runtime: Fatal error. Internal CLR error. (0x80131506) or unexpected NullReferenceException in XElement.Attribute(XName)

Description

In one of our internal tools we started to get unexpected NullReferenceExceptions in XElement.Attribute(XName) after switching from .NET 6.0 to .NET 7.0.

It downloads a lot of XML files in parallel and loads them into XDocuments which are then traversed.

Don’t know if it is relevant but it is configured to use server gc. <ServerGarbageCollection>true</ServerGarbageCollection>

Sometimes it happens after a few minutes, other times it can take an hour or more. And every now and then it can process all files without crashing.

Reproduction Steps

Don’t have any sample that can reproduce this and the code and data it process is private.

Expected behavior

No crash.

Actual behavior

Unexpected NullReferenceExceptions, access violations and segfaults.

So far we’ve had unexpected errors like this:

System.NullReferenceException: Object reference not set to an instance of an object.
   at System.Xml.Linq.XElement.Attribute(XName name)

The code basically does this over and over again with multiple calls running concurrently on different streams:

var doc = XDocument.Load(stream);
var root = doc.Root;
foreach (var element in root.Elements())
{
  var attr1 = (int?)element.Attribute("Something");
  var attr2 = (int)element.Attribute("Other");

  ...
}

Or the process dies with this error: Fatal error. Internal CLR error. (0x80131506)

On Linux we’ve also seen that might be related:

[3715361.236396] .NET Server GC[193449]: segfault at 8 ip 00007fab9722505c sp 00007fab8effde30 error 6 in libcoreclr.so[7fab96de7000+4e1000]
[3715361.236415] Code: a2 94 0f 00 c3 66 0f 1f 84 00 00 00 00 00 55 48 89 e5 40 84 ff 74 18 66 48 8d 3d 87 36 0c 00 66 66 48 e8 b7 0e 0a 00 48 8b 00 <f0> 83 48 08 40 48 8b 05 98 36 0c 00 48 8b 38 48 85 ff 74 09 48 8b
[3733590.684493] .NET Server GC[215602]: segfault at 8 ip 00007f596cde705c sp 00007f5964ab5e30 error 6 in libcoreclr.so[7f596c9a9000+4e1000]
[3733590.684510] Code: a2 94 0f 00 c3 66 0f 1f 84 00 00 00 00 00 55 48 89 e5 40 84 ff 74 18 66 48 8d 3d 87 36 0c 00 66 66 48 e8 b7 0e 0a 00 48 8b 00 <f0> 83 48 08 40 48 8b 05 98 36 0c 00 48 8b 38 48 85 ff 74 09 48 8b
[3781114.466120] traps: .NET BGC[273180] general protection fault ip:7f2d92268bd3 sp:7eebc67fbb90 error:0 in libcoreclr.so[7f2d91fd1000+4e1000]
[3784441.425115] .NET Server GC[278359]: segfault at 8 ip 00007fa46043105c sp 00007fa458209e30 error 6 in libcoreclr.so[7fa45fff3000+4e1000]
[3784441.425151] Code: a2 94 0f 00 c3 66 0f 1f 84 00 00 00 00 00 55 48 89 e5 40 84 ff 74 18 66 48 8d 3d 87 36 0c 00 66 66 48 e8 b7 0e 0a 00 48 8b 00 <f0> 83 48 08 40 48 8b 05 98 36 0c 00 48 8b 38 48 85 ff 74 09 48 8b

Regression?

This has never happened with .NET 6 that we’ve been using for this tool since February.

Known Workarounds

No response

Configuration

.NET 7.0

Windows 11 Debian GNU/Linux 11 (bullseye)

x64

Other information

No response