Crashpad Crash Dumps: Debugging Runaway Diagnostic Processes

If you woke up to find your disk space mysteriously evaporating or noticed your system groaning under unexpected I/O load, you’re not alone. A GitHub issue tracking OpenAI’s Codex Desktop just hit the front page of Hacker News with 99 points and climbing—developers are reporting that the application continuously generates Crashpad pending dumps, filling their systems with diagnostic data that was supposed to help, not harm. This isn’t just an OpenAI problem; it’s a textbook case of what happens when crash reporting frameworks go rogue, and it’s a perfect opportunity to learn how to identify, control, and prevent runaway diagnostic processes in your own infrastructure.

Crashpad is Google’s crash-reporting system, designed to capture application crashes and generate minidumps for post-mortem analysis. It’s incredibly valuable when it works correctly, but when it malfunctions—generating dumps continuously instead of only on actual crashes—it becomes a storage-devouring monster. Understanding how to diagnose and mitigate these issues is critical for anyone managing desktop applications, particularly Electron-based tools that bundle Crashpad by default.

Table of Contents

• What Is Crashpad and Why Does It Matter?
• Identifying Runaway Crash Dump Generation
• Diagnostic Commands and Techniques
• Controlling Crashpad Behavior
• Prevention Strategies for Production Systems

What Is Crashpad and Why Does It Matter?

Crashpad replaced Google’s older Breakpad system and has become the de facto crash reporter for Chromium-based applications, including Electron apps like VS Code, Slack, Discord, and yes, OpenAI’s Codex Desktop. When an application crashes, Crashpad captures memory state, stack traces, and system information, writing this data to disk as a minidump file. These files live in a “pending” directory until they’re either uploaded to a crash reporting server or cleaned up by the application.

The problem arises when the triggering mechanism goes haywire. Instead of capturing one dump per actual crash, a bug in the application’s signal handling, exception processing, or Crashpad integration can cause it to think it’s crashing repeatedly—even when it’s running normally. Each perceived crash generates a new dump file, typically ranging from a few kilobytes to hundreds of megabytes depending on memory footprint. Multiply that by dozens or hundreds of false crashes per hour, and you’ve got a storage crisis.

For IT professionals managing fleets of desktop applications or investigating performance issues, understanding the Crashpad lifecycle is essential. Many developers simply bundle it without fully understanding its configuration surface. Platforms like Coursera offer crash analysis and debugging courses that cover these frameworks in depth, helping you move beyond surface-level troubleshooting.

Identifying Runaway Crash Dump Generation

The first symptom is usually disk space alerts or sluggish system performance. On macOS, Crashpad typically stores pending dumps in ~/Library/Application Support/[AppName]/Crashpad/pending. On Windows, look under %LOCALAPPDATA%\[AppName]\User Data\Crashpad\reports. Linux follows a similar pattern under ~/.config/[AppName]/Crashpad.

Here’s a quick diagnostic command for macOS/Linux to count pending dumps and check their timestamps:

# Count pending Crashpad dumps and show creation times
find ~/Library/Application\ Support/*/Crashpad/pending -type f -name "*.dmp" -exec stat -f "%Sm %N" -t "%Y-%m-%d %H:%M:%S" {} \; | sort

This command recursively searches application support directories for dump files, displays their modification times in human-readable format, and sorts them chronologically. If you see dozens or hundreds of dumps created within minutes or hours, you’ve confirmed runaway generation.

On Windows, PowerShell provides equivalent functionality:

# List Crashpad dumps with timestamps sorted by creation time
Get-ChildItem -Path "$env:LOCALAPPDATA\*\User Data\Crashpad\reports" -Recurse -Filter "*.dmp" | Select-Object FullName, CreationTime | Sort-Object CreationTime

Diagnostic Commands and Techniques

Once you’ve identified the dump files, the next step is understanding why they’re being generated. Minidump files can be analyzed using platform-specific debuggers. On macOS, you can use lldb; on Windows, WinDbg is the gold standard; Linux users typically rely on gdb with minidump support.

For a quick inspection without a full debugger setup, minidump_stackwalk from Google’s Breakpad tools can extract human-readable stack traces. If you’re working with Electron applications specifically, understanding crash reporting integrations is crucial knowledge that platforms like DataCamp touch on in their system monitoring and observability tracks.

Examining Process Behavior

Beyond the dumps themselves, watch the application’s runtime behavior. On Unix-like systems, dtruss or strace can reveal whether Crashpad’s handler process is spawning repeatedly:

# Monitor system calls related to crash reporting (macOS)
sudo dtruss -f -n "Codex Desktop" 2>&1 | grep -i crash

This traces all system calls made by the Codex Desktop process and its children, filtering for crash-related activity. If you see continuous file creation operations in Crashpad directories, you’ve found your smoking gun. The key is correlating these file operations with application state—is the app actually crashing, or is something else triggering the crash reporter?

Controlling Crashpad Behavior

Immediate mitigation often means disabling or rate-limiting crash reporting until the underlying bug is fixed. Electron applications typically expose Crashpad controls through command-line flags or environment variables. The --disable-crash-reporter flag works for many Chromium-based apps:

# Launch application with crash reporter disabled
open -a "Codex Desktop" --args --disable-crash-reporter

For more granular control, you can set the BREAKPAD_DUMP_LOCATION environment variable to redirect dumps to a location you control, making them easier to monitor and clean up programmatically. Some organizations create wrapper scripts that launch applications with these flags by default, preventing runaway dumps across their entire fleet.

Rate Limiting at the Filesystem Level

For quick relief on production systems where you can’t modify application launch parameters, filesystem quotas or scheduled cleanup jobs can contain the damage. A simple cron job that deletes dumps older than an hour can prevent disk exhaustion while you investigate:

# Cron job to clean up old Crashpad dumps (run hourly)
0 * * * * find ~/Library/Application\ Support/*/Crashpad/pending -type f -name "*.dmp" -mmin +60 -delete

This isn’t a fix—it’s a tourniquet. But when your monitoring alerts are screaming about disk space at 95%, you need breathing room to implement a proper solution.

Prevention Strategies for Production Systems

If you’re developing or deploying applications that use Crashpad, prevention starts at the integration layer. Always implement these safeguards:

Upload and Cleanup Logic

Ensure your crash reporting integration actually uploads dumps and cleans up pending files. The Codex Desktop issue suggests this cleanup cycle broke, allowing dumps to accumulate indefinitely. Your integration should enforce maximum pending dump counts and implement exponential backoff for upload retries.

Health Checks and Monitoring

Add monitoring specifically for crash dump accumulation. Alert when pending dump counts exceed thresholds or when dump creation rate spikes. This isn’t just about Crashpad—any diagnostic or logging system can exhibit runaway behavior. Your observability stack should treat diagnostic data accumulation as a first-class metric.

Testing Exception Handling

Crashpad triggers are often tied to signal handlers or exception filters. Thoroughly test these code paths, including edge cases like rapid sequential exceptions or exceptions during exception handling. Fuzzing and chaos engineering techniques can surface these issues before they hit production.

The OpenAI Codex Desktop incident is a reminder that even sophisticated engineering teams ship bugs in diagnostic infrastructure—the very systems designed to help debug other problems. By understanding how crash reporters work under the hood, you’re better equipped to identify when they’re malfunctioning and how to contain the damage. This knowledge extends beyond Crashpad to any crash reporting, logging, or diagnostic framework in your environment.