Memory Dump Analysis Anthology- P17: This is a revised, edited, cross-referenced and thematically organized volume of selected blog posts about crash dump analysis and debugging written in 2006 - 2007 for software engineers developing and maintaining products on Windows platforms, technical support and escalation engineers dealing with complex software issues and general Windows users. | Wait Chain General 481 WAIT CHAIN GENERAL Wait Chain pattern is simply a sequence of causal relations between events thread A is waiting for an event E to happen that threads B C or D are supposed to signal at some time in the future but they are all waiting for an event F to happen that a thread G is about to signal as soon as it finishes processing some critical task This subsumes various deadlock patterns too which are causal loops where a thread A is waiting for an event AB that a thread B will signal as soon as the thread A signals an event BA the thread B is waiting for Please purchase PDF Split-Merge on to remove this watermark 482 PART 3 Crash Dump Analysis Patterns In this context Event means any type of synchronization object critical section LPC RPC reply or data arrival through some IPC channel and not only Win32 event object or kernel _KEVENT. As the first example of Wait Chain pattern I show a process being terminated and waiting for another thread to finish or in other words considering thread termination as an event itself the main process thread is waiting for the second thread object to be signaled. The second thread tries to cancel previous I O request directed to some device. However that IRP is not cancellable and process hangs. This can be depicted on the following diagram Please purchase PDF Split-Merge on to remove this watermark Wait Chain General 483 where Thread A is our main thread waiting for Event A which is the thread B itself waiting for I O cancellation Event B . Their stack traces are Cid Teb 7ffdf000 Win32Thread bc1b6e70 WAIT THREAD 8a3178d0 Unknown KernelMode 8af2c920 Thread Non-Alertable Not impersonating DeviceMap e1032530 Owning Process 89ff8d88 Image Wait Start TickCount 80444 Ticks 873 0 00 00 Context Switch Count 122 LargeStack UserTime 00 00 KernelTime 00 00 Win32 Start Address 0x010148a4 Start Address 0x77e617f8 Stack Init f3f29000 Current .
