Windebug 调试多线程程序死锁

 

class CTestThreadDlg : public CDialog
{ 
afx_msg void OnBnClickedButton1(); 
CRITICAL_SECTION _section;
CRITICAL_SECTION _section_sec; 
};
DWORD WINAPI   ThreadProc(LPVOID parame);
unsigned int __stdcall   ThreadProcSecond(void * parame);

void CTestThreadDlg::OnBnClickedButton1()

{
int parame = 123;
DWORD threadid=0;
HANDLE _thread = CreateThread(NULL,NULL,ThreadProc,this,CREATE_SUSPENDED,&threadid);
ResumeThread(_thread);
  
unsigned threadID; 
        HANDLE  _threadSecond = (HANDLE)_beginthreadex( NULL, 0, &ThreadProcSecond, this, 0, &threadID ); 

} 

DWORD WINAPI ThreadProc( LPVOID parame )
{
CTestThreadDlg * _dlg = (CTestThreadDlg*)parame;
EnterCriticalSection(&_dlg->_section);
Sleep(1000*2);
EnterCriticalSection(&_dlg->_section_sec);
 
LeaveCriticalSection(&_dlg->_section);
LeaveCriticalSection(&_dlg->_section_sec);
return 0;
}


unsigned int __stdcall ThreadProcSecond( void * parame )
{
CTestThreadDlg * _dlg = (CTestThreadDlg*)parame;
EnterCriticalSection(&_dlg->_section_sec);
Sleep(1000*2);
EnterCriticalSection(&_dlg->_section);
 
LeaveCriticalSection(&_dlg->_section);
LeaveCriticalSection(&_dlg->_section_sec);
 
   return 100;
}

如上程序在执行之后出现线程死锁，经过WinDbg分析后得到如下信息

0:001> ~*
   0  Id: 11e4.11d4 Suspend: 1 Teb: 7ffdf000 Unfrozen
      Start: *** WARNING: Unable to verify checksum for F:\Test\TestThread\Debug\TestThread.exe
TestThread!ILT+2030(_wWinMainCRTStartup) (004117f3) 
      Priority: 0  Priority class: 32  Affinity: 3
.  1  Id: 11e4.1354 Suspend: 1 Teb: 7ffde000 Unfrozen
      Start: ntdll!DbgUiRemoteBreakin (7c9720ec) 
      Priority: 0  Priority class: 32  Affinity: 3
   3  Id: 11e4.15cc Suspend: 1 Teb: 7ffdb000 Unfrozen
      Start: kernel32!BaseThreadStartThunk (7c810729) 
      Priority: 0  Priority class: 32  Affinity: 3
   4  Id: 11e4.138c Suspend: 1 Teb: 7ffdd000 Unfrozen
      Start: kernel32!BaseThreadStartThunk (7c810729) 
      Priority: 0  Priority class: 32  Affinity: 3
   5  Id: 11e4.10cc Suspend: 1 Teb: 7ffda000 Unfrozen
      Start: kernel32!BaseThreadStartThunk (7c810729) 
      Priority: 0  Priority class: 32  Affinity: 3

0:001> ~4kv
ChildEBP RetAddr  Args to Child              
055cfe3c 7c92df5a 7c939b23 00000208 00000000 ntdll!KiFastSystemCallRet (FPO: [0,0,0])
055cfe40 7c939b23 00000208 00000000 00000000 ntdll!NtWaitForSingleObject+0xc (FPO: [3,0,0])
055cfec8 7c921046 0012fe88 00413b1f 0012fe88 ntdll!RtlpWaitForCriticalSection+0x132 (FPO: [1,26,4])
055cfed0 00413b1f 0012fe88 00dafda0 010003f0 ntdll!RtlEnterCriticalSection+0x46 (FPO: [1,0,0])
055cffb4 7c80b729 0012fdf8 00dafda0 010003f0 TestThread!ThreadProc+0x5f (FPO: [Non-Fpo]) (CONV: stdcall) [f:\test\testthread\testthread\testthreaddlg.cpp @ 183]
055cffec 00000000 0041185c 0012fdf8 00000000 kernel32!BaseThreadStart+0x37 (FPO: [Non-Fpo])
0:001> ~5kv
ChildEBP RetAddr  Args to Child              
057cfddc 7c92df5a 7c939b23 00000210 00000000 ntdll!KiFastSystemCallRet (FPO: [0,0,0])
057cfde0 7c939b23 00000210 00000000 00000000 ntdll!NtWaitForSingleObject+0xc (FPO: [3,0,0])
057cfe68 7c921046 0012fe70 00412f7f 0012fe70 ntdll!RtlpWaitForCriticalSection+0x132 (FPO: [1,26,4])
057cfe70 00412f7f 0012fe70 10299358 0012f390 ntdll!RtlEnterCriticalSection+0x46 (FPO: [1,0,0])
057cff6c 1023dfd3 0012fdf8 cef52b3d 10299358 TestThread!ThreadProcSecond+0x5f (FPO: [Non-Fpo]) (CONV: stdcall) [f:\test\testthread\testthread\testthreaddlg.cpp @ 197]
057cffa8 1023df69 0039fd40 057cffec 7c80b729 MSVCR90D!_callthreadstartex+0x53 (FPO: [Non-Fpo]) (CONV: cdecl) [f:\dd\vctools\crt_bld\self_x86\crt\src\threadex.c @ 348]
057cffb4 7c80b729 0039fd40 10299358 0012f390 MSVCR90D!_threadstartex+0x89 (FPO: [Non-Fpo]) (CONV: stdcall) [f:\dd\vctools\crt_bld\self_x86\crt\src\threadex.c @ 331]
057cffec 00000000 1023dee0 0039fb00 00000000 kernel32!BaseThreadStart+0x37 (FPO: [Non-Fpo])
0:001> dt RTL_CRITICAL_SECTION 0012fe70
TestThread!RTL_CRITICAL_SECTION
   +0x000 DebugInfo        : 0x00161ff8 _RTL_CRITICAL_SECTION_DEBUG
   +0x004 LockCount        : 1
   +0x008 RecursionCount   : 1
   +0x00c OwningThread     : 0x0000138c 
   +0x010 LockSemaphore    : 0x00000210 
   +0x014 SpinCount        : 0
0:001> dt RTL_CRITICAL_SECTION 0012fe88 
TestThread!RTL_CRITICAL_SECTION
   +0x000 DebugInfo        : 0x00162a58 _RTL_CRITICAL_SECTION_DEBUG
   +0x004 LockCount        : 1
   +0x008 RecursionCount   : 1
   +0x00c OwningThread     : 0x000010cc 
   +0x010 LockSemaphore    : 0x00000208 
   +0x014 SpinCount        : 0

 (从上面红色数据得知，两个线程都在进入之后等待另外一个信号出现的死锁，而且看出是Critical_Section对象)

结论一： 线程4的线程地址是：11e4.138c (0x0000138c) ，它开始进入时占用了互斥对象0012fe70的信号0x00000210

              4  Id: 11e4.138c Suspend: 1 Teb: 7ffdd000 Unfrozen
             Start: kernel32!BaseThreadStartThunk (7c810729) 
              Priority: 0  Priority class: 32  Affinity: 3

0:001> dt RTL_CRITICAL_SECTION 0012fe70
TestThread!RTL_CRITICAL_SECTION
   +0x000 DebugInfo        : 0x00161ff8 _RTL_CRITICAL_SECTION_DEBUG
   +0x004 LockCount        : 1
   +0x008 RecursionCount   : 1
   +0x00c OwningThread     : 0x0000138c 
  +0x010 LockSemaphore    : 0x00000210 
  +0x014 SpinCount        : 0

 然后线程4，占用互斥对象0012fe70之后，尝试占用互斥对象0012fe88 

0:001> ~4kv
ChildEBP RetAddr  Args to Child              
055cfe3c 7c92df5a 7c939b23 00000208 00000000 ntdll!KiFastSystemCallRet (FPO: [0,0,0])
055cfe40 7c939b23 00000208 00000000 00000000 ntdll!NtWaitForSingleObject+0xc (FPO: [3,0,0])
055cfec8 7c9210460012fe8800413b1f 0012fe88 ntdll!RtlpWaitForCriticalSection+0x132 (FPO: [1,26,4])
055cfed0 00413b1f 0012fe8800dafda0 010003f0 ntdll!RtlEnterCriticalSection+0x46 (FPO: [1,0,0])

 但是此时互斥对象0012fe88 被线程5占用，线程5的地址为11e4.10cc (0x000010cc )，并且一直没有释放,

5  Id: 11e4.10cc Suspend: 1 Teb: 7ffda000 Unfrozen
 Start: kernel32!BaseThreadStartThunk (7c810729) 
Priority: 0  Priority class: 32  Affinity: 3

0:001> dt RTL_CRITICAL_SECTION 0012fe88 
TestThread!RTL_CRITICAL_SECTION
  +0x000 DebugInfo        : 0x00162a58 _RTL_CRITICAL_SECTION_DEBUG
   +0x004 LockCount        : 1
   +0x008 RecursionCount   : 1
   +0x00c OwningThread     :0x000010cc 
   +0x010 LockSemaphore    : 0x00000208 
   +0x014 SpinCount        : 0

此时，线程5也正在等待线程4所占用的互斥对象，所以出现了死锁

0:001> ~5kv
ChildEBP RetAddr  Args to Child              
057cfddc 7c92df5a 7c939b23 00000210 00000000 ntdll!KiFastSystemCallRet (FPO: [0,0,0])
057cfde0 7c939b23 00000210 00000000 00000000 ntdll!NtWaitForSingleObject+0xc (FPO: [3,0,0])
057cfe68 7c9210460012fe70 00412f7f 0012fe70 ntdll!RtlpWaitForCriticalSection+0x132 (FPO: [1,26,4])
057cfe70 00412f7f0012fe70 10299358 0012f390 ntdll!RtlEnterCriticalSection+0x46 (FPO: [1,0,0])

解决线程死锁的办法就是，所有线程按照同一个顺序访问互斥对象