I can't see the crash report. BreakDebuggerAsyncSafe()

[Jack Son]

I guess the function below doesn't let me see the crash report. (Windows VS2019)

void BreakDebuggerAsyncSafe() {
  if (IsDebugUISuppressed())
    _exit(1);

  __debugbreak();
}

How can I view the crash report?

Thanks

[Bruce Dawson]

It's not clear to me what you are trying to do. I can't tell from your screen shot whether you are debugging a crash dump or doing live debugging of Chrome.

If you are doing live debugging of Chrome and you want to save a crash dump then Visual Studio can save a crash dump. While sitting at the breakpoint you can select the Debug menu, then Save Dump As..., and then decide where to save the crash dump. You may want to change the type of crash dump from Minidump with Heap to just Minidump, since otherwise the minidump file will be quite large.

That said, if you can tell us more about what you are trying to do then we can try to help you.

[Bruce Dawson]

Once you have loaded the crash dump into windbg and got your symbol server paths sorted out (which you have done) you need to type .ecxr to load the exception context (which you have also done). Then you should go to the windbg View menu and click Call Stack to open the call stack window. You can then navigate up and down the call stack to see what was happening at various spots. There is no need to turn off BreakDebuggerAsyncSafe (and in fact it is needed) but you can skip past it to see the root cause of the failure.

It looks like there was a CHECK at PostDelayedTaskImpl+0x167 that failed so we intentionally crashed the process to avoid causing future problems.

You can also type .srcfix to enable source indexing. That will tell the debugger to download the source code on demand for the crash that you are debugging, which lets you see what source-code generated the crash.

I also find it helpful to have the Locals window and the Disassembly window open in order to better understand what is going on. I rarely found !analyze -v to be useful. But, how to set up and use windbg is very much a matter of personal taste. I have a windbg workspace configured so that when I open a crash dump I get this arrangement of windows:

On Fri, Dec 10, 2021 at 5:46 AM Jack Son <samet...@gmail.com> wrote:

Hi Bruce,

Sorry for the missing detail.
1) Yes I am debugging live chrome.

As you said I got the crash report and opened it with WinDBG.
I know the problem occurs at "base!base::sequence_manager::internal::TaskQueueImpl::PostDelayedTaskImpl+0x167" but I can't see the type of problem. (Is it a UAF or some other error?)

The Exception address is showing as "base!base::debug::BreakDebuggerAsyncSafe+0x0000000000000021". 

But I want to know the error code of the problem in "base!base::sequence_manager::internal::TaskQueueImpl::PostDelayedTaskImpl+0x167". Is there a way to turn off "BreakDebuggerAsyncSafe"?

here is the report:

*** WARNING: Unable to verify checksum for base.dll
base!base::debug::BreakDebuggerAsyncSafe+0x21:
00007ffc`cfb67221 cc              int     3
0:000> !analyze -v
ERROR: FindPlugIns 8007007b
*******************************************************************************
*                                                                             *
*                        Exception Analysis                                   *
*                                                                             *
*******************************************************************************

*** WARNING: Unable to verify checksum for blink_platform.dll
*** WARNING: Unable to verify checksum for blink_modules.dll
*** WARNING: Unable to verify checksum for blink_core.dll
*** WARNING: Unable to verify checksum for crdtp.dll
*** WARNING: Unable to verify checksum for bindings.dll
*** WARNING: Unable to verify checksum for ipc.dll
*** WARNING: Unable to verify checksum for content.dll
*** WARNING: Unable to verify checksum for chrome.dll
*** WARNING: Unable to verify checksum for chrome.exe
*** WARNING: Unable to verify checksum for mojo_core_embedder_internal.dll

KEY_VALUES_STRING: 1

    Key  : Analysis.CPU.Sec
    Value: 1

    Key  : Analysis.DebugAnalysisProvider.CPP
    Value: Create: 8007007e on LAPTOP-S7UL0S0K

    Key  : Analysis.DebugData
    Value: CreateObject

    Key  : Analysis.DebugModel
    Value: CreateObject

    Key  : Analysis.Elapsed.Sec
    Value: 13

    Key  : Analysis.Memory.CommitPeak.Mb
    Value: 113

    Key  : Analysis.System
    Value: CreateObject

    Key  : Timeline.OS.Boot.DeltaSec
    Value: 9663

    Key  : Timeline.Process.Start.DeltaSec
    Value: 178


NTGLOBALFLAG:  0

PROCESS_BAM_CURRENT_THROTTLED: 0

PROCESS_BAM_PREVIOUS_THROTTLED: 0

APPLICATION_VERIFIER_FLAGS:  0

CONTEXT:  (.ecxr)
rax=0000000000000000 rbx=0000000000000000 rcx=00007ffccfed28c8
rdx=0000000000000000 rsi=0000000000000000 rdi=0000000000000000
rip=00007ffccfb67221 rsp=0000009ac77fb0e0 rbp=0000000000000000
 r8=00007ffccfed76a8  r9=0000000000000000 r10=0000000000000000
r11=00007ffccfed28c8 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei pl zr na po nc
cs=0033  ss=002b  ds=0000  es=0000  fs=0000  gs=0000             efl=00000244
base!base::debug::BreakDebuggerAsyncSafe+0x21:
00007ffc`cfb67221 cc              int     3
Resetting default scope

EXCEPTION_RECORD:  (.exr -1)
ExceptionAddress: 00007ffccfb67221 (base!base::debug::BreakDebuggerAsyncSafe+0x0000000000000021)
   ExceptionCode: 80000003 (Break instruction exception)
  ExceptionFlags: 00000000
NumberParameters: 1
   Parameter[0]: 0000000000000000

PROCESS_NAME:  chrome.exe

ERROR_CODE: (NTSTATUS) 0x80000003 - {EXCEPTION}  Breakpoint  A breakpoint has been reached.

EXCEPTION_CODE_STR:  80000003

EXCEPTION_PARAMETER1:  0000000000000000

STACK_TEXT:  
0000009a`c77fb0e0 00007ffc`cf86d319 : 00007ffc`cfed28f0 0000009a`c77fb148 0000009a`c77fb2a0 0000021f`0b398250 : base!base::debug::BreakDebuggerAsyncSafe+0x21
0000009a`c77fb110 00007ffc`cf8c06ec : 00007ffc`cea33cd0 00000000`00000000 00000000`00000000 0000009a`c77fb23c : base!base::debug::BreakDebugger+0x9
0000009a`c77fb140 00007ffc`cf8c18cc : 00000000`00000000 0000021f`0b54ffe0 0000021f`0cda19b0 00007ffc`cf82b6e4 : base!logging::LogMessage::~LogMessage+0x6dc
0000009a`c77fc680 00007ffc`cf82b47f : 0000021f`0b54ffd0 00007ffc`cf82b446 0100009a`c77fc890 00007ffc`cfd1b435 : base!std::operator<<+0x9c
0000009a`c77fc6d0 00007ffc`cfa72177 : fffffffd`c6a1f240 00007ffc`cf820000 00003faa`2f82866c 00007ffc`cf861c92 : base!logging::CheckError::~CheckError+0x2f
0000009a`c77fc710 00007ffc`cfa70285 : 00000002`cfed3898 0000009a`c77fcb30 0000009a`c77fcc60 00007ffc`cf824ef2 : base!base::sequence_manager::internal::TaskQueueImpl::PostDelayedTaskImpl+0x167        
0000009a`c77fc9e0 00007ffc`cfa700e6 : 0000009a`c77fcc30 00007ffc`cf82a8f3 0000009a`c77fcc60 0000009a`c77fcca0 : base!base::sequence_manager::internal::TaskQueueImpl::PostTask+0x125
0000009a`c77fcad0 00007ffc`cfa70573 : 0000009a`c77fcc98 0000009a`c77fcca8 0000009a`c77fcca8 00007ffc`cf82a8f3 : base!base::sequence_manager::TaskQueue::PriorityToString+0x2f6
0000009a`c77fcbb0 00007ffc`9ae33df9 : 0000009a`c77fcd48 00007ffc`cf8be474 0000549a`00dbbaf8 0000009a`c77fce08 : base!base::sequence_manager::internal::TaskQueueImpl::PostTask+0x413
0000009a`c77fccc0 00007ffc`971c242e : 0000009a`c77fcf08 00007ffc`971d3742 0000009a`c77fce88 00007ffc`95248aef : blink_platform!blink::PostDelayedCancellableTask+0x1e9
0000009a`c77fcdb0 00007ffc`971bf22c : 0000549a`00644210 00007ffc`971cfe13 0000549a`00644218 0000549a`006441d8 : blink_modules!blink::Sensor::OnSensorReadingChanged+0x42e
0000009a`c77fcf00 00007ffc`971dd580 : 00003faa`2f828e7c 00007ffc`cfb2949b bff8da7e`39bae2a3 00000000`00000000 : blink_modules!blink::AmbientLightSensor::OnSensorReadingChanged+0x2eec
0000009a`c77fcf40 00007ffc`971c6959 : 0000009a`c77fd120 0000009a`c77fd138 0000009a`c77fd08f 0000549a`0015bae0 : blink_modules!blink::SensorProxy::ShouldSuspendUpdates+0xd490
0000009a`c77fcff0 00007ffc`9672468a : 0000009a`c77fd140 0000009a`c77fd130 0000021f`0cdccd80 0000009a`c77fd101 : blink_modules!blink::Sensor::GetReading+0x33f9
0000009a`c77fd0a0 00007ffc`a29cf232 : 0000021f`0b53efd8 0000021f`0b53f588 00000001`00000001 00007ffc`a77fb61a : blink_modules!blink::DeviceOrientationInspectorAgent::setDeviceOrientationOverride+0x14a
0000009a`c77fd160 00007ffc`a29d09f1 : 00000000`00000000 00007ffc`a77fb267 0000021f`0b53f520 0000021f`0b53f520 : blink_core!blink::protocol::DeviceOrientation::Frontend::sendRawNotification+0x5a2
0000009a`c77fd2c0 00007ffc`a29d09b4 : 0000b719`a34ae45d 00007ffc`a29ceecb 0000021f`0b53f520 00007ffc`a77f95e4 : blink_core!blink::protocol::DeviceOrientation::Dispatcher::wire+0x1661
0000009a`c77fd300 00007ffc`a29d0974 : 0000009a`c77fd848 0000009a`c77fd5f8 0000009a`c77fd5f8 00007ffc`a77f0d67 : blink_core!blink::protocol::DeviceOrientation::Dispatcher::wire+0x1624
0000009a`c77fd340 00007ffc`a29d092f : 0000009a`c77fd5f0 00007ffc`a77f0d00 0000021f`0cc130d0 0000009a`c77fd620 : blink_core!blink::protocol::DeviceOrientation::Dispatcher::wire+0x15e4
0000009a`c77fd380 00007ffc`a29d08f8 : 0000009a`c77fd838 0000009a`c77fd838 0000009a`c77fd618 00007ffc`a77f12fa : blink_core!blink::protocol::DeviceOrientation::Dispatcher::wire+0x159f
0000009a`c77fd3c0 00007ffc`a77fb409 : 0000009a`c77fd838 0000009a`c77fd838 0000021f`0cc106d0 00000001`c77f0000 : blink_core!blink::protocol::DeviceOrientation::Dispatcher::wire+0x1568
0000009a`c77fd410 00007ffc`a77fb3b3 : 00000000`00000069 00000000`c77fd530 0000009a`c77fd728 0000009a`c77fd728 : crdtp!crdtp::UberDispatcher::WireBackend+0x9bf9
0000009a`c77fd460 00007ffc`a77fb37a : 00000000`00000000 00000001`7ca9e959 0000009a`c77fd530 0000009a`c77fd530 : crdtp!crdtp::UberDispatcher::WireBackend+0x9ba3
0000009a`c77fd4a0 00007ffc`a77fb33b : 0000021f`0b54ed35 00000000`00000011 0000021f`0b54ed47 00000000`0000001c : crdtp!crdtp::UberDispatcher::WireBackend+0x9b6a
0000009a`c77fd4d0 00007ffc`a77fb30b : 0000021f`0b54ed35 00000000`0000002e 0000021f`0b54ed35 00000000`0000002e : crdtp!crdtp::UberDispatcher::WireBackend+0x9b2b
0000009a`c77fd500 00007ffc`a77fb2e3 : 0000021f`0b54ed35 00000000`0000002e 0000570c`004f0420 0100570c`004f0434 : crdtp!crdtp::UberDispatcher::WireBackend+0x9afb
0000009a`c77fd530 00007ffc`a77fb29f : 0000a713`64c29408 0000021f`0b54ed20 00000000`00000069 aaaaaaaa`00000000 : crdtp!crdtp::UberDispatcher::WireBackend+0x9ad3
0000009a`c77fd560 00007ffc`a77f96c6 : aaaaaaaa`aaaaaa01 0000021f`0b54ed6a 00000000`0000001e 00000000`00000000 : crdtp!crdtp::UberDispatcher::WireBackend+0x9a8f
0000009a`c77fd5a0 00007ffc`a77f0e07 : 00007ffc`a29d08b0 00007ffc`a3144110 00000000`00000069 0000021f`0b53f520 : crdtp!crdtp::UberDispatcher::WireBackend+0x7eb6
0000009a`c77fd5e0 00007ffc`a77f0da7 : 00007ffc`a781eb70 aaaaaaaa`aaaaaaaa 0000021f`0cc130d0 00007ffc`a29cf090 : crdtp!crdtp::UberDispatcher::DispatchResult::Run+0x97
0000009a`c77fd610 00007ffc`a002b877 : 0000009a`c77fd6b8 0000009a`c77fd900 0000021f`0b40b720 0000570c`004f0434 : crdtp!crdtp::UberDispatcher::DispatchResult::Run+0x37
0000009a`c77fd650 00007ffc`a002b209 : 0000009a`c77fe168 0100021f`0b54ecd0 0000021f`0b54ed08 0000009a`c77fe168 : blink_core!blink::DevToolsSession::DispatchProtocolCommandImpl+0x4e7
0000009a`c77fd880 00007ffc`9cc268c5 : 0000021f`0cc11450 00007ffc`cf8ebe38 0000009a`c77fdaa8 00007ffc`cf8ebcec : blink_core!blink::DevToolsSession::DispatchProtocolCommand+0x239
0000009a`c77fd970 00007ffc`a002eaee : 0000009a`c77fe168 00007ffc`ca7971b0 0000009a`c77fdbe0 0000021f`0b486db0 : blink_platform!blink::mojom::blink::DevToolsSessionStubDispatch::Accept+0x365
0000009a`c77fda70 00007ffc`ca7a711c : 01000036`c77fe170 00000001`00000001 0000021f`0b54ed08 0000021f`0b54ed08 : blink_core!blink::DevToolsSession::Trace+0x174e
0000009a`c77fdac0 00007ffc`ca7a69c1 : 0000021f`0b486ed8 00007ffc`ca7c26f3 0000021f`0cc42480 0000009a`c77fe168 : bindings!mojo::InterfaceEndpointClient::HandleValidatedMessage+0x74c
0000009a`c77fdd50 00007ffc`ca7c25a2 : 0000021f`0b54ec98 0000009a`c77fe168 00000004`00000001 0000009a`c77fe168 : bindings!mojo::internal::ValidateResponseGenericPacked+0xe51
0000009a`c77fdd90 00007ffc`ca7a9e0a : 0000021f`0cc57f40 00007ffc`ba580ee9 0000009a`c77fdf00 00007ffc`ba5862ed : bindings!mojo::MessageDispatcher::Accept+0x152
0000009a`c77fde30 00007ffc`ba58a628 : 0000021f`0b4d9de0 00007ffc`ed2c9153 0000021f`0b4d9d88 0000021f`0b4d9d90 : bindings!mojo::InterfaceEndpointClient::HandleIncomingMessage+0x9a
0000009a`c77fdff0 00007ffc`ba57a07e : 0000021f`0adba1e8 00007ffc`cfed2798 00000002`00000000 0000009a`c77fe130 : ipc!IPC::MojoBootstrap::Create+0x142d8
0000009a`c77fe110 00007ffc`ba579f60 : 0000021f`0b4d9d80 00007ffc`ba57a193 0000021f`0b38be78 00007ffc`cfb20c42 : ipc!IPC::MojoBootstrap::Create+0x3d2e
0000009a`c77fe1f0 00007ffc`ba579ebd : 00000100`00000010 00007ffc`cf825857 0000021f`0b38be40 00007ffc`cf824ef2 : ipc!IPC::MojoBootstrap::Create+0x3c10
0000009a`c77fe260 00007ffc`ba579e45 : 0000021f`0b38be40 00007ffc`cf823992 00003faa`2f82a2fc 00007ffc`cf825793 : ipc!IPC::MojoBootstrap::Create+0x3b6d
0000009a`c77fe2b0 00007ffc`cf821a97 : 00003faa`2f82a20c 00007ffc`cfa3b2bd 00003faa`2f82a20c 00007ffc`cfa3a6a3 : ipc!IPC::MojoBootstrap::Create+0x3af5
0000009a`c77fe300 00007ffc`cfa3b05c : 00000000`00000000 00007ffc`cf86d7b5 00000000`00000000 00007ffc`cf89ab37 : base!base::AtExitManager::RegisterTask+0x397
0000009a`c77fe350 00007ffc`cfa915c3 : 00007ffc`cfed1d90 00007ffc`cfed3ad0 00000000`00000000 00007ffc`cf86da0b : base!base::TaskAnnotator::RunTaskImpl+0x1ac
0000009a`c77fe410 00007ffc`cfa91363 : 00000002`395f83c5 00000001`cfabd269 0000021f`0adba200 00007ffc`cf861908 : base!base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWorkImpl+0x9a3
0000009a`c77fe4a0 00007ffc`cfa90953 : 0000009a`c77fe7b8 00000000`000199a3 0000009a`c77fe7b8 00000000`000199a3 : base!base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWorkImpl+0x743
0000009a`c77fe660 00007ffc`cf8edc71 : 0000021f`0adba1e0 0000021f`0ae8ebe8 0000009a`c77fe890 0000021f`0ae8ebe8 : base!base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWork+0x123
0000009a`c77fe770 00007ffc`cfa91ccf : 00000000`00000000 0000009a`c77fe9c8 00000000`00000000 0000009a`c77fe9c8 : base!base::MessagePumpDefault::Run+0x91
0000009a`c77fe800 00007ffc`cf9be8b9 : 0000009a`c77fe9a0 00000002`3587bd87 0000009a`c77fead0 0000009a`c77fead0 : base!base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::Run+0x29f
0000009a`c77fe8c0 00007ffc`b81b35be : 00000000`00000640 00007ffc`bb7b89ec 00000000`00000000 00007ffc`cf8fdfe6 : base!base::RunLoop::Run+0x339
0000009a`c77fea00 00007ffc`b8787c8a : 00000000`00000006 00007ffc`b8e57fb4 0000009a`c77fed08 00007ffc`cf82ace5 : content!content::RendererBlinkPlatformImpl::AppendContentSecurityPolicy+0x6e1e
0000009a`c77fecb0 00007ffc`b87894e0 : 00000000`00000000 0000021f`087c0000 00000000`00000000 00000000`00000000 : content!content::MojoIpcSupport::CreateBrowserStartupData+0xa8a
0000009a`c77fee40 00007ffc`b8786143 : 00000000`00000000 00007ffc`ce8d65a7 00000000`00000000 00000000`00000000 : content!content::MojoIpcSupport::CreateBrowserStartupData+0x22e0
0000009a`c77fef90 00007ffc`b8786784 : 08000000`00000000 00000000`00000000 00003faa`2f82b14c 00007ffc`cf82dd5b : content!content::RunContentProcess+0x453
0000009a`c77ff230 00007ffc`bb7b13b0 : 00005a4a`dc937627 00007ff7`8adc6539 0000021f`087c3640 00007ffc`cf8334fc : content!content::ContentMain+0x54
0000009a`c77ff2b0 00007ff7`8adc6584 : 00000000`00000000 00007ffc`bb7b1140 00000000`00000000 00000000`00000000 : chrome!ChromeMain+0x270
0000009a`c77ff410 00007ff7`8adc1814 : 00007ffd`3bb900e8 00000000`00000000 00000000`00000000 0000009a`c77ff600 : chrome_exe!GetPakFileHashes+0x5584
0000009a`c77ff500 00007ff7`8afb9632 : 00000000`00000000 00007ff7`8afb6f6d 00000000`00000000 00007ff7`8aff1d68 : chrome_exe!GetPakFileHashes+0x814
0000009a`c77ff890 00007ff7`8afb976e : 00007ff7`8aff1d00 00007ff7`8aff1d40 00000000`00000000 00000000`00000000 : chrome_exe!GetMainTargetServices+0x1c8ba2
0000009a`c77ff8d0 00007ff7`8afb97ee : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : chrome_exe!GetMainTargetServices+0x1c8cde
0000009a`c77ff940 00007ff7`8afb980e : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : chrome_exe!GetMainTargetServices+0x1c8d5e
0000009a`c77ff970 00007ffd`39fb7034 : 0000009a`c6fdf000 00000000`00000000 00000000`00000000 00000000`00000000 : chrome_exe!GetMainTargetServices+0x1c8d7e
0000009a`c77ff9a0 00007ffd`3bbe2651 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : kernel32!BaseThreadInitThunk+0x14
0000009a`c77ff9d0 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : ntdll!RtlUserThreadStart+0x21


SYMBOL_NAME:  base!base::debug::BreakDebuggerAsyncSafe+21

MODULE_NAME: base

IMAGE_NAME:  base.dll

STACK_COMMAND:  ~0s ; .ecxr ; kb

FAILURE_BUCKET_ID:  BREAKPOINT_80000003_base.dll!base::debug::BreakDebuggerAsyncSafe

OS_VERSION:  10.0.19041.1

BUILDLAB_STR:  vb_release

OSPLATFORM_TYPE:  x64

OSNAME:  Windows 10

FAILURE_ID_HASH:  {b41c8e84-63a7-104d-f82e-72d54bb53dff}

Followup:     MachineOwner
---------

10 Aralık 2021 Cuma tarihinde saat 04:22:03 UTC+3 itibarıyla Bruce Dawson şunları yazdı:

--

Bruce Dawson, he/him

[Bruce Dawson]

What do you see when you go up the call stack, and how does that compare to what you expect to see? Did source code show up?

Because you are debugging a fully optimized version of Chrome some of the verbose information that is present in an asan build is missing, which can make debugging crashes more difficult, but if the source code appears then it is usually obvious what CHECK call failed. If there are multiple CHECK statements or complex expressions then it may be more difficult to determine the problem. Sometimes you have to examine local variables, register contents, or even the assembly language.

If this crash dump is from an official Chrome build (canary, dev, beta, or stable) then you can always share the crash dump so that others can look at it, or go to chrome://crashes and upload it and then share the crash ID.

On Sat, Dec 11, 2021 at 4:25 AM Jack Son <samet...@gmail.com> wrote:

I did what you said, but I still can't find the type of error that occurs in "PostDelayedTaskImpl+0x167". Isn't there any other way to get an easy crash report like in Asan?

11 Aralık 2021 Cumartesi tarihinde saat 10:56:35 UTC+3 itibarıyla Bruce Dawson şunları yazdı:

--

Bruce Dawson, he/him

[Jack Son]

I did what you said, but I still can't find the type of error that occurs in "PostDelayedTaskImpl+0x167". Isn't there any other way to get an easy crash report like in Asan?

11 Aralık 2021 Cumartesi tarihinde saat 10:56:35 UTC+3 itibarıyla Bruce Dawson şunları yazdı:

[Jack Son]

It's not clear to me what you are trying to do. I can't tell from your screen shot whether you are debugging a crash dump or doing live debugging of Chrome.