目錄
示例代碼
#include <iostream>
#include <stdlib.h>
#include <windows.h>
#include <process.h>
static CRITICAL_SECTION g_cs1;
static CRITICAL_SECTION g_cs2;
unsigned int __stdcall threadFunc1(LPVOID lp)
{
std::cout << "Enter threadFunc1" << std::endl;
EnterCriticalSection(&g_cs1);
Sleep(10);
EnterCriticalSection(&g_cs2);
// do something
LeaveCriticalSection(&g_cs2);
LeaveCriticalSection(&g_cs1);
std::cout << "Leave threadFunc1" << std::endl;
return 0;
}
unsigned int __stdcall threadFunc2(LPVOID lp)
{
std::cout << "Enter threadFunc2" << std::endl;
EnterCriticalSection(&g_cs2);
Sleep(10);
EnterCriticalSection(&g_cs1);
// do something
LeaveCriticalSection(&g_cs1);
LeaveCriticalSection(&g_cs2);
std::cout << "Leave threadFunc2" << std::endl;
return 0;
}
int main()
{
InitializeCriticalSection(&g_cs1);
InitializeCriticalSection(&g_cs2);
_beginthreadex(NULL, 0, threadFunc1, 0, 0, NULL);
_beginthreadex(NULL, 0, threadFunc2, 0, 0, NULL);
system("pause");
return 0;
}
運行
並未輸出：Leave threadFunc1 及 Leave threadFunc2
分析
1. 輸入指令：!locks
|
*** WARNING: Unable to verify checksum for DeadLock.exe CritSec DeadLock!g_cs1+0 at 0133437c WaiterWoken No LockCount 1 RecursionCount 1 OwningThread 6284 EntryCount 0 ContentionCount 1 *** Locked
CritSec DeadLock!g_cs2+0 at 01334394 WaiterWoken No LockCount 1 RecursionCount 1 OwningThread 7288 EntryCount 0 ContentionCount 1 *** Locked
Scanned 109 critical sections |
經過分析，我們發現有兩個鎖，一個是g_cs1，地址爲0133437c，其所屬線程爲6284；另一個是g_cs2，地址爲01334394，其所屬線程爲7288。爲方便，以表格形式展示：
|
鎖名稱 |
鎖地址 |
所屬線程 |
|
g_cs1 |
0133437c |
6284 |
|
g_cs2 |
01334394 |
7288 |
2. 查看所有線程：~
|
0 Id: 7084.737c Suspend: 1 Teb: 7efdd000 Unfrozen 1 Id: 7084.6284 Suspend: 1 Teb: 7efda000 Unfrozen 2 Id: 7084.7288 Suspend: 1 Teb: 7efd7000 Unfrozen 3 Id: 7084.7048 Suspend: 1 Teb: 7ef9f000 Unfrozen |
從線程信息可以看到，線程6282及7288當前的狀態都是Suspend（7084表示進程號）。1是6284線程的相對線程號，2是7288線程的相對線程號。
3. 分別查看線程6284及7288的堆棧：
查看線程6248堆棧：~1 kb
|
# ChildEBP RetAddr Args to Child 00 0088f7b8 7773eb4e 00000044 00000000 00000000 ntdll!NtWaitForSingleObject+0x15 01 0088f81c 7773ea32 00000000 00000000 0063f8a0 ntdll!RtlpWaitOnCriticalSection+0x13e 02 0088f844 01331045 01334394 01331000 01331000 ntdll!RtlEnterCriticalSection+0x150 03 0088f85c 65a262e4 00000000 5230abd3 00000000 DeadLock!threadFunc1+0x45 [f:\總結文檔\windbg\deadlock\deadlock\deadlock.cpp @ 23] 04 0088f898 75d9336a 0063f8a0 0088f8e4 777298f2 ucrtbase!thread_start<unsigned int (__stdcall*)(void *)>+0x54 05 0088f8a4 777298f2 0063f8a0 74cb5f34 00000000 kernel32!BaseThreadInitThunk+0xe 06 0088f8e4 777298c5 65a26290 0063f8a0 00000000 ntdll!__RtlUserThreadStart+0x70 07 0088f8fc 00000000 65a26290 0063f8a0 00000000 ntdll!_RtlUserThreadStart+0x1b |
6284線程當前在等待鎖01334394，也即g_cs2
查看線程7288堆棧：~2 kb
|
# ChildEBP RetAddr Args to Child 00 009efdf8 7773eb4e 00000048 00000000 00000000 ntdll!NtWaitForSingleObject+0x15 01 009efe5c 7773ea32 00000000 00000000 0063f900 ntdll!RtlpWaitOnCriticalSection+0x13e 02 009efe84 013310d5 0133437c 01331090 01331090 ntdll!RtlEnterCriticalSection+0x150 03 009efe9c 65a262e4 00000000 5226ad93 00000000 DeadLock!threadFunc2+0x45 [f:\總結文檔\windbg\deadlock\deadlock\deadlock.cpp @ 38] 04 009efed8 75d9336a 0063f900 009eff24 777298f2 ucrtbase!thread_start<unsigned int (__stdcall*)(void *)>+0x54 05 009efee4 777298f2 0063f900 74dd58f4 00000000 kernel32!BaseThreadInitThunk+0xe 06 009eff24 777298c5 65a26290 0063f900 00000000 ntdll!__RtlUserThreadStart+0x70 07 009eff3c 00000000 65a26290 0063f900 00000000 ntdll!_RtlUserThreadStart+0x1b |
7288線程當前在等待鎖0133437c，也即g_cs1
結論
將上述分析結果以表格形式彙總：
從彙總結果看，線程1,2形成了死鎖。
擴展
1. !cs Address：顯示指定臨界區
|
0:001> !cs 01334394 ----------------------------------------- Critical section = 0x01334394 (DeadLock!g_cs2+0x0) DebugInfo = 0x0063f868 LOCKED LockCount = 0x1 WaiterWoken = No OwningThread = 0x00007288 RecursionCount = 0x1 LockSemaphore = 0x44 SpinCount = 0x00000000 |
2. !cs –l ：顯示鎖定的臨界區
|
0:001> !cs -l ----------------------------------------- DebugInfo = 0x0063f0a8 Critical section = 0x0133437c (DeadLock!g_cs1+0x0) LOCKED LockCount = 0x1 WaiterWoken = No OwningThread = 0x00006284 RecursionCount = 0x1 LockSemaphore = 0x48 SpinCount = 0x00000000 ----------------------------------------- DebugInfo = 0x0063f868 Critical section = 0x01334394 (DeadLock!g_cs2+0x0) LOCKED LockCount = 0x1 WaiterWoken = No OwningThread = 0x00007288 RecursionCount = 0x1 LockSemaphore = 0x44 SpinCount = 0x00000000 |
3. !cs –o：Displays the owner's stack for any locked critical section that is being displayed
參考資料
1. 調試死鎖
2. !deadlock
