win32k crashes if an invalid parent window handle is passed to CreateWindowEx

(..\win32ss\user\ntuser\window.c:2071) err: Cannot create a child window without a parrent!

(..\win32ss\user\ntuser\window.c:2593) err: co_UserCreateWindowEx failed!

Access violation - code c0000005 (!!! second chance !!!)

win32k!co_UserCreateWindowEx+0x7f5:

f2619c95 035050          add     edx,dword ptr [eax+50h]

kd> .reload

Connected to Windows Server 2003 3790 x86 compatible target at (Mon Oct 26 12:58:34.443 2015 (UTC + 1:00)), ptr64 FALSE

Loading Kernel Symbols

....................................................

Loading User Symbols

..............

kd> kp

ChildEBP RetAddr  

f20ccc54 f261a765 win32k!co_UserCreateWindowEx(struct tagCREATESTRUCTW * Cs = 0xf20ccc94, struct _UNICODE_STRING * ClassName = 0xf20cccc8 "BUTTON", struct _LARGE_STRING * WindowName = 0xf20ccc84, void * acbiBuffer = 0x00000000)+0x7f5 [c:\ros\reactos-clean\reactos\win32ss\user\ntuser\window.c @ 2224]

f20cccd0 804fec99 win32k!NtUserCreateWindowEx(unsigned long dwExStyle = 0, struct _LARGE_STRING * plstrClassName = 0x0012fd30, struct _LARGE_STRING * plstrClsVersion = 0x00000000, struct _LARGE_STRING * plstrWindowName = 0xf20ccc84, unsigned long dwStyle = 0x40000000, int x = 0, int y = 0, int nWidth = 0, int nHeight = 0, struct HWND__ * hWndParent = 0xffffffff, struct HMENU__ * hMenu = 0x00000000, struct HINSTANCE__ * hInstance = 0x00000000, void * lpParam = 0x00000000, unsigned long dwFlags = 0, void * acbiBuffer = 0x00000000)+0x215 [c:\ros\reactos-clean\reactos\win32ss\user\ntuser\window.c @ 2589]

f20ccd1c 804fe24d nt!KiSystemCallTrampoline(void * Handler = 0xf261a550, void * Arguments = 0x0012fcd8, unsigned long StackBytes = 0x3c)+0x19 [c:\ros\reactos-clean\reactos\ntoskrnl\include\internal\i386\ke.h @ 742]

f20ccd5c 80403e13 nt!KiSystemServiceHandler(struct _KTRAP_FRAME * TrapFrame = 0xf20ccd64, void * Arguments = 0x0012fcd8)+0x22d [c:\ros\reactos-clean\reactos\ntoskrnl\ke\i386\traphdlr.c @ 1738]

f20ccd5c 7c9493a4 nt!KiFastCallEntry+0x8c

0012fccc 7c5d4b28 ntdll!KiFastSystemCallRet

0012fcd0 7c5cc909 user32!ZwUserCreateWindowEx+0xc

0012fdb8 7c5ccfe8 user32!User32CreateWindowEx(unsigned long dwExStyle = 0, char * lpClassName = 0x004335b4 "B", char * lpWindowName = 0x00000000 "", unsigned long dwStyle = 0x40000000, int x = 0, int y = 0, int nWidth = 0, int nHeight = 0, struct HWND__ * hWndParent = 0xffffffff, struct HMENU__ * hMenu = 0x00000000, struct HINSTANCE__ * hInstance = 0x00000000, void * lpParam = 0x00000000, unsigned long dwFlags = 0)+0x2b9 [c:\ros\reactos-clean\reactos\win32ss\user\user32\windows\window.c @ 283]

0012fe38 00404f3e user32!CreateWindowExW(unsigned long dwExStyle = 0, wchar_t * lpClassName = 0x004335b4 "BUTTON", wchar_t * lpWindowName = 0x00000000 "", unsigned long dwStyle = 0x40000000, int x = 0, int y = 0, int nWidth = 0, int nHeight = 0, struct HWND__ * hWndParent = 0xffffffff, struct HMENU__ * hMenu = 0x00000000, struct HINSTANCE__ * hInstance = 0x00000000, void * lpParam = 0x00000000)+0x308 [c:\ros\reactos-clean\reactos\win32ss\user\user32\windows\window.c @ 567]

0012fe78 0042bac7 user32_apitest!func_CreateWindowEx(void)+0xce [c:\ros\reactos-clean\reactos\modules\rostests\apitests\user32\createwindowex.c @ 24]

0012fe90 0042b9ca user32_apitest!run_test(char * name = 0x00134018 "CreateWindowEx")+0x87 [c:\ros\reactos-clean\reactos\include\reactos\wine\test.h @ 636]

0012ff1c 0042c5aa user32_apitest!main(int argc = 2, char ** argv = 0x00135d20)+0x14a [c:\ros\reactos-clean\reactos\include\reactos\wine\test.h @ 683]

0012ffb4 0042c34f user32_apitest!__tmainCRTStartup(void)+0x24a [c:\ros\reactos-clean\reactos\lib\sdk\crt\startup\crtexe.c @ 311]

0012ffc0 7c7ced47 user32_apitest!mainCRTStartup(void)+0x1f [c:\ros\reactos-clean\reactos\lib\sdk\crt\startup\crtexe.c @ 196]

0012fff0 00000000 kernel32!BaseProcessStartup(<function> * lpStartAddress = 0x0042c330)+0x57 [c:\ros\reactos-clean\reactos\dll\win32\kernel32\client\proc.c @ 478]

kd> ?? ParentWindow

struct _WND * 0x00000000

Cs->x += ParentWindow->rcClient.left;