I had a stack overflow exception and i was able to use windbg to get a log of everything, however the log is very greek to me, and i'm not sure what i'm looking for. Any help is appreciated.
FAULTING_IP:
+1d42faf00b2df58
02dbb89f e9e3000000 jmp 02dbb987
EXCEPTION_RECORD: ffffffff -- (.exr 0xffffffffffffffff)
ExceptionAddress: 791a2c0c (clr!EECodeManager::EnumGcRefs+0x0000001b)
ExceptionCode: c00000fd (Stack overflow)
ExceptionFlags: 00000000
NumberParameters: 2
Parameter[0]: 00000001
Parameter[1]: 02dd2edc
PROCESS_NAME: crawler.exe
ERROR_CODE: (NTSTATUS) 0xc00000fd - A new guard page for the stack cannot be created.
EXCEPTION_CODE: (NTSTATUS) 0xc00000fd - A new guard page for the stack cannot be created.
EXCEPTION_PARAMETER1: 00000001
EXCEPTION_PARAMETER2: 02dd2edc
RECURRING_STACK: From frames 0x19 to 0x19
MOD_LIST: <ANALYSIS/>
NTGLOBALFLAG: 0
APPLICATION_VERIFIER_FLAGS: 0
MANAGED_STACK: !dumpstack -EE
No export dumpstack found
ADDITIONAL_DEBUG_TEXT: Followup set based on attribute [Is_ChosenCrashFollowupThread] from Frame:[0] on thread:[PSEUDO_THREAD]
LAST_CONTROL_TRANSFER: from 791a2fad to 791a2c0c
FAULTING_THREAD: ffffffff
DEFAULT_BUCKET_ID: NOSOS
PRIMARY_PROBLEM_CLASS: NOSOS
BUGCHECK_STR: APPLICATION_FAULT_NOSOS_STACK_OVERFLOW_STACKIMMUNE
STACK_TEXT:
00000000 00000000 crawler.exe+0x0
SYMBOL_NAME: crawler.exe
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: crawler
IMAGE_NAME: crawler.exe
DEBUG_FLR_IMAGE_TIMESTAMP: 4e5a416f
STACK_COMMAND: ** Pseudo Context ** ; kb
FAILURE_BUCKET_ID: NOSOS_c00000fd_crawler.exe!Unknown
BUCKET_ID: APPLICATION_FAULT_NOSOS_STACK_OVERFLOW_STACKIMMUNE_crawler.exe
FOLLOWUP_IP: *** WARNING: Unable to verify checksum for crawler.exe
*** ERROR: Module load completed but symbols could not be loaded for crawler.exe
crawler+0
00400000 4d dec ebp
WATSON_STAGEONE_URL: http://watson.microsoft.com/StageOne/crawler_exe/1_0_0_0/4e5a416f/clr_dll/4_0_30319_1/4ba1d9ef/c00000fd/00062c0c.htm?Retriage=1
Followup: MachineOwner
---------
0:005> .exr 0xffffffffffffffff
ExceptionAddress: 791a2c0c (clr!EECodeManager::EnumGcRefs+0x0000001b)
ExceptionCode: c00000fd (Stack overflow)
ExceptionFlags: 00000000
NumberParameters: 2
Parameter[0]: 00000001
Parameter[1]: 02dd2edc
Load SOS (.loadby sos clr
or .loadby sos mscorwks
if you're not on .NET 4) and use the !pe
command to display the exception. If you don't have the exception object, use !threads
to list the threads and any exceptions they may have.
Work out what the process was doing at the time, and look for either:
Accidentally recursive properties like this:
private readonly string foo;
public string Foo { get { return Foo; } } // Should have been return foo;
Ideally, you should have unit tests which can help to pin this down - they're normally pretty good at finding such problems. The unit test running may still crash (StackOverflowException can't be caught) but it should help to isolate it.
I would personally have a few goes at reproducing the problem in conventional ways before going for advanced debugging techniques.
Maybe try DebugDiag first - http://www.microsoft.com/download/en/details.aspx?id=26798. It will do automatic analysis of your dump.
If that's not enough you will need SOS to analyze .NET code - http://msdn.microsoft.com/en-us/library/bb190764.aspx.
Here you can find some info on how to load it - Unable to load SOS in WinDbg.
Then just use one of the commands to analyze dump. Tess Fernandez has great tutorials on how to use windbg with sos - http://blogs.msdn.com/b/tess/archive/tags/debugging/.
She also published labs to help you learn windbg - http://blogs.msdn.com/b/tess/archive/2008/02/04/net-debugging-demos-information-and-setup-instructions.aspx.
If your dump is from different system then the one you analyze on this might help - Is it possible to debug win2003 IIS crash dump using windbg on windows XP?
User contributions licensed under CC BY-SA 3.0