tags:

views:

269

answers:

1

We are observing 4-6 threads on Windows 7 x64 in the application which have 3 threads and behaves normally on any Windows (either 32 or 64 bit) prior Windows 7.

Process Explorer shows the following "unknown" thread:

ntdll.dll!EtwDeliverDataBlock+offset

after random interval the following threads appear:

ntdll.dll!TpCallbackIndependent+offset
ntdll.dll!TpCallbackIndependent+offset

after that application can't create thread (error code 8, hot enough space ...).

It seems to me that some system DLL creates ETW threads or something. Does anyone know what these threads for and how to manage them?

+1  A: 

The TP threads are a part of the Windows threadpool API and are created because your application (or a DLL used by your application) has used the Windows threadpool API. It also appears that your application (or one of the DLLs used by your application) is using the ETW APIs which also use a couple of threads. You really don't have the ability to manage these threads.

I seriously doubt that those threads are what is causing the out of memory error. It is more likely that the problem is that there isn't enough contiguous memory available in your process to reserve the room for the new thread's stack.

Larry Osterman
You are right, I believe. I used procmon to catch CreateThread calls, it shows that ws2_32.dll initilizes thread pool. Still quite iteresting why implementation so different in Win7 ... and why winsock library needs TP.
Shcheklein
Basically using the TP API becomes a convenient way of handling async operations without creating a dedicated thread - in theory if multiple DLLs all use the same threadpool the overall thread load on the system is lower.
Larry Osterman