[win32k]

- The timer is created usingUserCreateObject. It may be a good idea to save the handle in the timer object so that it can be deleted later.
- Dereference the object before attempting to delete it.

svn path=/trunk/; revision=47393

diff --git a/reactos/subsystems/win32/win32k/ntuser/timer.c b/reactos/subsystems/win32/win32k/ntuser/timer.c
index 3539b0a..4ab3916 100644 (file)
--- a/reactos/subsystems/win32/win32k/ntuser/timer.c
+++ b/reactos/subsystems/win32/win32k/ntuser/timer.c
@@ -50,13 +50,21 @@ CreateTimer(VOID)
   if (!FirstpTmr)
   {
       FirstpTmr = UserCreateObject(gHandleTable, NULL, &Handle, otTimer, sizeof(TIMER));
-      if (FirstpTmr) InitializeListHead(&FirstpTmr->ptmrList);
+      if (FirstpTmr)
+      {
+         FirstpTmr->head.h = Handle;
+         InitializeListHead(&FirstpTmr->ptmrList);
+      }
       Ret = FirstpTmr;
   }
   else
   {
       Ret = UserCreateObject(gHandleTable, NULL, &Handle, otTimer, sizeof(TIMER));
-      if (Ret) InsertTailList(&FirstpTmr->ptmrList, &Ret->ptmrList);
+      if (Ret)
+      {
+         Ret->head.h = Handle;
+         InsertTailList(&FirstpTmr->ptmrList, &Ret->ptmrList);
+      }
   }
   return Ret;
 }
@@ -66,14 +74,17 @@ BOOL
 FASTCALL
 RemoveTimer(PTIMER pTmr)
 {
+  BOOL Ret = FALSE;
   if (pTmr)
   {
      /* Set the flag, it will be removed when ready */
      RemoveEntryList(&pTmr->ptmrList);
-     UserDeleteObject( UserHMGetHandle(pTmr), otTimer);
-     return TRUE;
+     UserDereferenceObject(pTmr);
+     Ret = UserDeleteObject( UserHMGetHandle(pTmr), otTimer);
   }
-  return FALSE;
+  if (!Ret) DPRINT1("Warning unable to delete timer\n");
+
+  return Ret;
 }
 
 PTIMER
@@ -528,9 +539,7 @@ DestroyTimersForWindow(PTHREADINFO pti, PWINDOW_OBJECT Window)
    {
       if ((pTmr) && (pTmr->pti == pti) && (pTmr->pWnd == Window))
       {
-         RemoveEntryList(&pTmr->ptmrList);
-         UserDeleteObject( UserHMGetHandle(pTmr), otTimer);
-         TimersRemoved = TRUE;
+         TimersRemoved = RemoveTimer(pTmr);
       }
       pLE = pTmr->ptmrList.Flink;
       pTmr = CONTAINING_RECORD(pLE, TIMER, ptmrList);
@@ -557,9 +566,7 @@ DestroyTimersForThread(PTHREADINFO pti)
    {
       if ((pTmr) && (pTmr->pti == pti))
       {
-         RemoveEntryList(&pTmr->ptmrList);
-         UserDeleteObject( UserHMGetHandle(pTmr), otTimer);
-         TimersRemoved = TRUE;
+         TimersRemoved = RemoveTimer(pTmr);
       }
       pLE = pTmr->ptmrList.Flink;
       pTmr = CONTAINING_RECORD(pLE, TIMER, ptmrList);