From 68180a507ad47ac4ac995125d181dccded45df76 Mon Sep 17 00:00:00 2001
From: James Tabor <james.tabor@reactos.org>
Date: Sat, 3 Oct 2009 02:30:47 +0000
Subject: [PATCH] - Prevent kernel bug check in win32k when calling a hook proc
 when thread is in cleanup. - This is not a hack and not a fix. Please retest
 related bug report applications. Tested Firefox 3.5 and the new putty. Need
 new debug print outs. ATM Ff 3.5 send out WH_JOURNALRECORD hook calls when
 the thread is in cleanup. Look like this: Thread is in cleanup and trying to
 call hook 0 - Reference bug 4298.

svn path=/trunk/; revision=43259
---
 reactos/subsystems/win32/win32k/main/dllmain.c    | 4 ++--
 reactos/subsystems/win32/win32k/ntuser/callback.c | 8 ++++++++
 reactos/subsystems/win32/win32k/ntuser/window.c   | 1 +
 3 files changed, 11 insertions(+), 2 deletions(-)

diff --git a/reactos/subsystems/win32/win32k/main/dllmain.c b/reactos/subsystems/win32/win32k/main/dllmain.c
index 51a9bd4dcce..84b92bf6d58 100644
--- a/reactos/subsystems/win32/win32k/main/dllmain.c
+++ b/reactos/subsystems/win32/win32k/main/dllmain.c
@@ -16,8 +16,7 @@
  *  along with this program; if not, write to the Free Software
  *  Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
  */
-/* $Id$
- *
+/*
  *  Entry Point for win32k.sys
  */
 
@@ -285,6 +284,7 @@ Win32kThreadCallback(struct _ETHREAD *Thread,
       DPRINT("Destroying W32 thread TID:%d at IRQ level: %lu\n", Thread->Cid.UniqueThread, KeGetCurrentIrql());
 
       Win32Thread->IsExiting = TRUE;
+      Win32Thread->TIF_flags |= TIF_INCLEANUP;
       HOOK_DestroyThreadHooks(Thread);
       UnregisterThreadHotKeys(Thread);
       /* what if this co_ func crash in umode? what will clean us up then? */
diff --git a/reactos/subsystems/win32/win32k/ntuser/callback.c b/reactos/subsystems/win32/win32k/ntuser/callback.c
index 69715c9103e..b8a8eb06f26 100644
--- a/reactos/subsystems/win32/win32k/ntuser/callback.c
+++ b/reactos/subsystems/win32/win32k/ntuser/callback.c
@@ -326,6 +326,14 @@ co_IntCallHookProc(INT HookId,
    UNICODE_STRING ClassName;
    PANSI_STRING asWindowName;
    PANSI_STRING asClassName;
+   PTHREADINFO pti;
+
+   pti = PsGetCurrentThreadWin32Thread();
+   if (pti->TIF_flags & TIF_INCLEANUP)
+   {
+      DPRINT1("Thread is in cleanup and trying to call hook %d\n", Code);
+      return 0;
+   }
 
    ArgumentLength = sizeof(HOOKPROC_CALLBACK_ARGUMENTS) - sizeof(WCHAR)
                     + ModuleName->Length;
diff --git a/reactos/subsystems/win32/win32k/ntuser/window.c b/reactos/subsystems/win32/win32k/ntuser/window.c
index d1b86184c53..896a9f903ac 100644
--- a/reactos/subsystems/win32/win32k/ntuser/window.c
+++ b/reactos/subsystems/win32/win32k/ntuser/window.c
@@ -425,6 +425,7 @@ static LRESULT co_UserFreeWindow(PWINDOW_OBJECT Window,
          co_IntSendMessage(Window->hSelf, WM_NCDESTROY, 0, 0);
    }
    MsqRemoveTimersWindow(ThreadData->MessageQueue, Window->hSelf);
+   HOOK_DestroyThreadHooks(ThreadData->pEThread); // This is needed here too!
 
    /* flush the message queue */
    MsqRemoveWindowMessagesFromQueue(Window);