State Management

Re: Null Reference Exception in SessionStateModule

royhiggs — Wed, 26 Mar 2008 17:19:15 GMT

I installed the hotfix from Microsoft and my app pool recycling issue has gone away. However, I'm now getting a bunch of the following logs in my app log. I never got these before applying the patch. Haven't heard anything from users yet about not being able to log in, but it is strange that I am getting such a high number of these in the app log. Maybe it is users that have persisted their tickets and they just need to relogin after the hotfix. Did anyone else get a bunch of these logged after installing the hotfix?

Forms authentication failed for the request. Reason: The ticket supplied was invalid.

Re: Null Reference Exception in SessionStateModule

jfritz — Tue, 25 Mar 2008 17:53:55 GMT

The heart of my issue was related to a HttpModule that we wrote and consume in our application. The module was attempting to access the HttpSession object when the session was null, that is, during a fetch against image files or other non-aspx files.

Once we added a test for the presence of a Session object before we attempted to access it, the error went away.

Re: Null Reference Exception in SessionStateModule

royhiggs — Tue, 25 Mar 2008 16:45:50 GMT

I'm getting the exact same error and I don't use Dundas charting. Did you ever find a solution for this? It's happening 5 or 6 times a day on my server and causes the application pool to recycle unexpectedly which causes the site to come to a crawl. My stack trace is below:

System.Web.SessionState.SessionStateModule.PollLockedSessionCallback(Object state)

at System.Threading._TimerCallback.TimerCallback_Context(Object state)

at System.Threading.ExecutionContext.runTryCode(Object userData)

at System.Runtime.CompilerServices.RuntimeHelpers.ExecuteCodeWithGuaranteedCleanup(TryCode code, CleanupCode backoutCode, Object userData)

at System.Threading.ExecutionContext.RunInternal(ExecutionContext executionContext, ContextCallback callback, Object state)

at System.Threading.ExecutionContext.Run(ExecutionContext executionContext, ContextCallback callback, Object state)

at System.Threading._TimerCallback.PerformTimerCallback(Object state)

Re: Null Reference Exception in SessionStateModule

AndrewCushen — Wed, 12 Mar 2008 21:04:34 GMT

Jeff-

I'm no expert with this, but I would recommend you take this up with Dundas Tech Support. My guess is that their chart control does something security-wise or appdomain-wise that no longer works with the patch.

Since your page works without their control, I suspect the issue is with their control, and I think you will get the fastest fix from them directly...

HTH,

-Andrew

Re: Null Reference Exception in SessionStateModule

jfritz — Wed, 12 Mar 2008 17:49:21 GMT

I am having the same problem, we originally saw it back in July '07 when the patch was originally released. Our team found this thread, and removed the patch as recommended. We have since applied the .NET 2.0SP1 and found ourselves re-patched, and we are receiving this error again.

We are not using a custom Principal. We are not defining any impersonation, nor are we using the standard Asp.Net authentication and authorization modules. We are enforcing security on our own..

The stack trace we are seeing is:

System.Transactions Critical: 0 : <TraceRecord xmlns="http://schemas.microsoft.com/2004/10/E2ETraceEvent/TraceRecord" Severity="Critical"><TraceIdentifier>http://msdn.microsoft.com/TraceCodes/System/ActivityTracing/2004/07/Reliability/Exception/Unhandled</TraceIdentifier><Description>Unhandled exception</Description><AppDomain>/LM/w3svc/1/ROOT/FlBlueBoxWeb-1-128498092096915387</AppDomain><Exception><ExceptionType>System.NullReferenceException, mscorlib, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089</ExceptionType><Message>Object reference not set to an instance of an object.</Message><StackTrace>   at System.Web.SessionState.SessionStateModule.PollLockedSessionCallback(Object state)
   at System.Threading._TimerCallback.TimerCallback_Context(Object state)
   at System.Threading.ExecutionContext.runTryCode(Object userData)
   at System.Runtime.CompilerServices.RuntimeHelpers.ExecuteCodeWithGuaranteedCleanup(TryCode code, CleanupCode backoutCode, Object userData)
   at System.Threading.ExecutionContext.RunInternal(ExecutionContext executionContext, ContextCallback callback, Object state)
   at System.Threading.ExecutionContext.Run(ExecutionContext executionContext, ContextCallback callback, Object state)
   at System.Threading._TimerCallback.PerformTimerCallback(Object state)</StackTrace><ExceptionString>System.NullReferenceException: Object reference not set to an instance of an object.
   at System.Web.SessionState.SessionStateModule.PollLockedSessionCallback(Object state)
   at System.Threading._TimerCallback.TimerCallback_Context(Object state)
   at System.Threading.ExecutionContext.runTryCode(Object userData)
   at System.Runtime.CompilerServices.RuntimeHelpers.ExecuteCodeWithGuaranteedCleanup(TryCode code, CleanupCode backoutCode, Object userData)
   at System.Threading.ExecutionContext.RunInternal(ExecutionContext executionContext, ContextCallback callback, Object state)
   at System.Threading.ExecutionContext.Run(ExecutionContext executionContext, ContextCallback callback, Object state)
   at System.Threading._TimerCallback.PerformTimerCallback(Object state)</ExceptionString></Exception></TraceRecord>
The program '[3024] aspnet_wp.exe: Managed' has exited with code -532459699 (0xe0434f4d).

Curiously, we only see this crash when there is at least 2 Dundas Charts on a page, and session state is in use. We are currently using State Server, and have tried shifting to InProc (as recommended above) and SQLServer with no luck.

Any insight would be greatly appreciated.

Jeff

Re: Null Reference Exception in SessionStateModule

dear_vvr — Wed, 14 Nov 2007 17:25:03 GMT

I had the same problem (same stack trace) in XP machine and when I removed the security update KB928365, the problem is solved.

I had this problem only when the applicaiton uses the transactions. This problem is not related to any page. Looks like occurs at Global.asax

But even I did the samething in Vista machine, (removed security update KB929916) the problem still persists. Is there anything else I need to do?

Thanks

Re: Null Reference Exception in SessionStateModule

thxmike — Tue, 23 Oct 2007 22:29:41 GMT

We are experiencing the same issue. However, I went to the URL outlined to get the fix and it was not available. You have to call MS support.

Re: Null Reference Exception in SessionStateModule

fred.f.chopin — Fri, 28 Sep 2007 16:42:09 GMT

The tech that I worked with was named Sunil, and he was very helpful in this. I don't know if he is the one that initially filed the bug, but he did say that there were a few other incidents of this issue that had been reported so it's possible. Also, he just informed me today that the KB942086 is now publicly available, here's the direct link: http://support.microsoft.com/kb/942086

Re: Null Reference Exception in SessionStateModule

AndrewCushen — Wed, 26 Sep 2007 18:07:20 GMT

Fred-

Thanks for the update. With your new info "in hand", I contacted the Tech who worked on my case, and he verified that, although the error message I received was not the same as the one in the KB article you mentioned about the Hotfix, that the Hotfix *was* applicable to my case. Thanks to you, I now have the Hotfix and can apply it.

Incidentally, my Tech says he is the one who filed the bug which resulted in the Hotfix being developed. I wonder if you and I spoke to the same Tech? Small world if so.

Thanks again,

-Andrew

Re: Null Reference Exception in SessionStateModule

fred.f.chopin — Tue, 25 Sep 2007 18:27:51 GMT

I worked with MatthewP on this issue for our web application. I called Microsoft for support on this issue and after analyzing three crash dumps from our application (running without MatthewP's fix so we could repro the error) they had a lot of info for me. They initially stated that our custom IIdentity object was not serializing properly. I implemented explicit serialization on this object and it continued to crash. After analyzing the additional crash reports, Microsoft was able to supply me with an internal hotfix that fixes this issue. It hasn't been released yet although they have informed me that they will be making it available for download in the near future. It's ID is KB942086 and you'll need to call microsoft support to get it (as of this post, anyway) but this completely fixed the issue caused by KB928365 without the workaround that we were using and without the explicit serialization on our custom IIdentity object.

Re: Null Reference Exception in SessionStateModule

AndrewCushen — Tue, 25 Sep 2007 03:12:58 GMT

Hi all-

Just spent 4 hours struggling with this problem, including 2 hours after finding this thread; then another 3.5 hours on top of that, on the phone with MS Tech Support.

I thought I would share what I learned, which includes another workaround.

The workarounds suggested above were not an option for me for various reasons, and I was not using impersonation. My particular web application required a custom Security.Principal.

So, the upshot, after 3 and a half hours with the MS Tech connected remotely to my dev PC, was this:

Take the custom Security.Principal class out of the website project, and compile it as a Class library into a .DLL (assembly). Sign the .DLL with a Strong Name, and place it in the GAC. Adjust your code that references the custom Principal to call the code in its new location, if necessary- I wound up adding a Reference to the new assembly in my website project. No more problem!

A side note: if you use a WebSetup project to install your website, as I did, you can have it place the assembly into the server's GAC for you, during the installation.

There is apparently something about moving the code that deals with the IIdentity out of the main project (out of the process?), that avoids the issue.

I thought this might help someone else struggling with this issue. There is NOTHING on the web about this issue other than this thread!

Hope this helps someone,

-Andrew

Re: Null Reference Exception in SessionStateModule

matthewerwin — Mon, 24 Sep 2007 01:34:37 GMT

The solution suggested by MatthewP worked identically in my situation. Initially I suspected that the problem was caused by the location of the session state or the type of data stored it in. Further investigation proved this to be due to impersonation issues - specifically the assignment of IIdentity based objects to Context.User or to Thread.CurrentPrincipal. I was predictably able to reproduce this by refreshing the page 3-4 times but did not see the issue occur as frequently in production environments. It does not appear the problem is specific to servers under load.

My solution was to simply move any assignments to Context.User into Context.Session since impersonation could be done where needed rather than assigning it for the lifetime of execution. Likely a better solution all around.

Re: Null Reference Exception in SessionStateModule

MatthewP — Thu, 30 Aug 2007 20:52:34 GMT

We were able to fix this issue. As it turns out, the problem was caused by our custom IIdentity object we use to track authenticated users. I switched our code to use a static, thread-safe collection and pull authenticated users from this collection instead of the HttpContext.Current.User property. Now, our app does not replace the FormsIdentity object, and we no longer experience an app-pool crash under heavy load, and we can leave the security patch in place.

Re: Null Reference Exception in SessionStateModule

codepounder — Wed, 29 Aug 2007 22:25:16 GMT

We have the same issue with an almost identical stack trace as in the original post. We also removed the KB928365 security patch and the problem went away, but we're at a point now where we are going to need to keep the patch installed.

buckeyes has another post (http://forums.asp.net/t/1132290.aspx) with a possible solution, or at least a workaround. I'll need to investigate our code further to make sure we don't have that issue. That situation also involves AJAX. Is this primarily an AJAX issue then? Is there any further word from MSFT?

Dan

Re: Null Reference Exception in SessionStateModule

buckeyes — Mon, 20 Aug 2007 17:00:18 GMT

Have you found a fix for this yet. I have the same problem and the only fix we have found is to uninstall the update. If we do find the solution, I will post it.

Thanks.