dlls/oleaut32/tests/usrmarshal.c

   1 /*
   2  * Marshaling Tests
   3  *
   4  * Copyright 2004 Robert Shearman
   5  *
   6  * This library is free software; you can redistribute it and/or
   7  * modify it under the terms of the GNU Lesser General Public
   8  * License as published by the Free Software Foundation; either
   9  * version 2.1 of the License, or (at your option) any later version.
  10  *
  11  * This library is distributed in the hope that it will be useful,
  12  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  13  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  14  * Lesser General Public License for more details.
  15  *
  16  * You should have received a copy of the GNU Lesser General Public
  17  * License along with this library; if not, write to the Free Software
  18  * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA
  19  */
  20
  21 #define COBJMACROS
  22 #define CONST_VTABLE
  23
  24 #include <stdarg.h>
  25
  26 #include "windef.h"
  27 #include "winbase.h"
  28 #include "objbase.h"
  29 #include "propidl.h" /* for LPSAFEARRAY_User* routines */
  30
  31 #include "wine/test.h"
  32
  33 #if (__STDC__ && !defined(_FORCENAMELESSUNION)) || defined(NONAMELESSUNION)
  34 # define V_U2(A)  ((A)->n1.n2)
  35 #else
  36 # define V_U2(A)  (*(A))
  37 #endif
  38
  39 static HRESULT (WINAPI *pSafeArrayGetIID)(SAFEARRAY*,GUID*);
  40 static HRESULT (WINAPI *pSafeArrayGetVartype)(SAFEARRAY*,VARTYPE*);
  41 static HRESULT (WINAPI *pVarBstrCmp)(BSTR,BSTR,LCID,ULONG);
  42
  43 static inline SF_TYPE get_union_type(SAFEARRAY *psa)
  44 {
  45     VARTYPE vt;
  46     HRESULT hr;
  47
  48     hr = pSafeArrayGetVartype(psa, &vt);
  49     if (FAILED(hr))
  50     {
  51         if(psa->fFeatures & FADF_VARIANT) return SF_VARIANT;
  52
  53         switch(psa->cbElements)
  54         {
  55         case 1: vt = VT_I1; break;
  56         case 2: vt = VT_I2; break;
  57         case 4: vt = VT_I4; break;
  58         case 8: vt = VT_I8; break;
  59         default: return 0;
  60         }
  61     }
  62
  63     if (psa->fFeatures & FADF_HAVEIID)
  64         return SF_HAVEIID;
  65
  66     switch (vt)
  67     {
  68     case VT_I1:
  69     case VT_UI1:      return SF_I1;
  70     case VT_BOOL:
  71     case VT_I2:
  72     case VT_UI2:      return SF_I2;
  73     case VT_INT:
  74     case VT_UINT:
  75     case VT_I4:
  76     case VT_UI4:
  77     case VT_R4:       return SF_I4;
  78     case VT_DATE:
  79     case VT_CY:
  80     case VT_R8:
  81     case VT_I8:
  82     case VT_UI8:      return SF_I8;
  83     case VT_INT_PTR:
  84     case VT_UINT_PTR: return (sizeof(UINT_PTR) == 4 ? SF_I4 : SF_I8);
  85     case VT_BSTR:     return SF_BSTR;
  86     case VT_DISPATCH: return SF_DISPATCH;
  87     case VT_VARIANT:  return SF_VARIANT;
  88     case VT_UNKNOWN:  return SF_UNKNOWN;
  89     /* Note: Return a non-zero size to indicate vt is valid. The actual size
  90      * of a UDT is taken from the result of IRecordInfo_GetSize().
  91      */
  92     case VT_RECORD:   return SF_RECORD;
  93     default:          return SF_ERROR;
  94     }
  95 }
  96
  97 static ULONG get_cell_count(const SAFEARRAY *psa)
  98 {
  99     const SAFEARRAYBOUND* psab = psa->rgsabound;
 100     USHORT cCount = psa->cDims;
 101     ULONG ulNumCells = 1;
 102
 103     while (cCount--)
 104     {
 105          if (!psab->cElements)
 106             return 0;
 107         ulNumCells *= psab->cElements;
 108         psab++;
 109     }
 110     return ulNumCells;
 111 }
 112
 113 static DWORD elem_wire_size(LPSAFEARRAY lpsa, SF_TYPE sftype)
 114 {
 115     if (sftype == SF_BSTR)
 116         return sizeof(DWORD);
 117     else
 118         return lpsa->cbElements;
 119 }
 120
 121 static void check_safearray(void *buffer, LPSAFEARRAY lpsa)
 122 {
 123     unsigned char *wiresa = buffer;
 124     const SAFEARRAYBOUND *bounds;
 125     VARTYPE vt;
 126     SF_TYPE sftype;
 127     ULONG cell_count;
 128     int i;
 129
 130     if(!lpsa)
 131     {
 132         ok(*(DWORD *)wiresa == 0, "wiresa + 0x0 should be NULL instead of 0x%08x\n", *(DWORD *)wiresa);
 133         return;
 134     }
 135
 136     if (!pSafeArrayGetVartype || !pSafeArrayGetIID)
 137         return;
 138
 139     if(FAILED(pSafeArrayGetVartype(lpsa, &vt)))
 140         vt = 0;
 141
 142     sftype = get_union_type(lpsa);
 143     cell_count = get_cell_count(lpsa);
 144
 145     ok(*(DWORD *)wiresa, "wiresa + 0x0 should be non-NULL instead of 0x%08x\n", *(DWORD *)wiresa); /* win2k: this is lpsa. winxp: this is 0x00000001 */
 146     wiresa += sizeof(DWORD);
 147     ok(*(DWORD *)wiresa == lpsa->cDims, "wiresa + 0x4 should be lpsa->cDims instead of 0x%08x\n", *(DWORD *)wiresa);
 148     wiresa += sizeof(DWORD);
 149     ok(*(WORD *)wiresa == lpsa->cDims, "wiresa + 0x8 should be lpsa->cDims instead of 0x%04x\n", *(WORD *)wiresa);
 150     wiresa += sizeof(WORD);
 151     ok(*(WORD *)wiresa == lpsa->fFeatures, "wiresa + 0xa should be lpsa->fFeatures instead of 0x%08x\n", *(WORD *)wiresa);
 152     wiresa += sizeof(WORD);
 153     ok(*(DWORD *)wiresa == elem_wire_size(lpsa, sftype), "wiresa + 0xc should be 0x%08x instead of 0x%08x\n", elem_wire_size(lpsa, sftype), *(DWORD *)wiresa);
 154     wiresa += sizeof(DWORD);
 155     ok(*(WORD *)wiresa == lpsa->cLocks, "wiresa + 0x10 should be lpsa->cLocks instead of 0x%04x\n", *(WORD *)wiresa);
 156     wiresa += sizeof(WORD);
 157     ok(*(WORD *)wiresa == vt, "wiresa + 0x12 should be %04x instead of 0x%04x\n", vt, *(WORD *)wiresa);
 158     wiresa += sizeof(WORD);
 159     ok(*(DWORD *)wiresa == sftype, "wiresa + 0x14 should be %08x instead of 0x%08x\n", (DWORD)sftype, *(DWORD *)wiresa);
 160     wiresa += sizeof(DWORD);
 161     ok(*(DWORD *)wiresa == cell_count, "wiresa + 0x18 should be %u instead of %u\n", cell_count, *(DWORD *)wiresa);
 162     wiresa += sizeof(DWORD);
 163     ok(*(DWORD *)wiresa, "wiresa + 0x1c should be non-zero instead of 0x%08x\n", *(DWORD *)wiresa);
 164     wiresa += sizeof(DWORD);
 165     if(sftype == SF_HAVEIID)
 166     {
 167         GUID guid;
 168         pSafeArrayGetIID(lpsa, &guid);
 169         ok(IsEqualGUID(&guid, wiresa), "guid mismatch\n");
 170         wiresa += sizeof(GUID);
 171     }
 172
 173     /* bounds are marshaled in natural dimensions order */
 174     bounds = (SAFEARRAYBOUND*)wiresa;
 175     for(i=0; i<lpsa->cDims; i++)
 176     {
 177         ok(memcmp(bounds, &lpsa->rgsabound[lpsa->cDims-i-1], sizeof(SAFEARRAYBOUND)) == 0,
 178            "bounds mismatch for dimension %d, got (%d,%d), expected (%d,%d)\n", i,
 179             bounds->lLbound, bounds->cElements, lpsa->rgsabound[lpsa->cDims-i-1].lLbound,
 180             lpsa->rgsabound[lpsa->cDims-i-1].cElements);
 181         bounds++;
 182     }
 183
 184     wiresa += sizeof(lpsa->rgsabound[0]) * lpsa->cDims;
 185
 186     ok(*(DWORD *)wiresa == cell_count, "wiresa + 0x28 should be %u instead of %u\n", cell_count, *(DWORD*)wiresa);
 187     wiresa += sizeof(DWORD);
 188     /* elements are now pointed to by wiresa */
 189 }
 190
 191 static void * WINAPI user_allocate(SIZE_T size)
 192 {
 193     ok(0, "unexpected user_allocate call\n");
 194     return CoTaskMemAlloc(size);
 195 }
 196
 197 static void WINAPI user_free(void *p)
 198 {
 199     ok(0, "unexpected user_free call\n");
 200     CoTaskMemFree(p);
 201 }
 202
 203 static void init_user_marshal_cb(USER_MARSHAL_CB *umcb,
 204                                  PMIDL_STUB_MESSAGE stub_msg,
 205                                  PRPC_MESSAGE rpc_msg, unsigned char *buffer,
 206                                  unsigned int size, MSHCTX context)
 207 {
 208     memset(rpc_msg, 0, sizeof(*rpc_msg));
 209     rpc_msg->Buffer = buffer;
 210     rpc_msg->BufferLength = size;
 211
 212     memset(stub_msg, 0, sizeof(*stub_msg));
 213     stub_msg->RpcMsg = rpc_msg;
 214     stub_msg->Buffer = buffer;
 215     stub_msg->pfnAllocate = user_allocate;
 216     stub_msg->pfnFree = user_free;
 217
 218     memset(umcb, 0, sizeof(*umcb));
 219     umcb->Flags = MAKELONG(context, NDR_LOCAL_DATA_REPRESENTATION);
 220     umcb->pStubMsg = stub_msg;
 221     umcb->Signature = USER_MARSHAL_CB_SIGNATURE;
 222     umcb->CBType = buffer ? USER_MARSHAL_CB_UNMARSHALL : USER_MARSHAL_CB_BUFFER_SIZE;
 223 }
 224
 225 static void test_marshal_LPSAFEARRAY(void)
 226 {
 227     unsigned char *buffer, *next;
 228     ULONG size, expected;
 229     LPSAFEARRAY lpsa;
 230     LPSAFEARRAY lpsa2 = NULL;
 231     SAFEARRAYBOUND sab[2];
 232     RPC_MESSAGE rpc_msg;
 233     MIDL_STUB_MESSAGE stub_msg;
 234     USER_MARSHAL_CB umcb;
 235     HRESULT hr;
 236     VARTYPE vt, vt2;
 237     OLECHAR *values[10];
 238     int expected_bstr_size;
 239     int i;
 240     LONG indices[1];
 241
 242     sab[0].lLbound = 5;
 243     sab[0].cElements = 10;
 244
 245     lpsa = SafeArrayCreate(VT_I2, 1, sab);
 246     *(DWORD *)lpsa->pvData = 0xcafebabe;
 247
 248     lpsa->cLocks = 7;
 249     init_user_marshal_cb(&umcb, &stub_msg, &rpc_msg, NULL, 0, MSHCTX_DIFFERENTMACHINE);
 250     size = LPSAFEARRAY_UserSize(&umcb.Flags, 1, &lpsa);
 251     expected = (44 + 1 + sizeof(ULONG) - 1) & ~(sizeof(ULONG) - 1);
 252     expected += sab[0].cElements * sizeof(USHORT);
 253     ok(size == expected || size == expected + 12, /* win64 */
 254        "size should be %u bytes, not %u\n", expected, size);
 255     init_user_marshal_cb(&umcb, &stub_msg, &rpc_msg, NULL, 0, MSHCTX_DIFFERENTMACHINE);
 256     size = LPSAFEARRAY_UserSize(&umcb.Flags, 0, &lpsa);
 257     expected = 44 + sab[0].cElements * sizeof(USHORT);
 258     ok(size == expected || size == expected + 12, /* win64 */
 259        "size should be %u bytes, not %u\n", expected, size);
 260     buffer = HeapAlloc(GetProcessHeap(), 0, size);
 261     init_user_marshal_cb(&umcb, &stub_msg, &rpc_msg, buffer, size, MSHCTX_DIFFERENTMACHINE);
 262     next = LPSAFEARRAY_UserMarshal(&umcb.Flags, buffer, &lpsa);
 263     ok(next - buffer == expected, "Marshaled %u bytes, expected %u\n", (ULONG) (next - buffer), expected);
 264     ok(lpsa->cLocks == 7, "got lock count %u\n", lpsa->cLocks);
 265
 266     check_safearray(buffer, lpsa);
 267
 268     init_user_marshal_cb(&umcb, &stub_msg, &rpc_msg, buffer, size, MSHCTX_DIFFERENTMACHINE);
 269     LPSAFEARRAY_UserUnmarshal(&umcb.Flags, buffer, &lpsa2);
 270     ok(lpsa2 != NULL, "LPSAFEARRAY didn't unmarshal\n");
 271     if (pSafeArrayGetVartype)
 272     {
 273         pSafeArrayGetVartype(lpsa, &vt);
 274         pSafeArrayGetVartype(lpsa2, &vt2);
 275         ok(vt == vt2, "vts differ %x %x\n", vt, vt2);
 276     }
 277     ok(lpsa2->cLocks == 0, "got lock count %u, expected 0\n", lpsa2->cLocks);
 278     init_user_marshal_cb(&umcb, &stub_msg, &rpc_msg, NULL, 0, MSHCTX_DIFFERENTMACHINE);
 279     LPSAFEARRAY_UserFree(&umcb.Flags, &lpsa2);
 280     HeapFree(GetProcessHeap(), 0, buffer);
 281     lpsa->cLocks = 0;
 282     hr = SafeArrayDestroy(lpsa);
 283     ok(hr == S_OK, "got 0x%08x\n", hr);
 284
 285     /* use two dimensions */
 286     sab[0].lLbound = 5;
 287     sab[0].cElements = 10;
 288     sab[1].lLbound = 1;
 289     sab[1].cElements = 2;
 290
 291     lpsa = SafeArrayCreate(VT_I2, 2, sab);
 292     *(DWORD *)lpsa->pvData = 0xcafebabe;
 293
 294     lpsa->cLocks = 7;
 295     init_user_marshal_cb(&umcb, &stub_msg, &rpc_msg, NULL, 0, MSHCTX_DIFFERENTMACHINE);
 296     size = LPSAFEARRAY_UserSize(&umcb.Flags, 1, &lpsa);
 297     expected = (44 + 1 + +sizeof(SAFEARRAYBOUND) + sizeof(ULONG) - 1) & ~(sizeof(ULONG) - 1);
 298     expected += max(sab[0].cElements, sab[1].cElements) * lpsa->cDims * sizeof(USHORT);
 299     ok(size == expected || size == expected + 12, /* win64 */
 300        "size should be %u bytes, not %u\n", expected, size);
 301     init_user_marshal_cb(&umcb, &stub_msg, &rpc_msg, NULL, 0, MSHCTX_DIFFERENTMACHINE);
 302     size = LPSAFEARRAY_UserSize(&umcb.Flags, 0, &lpsa);
 303     expected = 52 + max(sab[0].cElements, sab[1].cElements) * lpsa->cDims * sizeof(USHORT);
 304     ok(size == expected || size == expected + 12, /* win64 */
 305        "size should be %u bytes, not %u\n", expected, size);
 306     buffer = HeapAlloc(GetProcessHeap(), 0, size);
 307     init_user_marshal_cb(&umcb, &stub_msg, &rpc_msg, buffer, size, MSHCTX_DIFFERENTMACHINE);
 308     next = LPSAFEARRAY_UserMarshal(&umcb.Flags, buffer, &lpsa);
 309     ok(next - buffer == expected, "Marshaled %u bytes, expected %u\n", (ULONG) (next - buffer), expected);
 310     ok(lpsa->cLocks == 7, "got lock count %u\n", lpsa->cLocks);
 311
 312     check_safearray(buffer, lpsa);
 313
 314     init_user_marshal_cb(&umcb, &stub_msg, &rpc_msg, buffer, size, MSHCTX_DIFFERENTMACHINE);
 315     LPSAFEARRAY_UserUnmarshal(&umcb.Flags, buffer, &lpsa2);
 316     ok(lpsa2 != NULL, "LPSAFEARRAY didn't unmarshal\n");
 317     if (pSafeArrayGetVartype)
 318     {
 319         pSafeArrayGetVartype(lpsa, &vt);
 320         pSafeArrayGetVartype(lpsa2, &vt2);
 321         ok(vt == vt2, "vts differ %x %x\n", vt, vt2);
 322     }
 323     ok(lpsa2->cLocks == 0, "got lock count %u, expected 0\n", lpsa2->cLocks);
 324     init_user_marshal_cb(&umcb, &stub_msg, &rpc_msg, NULL, 0, MSHCTX_DIFFERENTMACHINE);
 325     LPSAFEARRAY_UserFree(&umcb.Flags, &lpsa2);
 326     HeapFree(GetProcessHeap(), 0, buffer);
 327     lpsa->cLocks = 0;
 328     hr = SafeArrayDestroy(lpsa);
 329     ok(hr == S_OK, "got 0x%08x\n", hr);
 330
 331     /* test NULL safe array */
 332     lpsa = NULL;
 333
 334     init_user_marshal_cb(&umcb, &stub_msg, &rpc_msg, NULL, 0, MSHCTX_DIFFERENTMACHINE);
 335     size = LPSAFEARRAY_UserSize(&umcb.Flags, 0, &lpsa);
 336     expected = 4;
 337     ok(size == expected, "size should be 4 bytes, not %d\n", size);
 338     buffer = HeapAlloc(GetProcessHeap(), 0, size);
 339     init_user_marshal_cb(&umcb, &stub_msg, &rpc_msg, buffer, size, MSHCTX_DIFFERENTMACHINE);
 340     next = LPSAFEARRAY_UserMarshal(&umcb.Flags, buffer, &lpsa);
 341     ok(next - buffer == expected, "Marshaled %u bytes, expected %u\n", (ULONG) (next - buffer), expected);
 342     check_safearray(buffer, lpsa);
 343
 344     init_user_marshal_cb(&umcb, &stub_msg, &rpc_msg, buffer, size, MSHCTX_DIFFERENTMACHINE);
 345     LPSAFEARRAY_UserUnmarshal(&umcb.Flags, buffer, &lpsa2);
 346     ok(lpsa2 == NULL, "NULL LPSAFEARRAY didn't unmarshal\n");
 347     init_user_marshal_cb(&umcb, &stub_msg, &rpc_msg, NULL, 0, MSHCTX_DIFFERENTMACHINE);
 348     LPSAFEARRAY_UserFree(&umcb.Flags, &lpsa2);
 349     HeapFree(GetProcessHeap(), 0, buffer);
 350
 351     sab[0].lLbound = 5;
 352     sab[0].cElements = 10;
 353
 354     lpsa = SafeArrayCreate(VT_R8, 1, sab);
 355     *(double *)lpsa->pvData = 3.1415;
 356
 357     lpsa->cLocks = 7;
 358     init_user_marshal_cb(&umcb, &stub_msg, &rpc_msg, NULL, 0, MSHCTX_DIFFERENTMACHINE);
 359     size = LPSAFEARRAY_UserSize(&umcb.Flags, 1, &lpsa);
 360     expected = (44 + 1 + (sizeof(double) - 1)) & ~(sizeof(double) - 1);
 361     expected += sab[0].cElements * sizeof(double);
 362     ok(size == expected || size == expected + 16, /* win64 */
 363        "size should be %u bytes, not %u\n", expected, size);
 364     init_user_marshal_cb(&umcb, &stub_msg, &rpc_msg, NULL, 0, MSHCTX_DIFFERENTMACHINE);
 365     expected = (44 + (sizeof(double) - 1)) & ~(sizeof(double) - 1);
 366     expected += sab[0].cElements * sizeof(double);
 367     size = LPSAFEARRAY_UserSize(&umcb.Flags, 0, &lpsa);
 368     ok(size == expected || size == expected + 8, /* win64 */
 369        "size should be %u bytes, not %u\n", expected, size);
 370     buffer = HeapAlloc(GetProcessHeap(), 0, size);
 371     init_user_marshal_cb(&umcb, &stub_msg, &rpc_msg, buffer, size, MSHCTX_DIFFERENTMACHINE);
 372     next = LPSAFEARRAY_UserMarshal(&umcb.Flags, buffer, &lpsa);
 373     ok(next - buffer == expected || broken(next - buffer + sizeof(DWORD) == expected),
 374             "Marshaled %u bytes, expected %u\n", (ULONG) (next - buffer), expected);
 375
 376     check_safearray(buffer, lpsa);
 377
 378     HeapFree(GetProcessHeap(), 0, buffer);
 379     lpsa->cLocks = 0;
 380     hr = SafeArrayDestroy(lpsa);
 381     ok(hr == S_OK, "got 0x%08x\n", hr);
 382
 383     /* VARTYPE-less arrays can be marshaled if cbElements is 1,2,4 or 8 as type SF_In */
 384     hr = SafeArrayAllocDescriptor(1, &lpsa);
 385     ok(hr == S_OK, "saad failed %08x\n", hr);
 386     lpsa->cbElements = 8;
 387     lpsa->rgsabound[0].lLbound = 2;
 388     lpsa->rgsabound[0].cElements = 48;
 389     hr = SafeArrayAllocData(lpsa);
 390     ok(hr == S_OK, "saad failed %08x\n", hr);
 391
 392     if (pSafeArrayGetVartype)
 393     {
 394         hr = pSafeArrayGetVartype(lpsa, &vt);
 395         ok(hr == E_INVALIDARG, "ret %08x\n", hr);
 396     }
 397
 398     init_user_marshal_cb(&umcb, &stub_msg, &rpc_msg, NULL, 0, MSHCTX_DIFFERENTMACHINE);
 399     size = LPSAFEARRAY_UserSize(&umcb.Flags, 0, &lpsa);
 400     expected = (44 + lpsa->cbElements - 1) & ~(lpsa->cbElements - 1);
 401     expected += lpsa->cbElements * lpsa->rgsabound[0].cElements;
 402     ok(size == expected || size == expected + 8,  /* win64 */
 403        "size should be %u bytes, not %u\n", expected, size);
 404     buffer = HeapAlloc(GetProcessHeap(), 0, size);
 405     init_user_marshal_cb(&umcb, &stub_msg, &rpc_msg, buffer, size, MSHCTX_DIFFERENTMACHINE);
 406     next = LPSAFEARRAY_UserMarshal(&umcb.Flags, buffer, &lpsa);
 407     ok(next - buffer == expected || broken(next - buffer + sizeof(DWORD) == expected),
 408             "Marshaled %u bytes, expected %u\n", (ULONG) (next - buffer), expected);
 409     check_safearray(buffer, lpsa);
 410     HeapFree(GetProcessHeap(), 0, buffer);
 411     hr = SafeArrayDestroyData(lpsa);
 412     ok(hr == S_OK, "got 0x%08x\n", hr);
 413     hr = SafeArrayDestroyDescriptor(lpsa);
 414     ok(hr == S_OK, "got 0x%08x\n", hr);
 415
 416     /* Test an array of VT_BSTR */
 417     sab[0].lLbound = 3;
 418     sab[0].cElements = sizeof(values) / sizeof(values[0]);
 419
 420     lpsa = SafeArrayCreate(VT_BSTR, 1, sab);
 421     expected_bstr_size = 0;
 422     for (i = 0; i < sab[0].cElements; i++)
 423     {
 424         int j;
 425         WCHAR buf[128];
 426         for (j = 0; j <= i; j++)
 427             buf[j] = 'a' + j;
 428         buf[j] = 0;
 429         indices[0] = i + sab[0].lLbound;
 430         values[i] = SysAllocString(buf);
 431         hr = SafeArrayPutElement(lpsa, indices, values[i]);
 432         ok(hr == S_OK, "Failed to put bstr element hr 0x%x\n", hr);
 433         expected_bstr_size += (j * sizeof(WCHAR)) + (3 * sizeof(DWORD));
 434         if (i % 2 == 0) /* Account for DWORD padding.  Works so long as cElements is even */
 435             expected_bstr_size += sizeof(WCHAR);
 436     }
 437
 438     init_user_marshal_cb(&umcb, &stub_msg, &rpc_msg, NULL, 0, MSHCTX_DIFFERENTMACHINE);
 439     size = LPSAFEARRAY_UserSize(&umcb.Flags, 1, &lpsa);
 440     expected = 44 + (sab[0].cElements * sizeof(DWORD)) + expected_bstr_size;
 441     todo_wine
 442     ok(size == expected + sizeof(DWORD) || size  == (expected + sizeof(DWORD) + 12 /* win64 */),
 443             "size should be %u bytes, not %u\n", expected + (ULONG) sizeof(DWORD), size);
 444     init_user_marshal_cb(&umcb, &stub_msg, &rpc_msg, NULL, 0, MSHCTX_DIFFERENTMACHINE);
 445     size = LPSAFEARRAY_UserSize(&umcb.Flags, 0, &lpsa);
 446     todo_wine
 447     ok(size == expected || size  == (expected + 12 /* win64 */),
 448         "size should be %u bytes, not %u\n", expected, size);
 449     buffer = HeapAlloc(GetProcessHeap(), 0, size);
 450     memset(buffer, 0xcc, size);
 451     init_user_marshal_cb(&umcb, &stub_msg, &rpc_msg, buffer, size, MSHCTX_DIFFERENTMACHINE);
 452     next = LPSAFEARRAY_UserMarshal(&umcb.Flags, buffer, &lpsa);
 453     todo_wine
 454     ok(next - buffer == expected, "Marshaled %u bytes, expected %u\n", (ULONG) (next - buffer), expected);
 455
 456     check_safearray(buffer, lpsa);
 457
 458     lpsa2 = NULL;
 459     init_user_marshal_cb(&umcb, &stub_msg, &rpc_msg, buffer, size, MSHCTX_DIFFERENTMACHINE);
 460     next = LPSAFEARRAY_UserUnmarshal(&umcb.Flags, buffer, &lpsa2);
 461     todo_wine
 462     ok(next - buffer == expected, "Marshaled %u bytes, expected %u\n", (ULONG) (next - buffer), expected);
 463     ok(lpsa2 != NULL, "LPSAFEARRAY didn't unmarshal, result %p\n", next);
 464
 465     for (i = 0; i < sizeof(values) / sizeof(values[0]); i++)
 466     {
 467         BSTR gotvalue = NULL;
 468
 469         if (lpsa2)
 470         {
 471             indices[0] = i + sab[0].lLbound;
 472             hr = SafeArrayGetElement(lpsa2, indices, &gotvalue);
 473             ok(hr == S_OK, "Failed to get bstr element at hres 0x%x\n", hr);
 474             if (hr == S_OK)
 475             {
 476                 if (pVarBstrCmp)
 477                     ok(pVarBstrCmp(values[i], gotvalue, 0, 0) == VARCMP_EQ, "String %d does not match\n", i);
 478                 SysFreeString(gotvalue);
 479             }
 480         }
 481
 482         SysFreeString(values[i]);
 483     }
 484
 485     init_user_marshal_cb(&umcb, &stub_msg, &rpc_msg, NULL, 0, MSHCTX_DIFFERENTMACHINE);
 486     LPSAFEARRAY_UserFree(&umcb.Flags, &lpsa2);
 487
 488     HeapFree(GetProcessHeap(), 0, buffer);
 489     hr = SafeArrayDestroy(lpsa);
 490     ok(hr == S_OK, "got 0x%08x\n", hr);
 491
 492     /* VARTYPE-less arrays with FADF_VARIANT */
 493     hr = SafeArrayAllocDescriptor(1, &lpsa);
 494     ok(hr == S_OK, "saad failed %08x\n", hr);
 495     lpsa->cbElements = sizeof(VARIANT);
 496     lpsa->fFeatures = FADF_VARIANT;
 497     lpsa->rgsabound[0].lLbound = 2;
 498     lpsa->rgsabound[0].cElements = 48;
 499     hr = SafeArrayAllocData(lpsa);
 500     ok(hr == S_OK, "saad failed %08x\n", hr);
 501
 502     if (pSafeArrayGetVartype)
 503     {
 504         hr = pSafeArrayGetVartype(lpsa, &vt);
 505         ok(hr == E_INVALIDARG, "ret %08x\n", hr);
 506     }
 507
 508     init_user_marshal_cb(&umcb, &stub_msg, &rpc_msg, NULL, 0, MSHCTX_DIFFERENTMACHINE);
 509     size = LPSAFEARRAY_UserSize(&umcb.Flags, 0, &lpsa);
 510     expected = 44 + 28 * lpsa->rgsabound[0].cElements;
 511     todo_wine
 512     ok(size == expected || size == expected + 8,  /* win64 */
 513        "size should be %u bytes, not %u\n", expected, size);
 514     buffer = HeapAlloc(GetProcessHeap(), 0, size);
 515     init_user_marshal_cb(&umcb, &stub_msg, &rpc_msg, buffer, size, MSHCTX_DIFFERENTMACHINE);
 516     next = LPSAFEARRAY_UserMarshal(&umcb.Flags, buffer, &lpsa);
 517     todo_wine
 518     ok(next - buffer == expected || broken(next - buffer + sizeof(DWORD) == expected),
 519             "Marshaled %u bytes, expected %u\n", (ULONG) (next - buffer), expected);
 520     lpsa->cbElements = 16;  /* VARIANT wire size */
 521     check_safearray(buffer, lpsa);
 522     HeapFree(GetProcessHeap(), 0, buffer);
 523     hr = SafeArrayDestroyData(lpsa);
 524     ok(hr == S_OK, "got 0x%08x\n", hr);
 525     hr = SafeArrayDestroyDescriptor(lpsa);
 526     ok(hr == S_OK, "got 0x%08x\n", hr);
 527 }
 528
 529 static void check_bstr(void *buffer, BSTR b)
 530 {
 531     DWORD *wireb = buffer;
 532     DWORD len = SysStringByteLen(b);
 533
 534     ok(*wireb == (len + 1) / 2, "wv[0] %08x\n", *wireb);
 535     wireb++;
 536     if(b)
 537         ok(*wireb == len, "wv[1] %08x\n", *wireb);
 538     else
 539         ok(*wireb == 0xffffffff, "wv[1] %08x\n", *wireb);
 540     wireb++;
 541     ok(*wireb == (len + 1) / 2, "wv[2] %08x\n", *wireb);
 542     if(len)
 543     {
 544         wireb++;
 545         ok(!memcmp(wireb, b, (len + 1) & ~1), "strings differ\n");
 546     }
 547     return;
 548 }
 549
 550 static void test_marshal_BSTR(void)
 551 {
 552     ULONG size;
 553     RPC_MESSAGE rpc_msg;
 554     MIDL_STUB_MESSAGE stub_msg;
 555     USER_MARSHAL_CB umcb;
 556     unsigned char *buffer, *next;
 557     BSTR b, b2;
 558     WCHAR str[] = {'m','a','r','s','h','a','l',' ','t','e','s','t','1',0};
 559     DWORD len;
 560
 561     b = SysAllocString(str);
 562     len = SysStringLen(b);
 563     ok(len == 13, "get %d\n", len);
 564
 565     /* BSTRs are DWORD aligned */
 566
 567     init_user_marshal_cb(&umcb, &stub_msg, &rpc_msg, NULL, 0, MSHCTX_DIFFERENTMACHINE);
 568     size = BSTR_UserSize(&umcb.Flags, 1, &b);
 569     ok(size == 42, "size %d\n", size);
 570
 571     init_user_marshal_cb(&umcb, &stub_msg, &rpc_msg, NULL, 0, MSHCTX_DIFFERENTMACHINE);
 572     size = BSTR_UserSize(&umcb.Flags, 0, &b);
 573     ok(size == 38, "size %d\n", size);
 574
 575     buffer = HeapAlloc(GetProcessHeap(), 0, size);
 576     init_user_marshal_cb(&umcb, &stub_msg, &rpc_msg, buffer, size, MSHCTX_DIFFERENTMACHINE);
 577     next = BSTR_UserMarshal(&umcb.Flags, buffer, &b);
 578     ok(next == buffer + size, "got %p expect %p\n", next, buffer + size);
 579     check_bstr(buffer, b);
 580
 581     b2 = NULL;
 582     init_user_marshal_cb(&umcb, &stub_msg, &rpc_msg, buffer, size, MSHCTX_DIFFERENTMACHINE);
 583     next = BSTR_UserUnmarshal(&umcb.Flags, buffer, &b2);
 584     ok(next == buffer + size, "got %p expect %p\n", next, buffer + size);
 585     ok(b2 != NULL, "BSTR didn't unmarshal\n");
 586     ok(!memcmp(b, b2, (len + 1) * 2), "strings differ\n");
 587     init_user_marshal_cb(&umcb, &stub_msg, &rpc_msg, NULL, 0, MSHCTX_DIFFERENTMACHINE);
 588     BSTR_UserFree(&umcb.Flags, &b2);
 589
 590     HeapFree(GetProcessHeap(), 0, buffer);
 591     SysFreeString(b);
 592
 593     b = NULL;
 594     init_user_marshal_cb(&umcb, &stub_msg, &rpc_msg, NULL, 0, MSHCTX_DIFFERENTMACHINE);
 595     size = BSTR_UserSize(&umcb.Flags, 0, &b);
 596     ok(size == 12, "size %d\n", size);
 597
 598     buffer = HeapAlloc(GetProcessHeap(), 0, size);
 599     init_user_marshal_cb(&umcb, &stub_msg, &rpc_msg, buffer, size, MSHCTX_DIFFERENTMACHINE);
 600     next = BSTR_UserMarshal(&umcb.Flags, buffer, &b);
 601     ok(next == buffer + size, "got %p expect %p\n", next, buffer + size);
 602
 603     check_bstr(buffer, b);
 604     b2 = NULL;
 605     init_user_marshal_cb(&umcb, &stub_msg, &rpc_msg, buffer, size, MSHCTX_DIFFERENTMACHINE);
 606     next = BSTR_UserUnmarshal(&umcb.Flags, buffer, &b2);
 607     ok(next == buffer + size, "got %p expect %p\n", next, buffer + size);
 608     ok(b2 == NULL, "NULL BSTR didn't unmarshal\n");
 609     init_user_marshal_cb(&umcb, &stub_msg, &rpc_msg, NULL, 0, MSHCTX_DIFFERENTMACHINE);
 610     BSTR_UserFree(&umcb.Flags, &b2);
 611     HeapFree(GetProcessHeap(), 0, buffer);
 612
 613     b = SysAllocStringByteLen("abc", 3);
 614     *(((char*)b) + 3) = 'd';
 615     len = SysStringLen(b);
 616     ok(len == 1, "get %d\n", len);
 617     len = SysStringByteLen(b);
 618     ok(len == 3, "get %d\n", len);
 619
 620     init_user_marshal_cb(&umcb, &stub_msg, &rpc_msg, NULL, 0, MSHCTX_DIFFERENTMACHINE);
 621     size = BSTR_UserSize(&umcb.Flags, 0, &b);
 622     ok(size == 16, "size %d\n", size);
 623
 624     buffer = HeapAlloc(GetProcessHeap(), 0, size);
 625     memset(buffer, 0xcc, size);
 626     init_user_marshal_cb(&umcb, &stub_msg, &rpc_msg, buffer, size, MSHCTX_DIFFERENTMACHINE);
 627     next = BSTR_UserMarshal(&umcb.Flags, buffer, &b);
 628     ok(next == buffer + size, "got %p expect %p\n", next, buffer + size);
 629     check_bstr(buffer, b);
 630     ok(buffer[15] == 'd', "buffer[15] %02x\n", buffer[15]);
 631
 632     b2 = NULL;
 633     init_user_marshal_cb(&umcb, &stub_msg, &rpc_msg, buffer, size, MSHCTX_DIFFERENTMACHINE);
 634     next = BSTR_UserUnmarshal(&umcb.Flags, buffer, &b2);
 635     ok(next == buffer + size, "got %p expect %p\n", next, buffer + size);
 636     ok(b2 != NULL, "BSTR didn't unmarshal\n");
 637     ok(!memcmp(b, b2, len), "strings differ\n");
 638     init_user_marshal_cb(&umcb, &stub_msg, &rpc_msg, NULL, 0, MSHCTX_DIFFERENTMACHINE);
 639     BSTR_UserFree(&umcb.Flags, &b2);
 640     HeapFree(GetProcessHeap(), 0, buffer);
 641     SysFreeString(b);
 642
 643     b = SysAllocStringByteLen("", 0);
 644     len = SysStringLen(b);
 645     ok(len == 0, "get %d\n", len);
 646     len = SysStringByteLen(b);
 647     ok(len == 0, "get %d\n", len);
 648
 649     init_user_marshal_cb(&umcb, &stub_msg, &rpc_msg, NULL, 0, MSHCTX_DIFFERENTMACHINE);
 650     size = BSTR_UserSize(&umcb.Flags, 0, &b);
 651     ok(size == 12, "size %d\n", size);
 652
 653     buffer = HeapAlloc(GetProcessHeap(), 0, size);
 654     init_user_marshal_cb(&umcb, &stub_msg, &rpc_msg, buffer, size, MSHCTX_DIFFERENTMACHINE);
 655     next = BSTR_UserMarshal(&umcb.Flags, buffer, &b);
 656     ok(next == buffer + size, "got %p expect %p\n", next, buffer + size);
 657     check_bstr(buffer, b);
 658
 659     b2 = NULL;
 660     init_user_marshal_cb(&umcb, &stub_msg, &rpc_msg, buffer, size, MSHCTX_DIFFERENTMACHINE);
 661     next = BSTR_UserUnmarshal(&umcb.Flags, buffer, &b2);
 662     ok(next == buffer + size, "got %p expect %p\n", next, buffer + size);
 663     ok(b2 != NULL, "NULL LPSAFEARRAY didn't unmarshal\n");
 664     len = SysStringByteLen(b2);
 665     ok(len == 0, "byte len %d\n", len);
 666     init_user_marshal_cb(&umcb, &stub_msg, &rpc_msg, NULL, 0, MSHCTX_DIFFERENTMACHINE);
 667     BSTR_UserFree(&umcb.Flags, &b2);
 668     HeapFree(GetProcessHeap(), 0, buffer);
 669     SysFreeString(b);
 670 }
 671
 672 typedef struct
 673 {
 674     IUnknown IUnknown_iface;
 675     ULONG refs;
 676 } HeapUnknown;
 677
 678 static inline HeapUnknown *impl_from_IUnknown(IUnknown *iface)
 679 {
 680     return CONTAINING_RECORD(iface, HeapUnknown, IUnknown_iface);
 681 }
 682
 683 static HRESULT WINAPI HeapUnknown_QueryInterface(IUnknown *iface, REFIID riid, void **ppv)
 684 {
 685     if (IsEqualIID(riid, &IID_IUnknown))
 686     {
 687         IUnknown_AddRef(iface);
 688         *ppv = iface;
 689         return S_OK;
 690     }
 691     *ppv = NULL;
 692     return E_NOINTERFACE;
 693 }
 694
 695 static ULONG WINAPI HeapUnknown_AddRef(IUnknown *iface)
 696 {
 697     HeapUnknown *This = impl_from_IUnknown(iface);
 698     return InterlockedIncrement((LONG*)&This->refs);
 699 }
 700
 701 static ULONG WINAPI HeapUnknown_Release(IUnknown *iface)
 702 {
 703     HeapUnknown *This = impl_from_IUnknown(iface);
 704     ULONG refs = InterlockedDecrement((LONG*)&This->refs);
 705     if (!refs) HeapFree(GetProcessHeap(), 0, This);
 706     return refs;
 707 }
 708
 709 static const IUnknownVtbl HeapUnknown_Vtbl =
 710 {
 711     HeapUnknown_QueryInterface,
 712     HeapUnknown_AddRef,
 713     HeapUnknown_Release
 714 };
 715
 716 typedef struct
 717 {
 718     DWORD clSize;
 719     DWORD rpcReserved;
 720     USHORT vt;
 721     USHORT wReserved1;
 722     USHORT wReserved2;
 723     USHORT wReserved3;
 724     DWORD switch_is;
 725 } variant_wire_t;
 726
 727 static DWORD *check_variant_header(DWORD *wirev, VARIANT *v, ULONG size)
 728 {
 729     const variant_wire_t *header = (const variant_wire_t*)wirev;
 730     DWORD switch_is;
 731
 732     ok(header->clSize == (size + 7) >> 3, "wv[0] %08x, expected %08x\n", header->clSize, (size + 7) >> 3);
 733     ok(header->rpcReserved == 0, "wv[1] %08x\n", header->rpcReserved);
 734     ok(header->vt == V_VT(v), "vt %04x expected %04x\n", header->vt, V_VT(v));
 735     ok(header->wReserved1 == V_U2(v).wReserved1, "res1 %04x expected %04x\n", header->wReserved1, V_U2(v).wReserved1);
 736     ok(header->wReserved2 == V_U2(v).wReserved2, "res2 %04x expected %04x\n", header->wReserved2, V_U2(v).wReserved2);
 737     ok(header->wReserved3 == V_U2(v).wReserved3, "res3 %04x expected %04x\n", header->wReserved3, V_U2(v).wReserved3);
 738
 739     switch_is = V_VT(v);
 740     if(switch_is & VT_ARRAY)
 741         switch_is &= ~VT_TYPEMASK;
 742     ok(header->switch_is == switch_is, "switch_is %08x expected %08x\n", header->switch_is, switch_is);
 743
 744     return (DWORD*)((unsigned char*)wirev + sizeof(variant_wire_t));
 745 }
 746
 747 /* Win9x and WinME don't always align as needed. Variants have
 748  * an alignment of 8.
 749  */
 750 static void *alloc_aligned(SIZE_T size, void **buf)
 751 {
 752     *buf = HeapAlloc(GetProcessHeap(), 0, size + 7);
 753     return (void *)(((UINT_PTR)*buf + 7) & ~7);
 754 }
 755
 756 static void test_marshal_VARIANT(void)
 757 {
 758     VARIANT v, v2, v3;
 759     MIDL_STUB_MESSAGE stubMsg = { 0 };
 760     RPC_MESSAGE rpcMsg = { 0 };
 761     USER_MARSHAL_CB umcb = { 0 };
 762     unsigned char *buffer, *next;
 763     void *oldbuffer;
 764     ULONG ul;
 765     short s;
 766     double d;
 767     void *mem;
 768     DWORD *wirev;
 769     BSTR b;
 770     WCHAR str[] = {'m','a','r','s','h','a','l',' ','t','e','s','t',0};
 771     SAFEARRAYBOUND sab;
 772     LPSAFEARRAY lpsa;
 773     DECIMAL dec, dec2;
 774     HeapUnknown *heap_unknown;
 775     DWORD expected;
 776     HRESULT hr;
 777     LONG bound, bound2;
 778     VARTYPE vt, vt2;
 779
 780     stubMsg.RpcMsg = &rpcMsg;
 781
 782     umcb.Flags = MAKELONG(MSHCTX_DIFFERENTMACHINE, NDR_LOCAL_DATA_REPRESENTATION);
 783     umcb.pStubMsg = &stubMsg;
 784     umcb.pReserve = NULL;
 785     umcb.Signature = USER_MARSHAL_CB_SIGNATURE;
 786     umcb.CBType = USER_MARSHAL_CB_UNMARSHALL;
 787
 788     /*** I1 ***/
 789     VariantInit(&v);
 790     V_VT(&v) = VT_I1;
 791     V_I1(&v) = 0x12;
 792
 793     /* check_variant_header tests wReserved[123], so initialize to unique values.
 794      * (Could probably also do this by setting the variant to a known DECIMAL.)
 795      */
 796     V_U2(&v).wReserved1 = 0x1234;
 797     V_U2(&v).wReserved2 = 0x5678;
 798     V_U2(&v).wReserved3 = 0x9abc;
 799
 800     /* Variants have an alignment of 8 */
 801     rpcMsg.BufferLength = stubMsg.BufferLength = VARIANT_UserSize(&umcb.Flags, 1, &v);
 802     ok(stubMsg.BufferLength == 29, "size %d\n", stubMsg.BufferLength);
 803
 804     rpcMsg.BufferLength = stubMsg.BufferLength = VARIANT_UserSize(&umcb.Flags, 0, &v);
 805     ok(stubMsg.BufferLength == 21, "size %d\n", stubMsg.BufferLength);
 806
 807     buffer = rpcMsg.Buffer = stubMsg.Buffer = stubMsg.BufferStart = alloc_aligned(stubMsg.BufferLength, &oldbuffer);
 808     stubMsg.BufferEnd = stubMsg.Buffer + stubMsg.BufferLength;
 809     next = VARIANT_UserMarshal(&umcb.Flags, buffer, &v);
 810     ok(next == buffer + stubMsg.BufferLength, "got %p expect %p\n", next, buffer + stubMsg.BufferLength);
 811     wirev = (DWORD*)buffer;
 812
 813     wirev = check_variant_header(wirev, &v, stubMsg.BufferLength);
 814     ok(*(char*)wirev == V_I1(&v), "wv[5] %08x\n", *wirev);
 815     VariantInit(&v2);
 816     stubMsg.Buffer = buffer;
 817     next = VARIANT_UserUnmarshal(&umcb.Flags, buffer, &v2);
 818     ok(next == buffer + stubMsg.BufferLength, "got %p expect %p\n", next, buffer + stubMsg.BufferLength);
 819     ok(V_VT(&v) == V_VT(&v2), "got vt %d expect %d\n", V_VT(&v), V_VT(&v2));
 820     ok(V_I1(&v) == V_I1(&v2), "got i1 %x expect %x\n", V_I1(&v), V_I1(&v2));
 821
 822     VARIANT_UserFree(&umcb.Flags, &v2);
 823     HeapFree(GetProcessHeap(), 0, oldbuffer);
 824
 825     /*** I2 ***/
 826     VariantInit(&v);
 827     V_VT(&v) = VT_I2;
 828     V_I2(&v) = 0x1234;
 829
 830     rpcMsg.BufferLength = stubMsg.BufferLength = VARIANT_UserSize(&umcb.Flags, 0, &v);
 831     ok(stubMsg.BufferLength == 22, "size %d\n", stubMsg.BufferLength);
 832
 833     buffer = rpcMsg.Buffer = stubMsg.Buffer = stubMsg.BufferStart = alloc_aligned(stubMsg.BufferLength, &oldbuffer);
 834     stubMsg.BufferEnd = stubMsg.Buffer + stubMsg.BufferLength;
 835     next = VARIANT_UserMarshal(&umcb.Flags, buffer, &v);
 836     ok(next == buffer + stubMsg.BufferLength, "got %p expect %p\n", next, buffer + stubMsg.BufferLength);
 837     wirev = (DWORD*)buffer;
 838
 839     wirev = check_variant_header(wirev, &v, stubMsg.BufferLength);
 840     ok(*(short*)wirev == V_I2(&v), "wv[5] %08x\n", *wirev);
 841     VariantInit(&v2);
 842     stubMsg.Buffer = buffer;
 843     next = VARIANT_UserUnmarshal(&umcb.Flags, buffer, &v2);
 844     ok(next == buffer + stubMsg.BufferLength, "got %p expect %p\n", next, buffer + stubMsg.BufferLength);
 845     ok(V_VT(&v) == V_VT(&v2), "got vt %d expect %d\n", V_VT(&v), V_VT(&v2));
 846     ok(V_I2(&v) == V_I2(&v2), "got i2 %x expect %x\n", V_I2(&v), V_I2(&v2));
 847
 848     VARIANT_UserFree(&umcb.Flags, &v2);
 849     HeapFree(GetProcessHeap(), 0, oldbuffer);
 850
 851     /*** I2 BYREF ***/
 852     VariantInit(&v);
 853     V_VT(&v) = VT_I2 | VT_BYREF;
 854     s = 0x1234;
 855     V_I2REF(&v) = &s;
 856
 857     rpcMsg.BufferLength = stubMsg.BufferLength = VARIANT_UserSize(&umcb.Flags, 0, &v);
 858     ok(stubMsg.BufferLength == 26, "size %d\n", stubMsg.BufferLength);
 859
 860     buffer = rpcMsg.Buffer = stubMsg.Buffer = stubMsg.BufferStart = alloc_aligned(stubMsg.BufferLength, &oldbuffer);
 861     stubMsg.BufferEnd = stubMsg.Buffer + stubMsg.BufferLength;
 862     next = VARIANT_UserMarshal(&umcb.Flags, buffer, &v);
 863     ok(next == buffer + stubMsg.BufferLength, "got %p expect %p\n", next, buffer + stubMsg.BufferLength);
 864     wirev = (DWORD*)buffer;
 865
 866     wirev = check_variant_header(wirev, &v, stubMsg.BufferLength);
 867     ok(*wirev == 0x4, "wv[5] %08x\n", *wirev);
 868     wirev++;
 869     ok(*(short*)wirev == s, "wv[6] %08x\n", *wirev);
 870     VariantInit(&v2);
 871     V_VT(&v2) = VT_I2 | VT_BYREF;
 872     V_BYREF(&v2) = mem = CoTaskMemAlloc(sizeof(V_I2(&v2)));
 873     stubMsg.Buffer = buffer;
 874     next = VARIANT_UserUnmarshal(&umcb.Flags, buffer, &v2);
 875     ok(next == buffer + stubMsg.BufferLength, "got %p expect %p\n", next, buffer + stubMsg.BufferLength);
 876     ok(V_VT(&v) == V_VT(&v2), "got vt %d expect %d\n", V_VT(&v), V_VT(&v2));
 877     ok(V_BYREF(&v2) == mem, "didn't reuse existing memory\n");
 878     ok(*V_I2REF(&v) == *V_I2REF(&v2), "got i2 ref %x expect ui4 ref %x\n", *V_I2REF(&v), *V_I2REF(&v2));
 879
 880     VARIANT_UserFree(&umcb.Flags, &v2);
 881     HeapFree(GetProcessHeap(), 0, oldbuffer);
 882
 883     /*** I4 ***/
 884     VariantInit(&v);
 885     V_VT(&v) = VT_I4;
 886     V_I4(&v) = 0x1234;
 887
 888     rpcMsg.BufferLength = stubMsg.BufferLength = VARIANT_UserSize(&umcb.Flags, 0, &v);
 889     ok(stubMsg.BufferLength == 24, "size %d\n", stubMsg.BufferLength);
 890
 891     buffer = rpcMsg.Buffer = stubMsg.Buffer = stubMsg.BufferStart = alloc_aligned(stubMsg.BufferLength, &oldbuffer);
 892     stubMsg.BufferEnd = stubMsg.Buffer + stubMsg.BufferLength;
 893     next = VARIANT_UserMarshal(&umcb.Flags, buffer, &v);
 894     ok(next == buffer + stubMsg.BufferLength, "got %p expect %p\n", next, buffer + stubMsg.BufferLength);
 895     wirev = (DWORD*)buffer;
 896
 897     wirev = check_variant_header(wirev, &v, stubMsg.BufferLength);
 898     ok(*wirev == V_I4(&v), "wv[5] %08x\n", *wirev);
 899
 900     VariantInit(&v2);
 901     stubMsg.Buffer = buffer;
 902     next = VARIANT_UserUnmarshal(&umcb.Flags, buffer, &v2);
 903     ok(next == buffer + stubMsg.BufferLength, "got %p expect %p\n", next, buffer + stubMsg.BufferLength);
 904     ok(V_VT(&v) == V_VT(&v2), "got vt %d expect %d\n", V_VT(&v), V_VT(&v2));
 905     ok(V_I4(&v) == V_I4(&v2), "got i4 %x expect %x\n", V_I4(&v), V_I4(&v2));
 906
 907     VARIANT_UserFree(&umcb.Flags, &v2);
 908     HeapFree(GetProcessHeap(), 0, oldbuffer);
 909
 910     /*** UI4 ***/
 911     VariantInit(&v);
 912     V_VT(&v) = VT_UI4;
 913     V_UI4(&v) = 0x1234;
 914
 915     rpcMsg.BufferLength = stubMsg.BufferLength = VARIANT_UserSize(&umcb.Flags, 0, &v);
 916     ok(stubMsg.BufferLength == 24, "size %d\n", stubMsg.BufferLength);
 917
 918     buffer = rpcMsg.Buffer = stubMsg.Buffer = stubMsg.BufferStart = alloc_aligned(stubMsg.BufferLength, &oldbuffer);
 919     stubMsg.BufferEnd = stubMsg.Buffer + stubMsg.BufferLength;
 920     next = VARIANT_UserMarshal(&umcb.Flags, buffer, &v);
 921     ok(next == buffer + stubMsg.BufferLength, "got %p expect %p\n", next, buffer + stubMsg.BufferLength);
 922     wirev = (DWORD*)buffer;
 923
 924     wirev = check_variant_header(wirev, &v, stubMsg.BufferLength);
 925     ok(*wirev == 0x1234, "wv[5] %08x\n", *wirev);
 926     VariantInit(&v2);
 927     stubMsg.Buffer = buffer;
 928     next = VARIANT_UserUnmarshal(&umcb.Flags, buffer, &v2);
 929     ok(next == buffer + stubMsg.BufferLength, "got %p expect %p\n", next, buffer + stubMsg.BufferLength);
 930     ok(V_VT(&v) == V_VT(&v2), "got vt %d expect %d\n", V_VT(&v), V_VT(&v2));
 931     ok(V_UI4(&v) == V_UI4(&v2), "got ui4 %x expect %x\n", V_UI4(&v), V_UI4(&v2));
 932
 933     VARIANT_UserFree(&umcb.Flags, &v2);
 934     HeapFree(GetProcessHeap(), 0, oldbuffer);
 935
 936     /*** UI4 BYREF ***/
 937     VariantInit(&v);
 938     V_VT(&v) = VT_UI4 | VT_BYREF;
 939     ul = 0x1234;
 940     V_UI4REF(&v) = &ul;
 941
 942     rpcMsg.BufferLength = stubMsg.BufferLength = VARIANT_UserSize(&umcb.Flags, 0, &v);
 943     ok(stubMsg.BufferLength == 28, "size %d\n", stubMsg.BufferLength);
 944
 945     buffer = rpcMsg.Buffer = stubMsg.Buffer = stubMsg.BufferStart = alloc_aligned(stubMsg.BufferLength, &oldbuffer);
 946     stubMsg.BufferEnd = stubMsg.Buffer + stubMsg.BufferLength;
 947     next = VARIANT_UserMarshal(&umcb.Flags, buffer, &v);
 948     ok(next == buffer + stubMsg.BufferLength, "got %p expect %p\n", next, buffer + stubMsg.BufferLength);
 949     wirev = (DWORD*)buffer;
 950
 951     wirev = check_variant_header(wirev, &v, stubMsg.BufferLength);
 952     ok(*wirev == 0x4, "wv[5] %08x\n", *wirev);
 953     wirev++;
 954     ok(*wirev == ul, "wv[6] %08x\n", *wirev);
 955
 956     VariantInit(&v2);
 957     stubMsg.Buffer = buffer;
 958     next = VARIANT_UserUnmarshal(&umcb.Flags, buffer, &v2);
 959     ok(next == buffer + stubMsg.BufferLength, "got %p expect %p\n", next, buffer + stubMsg.BufferLength);
 960     ok(V_VT(&v) == V_VT(&v2), "got vt %d expect %d\n", V_VT(&v), V_VT(&v2));
 961     ok(*V_UI4REF(&v) == *V_UI4REF(&v2), "got ui4 ref %x expect ui4 ref %x\n", *V_UI4REF(&v), *V_UI4REF(&v2));
 962
 963     VARIANT_UserFree(&umcb.Flags, &v2);
 964     HeapFree(GetProcessHeap(), 0, oldbuffer);
 965
 966     /*** R4 ***/
 967     VariantInit(&v);
 968     V_VT(&v) = VT_R4;
 969     V_R8(&v) = 3.1415;
 970
 971     rpcMsg.BufferLength = stubMsg.BufferLength = VARIANT_UserSize(&umcb.Flags, 0, &v);
 972     ok(stubMsg.BufferLength == 24, "size %d\n", stubMsg.BufferLength);
 973
 974     buffer = rpcMsg.Buffer = stubMsg.Buffer = stubMsg.BufferStart = alloc_aligned(stubMsg.BufferLength, &oldbuffer);
 975     stubMsg.BufferEnd = stubMsg.Buffer + stubMsg.BufferLength;
 976     next = VARIANT_UserMarshal(&umcb.Flags, buffer, &v);
 977     ok(next == buffer + stubMsg.BufferLength, "got %p expect %p\n", next, buffer + stubMsg.BufferLength);
 978     wirev = (DWORD*)buffer;
 979
 980     wirev = check_variant_header(wirev, &v, stubMsg.BufferLength);
 981     ok(*(float*)wirev == V_R4(&v), "wv[5] %08x\n", *wirev);
 982     VariantInit(&v2);
 983     stubMsg.Buffer = buffer;
 984     next = VARIANT_UserUnmarshal(&umcb.Flags, buffer, &v2);
 985     ok(next == buffer + stubMsg.BufferLength, "got %p expect %p\n", next, buffer + stubMsg.BufferLength);
 986     ok(V_VT(&v) == V_VT(&v2), "got vt %d expect %d\n", V_VT(&v), V_VT(&v2));
 987     ok(V_R4(&v) == V_R4(&v2), "got r4 %f expect %f\n", V_R4(&v), V_R4(&v2));
 988
 989     VARIANT_UserFree(&umcb.Flags, &v2);
 990     HeapFree(GetProcessHeap(), 0, oldbuffer);
 991
 992     /*** R8 ***/
 993     VariantInit(&v);
 994     V_VT(&v) = VT_R8;
 995     V_R8(&v) = 3.1415;
 996
 997     rpcMsg.BufferLength = stubMsg.BufferLength = VARIANT_UserSize(&umcb.Flags, 0, &v);
 998     ok(stubMsg.BufferLength == 32, "size %d\n", stubMsg.BufferLength);
 999
1000     buffer = rpcMsg.Buffer = stubMsg.Buffer = stubMsg.BufferStart = alloc_aligned(stubMsg.BufferLength, &oldbuffer);
1001     stubMsg.BufferEnd = stubMsg.Buffer + stubMsg.BufferLength;
1002     memset(buffer, 0xcc, stubMsg.BufferLength);
1003     next = VARIANT_UserMarshal(&umcb.Flags, buffer, &v);
1004     ok(next == buffer + stubMsg.BufferLength, "got %p expect %p\n", next, buffer + stubMsg.BufferLength);
1005     wirev = (DWORD*)buffer;
1006
1007     wirev = check_variant_header(wirev, &v, stubMsg.BufferLength);
1008     ok(*wirev == 0xcccccccc, "wv[5] %08x\n", *wirev); /* pad */
1009     wirev++;
1010     ok(*(double*)wirev == V_R8(&v), "wv[6] %08x, wv[7] %08x\n", *wirev, *(wirev+1));
1011     VariantInit(&v2);
1012     stubMsg.Buffer = buffer;
1013     next = VARIANT_UserUnmarshal(&umcb.Flags, buffer, &v2);
1014     ok(next == buffer + stubMsg.BufferLength, "got %p expect %p\n", next, buffer + stubMsg.BufferLength);
1015     ok(V_VT(&v) == V_VT(&v2), "got vt %d expect %d\n", V_VT(&v), V_VT(&v2));
1016     ok(V_R8(&v) == V_R8(&v2), "got r8 %f expect %f\n", V_R8(&v), V_R8(&v2));
1017
1018     VARIANT_UserFree(&umcb.Flags, &v2);
1019     HeapFree(GetProcessHeap(), 0, oldbuffer);
1020
1021     /*** R8 BYREF ***/
1022     VariantInit(&v);
1023     V_VT(&v) = VT_R8 | VT_BYREF;
1024     d = 3.1415;
1025     V_R8REF(&v) = &d;
1026
1027     rpcMsg.BufferLength = stubMsg.BufferLength = VARIANT_UserSize(&umcb.Flags, 0, &v);
1028     ok(stubMsg.BufferLength == 32, "size %d\n", stubMsg.BufferLength);
1029
1030     buffer = rpcMsg.Buffer = stubMsg.Buffer = stubMsg.BufferStart = alloc_aligned(stubMsg.BufferLength, &oldbuffer);
1031     stubMsg.BufferEnd = stubMsg.Buffer + stubMsg.BufferLength;
1032     next = VARIANT_UserMarshal(&umcb.Flags, buffer, &v);
1033     ok(next == buffer + stubMsg.BufferLength, "got %p expect %p\n", next, buffer + stubMsg.BufferLength);
1034     wirev = (DWORD*)buffer;
1035
1036     wirev = check_variant_header(wirev, &v, stubMsg.BufferLength);
1037     ok(*wirev == 8, "wv[5] %08x\n", *wirev);
1038     wirev++;
1039     ok(*(double*)wirev == d, "wv[6] %08x wv[7] %08x\n", *wirev, *(wirev+1));
1040     VariantInit(&v2);
1041     stubMsg.Buffer = buffer;
1042     next = VARIANT_UserUnmarshal(&umcb.Flags, buffer, &v2);
1043     ok(next == buffer + stubMsg.BufferLength, "got %p expect %p\n", next, buffer + stubMsg.BufferLength);
1044     ok(V_VT(&v) == V_VT(&v2), "got vt %d expect %d\n", V_VT(&v), V_VT(&v2));
1045     ok(*V_R8REF(&v) == *V_R8REF(&v2), "got r8 ref %f expect %f\n", *V_R8REF(&v), *V_R8REF(&v2));
1046
1047     VARIANT_UserFree(&umcb.Flags, &v2);
1048     HeapFree(GetProcessHeap(), 0, oldbuffer);
1049
1050     /*** VARIANT_BOOL ***/
1051     VariantInit(&v);
1052     V_VT(&v) = VT_BOOL;
1053     V_BOOL(&v) = 0x1234;
1054
1055     rpcMsg.BufferLength = stubMsg.BufferLength = VARIANT_UserSize(&umcb.Flags, 0, &v);
1056     ok(stubMsg.BufferLength == 22, "size %d\n", stubMsg.BufferLength);
1057
1058     buffer = rpcMsg.Buffer = stubMsg.Buffer = stubMsg.BufferStart = alloc_aligned(stubMsg.BufferLength, &oldbuffer);
1059     stubMsg.BufferEnd = stubMsg.Buffer + stubMsg.BufferLength;
1060     next = VARIANT_UserMarshal(&umcb.Flags, buffer, &v);
1061     ok(next == buffer + stubMsg.BufferLength, "got %p expect %p\n", next, buffer + stubMsg.BufferLength);
1062     wirev = (DWORD*)buffer;
1063
1064     wirev = check_variant_header(wirev, &v, stubMsg.BufferLength);
1065     ok(*(short*)wirev == V_BOOL(&v), "wv[5] %04x\n", *(WORD*)wirev);
1066     VariantInit(&v2);
1067     stubMsg.Buffer = buffer;
1068     next = VARIANT_UserUnmarshal(&umcb.Flags, buffer, &v2);
1069     ok(next == buffer + stubMsg.BufferLength, "got %p expect %p\n", next, buffer + stubMsg.BufferLength);
1070     ok(V_VT(&v) == V_VT(&v2), "got vt %d expect %d\n", V_VT(&v), V_VT(&v2));
1071     ok(V_BOOL(&v) == V_BOOL(&v2), "got bool %x expect %x\n", V_BOOL(&v), V_BOOL(&v2));
1072
1073     VARIANT_UserFree(&umcb.Flags, &v2);
1074     HeapFree(GetProcessHeap(), 0, oldbuffer);
1075
1076     /*** DECIMAL ***/
1077     VarDecFromI4(0x12345678, &dec);
1078     dec.wReserved = 0xfedc;          /* Also initialize reserved field, as we check it later */
1079     VariantInit(&v);
1080     V_DECIMAL(&v) = dec;
1081     V_VT(&v) = VT_DECIMAL;
1082
1083     rpcMsg.BufferLength = stubMsg.BufferLength = VARIANT_UserSize(&umcb.Flags, 0, &v);
1084     ok(stubMsg.BufferLength == 40, "size %d\n", stubMsg.BufferLength);
1085
1086     buffer = rpcMsg.Buffer = stubMsg.Buffer = stubMsg.BufferStart = alloc_aligned(stubMsg.BufferLength, &oldbuffer);
1087     stubMsg.BufferEnd = stubMsg.Buffer + stubMsg.BufferLength;
1088     memset(buffer, 0xcc, stubMsg.BufferLength);
1089     next = VARIANT_UserMarshal(&umcb.Flags, buffer, &v);
1090     ok(next == buffer + stubMsg.BufferLength, "got %p expect %p\n", next, buffer + stubMsg.BufferLength);
1091     wirev = (DWORD*)buffer;
1092
1093     wirev = check_variant_header(wirev, &v, stubMsg.BufferLength);
1094     ok(*wirev == 0xcccccccc, "wirev[5] %08x\n", *wirev); /* pad */
1095     wirev++;
1096     dec2 = dec;
1097     dec2.wReserved = VT_DECIMAL;
1098     ok(!memcmp(wirev, &dec2, sizeof(dec2)), "wirev[6] %08x wirev[7] %08x wirev[8] %08x wirev[9] %08x\n",
1099        *wirev, *(wirev + 1), *(wirev + 2), *(wirev + 3));
1100     VariantInit(&v2);
1101     stubMsg.Buffer = buffer;
1102     next = VARIANT_UserUnmarshal(&umcb.Flags, buffer, &v2);
1103     ok(next == buffer + stubMsg.BufferLength, "got %p expect %p\n", next, buffer + stubMsg.BufferLength);
1104     ok(V_VT(&v) == V_VT(&v2), "got vt %d expect %d\n", V_VT(&v), V_VT(&v2));
1105     ok(!memcmp(&V_DECIMAL(&v), & V_DECIMAL(&v2), sizeof(DECIMAL)), "decimals differ\n");
1106
1107     VARIANT_UserFree(&umcb.Flags, &v2);
1108     HeapFree(GetProcessHeap(), 0, oldbuffer);
1109
1110     /*** DECIMAL BYREF ***/
1111     VariantInit(&v);
1112     V_VT(&v) = VT_DECIMAL | VT_BYREF;
1113     V_DECIMALREF(&v) = &dec;
1114
1115     rpcMsg.BufferLength = stubMsg.BufferLength = VARIANT_UserSize(&umcb.Flags, 0, &v);
1116     ok(stubMsg.BufferLength == 40, "size %d\n", stubMsg.BufferLength);
1117
1118     buffer = rpcMsg.Buffer = stubMsg.Buffer = stubMsg.BufferStart = alloc_aligned(stubMsg.BufferLength, &oldbuffer);
1119     stubMsg.BufferEnd = stubMsg.Buffer + stubMsg.BufferLength;
1120     next = VARIANT_UserMarshal(&umcb.Flags, buffer, &v);
1121     ok(next == buffer + stubMsg.BufferLength, "got %p expect %p\n", next, buffer + stubMsg.BufferLength);
1122     wirev = (DWORD*)buffer;
1123
1124     wirev = check_variant_header(wirev, &v, stubMsg.BufferLength);
1125     ok(*wirev == 16, "wv[5] %08x\n", *wirev);
1126     wirev++;
1127     ok(!memcmp(wirev, &dec, sizeof(dec)), "wirev[6] %08x wirev[7] %08x wirev[8] %08x wirev[9] %08x\n", *wirev, *(wirev + 1), *(wirev + 2), *(wirev + 3));
1128     VariantInit(&v2);
1129     /* check_variant_header tests wReserved[123], so initialize to unique values.
1130      * (Could probably also do this by setting the variant to a known DECIMAL.)
1131      */
1132     V_U2(&v2).wReserved1 = 0x0123;
1133     V_U2(&v2).wReserved2 = 0x4567;
1134     V_U2(&v2).wReserved3 = 0x89ab;
1135
1136     stubMsg.Buffer = buffer;
1137     next = VARIANT_UserUnmarshal(&umcb.Flags, buffer, &v2);
1138     ok(next == buffer + stubMsg.BufferLength, "got %p expect %p\n", next, buffer + stubMsg.BufferLength);
1139     ok(V_VT(&v) == V_VT(&v2), "got vt %d expect %d\n", V_VT(&v), V_VT(&v2));
1140     ok(!memcmp(V_DECIMALREF(&v), V_DECIMALREF(&v2), sizeof(DECIMAL)), "decimals differ\n");
1141
1142     VARIANT_UserFree(&umcb.Flags, &v2);
1143     HeapFree(GetProcessHeap(), 0, oldbuffer);
1144
1145     /*** EMPTY ***/
1146     VariantInit(&v);
1147     V_VT(&v) = VT_EMPTY;
1148
1149     rpcMsg.BufferLength = stubMsg.BufferLength = VARIANT_UserSize(&umcb.Flags, 0, &v);
1150     ok(stubMsg.BufferLength == 20, "size %d\n", stubMsg.BufferLength);
1151
1152     buffer = rpcMsg.Buffer = stubMsg.Buffer = stubMsg.BufferStart = alloc_aligned(stubMsg.BufferLength, &oldbuffer);
1153     stubMsg.BufferEnd = stubMsg.Buffer + stubMsg.BufferLength;
1154     next = VARIANT_UserMarshal(&umcb.Flags, buffer, &v);
1155     ok(next == buffer + stubMsg.BufferLength, "got %p expect %p\n", next, buffer + stubMsg.BufferLength);
1156     wirev = (DWORD*)buffer;
1157
1158     check_variant_header(wirev, &v, stubMsg.BufferLength);
1159     VariantInit(&v2);
1160     stubMsg.Buffer = buffer;
1161     next = VARIANT_UserUnmarshal(&umcb.Flags, buffer, &v2);
1162     ok(next == buffer + stubMsg.BufferLength, "got %p expect %p\n", next, buffer + stubMsg.BufferLength);
1163     ok(V_VT(&v) == V_VT(&v2), "got vt %d expect %d\n", V_VT(&v), V_VT(&v2));
1164
1165     VARIANT_UserFree(&umcb.Flags, &v2);
1166     HeapFree(GetProcessHeap(), 0, oldbuffer);
1167
1168     /*** NULL ***/
1169     VariantInit(&v);
1170     V_VT(&v) = VT_NULL;
1171
1172     rpcMsg.BufferLength = stubMsg.BufferLength = VARIANT_UserSize(&umcb.Flags, 0, &v);
1173     ok(stubMsg.BufferLength == 20, "size %d\n", stubMsg.BufferLength);
1174
1175     buffer = rpcMsg.Buffer = stubMsg.Buffer = stubMsg.BufferStart = alloc_aligned(stubMsg.BufferLength, &oldbuffer);
1176     stubMsg.BufferEnd = stubMsg.Buffer + stubMsg.BufferLength;
1177     next = VARIANT_UserMarshal(&umcb.Flags, buffer, &v);
1178     ok(next == buffer + stubMsg.BufferLength, "got %p expect %p\n", next, buffer + stubMsg.BufferLength);
1179     wirev = (DWORD*)buffer;
1180
1181     check_variant_header(wirev, &v, stubMsg.BufferLength);
1182     VariantInit(&v2);
1183     stubMsg.Buffer = buffer;
1184     next = VARIANT_UserUnmarshal(&umcb.Flags, buffer, &v2);
1185     ok(next == buffer + stubMsg.BufferLength, "got %p expect %p\n", next, buffer + stubMsg.BufferLength);
1186     ok(V_VT(&v) == V_VT(&v2), "got vt %d expect %d\n", V_VT(&v), V_VT(&v2));
1187
1188     VARIANT_UserFree(&umcb.Flags, &v2);
1189     HeapFree(GetProcessHeap(), 0, oldbuffer);
1190
1191     /*** BSTR ***/
1192     b = SysAllocString(str);
1193     VariantInit(&v);
1194     V_VT(&v) = VT_BSTR;
1195     V_BSTR(&v) = b;
1196
1197     rpcMsg.BufferLength = stubMsg.BufferLength = VARIANT_UserSize(&umcb.Flags, 0, &v);
1198     ok(stubMsg.BufferLength == 60, "size %d\n", stubMsg.BufferLength);
1199     buffer = rpcMsg.Buffer = stubMsg.Buffer = stubMsg.BufferStart = alloc_aligned(stubMsg.BufferLength, &oldbuffer);
1200     stubMsg.BufferEnd = stubMsg.Buffer + stubMsg.BufferLength;
1201     next = VARIANT_UserMarshal(&umcb.Flags, buffer, &v);
1202     ok(next == buffer + stubMsg.BufferLength, "got %p expect %p\n", next, buffer + stubMsg.BufferLength);
1203     wirev = (DWORD*)buffer;
1204
1205     wirev = check_variant_header(wirev, &v, stubMsg.BufferLength);
1206     ok(*wirev, "wv[5] %08x\n", *wirev); /* win2k: this is b. winxp: this is (char*)b + 1 */
1207     wirev++;
1208     check_bstr(wirev, V_BSTR(&v));
1209     VariantInit(&v2);
1210     stubMsg.Buffer = buffer;
1211     next = VARIANT_UserUnmarshal(&umcb.Flags, buffer, &v2);
1212     ok(next == buffer + stubMsg.BufferLength, "got %p expect %p\n", next, buffer + stubMsg.BufferLength);
1213     ok(V_VT(&v) == V_VT(&v2), "got vt %d expect %d\n", V_VT(&v), V_VT(&v2));
1214     ok(SysStringByteLen(V_BSTR(&v)) == SysStringByteLen(V_BSTR(&v2)), "bstr string lens differ\n");
1215     ok(!memcmp(V_BSTR(&v), V_BSTR(&v2), SysStringByteLen(V_BSTR(&v))), "bstrs differ\n");
1216
1217     VARIANT_UserFree(&umcb.Flags, &v2);
1218     HeapFree(GetProcessHeap(), 0, oldbuffer);
1219
1220     /*** BSTR BYREF ***/
1221     VariantInit(&v);
1222     V_VT(&v) = VT_BSTR | VT_BYREF;
1223     V_BSTRREF(&v) = &b;
1224
1225     rpcMsg.BufferLength = stubMsg.BufferLength = VARIANT_UserSize(&umcb.Flags, 0, &v);
1226     ok(stubMsg.BufferLength == 64, "size %d\n", stubMsg.BufferLength);
1227     buffer = rpcMsg.Buffer = stubMsg.Buffer = stubMsg.BufferStart = alloc_aligned(stubMsg.BufferLength, &oldbuffer);
1228     stubMsg.BufferEnd = stubMsg.Buffer + stubMsg.BufferLength;
1229     next = VARIANT_UserMarshal(&umcb.Flags, buffer, &v);
1230     ok(next == buffer + stubMsg.BufferLength, "got %p expect %p\n", next, buffer + stubMsg.BufferLength);
1231     wirev = (DWORD*)buffer;
1232
1233     wirev = check_variant_header(wirev, &v, stubMsg.BufferLength);
1234     ok(*wirev == 0x4, "wv[5] %08x\n", *wirev);
1235     wirev++;
1236     ok(*wirev, "wv[6] %08x\n", *wirev); /* win2k: this is b. winxp: this is (char*)b + 1 */
1237     wirev++;
1238     check_bstr(wirev, b);
1239     VariantInit(&v2);
1240     stubMsg.Buffer = buffer;
1241     next = VARIANT_UserUnmarshal(&umcb.Flags, buffer, &v2);
1242     ok(next == buffer + stubMsg.BufferLength, "got %p expect %p\n", next, buffer + stubMsg.BufferLength);
1243     ok(V_VT(&v) == V_VT(&v2), "got vt %d expect %d\n", V_VT(&v), V_VT(&v2));
1244     ok(SysStringByteLen(*V_BSTRREF(&v)) == SysStringByteLen(*V_BSTRREF(&v2)), "bstr string lens differ\n");
1245     ok(!memcmp(*V_BSTRREF(&v), *V_BSTRREF(&v2), SysStringByteLen(*V_BSTRREF(&v))), "bstrs differ\n");
1246
1247     VARIANT_UserFree(&umcb.Flags, &v2);
1248     HeapFree(GetProcessHeap(), 0, oldbuffer);
1249     SysFreeString(b);
1250
1251     /*** ARRAY ***/
1252     sab.lLbound = 5;
1253     sab.cElements = 10;
1254
1255     lpsa = SafeArrayCreate(VT_R8, 1, &sab);
1256     *(DWORD *)lpsa->pvData = 0xcafebabe;
1257     *((DWORD *)lpsa->pvData + 1) = 0xdeadbeef;
1258
1259     VariantInit(&v);
1260     V_VT(&v) = VT_UI4 | VT_ARRAY;
1261     V_ARRAY(&v) = lpsa;
1262
1263     rpcMsg.BufferLength = stubMsg.BufferLength = VARIANT_UserSize(&umcb.Flags, 0, &v);
1264     expected = 152;
1265     ok(stubMsg.BufferLength == expected || stubMsg.BufferLength == expected + 8, /* win64 */
1266        "size %u instead of %u\n", stubMsg.BufferLength, expected);
1267     buffer = rpcMsg.Buffer = stubMsg.Buffer = stubMsg.BufferStart = alloc_aligned(stubMsg.BufferLength, &oldbuffer);
1268     stubMsg.BufferEnd = stubMsg.Buffer + stubMsg.BufferLength;
1269     next = VARIANT_UserMarshal(&umcb.Flags, buffer, &v);
1270     ok(next == buffer + expected, "got %p expect %p\n", next, buffer + expected);
1271     wirev = (DWORD*)buffer;
1272
1273     wirev = check_variant_header(wirev, &v, expected);
1274     ok(*wirev, "wv[5] %08x\n", *wirev); /* win2k: this is lpsa. winxp: this is (char*)lpsa + 1 */
1275     wirev++;
1276     check_safearray(wirev, lpsa);
1277     VariantInit(&v2);
1278     stubMsg.Buffer = buffer;
1279     next = VARIANT_UserUnmarshal(&umcb.Flags, buffer, &v2);
1280     ok(next == buffer + expected, "got %p expect %p\n", next, buffer + expected);
1281     ok(V_VT(&v) == V_VT(&v2), "got vt %d expect %d\n", V_VT(&v), V_VT(&v2));
1282     ok(SafeArrayGetDim(V_ARRAY(&v)) == SafeArrayGetDim(V_ARRAY(&v2)), "array dims differ\n");
1283     SafeArrayGetLBound(V_ARRAY(&v), 1, &bound);
1284     SafeArrayGetLBound(V_ARRAY(&v2), 1, &bound2);
1285     ok(bound == bound2, "array lbounds differ\n");
1286     SafeArrayGetUBound(V_ARRAY(&v), 1, &bound);
1287     SafeArrayGetUBound(V_ARRAY(&v2), 1, &bound2);
1288     ok(bound == bound2, "array ubounds differ\n");
1289     if (pSafeArrayGetVartype)
1290     {
1291         pSafeArrayGetVartype(V_ARRAY(&v), &vt);
1292         pSafeArrayGetVartype(V_ARRAY(&v2), &vt2);
1293         ok(vt == vt2, "array vts differ %x %x\n", vt, vt2);
1294     }
1295     VARIANT_UserFree(&umcb.Flags, &v2);
1296     HeapFree(GetProcessHeap(), 0, oldbuffer);
1297
1298     /*** ARRAY BYREF ***/
1299     VariantInit(&v);
1300     V_VT(&v) = VT_UI4 | VT_ARRAY | VT_BYREF;
1301     V_ARRAYREF(&v) = &lpsa;
1302
1303     rpcMsg.BufferLength = stubMsg.BufferLength = VARIANT_UserSize(&umcb.Flags, 0, &v);
1304     expected = 152;
1305     ok(stubMsg.BufferLength == expected || stubMsg.BufferLength == expected + 16, /* win64 */
1306        "size %u instead of %u\n", stubMsg.BufferLength, expected);
1307     buffer = rpcMsg.Buffer = stubMsg.Buffer = stubMsg.BufferStart = alloc_aligned(stubMsg.BufferLength, &oldbuffer);
1308     stubMsg.BufferEnd = stubMsg.Buffer + stubMsg.BufferLength;
1309     next = VARIANT_UserMarshal(&umcb.Flags, buffer, &v);
1310     ok(next == buffer + expected, "got %p expect %p\n", next, buffer + expected);
1311     wirev = (DWORD*)buffer;
1312
1313     wirev = check_variant_header(wirev, &v, expected);
1314     ok(*wirev == 4, "wv[5] %08x\n", *wirev);
1315     wirev++;
1316     ok(*wirev, "wv[6] %08x\n", *wirev); /* win2k: this is lpsa. winxp: this is (char*)lpsa + 1 */
1317     wirev++;
1318     check_safearray(wirev, lpsa);
1319     VariantInit(&v2);
1320     stubMsg.Buffer = buffer;
1321     next = VARIANT_UserUnmarshal(&umcb.Flags, buffer, &v2);
1322     ok(next == buffer + expected, "got %p expect %p\n", next, buffer + expected);
1323     ok(V_VT(&v) == V_VT(&v2), "got vt %d expect %d\n", V_VT(&v), V_VT(&v2));
1324     ok(SafeArrayGetDim(*V_ARRAYREF(&v)) == SafeArrayGetDim(*V_ARRAYREF(&v2)), "array dims differ\n");
1325     SafeArrayGetLBound(*V_ARRAYREF(&v), 1, &bound);
1326     SafeArrayGetLBound(*V_ARRAYREF(&v2), 1, &bound2);
1327     ok(bound == bound2, "array lbounds differ\n");
1328     SafeArrayGetUBound(*V_ARRAYREF(&v), 1, &bound);
1329     SafeArrayGetUBound(*V_ARRAYREF(&v2), 1, &bound2);
1330     ok(bound == bound2, "array ubounds differ\n");
1331     if (pSafeArrayGetVartype)
1332     {
1333         pSafeArrayGetVartype(*V_ARRAYREF(&v), &vt);
1334         pSafeArrayGetVartype(*V_ARRAYREF(&v2), &vt2);
1335         ok(vt == vt2, "array vts differ %x %x\n", vt, vt2);
1336     }
1337     VARIANT_UserFree(&umcb.Flags, &v2);
1338     HeapFree(GetProcessHeap(), 0, oldbuffer);
1339     hr = SafeArrayDestroy(lpsa);
1340     ok(hr == S_OK, "got 0x%08x\n", hr);
1341
1342     /*** VARIANT BYREF ***/
1343     VariantInit(&v);
1344     VariantInit(&v2);
1345     V_VT(&v2) = VT_R8;
1346     V_R8(&v2) = 3.1415;
1347     V_VT(&v) = VT_VARIANT | VT_BYREF;
1348     V_VARIANTREF(&v) = &v2;
1349
1350     rpcMsg.BufferLength = stubMsg.BufferLength = VARIANT_UserSize(&umcb.Flags, 0, &v);
1351     ok(stubMsg.BufferLength == 64, "size %d\n", stubMsg.BufferLength);
1352     buffer = rpcMsg.Buffer = stubMsg.Buffer = stubMsg.BufferStart = alloc_aligned(stubMsg.BufferLength, &oldbuffer);
1353     stubMsg.BufferEnd = stubMsg.Buffer + stubMsg.BufferLength;
1354     memset(buffer, 0xcc, stubMsg.BufferLength);
1355     next = VARIANT_UserMarshal(&umcb.Flags, buffer, &v);
1356     ok(next == buffer + stubMsg.BufferLength, "got %p expect %p\n", next, buffer + stubMsg.BufferLength);
1357     wirev = (DWORD*)buffer;
1358     wirev = check_variant_header(wirev, &v, stubMsg.BufferLength);
1359
1360     ok(*wirev == sizeof(VARIANT), "wv[5] %08x\n", *wirev);
1361     wirev++;
1362     ok(*wirev == ('U' | 's' << 8 | 'e' << 16 | 'r' << 24), "wv[6] %08x\n", *wirev); /* 'User' */
1363     wirev++;
1364     ok(*wirev == 0xcccccccc, "wv[7] %08x\n", *wirev); /* pad */
1365     wirev++;
1366     wirev = check_variant_header(wirev, &v2, stubMsg.BufferLength - 32);
1367     ok(*wirev == 0xcccccccc, "wv[13] %08x\n", *wirev); /* pad for VT_R8 */
1368     wirev++;
1369     ok(*(double*)wirev == V_R8(&v2), "wv[6] %08x wv[7] %08x\n", *wirev, *(wirev+1));
1370     VariantInit(&v3);
1371     stubMsg.Buffer = buffer;
1372     next = VARIANT_UserUnmarshal(&umcb.Flags, buffer, &v3);
1373     ok(next == buffer + stubMsg.BufferLength, "got %p expect %p\n", next, buffer + stubMsg.BufferLength);
1374     ok(V_VT(&v) == V_VT(&v3), "got vt %d expect %d\n", V_VT(&v), V_VT(&v3));
1375     ok(V_VT(V_VARIANTREF(&v)) == V_VT(V_VARIANTREF(&v3)), "vts differ %x %x\n",
1376        V_VT(V_VARIANTREF(&v)), V_VT(V_VARIANTREF(&v3)));
1377     ok(V_R8(V_VARIANTREF(&v)) == V_R8(V_VARIANTREF(&v3)), "r8s differ\n");
1378     VARIANT_UserFree(&umcb.Flags, &v3);
1379     HeapFree(GetProcessHeap(), 0, oldbuffer);
1380
1381     /*** UNKNOWN ***/
1382     heap_unknown = HeapAlloc(GetProcessHeap(), 0, sizeof(*heap_unknown));
1383     heap_unknown->IUnknown_iface.lpVtbl = &HeapUnknown_Vtbl;
1384     heap_unknown->refs = 1;
1385     VariantInit(&v);
1386     VariantInit(&v2);
1387     V_VT(&v) = VT_UNKNOWN;
1388     V_UNKNOWN(&v) = &heap_unknown->IUnknown_iface;
1389
1390     rpcMsg.BufferLength = stubMsg.BufferLength = VARIANT_UserSize(&umcb.Flags, 0, &v);
1391     ok(stubMsg.BufferLength > 40, "size %d\n", stubMsg.BufferLength);
1392     buffer = rpcMsg.Buffer = stubMsg.Buffer = stubMsg.BufferStart = alloc_aligned(stubMsg.BufferLength, &oldbuffer);
1393     stubMsg.BufferEnd = stubMsg.Buffer + stubMsg.BufferLength;
1394     memset(buffer, 0xcc, stubMsg.BufferLength);
1395     next = VARIANT_UserMarshal(&umcb.Flags, buffer, &v);
1396 todo_wine
1397     ok(heap_unknown->refs == 2, "got refcount %d\n", heap_unknown->refs);
1398     wirev = (DWORD*)buffer;
1399     wirev = check_variant_header(wirev, &v, next - buffer);
1400
1401     ok(*wirev == (DWORD_PTR)V_UNKNOWN(&v) /* Win9x */ ||
1402        *wirev == (DWORD_PTR)V_UNKNOWN(&v) + 1 /* NT */, "wv[5] %08x\n", *wirev);
1403     wirev++;
1404     ok(*wirev == next - buffer - 0x20, "wv[6] %08x\n", *wirev);
1405     wirev++;
1406     ok(*wirev == next - buffer - 0x20, "wv[7] %08x\n", *wirev);
1407     wirev++;
1408     ok(*wirev == 0x574f454d, "wv[8] %08x\n", *wirev);
1409     VariantInit(&v3);
1410     V_VT(&v3) = VT_UNKNOWN;
1411     V_UNKNOWN(&v3) = &heap_unknown->IUnknown_iface;
1412     IUnknown_AddRef(V_UNKNOWN(&v3));
1413     stubMsg.Buffer = buffer;
1414 todo_wine
1415     ok(heap_unknown->refs == 3, "got refcount %d\n", heap_unknown->refs);
1416     next = VARIANT_UserUnmarshal(&umcb.Flags, buffer, &v3);
1417     ok(V_VT(&v) == V_VT(&v3), "got vt %d expect %d\n", V_VT(&v), V_VT(&v3));
1418     ok(V_UNKNOWN(&v) == V_UNKNOWN(&v3), "got %p expect %p\n", V_UNKNOWN(&v), V_UNKNOWN(&v3));
1419     VARIANT_UserFree(&umcb.Flags, &v3);
1420     ok(heap_unknown->refs == 1, "%d refcounts of IUnknown leaked\n", heap_unknown->refs - 1);
1421     IUnknown_Release(&heap_unknown->IUnknown_iface);
1422     HeapFree(GetProcessHeap(), 0, oldbuffer);
1423
1424     /*** NULL UNKNOWN ***/
1425     VariantInit(&v);
1426     V_VT(&v) = VT_UNKNOWN;
1427     V_UNKNOWN(&v) = NULL;
1428
1429     rpcMsg.BufferLength = stubMsg.BufferLength = VARIANT_UserSize(&umcb.Flags, 0, &v);
1430     ok(stubMsg.BufferLength >= 24, "size %d\n", stubMsg.BufferLength);
1431     buffer = rpcMsg.Buffer = stubMsg.Buffer = stubMsg.BufferStart = alloc_aligned(stubMsg.BufferLength, &oldbuffer);
1432     stubMsg.BufferEnd = stubMsg.Buffer + stubMsg.BufferLength;
1433     memset(buffer, 0xcc, stubMsg.BufferLength);
1434     next = VARIANT_UserMarshal(&umcb.Flags, buffer, &v);
1435     wirev = (DWORD*)buffer;
1436     wirev = check_variant_header(wirev, &v, next - buffer);
1437     ok(*wirev == 0, "wv[5] %08x\n", *wirev);
1438
1439     VariantInit(&v2);
1440     stubMsg.Buffer = buffer;
1441     next = VARIANT_UserUnmarshal(&umcb.Flags, buffer, &v2);
1442     ok(V_VT(&v) == V_VT(&v2), "got vt %d expect %d\n", V_VT(&v), V_VT(&v2));
1443     ok(V_UNKNOWN(&v2) == NULL, "got %p expect NULL\n", V_UNKNOWN(&v2));
1444     VARIANT_UserFree(&umcb.Flags, &v2);
1445     HeapFree(GetProcessHeap(), 0, oldbuffer);
1446
1447     /*** UNKNOWN BYREF ***/
1448     heap_unknown = HeapAlloc(GetProcessHeap(), 0, sizeof(*heap_unknown));
1449     heap_unknown->IUnknown_iface.lpVtbl = &HeapUnknown_Vtbl;
1450     heap_unknown->refs = 1;
1451     VariantInit(&v);
1452     VariantInit(&v2);
1453     V_VT(&v) = VT_UNKNOWN | VT_BYREF;
1454     V_UNKNOWNREF(&v) = (IUnknown **)&heap_unknown;
1455
1456     rpcMsg.BufferLength = stubMsg.BufferLength = VARIANT_UserSize(&umcb.Flags, 0, &v);
1457     ok(stubMsg.BufferLength >= 44, "size %d\n", stubMsg.BufferLength);
1458     buffer = rpcMsg.Buffer = stubMsg.Buffer = stubMsg.BufferStart = alloc_aligned(stubMsg.BufferLength, &oldbuffer);
1459     stubMsg.BufferEnd = stubMsg.Buffer + stubMsg.BufferLength;
1460     memset(buffer, 0xcc, stubMsg.BufferLength);
1461     ok(heap_unknown->refs == 1, "got refcount %d\n", heap_unknown->refs);
1462     next = VARIANT_UserMarshal(&umcb.Flags, buffer, &v);
1463 todo_wine
1464     ok(heap_unknown->refs == 2, "got refcount %d\n", heap_unknown->refs);
1465     wirev = (DWORD*)buffer;
1466     wirev = check_variant_header(wirev, &v, next - buffer);
1467
1468     ok(*wirev == 4, "wv[5] %08x\n", *wirev);
1469     wirev++;
1470     ok(*wirev == (DWORD_PTR)heap_unknown /* Win9x, Win2000 */ ||
1471        *wirev == (DWORD_PTR)heap_unknown + 1 /* XP */, "wv[6] %08x\n", *wirev);
1472     wirev++;
1473     ok(*wirev == next - buffer - 0x24, "wv[7] %08x\n", *wirev);
1474     wirev++;
1475     ok(*wirev == next - buffer - 0x24, "wv[8] %08x\n", *wirev);
1476     wirev++;
1477     ok(*wirev == 0x574f454d, "wv[9] %08x\n", *wirev);
1478
1479     VariantInit(&v3);
1480     V_VT(&v3) = VT_UNKNOWN;
1481     V_UNKNOWN(&v3) = &heap_unknown->IUnknown_iface;
1482     IUnknown_AddRef(V_UNKNOWN(&v3));
1483     stubMsg.Buffer = buffer;
1484     next = VARIANT_UserUnmarshal(&umcb.Flags, buffer, &v3);
1485     ok(heap_unknown->refs == 2, "got refcount %d\n", heap_unknown->refs);
1486     ok(V_VT(&v) == V_VT(&v3), "got vt %d expect %d\n", V_VT(&v), V_VT(&v3));
1487     ok(*V_UNKNOWNREF(&v) == *V_UNKNOWNREF(&v3), "got %p expect %p\n", *V_UNKNOWNREF(&v), *V_UNKNOWNREF(&v3));
1488     VARIANT_UserFree(&umcb.Flags, &v3);
1489     ok(heap_unknown->refs == 1, "%d refcounts of IUnknown leaked\n", heap_unknown->refs - 1);
1490     IUnknown_Release(&heap_unknown->IUnknown_iface);
1491     HeapFree(GetProcessHeap(), 0, oldbuffer);
1492 }
1493
1494
1495 START_TEST(usrmarshal)
1496 {
1497     HANDLE hOleaut32 = GetModuleHandleA("oleaut32.dll");
1498 #define GETPTR(func) p##func = (void*)GetProcAddress(hOleaut32, #func)
1499     GETPTR(SafeArrayGetIID);
1500     GETPTR(SafeArrayGetVartype);
1501     GETPTR(VarBstrCmp);
1502 #undef GETPTR
1503
1504     if (!pSafeArrayGetIID || !pSafeArrayGetVartype)
1505         win_skip("SafeArrayGetIID and/or SafeArrayGetVartype is not available, some tests will be skipped\n");
1506
1507     CoInitialize(NULL);
1508
1509     test_marshal_LPSAFEARRAY();
1510     test_marshal_BSTR();
1511     test_marshal_VARIANT();
1512
1513     CoUninitialize();
1514 }