[jimtabor] 72837: [Win32SS] - Fix menu crash, marking the menu object destroyed if the access count is more than one. Must remember these are not GDI objects. Expect a retooling of user objects soo...

Author: jimtabor
Date: Wed Sep 28 16:51:53 2016
New Revision: 72837

URL: http://svn.reactos.org/svn/reactos?rev=72837&view=rev
Log:
[Win32SS]
- Fix menu crash, marking the menu object destroyed if the access count is more than one. Must remember these are not GDI objects. Expect a retooling of user objects soon. Set CORE-11892.

Modified:
    trunk/reactos/win32ss/include/ntuser.h
    trunk/reactos/win32ss/user/ntuser/menu.c
    trunk/reactos/win32ss/user/ntuser/object.c
    trunk/reactos/win32ss/user/ntuser/object.h
    trunk/reactos/win32ss/user/ntuser/window.c
    trunk/reactos/win32ss/user/user32/misc/misc.c

Modified: trunk/reactos/win32ss/include/ntuser.h
URL: http://svn.reactos.org/svn/reactos/trunk/reactos/win32ss/include/ntuser.h?re...
==============================================================================
--- trunk/reactos/win32ss/include/ntuser.h	[iso-8859-1] (original)
+++ trunk/reactos/win32ss/include/ntuser.h	[iso-8859-1] Wed Sep 28 16:51:53 2016
@@ -13,7 +13,8 @@
 #define FIRST_USER_HANDLE 0x0020 /* first possible value for low word of user handle */
 #define LAST_USER_HANDLE 0xffef /* last possible value for low word of user handle */

-#define HANDLEENTRY_INDESTROY 1
+#define HANDLEENTRY_DESTROY 1
+#define HANDLEENTRY_INDESTROY 2

typedef struct _USER_HANDLE_ENTRY
 {

Modified: trunk/reactos/win32ss/user/ntuser/menu.c
URL: http://svn.reactos.org/svn/reactos/trunk/reactos/win32ss/user/ntuser/menu.c?...
==============================================================================
--- trunk/reactos/win32ss/user/ntuser/menu.c	[iso-8859-1] (original)
+++ trunk/reactos/win32ss/user/ntuser/menu.c	[iso-8859-1] Wed Sep 28 16:51:53 2016
@@ -322,13 +322,9 @@
 BOOL FASTCALL
 IntDestroyMenuObject(PMENU Menu, BOOL bRecurse)
 {
-   if(Menu)
+   if (Menu)
    {
       PWND Window;
-      ULONG Error;
-
-      /* Remove all menu items */
-      IntDestroyMenu( Menu, bRecurse);

if (PsGetCurrentProcessSessionId() == Menu->head.rpdesk->rpwinstaParent->dwSessionId)
       {
@@ -350,22 +346,14 @@
                }
             }
          }
-         if (UserObjectInDestroy(Menu->head.h))
-         {
-            WARN("Menu already dead!\n");
-            return FALSE;
-         }
+
+         if (!UserMarkObjectDestroy(Menu)) return TRUE;
+
+         /* Remove all menu items */
+         IntDestroyMenu( Menu, bRecurse);
+
          ret = UserDeleteObject(Menu->head.h, TYPE_MENU);
-         if (!ret)
-         {  // Make sure it is really dead or just marked for deletion.
-            Error = EngGetLastError();
-            ret = UserObjectInDestroy(Menu->head.h);
-            if (ret && EngGetLastError() == ERROR_INVALID_HANDLE)
-            {
-               EngSetLastError(Error);
-               ret = FALSE;
-            }
-         }  // See test_subpopup_locked_by_menu tests....
+         TRACE("IntDestroyMenuObject %d\n",ret);
          return ret;
       }
    }

Modified: trunk/reactos/win32ss/user/ntuser/object.c
URL: http://svn.reactos.org/svn/reactos/trunk/reactos/win32ss/user/ntuser/object....
==============================================================================
--- trunk/reactos/win32ss/user/ntuser/object.c	[iso-8859-1] (original)
+++ trunk/reactos/win32ss/user/ntuser/object.c	[iso-8859-1] Wed Sep 28 16:51:53 2016
@@ -582,6 +582,28 @@
    return Object;
 }

+BOOL
+FASTCALL
+UserMarkObjectDestroy(PVOID Object)
+{
+    PUSER_HANDLE_ENTRY entry;
+    PHEAD ObjHead = Object;
+
+    entry = handle_to_entry(gHandleTable, ObjHead->h);
+
+    ASSERT(entry != NULL);
+
+    entry->flags |= HANDLEENTRY_DESTROY;
+
+    if (ObjHead->cLockObj > 1)
+    {
+        entry->flags &= ~HANDLEENTRY_INDESTROY;
+        TRACE("Count %d\n",ObjHead->cLockObj);
+        return FALSE;
+    }
+
+    return TRUE;
+}

BOOL
 FASTCALL

Modified: trunk/reactos/win32ss/user/ntuser/object.h
URL: http://svn.reactos.org/svn/reactos/trunk/reactos/win32ss/user/ntuser/object....
==============================================================================
--- trunk/reactos/win32ss/user/ntuser/object.h	[iso-8859-1] (original)
+++ trunk/reactos/win32ss/user/ntuser/object.h	[iso-8859-1] Wed Sep 28 16:51:53 2016
@@ -19,6 +19,7 @@
 void DbgUserDumpHandleTable();
 PVOID FASTCALL ValidateHandle(HANDLE handle, HANDLE_TYPE type);
 BOOLEAN UserDestroyObjectsForOwner(PUSER_HANDLE_TABLE Table, PVOID Owner);
+BOOL FASTCALL UserMarkObjectDestroy(PVOID);

static __inline VOID
 UserRefObjectCo(PVOID obj, PUSER_REFERENCE_ENTRY UserReferenceEntry)

Modified: trunk/reactos/win32ss/user/ntuser/window.c
URL: http://svn.reactos.org/svn/reactos/trunk/reactos/win32ss/user/ntuser/window....
==============================================================================
--- trunk/reactos/win32ss/user/ntuser/window.c	[iso-8859-1] (original)
+++ trunk/reactos/win32ss/user/ntuser/window.c	[iso-8859-1] Wed Sep 28 16:51:53 2016
@@ -641,7 +641,7 @@
    }

UserReferenceObject(Window);
-   UserDeleteObject(UserHMGetHandle(Window), TYPE_WINDOW);
+   UserMarkObjectDestroy(Window);

IntDestroyScrollBars(Window);

@@ -670,6 +670,7 @@
    UserFreeWindowInfo(Window->head.pti, Window);

UserDereferenceObject(Window);
+   UserDeleteObject(UserHMGetHandle(Window), TYPE_WINDOW);

return 0;
 }

Modified: trunk/reactos/win32ss/user/user32/misc/misc.c
URL: http://svn.reactos.org/svn/reactos/trunk/reactos/win32ss/user/user32/misc/mi...
==============================================================================
--- trunk/reactos/win32ss/user/user32/misc/misc.c	[iso-8859-1] (original)
+++ trunk/reactos/win32ss/user/user32/misc/misc.c	[iso-8859-1] Wed Sep 28 16:51:53 2016
@@ -283,7 +283,7 @@
   if ( (!pEntry) ||
         (pEntry->type != uType) ||
         !pEntry->ptr ||
-        (pEntry->flags & HANDLEENTRY_INDESTROY) )
+        (pEntry->flags & HANDLEENTRY_DESTROY) || (pEntry->flags & HANDLEENTRY_INDESTROY) )
   {
      switch ( uType )
      {  // Test (with wine too) confirms these results!