Unfamiliar crash in prod environmnet c0000005

[maxima120]

Description

I started to get these exceptions from WPF app in a hardened prod environment after migrating to .net 9
not possible to reproduce on dev machines. These are from the prod event viewer and this is the only text there is, no other info:

.NET Version: 9.0.3
Description: The process was terminated due to an unhandled exception.
Exception Info: exception code c0000005, exception address 00007FFFB640E42A

Reproduction Steps

not possible to repro

Expected behavior

a stack trace at least

Actual behavior

application crashes

Regression?

this has never happened in .net 7/8 for 2 yrs

Known Workarounds

No response

Configuration

9.0.3
Windows 10 x64

M:\>dotnet --info
.NET SDK:
Version:           9.0.201
Commit:            071aaccdc2
Workload version:  9.0.200-manifests.21502d11
MSBuild version:   17.13.13+1c2026462

Runtime Environment:
OS Name:     Windows
OS Version:  10.0.19045
OS Platform: Windows
RID:         win-x64
Base Path:   C:\Program Files\dotnet\sdk\9.0.201\

.NET workloads installed:
There are no installed workloads to display.
Configured to use loose manifests when installing new manifests.

Host:
  Version:      9.0.3
  Architecture: x64
  Commit:       831d23e561

.NET SDKs installed:
  8.0.302 [C:\Program Files\dotnet\sdk]
  9.0.201 [C:\Program Files\dotnet\sdk]

.NET runtimes installed:
  Microsoft.AspNetCore.App 8.0.6 [C:\Program Files\dotnet\shared\Microsoft.AspNetCore.App]
  Microsoft.AspNetCore.App 9.0.3 [C:\Program Files\dotnet\shared\Microsoft.AspNetCore.App]
  Microsoft.NETCore.App 7.0.20 [C:\Program Files\dotnet\shared\Microsoft.NETCore.App]
  Microsoft.NETCore.App 8.0.6 [C:\Program Files\dotnet\shared\Microsoft.NETCore.App]
  Microsoft.NETCore.App 8.0.8 [C:\Program Files\dotnet\shared\Microsoft.NETCore.App]
  Microsoft.NETCore.App 9.0.3 [C:\Program Files\dotnet\shared\Microsoft.NETCore.App]
  Microsoft.WindowsDesktop.App 7.0.20 [C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App]
  Microsoft.WindowsDesktop.App 8.0.6 [C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App]
  Microsoft.WindowsDesktop.App 8.0.8 [C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App]
  Microsoft.WindowsDesktop.App 9.0.3 [C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App]

Other architectures found:
  x86   [C:\Program Files (x86)\dotnet]
    registered at [HKLM\SOFTWARE\dotnet\Setup\InstalledVersions\x86\InstallLocation]

Environment variables:
  Not set

global.json file:
  Not found

Other information

No response

[pra2892]

The exception code c0000005 indicates an access violation, which is often challenging to diagnose without a proper stack trace. Since this only happens in your production environment after migrating to .NET 9, here are some approaches to help diagnose and potentially fix the issue:

1. Enable Better Crash Diagnostics
2. Add Global Exception Handling

Common Fixes for c0000005 in .NET 9 WPF Apps will be any one of the following

1. Fix Threading Issues
2. Runtime Configuration Adjustments
3. Memory Management Improvements
4. Check for DLL Conflicts
5. Check for Security Restrictions

Thank You.

[AndyAyersMS]

If you can enable and then analyze (or share) crash dumps that would help pin things down more easily.

https://learn.microsoft.com/en-us/dotnet/core/diagnostics/collect-dumps-crash

[maxima120]

thank you guys. I am going to need few days to arrange that (changes in prod take time).. Would mini-dump be enough (I am not sure if i can share a full dump for security purposes). And how do I share it (can be large)?

[AndyAyersMS]

A mini dump should be good enough.

To share securely you can open an issue on https://developercommunity.visualstudio.com/home and then link that issue back here.

Once the issue is open you can attach the dump there.

[AndyAyersMS]

@maxima120 any luck getting a crash dump?

[maxima120]

sorry i just came back from the easter break.. i will get something tangible this week

[maxima120]

sorry Andy, am trying to get the dumps for the IT support.. should be soon.. I keep pushing..

[maxima120]

I finally received event logs and dumps from the user machines and this does not occur since a week ago.. I guess it was a local IT problem which was resolved by some weekly update.