multithreading - 分析死锁时"DebugInfo for CritSec does not point back to the critical section"

Question

我正在使用 Windbg 来分析用 delphi 编写的数据快照应用程序服务器中发生的死锁。

当我运行时

!analyze -hang -v

我明白了

:000:x86> !analyze -hang -v********************************************************************************                                                                             **                        Exception Analysis                                   **                                                                             ********************************************************************************GetPageUrlData failed, server returned HTTP status 404URL requested: http://watson.microsoft.com/00000000.htm?Retriage=1FAULTING_IP: +6ced24000000000 ??              ???EXCEPTION_RECORD:  ffffffffffffffff -- (.exr 0xffffffffffffffff)ExceptionAddress: 0000000000000000   ExceptionCode: 80000003 (Break instruction exception)  ExceptionFlags: 00000000NumberParameters: 0FAULTING_THREAD:  0000000000000000BUGCHECK_STR:  HANGDEFAULT_BUCKET_ID:  APPLICATION_HANGPROCESS_NAME:  ********.exeERROR_CODE: (NTSTATUS) 0xcfffffff - EXCEPTION_CODE: (NTSTATUS) 0xcfffffff - MOD_LIST: NTGLOBALFLAG:  0APPLICATION_VERIFIER_FLAGS:  0DERIVED_WAIT_CHAIN:  Dl Eid Cid     WaitType-- --- ------- --------------------------   0   c7c.2634 Critical Section       WAIT_CHAIN_COMMAND:  ~0s;k;;BLOCKING_THREAD:  0000000000002634PRIMARY_PROBLEM_CLASS:  APPLICATION_HANGLAST_CONTROL_TRANSFER:  from 0000000077138df4 to 000000007711f8b1STACK_TEXT:  0018fc50 77138df4 00000c6c 00000000 00000000 ntdll_77100000!NtWaitForSingleObject+0x150018fcb4 77138cd8 00000000 00000000 03fe0940 ntdll_77100000!RtlpWaitOnCriticalSection+0x13e0018fcdc 7369324f 736a3134 00000000 03fe0940 ntdll_77100000!RtlEnterCriticalSection+0x150WARNING: Stack unwind information not available. Following frames may be wrong.0018fcec 7369af5f 00000388 00000000 003d1e00 mswsock!GetLspGuid+0x19af0018fd08 76366958 00000388 0018fd84 0018fd9c mswsock!GetLspGuid+0x96bf0018fd38 0018fd58 763668cd 00000388 0018fd84 ws2_32!WSAAccept+0x8400000000 00000000 00000000 00000000 00000000 0x18fd58FOLLOWUP_IP: mswsock!GetLspGuid+19af7369324f 33db            xor     ebx,ebxSYMBOL_STACK_INDEX:  3SYMBOL_NAME:  mswsock!GetLspGuid+19afFOLLOWUP_NAME:  MachineOwnerMODULE_NAME: C:\Windows\System32\mswsockIMAGE_NAME:  lldDEBUG_FLR_IMAGE_TIMESTAMP:  4ce7c83dSTACK_COMMAND:  ~0s ; kbFAILURE_BUCKET_ID:  APPLICATION_HANG_cfffffff_lld!UnloadedBUCKET_ID:  X64_HANG_mswsock!GetLspGuid+19afWATSON_STAGEONE_URL:  http://watson.microsoft.com/00000000.htm?Retriage=1Followup: MachineOwner---------

I then did

!locks -V

查看它正在等待哪个锁，令我惊讶的是它返回了这个，

0:000:x86> !locks -VCritSec ntdll!RtlCriticalSectionLock+0 at 0000000077057060LockCount          NOT LOCKEDRecursionCount     0OwningThread       0EntryCount         0ContentionCount    0CritSec ntdll!LdrpLoaderLock+0 at 0000000077057490LockCount          NOT LOCKEDRecursionCount     0OwningThread       0EntryCount         0ContentionCount    0CritSec ntdll!RtlpDynamicFunctionTableLock+0 at 0000000077057468LockCount          NOT LOCKEDRecursionCount     0OwningThread       0EntryCount         0ContentionCount    0CritSec ntdll!FastPebLock+0 at 000000007705a900LockCount          NOT LOCKEDRecursionCount     0OwningThread       0EntryCount         0ContentionCount    0CritSec ntdll!RtlpProcessHeapsListLock+0 at 000000007705a240LockCount          NOT LOCKEDRecursionCount     0OwningThread       0EntryCount         0ContentionCount    0CritSec +270208 at 0000000000270208LockCount          NOT LOCKEDRecursionCount     0OwningThread       0EntryCount         0ContentionCount    1CritSec ntdll!EtwProvCritSect+0 at 000000007705a120LockCount          NOT LOCKEDRecursionCount     0OwningThread       0EntryCount         0ContentionCount    0CritSec ntdll!EtwPrivSessionCritSect+0 at 000000007705a1e0LockCount          NOT LOCKEDRecursionCount     0OwningThread       0EntryCount         0ContentionCount    0CritSec +10208 at 0000000000010208LockCount          NOT LOCKEDRecursionCount     0OwningThread       0EntryCount         0ContentionCount    0CritSec +276f40 at 0000000000276f40LockCount          NOT LOCKEDRecursionCount     0OwningThread       0EntryCount         0ContentionCount    0Scanned 10 critical sections

From looking at the call stack

STACK_TEXT:  0018fc50 77138df4 00000c6c 00000000 00000000 ntdll_77100000!NtWaitForSingleObject+0x150018fcb4 77138cd8 00000000 00000000 03fe0940 ntdll_77100000!RtlpWaitOnCriticalSection+0x13e0018fcdc 7369324f 736a3134 00000000 03fe0940 ntdll_77100000!RtlEnterCriticalSection+0x150WARNING: Stack unwind information not available. Following frames may be wrong.0018fcec 7369af5f 00000388 00000000 003d1e00 mswsock!GetLspGuid+0x19af0018fd08 76366958 00000388 0018fd84 0018fd9c mswsock!GetLspGuid+0x96bf0018fd38 0018fd58 763668cd 00000388 0018fd84 ws2_32!WSAAccept+0x8400000000 00000000 00000000 00000000 00000000 0x18fd58

I determined it was waiting on a critical section at address 0x736a3134 (First parameter passed to RtlEnterCriticalSection) so I ran this

!critsec 736a3134

这给了我这个输出

0:000:x86> !critsec 736a3134DebugInfo for CritSec at 00000000736a3134 does not point back to the critical sectionNOT an initialized critical section.CritSec mswsock!WSPStartup+6f64 at 00000000736a3134WaiterWoken        YesLockCount          -1RecursionCount     11028OwningThread       c6cEntryCount         1f49dad6ContentionCount    88000000*** Locked

现在，关键部分的指针已经损坏，可能是由于并发线程访问和代码中其他地方缺乏同步

我的问题是如何找到问题所在或查明是否是另一个问题？

PS:此错误仅在应用程序负载较重且连接了 700 个客户端时才会出现

(每个连接使用一个线程，我知道 32 位应用程序在默认线程堆栈大小下将限制为大约 2000 个线程，这不是最好的方法)

PPS:我有多个崩溃转储，其中应用程序挂起等待不同的关键部分，在每种情况下，关键部分的指针似乎都没有指向关键部分。

Answer 1

查看 !analyze -hang -v 的输出，您似乎没有使用应用程序验证器。我建议您在启用应用程序验证程序“锁定”选项后收集挂起转储。它肯定会为您提供更多信息以进行故障排除。

您可以从此处下载应用程序验证程序:

http://www.microsoft.com/en-us/download/details.aspx?id=20028

更多信息:

http://msdn.microsoft.com/en-us/library/windows/desktop/dd371695(v=vs.85).aspx