首页 > 代码库 > windbg .net 程序的死锁检测 常用方法（个人备份笔记）

windbg .net 程序的死锁检测 常用方法（个人备份笔记）

2024-08-13 03:08:11   221人阅读

//死锁检测

 

.load sosex.dll0:004> !dlk0:000> !mk -a

 

The mk command displays a call stack of the currently selected thread (including both managed and unmanaged frames).
The command has now been extended to support the -a switch which outputs both the local variables as well as parameters
(combination of -l and -p switches):

 

 

0:003> !finq

　　

The finq command (finalization queue) lists all the objects that are on the finalization queue. An example is shown below:

 

 

 

0:003> !frq -stat

　　


The frq command (f-reachable queue) on the other hand, lists all objects that are on the f-reachable queue as shown below:

 


// 200b220 代表线程等待，可能是锁，或者 Sleep()， 这个要进一步检查。

0:046> !threadsThreadCount:      54UnstartedThread:  0BackgroundThread: 22PendingThread:    0DeadThread:       9Hosted Runtime:   no                                           PreEmptive                                                   Lock       ID  OSID        ThreadOBJ     State GC       GC Alloc Context                  Domain           Count APT Exception   9    1  1644 0000000001412de0      8220 Enabled  0000000000000000:0000000000000000 0000000000311a20     0 Ukn  17    2   528 000000000141f5d0      b220 Enabled  0000000000000000:0000000000000000 0000000000311a20     0 MTA (Finalizer)  19    4  181c 00000000039853e0   100a220 Enabled  0000000000000000:0000000000000000 0000000000311a20     0 MTA (Threadpool Worker)  20    5  221c 0000000003998d00      1220 Enabled  0000000000000000:0000000000000000 0000000000311a20     0 Ukn  21    6  16d8 00000000044484c0   200b220 Enabled  0000000000000000:0000000000000000 00000000039980a0     0 MTA  22    7  1e54 0000000004460680   200b220 Enabled  0000000000000000:0000000000000000 00000000039980a0     0 MTA  23    8  1308 000000000445fd20   200b220 Enabled  0000000000000000:0000000000000000 00000000039980a0     0 MTAXXXX    9       00000000044b0510   1019820 Enabled  0000000000000000:0000000000000000 0000000000311a20     0 MTA (Threadpool Worker)  25    a  1e50 00000000044e0e80   200b020 Enabled  0000000000000000:0000000000000000 00000000039980a0     0 MTA  26    b  204c 000000000450b110   200b220 Enabled  0000000000000000:0000000000000000 00000000039980a0     0 MTA

　　

 

0:000> !ThreadState 3009220    Legal to Join    Background    CLR Owns    In Multi Threaded Apartment    Thread Pool Worker Thread    Interruptible0:000> !ThreadState 200b220    Legal to Join    Background    CLR Owns    CoInitialized    In Multi Threaded Apartment    Interruptible0:000> !ThreadState 8009220     Legal to Join    Background    CLR Owns    In Multi Threaded Apartment    Completion Port Thread

　　

// threadstate详细： http://www.parallelfun.com/2012_11_01_archive.html 



 0:050> !syncblkIndex         SyncBlock 		MonitorHeld Recursion 	Owning Thread Info          	SyncBlock Owner   57 		000000000456f9e8            1         1 	0000000004567c30 1c98  46   	00000001800b6e90 System.Object		Waiting threads:  141 		00000000045702a8            1         1 	0000000004567c30 1c98  46   	00000001800b6f70 ProtoBufV2.Meta.BasicList		Waiting threads:-----------------------------Total           152CCW             3RCW             2ComClassFactory 0Free            64

　　



// 46号托管线程拥有一个Monitor， MonitorHeld 的计算方法：(MonitorHeld-1)/2 个线程等待 46号线程。
// 例如： 线程91 的 MonitorHeld 是39，则：(39-1)/2=19 表示有19个线程等待线程91
// 这里的MonitorHeld按msdn的解释，拿锁的线程为1，等锁的线程为2； Monitorheld的值是偶数，也说明已经没有线程拿住锁了。

/*
Sync Block 的信息：
通过!syncblk 索引值 可以显示Sync Block的信息，主要有如下信息
Index: Sync Block Table中的Index值
Sync Block: Sync Block的地址
MonitorHeld: numbers of monitor held
Recursion: 该线程获取该sync block的次数
Owning thread info : 总共有三个值，第一个值是线程的数据结构地址，第二个是线程的系统线程ID,第三个值为线程的托管线程ID
SyncBlock Owner:指向拥有该SyncBlock的对象的内存地址，也就是Object的地址
如果有第二个值指这个synblock第二个Held的类型
统计信息：
Total 　　 152　　 (sync block table的总的sync Lock数量)
CCW 　　 3 　　　 (CCW（COM Callable Wrappers）对象拥有的sync block 数量)
RCW 　　 2 　　    (RCW（Runtime Callable Wrappers ）对象拥有的sync block 数量)
ComClassFactory 0
Free 64 Sync block table 剩余的空索引的数量

*/


/*

http://blogs.msdn.com/b/oldnewthing/archive/2006/12/12/1266392.aspx

!syncblock 详细解释和 !critsec 使用
http://blogs.msdn.com/b/tess/archive/2006/01/09/a-hang-scenario-locks-and-critical-sections.aspx
*/

0:044> !syncblkIndex         SyncBlock MonitorHeld Recursion Owning Thread Info          SyncBlock Owner 2193 000000000598fe18            5         1 000000000a4650e0 3038 110   00000001bff69770 System.Object		Waiting threads: 90 121 2616 000000000577db08          133         0 0000000000000000     none    000000011fc6aa30 System.RuntimeType+RuntimeTypeCache+MemberInfoCache`1[[System.Reflection.RuntimeMethodInfo, mscorlib]]		Waiting threads: 39 40 42 48 49 52 53 58 60 63 65 67 69 73 75 76 77 79 81 82 83 85 86 87 88 93 94 95 97 99 100 104 105 107 108 109 110 111 112 114 115 117 120 122 123 124 128 129 132 133 134 135 136 2910 000000000577bae8            3         1 000000000a5821b0 134bc  78   000000019fc88170 System.Object		Waiting threads: 64-----------------------------Total           3256CCW             3RCW             2ComClassFactory 1Free            2992

　　

//如果知道临界区的地址，可以用一下命令，如果不知道地址，可以用!locks

0:044> !critsec 000000011fc6aa30DebugInfo for CritSec at 000000011fc6aa30 does not point back to the critical sectionNOT an initialized critical section.CritSec +1fc6aa30 at 000000011fc6aa30WaiterWoken        YesLockCount          -1RecursionCount     0OwningThread       0EntryCount         fef56b35ContentionCount    2000007*** Locked

　　


// !locks 的输出
// http://msdn.microsoft.com/en-us/library/windows/hardware/ff541979(v=vs.85).aspx

0:105> !locksCritSec +1192340 at 0000000001192340WaiterWoken        NoLockCount          0RecursionCount     1OwningThread       bad0EntryCount         0ContentionCount    46a*** Locked

　　

//直接切换到进程上去：

0:014> ~~[bad0]s

　　

//或者用 ~ 列出所有线程，然后切过去
//参考：http://blogs.msdn.com/b/tess/archive/2006/01/09/a-hang-scenario-locks-and-critical-sections.aspx

 

0:105> ~#  0  Id: d9e0.a700 Suspend: 0 Teb: 000007ff`fffde000 Unfrozen   1  Id: d9e0.18bac Suspend: 0 Teb: 000007ff`fffdc000 Unfrozen   2  Id: d9e0.bfa0 Suspend: 0 Teb: 000007ff`fffd7000 Unfrozen   3  Id: d9e0.bad0 Suspend: 0 Teb: 000007ff`fffd3000 Unfrozen   4  Id: d9e0.16364 Suspend: 0 Teb: 000007ff`fff9e000 Unfrozen0:014> ~3s

　　






// 

 0:046> .shell -i - -ci "~*e !clrstack" FIND  /i "Monitor.Enter"0000000002f7d428 0000000076f6171a [HelperMethodFrame: 0000000002f7d428] System.Threading.Monitor.Enter(System.Object)00000000049ad3e8 0000000076f6171a [HelperMethodFrame: 00000000049ad3e8] System.Threading.Monitor.Enter(System.Object)0000000016a6d898 000007fef76500b9 [HelperMethodFrame: 0000000016a6d898] System.Threading.Monitor.Enter(System.Object)0000000016b6e8b8 000007fef76500b7 [HelperMethodFrame: 0000000016b6e8b8] System.Threading.Monitor.Enter(System.Object).shell: Process exited0:046> .shell -i - -ci "~*e !clrstack" FIND  /i "Monitor.TryEnter".shell: Process exited0:046> .shell -i - -ci "~*e !clrstack" FIND  /i "Monitor"000000000433eae8 0000000076f6186a [HelperMethodFrame_1OBJ: 000000000433eae8] System.Threading.Monitor.ObjWait(Boolean, Int32, System.Object)000000000504e3b8 0000000076f6186a [HelperMethodFrame_1OBJ: 000000000504e3b8] System.Threading.Monitor.ObjWait(Boolean, Int32, System.Object)000000000504e4e0 000007fef663d2ae System.Threading.Monitor.Wait(System.Object)0000000002f7d428 0000000076f6171a [HelperMethodFrame: 0000000002f7d428] System.Threading.Monitor.Enter(System.Object)00000000049ad3e8 0000000076f6171a [HelperMethodFrame: 00000000049ad3e8] System.Threading.Monitor.Enter(System.Object)0000000016a6d898 000007fef76500b9 [HelperMethodFrame: 0000000016a6d898] System.Threading.Monitor.Enter(System.Object)0000000016b6e8b8 000007fef76500b7 [HelperMethodFrame: 0000000016b6e8b8] System.Threading.Monitor.Enter(System.Object).shell: Process exited

　　




// 有时候会发现无锁定同步快或死锁，还可以用!mlocks 看看 

0:164> !dlkExamining SyncBlocks...Scanning for ReaderWriterLock instances...Scanning for holders of ReaderWriterLock locks...Scanning for ReaderWriterLockSlim instances...Scanning for holders of ReaderWriterLockSlim locks...Examining CriticalSections...Scanning for threads waiting on SyncBlocks...Scanning for threads waiting on ReaderWriterLock locks...Scanning for threads waiting on ReaderWriterLocksSlim locks...Scanning for threads waiting on CriticalSections...No deadlocks detected.0:164> !mlocksExamining SyncBlocks...Scanning for ReaderWriterLock instances...Scanning for holders of ReaderWriterLock locks...Scanning for ReaderWriterLockSlim instances...Scanning for holders of ReaderWriterLockSlim locks...Examining CriticalSections...ClrThread  DbgThread  OsThread    LockType    Lock              LockLevel------------------------------------------------------------------------------0x67       116        0x1e8       thinlock    000000014036a2b0  (recursion:0)0xab       182        0x268       thinlock    00000001c0724188  (recursion:0)  0xa4       177        0x14cc      RWLockSlim  000000013ff0a358  Writer              0:164> !rwlock 000000013ff0a358WriteLockOwnerThread:             0xa4UpgradableReadLockOwnerThread:    NoneReaderCount:                      0ReaderThreadIds:                  NoneWaitingReaderCount:               204WaitingReaderThreadIds:           0x9,0xa,0x11,0x12,0x13,0x14,0x15,0x16,0x17WaitingWriterCount:               204WaitingWriterThreadIds:           0x8,0xf,0x1d,0x21,0x24,0x2b,0x2f,0x30,WaitingUpgradableReaderCount:     0WaitingUpgradableReaderThreadIds: NoneWaitingWriterUpgradeCount:        0WaitingWriterUpgradeThreadIds:    None  ClrThread  DbgThread  OsThread    LockType    Lock              LockLevel------------------------------------------------------------------------------0x15       19         0x15e8      thinlock    00000000010b6130  (recursion:0)0x16c      226        0x1a1c      SyncBlock   0000000000c735a8

　　


// shell 命令： 

.shell -ci "!mlocks -d" find "Writer"

　　


















参考：
http://weblogs.thinktecture.com/ingo/2006/08/who-is-blocking-that-mutex---fun-with-windbg-cdb-and-kd.html

http://blogs.msdn.com/b/tess/archive/2006/01/09/a-hang-scenario-locks-and-critical-sections.aspx

http://hi.baidu.com/ju_feng/item/e22f06974dafe530326eeb64

http://stackoverflow.com/questions/22037581/determining-which-method-is-holding-a-readerwriterlockslim-writelock

windbg .net 程序的死锁检测 常用方法（个人备份笔记）


联系
我们