How does the task manager know that an application is not responding?

Question

Windows

How does the task manager know that an application is not responding?

Answer 1

Windows (since Vista) implements the Wait Chain Traversal (WCT) mechanism, which, using specialized functions, allows you to detect deadlocks of processes running in the system. A wait chain is a causal relationship between events in a system, which is a sequence of alternating pairs of threads and events, each thread is followed by the event it is waiting for, and that event is in turn followed by the next thread in the chain to which it belongs, etc. By an event in this context, we mean any type of synchronization object, mutex, critical section, COM, LPC/RPC response, messages, and so on. A thread waits for an event from the moment it requests it to the moment it owns it. A lock is owned by a thread from the moment the thread acquires it until the moment it releases it. The term "lock ownership" refers to a lock waiting for the owner thread to release it. Thus, if thread A is waiting on a lock owned by thread B, then we can safely say that thread A is waiting for thread B. WCT allows you to request a wait chain for one or more threads by creating a session using WCT functions such as OpenThreadWaitChainSession, GetThreadWaitChain, EnumProcesses and GetThreadWaitChain.