JVM is frequently crashing with a 0xc0000005 exception
search cancel

JVM is frequently crashing with a 0xc0000005 exception

book

Article ID: 160171

calendar_today

Updated On:

Products

Data Loss Prevention Network Monitor Data Loss Prevention Data Loss Prevention Core Package Data Loss Prevention Enforce Data Loss Prevention Enterprise Suite

Issue/Introduction

If the environment is having frequent restarts and the resulting JVM crashdumps (hs_err* files in Protect/bin) display an 0xc0000005 exception such as

Current thread (0x11f96c00):  JavaThread "Worker 3" daemon [_thread_in_native, id=8108, stack(0x12c20000,0x12c70000)]

siginfo: ExceptionCode=0xc0000005, reading address 0xfffffff8

  or 

Current thread (0x11b65400):  JavaThread "Worker 1" daemon [_thread_in_native, id=6392, stack(0x12c20000,0x12c70000)]

siginfo: ExceptionCode=0xc0000005, reading address 0x13feb003

Resolution

There may be several causes for this type of exception, but in most cases, this is related to enabled DEP (Data Execution Prevention, http://en.wikipedia.org/wiki/Data_Execution_Prevention)

In that case you may want to turn off DEP to verify that the crashes no longer occur and then fine-tune the DEP exceptions in the environment.

How to turn DEP on or off can be found in http://technet.microsoft.com/en-us/library/cc700810.aspx 

You may also want to check if there are other programs/services running that monitor processes and potentially stop them (Symantec Endpoint or McAfee). In this case, disable them and try again and see if they cause the exception. You may see in their specific logs entries that would indicate if a Symantec DLP process has been stopped.

Per http://www.0xc0000005.com/data-execution-prevention.html

Data Execution Prevention

The nasty 0xC0000005 error may occur because of Data Execution Prevention (DEP) introduced by Microsoft in SP2 and used in later Windows versions. DEP is a set of security features that prevents code execution from non-executable memory segments. In other words,

DEP monitors and ensures that the applications installed on your computer use the system memory in a safe way. Let’s look into this.

The information on your computer is stored as data and executable code, each type of information exploits its own memory segment. The 0xC0000005 error means that a program is trying to execute data as a code from non-executable parts of memory. Such behavior is characteristic of malware and DEP traps attempts to execute a malware code. The 0xC0000005 error message notifies you of such attempts. But many legal software programs use dynamic code generation, and the generated code is not always marked as executable code, which makes such applications incompatible with DEP and results in the 0xc0000005 access violation error.
Otherwise, you may review the following references for further troubleshooting.

See:

http://www.0xc0000005.com/

0xc0000005 is a critical Access Violation error that requires your immediate reaction. As a rule, you get the 0xc0000005 error message when you try to start one of your software programs in Windows. After that the program terminates and you can’t get it to work. Also, the 0xc0000005 error code may appear in other different error messages, depending on the software you are trying to start or install or the action you are trying to execute on your computer. The most typical causes for the ‘0xc0000005: Access Violation’ error are corrupt registry, malware, faulty RAM or device driver, incorrectly written, installed, or updated software, or even Windows security features.