SaveCurrentExceptionInfo fails in an UWP app using interop with minimum target higher than 15063

[JohannesKauffmann]

Description

I am developing an UWP app which uses libvlc interop via the LibVLCSharp (bindings) and LibVLC.UWP (native code) nuget packages. In debug x86 configuration (with and without debugger attached), an unhandled win32 exception occurs on startup in coreclr.dll. The last stack frame points to CheckThreadStateNoCreate, see below for details. It does not occur on release mode at all, and x64 also works fine. The "fix" is to set the minimum target version of the app to 15063 or to downgrade the LibVLC.UWP nuget package. See also here.

The crash can be reproduced by cloning this project, selecting x86 debug configuration and upgrading the minimum target version to 16299 or beyond.

Configuration

Running Windows 10 Education 1909 x64. Visual Studio 2019 is 16.8.3. The UniversalWindowsPlatform nuget package is version 6.2.11.

Regression?

With the minimum target version on 15063, everything works as expected. Anything above that fails.

Other information

Since I couldn't get windbg to attach to the UWP sample app before it crashes, I used another app to get a dump. Since the issue arises on startup in the corecrl, the stack trace should be the same. Below is the exception analysis.

*******************************************************************************
*                                                                             *
*                        Exception Analysis                                   *
*                                                                             *
*******************************************************************************

*** WARNING: Unable to verify checksum for libvlccore.dll
*** WARNING: Unable to verify checksum for libvlc.dll
Failed to request MethodData, not in JIT code range

KEY_VALUES_STRING: 1

    Key  : AV.Dereference
    Value: NullClassPtr

    Key  : AV.Fault
    Value: Read

    Key  : Analysis.CPU.Sec
    Value: 20

    Key  : Analysis.DebugAnalysisProvider.CPP
    Value: Create: 8007007e on JOHANNESMD

    Key  : Analysis.DebugData
    Value: CreateObject

    Key  : Analysis.DebugModel
    Value: CreateObject

    Key  : Analysis.Elapsed.Sec
    Value: 139

    Key  : Analysis.Memory.CommitPeak.Mb
    Value: 382

    Key  : Analysis.System
    Value: CreateObject

    Key  : CLR.Engine
    Value: CORECLR

    Key  : CLR.Version
    Value: 4.6.27902.3

    Key  : Timeline.OS.Boot.DeltaSec
    Value: 74415

    Key  : Timeline.Process.Start.DeltaSec
    Value: 749


NTGLOBALFLAG:  0

PROCESS_BAM_CURRENT_THROTTLED: 0

PROCESS_BAM_PREVIOUS_THROTTLED: 0

APPLICATION_VERIFIER_FLAGS:  0

CONTEXT:  (.ecxr)
eax=00000000 ebx=00000000 ecx=00000005 edx=0384f588 esi=0384f538 edi=0384f588
eip=7b77767a esp=0384f3ec ebp=0384f43c iopl=0         nv up ei pl zr na pe nc
cs=0023  ss=002b  ds=002b  es=002b  fs=0053  gs=002b             efl=00010246
coreclr!CExecutionEngine::GetTlsData+0xc [inlined in coreclr!CExecutionEngine::CheckThreadStateNoCreate+0xc]:
7b77767a 8b0488          mov     eax,dword ptr [eax+ecx*4] ds:002b:00000014=????????
Resetting default scope

EXCEPTION_RECORD:  0384f538 -- (.exr 0x384f538)
ExceptionAddress: 774336e4 (ntdll!LdrpReportError+0x000394dd)
   ExceptionCode: c0000139
  ExceptionFlags: 00000001
NumberParameters: 0

PROCESS_NAME:  OneDrive-Cloud-Player.exe

READ_ADDRESS:  00000014 

ERROR_CODE: (NTSTATUS) 0xc0000005 - De instructie op 0x%p verwijst naar geheugen op 0x%p. Het geheugen kan niet worden %s.

EXCEPTION_CODE_STR:  c0000005

EXCEPTION_PARAMETER1:  00000000

EXCEPTION_PARAMETER2:  00000014

FAULTING_THREAD:  ffffffff

STACK_TEXT:  
0384f3e8 7b77762c 0384f458 7b7772e0 7b77724c coreclr!CExecutionEngine::CheckThreadStateNoCreate+0xc
0384f3f4 7b77724c 45f46985 774b132c 00000000 coreclr!SaveCurrentExceptionInfo+0x11
0384f43c 773fcf26 0384f458 0384f588 0384f538 coreclr!CLRVectoredExceptionHandlerShim+0xac
0384f48c 773f8e8b 00000000 00000000 c0000139 ntdll!RtlpCallVectoredHandlers+0xd5
0384f520 774053c6 0384f538 0384f588 0384f538 ntdll!RtlDispatchException+0x6f
0384f520 774336e4 0384f538 0384f588 0384f538 ntdll!KiUserExceptionDispatcher+0x26
0384fbcc 77427734 c0000139 8e0245fe 774adc20 ntdll!LdrpReportError+0x394dd
0384fc78 773d946b 773d943e 00000000 773d946b ntdll!LdrpSnapModule+0x4f214
0384fcd4 773c9b09 773c9ab0 032060c0 03209338 ntdll!LdrpProcessWork+0x4d
0384fce4 773c9a1d 0384fdf4 00000000 032060c0 ntdll!LdrpWorkCallback+0x59
0384fd18 773c868c 0384fdf4 03206138 8e02474e ntdll!TppWorkpExecuteCallback+0x1dd
0384fec8 76bc6359 03205f30 76bc6340 0384ff34 ntdll!TppWorkerThread+0x72c
0384fed8 773f8944 03205f30 8e0246b2 00000000 kernel32!BaseThreadInitThunk+0x19
0384ff34 773f8914 ffffffff 7741a0da 00000000 ntdll!__RtlUserThreadStart+0x2f
0384ff44 00000000 773c7f60 03205f30 00000000 ntdll!_RtlUserThreadStart+0x1b


FAULTING_SOURCE_LINE:  e:\a\_work\414\s\src\vm\corhost.cpp

FAULTING_SOURCE_FILE:  e:\a\_work\414\s\src\vm\corhost.cpp

FAULTING_SOURCE_LINE_NUMBER:  3305

SYMBOL_NAME:  coreclr!CExecutionEngine::CheckThreadStateNoCreate+c

MODULE_NAME: coreclr

IMAGE_NAME:  coreclr.dll

STACK_COMMAND:  .cxr 384f588 ; kb ; ~2s ; .ecxr ; kb

FAILURE_BUCKET_ID:  NULL_CLASS_PTR_READ_c0000005_coreclr.dll!CExecutionEngine::CheckThreadStateNoCreate

BUCKET_ID_MODPRIVATE: 1

OS_VERSION:  10.0.18362.1

BUILDLAB_STR:  19h1_release

OSPLATFORM_TYPE:  x86

OSNAME:  Windows 10

FAILURE_ID_HASH:  {75b5e358-0cc2-f350-e8df-c0a10e1269f1}

Followup:     MachineOwner
---------

This issue looked similar, so I tried it on a Windows 10 machine build 2004 with the minimum and target versions set to the highest possible in hope it was fixed, but to no avail.

I couldn't figure out the best area label to add to this issue. If you have write-permissions please help me learn by adding exactly one area label.

[JohannesKauffmann]

With an updated Microsoft.NETCore.UniversalWindowsPlatform package (6.2.11 => 6.2.12), this is still an issue. However, the stack trace and error is different:

*******************************************************************************
*                                                                             *
*                        Exception Analysis                                   *
*                                                                             *
*******************************************************************************

*** ERROR: Symbol file could not be found.  Defaulted to export symbols for C:\Program Files\WindowsApps\Microsoft.NET.CoreRuntime.2.2_2.2.29713.2_x86__8wekyb3d8bbwe\UWPHOST.dll - 
*** ERROR: Symbol file could not be found.  Defaulted to export symbols for C:\Users\Johannes\source\repos\OneDrive-Cloud-Player\OneDrive-Cloud-Player\bin\x86\Debug\AppX\OneDrive-Cloud-Player.exe - 
*** WARNING: Unable to verify checksum for C:\Users\Johannes\source\repos\OneDrive-Cloud-Player\OneDrive-Cloud-Player\bin\x86\Debug\AppX\libvlccore.dll
*** ERROR: Symbol file could not be found.  Defaulted to export symbols for C:\Users\Johannes\source\repos\OneDrive-Cloud-Player\OneDrive-Cloud-Player\bin\x86\Debug\AppX\libvlccore.dll - 
*** WARNING: Unable to verify checksum for C:\Users\Johannes\source\repos\OneDrive-Cloud-Player\OneDrive-Cloud-Player\bin\x86\Debug\AppX\libvlc.DLL
*** ERROR: Symbol file could not be found.  Defaulted to export symbols for C:\Users\Johannes\source\repos\OneDrive-Cloud-Player\OneDrive-Cloud-Player\bin\x86\Debug\AppX\libvlc.DLL - 
*** ERROR: Symbol file could not be found.  Defaulted to export symbols for C:\Windows\System32\DriverStore\FileRepository\iigd_dch.inf_amd64_1f87eb04e8ab15c8\igd10iumd32.dll - 
GetUrlPageData2 (WinHttp) failed: 12002.

KEY_VALUES_STRING: 1


STACKHASH_ANALYSIS: 1

TIMELINE_ANALYSIS: 1

Timeline: !analyze.Start
    Name: <blank>
    Time: 2021-08-26T15:01:05.48Z
    Diff: 951 mSec

Timeline: Dump.Current
    Name: <blank>
    Time: 2021-08-26T15:01:06.0Z
    Diff: 0 mSec

Timeline: Process.Start
    Name: <blank>
    Time: 2021-08-26T14:57:28.0Z
    Diff: 218000 mSec

Timeline: OS.Boot
    Name: <blank>
    Time: 2021-08-20T10:51:59.0Z
    Diff: 533347000 mSec


DUMP_CLASS: 2

DUMP_QUALIFIER: 0

FAULTING_IP: 
ntdll!LdrpReportError+3c41e
77a963b1 cc              int     3

EXCEPTION_RECORD:  0344e900 -- (.exr 0x344e900)
ExceptionAddress: 77a963b1 (ntdll!LdrpReportError+0x0003c41e)
   ExceptionCode: c0000139
  ExceptionFlags: 00000001
NumberParameters: 0

FAULTING_THREAD:  00001610

FOLLOWUP_IP: 
CoreCLR!SaveCurrentExceptionInfo+18 [e:\a\_work\140\s\src\vm\excep.cpp @ 8452]
626b5516 8b0490          mov     eax,dword ptr [eax+edx*4]

READ_ADDRESS:  00000010 

ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%p referenced memory at 0x%p. The memory could not be %s.

EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%p referenced memory at 0x%p. The memory could not be %s.

EXCEPTION_CODE_STR:  c0000005

EXCEPTION_PARAMETER1:  00000000

EXCEPTION_PARAMETER2:  00000010

WATSON_BKT_PROCSTAMP:  601d0acc

WATSON_BKT_PROCVER:  1.0.0.0

PROCESS_VER_PRODUCT:  OneDrive-Cloud-Player

WATSON_BKT_MODULE:  CoreCLR.dll

WATSON_BKT_MODSTAMP:  5fff5f2b

WATSON_BKT_MODOFFSET:  45516

WATSON_BKT_MODVER:  4.6.29713.2

MODULE_VER_PRODUCT:  Microsoft® .NET Core

BUILD_VERSION_STRING:  19041.1.amd64fre.vb_release.191206-1406

MODLIST_WITH_TSCHKSUM_HASH:  4def56b6811404df26df562b8ae8123993df9793

MODLIST_SHA1_HASH:  6d7cf967a113535e8ed792e15591cbe970985953

DUMP_TYPE:  fe

PROCESS_NAME:  unknown

ANALYSIS_SESSION_HOST:  JOHANNES-E15

ANALYSIS_SESSION_TIME:  08-26-2021 17:01:05.0048

ANALYSIS_VERSION: 10.0.17763.132 x86fre

MANAGED_CODE: 1

MANAGED_ENGINE_MODULE:  CoreCLR

CONTEXT:  0344dd08 -- (.cxr 0x344dd08)
eax=00000000 ebx=00000000 ecx=0344e900 edx=00000004 esi=0344e900 edi=0344e950
eip=626b5516 esp=0344e7b8 ebp=0344e804 iopl=0         nv up ei pl zr na pe nc
cs=0023  ss=002b  ds=002b  es=002b  fs=0053  gs=002b             efl=00010246
CoreCLR!SaveCurrentExceptionInfo+0x18:
626b5516 8b0490          mov     eax,dword ptr [eax+edx*4] ds:002b:00000010=????????
Resetting default scope

THREAD_ATTRIBUTES: 
LAST_CONTROL_TRANSFER:  from 77a2e3ec to 77a963b1

THREAD_SHA1_HASH_MOD_FUNC:  2c33d04094b4fbb8c9346e722a05b4f126a14f43

THREAD_SHA1_HASH_MOD_FUNC_OFFSET:  883ece1d5f20780af1eb90e3864d397f863bdaba

ADDITIONAL_DEBUG_TEXT:  SOS.DLL is not loaded for managed code. Analysis might be incomplete

BUGCHECK_STR:  APPLICATION_FAULT_NULL_CLASS_PTR_READ_INVALID_POINTER_READ_NOSOS_CLRSETUP_MSCORLIBMISMATCH_AFTER_CALL

DEFAULT_BUCKET_ID:  NULL_CLASS_PTR_READ_NOSOS_CLRSETUP_MSCORLIBMISMATCH

PRIMARY_PROBLEM_CLASS:  APPLICATION_FAULT

PROBLEM_CLASSES: 

    ID:     [0n313]
    Type:   [@ACCESS_VIOLATION]
    Class:  Addendum
    Scope:  BUCKET_ID
    Name:   Omit
    Data:   Omit
    PID:    [Unspecified]
    TID:    [0x1610]
    Frame:  [0] : CoreCLR!SaveCurrentExceptionInfo

    ID:     [0n285]
    Type:   [INVALID_POINTER_READ]
    Class:  Primary
    Scope:  BUCKET_ID
    Name:   Add
    Data:   Omit
    PID:    [Unspecified]
    TID:    [0x1610]
    Frame:  [0] : CoreCLR!SaveCurrentExceptionInfo

    ID:     [0n310]
    Type:   [NULL_CLASS_PTR_READ]
    Class:  Primary
    Scope:  DEFAULT_BUCKET_ID (Failure Bucket ID prefix)
            BUCKET_ID
    Name:   Add
    Data:   Omit
    PID:    [0x4bd8]
    TID:    [0x1610]
    Frame:  [0] : CoreCLR!SaveCurrentExceptionInfo

    ID:     [0n121]
    Type:   [CLRSETUP_MSCORLIBMISMATCH]
    Class:  Addendum
    Scope:  DEFAULT_BUCKET_ID (Failure Bucket ID prefix)
            BUCKET_ID
    Name:   Add
    Data:   Omit
    PID:    [0x4bd8]
    TID:    [0x1610]
    Frame:  [Unspecified]

    ID:     [0n111]
    Type:   [AFTER_CALL]
    Class:  Addendum
    Scope:  BUCKET_ID
    Name:   Add
    Data:   Omit
    PID:    [0x4bd8]
    TID:    [0x1610]
    Frame:  [0] : CoreCLR!SaveCurrentExceptionInfo

    ID:     [0n251]
    Type:   [NOSOS]
    Class:  Addendum
    Scope:  DEFAULT_BUCKET_ID (Failure Bucket ID prefix)
            BUCKET_ID
    Name:   Add
    Data:   Omit
    PID:    [Unspecified]
    TID:    [Unspecified]
    Frame:  [0]

STACK_TEXT:  
0344e7bc 626b53c0 794f535b 77b1933c 00000000 CoreCLR!SaveCurrentExceptionInfo+0x18
0344e804 77a5cda8 0344e820 0344e950 0344e900 CoreCLR!CLRVectoredExceptionHandlerShim+0xb0
0344e854 77a5902b 00000000 00000000 c0000139 ntdll!RtlpCallVectoredHandlers+0xd7
0344e8e8 77a64ec6 0344e900 0344e950 0344e900 ntdll!RtlDispatchException+0x6f
0344e8e8 77a963b1 0344e900 0344e950 0344e900 ntdll!KiUserExceptionDispatcher+0x26
0344f564 77a2e3ec c0000139 323bea5e 77b15d00 ntdll!LdrpReportError+0x3c41e
0344f601 2677a6ad 0046d0dc 6c000000 650344f6 ntdll!LdrpSnapModule+0x59c
WARNING: Frame IP not in any known module. Following frames may be wrong.
0344f66c 77a27249 77a271f0 03005210 03007b68 0x2677a6ad
0344f67c 77a26d4d 0344f790 00000000 03005210 ntdll!LdrpWorkCallback+0x59
0344f6b0 77a25d52 0344f790 03005288 323be42a ntdll!TppWorkpExecuteCallback+0x1dd
0344f864 7636fa29 03005070 7636fa10 0344f8d0 ntdll!TppWorkerThread+0x472
0344f874 77a57a7e 03005070 323be49e 00000000 KERNEL32!BaseThreadInitThunk+0x19
0344f8d0 77a57a4e ffffffff 77a78a1f 00000000 ntdll!__RtlUserThreadStart+0x2f
0344f8e0 00000000 77a258e0 03005070 00000000 ntdll!_RtlUserThreadStart+0x1b


STACK_COMMAND:  .cxr 344e950 ; kb ; .cxr 0x344dd08 ; kb

THREAD_SHA1_HASH_MOD:  1378a0c552315ec99f53f6bbc798553c716f6f30

FAULT_INSTR_CODE:  8390048b

FAULTING_SOURCE_LINE:  e:\a\_work\140\s\src\vm\excep.cpp

FAULTING_SOURCE_FILE:  e:\a\_work\140\s\src\vm\excep.cpp

FAULTING_SOURCE_LINE_NUMBER:  8452

SYMBOL_STACK_INDEX:  0

SYMBOL_NAME:  coreclr!SaveCurrentExceptionInfo+18

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: CoreCLR

IMAGE_NAME:  CoreCLR.dll

DEBUG_FLR_IMAGE_TIMESTAMP:  5fff5f2b

FAILURE_BUCKET_ID:  NULL_CLASS_PTR_READ_NOSOS_CLRSETUP_MSCORLIBMISMATCH_c0000005_CoreCLR.dll!SaveCurrentExceptionInfo

BUCKET_ID:  APPLICATION_FAULT_NULL_CLASS_PTR_READ_INVALID_POINTER_READ_NOSOS_CLRSETUP_MSCORLIBMISMATCH_AFTER_CALL_coreclr!SaveCurrentExceptionInfo+18

FAILURE_EXCEPTION_CODE:  c0000005

FAILURE_IMAGE_NAME:  CoreCLR.dll

BUCKET_ID_IMAGE_STR:  CoreCLR.dll

FAILURE_MODULE_NAME:  CoreCLR

BUCKET_ID_MODULE_STR:  CoreCLR

FAILURE_FUNCTION_NAME:  SaveCurrentExceptionInfo

BUCKET_ID_FUNCTION_STR:  SaveCurrentExceptionInfo

BUCKET_ID_OFFSET:  18

BUCKET_ID_MODPRIVATE: 1

BUCKET_ID_MODTIMEDATESTAMP:  5fff5f2b

BUCKET_ID_MODCHECKSUM:  3a2f8e

BUCKET_ID_MODVER_STR:  4.6.29713.2

BUCKET_ID_PREFIX_STR:  APPLICATION_FAULT_NULL_CLASS_PTR_READ_INVALID_POINTER_READ_NOSOS_CLRSETUP_MSCORLIBMISMATCH_AFTER_CALL_

FAILURE_PROBLEM_CLASS:  APPLICATION_FAULT

FAILURE_SYMBOL_NAME:  CoreCLR.dll!SaveCurrentExceptionInfo

WATSON_STAGEONE_URL:  http://watson.microsoft.com/StageOne/unknown/1.0.0.0/601d0acc/CoreCLR.dll/4.6.29713.2/5fff5f2b/c0000005/00045516.htm?Retriage=1

TARGET_TIME:  2021-08-26T15:01:12.000Z

OSBUILD:  19042

OSSERVICEPACK:  1151

SERVICEPACK_NUMBER: 0

OS_REVISION: 0

SUITE_MASK:  256

PRODUCT_TYPE:  1

OSPLATFORM_TYPE:  x86

OSNAME:  Windows 10

OSEDITION:  Windows 10 WinNt SingleUserTS

OS_LOCALE:  

USER_LCID:  0

OSBUILD_TIMESTAMP:  1982-02-13 03:10:52

BUILDDATESTAMP_STR:  191206-1406

BUILDLAB_STR:  vb_release

BUILDOSVER_STR:  10.0.19041.1.amd64fre.vb_release.191206-1406

ANALYSIS_SESSION_ELAPSED_TIME:  70da

ANALYSIS_SOURCE:  UM

FAILURE_ID_HASH_STRING:  um:null_class_ptr_read_nosos_clrsetup_mscorlibmismatch_c0000005_coreclr.dll!savecurrentexceptioninfo

FAILURE_ID_HASH:  {7dcee4a3-84b3-7cf6-9977-2215d1abc585}

Followup:     MachineOwner

[JohannesKauffmann]

In fact, after some more investigation, it looks like the issue is indeed similar to #12072. The program crashes while trying to load an intel gfx module, as a result of the libvlc qsv module depending on it as an import dll. Then the windows loader fails, and the CoreCLR tries to read uninitialized TLS data, as shown in the screenshot.

Can anyone confirm that dotnet/coreclr#22702 has been fixed for the UWP CoreCLR as well?

[dotnet-policy-service]

Due to lack of recent activity, this issue has been marked as a candidate for backlog cleanup. It will be closed if no further activity occurs within 14 more days. Any new comment (by anyone, not necessarily the author) will undo this process.

This process is part of our issue cleanup automation.

[dotnet-policy-service]

This issue will now be closed since it had been marked no-recent-activity but received no further activity in the past 14 days. It is still possible to reopen or comment on the issue, but please note that the issue will be locked if it remains inactive for another 30 days.