Poonam Bajaj's Blog

Windows crash dumps for Java Processes

Poonam Parhar
Consulting Member of Technical Staff
Windows Crash Dump is memory dump of a process running on a Windows system. These dumps can be very useful for debugging Java process crashes. In this entry I discuss how to collect sane Crash Dumps for Java process crashes on Windows machines that can later be analyzed using Windbg or other 'Debugging Tools For Windows'.
I have a simple java class test which uses native library test.dll using JNI. test.dll implements a 'native' method where it accesses a null pointer and causes a crash. Complete source of this crashing program is here

Windows NT, 2000 and XP
Let's first run this program on a Windows NT/2000/XP machine:
D:\\demo>java test
# An unexpected error has been detected by Java Runtime Environment:
# EXCEPTION_ACCESS_VIOLATION (0xc0000005) at pc=0x10011f68, pid=2020, tid=640
# Java VM: Java HotSpot(TM) Client VM (10.0-b19 mixed mode, sharing windows-x86)
# Problematic frame:
# C [test.dll+0x11f68]
# An error report file with more information is saved as:
# D:\\demo\\hs_err_pid2020.log
# If you would like to submit a bug report, please visit:
# http://java.sun.com/webapps/bugreport/crash.jsp
# The crash happened outside the Java Virtual Machine in native code.
# See problematic frame for where to report the bug.
Running this program created an hs_err log file in the same folder. Error log file contains the following stack trace:
C [test.dll+0x1032]
j test.f()V+0
j test.main([Ljava/lang/String;)V+19
v ~StubRoutines::call_stub
V [jvm.dll+0x873ed]
V [jvm.dll+0xdfb96]
V [jvm.dll+0x872be]
V [jvm.dll+0x8e501]
C [java.exe+0x14c5]
C [java.exe+0x69cd]
C [kernel32.dll+0x16fd7]
Now, let's run it with -XX:+ShowMessageBoxOnError JVM option. I get the following message box:

Attaching Visual Studio or Windbg to this process or collecting a crash dump with Dr Watson and opening that crash dump with Windbg shows the following call trace:
This shows JVM's error handling frames and does not show that the crash happened in function test.f().
This is because, by default, the First Chance Exceptions are not sent to the System Debugger. And Debuggers receive only the Second Chance Exceptions. The exception in test.f() was a first Chance Exception that was hanlded by JVM. Please see details on First and Second chance exceptions: http://support.microsoft.com/kb/286350

So how can we collect crash dumps that contain the correct stack trace of the crash. Let's try 'adplus' to collect the crash dumps.
Start adplus in crash mode:
D:\\windbg>adplus -crash -pn java.exe
and then start your java process with -XX:+ShowMessageBoxOnError
By default, adplus creates mini dumps on First Chance Exceptions and full memory dumps on Second Chance Exceptions. It can be changed; details here: http://support.microsoft.com/kb/286350

'adplus' would create dump files in a folder like Crash_Mode__Date_08-12-2008__Time_15-12-56PM. Using Windbg, open the dump created at First Chance Exception and it shows the crashing frame as:
Ah! that's what I was looking for.

Windows 2008 and Windows Vista
Dr. Watson is not available on Windows 2008 and Windows Vista
Starting with Windows Server 2008 and Windows Vista Service Pack1 (SP1), Windows has new error reporting mechanism called 'Windows Error Reporting' or WER. WER can be configured so that full user-mode dumps are collected and stored locally after a user-mode application crashes. This feature is not enabled by default. Enabling this feature requires administrator privileges. To enable and configure the feature, we need to use the following registry values under the
HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\Windows Error Reporting\\LocalDumps key.
Details here:


And yes, here also we can use 'adplus' to collect Crash Dumps for First Chance and Second Chance Exceptions.

Enjoy Debugging !

Join the discussion

Comments ( 7 )
  • Yoshinori Toshima Monday, December 1, 2008

    It is annoying that we can get only hs_err or a dump.

    If possible, please explain why and if there is a room for

    improvement. If you can provide explanation based on

    topLevelExceptionFilter implmenentation, that would

    make things much clearer.

    The crash dump behavior depends on registry

    HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NTCurrentVersion\\AeDebug\\\*

    (especially whether Auto is 0 or 1) and it would be nice

    if you can provide explanations around this.

    A customer send both hs_err and the process dump for a

    crash and I wondered why. In hs_err, it turned out that

    they used -XX:OnError="drwtsn32 -p %p" option to get

    both. This worked well when I tried with some crashes,

    but it seems sometimes we may get an error which says

    the process is already attached by other debugger

    (according to a customer). As OnError creates an external

    process and tries to attach to the caller, error like this

    may happen due to debugger configuration conflicts.

    As there is no drwtsn32 on Vista, this method does not

    work. I'm not sure if userdump.exe, which is included in

    separate package for older Windows, works.

    If we can get both hs_err and dump (just like unix), they make

    debugging much easier and please check a reliable way to get both...

  • Ivan Krylov Thursday, December 4, 2008

    Installing adplus as the first chance debugger can make vm crash where it should not. Some Windows exceptions are normal for Hotspot operation. See implemetation of topLevelExceptionFilter, whereever we return there EXCEPTION_CONTINUE_EXECUTION it means jvm can continue it's execution.

    However I do agree with Yoshinori that it would be nice if hotspot could optionally generate a hs_err_log before reporting a crash. Some work is in progress in this area - see CR 6227246.

  • Poonam Bajaj Thursday, December 4, 2008

    Thanks Ivan for this useful information. Yes I agree that having first chance exception enabled in the debugger will cause unwanted dumps also. But the dump just befor the second chance exception can be useful to get to the root cause of the crash.

    The fix for 6227246 would be really useful. I just tested, with option UseOSErrorReporting, Dr watson also creates dump for the actual crash rather than for the VM error handler.



  • Ivan Krylov Monday, February 2, 2009

    Yoshinori, please be advised of improvements in this area. Update 14 of JDK6 will contain a new flag that allows to create both hs_err and crash dump with a single crash.

    Also you may use userdump.exe application instead of drwtsnt32 to create a dump. AFAIK, userdump should work on Vista too.



  • sandi miller Saturday, February 14, 2009

    I think it is sad that I am unable to get the information I need. I also am going to be very leary of using any more java updates on my computer. Message I got iscrash happened outside the java virtual machine in native code see problematic frame for where to report the bug. Now I want to know how to get rid of it. It is affecting my ability to play in yahoo games and pogo games. Please help

  • Emma Wednesday, November 10, 2010

    Can not play games right

  • sandra meckley Friday, January 28, 2011

    i keep getting hr_err_pid1 when i am playing games on pogo it is constantly doing this

Please enter your name.Please provide a valid email address.Please enter a comment.CAPTCHA challenge response provided was incorrect. Please try again.