locked
debug diag memory dump w3wp.exe RRS feed

  • Question

  • Hi, below is the output from a full memory dump of w3wp.exe that i took with debug diag.  any help on this would be great!


    Microsoft (R) Windows Debugger Version 6.11.0001.404 X86
    Copyright (c) Microsoft Corporation. All rights reserved.


    Loading Dump File [C:\Users\banasr.PAXIX\Desktop\New Folder\w3wp.exe__DefaultAppPool__PID__3684__Date__06_22_2010__Time_12_52_33PM__398__IIS_COM+ Hang Dump.dmp]
    User Mini Dump File with Full Memory: Only application data is available

    Comment: 'Dump created by Debug Diagnostic Service. IIS_COM+ Hang Dump'
    WARNING: Whitespace at end of path element
    Symbol search path is: SRV*c:\symfiles*http://msdl.microsoft.com/download/symbols
    Executable search path is:
    Windows Server 2003 Version 3790 (Service Pack 2) MP (4 procs) Free x86 compatible
    Product: Server, suite: TerminalServer SingleUserTS
    Machine Name:
    Debug session time: Tue Jun 22 12:52:34.000 2010 (GMT-4)
    System Uptime: 11 days 14:24:24.453
    Process Uptime: 0 days 16:52:54.000
    ................................................................
    .............................
    Loading unloaded module list
    ................
    eax=7c88b668 ebx=00000000 ecx=00000000 edx=7c88b080 esi=00000194 edi=00000000
    eip=7c82860c esp=0006fc0c ebp=0006fc7c iopl=0         nv up ei pl zr na pe nc
    cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00000246
    ntdll!KiFastSystemCallRet:
    7c82860c c3              ret
    0:000> !analyze -v
    *******************************************************************************
    *                                                                             *
    *                        Exception Analysis                                   *
    *                                                                             *
    *******************************************************************************

    *** ERROR: Module load completed but symbols could not be loaded for xpsp2res.dll
    *** ERROR: Module load completed but symbols could not be loaded for ws03res.dll
    *** ERROR: Symbol file could not be found.  Defaulted to export symbols for normaliz.dll -
    *** ERROR: Module load completed but symbols could not be loaded for odbcint.dll
    *** ERROR: Module load completed but symbols could not be loaded for msadcer.dll
    *** WARNING: Unable to verify checksum for FdfAcX.dll
    *** ERROR: Symbol file could not be found.  Defaulted to export symbols for FdfAcX.dll -
    *** ERROR: Symbol file could not be found.  Defaulted to export symbols for LeakTrack.dll -
    *** WARNING: Unable to verify checksum for fms2ksec.dll
    *** ERROR: Symbol file could not be found.  Defaulted to export symbols for fms2ksec.dll -
    *** WARNING: Unable to verify checksum for FdfTk.dll
    *** ERROR: Symbol file could not be found.  Defaulted to export symbols for FdfTk.dll -
    *** ERROR: Module load completed but symbols could not be loaded for iisres.dll
    *************************************************************************
    ***                                                                   ***
    ***                                                                   ***
    ***    Your debugger is not using the correct symbols                 ***
    ***                                                                   ***
    ***    In order for this command to work properly, your symbol path   ***
    ***    must point to .pdb files that have full type information.      ***
    ***                                                                   ***
    ***    Certain .pdb files (such as the public OS symbols) do not      ***
    ***    contain the required information.  Contact the group that      ***
    ***    provided you with these symbols if you need this command to    ***
    ***    work.                                                          ***
    ***                                                                   ***
    ***    Type referenced: kernel32!pNlsUserInfo                         ***
    ***                                                                   ***
    *************************************************************************
    *************************************************************************
    ***                                                                   ***
    ***                                                                   ***
    ***    Your debugger is not using the correct symbols                 ***
    ***                                                                   ***
    ***    In order for this command to work properly, your symbol path   ***
    ***    must point to .pdb files that have full type information.      ***
    ***                                                                   ***
    ***    Certain .pdb files (such as the public OS symbols) do not      ***
    ***    contain the required information.  Contact the group that      ***
    ***    provided you with these symbols if you need this command to    ***
    ***    work.                                                          ***
    ***                                                                   ***
    ***    Type referenced: kernel32!pNlsUserInfo                         ***
    ***                                                                   ***
    *************************************************************************

    FAULTING_IP:
    +5839952f029ddf04
    00000000 ??              ???

    EXCEPTION_RECORD:  ffffffff -- (.exr 0xffffffffffffffff)
    ExceptionAddress: 00000000
       ExceptionCode: 80000003 (Break instruction exception)
      ExceptionFlags: 00000000
    NumberParameters: 0

    FAULTING_THREAD:  00000c84

    DEFAULT_BUCKET_ID:  STATUS_BREAKPOINT

    PROCESS_NAME:  w3wp.exe

    ERROR_CODE: (NTSTATUS) 0x80000003 - {EXCEPTION}  Breakpoint  A breakpoint has been reached.

    EXCEPTION_CODE: (HRESULT) 0x80000003 (2147483651) - One or more arguments are invalid

    NTGLOBALFLAG:  0

    APPLICATION_VERIFIER_FLAGS:  0

    PRIMARY_PROBLEM_CLASS:  STATUS_BREAKPOINT

    BUGCHECK_STR:  APPLICATION_FAULT_STATUS_BREAKPOINT

    LAST_CONTROL_TRANSFER:  from 7c827d29 to 7c82860c

    STACK_TEXT: 
    0006fc08 7c827d29 77e61d1e 00000194 00000000 ntdll!KiFastSystemCallRet
    0006fc0c 77e61d1e 00000194 00000000 00000000 ntdll!ZwWaitForSingleObject+0xc
    0006fc7c 77e61c8d 00000194 ffffffff 00000000 kernel32!WaitForSingleObjectEx+0xac
    0006fc90 5a364692 00000194 ffffffff 00000000 kernel32!WaitForSingleObject+0x12
    0006fca0 5a366f27 00295270 5a3af3dd 00000000 w3dt!WP_CONTEXT::RunMainThreadLoop+0x10
    0006fca8 5a3af3dd 00000000 64711dcf 00000000 w3dt!UlAtqStartListen+0x2d
    0006fcb8 5a3bc315 01001418 010013e4 010012d0 w3core!W3_SERVER::StartListen+0xbd
    0006ff0c 0100187c 00000007 00293ba8 00000000 w3core!UlW3Start+0x26e
    0006ff44 01001a27 00000007 00293ba8 00294670 w3wp!wmain+0x22a
    0006ffc0 77e6f23b 00000000 00000000 7ffdf000 w3wp!wmainCRTStartup+0x12f
    0006fff0 00000000 010018f8 00000000 78746341 kernel32!BaseProcessStart+0x23


    STACK_COMMAND:  ~0s; .ecxr ; kb

    FOLLOWUP_IP:
    w3dt!WP_CONTEXT::RunMainThreadLoop+10
    5a364692 837e1400        cmp     dword ptr [esi+14h],0

    SYMBOL_STACK_INDEX:  4

    SYMBOL_NAME:  w3dt!WP_CONTEXT::RunMainThreadLoop+10

    FOLLOWUP_NAME:  MachineOwner

    MODULE_NAME: w3dt

    IMAGE_NAME:  w3dt.dll

    DEBUG_FLR_IMAGE_TIMESTAMP:  4b7cd0b4

    FAILURE_BUCKET_ID:  STATUS_BREAKPOINT_80000003_w3dt.dll!WP_CONTEXT::RunMainThreadLoop

    BUCKET_ID:  APPLICATION_FAULT_STATUS_BREAKPOINT_w3dt!WP_CONTEXT::RunMainThreadLoop+10

    WATSON_IBUCKET:  395708677

    WATSON_IBUCKETTABLE:  1

    WATSON_STAGEONE_URL:  http://watson.microsoft.com/StageOne/w3wp_exe/6_0_3790_3959/45d6968e/unknown/0_0_0_0/bbbbbbb4/80000003/00000000.htm?Retriage=1

    Followup: MachineOwner
    ---------

    0:000> lmvm w3dt
    start    end        module name
    5a360000 5a36d000   w3dt       (pdb symbols)          c:\symfiles\w3dt.pdb\52E7B28CDEDE40238CCDA18714A02BA12\w3dt.pdb
        Loaded symbol image file: w3dt.dll
        Image path: c:\WINDOWS\system32\inetsrv\w3dt.dll
        Image name: w3dt.dll
        Timestamp:        Thu Feb 18 00:31:32 2010 (4B7CD0B4)
        CheckSum:         00010411
        ImageSize:        0000D000
        File version:     6.0.3790.4667
        Product version:  6.0.3790.4667
        File flags:       0 (Mask 3F)
        File OS:          40004 NT Win32
        File type:        2.0 Dll
        File date:        00000000.00000000
        Translations:     0000.04b0
        CompanyName:      Microsoft Corporation
        ProductName:      Internet Information Services
        InternalName:     w3dt.dll
        OriginalFilename: w3dt.dll
        ProductVersion:   6.0.3790.4667
        FileVersion:      6.0.3790.4667 (srv03_sp2_gdr.100217-1800)
        FileDescription:  IIS Worker Process/Http.sys Interface
        LegalCopyright:   © Microsoft Corporation. All rights reserved.
    0:000> !clrstack
    No export clrstack found
    0:000> kvn100
     # ChildEBP RetAddr  Args to Child             
    00 0006fc08 7c827d29 77e61d1e 00000194 00000000 ntdll!KiFastSystemCallRet (FPO: [0,0,0])
    01 0006fc0c 77e61d1e 00000194 00000000 00000000 ntdll!ZwWaitForSingleObject+0xc (FPO: [3,0,0])
    02 0006fc7c 77e61c8d 00000194 ffffffff 00000000 kernel32!WaitForSingleObjectEx+0xac (FPO: [SEH])
    03 0006fc90 5a364692 00000194 ffffffff 00000000 kernel32!WaitForSingleObject+0x12 (FPO: [2,0,0])
    04 0006fca0 5a366f27 00295270 5a3af3dd 00000000 w3dt!WP_CONTEXT::RunMainThreadLoop+0x10 (FPO: [0,0,0])
    05 0006fca8 5a3af3dd 00000000 64711dcf 00000000 w3dt!UlAtqStartListen+0x2d (FPO: [0,0,0])
    06 0006fcb8 5a3bc315 01001418 010013e4 010012d0 w3core!W3_SERVER::StartListen+0xbd (FPO: [0,0,0])
    07 0006ff0c 0100187c 00000007 00293ba8 00000000 w3core!UlW3Start+0x26e (FPO: [3,144,4])
    08 0006ff44 01001a27 00000007 00293ba8 00294670 w3wp!wmain+0x22a (FPO: [2,6,4])
    09 0006ffc0 77e6f23b 00000000 00000000 7ffdf000 w3wp!wmainCRTStartup+0x12f (FPO: [SEH])
    0a 0006fff0 00000000 010018f8 00000000 78746341 kernel32!BaseProcessStart+0x23 (FPO: [SEH])
    0:000> ~0s;
    eax=7c88b668 ebx=00000000 ecx=00000000 edx=7c88b080 esi=00000194 edi=00000000
    eip=7c82860c esp=0006fc0c ebp=0006fc7c iopl=0         nv up ei pl zr na pe nc
    cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00000246
    ntdll!KiFastSystemCallRet:
    7c82860c c3              ret
    0:000> .ecxr
    Minidump doesn't have an exception context
    Unable to get exception context, HRESULT 0x80004002
    0:000> ; kb
    ChildEBP RetAddr  Args to Child             
    0006fc08 7c827d29 77e61d1e 00000194 00000000 ntdll!KiFastSystemCallRet
    0006fc0c 77e61d1e 00000194 00000000 00000000 ntdll!ZwWaitForSingleObject+0xc
    0006fc7c 77e61c8d 00000194 ffffffff 00000000 kernel32!WaitForSingleObjectEx+0xac
    0006fc90 5a364692 00000194 ffffffff 00000000 kernel32!WaitForSingleObject+0x12
    0006fca0 5a366f27 00295270 5a3af3dd 00000000 w3dt!WP_CONTEXT::RunMainThreadLoop+0x10
    0006fca8 5a3af3dd 00000000 64711dcf 00000000 w3dt!UlAtqStartListen+0x2d
    0006fcb8 5a3bc315 01001418 010013e4 010012d0 w3core!W3_SERVER::StartListen+0xbd
    0006ff0c 0100187c 00000007 00293ba8 00000000 w3core!UlW3Start+0x26e
    0006ff44 01001a27 00000007 00293ba8 00294670 w3wp!wmain+0x22a
    0006ffc0 77e6f23b 00000000 00000000 7ffdf000 w3wp!wmainCRTStartup+0x12f
    0006fff0 00000000 010018f8 00000000 78746341 kernel32!BaseProcessStart+0x23
    0:000> !dumpstack -EE
    No export dumpstack found
    0:000> r
    eax=7c88b668 ebx=00000000 ecx=00000000 edx=7c88b080 esi=00000194 edi=00000000
    eip=7c82860c esp=0006fc0c ebp=0006fc7c iopl=0         nv up ei pl zr na pe nc
    cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00000246
    ntdll!KiFastSystemCallRet:
    7c82860c c3              ret
    0:000> !address eip
        7c800000 : 7c801000 - 00088000
                        Type     01000000 MEM_IMAGE
                        Protect  00000020 PAGE_EXECUTE_READ
                        State    00001000 MEM_COMMIT
                        Usage    RegionUsageImage
                        FullPath C:\WINDOWS\system32\ntdll.dll
    0:000> ub eip
    ntdll!KiRaiseUserExceptionDispatcher+0x37:
    7c8285f3 8b0424          mov     eax,dword ptr [esp]
    7c8285f6 8be5            mov     esp,ebp
    7c8285f8 5d              pop     ebp
    7c8285f9 c3              ret
    7c8285fa 8da42400000000  lea     esp,[esp]
    7c828601 8da42400000000  lea     esp,[esp]
    ntdll!KiFastSystemCall:
    7c828608 8bd4            mov     edx,esp
    7c82860a 0f34            sysenter

    Wednesday, June 23, 2010 5:39 PM

Answers

All replies