Avoid returning an unlocked window pointer from WINPOS_WindowFromPoint.

include/queue.h

@@ -21,9 +21,6 @@ typedef struct tagQMSG
     int   type;
     MSG   msg;
     DWORD extraInfo;  /* Only in 3.1 */
-    
-    struct tagQMSG *nextMsg;
-    struct tagQMSG *prevMsg;
 } QMSG;
 
 #define QMSG_WIN16    0
@@ -54,17 +51,9 @@ typedef struct tagMESSAGEQUEUE
   HQUEUE16  self;                   /* Handle to self (was: reserved) */
   TEB*      teb;                    /* Thread owning queue */
   HANDLE    server_queue;           /* Handle to server-side queue */
-  CRITICAL_SECTION cSection;        /* Queue access critical section */
 
   DWORD     magic;                  /* magic number should be QUEUE_MAGIC */
   DWORD     lockCount;              /* reference counter */
-  
-  QMSG*     firstMsg;               /* First message in linked list */
-  QMSG*     lastMsg;                /* Last message in linked list */
-  
-  WORD      wPostQMsg;              /* PostQuitMessage flag */
-  WORD      wExitCode;              /* PostQuitMessage exit code */
-  WORD      wPaintCount;            /* Number of WM_PAINT needed */
 
   DWORD     GetMessageTimeVal;      /* Value for GetMessageTime */
   DWORD     GetMessagePosVal;       /* Value for GetMessagePos */
@@ -81,33 +70,22 @@ typedef struct tagMESSAGEQUEUE
 #define QUEUE_MAGIC        0xD46E80AF
 
 /* Per queue data management methods */
-PERQUEUEDATA* PERQDATA_CreateInstance( void );
-ULONG PERQDATA_Addref( PERQUEUEDATA* pQData );
-ULONG PERQDATA_Release( PERQUEUEDATA* pQData );
 HWND PERQDATA_GetFocusWnd( PERQUEUEDATA *pQData );
 HWND PERQDATA_SetFocusWnd( PERQUEUEDATA *pQData, HWND hWndFocus );
 HWND PERQDATA_GetActiveWnd( PERQUEUEDATA *pQData );
 HWND PERQDATA_SetActiveWnd( PERQUEUEDATA *pQData, HWND hWndActive );
-HWND PERQDATA_GetCaptureWnd( PERQUEUEDATA *pQData );
-HWND PERQDATA_SetCaptureWnd( PERQUEUEDATA *pQData, HWND hWndCapture );
-INT16  PERQDATA_GetCaptureInfo( PERQUEUEDATA *pQData );
-INT16 PERQDATA_SetCaptureInfo( PERQUEUEDATA *pQData, INT16 nCaptureHT );
-    
+HWND PERQDATA_GetCaptureWnd( INT *hittest );
+HWND PERQDATA_SetCaptureWnd( HWND hWndCapture, INT hittest );
+
 /* Message queue management methods */
 extern MESSAGEQUEUE *QUEUE_Lock( HQUEUE16 hQueue );
 extern void QUEUE_Unlock( MESSAGEQUEUE *queue );
-extern void QUEUE_DumpQueue( HQUEUE16 hQueue );
 extern BOOL QUEUE_IsExitingQueue( HQUEUE16 hQueue );
 extern void QUEUE_SetExitingQueue( HQUEUE16 hQueue );
-extern void QUEUE_SetWakeBit( MESSAGEQUEUE *queue, WORD set, WORD clear );
-extern void QUEUE_ClearWakeBit( MESSAGEQUEUE *queue, WORD bit );
 extern int QUEUE_WaitBits( WORD bits, DWORD timeout );
-extern void QUEUE_IncPaintCount( HQUEUE16 hQueue );
-extern void QUEUE_DecPaintCount( HQUEUE16 hQueue );
 extern BOOL QUEUE_DeleteMsgQueue( HQUEUE16 hQueue );
 extern HTASK16 QUEUE_GetQueueTask( HQUEUE16 hQueue );
 extern BOOL QUEUE_FindMsg( HWND hwnd, UINT first, UINT last, BOOL remove, QMSG *msg );
-extern void QUEUE_RemoveMsg( MESSAGEQUEUE * msgQueue, QMSG *qmsg );
 extern void QUEUE_CleanupWindow( HWND hwnd );
 
 extern HQUEUE16 WINAPI InitThreadInput16( WORD unknown, WORD flags );

include/winpos.h

@@ -37,7 +37,7 @@ extern LONG WINPOS_SendNCCalcSize(HWND hwnd, BOOL calcValidRect,
                                   RECT *newClientRect );
 extern LONG WINPOS_HandleWindowPosChanging16(struct tagWND *wndPtr, struct tagWINDOWPOS16 *winpos);
 extern LONG WINPOS_HandleWindowPosChanging(struct tagWND *wndPtr, WINDOWPOS *winpos);
-extern INT16 WINPOS_WindowFromPoint( struct tagWND* scopeWnd, POINT pt, struct tagWND **ppWnd );
+extern HWND WINPOS_WindowFromPoint( HWND hwndScope, POINT pt, INT *hittest );
 extern void WINPOS_CheckInternalPos( struct tagWND* wndPtr );
 extern BOOL WINPOS_ActivateOtherWindow(struct tagWND* pWnd);
 extern BOOL WINPOS_CreateInternalPosAtom(void);

windows/defwnd.c

@@ -322,19 +322,18 @@ static LRESULT DEFWND_DefWinProc( WND *wndPtr, UINT msg, WPARAM wParam,
         break;
 
     case WM_RBUTTONUP:
-        if (wndPtr->hwndSelf == GetCapture())
         {
-            /* release capture if we took it on WM_NCRBUTTONDOWN */
-            ReleaseCapture();
-        }
-        if ((wndPtr->flags & WIN_ISWIN32) || (TWEAK_WineLook > WIN31_LOOK))
-        {
-	    POINT pt;
+            POINT pt;
+
+            if (wndPtr->hwndSelf == GetCapture())
+                /* release capture if we took it on WM_NCRBUTTONDOWN */
+                ReleaseCapture();
+
 	    pt.x = SLOWORD(lParam);
 	    pt.y = SHIWORD(lParam);
 	    ClientToScreen(wndPtr->hwndSelf, &pt);
-	    lParam = MAKELPARAM(pt.x, pt.y);
-	    pSendMessage( wndPtr->hwndSelf, WM_CONTEXTMENU, wndPtr->hwndSelf, lParam );
+	    pSendMessage( wndPtr->hwndSelf, WM_CONTEXTMENU,
+                          wndPtr->hwndSelf, MAKELPARAM(pt.x, pt.y) );
         }
         break;
 

windows/input.c

@@ -400,19 +400,11 @@ HWND EVENT_Capture(HWND hwnd, INT16 ht)
     WND* wndPtr = 0;
     INT16 captureHT = 0;
 
-    /* Get the messageQ for the current thread */
-    if (!(pCurMsgQ = (MESSAGEQUEUE *)QUEUE_Lock( GetFastQueue16() )))
-    {
-        WARN_(win)("\tCurrent message queue not found. Exiting!\n" );
-        goto CLEANUP;
-    }
-    
-    /* Get the current capture window from the perQ data of the current message Q */
-    capturePrev = PERQDATA_GetCaptureWnd( pCurMsgQ->pQData );
+    capturePrev = GetCapture();
 
     if (!hwnd)
     {
-        captureWnd = 0L;
+        captureWnd = 0;
         captureHT = 0;
     }
     else
@@ -426,6 +418,13 @@ HWND EVENT_Capture(HWND hwnd, INT16 ht)
         }
     }
 
+    /* Get the messageQ for the current thread */
+    if (!(pCurMsgQ = (MESSAGEQUEUE *)QUEUE_Lock( GetFastQueue16() )))
+    {
+        WARN_(win)("\tCurrent message queue not found. Exiting!\n" );
+        goto CLEANUP;
+    }
+
     /* Update the perQ capture window and send messages */
     if( capturePrev != captureWnd )
     {
@@ -438,7 +437,7 @@ HWND EVENT_Capture(HWND hwnd, INT16 ht)
                 WARN_(win)("\tMessage queue not found. Exiting!\n" );
                 goto CLEANUP;
             }
-    
+
             /* Make sure that message queue for the window we are setting capture to
              * shares the same perQ data as the current threads message queue.
              */
@@ -446,17 +445,9 @@ HWND EVENT_Capture(HWND hwnd, INT16 ht)
                 goto CLEANUP;
         }
 
-        PERQDATA_SetCaptureWnd( pCurMsgQ->pQData, captureWnd );
-        PERQDATA_SetCaptureInfo( pCurMsgQ->pQData, captureHT );
-        
-        if( capturePrev )
-    {
-        WND* xwndPtr = WIN_FindWndPtr( capturePrev );
-        if( xwndPtr && (xwndPtr->flags & WIN_ISWIN32) )
-            SendMessageA( capturePrev, WM_CAPTURECHANGED, 0L, hwnd);
-	WIN_ReleaseWndPtr(xwndPtr);
+        PERQDATA_SetCaptureWnd( captureWnd, captureHT );
+        if (capturePrev) SendMessageA( capturePrev, WM_CAPTURECHANGED, 0, hwnd );
     }
-}
 
 CLEANUP:
     /* Unlock the queues before returning */
@@ -510,21 +501,8 @@ HWND16 WINAPI GetCapture16(void)
  */
 HWND WINAPI GetCapture(void)
 {
-    MESSAGEQUEUE *pCurMsgQ = 0;
-    HWND hwndCapture = 0;
-
-    /* Get the messageQ for the current thread */
-    if (!(pCurMsgQ = (MESSAGEQUEUE *)QUEUE_Lock( GetFastQueue16() )))
-{
-        TRACE_(win)("GetCapture: Current message queue not found. Exiting!\n" );
-        return 0;
-    }
-    
-    /* Get the current capture window from the perQ data of the current message Q */
-    hwndCapture = PERQDATA_GetCaptureWnd( pCurMsgQ->pQData );
-
-    QUEUE_Unlock( pCurMsgQ );
-    return hwndCapture;
+    INT hittest;
+    return PERQDATA_GetCaptureWnd( &hittest );
 }
 
 /**********************************************************************

windows/message.c

@@ -302,28 +302,17 @@ static BOOL process_raw_mouse_message( MSG *msg, ULONG_PTR extra_info )
 
     /* find the window to dispatch this mouse message to */
 
-    if (!(msg->hwnd = GetCapture()))
+    hittest = HTCLIENT;
+    if (!(msg->hwnd = PERQDATA_GetCaptureWnd( &ht )))
     {
         /* If no capture HWND, find window which contains the mouse position.
          * Also find the position of the cursor hot spot (hittest) */
         HWND hWndScope = (HWND)extra_info;
-        WND *pWndScope = IsWindow(hWndScope) ? WIN_FindWndPtr(hWndScope) : WIN_GetDesktop();
-        WND *pWnd;
 
-        ht = hittest = WINPOS_WindowFromPoint( pWndScope, msg->pt, &pWnd );
-        msg->hwnd = pWnd ? pWnd->hwndSelf : GetDesktopWindow();
-        WIN_ReleaseWndPtr( pWndScope );
-    }
-    else
-    {
-        MESSAGEQUEUE *queue = QUEUE_Lock( GetFastQueue16() );
-
-        ht = hittest = HTCLIENT;
-        if (queue)
-        {
-            ht = PERQDATA_GetCaptureInfo( queue->pQData );
-            QUEUE_Unlock(queue);
-        }
+        if (!IsWindow(hWndScope)) hWndScope = 0;
+        if (!(msg->hwnd = WINPOS_WindowFromPoint( hWndScope, msg->pt, &hittest )))
+            msg->hwnd = GetDesktopWindow();
+        ht = hittest;
     }
 
     if (HOOK_IsHooked( WH_JOURNALRECORD ))

windows/queue.c

@@ -23,7 +23,6 @@
 
 DEFAULT_DEBUG_CHANNEL(msg);
 
-#define MAX_QUEUE_SIZE   120  /* Max. size of a message queue */
 
 static HQUEUE16 hExitingQueue = 0;
 static PERQUEUEDATA *pQDataWin16 = NULL;  /* Global perQData for Win16 tasks */
@@ -32,6 +31,49 @@ HQUEUE16 hActiveQueue = 0;
 
 
 /***********************************************************************
+ *           PERQDATA_Addref
+ *
+ * Increment reference count for the PERQUEUEDATA instance
+ * Returns reference count for debugging purposes
+ */
+static void PERQDATA_Addref( PERQUEUEDATA *pQData )
+{
+    assert(pQData != 0 );
+    TRACE_(msg)("(): current refcount %lu ...\n", pQData->ulRefCount);
+
+    InterlockedIncrement( &pQData->ulRefCount );
+}
+
+
+/***********************************************************************
+ *           PERQDATA_Release
+ *
+ * Release a reference to a PERQUEUEDATA instance.
+ * Destroy the instance if no more references exist
+ * Returns reference count for debugging purposes
+ */
+static void PERQDATA_Release( PERQUEUEDATA *pQData )
+{
+    assert(pQData != 0 );
+    TRACE_(msg)("(): current refcount %lu ...\n",
+          (LONG)pQData->ulRefCount );
+
+    if (!InterlockedDecrement( &pQData->ulRefCount ))
+    {
+        DeleteCriticalSection( &pQData->cSection );
+
+        TRACE_(msg)("(): deleting PERQUEUEDATA instance ...\n" );
+
+        /* Deleting our global 16 bit perQData? */
+        if ( pQData == pQDataWin16 ) pQDataWin16 = 0;
+
+        /* Free the PERQUEUEDATA instance */
+        HeapFree( GetProcessHeap(), 0, pQData );
+    }
+}
+
+
+/***********************************************************************
  *           PERQDATA_CreateInstance
  *
  * Creates an instance of a reference counted PERQUEUEDATA element
@@ -43,7 +85,7 @@ HQUEUE16 hActiveQueue = 0;
  * We only store the current values for Active, Capture and focus windows
  * currently.
  */
-PERQUEUEDATA * PERQDATA_CreateInstance( )
+static PERQUEUEDATA * PERQDATA_CreateInstance(void)
 {
     PERQUEUEDATA *pQData;
     
@@ -88,61 +130,6 @@ PERQUEUEDATA * PERQDATA_CreateInstance( )
 
 
 /***********************************************************************
- *           PERQDATA_Addref
- *
- * Increment reference count for the PERQUEUEDATA instance
- * Returns reference count for debugging purposes
- */
-ULONG PERQDATA_Addref( PERQUEUEDATA *pQData )
-{
-    assert(pQData != 0 );
-    TRACE_(msg)("(): current refcount %lu ...\n", pQData->ulRefCount);
-
-    EnterCriticalSection( &pQData->cSection );
-    ++pQData->ulRefCount;
-    LeaveCriticalSection( &pQData->cSection );
-
-    return pQData->ulRefCount;
-}
-
-
-/***********************************************************************
- *           PERQDATA_Release
- *
- * Release a reference to a PERQUEUEDATA instance.
- * Destroy the instance if no more references exist
- * Returns reference count for debugging purposes
- */
-ULONG PERQDATA_Release( PERQUEUEDATA *pQData )
-{
-    assert(pQData != 0 );
-    TRACE_(msg)("(): current refcount %lu ...\n",
-          (LONG)pQData->ulRefCount );
-
-    EnterCriticalSection( &pQData->cSection );
-    if ( --pQData->ulRefCount == 0 )
-    {
-        LeaveCriticalSection( &pQData->cSection );
-        DeleteCriticalSection( &pQData->cSection );
-
-        TRACE_(msg)("(): deleting PERQUEUEDATA instance ...\n" );
-
-        /* Deleting our global 16 bit perQData? */
-        if ( pQData == pQDataWin16 )
-            pQDataWin16 = 0;
-            
-        /* Free the PERQUEUEDATA instance */
-        HeapFree( GetProcessHeap(), 0, pQData );
-
-        return 0;
-    }
-    LeaveCriticalSection( &pQData->cSection );
-
-    return pQData->ulRefCount;
-}
-
-
-/***********************************************************************
  *           PERQDATA_GetFocusWnd
  *
  * Get the focus hwnd member in a threadsafe manner
@@ -221,15 +208,21 @@ HWND PERQDATA_SetActiveWnd( PERQUEUEDATA *pQData, HWND hWndActive )
  *
  * Get the capture hwnd member in a threadsafe manner
  */
-HWND PERQDATA_GetCaptureWnd( PERQUEUEDATA *pQData )
+HWND PERQDATA_GetCaptureWnd( INT *hittest )
 {
+    MESSAGEQUEUE *queue;
+    PERQUEUEDATA *pQData;
     HWND hWndCapture;
-    assert(pQData != 0 );
+
+    if (!(queue = QUEUE_Lock( GetFastQueue16() ))) return 0;
+    pQData = queue->pQData;
 
     EnterCriticalSection( &pQData->cSection );
     hWndCapture = pQData->hWndCapture;
+    *hittest = pQData->nCaptureHT;
     LeaveCriticalSection( &pQData->cSection );
 
+    QUEUE_Unlock( queue );
     return hWndCapture;
 }
 
@@ -239,56 +232,26 @@ HWND PERQDATA_GetCaptureWnd( PERQUEUEDATA *pQData )
  *
  * Set the capture hwnd member in a threadsafe manner
  */
-HWND PERQDATA_SetCaptureWnd( PERQUEUEDATA *pQData, HWND hWndCapture )
+HWND PERQDATA_SetCaptureWnd( HWND hWndCapture, INT hittest )
 {
+    MESSAGEQUEUE *queue;
+    PERQUEUEDATA *pQData;
     HWND hWndCapturePrv;
-    assert(pQData != 0 );
+
+    if (!(queue = QUEUE_Lock( GetFastQueue16() ))) return 0;
+    pQData = queue->pQData;
 
     EnterCriticalSection( &pQData->cSection );
     hWndCapturePrv = pQData->hWndCapture;
     pQData->hWndCapture = hWndCapture;
+    pQData->nCaptureHT = hittest;
     LeaveCriticalSection( &pQData->cSection );
 
+    QUEUE_Unlock( queue );
     return hWndCapturePrv;
 }
 
 
-/***********************************************************************
- *           PERQDATA_GetCaptureInfo
- *
- * Get the capture info member in a threadsafe manner
- */
-INT16 PERQDATA_GetCaptureInfo( PERQUEUEDATA *pQData )
-{
-    INT16 nCaptureHT;
-    assert(pQData != 0 );
-
-    EnterCriticalSection( &pQData->cSection );
-    nCaptureHT = pQData->nCaptureHT;
-    LeaveCriticalSection( &pQData->cSection );
-
-    return nCaptureHT;
-}
-
-
-/***********************************************************************
- *           PERQDATA_SetCaptureInfo
- *
- * Set the capture info member in a threadsafe manner
- */
-INT16 PERQDATA_SetCaptureInfo( PERQUEUEDATA *pQData, INT16 nCaptureHT )
-{
-    INT16 nCaptureHTPrv;
-    assert(pQData != 0 );
-
-    EnterCriticalSection( &pQData->cSection );
-    nCaptureHTPrv = pQData->nCaptureHT;
-    pQData->nCaptureHT = nCaptureHT;
-    LeaveCriticalSection( &pQData->cSection );
-
-    return nCaptureHTPrv;
-}
-
 
 /***********************************************************************
  *	     QUEUE_Lock
@@ -330,7 +293,6 @@ void QUEUE_Unlock( MESSAGEQUEUE *queue )
 
         if ( --queue->lockCount == 0 )
         {
-            DeleteCriticalSection ( &queue->cSection );
             if (queue->server_queue)
                 CloseHandle( queue->server_queue );
             GlobalFree16( queue->self );
@@ -342,36 +304,6 @@ void QUEUE_Unlock( MESSAGEQUEUE *queue )
 
 
 /***********************************************************************
- *	     QUEUE_DumpQueue
- */
-void QUEUE_DumpQueue( HQUEUE16 hQueue )
-{
-    MESSAGEQUEUE *pq; 
-
-    if (!(pq = QUEUE_Lock( hQueue )) )
-    {
-        WARN_(msg)("%04x is not a queue handle\n", hQueue );
-        return;
-    }
-
-    EnterCriticalSection( &pq->cSection );
-
-    DPRINTF( "thread: %10p  Intertask SendMessage:\n"
-             "firstMsg: %8p   lastMsg:  %8p\n"
-             "lockCount: %7.4x\n"
-             "paints: %10.4x\n"
-             "hCurHook: %8.4x\n",
-             pq->teb, pq->firstMsg, pq->lastMsg,
-             (unsigned)pq->lockCount, pq->wPaintCount,
-             pq->hCurHook);
-
-    LeaveCriticalSection( &pq->cSection );
-
-    QUEUE_Unlock( pq );
-}
-
-
-/***********************************************************************
  *	     QUEUE_IsExitingQueue
  */
 BOOL QUEUE_IsExitingQueue( HQUEUE16 hQueue )
@@ -428,10 +360,6 @@ static HQUEUE16 QUEUE_CreateMsgQueue( BOOL16 bCreatePerQData )
     }
 
     msgQueue->self = hQueue;
-
-    InitializeCriticalSection( &msgQueue->cSection );
-    MakeCriticalSectionGlobal( &msgQueue->cSection );
-
     msgQueue->lockCount = 1;
     msgQueue->magic = QUEUE_MAGIC;
     
@@ -465,6 +393,7 @@ BOOL QUEUE_DeleteMsgQueue( HQUEUE16 hQueue )
     msgQueue->magic = 0;
 
     if( hActiveQueue == hQueue ) hActiveQueue = 0;
+    if (hExitingQueue == hQueue) hExitingQueue = 0;
 
     HeapLock( GetProcessHeap() );  /* FIXME: a bit overkill */
 

windows/winpos.c

@@ -364,20 +364,23 @@ BOOL WINAPI ScreenToClient( HWND hwnd, LPPOINT lppnt )
  *
  * Find the window and hittest for a given point.
  */
-INT16 WINPOS_WindowFromPoint( WND* wndScope, POINT pt, WND **ppWnd )
+HWND WINPOS_WindowFromPoint( HWND hwndScope, POINT pt, INT *hittest )
 {
-    WND *wndPtr;
-    INT16 hittest = HTERROR;
-    INT16 retvalue;
+    WND *wndScope, *wndPtr, *wndTmp;
+    HWND hwnd_ret = 0;
     POINT xy = pt;
 
-    TRACE("scope %04x %ld,%ld\n", wndScope->hwndSelf, pt.x, pt.y);
-   *ppWnd = NULL;
+    TRACE("scope %04x %ld,%ld\n", hwndScope, pt.x, pt.y);
+
+    if (!hwndScope) hwndScope = GetDesktopWindow();
+    if (!(wndScope = WIN_FindWndPtr( hwndScope ))) return 0;
+
+    *hittest = HTERROR;
     wndPtr = WIN_LockWndPtr(wndScope->child);
 
     if( wndScope->dwStyle & WS_DISABLED )
     {
-        retvalue = HTERROR;
+        *hittest = HTERROR;
         goto end;
     }
 
@@ -413,17 +416,17 @@ INT16 WINPOS_WindowFromPoint( WND* wndScope, POINT pt, WND **ppWnd )
 		 (xy.y < wndPtr->rectWindow.bottom))))
             {
                 TRACE("%ld,%ld is inside %04x\n", xy.x, xy.y, wndPtr->hwndSelf);
-                *ppWnd = wndPtr;  /* Got a suitable window */
+                hwnd_ret = wndPtr->hwndSelf;  /* Got a suitable window */
 
                 /* If window is minimized or disabled, return at once */
                 if (wndPtr->dwStyle & WS_MINIMIZE)
                 {
-                    retvalue = HTCAPTION;
+                    *hittest = HTCAPTION;
                     goto end;
                 }
                 if (wndPtr->dwStyle & WS_DISABLED)
                 {
-                    retvalue = HTERROR;
+                    *hittest = HTERROR;
                     goto end;
                 }
 
@@ -445,40 +448,43 @@ INT16 WINPOS_WindowFromPoint( WND* wndScope, POINT pt, WND **ppWnd )
 
 hittest:
         /* If nothing found, try the scope window */
-        if (!*ppWnd) *ppWnd = wndScope;
+        if (!hwnd_ret) hwnd_ret = hwndScope;
 
         /* Send the WM_NCHITTEST message (only if to the same task) */
-        if ((*ppWnd)->hmemTaskQ == GetFastQueue16())
+        if (GetWindowThreadProcessId( hwnd_ret, NULL ) == GetCurrentThreadId())
 	{
-            hittest = SendMessageA( (*ppWnd)->hwndSelf, WM_NCHITTEST,
-                                    0, MAKELONG( pt.x, pt.y ) );
-            if (hittest != HTTRANSPARENT)
+            INT res = SendMessageA( hwnd_ret, WM_NCHITTEST, 0, MAKELONG( pt.x, pt.y ) );
+            if (res != HTTRANSPARENT)
             {
-                retvalue = hittest;  /* Found the window */
+                *hittest = res;  /* Found the window */
                 goto end;
 	    }
 	}
         else
         {
-            retvalue = HTCLIENT;
+            *hittest = HTCLIENT;
             goto end;
 	}
 
+        if (!(wndTmp = WIN_FindWndPtr( hwnd_ret ))) break;
+
         /* If no children found in last search, make point relative to parent */
         if (!wndPtr)
         {
-            xy.x += (*ppWnd)->rectClient.left;
-            xy.y += (*ppWnd)->rectClient.top;
+            xy.x += wndTmp->rectClient.left;
+            xy.y += wndTmp->rectClient.top;
         }
 
         /* Restart the search from the next sibling */
-        WIN_UpdateWndPtr(&wndPtr,(*ppWnd)->next);
-        *ppWnd = (*ppWnd)->parent;
+        WIN_UpdateWndPtr(&wndPtr,wndTmp->next);
+        hwnd_ret = wndTmp->parent ? wndTmp->parent->hwndSelf : 0;
+        WIN_ReleaseWndPtr( wndTmp );
     }
 
 end:
     WIN_ReleaseWndPtr(wndPtr);
-    return retvalue;
+    WIN_ReleaseWndPtr(wndScope);
+    return hwnd_ret;
 }
 
 
@@ -499,10 +505,8 @@ HWND16 WINAPI WindowFromPoint16( POINT16 pt )
  */
 HWND WINAPI WindowFromPoint( POINT pt )
 {
-    WND *pWnd;
-    WINPOS_WindowFromPoint( WIN_GetDesktop(), pt, &pWnd );
-    WIN_ReleaseDesktop();
-    return (HWND)pWnd->hwndSelf;
+    INT hittest;
+    return WINPOS_WindowFromPoint( 0, pt, &hittest );
 }
 
 
@@ -1577,13 +1581,13 @@ BOOL WINPOS_SetActiveWindow( HWND hWnd, BOOL fMouse, BOOL fChangeFocus)
 
         if ((list = WIN_BuildWinArray( pDesktop, 0, NULL )))
         {
+            DWORD new_thread = GetWindowThreadProcessId( hwndActive, NULL );
             for (ppWnd = list; *ppWnd; ppWnd++)
             {
                 if (!IsWindow( (*ppWnd)->hwndSelf )) continue;
 
                 if ((*ppWnd)->hmemTaskQ == hOldActiveQueue)
-                   SendMessage16( (*ppWnd)->hwndSelf, WM_ACTIVATEAPP,
-                                   0, QUEUE_GetQueueTask(hNewActiveQueue) );
+                    SendMessageW( (*ppWnd)->hwndSelf, WM_ACTIVATEAPP, 0, new_thread );
             }
             WIN_ReleaseWinArray(list);
         }
@@ -1592,13 +1596,13 @@ BOOL WINPOS_SetActiveWindow( HWND hWnd, BOOL fMouse, BOOL fChangeFocus)
 
         if ((list = WIN_BuildWinArray(pDesktop, 0, NULL )))
         {
+            DWORD old_thread = GetWindowThreadProcessId( hwndPrevActive, NULL );
             for (ppWnd = list; *ppWnd; ppWnd++)
             {
                 if (!IsWindow( (*ppWnd)->hwndSelf )) continue;
 
                 if ((*ppWnd)->hmemTaskQ == hNewActiveQueue)
-                   SendMessage16( (*ppWnd)->hwndSelf, WM_ACTIVATEAPP,
-                                  1, QUEUE_GetQueueTask( hOldActiveQueue ) );
+                    SendMessageW( (*ppWnd)->hwndSelf, WM_ACTIVATEAPP, 1, old_thread );
             }
             WIN_ReleaseWinArray(list);
         }

windows/winproc.c

@@ -2018,7 +2018,11 @@ INT WINPROC_MapMsg32ATo16( HWND hwnd, UINT msg32, WPARAM wParam32,
     case WM_WININICHANGE:
         FIXME_(msg)("message %04x needs translation\n", msg32 );
         return -1;
-    case WM_SIZING:  /* should not be send to 16-bit apps */
+    /* following messages should not be sent to 16-bit apps */
+    case WM_SIZING:
+    case WM_CAPTURECHANGED:
+    case WM_STYLECHANGING:
+    case WM_STYLECHANGED:
         return -1;
     default:  /* No translation needed */
         return 0;