What is SysFader and why is it always crashing?

Raymond Chen

If you type SysFader into your favorite search engine, you’ll find lots of hits from people asking, “What is SysFader, and why is it always crashing Internet Explorer?”

When a program encounters a fatal error, the system crash dialog appears. And it needs to put somebody’s name in the title of the dialog to indicate which application crashed. Sure, it has the process name (iexplore.exe), but it has this nagging feeling that it can do better. After all, not everybody will know that “AcroRd32.exe” is “The menu for my favorite restaurant that I was looking at in Adobe Acrobat Reader”. So it goes looking for a window that belongs to the thread so it can steal the window’s title and use that to help the user understand what it was that crashed. And if can’t find any visible windows, it will go for invisible ones, on the theory that, “Well maybe the application crashed before it could show the window.” Now let’s see what happens when we apply this logic to SysFader. SysFader is a helper window used by Internet Explorer to perform fade-out animations. It really doesn’t do much, but it is a window, albeit an invisible one when there are no animations in progress. SysFader happens to run on a shared worker thread. If that worker thread is being borrowed by some other background task, and that background task crashes, then when the crash dialog appears and looks around for a window to put in the title, it says “Rats, I don’t have any visible windows, but I do have this invisible one, so I’ll go ahead and put that one in the title bar. Better than nothing.” It’s sort of the error-reporting version of the Politician’s Fallacy:

1. A window must be blamed.
2. This is a window.
3. Therefore, we must blame it.

It’s like your photo appearing in a newspaper article headlined Robbery at Woodgrove Bank, Suspect At Large, not because you’re the suspect, but because you happen to have been in the building at the time of the robbery. Bonus chatter: You probably recognize the exception code as an unhandled C++ exception. Internet Explorer doesn’t use C++ exceptions, so the exception most likely came from a plug-in.

[Raymond is currently away; this message was pre-recorded.]

Raymond Chen

Follow