Index: win32ss/include/ntuser.h
===================================================================
--- win32ss/include/ntuser.h	(revision 72470)
+++ win32ss/include/ntuser.h	(working copy)
@@ -13,7 +13,8 @@
 #define FIRST_USER_HANDLE 0x0020 /* first possible value for low word of user handle */
 #define LAST_USER_HANDLE 0xffef /* last possible value for low word of user handle */
 
-#define HANDLEENTRY_INDESTROY 1
+#define HANDLEENTRY_DESTROY 1
+#define HANDLEENTRY_INDESTROY 2
 
 typedef struct _USER_HANDLE_ENTRY
 {
Index: win32ss/user/user32/misc/misc.c
===================================================================
--- win32ss/user/user32/misc/misc.c	(revision 72470)
+++ win32ss/user/user32/misc/misc.c	(working copy)
@@ -283,7 +283,7 @@
   if ( (!pEntry) ||
         (pEntry->type != uType) ||
         !pEntry->ptr ||
-        (pEntry->flags & HANDLEENTRY_INDESTROY) )
+        (pEntry->flags & HANDLEENTRY_DESTROY) )
   {
      switch ( uType )
      {  // Test (with wine too) confirms these results!
Index: win32ss/user/ntuser/hook.c
===================================================================
--- win32ss/user/ntuser/hook.c	(revision 72470)
+++ win32ss/user/ntuser/hook.c	(working copy)
@@ -1022,6 +1022,8 @@
 FASTCALL
 IntFreeHook(PHOOK Hook)
 {
+    UserMarkObjectDestroy(Hook);
+
     RemoveEntryList(&Hook->Chain);
     if (Hook->ModuleName.Buffer)
     {
Index: win32ss/user/ntuser/window.c
===================================================================
--- win32ss/user/ntuser/window.c	(revision 72470)
+++ win32ss/user/ntuser/window.c	(working copy)
@@ -641,7 +641,7 @@
    }
 
    UserReferenceObject(Window);
-   UserDeleteObject(UserHMGetHandle(Window), TYPE_WINDOW);
+   UserMarkObjectDestroy(Window);
 
    IntDestroyScrollBars(Window);
 
@@ -670,6 +670,7 @@
    UserFreeWindowInfo(Window->head.pti, Window);
 
    UserDereferenceObject(Window);
+   UserDeleteObject(UserHMGetHandle(Window), TYPE_WINDOW);
 
    return 0;
 }
Index: win32ss/user/ntuser/object.c
===================================================================
--- win32ss/user/ntuser/object.c	(revision 72470)
+++ win32ss/user/ntuser/object.c	(working copy)
@@ -582,7 +582,29 @@
    return Object;
 }
 
+BOOL
+FASTCALL
+UserMarkObjectDestroy(PVOID Object)
+{
+    PUSER_HANDLE_ENTRY entry;
+    PHEAD ObjHead = Object;
 
+    entry = handle_to_entry(gHandleTable, ObjHead->h);
+
+    ASSERT(entry != NULL);
+
+    entry->flags |= HANDLEENTRY_DESTROY;
+
+    if (ObjHead->cLockObj > 1)
+    {
+        entry->flags &= ~HANDLEENTRY_INDESTROY;
+        ERR("Count %d\n",ObjHead->cLockObj);
+        return FALSE;
+    }
+
+    return TRUE;
+}
+
 BOOL
 FASTCALL
 UserDereferenceObject(PVOID Object)
Index: win32ss/user/ntuser/object.h
===================================================================
--- win32ss/user/ntuser/object.h	(revision 72470)
+++ win32ss/user/ntuser/object.h	(working copy)
@@ -19,6 +19,7 @@
 void DbgUserDumpHandleTable();
 PVOID FASTCALL ValidateHandle(HANDLE handle, HANDLE_TYPE type);
 BOOLEAN UserDestroyObjectsForOwner(PUSER_HANDLE_TABLE Table, PVOID Owner);
+BOOL FASTCALL UserMarkObjectDestroy(PVOID);
 
 static __inline VOID
 UserRefObjectCo(PVOID obj, PUSER_REFERENCE_ENTRY UserReferenceEntry)
Index: win32ss/user/ntuser/cursoricon.c
===================================================================
--- win32ss/user/ntuser/cursoricon.c	(revision 72470)
+++ win32ss/user/ntuser/cursoricon.c	(working copy)
@@ -315,6 +315,8 @@
 {
     PCURICON_OBJECT CurIcon = Object;
 
+    UserMarkObjectDestroy(CurIcon);
+
     /* Check if the cursor is in a list */
     if (CurIcon->CURSORF_flags & CURSORF_LINKED)
     {
Index: win32ss/user/ntuser/menu.c
===================================================================
--- win32ss/user/ntuser/menu.c	(revision 72470)
+++ win32ss/user/ntuser/menu.c	(working copy)
@@ -322,14 +322,10 @@
 BOOL FASTCALL
 IntDestroyMenuObject(PMENU Menu, BOOL bRecurse)
 {
-   if(Menu)
+   if (Menu)
    {
       PWND Window;
-      ULONG Error;
 
-      /* Remove all menu items */
-      IntDestroyMenu( Menu, bRecurse);
-
       if (PsGetCurrentProcessSessionId() == Menu->head.rpdesk->rpwinstaParent->dwSessionId)
       {
          BOOL ret;
@@ -350,22 +346,14 @@
                }
             }
          }
-         if (UserObjectInDestroy(Menu->head.h))
-         {
-            WARN("Menu already dead!\n");
-            return FALSE;
-         }
+
+         if (!UserMarkObjectDestroy(Menu)) return TRUE;
+
+         /* Remove all menu items */
+         IntDestroyMenu( Menu, bRecurse);
+
          ret = UserDeleteObject(Menu->head.h, TYPE_MENU);
-         if (!ret)
-         {  // Make sure it is really dead or just marked for deletion.
-            Error = EngGetLastError();
-            ret = UserObjectInDestroy(Menu->head.h);
-            if (ret && EngGetLastError() == ERROR_INVALID_HANDLE)
-            {
-               EngSetLastError(Error);
-               ret = FALSE;
-            }
-         }  // See test_subpopup_locked_by_menu tests....
+         ERR("IntDestroyMenuObject %d\n",ret);
          return ret;
       }
    }
@@ -5114,7 +5102,7 @@
 
       ItemInfo.cbSize = sizeof(MENUITEMINFOW);
       ItemInfo.fMask = MIIM_FTYPE | MIIM_STRING | MIIM_STATE | MIIM_SUBMENU;
-      ItemInfo.fType = 0;
+      ItemInfo.fType = MF_POPUP;
       ItemInfo.fState = MFS_ENABLED;
       ItemInfo.dwTypeData = NULL;
       ItemInfo.cch = 0;
@@ -5183,7 +5171,7 @@
       if (OldMenu)
       {
           OldMenu->fFlags &= ~MNF_SYSMENU;
-         IntDestroyMenuObject(OldMenu, TRUE);
+          IntDestroyMenuObject(OldMenu, TRUE);
       }
    }
 
