Index: event.c
===================================================================
--- win32ss/user/ntuser/event.c	(revision 63837)
+++ win32ss/user/ntuser/event.c	(working copy)
@@ -162,20 +162,15 @@
    if (!GlobalEvents || !GlobalEvents->Counts) return;
 
    pLE = GlobalEvents->Events.Flink;
-   if (IsListEmpty(pLE)) return;
-
-   pEH = CONTAINING_RECORD(pLE, EVENTHOOK, Chain);
-   do
+   while (pLE != &GlobalEvents->Events)
    {
-      if (IsListEmpty(pLE)) break;
-      if (!pEH) break;
-      pLE = pEH->Chain.Flink;
+      pEH = CONTAINING_RECORD(pLE, EVENTHOOK, Chain);
+      pLE = pLE->Flink;
       if (pEH->head.pti == pti)
       {
          IntRemoveEvent(pEH);
       }
-      pEH = CONTAINING_RECORD(pLE, EVENTHOOK, Chain);
-   } while (pLE != &GlobalEvents->Events);
+   }
 
    return;
 }
Index: misc.c
===================================================================
--- win32ss/user/ntuser/misc.c	(revision 63837)
+++ win32ss/user/ntuser/misc.c	(working copy)
@@ -656,6 +656,8 @@
     ASSERT(pci->ulClientDelta == DesktopHeapGetUserDelta());
     if (pti->pcti && pci->pDeskInfo)
         ASSERT(pci->pClientThreadInfo == (PVOID)((ULONG_PTR)pti->pcti - pci->ulClientDelta));
+    if (pti->pcti && IsListEmpty(&pti->SentMessagesListHead))
+        ASSERT((pti->pcti->fsChangeBits & QS_SENDMESSAGE) == 0);
     if (pti->KeyboardLayout)
         ASSERT(pci->hKL == pti->KeyboardLayout->hkl);
     if(pti->rpdesk != NULL)
Index: msgqueue.c
===================================================================
--- win32ss/user/ntuser/msgqueue.c	(revision 63837)
+++ win32ss/user/ntuser/msgqueue.c	(working copy)
@@ -1746,10 +1746,8 @@
     if (!filter_contains_hw_range( MsgFilterLow, MsgFilterHigh )) return FALSE;
 
     ListHead = &MessageQueue->HardwareMessagesListHead;
-    CurrentEntry = ListHead->Flink;
+    if (IsListEmpty(ListHead)) return FALSE;
 
-    if (IsListEmpty(CurrentEntry)) return FALSE;
-
     if (!MessageQueue->ptiSysLock)
     {
        MessageQueue->ptiSysLock = pti;
@@ -1762,48 +1760,46 @@
        return FALSE;
     }
 
-    CurrentMessage = CONTAINING_RECORD(CurrentEntry, USER_MESSAGE,
-                                          ListEntry);
-    do
+    CurrentEntry = ListHead->Flink;
+    while (CurrentEntry != ListHead)
     {
-        if (IsListEmpty(CurrentEntry)) break;
-        if (!CurrentMessage) break;
-        CurrentEntry = CurrentMessage->ListEntry.Flink;
-        if (!CurrentEntry) break; //// Fix CORE-6734 reported crash.
+        CurrentMessage = CONTAINING_RECORD(CurrentEntry,
+                                           USER_MESSAGE,
+                                           ListEntry);
+        CurrentEntry = CurrentEntry->Flink;
+
 /*
  MSDN:
  1: any window that belongs to the current thread, and any messages on the current thread's message queue whose hwnd value is NULL.
  2: retrieves only messages on the current thread's message queue whose hwnd value is NULL.
  3: handle to the window whose messages are to be retrieved.
  */
-      if ( ( !Window || // 1
-            ( Window == PWND_BOTTOM && CurrentMessage->Msg.hwnd == NULL ) || // 2
-            ( Window != PWND_BOTTOM && Window->head.h == CurrentMessage->Msg.hwnd ) ) && // 3
-            ( ( ( MsgFilterLow == 0 && MsgFilterHigh == 0 ) && CurrentMessage->QS_Flags & QSflags ) ||
-              ( MsgFilterLow <= CurrentMessage->Msg.message && MsgFilterHigh >= CurrentMessage->Msg.message ) ) )
+        if ( ( !Window || // 1
+              ( Window == PWND_BOTTOM && CurrentMessage->Msg.hwnd == NULL ) || // 2
+              ( Window != PWND_BOTTOM && Window->head.h == CurrentMessage->Msg.hwnd ) ) && // 3
+              ( ( ( MsgFilterLow == 0 && MsgFilterHigh == 0 ) && CurrentMessage->QS_Flags & QSflags ) ||
+                ( MsgFilterLow <= CurrentMessage->Msg.message && MsgFilterHigh >= CurrentMessage->Msg.message ) ) )
         {
-           msg = CurrentMessage->Msg;
+            msg = CurrentMessage->Msg;
 
-           UpdateKeyStateFromMsg(MessageQueue, &msg);
-           AcceptMessage = co_IntProcessHardwareMessage(&msg, &Remove, MsgFilterLow, MsgFilterHigh);
+            UpdateKeyStateFromMsg(MessageQueue, &msg);
+            AcceptMessage = co_IntProcessHardwareMessage(&msg, &Remove, MsgFilterLow, MsgFilterHigh);
 
-           if (Remove)
-           {
-               RemoveEntryList(&CurrentMessage->ListEntry);
-               ClearMsgBitsMask(pti, CurrentMessage->QS_Flags);
-               MsqDestroyMessage(CurrentMessage);
-           }
+            if (Remove)
+            {
+                RemoveEntryList(&CurrentMessage->ListEntry);
+                ClearMsgBitsMask(pti, CurrentMessage->QS_Flags);
+                MsqDestroyMessage(CurrentMessage);
+            }
 
-           if (AcceptMessage)
-           {
-              *pMsg = msg;
-              Ret = TRUE;
-              break;
-           }
+            if (AcceptMessage)
+            {
+                *pMsg = msg;
+                Ret = TRUE;
+                break;
+            }
         }
-        CurrentMessage = CONTAINING_RECORD(CurrentEntry, USER_MESSAGE, ListEntry);
     }
-    while(CurrentEntry != ListHead);
 
     MessageQueue->ptiSysLock = NULL;
     pti->pcti->CTI_flags &= ~CTI_THREADSYSLOCK;
@@ -1824,17 +1820,12 @@
    PLIST_ENTRY ListHead;
    BOOL Ret = FALSE;
 
-   CurrentEntry = pti->PostedMessagesListHead.Flink;
    ListHead = &pti->PostedMessagesListHead;
-
-   if (IsListEmpty(CurrentEntry)) return FALSE;
-
-   CurrentMessage = CONTAINING_RECORD(CurrentEntry, USER_MESSAGE,
+   CurrentEntry = ListHead->Flink;
+   while (CurrentEntry != ListHead)
+   {
+      CurrentMessage = CONTAINING_RECORD(CurrentEntry, USER_MESSAGE,
                                          ListEntry);
-   do
-   {
-      if (IsListEmpty(CurrentEntry)) break;
-      if (!CurrentMessage) break;
       CurrentEntry = CurrentEntry->Flink;
 /*
  MSDN:
@@ -1859,10 +1850,7 @@
          Ret = TRUE;
          break;
       }
-      CurrentMessage = CONTAINING_RECORD(CurrentEntry, USER_MESSAGE,
-                                         ListEntry);
    }
-   while (CurrentEntry != ListHead);
 
    return Ret;
 }
@@ -2187,7 +2175,7 @@
 {
    HWND Prev;
    PUSER_MESSAGE_QUEUE MessageQueue;
-   
+
    MessageQueue = pti->MessageQueue;
 
    switch(Type)