- Fix crash while mouse cursor is moving over stress test window (RegEdit). This fixes VLC too. Tested SeaMonkey and it did not crash. See CORE-9169 and CORE-9836.

svn path=/trunk/; revision=72080
This commit is contained in:
James Tabor 2016-08-02 04:05:16 +00:00
parent c6db848176
commit d7cf4ae646
4 changed files with 24 additions and 14 deletions

View file

@ -226,6 +226,15 @@ PCURICON_OBJECT FASTCALL UserGetCurIconObject(HCURSOR hCurIcon)
return CurIcon; return CurIcon;
} }
PCURICON_OBJECT
IntSystemSetCursor(PCURICON_OBJECT pcurNew)
{
PCURICON_OBJECT pcurOld = UserSetCursor(pcurNew, FALSE);
UserReferenceObject(pcurNew);
if (pcurOld) UserDereferenceObject(pcurOld);
return pcurOld;
}
BOOL UserSetCursorPos( INT x, INT y, DWORD flags, ULONG_PTR dwExtraInfo, BOOL Hook) BOOL UserSetCursorPos( INT x, INT y, DWORD flags, ULONG_PTR dwExtraInfo, BOOL Hook)
{ {
PWND DesktopWindow; PWND DesktopWindow;
@ -1062,9 +1071,12 @@ NtUserSetCursor(
} }
pcurOld = UserSetCursor(pcurNew, FALSE); pcurOld = UserSetCursor(pcurNew, FALSE);
if (pcurOld)
// If returning an old cursor than validate it, Justin Case!
if ( pcurOld &&
(pcurOld = UserGetObjectNoErr(gHandleTable, UserHMGetHandle(pcurOld), TYPE_CURSOR)))
{ {
hOldCursor = pcurOld->head.h; hOldCursor = UserHMGetHandle(pcurOld);
/* /*
Problem: Problem:
@ -1078,12 +1090,12 @@ NtUserSetCursor(
{ {
TRACE("Returning Global Cursor hcur %p\n",hOldCursor); TRACE("Returning Global Cursor hcur %p\n",hOldCursor);
if (pcurOld->head.cLockObj > 2) // Throttle down to 2. /*if (pcurOld->head.cLockObj > 2) // Throttle down to 2.
{ {
UserDereferenceObject(pcurOld); UserDereferenceObject(pcurOld);
} }
goto leave; goto leave;*/
} }
/* See if it was destroyed in the meantime */ /* See if it was destroyed in the meantime */

View file

@ -140,8 +140,6 @@ PCURICON_OBJECT FASTCALL UserGetCurIconObject(HCURSOR hCurIcon);
BOOL UserSetCursorPos( INT x, INT y, DWORD flags, ULONG_PTR dwExtraInfo, BOOL Hook); BOOL UserSetCursorPos( INT x, INT y, DWORD flags, ULONG_PTR dwExtraInfo, BOOL Hook);
BOOL APIENTRY UserClipCursor(RECTL *prcl); BOOL APIENTRY UserClipCursor(RECTL *prcl);
PSYSTEM_CURSORINFO IntGetSysCursorInfo(VOID); PSYSTEM_CURSORINFO IntGetSysCursorInfo(VOID);
PCURICON_OBJECT IntSystemSetCursor(PCURICON_OBJECT);
#define IntReleaseCurIconObject(CurIconObj) \
UserDereferenceObject(CurIconObj)
/* EOF */ /* EOF */

View file

@ -307,7 +307,7 @@ DefWndHandleSetCursor(PWND pWnd, WPARAM wParam, LPARAM lParam)
{ {
if (pWnd->pcls->spcur) if (pWnd->pcls->spcur)
{ {
UserSetCursor(pWnd->pcls->spcur, FALSE); IntSystemSetCursor(pWnd->pcls->spcur);
} }
return FALSE; return FALSE;
} }
@ -319,7 +319,7 @@ DefWndHandleSetCursor(PWND pWnd, WPARAM wParam, LPARAM lParam)
{ {
break; break;
} }
UserSetCursor(SYSTEMCUR(SIZEWE), FALSE); IntSystemSetCursor(SYSTEMCUR(SIZEWE));
return TRUE; return TRUE;
} }
@ -330,7 +330,7 @@ DefWndHandleSetCursor(PWND pWnd, WPARAM wParam, LPARAM lParam)
{ {
break; break;
} }
UserSetCursor(SYSTEMCUR(SIZENS), FALSE); IntSystemSetCursor(SYSTEMCUR(SIZENS));
return TRUE; return TRUE;
} }
@ -341,7 +341,7 @@ DefWndHandleSetCursor(PWND pWnd, WPARAM wParam, LPARAM lParam)
{ {
break; break;
} }
UserSetCursor(SYSTEMCUR(SIZENWSE), FALSE); IntSystemSetCursor(SYSTEMCUR(SIZENWSE));
return TRUE; return TRUE;
} }
@ -352,11 +352,11 @@ DefWndHandleSetCursor(PWND pWnd, WPARAM wParam, LPARAM lParam)
{ {
break; break;
} }
UserSetCursor(SYSTEMCUR(SIZENESW), FALSE); IntSystemSetCursor(SYSTEMCUR(SIZENESW));
return TRUE; return TRUE;
} }
} }
UserSetCursor(SYSTEMCUR(ARROW), FALSE); IntSystemSetCursor(SYSTEMCUR(ARROW));
return FALSE; return FALSE;
} }

View file

@ -1516,7 +1516,7 @@ BOOL co_IntProcessMouseMessage(MSG* msg, BOOL* RemoveMessages, BOOL* NotForUs, L
if (pwndMsg == NULL || pwndMsg->head.pti->MessageQueue != MessageQueue) if (pwndMsg == NULL || pwndMsg->head.pti->MessageQueue != MessageQueue)
{ {
// Crossing a boundary, so set cursor. See default message queue cursor. // Crossing a boundary, so set cursor. See default message queue cursor.
UserSetCursor(SYSTEMCUR(ARROW), FALSE); IntSystemSetCursor(SYSTEMCUR(ARROW));
/* Remove and ignore the message */ /* Remove and ignore the message */
*RemoveMessages = TRUE; *RemoveMessages = TRUE;
return FALSE; return FALSE;