Question

我们的Windows应用程序经常挂在内存中，我正在尝试使用windbg进行跟踪解决问题。我对windbg很新，可以使用一些建议（我已经开始阅读高级Windows调试了。）

该应用程序是用VB编写的C ++和COM对象的混合体。偶尔的时候你退出，应用程序似乎消失了，但任务经理显示它徘徊在记忆中，显然是空闲的。

！主题告诉我这个：

ThreadCount: 2
UnstartedThread: 0
BackgroundThread: 2
PendingThread: 0
DeadThread: 0
Hosted Runtime: no
                                      PreEmptive   GC Alloc           Lock
       ID OSID ThreadOBJ    State     GC       Context       Domain   Count APT Exception
   0    1 175c 001aa040      4220 Enabled  09131b78:09131fe8 001a2b80     0 STA
   6    2 143c 001b4b48      b220 Enabled  00000000:00000000 001a2b80     0 MTA (Finalizer)

对于我未经训练的眼睛，它看起来像是被它保持活着最终确定队列被单线程单元阻塞。做这个看起来合情合理吗？

〜0kb产量：

ntdll!KiFastSystemCallRet
user32!NtUserGetMessage+0xc
mfc80!AfxInternalPumpMessage+0x18 [f:\sp\vctools\vc7libs\ship\atlmfc\src\mfc\thrdcore.cpp @ 153]
mfc80!CWinThread::Run+0x54 [f:\sp\vctools\vc7libs\ship\atlmfc\src\mfc\thrdcore.cpp @ 625]
mfc80!AfxWinMain+0x69 [f:\sp\vctools\vc7libs\ship\atlmfc\src\mfc\winmain.cpp @ 47]
WARNING: Stack unwind information not available. Following frames may be wrong.
OurApp+0x7e8274
kernel32!BaseProcessStart+0x23

~6kb产量：

ntdll!KiFastSystemCallRet
ntdll!ZwWaitForMultipleObjects+0xc
kernel32!WaitForMultipleObjectsEx+0x12c
kernel32!WaitForMultipleObjects+0x18
mscorwks!WKS::WaitForFinalizerEvent+0x7a
mscorwks!WKS::GCHeap::FinalizerThreadWorker+0x75
mscorwks!Thread::UserResumeThread+0xfb
mscorwks!Thread::DoADCallBack+0x355
mscorwks!Thread::DoADCallBack+0x541
mscorwks!ManagedThreadBase_NoADTransition+0x32
mscorwks!ManagedThreadBase::FinalizerBase+0xb
mscorwks!WKS::GCHeap::FinalizerThreadStart+0xbb
mscorwks!Thread::intermediateThreadProc+0x49
kernel32!BaseThreadStart+0x37

我很感激这里有一点修正。如果我猜了一个阻止终结器似乎合理，请告诉我。我也会非常乐意就确定究竟是什么阻塞提出一些建议。

修改

Shane要求输出！analyze。这实际上来自一个不同的转储 - 我有很多它们，它们看起来几乎一样。

FAULTING_IP: 
+18a952f00ebdf74
00000000 ??              ???

EXCEPTION_RECORD:  ffffffff -- (.exr 0xffffffffffffffff)
ExceptionAddress: 00000000
   ExceptionCode: 80000007 (Wake debugger)
  ExceptionFlags: 00000000
NumberParameters: 0

BUGCHECK_STR:  80000007

PROCESS_NAME:  OurApp.exe

OVERLAPPED_MODULE: Address regions for 'OurApp' and 'Unknown_Module_00350062' overlap

ERROR_CODE: (NTSTATUS) 0x80000007 - {Kernel Debugger Awakened}  the system debugger was awakened by an interrupt.

EXCEPTION_CODE: (HRESULT) 0x80000007 (2147483655) - Operation aborted

NTGLOBALFLAG:  0

APPLICATION_VERIFIER_FLAGS:  0

MANAGED_STACK: !dumpstack -EE
OS Thread Id: 0x4490 (0)
Current frame: 
ChildEBP RetAddr  Caller,Callee

DERIVED_WAIT_CHAIN:  

Dl Eid Cid     WaitType
-- --- ------- --------------------------
   0   48c8.4490 Speculated (Triage)    -->
   5   48c8.4b74 Event                  

WAIT_CHAIN_COMMAND:  ~0s;k;;~5s;k;;

BLOCKING_THREAD:  00004b74

DEFAULT_BUCKET_ID:  APPLICATION_HANG_BlockedOn_EventHandle

PRIMARY_PROBLEM_CLASS:  APPLICATION_HANG_BlockedOn_EventHandle

LAST_CONTROL_TRANSFER:  from 7c90df4a to 7c90e514

FAULTING_THREAD:  00000005

STACK_TEXT:  
0882fcd0 7c90df4a 7c809590 00000002 0882fcfc ntdll!KiFastSystemCallRet
0882fcd4 7c809590 00000002 0882fcfc 00000001 ntdll!ZwWaitForMultipleObjects+0xc
0882fd70 7c80a115 00000002 7a3b8d28 00000000 kernel32!WaitForMultipleObjectsEx+0x12c
0882fd8c 79f92c5b 00000002 7a3b8d28 00000000 kernel32!WaitForMultipleObjects+0x18
0882fdac 79f970b8 001b1ad8 0882feb0 001a0b18 mscorwks!WKS::WaitForFinalizerEvent+0x77
0882fdc0 79e984cf 0882feb0 00000000 00000000 mscorwks!WKS::GCHeap::FinalizerThreadWorker+0x49
0882fdd4 79e9846b 0882feb0 0882fe5c 79f7762b mscorwks!Thread::DoADCallBack+0x32a
0882fe68 79e98391 0882feb0 9f3f02e2 00000000 mscorwks!Thread::ShouldChangeAbortToUnload+0xe3
0882fea4 79eef74c 0882feb0 00000000 001a86c0 mscorwks!Thread::ShouldChangeAbortToUnload+0x30a
0882fecc 79eef75d 79f9706d 00000008 0882ff14 mscorwks!ManagedThreadBase_NoADTransition+0x32
0882fedc 79f3c6bc 79f9706d 9f3f0352 00000000 mscorwks!ManagedThreadBase::FinalizerBase+0xd
0882ff14 79f920a5 00000000 86fb6620 804fb078 mscorwks!WKS::GCHeap::FinalizerThreadStart+0xbb
0882ffb4 7c80b729 001a0b18 00730074 00610020 mscorwks!Thread::intermediateThreadProc+0x49
0882ffec 00000000 79f9205f 001a0b18 00000000 kernel32!BaseThreadStart+0x37


FOLLOWUP_IP: 
mscorwks!WKS::WaitForFinalizerEvent+77
79f92c5b 85c0            test    eax,eax

SYMBOL_STACK_INDEX:  4

SYMBOL_NAME:  mscorwks!WKS::WaitForFinalizerEvent+77

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: mscorwks

IMAGE_NAME:  mscorwks.dll

DEBUG_FLR_IMAGE_TIMESTAMP:  492b82c1

STACK_COMMAND:  ~5s ; kb

BUCKET_ID:  80000007_mscorwks!WKS::WaitForFinalizerEvent+77

FAILURE_BUCKET_ID:  APPLICATION_HANG_BlockedOn_EventHandle_80000007_mscorwks.dll!WKS::WaitForFinalizerEvent

WATSON_STAGEONE_URL:  http://watson.microsoft.com/StageOne/OurApp_exe/6_2_6_1/4a29a184/unknown/0_0_0_0/bbbbbbb4/80000007/00000000.htm?Retriage=1

Followup: MachineOwner
---------

0:000> !threads
ThreadCount: 2
UnstartedThread: 0
BackgroundThread: 2
PendingThread: 0
DeadThread: 0
Hosted Runtime: no
                                      PreEmptive   GC Alloc           Lock
       ID OSID ThreadOBJ    State     GC       Context       Domain   Count APT Exception
   0    1 4490 0019de20      4220 Enabled  09003658:09003fe8 001a86c0     0 STA
   5    2 4b74 001b1b08      b220 Enabled  00000000:00000000 001a86c0     0 MTA (Finalizer)

Answer 1

终结器线程处于空闲状态并正在等待工作 - 它的跟踪看起来很好。 0还看起来很好并且空闲 - 它等待下一个UI消息。

您能否提供一些有关退出申请的详细信息？鉴于消息循环仍在运行，在我看来，你的关闭应用程序逻辑出了问题。

Answer 2

我同意J. Passing。

由于一个线程是托管代码，您是否尝试在windbg中加载SOS调试扩展以获取托管堆栈跟踪。你也可以试试windbg的“!analyze -v”命令，看看那句话。

诊断无法停止的应用程序

2 个答案: