What is an Event Handle?

Question

I have a handle leak in a big old program. Using sysinternals handle.exe I deduced that the type of handle that is leaking is an "Event" handle. But I'm not sure what parts of my code I should be looking at. Is there a list somewhere of functions that return handles to events?

EDIT: There is not a single instance of CreateEvent, CreateEventEx or OpenEvent in the entire program.

Answer 1

How much of these leaked handles do you see?

Events are created implicitly by critical sections (see InitializeCriticalSection et.al.) and, probably, some other Win32 elements which I can't remember at the moment. Also, they can be created by the framework you are using (if any) such as MFC, or by libraries you are using.

To track down the leak, you can use a print-only breakpoint. Step into CreateEvent function (using assembly view) and put a breakpoint on its first instruction. Then right-click the breakpoint, choose 'When Hit...' and edit the options so it won't break into debugger but will print some useful information (e.g. see $CALLER macro). Then run your app... and be prepared to see a HUGE log. If there is a true leak, you'll see a repeating pattern in the log, which identifies the offender.

Answer 2

As other people have mentioned, CreateEvent / CreateEventEx are used to create "Event" handles. These represent synchronization objects that are frequently used to gate access, provide signals (potentially) to other threads, and may also be used as the basis for locks.

If you're trying to debug a leak involving Event handles, you should try to look for places where CreateEvent(Ex) is called without a corresponding CloseHandle(). Depending on what frameworks you used to obtain Events, you may also find that you might just be missing them on cleanup if they are members of another object/structure (Ex. something that has a generic HANDLE member variable that is skipped on cleanup, or a pointer to a HANDLE, etc).

If you don't recall having created these objects in your own code, it is possible you are missing a analogous Close() or other cleanup method on another class or provider that uses them internally. Things that do background processing, signaling, or provide methods to wait for operations to finish are the usual suspects here.

Create Event Handles
CreateEvent Function @ MSDN
CreateEventEx Function @ MSDN

Cleanup Handles
CloseHandle Function @ MSDN