows.Forms.DataGridView.WndProc(System.Windows.Forms.Message ByRef)
System.Windows.Forms.Control+ControlNativeWindow.OnMessage(System.Windows.Forms.Message ByRef)
System.Windows.Forms.Control+ControlNativeWindow.WndProc(System.Windows.Forms.Message ByRef)
System.Windows.Forms.NativeWindow.Callback(IntPtr, Int32, IntPtr, IntPtr)
[InlinedCallFrame: 0074f2b4]
DomainBoundILStubClass.IL_STUB_PInvoke(MSG ByRef)
[InlinedCallFrame: 0074f2b4] System.Windows.Forms.UnsafeNativeMethods.DispatchMessageW(MSG ByRef)
System.Windows.Forms.Application+ComponentManager.System.Windows.Forms.UnsafeNativeMethods.IMsoComponentManager.FPushMessageLoop(IntPtr, Int32, Int32)
[InlinedCallFrame: 0074f2ec]
System.Windows.Forms.Application+ThreadContext.RunMessageLoopInner(Int32, System.Windows.Forms.ApplicationContext)
System.Windows.Forms.Application+ThreadContext.RunMessageLoop(Int32, System.Windows.Forms.ApplicationContext)
System.Windows.Forms.Application.Run(System.Windows.Forms.Form)
app.Program.Main() [C:\Projects\App\App\Program.cs @ 55]

Which manages to link back to Application.Run command but not to anywhere else.

Am I missing something which can help me find what the cause of the crash is, or have I been over looking some information?

# # Update # #

The error turned out to be from the line.

System.Windows.Forms.Control.InvokeMarshaledCallbacks()

Which was being produced from a BeginInvoke call.

c#
winforms
windbg
asked on Stack Overflow Dec 1, 2020 by Ben Close • edited Dec 4, 2020 by Ben Close

1 Answer

1

If you use the BugSplat .NET SDK, you'll get a managed call stack as well as the native call stack. If you need help with that, feel free to reach out to support@bugsplat.com

answered on Stack Overflow Dec 1, 2020 by Dave Splat

User contributions licensed under CC BY-SA 3.0