NTDebuggers Debug Puzzler 0x00000001 "Where did my process go?"

re: NTDebuggers Debug Puzzler 0x00000001 "Where did my process go?"

Ingo Rammer — Mon, 07 Apr 2008 18:54:32 GMT

My guess: a regular process termination by some obscure component in your application, or alternatively regular terminate process from a global unhandled exception filter/handler.

bp ntdll!zwterminateprocess usually gets me a tiny little bit closer to the problem.

-Ingo

re: NTDebuggers Debug Puzzler 0x00000001 "Where did my process go?"

Jim Austin — Mon, 07 Apr 2008 19:01:36 GMT

A thread exhausted it's stack because stack expansion was disabled by dereferencing an invalid pointer in an exception handler.

re: NTDebuggers Debug Puzzler 0x00000001 "Where did my process go?"

Skywing — Mon, 07 Apr 2008 19:10:33 GMT

Anything sufficiently broken/corrupted in the critical path for JIT debugging, which is a lot of things (the process heap is a big one) can cause secondary failures in the JIT path (CreateProcessW is fairly heavyweight of an operation). These secondary failures typically lead to the process getting hard killed instead of being able to create the JIT debugger process successfully.

Monitoring from an external process instead of doing things from the point of an AV in a program is much better as it avoids exposing the fault handling code to whatever corruption claimed the process and caused the AV in the first place.

re: NTDebuggers Debug Puzzler 0x00000001 "Where did my process go?"

Chris Clark — Mon, 07 Apr 2008 20:06:23 GMT

This is probably not the answer but annoyed the heck out of me for a bit. On my Vista x64 machine, the JIT (windbg) was not launching properly because it was not configured correctly in both the Wow6432Node and the standard registry hive. So for 32-bit processes I would get the Visual Studio JIT and for 64-bit I would get WinDbg like I expected. Manually updating the registration in both locations fixed it.

In the absence of that, I would vote for Skywings answer.

re: NTDebuggers Debug Puzzler 0x00000001 "Where did my process go?"

molotov — Mon, 07 Apr 2008 23:02:12 GMT

A stack overflow seems one case where Dr. Watson may not kick in.

In testing, unhandled C++ exceptions ("This application has requested the Runtime to terminate it in an unusual way.") may give one the impression that the good doctor is doing some work (do get a visual/audio notification, if configured) but in fact no dump is generated and only the header is written to drwtsn32.log. Similar results when terminate() is called due to an exception being thrown from a destructor during stack unwinding. In these cases, it would seem to be an intentional behavior of Dr. Watson, for whatever reason.

re: NTDebuggers Debug Puzzler 0x00000001 "Where did my process go?"

molotov — Mon, 07 Apr 2008 23:25:24 GMT

Apologies for the addition...

> it would seem to be an intentional behavior of Dr. Watson, for whatever reason. <

"whatever reason" could include, as seems to be the case here, that the failing process that invoked Dr. Watson has exited by the time Dr. Watson is ready to go.

re: NTDebuggers Debug Puzzler 0x00000001 "Where did my process go?"

Tal — Tue, 08 Apr 2008 11:02:58 GMT

We had exactly this issue.

In our case, it turned out to be a 3rdParty library calling abort() after encountering RTL heap memory corruption.

I think there are other cases:

- The VC RTL heap might popup a dialog box, and the user might decide to terminate the application.

- Service failed to start, caused by some loader issues (Missing DLL, or missing API, or even DllMain exception ).

re: NTDebuggers Debug Puzzler 0x00000001 "Where did my process go?"

Zaki Mirza — Fri, 11 Apr 2008 17:52:00 GMT

Well, im kind of new to NT Development and i'm more into .Net development but i faced a problem like that. And what was happening was that some exception was raised, caught and the catching code silently closed the app (which is legal exit of an application).

re: NTDebuggers Debug Puzzler 0x00000001 "Where did my process go?"

MSDNTST — Tue, 15 Apr 2008 07:38:09 GMT

Interesting series.

Vista just improves this limitation(problem) and moves the "unhandled exception handling" code in the kernel-mode by using the WER service. We finally will not get silent process exit now. I provided a reply in the link below:

http://groups.google.com/group/microsoft.public.windbg/msg/104e802ce3a20cdb

Jeffrey Tan

re: NTDebuggers Debug Puzzler 0x00000001 "Where did my process go?"

Brian Hartung — Sat, 10 May 2008 18:42:17 GMT

To put a finer point on the stack overflow reponses, this will specifically happen if you attempt to write to the hard guard page.