[NtUser]

- Fix crash while mouse cursor is moving over stress test window (RegEdit). This fixes VLC too. Tested SeaMonkey and it did not crash. See CORE-9169 and CORE-9836.

svn path=/trunk/; revision=72080

reactos/win32ss/user/ntuser/cursoricon.c

@@ -226,6 +226,15 @@ PCURICON_OBJECT FASTCALL UserGetCurIconObject(HCURSOR hCurIcon)
     return CurIcon;
 }
 
+PCURICON_OBJECT
+IntSystemSetCursor(PCURICON_OBJECT pcurNew)
+{
+    PCURICON_OBJECT pcurOld = UserSetCursor(pcurNew, FALSE);
+    UserReferenceObject(pcurNew);
+    if (pcurOld) UserDereferenceObject(pcurOld);
+    return pcurOld;
+}
+
 BOOL UserSetCursorPos( INT x, INT y, DWORD flags, ULONG_PTR dwExtraInfo, BOOL Hook)
 {
     PWND DesktopWindow;
@@ -1062,9 +1071,12 @@ NtUserSetCursor(
     }
 
     pcurOld = UserSetCursor(pcurNew, FALSE);
-    if (pcurOld)
+
+    // If returning an old cursor than validate it, Justin Case!
+    if ( pcurOld &&
+        (pcurOld = UserGetObjectNoErr(gHandleTable, UserHMGetHandle(pcurOld), TYPE_CURSOR)))
     {
-        hOldCursor = pcurOld->head.h;
+        hOldCursor = UserHMGetHandle(pcurOld);
     /*
         Problem:
 
@@ -1078,12 +1090,12 @@ NtUserSetCursor(
         {
            TRACE("Returning Global Cursor hcur %p\n",hOldCursor);
 
-           if (pcurOld->head.cLockObj > 2) // Throttle down to 2.
+           /*if (pcurOld->head.cLockObj > 2) // Throttle down to 2.
            {
               UserDereferenceObject(pcurOld);
            }
 
-           goto leave;
+           goto leave;*/
         }
 
         /* See if it was destroyed in the meantime */

reactos/win32ss/user/ntuser/cursoricon.h

@@ -140,8 +140,6 @@ PCURICON_OBJECT FASTCALL UserGetCurIconObject(HCURSOR hCurIcon);
 BOOL UserSetCursorPos( INT x, INT y, DWORD flags, ULONG_PTR dwExtraInfo, BOOL Hook);
 BOOL APIENTRY UserClipCursor(RECTL *prcl);
 PSYSTEM_CURSORINFO IntGetSysCursorInfo(VOID);
-
-#define IntReleaseCurIconObject(CurIconObj) \
-  UserDereferenceObject(CurIconObj)
+PCURICON_OBJECT IntSystemSetCursor(PCURICON_OBJECT);
 
 /* EOF */

reactos/win32ss/user/ntuser/defwnd.c

@@ -307,7 +307,7 @@ DefWndHandleSetCursor(PWND pWnd, WPARAM wParam, LPARAM lParam)
       {
          if (pWnd->pcls->spcur)
          {
-            UserSetCursor(pWnd->pcls->spcur, FALSE);
+            IntSystemSetCursor(pWnd->pcls->spcur);
 	 }
 	 return FALSE;
       }
@@ -319,7 +319,7 @@ DefWndHandleSetCursor(PWND pWnd, WPARAM wParam, LPARAM lParam)
          {
             break;
          }
-         UserSetCursor(SYSTEMCUR(SIZEWE), FALSE);
+         IntSystemSetCursor(SYSTEMCUR(SIZEWE));
          return TRUE;
       }
 
@@ -330,7 +330,7 @@ DefWndHandleSetCursor(PWND pWnd, WPARAM wParam, LPARAM lParam)
          {
             break;
          }
-         UserSetCursor(SYSTEMCUR(SIZENS), FALSE);
+         IntSystemSetCursor(SYSTEMCUR(SIZENS));
          return TRUE;
        }
 
@@ -341,7 +341,7 @@ DefWndHandleSetCursor(PWND pWnd, WPARAM wParam, LPARAM lParam)
          {
             break;
          }
-         UserSetCursor(SYSTEMCUR(SIZENWSE), FALSE);
+         IntSystemSetCursor(SYSTEMCUR(SIZENWSE));
          return TRUE;
        }
 
@@ -352,11 +352,11 @@ DefWndHandleSetCursor(PWND pWnd, WPARAM wParam, LPARAM lParam)
          {
             break;
          }
-         UserSetCursor(SYSTEMCUR(SIZENESW), FALSE);
+         IntSystemSetCursor(SYSTEMCUR(SIZENESW));
          return TRUE;
        }
    }
-   UserSetCursor(SYSTEMCUR(ARROW), FALSE);
+   IntSystemSetCursor(SYSTEMCUR(ARROW));
    return FALSE;
 }
 

reactos/win32ss/user/ntuser/msgqueue.c

@@ -1516,7 +1516,7 @@ BOOL co_IntProcessMouseMessage(MSG* msg, BOOL* RemoveMessages, BOOL* NotForUs, L
     if (pwndMsg == NULL || pwndMsg->head.pti->MessageQueue != MessageQueue)
     {
         // Crossing a boundary, so set cursor. See default message queue cursor.
-        UserSetCursor(SYSTEMCUR(ARROW), FALSE);
+        IntSystemSetCursor(SYSTEMCUR(ARROW));
         /* Remove and ignore the message */
         *RemoveMessages = TRUE;
         return FALSE;