什么是 ntdll.dll?RcConsolidateFrames？

Question

I have a call stack like below from my dump file. I want to find my code in the call stack, but I can't. What is start point to analyze my dump? Link option of my program is release/Od.

msvcr120.dll!abort() 
msvcr120.dll!terminate()
msvcp120.dll!_Call_func$catch()
msvcr120.dll!_CallSettingFrame()
msvcr120.dll!__CxxCallCatchBlock(_EXCEPTION_RECORD * pExcept=0x0000002885f9b010)
ntdll.dll!RcConsolidateFrames()
msvcp120.dll!_Call_func(void * _Data=0x00000028835d5ce0)
msvcr120.dll!_callthreadstartex()
msvcr120.dll!_threadstartex(void * ptd=0x000000288366e410)
kernel32.dll!BaseThreadInitThunk()
ntdll.dll!RtlUserThreadStart()

Answer 1

TL;DR : If you re- throw; the call stack will not show the original location, but something further up the stack and ntdll.dll!RcConsolidateFrames() .

---

You will find ntdll.dll!RcConsolidateFrames() in your call stack for an unhandled exception instead of the actual location when the code uses catch(ANYTHING) + throw; in an x64 binary .

You see, if you catch and re-throw, the original call stack has been already unwound , and when you then throw; it will re-throw the original exception, but the call stack information is now messed up.

My observations for MSVC is that this will always happen with any throw; that is then unhandled and leads to a dump file. Specifically:

• It does not matter whether you use catch(...) or catch(cppTypeEx&)
• It does not matter whether it is a C++ exception (with /EHsc or /EHa ) or a SEH exception (with /EHa ).
• It will look like this in the debugger as well as in a dump file.

Bottom line: throw; will mess up your call stack