Inspecting thread static value for generic class failed in SOS

[cshung]

Inspecting the value of a thread static field of the generic class is failing with the following AV (which is then swallowed and show nothing)

00 0000001d`ff0fb4e0 00007fff`5710e41d mscordaccore!__TPtrBase::GetAddr+0xb [C:\Dev\runtime\src\coreclr\src\inc\daccess.h @ 882] 
01 0000001d`ff0fb4f0 00007fff`5716c465 mscordaccore!__DPtr<Object>::__DPtr<Object>+0x2d [C:\Dev\runtime\src\coreclr\src\inc\daccess.h @ 1158] 
02 0000001d`ff0fb520 00007fff`571acc34 mscordaccore!ObjectFromHandle+0x75 [C:\Dev\runtime\src\coreclr\src\vm\gchandleutilities.h @ 49] 
03 0000001d`ff0fb560 00007fff`571b021d mscordaccore!ThreadLocalModule::GetPrecomputedGCStaticsBasePointer+0x74 [C:\Dev\runtime\src\coreclr\src\vm\threadstatics.h @ 176] 
04 0000001d`ff0fb5b0 00007fff`6eb42e10 mscordaccore!ClrDataAccess::GetThreadLocalModuleData+0x1ad [C:\Dev\runtime\src\coreclr\src\debug\daccess\request.cpp @ 3240] 
05 0000001d`ff0fb7d0 00007fff`6eb424c4 sos!DisplayThreadStatic+0x200 [C:\Dev\diagnostics\src\SOS\Strike\util.cpp @ 730] 
06 0000001d`ff0fb970 00007fff`6eb20a13 sos!DisplayFields+0x604 [C:\Dev\diagnostics\src\SOS\Strike\util.cpp @ 984] 
07 0000001d`ff0fc530 00007fff`6cdb47b3 sos!DumpClass+0x7c3 [C:\Dev\diagnostics\src\SOS\Strike\strike.cpp @ 1257] 

Here is the call to GetPrecomputedGCStaticsBasePointer

https://github.com/dotnet/runtime/blob/a498bc5b97f2d0857049232375d96f10d64001d6/src/coreclr/src/debug/daccess/request.cpp#L3240

This is a wrong call because it would fail if the m_pGCStatics is null, the code would dereferencing null. In my scenario, at runtime, the field is indeed null.

Commenting out that line (wrongly, it should be done conditionally) just sadly leads me to:

diagnostics/src/SOS/Strike/util.cpp

Line 590 in 6b66e69

ExtOut("dynamic thread statics NYI");

This feels like #50

This is blocking me from making progress for dotnet/runtime#31940

I am trying to nail a race condition between a managed thread and the finalizer thread. I can capture the time travel trace, but without thread static inspection support for generic class, I can't track down what is wrong with the data structure.

Here is a very simple repro:

using System;

namespace ThreadStaticInspectionRepro
{
    class ThreadStaticHolder<T>
    {
        [ThreadStatic]
        public static T ThreadStaticValue;
    }


    class Program
    {
        static void Main(string[] args)
        {
            ThreadStaticHolder<int>.ThreadStaticValue = 12;
            Console.ReadLine();
        }
    }
}

Launch it under WInDBG, break-in at the ReadLine, and inspect the ThreadStaticHolder class will lead to the failure

[mikem8361]

What exact commands do you use to "inspect the ThreadStaticHolder" class

[cshung]

Here is what I did, launch the repro under WinDBG and async break into the process while the repro stuck in the Console.ReadLine().

0:000> !DumpDomain
--------------------------------------
System Domain:      00007ffd39ed56f0
LowFrequencyHeap:   00007FFD39ED5C58
HighFrequencyHeap:  00007FFD39ED5CE8
StubHeap:           00007FFD39ED5D78
Stage:              OPEN
Name:               None
--------------------------------------
Domain 1:           00000200a1722dd0
LowFrequencyHeap:   00007FFD39ED5C58
HighFrequencyHeap:  00007FFD39ED5CE8
StubHeap:           00007FFD39ED5D78
Stage:              OPEN
Name:               clrhost
Assembly:           00000200a17d9570 [C:\Dev\ThreadStaticInspectionRepro\bin\Debug\netcoreapp3.1\win-x64\publish\System.Private.CoreLib.dll]
ClassLoader:        00000200A17D9620
  Module Name
00007ffcd9eb4020    C:\Dev\ThreadStaticInspectionRepro\bin\Debug\netcoreapp3.1\win-x64\publish\System.Private.CoreLib.dll

Assembly:           00000200a173c5a0 [C:\Dev\ThreadStaticInspectionRepro\bin\Debug\netcoreapp3.1\win-x64\publish\ThreadStaticInspectionRepro.dll]
ClassLoader:        00000200A173CAA0
  Module Name
00007ffcda0866d8    C:\Dev\ThreadStaticInspectionRepro\bin\Debug\netcoreapp3.1\win-x64\publish\ThreadStaticInspectionRepro.dll

Assembly:           00000200a172e580 [C:\Dev\ThreadStaticInspectionRepro\bin\Debug\netcoreapp3.1\win-x64\publish\System.Runtime.dll]
ClassLoader:        00000200A17DE130
  Module Name
00007ffcda087c98    C:\Dev\ThreadStaticInspectionRepro\bin\Debug\netcoreapp3.1\win-x64\publish\System.Runtime.dll

Assembly:           00000200bb6c2270 [C:\Dev\ThreadStaticInspectionRepro\bin\Debug\netcoreapp3.1\win-x64\publish\System.Console.dll]
ClassLoader:        00000200BB6C2320
  Module Name
00007ffcda0a5d88    C:\Dev\ThreadStaticInspectionRepro\bin\Debug\netcoreapp3.1\win-x64\publish\System.Console.dll

Assembly:           00000200bb6c37b0 [C:\Dev\ThreadStaticInspectionRepro\bin\Debug\netcoreapp3.1\win-x64\publish\System.Threading.dll]
ClassLoader:        00000200BB6C3860
  Module Name
00007ffcda0a6e88    C:\Dev\ThreadStaticInspectionRepro\bin\Debug\netcoreapp3.1\win-x64\publish\System.Threading.dll

Assembly:           00000200bb6c4cd0 [C:\Dev\ThreadStaticInspectionRepro\bin\Debug\netcoreapp3.1\win-x64\publish\System.Runtime.Extensions.dll]
ClassLoader:        00000200BB6C4D80
  Module Name
00007ffcda0a7838    C:\Dev\ThreadStaticInspectionRepro\bin\Debug\netcoreapp3.1\win-x64\publish\System.Runtime.Extensions.dll

Assembly:           00000200bb6c6a50 [C:\Dev\ThreadStaticInspectionRepro\bin\Debug\netcoreapp3.1\win-x64\publish\System.Text.Encoding.Extensions.dll]
ClassLoader:        00000200BB6C5F00
  Module Name
00007ffcda0ad078    C:\Dev\ThreadStaticInspectionRepro\bin\Debug\netcoreapp3.1\win-x64\publish\System.Text.Encoding.Extensions.dll

Now we zoom into the ThreadStaticInspectionRepro module, note the use of -mt to get the method tables.

0:000> !DumpModule -mt 00007ffcda0866d8
Name:       C:\Dev\ThreadStaticInspectionRepro\bin\Debug\netcoreapp3.1\win-x64\publish\ThreadStaticInspectionRepro.dll
Attributes: PEFile SupportsUpdateableMethods
Assembly:   00000200a173c5a0
PEFile:                  00000200A172ED30
ModuleId:                00007FFCDA086AA0
LoaderHeap:              0000000000000000
TypeDefToMethodTableMap: 00007FFCDA06C8A8
TypeRefToMethodTableMap: 00007FFCDA06C8C8
MethodDefToDescMap:      00007FFCDA06C940
FieldDefToDescMap:       00007FFCDA06C960
MemberRefToDescMap:      0000000000000000
FileReferencesMap:       00007FFCDA06C980
AssemblyReferencesMap:   00007FFCDA06C988
MetaData start address:  00000200A16C206C (1444 bytes)

Types defined in this module

              MT          TypeDef Name
------------------------------------------------------------------------------
00007ffcda0a5aa0 0x02000002 ThreadStaticInspectionRepro.ThreadStaticHolder`1
00007ffcda088318 0x02000003 ThreadStaticInspectionRepro.Program

Types referenced in this module

              MT            TypeRef Name
------------------------------------------------------------------------------
00007ffcd9fb0ab0 0x0200000c System.Object
00007ffcda0a6c08 0x0200000e System.Console
0:000> !DumpMT /d 00007ffcda0a5aa0
EEClass:         00007ffcda09c430
Module:          00007ffcda0866d8
Name:            ThreadStaticInspectionRepro.ThreadStaticHolder`1
mdToken:         0000000002000002
File:            C:\Dev\ThreadStaticInspectionRepro\bin\Debug\netcoreapp3.1\win-x64\publish\ThreadStaticInspectionRepro.dll
BaseSize:        0x18
ComponentSize:   0x0
Slots in VTable: 5
Number of IFaces in IFaceMap: 0

Now, zoom into the ThreadStaticInspectionRepro.ThreadStaticHolder`1 class:

0:000> !DumpClass /d 00007ffcda09c430
Class Name:      ThreadStaticInspectionRepro.ThreadStaticHolder`1
mdToken:         0000000002000002
File:            C:\Dev\ThreadStaticInspectionRepro\bin\Debug\netcoreapp3.1\win-x64\publish\ThreadStaticInspectionRepro.dll
Parent Class:    00007ffcd9fdbb18
Module:          00007ffcda0866d8
Method Table:    00007ffcda0a5aa0
Vtable Slots:    4
Total Method Slots:  5
Class Attributes:    100000  
NumInstanceFields:   0
NumStaticFields:     1
NumThreadStaticFields: 1
              MT    Field   Offset                 Type VT     Attr            Value Name
0000000000000000  4000001        0                  VAR  0 TLstatic  ThreadStaticValue
    >> Thread:Value <<

If we ran the WinDBG under another WinDBG, we will see the AV call stack. As we can see in the call stack, the initiating command is DumpClass and it is attempting to resolve the value of the ThreadStatic.

[mikem8361]

I spent some time looking into this and it would take a lot of work to support dynamic statics in the DAC and SOS. "Dynamic statics" are used in generic classes (and may be other scenarios) and never have been supported. The exception in the DAC's GetThreadLocalModuleData() function is a simple fix but that isn't enough. New DAC APIs would be required to take the DynamicClassTable and get the value of the generic class's static variables. I know this is holding you up Andrew but this is a lot a work right now.

/cc: @tommcdon

[mikem8361]

From @qingchuan Zhang

Hi Mike, I am Qingchuan from M365 Perf team. We've recently encountered the same issue as described in #818 during the development of our windbg extension.
Inspecting thread static value for generic class failed in SOS · Issue #818 · dotnet/diagnostics
Inspecting the value of a thread static field of the generic class is failing with the following AV (which is then swallowed and show nothing) 00 0000001dff0fb4e0 00007fff5710e41d mscordaccore!__...

I am wondering if the fix is already on schedule or still in backlog? I would like to help if there is a lack of resource for that fix. Is there anything I can read other than the DAC notes in the book of the runtime?

If we do find time to implement this feature, it would only be in our 7.0 release. This would probably be way to much to backport to a 6.0 service release.

[qingchuan]

来信已收到。GOOD LUCK!