Event handles being created outside my code
in [Win32 Kernel]
|
From: Luc Kumps on 25 Mar 2006 17:13 I have a small multithreaded application. It's not complicated, it has a few threads running in parallel, communicates with two other processes through named pipes. It uses event flags, created with CreateEvent, to wake up another thread and also in the OVERLAPPED structure used for the overlapped I/O (WriteFile, ReadFile, GetOverlappedResult, WFMO) on the named pipes. 1. I saw the Handle Count of the process going up continuously in Task Manager. 2. I used the native API and NtSysInfo to dump the objects corresponding to the handles, this way I found out the handles being created correspond to anonymous event handles 3. I added an output statement to all my CreateEvent calls AND I made my event flags NAMED 4. I monitored all calls to CreateEventA and CreateEventW with APISPY32 Results from (3) and (4) indicate that my program is NOT calling CreateEvent after startup. NtSysInfo tells me the extra event flags are still anonymous. Does anyone have ANY idea what could cause event flags to be created without APISPY32 noticing it (it DOES notice ny 'normal' CreateEvent calls). I also monitored calls to DuplicateHandle, no hits. Anything else I could monitor? I'll give NtCreateEvent a try now... When I change the timing of my application, e.g. by adding printf statements, the frequency of handle creation drops, so it's difficult to track down the actual location where the handles are being created. I'm getting the same behavior on Win2000 and WinXp. On the latter system, I'm now using GetProcessHandleCount() (it also shows the handle count going up) in an attempt to pinpoint the location where the handles are created, but it appears to be more or less random. I'm creating threads only at startup, as well as the event flags. TIA, Luc K
From: Luc Kumps on 25 Mar 2006 17:26 Luc Kumps wrote: > could monitor? I'll give NtCreateEvent a try now... YES!! NtCreateEvent is being called. I'll do a stack trace from there now! Luc K
From: Luc Kumps on 25 Mar 2006 18:50 Luc Kumps wrote: > Luc Kumps wrote: >> could monitor? I'll give NtCreateEvent a try now... > > YES!! NtCreateEvent is being called. I'll do a stack trace from there > now! Surprise surprise - NtCreateEvent is being called from within EnterCriticalSection, I guess my CS wasn't initialized properly. More later! Luc K
From: Luc Kumps on 26 Mar 2006 01:18 Luc Kumps wrote: > Surprise surprise - NtCreateEvent is being called from within > EnterCriticalSection, I guess my CS wasn't initialized properly. More > later! A Google on "NtCreateEvent" in combination with "EnterCriticalSection" learned me that "The handle is created when the critical section is first 'contented' and it will be closed when the critical section is deleted." These anonymous event handles are being created by DESIGN within EnterCriticalSection! In this stress test, I was using 20,000 critical sections VERY intensively, so event handles were being created now and then. I'll modify the code so it uses only a single 'global' CS... Luc K
|
Pages: 1 Prev: LowLevelHooksTimeout? Next: Thread pooling vs. AfxCreateThread() vs. beginthreadex... |