w3wp.exe crashes with C0000005 when HTTP Headers are modified after UpdateRequestCach event

w3wp.exe crashes with C0000005 exception code when HTTP Headers are modified after UpdateRequestCach event.

The call stack looks like below:

00 000000ab`a2d5ef80 00007ffe`d2ad4f12 ntdll!RtlReportCriticalFailure(long StatusCode = 0n-1563038352, void * FailureInfo = 0x00000000`00000000)+0x8c 

01 000000ab`a2d5f090 00007ffe`d2ad5b10 ntdll!RtlpHeapHandleError(long ErrorLevel = 0n-768565248)+0x12 

02 000000ab`a2d5f0c0 00007ffe`d2a8a5ff ntdll!RtlpLogHeapFailure(_HEAP_FAILURE_TYPE FailureType = heap_failure_block_not_busy (0n8), void * HeapAddress = 0x000000a7`2ae10000, void * Address = 0x000000ab`9e16c470, void * Param1 = 0x00000000`00000000, void * Param2 = 0x00000000`00000000)+0xa4 

03 (Inline Function) --------`-------- ntdll!RtlpProbeUserBufferUnsafe+0x74ef3 

04 (Inline Function) --------`-------- ntdll!RtlpProbeUserBuffer+0x74efd 

05 000000ab`a2d5f0f0 00007ffe`b93d7fa0 ntdll!RtlFreeHeap+0x74f2f 

06 000000ab`a2d5f190 00007ffe`b93d4e2d cachhttp!RESPONSE_ENTRY::~RESPONSE_ENTRY(void)+0xcc 

07 000000ab`a2d5f1c0 00007ffe`b93d4d3e cachhttp!RESPONSE_ENTRY::DereferenceResponseEntry(void)+0x19 

08 000000ab`a2d5f1f0 00007ffe`b93d4692 cachhttp!OUTPUT_ENTRY::ClearIdentityResponseEntry(void)+0x26 

09 (Inline Function) --------`-------- cachhttp!OUTPUT_ENTRY::{dtor}+0x5

0a 000000ab`a2d5f220 00007ffe`b93d4def cachhttp!OUTPUT_ENTRY::`scalar deleting destructor'(void)+0xe

0b 000000ab`a2d5f250 00007ffe`b93d715f cachhttp!OUTPUT_ENTRY::DereferenceOutputEntry(void)+0x13 

0c (Inline Function) --------`-------- cachhttp!OUTPUT_CACHE::AddRefRecord+0x17

0d 000000ab`a2d5f280 00007ffe`c912615e cachhttp!CTypedHashTable<OUTPUT_CACHE,OUTPUT_ENTRY,OUTPUT_KEY * __ptr64,CLKRHashTable>::_AddRefRecord(void * pvRecord = 0x00007ffe`d230a000, int nIncr = 0n0)+0x1b 

0e 000000ab`a2d5f2b0 00007ffe`c9127f9e iisutil!CLKRLinearHashTable::_DeleteNode(class CBucket * pbkt = 0x000000a7`2bbfe270, class CNodeClump ** rpnc = 0x000000ab`a2d5f310, class CNodeClump ** rpncPrev = 0x000000ab`a2d5f318, int * riNode = 0x000000ab`a2d5f360)+0x3e 

0f 000000ab`a2d5f2e0 00007ffe`c9122130 iisutil!CLKRLinearHashTable::_DeleteIf(<function> * pfnPredicate = 0x00007ffe`b93d23e0, void * pvState = 0x000000ab`a2d5f3c0, LK_PREDICATE * rlkp = 0x000000ab`a2d5f3a0)+0x124 

10 000000ab`a2d5f360 00007ffe`b93d4d83 iisutil!CLKRHashTable::DeleteIf(<function> * pfnPredicate = 0x00007ffe`b93d23e0, void * pvState = 0x000000ab`a2d5f3c0)+0x60 

11 000000ab`a2d5f3a0 00007ffe`b93d3f74 cachhttp!CTypedHashTable<OUTPUT_CACHE,OUTPUT_ENTRY,OUTPUT_KEY * __ptr64,CLKRHashTable>::DeleteIf(<function> * pfnPredicate = 0x01d11c88`00000000, void * pvState = 0x000000ab`a2d5ece0)+0x2f 

12 000000ab`a2d5f3f0 00007ffe`d29f8b9e cachhttp!OUTPUT_CACHE::ScavengerCallback+0x2254 

13 000000ab`a2d5f470 00007ffe`d29f8f2e ntdll!RtlpTpTimerCallback(struct _TP_CALLBACK_INSTANCE * Instance = 0x00007ffe`d29f8b20, void * Context = 0x000000ab`7de35580, struct _TP_TIMER * Timer = 0x000000ab`7dd6bc90)+0x7e 

14 000000ab`a2d5f4b0 00007ffe`d2a18e8d ntdll!TppTimerpExecuteCallback(struct _TP_CALLBACK_INSTANCE * Instance = 0x000000ab`a2d5f668, struct _TP_TASK * Task = 0x000000ab`7dd6bc90)+0x8e

15 000000ab`a2d5f4f0 00007ffe`d21f13d2 ntdll!TppWorkerThread(void * Parameter = 0x000000a7`2ae190e0)+0x47d 

16 000000ab`a2d5f8d0 00007ffe`d29f54f4 kernel32!BaseThreadInitThunk(unsigned long RunProcessInit = <Value unavailable error>, <function> * StartAddress = 0x00007ffe`d2a18a10, void * Argument = 0x000000a7`2ae190e0)+0x22 

17 000000ab`a2d5f900 00000000`00000000 ntdll!RtlUserThreadStart(<function> * StartAddress = 0x00007ffe`d2a18a10, void * Argument = 0x000000a7`2ae190e0)+0x34 

The HTTP headers modification needs to be done on any event before UpdateRequestCache event.