.NET Framework 4.8 crashed during GC if the profiling API is used

Question

OS: Windows 10 Pro x64 (Build 19042)
.NET Framework: 4.8.4084 x64

We have the our customer dump file, but we can check if user allows to share it.

Profiling API flags:

COR_PRF_ENABLE_OBJECT_ALLOCATED
COR_PRF_MONITOR_APPDOMAIN_LOADS
COR_PRF_MONITOR_GC
COR_PRF_MONITOR_THREADS
COR_PRF_MONITOR_MODULE_LOADS
COR_PRF_MONITOR_CLASS_LOADS
COR_PRF_MONITOR_APPDOMAIN_LOADS

Dump investigation:

(1414.e08c): Access violation - code c0000005 (first/second chance not available)
clr!HashTypeHandle+0x137:
00007ff9`529b222d 440fb687feffffff movzx   r8d,byte ptr [rdi-2] ds:000000bb`3abdc4fe=00
0:000> r
rax=00000000025bdef4 rbx=000000bb3abdc9f0 rcx=0000000000000001
rdx=00007ff952fe34a0 rsi=000000bb3abdc9f0 rdi=000000bb3abdc500
rip=00007ff9529b222d rsp=000000bb3abdcc90 rbp=0000000000000006
 r8=000000000000000f  r9=00007ff8c696d752 r10=00007ff952fe34a0
r11=0000000000000000 r12=0000000000000006 r13=00007ff8c69b2530
r14=00007ff8c696cc60 r15=000000bb3abdd030
iopl=0         nv up ei pl nz na pe nc
cs=0033  ss=002b  ds=002b  es=002b  fs=0053  gs=002b             efl=00010200
clr!HashTypeHandle+0x137:
00007ff9`529b222d 440fb687feffffff movzx   r8d,byte ptr [rdi-2] ds:000000bb`3abdc4fe=00
:000> k
  *** Stack trace for last set context - .thread/.cxr resets it
 # Child-SP          RetAddr           Call Site
00 000000bb`3abdcc90 00007ff9`528c6a5c clr!HashTypeHandle+0x137
01 000000bb`3abdccd0 00007ff9`528c670a clr!HashFnPtrType+0x44
02 000000bb`3abdcd00 00007ff9`5281ed1c clr!HashTypeHandle+0xa7bea
03 000000bb`3abdcd40 00007ff9`528efd81 clr!EETypeHashTable::FindItem+0x3eb
04 000000bb`3abdce30 00007ff9`528efd4b clr!EETypeHashTable::GetValue+0x15
05 000000bb`3abdce60 00007ff9`528efcfa clr!ClassLoader::LookupTypeKey+0x3f
06 000000bb`3abdce90 00007ff9`529bbc60 clr!ClassLoader::LoadConstructedTypeThrowing+0x635
07 000000bb`3abdcff0 00007ff9`529de659 clr!ClassLoader::LoadArrayTypeThrowing+0xbd
08 000000bb`3abdd090 00007ff9`52d764f5 clr!ArrayBase::GetTypeHandle+0x49
09 000000bb`3abdd0d0 00007ff9`52e05e26 clr!Object::GetGCSafeTypeHandleIfPossible+0xf9
0a 000000bb`3abdd110 00007ff9`52dfb741 clr!SafeGetClassIDFromObject+0xe
0b 000000bb`3abdd140 00007ff9`52dba73a clr!AllocByClassHelper+0x71
0c 000000bb`3abdd190 00007ff9`52b7b6df clr!WKS::gc_heap::walk_heap_per_heap+0xba
0d 000000bb`3abdd1e0 00007ff9`529cec54 clr!GCToEEInterface::DiagGCStart+0x1f2dc7
0e 000000bb`3abdd240 00007ff9`529d0ae7 clr!WKS::gc_heap::garbage_collect+0x144
0f 000000bb`3abdd280 00007ff9`529d2d37 clr!WKS::GCHeap::GarbageCollectGeneration+0xef
10 000000bb`3abdd2d0 00007ff9`5297e906 clr!WKS::GCHeap::Alloc+0x29c
11 000000bb`3abdd320 00007ff9`4baac698 clr!JIT_NewArr1+0x6be
12 000000bb`3abdd6c0 00007ff9`4bb722aa System_Drawing_ni!System.Drawing.Icon.Initialize(Int32, Int32)$##600030F+0x638
13 000000bb`3abdd820 00007ff8`9491a201 System_Drawing_ni!System.Drawing.Icon..ctor(System.IO.Stream, System.Drawing.Size)$##60002FA+0x1a
...

P.S. There is also the comment in .NET Core 3.0 for SafeGetClassIDFromObject():

// It's generally unsafe for profiling API code to call Get(GCSafe)TypeHandle() on
// objects, since we can encounter objects on the heap whose types belong to unloading
// AppDomains. In such cases, getting the type handle of the object could AV.  Use this
// function instead, which will return NULL for potentially unloaded types.