Hello everyone.
Our URP game in version 2022.3.15f1 is crashing quite often at completely random times in the build. From the dump file it is this issue(which everyone gets with the same problem):
NULL_CLASS_PTR_WRITE_c0000005_UnityPlayer.dll!Unknown
We’ve read countless posts regarding the same issue and still could not find the right solution for our game. Apparently with some games that had this issue resolved they found out it was caused by certain external packages.
This is the exception analysis provided by WinDbg.
0:000> !analyze -v
*******************************************************************************
* *
* Exception Analysis *
* *
*******************************************************************************
KEY_VALUES_STRING: 1
Key : AV.Dereference
Value: NullClassPtr
Key : AV.Fault
Value: Write
Key : Analysis.CPU.mSec
Value: 468
Key : Analysis.Elapsed.mSec
Value: 7441
Key : Analysis.IO.Other.Mb
Value: 20
Key : Analysis.IO.Read.Mb
Value: 0
Key : Analysis.IO.Write.Mb
Value: 56
Key : Analysis.Init.CPU.mSec
Value: 234
Key : Analysis.Init.Elapsed.mSec
Value: 34066
Key : Analysis.Memory.CommitPeak.Mb
Value: 110
Key : Failure.Bucket
Value: NULL_CLASS_PTR_WRITE_c0000005_UnityPlayer.dll!Unknown
Key : Failure.Hash
Value: {d3f8a8e0-0579-efb9-a6f0-5117c4205698}
Key : Timeline.OS.Boot.DeltaSec
Value: 33373
Key : Timeline.Process.Start.DeltaSec
Value: 2170
Key : WER.OS.Branch
Value: ni_release
Key : WER.OS.Version
Value: 10.0.22621.1
Key : WER.Process.Version
Value: 9.18.944.0
FILE_IN_CAB: crash.dmp
CONTEXT: (.ecxr)
rax=0000000000000000 rbx=0000029dab433c00 rcx=ffffffffffffffff
rdx=0000000000000000 rsi=0000029e1e440c40 rdi=0000029a52309de0
rip=00007ffcac81ff51 rsp=0000009dddeedae8 rbp=0000009dddeedca0
r8=0000029a52309de0 r9=0000000000000000 r10=00000000fff7013c
r11=00000000000ffff8 r12=0000009dddeee3e0 r13=0000009dddeee570
r14=0000029b09702d20 r15=0000029c128ffb60
iopl=0 nv up ei ng nz na po nc
cs=0033 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00010286
UnityPlayer+0x76ff51:
00007ffc`ac81ff51 48894108 mov qword ptr [rcx+8],rax ds:00000000`00000007=????????????????
Resetting default scope
EXCEPTION_RECORD: (.exr -1)
ExceptionAddress: 00007ffcac81ff51 (UnityPlayer+0x000000000076ff51)
ExceptionCode: c0000005 (Access violation)
ExceptionFlags: 00000000
NumberParameters: 2
Parameter[0]: 0000000000000001
Parameter[1]: 0000000000000007
Attempt to write to address 0000000000000007
PROCESS_NAME: Inkression.exe
WRITE_ADDRESS: 0000000000000007
ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%p referenced memory at 0x%p. The memory could not be %s.
EXCEPTION_CODE_STR: c0000005
EXCEPTION_PARAMETER1: 0000000000000001
EXCEPTION_PARAMETER2: 0000000000000007
STACK_TEXT:
0000009d`ddeedae8 00007ffc`ac820019 : 0000029a`52309de0 0000029d`ab433c00 0000009d`ddeedca0 0000029b`925c4400 : UnityPlayer+0x76ff51
0000009d`ddeedaf0 0000029a`52309de0 : 0000029d`ab433c00 0000009d`ddeedca0 0000029b`925c4400 bf73f256`bf73f400 : UnityPlayer+0x770019
0000009d`ddeedaf8 0000029d`ab433c00 : 0000009d`ddeedca0 0000029b`925c4400 bf73f256`bf73f400 00000000`2d50a880 : 0x0000029a`52309de0
0000009d`ddeedb00 0000009d`ddeedca0 : 0000029b`925c4400 bf73f256`bf73f400 00000000`2d50a880 0000029d`17a68400 : 0x0000029d`ab433c00
0000009d`ddeedb08 0000029b`925c4400 : bf73f256`bf73f400 00000000`2d50a880 0000029d`17a68400 0000029d`17a68400 : 0x0000009d`ddeedca0
0000009d`ddeedb10 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x0000029b`925c4400
STACK_COMMAND: ~0s; .ecxr ; kb
SYMBOL_NAME: UnityPlayer+76ff51
MODULE_NAME: UnityPlayer
IMAGE_NAME: UnityPlayer.dll
FAILURE_BUCKET_ID: NULL_CLASS_PTR_WRITE_c0000005_UnityPlayer.dll!Unknown
OS_VERSION: 10.0.22621.1
BUILDLAB_STR: ni_release
OSPLATFORM_TYPE: x64
OSNAME: Windows 10
IMAGE_VERSION: 2022.3.15.32803
FAILURE_ID_HASH: {d3f8a8e0-0579-efb9-a6f0-5117c4205698}
Followup: MachineOwner
---------
Any assistance will be greatly appreciated as this issue has been happening for quite sometime. We’ve also noticed this crash to only happen for desktops but never for laptops. Hope that would help. Thank you.
Can you point WinDBG to https://symbolserver.unity3d.com? That’d make it give you a symbolicated callstack. You can do that by executing “.sympath+ https://symbolserver.unity3d.com” before doing “!analyze -v”.
UnityPlayer.dll is the entire Unity runtime. So it could be anything.
Like actually doing .sympath+ with the link? I’ll try that.
This is the output:
0:000> .sympath+ https://symbolserver.unity3d.com
Symbol search path is: srv*;https://symbolserver.unity3d.com
Expanded Symbol search path is: cache*;SRV*https://msdl.microsoft.com/download/symbols;https://symbolserver.unity3d.com
************* Path validation summary **************
Response Time (ms) Location
Deferred srv*
Deferred https://symbolserver.unity3d.com
What does this mean?
It means it successfully added the Unity symbol server to the list of the servers to load symbols from. I think if you do “!analyze -v” it should produce better results. If it still doesn’t have a proper stacktrace, you might need to run “.reload /f” first.
This is the output after running !analyze -v. I noticed the difference with the regular one is:
UnityPlayer!MonoBehaviour::RemoveNodesFromLists+0xf1:
0:000> !analyze -v
*******************************************************************************
* *
* Exception Analysis *
* *
*******************************************************************************
KEY_VALUES_STRING: 1
Key : AV.Dereference
Value: NullClassPtr
Key : AV.Fault
Value: Write
Key : Analysis.CPU.mSec
Value: 796
Key : Analysis.Elapsed.mSec
Value: 2073
Key : Analysis.IO.Other.Mb
Value: 1
Key : Analysis.IO.Read.Mb
Value: 5
Key : Analysis.IO.Write.Mb
Value: 25
Key : Analysis.Init.CPU.mSec
Value: 296
Key : Analysis.Init.Elapsed.mSec
Value: 5953810
Key : Analysis.Memory.CommitPeak.Mb
Value: 133
Key : Failure.Bucket
Value: NULL_CLASS_PTR_WRITE_c0000005_UnityPlayer.dll!MonoBehaviour::RemoveNodesFromLists
Key : Failure.Hash
Value: {a562086a-23bd-7205-2c04-3026df1f4d53}
Key : Timeline.OS.Boot.DeltaSec
Value: 33373
Key : Timeline.Process.Start.DeltaSec
Value: 2170
Key : WER.OS.Branch
Value: ni_release
Key : WER.OS.Version
Value: 10.0.22621.1
Key : WER.Process.Version
Value: 9.18.944.0
FILE_IN_CAB: crash.dmp
CONTEXT: (.ecxr)
rax=0000000000000000 rbx=0000029dab433c00 rcx=ffffffffffffffff
rdx=0000000000000000 rsi=0000029e1e440c40 rdi=0000029a52309de0
rip=00007ffcac81ff51 rsp=0000009dddeedae8 rbp=0000009dddeedca0
r8=0000029a52309de0 r9=0000000000000000 r10=00000000fff7013c
r11=00000000000ffff8 r12=0000009dddeee3e0 r13=0000009dddeee570
r14=0000029b09702d20 r15=0000029c128ffb60
iopl=0 nv up ei ng nz na po nc
cs=0033 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00010286
UnityPlayer!MonoBehaviour::RemoveNodesFromLists+0xf1:
00007ffc`ac81ff51 48894108 mov qword ptr [rcx+8],rax ds:00000000`00000007=????????????????
Resetting default scope
EXCEPTION_RECORD: (.exr -1)
ExceptionAddress: 00007ffcac81ff51 (UnityPlayer!MonoBehaviour::RemoveNodesFromLists+0x00000000000000f1)
ExceptionCode: c0000005 (Access violation)
ExceptionFlags: 00000000
NumberParameters: 2
Parameter[0]: 0000000000000001
Parameter[1]: 0000000000000007
Attempt to write to address 0000000000000007
PROCESS_NAME: Inkression.exe
WRITE_ADDRESS: 0000000000000007
That output looks cut off, is there nothing below that?
I’m thinking Unity Cloud Diagnostics could help to diagnose such issues. It’s free but the number of reports are limited in free.
This is the full output here:
*******************************************************************************
* *
* Exception Analysis *
* *
*******************************************************************************
KEY_VALUES_STRING: 1
Key : AV.Dereference
Value: NullClassPtr
Key : AV.Fault
Value: Write
Key : Analysis.CPU.mSec
Value: 1015
Key : Analysis.Elapsed.mSec
Value: 1657
Key : Analysis.IO.Other.Mb
Value: 0
Key : Analysis.IO.Read.Mb
Value: 0
Key : Analysis.IO.Write.Mb
Value: 0
Key : Analysis.Init.CPU.mSec
Value: 171
Key : Analysis.Init.Elapsed.mSec
Value: 45608
Key : Analysis.Memory.CommitPeak.Mb
Value: 162
Key : Failure.Bucket
Value: NULL_CLASS_PTR_WRITE_c0000005_UnityPlayer.dll!MonoBehaviour::RemoveNodesFromLists
Key : Failure.Hash
Value: {a562086a-23bd-7205-2c04-3026df1f4d53}
Key : Timeline.OS.Boot.DeltaSec
Value: 33373
Key : Timeline.Process.Start.DeltaSec
Value: 2170
Key : WER.OS.Branch
Value: ni_release
Key : WER.OS.Version
Value: 10.0.22621.1
Key : WER.Process.Version
Value: 9.18.944.0
FILE_IN_CAB: crash.dmp
CONTEXT: (.ecxr)
rax=0000000000000000 rbx=0000029dab433c00 rcx=ffffffffffffffff
rdx=0000000000000000 rsi=0000029e1e440c40 rdi=0000029a52309de0
rip=00007ffcac81ff51 rsp=0000009dddeedae8 rbp=0000009dddeedca0
r8=0000029a52309de0 r9=0000000000000000 r10=00000000fff7013c
r11=00000000000ffff8 r12=0000009dddeee3e0 r13=0000009dddeee570
r14=0000029b09702d20 r15=0000029c128ffb60
iopl=0 nv up ei ng nz na po nc
cs=0033 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00010286
UnityPlayer!MonoBehaviour::RemoveNodesFromLists+0xf1:
00007ffc`ac81ff51 48894108 mov qword ptr [rcx+8],rax ds:00000000`00000007=????????????????
Resetting default scope
EXCEPTION_RECORD: (.exr -1)
ExceptionAddress: 00007ffcac81ff51 (UnityPlayer!MonoBehaviour::RemoveNodesFromLists+0x00000000000000f1)
ExceptionCode: c0000005 (Access violation)
ExceptionFlags: 00000000
NumberParameters: 2
Parameter[0]: 0000000000000001
Parameter[1]: 0000000000000007
Attempt to write to address 0000000000000007
PROCESS_NAME: Inkression.exe
WRITE_ADDRESS: 0000000000000007
ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%p referenced memory at 0x%p. The memory could not be %s.
EXCEPTION_CODE_STR: c0000005
EXCEPTION_PARAMETER1: 0000000000000001
EXCEPTION_PARAMETER2: 0000000000000007
STACK_TEXT:
0000009d`ddeedae8 00007ffc`ac820019 : 0000029a`52309de0 0000029d`ab433c00 0000009d`ddeedca0 0000029b`925c4400 : UnityPlayer!MonoBehaviour::RemoveNodesFromLists+0xf1
0000009d`ddeedaf0 00007ffc`ac4f1f44 : 0000029d`ab433c00 0000029d`17a68400 00000000`00000002 00007ffc`b21355bb : UnityPlayer!MonoBehaviour::RemoveFromManager+0x99
0000009d`ddeedb40 00007ffc`ac830a03 : 0000029a`52c14ed0 0000029d`1678adc0 0000009d`ddeedb80 00007ffc`b260f188 : UnityPlayer!Behaviour::SetEnabled+0x64
0000009d`ddeedb70 00007ffc`ac1b4d35 : 0000029a`53151a20 0000029e`1e440c40 00000000`00000000 00007ffc`b1ff8166 : UnityPlayer!Scripting::smile:isableBehaviours+0x53
0000009d`ddeedba0 0000029d`da5120cf : 0000029e`fff7013c 0000029e`1e440c40 0000029e`1e440c40 0000029a`2750c520 : UnityPlayer!Object_CUSTOM_Destroy+0x115
0000009d`ddeedc00 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x0000029d`da5120cf
STACK_COMMAND: ~0s; .ecxr ; kb
SYMBOL_NAME: UnityPlayer!MonoBehaviour::RemoveNodesFromLists+f1
MODULE_NAME: UnityPlayer
IMAGE_NAME: UnityPlayer.dll
FAILURE_BUCKET_ID: NULL_CLASS_PTR_WRITE_c0000005_UnityPlayer.dll!MonoBehaviour::RemoveNodesFromLists
OS_VERSION: 10.0.22621.1
BUILDLAB_STR: ni_release
OSPLATFORM_TYPE: x64
OSNAME: Windows 10
IMAGE_VERSION: 2022.3.15.32803
FAILURE_ID_HASH: {a562086a-23bd-7205-2c04-3026df1f4d53}
Followup: MachineOwner
Based on research apparently this might be caused due to some problem with RenderFeatures and possibly could be from certain packages.
Currently we are using:
- Beautify Post Processing
- Volumetric fog
- Bakery
- Amplified shader
Also our game does constantly modify material intance’s values to change its appearance, not sure if that could be the source of the crash?
It crashes when destroying some game object, Either because it is being destroyed twice or because memory is corrupted. I’d recommend try running the game with the -debugallocator command line flag and see if you can get it to crash more reliably. That’d help narrowing the possibilities down.
Could you provide specifically how to run the -debugallocator command? Are we supposed to run it in the build?
Yes, you run the build. You can either run it via the command prompt/Windows Terminal and specify it there, or create shortcut to the game .exe, then go into the shortcut properties and add it there.
When running under that what kind of report does it generate?
It doesn’t generate anything special - you will get a .dmp file and a log file just like with normal crashes. But it hopefully would make it crash earlier and would pinpoint what’s causing it.
We’ve also identified crashes on laptops as well. All crash.dmp files output the same as what I’ve attached earlier. We are using cloud diagnostics and this is the thread that crashed in one of the crashes:
Thread 23 (crashed)
0 ntdll 0x00007fffe69104a4 ZwWaitForMultipleObjects
1 KERNELBASE 0x00007fffe3befda9 WaitForMultipleObjectsEx
2 KERNELBASE 0x00007fffe3befcae WaitForMultipleObjects
3 UnityPlayer 0x00007fff03ab9c7d winutils::ExternalCrashHandler::HandleCrash (C:\build\output\unity\unity\PlatformDependent\Win\ExternalCrashHandler.cpp:357)
4 UnityPlayer 0x00007fff03ad0890 winutils::CrashHandler::HandleCrash (C:\build\output\unity\unity\PlatformDependent\Win\CrashHandler.cpp:285)
5 UnityPlayer 0x00007fff03ad6d89 winutils::ProcessInternalCrash (C:\build\output\unity\unity\PlatformDependent\Win\WinUtils.cpp:594)
6 KERNELBASE 0x00007fffe3cecd9c UnhandledExceptionFilter
7 ntdll 0x00007fffe691907d RtlUserThreadStart$filt$0
8 ntdll 0x00007fffe68ff187 _C_specific_handler
9 ntdll 0x00007fffe69149ff RtlpExecuteHandlerForException
10 ntdll 0x00007fffe688e466 RtlDispatchException
11 ntdll 0x00007fffe69139ee KiUserExceptionDispatcher
12 UnityPlayer 0x00000000005d688a (C:\build\output\unity\unity\Runtime\Profiler\ProfilerRecorder.h:135)
13 UnityPlayer 0x00007fff036a688a profiling::ProfilerManager:
isposeProfilerRecorder (C:\build\output\unity\unity\Runtime\Profiler\ProfilerManager.cpp:636)
14 (Mono)
15 (Mono)
16 (Mono)
17 (Mono)
18 (Mono)
19 mono-2.0-bdwgc 0x00007fff0a776f57 mono_gc_run_finalize (C:\build\output\Unity-Technologies\mono\mono\metadata\gc.c:383)
20 mono-2.0-bdwgc 0x00007fff0a9fca48 GC_invoke_finalizers (C:\build\output\Unity-Technologies\mono\external\bdwgc\finalize.c:1318)
21 mono-2.0-bdwgc 0x00000000002686a8 mono_runtime_do_background_work (C:\build\output\Unity-Technologies\mono\mono\metadata\gc.c:987)
22 mono-2.0-bdwgc 0x00007fff0a7786a8 finalizer_thread (C:\build\output\Unity-Technologies\mono\mono\metadata\gc.c:1036)
23 mono-2.0-bdwgc 0x00007fff0a70f98b start_wrapper_internal (C:\build\output\Unity-Technologies\mono\mono\metadata\threads.c:1272)
24 mono-2.0-bdwgc 0x00007fff0a70fb9e start_wrapper (C:\build\output\Unity-Technologies\mono\mono\metadata\threads.c:1348)
25 KERNEL32 0x00007fffe508257d BaseThreadInitThunk
26 ntdll 0x00007fffe68caa48 RtlUserThreadStart
27 ntdll 0x00007fffe68caa48 RtlUserThreadStart
Does this help with anything??
We just used debugallocator and found this:
UnityPlayer!profiling::ProfilerManager:isposeProfilerRecorder+a
Here is the full report:
KEY_VALUES_STRING: 1
Key : AV.Fault
Value: Write
Key : Analysis.CPU.mSec
Value: 1015
Key : Analysis.Elapsed.mSec
Value: 1583
Key : Analysis.IO.Other.Mb
Value: 0
Key : Analysis.IO.Read.Mb
Value: 0
Key : Analysis.IO.Write.Mb
Value: 0
Key : Analysis.Init.CPU.mSec
Value: 202
Key : Analysis.Init.Elapsed.mSec
Value: 66172
Key : Analysis.Memory.CommitPeak.Mb
Value: 162
Key : Failure.Bucket
Value: INVALID_POINTER_WRITE_c0000005_UnityPlayer.dll!profiling::ProfilerManager::smile:isposeProfilerRecorder
Key : Failure.Hash
Value: {85c48d41-c878-90e2-7bdc-c4d05941acc0}
Key : Timeline.Process.Start.DeltaSec
Value: 1383
Key : WER.OS.Branch
Value: ni_release
Key : WER.OS.Version
Value: 10.0.22621.1
Key : WER.Process.Version
Value: 9.18.944.0
FILE_IN_CAB: crash.dmp
CONTEXT: (.ecxr)
rax=0000000000000004 rbx=000002a48928ffa0 rcx=000002a18ede0b80
rdx=00000d78ed140f00 rsi=0000000000000004 rdi=000000dd3c3ffa08
rip=00007ffc5e43688a rsp=000000dd3c3ff910 rbp=000000dd3c3ff9d0
r8=000000dd3c3ffc58 r9=0000000000000000 r10=000002a48928ffa0
r11=00007ffd56af8100 r12=00007ffd56ac97f0 r13=000002a16f7ac690
r14=000002a176a15d38 r15=000002a16f770d90
iopl=0 nv up ei pl nz na pe nc
cs=0033 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00010202
UnityPlayer!profiling::ProfilerManager::smile:isposeProfilerRecorder+0xa:
00007ffc`5e43688a 4883aaf000000001 sub qword ptr [rdx+0F0h],1 ds:00000d78`ed140ff0=????????????????
Resetting default scope
EXCEPTION_RECORD: (.exr -1)
ExceptionAddress: 00007ffc5e43688a (UnityPlayer!profiling::ProfilerManager::smile:isposeProfilerRecorder+0x000000000000000a)
ExceptionCode: c0000005 (Access violation)
ExceptionFlags: 00000000
NumberParameters: 2
Parameter[0]: 0000000000000001
Parameter[1]: 00000d78ed140ff0
Attempt to write to address 00000d78ed140ff0
PROCESS_NAME: Inkression.exe
WRITE_ADDRESS: 00000d78ed140ff0
ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%p referenced memory at 0x%p. The memory could not be %s.
EXCEPTION_CODE_STR: c0000005
EXCEPTION_PARAMETER1: 0000000000000001
EXCEPTION_PARAMETER2: 00000d78ed140ff0
IP_ON_HEAP: 000002a179131295
The fault address in not in any loaded module, please check your build's rebase
log at <releasedir>\bin\build_logs\timebuild\ntrebase.log for module which may
contain the address if it were loaded.
FRAME_ONE_INVALID: 1
STACK_TEXT:
000000dd`3c3ff910 000002a1`79131295 : 00000000`0000000c 00000d35`a1fd0f70 00000000`00000004 00007ffd`56ba0407 : UnityPlayer!profiling::ProfilerManager::smile:isposeProfilerRecorder+0xa
000000dd`3c3ff940 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x000002a1`79131295
SYMBOL_NAME: UnityPlayer!profiling::ProfilerManager::smile:isposeProfilerRecorder+a
MODULE_NAME: UnityPlayer
IMAGE_NAME: UnityPlayer.dll
STACK_COMMAND: ~20s; .ecxr ; kb
FAILURE_BUCKET_ID: INVALID_POINTER_WRITE_c0000005_UnityPlayer.dll!profiling::ProfilerManager::smile:isposeProfilerRecorder
OS_VERSION: 10.0.22621.1
BUILDLAB_STR: ni_release
OSPLATFORM_TYPE: x64
OSNAME: Windows 10
IMAGE_VERSION: 2022.3.15.32803
FAILURE_ID_HASH: {85c48d41-c878-90e2-7bdc-c4d05941acc0}
Followup: MachineOwner
---------
We looked up the exception and apparently there is this thread: Unity Issue Tracker - Crash on profiling::ProfilerManager::DisposeProfilerRecorder when Editor is in play mode.
If this is indeed the issue caused because we’re still using 2022.3.15, would updating to a newer version get rid of this bug? If so which version should we migrate to that still supports LTS?
This issue was supposed to be fixed in 2022.3.9, so if you’re seeing it in 2022.3.15, it’s possible it could be a different issue. Trying the newest LTS version is always a good idea just to see if it makes any difference.
Is the reproduction with -debugallocator consistent? Does it always crash in the same place?
No it’s crashing at completely random and different times. We upgraded to 2022.3.33f1 but it still crashes for people. We try to run -debugallocator more but the output is still the same as yesterday with the profiler bug.
This is getting really frustrating. 