[9.0b13] TC Hang on close

[browny]

kernel32.dll+0x2542 is in WaitForMultipleObjects.

When I open process properties, there are usually 4 threads in the list.
Top line is active (CPU over 90%, CSwitch Delta ~100), other threads are idling.
Counters show that used time is kernel time.

When I press refresh button in Process Explorer, I get these different, but similar stacks:

Code: Select all

ntkrnlpa.exe+0x6a7af
ntkrnlpa.exe+0xf6ee8
ntkrnlpa.exe+0x26ae1
hal.dll+0x6c0e
ntkrnlpa.exe+0xdf0a4
ntkrnlpa.exe+0x66638
ntdll.dll+0xe4f4
kernel32.dll+0x2542
TOTALCMD.EXE+0x16e512
TOTALCMD.EXE+0x192b2
TOTALCMD.EXE+0x364a
kernel32.dll+0xb713

Code: Select all

ntkrnlpa.exe+0x6a7af
ntkrnlpa.exe+0xf6ee8
ntkrnlpa.exe+0x26ae1
hal.dll+0x6c0e
kernel32.dll+0x256a
kernel32.dll+0x2542
TOTALCMD.EXE+0x16e512
TOTALCMD.EXE+0x192b2
TOTALCMD.EXE+0x364a
kernel32.dll+0xb713

Code: Select all

ntkrnlpa.exe+0x6a7af
ntkrnlpa.exe+0xf6ee8
ntkrnlpa.exe+0x26ae1
hal.dll+0x6c0e
ntkrnlpa.exe+0x60f2b
ntkrnlpa.exe+0x66638
ntdll.dll+0xe4f4
kernel32.dll+0x2542
TOTALCMD.EXE+0x16e512
TOTALCMD.EXE+0x192b2
TOTALCMD.EXE+0x364a
kernel32.dll+0xb713

And so on.
What that thread might be waiting for?

[ghisler(Author)]

As you can see, all these threads contain kernel32.dll+0x2542 , which is WaitForMultipleObjects.

They are all background threads waiting for additional input. WaitForMultipleObjects does not cause any high CPU usage!

TC wakes up these threads when there is something to do in the background, e.g. load an icon for a file.

Please try to find threads which do not contain the address kernel32.dll+0x2542 in the stack trace.

[browny]

As you can see, all these threads contain kernel32.dll+0x2542 , which is WaitForMultipleObjects.

Edit.
You got it incorrrectly; those were different stacks for the same thread. There is Refresh button in Stack dialog.
End of edit.

Process explorer gives state of this thread as Ready, not Waiting.
And three other threads have zeros in User Time and Kernel Time.

All I have in this virtual machine is VC++ 6.0, no .pdb files, no TC map.
Not the best setup for getting useful debug information.

[j7n]

I got six threads. The one consuming CPU is Ready. What I believe to be a main thread is idle and has status Wait:WrUserRequest.

Code: Select all

ntkrnlpa.exe!KiSwapContext+0x25
ntkrnlpa.exe!KiExitDispatcher+0xd3
ntkrnlpa.exe!KeSetEvent+0xb8
ntdll.dll!KiFastSystemCallRet
user32.dll!NtUserWaitMessage+0xc
TOTALCMD.EXE+0x2ba5d
TOTALCMD.EXE+0x340d17
kernel32.dll!BaseProcessStart+0x23

If I poke around Process Explorer, I do see KeWaitForSingleObject added to it, but do not understand if it has any significance.

Code: Select all

ntkrnlpa.exe!KiSwapContext+0x25
ntkrnlpa.exe!KiSwapThread+0x83
ntkrnlpa.exe!KeWaitForSingleObject+0x2e0
ntkrnlpa.exe!KiSuspendThread+0x18
ntkrnlpa.exe!KiDeliverApc+0x114
ntkrnlpa.exe!KiSwapThread+0x9f
ntkrnlpa.exe!KeWaitForSingleObject+0x2e0
win32k.sys!xxxSleepThread+0x1be
win32k.sys!xxxRealWaitMessageEx+0x12
win32k.sys!NtUserWaitMessage+0x14
ntkrnlpa.exe!KiFastCallEntry+0xf8
ntdll.dll!KiFastSystemCallRet
user32.dll!NtUserWaitMessage+0xc
TOTALCMD.EXE+0x2ba5d
TOTALCMD.EXE+0x340d17
kernel32.dll!BaseProcessStart+0x23

The only CPU consuming thread looks similar to the above.

Code: Select all

ntkrnlpa.exe!KiSwapContext+0x25
ntkrnlpa.exe!KiExitDispatcher+0x98
ntkrnlpa.exe!KeSetEvent+0xb8
ntkrnlpa.exe!PspGetSetContextSpecialApc+0x4e
ntkrnlpa.exe!KiDeliverApc+0xb8
hal.dll!HalpDispatchSoftwareInterrupt+0x49
hal.dll!HalpCheckForSoftwareInterrupt+0x81
hal.dll!HalEndSystemInterrupt+0x67
ntkrnlpa.exe!KiInterruptDispatch+0x50
ntkrnlpa.exe!_SEH_prolog+0x34
ntkrnlpa.exe!KiFastCallEntry+0xf8
ntdll.dll!KiFastSystemCallRet
ntdll.dll!NtWaitForSingleObject+0xc
kernel32.dll!WaitForSingleObjectEx+0xac
kernel32.dll!WaitForSingleObject+0x12
TOTALCMD.EXE+0x16e512
TOTALCMD.EXE+0x192b2
TOTALCMD.EXE+0x364a
kernel32.dll!BaseThreadStart+0x34

So far the hang up has happened every single time I closed TC 9 from the taskbar on XP/2003, but only very rarely on Win Seven.

(Process Explorer uses Symbols from Microsoft to show function names.)

[krig]

Same here, TC9b14x64 hangs often but "WhatIsHang" does not work (started as admin):

"Error 5: Zugriff verweigert

WhatIsHang failed to extract thread information from the process. Try to right-click on WhatIsHang.exe and choose 'Run As Administrator' and then generate the report again."

I find out, that explorer.exe (SHLWAPI.dll) in connection with TB lead to a heavy CPU load.

[krasusczak]

I find out, that explorer.exe (SHLWAPI.dll) in connection with TB lead to a heavy CPU load.

This is logical because explorer.exe = taskbar, so need to be related

[browny]

I did not know 64-bit TC also fails this way.
Yesterday I unsuccessfully tried to do the trick in Windows 7 64-bit with 32-bit TC 9.0 beta14 at least half a dozen times.
Today it happend immediately.
But here I had the latest VS installed.
Here is the loop.

Code: Select all

0056E502 68 F4 01 00 00       push        1F4h  
0056E507 A1 D8 60 74 00       mov         eax,dword ptr ds:[007460D8h]  
0056E50C 50                   push        eax  
0056E50D E8 46 74 E9 FF       call        00405958  
0056E512 85 C0                test        eax,eax  
0056E514 0F 94 C0             sete        al  
0056E517 0A C3                or          al,bl  
0056E519 74 0F                je          0056E52A  
0056E51B 8B 46 24             mov         eax,dword ptr [esi+24h]  
0056E51E E8 01 E1 FF FF       call        0056C624  
0056E523 E8 7C FC FF FF       call        0056E1A4  
0056E528 8B D8                mov         ebx,eax  
0056E52A 80 7E 0C 00          cmp         byte ptr [esi+0Ch],0  
0056E52E 74 D2                je          0056E502  

Somewhere deeper wait routine is called, but (if I get it correctly) fails with NT error code 6 (invalid handle), returns -1 and the code loops.

[krasusczak]

http://ghisler.ch/board/viewtopic.php?t=45723

[Hacker]

Hi all,
Yesterday I experienced something that reminded me of this thread.

I am usually running TC 32-bit but yesterday I needed to do some 64-bit stuff so I started TC 64-bit from TC 32-bit. After finishing I closed TC 64-bit (I am not exactly sure how, either Alt-F4 or "X" in the upper right corner) and continued working in TC 32-bit. After some hours I wanted to shutdown my computer and by chance I was checking something in Process Explorer where I saw the TC process (I think totalcmd.exe) took up 50 % CPU (two cores of my quad core CPU). Upon double clicking and checking the threads I saw the CPU is taken up by WaitForMultipleObjects if I remember correctly (I am sorry for the unclear details, it was 4 AM already).

So this reminded me of this thread, I thought it might perhaps be relevant. If it happens again I will try and check in more detail.

Roman

[Hacker]

Hi all again,
Tried to reproduce it - ran TC 32-bit, from TC 32-bit ran TC 64-bit, from TC 64-bit ran Regedit, exit Regedit, exit TC 64-bit, check Process Explorer -> no luck.
Check Process Explorer later, (I think after closing TC but not sure) before shutdown - 50 % CPU usage just as described above, made two screenshots:
Thread 1964
Thread 6828

HTH
Roman

[ghisler(Author)]

Please try again with beta 15.

[j7n]

The problem appears to be fixed for me.

[krasusczak]

looks ok