From a90234288ccc244fa3c7056da501b796644ae962 Mon Sep 17 00:00:00 2001
From: James Tabor <james.tabor@reactos.org>
Date: Mon, 6 Aug 2012 03:13:27 +0000
Subject: [PATCH] [NtUser] - Fixed crash, see bug 7226. - AttachThreadInput is
 new to ReactOS, it passes the wine tests, help is needed, white papers are
 welcome.

svn path=/trunk/; revision=57045
---
 reactos/win32ss/user/ntuser/input.c | 24 ++++++++++++++++++++++--
 reactos/win32ss/user/ntuser/input.h |  1 +
 reactos/win32ss/user/ntuser/main.c  | 15 +++++++++++++--
 3 files changed, 36 insertions(+), 4 deletions(-)

diff --git a/reactos/win32ss/user/ntuser/input.c b/reactos/win32ss/user/ntuser/input.c
index 83d1463305f..d4c2ed14981 100644
--- a/reactos/win32ss/user/ntuser/input.c
+++ b/reactos/win32ss/user/ntuser/input.c
@@ -394,6 +394,26 @@ NtUserBlockInput(
     return ret;
 }
 
+PTHREADINFO FASTCALL
+IsThreadAttach(PTHREADINFO ptiTo)
+{
+    PATTACHINFO pai;
+
+    if (!gpai) return NULL;
+
+    pai = gpai;
+    do
+    {
+        if (pai->pti2 == ptiTo) break;
+        pai = pai->paiNext;
+    } while (pai);
+
+    if (!pai) return NULL;
+
+    // Return ptiFrom.
+    return pai->pti1;
+}
+
 BOOL FASTCALL
 UserAttachThreadInput(PTHREADINFO ptiFrom, PTHREADINFO ptiTo, BOOL fAttach)
 {
@@ -419,7 +439,7 @@ UserAttachThreadInput(PTHREADINFO ptiFrom, PTHREADINFO ptiTo, BOOL fAttach)
         pai->pti1 = ptiFrom;
         pai->pti2 = ptiTo;
         gpai = pai;
-        TRACE("Attach Allocated! ptiFrom 0x%p  ptiTo 0x%p\n",ptiFrom,ptiTo);
+        ERR("Attach Allocated! ptiFrom 0x%p  ptiTo 0x%p\n",ptiFrom,ptiTo);
 
         ptiTo->MessageQueue->iCursorLevel -= ptiFrom->iCursorLevel;
         ptiFrom->pqAttach = ptiFrom->MessageQueue;
@@ -457,7 +477,7 @@ UserAttachThreadInput(PTHREADINFO ptiFrom, PTHREADINFO ptiTo, BOOL fAttach)
         if (paiprev) paiprev->paiNext = pai->paiNext;
 
         ExFreePoolWithTag(pai, USERTAG_ATTACHINFO);
-        TRACE("Attach Free! ptiFrom 0x%p  ptiTo 0x%p\n",ptiFrom,ptiTo);
+        ERR("Attach Free! ptiFrom 0x%p  ptiTo 0x%p\n",ptiFrom,ptiTo);
 
         ptiFrom->MessageQueue = ptiFrom->pqAttach;
         // FIXME: conditions?
diff --git a/reactos/win32ss/user/ntuser/input.h b/reactos/win32ss/user/ntuser/input.h
index 93c35615b20..a7456b01d71 100644
--- a/reactos/win32ss/user/ntuser/input.h
+++ b/reactos/win32ss/user/ntuser/input.h
@@ -63,6 +63,7 @@ INIT_FUNCTION NTSTATUS NTAPI InitInputImpl(VOID);
 BOOL FASTCALL IntBlockInput(PTHREADINFO W32Thread, BOOL BlockIt);
 DWORD NTAPI CreateSystemThreads(UINT Type);
 BOOL FASTCALL UserAttachThreadInput(PTHREADINFO,PTHREADINFO,BOOL);
+PTHREADINFO FASTCALL IsThreadAttach(PTHREADINFO);
 VOID FASTCALL DoTheScreenSaver(VOID);
 #define ThreadHasInputAccess(W32Thread) (TRUE)
 
diff --git a/reactos/win32ss/user/ntuser/main.c b/reactos/win32ss/user/ntuser/main.c
index ef8330d3a39..75b46daf6d7 100644
--- a/reactos/win32ss/user/ntuser/main.c
+++ b/reactos/win32ss/user/ntuser/main.c
@@ -247,6 +247,8 @@ UserCreateThreadInfo(struct _ETHREAD *Thread)
         return STATUS_NO_MEMORY;
     }
 
+    TRACE_CH(UserThread,"Create pti 0x%p eThread 0x%p\n", ptiCurrent, Thread);
+
     RtlZeroMemory(ptiCurrent, sizeof(THREADINFO));
 
     PsSetThreadWin32Thread(Thread, ptiCurrent);
@@ -391,7 +393,7 @@ UserDestroyThreadInfo(struct _ETHREAD *Thread)
 
     ASSERT(ptiCurrent);
 
-    TRACE_CH(UserThread,"Destroying pti 0x%p\n", ptiCurrent);
+    TRACE_CH(UserThread,"Destroying pti 0x%p eThread 0x%p\n", ptiCurrent, Thread);
 
     ptiCurrent->TIF_flags |= TIF_INCLEANUP;
     ptiCurrent->pClientInfo->dwTIFlags = ptiCurrent->TIF_flags;
@@ -470,11 +472,20 @@ UserDestroyThreadInfo(struct _ETHREAD *Thread)
         }
     }
 
+    // ptiTo
+    if (IsThreadAttach(ptiCurrent))
+    {
+       PTHREADINFO ptiFrom = IsThreadAttach(ptiCurrent);
+       TRACE_CH(UserThread,"Attached Thread ptiTo is getting switched!\n");
+       UserAttachThreadInput(ptiFrom, ptiCurrent, FALSE);
+    }
+    
+    // ptiFrom
     if (ptiCurrent->pqAttach && ptiCurrent->MessageQueue)
     {
        PTHREADINFO ptiTo;
        ptiTo = PsGetThreadWin32Thread(ptiCurrent->MessageQueue->Thread);
-       TRACE_CH(UserThread,"Attached Thread is getting switched!\n");
+       TRACE_CH(UserThread,"Attached Thread ptiFrom is getting switched!\n");
        UserAttachThreadInput( ptiCurrent, ptiTo, FALSE);
     }