EventType clr20r3, P1 w3wp.exe – system.nullreferenceexception

December 15th, 2011
By: Cory Mathews

My web app was crashing every few minutes, logging everyone off and completely restarting. Here was the message I had to go on and how I fixed it.

Event Type: Error
Event Source: .NET Runtime 2.0 Error Reporting
Event Category: None
Event ID: 5000
Date: ******
Time: *******
User: N/A
Computer: *******
EventType clr20r3, P1 w3wp.exe, P2 6.0.3790.3959, P3 *******, P4 *******, P5, P6 *******, P7 3b6, P8 c2, P9 system.nullreferenceexception, P10 NIL.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

This was found in my Windows Application Error Log. Basically I had a system.nullreferenceexception somewhere in my application that was causing the ENTIRE application to restart. Fucking retarded, but according to this KB

“ASP.NET uses the default policy for unhandled exceptions in the .NET Framework 2.0. When an unhandled exception is thrown, the ASP.NET-based application unexpectedly quits.

This behavior does not apply to exceptions that occur in the context of a request. These kinds of exceptions are still handled and wrapped by an HttpException object. Exceptions that occur in the context of a request do not cause the worker process to end. However, unhandled exceptions outside the context of a request, such as exceptions on a timer thread or in a callback function, cause the worker process to end.

“This behavior is by design.”

So now I know that I have an error in code that runs behind the scenes. But without some direction good luck ever figuring out the problem, which is where this nasty cryptic error message above comes into play.

The key items are the P1 РP10 specifically p7. According to this article on clr20r3 (notice clr20r3 was given before the P1 for EventType)

P1: Application Name
P2: Application version
P3: Application time stamp
P4: Assembly/Module name
P5: Assembly/Module version
p6: Assembly/Module timestamp
P7: MethodDef
p8: IL offset
p9: Exception name (Hashed because the name is too long )

So in my error above p7 is 3b6. Now comes the fun part. Open up IL Disassembler (comes with visual studio under the SDK tools)

  1. Go to File > Open and select the .dll the error is happening in (the P4 from the error message)
  2. View > Meta Info > Show!
  3. Find and type in 06000 and your p7 so in this case 060003b6
  4. You should see something like the picture below. If you scroll up the page it will say class and you should be able to narrow down the function causing the error from there.