Application crashes issues in .net application RRS feed

  • Question

  • Greetings!!.

    I have a couple of weird issues recently with my VB.net(.net 4) desktop application which has been working fine for other clients but crashing for a couple of clients very randomly. I already have a global level exception handling done for CurrentDomain.UnhandledException and Application.ThreadException, which are not getting called when these exceptions occur. The <g class="gr_ gr_38 gr-alert gr_spell gr_inline_cards gr_run_anim ContextualSpelling" data-gr-id="38" id="38">exe</g> simply crashes with following exception details in the Win Event Viewer.

    Issue 1:
    Description: The process was terminated due to an unhandled exception. Exception Info: System.AccessViolationException 
    This issue happens very randomly at any place. It gives me some call stacks like following in the Win Event Viewer, but I am not able to make a proper judgment on why it fails here. The form that is getting called has simple controls. The FAILURE_ID_HASH_STRING from the windows memory dump shows for AccessViolationException kind of issues like 'um:null_class_ptr_read_c0000005_system.windows.forms.dll!unknown', 'um:heap_corruption_actionable_blocknotbusy_double_free_c0000005_clr.dll!<g class="gr_ gr_35 gr-alert gr_spell gr_inline_cards gr_run_anim ContextualSpelling" data-gr-id="35" id="35">eeheapfreeinprocessheap</g>'.
    Application: MyApp.exe Framework Version: v4.0.30319 Description: The process was terminated due to an unhandled exception. Exception Info: System.AccessViolationException  
    Stack: at System.Windows.Forms.UnsafeNativeMethods.CallWindowProc(IntPtr, IntPtr, Int32, IntPtr, IntPtr) at System.Windows.Forms.NativeWindow.DefWndProc(System.Windows.Forms.Message ByRef) at System.Windows.Forms.ToolTip.WndProc(System.Windows.Forms.Message ByRef) at System.Windows.Forms.ToolTip+ToolTipNativeWindow.WndProc(System.Windows.Forms.Message ByRef) at System.Windows.Forms.NativeWindow.Callback(IntPtr, Int32, IntPtr, IntPtr) at System.Windows.Forms.UnsafeNativeMethods.DispatchMessageW(MSG ByRef) at System.Windows.Forms.Application+ComponentManager.System.Windows.Forms.UnsafeNativeMethods.IMsoComponentManager.FPushMessageLoop(IntPtr, Int32, Int32) at System.Windows.Forms.Application+ThreadContext.RunMessageLoopInner(Int32, System.Windows.Forms.ApplicationContext) at System.Windows.Forms.Application+ThreadContext.RunMessageLoop(Int32, System.Windows.Forms.ApplicationContext) at System.Windows.Forms.Application.RunDialog(System.Windows.Forms.Form) at System.Windows.Forms.Form.ShowDialog(System.Windows.Forms.IWin32Window) at System.Windows.Forms.Form.ShowDialog() at ClientUIEFileSystem.EFileManager.MyAppImageButton_Scan_Click(System.Object, System.EventArgs) 

    Issue 2:
    Faulting application name: MyApp.exe, version:, time stamp: 0x5bbc4f12 Faulting module name: ntdll.dll, version: 6.1.7601.24260, time stamp: 0x5b946ce2 Exception code: 0xc0000005 Fault offset: 0x0002e4c3 Faulting process id: 0x13c0 Faulting application start time: 0x01d4776667309568 Faulting application path: C:\Program Files\First Insight\MyApp Client\MyApp.exe Faulting module path: C:\Windows\SysWOW64\ntdll.dll Report Id: 71e8befe-e389-11e8-b1c9-005056bc600d 
    Application: MyApp.exe Framework Version: v4.0.30319 Description: The process was terminated due to an unhandled exception. Exception Info: exception code c0000005, exception address 770FE4C3  

    This issue doesn't show any other call stacks even in the Event Viewer. 

    I have multiple windows dump files captured for these issues and I can see these Dumps in the WinDbg. Different types of FAILURE_ID_HASH_STRING from Dumps are um:heap_corruption_c0000005_heap_corruption!MyApp.exe, um:invalid_pointer_read_actionable_blocknotbusy_c0000005_clr.dll!<g class="gr_ gr_36 gr-alert gr_spell gr_inline_cards gr_run_anim ContextualSpelling" data-gr-id="36" id="36">rtlfreeheap</g>, um:null_class_ptr_read_c0000005_system.windows.forms.dll!unknown, um:heap_corruption_actionable_blocknotbusy_double_free_c0000005_clr.dll!<g class="gr_ gr_37 gr-alert gr_spell gr_inline_cards gr_run_anim ContextualSpelling" data-gr-id="37" id="37">eeheapfreeinprocessheap</g>.

    Any help or guidance will greatly help me to get to the root causes of these issues. Thanks in advance. 


    Friday, November 9, 2018 10:28 AM

All replies

  • Yeah the c0000005 Access Violations are native and considered "critical" so not getting any logs/exception handlers thrown in your app isn't surprising.  ..  If you are able to reproduce it fairly easily and want to try to do any type of Exception handling at the managed level for these  there is an option in newer versions of .net that allow you to try handling it.   You might be able to get better managed stack frames and heap info this way on a test machine.  Check into this "handleprocesscorruptedstate*" 

       system.runtime.exceptionservices handleprocesscorruptedstateexceptionsattribute

    I tried giving you a link to MSDN but I can't add links in posts sorry I am really partial to using Perfview / ETW when I have to hunt down native issues (I had to just recently root cause COM interop/AV on unloaded OCX race conditions) because it does a good job at getting you both native and managed call stacks and you can also turn on native memory allocations/deallocs in parallel with GC information which lines up nicely when looking at it in WPA/Perfview 

    Also, I always focus on what is different/changed on the once working clients IE was it updated with any OS or Security patches?  (Access Violations are fun when your Antivirus stuff kicks in).. or are the client's on different versions of .Net? received a new .net patch or is one on Windows 7 and other on Windows 10 and 4.6.1 versus 4.7.1  etc.... 

    I have seen issues with .Net controls that were built and working just fine until that client upgraded/installed a new .net update.... 

    With what info you have provided and it were me I would be setting up the ETW traces and maybe even procdump to dump right on the first AV you got those are always my first go to tools and usually give me what I need 

    Good luck!
    Saturday, November 10, 2018 1:01 AM
  • Hi PseudoRandom1,
    Thanks for the detailed help. I am not able to reproduce it easily, it is customer environment and issue randomly gets reproduced weekly once/twice. Did you mean that latest .net version allows to capture .net errors like [HandleProcessCorruptedStateExceptions] decorators in the exception handlers?
    Let me give a try with ETW/<g class="gr_ gr_15 gr-alert gr_spell gr_inline_cards gr_run_anim ContextualSpelling ins-del multiReplace" data-gr-id="15" id="15">PerView</g> if I can capture some of these details. At <g class="gr_ gr_16 gr-alert gr_spell gr_inline_cards gr_run_anim ContextualSpelling ins-del multiReplace" data-gr-id="16" id="16">leastd</g> all of these FAILURE_ID_HASH_STRING pointing me to the improper read and writes to <g class="gr_ gr_17 gr-alert gr_gramm gr_inline_cards gr_run_anim Grammar only-ins replaceWithoutSep" data-gr-id="17" id="17">heap</g> which I need to find and avoid.

    I have tried all the variations of .net versions, security patches <g class="gr_ gr_18 gr-alert gr_gramm gr_inline_cards gr_run_anim Punctuation only-ins replaceWithoutSep" data-gr-id="18" id="18">and</g> OS upgrades and rollbacks. Nothing is helping :(.

    Thanks again for the help. I will get back to you soon with my findings. I am still keeping this thread open just to see what all suggestions I can get to resolve this quickly.


    Monday, November 12, 2018 12:45 PM