April 11th, 2019

How can I determine the reason why my window is closing?

Raymond Chen

A customer wanted to know whether their MFC program can determine why their window is closing, similar to how WinForms does.

The source code for WinForms is online. You can see how they do it, and then translate that to MFC.

Many of the CloseReason values refer to actions that occurred within WinForms itself, so those are naturally generated by WinForms. Three of the reasons are external to WinForms.

UserClosing: This is generated in response to the WM_SYSCOMMAND when the code is SC_CLOSE. This happens when the user closes the window by clicking the × in the upper right corner, or by double-clicking the system icon, or by selecting Close from the system menu.
WindowsShutDown: This is generated in response to the WM_QUERYENDSESSION and WM_ENDSESSION messages.
TaskManagerClosing: This is generated in response to the WM_CLOSE message, provided it wasn’t already set by someone else with better information.

The “provided it wasn’t already set by someone else with better information” is important, because many of the window closing scenarios lead to WM_CLOSE. For example, the default handling for the SC_CLOSE system menu command is to send the WM_CLOSE message, so you will see the SC_CLOSE first, followed by the WM_CLOSE message.

Note that TaskManagerClosing is inferred by the fact a WM_CLOSE message arrives without any of the known preliminaries. While it’s true that Task Manager uses the WM_CLOSE message to encourage an app to exit, it’s not the only program that does it.

A better name might be External or Programmatic.

Author

Raymond Chen

Raymond has been involved in the evolution of Windows for more than 30 years. In 2003, he began a Web site known as The Old New Thing which has grown in popularity far beyond his wildest imagination, a development which still gives him the heebie-jeebies. The Web site spawned a book, coincidentally also titled The Old New Thing (Addison Wesley 2007). He occasionally appears on the Windows Dev Docs Twitter account to tell stories which convey no useful information.

4 comments

Discussion is closed. Login to edit/delete existing comments.

Sort by :

Newest

Newest Popular Oldest

Ji Luo April 12, 2019 0

I’d say any program that programmatically posts quit message to apps can be thought as a task manager. BTW, WindowsShutdown is really LoggingOff, but that naming doesn’t sound as urgent as shutting down.
Joe Beans April 11, 2019 0

The problem with Task Manager’s WM_CLOSE is that, besides giving the target process more opportunity to do extra damage, it might route the target’s code through a “clean” pathway that persists the messed-up situation for future processes. Kill has to mean kill.
Also, something that gets overlooked in frameworks is a property saying if a close is already in progress.
- Andrew Cook April 12, 2019 0
  
  Which is why Task Manager gives you another option: Task Manager sends WM_CLOSE when you use the Processes tab (formerly known as the Applications tab), but when you use the Details tab (formerly known as the Processes tab) or if the window’s message pump isn’t responding, it injects a thread that calls TerminateProcess(). Which really does mean kill.
  - Kalle Niemitalo April 12, 2019 0
    
    I set a breakpoint at KERNELBASE!TerminateProcess in the Task Manager process on Win10 1809 and told it to end a process. The breakpoint was hit on the main thread of Task Manager. If older versions used to inject a thread to the process being killed, I’m curious why.