From 9eca7c52f6be89edf2b9323f48a94133aa0dae78 Mon Sep 17 00:00:00 2001
From: Timo Kreuzer <timo.kreuzer@reactos.org>
Date: Mon, 25 Sep 2023 20:12:51 +0300
Subject: [PATCH] [WIN32K] ASSERT that all callout references have been cleaned
 up on thread exit

---
 win32ss/user/ntuser/main.c   | 5 +++++
 win32ss/user/ntuser/object.h | 6 ++++++
 win32ss/user/ntuser/win32.h  | 1 +
 3 files changed, 12 insertions(+)

diff --git a/win32ss/user/ntuser/main.c b/win32ss/user/ntuser/main.c
index cb5dc019918..1e817ddc1c7 100644
--- a/win32ss/user/ntuser/main.c
+++ b/win32ss/user/ntuser/main.c
@@ -813,6 +813,9 @@ ExitThreadCallback(PETHREAD Thread)
             UserDereferenceObject(ref->obj);
 
             psle = PopEntryList(&ptiCurrent->ReferencesList);
+#if DBG
+            ptiCurrent->cRefObjectCo--;
+#endif
         }
     }
 
@@ -872,6 +875,8 @@ ExitThreadCallback(PETHREAD Thread)
     }
     ptiCurrent->hEventQueueClient = NULL;
 
+    ASSERT(ptiCurrent->cRefObjectCo == 0);
+
     /* The thread is dying */
     PsSetThreadWin32Thread(Thread /*ptiCurrent->pEThread*/, NULL, ptiCurrent);
 
diff --git a/win32ss/user/ntuser/object.h b/win32ss/user/ntuser/object.h
index 0d6bc6dda88..4a2891c5b82 100644
--- a/win32ss/user/ntuser/object.h
+++ b/win32ss/user/ntuser/object.h
@@ -34,6 +34,9 @@ UserRefObjectCo(PVOID obj, PUSER_REFERENCE_ENTRY UserReferenceEntry)
     UserReferenceEntry->obj = obj;
     UserReferenceObject(obj);
     PushEntryList(&W32Thread->ReferencesList, &UserReferenceEntry->Entry);
+#if DBG
+    W32Thread->cRefObjectCo++;
+#endif
 }
 
 static __inline VOID
@@ -53,6 +56,9 @@ UserDerefObjectCo(PVOID obj)
 
     ASSERT(obj == UserReferenceEntry->obj);
     UserDereferenceObject(obj);
+#if DBG
+    W32Thread->cRefObjectCo--;
+#endif
 }
 
 void FreeProcMarkObject(_In_ PVOID Object);
diff --git a/win32ss/user/ntuser/win32.h b/win32ss/user/ntuser/win32.h
index 9f97725ff6b..c4fc64570cd 100644
--- a/win32ss/user/ntuser/win32.h
+++ b/win32ss/user/ntuser/win32.h
@@ -158,6 +158,7 @@ typedef struct _THREADINFO
     ULONG cExclusiveLocks;
 #if DBG
     USHORT acExclusiveLockCount[GDIObjTypeTotal + 1];
+    UINT cRefObjectCo;
 #endif
 #endif // __cplusplus
 } THREADINFO;