Access violation at COMUnhandledExceptionFilter

[dmalukov]

Description

Apparently, gCurrentThreadInfo (threads.inl) is null.

inline Thread* GetThreadNULLOk()
{
    return gCurrentThreadInfo.m_pThread;
}

[0x1]   coreclr!COMUnhandledExceptionFilter+0x1e [D:\a\_work\1\s\src\coreclr\vm\excep.cpp @ 4769]   0x6f3ef7d0c0   0x7ffd15cc9f73   
[0x2]   KERNELBASE!UnhandledExceptionFilter+0x1f3   0x6f3ef7d0f0   0x7ffd188453fa   
[0x3]   ntdll!RtlUserThreadStart$filt$0+0x3f   0x6f3ef7d1e0   0x7ffd187fe963   
[0x4]   ntdll!_C_specific_handler+0x93   0x6f3ef7d210   0x7ffd188406ff   
[0x5]   ntdll!RtlpExecuteHandlerForException+0xf   0x6f3ef7d280   0x7ffd1871a328   
[0x6]   ntdll!RtlDispatchException+0x2c8   0x6f3ef7d2b0   0x7ffd1884003e   
[0x7]   ntdll!KiUserExceptionDispatch+0x2e   0x6f3ef7da80   0x7ffc5c6b001e   
[0x8]   coreclr!GetThreadNULLOk+0x14 [D:\a\_work\1\s\src\coreclr\vm\threads.inl @ 37]   (Inline Function)   (Inline Function)   
[0x9]   coreclr!COMUnhandledExceptionFilter+0x1e [D:\a\_work\1\s\src\coreclr\vm\excep.cpp @ 4769]   0x6f3ef7e1c0   0x7ffd15cc9f73   
[0xa]   KERNELBASE!UnhandledExceptionFilter+0x1f3   0x6f3ef7e1f0   0x7ffd188372fe   
[0xb]   ntdll!TppWorkerpInnerExceptionFilter+0x1a   0x6f3ef7e2e0   0x7ffd18843061   
[0xc]   ntdll!TppWorkerThread$filt$5+0x19   0x6f3ef7e310   0x7ffd187fe963   
[0xd]   ntdll!_C_specific_handler+0x93   0x6f3ef7e360   0x7ffd1883bb2e   
[0xe]   ntdll!_GSHandlerCheck_SEH+0x6a   0x6f3ef7e3d0   0x7ffd188406ff   
[0xf]   ntdll!RtlpExecuteHandlerForException+0xf   0x6f3ef7e400   0x7ffd1871a328   
[0x10]   ntdll!RtlDispatchException+0x2c8   0x6f3ef7e430   0x7ffd1884003e   
[0x11]   ntdll!KiUserExceptionDispatch+0x2e   0x6f3ef7ec00   0x7ffd1878cbe1   
[0x12]   ntdll!RtlpHpLfhOwnerMoveSubsegment+0x191   0x6f3ef7f330   0x7ffd1878cd10   
[0x13]   ntdll!RtlpHpLfhOwnerRunMaintenance+0x90   0x6f3ef7f3d0   0x7ffd1873f73d   
[0x14]   ntdll!RtlpHpLfhOwnerCompact+0x1ed   0x6f3ef7f470   0x7ffd1873f415   
[0x15]   ntdll!RtlpHpLfhContextCompact+0x195   0x6f3ef7f5f0   0x7ffd1873db13   
[0x16]   ntdll!RtlpHpGCFlushCallback+0x43   0x6f3ef7f640   0x7ffd1874b88e   
[0x17]   ntdll!RtlpEnumProcessHeaps+0xae   0x6f3ef7f670   0x7ffd18749ab6   
[0x18]   ntdll!RtlpHpGCCallback+0x16   0x6f3ef7f6d0   0x7ffd18714f06   
[0x19]   ntdll!TppTimerpExecuteCallback+0x1d6   0x6f3ef7f700   0x7ffd186f5cbd   
[0x1a]   ntdll!TppWorkerThread+0x80d   0x6f3ef7f740   0x7ffd1671e8d7   
[0x1b]   kernel32!BaseThreadInitThunk+0x17   0x6f3ef7faa0   0x7ffd187914fc   
[0x1c]   ntdll!RtlUserThreadStart+0x2c   0x6f3ef7fad0   0x0   

The full crash dump is available here.

OS Version: 10.0.26100
CLR Version: 9.0.325.11113

[dmalukov]

I assume the app misbehaves in a way that there are too many threads created.
Nonetheless, the runtime should not crash.

[jkotas]

We can add a check like this

runtime/src/coreclr/vm/excep.cpp

Lines 7011 to 7015 in 4420903

	if (NtCurrentTeb()->ThreadLocalStoragePointer == NULL)
	{
	// Ignore exceptions early during thread startup before the thread is fully initialized by the OS
	return EXCEPTION_CONTINUE_SEARCH;
	}

to avoid crashing in coreclr.dll

[dmalukov]

@jkotas are there any plans to include the fix in one of the upcoming servicing updates?

[jkotas]

I assume the app misbehaves in a way that there are too many threads created

I have looked at your dump. The crash is not caused by too many threads. The original fault occurred in RtlpHpLfhOwnerMoveSubsegment. It is caused by unmanaged heap corruption - use-after-free, double-free or buffer overrun in unmanaged code. The corrupted memory contains a string {0.0.0.00000000}.{f7922446-79e8-46b3-a021-7f116af84e30}. It may be a clue for where the memory corruption is coming from.

are there any plans to include the fix in one of the upcoming servicing updates?

I do not expect this fix to be included in servicing. The app is going is about to crash anyway. The potential fix just makes this crash a tiny bit easier to diagnose. However, all bets are off with unmanaged heap corruptions like this. They are never easy to diagnose.