Hi 大侠们，
我们的正式站点每天会随机出现几次如下错误，会导致崩溃500错误，错误信息大致如下。
An error occurred during a process host idle check.
Exception: System.AccessViolationException
Message: Attempted to read or write protected memory. This is often an indication that other memory is corrupt.
StackTrace:    at System.Collections.Hashtable.HashtableEnumerator.MoveNext()
   at System.Web.Hosting.ApplicationManager.IsIdle()
   at System.Web.Hosting.ProcessHost.IsIdle()

------------------------------------------------
由于在我们的log文件中看到的也大多是：Attempted to read or write protected memory. This is often an indication that other memory is corrupt.没有发现多少有价值的异常信息。
所以只能需要windbg可以发现错误的地方。

-------------------------------------------------
下面是我尝试使用windbg。。。菜鸟一只不大会用。

0:015> .load C:\Windows\Microsoft.NET\Framework\v2.0.50727\sos.dll
0:015> .load C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscordacwks.dll
0:015> !analyze -v

FAULTING_IP:
mscorwks!JIT_Stelem_Ref+20
7395c262 e8396bffff      call    mscorwks!JIT_WriteBarrierEAX (73952da0)

EXCEPTION_RECORD:  ffffffff -- (.exr 0xffffffffffffffff)
ExceptionAddress: 7395c262 (mscorwks!JIT_Stelem_Ref+0x00000020)
   ExceptionCode: c0000005 (Access violation)
  ExceptionFlags: 00000000
NumberParameters: 2
   Parameter[0]: 00000001
   Parameter[1]: 016a205c
Attempt to write to address 016a205c

PROCESS_NAME:  w3wp.exe

OVERLAPPED_MODULE: Address regions for 'CSScriptLibrary' and 'RichEd20.dll' overlap

ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

EXCEPTION_PARAMETER1:  00000001

EXCEPTION_PARAMETER2:  016a205c

WRITE_ADDRESS:  016a205c

FOLLOWUP_IP:
System_Web_ni+164301
71714301 8b4dd4          mov     ecx,dword ptr [ebp-2Ch]

NTGLOBALFLAG:  0

APPLICATION_VERIFIER_FLAGS:  0

MANAGED_STACK:
(TransitionMU)
0DF1F5F4 71714301 System_Web_ni!System.Web.Hosting.ISAPIRuntime.ProcessRequest(IntPtr, Int32)+0x91
(TransitionUM)

EXCEPTION_OBJECT: !pe 1ad00ec
Exception object: 01ad00ec
Exception type: System.ExecutionEngineException
Message: <none>
InnerException: <none>
StackTrace (generated):
<none>
StackTraceString: <none>
HResult: 80131506

MANAGED_OBJECT_NAME:  System.ExecutionEngineException

LAST_CONTROL_TRANSFER:  from 72ace9ae to 7395c262

FAULTING_THREAD:  ffffffff

BUGCHECK_STR:  APPLICATION_FAULT_CORRUPT_MODULELIST_OVERLAPPED_MODULE_INVALID_POINTER_WRITE_WRONG_SYMBOLS

PRIMARY_PROBLEM_CLASS:  CORRUPT_MODULELIST

DEFAULT_BUCKET_ID:  CORRUPT_MODULELIST

STACK_TEXT: 
71714301 System_Web_ni!System.Web.Hosting.ISAPIRuntime.ProcessRequest+0x91


SYMBOL_STACK_INDEX:  0

SYMBOL_NAME:  System_Web_ni!System.Web.Hosting.ISAPIRuntime.ProcessRequest+164301

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: System_Web_ni

IMAGE_NAME:  System.Web.ni.dll

DEBUG_FLR_IMAGE_TIMESTAMP:  4a275eab

STACK_COMMAND:  ** Pseudo Context ** ; kb

FAILURE_BUCKET_ID:  CORRUPT_MODULELIST_c0000005_System.Web.ni.dll!System.Web.Hosting.ISAPIRuntime.ProcessRequest

BUCKET_ID:  APPLICATION_FAULT_CORRUPT_MODULELIST_OVERLAPPED_MODULE_INVALID_POINTER_WRITE_WRONG_SYMBOLS_System_Web_ni!System.Web.Hosting.ISAPIRuntime.ProcessRequest+164301

WATSON_STAGEONE_URL:  http://watson.microsoft.com/StageOne/w3wp_exe/7_5_7600_16385/4a5bcd2b/mscorwks_dll/2_0_50727_4952/4bebd49a/c0000005/0000c262.htm?Retriage=1

Followup: MachineOwner
---------

0:015> .time
Debug session time: Wed Nov 10 10:01:35.000 2010 (GMT+2)
System Uptime: 55 days 17:40:16.015
Process Uptime: 0 days 6:25:43.000
  Kernel time: 0 days 0:00:05.000
  User time: 0 days 0:01:43.000

0:015> !threadpool
CPU utilization 6%
Worker Thread: Total: 2 Running: 1 Idle: 1 MaxLimit: 200 MinLimit: 2
Work Request in Queue: 0
--------------------------------------
Number of Timers: 12
--------------------------------------
Completion Port Thread:Total: 1 Free: 1 MaxFree: 4 CurrentLimit: 0 MaxLimit: 200 MinLimit: 2
0:015> !runaway
 User Mode Time
  Thread       Time
  15:f1c       0 days 0:00:53.265
  24:c48       0 days 0:00:46.015
  13:b00       0 days 0:00:01.515
  12:a64       0 days 0:00:01.312
  19:d40       0 days 0:00:00.265
   5:b30       0 days 0:00:00.171
   3:2a0       0 days 0:00:00.109
  14:b74       0 days 0:00:00.093
   6:b3c       0 days 0:00:00.078
   4:83c       0 days 0:00:00.046
  16:efc       0 days 0:00:00.015
  10:ff8       0 days 0:00:00.015
   9:d38       0 days 0:00:00.015
   0:e50       0 days 0:00:00.015
  27:810       0 days 0:00:00.000
  26:b18       0 days 0:00:00.000
  25:de8       0 days 0:00:00.000
  23:920       0 days 0:00:00.000
  22:cdc       0 days 0:00:00.000
  21:9fc       0 days 0:00:00.000
  20:d08       0 days 0:00:00.000
  18:254       0 days 0:00:00.000
  17:b84       0 days 0:00:00.000
  11:d84       0 days 0:00:00.000
   8:e4c       0 days 0:00:00.000
   7:bb8       0 days 0:00:00.000
   2:a94       0 days 0:00:00.000
   1:84c       0 days 0:00:00.000

0:015> !threads
ThreadCount: 16
UnstartedThread: 0
BackgroundThread: 14
PendingThread: 0
DeadThread: 0
Hosted Runtime: no
                                      PreEmptive   GC Alloc           Lock
       ID OSID ThreadOBJ    State     GC       Context       Domain   Count APT Exception
   6    1  b3c 01521fd0      8220 Enabled  00000000:00000000 0151f9c8     0 Ukn
  14    2  b74 01526890      b220 Enabled  0655b0e4:0655cb5c 0151f9c8     0 MTA (Finalizer)
  15    3  f1c 01547050   180b220 Disabled 0676adac:0676c3d0 01549f50     4 MTA (Threadpool Worker) System.ExecutionEngineException (01ad00ec)
  16    4  efc 01547b28    80a220 Enabled  00000000:00000000 0151f9c8     0 MTA (Threadpool Completion Port)
  17    5  b84 015498a8      1220 Enabled  00000000:00000000 0151f9c8     0 Ukn
  19    7  d40 0ee6ce28   200b020 Enabled  00000000:00000000 01549f50     0 MTA
  20    8  d08 0ee72d40   200b020 Enabled  00000000:00000000 01549f50     0 MTA
   9    9  d38 0ee780e0   880a220 Enabled  0267cf8c:0267ea6c 0151f9c8     0 MTA (Threadpool Completion Port)
  22    a  cdc 0ee91220   200b220 Enabled  00000000:00000000 01549f50     0 MTA
  23    b  920 0eede8f8   200b220 Enabled  00000000:00000000 01549f50     0 MTA
  24    c  c48 0ee7e1a8   180b220 Enabled  0267af24:0267ca6c 0151f9c8     0 MTA (Threadpool Worker)
   5    e  b30 0ef0c438       220 Enabled  00000000:00000000 0151f9c8     0 Ukn
   4   24  83c 11d4bb80       220 Enabled  00000000:00000000 0151f9c8     0 Ukn
   3   1c  2a0 0edea5a8       220 Enabled  00000000:00000000 0151f9c8     0 Ukn
  26   14  b18 11e51398       220 Enabled  00000000:00000000 0151f9c8     0 Ukn
  27   15  810 11e50fb0       220 Enabled  00000000:00000000 0151f9c8     0 Ukn

0:003> ~15s
eax=00000000 ebx=00000000 ecx=064511a8 edx=00019144 esi=000014e8 edi=0df1d56c
eip=7760f861 esp=0df1d524 ebp=0df1d590 iopl=0         nv up ei pl nz ac po cy
cs=0023  ss=002b  ds=002b  es=002b  fs=0053  gs=002b             efl=00010213
ntdll!ZwWaitForSingleObject+0x15:
7760f861 83c404          add     esp,4

0:015> !clrstack
OS Thread Id: 0xf1c (15)
ESP       EIP    
0df1f5f8 7760f861 [InlinedCallFrame: 0df1f5f8] System.Web.UnsafeNativeMethods.GetEcb(IntPtr)
0df1f5f4 71714301 System.Web.Hosting.ISAPIRuntime.ProcessRequest(IntPtr, Int32)
0df1f808 73a70256 [ContextTransitionFrame: 0df1f808]
0df1f83c 73a70256 [GCFrame: 0df1f83c]
0df1f998 73a70256 [ComMethodFrame: 0df1f998]

0:015> k
ChildEBP RetAddr 
0df1d524 766e0816 ntdll!ZwWaitForSingleObject+0x15
0df1d590 75231184 KERNELBASE!WaitForSingleObjectEx+0x98
0df1d5a8 75231138 kernel32!WaitForSingleObjectExImplementation+0x75
0df1d5bc 73b36cb5 kernel32!WaitForSingleObject+0x12
0df1d5ec 73b3720f mscorwks!ClrWaitForSingleObject+0x24
0df1daa8 73b399ac mscorwks!RunWatson+0x1df
0df1e1ec 73b3a072 mscorwks!DoFaultReportWorker+0xb59
0df1e228 73b77fa6 mscorwks!DoFaultReport+0xc3
0df1e24c 73b7708d mscorwks!WatsonLastChance+0x3f
0df1e708 73b772c6 mscorwks!EEPolicy::LogFatalError+0x3ae
0df1e720 73b78525 mscorwks!EEPolicy::HandleFatalError+0x4d
0df1e744 73a66a7b mscorwks!CLRVectoredExceptionHandlerPhase3+0xbc
0df1e778 73a66919 mscorwks!CLRVectoredExceptionHandlerPhase2+0x20
0df1e7ac 739cd478 mscorwks!CLRVectoredExceptionHandler+0x10a
0df1e7d8 739cd675 mscorwks!CPFH_RealFirstPassHandler+0x607
0df1e7fc 77648799 mscorwks!COMPlusFrameHandler+0x15a
0df1e820 7764876b ntdll!ExecuteHandler2+0x26
0df1e8d0 7760010f ntdll!ExecuteHandler+0x24
0df1e8d0 7395c262 ntdll!KiUserExceptionDispatcher+0xf
0df1ec20 72ace9ae mscorwks!JIT_Stelem_Ref+0x20

发现我根本看不懂了。。。都是系统里的调用。。。大侠们help