BUG: An access violation occurs in fusion during shutdown (327423)

CAUSE

For each application domain, fusion (assembly binding) maintains a bind history object that keeps track of all the assemblies that are loaded and the policy resolutions that resulted in loading that assembly. This information is typically flushed at process shutdown into an .ini file, which the .NET application Restore tool uses to repair applications that policy has broken.

The bind history object internally uses a linked list to keep track of all the information that is associated with each assembly bind. Because the bind history object uses the list in a non-thread-safe manner, contention updating the list may result in inconsistent data. There are two main side effects of this:

• When an application tries to bind to many assemblies at the same time, the list data may not be updated correctly, causing the information for one of binds in contention to be lost.
• When the two binds in contention involve a bind to an assembly where a policy change has been detected and a bind to an assembly that has not had a policy change, the assembly bind that detected the change will try to flush the list of queued bind information. This sets the list count back to zero. If the other thread (that is, the bind to an assembly that has not been changed) tries to add itself to the list at the same time, the pending list may be cleared except for one new assembly, but the count is much higher than it should be.

At process shutdown, fusion tries to flush this list by iterating through each element in such a way that it relies on the count variable in the list. Because the count is incorrect, fusion looks at some nonexistent nodes, and causes an access violation.