- Rename GDIOBJ_AllocObj to GDIOBJ_allocObjWithHandle and make it return a pointer to a locked object.c

- Implement GDIOBJ_AllocObjDepricated as a wrapper for those functions that currently still need the old way of allocation. Will be gone soon
- Implement GDIOBJ_AllocObj that only allocates a memory object without a handle
- Rename GDIOBJ_FreeObject to GDIOBJ_FreeObjByHandle
- Implement GDIOBJ_FreeObj that only frees the memory object
- Rename all XXX_Alloc and XXX_Free functions accordingly
- Fix NtGdiCreateClientObject and NtGdiDeleteClientObject
- Reformat TextIntCreateFontIndirect
- NtGdiHfontCreate: reformat and MmCopyFromCaller -> SEH

svn path=/trunk/; revision=32721

reactos/subsystems/win32/win32k/eng/palette.c

@@ -82,7 +82,7 @@ EngDeletePalette(IN HPALETTE Palette)
 {
    GDIOBJ_SetOwnership(Palette, PsGetCurrentProcess());
 
-   return PALETTE_FreePalette(Palette);
+   return PALETTE_FreePaletteByHandle(Palette);
 }
 
 /*

reactos/subsystems/win32/win32k/eng/surface.c

@@ -264,7 +264,7 @@ IntCreateBitmap(IN SIZEL Size,
   if (Format == 0)
 	return 0;
 
-  NewBitmap = BITMAPOBJ_AllocBitmap();
+  NewBitmap = BITMAPOBJ_AllocBitmapDepricated();
   if (NewBitmap == NULL)
 	return 0;
 
@@ -272,7 +272,7 @@ IntCreateBitmap(IN SIZEL Size,
   if (! BITMAPOBJ_InitBitsLock(BitmapObj))
     {
       BITMAPOBJ_UnlockBitmap(BitmapObj);
-      BITMAPOBJ_FreeBitmap(NewBitmap);
+      BITMAPOBJ_FreeBitmapByHandle(NewBitmap);
       return 0;
     }
   SurfObj = &BitmapObj->SurfObj;
@@ -325,7 +325,7 @@ IntCreateBitmap(IN SIZEL Size,
           if (SurfObj->pvBits == NULL)
             {
               BITMAPOBJ_UnlockBitmap(BitmapObj);
-              BITMAPOBJ_FreeBitmap(NewBitmap);
+              BITMAPOBJ_FreeBitmapByHandle(NewBitmap);
               return 0;
             }
         }
@@ -396,7 +396,7 @@ EngCreateDeviceSurface(IN DHSURF dhsurf,
   SURFOBJ *SurfObj;
   BITMAPOBJ *BitmapObj;
 
-  NewSurface = (HSURF)BITMAPOBJ_AllocBitmap();
+  NewSurface = (HSURF)BITMAPOBJ_AllocBitmapDepricated();
   if (NewSurface == NULL)
 	return 0;
 
@@ -406,7 +406,7 @@ EngCreateDeviceSurface(IN DHSURF dhsurf,
   if (! BITMAPOBJ_InitBitsLock(BitmapObj))
     {
       BITMAPOBJ_UnlockBitmap(BitmapObj);
-      BITMAPOBJ_FreeBitmap(NewSurface);
+      BITMAPOBJ_FreeBitmapByHandle(NewSurface);
       return 0;
     }
   SurfObj = &BitmapObj->SurfObj;
@@ -513,7 +513,7 @@ BOOL STDCALL
 EngDeleteSurface(IN HSURF Surface)
 {
    GDIOBJ_SetOwnership(Surface, PsGetCurrentProcess());
-   BITMAPOBJ_FreeBitmap(Surface);
+   BITMAPOBJ_FreeBitmapByHandle(Surface);
    return TRUE;
 }
 

reactos/subsystems/win32/win32k/include/bitmaps.h

@@ -26,10 +26,12 @@ typedef struct _BITMAPOBJ
 
 /*  Internal interface  */
 
-#define  BITMAPOBJ_AllocBitmap()  \
+#define  BITMAPOBJ_AllocBitmap()    ((PBITMAPOBJ) GDIOBJ_AllocObj(GDIObjType_SURF_TYPE))
-  ((HBITMAP) GDIOBJ_AllocObj (GDI_OBJECT_TYPE_BITMAP))
+#define  BITMAPOBJ_AllocBitmapWithHandle()    ((PBITMAPOBJ) GDIOBJ_AllocObjWithHandle(GDI_OBJECT_TYPE_BITMAP))
-#define  BITMAPOBJ_FreeBitmap(hBMObj)  \
+#define  BITMAPOBJ_AllocBitmapDepricated()    ((HBITMAP) GDIOBJ_AllocObjDepricated(GDI_OBJECT_TYPE_BITMAP))
-  GDIOBJ_FreeObj((HGDIOBJ) hBMObj, GDI_OBJECT_TYPE_BITMAP)
+#define  BITMAPOBJ_FreeBitmap(pBMObj) GDIOBJ_FreeObj((POBJ) pBMObj, GDIObjType_SURF_TYPE)
+#define  BITMAPOBJ_FreeBitmapByHandle(hBMObj) GDIOBJ_FreeObjByHandle((HGDIOBJ) hBMObj, GDI_OBJECT_TYPE_BITMAP)
+
 /* NOTE: Use shared locks! */
 #define  BITMAPOBJ_LockBitmap(hBMObj) \
   ((PBITMAPOBJ) GDIOBJ_ShareLockObj ((HGDIOBJ) hBMObj, GDI_OBJECT_TYPE_BITMAP))

reactos/subsystems/win32/win32k/include/brush.h

@@ -72,8 +72,11 @@ typedef struct
 #define GDIBRUSH_IS_MASKING		0x8000 /* Pattern bitmap is used as transparent mask (?) */
 #define GDIBRUSH_CACHED_IS_SOLID	0x80000000
 
-#define  BRUSHOBJ_AllocBrush() ((HBRUSH) GDIOBJ_AllocObj (GDI_OBJECT_TYPE_BRUSH))
+#define  BRUSHOBJ_AllocBrush() ((PGDIBRUSHOBJ) GDIOBJ_AllocObj(GDIObjType_BRUSH_TYPE))
-#define  BRUSHOBJ_FreeBrush(hBrush) GDIOBJ_FreeObj((HGDIOBJ)hBrush, GDI_OBJECT_TYPE_BRUSH)
+#define  BRUSHOBJ_AllocBrushWithHandle() ((PGDIBRUSHOBJ) GDIOBJ_AllocObjWithHandle (GDI_OBJECT_TYPE_BRUSH))
+#define  BRUSHOBJ_AllocBrushDepricated() ((HBRUSH) GDIOBJ_AllocObjDepricated (GDI_OBJECT_TYPE_BRUSH))
+#define  BRUSHOBJ_FreeBrush(pBrush) GDIOBJ_FreeObj((POBJ)pBrush, GDIObjType_BRUSH_TYPE)
+#define  BRUSHOBJ_FreeBrushByHandle(hBrush) GDIOBJ_FreeObjByHandle((HGDIOBJ)hBrush, GDI_OBJECT_TYPE_BRUSH)
 #define  BRUSHOBJ_LockBrush(hBrush) ((PGDIBRUSHOBJ)GDIOBJ_LockObj((HGDIOBJ)hBrush, GDI_OBJECT_TYPE_BRUSH))
 #define  BRUSHOBJ_UnlockBrush(pBrush) GDIOBJ_UnlockObjByPtr((POBJ)pBrush)
 

reactos/subsystems/win32/win32k/include/gdiobj.h

@@ -46,6 +46,11 @@ typedef struct _BASEOBJECT
   PW32THREAD  Tid;
 } BASEOBJECT, *POBJ;
 
+enum BASEFLAGS
+{
+    BASEFLAG_LOOKASIDE = 0x80
+};
+
 BOOL    INTERNAL_CALL GDIOBJ_OwnedByCurrentProcess(HGDIOBJ ObjectHandle);
 VOID    INTERNAL_CALL GDIOBJ_SetOwnership(HGDIOBJ ObjectHandle, PEPROCESS Owner);
 VOID    INTERNAL_CALL GDIOBJ_CopyOwnership(HGDIOBJ CopyFrom, HGDIOBJ CopyTo);
@@ -53,8 +58,11 @@ BOOL    INTERNAL_CALL GDIOBJ_ConvertToStockObj(HGDIOBJ *hObj);
 VOID    INTERNAL_CALL GDIOBJ_UnlockObjByPtr(POBJ Object);
 VOID    INTERNAL_CALL GDIOBJ_ShareUnlockObjByPtr(POBJ Object);
 BOOL    INTERNAL_CALL GDIOBJ_ValidateHandle(HGDIOBJ hObj, ULONG ObjectType);
-HGDIOBJ INTERNAL_CALL GDIOBJ_AllocObj(ULONG ObjectType);
+POBJ    INTERNAL_CALL GDIOBJ_AllocObj(UCHAR ObjectType);
-BOOL    INTERNAL_CALL GDIOBJ_FreeObj (HGDIOBJ hObj, DWORD ObjectType);
+POBJ    INTERNAL_CALL GDIOBJ_AllocObjWithHandle(ULONG ObjectType);
+HGDIOBJ INTERNAL_CALL GDIOBJ_AllocObjDepricated(ULONG ObjectType);
+VOID    INTERNAL_CALL GDIOBJ_FreeObj (POBJ pObj, UCHAR ObjectType);
+BOOL    INTERNAL_CALL GDIOBJ_FreeObjByHandle (HGDIOBJ hObj, DWORD ObjectType);
 PGDIOBJ INTERNAL_CALL GDIOBJ_LockObj (HGDIOBJ hObj, DWORD ObjectType);
 PGDIOBJ INTERNAL_CALL GDIOBJ_ShareLockObj (HGDIOBJ hObj, DWORD ObjectType);
 

reactos/subsystems/win32/win32k/include/palette.h

@@ -64,7 +64,8 @@ HPALETTE FASTCALL PALETTE_AllocPalette(ULONG Mode,
                                        ULONG Blue);
 HPALETTE FASTCALL PALETTE_AllocPaletteIndexedRGB(ULONG NumColors,
                                                  CONST RGBQUAD *Colors);
-#define  PALETTE_FreePalette(hPalette)  GDIOBJ_FreeObj((HGDIOBJ)hPalette, GDI_OBJECT_TYPE_PALETTE)
+#define  PALETTE_FreePalette(pPalette)  GDIOBJ_FreeObj((POBJ)pPalette, GDIObjType_PAL_TYPE)
+#define  PALETTE_FreePaletteByHandle(hPalette)  GDIOBJ_FreeObjByHandle((HGDIOBJ)hPalette, GDI_OBJECT_TYPE_PALETTE)
 #define  PALETTE_LockPalette(hPalette) ((PPALGDI)GDIOBJ_LockObj((HGDIOBJ)hPalette, GDI_OBJECT_TYPE_PALETTE))
 #define  PALETTE_UnlockPalette(pPalette) GDIOBJ_UnlockObjByPtr((POBJ)pPalette)
 BOOL INTERNAL_CALL PALETTE_Cleanup(PVOID ObjectBody);

reactos/subsystems/win32/win32k/include/pen.h

@@ -6,11 +6,17 @@
 
 /* Internal interface */
 
-#define PENOBJ_AllocPen() ((HPEN)GDIOBJ_AllocObj(GDI_OBJECT_TYPE_PEN))
+#define PENOBJ_AllocPen() ((HPEN)GDIOBJ_AllocObj(GDIObjType_BRUSH_TYPE))
-#define PENOBJ_FreePen(hBMObj) GDIOBJ_FreeObj((HGDIOBJ) hBMObj, GDI_OBJECT_TYPE_PEN)
+#define PENOBJ_AllocPenWithHandle() ((PGDIBRUSHOBJ)GDIOBJ_AllocObjWithHandle(GDI_OBJECT_TYPE_PEN))
+#define PENOBJ_AllocPenDepricated() ((HPEN)GDIOBJ_AllocObjDepricated(GDI_OBJECT_TYPE_PEN))
+#define PENOBJ_FreePen(pBMObj) GDIOBJ_FreeObj((POBJ) pBMObj, GDI_OBJECT_TYPE_PEN)
+#define PENOBJ_FreePenByHandle(hBMObj) GDIOBJ_FreeObjByHandle((HGDIOBJ) hBMObj, GDI_OBJECT_TYPE_PEN)
 #define PENOBJ_LockPen(hBMObj) ((PGDIBRUSHOBJ)GDIOBJ_LockObj((HGDIOBJ) hBMObj, GDI_OBJECT_TYPE_PEN))
-#define PENOBJ_AllocExtPen() ((HPEN)GDIOBJ_AllocObj(GDI_OBJECT_TYPE_EXTPEN))
+#define PENOBJ_AllocExtPen() ((PGDIBRUSHOBJ)GDIOBJ_AllocObj(GDIObjType_BRUSH_TYPE))
-#define PENOBJ_FreeExtPen(hBMObj) GDIOBJ_FreeObj((HGDIOBJ) hBMObj, GDI_OBJECT_TYPE_EXTPEN)
+#define PENOBJ_AllocExtPenWithHandle() ((PGDIBRUSHOBJ)GDIOBJ_AllocObjWithHandle(GDI_OBJECT_TYPE_EXTPEN))
+#define PENOBJ_AllocExtPenDepricated() ((HPEN)GDIOBJ_AllocObjDepricated(GDI_OBJECT_TYPE_EXTPEN))
+#define PENOBJ_FreeExtPen(pBMObj) GDIOBJ_FreeObj((POBJ) pBMObj, GDI_OBJECT_TYPE_EXTPEN)
+#define PENOBJ_FreeExtPenByHandle(hBMObj) GDIOBJ_FreeObjByHandle((HGDIOBJ) hBMObj, GDI_OBJECT_TYPE_EXTPEN)
 #define PENOBJ_LockExtPen(hBMObj) ((PGDIBRUSHOBJ)GDIOBJ_LockObj((HGDIOBJ) hBMObj, GDI_OBJECT_TYPE_EXTPEN))
 #define PENOBJ_UnlockPen(pPenObj) GDIOBJ_UnlockObjByPtr((POBJ)pPenObj)
 

reactos/subsystems/win32/win32k/include/region.h

@@ -21,7 +21,8 @@ typedef struct _ROSRGNDATA
 
 /* Functions ******************************************************************/
 
-#define  REGION_FreeRgn(hRgn)  GDIOBJ_FreeObj((HGDIOBJ)hRgn, GDI_OBJECT_TYPE_REGION)
+#define  REGION_FreeRgn(pRgn)  GDIOBJ_FreeObj((POBJ)pRgn, GDIObjType_RGN_TYPE)
+#define  REGION_FreeRgnByHandle(hRgn)  GDIOBJ_FreeObjbyHandle((HGDIOBJ)hRgn, GDI_OBJECT_TYPE_REGION)
 #define  REGION_LockRgn(hRgn) ((PROSRGNDATA)GDIOBJ_LockObj((HGDIOBJ)hRgn, GDI_OBJECT_TYPE_REGION))
 #define  REGION_UnlockRgn(pRgn) GDIOBJ_UnlockObjByPtr((POBJ)pRgn)
 

reactos/subsystems/win32/win32k/include/text.h

@@ -68,9 +68,11 @@ typedef struct
 
 /*  Internal interface  */
 
-#define  TEXTOBJ_AllocText() \
+#define  TEXTOBJ_AllocText()       ((PTEXTOBJ) GDIOBJ_AllocObj(GDIObjType_LFONT_TYPE))
-  ((HFONT) GDIOBJ_AllocObj (GDI_OBJECT_TYPE_FONT))
+#define  TEXTOBJ_AllocTextWithHandle() ((PTEXTOBJ) GDIOBJ_AllocObjWithHandle(GDI_OBJECT_TYPE_FONT))
-#define  TEXTOBJ_FreeText(hBMObj)  GDIOBJ_FreeObj((HGDIOBJ) hBMObj, GDI_OBJECT_TYPE_FONT)
+#define  TEXTOBJ_AllocTextDepricated() ((HFONT) GDIOBJ_AllocObj(GDI_OBJECT_TYPE_FONT))
+#define  TEXTOBJ_FreeText(pBMObj)  GDIOBJ_FreeObj((POBJ) pBMObj, GDILoObjType_LO_FONT_TYPE)
+#define  TEXTOBJ_FreeTextByHandle(hBMObj)  GDIOBJ_FreeObj((HGDIOBJ) hBMObj, GDI_OBJECT_TYPE_FONT)
 #define  TEXTOBJ_LockText(hBMObj) ((PTEXTOBJ) GDIOBJ_LockObj ((HGDIOBJ) hBMObj, GDI_OBJECT_TYPE_FONT))
 #define  TEXTOBJ_UnlockText(pBMObj) GDIOBJ_UnlockObjByPtr ((POBJ)pBMObj)
 

reactos/subsystems/win32/win32k/ntuser/painting.c

@@ -272,7 +272,7 @@ co_IntPaintWindows(PWINDOW_OBJECT Window, ULONG Flags, BOOL Recurse)
             if ((HANDLE) 1 != TempRegion && NULL != TempRegion)
             {
                /* NOTE: The region can already be deleted! */
-               GDIOBJ_FreeObj(TempRegion, GDI_OBJECT_TYPE_REGION | GDI_OBJECT_TYPE_SILENT);
+               GDIOBJ_FreeObjByHandle(TempRegion, GDI_OBJECT_TYPE_REGION | GDI_OBJECT_TYPE_SILENT);
             }
          }
 
@@ -801,7 +801,7 @@ NtUserBeginPaint(HWND hWnd, PAINTSTRUCT* UnsafePs)
       if (hRgn != (HANDLE)1 && hRgn != NULL)
       {
          /* NOTE: The region can already by deleted! */
-         GDIOBJ_FreeObj(hRgn, GDI_OBJECT_TYPE_REGION | GDI_OBJECT_TYPE_SILENT);
+         GDIOBJ_FreeObjByHandle(hRgn, GDI_OBJECT_TYPE_REGION | GDI_OBJECT_TYPE_SILENT);
       }
    }
 

reactos/subsystems/win32/win32k/objects/brush.c

@@ -351,16 +351,14 @@ IntGdiCreateDIBBrush(
    BitmapObject->hDIBPalette = BuildDIBPalette(BitmapInfo, &PaletteType);
    BITMAPOBJ_UnlockBitmap(BitmapObject);
 
-   hBrush = BRUSHOBJ_AllocBrush();
+   BrushObject = BRUSHOBJ_AllocBrushWithHandle();
-   if (hBrush == NULL)
+   if (BrushObject == NULL)
    {
       NtGdiDeleteObject(hPattern);
       SetLastWin32Error(ERROR_NOT_ENOUGH_MEMORY);
       return NULL;
    }
-
+   hBrush = BrushObject->BaseObject.hHmgr;
-   BrushObject = BRUSHOBJ_LockBrush(hBrush);
-   ASSERT(BrushObject != NULL);
 
    BrushObject->flAttrs |= GDIBRUSH_IS_BITMAP | GDIBRUSH_IS_DIB;
    BrushObject->hbmPattern = hPattern;
@@ -394,16 +392,14 @@ IntGdiCreateHatchBrush(
       return NULL;
    }
 
-   hBrush = BRUSHOBJ_AllocBrush();
+   BrushObject = BRUSHOBJ_AllocBrushWithHandle();
-   if (hBrush == NULL)
+   if (BrushObject == NULL)
    {
       NtGdiDeleteObject(hPattern);
       SetLastWin32Error(ERROR_NOT_ENOUGH_MEMORY);
       return NULL;
    }
-
+   hBrush = BrushObject->BaseObject.hHmgr;
-   BrushObject = BRUSHOBJ_LockBrush(hBrush);
-   ASSERT(BrushObject != NULL);
 
    BrushObject->flAttrs |= GDIBRUSH_IS_HATCH;
    BrushObject->hbmPattern = hPattern;
@@ -431,16 +427,14 @@ IntGdiCreatePatternBrush(
       return NULL;
    }
 
-   hBrush = BRUSHOBJ_AllocBrush();
+   BrushObject = BRUSHOBJ_AllocBrushWithHandle();
-   if (hBrush == NULL)
+   if (BrushObject == NULL)
    {
       NtGdiDeleteObject(hPattern);
       SetLastWin32Error(ERROR_NOT_ENOUGH_MEMORY);
       return NULL;
    }
-
+   hBrush = BrushObject->BaseObject.hHmgr;
-   BrushObject = BRUSHOBJ_LockBrush(hBrush);
-   ASSERT(BrushObject != NULL);
 
    BrushObject->flAttrs |= GDIBRUSH_IS_BITMAP;
    BrushObject->hbmPattern = hPattern;
@@ -460,15 +454,13 @@ IntGdiCreateSolidBrush(
    HBRUSH hBrush;
    PGDIBRUSHOBJ BrushObject;
 
-   hBrush = BRUSHOBJ_AllocBrush();
+   BrushObject = BRUSHOBJ_AllocBrushWithHandle();
-   if (hBrush == NULL)
+   if (BrushObject == NULL)
    {
       SetLastWin32Error(ERROR_NOT_ENOUGH_MEMORY);
       return NULL;
    }
-
+   hBrush = BrushObject->BaseObject.hHmgr;
-   BrushObject = BRUSHOBJ_LockBrush(hBrush);
-   ASSERT(BrushObject != NULL);
 
    BrushObject->flAttrs |= GDIBRUSH_IS_SOLID;
 
@@ -486,15 +478,14 @@ IntGdiCreateNullBrush(VOID)
    HBRUSH hBrush;
    PGDIBRUSHOBJ BrushObject;
 
-   hBrush = BRUSHOBJ_AllocBrush();
+   BrushObject = BRUSHOBJ_AllocBrushWithHandle();
-   if (hBrush == NULL)
+   if (BrushObject == NULL)
    {
       SetLastWin32Error(ERROR_NOT_ENOUGH_MEMORY);
       return NULL;
    }
+   hBrush = BrushObject->BaseObject.hHmgr;
 
-   BrushObject = BRUSHOBJ_LockBrush(hBrush);
-   ASSERT(BrushObject != NULL);
    BrushObject->flAttrs |= GDIBRUSH_IS_NULL;
    BRUSHOBJ_UnlockBrush(BrushObject);
 

reactos/subsystems/win32/win32k/objects/dc.c

@@ -2270,7 +2270,7 @@ DC_AllocDC(PUNICODE_STRING Driver)
     RtlCopyMemory(Buf, Driver->Buffer, Driver->MaximumLength);
   }
 
-  hDC = (HDC) GDIOBJ_AllocObj(GDI_OBJECT_TYPE_DC);
+  hDC = (HDC) GDIOBJ_AllocObjDepricated(GDI_OBJECT_TYPE_DC);
   if (hDC == NULL)
   {
     if(Buf)
@@ -2441,7 +2441,7 @@ DC_FreeDC(HDC  DCToFree)
   DC_FreeDcAttr(DCToFree);
   if(!IsObjectDead( DCToFree ))
   {
-    if (!GDIOBJ_FreeObj(DCToFree, GDI_OBJECT_TYPE_DC))
+    if (!GDIOBJ_FreeObjByHandle(DCToFree, GDI_OBJECT_TYPE_DC))
     {
        DPRINT1("DC_FreeDC failed\n");
     }

reactos/subsystems/win32/win32k/objects/dibobj.c

@@ -237,7 +237,7 @@ IntSetDIBits(
   XlateObj = IntEngCreateXlate(DDB_Palette_Type, DIB_Palette_Type, DDB_Palette, DIB_Palette);
   if (NULL == XlateObj)
     {
-      PALETTE_FreePalette(DIB_Palette);
+      PALETTE_FreePaletteByHandle(DIB_Palette);
       EngUnlockSurface(SourceSurf);
       EngDeleteSurface((HSURF)SourceBitmap);
       BITMAPOBJ_UnlockBitmap(bitmap);
@@ -265,7 +265,7 @@ IntSetDIBits(
 
   // Clean up
   EngDeleteXlate(XlateObj);
-  PALETTE_FreePalette(DIB_Palette);
+  PALETTE_FreePaletteByHandle(DIB_Palette);
   EngUnlockSurface(SourceSurf);
   EngDeleteSurface((HSURF)SourceBitmap);
 
@@ -713,7 +713,7 @@ cleanup:
         EngDeleteSurface((HSURF)hDestBitmap);
 
     if (hDestPalette != NULL && bPaletteMatch == FALSE)
-        PALETTE_FreePalette(hDestPalette);
+        PALETTE_FreePaletteByHandle(hDestPalette);
 
     BITMAPOBJ_UnlockBitmap(BitmapObj);
 
@@ -1147,7 +1147,7 @@ DIB_CreateDIBSection(
 
     if (dib) { ExFreePool(dib); dib = NULL; }
     if (bmp) { bmp = NULL; }
-    if (res) { BITMAPOBJ_FreeBitmap(res); res = 0; }
+    if (res) { BITMAPOBJ_FreeBitmapByHandle(res); res = 0; }
   }
 
   if (lpRGB != bmi->bmiColors)

reactos/subsystems/win32/win32k/objects/gdiobj.c

@@ -72,7 +72,7 @@ OBJ_TYPE_INFO ObjTypeInfo[] =
   {1, sizeof(DC),            TAG_DC,           DC_Cleanup},       /* 01 DC */
   {1, 0,                     0,                NULL},             /* 02 UNUSED1 */
   {1, 0,                     0,                NULL},             /* 03 UNUSED2 */
-  {1, sizeof(ROSRGNDATA),    TAG_REGION,       REGION_Cleanup},  /* 04 RGN */
+  {1, sizeof(ROSRGNDATA),    TAG_REGION,       REGION_Cleanup},   /* 04 RGN */
   {1, sizeof(BITMAPOBJ),     TAG_SURFACE,      BITMAP_Cleanup},   /* 05 SURFACE */
   {0, sizeof(DC),            TAG_CLIENTOBJ,    GDI_CleanupDummy}, /* 06 CLIENTOBJ: METADC,... FIXME: don't use DC struct */
   {0, 0,                     TAG_PATH,         NULL},             /* 07 PATH, unused */
@@ -444,24 +444,51 @@ GDIOBJ_ValidateHandle(HGDIOBJ hObj, ULONG ObjectType)
     return FALSE;
 }
 
+POBJ INTERNAL_CALL
+GDIOBJ_AllocObj(UCHAR BaseType)
+{
+    POBJ pObject;
+
+    ASSERT((BaseType & ~GDIObjTypeTotal) == 0);
+//    BaseType &= GDI_HANDLE_BASETYPE_MASK;
+
+    if (ObjTypeInfo[BaseType].bUseLookaside)
+    {
+        PPAGED_LOOKASIDE_LIST LookasideList;
+
+        LookasideList = GdiHandleTable->LookasideLists + BaseType;
+        pObject = ExAllocateFromPagedLookasideList(LookasideList);
+    }
+    else
+    {
+        pObject = ExAllocatePoolWithTag(PagedPool,
+                                        ObjTypeInfo[BaseType].ulBodySize,
+                                        ObjTypeInfo[BaseType].Tag);
+    }
+
+    if (pObject)
+    {
+        RtlZeroMemory(pObject, ObjTypeInfo[BaseType].ulBodySize);
+    }
+
+    return pObject;
+}
+
+
 /*!
  * Allocate memory for GDI object and return handle to it.
  *
  * \param ObjectType - type of object \ref GDI object types
  *
- * \return Handle of the allocated object.
+ * \return Pointer to the allocated object, which is locked.
- *
- * \note Use GDIOBJ_Lock() to obtain pointer to the new object.
- * \todo return the object pointer and lock it by default.
 */
-HGDIOBJ INTERNAL_CALL
+POBJ INTERNAL_CALL
-GDIOBJ_AllocObj(ULONG ObjectType)
+GDIOBJ_AllocObjWithHandle(ULONG ObjectType)
 {
     PW32PROCESS W32Process;
     POBJ  newObject = NULL;
-    PPAGED_LOOKASIDE_LIST LookasideList = NULL;
     HANDLE CurrentProcessId, LockedProcessId;
-    ULONG TypeIndex;
+    UCHAR TypeIndex;
 #ifdef GDI_DEBUG
     ULONG Attempts = 0;
 #endif
@@ -475,106 +502,130 @@ GDIOBJ_AllocObj(ULONG ObjectType)
     ASSERT(ObjectType != GDI_OBJECT_TYPE_DONTCARE);
 
     TypeIndex = GDI_OBJECT_GET_TYPE_INDEX(ObjectType);
-    if (ObjTypeInfo[TypeIndex].bUseLookaside)
+
+    newObject = GDIOBJ_AllocObj(TypeIndex);
+    if (!newObject)
     {
-        LookasideList = FindLookasideList(TypeIndex);
+        DPRINT1("Not enough memory to allocate gdi object!\n");
-        if (LookasideList != NULL)
+        return NULL;
-        {
-            newObject = ExAllocateFromPagedLookasideList(LookasideList);
-        }
     }
-    else
+
+    UINT Index;
+    PGDI_TABLE_ENTRY Entry;
+    LONG TypeInfo;
+
+    CurrentProcessId = PsGetCurrentProcessId();
+    LockedProcessId = (HANDLE)((ULONG_PTR)CurrentProcessId | 0x1);
+
+//    RtlZeroMemory(newObject, GetObjectSize(TypeIndex));
+
+    /* On Windows the higher 16 bit of the type field don't contain the
+       full type from the handle, but the base type.
+       (type = BRSUH, PEN, EXTPEN, basetype = BRUSH) */
+    TypeInfo = (ObjectType & GDI_HANDLE_BASETYPE_MASK) | (ObjectType >> GDI_ENTRY_UPPER_SHIFT);
+
+    Index = InterlockedPopFreeEntry();
+    if (Index != 0)
     {
-        newObject = ExAllocatePoolWithTag(PagedPool,
+        HANDLE PrevProcId;
-                                          ObjTypeInfo[TypeIndex].ulBodySize,
-                                          ObjTypeInfo[TypeIndex].Tag);
-    }
-    if (newObject != NULL)
-    {
-        UINT Index;
-        PGDI_TABLE_ENTRY Entry;
-        LONG TypeInfo;
 
-        CurrentProcessId = PsGetCurrentProcessId();
+        Entry = &GdiHandleTable->Entries[Index];
-        LockedProcessId = (HANDLE)((ULONG_PTR)CurrentProcessId | 0x1);
-
-        RtlZeroMemory(newObject, GetObjectSize(TypeIndex));
-
-        /* On Windows the higher 16 bit of the type field don't contain the
-           full type from the handle, but the base type.
-           (type = BRSUH, PEN, EXTPEN, basetype = BRUSH) */
-        TypeInfo = (ObjectType & GDI_HANDLE_BASETYPE_MASK) | (ObjectType >> GDI_ENTRY_UPPER_SHIFT);
-
-        Index = InterlockedPopFreeEntry();
-        if (Index != 0)
-        {
-            HANDLE PrevProcId;
-
-            Entry = &GdiHandleTable->Entries[Index];
 
 LockHandle:
-            PrevProcId = _InterlockedCompareExchangePointer((PVOID*)&Entry->ProcessId, LockedProcessId, 0);
+        PrevProcId = _InterlockedCompareExchangePointer((PVOID*)&Entry->ProcessId, LockedProcessId, 0);
-            if (PrevProcId == NULL)
+        if (PrevProcId == NULL)
-            {
-                HGDIOBJ Handle;
-
-                Entry->KernelData = newObject;
-
-                /* copy the reuse-counter */
-                TypeInfo |= Entry->Type & GDI_ENTRY_REUSE_MASK;
-
-                /* we found a free entry, no need to exchange this field atomically
-                   since we're holding the lock */
-                Entry->Type = TypeInfo;
-
-                /* unlock the entry */
-                (void)_InterlockedExchangePointer((PVOID*)&Entry->ProcessId, CurrentProcessId);
-
-                GDIDBG_CAPTUREALLOCATOR(Index);
-
-                if (W32Process != NULL)
-                {
-                    _InterlockedIncrement(&W32Process->GDIObjects);
-                }
-                Handle = (HGDIOBJ)((Index & 0xFFFF) | (TypeInfo << GDI_ENTRY_UPPER_SHIFT));
-                newObject->hHmgr = Handle;
-
-                DPRINT("GDIOBJ_AllocObj: 0x%x ob: 0x%x\n", Handle, newObject);
-                return Handle;
-            }
-            else
-            {
-#ifdef GDI_DEBUG
-                if (++Attempts > 20)
-                {
-                    DPRINT1("[%d]Waiting on handle in index 0x%x\n", Attempts, Index);
-                }
-#endif
-                /* damn, someone is trying to lock the object even though it doesn't
-                   eve nexist anymore, wait a little and try again!
-                   FIXME - we shouldn't loop forever! Give up after some time! */
-                DelayExecution();
-                /* try again */
-                goto LockHandle;
-            }
-        }
-
-        if (ObjTypeInfo[TypeIndex].bUseLookaside)
         {
-            ExFreeToPagedLookasideList(LookasideList, newObject);
+            PW32THREAD Thread = PsGetCurrentThreadWin32Thread();
+            HGDIOBJ Handle;
+
+            Entry->KernelData = newObject;
+
+            /* copy the reuse-counter */
+            TypeInfo |= Entry->Type & GDI_ENTRY_REUSE_MASK;
+
+            /* we found a free entry, no need to exchange this field atomically
+               since we're holding the lock */
+            Entry->Type = TypeInfo;
+
+            /* Create a handle */
+            Handle = (HGDIOBJ)((Index & 0xFFFF) | (TypeInfo << GDI_ENTRY_UPPER_SHIFT));
+
+            /* Initialize BaseObject fields */
+            newObject->hHmgr = Handle;
+            newObject->ulShareCount = 0;
+            newObject->cExclusiveLock = 1;
+            newObject->Tid = Thread;
+
+            /* unlock the entry */
+            (void)_InterlockedExchangePointer((PVOID*)&Entry->ProcessId, CurrentProcessId);
+
+            GDIDBG_CAPTUREALLOCATOR(Index);
+
+            if (W32Process != NULL)
+            {
+                _InterlockedIncrement(&W32Process->GDIObjects);
+            }
+
+            DPRINT("GDIOBJ_AllocObj: 0x%x ob: 0x%x\n", Handle, newObject);
+            return newObject;
         }
         else
         {
-            ExFreePool(newObject);
+#ifdef GDI_DEBUG
+            if (++Attempts > 20)
+            {
+                DPRINT1("[%d]Waiting on handle in index 0x%x\n", Attempts, Index);
+            }
+#endif
+            /* damn, someone is trying to lock the object even though it doesn't
+               even exist anymore, wait a little and try again!
+               FIXME - we shouldn't loop forever! Give up after some time! */
+            DelayExecution();
+            /* try again */
+            goto LockHandle;
         }
-        DPRINT1("Failed to insert gdi object into the handle table, no handles left!\n");
+    }
-        GDIDBG_DUMPHANDLETABLE();
+
+    GDIOBJ_FreeObj(newObject, TypeIndex);
+
+    DPRINT1("Failed to insert gdi object into the handle table, no handles left!\n");
+    GDIDBG_DUMPHANDLETABLE();
+
+    return NULL;
+}
+
+/* Wrapper for compatibility with old calls, will be removed later */
+HGDIOBJ INTERNAL_CALL
+GDIOBJ_AllocObjDepricated(ULONG ObjectType)
+{
+    POBJ pObject;
+    HGDIOBJ hObject;
+
+    pObject = GDIOBJ_AllocObjWithHandle(ObjectType);
+    hObject = pObject->hHmgr;
+    GDIOBJ_UnlockObjByPtr(pObject);
+
+    return hObject;
+}
+
+
+VOID INTERNAL_CALL
+GDIOBJ_FreeObj(POBJ pObject, UCHAR BaseType)
+{
+    /* Object must not have a handle! */
+    ASSERT(pObject->hHmgr == NULL);
+
+    if (ObjTypeInfo[BaseType].bUseLookaside)
+    {
+        PPAGED_LOOKASIDE_LIST LookasideList;
+
+        LookasideList = GdiHandleTable->LookasideLists + BaseType;
+        ExFreeToPagedLookasideList(LookasideList, pObject);
     }
     else
     {
-        DPRINT1("Not enough memory to allocate gdi object!\n");
+        ExFreePool(pObject);
     }
-    return NULL;
 }
 
 /*!
@@ -588,10 +639,9 @@ LockHandle:
  * to the calling process.
 */
 BOOL INTERNAL_CALL
-GDIOBJ_FreeObj(HGDIOBJ hObj, DWORD ExpectedType)
+GDIOBJ_FreeObjByHandle(HGDIOBJ hObj, DWORD ExpectedType)
 {
     PGDI_TABLE_ENTRY Entry;
-    PPAGED_LOOKASIDE_LIST LookasideList;
     HANDLE ProcessId, LockedProcessId, PrevProcId;
     ULONG HandleType, HandleUpper, TypeIndex;
     BOOL Silent;
@@ -658,6 +708,8 @@ LockHandle:
                 /* push this entry to the free list */
                 InterlockedPushFreeEntry(GDI_ENTRY_TO_INDEX(GdiHandleTable, Entry));
 
+                Object->hHmgr = NULL;
+
                 if (W32Process != NULL)
                 {
                     _InterlockedDecrement(&W32Process->GDIObjects);
@@ -668,18 +720,7 @@ LockHandle:
                 Ret = RunCleanupCallback(Object, TypeIndex);
 
                 /* Now it's time to free the memory */
-                if (ObjTypeInfo[TypeIndex].bUseLookaside)
+                GDIOBJ_FreeObj(Object, TypeIndex);
-                {
-                    LookasideList = FindLookasideList(TypeIndex);
-                    if (LookasideList != NULL)
-                    {
-                        ExFreeToPagedLookasideList(LookasideList, Object);
-                    }
-                }
-                else
-                {
-                    ExFreePool(Object);
-                }
 
                 return Ret;
             }
@@ -764,7 +805,7 @@ NtGdiDeleteObject(HGDIOBJ hObject)
     if (!IsObjectDead(hObject))
     {
         return NULL != hObject
-               ? GDIOBJ_FreeObj(hObject, GDI_OBJECT_TYPE_DONTCARE) : FALSE;
+               ? GDIOBJ_FreeObjByHandle(hObject, GDI_OBJECT_TYPE_DONTCARE) : FALSE;
     }
     else
     {
@@ -818,7 +859,7 @@ GDI_CleanupForProcess(struct _EPROCESS *Process)
                    simply ignore this fact here. */
                 ObjectHandle = (HGDIOBJ)(Index | (Entry->Type << GDI_ENTRY_UPPER_SHIFT));
 
-                if (GDIOBJ_FreeObj(ObjectHandle, GDI_OBJECT_TYPE_DONTCARE) &&
+                if (GDIOBJ_FreeObjByHandle(ObjectHandle, GDI_OBJECT_TYPE_DONTCARE) &&
                         W32Process->GDIObjects == 0)
                 {
                     /* there are no more gdi handles for this process, bail */
@@ -1569,21 +1610,30 @@ NtGdiCreateClientObj(
     IN ULONG ulType
 )
 {
-// ATM we use DC object for KernelData. I think it should be at a minimum GDIOBJEMPTYHDR.
+// ATM we use DC object for KernelData. This is wrong.
+// The real type consists of BASEOBJECT and a pointer.
 // The UserData is set in user mode, so it is always NULL.
+// HANDLE should be HGDIOBJ
 //
-    INT Index;
+    POBJ pObject;
-    PGDI_TABLE_ENTRY Entry;
+    HANDLE handle;
-    HANDLE handle = GDIOBJ_AllocObj(GDI_OBJECT_TYPE_CLIOBJ);
+
-// Need to change handle type based on ulType.
+    /* Mask out everything that would change the type in a wrong manner */
-    Index = GDI_HANDLE_GET_INDEX((HGDIOBJ)handle);
+    ulType &= (GDI_HANDLE_TYPE_MASK & ~GDI_HANDLE_BASETYPE_MASK);
-    Entry = &GdiHandleTable->Entries[Index];
+
-// mask out lower half and set the type by ulType.
+    /* Allocate a new object */
-    Entry->Type &= GDI_HANDLE_UPPER_MASK;
+    pObject = GDIOBJ_AllocObjWithHandle(GDI_OBJECT_TYPE_CLIOBJ | ulType);
-    Entry->Type |= ulType >> GDI_ENTRY_UPPER_SHIFT;
+    if (!pObject)
-// mask out handle type than set it by ulType.
+    {
-    handle = (HANDLE)(((ULONG_PTR)(handle)) & (GDI_HANDLE_REUSE_MASK|GDI_HANDLE_STOCK_MASK|0x0ffff));
+        return NULL;
-    handle = (HANDLE)(((ULONG_PTR)(handle)) | ulType);
+    }
+
+    /* get the handle */
+    handle = pObject->hHmgr;
+
+    /* Unlock it */
+    GDIOBJ_UnlockObjByPtr(pObject);
+
     return handle;
 }
 
@@ -1594,7 +1644,16 @@ NtGdiDeleteClientObj(
     IN HANDLE h
 )
 {
-    return GDIOBJ_FreeObj(h, GDI_OBJECT_TYPE_CLIOBJ);
+    /* We first need to get the real type from the handle */
+    ULONG type = GDI_HANDLE_GET_TYPE(h);
+
+    /* Check if it's really a CLIENTOBJ */
+    if ((type & GDI_HANDLE_BASETYPE_MASK) != GDILoObjType_LO_CLIENTOBJ_TYPE)
+    {
+        /* FIXME: SetLastError? */
+        return FALSE;
+    }
+    return GDIOBJ_FreeObjByHandle(h, type);
 }
 
 INT

reactos/subsystems/win32/win32k/objects/metafile.c

@@ -230,7 +230,7 @@ NtGdiCloseEnhMetaFile(HDC  hDC)
           NtClose( Dc->hFile );
     }
 
-  hmf = GDIOBJ_AllocObj(GdiHandleTable, GDI_OBJECT_TYPE_ENHMETAFILE);
+  hmf = GDIOBJ_AllocObjDepricated(GdiHandleTable, GDI_OBJECT_TYPE_ENHMETAFILE);
   if (hmf != NULL)
   {
      phmf = GDIOBJ_LockObj(GdiHandleTable, hmf, GDI_OBJECT_TYPE_ENHMETAFILE);

reactos/subsystems/win32/win32k/objects/palobj.c

@@ -63,7 +63,7 @@ PALETTE_AllocPalette(ULONG Mode,
   HPALETTE NewPalette;
   PPALGDI PalGDI;
 
-  NewPalette = (HPALETTE) GDIOBJ_AllocObj(GDI_OBJECT_TYPE_PALETTE);
+  NewPalette = (HPALETTE) GDIOBJ_AllocObjDepricated(GDI_OBJECT_TYPE_PALETTE);
   if (NULL == NewPalette)
     {
       return NULL;
@@ -82,7 +82,7 @@ PALETTE_AllocPalette(ULONG Mode,
       if (NULL == PalGDI->IndexedColors)
 	{
 	  PALETTE_UnlockPalette(PalGDI);
-	  PALETTE_FreePalette(NewPalette);
+	  PALETTE_FreePaletteByHandle(NewPalette);
 	  return NULL;
 	}
       RtlCopyMemory(PalGDI->IndexedColors, Colors, sizeof(PALETTEENTRY) * NumColors);
@@ -112,7 +112,7 @@ PALETTE_AllocPaletteIndexedRGB(ULONG NumColors,
   PPALGDI PalGDI;
   unsigned i;
 
-  NewPalette = (HPALETTE) GDIOBJ_AllocObj(GDI_OBJECT_TYPE_PALETTE);
+  NewPalette = (HPALETTE) GDIOBJ_AllocObjDepricated(GDI_OBJECT_TYPE_PALETTE);
   if (NULL == NewPalette)
     {
       return NULL;
@@ -129,7 +129,7 @@ PALETTE_AllocPaletteIndexedRGB(ULONG NumColors,
   if (NULL == PalGDI->IndexedColors)
     {
       PALETTE_UnlockPalette(PalGDI);
-      PALETTE_FreePalette(NewPalette);
+      PALETTE_FreePaletteByHandle(NewPalette);
       return NULL;
     }
   for (i = 0; i < NumColors; i++)

reactos/subsystems/win32/win32k/objects/pen.c

@@ -51,29 +51,20 @@ IntGdiExtCreatePen(
 
    if (bOldStylePen)
    {
-      hPen = PENOBJ_AllocPen();
+      PenObject = PENOBJ_AllocPenWithHandle();
    }
    else
    {
-      hPen = PENOBJ_AllocExtPen();
+      PenObject = PENOBJ_AllocExtPenWithHandle();
    }
 
-   if (!hPen)
+   if (!PenObject)
    {
       SetLastWin32Error(ERROR_NOT_ENOUGH_MEMORY);
       DPRINT("Can't allocate pen\n");
       return 0;
    }
-
+   hPen = PenObject->BaseObject.hHmgr;
-   if (bOldStylePen)
-   {
-      PenObject = PENOBJ_LockPen(hPen);
-   }
-   else
-   {
-      PenObject = PENOBJ_LockExtPen(hPen);
-   }
-   /* FIXME - Handle PenObject == NULL!!! */
 
    PenObject->ptPenWidth.x = dwWidth;
    PenObject->ptPenWidth.y = 0;

reactos/subsystems/win32/win32k/objects/region.c

@@ -2024,7 +2024,7 @@ REGION_AllocRgnWithHandle(INT n)
     HRGN hReg;
     PROSRGNDATA pReg;
 
-    if ((hReg = (HRGN) GDIOBJ_AllocObj(GDI_OBJECT_TYPE_REGION)))
+    if ((hReg = (HRGN) GDIOBJ_AllocObjDepricated(GDI_OBJECT_TYPE_REGION)))
     {
         if (NULL != (pReg = REGION_LockRgn(hReg)))
         {

reactos/subsystems/win32/win32k/objects/text.c

@@ -487,36 +487,24 @@ NTSTATUS FASTCALL
 TextIntCreateFontIndirect(CONST LPLOGFONTW lf, HFONT *NewFont)
 {
   PTEXTOBJ TextObj;
-  NTSTATUS Status = STATUS_SUCCESS;
 
-  *NewFont = TEXTOBJ_AllocText();
+  TextObj = TEXTOBJ_AllocTextWithHandle();
-  if (NULL != *NewFont)
+  if (!TextObj)
   {
-    TextObj = TEXTOBJ_LockText(*NewFont);
+    return STATUS_NO_MEMORY;
-    if (NULL != TextObj)
-    {
-      memcpy(&TextObj->logfont.elfEnumLogfontEx.elfLogFont, lf, sizeof(LOGFONTW));
-      if (lf->lfEscapement != lf->lfOrientation)
-      {
-        /* this should really depend on whether GM_ADVANCED is set */
-        TextObj->logfont.elfEnumLogfontEx.elfLogFont.lfOrientation =
-        TextObj->logfont.elfEnumLogfontEx.elfLogFont.lfEscapement;
-      }
-      TEXTOBJ_UnlockText(TextObj);
-    }
-    else
-    {
-/* FIXME */
-/*      ASSERT(FALSE);*/
-      Status = STATUS_INVALID_HANDLE;
-    }
-  }
-  else
-  {
-    Status = STATUS_NO_MEMORY;
   }
 
-  return Status;
+  *NewFont = TextObj->BaseObject.hHmgr;
+  memcpy(&TextObj->logfont.elfEnumLogfontEx.elfLogFont, lf, sizeof(LOGFONTW));
+  if (lf->lfEscapement != lf->lfOrientation)
+  {
+    /* this should really depend on whether GM_ADVANCED is set */
+    TextObj->logfont.elfEnumLogfontEx.elfLogFont.lfOrientation =
+    TextObj->logfont.elfEnumLogfontEx.elfLogFont.lfEscapement;
+  }
+  TEXTOBJ_UnlockText(TextObj);
+
+  return STATUS_SUCCESS;
 }
 
 HFONT
@@ -528,51 +516,51 @@ NtGdiHfontCreate(
   IN FLONG  fl,
   IN PVOID pvCliData )
 {
- ENUMLOGFONTEXDVW SafeLogfont;
+  ENUMLOGFONTEXDVW SafeLogfont;
- HFONT NewFont;
+  HFONT hNewFont;
- PTEXTOBJ TextObj;
+  PTEXTOBJ TextObj;
- NTSTATUS Status = STATUS_SUCCESS;
+  NTSTATUS Status = STATUS_SUCCESS;
 
-  if (NULL != pelfw)
+  if (!pelfw)
   {
-    Status = MmCopyFromCaller(&SafeLogfont, pelfw, sizeof(ENUMLOGFONTEXDVW));
+      return NULL;
-    if (NT_SUCCESS(Status))
-    {
-       NewFont = TEXTOBJ_AllocText();
-       if (NULL != NewFont)
-       {
-          TextObj = TEXTOBJ_LockText(NewFont);
-
-          if (NULL != TextObj)
-          {
-             RtlCopyMemory ( &TextObj->logfont,
-                                  &SafeLogfont,
-                                  sizeof(ENUMLOGFONTEXDVW));
-
-             if (SafeLogfont.elfEnumLogfontEx.elfLogFont.lfEscapement !=
-                 SafeLogfont.elfEnumLogfontEx.elfLogFont.lfOrientation)
-             {
-        /* this should really depend on whether GM_ADVANCED is set */
-                TextObj->logfont.elfEnumLogfontEx.elfLogFont.lfOrientation =
-                TextObj->logfont.elfEnumLogfontEx.elfLogFont.lfEscapement;
-             }
-             TEXTOBJ_UnlockText(TextObj);
-          }
-          else
-          {
-/* FIXME */
-/*      ASSERT(FALSE);*/
-            Status = STATUS_INVALID_HANDLE;
-          }
-       }
-    }
-  }
-  else
-  {
-    Status = STATUS_INVALID_PARAMETER;
   }
 
- return NT_SUCCESS(Status) ? NewFont : NULL;
+  _SEH_TRY
+  {
+      ProbeForRead(pelfw, sizeof(ENUMLOGFONTEXDVW), 1);
+      RtlCopyMemory(&SafeLogfont, pelfw, sizeof(ENUMLOGFONTEXDVW));
+  }
+  _SEH_HANDLE
+  {
+      Status = _SEH_GetExceptionCode();
+  }
+  _SEH_END
+
+  if (!NT_SUCCESS(Status))
+  {
+      return NULL;
+  }
+
+  TextObj = TEXTOBJ_AllocTextWithHandle();
+  if (!TextObj)
+  {
+      return NULL;
+  }
+  hNewFont = TextObj->BaseObject.hHmgr;
+
+  RtlCopyMemory (&TextObj->logfont, &SafeLogfont, sizeof(ENUMLOGFONTEXDVW));
+
+  if (SafeLogfont.elfEnumLogfontEx.elfLogFont.lfEscapement !=
+      SafeLogfont.elfEnumLogfontEx.elfLogFont.lfOrientation)
+  {
+    /* this should really depend on whether GM_ADVANCED is set */
+    TextObj->logfont.elfEnumLogfontEx.elfLogFont.lfOrientation =
+    TextObj->logfont.elfEnumLogfontEx.elfLogFont.lfEscapement;
+  }
+  TEXTOBJ_UnlockText(TextObj);
+
+  return hNewFont;
 
 }
 
@@ -1577,7 +1565,7 @@ NtGdiExtTextOutW(
 
    Dc_Attr = dc->pDc_Attr;
    if(!Dc_Attr) Dc_Attr = &dc->Dc_Attr;
-   
+
 	/* Check if String is valid */
    if ((Count > 0xFFFF) || (Count > 0 && UnsafeString == NULL))
    {
@@ -2159,7 +2147,7 @@ NtGdiGetCharABCWidthsW(
       SetLastWin32Error(Status);
       return FALSE;
    }
-   
+
    BufferSize = Count * sizeof(ABC); // Same size!
    SafeBuff = ExAllocatePoolWithTag(PagedPool, BufferSize, TAG_GDITEXT);
    if (!fl) SafeBuffF = (LPABCFLOAT) SafeBuff;
@@ -2447,7 +2435,7 @@ NtGdiGetGlyphIndicesW(
   WCHAR DefChar = 0;
   PWSTR Buffer = NULL;
   ULONG Size;
-  
+
   if ((!UnSafepwc) && (!UnSafepgi)) return cwc;
 
   dc = DC_LockDc(hdc);
@@ -2488,7 +2476,7 @@ NtGdiGetGlyphIndicesW(
         goto ErrorRet;
      }
      IntGetOutlineTextMetrics(FontGDI, Size, potm);
-     DefChar = potm->otmTextMetrics.tmDefaultChar; // May need this.  
+     DefChar = potm->otmTextMetrics.tmDefaultChar; // May need this.
      ExFreePool(potm);
   }
 
@@ -2508,7 +2496,7 @@ NtGdiGetGlyphIndicesW(
 
   IntLockFreeType;
   face = FontGDI->face;
-    
+
   for (i = 0; i < cwc; i++)
   {
      Buffer[i] = FT_Get_Char_Index(face, UnSafepwc[i]);
@@ -3340,7 +3328,7 @@ NtGdiGetCharSet(HDC hDC)
   PDC Dc;
   PDC_ATTR Dc_Attr;
   DWORD cscp = IntGdiGetCharSet(hDC);
-  // If here, update everything!  
+  // If here, update everything!
   Dc = DC_LockDc(hDC);
   Dc_Attr = Dc->pDc_Attr;
   if (!Dc_Attr) Dc_Attr = &Dc->Dc_Attr;