win32u: Allow NULL cbtc in NtUserCreateWindowEx.

dlls/win32u/window.c

@@ -4845,9 +4845,10 @@ HWND WINAPI NtUserCreateWindowEx( DWORD ex_style, UNICODE_STRING *class_name,
                                   HWND parent, HMENU menu, HINSTANCE instance, void *params,
                                   DWORD flags, CBT_CREATEWNDW *cbtc, DWORD unk, BOOL ansi )
 {
-    CREATESTRUCTW cs, *client_cs = cbtc->lpcs;
+    CREATESTRUCTW cs, *client_cs, cs_buf;
     UINT win_dpi, thread_dpi = get_thread_dpi();
     DPI_AWARENESS_CONTEXT context;
+    CBT_CREATEWNDW cbtc_buf;
     HWND hwnd, owner = 0;
     INT sw = SW_SHOW;
     RECT rect;
@@ -4855,8 +4856,24 @@ HWND WINAPI NtUserCreateWindowEx( DWORD ex_style, UNICODE_STRING *class_name,
 
     static const WCHAR messageW[] = {'M','e','s','s','a','g','e'};
 
+    /* FIXME: We should pass a packed struct to client instead of using client_cs */
+    if (cbtc)
+    {
+        client_cs = cbtc->lpcs;
+        cs.lpszName  = client_cs->lpszName;
+        cs.lpszClass = client_cs->lpszClass;
+        cs.hInstance = client_cs->hInstance; /* may be different than instance for win16 */
+    }
+    else
+    {
+        cbtc = &cbtc_buf;
+        client_cs = cbtc->lpcs = &cs_buf;
+        cs.lpszName = window_name ? window_name->Buffer : NULL;
+        cs.lpszClass = class_name->Buffer;
+        cs.hInstance = instance;
+    }
+
     cs.lpCreateParams = params;
-    cs.hInstance  = client_cs->hInstance; /* may be different than instance for win16 */
     cs.hMenu      = menu;
     cs.hwndParent = parent;
     cs.style      = style;
@@ -4865,10 +4882,6 @@ HWND WINAPI NtUserCreateWindowEx( DWORD ex_style, UNICODE_STRING *class_name,
     cs.y  = y;
     cs.cx = cx;
     cs.cy = cy;
-    /* We use client_cs to pass original class and name pointers,
-     * that's probably not how native handles it. */
-    cs.lpszName  = client_cs->lpszName;
-    cs.lpszClass = client_cs->lpszClass;
 
     /* Find the parent window */
     if (parent == HWND_MESSAGE)