.NET 10 regression: Runtime in COM server application crashes when it receives certain sequence of COM method calls (access violation)

[spkl]

Description

We are currently migrating our C# application that provides an out-process COM server from .NET 8 to .NET 10. We have automated tests, also implemented in C#, that use the COM interface which the application provides. Some of these tests are failing since switching to .NET 10, because the COM server application crashes while executing runtime code (coreclr).

The Visual Studio debugger displays an "ExecutionEngineException". Event log and stack traces see below.

Reproduction Steps

Edit: Minimal repro is now available here: https://github.com/spkl/Net10ComServerCrashRegressionRepro

I tried, but I was not able to create a minimal repro example.
Let me share the COM client code that crashes the runtime of the COM server:

Type objType = Type.GetTypeFromProgID(progId);
IRedacted application = (IRedacted)Activator.CreateInstance(objType);
// obj1 is obtained from application (details left out).
IArtifactDescriptor obj2 = obj1.SetNewArtifactDescriptor();

// Interesting part starts here.
// When removing this, the crash will NOT occur:
obj2.Files.Add("foo");

// The next two statements occur in some of the failing cases; they have no effect on whether the crash happens or not:
obj2.Category = "Category";
obj2.Domain = "Domain";

// The "Add" call is where the server crashes:
obj2.RevisionLabels.Add("1.0.0");

Further information and observations:

• IArtifactDescriptor.Files and IArtifactDescriptor.RevisionLabels are both of the same interface type IStrings, our own type.
  • For Files, the implementation is class StringFileUris, which is derived from class Strings. StringFileUris overrides the Add method from Strings.
  • For RevisionLabels, the implementation is class Strings.
• The crash occurs in the server application AFTER the RevisionLabels getter returns, but BEFORE the Add method is called (breakpoint in Add is not hit).
• The crash does NOT occur, when changing the declaration of obj from IArtifactDescriptor obj2 to dynamic obj2.
• The crash does NOT occur, when flipping the Files.Add and RevisionLabels.Add lines.

Definition of IStrings and base interfaces:

[ComVisible(true)]
[Guid("f2999378-816f-4d82-93c7-6f42d64343ed")]
public interface IStrings : IAutomationPrimitiveList<string>
{
    new int Count { get; }	
    new string[] Elements
    {
        [return: MarshalAs(UnmanagedType.SafeArray, SafeArraySubType = VarEnum.VT_BSTR)]
        get;
    }
    new string ElementAt(int pIndex);
    new object Parent { get; }
    new void Clear();
    new bool Contains(string pElement);
    new int IndexOf(string pElement);
    new void RemoveAt(int pIndex);
    new IRedacted Root { get; }
    new string ElementType { get; }
    void Add(string pItem);
}

[ComVisible(false)]
[Guid("564ee013-b41a-4050-a325-22ddeeff607a")]
public interface IAutomationPrimitiveList<IListItemType> : IAutomationBase
{
	int Count { get; }
	IListItemType[] Elements
	{
		[return: MarshalAs(UnmanagedType.SafeArray, SafeArraySubType = VarEnum.VT_DISPATCH)]
		get;
	}
	IListItemType ElementAt(int pIndex);
	object Parent { get; }
	void Clear();
	bool Contains(IListItemType element);
	int IndexOf(IListItemType element);
	void RemoveAt(int index);
	string ElementType { get; }
	new IRedacted Root { get; }
}

[ComVisible(true)]
[Guid("4618daca-7da7-4338-8487-d880adef03bb")]
public interface IAutomationBase
{
	IRedacted Root { get; }
}

Expected behavior

The application does not crash.

Actual behavior

The application crashes.

Error 28.04.2026 15:29:33 Application Error 1000 Application Crashing Events:

Faulting application name: redacted.exe, version: 26.1.0.17839, time stamp: 0x69760000
Faulting module name: coreclr.dll, version: 10.0.726.21808, time stamp: 0x69e279e8
Exception code: 0xc0000005
Fault offset: 0x000000000035699f
Faulting process id: 0xC6F0
Faulting application start time: 0x1DCD712FF2EE281
Faulting application path: C:\redacted\redacted.exe
Faulting module path: C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.7\coreclr.dll
Report Id: 020475a2-3499-41a8-b3ea-64836424d5ce
Faulting package full name: 
Faulting package-relative application ID: 

Error 28.04.2026 15:29:31 .NET Runtime 1026 None:

Application: redacted.exe
CoreCLR Version: 10.0.726.21808
.NET Version: 10.0.7
Description: The process was terminated due to an unhandled exception.
Stack:

0:011> kn
 # Child-SP          RetAddr               Call Site
00 00000031`c477da18 00007ffc`ed8a6b73     0x0
01 00000031`c477da20 00007ffd`404a8b09     0x00007ffc`ed8a6b73
02 00000031`c477da70 00007ffd`40663e87     coreclr!COMToCLRDispatchHelper+0x39 [D:\a\_work\1\s\src\runtime\src\coreclr\vm\amd64\GenericComCallStubs.asm @ 263] 
03 (Inline Function) --------`--------     coreclr!InvokeStub+0x1b [D:\a\_work\1\s\src\runtime\src\coreclr\vm\comtoclrcall.cpp @ 191] 
04 (Inline Function) --------`--------     coreclr!COMToCLRInvokeTarget+0x64 [D:\a\_work\1\s\src\runtime\src\coreclr\vm\comtoclrcall.cpp @ 291] 
05 (Inline Function) --------`--------     coreclr!COMToCLRWorkerBody+0x175 [D:\a\_work\1\s\src\runtime\src\coreclr\vm\comtoclrcall.cpp @ 406] 
06 00000031`c477daa0 00007ffd`404a8a6b     coreclr!COMToCLRWorker+0x2b7 [D:\a\_work\1\s\src\runtime\src\coreclr\vm\comtoclrcall.cpp @ 496] 
07 00000031`c477db10 00007ffe`8c9a36b3     coreclr!GenericComCallStub+0x4b [D:\a\_work\1\s\src\runtime\src\coreclr\vm\amd64\GenericComCallStubs.asm @ 111] 
08 00000031`c477db90 00007ffe`8c8e74bd     RPCRT4!Invoke+0x73
09 00000031`c477dbe0 00007ffe`8c2179c1     RPCRT4!NdrStubCall2+0x30d
0a 00000031`c477de90 00007ffe`8cc4d570     combase!CStdStubBuffer_Invoke+0x141 [onecore\com\combase\ndr\ndrole\stub.cxx @ 1400] 
0b 00000031`c477ded0 00007ffe`8c217842     OLEAUT32!CUnivStubWrapper::Invoke+0x50
0c (Inline Function) --------`--------     combase!InvokeStubWithExceptionPolicyAndTracing::__l6::<lambda_c9f3956a20c9da92a64affc24fdd69ec>::operator()+0x2d [onecore\com\combase\dcomrem\channelb.cxx @ 1152] 
0d 00000031`c477df30 00007ffe`8c216db6     combase!ObjectMethodExceptionHandlingAction<<lambda_c9f3956a20c9da92a64affc24fdd69ec> >+0x4e [onecore\com\combase\dcomrem\excepn.hxx @ 94] 
0e (Inline Function) --------`--------     combase!InvokeStubWithExceptionPolicyAndTracing+0x182 [onecore\com\combase\dcomrem\channelb.cxx @ 1150] 
0f 00000031`c477df90 00007ffe`8c2160c8     combase!DefaultStubInvoke+0x376 [onecore\com\combase\dcomrem\channelb.cxx @ 1219] 
10 (Inline Function) --------`--------     combase!SyncStubCall::Invoke+0x7 [onecore\com\combase\dcomrem\channelb.cxx @ 1276] 
11 (Inline Function) --------`--------     combase!SyncServerCall::StubInvoke+0x33 [onecore\com\combase\dcomrem\ServerCall.hpp @ 790] 
12 00000031`c477e150 00007ffe`8c287c9f     combase!StubInvoke+0x138 [onecore\com\combase\dcomrem\channelb.cxx @ 1485] 
13 00000031`c477e220 00007ffe`8c217aca     combase!ServerCall::ContextInvoke+0x28f [onecore\com\combase\dcomrem\ctxchnl.cxx @ 1436] 
14 00000031`c477e4b0 00007ffe`8c1dac0e     combase!DefaultInvokeInApartment+0x8a [onecore\com\combase\dcomrem\callctrl.cxx @ 3247] 
15 00000031`c477e4e0 00007ffe`8c21895f     combase!ComInvokeWithLockAndIPID+0xcce [onecore\com\combase\dcomrem\channelb.cxx @ 2152] 
16 (Inline Function) --------`--------     combase!ThreadInvokeReturnHresult+0x108 [onecore\com\combase\dcomrem\channelb.cxx @ 6962] 
17 00000031`c477e7e0 00007ffe`8c958687     combase!ThreadInvoke+0x11f [onecore\com\combase\dcomrem\channelb.cxx @ 7062] 
18 00000031`c477e880 00007ffe`8c91da74     RPCRT4!DispatchToStubInCNoAvrf+0x17
19 00000031`c477e8d0 00007ffe`8c91e83a     RPCRT4!RPC_INTERFACE::DispatchToStubWorker+0x194
1a 00000031`c477e9a0 00007ffe`8c90bc14     RPCRT4!LRPC_SCALL::DispatchRequest+0x85a
1b 00000031`c477ee10 00007ffe`8c91bfdc     RPCRT4!LRPC_SCALL::QueueOrDispatchCall+0xe4
1c 00000031`c477efd0 00007ffe`8c921fdc     RPCRT4!LRPC_SCALL::HandleRequest+0x2bc
1d 00000031`c477f150 00007ffe`8c921163     RPCRT4!LRPC_ADDRESS::HandleRequest+0x3ac
1e 00000031`c477f230 00007ffe`8c920108     RPCRT4!LRPC_ADDRESS::ProcessIO+0x2f3
1f 00000031`c477f5a0 00007ffe`8d217f4e     RPCRT4!LrpcIoComplete+0xc8
20 00000031`c477f6c0 00007ffe`8d216073     ntdll!TppAlpcpExecuteCallback+0x44e
21 00000031`c477f830 00007ffe`8b94e8d7     ntdll!TppWorkerThread+0x563
22 00000031`c477fb90 00007ffe`8d22c48c     KERNEL32!BaseThreadInitThunk+0x17
23 00000031`c477fbc0 00000000`00000000     ntdll!RtlUserThreadStart+0x2c

0:011> .exr -1
ExceptionAddress: 0000000000000000
   ExceptionCode: c0000005 (Access violation)
  ExceptionFlags: 00000000
NumberParameters: 2
   Parameter[0]: 0000000000000008
   Parameter[1]: 0000000000000000
Attempt to execute non-executable address 0000000000000000

0:011> !clrstack -all
OS Thread Id: 0x6104
        Child SP               IP Call Site
00000031C3E7FA10 00007ffe8d301b14 [DebuggerU2MCatchHandlerFrame: 00000031c3e7fa10] 
OS Thread Id: 0x3d68
        Child SP               IP Call Site
00000031C297E4C8 00007ffe8ab21334 [InlinedCallFrame: 00000031c297e4c8] MS.Win32.UnsafeNativeMethods+ITfMessagePump.GetMessageW(System.Windows.Interop.MSG ByRef, IntPtr, Int32, Int32, Int32 ByRef)
00000031C297E4C8 00007ffce1ad374b [InlinedCallFrame: 00000031c297e4c8] MS.Win32.UnsafeNativeMethods+ITfMessagePump.GetMessageW(System.Windows.Interop.MSG ByRef, IntPtr, Int32, Int32, Int32 ByRef)
00000031C297E490 00007ffce1ad374b ILStubClass.IL_STUB_CLRtoCOM(System.Windows.Interop.MSG ByRef, IntPtr, Int32, Int32, Int32 ByRef)
00000031C297E5B0 00007ffceb30bd2f System.Windows.Threading.Dispatcher.GetMessage(System.Windows.Interop.MSG ByRef, IntPtr, Int32, Int32)
00000031C297E6B0 00007ffd3ccd1e71 System.Windows.Threading.Dispatcher.PushFrameImpl(System.Windows.Threading.DispatcherFrame)
00000031C297E730 00007ffd3ad395e5 System.Windows.Application.RunDispatcher(System.Object)
00000031C297E770 00007ffd3ad37fe3 System.Windows.Application.RunInternal(System.Windows.Window)
00000031C297E7D0 00007ffce08647f1 Redacted.App.Main()
OS Thread Id: 0x3480
        Child SP               IP Call Site
00000031C417F990 00007ffe8d302114 [DebuggerU2MCatchHandlerFrame: 00000031c417f990] 
OS Thread Id: 0x14fc
        Child SP               IP Call Site
00000031C447F4C8 00007ffe8d301bb4 [InlinedCallFrame: 00000031c447f4c8] Interop+Kernel32.g____PInvoke|51_0(IntPtr, UInt32*, UIntPtr*, IntPtr*, Int32)
00000031C447F4C8 00007ffceb35a068 [InlinedCallFrame: 00000031c447f4c8] Interop+Kernel32.g____PInvoke|51_0(IntPtr, UInt32*, UIntPtr*, IntPtr*, Int32)
00000031C447F4A0 00007ffceb35a068 System.Threading.LowLevelLifoSemaphore.WaitForSignal(Int32) [/_/src/runtime/src/libraries/System.Private.CoreLib/src/System/Threading/LowLevelLifoSemaphore.cs @ 160]
00000031C447F560 00007ffd3f7b617f System.Threading.PortableThreadPool+WorkerThread.WorkerThreadStart() [/_/src/runtime/src/libraries/System.Private.CoreLib/src/System/Threading/PortableThreadPool.WorkerThread.cs @ 116]
00000031C447F660 00007ffd3f793cbb System.Threading.Thread.StartCallback()
00000031C447F8B0 00007ffd404a8933 [DebuggerU2MCatchHandlerFrame: 00000031c447f8b0] 
OS Thread Id: 0x7e5c
        Child SP               IP Call Site
00000031C24CF9D0 00007ffe8d3025e4 [InlinedCallFrame: 00000031c24cf9d0] System.Threading.WaitHandle.g____PInvoke|0_0(IntPtr, Int32, Int32)
00000031C24CF9D0 00007ffceb7bfa07 [InlinedCallFrame: 00000031c24cf9d0] System.Threading.WaitHandle.g____PInvoke|0_0(IntPtr, Int32, Int32)
00000031C24CF9A0 00007ffceb7bfa07 System.Threading.WaitHandle.WaitOneNoCheck(Int32, Boolean, System.Object, WaitHandleWaitSourceMap) [/_/src/runtime/src/libraries/System.Private.CoreLib/src/System/Threading/WaitHandle.cs @ 183]
00000031C24CFA60 00007ffd3f7b3399 System.Threading.PortableThreadPool+GateThread.GateThreadStart()
00000031C24CFBA0 00007ffd3f793cbb System.Threading.Thread.StartCallback()
00000031C24CFDF0 00007ffd404a8933 [DebuggerU2MCatchHandlerFrame: 00000031c24cfdf0] 
OS Thread Id: 0x8440
        Child SP               IP Call Site
00000031CBE7F860 00007ffe8d3025e4 [InlinedCallFrame: 00000031cbe7f860] System.Threading.WaitHandle.g____PInvoke|0_0(IntPtr, Int32, Int32)
00000031CBE7F860 00007ffceb7bfa07 [InlinedCallFrame: 00000031cbe7f860] System.Threading.WaitHandle.g____PInvoke|0_0(IntPtr, Int32, Int32)
00000031CBE7F830 00007ffceb7bfa07 System.Threading.WaitHandle.WaitOneNoCheck(Int32, Boolean, System.Object, WaitHandleWaitSourceMap) [/_/src/runtime/src/libraries/System.Private.CoreLib/src/System/Threading/WaitHandle.cs @ 183]
00000031CBE7F8F0 00007ffd3f7971d2 System.Threading.WaitHandle.WaitOne(Int32) [/_/src/runtime/src/libraries/System.Private.CoreLib/src/System/Threading/WaitHandle.cs @ 104]
00000031CBE7F920 00007ffce1adc577 Redacted.SomeClass.RunMessageLoop()
00000031CBE7FAB0 00007ffd3f79595b System.Threading.Thread+StartHelper.Callback(System.Object) [/_/src/runtime/src/libraries/System.Private.CoreLib/src/System/Threading/Thread.cs @ 44]
00000031CBE7FAF0 00007ffd3f79ce94 System.Threading.ExecutionContext.RunInternal(System.Threading.ExecutionContext, System.Threading.ContextCallback, System.Object) [/_/src/runtime/src/libraries/System.Private.CoreLib/src/System/Threading/ExecutionContext.cs @ 179]
00000031CBE7FD70 00007ffd404a8933 [DebuggerU2MCatchHandlerFrame: 00000031cbe7fd70] 
OS Thread Id: 0x2688
        Child SP               IP Call Site
00000031CC17FA48 00007ffe8d3025e4 [InlinedCallFrame: 00000031cc17fa48] 
00000031CC17FA48 00007ffd3f7972d3 [InlinedCallFrame: 00000031cc17fa48] 
00000031CC17FA10 00007ffd3f7972d3 System.Threading.WaitHandle.WaitOneNoCheck(Int32, Boolean, System.Object, WaitHandleWaitSourceMap) [/_/src/runtime/src/libraries/System.Private.CoreLib/src/System/Threading/WaitHandle.cs @ 183]
00000031CC17FAF0 00007ffd3f797f6b System.Threading.WaitHandle.WaitOne() [/_/src/runtime/src/libraries/System.Private.CoreLib/src/System/Threading/WaitHandle.cs @ 503]
00000031CC17FB20 00007ffce1aeb041 System.Management.MTAHelper.WorkerThread() [/_/src/libraries/System.Management/src/System/Management/InteropClasses/WMIInterop.cs @ 1263]
00000031CC17FBF0 00007ffd3f79595b System.Threading.Thread+StartHelper.Callback(System.Object) [/_/src/runtime/src/libraries/System.Private.CoreLib/src/System/Threading/Thread.cs @ 44]
00000031CC17FC30 00007ffd3f79ce94 System.Threading.ExecutionContext.RunInternal(System.Threading.ExecutionContext, System.Threading.ContextCallback, System.Object) [/_/src/runtime/src/libraries/System.Private.CoreLib/src/System/Threading/ExecutionContext.cs @ 179]
00000031CC17FEB0 00007ffd404a8933 [DebuggerU2MCatchHandlerFrame: 00000031cc17feb0] 
OS Thread Id: 0xc250
        Child SP               IP Call Site
OS Thread Id: 0x5d04
        Child SP               IP Call Site
00000031CCA7FA10 00007ffe8d3025e4 [InlinedCallFrame: 00000031cca7fa10] System.Threading.WaitHandle.g____PInvoke|0_0(IntPtr, Int32, Int32)
00000031CCA7FA10 00007ffceb7bfa07 [InlinedCallFrame: 00000031cca7fa10] System.Threading.WaitHandle.g____PInvoke|0_0(IntPtr, Int32, Int32)
00000031CCA7F9E0 00007ffceb7bfa07 System.Threading.WaitHandle.WaitOneNoCheck(Int32, Boolean, System.Object, WaitHandleWaitSourceMap) [/_/src/runtime/src/libraries/System.Private.CoreLib/src/System/Threading/WaitHandle.cs @ 183]
00000031CCA7FAA0 00007ffd3f7971d2 System.Threading.WaitHandle.WaitOne(Int32) [/_/src/runtime/src/libraries/System.Private.CoreLib/src/System/Threading/WaitHandle.cs @ 104]
00000031CCA7FAD0 00007ffce1b00e15 Redacted.SomeClass.RunLoggingLoop()
00000031CCA7FB80 00007ffd3f79595b System.Threading.Thread+StartHelper.Callback(System.Object) [/_/src/runtime/src/libraries/System.Private.CoreLib/src/System/Threading/Thread.cs @ 44]
00000031CCA7FBC0 00007ffd3f79ce94 System.Threading.ExecutionContext.RunInternal(System.Threading.ExecutionContext, System.Threading.ContextCallback, System.Object) [/_/src/runtime/src/libraries/System.Private.CoreLib/src/System/Threading/ExecutionContext.cs @ 179]
00000031CCA7FE40 00007ffd404a8933 [DebuggerU2MCatchHandlerFrame: 00000031cca7fe40] 
OS Thread Id: 0x17f4
        Child SP               IP Call Site
00000031CCD7FA60 00007ffe8d3025e4 [InlinedCallFrame: 00000031ccd7fa60] System.Threading.WaitHandle.g____PInvoke|0_0(IntPtr, Int32, Int32)
00000031CCD7FA60 00007ffceb7bfa07 [InlinedCallFrame: 00000031ccd7fa60] System.Threading.WaitHandle.g____PInvoke|0_0(IntPtr, Int32, Int32)
00000031CCD7FA30 00007ffceb7bfa07 System.Threading.WaitHandle.WaitOneNoCheck(Int32, Boolean, System.Object, WaitHandleWaitSourceMap) [/_/src/runtime/src/libraries/System.Private.CoreLib/src/System/Threading/WaitHandle.cs @ 183]
00000031CCD7FAF0 00007ffd3f7ac555 System.Threading.TimerQueue.TimerThread() [/_/src/runtime/src/libraries/System.Private.CoreLib/src/System/Threading/TimerQueue.Portable.cs @ 93]
00000031CCD7FB90 00007ffd3f793cbb System.Threading.Thread.StartCallback()
00000031CCD7FDE0 00007ffd404a8933 [DebuggerU2MCatchHandlerFrame: 00000031ccd7fde0] 
OS Thread Id: 0x275c
        Child SP               IP Call Site
00000031CE27F8D0 00007ffe8ab21334 [InlinedCallFrame: 00000031ce27f8d0] 
00000031CE27F8D0 00007ffe61446424 [InlinedCallFrame: 00000031ce27f8d0] 
00000031CE27F890 00007ffe61446424 Interop+User32.g____PInvoke|212_0(MSG*, IntPtr, Int32, Int32)
00000031CE27F970 00007ffe61445edb Microsoft.Win32.SystemEvents.WindowThreadProc() [/_/src/runtime/src/libraries/Microsoft.Win32.SystemEvents/src/Microsoft/Win32/SystemEvents.cs @ 1214]
00000031CE27F9E0 00007ffd3f79595b System.Threading.Thread+StartHelper.Callback(System.Object) [/_/src/runtime/src/libraries/System.Private.CoreLib/src/System/Threading/Thread.cs @ 44]
00000031CE27FA20 00007ffce38b44f2 System.Threading.ExecutionContext.RunInternal(System.Threading.ExecutionContext, System.Threading.ContextCallback, System.Object) [/_/src/runtime/src/libraries/System.Private.CoreLib/src/System/Threading/ExecutionContext.cs @ 179]
00000031CE27FCA0 00007ffd404a8933 [DebuggerU2MCatchHandlerFrame: 00000031ce27fca0] 
OS Thread Id: 0x56b8
        Child SP               IP Call Site
00000031CF47F608 00007ffe8d301bb4 [InlinedCallFrame: 00000031cf47f608] Interop+Kernel32.g____PInvoke|51_0(IntPtr, UInt32*, UIntPtr*, IntPtr*, Int32)
00000031CF47F608 00007ffceb35a068 [InlinedCallFrame: 00000031cf47f608] Interop+Kernel32.g____PInvoke|51_0(IntPtr, UInt32*, UIntPtr*, IntPtr*, Int32)
00000031CF47F5E0 00007ffceb35a068 System.Threading.LowLevelLifoSemaphore.WaitForSignal(Int32) [/_/src/runtime/src/libraries/System.Private.CoreLib/src/System/Threading/LowLevelLifoSemaphore.cs @ 160]
00000031CF47F6A0 00007ffced155cb0 System.Threading.LowLevelLifoSemaphore.Wait(Int32, Boolean) [/_/src/runtime/src/libraries/System.Private.CoreLib/src/System/Threading/LowLevelLifoSemaphore.cs @ 85]
00000031CF47F750 00007ffd3f7b617f System.Threading.PortableThreadPool+WorkerThread.WorkerThreadStart() [/_/src/runtime/src/libraries/System.Private.CoreLib/src/System/Threading/PortableThreadPool.WorkerThread.cs @ 116]
00000031CF47F850 00007ffd3f793cbb System.Threading.Thread.StartCallback()
00000031CF47FAA0 00007ffd404a8933 [DebuggerU2MCatchHandlerFrame: 00000031cf47faa0] 
OS Thread Id: 0xbd30
        Child SP               IP Call Site
00000031D007F598 00007ffe8d301bb4 [InlinedCallFrame: 00000031d007f598] Interop+Kernel32.g____PInvoke|51_0(IntPtr, UInt32*, UIntPtr*, IntPtr*, Int32)
00000031D007F598 00007ffceb35a068 [InlinedCallFrame: 00000031d007f598] Interop+Kernel32.g____PInvoke|51_0(IntPtr, UInt32*, UIntPtr*, IntPtr*, Int32)
00000031D007F570 00007ffceb35a068 System.Threading.LowLevelLifoSemaphore.WaitForSignal(Int32) [/_/src/runtime/src/libraries/System.Private.CoreLib/src/System/Threading/LowLevelLifoSemaphore.cs @ 160]
00000031D007F630 00007ffced155cb0 System.Threading.LowLevelLifoSemaphore.Wait(Int32, Boolean) [/_/src/runtime/src/libraries/System.Private.CoreLib/src/System/Threading/LowLevelLifoSemaphore.cs @ 85]
00000031D007F6E0 00007ffd3f7b617f System.Threading.PortableThreadPool+WorkerThread.WorkerThreadStart() [/_/src/runtime/src/libraries/System.Private.CoreLib/src/System/Threading/PortableThreadPool.WorkerThread.cs @ 116]
00000031D007F7E0 00007ffd3f793cbb System.Threading.Thread.StartCallback()
00000031D007FA30 00007ffd404a8933 [DebuggerU2MCatchHandlerFrame: 00000031d007fa30] 
OS Thread Id: 0xc8a8
        Child SP               IP Call Site
00000031D0C7F508 00007ffe8d301bb4 [InlinedCallFrame: 00000031d0c7f508] Interop+Kernel32.g____PInvoke|51_0(IntPtr, UInt32*, UIntPtr*, IntPtr*, Int32)
00000031D0C7F508 00007ffceb35a068 [InlinedCallFrame: 00000031d0c7f508] Interop+Kernel32.g____PInvoke|51_0(IntPtr, UInt32*, UIntPtr*, IntPtr*, Int32)
00000031D0C7F4E0 00007ffceb35a068 System.Threading.LowLevelLifoSemaphore.WaitForSignal(Int32) [/_/src/runtime/src/libraries/System.Private.CoreLib/src/System/Threading/LowLevelLifoSemaphore.cs @ 160]
00000031D0C7F5A0 00007ffd3f7b617f System.Threading.PortableThreadPool+WorkerThread.WorkerThreadStart() [/_/src/runtime/src/libraries/System.Private.CoreLib/src/System/Threading/PortableThreadPool.WorkerThread.cs @ 116]
00000031D0C7F6A0 00007ffd3f793cbb System.Threading.Thread.StartCallback()
00000031D0C7F8F0 00007ffd404a8933 [DebuggerU2MCatchHandlerFrame: 00000031d0c7f8f0] 
OS Thread Id: 0x6ed8
        Child SP               IP Call Site
00000031D0F7F358 00007ffe8d301bb4 [InlinedCallFrame: 00000031d0f7f358] Interop+Kernel32.g____PInvoke|51_0(IntPtr, UInt32*, UIntPtr*, IntPtr*, Int32)
00000031D0F7F358 00007ffceb35a068 [InlinedCallFrame: 00000031d0f7f358] Interop+Kernel32.g____PInvoke|51_0(IntPtr, UInt32*, UIntPtr*, IntPtr*, Int32)
00000031D0F7F330 00007ffceb35a068 System.Threading.LowLevelLifoSemaphore.WaitForSignal(Int32) [/_/src/runtime/src/libraries/System.Private.CoreLib/src/System/Threading/LowLevelLifoSemaphore.cs @ 160]
00000031D0F7F3F0 00007ffd3f7b617f System.Threading.PortableThreadPool+WorkerThread.WorkerThreadStart() [/_/src/runtime/src/libraries/System.Private.CoreLib/src/System/Threading/PortableThreadPool.WorkerThread.cs @ 116]
00000031D0F7F4F0 00007ffd3f793cbb System.Threading.Thread.StartCallback()
00000031D0F7F740 00007ffd404a8933 [DebuggerU2MCatchHandlerFrame: 00000031d0f7f740] 
OS Thread Id: 0x7160
        Child SP               IP Call Site
00000031D127F458 00007ffe8d301bb4 [InlinedCallFrame: 00000031d127f458] Interop+Kernel32.g____PInvoke|51_0(IntPtr, UInt32*, UIntPtr*, IntPtr*, Int32)
00000031D127F458 00007ffceb35a068 [InlinedCallFrame: 00000031d127f458] Interop+Kernel32.g____PInvoke|51_0(IntPtr, UInt32*, UIntPtr*, IntPtr*, Int32)
00000031D127F430 00007ffceb35a068 System.Threading.LowLevelLifoSemaphore.WaitForSignal(Int32) [/_/src/runtime/src/libraries/System.Private.CoreLib/src/System/Threading/LowLevelLifoSemaphore.cs @ 160]
00000031D127F4F0 00007ffced155cb0 System.Threading.LowLevelLifoSemaphore.Wait(Int32, Boolean) [/_/src/runtime/src/libraries/System.Private.CoreLib/src/System/Threading/LowLevelLifoSemaphore.cs @ 85]
00000031D127F5A0 00007ffd3f7b617f System.Threading.PortableThreadPool+WorkerThread.WorkerThreadStart() [/_/src/runtime/src/libraries/System.Private.CoreLib/src/System/Threading/PortableThreadPool.WorkerThread.cs @ 116]
00000031D127F6A0 00007ffd3f793cbb System.Threading.Thread.StartCallback()
00000031D127F8F0 00007ffd404a8933 [DebuggerU2MCatchHandlerFrame: 00000031d127f8f0] 
OS Thread Id: 0xd2a0
        Child SP               IP Call Site
00000031D157F678 00007ffe8d301bb4 [InlinedCallFrame: 00000031d157f678] Interop+Kernel32.g____PInvoke|51_0(IntPtr, UInt32*, UIntPtr*, IntPtr*, Int32)
00000031D157F678 00007ffceb35a068 [InlinedCallFrame: 00000031d157f678] Interop+Kernel32.g____PInvoke|51_0(IntPtr, UInt32*, UIntPtr*, IntPtr*, Int32)
00000031D157F650 00007ffceb35a068 System.Threading.LowLevelLifoSemaphore.WaitForSignal(Int32) [/_/src/runtime/src/libraries/System.Private.CoreLib/src/System/Threading/LowLevelLifoSemaphore.cs @ 160]
00000031D157F710 00007ffced155cb0 System.Threading.LowLevelLifoSemaphore.Wait(Int32, Boolean) [/_/src/runtime/src/libraries/System.Private.CoreLib/src/System/Threading/LowLevelLifoSemaphore.cs @ 85]
00000031D157F7C0 00007ffd3f7b617f System.Threading.PortableThreadPool+WorkerThread.WorkerThreadStart() [/_/src/runtime/src/libraries/System.Private.CoreLib/src/System/Threading/PortableThreadPool.WorkerThread.cs @ 116]
00000031D157F8C0 00007ffd3f793cbb System.Threading.Thread.StartCallback()
00000031D157FB10 00007ffd404a8933 [DebuggerU2MCatchHandlerFrame: 00000031d157fb10] 
OS Thread Id: 0x4d8c
        Child SP               IP Call Site
OS Thread Id: 0xafe0
        Child SP               IP Call Site
OS Thread Id: 0x4f14
        Child SP               IP Call Site
00000031C477DB70 0000000000000000 [ComMethodFrame: 00000031c477db70] 

Regression?

Yes, it worked in .NET 8.
It does not work in .NET 10, I tested versions 10.0.6 and 10.0.7.

Known Workarounds

No known workarounds on server-side.

Configuration

• .NET 10.0.7
• Windows 11 and Windows Server 2025
• x64

Other information

No response

[dotnet-policy-service]

Tagging subscribers to this area: @steveisok, @tommcdon, @dotnet/dotnet-diag
See info in area-owners.md if you want to be subscribed.

[jkoritzinsky]

@spkl in the debugger for the crash, can you also run !clrstack -all to get the managed stack frames (in particular, the managed symbol for frame 0x1 if one exists is the interesting one). If you could share a dump that would be interesting as well.

Can you share the definition of your IStrings interface as well?

[dotnet-policy-service]

Tagging subscribers to this area: @dotnet/interop-contrib
See info in area-owners.md if you want to be subscribed.

[spkl]

@jkoritzinsky I have added the output of !clrstack -all and the definition of IStrings to my initial post.
Is there a way I can provide a memory dump that is not public for all?
As for creating the memory dump, should I use dotnet-dump? Any specific options to set?

[spkl]

I just found a workaround. The problem occurs when overriding the public-facing Add method like this:

class Strings : IStrings
{
    public virtual void Add(string pItem) { ... }
}

class StringFileUris : Strings
{
    public override void Add(string pItem) { ... }
}

But it does not occur anymore, when I move the method override to a method that is not part of the COM interface:

class Strings : IStrings
{
    public void Add(string pItem) { this.AddInternal(pItem); }
    protected virtual void AddInternal(string pItem) { ... }
}

class StringFileUris : Strings
{
    protected override void AddInternal(string pItem) { ... }
}

[spkl]

I was finally able to create a minimal repro example! You can find it here: https://github.com/spkl/Net10ComServerCrashRegressionRepro
I have also added this link to the initial post.