dlls/oleaut32/tests/usrmarshal.c

   1 /*
   2  * Marshaling Tests
   3  *
   4  * Copyright 2004 Robert Shearman
   5  *
   6  * This library is free software; you can redistribute it and/or
   7  * modify it under the terms of the GNU Lesser General Public
   8  * License as published by the Free Software Foundation; either
   9  * version 2.1 of the License, or (at your option) any later version.
  10  *
  11  * This library is distributed in the hope that it will be useful,
  12  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  13  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  14  * Lesser General Public License for more details.
  15  *
  16  * You should have received a copy of the GNU Lesser General Public
  17  * License along with this library; if not, write to the Free Software
  18  * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA
  19  */
  20
  21 #define COBJMACROS
  22 #define CONST_VTABLE
  23
  24 #include <stdarg.h>
  25
  26 #include "windef.h"
  27 #include "winbase.h"
  28 #include "objbase.h"
  29 #include "propidl.h" /* for LPSAFEARRAY_User* routines */
  30
  31 #include "wine/test.h"
  32
  33 typedef struct
  34 {
  35     IUnknown IUnknown_iface;
  36     ULONG refs;
  37 } HeapUnknown;
  38
  39 static const IUnknownVtbl HeapUnknown_Vtbl;
  40
  41 static inline SF_TYPE get_union_type(SAFEARRAY *psa)
  42 {
  43     VARTYPE vt;
  44     HRESULT hr;
  45
  46     hr = SafeArrayGetVartype(psa, &vt);
  47     if (FAILED(hr))
  48     {
  49         if(psa->fFeatures & FADF_VARIANT) return SF_VARIANT;
  50
  51         switch(psa->cbElements)
  52         {
  53         case 1: vt = VT_I1; break;
  54         case 2: vt = VT_I2; break;
  55         case 4: vt = VT_I4; break;
  56         case 8: vt = VT_I8; break;
  57         default: return 0;
  58         }
  59     }
  60
  61     if (psa->fFeatures & FADF_HAVEIID)
  62         return SF_HAVEIID;
  63
  64     switch (vt)
  65     {
  66     case VT_I1:
  67     case VT_UI1:      return SF_I1;
  68     case VT_BOOL:
  69     case VT_I2:
  70     case VT_UI2:      return SF_I2;
  71     case VT_INT:
  72     case VT_UINT:
  73     case VT_I4:
  74     case VT_UI4:
  75     case VT_R4:       return SF_I4;
  76     case VT_DATE:
  77     case VT_CY:
  78     case VT_R8:
  79     case VT_I8:
  80     case VT_UI8:      return SF_I8;
  81     case VT_INT_PTR:
  82     case VT_UINT_PTR: return (sizeof(UINT_PTR) == 4 ? SF_I4 : SF_I8);
  83     case VT_BSTR:     return SF_BSTR;
  84     case VT_DISPATCH: return SF_DISPATCH;
  85     case VT_VARIANT:  return SF_VARIANT;
  86     case VT_UNKNOWN:  return SF_UNKNOWN;
  87     /* Note: Return a non-zero size to indicate vt is valid. The actual size
  88      * of a UDT is taken from the result of IRecordInfo_GetSize().
  89      */
  90     case VT_RECORD:   return SF_RECORD;
  91     default:          return SF_ERROR;
  92     }
  93 }
  94
  95 static ULONG get_cell_count(const SAFEARRAY *psa)
  96 {
  97     const SAFEARRAYBOUND* psab = psa->rgsabound;
  98     USHORT cCount = psa->cDims;
  99     ULONG ulNumCells = 1;
 100
 101     while (cCount--)
 102     {
 103          if (!psab->cElements)
 104             return 0;
 105         ulNumCells *= psab->cElements;
 106         psab++;
 107     }
 108     return ulNumCells;
 109 }
 110
 111 static DWORD elem_wire_size(LPSAFEARRAY lpsa, SF_TYPE sftype)
 112 {
 113     switch (sftype)
 114     {
 115     case SF_HAVEIID:
 116     case SF_UNKNOWN:
 117     case SF_DISPATCH:
 118     case SF_BSTR:
 119         return sizeof(DWORD);
 120
 121     default:
 122         return lpsa->cbElements;
 123     }
 124 }
 125
 126 static void check_safearray(void *buffer, LPSAFEARRAY lpsa)
 127 {
 128     unsigned char *wiresa = buffer;
 129     const SAFEARRAYBOUND *bounds;
 130     VARTYPE vt;
 131     SF_TYPE sftype;
 132     ULONG cell_count;
 133     int i;
 134
 135     if(!lpsa)
 136     {
 137         ok(*(DWORD *)wiresa == 0, "wiresa + 0x0 should be NULL instead of 0x%08lx\n", *(DWORD *)wiresa);
 138         return;
 139     }
 140
 141     /* If FADF_HAVEIID is set, VT will be 0. */
 142     if((lpsa->fFeatures & FADF_HAVEIID) || FAILED(SafeArrayGetVartype(lpsa, &vt)))
 143         vt = 0;
 144
 145     sftype = get_union_type(lpsa);
 146     cell_count = get_cell_count(lpsa);
 147
 148     ok(*(DWORD *)wiresa, "wiresa + 0x0 should be non-NULL instead of 0x%08lx\n", *(DWORD *)wiresa); /* win2k: this is lpsa. winxp: this is 0x00000001 */
 149     wiresa += sizeof(DWORD);
 150     ok(*(DWORD *)wiresa == lpsa->cDims, "wiresa + 0x4 should be lpsa->cDims instead of 0x%08lx\n", *(DWORD *)wiresa);
 151     wiresa += sizeof(DWORD);
 152     ok(*(WORD *)wiresa == lpsa->cDims, "wiresa + 0x8 should be lpsa->cDims instead of 0x%04x\n", *(WORD *)wiresa);
 153     wiresa += sizeof(WORD);
 154     ok(*(WORD *)wiresa == lpsa->fFeatures, "wiresa + 0xa should be lpsa->fFeatures instead of 0x%08x\n", *(WORD *)wiresa);
 155     wiresa += sizeof(WORD);
 156     ok(*(DWORD *)wiresa == elem_wire_size(lpsa, sftype), "wiresa + 0xc should be 0x%08lx instead of 0x%08lx\n", elem_wire_size(lpsa, sftype), *(DWORD *)wiresa);
 157     wiresa += sizeof(DWORD);
 158     ok(*(WORD *)wiresa == lpsa->cLocks, "wiresa + 0x10 should be lpsa->cLocks instead of 0x%04x\n", *(WORD *)wiresa);
 159     wiresa += sizeof(WORD);
 160     ok(*(WORD *)wiresa == vt, "wiresa + 0x12 should be %04x instead of 0x%04x\n", vt, *(WORD *)wiresa);
 161     wiresa += sizeof(WORD);
 162     ok(*(DWORD *)wiresa == sftype, "wiresa + 0x14 should be %08lx instead of 0x%08lx\n", (DWORD)sftype, *(DWORD *)wiresa);
 163     wiresa += sizeof(DWORD);
 164     ok(*(DWORD *)wiresa == cell_count, "wiresa + 0x18 should be %lu instead of %lu\n", cell_count, *(DWORD *)wiresa);
 165     wiresa += sizeof(DWORD);
 166     ok(*(DWORD *)wiresa, "wiresa + 0x1c should be non-zero instead of 0x%08lx\n", *(DWORD *)wiresa);
 167     wiresa += sizeof(DWORD);
 168     if(sftype == SF_HAVEIID)
 169     {
 170         GUID guid;
 171         SafeArrayGetIID(lpsa, &guid);
 172         ok(IsEqualGUID(&guid, wiresa), "guid mismatch\n");
 173         wiresa += sizeof(GUID);
 174     }
 175
 176     /* bounds are marshaled in natural dimensions order */
 177     bounds = (SAFEARRAYBOUND*)wiresa;
 178     for(i=0; i<lpsa->cDims; i++)
 179     {
 180         ok(memcmp(bounds, &lpsa->rgsabound[lpsa->cDims-i-1], sizeof(SAFEARRAYBOUND)) == 0,
 181            "bounds mismatch for dimension %d, got (%ld,%ld), expected (%ld,%ld)\n", i,
 182             bounds->lLbound, bounds->cElements, lpsa->rgsabound[lpsa->cDims-i-1].lLbound,
 183             lpsa->rgsabound[lpsa->cDims-i-1].cElements);
 184         bounds++;
 185     }
 186
 187     wiresa += sizeof(lpsa->rgsabound[0]) * lpsa->cDims;
 188
 189     ok(*(DWORD *)wiresa == cell_count, "wiresa + 0x28 should be %lu instead of %lu\n", cell_count, *(DWORD*)wiresa);
 190     wiresa += sizeof(DWORD);
 191     /* elements are now pointed to by wiresa */
 192 }
 193
 194 static void * WINAPI user_allocate(SIZE_T size)
 195 {
 196     ok(0, "unexpected user_allocate call\n");
 197     return CoTaskMemAlloc(size);
 198 }
 199
 200 static void WINAPI user_free(void *p)
 201 {
 202     ok(0, "unexpected user_free call\n");
 203     CoTaskMemFree(p);
 204 }
 205
 206 static void init_user_marshal_cb(USER_MARSHAL_CB *umcb,
 207                                  PMIDL_STUB_MESSAGE stub_msg,
 208                                  PRPC_MESSAGE rpc_msg, unsigned char *buffer,
 209                                  unsigned int size, MSHCTX context)
 210 {
 211     memset(rpc_msg, 0, sizeof(*rpc_msg));
 212     rpc_msg->Buffer = buffer;
 213     rpc_msg->BufferLength = size;
 214
 215     memset(stub_msg, 0, sizeof(*stub_msg));
 216     stub_msg->RpcMsg = rpc_msg;
 217     stub_msg->Buffer = buffer;
 218     stub_msg->pfnAllocate = user_allocate;
 219     stub_msg->pfnFree = user_free;
 220
 221     memset(umcb, 0, sizeof(*umcb));
 222     umcb->Flags = MAKELONG(context, NDR_LOCAL_DATA_REPRESENTATION);
 223     umcb->pStubMsg = stub_msg;
 224     umcb->Signature = USER_MARSHAL_CB_SIGNATURE;
 225     umcb->CBType = buffer ? USER_MARSHAL_CB_UNMARSHALL : USER_MARSHAL_CB_BUFFER_SIZE;
 226 }
 227
 228 static void test_marshal_LPSAFEARRAY(void)
 229 {
 230     HeapUnknown *heap_unknown[10];
 231     unsigned char *buffer, *next;
 232     ULONG size, expected, size2;
 233     LPSAFEARRAY lpsa;
 234     LPSAFEARRAY lpsa2 = NULL;
 235     SAFEARRAYBOUND sab[2];
 236     RPC_MESSAGE rpc_msg;
 237     MIDL_STUB_MESSAGE stub_msg;
 238     USER_MARSHAL_CB umcb;
 239     HRESULT hr;
 240     VARTYPE vt, vt2;
 241     OLECHAR *values[10];
 242     int expected_bstr_size;
 243     int i;
 244     LONG indices[1];
 245
 246     sab[0].lLbound = 5;
 247     sab[0].cElements = 10;
 248
 249     lpsa = SafeArrayCreate(VT_I2, 1, sab);
 250     *(DWORD *)lpsa->pvData = 0xcafebabe;
 251
 252     lpsa->cLocks = 7;
 253     init_user_marshal_cb(&umcb, &stub_msg, &rpc_msg, NULL, 0, MSHCTX_DIFFERENTMACHINE);
 254     size = LPSAFEARRAY_UserSize(&umcb.Flags, 1, &lpsa);
 255     expected = (44 + 1 + sizeof(ULONG) - 1) & ~(sizeof(ULONG) - 1);
 256     expected += sab[0].cElements * sizeof(USHORT);
 257     ok(size == expected || size == expected + 12, /* win64 */
 258        "size should be %lu bytes, not %lu\n", expected, size);
 259     init_user_marshal_cb(&umcb, &stub_msg, &rpc_msg, NULL, 0, MSHCTX_DIFFERENTMACHINE);
 260     size = LPSAFEARRAY_UserSize(&umcb.Flags, 0, &lpsa);
 261     expected = 44 + sab[0].cElements * sizeof(USHORT);
 262     ok(size == expected || size == expected + 12, /* win64 */
 263        "size should be %lu bytes, not %lu\n", expected, size);
 264     buffer = HeapAlloc(GetProcessHeap(), 0, size);
 265     init_user_marshal_cb(&umcb, &stub_msg, &rpc_msg, buffer, size, MSHCTX_DIFFERENTMACHINE);
 266     next = LPSAFEARRAY_UserMarshal(&umcb.Flags, buffer, &lpsa);
 267     ok(next - buffer == expected, "Marshaled %lu bytes, expected %lu\n", (ULONG) (next - buffer), expected);
 268     ok(lpsa->cLocks == 7, "got lock count %lu\n", lpsa->cLocks);
 269
 270     check_safearray(buffer, lpsa);
 271
 272     init_user_marshal_cb(&umcb, &stub_msg, &rpc_msg, buffer, size, MSHCTX_DIFFERENTMACHINE);
 273     LPSAFEARRAY_UserUnmarshal(&umcb.Flags, buffer, &lpsa2);
 274     ok(lpsa2 != NULL, "LPSAFEARRAY didn't unmarshal\n");
 275     SafeArrayGetVartype(lpsa, &vt);
 276     SafeArrayGetVartype(lpsa2, &vt2);
 277     ok(vt == vt2, "vts differ %x %x\n", vt, vt2);
 278     ok(lpsa2->cLocks == 0, "got lock count %lu, expected 0\n", lpsa2->cLocks);
 279     init_user_marshal_cb(&umcb, &stub_msg, &rpc_msg, NULL, 0, MSHCTX_DIFFERENTMACHINE);
 280     LPSAFEARRAY_UserFree(&umcb.Flags, &lpsa2);
 281     ok(!lpsa2, "lpsa2 was not set to 0 by LPSAFEARRAY_UserFree\n");
 282     HeapFree(GetProcessHeap(), 0, buffer);
 283     lpsa->cLocks = 0;
 284     hr = SafeArrayDestroy(lpsa);
 285     ok(hr == S_OK, "got 0x%08lx\n", hr);
 286
 287     /* use two dimensions */
 288     sab[0].lLbound = 5;
 289     sab[0].cElements = 10;
 290     sab[1].lLbound = 1;
 291     sab[1].cElements = 2;
 292
 293     lpsa = SafeArrayCreate(VT_I2, 2, sab);
 294     *(DWORD *)lpsa->pvData = 0xcafebabe;
 295
 296     lpsa->cLocks = 7;
 297     init_user_marshal_cb(&umcb, &stub_msg, &rpc_msg, NULL, 0, MSHCTX_DIFFERENTMACHINE);
 298     size = LPSAFEARRAY_UserSize(&umcb.Flags, 1, &lpsa);
 299     expected = (44 + 1 + +sizeof(SAFEARRAYBOUND) + sizeof(ULONG) - 1) & ~(sizeof(ULONG) - 1);
 300     expected += max(sab[0].cElements, sab[1].cElements) * lpsa->cDims * sizeof(USHORT);
 301     ok(size == expected || size == expected + 12, /* win64 */
 302        "size should be %lu bytes, not %lu\n", expected, size);
 303     init_user_marshal_cb(&umcb, &stub_msg, &rpc_msg, NULL, 0, MSHCTX_DIFFERENTMACHINE);
 304     size = LPSAFEARRAY_UserSize(&umcb.Flags, 0, &lpsa);
 305     expected = 52 + max(sab[0].cElements, sab[1].cElements) * lpsa->cDims * sizeof(USHORT);
 306     ok(size == expected || size == expected + 12, /* win64 */
 307        "size should be %lu bytes, not %lu\n", expected, size);
 308     buffer = HeapAlloc(GetProcessHeap(), 0, size);
 309     init_user_marshal_cb(&umcb, &stub_msg, &rpc_msg, buffer, size, MSHCTX_DIFFERENTMACHINE);
 310     next = LPSAFEARRAY_UserMarshal(&umcb.Flags, buffer, &lpsa);
 311     ok(next - buffer == expected, "Marshaled %lu bytes, expected %lu\n", (ULONG) (next - buffer), expected);
 312     ok(lpsa->cLocks == 7, "got lock count %lu\n", lpsa->cLocks);
 313
 314     check_safearray(buffer, lpsa);
 315
 316     init_user_marshal_cb(&umcb, &stub_msg, &rpc_msg, buffer, size, MSHCTX_DIFFERENTMACHINE);
 317     LPSAFEARRAY_UserUnmarshal(&umcb.Flags, buffer, &lpsa2);
 318     ok(lpsa2 != NULL, "LPSAFEARRAY didn't unmarshal\n");
 319     SafeArrayGetVartype(lpsa, &vt);
 320     SafeArrayGetVartype(lpsa2, &vt2);
 321     ok(vt == vt2, "vts differ %x %x\n", vt, vt2);
 322     ok(lpsa2->cLocks == 0, "got lock count %lu, expected 0\n", lpsa2->cLocks);
 323     init_user_marshal_cb(&umcb, &stub_msg, &rpc_msg, NULL, 0, MSHCTX_DIFFERENTMACHINE);
 324     LPSAFEARRAY_UserFree(&umcb.Flags, &lpsa2);
 325     HeapFree(GetProcessHeap(), 0, buffer);
 326     lpsa->cLocks = 0;
 327     hr = SafeArrayDestroy(lpsa);
 328     ok(hr == S_OK, "got 0x%08lx\n", hr);
 329
 330     /* test NULL safe array */
 331     lpsa = NULL;
 332
 333     init_user_marshal_cb(&umcb, &stub_msg, &rpc_msg, NULL, 0, MSHCTX_DIFFERENTMACHINE);
 334     size = LPSAFEARRAY_UserSize(&umcb.Flags, 0, &lpsa);
 335     expected = 4;
 336     ok(size == expected, "size should be 4 bytes, not %ld\n", size);
 337     buffer = HeapAlloc(GetProcessHeap(), 0, size);
 338     init_user_marshal_cb(&umcb, &stub_msg, &rpc_msg, buffer, size, MSHCTX_DIFFERENTMACHINE);
 339     next = LPSAFEARRAY_UserMarshal(&umcb.Flags, buffer, &lpsa);
 340     ok(next - buffer == expected, "Marshaled %lu bytes, expected %lu\n", (ULONG) (next - buffer), expected);
 341     check_safearray(buffer, lpsa);
 342
 343     init_user_marshal_cb(&umcb, &stub_msg, &rpc_msg, buffer, size, MSHCTX_DIFFERENTMACHINE);
 344     LPSAFEARRAY_UserUnmarshal(&umcb.Flags, buffer, &lpsa2);
 345     ok(lpsa2 == NULL, "NULL LPSAFEARRAY didn't unmarshal\n");
 346     init_user_marshal_cb(&umcb, &stub_msg, &rpc_msg, NULL, 0, MSHCTX_DIFFERENTMACHINE);
 347     LPSAFEARRAY_UserFree(&umcb.Flags, &lpsa2);
 348     HeapFree(GetProcessHeap(), 0, buffer);
 349
 350     sab[0].lLbound = 5;
 351     sab[0].cElements = 10;
 352
 353     lpsa = SafeArrayCreate(VT_R8, 1, sab);
 354     *(double *)lpsa->pvData = 3.1415;
 355
 356     lpsa->cLocks = 7;
 357     init_user_marshal_cb(&umcb, &stub_msg, &rpc_msg, NULL, 0, MSHCTX_DIFFERENTMACHINE);
 358     size = LPSAFEARRAY_UserSize(&umcb.Flags, 1, &lpsa);
 359     expected = (44 + 1 + (sizeof(double) - 1)) & ~(sizeof(double) - 1);
 360     expected += sab[0].cElements * sizeof(double);
 361     ok(size == expected || size == expected + 16, /* win64 */
 362        "size should be %lu bytes, not %lu\n", expected, size);
 363     init_user_marshal_cb(&umcb, &stub_msg, &rpc_msg, NULL, 0, MSHCTX_DIFFERENTMACHINE);
 364     expected = (44 + (sizeof(double) - 1)) & ~(sizeof(double) - 1);
 365     expected += sab[0].cElements * sizeof(double);
 366     size = LPSAFEARRAY_UserSize(&umcb.Flags, 0, &lpsa);
 367     ok(size == expected || size == expected + 8, /* win64 */
 368        "size should be %lu bytes, not %lu\n", expected, size);
 369     buffer = HeapAlloc(GetProcessHeap(), 0, size);
 370     init_user_marshal_cb(&umcb, &stub_msg, &rpc_msg, buffer, size, MSHCTX_DIFFERENTMACHINE);
 371     next = LPSAFEARRAY_UserMarshal(&umcb.Flags, buffer, &lpsa);
 372     ok(next - buffer == expected || broken(next - buffer + sizeof(DWORD) == expected),
 373             "Marshaled %lu bytes, expected %lu\n", (ULONG) (next - buffer), expected);
 374
 375     check_safearray(buffer, lpsa);
 376
 377     HeapFree(GetProcessHeap(), 0, buffer);
 378     lpsa->cLocks = 0;
 379     hr = SafeArrayDestroy(lpsa);
 380     ok(hr == S_OK, "got 0x%08lx\n", hr);
 381
 382     /* VARTYPE-less arrays can be marshaled if cbElements is 1,2,4 or 8 as type SF_In */
 383     hr = SafeArrayAllocDescriptor(1, &lpsa);
 384     ok(hr == S_OK, "saad failed %08lx\n", hr);
 385     lpsa->cbElements = 8;
 386     lpsa->rgsabound[0].lLbound = 2;
 387     lpsa->rgsabound[0].cElements = 48;
 388     hr = SafeArrayAllocData(lpsa);
 389     ok(hr == S_OK, "saad failed %08lx\n", hr);
 390     hr = SafeArrayGetVartype(lpsa, &vt);
 391     ok(hr == E_INVALIDARG, "ret %08lx\n", hr);
 392
 393     init_user_marshal_cb(&umcb, &stub_msg, &rpc_msg, NULL, 0, MSHCTX_DIFFERENTMACHINE);
 394     size = LPSAFEARRAY_UserSize(&umcb.Flags, 0, &lpsa);
 395     expected = (44 + lpsa->cbElements - 1) & ~(lpsa->cbElements - 1);
 396     expected += lpsa->cbElements * lpsa->rgsabound[0].cElements;
 397     ok(size == expected || size == expected + 8,  /* win64 */
 398        "size should be %lu bytes, not %lu\n", expected, size);
 399     buffer = HeapAlloc(GetProcessHeap(), 0, size);
 400     init_user_marshal_cb(&umcb, &stub_msg, &rpc_msg, buffer, size, MSHCTX_DIFFERENTMACHINE);
 401     next = LPSAFEARRAY_UserMarshal(&umcb.Flags, buffer, &lpsa);
 402     ok(next - buffer == expected || broken(next - buffer + sizeof(DWORD) == expected),
 403             "Marshaled %lu bytes, expected %lu\n", (ULONG) (next - buffer), expected);
 404     check_safearray(buffer, lpsa);
 405     HeapFree(GetProcessHeap(), 0, buffer);
 406     hr = SafeArrayDestroyData(lpsa);
 407     ok(hr == S_OK, "got 0x%08lx\n", hr);
 408     hr = SafeArrayDestroyDescriptor(lpsa);
 409     ok(hr == S_OK, "got 0x%08lx\n", hr);
 410
 411     /* Test an array of VT_BSTR */
 412     sab[0].lLbound = 3;
 413     sab[0].cElements = ARRAY_SIZE(values);
 414
 415     lpsa = SafeArrayCreate(VT_BSTR, 1, sab);
 416     expected_bstr_size = 0;
 417     for (i = 0; i < sab[0].cElements; i++)
 418     {
 419         int j;
 420         WCHAR buf[128];
 421         for (j = 0; j <= i; j++)
 422             buf[j] = 'a' + j;
 423         buf[j] = 0;
 424         indices[0] = i + sab[0].lLbound;
 425         values[i] = SysAllocString(buf);
 426         hr = SafeArrayPutElement(lpsa, indices, values[i]);
 427         ok(hr == S_OK, "Failed to put bstr element hr 0x%lx\n", hr);
 428         expected_bstr_size += (j * sizeof(WCHAR)) + (3 * sizeof(DWORD));
 429         if (i % 2 == 0) /* Account for DWORD padding.  Works so long as cElements is even */
 430             expected_bstr_size += sizeof(WCHAR);
 431     }
 432
 433     init_user_marshal_cb(&umcb, &stub_msg, &rpc_msg, NULL, 0, MSHCTX_DIFFERENTMACHINE);
 434     size = LPSAFEARRAY_UserSize(&umcb.Flags, 1, &lpsa);
 435     expected = 44 + (sab[0].cElements * sizeof(DWORD)) + expected_bstr_size;
 436     todo_wine
 437     ok(size == expected + sizeof(DWORD) || size  == (expected + sizeof(DWORD) + 12 /* win64 */),
 438             "size should be %lu bytes, not %lu\n", expected + (ULONG) sizeof(DWORD), size);
 439     init_user_marshal_cb(&umcb, &stub_msg, &rpc_msg, NULL, 0, MSHCTX_DIFFERENTMACHINE);
 440     size = LPSAFEARRAY_UserSize(&umcb.Flags, 0, &lpsa);
 441     todo_wine
 442     ok(size == expected || size  == (expected + 12 /* win64 */),
 443         "size should be %lu bytes, not %lu\n", expected, size);
 444     buffer = HeapAlloc(GetProcessHeap(), 0, size);
 445     memset(buffer, 0xcc, size);
 446     init_user_marshal_cb(&umcb, &stub_msg, &rpc_msg, buffer, size, MSHCTX_DIFFERENTMACHINE);
 447     next = LPSAFEARRAY_UserMarshal(&umcb.Flags, buffer, &lpsa);
 448     todo_wine
 449     ok(next - buffer == expected, "Marshaled %lu bytes, expected %lu\n", (ULONG) (next - buffer), expected);
 450
 451     check_safearray(buffer, lpsa);
 452
 453     lpsa2 = NULL;
 454     init_user_marshal_cb(&umcb, &stub_msg, &rpc_msg, buffer, size, MSHCTX_DIFFERENTMACHINE);
 455     next = LPSAFEARRAY_UserUnmarshal(&umcb.Flags, buffer, &lpsa2);
 456     todo_wine
 457     ok(next - buffer == expected, "Marshaled %lu bytes, expected %lu\n", (ULONG) (next - buffer), expected);
 458     ok(lpsa2 != NULL, "LPSAFEARRAY didn't unmarshal, result %p\n", next);
 459
 460     for (i = 0; i < ARRAY_SIZE(values); i++)
 461     {
 462         BSTR gotvalue = NULL;
 463
 464         if (lpsa2)
 465         {
 466             indices[0] = i + sab[0].lLbound;
 467             hr = SafeArrayGetElement(lpsa2, indices, &gotvalue);
 468             ok(hr == S_OK, "Failed to get bstr element at hres 0x%lx\n", hr);
 469             if (hr == S_OK)
 470             {
 471                 ok(VarBstrCmp(values[i], gotvalue, 0, 0) == VARCMP_EQ, "String %d does not match\n", i);
 472                 SysFreeString(gotvalue);
 473             }
 474         }
 475
 476         SysFreeString(values[i]);
 477     }
 478
 479     init_user_marshal_cb(&umcb, &stub_msg, &rpc_msg, NULL, 0, MSHCTX_DIFFERENTMACHINE);
 480     LPSAFEARRAY_UserFree(&umcb.Flags, &lpsa2);
 481
 482     HeapFree(GetProcessHeap(), 0, buffer);
 483     hr = SafeArrayDestroy(lpsa);
 484     ok(hr == S_OK, "got 0x%08lx\n", hr);
 485
 486     /* VARTYPE-less arrays with FADF_VARIANT */
 487     hr = SafeArrayAllocDescriptor(1, &lpsa);
 488     ok(hr == S_OK, "saad failed %08lx\n", hr);
 489     lpsa->cbElements = sizeof(VARIANT);
 490     lpsa->fFeatures = FADF_VARIANT;
 491     lpsa->rgsabound[0].lLbound = 2;
 492     lpsa->rgsabound[0].cElements = 48;
 493     hr = SafeArrayAllocData(lpsa);
 494     ok(hr == S_OK, "saad failed %08lx\n", hr);
 495     hr = SafeArrayGetVartype(lpsa, &vt);
 496     ok(hr == E_INVALIDARG, "ret %08lx\n", hr);
 497
 498     init_user_marshal_cb(&umcb, &stub_msg, &rpc_msg, NULL, 0, MSHCTX_DIFFERENTMACHINE);
 499     size = LPSAFEARRAY_UserSize(&umcb.Flags, 0, &lpsa);
 500     expected = 44 + 28 * lpsa->rgsabound[0].cElements;
 501     todo_wine
 502     ok(size == expected || size == expected + 8,  /* win64 */
 503        "size should be %lu bytes, not %lu\n", expected, size);
 504     buffer = HeapAlloc(GetProcessHeap(), 0, size);
 505     init_user_marshal_cb(&umcb, &stub_msg, &rpc_msg, buffer, size, MSHCTX_DIFFERENTMACHINE);
 506     next = LPSAFEARRAY_UserMarshal(&umcb.Flags, buffer, &lpsa);
 507     todo_wine
 508     ok(next - buffer == expected || broken(next - buffer + sizeof(DWORD) == expected),
 509             "Marshaled %lu bytes, expected %lu\n", (ULONG) (next - buffer), expected);
 510     lpsa->cbElements = 16;  /* VARIANT wire size */
 511     check_safearray(buffer, lpsa);
 512     HeapFree(GetProcessHeap(), 0, buffer);
 513     hr = SafeArrayDestroyData(lpsa);
 514     ok(hr == S_OK, "got 0x%08lx\n", hr);
 515     hr = SafeArrayDestroyDescriptor(lpsa);
 516     ok(hr == S_OK, "got 0x%08lx\n", hr);
 517
 518     /* Test an array of VT_UNKNOWN */
 519     sab[0].lLbound = 3;
 520     sab[0].cElements = ARRAY_SIZE(heap_unknown);
 521
 522     lpsa = SafeArrayCreate(VT_UNKNOWN, 1, sab);
 523
 524     /*
 525      * Calculate approximate expected size. Sizes are different between Windows
 526      * versions, so this should calculate the smallest size that seems sane.
 527      */
 528     expected = 60;
 529     for (i = 0; i < sab[0].cElements; i++)
 530     {
 531         HeapUnknown *unk;
 532         VARIANT v;
 533
 534         unk = HeapAlloc(GetProcessHeap(), 0, sizeof(*unk));
 535         unk->IUnknown_iface.lpVtbl = &HeapUnknown_Vtbl;
 536         unk->refs = 1;
 537
 538         indices[0] = i + sab[0].lLbound;
 539         heap_unknown[i] = unk;
 540         hr = SafeArrayPutElement(lpsa, indices, &heap_unknown[i]->IUnknown_iface);
 541         ok(hr == S_OK, "Failed to put unknown element hr 0x%lx\n", hr);
 542         ok(unk->refs == 2, "VT_UNKNOWN safearray elem %d, refcount %ld\n", i, unk->refs);
 543
 544         V_VT(&v) = VT_UNKNOWN;
 545         V_UNKNOWN(&v) = &unk->IUnknown_iface;
 546         expected += VARIANT_UserSize(&umcb.Flags, 0, &v) - 20;
 547     }
 548
 549     init_user_marshal_cb(&umcb, &stub_msg, &rpc_msg, NULL, 0, MSHCTX_DIFFERENTMACHINE);
 550     size = LPSAFEARRAY_UserSize(&umcb.Flags, 0, &lpsa);
 551     ok(size >= expected || size  >= (expected + 12 ),
 552         "size should be at least %lu bytes, not %lu\n", expected, size);
 553
 554     init_user_marshal_cb(&umcb, &stub_msg, &rpc_msg, NULL, 0, MSHCTX_DIFFERENTMACHINE);
 555     size2 = LPSAFEARRAY_UserSize(&umcb.Flags, 1, &lpsa);
 556     ok(size2 == (size + sizeof(DWORD)) || size2  == (size + sizeof(DWORD) + 12),
 557             "size should be %lu bytes, not %lu\n", size + (ULONG) sizeof(DWORD), size2);
 558
 559     buffer = HeapAlloc(GetProcessHeap(), 0, size);
 560     memset(buffer, 0xcc, size);
 561     init_user_marshal_cb(&umcb, &stub_msg, &rpc_msg, buffer, size, MSHCTX_DIFFERENTMACHINE);
 562     next = LPSAFEARRAY_UserMarshal(&umcb.Flags, buffer, &lpsa);
 563     ok((next - buffer) <= size, "Marshaled %lu bytes, expected at most %lu\n", (ULONG) (next - buffer), size);
 564     check_safearray(buffer, lpsa);
 565     todo_wine
 566     ok(heap_unknown[0]->refs == 3, "Unexpected refcount %ld\n", heap_unknown[0]->refs);
 567
 568     lpsa2 = NULL;
 569     init_user_marshal_cb(&umcb, &stub_msg, &rpc_msg, buffer, size, MSHCTX_DIFFERENTMACHINE);
 570     next = LPSAFEARRAY_UserUnmarshal(&umcb.Flags, buffer, &lpsa2);
 571     ok((next - buffer) <= size, "Marshaled %lu bytes, expected at most %lu\n", (ULONG) (next - buffer), size);
 572     ok(lpsa2 != NULL, "LPSAFEARRAY didn't unmarshal, result %p\n", next);
 573
 574     for (i = 0; i < ARRAY_SIZE(heap_unknown); i++)
 575     {
 576         IUnknown *gotvalue = NULL;
 577
 578         if (lpsa2)
 579         {
 580             indices[0] = i + sab[0].lLbound;
 581             hr = SafeArrayGetElement(lpsa2, indices, &gotvalue);
 582             ok(hr == S_OK, "Failed to get unk element at %d, hres 0x%lx\n", i, hr);
 583             if (hr == S_OK)
 584             {
 585                 ok(gotvalue == &heap_unknown[i]->IUnknown_iface, "Interface %d mismatch, expected %p, got %p\n",
 586                         i, &heap_unknown[i]->IUnknown_iface, gotvalue);
 587                 IUnknown_Release(gotvalue);
 588             }
 589         }
 590     }
 591
 592     init_user_marshal_cb(&umcb, &stub_msg, &rpc_msg, NULL, 0, MSHCTX_DIFFERENTMACHINE);
 593     LPSAFEARRAY_UserFree(&umcb.Flags, &lpsa2);
 594
 595     /* Set one of the elements to NULL, see how this effects size. */
 596     indices[0] = 3 + sab[0].lLbound;
 597     hr = SafeArrayPutElement(lpsa, indices, NULL);
 598     ok(hr == S_OK, "Failed to put unknown element hr 0x%lx\n", hr);
 599
 600     expected = 60;
 601     for (i = 0; i < sab[0].cElements; i++)
 602     {
 603         VARIANT v;
 604
 605         V_VT(&v) = VT_UNKNOWN;
 606         V_UNKNOWN(&v) = (i != 3) ? &heap_unknown[i]->IUnknown_iface : NULL;
 607         expected += VARIANT_UserSize(&umcb.Flags, 0, &v) - 20;
 608     }
 609
 610     init_user_marshal_cb(&umcb, &stub_msg, &rpc_msg, NULL, 0, MSHCTX_DIFFERENTMACHINE);
 611     size = LPSAFEARRAY_UserSize(&umcb.Flags, 0, &lpsa);
 612     ok(size >= expected || size  >= (expected + 12 ),
 613         "size should be at least %lu bytes, not %lu\n", expected, size);
 614
 615     init_user_marshal_cb(&umcb, &stub_msg, &rpc_msg, NULL, 0, MSHCTX_DIFFERENTMACHINE);
 616     size2 = LPSAFEARRAY_UserSize(&umcb.Flags, 1, &lpsa);
 617     ok(size2 == (size + sizeof(DWORD)) || size2 == (size + sizeof(DWORD) + 12),
 618             "size should be %lu bytes, not %lu\n", size + (ULONG) sizeof(DWORD), size2);
 619
 620     buffer = HeapAlloc(GetProcessHeap(), 0, size);
 621     memset(buffer, 0xcc, size);
 622     init_user_marshal_cb(&umcb, &stub_msg, &rpc_msg, buffer, size, MSHCTX_DIFFERENTMACHINE);
 623     next = LPSAFEARRAY_UserMarshal(&umcb.Flags, buffer, &lpsa);
 624     ok((next - buffer) <= expected, "Marshaled %lu bytes, expected at most %lu bytes\n", (ULONG) (next - buffer), expected);
 625     check_safearray(buffer, lpsa);
 626
 627     lpsa2 = NULL;
 628     init_user_marshal_cb(&umcb, &stub_msg, &rpc_msg, buffer, size, MSHCTX_DIFFERENTMACHINE);
 629     next = LPSAFEARRAY_UserUnmarshal(&umcb.Flags, buffer, &lpsa2);
 630     ok((next - buffer) <= expected, "Marshaled %lu bytes, expected at most %lu bytes\n", (ULONG) (next - buffer), expected);
 631     ok(lpsa2 != NULL, "LPSAFEARRAY didn't unmarshal, result %p\n", next);
 632
 633     for (i = 0; i < ARRAY_SIZE(heap_unknown); i++)
 634     {
 635         IUnknown *gotvalue = NULL;
 636
 637         if (lpsa2)
 638         {
 639             indices[0] = i + sab[0].lLbound;
 640             hr = SafeArrayGetElement(lpsa2, indices, &gotvalue);
 641             ok(hr == S_OK, "Failed to get unk element at %d, hres 0x%lx\n", i, hr);
 642             if (hr == S_OK)
 643             {
 644                 /* Our NULL interface. */
 645                 if (i == 3)
 646                     ok(gotvalue == NULL, "Interface %d expected NULL, got %p\n", i, gotvalue);
 647                 else
 648                 {
 649                     ok(gotvalue == &heap_unknown[i]->IUnknown_iface, "Interface %d mismatch, expected %p, got %p\n",
 650                             i, &heap_unknown[i]->IUnknown_iface, gotvalue);
 651                     IUnknown_Release(gotvalue);
 652                 }
 653             }
 654         }
 655         IUnknown_Release(&heap_unknown[i]->IUnknown_iface);
 656     }
 657
 658     init_user_marshal_cb(&umcb, &stub_msg, &rpc_msg, NULL, 0, MSHCTX_DIFFERENTMACHINE);
 659     LPSAFEARRAY_UserFree(&umcb.Flags, &lpsa2);
 660
 661     ok(heap_unknown[0]->refs == 1, "Unexpected refcount %ld\n", heap_unknown[0]->refs);
 662
 663     hr = SafeArrayDestroy(lpsa);
 664     ok(hr == S_OK, "got 0x%08lx\n", hr);
 665 }
 666
 667 static void check_bstr(void *buffer, BSTR b)
 668 {
 669     DWORD *wireb = buffer;
 670     DWORD len = SysStringByteLen(b);
 671
 672     ok(*wireb == (len + 1) / 2, "wv[0] %08lx\n", *wireb);
 673     wireb++;
 674     if(b)
 675         ok(*wireb == len, "wv[1] %08lx\n", *wireb);
 676     else
 677         ok(*wireb == 0xffffffff, "wv[1] %08lx\n", *wireb);
 678     wireb++;
 679     ok(*wireb == (len + 1) / 2, "wv[2] %08lx\n", *wireb);
 680     if(len)
 681     {
 682         wireb++;
 683         ok(!memcmp(wireb, b, (len + 1) & ~1), "strings differ\n");
 684     }
 685     return;
 686 }
 687
 688 static void test_marshal_BSTR(void)
 689 {
 690     ULONG size;
 691     RPC_MESSAGE rpc_msg;
 692     MIDL_STUB_MESSAGE stub_msg;
 693     USER_MARSHAL_CB umcb;
 694     unsigned char *buffer, *next;
 695     BSTR b, b2;
 696     WCHAR str[] = {'m','a','r','s','h','a','l',' ','t','e','s','t','1',0};
 697     DWORD len;
 698
 699     b = SysAllocString(str);
 700     len = SysStringLen(b);
 701     ok(len == 13, "get %ld\n", len);
 702
 703     /* BSTRs are DWORD aligned */
 704
 705     init_user_marshal_cb(&umcb, &stub_msg, &rpc_msg, NULL, 0, MSHCTX_DIFFERENTMACHINE);
 706     size = BSTR_UserSize(&umcb.Flags, 1, &b);
 707     ok(size == 42, "size %ld\n", size);
 708
 709     init_user_marshal_cb(&umcb, &stub_msg, &rpc_msg, NULL, 0, MSHCTX_DIFFERENTMACHINE);
 710     size = BSTR_UserSize(&umcb.Flags, 0, &b);
 711     ok(size == 38, "size %ld\n", size);
 712
 713     buffer = HeapAlloc(GetProcessHeap(), 0, size);
 714     init_user_marshal_cb(&umcb, &stub_msg, &rpc_msg, buffer, size, MSHCTX_DIFFERENTMACHINE);
 715     next = BSTR_UserMarshal(&umcb.Flags, buffer, &b);
 716     ok(next == buffer + size, "got %p expect %p\n", next, buffer + size);
 717     check_bstr(buffer, b);
 718
 719     b2 = NULL;
 720     init_user_marshal_cb(&umcb, &stub_msg, &rpc_msg, buffer, size, MSHCTX_DIFFERENTMACHINE);
 721     next = BSTR_UserUnmarshal(&umcb.Flags, buffer, &b2);
 722     ok(next == buffer + size, "got %p expect %p\n", next, buffer + size);
 723     ok(b2 != NULL, "BSTR didn't unmarshal\n");
 724     ok(!memcmp(b, b2, (len + 1) * 2), "strings differ\n");
 725     init_user_marshal_cb(&umcb, &stub_msg, &rpc_msg, NULL, 0, MSHCTX_DIFFERENTMACHINE);
 726     BSTR_UserFree(&umcb.Flags, &b2);
 727
 728     HeapFree(GetProcessHeap(), 0, buffer);
 729     SysFreeString(b);
 730
 731     b = NULL;
 732     init_user_marshal_cb(&umcb, &stub_msg, &rpc_msg, NULL, 0, MSHCTX_DIFFERENTMACHINE);
 733     size = BSTR_UserSize(&umcb.Flags, 0, &b);
 734     ok(size == 12, "size %ld\n", size);
 735
 736     buffer = HeapAlloc(GetProcessHeap(), 0, size);
 737     init_user_marshal_cb(&umcb, &stub_msg, &rpc_msg, buffer, size, MSHCTX_DIFFERENTMACHINE);
 738     next = BSTR_UserMarshal(&umcb.Flags, buffer, &b);
 739     ok(next == buffer + size, "got %p expect %p\n", next, buffer + size);
 740
 741     check_bstr(buffer, b);
 742     b2 = NULL;
 743     init_user_marshal_cb(&umcb, &stub_msg, &rpc_msg, buffer, size, MSHCTX_DIFFERENTMACHINE);
 744     next = BSTR_UserUnmarshal(&umcb.Flags, buffer, &b2);
 745     ok(next == buffer + size, "got %p expect %p\n", next, buffer + size);
 746     ok(b2 == NULL, "NULL BSTR didn't unmarshal\n");
 747     init_user_marshal_cb(&umcb, &stub_msg, &rpc_msg, NULL, 0, MSHCTX_DIFFERENTMACHINE);
 748     BSTR_UserFree(&umcb.Flags, &b2);
 749     HeapFree(GetProcessHeap(), 0, buffer);
 750
 751     b = SysAllocStringByteLen("abc", 3);
 752     *(((char*)b) + 3) = 'd';
 753     len = SysStringLen(b);
 754     ok(len == 1, "get %ld\n", len);
 755     len = SysStringByteLen(b);
 756     ok(len == 3, "get %ld\n", len);
 757
 758     init_user_marshal_cb(&umcb, &stub_msg, &rpc_msg, NULL, 0, MSHCTX_DIFFERENTMACHINE);
 759     size = BSTR_UserSize(&umcb.Flags, 0, &b);
 760     ok(size == 16, "size %ld\n", size);
 761
 762     buffer = HeapAlloc(GetProcessHeap(), 0, size);
 763     memset(buffer, 0xcc, size);
 764     init_user_marshal_cb(&umcb, &stub_msg, &rpc_msg, buffer, size, MSHCTX_DIFFERENTMACHINE);
 765     next = BSTR_UserMarshal(&umcb.Flags, buffer, &b);
 766     ok(next == buffer + size, "got %p expect %p\n", next, buffer + size);
 767     check_bstr(buffer, b);
 768     ok(buffer[15] == 'd', "buffer[15] %02x\n", buffer[15]);
 769
 770     b2 = NULL;
 771     init_user_marshal_cb(&umcb, &stub_msg, &rpc_msg, buffer, size, MSHCTX_DIFFERENTMACHINE);
 772     next = BSTR_UserUnmarshal(&umcb.Flags, buffer, &b2);
 773     ok(next == buffer + size, "got %p expect %p\n", next, buffer + size);
 774     ok(b2 != NULL, "BSTR didn't unmarshal\n");
 775     ok(!memcmp(b, b2, len), "strings differ\n");
 776     init_user_marshal_cb(&umcb, &stub_msg, &rpc_msg, NULL, 0, MSHCTX_DIFFERENTMACHINE);
 777     BSTR_UserFree(&umcb.Flags, &b2);
 778     HeapFree(GetProcessHeap(), 0, buffer);
 779     SysFreeString(b);
 780
 781     b = SysAllocStringByteLen("", 0);
 782     len = SysStringLen(b);
 783     ok(len == 0, "get %ld\n", len);
 784     len = SysStringByteLen(b);
 785     ok(len == 0, "get %ld\n", len);
 786
 787     init_user_marshal_cb(&umcb, &stub_msg, &rpc_msg, NULL, 0, MSHCTX_DIFFERENTMACHINE);
 788     size = BSTR_UserSize(&umcb.Flags, 0, &b);
 789     ok(size == 12, "size %ld\n", size);
 790
 791     buffer = HeapAlloc(GetProcessHeap(), 0, size);
 792     init_user_marshal_cb(&umcb, &stub_msg, &rpc_msg, buffer, size, MSHCTX_DIFFERENTMACHINE);
 793     next = BSTR_UserMarshal(&umcb.Flags, buffer, &b);
 794     ok(next == buffer + size, "got %p expect %p\n", next, buffer + size);
 795     check_bstr(buffer, b);
 796
 797     b2 = NULL;
 798     init_user_marshal_cb(&umcb, &stub_msg, &rpc_msg, buffer, size, MSHCTX_DIFFERENTMACHINE);
 799     next = BSTR_UserUnmarshal(&umcb.Flags, buffer, &b2);
 800     ok(next == buffer + size, "got %p expect %p\n", next, buffer + size);
 801     ok(b2 != NULL, "NULL LPSAFEARRAY didn't unmarshal\n");
 802     len = SysStringByteLen(b2);
 803     ok(len == 0, "byte len %ld\n", len);
 804     init_user_marshal_cb(&umcb, &stub_msg, &rpc_msg, NULL, 0, MSHCTX_DIFFERENTMACHINE);
 805     BSTR_UserFree(&umcb.Flags, &b2);
 806     HeapFree(GetProcessHeap(), 0, buffer);
 807     SysFreeString(b);
 808 }
 809
 810 static inline HeapUnknown *impl_from_IUnknown(IUnknown *iface)
 811 {
 812     return CONTAINING_RECORD(iface, HeapUnknown, IUnknown_iface);
 813 }
 814
 815 static HRESULT WINAPI HeapUnknown_QueryInterface(IUnknown *iface, REFIID riid, void **ppv)
 816 {
 817     if (IsEqualIID(riid, &IID_IUnknown))
 818     {
 819         IUnknown_AddRef(iface);
 820         *ppv = iface;
 821         return S_OK;
 822     }
 823     *ppv = NULL;
 824     return E_NOINTERFACE;
 825 }
 826
 827 static ULONG WINAPI HeapUnknown_AddRef(IUnknown *iface)
 828 {
 829     HeapUnknown *This = impl_from_IUnknown(iface);
 830     return InterlockedIncrement((LONG*)&This->refs);
 831 }
 832
 833 static ULONG WINAPI HeapUnknown_Release(IUnknown *iface)
 834 {
 835     HeapUnknown *This = impl_from_IUnknown(iface);
 836     ULONG refs = InterlockedDecrement((LONG*)&This->refs);
 837     if (!refs) HeapFree(GetProcessHeap(), 0, This);
 838     return refs;
 839 }
 840
 841 static const IUnknownVtbl HeapUnknown_Vtbl =
 842 {
 843     HeapUnknown_QueryInterface,
 844     HeapUnknown_AddRef,
 845     HeapUnknown_Release
 846 };
 847
 848 typedef struct
 849 {
 850     DWORD clSize;
 851     DWORD rpcReserved;
 852     USHORT vt;
 853     USHORT wReserved1;
 854     USHORT wReserved2;
 855     USHORT wReserved3;
 856     DWORD switch_is;
 857 } variant_wire_t;
 858
 859 static DWORD *check_variant_header(DWORD *wirev, VARIANT *v, ULONG size)
 860 {
 861     const variant_wire_t *header = (const variant_wire_t*)wirev;
 862     DWORD switch_is;
 863
 864     ok(header->clSize == (size + 7) >> 3, "wv[0] %08lx, expected %08lx\n", header->clSize, (size + 7) >> 3);
 865     ok(header->rpcReserved == 0, "wv[1] %08lx\n", header->rpcReserved);
 866     ok(header->vt == V_VT(v), "vt %04x expected %04x\n", header->vt, V_VT(v));
 867     ok(header->wReserved1 == v->wReserved1, "res1 %04x expected %04x\n", header->wReserved1, v->wReserved1);
 868     ok(header->wReserved2 == v->wReserved2, "res2 %04x expected %04x\n", header->wReserved2, v->wReserved2);
 869     ok(header->wReserved3 == v->wReserved3, "res3 %04x expected %04x\n", header->wReserved3, v->wReserved3);
 870
 871     switch_is = V_VT(v);
 872     if(switch_is & VT_ARRAY)
 873         switch_is &= ~VT_TYPEMASK;
 874     ok(header->switch_is == switch_is, "switch_is %08lx expected %08lx\n", header->switch_is, switch_is);
 875
 876     return (DWORD*)((unsigned char*)wirev + sizeof(variant_wire_t));
 877 }
 878
 879 /* Win9x and WinME don't always align as needed. Variants have
 880  * an alignment of 8.
 881  */
 882 static void *alloc_aligned(SIZE_T size, void **buf)
 883 {
 884     *buf = HeapAlloc(GetProcessHeap(), 0, size + 7);
 885     return (void *)(((UINT_PTR)*buf + 7) & ~7);
 886 }
 887
 888 static void test_marshal_VARIANT(void)
 889 {
 890     VARIANT v, v2, v3;
 891     MIDL_STUB_MESSAGE stubMsg = { 0 };
 892     RPC_MESSAGE rpcMsg = { 0 };
 893     USER_MARSHAL_CB umcb = { 0 };
 894     unsigned char *buffer, *next;
 895     IMalloc *allocator;
 896     void *oldbuffer;
 897     SIZE_T size;
 898     ULONG ul;
 899     short s;
 900     double d;
 901     void *mem;
 902     DWORD *wirev;
 903     BSTR b, b2;
 904     WCHAR str[] = {'m','a','r','s','h','a','l',' ','t','e','s','t',0};
 905     SAFEARRAYBOUND sab;
 906     LPSAFEARRAY lpsa, lpsa2, lpsa_copy;
 907     DECIMAL dec, dec2;
 908     HeapUnknown *heap_unknown;
 909     DWORD expected;
 910     HRESULT hr;
 911     LONG bound, bound2;
 912     VARTYPE vt, vt2;
 913     IUnknown *unk;
 914
 915     hr = CoGetMalloc(MEMCTX_TASK, &allocator);
 916     ok(hr == S_OK, "got hr %#lx\n", hr);
 917     ok(!!allocator, "got allocator %p\n", allocator);
 918
 919     stubMsg.RpcMsg = &rpcMsg;
 920
 921     umcb.Flags = MAKELONG(MSHCTX_DIFFERENTMACHINE, NDR_LOCAL_DATA_REPRESENTATION);
 922     umcb.pStubMsg = &stubMsg;
 923     umcb.pReserve = NULL;
 924     umcb.Signature = USER_MARSHAL_CB_SIGNATURE;
 925     umcb.CBType = USER_MARSHAL_CB_UNMARSHALL;
 926
 927     /*** I1 ***/
 928     VariantInit(&v);
 929     V_VT(&v) = VT_I1;
 930     V_I1(&v) = 0x12;
 931
 932     /* check_variant_header tests wReserved[123], so initialize to unique values.
 933      * (Could probably also do this by setting the variant to a known DECIMAL.)
 934      */
 935     v.wReserved1 = 0x1234;
 936     v.wReserved2 = 0x5678;
 937     v.wReserved3 = 0x9abc;
 938
 939     /* Variants have an alignment of 8 */
 940     rpcMsg.BufferLength = stubMsg.BufferLength = VARIANT_UserSize(&umcb.Flags, 1, &v);
 941     ok(stubMsg.BufferLength == 29, "size %ld\n", stubMsg.BufferLength);
 942
 943     rpcMsg.BufferLength = stubMsg.BufferLength = VARIANT_UserSize(&umcb.Flags, 0, &v);
 944     ok(stubMsg.BufferLength == 21, "size %ld\n", stubMsg.BufferLength);
 945
 946     buffer = rpcMsg.Buffer = stubMsg.Buffer = stubMsg.BufferStart = alloc_aligned(stubMsg.BufferLength, &oldbuffer);
 947     stubMsg.BufferEnd = stubMsg.Buffer + stubMsg.BufferLength;
 948     next = VARIANT_UserMarshal(&umcb.Flags, buffer, &v);
 949     ok(next == buffer + stubMsg.BufferLength, "got %p expect %p\n", next, buffer + stubMsg.BufferLength);
 950     wirev = (DWORD*)buffer;
 951
 952     wirev = check_variant_header(wirev, &v, stubMsg.BufferLength);
 953     ok(*(char*)wirev == V_I1(&v), "wv[5] %08lx\n", *wirev);
 954     VariantInit(&v2);
 955     stubMsg.Buffer = buffer;
 956     next = VARIANT_UserUnmarshal(&umcb.Flags, buffer, &v2);
 957     ok(next == buffer + stubMsg.BufferLength, "got %p expect %p\n", next, buffer + stubMsg.BufferLength);
 958     ok(V_VT(&v) == V_VT(&v2), "got vt %d expect %d\n", V_VT(&v), V_VT(&v2));
 959     ok(V_I1(&v) == V_I1(&v2), "got i1 %x expect %x\n", V_I1(&v), V_I1(&v2));
 960
 961     VARIANT_UserFree(&umcb.Flags, &v2);
 962     HeapFree(GetProcessHeap(), 0, oldbuffer);
 963
 964     /*** I2 ***/
 965     VariantInit(&v);
 966     V_VT(&v) = VT_I2;
 967     V_I2(&v) = 0x1234;
 968
 969     rpcMsg.BufferLength = stubMsg.BufferLength = VARIANT_UserSize(&umcb.Flags, 0, &v);
 970     ok(stubMsg.BufferLength == 22, "size %ld\n", stubMsg.BufferLength);
 971
 972     buffer = rpcMsg.Buffer = stubMsg.Buffer = stubMsg.BufferStart = alloc_aligned(stubMsg.BufferLength, &oldbuffer);
 973     stubMsg.BufferEnd = stubMsg.Buffer + stubMsg.BufferLength;
 974     next = VARIANT_UserMarshal(&umcb.Flags, buffer, &v);
 975     ok(next == buffer + stubMsg.BufferLength, "got %p expect %p\n", next, buffer + stubMsg.BufferLength);
 976     wirev = (DWORD*)buffer;
 977
 978     wirev = check_variant_header(wirev, &v, stubMsg.BufferLength);
 979     ok(*(short*)wirev == V_I2(&v), "wv[5] %08lx\n", *wirev);
 980     VariantInit(&v2);
 981     stubMsg.Buffer = buffer;
 982     next = VARIANT_UserUnmarshal(&umcb.Flags, buffer, &v2);
 983     ok(next == buffer + stubMsg.BufferLength, "got %p expect %p\n", next, buffer + stubMsg.BufferLength);
 984     ok(V_VT(&v) == V_VT(&v2), "got vt %d expect %d\n", V_VT(&v), V_VT(&v2));
 985     ok(V_I2(&v) == V_I2(&v2), "got i2 %x expect %x\n", V_I2(&v), V_I2(&v2));
 986
 987     VARIANT_UserFree(&umcb.Flags, &v2);
 988     HeapFree(GetProcessHeap(), 0, oldbuffer);
 989
 990     /*** I2 BYREF ***/
 991     VariantInit(&v);
 992     V_VT(&v) = VT_I2 | VT_BYREF;
 993     s = 0x1234;
 994     V_I2REF(&v) = &s;
 995
 996     rpcMsg.BufferLength = stubMsg.BufferLength = VARIANT_UserSize(&umcb.Flags, 0, &v);
 997     ok(stubMsg.BufferLength == 26, "size %ld\n", stubMsg.BufferLength);
 998
 999     buffer = rpcMsg.Buffer = stubMsg.Buffer = stubMsg.BufferStart = alloc_aligned(stubMsg.BufferLength, &oldbuffer);
1000     stubMsg.BufferEnd = stubMsg.Buffer + stubMsg.BufferLength;
1001     next = VARIANT_UserMarshal(&umcb.Flags, buffer, &v);
1002     ok(next == buffer + stubMsg.BufferLength, "got %p expect %p\n", next, buffer + stubMsg.BufferLength);
1003     wirev = (DWORD*)buffer;
1004
1005     wirev = check_variant_header(wirev, &v, stubMsg.BufferLength);
1006     ok(*wirev == 0x4, "wv[5] %08lx\n", *wirev);
1007     wirev++;
1008     ok(*(short*)wirev == s, "wv[6] %08lx\n", *wirev);
1009     VariantInit(&v2);
1010     V_VT(&v2) = VT_I2 | VT_BYREF;
1011     V_BYREF(&v2) = mem = CoTaskMemAlloc(sizeof(V_I2(&v2)));
1012     stubMsg.Buffer = buffer;
1013     next = VARIANT_UserUnmarshal(&umcb.Flags, buffer, &v2);
1014     ok(next == buffer + stubMsg.BufferLength, "got %p expect %p\n", next, buffer + stubMsg.BufferLength);
1015     ok(V_VT(&v) == V_VT(&v2), "got vt %d expect %d\n", V_VT(&v), V_VT(&v2));
1016     ok(V_BYREF(&v2) == mem, "didn't reuse existing memory\n");
1017     ok(*V_I2REF(&v) == *V_I2REF(&v2), "got i2 ref %x expect ui4 ref %x\n", *V_I2REF(&v), *V_I2REF(&v2));
1018
1019     VARIANT_UserFree(&umcb.Flags, &v2);
1020     HeapFree(GetProcessHeap(), 0, oldbuffer);
1021
1022     /*** I4 ***/
1023     VariantInit(&v);
1024     V_VT(&v) = VT_I4;
1025     V_I4(&v) = 0x1234;
1026
1027     rpcMsg.BufferLength = stubMsg.BufferLength = VARIANT_UserSize(&umcb.Flags, 0, &v);
1028     ok(stubMsg.BufferLength == 24, "size %ld\n", stubMsg.BufferLength);
1029
1030     buffer = rpcMsg.Buffer = stubMsg.Buffer = stubMsg.BufferStart = alloc_aligned(stubMsg.BufferLength, &oldbuffer);
1031     stubMsg.BufferEnd = stubMsg.Buffer + stubMsg.BufferLength;
1032     next = VARIANT_UserMarshal(&umcb.Flags, buffer, &v);
1033     ok(next == buffer + stubMsg.BufferLength, "got %p expect %p\n", next, buffer + stubMsg.BufferLength);
1034     wirev = (DWORD*)buffer;
1035
1036     wirev = check_variant_header(wirev, &v, stubMsg.BufferLength);
1037     ok(*wirev == V_I4(&v), "wv[5] %08lx\n", *wirev);
1038
1039     VariantInit(&v2);
1040     stubMsg.Buffer = buffer;
1041     next = VARIANT_UserUnmarshal(&umcb.Flags, buffer, &v2);
1042     ok(next == buffer + stubMsg.BufferLength, "got %p expect %p\n", next, buffer + stubMsg.BufferLength);
1043     ok(V_VT(&v) == V_VT(&v2), "got vt %d expect %d\n", V_VT(&v), V_VT(&v2));
1044     ok(V_I4(&v) == V_I4(&v2), "got i4 %lx expect %lx\n", V_I4(&v), V_I4(&v2));
1045
1046     VARIANT_UserFree(&umcb.Flags, &v2);
1047     HeapFree(GetProcessHeap(), 0, oldbuffer);
1048
1049     /*** UI4 ***/
1050     VariantInit(&v);
1051     V_VT(&v) = VT_UI4;
1052     V_UI4(&v) = 0x1234;
1053
1054     rpcMsg.BufferLength = stubMsg.BufferLength = VARIANT_UserSize(&umcb.Flags, 0, &v);
1055     ok(stubMsg.BufferLength == 24, "size %ld\n", stubMsg.BufferLength);
1056
1057     buffer = rpcMsg.Buffer = stubMsg.Buffer = stubMsg.BufferStart = alloc_aligned(stubMsg.BufferLength, &oldbuffer);
1058     stubMsg.BufferEnd = stubMsg.Buffer + stubMsg.BufferLength;
1059     next = VARIANT_UserMarshal(&umcb.Flags, buffer, &v);
1060     ok(next == buffer + stubMsg.BufferLength, "got %p expect %p\n", next, buffer + stubMsg.BufferLength);
1061     wirev = (DWORD*)buffer;
1062
1063     wirev = check_variant_header(wirev, &v, stubMsg.BufferLength);
1064     ok(*wirev == 0x1234, "wv[5] %08lx\n", *wirev);
1065     VariantInit(&v2);
1066     stubMsg.Buffer = buffer;
1067     next = VARIANT_UserUnmarshal(&umcb.Flags, buffer, &v2);
1068     ok(next == buffer + stubMsg.BufferLength, "got %p expect %p\n", next, buffer + stubMsg.BufferLength);
1069     ok(V_VT(&v) == V_VT(&v2), "got vt %d expect %d\n", V_VT(&v), V_VT(&v2));
1070     ok(V_UI4(&v) == V_UI4(&v2), "got ui4 %lx expect %lx\n", V_UI4(&v), V_UI4(&v2));
1071
1072     VARIANT_UserFree(&umcb.Flags, &v2);
1073     HeapFree(GetProcessHeap(), 0, oldbuffer);
1074
1075     /*** UI4 BYREF ***/
1076     VariantInit(&v);
1077     V_VT(&v) = VT_UI4 | VT_BYREF;
1078     ul = 0x1234;
1079     V_UI4REF(&v) = &ul;
1080
1081     rpcMsg.BufferLength = stubMsg.BufferLength = VARIANT_UserSize(&umcb.Flags, 0, &v);
1082     ok(stubMsg.BufferLength == 28, "size %ld\n", stubMsg.BufferLength);
1083
1084     buffer = rpcMsg.Buffer = stubMsg.Buffer = stubMsg.BufferStart = alloc_aligned(stubMsg.BufferLength, &oldbuffer);
1085     stubMsg.BufferEnd = stubMsg.Buffer + stubMsg.BufferLength;
1086     next = VARIANT_UserMarshal(&umcb.Flags, buffer, &v);
1087     ok(next == buffer + stubMsg.BufferLength, "got %p expect %p\n", next, buffer + stubMsg.BufferLength);
1088     wirev = (DWORD*)buffer;
1089
1090     wirev = check_variant_header(wirev, &v, stubMsg.BufferLength);
1091     ok(*wirev == 0x4, "wv[5] %08lx\n", *wirev);
1092     wirev++;
1093     ok(*wirev == ul, "wv[6] %08lx\n", *wirev);
1094
1095     VariantInit(&v2);
1096     stubMsg.Buffer = buffer;
1097     next = VARIANT_UserUnmarshal(&umcb.Flags, buffer, &v2);
1098     ok(next == buffer + stubMsg.BufferLength, "got %p expect %p\n", next, buffer + stubMsg.BufferLength);
1099     ok(V_VT(&v) == V_VT(&v2), "got vt %d expect %d\n", V_VT(&v), V_VT(&v2));
1100     ok(*V_UI4REF(&v) == *V_UI4REF(&v2), "got ui4 ref %lx expect ui4 ref %lx\n", *V_UI4REF(&v), *V_UI4REF(&v2));
1101     size = IMalloc_GetSize(allocator, V_BYREF(&v2));
1102     ok(size == sizeof(V_UI4(&v2)), "got size %#Ix\n", size);
1103     VARIANT_UserFree(&umcb.Flags, &v2);
1104     HeapFree(GetProcessHeap(), 0, oldbuffer);
1105
1106     /*** I8 ***/
1107     VariantInit(&v);
1108     V_VT(&v) = VT_I8;
1109     V_I8(&v) = (LONGLONG)1000000 * 1000000;
1110
1111     rpcMsg.BufferLength = stubMsg.BufferLength = VARIANT_UserSize(&umcb.Flags, 0, &v);
1112     ok(stubMsg.BufferLength == 32, "size %ld\n", stubMsg.BufferLength);
1113
1114     buffer = rpcMsg.Buffer = stubMsg.Buffer = stubMsg.BufferStart = alloc_aligned(stubMsg.BufferLength, &oldbuffer);
1115     stubMsg.BufferEnd = stubMsg.Buffer + stubMsg.BufferLength;
1116     memset(buffer, 0xcc, stubMsg.BufferLength);
1117     next = VARIANT_UserMarshal(&umcb.Flags, buffer, &v);
1118     ok(next == buffer + stubMsg.BufferLength, "got %p expect %p\n", next, buffer + stubMsg.BufferLength);
1119     wirev = (DWORD*)buffer;
1120
1121     wirev = check_variant_header(wirev, &v, stubMsg.BufferLength);
1122     ok(*wirev == 0xcccccccc, "wv[5] %08lx\n", *wirev); /* pad */
1123     wirev++;
1124     ok(*(LONGLONG *)wirev == V_I8(&v), "wv[6] %s\n", wine_dbgstr_longlong(*(LONGLONG *)wirev));
1125     VariantInit(&v2);
1126     stubMsg.Buffer = buffer;
1127     next = VARIANT_UserUnmarshal(&umcb.Flags, buffer, &v2);
1128     ok(next == buffer + stubMsg.BufferLength, "got %p expect %p\n", next, buffer + stubMsg.BufferLength);
1129     ok(V_VT(&v) == V_VT(&v2), "got vt %d expect %d\n", V_VT(&v), V_VT(&v2));
1130     ok(V_I8(&v) == V_I8(&v2), "got i8 %s expect %s\n",
1131             wine_dbgstr_longlong(V_I8(&v)), wine_dbgstr_longlong(V_I8(&v2)));
1132
1133     VARIANT_UserFree(&umcb.Flags, &v2);
1134     HeapFree(GetProcessHeap(), 0, oldbuffer);
1135
1136     /*** R4 ***/
1137     VariantInit(&v);
1138     V_VT(&v) = VT_R4;
1139     V_R8(&v) = 3.1415;
1140
1141     rpcMsg.BufferLength = stubMsg.BufferLength = VARIANT_UserSize(&umcb.Flags, 0, &v);
1142     ok(stubMsg.BufferLength == 24, "size %ld\n", stubMsg.BufferLength);
1143
1144     buffer = rpcMsg.Buffer = stubMsg.Buffer = stubMsg.BufferStart = alloc_aligned(stubMsg.BufferLength, &oldbuffer);
1145     stubMsg.BufferEnd = stubMsg.Buffer + stubMsg.BufferLength;
1146     next = VARIANT_UserMarshal(&umcb.Flags, buffer, &v);
1147     ok(next == buffer + stubMsg.BufferLength, "got %p expect %p\n", next, buffer + stubMsg.BufferLength);
1148     wirev = (DWORD*)buffer;
1149
1150     wirev = check_variant_header(wirev, &v, stubMsg.BufferLength);
1151     ok(*(float*)wirev == V_R4(&v), "wv[5] %08lx\n", *wirev);
1152     VariantInit(&v2);
1153     stubMsg.Buffer = buffer;
1154     next = VARIANT_UserUnmarshal(&umcb.Flags, buffer, &v2);
1155     ok(next == buffer + stubMsg.BufferLength, "got %p expect %p\n", next, buffer + stubMsg.BufferLength);
1156     ok(V_VT(&v) == V_VT(&v2), "got vt %d expect %d\n", V_VT(&v), V_VT(&v2));
1157     ok(V_R4(&v) == V_R4(&v2), "got r4 %f expect %f\n", V_R4(&v), V_R4(&v2));
1158
1159     VARIANT_UserFree(&umcb.Flags, &v2);
1160     HeapFree(GetProcessHeap(), 0, oldbuffer);
1161
1162     /*** R8 ***/
1163     VariantInit(&v);
1164     V_VT(&v) = VT_R8;
1165     V_R8(&v) = 3.1415;
1166
1167     rpcMsg.BufferLength = stubMsg.BufferLength = VARIANT_UserSize(&umcb.Flags, 0, &v);
1168     ok(stubMsg.BufferLength == 32, "size %ld\n", stubMsg.BufferLength);
1169
1170     buffer = rpcMsg.Buffer = stubMsg.Buffer = stubMsg.BufferStart = alloc_aligned(stubMsg.BufferLength, &oldbuffer);
1171     stubMsg.BufferEnd = stubMsg.Buffer + stubMsg.BufferLength;
1172     memset(buffer, 0xcc, stubMsg.BufferLength);
1173     next = VARIANT_UserMarshal(&umcb.Flags, buffer, &v);
1174     ok(next == buffer + stubMsg.BufferLength, "got %p expect %p\n", next, buffer + stubMsg.BufferLength);
1175     wirev = (DWORD*)buffer;
1176
1177     wirev = check_variant_header(wirev, &v, stubMsg.BufferLength);
1178     ok(*wirev == 0xcccccccc, "wv[5] %08lx\n", *wirev); /* pad */
1179     wirev++;
1180     ok(*(double*)wirev == V_R8(&v), "wv[6] %08lx, wv[7] %08lx\n", *wirev, *(wirev+1));
1181     VariantInit(&v2);
1182     stubMsg.Buffer = buffer;
1183     next = VARIANT_UserUnmarshal(&umcb.Flags, buffer, &v2);
1184     ok(next == buffer + stubMsg.BufferLength, "got %p expect %p\n", next, buffer + stubMsg.BufferLength);
1185     ok(V_VT(&v) == V_VT(&v2), "got vt %d expect %d\n", V_VT(&v), V_VT(&v2));
1186     ok(V_R8(&v) == V_R8(&v2), "got r8 %f expect %f\n", V_R8(&v), V_R8(&v2));
1187
1188     VARIANT_UserFree(&umcb.Flags, &v2);
1189     HeapFree(GetProcessHeap(), 0, oldbuffer);
1190
1191     /*** R8 BYREF ***/
1192     VariantInit(&v);
1193     V_VT(&v) = VT_R8 | VT_BYREF;
1194     d = 3.1415;
1195     V_R8REF(&v) = &d;
1196
1197     rpcMsg.BufferLength = stubMsg.BufferLength = VARIANT_UserSize(&umcb.Flags, 0, &v);
1198     ok(stubMsg.BufferLength == 32, "size %ld\n", stubMsg.BufferLength);
1199
1200     buffer = rpcMsg.Buffer = stubMsg.Buffer = stubMsg.BufferStart = alloc_aligned(stubMsg.BufferLength, &oldbuffer);
1201     stubMsg.BufferEnd = stubMsg.Buffer + stubMsg.BufferLength;
1202     next = VARIANT_UserMarshal(&umcb.Flags, buffer, &v);
1203     ok(next == buffer + stubMsg.BufferLength, "got %p expect %p\n", next, buffer + stubMsg.BufferLength);
1204     wirev = (DWORD*)buffer;
1205
1206     wirev = check_variant_header(wirev, &v, stubMsg.BufferLength);
1207     ok(*wirev == 8, "wv[5] %08lx\n", *wirev);
1208     wirev++;
1209     ok(*(double*)wirev == d, "wv[6] %08lx wv[7] %08lx\n", *wirev, *(wirev+1));
1210     VariantInit(&v2);
1211     stubMsg.Buffer = buffer;
1212     next = VARIANT_UserUnmarshal(&umcb.Flags, buffer, &v2);
1213     ok(next == buffer + stubMsg.BufferLength, "got %p expect %p\n", next, buffer + stubMsg.BufferLength);
1214     ok(V_VT(&v) == V_VT(&v2), "got vt %d expect %d\n", V_VT(&v), V_VT(&v2));
1215     ok(*V_R8REF(&v) == *V_R8REF(&v2), "got r8 ref %f expect %f\n", *V_R8REF(&v), *V_R8REF(&v2));
1216     size = IMalloc_GetSize(allocator, V_BYREF(&v2));
1217     ok(size == sizeof(V_R8(&v2)), "got size %#Ix\n", size);
1218     VARIANT_UserFree(&umcb.Flags, &v2);
1219     HeapFree(GetProcessHeap(), 0, oldbuffer);
1220
1221     /*** VARIANT_BOOL ***/
1222     VariantInit(&v);
1223     V_VT(&v) = VT_BOOL;
1224     V_BOOL(&v) = 0x1234;
1225
1226     rpcMsg.BufferLength = stubMsg.BufferLength = VARIANT_UserSize(&umcb.Flags, 0, &v);
1227     ok(stubMsg.BufferLength == 22, "size %ld\n", stubMsg.BufferLength);
1228
1229     buffer = rpcMsg.Buffer = stubMsg.Buffer = stubMsg.BufferStart = alloc_aligned(stubMsg.BufferLength, &oldbuffer);
1230     stubMsg.BufferEnd = stubMsg.Buffer + stubMsg.BufferLength;
1231     next = VARIANT_UserMarshal(&umcb.Flags, buffer, &v);
1232     ok(next == buffer + stubMsg.BufferLength, "got %p expect %p\n", next, buffer + stubMsg.BufferLength);
1233     wirev = (DWORD*)buffer;
1234
1235     wirev = check_variant_header(wirev, &v, stubMsg.BufferLength);
1236     ok(*(short*)wirev == V_BOOL(&v), "wv[5] %04x\n", *(WORD*)wirev);
1237     VariantInit(&v2);
1238     stubMsg.Buffer = buffer;
1239     next = VARIANT_UserUnmarshal(&umcb.Flags, buffer, &v2);
1240     ok(next == buffer + stubMsg.BufferLength, "got %p expect %p\n", next, buffer + stubMsg.BufferLength);
1241     ok(V_VT(&v) == V_VT(&v2), "got vt %d expect %d\n", V_VT(&v), V_VT(&v2));
1242     ok(V_BOOL(&v) == V_BOOL(&v2), "got bool %x expect %x\n", V_BOOL(&v), V_BOOL(&v2));
1243
1244     VARIANT_UserFree(&umcb.Flags, &v2);
1245     HeapFree(GetProcessHeap(), 0, oldbuffer);
1246
1247     /*** DECIMAL ***/
1248     VarDecFromI4(0x12345678, &dec);
1249     dec.wReserved = 0xfedc;          /* Also initialize reserved field, as we check it later */
1250     VariantInit(&v);
1251     V_DECIMAL(&v) = dec;
1252     V_VT(&v) = VT_DECIMAL;
1253
1254     rpcMsg.BufferLength = stubMsg.BufferLength = VARIANT_UserSize(&umcb.Flags, 0, &v);
1255     ok(stubMsg.BufferLength == 40, "size %ld\n", stubMsg.BufferLength);
1256
1257     buffer = rpcMsg.Buffer = stubMsg.Buffer = stubMsg.BufferStart = alloc_aligned(stubMsg.BufferLength, &oldbuffer);
1258     stubMsg.BufferEnd = stubMsg.Buffer + stubMsg.BufferLength;
1259     memset(buffer, 0xcc, stubMsg.BufferLength);
1260     next = VARIANT_UserMarshal(&umcb.Flags, buffer, &v);
1261     ok(next == buffer + stubMsg.BufferLength, "got %p expect %p\n", next, buffer + stubMsg.BufferLength);
1262     wirev = (DWORD*)buffer;
1263
1264     wirev = check_variant_header(wirev, &v, stubMsg.BufferLength);
1265     ok(*wirev == 0xcccccccc, "wirev[5] %08lx\n", *wirev); /* pad */
1266     wirev++;
1267     dec2 = dec;
1268     dec2.wReserved = VT_DECIMAL;
1269     ok(!memcmp(wirev, &dec2, sizeof(dec2)), "wirev[6] %08lx wirev[7] %08lx wirev[8] %08lx wirev[9] %08lx\n",
1270        *wirev, *(wirev + 1), *(wirev + 2), *(wirev + 3));
1271     VariantInit(&v2);
1272     stubMsg.Buffer = buffer;
1273     next = VARIANT_UserUnmarshal(&umcb.Flags, buffer, &v2);
1274     ok(next == buffer + stubMsg.BufferLength, "got %p expect %p\n", next, buffer + stubMsg.BufferLength);
1275     ok(V_VT(&v) == V_VT(&v2), "got vt %d expect %d\n", V_VT(&v), V_VT(&v2));
1276     ok(!memcmp(&V_DECIMAL(&v), & V_DECIMAL(&v2), sizeof(DECIMAL)), "decimals differ\n");
1277
1278     VARIANT_UserFree(&umcb.Flags, &v2);
1279     HeapFree(GetProcessHeap(), 0, oldbuffer);
1280
1281     /*** DECIMAL BYREF ***/
1282     VariantInit(&v);
1283     V_VT(&v) = VT_DECIMAL | VT_BYREF;
1284     V_DECIMALREF(&v) = &dec;
1285
1286     rpcMsg.BufferLength = stubMsg.BufferLength = VARIANT_UserSize(&umcb.Flags, 0, &v);
1287     ok(stubMsg.BufferLength == 40, "size %ld\n", stubMsg.BufferLength);
1288
1289     buffer = rpcMsg.Buffer = stubMsg.Buffer = stubMsg.BufferStart = alloc_aligned(stubMsg.BufferLength, &oldbuffer);
1290     stubMsg.BufferEnd = stubMsg.Buffer + stubMsg.BufferLength;
1291     next = VARIANT_UserMarshal(&umcb.Flags, buffer, &v);
1292     ok(next == buffer + stubMsg.BufferLength, "got %p expect %p\n", next, buffer + stubMsg.BufferLength);
1293     wirev = (DWORD*)buffer;
1294
1295     wirev = check_variant_header(wirev, &v, stubMsg.BufferLength);
1296     ok(*wirev == 16, "wv[5] %08lx\n", *wirev);
1297     wirev++;
1298     ok(!memcmp(wirev, &dec, sizeof(dec)), "wirev[6] %08lx wirev[7] %08lx wirev[8] %08lx wirev[9] %08lx\n", *wirev, *(wirev + 1), *(wirev + 2), *(wirev + 3));
1299     VariantInit(&v2);
1300     /* check_variant_header tests wReserved[123], so initialize to unique values.
1301      * (Could probably also do this by setting the variant to a known DECIMAL.)
1302      */
1303     v2.wReserved1 = 0x0123;
1304     v2.wReserved2 = 0x4567;
1305     v2.wReserved3 = 0x89ab;
1306
1307     stubMsg.Buffer = buffer;
1308     next = VARIANT_UserUnmarshal(&umcb.Flags, buffer, &v2);
1309     ok(next == buffer + stubMsg.BufferLength, "got %p expect %p\n", next, buffer + stubMsg.BufferLength);
1310     ok(V_VT(&v) == V_VT(&v2), "got vt %d expect %d\n", V_VT(&v), V_VT(&v2));
1311     ok(!memcmp(V_DECIMALREF(&v), V_DECIMALREF(&v2), sizeof(DECIMAL)), "decimals differ\n");
1312     size = IMalloc_GetSize(allocator, V_BYREF(&v2));
1313     ok(size == sizeof(V_DECIMAL(&v2)), "got size %#Ix\n", size);
1314     VARIANT_UserFree(&umcb.Flags, &v2);
1315     HeapFree(GetProcessHeap(), 0, oldbuffer);
1316
1317     /*** EMPTY ***/
1318     VariantInit(&v);
1319     V_VT(&v) = VT_EMPTY;
1320
1321     rpcMsg.BufferLength = stubMsg.BufferLength = VARIANT_UserSize(&umcb.Flags, 0, &v);
1322     ok(stubMsg.BufferLength == 20, "size %ld\n", stubMsg.BufferLength);
1323
1324     buffer = rpcMsg.Buffer = stubMsg.Buffer = stubMsg.BufferStart = alloc_aligned(stubMsg.BufferLength, &oldbuffer);
1325     stubMsg.BufferEnd = stubMsg.Buffer + stubMsg.BufferLength;
1326     next = VARIANT_UserMarshal(&umcb.Flags, buffer, &v);
1327     ok(next == buffer + stubMsg.BufferLength, "got %p expect %p\n", next, buffer + stubMsg.BufferLength);
1328     wirev = (DWORD*)buffer;
1329
1330     check_variant_header(wirev, &v, stubMsg.BufferLength);
1331     VariantInit(&v2);
1332     stubMsg.Buffer = buffer;
1333     next = VARIANT_UserUnmarshal(&umcb.Flags, buffer, &v2);
1334     ok(next == buffer + stubMsg.BufferLength, "got %p expect %p\n", next, buffer + stubMsg.BufferLength);
1335     ok(V_VT(&v) == V_VT(&v2), "got vt %d expect %d\n", V_VT(&v), V_VT(&v2));
1336
1337     VARIANT_UserFree(&umcb.Flags, &v2);
1338     HeapFree(GetProcessHeap(), 0, oldbuffer);
1339
1340     /*** NULL ***/
1341     VariantInit(&v);
1342     V_VT(&v) = VT_NULL;
1343
1344     rpcMsg.BufferLength = stubMsg.BufferLength = VARIANT_UserSize(&umcb.Flags, 0, &v);
1345     ok(stubMsg.BufferLength == 20, "size %ld\n", stubMsg.BufferLength);
1346
1347     buffer = rpcMsg.Buffer = stubMsg.Buffer = stubMsg.BufferStart = alloc_aligned(stubMsg.BufferLength, &oldbuffer);
1348     stubMsg.BufferEnd = stubMsg.Buffer + stubMsg.BufferLength;
1349     next = VARIANT_UserMarshal(&umcb.Flags, buffer, &v);
1350     ok(next == buffer + stubMsg.BufferLength, "got %p expect %p\n", next, buffer + stubMsg.BufferLength);
1351     wirev = (DWORD*)buffer;
1352
1353     check_variant_header(wirev, &v, stubMsg.BufferLength);
1354     VariantInit(&v2);
1355     stubMsg.Buffer = buffer;
1356     next = VARIANT_UserUnmarshal(&umcb.Flags, buffer, &v2);
1357     ok(next == buffer + stubMsg.BufferLength, "got %p expect %p\n", next, buffer + stubMsg.BufferLength);
1358     ok(V_VT(&v) == V_VT(&v2), "got vt %d expect %d\n", V_VT(&v), V_VT(&v2));
1359
1360     VARIANT_UserFree(&umcb.Flags, &v2);
1361     HeapFree(GetProcessHeap(), 0, oldbuffer);
1362
1363     /*** BSTR ***/
1364     b = SysAllocString(str);
1365     VariantInit(&v);
1366     V_VT(&v) = VT_BSTR;
1367     V_BSTR(&v) = b;
1368
1369     rpcMsg.BufferLength = stubMsg.BufferLength = VARIANT_UserSize(&umcb.Flags, 0, &v);
1370     ok(stubMsg.BufferLength == 60, "size %ld\n", stubMsg.BufferLength);
1371     buffer = rpcMsg.Buffer = stubMsg.Buffer = stubMsg.BufferStart = alloc_aligned(stubMsg.BufferLength, &oldbuffer);
1372     stubMsg.BufferEnd = stubMsg.Buffer + stubMsg.BufferLength;
1373     next = VARIANT_UserMarshal(&umcb.Flags, buffer, &v);
1374     ok(next == buffer + stubMsg.BufferLength, "got %p expect %p\n", next, buffer + stubMsg.BufferLength);
1375     wirev = (DWORD*)buffer;
1376
1377     wirev = check_variant_header(wirev, &v, stubMsg.BufferLength);
1378     ok(*wirev, "wv[5] %08lx\n", *wirev); /* win2k: this is b. winxp: this is (char*)b + 1 */
1379     wirev++;
1380     check_bstr(wirev, V_BSTR(&v));
1381     VariantInit(&v2);
1382     stubMsg.Buffer = buffer;
1383     next = VARIANT_UserUnmarshal(&umcb.Flags, buffer, &v2);
1384     ok(next == buffer + stubMsg.BufferLength, "got %p expect %p\n", next, buffer + stubMsg.BufferLength);
1385     ok(V_VT(&v) == V_VT(&v2), "got vt %d expect %d\n", V_VT(&v), V_VT(&v2));
1386     ok(SysStringByteLen(V_BSTR(&v)) == SysStringByteLen(V_BSTR(&v2)), "bstr string lens differ\n");
1387     ok(!memcmp(V_BSTR(&v), V_BSTR(&v2), SysStringByteLen(V_BSTR(&v))), "bstrs differ\n");
1388
1389     VARIANT_UserFree(&umcb.Flags, &v2);
1390     HeapFree(GetProcessHeap(), 0, oldbuffer);
1391
1392     /*** BSTR BYREF ***/
1393     VariantInit(&v);
1394     V_VT(&v) = VT_BSTR | VT_BYREF;
1395     V_BSTRREF(&v) = &b;
1396
1397     rpcMsg.BufferLength = stubMsg.BufferLength = VARIANT_UserSize(&umcb.Flags, 0, &v);
1398     ok(stubMsg.BufferLength == 64, "size %ld\n", stubMsg.BufferLength);
1399     buffer = rpcMsg.Buffer = stubMsg.Buffer = stubMsg.BufferStart = alloc_aligned(stubMsg.BufferLength, &oldbuffer);
1400     stubMsg.BufferEnd = stubMsg.Buffer + stubMsg.BufferLength;
1401     next = VARIANT_UserMarshal(&umcb.Flags, buffer, &v);
1402     ok(next == buffer + stubMsg.BufferLength, "got %p expect %p\n", next, buffer + stubMsg.BufferLength);
1403     wirev = (DWORD*)buffer;
1404
1405     wirev = check_variant_header(wirev, &v, stubMsg.BufferLength);
1406     ok(*wirev == 0x4, "wv[5] %08lx\n", *wirev);
1407     wirev++;
1408     ok(*wirev, "wv[6] %08lx\n", *wirev); /* win2k: this is b. winxp: this is (char*)b + 1 */
1409     wirev++;
1410     check_bstr(wirev, b);
1411     b2 = SysAllocString(str);
1412     b2[0] = 0;
1413     V_VT(&v2) = VT_BSTR | VT_BYREF;
1414     V_BSTRREF(&v2) = &b2;
1415     mem = b2;
1416     VariantInit(&v2);
1417     stubMsg.Buffer = buffer;
1418     next = VARIANT_UserUnmarshal(&umcb.Flags, buffer, &v2);
1419     ok(next == buffer + stubMsg.BufferLength, "got %p expect %p\n", next, buffer + stubMsg.BufferLength);
1420     ok(mem == b2, "BSTR should be reused\n");
1421     ok(V_VT(&v) == V_VT(&v2), "got vt %d expect %d\n", V_VT(&v), V_VT(&v2));
1422     ok(SysStringByteLen(*V_BSTRREF(&v)) == SysStringByteLen(*V_BSTRREF(&v2)), "bstr string lens differ\n");
1423     ok(!memcmp(*V_BSTRREF(&v), *V_BSTRREF(&v2), SysStringByteLen(*V_BSTRREF(&v))), "bstrs differ\n");
1424     size = IMalloc_GetSize(allocator, V_BYREF(&v2));
1425     ok(size == sizeof(V_BSTR(&v2)), "got size %#Ix\n", size);
1426     SysFreeString(b2);
1427     HeapFree(GetProcessHeap(), 0, oldbuffer);
1428     SysFreeString(b);
1429
1430     /*** ARRAY ***/
1431     sab.lLbound = 5;
1432     sab.cElements = 10;
1433
1434     lpsa = SafeArrayCreate(VT_R8, 1, &sab);
1435     *(DWORD *)lpsa->pvData = 0xcafebabe;
1436     *((DWORD *)lpsa->pvData + 1) = 0xdeadbeef;
1437
1438     VariantInit(&v);
1439     V_VT(&v) = VT_UI4 | VT_ARRAY;
1440     V_ARRAY(&v) = lpsa;
1441
1442     rpcMsg.BufferLength = stubMsg.BufferLength = VARIANT_UserSize(&umcb.Flags, 0, &v);
1443     expected = 152;
1444     ok(stubMsg.BufferLength == expected || stubMsg.BufferLength == expected + 8, /* win64 */
1445        "size %lu instead of %lu\n", stubMsg.BufferLength, expected);
1446     buffer = rpcMsg.Buffer = stubMsg.Buffer = stubMsg.BufferStart = alloc_aligned(stubMsg.BufferLength, &oldbuffer);
1447     stubMsg.BufferEnd = stubMsg.Buffer + stubMsg.BufferLength;
1448     next = VARIANT_UserMarshal(&umcb.Flags, buffer, &v);
1449     ok(next == buffer + expected, "got %p expect %p\n", next, buffer + expected);
1450     wirev = (DWORD*)buffer;
1451
1452     wirev = check_variant_header(wirev, &v, expected);
1453     ok(*wirev, "wv[5] %08lx\n", *wirev); /* win2k: this is lpsa. winxp: this is (char*)lpsa + 1 */
1454     wirev++;
1455     check_safearray(wirev, lpsa);
1456     VariantInit(&v2);
1457     stubMsg.Buffer = buffer;
1458     next = VARIANT_UserUnmarshal(&umcb.Flags, buffer, &v2);
1459     ok(next == buffer + expected, "got %p expect %p\n", next, buffer + expected);
1460     ok(V_VT(&v) == V_VT(&v2), "got vt %d expect %d\n", V_VT(&v), V_VT(&v2));
1461     ok(SafeArrayGetDim(V_ARRAY(&v)) == SafeArrayGetDim(V_ARRAY(&v2)), "array dims differ\n");
1462     SafeArrayGetLBound(V_ARRAY(&v), 1, &bound);
1463     SafeArrayGetLBound(V_ARRAY(&v2), 1, &bound2);
1464     ok(bound == bound2, "array lbounds differ\n");
1465     SafeArrayGetUBound(V_ARRAY(&v), 1, &bound);
1466     SafeArrayGetUBound(V_ARRAY(&v2), 1, &bound2);
1467     ok(bound == bound2, "array ubounds differ\n");
1468     SafeArrayGetVartype(V_ARRAY(&v), &vt);
1469     SafeArrayGetVartype(V_ARRAY(&v2), &vt2);
1470     ok(vt == vt2, "array vts differ %x %x\n", vt, vt2);
1471     VARIANT_UserFree(&umcb.Flags, &v2);
1472     HeapFree(GetProcessHeap(), 0, oldbuffer);
1473
1474     /*** ARRAY BYREF ***/
1475     VariantInit(&v);
1476     V_VT(&v) = VT_UI4 | VT_ARRAY | VT_BYREF;
1477     V_ARRAYREF(&v) = &lpsa;
1478
1479     rpcMsg.BufferLength = stubMsg.BufferLength = VARIANT_UserSize(&umcb.Flags, 0, &v);
1480     expected = 152;
1481     ok(stubMsg.BufferLength == expected || stubMsg.BufferLength == expected + 16, /* win64 */
1482        "size %lu instead of %lu\n", stubMsg.BufferLength, expected);
1483     buffer = rpcMsg.Buffer = stubMsg.Buffer = stubMsg.BufferStart = alloc_aligned(stubMsg.BufferLength, &oldbuffer);
1484     stubMsg.BufferEnd = stubMsg.Buffer + stubMsg.BufferLength;
1485     next = VARIANT_UserMarshal(&umcb.Flags, buffer, &v);
1486     ok(next == buffer + expected, "got %p expect %p\n", next, buffer + expected);
1487     wirev = (DWORD*)buffer;
1488
1489     wirev = check_variant_header(wirev, &v, expected);
1490     ok(*wirev == 4, "wv[5] %08lx\n", *wirev);
1491     wirev++;
1492     ok(*wirev, "wv[6] %08lx\n", *wirev); /* win2k: this is lpsa. winxp: this is (char*)lpsa + 1 */
1493     wirev++;
1494     check_safearray(wirev, lpsa);
1495     VariantInit(&v2);
1496     stubMsg.Buffer = buffer;
1497     next = VARIANT_UserUnmarshal(&umcb.Flags, buffer, &v2);
1498     ok(next == buffer + expected, "got %p expect %p\n", next, buffer + expected);
1499     ok(V_VT(&v) == V_VT(&v2), "got vt %d expect %d\n", V_VT(&v), V_VT(&v2));
1500     ok(SafeArrayGetDim(*V_ARRAYREF(&v)) == SafeArrayGetDim(*V_ARRAYREF(&v2)), "array dims differ\n");
1501     SafeArrayGetLBound(*V_ARRAYREF(&v), 1, &bound);
1502     SafeArrayGetLBound(*V_ARRAYREF(&v2), 1, &bound2);
1503     ok(bound == bound2, "array lbounds differ\n");
1504     SafeArrayGetUBound(*V_ARRAYREF(&v), 1, &bound);
1505     SafeArrayGetUBound(*V_ARRAYREF(&v2), 1, &bound2);
1506     ok(bound == bound2, "array ubounds differ\n");
1507     SafeArrayGetVartype(*V_ARRAYREF(&v), &vt);
1508     SafeArrayGetVartype(*V_ARRAYREF(&v2), &vt2);
1509     ok(vt == vt2, "array vts differ %x %x\n", vt, vt2);
1510     size = IMalloc_GetSize(allocator, V_BYREF(&v2));
1511     ok(size == sizeof(V_ARRAY(&v2)), "got size %#Ix\n", size);
1512     VARIANT_UserFree(&umcb.Flags, &v2);
1513     HeapFree(GetProcessHeap(), 0, oldbuffer);
1514
1515     /*** ARRAY BYREF ***/
1516     VariantInit(&v);
1517     V_VT(&v) = VT_UI4 | VT_ARRAY | VT_BYREF;
1518     V_ARRAYREF(&v) = &lpsa;
1519     lpsa->fFeatures |= FADF_STATIC;
1520
1521     rpcMsg.BufferLength = stubMsg.BufferLength = VARIANT_UserSize(&umcb.Flags, 0, &v);
1522     expected = 152;
1523     ok(stubMsg.BufferLength == expected || stubMsg.BufferLength == expected + 16, /* win64 */
1524        "size %lu instead of %lu\n", stubMsg.BufferLength, expected);
1525     buffer = rpcMsg.Buffer = stubMsg.Buffer = stubMsg.BufferStart = alloc_aligned(stubMsg.BufferLength, &oldbuffer);
1526     stubMsg.BufferEnd = stubMsg.Buffer + stubMsg.BufferLength;
1527     next = VARIANT_UserMarshal(&umcb.Flags, buffer, &v);
1528     ok(next == buffer + expected, "got %p expect %p\n", next, buffer + expected);
1529     wirev = (DWORD*)buffer;
1530
1531     wirev = check_variant_header(wirev, &v, expected);
1532     ok(*wirev == 4, "wv[5] %08lx\n", *wirev);
1533     wirev++;
1534     ok(*wirev, "wv[6] %08lx\n", *wirev); /* win2k: this is lpsa. winxp: this is (char*)lpsa + 1 */
1535     wirev++;
1536     check_safearray(wirev, lpsa);
1537     lpsa_copy = lpsa2 = SafeArrayCreate(VT_I8, 1, &sab);
1538     /* set FADF_STATIC feature to make sure lpsa2->pvData pointer changes if new data buffer is allocated */
1539     lpsa2->fFeatures |= FADF_STATIC;
1540     mem = lpsa2->pvData;
1541     V_VT(&v2) = VT_UI4 | VT_ARRAY | VT_BYREF;
1542     V_ARRAYREF(&v2) = &lpsa2;
1543     stubMsg.Buffer = buffer;
1544     next = VARIANT_UserUnmarshal(&umcb.Flags, buffer, &v2);
1545     ok(next == buffer + expected, "got %p expect %p\n", next, buffer + expected);
1546     ok(V_VT(&v) == V_VT(&v2), "got vt %d expect %d\n", V_VT(&v), V_VT(&v2));
1547     ok(lpsa2 == lpsa_copy, "safearray should be reused\n");
1548     ok(mem == lpsa2->pvData, "safearray data should be reused\n");
1549     ok(SafeArrayGetDim(*V_ARRAYREF(&v)) == SafeArrayGetDim(*V_ARRAYREF(&v2)), "array dims differ\n");
1550     SafeArrayGetLBound(*V_ARRAYREF(&v), 1, &bound);
1551     SafeArrayGetLBound(*V_ARRAYREF(&v2), 1, &bound2);
1552     ok(bound == bound2, "array lbounds differ\n");
1553     SafeArrayGetUBound(*V_ARRAYREF(&v), 1, &bound);
1554     SafeArrayGetUBound(*V_ARRAYREF(&v2), 1, &bound2);
1555     ok(bound == bound2, "array ubounds differ\n");
1556     SafeArrayGetVartype(*V_ARRAYREF(&v), &vt);
1557     SafeArrayGetVartype(*V_ARRAYREF(&v2), &vt2);
1558     ok(vt == vt2, "array vts differ %x %x\n", vt, vt2);
1559     lpsa2->fFeatures &= ~FADF_STATIC;
1560     hr = SafeArrayDestroy(*V_ARRAYREF(&v2));
1561     ok(hr == S_OK, "got 0x%08lx\n", hr);
1562     HeapFree(GetProcessHeap(), 0, oldbuffer);
1563     lpsa->fFeatures &= ~FADF_STATIC;
1564     hr = SafeArrayDestroy(lpsa);
1565     ok(hr == S_OK, "got 0x%08lx\n", hr);
1566
1567     /*** VARIANT BYREF ***/
1568     VariantInit(&v);
1569     VariantInit(&v2);
1570     V_VT(&v2) = VT_R8;
1571     V_R8(&v2) = 3.1415;
1572     V_VT(&v) = VT_VARIANT | VT_BYREF;
1573     V_VARIANTREF(&v) = &v2;
1574
1575     rpcMsg.BufferLength = stubMsg.BufferLength = VARIANT_UserSize(&umcb.Flags, 0, &v);
1576     ok(stubMsg.BufferLength == 64, "size %ld\n", stubMsg.BufferLength);
1577     buffer = rpcMsg.Buffer = stubMsg.Buffer = stubMsg.BufferStart = alloc_aligned(stubMsg.BufferLength, &oldbuffer);
1578     stubMsg.BufferEnd = stubMsg.Buffer + stubMsg.BufferLength;
1579     memset(buffer, 0xcc, stubMsg.BufferLength);
1580     next = VARIANT_UserMarshal(&umcb.Flags, buffer, &v);
1581     ok(next == buffer + stubMsg.BufferLength, "got %p expect %p\n", next, buffer + stubMsg.BufferLength);
1582     wirev = (DWORD*)buffer;
1583     wirev = check_variant_header(wirev, &v, stubMsg.BufferLength);
1584
1585     ok(*wirev == sizeof(VARIANT), "wv[5] %08lx\n", *wirev);
1586     wirev++;
1587     ok(*wirev == ('U' | 's' << 8 | 'e' << 16 | 'r' << 24), "wv[6] %08lx\n", *wirev); /* 'User' */
1588     wirev++;
1589     ok(*wirev == 0xcccccccc, "wv[7] %08lx\n", *wirev); /* pad */
1590     wirev++;
1591     wirev = check_variant_header(wirev, &v2, stubMsg.BufferLength - 32);
1592     ok(*wirev == 0xcccccccc, "wv[13] %08lx\n", *wirev); /* pad for VT_R8 */
1593     wirev++;
1594     ok(*(double*)wirev == V_R8(&v2), "wv[6] %08lx wv[7] %08lx\n", *wirev, *(wirev+1));
1595     VariantInit(&v3);
1596     stubMsg.Buffer = buffer;
1597     next = VARIANT_UserUnmarshal(&umcb.Flags, buffer, &v3);
1598     ok(next == buffer + stubMsg.BufferLength, "got %p expect %p\n", next, buffer + stubMsg.BufferLength);
1599     ok(V_VT(&v) == V_VT(&v3), "got vt %d expect %d\n", V_VT(&v), V_VT(&v3));
1600     ok(V_VT(V_VARIANTREF(&v)) == V_VT(V_VARIANTREF(&v3)), "vts differ %x %x\n",
1601        V_VT(V_VARIANTREF(&v)), V_VT(V_VARIANTREF(&v3)));
1602     ok(V_R8(V_VARIANTREF(&v)) == V_R8(V_VARIANTREF(&v3)), "r8s differ\n");
1603     size = IMalloc_GetSize(allocator, V_BYREF(&v3));
1604     ok(size == sizeof(*V_VARIANTREF(&v3)), "got size %#Ix\n", size);
1605     VARIANT_UserFree(&umcb.Flags, &v3);
1606     HeapFree(GetProcessHeap(), 0, oldbuffer);
1607
1608     /*** UNKNOWN ***/
1609     heap_unknown = HeapAlloc(GetProcessHeap(), 0, sizeof(*heap_unknown));
1610     heap_unknown->IUnknown_iface.lpVtbl = &HeapUnknown_Vtbl;
1611     heap_unknown->refs = 1;
1612     VariantInit(&v);
1613     VariantInit(&v2);
1614     V_VT(&v) = VT_UNKNOWN;
1615     V_UNKNOWN(&v) = &heap_unknown->IUnknown_iface;
1616
1617     rpcMsg.BufferLength = stubMsg.BufferLength = VARIANT_UserSize(&umcb.Flags, 0, &v);
1618     ok(stubMsg.BufferLength > 40, "size %ld\n", stubMsg.BufferLength);
1619     buffer = rpcMsg.Buffer = stubMsg.Buffer = stubMsg.BufferStart = alloc_aligned(stubMsg.BufferLength, &oldbuffer);
1620     stubMsg.BufferEnd = stubMsg.Buffer + stubMsg.BufferLength;
1621     memset(buffer, 0xcc, stubMsg.BufferLength);
1622     next = VARIANT_UserMarshal(&umcb.Flags, buffer, &v);
1623     todo_wine
1624     ok(heap_unknown->refs == 2, "got refcount %ld\n", heap_unknown->refs);
1625     wirev = (DWORD*)buffer;
1626     wirev = check_variant_header(wirev, &v, next - buffer);
1627
1628     todo_wine_if( *wirev == (DWORD)(DWORD_PTR)V_UNKNOWN(&v) /* win9x */)
1629     ok(*wirev == (DWORD)(DWORD_PTR)V_UNKNOWN(&v) + 1, "wv[5] %08lx\n", *wirev);
1630     wirev++;
1631     ok(*wirev == next - buffer - 0x20, "wv[6] %08lx\n", *wirev);
1632     wirev++;
1633     ok(*wirev == next - buffer - 0x20, "wv[7] %08lx\n", *wirev);
1634     wirev++;
1635     ok(*wirev == 0x574f454d, "wv[8] %08lx\n", *wirev);
1636     VariantInit(&v3);
1637     V_VT(&v3) = VT_UNKNOWN;
1638     V_UNKNOWN(&v3) = &heap_unknown->IUnknown_iface;
1639     IUnknown_AddRef(V_UNKNOWN(&v3));
1640     stubMsg.Buffer = buffer;
1641     todo_wine
1642     ok(heap_unknown->refs == 3, "got refcount %ld\n", heap_unknown->refs);
1643     next = VARIANT_UserUnmarshal(&umcb.Flags, buffer, &v3);
1644     ok(V_VT(&v) == V_VT(&v3), "got vt %d expect %d\n", V_VT(&v), V_VT(&v3));
1645     ok(V_UNKNOWN(&v) == V_UNKNOWN(&v3), "got %p expect %p\n", V_UNKNOWN(&v), V_UNKNOWN(&v3));
1646     VARIANT_UserFree(&umcb.Flags, &v3);
1647     ok(heap_unknown->refs == 1, "%ld refcounts of IUnknown leaked\n", heap_unknown->refs - 1);
1648     IUnknown_Release(&heap_unknown->IUnknown_iface);
1649     HeapFree(GetProcessHeap(), 0, oldbuffer);
1650
1651     /*** NULL UNKNOWN ***/
1652     VariantInit(&v);
1653     V_VT(&v) = VT_UNKNOWN;
1654     V_UNKNOWN(&v) = NULL;
1655
1656     rpcMsg.BufferLength = stubMsg.BufferLength = VARIANT_UserSize(&umcb.Flags, 0, &v);
1657     ok(stubMsg.BufferLength >= 24, "size %ld\n", stubMsg.BufferLength);
1658     buffer = rpcMsg.Buffer = stubMsg.Buffer = stubMsg.BufferStart = alloc_aligned(stubMsg.BufferLength, &oldbuffer);
1659     stubMsg.BufferEnd = stubMsg.Buffer + stubMsg.BufferLength;
1660     memset(buffer, 0xcc, stubMsg.BufferLength);
1661     next = VARIANT_UserMarshal(&umcb.Flags, buffer, &v);
1662     wirev = (DWORD*)buffer;
1663     wirev = check_variant_header(wirev, &v, next - buffer);
1664     ok(*wirev == 0, "wv[5] %08lx\n", *wirev);
1665
1666     VariantInit(&v2);
1667     stubMsg.Buffer = buffer;
1668     next = VARIANT_UserUnmarshal(&umcb.Flags, buffer, &v2);
1669     ok(V_VT(&v) == V_VT(&v2), "got vt %d expect %d\n", V_VT(&v), V_VT(&v2));
1670     ok(V_UNKNOWN(&v2) == NULL, "got %p expect NULL\n", V_UNKNOWN(&v2));
1671     VARIANT_UserFree(&umcb.Flags, &v2);
1672     HeapFree(GetProcessHeap(), 0, oldbuffer);
1673
1674     /*** UNKNOWN BYREF ***/
1675     heap_unknown = HeapAlloc(GetProcessHeap(), 0, sizeof(*heap_unknown));
1676     heap_unknown->IUnknown_iface.lpVtbl = &HeapUnknown_Vtbl;
1677     heap_unknown->refs = 1;
1678     VariantInit(&v);
1679     VariantInit(&v2);
1680     V_VT(&v) = VT_UNKNOWN | VT_BYREF;
1681     V_UNKNOWNREF(&v) = (IUnknown **)&heap_unknown;
1682
1683     rpcMsg.BufferLength = stubMsg.BufferLength = VARIANT_UserSize(&umcb.Flags, 0, &v);
1684     ok(stubMsg.BufferLength >= 44, "size %ld\n", stubMsg.BufferLength);
1685     buffer = rpcMsg.Buffer = stubMsg.Buffer = stubMsg.BufferStart = alloc_aligned(stubMsg.BufferLength, &oldbuffer);
1686     stubMsg.BufferEnd = stubMsg.Buffer + stubMsg.BufferLength;
1687     memset(buffer, 0xcc, stubMsg.BufferLength);
1688     ok(heap_unknown->refs == 1, "got refcount %ld\n", heap_unknown->refs);
1689     next = VARIANT_UserMarshal(&umcb.Flags, buffer, &v);
1690     todo_wine
1691     ok(heap_unknown->refs == 2, "got refcount %ld\n", heap_unknown->refs);
1692     wirev = (DWORD*)buffer;
1693     wirev = check_variant_header(wirev, &v, next - buffer);
1694
1695     ok(*wirev == 4, "wv[5] %08lx\n", *wirev);
1696     wirev++;
1697     todo_wine_if( *wirev == (DWORD)(DWORD_PTR)heap_unknown /* win9x */)
1698     ok(*wirev == (DWORD)(DWORD_PTR)heap_unknown + 1, "wv[6] %08lx\n", *wirev);
1699     wirev++;
1700     ok(*wirev == next - buffer - 0x24, "wv[7] %08lx\n", *wirev);
1701     wirev++;
1702     ok(*wirev == next - buffer - 0x24, "wv[8] %08lx\n", *wirev);
1703     wirev++;
1704     ok(*wirev == 0x574f454d, "wv[9] %08lx\n", *wirev);
1705
1706     VariantInit(&v3);
1707     V_VT(&v3) = VT_UNKNOWN;
1708     V_UNKNOWN(&v3) = &heap_unknown->IUnknown_iface;
1709     IUnknown_AddRef(V_UNKNOWN(&v3));
1710     stubMsg.Buffer = buffer;
1711     next = VARIANT_UserUnmarshal(&umcb.Flags, buffer, &v3);
1712     ok(heap_unknown->refs == 2, "got refcount %ld\n", heap_unknown->refs);
1713     ok(V_VT(&v) == V_VT(&v3), "got vt %d expect %d\n", V_VT(&v), V_VT(&v3));
1714     ok(*V_UNKNOWNREF(&v) == *V_UNKNOWNREF(&v3), "got %p expect %p\n", *V_UNKNOWNREF(&v), *V_UNKNOWNREF(&v3));
1715     size = IMalloc_GetSize(allocator, V_BYREF(&v3));
1716     ok(size == sizeof(V_BSTR(&v3)), "got size %#Ix\n", size);
1717     VARIANT_UserFree(&umcb.Flags, &v3);
1718     ok(heap_unknown->refs == 1, "%ld refcounts of IUnknown leaked\n", heap_unknown->refs - 1);
1719     IUnknown_Release(&heap_unknown->IUnknown_iface);
1720     HeapFree(GetProcessHeap(), 0, oldbuffer);
1721
1722     unk = NULL;
1723     VariantInit(&v);
1724     V_VT(&v) = VT_UNKNOWN | VT_BYREF;
1725     V_UNKNOWNREF(&v) = &unk;
1726
1727     rpcMsg.BufferLength = stubMsg.BufferLength = VARIANT_UserSize(&umcb.Flags, 0, &v);
1728     ok(stubMsg.BufferLength >= 28, "size %ld\n", stubMsg.BufferLength);
1729     buffer = rpcMsg.Buffer = stubMsg.Buffer = stubMsg.BufferStart = alloc_aligned(stubMsg.BufferLength, &oldbuffer);
1730     stubMsg.BufferEnd = stubMsg.Buffer + stubMsg.BufferLength;
1731     memset(buffer, 0xcc, stubMsg.BufferLength);
1732     next = VARIANT_UserMarshal(&umcb.Flags, buffer, &v);
1733     ok(next == buffer + stubMsg.BufferLength, "got %p expect %p\n", next, buffer + stubMsg.BufferLength);
1734     wirev = (DWORD*)buffer;
1735     wirev = check_variant_header(wirev, &v, stubMsg.BufferLength);
1736
1737     ok(*wirev == 4, "wv[5] %08lx\n", *wirev);
1738
1739     VariantInit(&v2);
1740     stubMsg.Buffer = buffer;
1741     next = VARIANT_UserUnmarshal(&umcb.Flags, buffer, &v2);
1742     ok(next == buffer + stubMsg.BufferLength, "got %p expect %p\n", next, buffer + stubMsg.BufferLength);
1743     ok(V_VT(&v) == V_VT(&v2), "got vt %d expect %d\n", V_VT(&v2), V_VT(&v));
1744     ok(!*V_UNKNOWNREF(&v2), "got %p expect NULL\n", *V_UNKNOWNREF(&v2));
1745     size = IMalloc_GetSize(allocator, V_BYREF(&v2));
1746     ok(size == sizeof(V_BSTR(&v2)), "got size %#Ix\n", size);
1747     VARIANT_UserFree(&umcb.Flags, &v2);
1748     HeapFree(GetProcessHeap(), 0, oldbuffer);
1749
1750     IMalloc_Release(allocator);
1751 }
1752
1753
1754 START_TEST(usrmarshal)
1755 {
1756     CoInitialize(NULL);
1757
1758     test_marshal_LPSAFEARRAY();
1759     test_marshal_BSTR();
1760     test_marshal_VARIANT();
1761
1762     CoUninitialize();
1763 }