Random w3wp.exe crashes in .net 4

Question

I have a website that has been working and working absolutely normal for about 8 months. It works with integrated .net 4 mode.

I recently started getting some “random” w3wp.exe crashes, and after 5 of them IIS protection starts up quickly, and I have to manually log in to the server and start the application pool again.

Here's what the event viewer says for Error:

Faulting application name: w3wp.exe, version: 7.5.7601.17514, time stamp: 0x4ce7afa2 Faulting module name: nlssorting.dll, version: 4.0.30319.296, time stamp: 0x504835c7 Exception code: 0xc00000fd Fault offset: 0x000000000000191f Faulting process id: 0x1998 Faulting application start time: 0x01ce6e6b9b80c949 Faulting application path: c:\windows\system32\inetsrv\w3wp.exe Faulting module path: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\nlssorting.dll Report Id: d9cf3164-da5e-11e2-8cc5-f46d0440f6d5 

Immediately after the crashes, I get the Information log in the event viewer, which at the bottom gives me the location of the .wer file.

This is what the .wer files contain:

 Version=1 EventType=APPCRASH EventTime=130162847687759734 ReportType=2 Consent=1 ReportIdentifier=d7c5e520-da5e-11e2-8cc5-f46d0440f6d5 IntegratorReportIdentifier=d7c5e51f-da5e-11e2-8cc5-f46d0440f6d5 Response.type=4 Sig[0].Name=Application Name Sig[0].Value=w3wp.exe Sig[1].Name=Application Version Sig[1].Value=7.5.7601.17514 Sig[2].Name=Application Timestamp Sig[2].Value=4ce7afa2 Sig[3].Name=Fault Module Name Sig[3].Value=nlssorting.dll Sig[4].Name=Fault Module Version Sig[4].Value=4.0.30319.296 Sig[5].Name=Fault Module Timestamp Sig[5].Value=504835c7 Sig[6].Name=Exception Code Sig[6].Value=c00000fd Sig[7].Name=Exception Offset Sig[7].Value=000000000000197d DynamicSig[1].Name=OS Version DynamicSig[1].Value=6.1.7601.2.1.0.1296.17 DynamicSig[2].Name=Locale ID DynamicSig[2].Value=2057 DynamicSig[22].Name=Additional Information 1 DynamicSig[22].Value=6141 DynamicSig[23].Name=Additional Information 2 DynamicSig[23].Value=61419d6dee6cf74b8ac2b00b4c3b3373 DynamicSig[24].Name=Additional Information 3 DynamicSig[24].Value=c19b DynamicSig[25].Name=Additional Information 4 DynamicSig[25].Value=c19b8acf029a3088171b1f5f3dd9dc77 UI[2]=c:\windows\system32\inetsrv\w3wp.exe UI[5]=Check online for a solution (recommended) UI[6]=Check for a solution later (recommended) UI[7]=Close UI[8]=IIS Worker Process stopped working and was closed UI[9]=A problem caused the application to stop working correctly. Windows will notify you if a solution is available. UI[10]=&Close LoadedModule[0]=c:\windows\system32\inetsrv\w3wp.exe LoadedModule[1]=C:\Windows\SYSTEM32\ntdll.dll LoadedModule[2]=C:\Windows\system32\kernel32.dll LoadedModule[3]=C:\Windows\system32\KERNELBASE.dll LoadedModule[4]=C:\Windows\system32\ADVAPI32.dll LoadedModule[5]=C:\Windows\system32\msvcrt.dll LoadedModule[6]=C:\Windows\SYSTEM32\sechost.dll LoadedModule[7]=C:\Windows\system32\RPCRT4.dll LoadedModule[8]=C:\Windows\system32\pcwum.DLL LoadedModule[9]=C:\Windows\system32\USER32.dll LoadedModule[10]=C:\Windows\system32\GDI32.dll LoadedModule[11]=C:\Windows\system32\LPK.dll LoadedModule[12]=C:\Windows\system32\USP10.dll LoadedModule[13]=C:\Windows\system32\ole32.dll LoadedModule[14]=c:\windows\system32\inetsrv\IISUTIL.dll LoadedModule[15]=C:\Windows\system32\IMM32.DLL LoadedModule[16]=C:\Windows\system32\MSCTF.dll LoadedModule[17]=C:\Windows\system32\CRYPTBASE.dll LoadedModule[18]=C:\Windows\system32\ntmarta.dll LoadedModule[19]=C:\Windows\system32\WLDAP32.dll LoadedModule[20]=c:\windows\system32\inetsrv\w3wphost.dll LoadedModule[21]=C:\Windows\system32\OLEAUT32.dll LoadedModule[22]=c:\windows\system32\inetsrv\nativerd.dll LoadedModule[23]=C:\Windows\system32\CRYPT32.dll LoadedModule[24]=C:\Windows\system32\MSASN1.dll LoadedModule[25]=C:\Windows\system32\XmlLite.dll LoadedModule[26]=C:\Windows\system32\ktmw32.dll LoadedModule[27]=c:\windows\system32\inetsrv\IISRES.DLL LoadedModule[28]=C:\Windows\system32\CRYPTSP.dll LoadedModule[29]=C:\Windows\system32\rsaenh.dll LoadedModule[30]=C:\Windows\system32\mscoree.dll LoadedModule[31]=C:\Windows\system32\CLBCatQ.DLL LoadedModule[32]=C:\Windows\system32\mlang.dll LoadedModule[33]=C:\Windows\Microsoft.NET\Framework64\v4.0.30319\webengine4.dll LoadedModule[34]=C:\Windows\system32\MSVCR100_CLR0400.dll LoadedModule[35]=C:\Windows\system32\USERENV.dll LoadedModule[36]=C:\Windows\system32\profapi.dll LoadedModule[37]=C:\Windows\system32\PSAPI.DLL LoadedModule[38]=C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll LoadedModule[39]=C:\Windows\system32\SHLWAPI.dll LoadedModule[40]=C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll LoadedModule[41]=C:\Windows\system32\inetsrv\iiscore.dll LoadedModule[42]=c:\windows\system32\inetsrv\W3TP.dll LoadedModule[43]=c:\windows\system32\inetsrv\w3dt.dll LoadedModule[44]=C:\Windows\system32\HTTPAPI.dll LoadedModule[45]=C:\Windows\system32\slc.dll LoadedModule[46]=C:\Windows\system32\WS2_32.dll LoadedModule[47]=C:\Windows\system32\NSI.dll LoadedModule[48]=C:\Windows\system32\Normaliz.dll LoadedModule[49]=C:\Windows\system32\faultrep.dll LoadedModule[50]=C:\Windows\system32\Secur32.dll LoadedModule[51]=C:\Windows\system32\SSPICLI.DLL LoadedModule[52]=C:\Windows\system32\NLAapi.dll LoadedModule[53]=C:\Windows\system32\napinsp.dll LoadedModule[54]=C:\Windows\System32\mswsock.dll LoadedModule[55]=C:\Windows\system32\DNSAPI.dll LoadedModule[56]=C:\Windows\System32\winrnr.dll LoadedModule[57]=C:\Windows\System32\wshtcpip.dll LoadedModule[58]=C:\Windows\System32\wship6.dll LoadedModule[59]=C:\Windows\system32\IPHLPAPI.DLL LoadedModule[60]=C:\Windows\system32\WINNSI.DLL LoadedModule[61]=C:\Windows\system32\rasadhlp.dll LoadedModule[62]=C:\Windows\System32\fwpuclnt.dll LoadedModule[63]=C:\Windows\System32\inetsrv\cachuri.dll LoadedModule[64]=C:\Windows\System32\inetsrv\cachfile.dll LoadedModule[65]=C:\Windows\System32\inetsrv\cachtokn.dll LoadedModule[66]=C:\Windows\System32\inetsrv\cachhttp.dll LoadedModule[67]=C:\Windows\System32\inetsrv\compdyn.dll LoadedModule[68]=C:\Windows\System32\inetsrv\compstat.dll LoadedModule[69]=C:\Windows\System32\inetsrv\defdoc.dll LoadedModule[70]=C:\Windows\System32\inetsrv\protsup.dll LoadedModule[71]=C:\Windows\System32\inetsrv\redirect.dll LoadedModule[72]=C:\Windows\System32\inetsrv\static.dll LoadedModule[73]=C:\Windows\System32\inetsrv\authanon.dll LoadedModule[74]=C:\Windows\System32\inetsrv\authbas.dll LoadedModule[75]=C:\Windows\System32\inetsrv\authsspi.dll LoadedModule[76]=C:\Windows\system32\NETAPI32.dll LoadedModule[77]=C:\Windows\system32\netutils.dll LoadedModule[78]=C:\Windows\system32\srvcli.dll LoadedModule[79]=C:\Windows\system32\wkscli.dll LoadedModule[80]=C:\Windows\System32\inetsrv\iprestr.dll LoadedModule[81]=C:\Windows\System32\inetsrv\modrqflt.dll LoadedModule[82]=C:\Windows\System32\inetsrv\logcust.dll LoadedModule[83]=C:\Windows\System32\inetsrv\custerr.dll LoadedModule[84]=C:\Windows\System32\inetsrv\loghttp.dll LoadedModule[85]=C:\Windows\System32\inetsrv\isapi.dll LoadedModule[86]=C:\Windows\System32\inetsrv\filter.dll LoadedModule[87]=C:\Windows\System32\inetsrv\validcfg.dll LoadedModule[88]=c:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_filter.dll LoadedModule[89]=C:\Windows\system32\inetsrv\wbhst_pm.dll LoadedModule[90]=C:\Windows\Microsoft.NET\Framework64\v4.0.30319\webengine.dll LoadedModule[91]=C:\Windows\assembly\NativeImages_v4.0.30319_64\mscorlib\4f52500ab48877b85e71430f4f46670f\mscorlib.ni.dll LoadedModule[92]=C:\Windows\Microsoft.NET\Framework64\v4.0.30319\nlssorting.dll LoadedModule[93]=C:\Windows\assembly\NativeImages_v4.0.30319_64\System\a91f32875cb3ba779f1b3ceff1690251\System.ni.dll LoadedModule[94]=C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Core\0a8d99339ffe6b25debb8f8201c27664\System.Core.ni.dll LoadedModule[95]=C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Web\5b905bd7b71f9fd6bea2d05cc1ae85f8\System.Web.ni.dll LoadedModule[96]=C:\Windows\system32\sxs.dll LoadedModule[97]=C:\Windows\system32\RpcRtRemote.dll LoadedModule[98]=C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Configuration\fa65f89fd682c459fc5e7bcbd0418317\System.Configuration.ni.dll LoadedModule[99]=C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Xml\f4afb233f160b8e55aad4660e45b374c\System.Xml.ni.dll LoadedModule[100]=C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clrjit.dll LoadedModule[101]=C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.Build.Uti#\14e16d61fae3cd1d9a1fa79b789f8438\Microsoft.Build.Utilities.v4.0.ni.dll LoadedModule[102]=C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Runtime.Cach#\8fdbe304abab0631b8a4310b35f3d93a\System.Runtime.Caching.ni.dll LoadedModule[103]=C:\Windows\system32\shfolder.dll LoadedModule[104]=C:\Windows\system32\SHELL32.dll LoadedModule[105]=C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.JScript\85204dde340780329b569b025e249c23\Microsoft.JScript.ni.dll LoadedModule[106]=C:\Windows\system32\version.dll LoadedModule[107]=C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Temporary ASP.NET Files\root\587f6661\a99d8ff8\App_Code.cgixlnxh.dll LoadedModule[108]=C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Data.Linq\feaa494ad67542d2060b31b9eeb6458b\System.Data.Linq.ni.dll LoadedModule[109]=C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Data\b928128fca867546a858a1a39240d85c\System.Data.ni.dll LoadedModule[110]=C:\Windows\Microsoft.Net\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll LoadedModule[111]=C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Temporary ASP.NET Files\root\587f6661\a99d8ff8\assembly\dl3\595a888a\f26c0653_7f81cd01\HtmlAgilityPack.dll LoadedModule[112]=C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Drawing\5ae853f556290da9399b15b3619f7e15\System.Drawing.ni.dll LoadedModule[113]=C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Temporary ASP.NET Files\root\587f6661\a99d8ff8\assembly\dl3\85ba5013\f0c8f388_706bce01\TweetSharp.dll LoadedModule[114]=C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Web.Extensio#\0180a2d993d2a9699cf07f7163524fff\System.Web.Extensions.ni.dll LoadedModule[115]=C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Transactions\7b2099a1386e38ff198a51939304ce6e\System.Transactions.ni.dll LoadedModule[116]=C:\Windows\Microsoft.Net\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll LoadedModule[117]=C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Temporary ASP.NET Files\root\587f6661\a99d8ff8\App_global.asax.yxdky-qn.dll LoadedModule[118]=C:\Windows\assembly\NativeImages_v4.0.30319_64\System.ServiceModel#\7a5a5ff4a0b3bb4ba4bcc13166918e36\System.ServiceModel.Activation.ni.dll LoadedModule[119]=C:\Windows\system32\bcrypt.dll LoadedModule[120]=C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Runtime.Dura#\799274e49455d0fe4ca563f42143bef2\System.Runtime.DurableInstancing.ni.dll LoadedModule[121]=C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Numerics\a66416296451fe6d2d8a5506ca41b23d\System.Numerics.ni.dll LoadedModule[122]=C:\Windows\assembly\NativeImages_v4.0.30319_64\System.ServiceModel\15834d73d2846fc01ed54488ccfff5c8\System.ServiceModel.ni.dll LoadedModule[123]=C:\Windows\assembly\NativeImages_v4.0.30319_64\SMDiagnostics\31f93b6be386908ff2727bcd825de0ca\SMDiagnostics.ni.dll LoadedModule[124]=C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Xaml.Hosting\cf8401f4952deb5303e0d7fd459ce530\System.Xaml.Hosting.ni.dll LoadedModule[125]=C:\Windows\system32\inetsrv\gzip.dll LoadedModule[126]=C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Temporary ASP.NET Files\root\587f6661\a99d8ff8\assembly\dl3\3d63b311\fe7c9b8a_706bce01\Hammock.ClientProfile.dll LoadedModule[127]=C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Temporary ASP.NET Files\root\587f6661\a99d8ff8\assembly\dl3\6a128bd2\c184e08a_706bce01\Newtonsoft.Json.dll LoadedModule[128]=C:\Windows\system32\rasapi32.dll LoadedModule[129]=C:\Windows\system32\rasman.dll LoadedModule[130]=C:\Windows\system32\rtutils.dll LoadedModule[131]=C:\Windows\system32\winhttp.dll LoadedModule[132]=C:\Windows\system32\webio.dll LoadedModule[133]=C:\Windows\system32\credssp.dll LoadedModule[134]=C:\Windows\system32\dhcpcsvc6.DLL LoadedModule[135]=C:\Windows\system32\dhcpcsvc.DLL LoadedModule[136]=C:\Windows\system32\security.dll LoadedModule[137]=C:\Windows\system32\schannel.DLL LoadedModule[138]=C:\Windows\system32\ncrypt.dll LoadedModule[139]=C:\Windows\system32\bcryptprimitives.dll LoadedModule[140]=C:\Windows\system32\GPAPI.dll FriendlyEventName=Stopped working ConsentKey=APPCRASH AppName=IIS Worker Process AppPath=c:\windows\system32\inetsrv\w3wp.exe 

That nlssorting.dll seems to be a lot, but I can not find anything on the Internet. The only thing I can find that matches my error is here , but it really doesn't help me.

I am completely at a dead end where to go to fix this. Here is what I tried:

• Downloading IIS log files and searching for each request 30 minutes before the failure, and none of the pages cause any errors.
• Finding my code for any recursion that may call stackoverflow but doesn't exist
• online trawling for ANYTHING that can help

Has anyone else had problems with nlssorting.dll? Can I get more information from a .wer file that can help me indicate where this is happening?

Thanks in advance for your help!

UPDATE

I used a third-party DLL that 0xc00000fd exception ( 0xc00000fd )

After further investigation, this happened only after a certain chain of events occurred - hence the “random” in the title. Removing the DLL fixes the problem.

Answer 1

We had the same problem with one of our sites. Using SVN, we tracked it down to a method that scanned images in a folder.

I changed the code as follows:

• Checking the length of the array of scan results should be> 0 instead of == 1
• Adding CultureInfo.InvariantCulture to all Int32.ToString() calls

After that, we no longer experienced a mistake. The exact cause is still unknown.

I believe that none of the above points should affect our environment. I believe that the problem could be, people changed the files and folders of the images during the call of the image scanning method.

Hope this helps someone.

Answer 2

For anyone interested, this is PITA for debugging. Here are three reasons why rumors are circulating:

(1) Stack overflow, as in the original message.

(2) Too much CPU / memory usage, which becomes obvious, and a quick protection failure closes the process.

(3) It is not possible to respond to pings / requests due to hogging application resources, but in such a way that quick protection against crashes is considered appropriate to complete the process, and not explicitly due to (1) or (2).

Our solution was to add manual log tracing to the production environment until we found a recursion that caused the application to stop the reliability services (due to the inability to respond to pings or an accidental process failure) to exclude the application.

Answer 3

I had a problem when w3p threw an unhandled error as soon as I deployed the URL of the \ api site from a web browser, after which it will work.

I was able to determine what part of my code called it in my case, it was in the Owin launch class, and I read some configuration entries from the database, but before that it gets the connection string from the configuration file outside the web application directory.

I checked the ownership of the folder in which he showed my account, but apparently the subfolders did not belong to me, so I set the ownership of me again, clicked "OK" to allow the intersection of objects, and voila bye bye w3p error and loaded API,

So, in my case, it was an access denied error in the folder \ file containing the connection string.