We encountered an iis crash issue. It is happened randomly in our customer site. It is hard to reproduce in our testing environment. While the issue is happening, the following application error is logged:
Faulting application name: w3wp.exe, version: 8.0.9200.16384, time stamp: 0x5010885f
Faulting module name: KERNELBASE.dll, version: 6.2.9200.16384, time stamp: 0x5010ac2f
Exception code: 0xe0434352
Fault offset: 0x00014b32
Faulting process id: 0x3fb4
Faulting application start time: 0x01d0dfd3e07f2c5e
Faulting application path: C:\Windows\SysWOW64\inetsrv\w3wp.exe
Faulting module path: C:\Windows\SYSTEM32\KERNELBASE.dll
Report Id: a73637e3-4bc9-11e5-9431-441ea13a85ce
Faulting package full name:
Faulting package-relative application ID:
We get the dump files and do analysis. What we get is like:
FAULTING_IP:
KERNELBASE!RaiseException+6c
75954b32 8b4c2454 mov ecx,dword ptr [esp+54h]
EXCEPTION_RECORD: ffffffff -- (.exr 0xffffffffffffffff)
ExceptionAddress: 75954b32 (KERNELBASE!RaiseException+0x0000006c)
ExceptionCode: e0434352 (CLR exception)
ExceptionFlags: 00000001
NumberParameters: 5
Parameter[0]: 80131604
Parameter[1]: 00000000
Parameter[2]: 00000000
Parameter[3]: 00000000
Parameter[4]: 74cb0000
CONTEXT: 00000000 -- (.cxr 0x0;r)
eax=00000000 ebx=2b7ce698 ecx=00000005 edx=00000000 esi=2b7ce608 edi=00000000
eip=77e31318 esp=2b7ce4e0 ebp=2b7ce660 iopl=0 nv up ei pl nz ac po nc
cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00000212
ntdll!NtWaitForMultipleObjects+0xc:
77e31318 c21400 ret 14h
DEFAULT_BUCKET_ID: WRONG_SYMBOLS
PROCESS_NAME: w3wp.exe
ERROR_CODE: (NTSTATUS) 0xe0434352 - <Unable to get error code text>
EXCEPTION_CODE: (NTSTATUS) 0xe0434352 - <Unable to get error code text>
EXCEPTION_PARAMETER1: 80131604
EXCEPTION_PARAMETER2: 00000000
EXCEPTION_PARAMETER3: 00000000
EXCEPTION_PARAMETER4: 0
NTGLOBALFLAG: 0
APPLICATION_VERIFIER_FLAGS: 0
APP: w3wp.exe
ANALYSIS_VERSION: 6.3.9600.17298 (debuggers(dbg).141024-1500) x86fre
MANAGED_STACK:
at IrdetoAccess.PIsys.Commands.ClientDevice.HGPC.ClientDeviceHGPCCommands.activateNetworkHN(SessionContext session, String operatorTag, String smartcardSerialNumber, String serialSecondary1, String activationCode1, String serialSecondary2, String activationCode2, String serialSecondary3, String activationCode3, String serialSecondary4, String activationCode4, CommandResultData commandResult)
at IrdetoAccess.PIsys.ClientDevice.HGPC.HGPC.activateNetworkHN(String operatorTag, UInt64 serialNumber, String serialSecondary1, String activationCode1, String serialSecondary2, String activationCode2, String serialSecondary3, String activationCode3, String serialSecondary4, String activationCode4)
EXCEPTION_OBJECT: !pe 12e55364
Exception object: 12e55364
Exception type: System.Reflection.TargetInvocationException
Message: Exception has been thrown by the target of an invocation.
InnerException: System.AccessViolationException, Use !PrintException 12e59e40 to see more.
StackTrace (generated):
<none>
StackTraceString: <none>
HResult: 80131604
EXCEPTION_OBJECT: !pe 12e59e40
Exception object: 12e59e40
Exception type: System.AccessViolationException
Message: Attempted to read or write protected memory. This is often an indication that other memory is corrupt.
InnerException: <none>
StackTrace (generated):<none>
StackTraceString: <none>
HResult: 80004003
MANAGED_OBJECT: !dumpobj 12e5be14
Name: System.String
MethodTable: 7400afb0
EEClass: 73c1486c
Size: 1416(0x588) bytes
File: C:\Windows\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\mscorlib.dll
String: at IrdetoAccess.PIsys.Commands.ClientDevice.HGPC.ClientDeviceHGPCCommands.activateNetworkHN(SessionContext session, String operatorTag, String smartcardSerialNumber, String serialSecondary1, String activationCode1, String serialSecondary2, String activationCode2, String serialSecondary3, String activationCode3, String serialSecondary4, String activationCode4, CommandResultData commandResult)
at IrdetoAccess.PIsys.ClientDevice.HGPC.HGPC.activateNetworkHN(String operatorTag, UInt64 serialNumber, String serialSecondary1, String activationCode1, String serialSecondary2, String activationCode2, String serialSecondary3, String activationCode3, String serialSecondary4, String activationCode4)
Fields:
MT Field Offset Type VT Attr Value Name
7400c770 40000aa 4 System.Int32 1 instance 701 m_stringLength
7400b9a8 40000ab 8 System.Char 1 instance 20 m_firstChar
7400afb0 40000ac c System.String 0 shared static Empty
>> Domain:Value 014e87a8:NotInit 02686060:NotInit 29bcc5f8:NotInit 29de3d60:NotInit 2ba235c0:NotInit <<
EXCEPTION_MESSAGE: Attempted to read or write protected memory. This is often an indication that other memory is corru
MANAGED_OBJECT_NAME: SYSTEM.ACCESSVIOLATIONEXCEPTION
MANAGED_STACK_COMMAND: ** Check field _remoteStackTraceString **;!do 12e59e40;!do 12e5be14
LAST_CONTROL_TRANSFER: from 74dd48c7 to 75954b32
PRIMARY_PROBLEM_CLASS: WRONG_SYMBOLS
BUGCHECK_STR: APPLICATION_FAULT_WRONG_SYMBOLS_CLR_EXCEPTION
STACK_TEXT:
00000000 00000000 unknown!IrdetoAccess.PIsys.Commands.ClientDevice.HGPC.ClientDeviceHGPCCommands.activateNetworkHN+0x0
00000000 00000000 unknown!IrdetoAccess.PIsys.ClientDevice.HGPC.HGPC.activateNetworkHN+0x0
SYMBOL_STACK_INDEX: 0
SYMBOL_NAME: unknown!IrdetoAccess.PIsys.Commands.ClientDevice.HGPC.ClientDeviceHGPCCommands.activateNetworkHN
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: unknown
IMAGE_NAME: unknown
DEBUG_FLR_IMAGE_TIMESTAMP: 0
STACK_COMMAND: ** Check field _remoteStackTraceString **;!do 12e59e40;!do 12e5be14 ; ** Pseudo Context ** ; kb
FAILURE_BUCKET_ID: WRONG_SYMBOLS_e0434352_unknown!IrdetoAccess.PIsys.Commands.ClientDevice.HGPC.ClientDeviceHGPCCommands.activateNetworkHN
BUCKET_ID: APPLICATION_FAULT_WRONG_SYMBOLS_CLR_EXCEPTION_unknown!IrdetoAccess.PIsys.Commands.ClientDevice.HGPC.ClientDeviceHGPCCommands.activateNetworkHN
ANALYSIS_SOURCE: UM
FAILURE_ID_HASH_STRING: um:wrong_symbols_e0434352_unknown!irdetoaccess.pisys.commands.clientdevice.hgpc.clientdevicehgpccommands.activatenetworkhn
FAILURE_ID_HASH: {08572cef-1715-466a-1a7b-4f80c3617a30}
Followup: MachineOwner
Any suggestion are appreciated.