-replace user object/handle manager with the one from wine. its simpler, faster and more correct.
-convert dozens of functions to take pointers as args, not handles
-attempt to simplify/correct refcounting
-remove much useless refcounting
-make callout refcounts auto undoable (ei. if the thread crash in umode during callback)
-misc formatting/naming changes
Modified: trunk/reactos/subsys/win32k/eng/window.c
Modified: trunk/reactos/subsys/win32k/include/cursoricon.h
Modified: trunk/reactos/subsys/win32k/include/object.h
Modified: trunk/reactos/subsys/win32k/include/userfuncs.h
Modified: trunk/reactos/subsys/win32k/include/win32.h
Modified: trunk/reactos/subsys/win32k/include/window.h
Modified: trunk/reactos/subsys/win32k/include/winpos.h
Modified: trunk/reactos/subsys/win32k/main/dllmain.c
Modified: trunk/reactos/subsys/win32k/ntuser/accelerator.c
Modified: trunk/reactos/subsys/win32k/ntuser/class.c
Modified: trunk/reactos/subsys/win32k/ntuser/cursoricon.c
Modified: trunk/reactos/subsys/win32k/ntuser/focus.c
Modified: trunk/reactos/subsys/win32k/ntuser/hook.c
Modified: trunk/reactos/subsys/win32k/ntuser/input.c
Modified: trunk/reactos/subsys/win32k/ntuser/menu.c
Modified: trunk/reactos/subsys/win32k/ntuser/misc.c
Modified: trunk/reactos/subsys/win32k/ntuser/monitor.c
Modified: trunk/reactos/subsys/win32k/ntuser/msgqueue.c
Modified: trunk/reactos/subsys/win32k/ntuser/ntuser.c
Modified: trunk/reactos/subsys/win32k/ntuser/object.c
Modified: trunk/reactos/subsys/win32k/ntuser/painting.c
Modified: trunk/reactos/subsys/win32k/ntuser/scrollbar.c
Modified: trunk/reactos/subsys/win32k/ntuser/vis.c
Modified: trunk/reactos/subsys/win32k/ntuser/window.c
Modified: trunk/reactos/subsys/win32k/ntuser/winpos.c

Modified: trunk/reactos/subsys/win32k/eng/window.c
--- trunk/reactos/subsys/win32k/eng/window.c	2005-09-07 19:37:28 UTC (rev 17727)
+++ trunk/reactos/subsys/win32k/eng/window.c	2005-09-07 20:59:26 UTC (rev 17728)
@@ -197,7 +197,7 @@
 STDCALL
 EngCreateWnd(
   SURFOBJ          *pso,
-  HWND              hwnd,
+  HWND              hWnd,
   WNDOBJCHANGEPROC  pfn,
   FLONG             fl,
   int               iPixelFormat)
@@ -209,7 +209,7 @@
   DECLARE_RETURN(WNDOBJ*);
 
   DPRINT("EngCreateWnd: pso = 0x%x, hwnd = 0x%x, pfn = 0x%x, fl = 0x%x, pixfmt = %d\n",
-         pso, hwnd, pfn, fl, iPixelFormat);
+         pso, hWnd, pfn, fl, iPixelFormat);
 
   calledFromUser = UserIsEntered();
   if (!calledFromUser){
@@ -217,7 +217,7 @@
   }
 
   /* Get window object */
-  Window = IntGetWindowObject(hwnd);
+  Window = UserGetWindowObject(hWnd);
   if (Window == NULL)
     {
       RETURN( NULL);
@@ -227,7 +227,6 @@
   WndObjInt = EngAllocMem(0, sizeof (WNDGDI), TAG_WNDOBJ);
   if (WndObjInt == NULL)
     {
-      IntReleaseWindowObject(Window);
       DPRINT1("Failed to allocate memory for a WND structure!\n");
       RETURN( NULL);
     }
@@ -236,7 +235,6 @@
   WndObjInt->ClientClipObj = NULL;
   if (!IntEngWndUpdateClipObj(WndObjInt, Window))
     {
-      IntReleaseWindowObject(Window);
       EngFreeMem(WndObjInt);
       RETURN( NULL);
     }
@@ -247,7 +245,7 @@
   WndObjUser->pvConsumer = NULL;
 
   /* Fill internal object */
-  WndObjInt->Hwnd = hwnd;
+  WndObjInt->Hwnd = hWnd;
   WndObjInt->ChangeProc = pfn;
   WndObjInt->Flags = fl;
   WndObjInt->PixelFormat = iPixelFormat;
@@ -255,9 +253,6 @@
   /* associate object with window */
   InsertTailList(&Window->WndObjListHead, &WndObjInt->ListEntry);
 
-  /* release resources */
-  IntReleaseWindowObject(Window);
-
   DPRINT("EngCreateWnd: SUCCESS!\n");
   
   RETURN( WndObjUser);

Modified: trunk/reactos/subsys/win32k/include/cursoricon.h
--- trunk/reactos/subsys/win32k/include/cursoricon.h	2005-09-07 19:37:28 UTC (rev 17727)
+++ trunk/reactos/subsys/win32k/include/cursoricon.h	2005-09-07 20:59:26 UTC (rev 17728)
@@ -50,7 +50,7 @@
 
 HCURSOR FASTCALL IntSetCursor(PWINSTATION_OBJECT WinStaObject, PCURICON_OBJECT NewCursor, BOOL ForceChange);
 BOOL FASTCALL IntSetupCurIconHandles(PWINSTATION_OBJECT WinStaObject);
-PCURICON_OBJECT FASTCALL IntGetCurIconObject(PWINSTATION_OBJECT WinStaObject, HANDLE Handle);
+PCURICON_OBJECT FASTCALL IntGetCurIconObject(HANDLE Handle);
 PCURICON_OBJECT FASTCALL IntCreateCurIconHandle(PWINSTATION_OBJECT WinStaObject);
 VOID FASTCALL IntCleanupCurIcons(struct _EPROCESS *Process, PW32PROCESS Win32Process);
 

Modified: trunk/reactos/subsys/win32k/include/object.h
--- trunk/reactos/subsys/win32k/include/object.h	2005-09-07 19:37:28 UTC (rev 17727)
+++ trunk/reactos/subsys/win32k/include/object.h	2005-09-07 20:59:26 UTC (rev 17728)
@@ -5,106 +5,128 @@
 #include <win32k/bitmaps.h>
 #include <win32k/pen.h>
 
-typedef enum {
-  otUnknown = 0,
-  otClass,
-  otWindow,
-  otMenu,
-  otAcceleratorTable,
-  otCursorIcon,
-  otHookProc,
-  otMonitor
-} USER_OBJECT_TYPE;
+#define FIRST_USER_HANDLE 0x0020  /* first possible value for low word of user handle */
+#define LAST_USER_HANDLE  0xffef  /* last possible value for low word of user handle */
 
-typedef struct _USER_OBJECT_HEADER
-/*
- * Header for user object
- */
-{
-  USER_OBJECT_TYPE Type;
-  LONG HandleCount;
-  LONG RefCount;
-  CSHORT Size;
-} USER_OBJECT_HEADER, *PUSER_OBJECT_HEADER;
 
-typedef struct _USER_HANDLE
-{
-  PVOID ObjectBody;
-} USER_HANDLE, *PUSER_HANDLE;
+#define USER_HEADER_TO_BODY(ObjectHeader) \
+  ((PVOID)(((PUSER_OBJECT_HEADER)ObjectHeader) + 1))
 
-#define HANDLE_BLOCK_ENTRIES ((PAGE_SIZE-sizeof(LIST_ENTRY))/sizeof(USER_HANDLE))
+#define USER_BODY_TO_HEADER(ObjectBody) \
+  ((PUSER_OBJECT_HEADER)(((PUSER_OBJECT_HEADER)ObjectBody) - 1))
 
-typedef struct _USER_HANDLE_BLOCK
+
+
+typedef struct _USER_HANDLE_ENTRY
 {
-  LIST_ENTRY ListEntry;
-  USER_HANDLE Handles[HANDLE_BLOCK_ENTRIES];
-} USER_HANDLE_BLOCK, *PUSER_HANDLE_BLOCK;
+    void          *ptr;          /* pointer to object */
+    unsigned short type;         /* object type (0 if free) */
+    unsigned short generation;   /* generation counter */
+} USER_HANDLE_ENTRY, * PUSER_HANDLE_ENTRY;
 
+
+
 typedef struct _USER_HANDLE_TABLE
 {
-   LIST_ENTRY ListHead;
-} USER_HANDLE_TABLE, *PUSER_HANDLE_TABLE;
+   PUSER_HANDLE_ENTRY handles;
+   PUSER_HANDLE_ENTRY freelist;
+   int nb_handles;
+   int allocated_handles;
+} USER_HANDLE_TABLE, * PUSER_HANDLE_TABLE;
 
 
-ULONG FASTCALL
-ObmGetReferenceCount(
-  PVOID ObjectBody);
 
-ULONG FASTCALL
-ObmGetHandleCount(
-  PVOID ObjectBody);
+typedef enum _USER_OBJECT_TYPE
+{
+  otFree = 0,
+  otWindow,
+  otMenu,
+  otAccel,
+  otCursor,
+  otHook,
+  otMonitor,
+  otClass //fixme: remove
+  
+} USER_OBJECT_TYPE;
 
-VOID FASTCALL
-ObmReferenceObject(
-  PVOID ObjectBody);
 
-VOID FASTCALL
-ObmDereferenceObject(
-  PVOID ObjectBody);
+typedef struct _USER_OBJECT_HEADER
+/*
+ * Header for user object
+ */
+{
+//  USER_OBJECT_TYPE Type;
+  LONG RefCount;
+  BOOL destroyed;
+  HANDLE hSelf;
+//  CSHORT Size;
+} USER_OBJECT_HEADER, *PUSER_OBJECT_HEADER;
 
-NTSTATUS FASTCALL
-ObmReferenceObjectByPointer(
-  PVOID ObjectBody,
-  USER_OBJECT_TYPE ObjectType);
 
-PVOID FASTCALL
-ObmCreateObject(
-  PUSER_HANDLE_TABLE HandleTable,
-  PHANDLE Handle,
-	USER_OBJECT_TYPE ObjectType,
-  ULONG ObjectSize);
+typedef struct _USER_REFERENCE_ENTRY
+{
+   SINGLE_LIST_ENTRY Entry;
+   PVOID obj;
+} USER_REFERENCE_ENTRY, *PUSER_REFERENCE_ENTRY;
 
-NTSTATUS FASTCALL
-ObmCreateHandle(
-  PUSER_HANDLE_TABLE HandleTable,
-  PVOID ObjectBody,
-	PHANDLE HandleReturn);
 
-NTSTATUS FASTCALL
-ObmReferenceObjectByHandle(
-  PUSER_HANDLE_TABLE HandleTable,
-  HANDLE Handle,
-	USER_OBJECT_TYPE ObjectType,
-	PVOID* Object);
 
-NTSTATUS FASTCALL
-ObmCloseHandle(
-  PUSER_HANDLE_TABLE HandleTable,
-  HANDLE Handle);
+#include <malloc.h>
 
-VOID FASTCALL
-ObmInitializeHandleTable(
-  PUSER_HANDLE_TABLE HandleTable);
+#define ASSERT_LAST_REF(_obj_) \
+{ \
+   PW32THREAD t; \
+   PSINGLE_LIST_ENTRY e; \
+   PUSER_REFERENCE_ENTRY ref; \
+   \
+   ASSERT(_obj_); \
+   t = PsGetWin32Thread(); \
+   ASSERT(t); \
+   e = t->ReferencesList.Next; \
+   ASSERT(e); \
+   ref = CONTAINING_RECORD(e, USER_REFERENCE_ENTRY, Entry); \
+   ASSERT(ref); \
+   \
+   ASSERT(_obj_ == ref->obj); \
+   \
+}
+#define UserRefObjectCo(_obj_) \
+{ \
+   PW32THREAD t; \
+   PUSER_REFERENCE_ENTRY ref; \
+   \
+   ASSERT(_obj_); \
+   t = PsGetWin32Thread(); \
+   ASSERT(t); \
+   ref = (PUSER_REFERENCE_ENTRY)_alloca(sizeof(USER_REFERENCE_ENTRY)); \
+   ASSERT(ref); \
+   ref->obj = _obj_; \
+   ObmReferenceObject(_obj_); \
+ \
+   PushEntryList(&t->ReferencesList, &ref->Entry); \
+   \
+}
 
-VOID FASTCALL
-ObmFreeHandleTable(
-  PUSER_HANDLE_TABLE HandleTable);
 
-PUSER_HANDLE_TABLE FASTCALL
-ObmCreateHandleTable(VOID);
+#define UserDerefObjectCo(_obj_) \
+{ \
+   PW32THREAD t; \
+   PSINGLE_LIST_ENTRY e; \
+   PUSER_REFERENCE_ENTRY ref; \
+   \
+   ASSERT(_obj_); \
+   t = PsGetWin32Thread(); \
+   ASSERT(t); \
+   e = PopEntryList(&t->ReferencesList); \
+   ASSERT(e); \
+   ref = CONTAINING_RECORD(e, USER_REFERENCE_ENTRY, Entry); \
+   ASSERT(ref); \
+   \
+   ASSERT(_obj_ == ref->obj); \
+   ObmDereferenceObject(_obj_); \
+   \
+}
 
-VOID  FASTCALL ObmDestroyHandleTable (PUSER_HANDLE_TABLE HandleTable);
-
 VOID  INTERNAL_CALL InitGdiObjectHandleTable (VOID);
 
 VOID  FASTCALL CreateStockObjects (VOID);

Modified: trunk/reactos/subsys/win32k/include/userfuncs.h
--- trunk/reactos/subsys/win32k/include/userfuncs.h	2005-09-07 19:37:28 UTC (rev 17727)
+++ trunk/reactos/subsys/win32k/include/userfuncs.h	2005-09-07 20:59:26 UTC (rev 17728)
@@ -1,18 +1,52 @@
 #ifndef _WIN32K_USERFUNCS_H
 #define _WIN32K_USERFUNCS_H
 
-//currently unused
-#define ASSERT_REFS(obj) ASSERT(ObmGetReferenceCount(obj) >= 2)
 
-#define UserReferenceWindowObjectCo(o) IntReferenceWindowObject(o)
-#define UserDereferenceWindowObjectCo(o) IntReleaseWindowObject(o)
+#define ASSERT_REFS_CO(obj) \
+{ \
+   LONG ref = USER_BODY_TO_HEADER(obj)->RefCount;\
+   if (!(ref >= 1)){ \
+      DPRINT1("obj 0x%x, refs %i\n", obj, ref); \
+      ASSERT(FALSE); \
+   } \
+}
 
-#define UserReferenceAccelObjectCo(o) IntReferenceWindowObject(o)
-#define UserDereferenceAccelObjectCo(o) IntReleaseWindowObject(o)
+#define DUMP_REFS(obj) DPRINT1("obj 0x%x, refs %i\n",obj, USER_BODY_TO_HEADER(obj)->RefCount)
 
-extern PUSER_HANDLE_TABLE gHandleTable;
 
 
+
+VOID FASTCALL ObmReferenceObject(PVOID obj);
+BOOL FASTCALL ObmDereferenceObject(PVOID obj);
+
+#define IntReferenceWindowObject(o) ObmReferenceObject(o)
+
+VOID FASTCALL IntReleaseWindowObject(PWINDOW_OBJECT Window);
+PWINDOW_OBJECT FASTCALL IntGetWindowObject(HWND hWnd);
+PVOID FASTCALL
+ObmCreateObject(PUSER_HANDLE_TABLE ht, HANDLE* h,USER_OBJECT_TYPE type , ULONG size);
+
+BOOL FASTCALL 
+ObmDeleteObject(HANDLE h, USER_OBJECT_TYPE type );
+
+//#define UserRefObjectCo(o) ObmReferenceObject(o)
+//#define UserDerefObjectCo(o) ObmDereferenceObject(o)
+BOOL FASTCALL ObmCreateHandleTable();
+
+
+extern USER_HANDLE_TABLE gHandleTable;
+
+
+/******************** HANDLE.C ***************/
+
+
+PUSER_HANDLE_ENTRY handle_to_entry(PUSER_HANDLE_TABLE ht, HANDLE handle );
+VOID UserInitHandleTable(PUSER_HANDLE_TABLE ht, PVOID mem, ULONG bytes);
+HANDLE UserAllocHandle(PUSER_HANDLE_TABLE ht, PVOID object, USER_OBJECT_TYPE type );
+PVOID UserGetObject(PUSER_HANDLE_TABLE ht, HANDLE handle, USER_OBJECT_TYPE type );
+PVOID UserFreeHandle(PUSER_HANDLE_TABLE ht, HANDLE handle );
+PVOID UserGetNextHandle(PUSER_HANDLE_TABLE ht, HANDLE* handle, USER_OBJECT_TYPE type );
+
 /*************** WINSTA.C ***************/
 
 HWINSTA FASTCALL UserGetProcessWindowStation(VOID);
@@ -25,7 +59,7 @@
 /*************** WINPOS.C ***************/
 
 BOOL FASTCALL
-UserGetClientOrigin(HWND hWnd, LPPOINT Point);
+UserGetClientOrigin(PWINDOW_OBJECT Window, LPPOINT Point);
 
 /*************** FOCUS.C ***************/
 
@@ -81,7 +115,7 @@
 
 /*************** PAINTING.C ***************/
 
-BOOL FASTCALL UserValidateRgn(HWND hWnd, HRGN hRgn);
+BOOL FASTCALL co_UserValidateRgn(PWINDOW_OBJECT Window, HRGN hRgn);
 
 
 /*************** WINDOW.C ***************/

Modified: trunk/reactos/subsys/win32k/include/win32.h
--- trunk/reactos/subsys/win32k/include/win32.h	2005-09-07 19:37:28 UTC (rev 17727)
+++ trunk/reactos/subsys/win32k/include/win32.h	2005-09-07 20:59:26 UTC (rev 17728)
@@ -13,6 +13,8 @@
   HANDLE hDesktop;
   DWORD MessagePumpHookValue;
   BOOLEAN IsExiting;
+  SINGLE_LIST_ENTRY  ReferencesList;
+
 } W32THREAD, *PW32THREAD;
 
 #include <poppack.h>

Modified: trunk/reactos/subsys/win32k/include/window.h
--- trunk/reactos/subsys/win32k/include/window.h	2005-09-07 19:37:28 UTC (rev 17727)
+++ trunk/reactos/subsys/win32k/include/window.h	2005-09-07 20:59:26 UTC (rev 17728)
@@ -123,15 +123,7 @@
 #define IntIsBroadcastHwnd(hWnd) \
   (hWnd == HWND_BROADCAST || hWnd == HWND_TOPMOST)
 
-#define IntGetWindowObject(hWnd) \
-  IntGetProcessWindowObject(PsGetWin32Thread(), hWnd)
 
-#define IntReferenceWindowObject(WndObj) \
-  ObmReferenceObjectByPointer(WndObj, otWindow)
-
-#define IntReleaseWindowObject(WndObj) \
-  ObmDereferenceObject(WndObj)
-
 #define IntWndBelongsToThread(WndObj, W32Thread) \
   (((WndObj->OwnerThread && WndObj->OwnerThread->Tcb.Win32Thread)) && \
    (WndObj->OwnerThread->Tcb.Win32Thread == W32Thread))
@@ -143,9 +135,6 @@
   WndObj->OwnerThread->ThreadsProcess->UniqueProcessId
 
 
-PWINDOW_OBJECT FASTCALL
-IntGetProcessWindowObject(PW32THREAD Thread, HWND hWnd);
-
 BOOL FASTCALL
 IntIsWindow(HWND hWnd);
 

Modified: trunk/reactos/subsys/win32k/include/winpos.h
--- trunk/reactos/subsys/win32k/include/winpos.h	2005-09-07 19:37:28 UTC (rev 17727)
+++ trunk/reactos/subsys/win32k/include/winpos.h	2005-09-07 20:59:26 UTC (rev 17728)
@@ -17,7 +17,7 @@
 UINT
 FASTCALL co_WinPosArrangeIconicWindows(PWINDOW_OBJECT parent);
 BOOL FASTCALL
-IntGetClientOrigin(HWND hWnd, LPPOINT Point);
+IntGetClientOrigin(PWINDOW_OBJECT Window, LPPOINT Point);
 LRESULT FASTCALL
 co_WinPosGetNonClientSize(HWND Wnd, RECT* WindowRect, RECT* ClientRect);
 UINT FASTCALL
@@ -26,7 +26,7 @@
 UINT FASTCALL
 co_WinPosMinMaximize(PWINDOW_OBJECT WindowObject, UINT ShowFlag, RECT* NewPos);
 BOOLEAN FASTCALL
-co_WinPosSetWindowPos(HWND Wnd, HWND WndInsertAfter, INT x, INT y, INT cx,
+co_WinPosSetWindowPos(PWINDOW_OBJECT Wnd, HWND WndInsertAfter, INT x, INT y, INT cx,
 		   INT cy, UINT flags);
 BOOLEAN FASTCALL
 co_WinPosShowWindow(PWINDOW_OBJECT Window, INT Cmd);

Modified: trunk/reactos/subsys/win32k/main/dllmain.c
--- trunk/reactos/subsys/win32k/main/dllmain.c	2005-09-07 19:37:28 UTC (rev 17727)
+++ trunk/reactos/subsys/win32k/main/dllmain.c	2005-09-07 20:59:26 UTC (rev 17728)
@@ -219,11 +219,14 @@
     }
   else
     {
+      PSINGLE_LIST_ENTRY e;
+      
       DPRINT("Destroying W32 thread TID:%d at IRQ level: %lu\n", Thread->Cid.UniqueThread, KeGetCurrentIrql());
 
       Win32Thread->IsExiting = TRUE;
       HOOK_DestroyThreadHooks(Thread);
       UnregisterThreadHotKeys(Thread);
+      /* what if this co_ func crash in umode? what will clean us up then? */
       co_DestroyThreadWindows(Thread);
       IntBlockInput(Win32Thread, FALSE);
       MsqDestroyMessageQueue(Win32Thread->MessageQueue);
@@ -232,6 +235,17 @@
       {
         ObDereferenceObject(Win32Thread->Desktop);
       }
+      
+      /* cleanup user object references stack */
+      e = PopEntryList(&Win32Thread->ReferencesList);
+      while (e)
+      {
+         PUSER_REFERENCE_ENTRY ref = CONTAINING_RECORD(e, USER_REFERENCE_ENTRY, Entry);
+         DPRINT1("thread clean: remove reference obj 0x%x\n",ref->obj);
+         ObmDereferenceObject(ref->obj);
+         
+         e = PopEntryList(&Win32Thread->ReferencesList);
+      }
     }
 
   RETURN( STATUS_SUCCESS);

Modified: trunk/reactos/subsys/win32k/ntuser/accelerator.c
--- trunk/reactos/subsys/win32k/ntuser/accelerator.c	2005-09-07 19:37:28 UTC (rev 17727)
+++ trunk/reactos/subsys/win32k/ntuser/accelerator.c	2005-09-07 20:59:26 UTC (rev 17728)
@@ -70,21 +70,19 @@
 
 
 static
-PACCELERATOR_TABLE FASTCALL UserGetAccelObjectNoRef(HACCEL hAccel)
+PACCELERATOR_TABLE FASTCALL UserGetAccelObject(HACCEL hAccel)
 {
-   PACCELERATOR_TABLE Accel=NULL;
-   NTSTATUS Status = ObmReferenceObjectByHandle(gHandleTable,
-    hAccel,
-    otAcceleratorTable,
-    (PVOID*)&Accel);
-    
-  if (!NT_SUCCESS(Status))
-  {
-    SetLastWin32Error(ERROR_INVALID_ACCEL_HANDLE);
-    return NULL;
-  }
+   PACCELERATOR_TABLE Accel= UserGetObject(&gHandleTable, hAccel,  otAccel);
    
-   ObmDereferenceObject(Accel);
+   if (Accel)
+   {
+      ASSERT(USER_BODY_TO_HEADER(Accel)->RefCount >= 0);
+   }
+   else
+   {
+      SetLastWin32Error(ERROR_INVALID_ACCEL_HANDLE);
+   }
+
    return Accel;
 }
 
@@ -118,7 +116,7 @@
     RETURN(0);
   }
 
-  if (!(Accel = UserGetAccelObjectNoRef(hAccel)))
+  if (!(Accel = UserGetAccelObject(hAccel)))
   {
     ObDereferenceObject(WindowStation);
     RETURN(0);
@@ -177,11 +175,7 @@
     RETURN( FALSE );
   }
 
-  Accel = ObmCreateObject(
-    gHandleTable,
-    (PHANDLE)&hAccel,
-    otAcceleratorTable,
-	sizeof(ACCELERATOR_TABLE));
+  Accel = ObmCreateObject(&gHandleTable, (PHANDLE)&hAccel, otAccel, sizeof(ACCELERATOR_TABLE));
    
   if (Accel == NULL)
   {
@@ -196,7 +190,7 @@
 	Accel->Table = ExAllocatePoolWithTag(PagedPool, EntriesCount * sizeof(ACCEL), TAG_ACCEL);
 	if (Accel->Table == NULL)
 	{
-      ObmCloseHandle(gHandleTable, hAccel);
+      ObmDeleteObject(hAccel, otAccel);
 		ObDereferenceObject(WindowStation);
 		SetLastNtError(Status);
       RETURN( (HACCEL) 0);
@@ -206,7 +200,7 @@
     if (!NT_SUCCESS(Status))
     {
 	  ExFreePool(Accel->Table);
-     ObmCloseHandle(gHandleTable, hAccel);
+     ObmDeleteObject(hAccel, otAccel);
       ObDereferenceObject(WindowStation);
       SetLastNtError(Status);
       RETURN((HACCEL) 0);
@@ -258,13 +252,13 @@
     RETURN( FALSE);
   }
 
-  if (!(Accel = UserGetAccelObjectNoRef(hAccel)))
+  if (!(Accel = UserGetAccelObject(hAccel)))
   {
     ObDereferenceObject(WindowStation);
     RETURN( FALSE);
   }
 
-  ObmCloseHandle(gHandleTable, hAccel);
+  ObmDeleteObject(hAccel, otAccel);
 
   if (Accel->Table != NULL)
   {
@@ -294,7 +288,7 @@
 {
   UINT mesg = 0;
 
-  ASSERT_REFS(Window); 
+  ASSERT_REFS_CO(Window); 
 
   DPRINT("IntTranslateAccelerator(hwnd %x, message %x, wParam %x, lParam %x, fVirt %d, key %x, cmd %x)\n",
     Window->hSelf, message, wParam, lParam, fVirt, key, cmd);
@@ -509,19 +503,19 @@
     RETURN( 0);
   }
 
-  if (!(Accel = UserGetAccelObjectNoRef(hAccel)))
+  if (!(Accel = UserGetAccelObject(hAccel)))
   {
     RETURN( 0);
   }
 
-  UserReferenceAccelObjectCo(Accel); 
+  UserRefObjectCo(Accel); 
 
   if (!(Window = UserGetWindowObject(hWnd)))
   {
     RETURN( 0);
   }
 
-  UserReferenceWindowObjectCo(Window); 
+  UserRefObjectCo(Window); 
   
 
   /* FIXME: Associate AcceleratorTable with the current thread */
@@ -546,8 +540,8 @@
   
 CLEANUP:
   
-  if (Window) UserReferenceWindowObjectCo(Window); 
-  if (Accel) UserReferenceAccelObjectCo(Accel); 
+  if (Window) UserDerefObjectCo(Window); 
+  if (Accel) UserDerefObjectCo(Accel); 
 
   if (WindowStation) ObDereferenceObject(WindowStation);
 

Modified: trunk/reactos/subsys/win32k/ntuser/class.c
--- trunk/reactos/subsys/win32k/ntuser/class.c	2005-09-07 19:37:28 UTC (rev 17727)
+++ trunk/reactos/subsys/win32k/ntuser/class.c	2005-09-07 20:59:26 UTC (rev 17728)
@@ -299,7 +299,7 @@
 	}
 
 	objectSize = sizeof(WNDCLASS_OBJECT) + lpwcx->cbClsExtra;
-	ClassObject = ObmCreateObject(NULL, NULL, otClass, objectSize);
+	ClassObject = ObmCreateObject(&gHandleTable, NULL, otClass, objectSize);
 	if (ClassObject == 0)
 	{
 		SetLastWin32Error(ERROR_NOT_ENOUGH_MEMORY);
@@ -538,22 +538,18 @@
 NtUserGetClassLong(HWND hWnd, DWORD Offset, BOOL Ansi)
 {
   PWINDOW_OBJECT Window;
-  LONG Ret;
   DECLARE_RETURN(DWORD);
 
   DPRINT("Enter NtUserGetClassLong\n");
   UserEnterExclusive();
 
-  Window = IntGetWindowObject(hWnd);
-  if (Window == NULL)
+  if (!(Window = UserGetWindowObject(hWnd)))
   {
-    SetLastWin32Error(ERROR_INVALID_WINDOW_HANDLE);
     RETURN(0);
   }
-  Ret = IntGetClassLong(Window, Offset, Ansi);
-  IntReleaseWindowObject(Window);
-  RETURN(Ret);
   
+  RETURN(IntGetClassLong(Window, Offset, Ansi));
+  
 CLEANUP:
   DPRINT("Leave NtUserGetClassLong, ret=%i\n",_ret_);
   UserLeave();
@@ -565,6 +561,8 @@
 {
   PWINDOW_OBJECT Parent, Owner;
 
+  ASSERT_REFS_CO(Window); 
+
   if ((int)Offset >= 0)
     {
       DPRINT("SetClassLong(%x, %d, %x)\n", Window->hSelf, Offset, dwNewLong);
@@ -669,14 +667,18 @@
   DPRINT("Enter NtUserSetClassLong\n");
   UserEnterExclusive();
 
-  if (!(Window = IntGetWindowObject(hWnd)))
+  if (!(Window = UserGetWindowObject(hWnd)))
   {
-    SetLastWin32Error(ERROR_INVALID_WINDOW_HANDLE);
     RETURN(0);
   }
+  
+  UserRefObjectCo(Window);
+  
   Ret = IntGetClassLong(Window, Offset, Ansi);
   co_IntSetClassLong(Window, Offset, dwNewLong, Ansi);
-  IntReleaseWindowObject(Window);
+  
+  UserDerefObjectCo(Window);
+  
   RETURN(Ret);
   
 CLEANUP:

Modified: trunk/reactos/subsys/win32k/ntuser/cursoricon.c
--- trunk/reactos/subsys/win32k/ntuser/cursoricon.c	2005-09-07 19:37:28 UTC (rev 17727)
+++ trunk/reactos/subsys/win32k/ntuser/cursoricon.c	2005-09-07 20:59:26 UTC (rev 17728)
@@ -71,21 +71,36 @@
   return TRUE;
 }
 
-PCURICON_OBJECT FASTCALL
-IntGetCurIconObject(PWINSTATION_OBJECT WinStaObject, HANDLE Handle)
+
+
+
+/* temp hack */
+PCURICON_OBJECT FASTCALL UserGetCurIconObject(HANDLE hWnd)
 {
-   PCURICON_OBJECT Object;
-   NTSTATUS Status;
-
-   Status = ObmReferenceObjectByHandle(gHandleTable,
-      Handle, otCursorIcon, (PVOID*)&Object);
-   if (!NT_SUCCESS(Status))
+   PCURICON_OBJECT Window = (PCURICON_OBJECT)UserGetObject(&gHandleTable, hWnd, otCursor);
+   if (!Window)
    {
+      SetLastWin32Error(ERROR_INVALID_CURSOR_HANDLE);
       return NULL;
    }
-   return Object;
+   
+   ASSERT(USER_BODY_TO_HEADER(Window)->RefCount >= 0);
+   return Window;
 }
 
+PCURICON_OBJECT FASTCALL
+IntGetCurIconObject(HANDLE Handle)
+{
+   PCURICON_OBJECT ci = UserGetCurIconObject(Handle);
+   if (ci)
+   {
+      ASSERT(USER_BODY_TO_HEADER(ci)->RefCount >= 0);
+      
+      USER_BODY_TO_HEADER(ci)->RefCount++;
+   }
+   return ci;
+}
+
 #define COLORCURSORS_ALLOWED FALSE
 HCURSOR FASTCALL
 IntSetCursor(PWINSTATION_OBJECT WinStaObject, PCURICON_OBJECT NewCursor,
@@ -362,7 +377,9 @@
   {
     Object = CONTAINING_RECORD(CurrentEntry, CURICON_OBJECT, ListEntry);
     CurrentEntry = CurrentEntry->Flink;
-    if(NT_SUCCESS(ObmReferenceObjectByPointer(Object, otCursorIcon)))
+
+//    if(NT_SUCCESS(ObmReferenceObjectByPointer(Object, otCursorIcon))) //<- huh????
+    ObmReferenceObject(  Object);
     {
       if((Object->hModule == hModule) && (Object->hRsrc == hRsrc))
       {
@@ -380,6 +397,7 @@
       }
     }
     ObmDereferenceObject(Object);
+
   }
 
   return NULL;
@@ -391,7 +409,7 @@
   PCURICON_OBJECT Object;
   HANDLE Handle;
 
-  Object = ObmCreateObject(gHandleTable, &Handle, otCursorIcon, sizeof(CURICON_OBJECT));
+  Object = ObmCreateObject(&gHandleTable, &Handle, otCursor, sizeof(CURICON_OBJECT));
 
   if(!Object)
   {
@@ -405,7 +423,7 @@
   if (! ReferenceCurIconByProcess(Object))
   {
     DPRINT1("Failed to add process\n");
-    ObmCloseHandle(gHandleTable, Handle);
+    ObmDeleteObject(Handle, otCursor);
     ObmDereferenceObject(Object);
     return NULL;
   }
@@ -483,7 +501,7 @@
   bmpMask = Object->IconInfo.hbmMask;
   bmpColor = Object->IconInfo.hbmColor;
 
-  Ret = NT_SUCCESS(ObmCloseHandle(gHandleTable, Object->Self));
+  Ret = ObmDeleteObject(Object->Self, otCursor);
 
   /* delete bitmaps */
   if(bmpMask)
@@ -520,7 +538,10 @@
   {
     Object = CONTAINING_RECORD(CurrentEntry, CURICON_OBJECT, ListEntry);
     CurrentEntry = CurrentEntry->Flink;
-    if(NT_SUCCESS(ObmReferenceObjectByPointer(Object, otCursorIcon)))
+
+
+      ObmReferenceObject(Object);
+//    if(NT_SUCCESS(ObmReferenceObjectByPointer(Object, otCursorIcon)))
       {
       ProcessEntry = Object->ProcessList.Flink;
       while (ProcessEntry != &Object->ProcessList)
@@ -537,6 +558,8 @@
 
       ObmDereferenceObject(Object);
     }
+
+
   }
 
   ObDereferenceObject(WinStaObject);
@@ -646,7 +669,7 @@
     RETURN( FALSE);
   }
 
-  CurIconObject = IntGetCurIconObject(WinStaObject, Handle);
+  CurIconObject = IntGetCurIconObject(Handle);
   if(CurIconObject)
   {
     if(IconInfo)
@@ -712,7 +735,7 @@
     RETURN( FALSE);
   }
 
-  CurIconObject = IntGetCurIconObject(WinStaObject, Handle);
+  CurIconObject = IntGetCurIconObject(Handle);
   if(CurIconObject)
   {
     /* Copy fields */
@@ -929,7 +952,6 @@
 {
   PWINSTATION_OBJECT WinStaObject;
   PCURICON_OBJECT Object;
-  NTSTATUS Status;
   DECLARE_RETURN(BOOL);
 
   DPRINT("Enter NtUserDestroyCursorIcon\n");
@@ -941,13 +963,18 @@
     RETURN( FALSE);
   }
 
-  Status = ObmReferenceObjectByHandle(gHandleTable, Handle, otCursorIcon, (PVOID*)&Object);
-  if(!NT_SUCCESS(Status))
+  if (!(Object = IntGetCurIconObject(Handle)))
   {
-    ObDereferenceObject(WinStaObject);
-    SetLastNtError(Status);
-    RETURN( FALSE);
+     ObDereferenceObject(WinStaObject);
+     RETURN(FALSE); 
   }
+//  Status = ObmReferenceObjectByHandle(gHandleTable, Handle, otCursorIcon, (PVOID*)&Object);
+//  if(!NT_SUCCESS(Status))
+//  {
+//    ObDereferenceObject(WinStaObject);
+//    SetLastNtError(Status);
+//    RETURN( FALSE);
+//  }
 
   if(IntDestroyCurIconObject(WinStaObject, Object, FALSE))
   {
@@ -1098,7 +1125,7 @@
     RETURN( (HCURSOR)0);
   }
 
-  CurIconObject = IntGetCurIconObject(WinStaObject, hCursor);
+  CurIconObject = IntGetCurIconObject(hCursor);
   if(CurIconObject)
   {
     OldCursor = IntSetCursor(WinStaObject, CurIconObject, FALSE);
@@ -1142,7 +1169,7 @@
     RETURN( FALSE);
   }
 
-  CurIconObject = IntGetCurIconObject(WinStaObject, Handle);
+  CurIconObject = IntGetCurIconObject(Handle);
   if(CurIconObject)
   {
     /* Copy fields */
@@ -1222,7 +1249,7 @@
     RETURN( FALSE);
   }
 
-  CurIconObject = IntGetCurIconObject(WinStaObject, Handle);
+  CurIconObject = IntGetCurIconObject(Handle);
   if(CurIconObject)
   {
     CurIconObject->hModule = hModule;
@@ -1338,7 +1365,7 @@
     RETURN( FALSE);
   }
 
-  CurIconObject = IntGetCurIconObject(WinStaObject, hIcon);
+  CurIconObject = IntGetCurIconObject(hIcon);
   if(CurIconObject)
   {
     hbmMask = CurIconObject->IconInfo.hbmMask;

Modified: trunk/reactos/subsys/win32k/ntuser/focus.c
--- trunk/reactos/subsys/win32k/ntuser/focus.c	2005-09-07 19:37:28 UTC (rev 17727)
+++ trunk/reactos/subsys/win32k/ntuser/focus.c	2005-09-07 20:59:26 UTC (rev 17728)
@@ -63,7 +63,7 @@
 {
    PWINDOW_OBJECT Window, Owner, Parent;
 
-   if (hWnd)
+   if (hWnd && (Window = IntGetWindowObject(hWnd)))
    {
       /* Send palette messages */
       if (co_IntPostOrSendMessage(hWnd, WM_QUERYNEWPALETTE, 0, 0))
@@ -73,25 +73,26 @@
       }
 
       if (UserGetWindow(hWnd, GW_HWNDPREV) != NULL)
-         co_WinPosSetWindowPos(hWnd, HWND_TOP, 0, 0, 0, 0,
+         co_WinPosSetWindowPos(Window, HWND_TOP, 0, 0, 0, 0,
             SWP_NOSIZE | SWP_NOMOVE | SWP_NOACTIVATE | SWP_NOSENDCHANGING);
 
-      Window = IntGetWindowObject(hWnd);
-      if (Window) {
-        Owner = IntGetOwner(Window);
-        if (!Owner) {
-          Parent = IntGetParent(Window);
-          if (!Parent)
+      
+      Owner = IntGetOwner(Window);
+      if (!Owner) 
+      {
+         Parent = IntGetParent(Window);
+         if (!Parent)
             co_IntShellHookNotify(HSHELL_WINDOWACTIVATED, (LPARAM) hWnd);
-          else
+         else
             IntReleaseWindowObject(Parent);
-        } else {
-          IntReleaseWindowObject(Owner);
-        }
-
-        IntReleaseWindowObject(Window);
+      } 
+      else 
+      {
+         IntReleaseWindowObject(Owner);
       }
 
+      IntReleaseWindowObject(Window);
+
       /* FIXME: IntIsWindow */
 
       co_IntPostOrSendMessage(hWnd, WM_NCACTIVATE, (WPARAM)(hWnd == UserGetForegroundWindow()), 0);
@@ -154,6 +155,8 @@
    HWND hWndFocusPrev = NULL;
    PUSER_MESSAGE_QUEUE PrevForegroundQueue;
 
+   ASSERT_REFS_CO(Window);
+
    DPRINT("IntSetForegroundAndFocusWindow(%x, %x, %s)\n", hWnd, hWndFocus, MouseActivate ? "TRUE" : "FALSE");
    DPRINT("(%wZ)\n", &Window->WindowName);
 
@@ -214,6 +217,8 @@
 BOOL FASTCALL
 co_IntSetForegroundWindow(PWINDOW_OBJECT Window)
 {
+   ASSERT_REFS_CO(Window);
+   
    return co_IntSetForegroundAndFocusWindow(Window, Window, FALSE);
 }
 
@@ -223,6 +228,8 @@
   HWND Top;
   PWINDOW_OBJECT TopWindow;
 
+  ASSERT_REFS_CO(Window);
+
   if(Window->Style & WS_DISABLED)
   {
     BOOL Ret;
@@ -269,12 +276,14 @@
 }
 
 HWND FASTCALL
-co_IntSetActiveWindow(PWINDOW_OBJECT Window)
+co_IntSetActiveWindow(PWINDOW_OBJECT Window OPTIONAL)
 {
    PUSER_MESSAGE_QUEUE ThreadQueue;
    HWND hWndPrev;
    HWND hWnd = 0;
 
+   if (Window) ASSERT_REFS_CO(Window);
+
    ThreadQueue = (PUSER_MESSAGE_QUEUE)PsGetWin32Thread()->MessageQueue;
    ASSERT(ThreadQueue != 0);
 
@@ -404,10 +413,8 @@
       PUSER_MESSAGE_QUEUE ThreadQueue;
       HWND hWndPrev;
 
-      Window = IntGetWindowObject(hWnd);
-      if (Window == NULL)
+      if (!(Window = UserGetWindowObject(hWnd)))
       {
-         SetLastWin32Error(ERROR_INVALID_WINDOW_HANDLE);
          RETURN( 0);
       }
 
@@ -417,13 +424,13 @@
 
       if (Window->MessageQueue != ThreadQueue)
       {
-         IntReleaseWindowObject(Window);
          SetLastWin32Error(ERROR_INVALID_WINDOW_HANDLE);
          RETURN( 0);
       }
 
[truncated at 1000 lines; 2443 more skipped]