\n| \n \nBack in the days of Windows 95 development,\none of my colleagues debugged\na line-of-business application for a major delivery service.\n\nThis was a program that the company gave to its top-tier\nhigh-volume customers,\nso that they could place and track their orders directly.\n<\/font>\nAnd by directly<\/i>,\nI mean that the program\ndialed the modem\n(since that was how computers communicated with each other back then)\nto contact\nthe delivery service’s mainframe\n(it was all mainframes back then)<\/font><\/strike>\na computer at the delivery service<\/u>\nand upload the new orders\nand download the status of existing orders.¹<\/font>\n<\/p>\n<\/td>\n\n\n[Length. The “top tier customer” part of the story is irrelevant.]\n<\/div>\n \n[Length. The mainframe part of the story is irrelevant.]\n<\/div>\n \n[Speculation.\nNo proof that the computer being dialed is a mainframe.\nFor all you know, it was an Apple ][ on the other end of the modem.]\n<\/div>\n<\/td>\n<\/tr>\n \n| \n \nVersion 1.0 of the application had a notorious bug:\nNinety days after you installed the program,\nit stopped working.\nThey forgot to remove the beta expiration code.\nI guess that’s why they have a version 1.01.<\/font><\/strike>\nIt told you that the beta period has expired.<\/u>\n<\/p>\n<\/td>\n\n\n[Length. Version 1.0 is irrelevant.]\n<\/div>\n \n[Speculation.\nNo proof that the beta expiration code was left by mistake.\nIt could have been intentional, for whatever reason.\nProbably some nefarious reason.]\n<\/div>\n<\/td>\n<\/tr>\n \n| \n \nAnyway, the bug that my colleague investigated\nwas that<\/font>\nIf you entered a particular type of\norder with a particular set of options\nin a particular way,\nthen the application crashed your system.\nSetting up a copy of the application\nin order to replicate the problem\nwas itself a bit of an ordeal,\nbut that’s a whole different story.<\/font>\n<\/p>\n<\/td>\n | \n\n[Length. Retransition no longer necessary.\nThe “setting up” story is irrelevant.]\n<\/div>\n<\/td>\n<\/tr>\n \n| \n \nOkay, the program is set up, and yup, it crashes exactly\nas described when run on Windows 95.\nActually, it also crashes exactly as described when\nrun on Windows 3.1.\nThis is just plain an application bug.\n<\/p>\n<\/td>\n | \n\n[Length. Irrelevant.]\n<\/div>\n<\/td>\n<\/tr>\n \n| \n \nThe initial crash<\/b><\/u>\n<\/p>\n<\/td>\n | \n\n[Structure. Create heading (even though it gives away some of the story).]\n<\/div>\n<\/td>\n<\/tr>\n \n| \n \nHere’s why it crashed:<\/strike>\nAfter the program\ndials up\nthe mainframe to submit the order<\/font><\/strike>\nthe order system<\/u>,\nit tries to refresh\nthe list of orders that have yet to be delivered<\/font><\/strike>\na list box control<\/u>.\nThe code that does this assumes that\nthe list of undelivered orders<\/font><\/strike>\nthe list box control<\/u>\nis the control with focus.\nBut\nif you ask for labels to be printed,\nthen the printing code changes focus in order to\ndisplay the “Please place the label on the package\nexactly like this” dialog<\/font><\/strike>,\nunder the specific circumstances,\nthe control is no longer focus;\nas I recall, it was because a dialog box had appeared and changed focus<\/u>,\nand as a result, the refresh code can’t find the\nundelivered order list<\/font><\/strike>\nlist box<\/u>\nand crashes on a null pointer.\n(I’m totally making this up, by the way.\nThe details of the scenario aren’t important to the story.)<\/font><\/strike>\n<\/p>\n<\/td>\n\n\n[Fabrication.\nAll that is known is that there was a list box that lost focus to\na dialog box.]\n<\/div>\n<\/td>\n<\/tr>\n \n| \n \nOkay, well, that’s no big deal.<\/font>\nA null pointer fault should just put up the\nUnrecoverable Application Error dialog box\nand close the program.\nWhy does this particular null pointer fault crash the entire system?\n<\/p>\n<\/td>\n | \n\n[Embellishment.]\n<\/div>\n<\/td>\n<\/tr>\n \n| \n \nRecovering from the crash<\/b><\/u>\n<\/p>\n<\/td>\n | \n\n[Structure. Create heading.]\n<\/div>\n<\/td>\n<\/tr>\n \n| \n \nThe developers of the program saw that their refresh code\nsometimes crashed on a null pointer,\nand instead of fixing it by actually fixing the code so it\ncould find the list of undelivered orders even if it didn’t\nhave focus,\nor fixing it by adding a null pointer check,\nthey fixed it by adding a null pointer exception handler.\n(I wish to commend myself for\nresisting the urge to put the word fixed<\/i> in quotation marks\nin that last sentence.)<\/font><\/strike>\nThe program installed a null pointer exception handler.<\/u>\n<\/p>\n<\/td>\n\n\n[Speculation.\nNo way of knowing that this was what the developers were thinking\nwhen they wrote the code.]\n<\/div>\n<\/td>\n<\/tr>\n \n| \n \nNow, 16-bit Windows didn’t have structured exception handling.\nThe only type of exception handler was a global exception handler,\nand this wasn’t just global to the process.\nThis was global to the entire system.\nYour exception handler was called for every exception everywhere.\nIf you screwed it up, you screwed up the entire system.\n(I think you can see where this is going.)<\/font>\n<\/p>\n<\/td>\n | \n \n[Embellishment.]\n<\/p>\n<\/td>\n<\/tr>\n | \n| \n \nThe developers of the program converted their global exception handler\nto a local one by going\nto every function that had a\n“We seem to crash on a null pointer and I\ndon’t know why” bug and making these changes:\n<\/font><\/strike>\nA few functions in the program took the following form:<\/u>\n<\/p>\n\nextern jmp_buf caught;\nextern BOOL trapExceptions;\nvoid scaryFunction(...)\n{\n if (setjmp(&caught)) return;\n trapExceptions = TRUE;<\/font>\n ... body of function ...\n trapExceptions = FALSE;<\/font>\n}\n<\/pre>\n\nTheir global exception handler checks the trapExceptions<\/code>\nglobal variable,\nand if it is TRUE<\/code>,\nthey set it back to FALSE<\/code> and\ndo a longjmp<\/code> which sends control\nback to the start of the function,\nwhich detects that something bad must have happened and just\nreturns out of the function.\n<\/p>\n<\/td>\n\n\n[Speculation.\nNo way of knowing that this was what the developers were thinking\nwhen they wrote the code.\nNo proof that the code was first written without a global exception handler,\nand that the handler was added later.\nNo proof that every<\/i> such function set this variable.\nNo proof that the reason for adding the setjmp<\/code> was to\nprotect against null pointer failures.]\n<\/div>\n<\/td>\n<\/tr>\n\n| \n \nYes, things are kind of messed up as a result of this.\nYes, there is a memory leak.\nBut at least their application didn’t crash.<\/font>\n<\/p>\n<\/td>\n | \n\n[Embellishment.]\n<\/div>\n<\/td>\n<\/tr>\n \n| \n \nOn the other hand, if the global variable is FALSE<\/code>,\nbecause their application crashed in some other function that\ndidn’t have this special protection,\nor because some other totally unrelated application crashed,\nthe global exception handler decided to exit the application\nby running around freeing all the DLLs and memory associated with their\napplication.<\/p>\n\nOkay, so far so good, for certain values of good<\/i>.<\/font>\n<\/p>\n<\/td>\n \n\n[Embellishment.]\n<\/div>\n<\/td>\n<\/tr>\n \n| \n \nFailed recovery<\/b><\/u>\n<\/p>\n | \n\n[Structure. Add heading here.]\n<\/div>\n<\/td>\n<\/tr>\n \n| \n \nThese system-wide exception handlers had to be written in assembly\ncode because they were dispatched with a very strange calling\nconvention.\nBut the developers of this application\ndidn’t write their system-wide exception handler\nin assembly language.\nTheir application was written in MFC,\nso they just went to Visual C++ (as it was then known),\nclicked through some Add a Windows hook<\/i> wizard,\nand got some generic HOOKPROC<\/code>.\n(I don’t know if Visual C++ actually had an\nAdd a Windows hook<\/i> wizard;\nthey could just have copied the code from somewhere.)\nNevermind that these system-wide exception handlers are not\nHOOKPROC<\/code>s, so the function has the wrong prototype.\nWhat’s more, the code they used marked the hook function\nas __loadds<\/code>.\nThis means that the function<\/font><\/strike>\nFor whatever reason, the handler they installed<\/u>\nsaves the previous value of the\nDS<\/code> register on entry,\nthen changes the register to point to the application’s data,\nand on exit, the function restores the previous value of DS<\/code>.\n<\/font><\/strike>\n<\/p>\n<\/td>\n\n\n[Speculation.\nNo proof that the program was written with MFC in the\nMicrosoft Visual C++ IDE.\nIt could have been written with Notepad in\nassembly language\nthat just happens to look like the assembly language generated by\nthe Microsoft Visual C++ compiler when it compiles code written in MFC.]\n<\/div>\n<\/td>\n<\/tr>\n \n| \n \nThe DS<\/code> is a register on the x86 CPU that describes the\ndata currently being operated upon.\nAll that’s important here is that the value in the DS<\/code>\nregister must always be valid, or the CPU will raise an exception.<\/u>\n<\/p>\n<\/td>\n\n\n[Need to explain the DS<\/code> register in case the reader cannot\ninfer this from the description that comes later.\nWe have established that neither the author nor the reader\nis allowed to draw inferences.]\n<\/div>\n<\/td>\n<\/tr>\n\n| \n \nOkay, now we’re about to enter the\n\nset piece<\/a> at the end of the movie:\nOur hero’s fear of spiders,\nhis girlfriend’s bad ankle from an old soccer injury,\nthe executive toy on the villain’s desk,\nand all the other tiny little clues\ndropped in the previous ninety minutes\ncome together to form an enormous chain reaction.<\/font><\/strike>\n<\/p>\n<\/td>\n\n\n[Embellishment.]\n<\/div>\n<\/td>\n<\/tr>\n \n| \n \nThe application crashes on a null pointer.\nThe system-wide custom exception handler is called.\nThe crash is not one that is being protected by the global variable,\nso the custom exception handler frees the application from memory.\nThe system-wide custom exception handler now returns,\nbut wait, what is it returning to?\n<\/p>\n \nThe crash was in the application,\nwhich means that the DS<\/code> register\nit saved on entry to the custom exception handler\npoints to the application’s data.\nThe custom exception handler freed the application’s data\nand then returned, declaring the exception handled.\nAs the function exited,\nit tried to restore the original DS<\/code> register,\nbut the CPU said,\n“Nice try,\nbut that is not a valid value for the DS<\/code> register\n(because you freed it).”\nThe CPU reported this error by\n\n(dramatic pause)\n<\/font>\nraising an exception.\n<\/p>\n<\/td>\n\n\n[Embellishment.]\n<\/div>\n<\/td>\n<\/tr>\n \n| \n \nThat’s right,<\/font>\nThe system-wide custom exception handler\ncrashed with an exception.\n<\/p>\n<\/td>\n | \n\n[Embellishment]\n<\/div>\n<\/td>\n<\/tr>\n \n| \n \nThe chain reaction<\/b><\/u>\n<\/p>\n<\/td>\n | \n\n[Structure. Add heading here.]\n<\/div>\n<\/td>\n<\/tr>\n \n| \n \nOkay, things start snowballing.\nThis is the part of the movie where the director uses\nquick cuts between different locations,\n\nmaybe with a little slow motion thrown in<\/a>.<\/font><\/strike>\n<\/p>\n<\/td>\n\n\n[Embellishment.]\n<\/div>\n<\/td>\n<\/tr>\n \n| \n \nSince an exception was raised,\nthe custom exception handler is called recursively.\nEach time through the recursion, the custom exception handler\nfrees all the DLLs and memory associated with the application.\nBut that’s okay, right?\nBecause the second and subsequent times,\nthe memory was already freed,\nso the attempts to free them again will just fail\nwith an invalid parameter error.\n<\/p>\n \nBut wait, their list of DLLs associated\nwith the application included\nUSER<\/code>,\nGDI<\/code>,\nand\nKERNEL<\/code>.\nNow, Windows is perfectly capable of unloading dependent DLLs\nwhen you unload the main DLL,\nso when they unloaded their main program, the kernel already\ndecremented\nthe usage count on\nUSER<\/code>,\nGDI<\/code>,\nand\nKERNEL<\/code> automatically.\nBut they apparently didn’t trust Windows to do this,\nbecause after all,\nit was Windows that was causing their application to crash,\nso they took it upon themselves to free those DLLs manually.<\/font><\/strike>\nFor whatever reason, the handler frees the DLLs anyway.<\/u>\n<\/p>\n<\/td>\n\n\n[Speculation.\nNo way of knowing that this was what the developers\nwere thinking when they wrote the code.]\n<\/div>\n<\/td>\n<\/tr>\n \n| \n \nTherefore, each time through the loop,\nthe usage counts for\nUSER<\/code>,\nGDI<\/code>,\nand\nKERNEL<\/code> drop by one.\nZoom in on the countdown clock on the ticking time bomb.<\/i><\/font><\/strike>\n<\/p>\n\nBeep beep beep beep beep<\/i>.<\/font><\/strike>\nThe reference count finally drops to zero.\nThe window manager, the graphics subsystem,\nand the kernel itself have all been unloaded from memory.\nThere’s nothing left to run the show!\n<\/p>\n<\/td>\n\n\n[Embellishment.]\n<\/div>\n<\/td>\n<\/tr>\n \n| \n \nBoom, bluescreen.\nHot flaming death.\n<\/p>\n \nThe punch line to all this is that whenever you call the company’s\nproduct\nsupport line and describe a problem you encountered,\ntheir response is always,\n“Yeah, we’re really sorry about that one.”<\/font><\/strike>\n<\/p>\n<\/td>\n\n\n[Length. Irrelevant.]\n<\/div>\n<\/td>\n<\/tr>\n \n| \n \n\nBonus chatter<\/b>:\nWhat is that whole different story<\/i>\nmentioned near the top?\n<\/font>\n<\/p>\n<\/td>\n | \n\n[Length. Cut the entire bonus chatter. Irrelevant story.]\n<\/td>\n<\/tr>\n \n| \n \n\nWell, when the delivery service sent the latest version\nof the software to the Windows 95 team,\nthey also provided an account number to use.\nMy colleague used that account number to\ntry to reproduce the problem,\nand since the problem occurred only after the order was\nsubmitted,\nshe would have to submit delivery requests,\nsay for a letter to be picked up\nfrom 221B Baker Street\nand delivered to 62 West Wallaby Street,\nor maybe for a 100-pound package of radioactive material\nto be picked up from\n1600 Pennsylvania Avenue\nand delivered to\n10 Downing Street.<\/font><\/strike>\nall of which were fictitious<\/u>.\n<\/font>\n<\/p>\n<\/td>\n\n\n[Fabrication.\nNo proof that these were the addresses and orders used.\nAll that is known is that fictitious orders were placed.]\n<\/div>\n<\/td>\n<\/tr>\n \n| \n \n\nAfter\nabout two weeks of this,\nmy colleague got a phone call from\npeople identifying themselves as<\/u>\nMicrosoft’s\nshipping department.\n“What the heck are you doing?”<\/font><\/strike>\n<\/font>\n<\/p>\n<\/td>\n\n\n[Speculation.\nNo proof that the call truly came from the shipping department.\nCould have been a lucky prank call.]\n<\/div>\n \n[Fabrication.\nNo transcript of this call exists.]\n<\/div>\n<\/td>\n<\/tr>\n \n| \n \n\nIt turns out that the account number my colleague was given\nwas Microsoft’s own corporate account number.\nAs in a real live account<\/i>.\nShe was inadvertently prank-calling the delivery company\nand sending actual trucks all over the\ncountry to pick up nonexistent letters and packages.\nThe people who identified themselves as<\/u>\nMicrosoft’s shipping department and people\nfrom the delivery service’s headquarters\nclaimed that they<\/u>\nwere frantic trying to trace where all the bogus\norders were coming from.\n<\/font>\n<\/p>\n<\/td>\n | \n\n[Hearsay.]\n<\/div>\n<\/td>\n<\/tr>\n \n| \n \n\n¹\nMind you, this sort of thing is the stuff that average Joe\ncustomers can do while still in their pajamas,\nbut back in those days,\nit was a feature that only top-tier customers had access to,\nbecause, y’know, mainframe.\n<\/font>\n<\/p>\n<\/td>\n<\/tr>\n<\/table>\n","protected":false},"excerpt":{"rendered":"Some people objected to the length, the structure, the metaphors, the speculation, and fabrication. So let’s say they were my editors. Here’s what the article might have looked like, had I taken their recommendations. (Some recommendations were to text that was also recommended cut. I applied the recommendations before cutting; the cuts are in gray.) […]<\/p>\n","protected":false},"author":1069,"featured_media":111744,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[1],"tags":[2],"class_list":["post-443","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-oldnewthing","tag-history"],"acf":[],"blog_post_summary":" Some people objected to the length, the structure, the metaphors, the speculation, and fabrication. So let’s say they were my editors. Here’s what the article might have looked like, had I taken their recommendations. (Some recommendations were to text that was also recommended cut. I applied the recommendations before cutting; the cuts are in gray.) […]<\/p>\n","_links":{"self":[{"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/posts\/443","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/users\/1069"}],"replies":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/comments?post=443"}],"version-history":[{"count":0,"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/posts\/443\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/media\/111744"}],"wp:attachment":[{"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/media?parent=443"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/categories?post=443"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/tags?post=443"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}} | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | |