Debugging SP2 on the Tablet PC – managed code, tabtip.exe, and procexp

If you've got a Tablet PC and you're running SP2 (and you should be!) you might have noticed a couple of processes hanging around called TabTip.exe and TCServer.exe. And right after noticing them, you probably wondered why they seemed to be taking up so much memory.

Luckily, autoruns is not the only cool tool from those fine folks at Sysinternals. They've also produced the must-have procexp: it's a better task manager than Task Manager, and is great for these kinds of "what the heck is that process doing" moments. In particular, you can tell procexp to use highlighting to call attention to services, jobs, your own processes, or (as in this case) .NET processes:

procexp - process view

Yup, that's right, TCServer and TabTip are both written in managed code - after all, the Tablet PC edition of Windows XP was the first to ship with the .NET CLR, so why not use it? 🙂 Now we can use another neat feature of procexp: right-click on the TabTip process, bring up its property window, and scroll across to the .NET tab. Managed processes define many counters to keep track of their own performance, and procexp lets you see them all. Here are some of the .NET memory counters for that process:

procexp - .NET view

Now we can see why TabTip seems to be taking up so much memory: even though it's got just 0.5 MB of heap data and 1.5 MB of total data, the CLR has reserved 32 MB of virtual memory for it, "just in case". For users accustomed to unmanaged apps that do their own memory management, this "greedy" memory behavior of the CLR can come as a surprise, but for garbage-collected applications it makes sense. After all, if the machine has sufficient memory, why bother spending the time to collect objects that are no longer used?

As the Windows world moves towards .NET, we'll probably have to spend a lot more time explaining this to customers. In the meantime, procexp is a great tool for looking into the guts of your .NET applications.

Update: AT caught a mistake, now fixed. Also, this diagram from Rico Mariani's excellent introductory article on "Garbage Collector Basics and Performance Hints" shows the difference between allocated, committed, and reserved space very nicely:

.net heaps

Comments (11)

  1. Ron Jeffries says:

    Thanks for the tip on procexp.

    To build on what you’re saying here, is it fair to say that what matters in system performance isn’t how much virtual is reserved, but how much actual memory is in use?

    And I gather that you’re saying that grabbing lots of virtual (32 meg here) allows the app to run with less garbage collection overhead, because until the app gets close to that limit, it won’t GC?

    Finally, if there IS memory pressure on the machine, what does .NET do, and when?



  2. Julie Lerman says:

    Although these two apps are managed, it’s important to remember that the TabletPC SDK is not. It’s COM with a wrapper for accessing it from .NET.

  3. AT says:

    This is common misunderstanding with memory consumption in Windows.

    Reserving memory does not consume physical memory that much. Reserved memory simply mark PTE (or VAD) entries as reserved.

    Real physical memory used only then memory is commited.

    So in reality your TabTip use about 13Mb of physical memory (and some part of this can be shared with other .NET processes as it’s CLR DLLs data)

    Take a read for example this:

    or this

    "Memory allocation in NT is a two-step process–virtual memory addresses are reserved first, and committed second. The reservation process is simply a way NT tells the Memory Manager to reserve a block of virtual memory pages to satisfy other memory requests by the process. However, Memory Manager makes no changes to a process at the time of a reservation because the reservation does not use actual memory"

    There is even more tricky memory issue. Memory-mapped files. They appear as commited memory – but in reality they do not use that much physical memory and does not use pagefile at all.

    Read-only memory mapped files can be purged out of memory easily – but if it’s kepped in memory – it’s served as cache and increase overall program speed.

    Read/Write memory mapped files are similar to Read-only – but then they are paged-out – they are stored on disk (not in pagefile).

    Even more – paging is NOT evil ! For one program – keeping as much as possible data in memory is good. You have already paid for your memory chips – why not use them ? Paging is an evil if you have many programs and you unable to keep all their data in memory.

    This mean that program instead of keeping all data in memory will access slow harddrive more often.


    Program that will comsume at most 128Kb memory buffer to _randomly_ access 45Mb file using disk-IO every time it need to read/write something or program that can consume up to 45Mb mapped memory and will use IO (using page fault handler) only then there is shortage of memory.

    Which program expected to work faster ? One that consume at most 128Kb or one with 45Mb ?

  4. AT says:

    After I was thinking that "CLR Reserved memory" can mean something different from "Windows Memory Manager reserved" I’ve found this link:

    "# Total reserved Bytes:

    Displays the amount of virtual memory. in bytes, currently reserved by the garbage collector. Reserved memory is the virtual memory space reserved for the application but no disk or main memory pages have been used. "

    P.S> Google rocks !!

  5. DrFooMod2 says:

    OK, so it’s managed code, but that still doesn’t change the fact that I have a tablet w/ 512MB RAM and it’s into virtual memory w/o starting a single app. What am I supposed to do? No where did I see that SP2 would required a memory upgrade. Urgh!

  6. My Toshiba has just over 200 MB "committed" after boot, and that’s with various memory-hungry background apps running, such as a Microsoft-mandated virus checker. What are you running that takes up another 300 MB??

  7. seattleduck says:

    I came across this post looking for help on why tcserver.exe was sucking up 343 MB of memory on my Portege M200, when all I had running was Word, Outlook, and a couple IE windows. I had to restart, knocking TCserver.exe back down to about 23 MB. TabTip.exe is taking up 51 MB right now.

    So I get TabTip, but 343 BM from tcserver? my machine could barely move. SP2 running and all, any idea what would cause this? It had been on for about 1 week w/ no restart.

  8. Yup, there’s a known issue where tcserver.exe can start allocating way too much memory 🙁 Until there’s a fix for this, the cleanest workaround is to log off and back on again – that will give you a new tcserver.exe in a sane state.

    If you don’t want to log off, an alternative is:

    1) kill tabtip.exe

    2) kill tcserver.exe

    3) restart tabtip.exe using the TIP button (this restarts tcserver.exe, which is why you have to do #1 and #2 in that order)

  9. In August 2004, I mentioned that the Tablet PC uses managed code for parts of its inking support. Specifically,…

  10. In August 2004, I mentioned that the Tablet PC uses managed code for parts of its inking support. Specifically,

Skip to main content