I am investigating a application hang (winforms). It happens only on the customer machines. They got us a dmp from the frozen process. But i am unsure of how to interpret the data.
I loaded the file into WinDbg.
!dlk => no deadlocks
!analyze -hang
FAULTING_THREAD: 00003aec (That's the main thread) WATSON_BKT_EVENT: AppHang ERROR_CODE: (NTSTATUS) 0xcfffffff - EXCEPTION_CODE_STR: cfffffff DERIVED_WAIT_CHAIN:
Dl Eid Cid WaitType
0 3ae8.3aec COM
=> Looks like a COM Problem on the main thread to me!dumpstack
user32!_PeekMessage+0x42, calling win32u!NtUserPeekMessage combase!CCliModalLoop::MyPeekMessage+0x52, calling user32!PeekMessageW user32!PeekMessageW+0x149, calling user32!_PeekMessage user32!PeekMessageW+0x149, calling user32!_PeekMessage combase!CCliModalLoop::MyPeekMessage+0x52, calling user32!PeekMessageW combase!CCliModalLoop::MyPeekMessage+0x52, calling user32!PeekMessageW combase!CCliModalLoop::HandleWakeForMsg+0x13b, calling combase!CCliModalLoop::SetPointerInputModeAsAppropriateForQueueAttachmentConditions combase!CCliModalLoop::PeekRPCAndDDEMessage+0x49, calling combase!CCliModalLoop::MyPeekMessage combase!CCliModalLoop::RevertToNormalPointerInputMode+0x1d, calling combase!CCliModalLoop::IsAttachedQueuePointerMessageReorderingAllowed combase!CCliModalLoop::BlockFn+0x262, calling combase!CCliModalLoop::PeekRPCAndDDEMessage combase!ClassicSTAThreadWaitForHandles+0x9f, calling combase!CCliModalLoop::BlockFn clr!PrepareCriticalFinalizerObject+0x5e, calling clr!_security_check_cookie combase!CoWaitForMultipleHandles+0x76, calling combase!_guard_dispatch_icall_nop clr!MsgWaitHelper+0x8e, calling combase!CoWaitForMultipleHandles clr!ThreadStateNCStackHolder::~ThreadStateNCStackHolder+0x1c, calling clr!GetThread clr!Thread::DoAppropriateWaitWorker+0x2e6, calling clr!MsgWaitHelper clr!Thread::DoAppropriateWait+0x7d, calling clr!Thread::DoAppropriateWaitWorker clr!WaitHandleNative::CorWaitOneNative+0x161, calling clr!Thread::DoAppropriateWait KERNELBASE!CreateEventW+0x8c, calling ntdll!RtlSetLastWin32Error :
I am unsure how to investigate/interpret this further. From the stack I would guess a thread where some COM stuff happened is not responding. The call to "PeekMessage" might suggest a broken/not responding message queue. The line with "SetPointerInputModeAs..." also seems highly suspicious to me.
Any suggestions or ideas anybody?
Kind regards
