WPA - Symbols from my application PDB not shown in the New Thread Stack (?!?)

Razvan Sirbu 0 Reputation points

I wrote a simple test application in C# WinForms (Visual Studio 2015) called RSWPA to understand how to use the WPA.

The New Thread Stack column cannot display the symbols defined in my application (just a simple exe, no dlls).

All the PDBs are loaded including RSWPA.pdb:

User's image

but in the New Thread Stack column, I got:

User's image

I'm using WPA version

The SymCache folder contains the correct version and I can see my symbols in the file

User's image

I found on the internet several similar questions but without an answer/solution.

Can somebody help?



Windows Performance Toolkit
Windows Performance Toolkit
A collection of Microsoft performance monitoring tools that produce in-depth performance profiles of Windows operating systems and applications.
64 questions
{count} votes

1 answer

Sort by: Most helpful
  1. Gary Nebbett 5,426 Reputation points

    Hello Razvan,

    This picture of a WPA Analysis View shows why there are no symbolic names for your application:

    User's image

    RSWPA.exe did not generate any of the DotNET events needed to map native addresses to IL addresses and .NET classes/methods. RSWPA.vshost.exe did produce the right type of events, but that is not your application (RSWPA.exe).

    So, I would say that WPA is working correctly. The mystery is why no DotNETRuntime events were recorded for the application but that is (potentially) a DotNETRuntime issue and not a WPA problem. I see that the application is running as a 32 bit application under WOW.

    I am currently trying to reproduce that behaviour (no DotNETRuntime events for a process when DotNETRuntime tracing is enabled). My suspicion is that RSWPA.exe is "suspended" by a debugger at the time that the events would have been generated and is therefore not able to participate.


    I am now fairly sure that RSWPA.exe is "suspended" by a debugger and is not able to participate in DotNET Runtime Rundown event generation. RSWPA.exe may well have run to completion and is possibly stopped at the final (intrinsic) debugger breakpoint (e.g. ntdll!NtTerminateProcess+0x14 or wow64cpu!CpupSyscallStub+0x13).