- Update KTHREAD and KUSER_SHARED_DATA to latest versions. This should make 2K3 drive...
[reactos.git] / reactos / subsys / win32k / ntuser / painting.c
index f524074..acfcf84 100644 (file)
@@ -16,7 +16,7 @@
  *  along with this program; if not, write to the Free Software
  *  Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
  *
- *  $Id: painting.c,v 1.76 2004/03/13 17:33:53 gvg Exp $
+ *  $Id$
  *
  *  COPYRIGHT:        See COPYING in the top level directory
  *  PROJECT:          ReactOS kernel
 
 /* INCLUDES ******************************************************************/
 
-#include <ddk/ntddk.h>
-#include <internal/safe.h>
-#include <win32k/win32k.h>
-#include <include/object.h>
-#include <include/guicheck.h>
-#include <include/window.h>
-#include <include/desktop.h>
-#include <include/winpos.h>
-#include <include/class.h>
-#include <include/caret.h>
-#include <include/error.h>
-#include <include/winsta.h>
-#include <windows.h>
-#include <include/painting.h>
-#include <user32/wininternal.h>
-#include <include/rect.h>
-#include <win32k/coord.h>
-#include <win32k/region.h>
-#include <include/vis.h>
-#include <include/intgdi.h>
+#include <w32k.h>
 
 #define NDEBUG
-#include <win32k/debug1.h>
+#include <debug.h>
 
 /* PRIVATE FUNCTIONS **********************************************************/
 
+/**
+ * @name IntIntersectWithParents
+ *
+ * Intersect window rectangle with all parent client rectangles.
+ *
+ * @param Child
+ *        Pointer to child window to start intersecting from.
+ * @param WindowRect
+ *        Pointer to rectangle that we want to intersect in screen
+ *        coordinates on input and intersected rectangle on output (if TRUE
+ *        is returned).
+ *
+ * @return
+ *    If any parent is minimized or invisible or the resulting rectangle
+ *    is empty then FALSE is returned. Otherwise TRUE is returned.
+ */
+
+BOOL FASTCALL
+IntIntersectWithParents(PWINDOW_OBJECT Child, PRECT WindowRect)
+{
+   PWINDOW_OBJECT ParentWindow;
+
+   ParentWindow = Child->Parent;
+   while (ParentWindow != NULL)
+   {
+      if (!(ParentWindow->Style & WS_VISIBLE) ||
+          (ParentWindow->Style & WS_MINIMIZE))
+      {
+         return FALSE;
+      }
+
+      if (!IntGdiIntersectRect(WindowRect, WindowRect, &ParentWindow->ClientRect))
+      {
+         return FALSE;
+      }
+
+      /* FIXME: Layered windows. */
+
+      ParentWindow = ParentWindow->Parent;
+   }
+
+   return TRUE;
+}
+
 VOID FASTCALL
 IntValidateParent(PWINDOW_OBJECT Child, HRGN ValidRegion)
 {
-   PWINDOW_OBJECT ParentWindow = IntGetParentObject(Child), OldWindow;
+   PWINDOW_OBJECT ParentWindow = Child->Parent;
 
    while (ParentWindow)
    {
-      if (!(ParentWindow->Style & WS_CLIPCHILDREN))
+      if (ParentWindow->Style & WS_CLIPCHILDREN)
+         break;      
+
+      if (ParentWindow->UpdateRegion != 0)
       {
-         IntLockWindowUpdate(ParentWindow);
-         if (ParentWindow->UpdateRegion != 0)
-         {
-            INT OffsetX, OffsetY;
+         NtGdiCombineRgn(ParentWindow->UpdateRegion, ParentWindow->UpdateRegion,
+            ValidRegion, RGN_DIFF);
+         /* FIXME: If the resulting region is empty, remove fake posted paint message */
+      }
 
-            /*
-             * We must offset the child region by the offset of the
-             * child rect in the parent.
-             */
-            OffsetX = Child->WindowRect.left - ParentWindow->WindowRect.left;
-            OffsetY = Child->WindowRect.top - ParentWindow->WindowRect.top;
-            NtGdiOffsetRgn(ValidRegion, OffsetX, OffsetY);
-            NtGdiCombineRgn(ParentWindow->UpdateRegion, ParentWindow->UpdateRegion,
-               ValidRegion, RGN_DIFF);
-            /* FIXME: If the resulting region is empty, remove fake posted paint message */
-            NtGdiOffsetRgn(ValidRegion, -OffsetX, -OffsetY);
+      ParentWindow = ParentWindow->Parent;
+   }
+}
+
+/**
+ * @name IntCalcWindowRgn
+ *
+ * Get a window or client region.
+ */
+
+HRGN FASTCALL
+IntCalcWindowRgn(PWINDOW_OBJECT Window, BOOL Client)
+{
+   HRGN hRgnWindow;
+   UINT RgnType;
+
+   if (Client)
+      hRgnWindow = UnsafeIntCreateRectRgnIndirect(&Window->ClientRect);
+   else
+      hRgnWindow = UnsafeIntCreateRectRgnIndirect(&Window->WindowRect);
+
+   if (Window->WindowRegion != NULL && !(Window->Style & WS_MINIMIZE))
+   {
+      NtGdiOffsetRgn(hRgnWindow,
+         -Window->WindowRect.left,
+         -Window->WindowRect.top);
+      RgnType = NtGdiCombineRgn(hRgnWindow, hRgnWindow, Window->WindowRegion, RGN_AND);
+      NtGdiOffsetRgn(hRgnWindow,
+         Window->WindowRect.left,
+         Window->WindowRect.top);
+   }
+
+   return hRgnWindow;
+}
+
+/**
+ * @name IntGetNCUpdateRgn
+ *
+ * Get non-client update region of a window and optionally validate it.
+ *
+ * @param Window
+ *        Pointer to window to get the NC update region from.
+ * @param Validate
+ *        Set to TRUE to force validating the NC update region.
+ *
+ * @return
+ *    Handle to NC update region. The caller is responsible for deleting
+ *    it.
+ */
+
+HRGN FASTCALL
+IntGetNCUpdateRgn(PWINDOW_OBJECT Window, BOOL Validate)
+{
+   HRGN hRgnNonClient;
+   HRGN hRgnWindow;
+   UINT RgnType;
+   
+   if (Window->UpdateRegion != NULL &&
+       Window->UpdateRegion != (HRGN)1)
+   {
+      hRgnNonClient = NtGdiCreateRectRgn(0, 0, 0, 0);
+      hRgnWindow = IntCalcWindowRgn(Window, TRUE);
+
+      /*
+       * If region creation fails it's safe to fallback to whole
+       * window region.
+       */
+
+      if (hRgnNonClient == NULL)
+      {
+         return (HRGN)1;
+      }
+
+      RgnType = NtGdiCombineRgn(hRgnNonClient, Window->UpdateRegion,
+                                hRgnWindow, RGN_DIFF);
+      if (RgnType == ERROR)
+      {
+         NtGdiDeleteObject(hRgnNonClient);
+         return (HRGN)1;
+      }
+      else if (RgnType == NULLREGION)
+      {
+         NtGdiDeleteObject(hRgnNonClient);
+         return NULL;
+      }
+
+      /*
+       * Remove the nonclient region from the standard update region if
+       * we were asked for it.
+       */
+
+      if (Validate)
+      {
+         if (NtGdiCombineRgn(Window->UpdateRegion, Window->UpdateRegion,
+                             hRgnWindow, RGN_AND) == NULLREGION)
+         {
+            GDIOBJ_SetOwnership(Window->UpdateRegion, PsGetCurrentProcess());
+            NtGdiDeleteObject(Window->UpdateRegion);
+            Window->UpdateRegion = NULL;
+            if (!(Window->Flags & WINDOWOBJECT_NEED_INTERNALPAINT))
+               MsqDecPaintCountQueue(Window->MessageQueue);
          }
-         IntUnLockWindowUpdate(ParentWindow);
       }
-      OldWindow = ParentWindow;
-      ParentWindow = IntGetParentObject(ParentWindow);
-      IntReleaseWindowObject(OldWindow);
+
+      NtGdiDeleteObject(hRgnWindow);
+
+      return hRgnNonClient;
+   }
+   else
+   {
+      return Window->UpdateRegion;
    }
 }
 
@@ -97,102 +219,91 @@ IntValidateParent(PWINDOW_OBJECT Child, HRGN ValidRegion)
  */
 
 STATIC VOID FASTCALL
-IntPaintWindows(PWINDOW_OBJECT Window, ULONG Flags)
+co_IntPaintWindows(PWINDOW_OBJECT Window, ULONG Flags)
 {
-  HDC hDC;
-  HWND hWnd = Window->Self;
-  HRGN TempRegion;
-
-  if (Flags & (RDW_ERASENOW | RDW_UPDATENOW))
-    {
-      if (Window->Flags & WINDOWOBJECT_NEED_NCPAINT)
-        {
-          IntLockWindowUpdate(Window);
-          if (Window->NCUpdateRegion)
-            {
-              IntValidateParent(Window, Window->NCUpdateRegion);
-            }
-          TempRegion = Window->NCUpdateRegion;
-          if ((HANDLE) 1 != TempRegion && NULL != TempRegion)
-            {
-              GDIOBJ_SetOwnership(TempRegion, PsGetCurrentProcess());
-            }
-          Window->NCUpdateRegion = NULL;
-          Window->Flags &= ~WINDOWOBJECT_NEED_NCPAINT;
-          MsqDecPaintCountQueue(Window->MessageQueue);
-          IntUnLockWindowUpdate(Window);
-          IntSendMessage(hWnd, WM_NCPAINT, (WPARAM)TempRegion, 0);
-        }
-
-      if (Window->Flags & WINDOWOBJECT_NEED_ERASEBKGND)
-        {
-          if (Window->UpdateRegion)
-            {
-              IntValidateParent(Window, Window->UpdateRegion);
-              hDC = NtUserGetDCEx(hWnd, 0, DCX_CACHE | DCX_USESTYLE |
-                                           DCX_INTERSECTUPDATE);
-              if (hDC != NULL)
-                {
-                  if (IntSendMessage(hWnd, WM_ERASEBKGND, (WPARAM)hDC, 0))
-                    {
-                      Window->Flags &= ~WINDOWOBJECT_NEED_ERASEBKGND;
-                    }
-                  NtUserReleaseDC(hWnd, hDC);
-                }
-            }
-        }
+   HDC hDC;
+   HWND hWnd = Window->hSelf;
+   HRGN TempRegion;
+
+   if (Flags & (RDW_ERASENOW | RDW_UPDATENOW))
+   {
+      if (Window->UpdateRegion)
+      {
+         IntValidateParent(Window, Window->UpdateRegion);
+      }
 
       if (Flags & RDW_UPDATENOW)
-        {
-          if (Window->UpdateRegion != NULL ||
-              Window->Flags & WINDOWOBJECT_NEED_INTERNALPAINT)
+      {
+         if (Window->UpdateRegion != NULL ||
+             Window->Flags & WINDOWOBJECT_NEED_INTERNALPAINT)
+         {
+            co_IntSendMessage(hWnd, WM_PAINT, 0, 0);
+         }
+      }
+      else
+      {
+         if (Window->Flags & WINDOWOBJECT_NEED_NCPAINT)
+         {
+            TempRegion = IntGetNCUpdateRgn(Window, TRUE);
+            Window->Flags &= ~WINDOWOBJECT_NEED_NCPAINT;
+            MsqDecPaintCountQueue(Window->MessageQueue);
+            co_IntSendMessage(hWnd, WM_NCPAINT, (WPARAM)TempRegion, 0);
+            if ((HANDLE) 1 != TempRegion && NULL != TempRegion)
             {
-              IntSendMessage(hWnd, WM_PAINT, 0, 0);
-              IntLockWindowUpdate(Window);
-              if (Window->Flags & WINDOWOBJECT_NEED_INTERNALPAINT)
-                {
-                  Window->Flags &= ~WINDOWOBJECT_NEED_INTERNALPAINT;
-                  if (Window->UpdateRegion == NULL)
-                    {
-                      MsqDecPaintCountQueue(Window->MessageQueue);
-                    }
-                }
-              IntUnLockWindowUpdate(Window);
+               /* NOTE: The region can already be deleted! */
+               GDIOBJ_FreeObj(TempRegion, GDI_OBJECT_TYPE_REGION | GDI_OBJECT_TYPE_SILENT);
             }
-        }
-    }
+         }
 
-  /*
-   * Check that the window is still valid at this point
-   */
+         if (Window->Flags & WINDOWOBJECT_NEED_ERASEBKGND)
+         {
+            if (Window->UpdateRegion)
+            {
+               hDC = UserGetDCEx(Window, Window->UpdateRegion,
+                                 DCX_CACHE | DCX_USESTYLE |
+                                 DCX_INTERSECTRGN | DCX_KEEPCLIPRGN);
+               if (co_IntSendMessage(hWnd, WM_ERASEBKGND, (WPARAM)hDC, 0))
+               {
+                  Window->Flags &= ~WINDOWOBJECT_NEED_ERASEBKGND;
+               }
+               UserReleaseDC(Window, hDC, FALSE);
+            }
+         }
+      }
+   }
 
-  if (! IntIsWindow(hWnd))
-    {
+   /*
+    * Check that the window is still valid at this point
+    */
+   if (!IntIsWindow(hWnd))
+   {
       return;
-    }
-
-  /*
-   * Paint child windows.
-   */
-  if (!(Flags & RDW_NOCHILDREN) && !(Window->Style & WS_MINIMIZE) &&
-      ((Flags & RDW_ALLCHILDREN) || !(Window->Style & WS_CLIPCHILDREN)))
-    {
+   }
+
+   /*
+    * Paint child windows.
+    */
+   if (!(Flags & RDW_NOCHILDREN) && !(Window->Style & WS_MINIMIZE) &&
+       ((Flags & RDW_ALLCHILDREN) || !(Window->Style & WS_CLIPCHILDREN)))
+   {
       HWND *List, *phWnd;
 
       if ((List = IntWinListChildren(Window)))
-        {
-          for (phWnd = List; *phWnd; ++phWnd)
+      {
+         for (phWnd = List; *phWnd; ++phWnd)
+         {
+            Window = UserGetWindowObject(*phWnd);
+            if (Window && (Window->Style & WS_VISIBLE))
             {
-              Window = IntGetWindowObject(*phWnd);
-              if (Window && (Window->Style & WS_VISIBLE))
-                {
-                  IntPaintWindows(Window, Flags);
-                  IntReleaseWindowObject(Window);
-                }
+               USER_REFERENCE_ENTRY Ref;
+               UserRefObjectCo(Window, &Ref);
+               co_IntPaintWindows(Window, Flags);
+               UserDerefObjectCo(Window);
             }
-          ExFreePool(List);
-        }
-    }
+         }
+         ExFreePool(List);
+      }
+   }
 }
 
 /*
@@ -212,33 +323,31 @@ IntInvalidateWindows(PWINDOW_OBJECT Window, HRGN hRgn, ULONG Flags)
     * Clip the given region with window rectangle (or region)
     */
 
-#ifdef TODO
-   if (!Window->WindowRegion)
-#endif
+   if (!Window->WindowRegion || (Window->Style & WS_MINIMIZE))
    {
       HRGN hRgnWindow;
 
       hRgnWindow = UnsafeIntCreateRectRgnIndirect(&Window->WindowRect);
-      NtGdiOffsetRgn(hRgnWindow,
-         -Window->WindowRect.left,
-         -Window->WindowRect.top);
       RgnType = NtGdiCombineRgn(hRgn, hRgn, hRgnWindow, RGN_AND);
       NtGdiDeleteObject(hRgnWindow);
    }
-#ifdef TODO
    else
    {
-      RgnType = NtGdiCombineRgn(hRgn, hRgn, Window->WindowRegion, RGN_AND);        
+      NtGdiOffsetRgn(hRgn,
+         -Window->WindowRect.left,
+         -Window->WindowRect.top);
+      RgnType = NtGdiCombineRgn(hRgn, hRgn, Window->WindowRegion, RGN_AND);
+      NtGdiOffsetRgn(hRgn,
+         Window->WindowRect.left,
+         Window->WindowRect.top);
    }
-#endif
 
    /*
     * Save current state of pending updates
     */
 
-   IntLockWindowUpdate(Window);
    HadPaintMessage = Window->UpdateRegion != NULL ||
-      Window->Flags & WINDOWOBJECT_NEED_INTERNALPAINT;
+                     Window->Flags & WINDOWOBJECT_NEED_INTERNALPAINT;
    HadNCPaintMessage = Window->Flags & WINDOWOBJECT_NEED_NCPAINT;
 
    /*
@@ -254,7 +363,7 @@ IntInvalidateWindows(PWINDOW_OBJECT Window, HRGN hRgn, ULONG Flags)
       }
 
       if (NtGdiCombineRgn(Window->UpdateRegion, Window->UpdateRegion,
-          hRgn, RGN_OR) == NULLREGION)
+                          hRgn, RGN_OR) == NULLREGION)
       {
          GDIOBJ_SetOwnership(Window->UpdateRegion, PsGetCurrentProcess());
          NtGdiDeleteObject(Window->UpdateRegion);
@@ -274,7 +383,7 @@ IntInvalidateWindows(PWINDOW_OBJECT Window, HRGN hRgn, ULONG Flags)
       if (Window->UpdateRegion != NULL)
       {
          if (NtGdiCombineRgn(Window->UpdateRegion, Window->UpdateRegion,
-             hRgn, RGN_DIFF) == NULLREGION)
+                             hRgn, RGN_DIFF) == NULLREGION)
          {
             GDIOBJ_SetOwnership(Window->UpdateRegion, PsGetCurrentProcess());
             NtGdiDeleteObject(Window->UpdateRegion);
@@ -300,93 +409,28 @@ IntInvalidateWindows(PWINDOW_OBJECT Window, HRGN hRgn, ULONG Flags)
       Window->Flags &= ~WINDOWOBJECT_NEED_INTERNALPAINT;
    }
 
-   /*
-    * Split the nonclient update region.
-    */
-
-   {
-      HRGN hRgnWindow, hRgnNonClient;
-
-      hRgnWindow = UnsafeIntCreateRectRgnIndirect(&Window->ClientRect);
-      NtGdiOffsetRgn(hRgnWindow,
-         -Window->WindowRect.left,
-         -Window->WindowRect.top);
-
-      hRgnNonClient = NtGdiCreateRectRgn(0, 0, 0, 0);
-      GDIOBJ_SetOwnership(hRgnNonClient, NULL);
-      if (NtGdiCombineRgn(hRgnNonClient, Window->UpdateRegion,
-          hRgnWindow, RGN_DIFF) == NULLREGION)
-      {
-         GDIOBJ_SetOwnership(hRgnNonClient, PsGetCurrentProcess());
-         NtGdiDeleteObject(hRgnNonClient);
-         hRgnNonClient = NULL;
-      }
-
-      /*
-       * Remove the nonclient region from the standard update region.
-       */
-
-      if (NtGdiCombineRgn(Window->UpdateRegion, Window->UpdateRegion,
-          hRgnWindow, RGN_AND) == NULLREGION)
-      {
-         GDIOBJ_SetOwnership(Window->UpdateRegion, PsGetCurrentProcess());
-         NtGdiDeleteObject(Window->UpdateRegion);
-         Window->UpdateRegion = NULL;
-      }
-
-      if (Window->NCUpdateRegion == NULL)
-      {
-         Window->NCUpdateRegion = hRgnNonClient;
-      }
-      else
-      {
-         NtGdiCombineRgn(Window->NCUpdateRegion, Window->NCUpdateRegion,
-            hRgnNonClient, RGN_OR);
-         if (NULL != hRgnNonClient)
-         {
-            GDIOBJ_SetOwnership(hRgnNonClient, PsGetCurrentProcess());
-            NtGdiDeleteObject(hRgnNonClient);
-         }
-      }
-
-      NtGdiDeleteObject(hRgnWindow);
-   }
-
    /*
     * Process children if needed
     */
 
    if (!(Flags & RDW_NOCHILDREN) && !(Window->Style & WS_MINIMIZE) &&
-       ((Flags & RDW_ALLCHILDREN) || !(Window->Style & WS_CLIPCHILDREN)))
+         ((Flags & RDW_ALLCHILDREN) || !(Window->Style & WS_CLIPCHILDREN)))
    {
-      HWND *List, *phWnd;
       PWINDOW_OBJECT Child;
 
-      if ((List = IntWinListChildren(Window)))
+      for (Child = Window->FirstChild; Child; Child = Child->NextSibling)
       {
-         for (phWnd = List; *phWnd; ++phWnd)
+         if (Child->Style & WS_VISIBLE)
          {
-            Child = IntGetWindowObject(*phWnd);
-            if(!Child)
-            {
-              continue;
-            }
-            if (Child->Style & WS_VISIBLE)
-            {
-               /*
-                * Recursive call to update children UpdateRegion
-                */
-               HRGN hRgnTemp = NtGdiCreateRectRgn(0, 0, 0, 0);
-               NtGdiCombineRgn(hRgnTemp, hRgn, 0, RGN_COPY);
-               NtGdiOffsetRgn(hRgnTemp,
-                  Window->WindowRect.left - Child->WindowRect.left,
-                  Window->WindowRect.top - Child->WindowRect.top);
-               IntInvalidateWindows(Child, hRgnTemp, Flags);
-               NtGdiDeleteObject(hRgnTemp);
-            }
-            IntReleaseWindowObject(Child);
+            /*
+             * Recursive call to update children UpdateRegion
+             */
+            HRGN hRgnTemp = NtGdiCreateRectRgn(0, 0, 0, 0);
+            NtGdiCombineRgn(hRgnTemp, hRgn, 0, RGN_COPY);
+            IntInvalidateWindows(Child, hRgnTemp, Flags);
+            NtGdiDeleteObject(hRgnTemp);
          }
-         ExFreePool(List);
+
       }
    }
 
@@ -395,7 +439,7 @@ IntInvalidateWindows(PWINDOW_OBJECT Window, HRGN hRgn, ULONG Flags)
     */
 
    HasPaintMessage = Window->UpdateRegion != NULL ||
-         Window->Flags & WINDOWOBJECT_NEED_INTERNALPAINT;
+                     Window->Flags & WINDOWOBJECT_NEED_INTERNALPAINT;
    HasNCPaintMessage = Window->Flags & WINDOWOBJECT_NEED_NCPAINT;
 
    if (HasPaintMessage != HadPaintMessage)
@@ -414,7 +458,6 @@ IntInvalidateWindows(PWINDOW_OBJECT Window, HRGN hRgn, ULONG Flags)
          MsqIncPaintCountQueue(Window->MessageQueue);
    }
 
-   IntUnLockWindowUpdate(Window);
 }
 
 /*
@@ -428,21 +471,16 @@ IntInvalidateWindows(PWINDOW_OBJECT Window, HRGN hRgn, ULONG Flags)
 BOOL FASTCALL
 IntIsWindowDrawable(PWINDOW_OBJECT Window)
 {
-   PWINDOW_OBJECT Old, Wnd = Window;
-   
-   IntReferenceWindowObject(Wnd);
-   do
+   PWINDOW_OBJECT Wnd;
+
+   for (Wnd = Window; Wnd != NULL; Wnd = Wnd->Parent)
    {
       if (!(Wnd->Style & WS_VISIBLE) ||
-          ((Wnd->Style & WS_MINIMIZE) && (Wnd != Window)))
+            ((Wnd->Style & WS_MINIMIZE) && (Wnd != Window)))
       {
-         IntReleaseWindowObject(Wnd);
          return FALSE;
       }
-      Old = Wnd;
-      Wnd = IntGetParentObject(Wnd);
-      IntReleaseWindowObject(Old);
-   } while(Wnd);
+   }
 
    return TRUE;
 }
@@ -455,8 +493,8 @@ IntIsWindowDrawable(PWINDOW_OBJECT Window)
  */
 
 BOOL FASTCALL
-IntRedrawWindow(PWINDOW_OBJECT Window, const RECT* UpdateRect, HRGN UpdateRgn,
-   ULONG Flags)
+co_UserRedrawWindow(PWINDOW_OBJECT Window, const RECT* UpdateRect, HRGN UpdateRgn,
+                    ULONG Flags)
 {
    HRGN hRgn = NULL;
 
@@ -466,8 +504,8 @@ IntRedrawWindow(PWINDOW_OBJECT Window, const RECT* UpdateRect, HRGN UpdateRgn,
     */
 
    if (!IntIsWindowDrawable(Window) ||
-       (Flags & (RDW_VALIDATE | RDW_INVALIDATE)) ==
-       (RDW_VALIDATE | RDW_INVALIDATE))
+         (Flags & (RDW_VALIDATE | RDW_INVALIDATE)) ==
+         (RDW_VALIDATE | RDW_INVALIDATE))
    {
       return FALSE;
    }
@@ -475,7 +513,7 @@ IntRedrawWindow(PWINDOW_OBJECT Window, const RECT* UpdateRect, HRGN UpdateRgn,
    /*
     * Step 2.
     * Transform the parameters UpdateRgn and UpdateRect into
-    * a region hRgn specified in window coordinates.
+    * a region hRgn specified in screen coordinates.
     */
 
    if (Flags & (RDW_INVALIDATE | RDW_VALIDATE))
@@ -483,32 +521,29 @@ IntRedrawWindow(PWINDOW_OBJECT Window, const RECT* UpdateRect, HRGN UpdateRgn,
       if (UpdateRgn != NULL)
       {
          hRgn = NtGdiCreateRectRgn(0, 0, 0, 0);
-         NtGdiCombineRgn(hRgn, UpdateRgn, NULL, RGN_COPY);
-         NtGdiOffsetRgn(hRgn, 
-            Window->ClientRect.left - Window->WindowRect.left,
-            Window->ClientRect.top - Window->WindowRect.top);
-      } else
-      if (UpdateRect != NULL)
+         if (NtGdiCombineRgn(hRgn, UpdateRgn, NULL, RGN_COPY) == NULLREGION)
+            NtGdiDeleteObject(hRgn);
+         else
+            NtGdiOffsetRgn(hRgn, Window->ClientRect.left, Window->ClientRect.top);
+      }
+      else if (UpdateRect != NULL)
       {
-         hRgn = UnsafeIntCreateRectRgnIndirect((RECT *)UpdateRect);
-         NtGdiOffsetRgn(hRgn, 
-            Window->ClientRect.left - Window->WindowRect.left,
-            Window->ClientRect.top - Window->WindowRect.top);
-      } else
-      if ((Flags & (RDW_INVALIDATE | RDW_FRAME)) == (RDW_INVALIDATE | RDW_FRAME) ||
-          (Flags & (RDW_VALIDATE | RDW_NOFRAME)) == (RDW_VALIDATE | RDW_NOFRAME))
+         if (!IntGdiIsEmptyRect(UpdateRect))
+         {
+            hRgn = UnsafeIntCreateRectRgnIndirect((RECT *)UpdateRect);
+            NtGdiOffsetRgn(hRgn, Window->ClientRect.left, Window->ClientRect.top);
+         }
+      }
+      else if ((Flags & (RDW_INVALIDATE | RDW_FRAME)) == (RDW_INVALIDATE | RDW_FRAME) ||
+               (Flags & (RDW_VALIDATE | RDW_NOFRAME)) == (RDW_VALIDATE | RDW_NOFRAME))
       {
-         hRgn = UnsafeIntCreateRectRgnIndirect(&Window->WindowRect);
-         NtGdiOffsetRgn(hRgn, 
-            -Window->WindowRect.left,
-            -Window->WindowRect.top);
+         if (!IntGdiIsEmptyRect(&Window->WindowRect))
+            hRgn = UnsafeIntCreateRectRgnIndirect(&Window->WindowRect);
       }
       else
       {
-         hRgn = UnsafeIntCreateRectRgnIndirect(&Window->ClientRect);
-         NtGdiOffsetRgn(hRgn, 
-            -Window->WindowRect.left,
-            -Window->WindowRect.top);
+         if (!IntGdiIsEmptyRect(&Window->ClientRect))
+            hRgn = UnsafeIntCreateRectRgnIndirect(&Window->ClientRect);
       }
    }
 
@@ -517,7 +552,8 @@ IntRedrawWindow(PWINDOW_OBJECT Window, const RECT* UpdateRect, HRGN UpdateRgn,
     * Adjust the window update region depending on hRgn and flags.
     */
 
-   if (Flags & (RDW_INVALIDATE | RDW_VALIDATE | RDW_INTERNALPAINT | RDW_NOINTERNALPAINT))
+   if (Flags & (RDW_INVALIDATE | RDW_VALIDATE | RDW_INTERNALPAINT | RDW_NOINTERNALPAINT) &&
+       hRgn != NULL)
    {
       IntInvalidateWindows(Window, hRgn, Flags);
    }
@@ -529,7 +565,7 @@ IntRedrawWindow(PWINDOW_OBJECT Window, const RECT* UpdateRect, HRGN UpdateRgn,
 
    if (Flags & (RDW_ERASENOW | RDW_UPDATENOW))
    {
-      IntPaintWindows(Window, Flags);
+      co_IntPaintWindows(Window, Flags);
    }
 
    /*
@@ -549,158 +585,118 @@ BOOL FASTCALL
 IntIsWindowDirty(PWINDOW_OBJECT Window)
 {
    return (Window->Style & WS_VISIBLE) &&
-      ((Window->UpdateRegion != NULL) ||
-       (Window->Flags & WINDOWOBJECT_NEED_INTERNALPAINT) ||
-       (Window->Flags & WINDOWOBJECT_NEED_NCPAINT));
+          ((Window->UpdateRegion != NULL) ||
+           (Window->Flags & WINDOWOBJECT_NEED_INTERNALPAINT) ||
+           (Window->Flags & WINDOWOBJECT_NEED_NCPAINT));
 }
 
-HWND STDCALL
-IntFindWindowToRepaint(HWND hWnd, PW32THREAD Thread)
+HWND FASTCALL
+IntFindWindowToRepaint(PWINDOW_OBJECT Window, PW32THREAD Thread)
 {
-   PWINDOW_OBJECT Window;
-   PWINDOW_OBJECT Child;
-   HWND hFoundWnd = NULL;
-
-   Window = IntGetWindowObject(hWnd);
-   if (Window == NULL)
-      return NULL;
-
-   if (IntIsWindowDirty(Window) && 
-       IntWndBelongsToThread(Window, Thread))
-   {
-      IntReleaseWindowObject(Window);
-      return hWnd;
-   }
+   HWND hChild;
+   PWINDOW_OBJECT TempWindow;
 
-   IntLockRelatives(Window);
-   for (Child = Window->FirstChild; Child; Child = Child->NextSibling)
+   for (; Window != NULL; Window = Window->NextSibling)
    {
-      if (IntIsWindowDirty(Child) &&
-          IntWndBelongsToThread(Child, Thread))
+      if (IntWndBelongsToThread(Window, Thread) &&
+          IntIsWindowDirty(Window))
       {
-         hFoundWnd = Child->Self;
-         break;
-      }
-   }
-   IntUnLockRelatives(Window);
+         /* Make sure all non-transparent siblings are already drawn. */
+         if (Window->ExStyle & WS_EX_TRANSPARENT)
+         {
+            for (TempWindow = Window->NextSibling; TempWindow != NULL;
+                 TempWindow = TempWindow->NextSibling)
+            {
+               if (!(TempWindow->ExStyle & WS_EX_TRANSPARENT) &&
+                   IntWndBelongsToThread(TempWindow, Thread) &&
+                   IntIsWindowDirty(TempWindow))
+               {
+                  return TempWindow->hSelf;
+               }
+            }
+         }
 
-   if (hFoundWnd == NULL)
-   {
-      HWND *List;
-      INT i;
+         return Window->hSelf;
+      }
 
-      List = IntWinListChildren(Window);
-      if (List != NULL)
+      if (Window->FirstChild)
       {
-         for (i = 0; List[i]; i++)
-         {
-            hFoundWnd = IntFindWindowToRepaint(List[i], Thread);
-            if (hFoundWnd != NULL)
-               break;
-         }
-         ExFreePool(List);
+         hChild = IntFindWindowToRepaint(Window->FirstChild, Thread);
+         if (hChild != NULL)
+            return hChild;
       }
    }
 
-   IntReleaseWindowObject(Window);
-
-   return hFoundWnd;
+   return NULL;
 }
 
 BOOL FASTCALL
-IntGetPaintMessage(HWND hWnd, PW32THREAD Thread, MSG *Message,
-   BOOL Remove)
+IntGetPaintMessage(HWND hWnd, UINT MsgFilterMin, UINT MsgFilterMax,
+                   PW32THREAD Thread, MSG *Message, BOOL Remove)
 {
-   PWINDOW_OBJECT Window;
    PUSER_MESSAGE_QUEUE MessageQueue = (PUSER_MESSAGE_QUEUE)Thread->MessageQueue;
 
-   if (!MessageQueue->PaintPosted)
+   if (!MessageQueue->PaintCount)
       return FALSE;
 
-   if (hWnd)
-      Message->hwnd = IntFindWindowToRepaint(hWnd, PsGetWin32Thread());
-   else
-      Message->hwnd = IntFindWindowToRepaint(IntGetDesktopWindow(), PsGetWin32Thread());
+   if ((MsgFilterMin != 0 || MsgFilterMax != 0) &&
+         (MsgFilterMin > WM_PAINT || MsgFilterMax < WM_PAINT))
+      return FALSE;
+
+   Message->hwnd = IntFindWindowToRepaint(UserGetDesktopWindow(), PsGetWin32Thread());
 
    if (Message->hwnd == NULL)
    {
-#if 0
       DPRINT1("PAINTING BUG: Thread marked as containing dirty windows, but no dirty windows found!\n");
-#endif
-      IntLockMessageQueue(MessageQueue);
-      MessageQueue->PaintPosted = 0;
-      MessageQueue->PaintCount = 0;
-      IntUnLockMessageQueue(MessageQueue);
       return FALSE;
    }
 
-   Window = IntGetWindowObject(Message->hwnd);
-   if (Window != NULL)
-   {
-      IntLockWindowUpdate(Window);
-      if (Window->Flags & WINDOWOBJECT_NEED_NCPAINT)
-      {
-         Message->message = WM_NCPAINT;
-         Message->wParam = (WPARAM)Window->NCUpdateRegion;
-         Message->lParam = 0;
-         if (Remove)
-         {
-            IntValidateParent(Window, Window->NCUpdateRegion);
-            Window->NCUpdateRegion = NULL;
-            Window->Flags &= ~WINDOWOBJECT_NEED_NCPAINT;
-            MsqDecPaintCountQueue(Window->MessageQueue);
-         }
-      } else
-      {
-         Message->message = WM_PAINT;
-         Message->wParam = Message->lParam = 0;
-         if (Remove && Window->Flags & WINDOWOBJECT_NEED_INTERNALPAINT)
-         {
-            Window->Flags &= ~WINDOWOBJECT_NEED_INTERNALPAINT;
-            if (Window->UpdateRegion == NULL)
-            {
-               MsqDecPaintCountQueue(Window->MessageQueue);
-            }
-         }
-      }
-      IntUnLockWindowUpdate(Window);
+   if (hWnd != NULL && Message->hwnd != hWnd)
+      return FALSE;
 
-      IntReleaseWindowObject(Window);
-      return TRUE;
-   }
+   Message->message = WM_PAINT;
+   Message->wParam = Message->lParam = 0;
 
-   return FALSE;
+   return TRUE;
 }
 
+static
 HWND FASTCALL
-IntFixCaret(HWND hWnd, LPRECT lprc, UINT flags)
+co_IntFixCaret(PWINDOW_OBJECT Window, LPRECT lprc, UINT flags)
 {
    PDESKTOP_OBJECT Desktop;
    PTHRDCARETINFO CaretInfo;
    HWND hWndCaret;
+   PWINDOW_OBJECT WndCaret;
+
+   ASSERT_REFS_CO(Window);
 
-   Desktop = PsGetCurrentThread()->Win32Thread->Desktop;
+   Desktop = ((PW32THREAD)PsGetCurrentThread()->Tcb.Win32Thread)->Desktop;
    CaretInfo = ((PUSER_MESSAGE_QUEUE)Desktop->ActiveMessageQueue)->CaretInfo;
    hWndCaret = CaretInfo->hWnd;
-   if (hWndCaret == hWnd ||
-       ((flags & SW_SCROLLCHILDREN) && IntIsChildWindow(hWnd, hWndCaret)))
+
+   WndCaret = UserGetWindowObject(hWndCaret);
+
+   //fix: check for WndCaret can be null
+   if (WndCaret == Window ||
+         ((flags & SW_SCROLLCHILDREN) && IntIsChildWindow(Window, WndCaret)))
    {
       POINT pt, FromOffset, ToOffset, Offset;
       RECT rcCaret;
-      
+
       pt.x = CaretInfo->Pos.x;
       pt.y = CaretInfo->Pos.y;
-      IntGetClientOrigin(hWndCaret, &FromOffset);
-      IntGetClientOrigin(hWnd, &ToOffset);
+      IntGetClientOrigin(WndCaret, &FromOffset);
+      IntGetClientOrigin(Window, &ToOffset);
       Offset.x = FromOffset.x - ToOffset.x;
       Offset.y = FromOffset.y - ToOffset.y;
       rcCaret.left = pt.x;
       rcCaret.top = pt.y;
       rcCaret.right = pt.x + CaretInfo->Size.cx;
       rcCaret.bottom = pt.y + CaretInfo->Size.cy;
-      if (NtGdiIntersectRect(lprc, lprc, &rcCaret))
+      if (IntGdiIntersectRect(lprc, lprc, &rcCaret))
       {
-         NtUserHideCaret(0);
+         co_UserHideCaret(0);
          lprc->left = pt.x;
          lprc->top = pt.y;
          return hWndCaret;
@@ -720,59 +716,106 @@ IntFixCaret(HWND hWnd, LPRECT lprc, UINT flags)
  */
 
 HDC STDCALL
-NtUserBeginPaint(HWND hWnd, PAINTSTRUCT* lPs)
+NtUserBeginPaint(HWND hWnd, PAINTSTRUCT* UnsafePs)
 {
-   PWINDOW_OBJECT Window;
+   PWINDOW_OBJECT Window = NULL;
+   PAINTSTRUCT Ps;
+   PROSRGNDATA Rgn;
+   NTSTATUS Status;
+   DECLARE_RETURN(HDC);
+   USER_REFERENCE_ENTRY Ref;
+
+   DPRINT("Enter NtUserBeginPaint\n");
+   UserEnterExclusive();
 
-   if (!(Window = IntGetWindowObject(hWnd)))
+   if (!(Window = UserGetWindowObject(hWnd)))
    {
-      SetLastWin32Error(ERROR_INVALID_WINDOW_HANDLE);
-      return NULL;
+      RETURN( NULL);
    }
 
-   NtUserHideCaret(hWnd);
+   UserRefObjectCo(Window, &Ref);
+   
+   co_UserHideCaret(Window);
+
+   if (Window->Flags & WINDOWOBJECT_NEED_NCPAINT)
+   {
+      HRGN hRgn;
+
+      hRgn = IntGetNCUpdateRgn(Window, FALSE);
+      Window->Flags &= ~WINDOWOBJECT_NEED_NCPAINT;
+      MsqDecPaintCountQueue(Window->MessageQueue);
+      co_IntSendMessage(hWnd, WM_NCPAINT, (WPARAM)hRgn, 0);
+      if (hRgn != (HANDLE)1 && hRgn != NULL)
+      {
+         /* NOTE: The region can already by deleted! */
+         GDIOBJ_FreeObj(hRgn, GDI_OBJECT_TYPE_REGION | GDI_OBJECT_TYPE_SILENT);
+      }
+   }
 
-   lPs->hdc = NtUserGetDCEx(hWnd, 0, DCX_INTERSECTUPDATE | DCX_WINDOWPAINT |
-      DCX_USESTYLE);
+   RtlZeroMemory(&Ps, sizeof(PAINTSTRUCT));
 
-   if (!lPs->hdc)
+   Ps.hdc = UserGetDCEx(Window, Window->UpdateRegion, DCX_INTERSECTRGN | DCX_USESTYLE);
+   if (!Ps.hdc)
    {
-      IntReleaseWindowObject(Window);
-      return NULL;
+      RETURN(NULL);
    }
 
-   IntLockWindowUpdate(Window);
    if (Window->UpdateRegion != NULL)
    {
       MsqDecPaintCountQueue(Window->MessageQueue);
-      IntValidateParent(Window, Window->UpdateRegion);
-      NtGdiGetRgnBox(Window->UpdateRegion, &lPs->rcPaint);
-      NtGdiOffsetRect(&lPs->rcPaint,
-         Window->WindowRect.left - Window->ClientRect.left,
-         Window->WindowRect.top - Window->ClientRect.top);
+      Rgn = RGNDATA_LockRgn(Window->UpdateRegion);
+      if (NULL != Rgn)
+      {
+         UnsafeIntGetRgnBox(Rgn, &Ps.rcPaint);
+         RGNDATA_UnlockRgn(Rgn);
+         IntGdiIntersectRect(&Ps.rcPaint, &Ps.rcPaint, &Window->ClientRect);
+         IntGdiOffsetRect(&Ps.rcPaint,
+                          -Window->ClientRect.left,
+                          -Window->ClientRect.top);
+      }
+      else
+      {
+         IntGetClientRect(Window, &Ps.rcPaint);
+      }
       GDIOBJ_SetOwnership(Window->UpdateRegion, PsGetCurrentProcess());
-      NtGdiDeleteObject(Window->UpdateRegion);
       Window->UpdateRegion = NULL;
    }
    else
    {
-      NtUserGetClientRect(Window, &lPs->rcPaint);
+      if (Window->Flags & WINDOWOBJECT_NEED_INTERNALPAINT)
+         MsqDecPaintCountQueue(Window->MessageQueue);
+         
+      IntGetClientRect(Window, &Ps.rcPaint);
    }
-   IntUnLockWindowUpdate(Window);
+
+   Window->Flags &= ~WINDOWOBJECT_NEED_INTERNALPAINT;
 
    if (Window->Flags & WINDOWOBJECT_NEED_ERASEBKGND)
    {
       Window->Flags &= ~WINDOWOBJECT_NEED_ERASEBKGND;
-      lPs->fErase = !IntSendMessage(hWnd, WM_ERASEBKGND, (WPARAM)lPs->hdc, 0);
+      Ps.fErase = !co_IntSendMessage(hWnd, WM_ERASEBKGND, (WPARAM)Ps.hdc, 0);
    }
    else
    {
-      lPs->fErase = FALSE;
+      Ps.fErase = FALSE;
    }
 
-   IntReleaseWindowObject(Window);
+   Status = MmCopyToCaller(UnsafePs, &Ps, sizeof(PAINTSTRUCT));
+   if (! NT_SUCCESS(Status))
+   {
+      SetLastNtError(Status);
+      RETURN(NULL);
+   }
+
+   RETURN(Ps.hdc);
+
+CLEANUP:
+   if (Window) UserDerefObjectCo(Window);
+   
+   DPRINT("Leave NtUserBeginPaint, ret=%i\n",_ret_);
+   UserLeave();
+   END_CLEANUP;
 
-   return lPs->hdc;
 }
 
 /*
@@ -785,62 +828,60 @@ NtUserBeginPaint(HWND hWnd, PAINTSTRUCT* lPs)
 BOOL STDCALL
 NtUserEndPaint(HWND hWnd, CONST PAINTSTRUCT* lPs)
 {
-   NtUserReleaseDC(hWnd, lPs->hdc);
-   NtUserShowCaret(hWnd);
+   PWINDOW_OBJECT Window;
+   DECLARE_RETURN(BOOL);
+   USER_REFERENCE_ENTRY Ref;
 
-   return TRUE;
-}
+   DPRINT("Enter NtUserEndPaint\n");
+   UserEnterExclusive();
 
-/*
- * NtUserInvalidateRect
- *
- * Status
- *    @implemented
- */
+   if (!(Window = UserGetWindowObject(hWnd)))
+   {
+      RETURN(FALSE);
+   }
 
-DWORD STDCALL
-NtUserInvalidateRect(HWND hWnd, CONST RECT *Rect, BOOL Erase)
-{
-   return NtUserRedrawWindow(hWnd, Rect, 0, RDW_INVALIDATE | (Erase ? RDW_ERASE : 0));
-}
+   UserReleaseDC(Window, lPs->hdc, TRUE);
 
-/*
- * NtUserInvalidateRgn
- *
- * Status
- *    @implemented
- */
+   UserRefObjectCo(Window, &Ref);
+   co_UserShowCaret(Window);
+   UserDerefObjectCo(Window);
 
-DWORD STDCALL
-NtUserInvalidateRgn(HWND hWnd, HRGN Rgn, BOOL Erase)
-{
-   return NtUserRedrawWindow(hWnd, NULL, Rgn, RDW_INVALIDATE | (Erase ? RDW_ERASE : 0));
+   RETURN(TRUE);
+
+CLEANUP:
+   DPRINT("Leave NtUserEndPaint, ret=%i\n",_ret_);
+   UserLeave();
+   END_CLEANUP;
 }
 
-/*
- * NtUserValidateRgn
- *
- * Status
- *    @implemented
- */
 
-BOOL STDCALL
-NtUserValidateRgn(HWND hWnd, HRGN hRgn)
+INT FASTCALL
+co_UserGetUpdateRgn(PWINDOW_OBJECT Window, HRGN hRgn, BOOL bErase)
 {
-   return NtUserRedrawWindow(hWnd, NULL, hRgn, RDW_VALIDATE | RDW_NOCHILDREN);
-}
+   int RegionType;
+   RECT Rect;
 
-/*
- * NtUserUpdateWindow
- *
- * Status
- *    @implemented
- */
-BOOL STDCALL
-NtUserUpdateWindow(HWND hWnd)
-{
-   return NtUserRedrawWindow(hWnd, NULL, 0, RDW_UPDATENOW | RDW_ALLCHILDREN);
+   ASSERT_REFS_CO(Window);
+
+   if (Window->UpdateRegion == NULL)
+   {
+      RegionType = (NtGdiSetRectRgn(hRgn, 0, 0, 0, 0) ? NULLREGION : ERROR);
+   }
+   else
+   {
+      Rect = Window->ClientRect;
+      IntIntersectWithParents(Window, &Rect);
+      NtGdiSetRectRgn(hRgn, Rect.left, Rect.top, Rect.right, Rect.bottom);
+      RegionType = NtGdiCombineRgn(hRgn, hRgn, Window->UpdateRegion, RGN_AND);
+      NtGdiOffsetRgn(hRgn, -Window->ClientRect.left, -Window->ClientRect.top);
+   }
+
+   if (bErase && RegionType != NULLREGION && RegionType != ERROR)
+   {
+      co_UserRedrawWindow(Window, NULL, NULL, RDW_ERASENOW | RDW_NOCHILDREN);
+   }
+
+   return RegionType;
 }
 
 /*
@@ -853,36 +894,29 @@ NtUserUpdateWindow(HWND hWnd)
 INT STDCALL
 NtUserGetUpdateRgn(HWND hWnd, HRGN hRgn, BOOL bErase)
 {
+   DECLARE_RETURN(INT);
    PWINDOW_OBJECT Window;
-   int RegionType;
+   INT ret;
+   USER_REFERENCE_ENTRY Ref;
 
-   if (!(Window = IntGetWindowObject(hWnd)))
-   {
-      SetLastWin32Error(ERROR_INVALID_WINDOW_HANDLE);
-      return ERROR;
-   }
-    
-   if (Window->UpdateRegion == NULL)
-   {
-      RegionType = (NtGdiSetRectRgn(hRgn, 0, 0, 0, 0) ? NULLREGION : ERROR);
-   }
-   else
+   DPRINT("Enter NtUserGetUpdateRgn\n");
+   UserEnterExclusive();
+
+   if (!(Window = UserGetWindowObject(hWnd)))
    {
-      RegionType = NtGdiCombineRgn(hRgn, Window->UpdateRegion, hRgn, RGN_COPY);
-      NtGdiOffsetRgn(
-         hRgn,
-         Window->WindowRect.left - Window->ClientRect.left,
-         Window->WindowRect.top - Window->ClientRect.top);
+      RETURN(ERROR);
    }
 
-   IntReleaseWindowObject(Window);
+   UserRefObjectCo(Window, &Ref);
+   ret = co_UserGetUpdateRgn(Window, hRgn, bErase);
+   UserDerefObjectCo(Window);
 
-   if (bErase && RegionType != NULLREGION && RegionType != ERROR)
-   {
-      NtUserRedrawWindow(hWnd, NULL, NULL, RDW_ERASENOW | RDW_NOCHILDREN);
-   }
-  
-   return RegionType;
+   RETURN(ret);
+
+CLEANUP:
+   DPRINT("Leave NtUserGetUpdateRgn, ret=%i\n",_ret_);
+   UserLeave();
+   END_CLEANUP;
 }
 
 /*
@@ -893,21 +927,80 @@ NtUserGetUpdateRgn(HWND hWnd, HRGN hRgn, BOOL bErase)
  */
 
 BOOL STDCALL
-NtUserGetUpdateRect(HWND hWnd, LPRECT lpRect, BOOL fErase)
+NtUserGetUpdateRect(HWND hWnd, LPRECT UnsafeRect, BOOL bErase)
 {
-   HRGN hRgn = NtGdiCreateRectRgn(0, 0, 0, 0);
+   PWINDOW_OBJECT Window;
+   RECT Rect;
+   INT RegionType;
+   PROSRGNDATA RgnData;
+   NTSTATUS Status;
+   DECLARE_RETURN(BOOL);
+
+   DPRINT("Enter NtUserGetUpdateRect\n");
+   UserEnterExclusive();
 
-   if (!lpRect)
+   if (!(Window = UserGetWindowObject(hWnd)))
    {
-      SetLastWin32Error(ERROR_INVALID_PARAMETER);
-      return FALSE;
+      RETURN(FALSE);
    }
 
-   NtUserGetUpdateRgn(hWnd, hRgn, fErase);
-   NtGdiGetRgnBox(hRgn, lpRect);
-   NtGdiDeleteObject(hRgn);
+   if (Window->UpdateRegion == NULL)
+   {
+      Rect.left = Rect.top = Rect.right = Rect.bottom = 0;
+   }
+   else
+   {
+      /* Get the update region bounding box. */
+      if (Window->UpdateRegion == (HRGN)1)
+      {
+         Rect = Window->ClientRect;
+      }
+      else
+      {
+         RgnData = RGNDATA_LockRgn(Window->UpdateRegion);
+         ASSERT(RgnData != NULL);
+         RegionType = UnsafeIntGetRgnBox(RgnData, &Rect);
+         RGNDATA_UnlockRgn(RgnData);
 
-   return lpRect->left < lpRect->right && lpRect->top < lpRect->bottom;
+         if (RegionType != ERROR && RegionType != NULLREGION)
+            IntGdiIntersectRect(&Rect, &Rect, &Window->ClientRect);
+      }
+
+      if (IntIntersectWithParents(Window, &Rect))
+      {
+         IntGdiOffsetRect(&Rect,
+                          -Window->ClientRect.left,
+                          -Window->ClientRect.top);
+      } else
+      {
+         Rect.left = Rect.top = Rect.right = Rect.bottom = 0;
+      }
+   }
+
+   if (bErase && !IntGdiIsEmptyRect(&Rect))
+   {
+      USER_REFERENCE_ENTRY Ref;
+      UserRefObjectCo(Window, &Ref);
+      co_UserRedrawWindow(Window, NULL, NULL, RDW_ERASENOW | RDW_NOCHILDREN);
+      UserDerefObjectCo(Window);
+   }
+
+   if (UnsafeRect != NULL)
+   {
+      Status = MmCopyToCaller(UnsafeRect, &Rect, sizeof(RECT));
+      if (!NT_SUCCESS(Status))
+      {
+         SetLastWin32Error(ERROR_INVALID_PARAMETER);
+         RETURN(FALSE);
+      }
+   }
+
+   RETURN(Window->UpdateRegion != NULL);
+
+CLEANUP:
+   DPRINT("Leave NtUserGetUpdateRect, ret=%i\n",_ret_);
+   UserLeave();
+   END_CLEANUP;
 }
 
 /*
@@ -919,56 +1012,62 @@ NtUserGetUpdateRect(HWND hWnd, LPRECT lpRect, BOOL fErase)
 
 BOOL STDCALL
 NtUserRedrawWindow(HWND hWnd, CONST RECT *lprcUpdate, HRGN hrgnUpdate,
-   UINT flags)
+                   UINT flags)
 {
    RECT SafeUpdateRect;
    NTSTATUS Status;
    PWINDOW_OBJECT Wnd;
+   DECLARE_RETURN(BOOL);
+   USER_REFERENCE_ENTRY Ref;
+
+   DPRINT("Enter NtUserRedrawWindow\n");
+   UserEnterExclusive();
 
-   if (!(Wnd = IntGetWindowObject(hWnd ? hWnd : IntGetDesktopWindow())))
+   if (!(Wnd = UserGetWindowObject(hWnd ? hWnd : IntGetDesktopWindow())))
    {
-      SetLastWin32Error(ERROR_INVALID_WINDOW_HANDLE);
-      return FALSE;
+      RETURN( FALSE);
    }
 
    if (lprcUpdate != NULL)
    {
       Status = MmCopyFromCaller(&SafeUpdateRect, (PRECT)lprcUpdate,
-         sizeof(RECT));
+                                sizeof(RECT));
 
       if (!NT_SUCCESS(Status))
       {
          SetLastWin32Error(ERROR_INVALID_PARAMETER);
-         IntReleaseWindowObject(Wnd);
-         return FALSE;
+         RETURN( FALSE);
       }
    }
 
-   Status = IntRedrawWindow(Wnd, NULL == lprcUpdate ? NULL : &SafeUpdateRect,
-      hrgnUpdate, flags);
+   UserRefObjectCo(Wnd, &Ref);
+
+   Status = co_UserRedrawWindow(Wnd, NULL == lprcUpdate ? NULL : &SafeUpdateRect,
+                                hrgnUpdate, flags);
+
+   UserDerefObjectCo(Wnd);
 
    if (!NT_SUCCESS(Status))
    {
       /* IntRedrawWindow fails only in case that flags are invalid */
       SetLastWin32Error(ERROR_INVALID_PARAMETER);
-      IntReleaseWindowObject(Wnd);
-      return FALSE;
+      RETURN( FALSE);
    }
-   IntReleaseWindowObject(Wnd);
-   return TRUE;
+
+   RETURN( TRUE);
+
+CLEANUP:
+   DPRINT("Leave NtUserRedrawWindow, ret=%i\n",_ret_);
+   UserLeave();
+   END_CLEANUP;
 }
 
-/*
- * NtUserScrollDC
- *
- * Status
- *    @implemented
- */
 
-DWORD STDCALL
-NtUserScrollDC(HDC hDC, INT dx, INT dy, const RECT *lprcScroll,
-   const RECT *lprcClip, HRGN hrgnUpdate, LPRECT lprcUpdate)
+
+static
+DWORD FASTCALL
+UserScrollDC(HDC hDC, INT dx, INT dy, const RECT *lprcScroll,
+             const RECT *lprcClip, HRGN hrgnUpdate, LPRECT lprcUpdate)
 {
    RECT rSrc, rClipped_src, rClip, rDst, offset;
    PDC DC;
@@ -979,9 +1078,9 @@ NtUserScrollDC(HDC hDC, INT dx, INT dy, const RECT *lprcScroll,
 
    DC = DC_LockDc(hDC);
    if (NULL == DC)
-     {
-       return FALSE;
-     }
+   {
+      return FALSE;
+   }
    if (lprcScroll)
       rSrc = *lprcScroll;
    else
@@ -994,13 +1093,13 @@ NtUserScrollDC(HDC hDC, INT dx, INT dy, const RECT *lprcScroll,
       IntGdiGetClipBox(hDC, &rClip);
    IntLPtoDP(DC, (LPPOINT)&rClip, 2);
 
-   NtGdiIntersectRect(&rClipped_src, &rSrc, &rClip);
+   IntGdiIntersectRect(&rClipped_src, &rSrc, &rClip);
 
    rDst = rClipped_src;
-   NtGdiSetRect(&offset, 0, 0, dx, dy);
+   IntGdiSetRect(&offset, 0, 0, dx, dy);
    IntLPtoDP(DC, (LPPOINT)&offset, 2);
-   NtGdiOffsetRect(&rDst, offset.right - offset.left,  offset.bottom - offset.top);
-   NtGdiIntersectRect(&rDst, &rDst, &rClip);
+   IntGdiOffsetRect(&rDst, offset.right - offset.left,  offset.bottom - offset.top);
+   IntGdiIntersectRect(&rDst, &rDst, &rClip);
 
    /*
     * Copy bits, if possible.
@@ -1010,10 +1109,10 @@ NtUserScrollDC(HDC hDC, INT dx, INT dy, const RECT *lprcScroll,
    {
       RECT rDst_lp = rDst, rSrc_lp = rDst;
 
-      NtGdiOffsetRect(&rSrc_lp, offset.left - offset.right, offset.top - offset.bottom);
+      IntGdiOffsetRect(&rSrc_lp, offset.left - offset.right, offset.top - offset.bottom);
       IntDPtoLP(DC, (LPPOINT)&rDst_lp, 2);
       IntDPtoLP(DC, (LPPOINT)&rSrc_lp, 2);
-      DC_UnlockDc(hDC);
+      DC_UnlockDc(DC);
 
       if (!NtGdiBitBlt(hDC, rDst_lp.left, rDst_lp.top, rDst_lp.right - rDst_lp.left,
                        rDst_lp.bottom - rDst_lp.top, hDC, rSrc_lp.left, rSrc_lp.top,
@@ -1022,7 +1121,7 @@ NtUserScrollDC(HDC hDC, INT dx, INT dy, const RECT *lprcScroll,
    }
    else
    {
-      DC_UnlockDc(hDC);
+      DC_UnlockDc(DC);
    }
 
    /*
@@ -1046,7 +1145,7 @@ NtUserScrollDC(HDC hDC, INT dx, INT dy, const RECT *lprcScroll,
 
       NtGdiSetRectRgn(hRgn2, rDst.left, rDst.top, rDst.right, rDst.bottom);
       NtGdiCombineRgn(hRgn, hRgn, hRgn2, RGN_DIFF);
-        
+
       NtGdiSetRectRgn(hRgn2, rClip.left, rClip.top, rClip.right, rClip.bottom);
       NtGdiCombineRgn(hRgn, hRgn, hRgn2, RGN_AND);
 
@@ -1064,6 +1163,34 @@ NtUserScrollDC(HDC hDC, INT dx, INT dy, const RECT *lprcScroll,
    return TRUE;
 }
 
+
+
+
+/*
+ * NtUserScrollDC
+ *
+ * Status
+ *    @implemented
+ */
+
+DWORD STDCALL
+NtUserScrollDC(HDC hDC, INT dx, INT dy, const RECT *lprcScroll,
+               const RECT *lprcClip, HRGN hrgnUpdate, LPRECT lprcUpdate)
+{
+   DECLARE_RETURN(DWORD);
+
+   DPRINT("Enter NtUserScrollDC\n");
+   UserEnterExclusive();
+
+   RETURN( UserScrollDC(hDC, dx, dy, lprcScroll, lprcClip, hrgnUpdate, lprcUpdate));
+
+CLEANUP:
+   DPRINT("Leave NtUserScrollDC, ret=%i\n",_ret_);
+   UserLeave();
+   END_CLEANUP;
+
+}
+
 /*
  * NtUserScrollWindowEx
  *
@@ -1072,70 +1199,95 @@ NtUserScrollDC(HDC hDC, INT dx, INT dy, const RECT *lprcScroll,
  */
 
 DWORD STDCALL
-NtUserScrollWindowEx(HWND hWnd, INT dx, INT dy, const RECT *rect,
-   const RECT *clipRect, HRGN hrgnUpdate, LPRECT rcUpdate, UINT flags)
+NtUserScrollWindowEx(HWND hWnd, INT dx, INT dy, const RECT *UnsafeRect,
+                     const RECT *UnsafeClipRect, HRGN hrgnUpdate, LPRECT rcUpdate, UINT flags)
 {
-   RECT rc, cliprc, caretrc;
+   RECT rc, cliprc, caretrc, rect, clipRect;
    INT Result;
-   PWINDOW_OBJECT Window;
+   PWINDOW_OBJECT Window = NULL, CaretWnd;
    HDC hDC;
    HRGN hrgnTemp;
    HWND hwndCaret;
    BOOL bUpdate = (rcUpdate || hrgnUpdate || flags & (SW_INVALIDATE | SW_ERASE));
    BOOL bOwnRgn = TRUE;
+   NTSTATUS Status;
+   DECLARE_RETURN(DWORD);
+   USER_REFERENCE_ENTRY Ref, CaretRef;
 
-   Window = IntGetWindowObject(hWnd);
+   DPRINT("Enter NtUserScrollWindowEx\n");
+   UserEnterExclusive();
+
+   Window = UserGetWindowObject(hWnd);
    if (!Window || !IntIsWindowDrawable(Window))
    {
-      IntReleaseWindowObject(Window);
-      return ERROR;
+      Window = NULL; /* prevent deref at cleanup */
+      RETURN( ERROR);
    }
+   UserRefObjectCo(Window, &Ref);
 
    IntGetClientRect(Window, &rc);
-   if (rect)
-      NtGdiIntersectRect(&rc, &rc, rect);
 
-   if (clipRect)
-      NtGdiIntersectRect(&cliprc, &rc, clipRect);
+   if (NULL != UnsafeRect)
+   {
+      Status = MmCopyFromCaller(&rect, UnsafeRect, sizeof(RECT));
+      if (! NT_SUCCESS(Status))
+      {
+         SetLastNtError(Status);
+         RETURN( ERROR);
+      }
+      IntGdiIntersectRect(&rc, &rc, &rect);
+   }
+
+   if (NULL != UnsafeClipRect)
+   {
+      Status = MmCopyFromCaller(&clipRect, UnsafeClipRect, sizeof(RECT));
+      if (! NT_SUCCESS(Status))
+      {
+         SetLastNtError(Status);
+         RETURN( ERROR);
+      }
+      IntGdiIntersectRect(&cliprc, &rc, &clipRect);
+   }
    else
       cliprc = rc;
 
    if (cliprc.right <= cliprc.left || cliprc.bottom <= cliprc.top ||
-       (dx == 0 && dy == 0))
-   { 
-      return NULLREGION;
+         (dx == 0 && dy == 0))
+   {
+      RETURN( NULLREGION);
    }
 
    caretrc = rc;
-   hwndCaret = IntFixCaret(hWnd, &caretrc, flags);
+   hwndCaret = co_IntFixCaret(Window, &caretrc, flags);
 
    if (hrgnUpdate)
       bOwnRgn = FALSE;
    else if (bUpdate)
       hrgnUpdate = NtGdiCreateRectRgn(0, 0, 0, 0);
 
-   hDC = NtUserGetDCEx(hWnd, 0, DCX_CACHE | DCX_USESTYLE);
+   hDC = UserGetDCEx(Window, 0, DCX_CACHE | DCX_USESTYLE);
    if (hDC)
    {
-      NtUserScrollDC(hDC, dx, dy, &rc, &cliprc, hrgnUpdate, rcUpdate);
-      NtUserReleaseDC(hWnd, hDC);
+      UserScrollDC(hDC, dx, dy, &rc, &cliprc, hrgnUpdate, rcUpdate);
+      UserReleaseDC(Window, hDC, FALSE);
    }
 
-   /* 
+   /*
     * Take into account the fact that some damage may have occurred during
     * the scroll.
     */
 
    hrgnTemp = NtGdiCreateRectRgn(0, 0, 0, 0);
-   Result = NtUserGetUpdateRgn(hWnd, hrgnTemp, FALSE);
+   Result = co_UserGetUpdateRgn(Window, hrgnTemp, FALSE);
    if (Result != NULLREGION)
    {
       HRGN hrgnClip = UnsafeIntCreateRectRgnIndirect(&cliprc);
       NtGdiOffsetRgn(hrgnTemp, dx, dy);
       NtGdiCombineRgn(hrgnTemp, hrgnTemp, hrgnClip, RGN_AND);
-      NtUserRedrawWindow(hWnd, NULL, hrgnTemp, RDW_INVALIDATE | RDW_ERASE);
+      co_UserRedrawWindow(Window, NULL, hrgnTemp, RDW_INVALIDATE | RDW_ERASE);
       NtGdiDeleteObject(hrgnClip);
    }
+
    NtGdiDeleteObject(hrgnTemp);
 
    if (flags & SW_SCROLLCHILDREN)
@@ -1146,41 +1298,62 @@ NtUserScrollWindowEx(HWND hWnd, INT dx, INT dy, const RECT *rect,
          int i;
          RECT r, dummy;
          POINT ClientOrigin;
+         PWINDOW_OBJECT Wnd;
+         USER_REFERENCE_ENTRY WndRef;
 
+         IntGetClientOrigin(Window, &ClientOrigin);
          for (i = 0; List[i]; i++)
          {
-            NtUserGetWindowRect(List[i], &r);
-            IntGetClientOrigin(hWnd, &ClientOrigin);
+            if (!(Wnd = UserGetWindowObject(List[i])))
+               continue;
+
+            r = Wnd->WindowRect;
             r.left -= ClientOrigin.x;
             r.top -= ClientOrigin.y;
             r.right -= ClientOrigin.x;
             r.bottom -= ClientOrigin.y;
-            if (!rect || NtGdiIntersectRect(&dummy, &r, &rc))
-               WinPosSetWindowPos(List[i], 0, r.left + dx, r.top + dy, 0, 0,
-                                  SWP_NOZORDER | SWP_NOSIZE | SWP_NOACTIVATE |
-                                  SWP_NOREDRAW);
+
+            if (! UnsafeRect || IntGdiIntersectRect(&dummy, &r, &rc))
+            {
+               UserRefObjectCo(Wnd, &WndRef);
+               co_WinPosSetWindowPos(Wnd, 0, r.left + dx, r.top + dy, 0, 0,
+                                     SWP_NOZORDER | SWP_NOSIZE | SWP_NOACTIVATE |
+                                     SWP_NOREDRAW);
+               UserDerefObjectCo(Wnd);
+            }
+
          }
          ExFreePool(List);
       }
    }
 
    if (flags & (SW_INVALIDATE | SW_ERASE))
-      NtUserRedrawWindow(hWnd, NULL, hrgnUpdate, RDW_INVALIDATE | RDW_ERASE |
-                         ((flags & SW_ERASE) ? RDW_ERASENOW : 0) |
-                         ((flags & SW_SCROLLCHILDREN) ? RDW_ALLCHILDREN : 0));
+      co_UserRedrawWindow(Window, NULL, hrgnUpdate, RDW_INVALIDATE | RDW_ERASE |
+                          ((flags & SW_ERASE) ? RDW_ERASENOW : 0) |
+                          ((flags & SW_SCROLLCHILDREN) ? RDW_ALLCHILDREN : 0));
 
    if (bOwnRgn && hrgnUpdate)
       NtGdiDeleteObject(hrgnUpdate);
-   
-   if (hwndCaret)
+
+   if ((CaretWnd = UserGetWindowObject(hwndCaret)))
    {
-      IntSetCaretPos(caretrc.left + dx, caretrc.top + dy);
-      NtUserShowCaret(hwndCaret);
+      UserRefObjectCo(CaretWnd, &CaretRef);
+
+      co_IntSetCaretPos(caretrc.left + dx, caretrc.top + dy);
+      co_UserShowCaret(CaretWnd);
+
+      UserDerefObjectCo(CaretWnd);
    }
 
-   IntReleaseWindowObject(Window);
-    
-   return Result;
+   RETURN(Result);
+
+CLEANUP:
+   if (Window)
+      UserDerefObjectCo(Window);
+
+   DPRINT("Leave NtUserScrollWindowEx, ret=%i\n",_ret_);
+   UserLeave();
+   END_CLEANUP;
 }
 
 /* EOF */