We run a program as a service and we attach adplus to it to get crash dumps.

On startup, we semi-regularly get crash dumps with a first chance access violation with the following call stack

```
0:011> !mk -cc
Thread 11:
           IP
00:M 00007ffa710ca358 PerformanceMonitor.GetData(String)(+0x19 IL,+0x88 Native)
01:M 00007ffa710c7c5f PerformanceCounterLib.GetPerformanceData(String)(+0xff Native)
02:M 00007ffa710c7e2c PerformanceCounterLib.get_CategoryTable()(+0x35 IL,+0xac Native)
03:M 00007ffa710c771e PerformanceCounterLib.GetCategorySample(String, String)(+0xe IL,+0x4e Native)
04:M 00007ffa710b605f PerformanceCounterCategory.GetCounterInstances(String, String)(+0x11 IL,+0x8f Native)
05:M 00007ffa165c4ef1 PerformanceCounterCollection.AddCounter(String, String)(+0xad IL,+0x241 Native)
06:M 00007ffa165c4a9f MonitorResponder.CreatePerformanceCounters()(+0x30 IL,+0x8f Native)
07:M 00007ffa165c47ac MonitorResponder.Start()(+0xa IL,+0x2c Native)
08:M 00007ffa718b39a5 ExecutionContext.RunInternal(ExecutionContext, ContextCallback, Object, Boolean)(+0x72 IL,+0x285 Native)
09:M 00007ffa718b3719 ExecutionContext.Run(ExecutionContext, ContextCallback, Object, Boolean)(+0x0 IL,+0x9 Native)
0a:M 00007ffa718b36f7 ExecutionContext.Run(ExecutionContext, ContextCallback, Object)(+0x57 Native)
0b:M 00007ffa718cadc1 ThreadHelper.ThreadStart()(+0x51 Native)
0c:U 00007ffa75b7a7f3 clr!CallDescrWorkerInternal+0x83
0d:U 00007ffa75b7a6de clr!CallDescrWorkerWithHandler+0x4a
0e:U 00007ffa75b7ae76 clr!MethodDescCallSite::CallTargetWorker+0x251
0f:U 00007ffa75d2969d clr!ThreadNative::KickOffThread_Worker+0x105
10:U 00007ffa75b7c121 clr!ManagedThreadBase_DispatchInner+0x2d
11:U 00007ffa75b7c0a8 clr!ManagedThreadBase_DispatchMiddle+0x6c
12:U 00007ffa75b7c019 clr!ManagedThreadBase_DispatchOuter+0x75
13:U 00007ffa75b7c15f clr!ManagedThreadBase_FullTransitionWithAD+0x2f
14:U 00007ffa75d2957e clr!ThreadNative::KickOffThread+0xd2
15:U 00007ffa75cbfcb6 clr!Thread::intermediateThreadProc+0x7d
16:U 00007ffa7e4a13d2 kernel32!BaseThreadInitThunk+0x22
17:U 00007ffa80b45454 ntdll!RtlUserThreadStart+0x34

```

I believe our dump actually comes from:

```
     foreach ( string instanceName in category.GetInstanceNames() )

```

WinDbg gives this line number and when I decompiled it showed that it calls GetCounterInstances.

```
/// <summary>
/// Retrieves the list of performance object instances that are associated with this category.
/// </summary>
/// 
/// <returns>
/// An array of strings representing the performance object instance names that are associated with this category or, if the category contains only one performance object instance, a single-entry array that contains an empty string ("").
/// </returns>
/// <exception cref="T:System.InvalidOperationException">The <see cref="P:System.Diagnostics.PerformanceCounterCategory.CategoryName"/> property is null. The property might not have been set. -or-The category does not have an associated instance.</exception><exception cref="T:System.ComponentModel.Win32Exception">A call to an underlying system API failed. </exception><exception cref="T:System.UnauthorizedAccessException">Code that is executing without administrative privileges attempted to read a performance counter.</exception><filterpriority>2</filterpriority><PermissionSet><IPermission class="System.Security.Permissions.EnvironmentPermission, mscorlib, Version=2.0.3600.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" version="1" Unrestricted="true"/><IPermission class="System.Security.Permissions.SecurityPermission, mscorlib, Version=2.0.3600.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" version="1" Flags="UnmanagedCode"/><IPermission class="System.Diagnostics.PerformanceCounterPermission, System, Version=2.0.3600.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" version="1" Unrestricted="true"/></PermissionSet>
public string[] GetInstanceNames()
{
  if (this.categoryName == null)
    throw new InvalidOperationException(SR.GetString("CategoryNameNotSet"));
  return PerformanceCounterCategory.GetCounterInstances(this.categoryName, this.machineName);
}

```

From here: <https://msdn.microsoft.com/en-us/library/vstudio/system.diagnostics.performancecountercategory.getinstancenames(v=vs.100).aspx>

I see that this method throws InvalidOperationException, Win32Exception, UnauthorizedAccessException.

Our c# code doesn't seem to have any exception handling in this area. 

I'm wondering:
If we did try to catch InvalidOperationException, Win32Exception, and UnauthorizedAccessException would we still get a crash dump with a first chance access violation?

Can an access violation from a call to PerformanceCounterCategory.GetCounterInstances be handled?

I'm a little fuzzy on whether access violations can be handled successfully. In this case we are calling out to .NET libraries for PerformanceCounters - so it is not like we can modify this code to prevent the access violation from happening.

We don't get this crash very often, but often enough that I recognize the callstack.

**Edit:**

We do run with legacyCorruptedStateExceptionsPolicy enabled="true"

With our QA Servers – we run with full dump and exit on first chance access violations.

I believe our reasoning with this is that we don’t want to run with a corrupted process, and we want to get as much information as possible as soon as we get an access violation.

It could be nested deep inside a c++ call stack, but we could have a managed exception handler at the entry point.

We don’t want do a full dump and continue because sometimes you can get into a bad state and end up with tons of crash dumps. Also, a full dump can take a long time, which I think can cause other problems.

By default customers don't run with adplus attached, but if they do, they run with minidump and continue on first-chance access violations. For us, we always run with full dumps on first-chance access violations because we get better information out of them.

I guess our dilemma is that we want a full dump on first-chance if we have an access violation inside our c++ code but not necessarily when we are calling into .NET code and getting an access violation that we “handle”. Although it is said that you can’t “handle” access violations.

I have seen several crash dumps on qa servers for server startup around PerformanceMonitor. I checked and we do actually catch exceptions around this. The problem is that when we have adplus attached to do full dump and exit on first chance access violations I end up with these crash dumps.

I guess I can probably ignore them, since they are likely handled safely when we don't had adplus set to do full dumps and exits on first-chance access violations.

```
0:011> .exr -1
ExceptionAddress: 00007ffa710ca358 (System_ni+0x000000000093a358)
   ExceptionCode: c0000005 (Access violation)
  ExceptionFlags: 00000000
NumberParameters: 2
   Parameter[0]: 0000000000000000
   Parameter[1]: 0000000000000000
Attempt to read from address 0000000000000000

```