PART1:CrashDumpAnalysisPatterns
SystemCall
Usually,threadsareBlocked(Volume2)waitingforsynchronizationobjectsorActive(Volume7)
runningthreads.Thereisadifferentcategoryofthreadsthatappearblockedinuserspacebutinfact,
maybedoingalotofinvisiblework(notvisiblefromthedumptype)inkernelspace.Wecallsuchan
analysispatternSystemCall.ComparethesethreadStackTraces(Volume1)fromStackTrace
Collection(Volume1):
#CallSite
00ntdll!NtWaitForMultipleObjects
01KERNELBASE!WaitForMultipleObjectsEx
02user32!MsgWaitForMultipleObjectsEx
03combase!ASTAWaitContext::KernelWait
04combase!ASTAWaitContext::Wait
05combase!CoMsgWaitInProcessEvents
06Windows_UI!Windows::UI::Core::CDispatcher::WaitAndProcessMessages
07Windows_UI!Windows::UI::Core::CDispatcher::ProcessEvents
08Windows_UI_Xaml!CJupiterWindow::RunCoreWindowMessageLoop
09Windows_UI_Xaml!CJupiterControl::RunMessageLoop
0aWindows_UI_Xaml!DirectUI::DXamlCore::RunMessageLoop
0btwinapi_appcore!Windows::ApplicationModel::Core::CoreApplicationView::Run
[...]
0ekernel32!BaseThreadInitThunk
0fntdll!RtlUserThreadStart
#CallSite
00user32!NtUserCallNoParam
01user32!MsgWaitForMultipleObjectsEx
02combase!ASTAWaitContext::KernelWait
03combase!ASTAWaitContext::Wait
04combase!CoMsgWaitInProcessEvents
05Windows_UI!Windows::UI::Core::CDispatcher::WaitAndProcessMessages
06Windows_UI!Windows::UI::Core::CDispatcher::ProcessEvents
07Windows_UI_Xaml!CJupiterWindow::RunCoreWindowMessageLoop
08Windows_UI_Xaml!CJupiterControl::RunMessageLoop
09Windows_UI_Xaml!DirectUI::DXamlCore::RunMessageLoop
0atwinapi_appcore!Windows::ApplicationModel::Core::CoreApplicationView::Run
[...]
0dkernel32!BaseThreadInitThunk
0entdll!RtlUserThreadStart
Thefirstthreadistraditionallywaiting,buttheotherwaswokeduptoprocessaninputmessageand
maybeblockedinthekernelordoingsomeworkthere.Incaseofadoubtwecandoublecheckthe
lastexecutedinstruction(fromthestacktraceperspective):
s & Deals
lights
ngs
Support
Sign Out
