According to JIRA user simonelombardo, there was crash in exiting a thread.
- Add UserAssignmentLock, and UserAssignmentUnlock helper functions.
- Lock and unlock pti->spDefaultImc by using those helper functions.
CORE-18044
else // First time. It's the default IMC.
{
// Add the first one (default) to the list.
- if (pti->spDefaultImc)
- UserDereferenceObject(pti->spDefaultImc);
- pti->spDefaultImc = pIMC;
+ UserAssignmentLock((PVOID*)&pti->spDefaultImc, pIMC);
pIMC->pImcNext = NULL;
}
VOID
UserDisplayNotifyShutdown(PPROCESSINFO ppiCurrent);
+// Win: xxxDestroyThreadInfo
NTSTATUS
NTAPI
ExitThreadCallback(PETHREAD Thread)
ASSERT(FALSE);
return STATUS_UNSUCCESSFUL;
}
+ UserAssignmentUnlock((PVOID*)&ptiCurrent->spDefaultImc);
if (ppiCurrent && ppiCurrent->ptiList == ptiCurrent && !ptiCurrent->ptiSibling &&
ppiCurrent->W32PF_flags & W32PF_CLASSESREGISTERED)
UserLeave();
END_CLEANUP;
}
+
+// Win: HMAssignmentLock
+PVOID FASTCALL UserAssignmentLock(PVOID *ppvObj, PVOID pvNew)
+{
+ PVOID pvOld = *ppvObj;
+ *ppvObj = pvNew;
+
+ if (pvOld && pvOld == pvNew)
+ return pvOld;
+
+ if (pvNew)
+ UserReferenceObject(pvNew);
+
+ if (pvOld)
+ {
+ if (UserDereferenceObject(pvOld))
+ pvOld = NULL;
+ }
+
+ return pvOld;
+}
+
+// Win: HMAssignmentUnlock
+PVOID FASTCALL UserAssignmentUnlock(PVOID *ppvObj)
+{
+ PVOID pvOld = *ppvObj;
+ *ppvObj = NULL;
+
+ if (pvOld)
+ {
+ if (UserDereferenceObject(pvOld))
+ pvOld = NULL;
+ }
+
+ return pvOld;
+}
PVOID FASTCALL ValidateHandle(HANDLE handle, HANDLE_TYPE type);
BOOLEAN UserDestroyObjectsForOwner(PUSER_HANDLE_TABLE Table, PVOID Owner);
BOOL FASTCALL UserMarkObjectDestroy(PVOID);
+PVOID FASTCALL UserAssignmentLock(PVOID *ppvObj, PVOID pvNew);
+PVOID FASTCALL UserAssignmentUnlock(PVOID *ppvObj);
static __inline VOID
UserRefObjectCo(PVOID obj, PUSER_REFERENCE_ENTRY UserReferenceEntry)