Windows core programming Note (4)----thread

1. Process and thread process is inert and never executes anything, it is just a container of threads. A thread must be created in the context of a process, and its life cycle is within that process. Because the handle table is for each process, multiple threads in the same process can share kernel object handles. Process runs require a lot of memory resources (load DLLs, etc.), and the process requires only one kernel object and one process stack, without the need to consume much memory. 2. Several ways to terminate a thread: 2.1 Thread function return (highly recommended) 2.2 kill yourself with the ExitThread function (suicide, not recommended) terminate the thread to run, the operating system cleans up the system resources used by the thread, but the C + + object is not destroyed. 2.3 A thread in the same process or another process calls the TerminateThread function termination process (homicide, not recommended) and the kill process, TerminateThread is executed asynchronously, notifies the system to terminate the thread, but when the function returns does not determine that the thread has been terminated, You can use WaitForSingleObject to wait, and if it is exitthread terminate the thread, the stack of the thread will be cleaned out. However, if you use TerminateThread, the system does not destroy the thread's stack unless the process that owns the thread terminates (it is important that for long-running programs, if we have repeatedly created threads, killing threads can cause memory to grow, the final program might crash). The stack of the killed thread is not cleaned up, and the other threads still have normal access. In addition, the DLL usually receives notification when the thread terminates normally, releasing the associated resources. However, when a thread is forcibly killed by TerminateThread, the DLL will not be notified and will not be able to perform normal cleanup work. 2.4 The process in which the thread is running terminates the Run program: after the C\c++ runtime calls the Main\winmain function, after the Mian function returns, the C\c++ runtime calls ExitProcess to exit the process. When multiple threads are optimistic, the termination process for each thread needs to be handled before the main thread returns. Otherwise, other running threads will suddenly die after the c\c++ runtime calls ExitProcess. 3, Thread normal termination process (1) The user object handles owned by the thread are freed, and a thread has two user objects: Windows and hooks. Once the thread exits, the window it creates is destroyed and the hooks created or mounted by the thread are unloaded. Other objects are destroyed only when the thread-owning process terminates, and (2) The exit code of the thread is passed from the Still_active Centennial City to the exit thread function, and (3) The Kernel object state of the threads becomes the trigger state; (4) If the thread is the last active thread in the process, The system considers that the process has also terminated; (5) in-thread checkThe application of the elephant counts-1. Other threads can use GetExitCodeThread () to check that the thread identified by Hthread has terminated and returns still_active if the thread is not terminated. 4, kernel thread execution procedure call kernel API Rtluserthreadstart, incoming thread function address fun and thread execution parameter param, the process is as follows: (1) Set structured exception handling frame, (2) system call thread function fun incoming parameter param ; (3) After the thread function returns, call ExitThread and pass the function return value to it. The thread kernel object reference count decrements, the thread stops executing, (4) 5, when the thread's kernel object is destroyed it is well known that the kernel object reference count is decremented after the call to CloseHandle, and the reference count is 0 o'clock the kernel object will be destroyed. But we often use closehandle immediately after creating a thread, and then the thread can continue to execute, and the kernel object is not destroyed? The reason is that when the kernel object of a thread is created, the initial reference count of 2,closehandle only means that we no longer care about the handle of the thread, the reference count is 1, so the kernel object is not destroyed. The thread's kernel object will not be destroyed unless the thread terminates and the thread handle returned from CreateThread is closed!!! (this tells us that when we no longer need to use a thread handle, we close it earlier) 6, the creation thread uses _beginthreadex instead of Createthreadcreatethread to create the thread, when the thread needs to call the function that contains the _TIDDATA structure , the c\c++ runtime attempts to get the address of the thread data block through TlsGetValue, CreateThread does not initialize the _TIDDATA structure and therefore returns NULL. At this point c\c++ allocates and initializes a _tiddata block for the thread, and then associates the structure with that line threads through TlsSetValue. Then, the thread calls any of the c\c++ run-time library functions to use the structure. So, here's the problem. Because the thread does not initialize the exception-handling frame, the entire process terminates when the thread uses the c\c++ signal function. Also, if a thread is not terminated by _endthreadex, the data block cannot be destroyed, causing a memory leak. (for a thread created with CreateThread, we do not really use _endthreadex to terminate) when the module is linked to the DLL repository of c\c++, the library receives a DLL_THREAD_DETACH notification when thread terminates and releases _ Tiddata the memory block (if assigned). 7. Do not use _beginthreaD (), _endthread (), early function limitations are more, not recommended. 8, understand their identity 8.1GetCurrentProcess return pseudo handle 0xffffffffGetCurrentThread return pseudo handle 0xFFFFFFFE call CloseHandle close the pseudo handle, return false, there is no need to close. 8.2 The pseudo handle to the true handle uses the DuplicateHandle function, and the converted handle needs to be CloseHandle closed after it is finished.

Windows core programming Note (4)----thread