From bd1fab7862a97009fcbd7a1d1239cb0704fd139b Mon Sep 17 00:00:00 2001
From: Alexandre Julliard <julliard@winehq.org>
Date: Thu, 21 Apr 2011 14:35:11 +0200
Subject: [PATCH] user32: Don't start menu tracking when the owner window is
 invalid.

---
 dlls/user32/menu.c       |  5 +++++
 dlls/user32/tests/menu.c | 14 ++++++++++++++
 2 files changed, 19 insertions(+)

diff --git a/dlls/user32/menu.c b/dlls/user32/menu.c
index e834cbdcee2..7fd7d4c8837 100644
--- a/dlls/user32/menu.c
+++ b/dlls/user32/menu.c
@@ -1848,6 +1848,11 @@ static BOOL MENU_ShowPopup( HWND hwndOwner, HMENU hmenu, UINT id, UINT flags,
     }
 
     /* store the owner for DrawItem */
+    if (!IsWindow( hwndOwner ))
+    {
+        SetLastError( ERROR_INVALID_WINDOW_HANDLE );
+        return FALSE;
+    }
     menu->hwndOwner = hwndOwner;
 
     menu->nScrollPos = 0;
diff --git a/dlls/user32/tests/menu.c b/dlls/user32/tests/menu.c
index c0c8b9e9254..26fe6fb6579 100644
--- a/dlls/user32/tests/menu.c
+++ b/dlls/user32/tests/menu.c
@@ -2932,6 +2932,20 @@ static void test_menu_trackpopupmenu(void)
                 gflag_initmenupopup ? " WM_INITMENUPOPUP ": " ",
                 gflag_entermenuloop ? "WM_INITMENULOOP ": "",
                 gflag_initmenu ? "WM_INITMENU": "");
+
+        /* invalid window */
+        SetLastError(0xdeadbeef);
+        gflag_initmenupopup = gflag_entermenuloop = gflag_initmenu = 0;
+        ret = MyTrackPopupMenu( Ex, hmenu, TPM_RETURNCMD, 100,100, 0, NULL);
+        gle = GetLastError();
+        ok( !ret, "TrackPopupMenu%s should have failed\n", Ex ? "Ex" : "");
+        ok( gle == ERROR_INVALID_WINDOW_HANDLE, "TrackPopupMenu%s error got %u\n", Ex ? "Ex" : "", gle );
+        ok( !(gflag_initmenupopup || gflag_entermenuloop || gflag_initmenu),
+                "got unexpected message(s)%s%s%s\n",
+                gflag_initmenupopup ? " WM_INITMENUPOPUP ": " ",
+                gflag_entermenuloop ? "WM_INITMENULOOP ": "",
+                gflag_initmenu ? "WM_INITMENU": "");
+
         /* now a somewhat successful call */
         SetLastError(0xdeadbeef);
         gflag_initmenupopup = gflag_entermenuloop = gflag_initmenu = 0;