Debugging studies - day 3

Lab 5 was the longest one for me so far to get through. First I was not able to reproduce a bug actually. Tess may correct it in a way that it will be more reproducible, but in my case I had to read a review, so it took a lot of a thrill factor away.

In Vista Home I was not getting any extra application events in the log but this:

Faulting application w3wp.exe, version 7.0.6001.18000, time stamp 0x47919413, faulting module kernel32.dll, version 6.0.6001.18000, time stamp 0x4791a76d, exception code 0xe053534f, fault offset 0x000442eb, process id 0x%9, application start time 0x%10.

So no 0x800703E9 (means "Recursion too deep; the stack overflowed.") pointer here. Probably just me being reluctant once again to find how to get IIS7 on Vista Home to log those events (that is logged by default in IIS6). Or IIS7 handles it differently?

Taking advantage of having a review scanned, I executed the following adplus command to kill many birds with just one stone:

adplus -crash -pn w3wp.exe -o c:\dumps\ -ce 0xe053534f  -quiet

That got me the following:

For few moments I was really feeling as a smart guy, until I have uncovered the full meaning of "mini" in the custom exception dump. First warning was given when loading the sos, saying that its functionality is going to be limited. Secondly I was clearly able to see the StackOverflow happened, although no way I could even use ln or !ip2md in any reasonable manner to track it down (some of the nearby methods were mapped ok, some were not ...:( )

I tried -fullonfirst with -ce options, but no luck really; dumps on all of the 1st chance exceptions. Turns out Tess's custom adplus config file was not a nicety but the only (?) way how to tell adplus to create a full dump on the custom exception.

After re-using the config file (and given I had to scan the review in advance) the completion of the lab was really straight forward.