[WIN32K] ASSERT that all callout references have been cleaned up on thread exit

win32ss/user/ntuser/main.c

@@ -813,6 +813,9 @@ ExitThreadCallback(PETHREAD Thread)
             UserDereferenceObject(ref->obj);
 
             psle = PopEntryList(&ptiCurrent->ReferencesList);
+#if DBG
+            ptiCurrent->cRefObjectCo--;
+#endif
         }
     }
 
@@ -872,6 +875,8 @@ ExitThreadCallback(PETHREAD Thread)
     }
     ptiCurrent->hEventQueueClient = NULL;
 
+    ASSERT(ptiCurrent->cRefObjectCo == 0);
+
     /* The thread is dying */
     PsSetThreadWin32Thread(Thread /*ptiCurrent->pEThread*/, NULL, ptiCurrent);
 

win32ss/user/ntuser/object.h

@@ -34,6 +34,9 @@ UserRefObjectCo(PVOID obj, PUSER_REFERENCE_ENTRY UserReferenceEntry)
     UserReferenceEntry->obj = obj;
     UserReferenceObject(obj);
     PushEntryList(&W32Thread->ReferencesList, &UserReferenceEntry->Entry);
+#if DBG
+    W32Thread->cRefObjectCo++;
+#endif
 }
 
 static __inline VOID
@@ -53,6 +56,9 @@ UserDerefObjectCo(PVOID obj)
 
     ASSERT(obj == UserReferenceEntry->obj);
     UserDereferenceObject(obj);
+#if DBG
+    W32Thread->cRefObjectCo--;
+#endif
 }
 
 void FreeProcMarkObject(_In_ PVOID Object);

win32ss/user/ntuser/win32.h

@@ -158,6 +158,7 @@ typedef struct _THREADINFO
     ULONG cExclusiveLocks;
 #if DBG
     USHORT acExclusiveLockCount[GDIObjTypeTotal + 1];
+    UINT cRefObjectCo;
 #endif
 #endif // __cplusplus
 } THREADINFO;