Question

There is a post by Raymond Chen, where he tells how bad IsBadXxxPtr function is by eating guard page exception.

I don’t quite understand how it is applied to Delphi. Who and how should normally (i.e. without call to IsBadXxxPtr) process this exception? I do know that Delphi inserts a code, which (for example) access a memory for large static arrays – exactly for this reason: to expand stack.

But if guard page exception is raised: who will handle it in a Delphi application? Can’t I accidentally mess with it by using try/except in inappropriate way? Will Delphi’s debugger notify me about these exceptions?

Answer 1

Windows structured exception handling (SEH) is has a two-phase structure. When an exception occurs, Windows first looks for a handler for the exception by following the registered exception handler chain (the head of which is stored in fs:[0] on x86, i.e. the first dword in the segment pointed to by the FS segment register – all that ugly 16-bit segment-offset logic didn’t go away in 32-bit, it just became less relevant).

The search is done by calling a function with a particular flag, a pointer to which is stored in each exception frame on the stack. fs:[0] points to the topmost frame. Each frame points to the previous frame. Ultimately, the last frame on the list is one that has been provided by the OS (this handler will pop up a app-crash dialog if an unhandled exception reaches it).

These functions normally check the type of the exception, and return a code to indicate what to do. One of the codes that can be returned is basically, ‘ignore this exception and continue’. If Windows sees this, it will reset the instruction pointer to the point of the exception and resume execution. Another code indicates that this exception frame should handle the given exception. A third code is ‘I’m not going to catch this exception, keep searching’. Windows keeps on calling these exception filter functions until it finds one that handles the exception one way or the other.

If Windows finds one that handles the exception by catching it, then it will proceed to unwind the stack back to that handler, which consists of calling all the functions again, only passing in a different flag. It’s at this point that the functions execute the finally logic, up until the handler which executes the except logic.

However, with the stack page guard exception, the process is different. None of the language’s exception handlers will elect to handle this exception, because otherwise the stack growth mechanism would break. Instead, the filter search filters all the way through to the base exception handler provided by the OS, which grows the stack allocation by committing the appropriate memory, and then returns the appropriate return code to indicate that the OS should continue where it left off, rather than unwind the stack.

The tool and debugging infrastructure are designed to let these particular exceptions play out correctly, so you don’t need to worry about handling them.

You can read more about SEH in Matt Pietrek’s excellent article in MSJ from over a decade ago.