Determine line number of InnerException from minidump using WinDbg

Question

I am trying to find a NullReferenceException from a dump. A NullReferenceException is no exception, and a failure exception is a TargetInvocationException with an InnerException, which is a NullReferenceException.

I use Windbg with SOS, I use the analyze -v command, and this gives me a stack of NullReferenceException exception calls:

 EXCEPTION_OBJECT: !pe f6cb150 Exception object: 000000000f6cb150 Exception type: System.NullReferenceException Message: Object reference not set to an instance of an object. InnerException: <none> StackTrace (generated): SP IP Function 000000002CD9D8C0 000007FF01E7C639 MyDll!DoSomething2()+0xe99 000000002CD9DBE0 000007FF01E7B11D MyDll!DoSomething1()+0x43d 000000002CD9DD20 000007FF01E7AB11 MyDll!WorkerDoWork(System.Object, System.ComponentModel.DoWorkEventArgs)+0x51 000000002CD9DD80 000007FEEA68A0F2 System_ni!System.ComponentModel.BackgroundWorker.WorkerThreadStart(System.Object)+0x62 

Note that I get method names with byte offsets, but not line numbers. DoSomething2 is a big function, so it’s not obvious where the NullReferenceException occurred.

I tried following the instructions on the Tess Ferranddes blog:

Pure exceptions - tracking where exceptions occurred in code

But I am stuck at an early stage when I try to define a method handle for the DoSomething2 method using! ip2md with IP DoSomething2: 7FF01E7C639:

 > !ip2md 7FF01E7C639 Failed to request MethodData, not in JIT code range 

Please note that the team! ip2md succeeds in the IP method of the method in which the TargetInvocationException event occurred.

Question

Where can I go from here to narrow down which line in DoSomething2 is crashing? Please note that I cannot reproduce the crash, so I have (and several duplicate) dumps.

Additional notes :

• .NET 4.0
• Windbg Version: 6.12.0002.633 AMD64
• I'm new to Windbg: so the more information the better

Change 1

When I don't have the correct characters, I get the following:

 STACK_TEXT: 00000000`2cd9d8c0 00000000`ffffffff MyDll!Unknown_0xe99+0xe99 00000000`2cd9dbe0 00000000`ffffffff MyDll!Unknown_0x43d+0x43d 00000000`2cd9dd20 00000000`ffffffff MyDll!Unknown_0x51+0x51 00000000`2cd9dd80 00000000`ffffffff system_ni! System.ComponentModel.BackgroundWorker.WorkerThreadStart+0x62 

When I configured it to point to my character server and turned on! sym noisy, it seems to load characters correctly:

 0:000> ld MyDll DBGHELP: C:\Program Files\Debugging Tools for Windows (x64)\MyDll.dll - file not found SYMSRV: c:\symbols\MyDll.dll\4F3D6F4B154000\MyDll.dll not found SYMSRV: http://msdl.microsoft.com/download/symbols/MyDll.dll/4F3D6F4B154000/MyDll.dll not found SYMSRV: \\mysymbolserver\store\Mydll.dll\4F3D6F4B154000\file.ptr SYMSRV: MyDll.dl_ from \\mysymbolserver\store: uncompressed DBGHELP: c:\symbols\MyDll.dll\4F3D6F4B154000\MyDll.dll - OK DBGENG: c:\symbols\MyDll.dll\4F3D6F4B154000\MyDll.dll - Mapped image memory SYMSRV: c:\symbols\MyDll.pdb\8AFC2BE7529A41289FA9FBCEDB6836161\Mydll.pdb not found SYMSRV: http://msdl.microsoft.com/download/symbols/Mydll.pdb/8AFC2BE7529A41289FA9FBCEDB6836161/MyDll.pdb not found SYMSRV: \\mysymbolserver\store\MyDll.pdb\8AFC2BE7529A41289FA9FBCEDB6836161\file.ptr SYMSRV: MyDll.pd_ from \\mysymbolserver\store: uncompressed DBGHELP: MyDll - private symbols & lines c:\symbols\MyDll.pdb\8AFC2BE7529A41289FA9FBCEDB6836161\MyDll.pdb Symbols loaded for MyDll 

Edit 2

I tried to use! name2ee as follows:

 0:000> !name2ee MyDll!MyType.DoSomething2 Module: 000007ff004995b8 Assembly: Autodesk.DataManagement.Client.Framework.Vault.dll <invalid module token> 

So no luck. But then I almost understood something:

 0:000> !name2ee MyDll.dll!MyNamespace.MyType Module: 000007ff004995b8 Assembly: MyDll.dll Token: 000000000200008c MethodTable: 000007ff01b2e258 EEClass: 000007ff01b415e0 Name: MyNamespace.MyType 0:000> !dumpmt -md 7ff01b2e258 EEClass: 000007ff01b415e0 Module: 000007ff004995b8 Name: MyNamspace.MyType mdToken: 000000000200008c File: C:\Program Files\MyCompany\MyProduct\Bin\MyDll.dll BaseSize: 0x30 ComponentSize: 0x0 Slots in VTable: 31 Number of IFaces in IFaceMap: 2 -------------------------------------- MethodDesc Table Entry MethodDesc JIT Name 000007feeb31a2c0 0000000000000000 NONE 0000000000000000 is not a MethodDesc 000007feeb3689f0 0000000000000000 NONE 0000000000000000 is not a MethodDesc 000007feeb3688c0 0000000000000000 NONE 0000000000000000 is not a MethodDesc 000007feeb353440 0000000000000000 NONE 0000000000000000 is not a MethodDesc 000007ff01b01300 0000000000000000 NONE 0000000000000000 is not a MethodDesc 000007ff01e89140 0000000000000000 NONE 0000000000000000 is not a MethodDesc 000007ff01b9c080 0000000000000000 NONE 0000000000000000 is not a MethodDesc 000007ff01f45f40 0000000000000000 NONE 0000000000000000 is not a MethodDesc 000007ff01a9b358 000007ff01b2e128 NONE MyType.DoSomething3() 000007ff01a9b360 000007ff01b2e130 NONE MyType.DoSomething4() 000007ff01a9b368 000007ff01b2e138 NONE MyType.DoSomething5() 000007ff01e79800 0000000000000000 NONE 0000000000000000 is not a MethodDesc 000007ff020fea80 0000000000000000 NONE 0000000000000000 is not a MethodDesc 000007ff01a9b3b0 000007ff01b2e1b0 NONE MyType.DoSomething6() 000007ff01a9b3b8 000007ff01b2e1b8 NONE MyType.DoSomething7() 000007ff01a9b328 000007ff01b2e0f0 NONE MyType..ctor() 000007ff01b01280 0000000000000000 NONE 0000000000000000 is not a MethodDesc 000007ff01e7a810 0000000000000000 NONE 0000000000000000 is not a MethodDesc 000007ff01e7aac0 0000000000000000 NONE 0000000000000000 is not a MethodDesc 000007ff01e83240 0000000000000000 NONE 0000000000000000 is not a MethodDesc 000007ff01f19520 000007ff01b2e178 JIT MyType.RunWorkerCompleted(System.Object, System.ComponentModel.RunWorkerCompletedEventArgs) 000007ff01e7ace0 0000000000000000 JIT 0000000000000000 is not a MethodDesc 000007ff01e7b7a0 0000000000000000 JIT 0000000000000000 is not a MethodDesc 000007ff01e7b710 0000000000000000 JIT 0000000000000000 is not a MethodDesc 000007ff01e7d2b0 0000000000000000 JIT 0000000000000000 is not a MethodDesc 000007ff01b015f0 0000000000000000 JIT 0000000000000000 is not a MethodDesc 000007ff01b88ce0 0000000000000000 JIT 0000000000000000 is not a MethodDesc 000007ff01a9b3e0 000007ff01b2e200 NONE MyType.DoSomething8() 000007ff01b921e0 0000000000000000 NONE 0000000000000000 is not a MethodDesc 000007ff01b933b0 0000000000000000 NONE 0000000000000000 is not a MethodDesc 000007ff01b93870 0000000000000000 NONE 0000000000000000 is not a MethodDesc 

I assume that all the missing entries (those listed with "is not MethodDesc method") are related to the fact that this is not a complete mini-dump. Is it correct?

Answer 1

In the above comment, you indicate that || the command gives "User mini dump". To properly debug .NET code, you need a full dump that will point to the “Full memory user mini-dump” section || command. I think this is your problem. Without access to full heap loading, it is impossible to match the code address with the .NET method, so you cannot get a stack trace. If you can reproduce this problem, record a complete dump. You can use ADPlus, ProcDump, or DebugDiag to capture a dump on failure.

Answer 2

WinDbg doesn't seem to display characters for your DLL. You can study this by setting the symbol path and using !sym noisy to troubleshoot if necessary.

I can’t say why !ip2md does not work in this case, but there are other ways to get the code for DoSomething2 . Try !name2ee in the method name, for example. !name2ee *!TypeName.DoSomething2 , or you can get it using a type like !name2ee *!Namespace.TypeName and then !dumpmt -md <method table> in the !dumpmt -md <method table> that you get from !name2ee .

Once you have the code, the !u command can show you an annotated dump of the .NET assembly code. Using the bias from the exception, you can determine the nature of the NullReferenceException.

Answer 3

You are probably using a split PDB file, created by default for a project in the Release assembly. All information about the file and line is deleted from such a file.

Switch to the configuration Release, Project + Properties, tab Build, Advanced, Debug Info = "full".

This is a deliberate mistake, the line number information is not very accurate for the Release build. The jitter optimizer moves code around, so you need to keep in mind that the displayed line number is approximate.