Strange threads in application in Win7 WOW64

Question

We are observing 4-6 threads on Windows 7 x64 in the application which have 3 threads and behaves normally on any Windows (either 32 or 64 bit) prior Windows 7.

Process Explorer shows the following "unknown" thread:

ntdll.dll!EtwDeliverDataBlock+offset

after random interval the following threads appear:

ntdll.dll!TpCallbackIndependent+offset
ntdll.dll!TpCallbackIndependent+offset

after that application can't create thread (error code 8, hot enough space ...).

It seems to me that some system DLL creates ETW threads or something. Does anyone know what these threads for and how to manage them?

Answer 1

The TP threads are a part of the Windows threadpool API and are created because your application (or a DLL used by your application) has used the Windows threadpool API. It also appears that your application (or one of the DLLs used by your application) is using the ETW APIs which also use a couple of threads. You really don't have the ability to manage these threads.

I seriously doubt that those threads are what is causing the out of memory error. It is more likely that the problem is that there isn't enough contiguous memory available in your process to reserve the room for the new thread's stack.