- Fix the last two Ob reference counting bugs:

- Don't de-reference the object when duplicating it (not sure why this was left there). This fixes all the "misbehaving object: Event" messages in the console and fixes those regressions.
  - Don't reference the object when doing a lookup (not sure why this was there either). This made it impossible to kill named objects, since ObpDeleteNameCheck did a lookup before killing them, and the lookup ended up adding a reference.
- Cm still needs fixing!

svn path=/trunk/; revision=22692

reactos/include/ndk/rtlfuncs.h

@@ -2328,6 +2328,15 @@ RtlFindClearBitsAndSet(
     IN ULONG HintIndex
 );
 
+NTSYSAPI
+ULONG
+NTAPI
+RtlFindNextForwardRunClear(
+    IN PRTL_BITMAP BitMapHeader,
+    IN ULONG FromIndex,
+    IN PULONG StartingRunIndex
+);
+
 NTSYSAPI
 VOID
 NTAPI
@@ -2337,6 +2346,13 @@ RtlInitializeBitMap(
     IN ULONG SizeOfBitMap
 );
 
+NTSYSAPI
+ULONG
+NTAPI
+RtlNumberOfSetBits(
+    IN PRTL_BITMAP BitMapHeader
+);
+
 NTSYSAPI
 VOID
 NTAPI

reactos/ntoskrnl/ob/obdir.c

@@ -220,9 +220,6 @@ ObpLookupEntryDirectory(IN POBJECT_DIRECTORY Directory,
         /* Save the found object */
         FoundObject = CurrentEntry->Object;
         if (!FoundObject) goto Quickie;
-
-        /* Add a reference to the object */
-        ObReferenceObject(FoundObject);
     }
 
     /* Check if the directory was unlocked (which means we locked it) */

reactos/ntoskrnl/ob/obhandle.c

@@ -1382,7 +1382,6 @@ ObDuplicateObject(IN PEPROCESS SourceProcess,
     }
 
     /* Now create the handle */
-    ObDereferenceObject(SourceObject);
     NewHandle = ExCreateHandle(HandleTable, &NewHandleEntry);
     if (!NewHandle)
     {

reactos/ntoskrnl/ob/obname.c

@@ -102,6 +102,7 @@ ObpDeleteNameCheck(IN PVOID Object)
         /* Check if we were inserted in a directory */
         if (Directory)
         {
+            /* We were, so dereference the directory and the object as well */
             ObDereferenceObject(Directory);
             ObDereferenceObject(Object);
         }

reactos/ntoskrnl/ob/obref.c

@@ -88,7 +88,7 @@ ObfDereferenceObject(IN PVOID Object)
     /* Extract the object header */
     Header = OBJECT_TO_OBJECT_HEADER(Object);
 
-    if (Header->PointerCount <= Header->HandleCount)
+    if (Header->PointerCount < Header->HandleCount)
     {
         DPRINT1("Misbehaving object: %wZ\n", &Header->Type->Name);
         return;