dlls/oleaut32/tests/usrmarshal.c

   1 /*
   2  * Marshaling Tests
   3  *
   4  * Copyright 2004 Robert Shearman
   5  *
   6  * This library is free software; you can redistribute it and/or
   7  * modify it under the terms of the GNU Lesser General Public
   8  * License as published by the Free Software Foundation; either
   9  * version 2.1 of the License, or (at your option) any later version.
  10  *
  11  * This library is distributed in the hope that it will be useful,
  12  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  13  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  14  * Lesser General Public License for more details.
  15  *
  16  * You should have received a copy of the GNU Lesser General Public
  17  * License along with this library; if not, write to the Free Software
  18  * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA
  19  */
  20
  21 #define COBJMACROS
  22 #define CONST_VTABLE
  23
  24 #include <stdarg.h>
  25
  26 #include "windef.h"
  27 #include "winbase.h"
  28 #include "objbase.h"
  29 #include "propidl.h" /* for LPSAFEARRAY_User* routines */
  30
  31 #include "wine/test.h"
  32
  33 #if (__STDC__ && !defined(_FORCENAMELESSUNION)) || defined(NONAMELESSUNION)
  34 # define V_U2(A)  ((A)->n1.n2)
  35 #else
  36 # define V_U2(A)  (*(A))
  37 #endif
  38
  39 static HRESULT (WINAPI *pSafeArrayGetVartype)(SAFEARRAY*,VARTYPE*);
  40
  41 static inline SF_TYPE get_union_type(SAFEARRAY *psa)
  42 {
  43     VARTYPE vt;
  44     HRESULT hr;
  45
  46     hr = pSafeArrayGetVartype(psa, &vt);
  47     if (FAILED(hr))
  48     {
  49         if(psa->fFeatures & FADF_VARIANT) return SF_VARIANT;
  50
  51         switch(psa->cbElements)
  52         {
  53         case 1: vt = VT_I1; break;
  54         case 2: vt = VT_I2; break;
  55         case 4: vt = VT_I4; break;
  56         case 8: vt = VT_I8; break;
  57         default: return 0;
  58         }
  59     }
  60
  61     if (psa->fFeatures & FADF_HAVEIID)
  62         return SF_HAVEIID;
  63
  64     switch (vt)
  65     {
  66     case VT_I1:
  67     case VT_UI1:      return SF_I1;
  68     case VT_BOOL:
  69     case VT_I2:
  70     case VT_UI2:      return SF_I2;
  71     case VT_INT:
  72     case VT_UINT:
  73     case VT_I4:
  74     case VT_UI4:
  75     case VT_R4:       return SF_I4;
  76     case VT_DATE:
  77     case VT_CY:
  78     case VT_R8:
  79     case VT_I8:
  80     case VT_UI8:      return SF_I8;
  81     case VT_INT_PTR:
  82     case VT_UINT_PTR: return (sizeof(UINT_PTR) == 4 ? SF_I4 : SF_I8);
  83     case VT_BSTR:     return SF_BSTR;
  84     case VT_DISPATCH: return SF_DISPATCH;
  85     case VT_VARIANT:  return SF_VARIANT;
  86     case VT_UNKNOWN:  return SF_UNKNOWN;
  87     /* Note: Return a non-zero size to indicate vt is valid. The actual size
  88      * of a UDT is taken from the result of IRecordInfo_GetSize().
  89      */
  90     case VT_RECORD:   return SF_RECORD;
  91     default:          return SF_ERROR;
  92     }
  93 }
  94
  95 static ULONG get_cell_count(const SAFEARRAY *psa)
  96 {
  97     const SAFEARRAYBOUND* psab = psa->rgsabound;
  98     USHORT cCount = psa->cDims;
  99     ULONG ulNumCells = 1;
 100
 101     while (cCount--)
 102     {
 103          if (!psab->cElements)
 104             return 0;
 105         ulNumCells *= psab->cElements;
 106         psab++;
 107     }
 108     return ulNumCells;
 109 }
 110
 111 static DWORD elem_wire_size(LPSAFEARRAY lpsa, SF_TYPE sftype)
 112 {
 113     if (sftype == SF_BSTR)
 114         return sizeof(DWORD);
 115     else
 116         return lpsa->cbElements;
 117 }
 118
 119 static void check_safearray(void *buffer, LPSAFEARRAY lpsa)
 120 {
 121     unsigned char *wiresa = buffer;
 122     const SAFEARRAYBOUND *bounds;
 123     VARTYPE vt;
 124     SF_TYPE sftype;
 125     ULONG cell_count;
 126     int i;
 127
 128     if(!lpsa)
 129     {
 130         ok(*(DWORD *)wiresa == 0, "wiresa + 0x0 should be NULL instead of 0x%08x\n", *(DWORD *)wiresa);
 131         return;
 132     }
 133
 134     if (!pSafeArrayGetVartype)
 135         return;
 136
 137     if(FAILED(pSafeArrayGetVartype(lpsa, &vt)))
 138         vt = 0;
 139
 140     sftype = get_union_type(lpsa);
 141     cell_count = get_cell_count(lpsa);
 142
 143     ok(*(DWORD *)wiresa, "wiresa + 0x0 should be non-NULL instead of 0x%08x\n", *(DWORD *)wiresa); /* win2k: this is lpsa. winxp: this is 0x00000001 */
 144     wiresa += sizeof(DWORD);
 145     ok(*(DWORD *)wiresa == lpsa->cDims, "wiresa + 0x4 should be lpsa->cDims instead of 0x%08x\n", *(DWORD *)wiresa);
 146     wiresa += sizeof(DWORD);
 147     ok(*(WORD *)wiresa == lpsa->cDims, "wiresa + 0x8 should be lpsa->cDims instead of 0x%04x\n", *(WORD *)wiresa);
 148     wiresa += sizeof(WORD);
 149     ok(*(WORD *)wiresa == lpsa->fFeatures, "wiresa + 0xa should be lpsa->fFeatures instead of 0x%08x\n", *(WORD *)wiresa);
 150     wiresa += sizeof(WORD);
 151     ok(*(DWORD *)wiresa == elem_wire_size(lpsa, sftype), "wiresa + 0xc should be 0x%08x instead of 0x%08x\n", elem_wire_size(lpsa, sftype), *(DWORD *)wiresa);
 152     wiresa += sizeof(DWORD);
 153     ok(*(WORD *)wiresa == lpsa->cLocks, "wiresa + 0x10 should be lpsa->cLocks instead of 0x%04x\n", *(WORD *)wiresa);
 154     wiresa += sizeof(WORD);
 155     ok(*(WORD *)wiresa == vt, "wiresa + 0x12 should be %04x instead of 0x%04x\n", vt, *(WORD *)wiresa);
 156     wiresa += sizeof(WORD);
 157     ok(*(DWORD *)wiresa == sftype, "wiresa + 0x14 should be %08x instead of 0x%08x\n", (DWORD)sftype, *(DWORD *)wiresa);
 158     wiresa += sizeof(DWORD);
 159     ok(*(DWORD *)wiresa == cell_count, "wiresa + 0x18 should be %u instead of %u\n", cell_count, *(DWORD *)wiresa);
 160     wiresa += sizeof(DWORD);
 161     ok(*(DWORD *)wiresa, "wiresa + 0x1c should be non-zero instead of 0x%08x\n", *(DWORD *)wiresa);
 162     wiresa += sizeof(DWORD);
 163     if(sftype == SF_HAVEIID)
 164     {
 165         GUID guid;
 166         SafeArrayGetIID(lpsa, &guid);
 167         ok(IsEqualGUID(&guid, wiresa), "guid mismatch\n");
 168         wiresa += sizeof(GUID);
 169     }
 170
 171     /* bounds are marshaled in natural dimensions order */
 172     bounds = (SAFEARRAYBOUND*)wiresa;
 173     for(i=0; i<lpsa->cDims; i++)
 174     {
 175         ok(memcmp(bounds, &lpsa->rgsabound[lpsa->cDims-i-1], sizeof(SAFEARRAYBOUND)) == 0,
 176            "bounds mismatch for dimension %d, got (%d,%d), expected (%d,%d)\n", i,
 177             bounds->lLbound, bounds->cElements, lpsa->rgsabound[lpsa->cDims-i-1].lLbound,
 178             lpsa->rgsabound[lpsa->cDims-i-1].cElements);
 179         bounds++;
 180     }
 181
 182     wiresa += sizeof(lpsa->rgsabound[0]) * lpsa->cDims;
 183
 184     ok(*(DWORD *)wiresa == cell_count, "wiresa + 0x28 should be %u instead of %u\n", cell_count, *(DWORD*)wiresa);
 185     wiresa += sizeof(DWORD);
 186     /* elements are now pointed to by wiresa */
 187 }
 188
 189 static void * WINAPI user_allocate(SIZE_T size)
 190 {
 191     ok(0, "unexpected user_allocate call\n");
 192     return CoTaskMemAlloc(size);
 193 }
 194
 195 static void WINAPI user_free(void *p)
 196 {
 197     ok(0, "unexpected user_free call\n");
 198     CoTaskMemFree(p);
 199 }
 200
 201 static void init_user_marshal_cb(USER_MARSHAL_CB *umcb,
 202                                  PMIDL_STUB_MESSAGE stub_msg,
 203                                  PRPC_MESSAGE rpc_msg, unsigned char *buffer,
 204                                  unsigned int size, MSHCTX context)
 205 {
 206     memset(rpc_msg, 0, sizeof(*rpc_msg));
 207     rpc_msg->Buffer = buffer;
 208     rpc_msg->BufferLength = size;
 209
 210     memset(stub_msg, 0, sizeof(*stub_msg));
 211     stub_msg->RpcMsg = rpc_msg;
 212     stub_msg->Buffer = buffer;
 213     stub_msg->pfnAllocate = user_allocate;
 214     stub_msg->pfnFree = user_free;
 215
 216     memset(umcb, 0, sizeof(*umcb));
 217     umcb->Flags = MAKELONG(context, NDR_LOCAL_DATA_REPRESENTATION);
 218     umcb->pStubMsg = stub_msg;
 219     umcb->Signature = USER_MARSHAL_CB_SIGNATURE;
 220     umcb->CBType = buffer ? USER_MARSHAL_CB_UNMARSHALL : USER_MARSHAL_CB_BUFFER_SIZE;
 221 }
 222
 223 static void test_marshal_LPSAFEARRAY(void)
 224 {
 225     unsigned char *buffer, *next;
 226     ULONG size, expected;
 227     LPSAFEARRAY lpsa;
 228     LPSAFEARRAY lpsa2 = NULL;
 229     SAFEARRAYBOUND sab[2];
 230     RPC_MESSAGE rpc_msg;
 231     MIDL_STUB_MESSAGE stub_msg;
 232     USER_MARSHAL_CB umcb;
 233     HRESULT hr;
 234     VARTYPE vt, vt2;
 235     OLECHAR *values[10];
 236     int expected_bstr_size;
 237     int i;
 238     LONG indices[1];
 239
 240     sab[0].lLbound = 5;
 241     sab[0].cElements = 10;
 242
 243     lpsa = SafeArrayCreate(VT_I2, 1, sab);
 244     *(DWORD *)lpsa->pvData = 0xcafebabe;
 245
 246     lpsa->cLocks = 7;
 247     init_user_marshal_cb(&umcb, &stub_msg, &rpc_msg, NULL, 0, MSHCTX_DIFFERENTMACHINE);
 248     size = LPSAFEARRAY_UserSize(&umcb.Flags, 1, &lpsa);
 249     expected = (44 + 1 + sizeof(ULONG) - 1) & ~(sizeof(ULONG) - 1);
 250     expected += sab[0].cElements * sizeof(USHORT);
 251     ok(size == expected || size == expected + 12, /* win64 */
 252        "size should be %u bytes, not %u\n", expected, size);
 253     init_user_marshal_cb(&umcb, &stub_msg, &rpc_msg, NULL, 0, MSHCTX_DIFFERENTMACHINE);
 254     size = LPSAFEARRAY_UserSize(&umcb.Flags, 0, &lpsa);
 255     expected = 44 + sab[0].cElements * sizeof(USHORT);
 256     ok(size == expected || size == expected + 12, /* win64 */
 257        "size should be %u bytes, not %u\n", expected, size);
 258     buffer = HeapAlloc(GetProcessHeap(), 0, size);
 259     init_user_marshal_cb(&umcb, &stub_msg, &rpc_msg, buffer, size, MSHCTX_DIFFERENTMACHINE);
 260     next = LPSAFEARRAY_UserMarshal(&umcb.Flags, buffer, &lpsa);
 261     ok(next - buffer == expected, "Marshaled %u bytes, expected %u\n", (ULONG) (next - buffer), expected);
 262     ok(lpsa->cLocks == 7, "got lock count %u\n", lpsa->cLocks);
 263
 264     check_safearray(buffer, lpsa);
 265
 266     init_user_marshal_cb(&umcb, &stub_msg, &rpc_msg, buffer, size, MSHCTX_DIFFERENTMACHINE);
 267     LPSAFEARRAY_UserUnmarshal(&umcb.Flags, buffer, &lpsa2);
 268     ok(lpsa2 != NULL, "LPSAFEARRAY didn't unmarshal\n");
 269     if (pSafeArrayGetVartype)
 270     {
 271         pSafeArrayGetVartype(lpsa, &vt);
 272         pSafeArrayGetVartype(lpsa2, &vt2);
 273         ok(vt == vt2, "vts differ %x %x\n", vt, vt2);
 274     }
 275     ok(lpsa2->cLocks == 0, "got lock count %u, expected 0\n", lpsa2->cLocks);
 276     init_user_marshal_cb(&umcb, &stub_msg, &rpc_msg, NULL, 0, MSHCTX_DIFFERENTMACHINE);
 277     LPSAFEARRAY_UserFree(&umcb.Flags, &lpsa2);
 278     ok(!lpsa2, "lpsa2 was not set to 0 by LPSAFEARRAY_UserFree\n");
 279     HeapFree(GetProcessHeap(), 0, buffer);
 280     lpsa->cLocks = 0;
 281     hr = SafeArrayDestroy(lpsa);
 282     ok(hr == S_OK, "got 0x%08x\n", hr);
 283
 284     /* use two dimensions */
 285     sab[0].lLbound = 5;
 286     sab[0].cElements = 10;
 287     sab[1].lLbound = 1;
 288     sab[1].cElements = 2;
 289
 290     lpsa = SafeArrayCreate(VT_I2, 2, sab);
 291     *(DWORD *)lpsa->pvData = 0xcafebabe;
 292
 293     lpsa->cLocks = 7;
 294     init_user_marshal_cb(&umcb, &stub_msg, &rpc_msg, NULL, 0, MSHCTX_DIFFERENTMACHINE);
 295     size = LPSAFEARRAY_UserSize(&umcb.Flags, 1, &lpsa);
 296     expected = (44 + 1 + +sizeof(SAFEARRAYBOUND) + sizeof(ULONG) - 1) & ~(sizeof(ULONG) - 1);
 297     expected += max(sab[0].cElements, sab[1].cElements) * lpsa->cDims * sizeof(USHORT);
 298     ok(size == expected || size == expected + 12, /* win64 */
 299        "size should be %u bytes, not %u\n", expected, size);
 300     init_user_marshal_cb(&umcb, &stub_msg, &rpc_msg, NULL, 0, MSHCTX_DIFFERENTMACHINE);
 301     size = LPSAFEARRAY_UserSize(&umcb.Flags, 0, &lpsa);
 302     expected = 52 + max(sab[0].cElements, sab[1].cElements) * lpsa->cDims * sizeof(USHORT);
 303     ok(size == expected || size == expected + 12, /* win64 */
 304        "size should be %u bytes, not %u\n", expected, size);
 305     buffer = HeapAlloc(GetProcessHeap(), 0, size);
 306     init_user_marshal_cb(&umcb, &stub_msg, &rpc_msg, buffer, size, MSHCTX_DIFFERENTMACHINE);
 307     next = LPSAFEARRAY_UserMarshal(&umcb.Flags, buffer, &lpsa);
 308     ok(next - buffer == expected, "Marshaled %u bytes, expected %u\n", (ULONG) (next - buffer), expected);
 309     ok(lpsa->cLocks == 7, "got lock count %u\n", lpsa->cLocks);
 310
 311     check_safearray(buffer, lpsa);
 312
 313     init_user_marshal_cb(&umcb, &stub_msg, &rpc_msg, buffer, size, MSHCTX_DIFFERENTMACHINE);
 314     LPSAFEARRAY_UserUnmarshal(&umcb.Flags, buffer, &lpsa2);
 315     ok(lpsa2 != NULL, "LPSAFEARRAY didn't unmarshal\n");
 316     if (pSafeArrayGetVartype)
 317     {
 318         pSafeArrayGetVartype(lpsa, &vt);
 319         pSafeArrayGetVartype(lpsa2, &vt2);
 320         ok(vt == vt2, "vts differ %x %x\n", vt, vt2);
 321     }
 322     ok(lpsa2->cLocks == 0, "got lock count %u, expected 0\n", lpsa2->cLocks);
 323     init_user_marshal_cb(&umcb, &stub_msg, &rpc_msg, NULL, 0, MSHCTX_DIFFERENTMACHINE);
 324     LPSAFEARRAY_UserFree(&umcb.Flags, &lpsa2);
 325     HeapFree(GetProcessHeap(), 0, buffer);
 326     lpsa->cLocks = 0;
 327     hr = SafeArrayDestroy(lpsa);
 328     ok(hr == S_OK, "got 0x%08x\n", hr);
 329
 330     /* test NULL safe array */
 331     lpsa = NULL;
 332
 333     init_user_marshal_cb(&umcb, &stub_msg, &rpc_msg, NULL, 0, MSHCTX_DIFFERENTMACHINE);
 334     size = LPSAFEARRAY_UserSize(&umcb.Flags, 0, &lpsa);
 335     expected = 4;
 336     ok(size == expected, "size should be 4 bytes, not %d\n", size);
 337     buffer = HeapAlloc(GetProcessHeap(), 0, size);
 338     init_user_marshal_cb(&umcb, &stub_msg, &rpc_msg, buffer, size, MSHCTX_DIFFERENTMACHINE);
 339     next = LPSAFEARRAY_UserMarshal(&umcb.Flags, buffer, &lpsa);
 340     ok(next - buffer == expected, "Marshaled %u bytes, expected %u\n", (ULONG) (next - buffer), expected);
 341     check_safearray(buffer, lpsa);
 342
 343     init_user_marshal_cb(&umcb, &stub_msg, &rpc_msg, buffer, size, MSHCTX_DIFFERENTMACHINE);
 344     LPSAFEARRAY_UserUnmarshal(&umcb.Flags, buffer, &lpsa2);
 345     ok(lpsa2 == NULL, "NULL LPSAFEARRAY didn't unmarshal\n");
 346     init_user_marshal_cb(&umcb, &stub_msg, &rpc_msg, NULL, 0, MSHCTX_DIFFERENTMACHINE);
 347     LPSAFEARRAY_UserFree(&umcb.Flags, &lpsa2);
 348     HeapFree(GetProcessHeap(), 0, buffer);
 349
 350     sab[0].lLbound = 5;
 351     sab[0].cElements = 10;
 352
 353     lpsa = SafeArrayCreate(VT_R8, 1, sab);
 354     *(double *)lpsa->pvData = 3.1415;
 355
 356     lpsa->cLocks = 7;
 357     init_user_marshal_cb(&umcb, &stub_msg, &rpc_msg, NULL, 0, MSHCTX_DIFFERENTMACHINE);
 358     size = LPSAFEARRAY_UserSize(&umcb.Flags, 1, &lpsa);
 359     expected = (44 + 1 + (sizeof(double) - 1)) & ~(sizeof(double) - 1);
 360     expected += sab[0].cElements * sizeof(double);
 361     ok(size == expected || size == expected + 16, /* win64 */
 362        "size should be %u bytes, not %u\n", expected, size);
 363     init_user_marshal_cb(&umcb, &stub_msg, &rpc_msg, NULL, 0, MSHCTX_DIFFERENTMACHINE);
 364     expected = (44 + (sizeof(double) - 1)) & ~(sizeof(double) - 1);
 365     expected += sab[0].cElements * sizeof(double);
 366     size = LPSAFEARRAY_UserSize(&umcb.Flags, 0, &lpsa);
 367     ok(size == expected || size == expected + 8, /* win64 */
 368        "size should be %u bytes, not %u\n", expected, size);
 369     buffer = HeapAlloc(GetProcessHeap(), 0, size);
 370     init_user_marshal_cb(&umcb, &stub_msg, &rpc_msg, buffer, size, MSHCTX_DIFFERENTMACHINE);
 371     next = LPSAFEARRAY_UserMarshal(&umcb.Flags, buffer, &lpsa);
 372     ok(next - buffer == expected || broken(next - buffer + sizeof(DWORD) == expected),
 373             "Marshaled %u bytes, expected %u\n", (ULONG) (next - buffer), expected);
 374
 375     check_safearray(buffer, lpsa);
 376
 377     HeapFree(GetProcessHeap(), 0, buffer);
 378     lpsa->cLocks = 0;
 379     hr = SafeArrayDestroy(lpsa);
 380     ok(hr == S_OK, "got 0x%08x\n", hr);
 381
 382     /* VARTYPE-less arrays can be marshaled if cbElements is 1,2,4 or 8 as type SF_In */
 383     hr = SafeArrayAllocDescriptor(1, &lpsa);
 384     ok(hr == S_OK, "saad failed %08x\n", hr);
 385     lpsa->cbElements = 8;
 386     lpsa->rgsabound[0].lLbound = 2;
 387     lpsa->rgsabound[0].cElements = 48;
 388     hr = SafeArrayAllocData(lpsa);
 389     ok(hr == S_OK, "saad failed %08x\n", hr);
 390
 391     if (pSafeArrayGetVartype)
 392     {
 393         hr = pSafeArrayGetVartype(lpsa, &vt);
 394         ok(hr == E_INVALIDARG, "ret %08x\n", hr);
 395     }
 396
 397     init_user_marshal_cb(&umcb, &stub_msg, &rpc_msg, NULL, 0, MSHCTX_DIFFERENTMACHINE);
 398     size = LPSAFEARRAY_UserSize(&umcb.Flags, 0, &lpsa);
 399     expected = (44 + lpsa->cbElements - 1) & ~(lpsa->cbElements - 1);
 400     expected += lpsa->cbElements * lpsa->rgsabound[0].cElements;
 401     ok(size == expected || size == expected + 8,  /* win64 */
 402        "size should be %u bytes, not %u\n", expected, size);
 403     buffer = HeapAlloc(GetProcessHeap(), 0, size);
 404     init_user_marshal_cb(&umcb, &stub_msg, &rpc_msg, buffer, size, MSHCTX_DIFFERENTMACHINE);
 405     next = LPSAFEARRAY_UserMarshal(&umcb.Flags, buffer, &lpsa);
 406     ok(next - buffer == expected || broken(next - buffer + sizeof(DWORD) == expected),
 407             "Marshaled %u bytes, expected %u\n", (ULONG) (next - buffer), expected);
 408     check_safearray(buffer, lpsa);
 409     HeapFree(GetProcessHeap(), 0, buffer);
 410     hr = SafeArrayDestroyData(lpsa);
 411     ok(hr == S_OK, "got 0x%08x\n", hr);
 412     hr = SafeArrayDestroyDescriptor(lpsa);
 413     ok(hr == S_OK, "got 0x%08x\n", hr);
 414
 415     /* Test an array of VT_BSTR */
 416     sab[0].lLbound = 3;
 417     sab[0].cElements = ARRAY_SIZE(values);
 418
 419     lpsa = SafeArrayCreate(VT_BSTR, 1, sab);
 420     expected_bstr_size = 0;
 421     for (i = 0; i < sab[0].cElements; i++)
 422     {
 423         int j;
 424         WCHAR buf[128];
 425         for (j = 0; j <= i; j++)
 426             buf[j] = 'a' + j;
 427         buf[j] = 0;
 428         indices[0] = i + sab[0].lLbound;
 429         values[i] = SysAllocString(buf);
 430         hr = SafeArrayPutElement(lpsa, indices, values[i]);
 431         ok(hr == S_OK, "Failed to put bstr element hr 0x%x\n", hr);
 432         expected_bstr_size += (j * sizeof(WCHAR)) + (3 * sizeof(DWORD));
 433         if (i % 2 == 0) /* Account for DWORD padding.  Works so long as cElements is even */
 434             expected_bstr_size += sizeof(WCHAR);
 435     }
 436
 437     init_user_marshal_cb(&umcb, &stub_msg, &rpc_msg, NULL, 0, MSHCTX_DIFFERENTMACHINE);
 438     size = LPSAFEARRAY_UserSize(&umcb.Flags, 1, &lpsa);
 439     expected = 44 + (sab[0].cElements * sizeof(DWORD)) + expected_bstr_size;
 440     todo_wine
 441     ok(size == expected + sizeof(DWORD) || size  == (expected + sizeof(DWORD) + 12 /* win64 */),
 442             "size should be %u bytes, not %u\n", expected + (ULONG) sizeof(DWORD), size);
 443     init_user_marshal_cb(&umcb, &stub_msg, &rpc_msg, NULL, 0, MSHCTX_DIFFERENTMACHINE);
 444     size = LPSAFEARRAY_UserSize(&umcb.Flags, 0, &lpsa);
 445     todo_wine
 446     ok(size == expected || size  == (expected + 12 /* win64 */),
 447         "size should be %u bytes, not %u\n", expected, size);
 448     buffer = HeapAlloc(GetProcessHeap(), 0, size);
 449     memset(buffer, 0xcc, size);
 450     init_user_marshal_cb(&umcb, &stub_msg, &rpc_msg, buffer, size, MSHCTX_DIFFERENTMACHINE);
 451     next = LPSAFEARRAY_UserMarshal(&umcb.Flags, buffer, &lpsa);
 452     todo_wine
 453     ok(next - buffer == expected, "Marshaled %u bytes, expected %u\n", (ULONG) (next - buffer), expected);
 454
 455     check_safearray(buffer, lpsa);
 456
 457     lpsa2 = NULL;
 458     init_user_marshal_cb(&umcb, &stub_msg, &rpc_msg, buffer, size, MSHCTX_DIFFERENTMACHINE);
 459     next = LPSAFEARRAY_UserUnmarshal(&umcb.Flags, buffer, &lpsa2);
 460     todo_wine
 461     ok(next - buffer == expected, "Marshaled %u bytes, expected %u\n", (ULONG) (next - buffer), expected);
 462     ok(lpsa2 != NULL, "LPSAFEARRAY didn't unmarshal, result %p\n", next);
 463
 464     for (i = 0; i < ARRAY_SIZE(values); i++)
 465     {
 466         BSTR gotvalue = NULL;
 467
 468         if (lpsa2)
 469         {
 470             indices[0] = i + sab[0].lLbound;
 471             hr = SafeArrayGetElement(lpsa2, indices, &gotvalue);
 472             ok(hr == S_OK, "Failed to get bstr element at hres 0x%x\n", hr);
 473             if (hr == S_OK)
 474             {
 475                 ok(VarBstrCmp(values[i], gotvalue, 0, 0) == VARCMP_EQ, "String %d does not match\n", i);
 476                 SysFreeString(gotvalue);
 477             }
 478         }
 479
 480         SysFreeString(values[i]);
 481     }
 482
 483     init_user_marshal_cb(&umcb, &stub_msg, &rpc_msg, NULL, 0, MSHCTX_DIFFERENTMACHINE);
 484     LPSAFEARRAY_UserFree(&umcb.Flags, &lpsa2);
 485
 486     HeapFree(GetProcessHeap(), 0, buffer);
 487     hr = SafeArrayDestroy(lpsa);
 488     ok(hr == S_OK, "got 0x%08x\n", hr);
 489
 490     /* VARTYPE-less arrays with FADF_VARIANT */
 491     hr = SafeArrayAllocDescriptor(1, &lpsa);
 492     ok(hr == S_OK, "saad failed %08x\n", hr);
 493     lpsa->cbElements = sizeof(VARIANT);
 494     lpsa->fFeatures = FADF_VARIANT;
 495     lpsa->rgsabound[0].lLbound = 2;
 496     lpsa->rgsabound[0].cElements = 48;
 497     hr = SafeArrayAllocData(lpsa);
 498     ok(hr == S_OK, "saad failed %08x\n", hr);
 499
 500     if (pSafeArrayGetVartype)
 501     {
 502         hr = pSafeArrayGetVartype(lpsa, &vt);
 503         ok(hr == E_INVALIDARG, "ret %08x\n", hr);
 504     }
 505
 506     init_user_marshal_cb(&umcb, &stub_msg, &rpc_msg, NULL, 0, MSHCTX_DIFFERENTMACHINE);
 507     size = LPSAFEARRAY_UserSize(&umcb.Flags, 0, &lpsa);
 508     expected = 44 + 28 * lpsa->rgsabound[0].cElements;
 509     todo_wine
 510     ok(size == expected || size == expected + 8,  /* win64 */
 511        "size should be %u bytes, not %u\n", expected, size);
 512     buffer = HeapAlloc(GetProcessHeap(), 0, size);
 513     init_user_marshal_cb(&umcb, &stub_msg, &rpc_msg, buffer, size, MSHCTX_DIFFERENTMACHINE);
 514     next = LPSAFEARRAY_UserMarshal(&umcb.Flags, buffer, &lpsa);
 515     todo_wine
 516     ok(next - buffer == expected || broken(next - buffer + sizeof(DWORD) == expected),
 517             "Marshaled %u bytes, expected %u\n", (ULONG) (next - buffer), expected);
 518     lpsa->cbElements = 16;  /* VARIANT wire size */
 519     check_safearray(buffer, lpsa);
 520     HeapFree(GetProcessHeap(), 0, buffer);
 521     hr = SafeArrayDestroyData(lpsa);
 522     ok(hr == S_OK, "got 0x%08x\n", hr);
 523     hr = SafeArrayDestroyDescriptor(lpsa);
 524     ok(hr == S_OK, "got 0x%08x\n", hr);
 525 }
 526
 527 static void check_bstr(void *buffer, BSTR b)
 528 {
 529     DWORD *wireb = buffer;
 530     DWORD len = SysStringByteLen(b);
 531
 532     ok(*wireb == (len + 1) / 2, "wv[0] %08x\n", *wireb);
 533     wireb++;
 534     if(b)
 535         ok(*wireb == len, "wv[1] %08x\n", *wireb);
 536     else
 537         ok(*wireb == 0xffffffff, "wv[1] %08x\n", *wireb);
 538     wireb++;
 539     ok(*wireb == (len + 1) / 2, "wv[2] %08x\n", *wireb);
 540     if(len)
 541     {
 542         wireb++;
 543         ok(!memcmp(wireb, b, (len + 1) & ~1), "strings differ\n");
 544     }
 545     return;
 546 }
 547
 548 static void test_marshal_BSTR(void)
 549 {
 550     ULONG size;
 551     RPC_MESSAGE rpc_msg;
 552     MIDL_STUB_MESSAGE stub_msg;
 553     USER_MARSHAL_CB umcb;
 554     unsigned char *buffer, *next;
 555     BSTR b, b2;
 556     WCHAR str[] = {'m','a','r','s','h','a','l',' ','t','e','s','t','1',0};
 557     DWORD len;
 558
 559     b = SysAllocString(str);
 560     len = SysStringLen(b);
 561     ok(len == 13, "get %d\n", len);
 562
 563     /* BSTRs are DWORD aligned */
 564
 565     init_user_marshal_cb(&umcb, &stub_msg, &rpc_msg, NULL, 0, MSHCTX_DIFFERENTMACHINE);
 566     size = BSTR_UserSize(&umcb.Flags, 1, &b);
 567     ok(size == 42, "size %d\n", size);
 568
 569     init_user_marshal_cb(&umcb, &stub_msg, &rpc_msg, NULL, 0, MSHCTX_DIFFERENTMACHINE);
 570     size = BSTR_UserSize(&umcb.Flags, 0, &b);
 571     ok(size == 38, "size %d\n", size);
 572
 573     buffer = HeapAlloc(GetProcessHeap(), 0, size);
 574     init_user_marshal_cb(&umcb, &stub_msg, &rpc_msg, buffer, size, MSHCTX_DIFFERENTMACHINE);
 575     next = BSTR_UserMarshal(&umcb.Flags, buffer, &b);
 576     ok(next == buffer + size, "got %p expect %p\n", next, buffer + size);
 577     check_bstr(buffer, b);
 578
 579     b2 = NULL;
 580     init_user_marshal_cb(&umcb, &stub_msg, &rpc_msg, buffer, size, MSHCTX_DIFFERENTMACHINE);
 581     next = BSTR_UserUnmarshal(&umcb.Flags, buffer, &b2);
 582     ok(next == buffer + size, "got %p expect %p\n", next, buffer + size);
 583     ok(b2 != NULL, "BSTR didn't unmarshal\n");
 584     ok(!memcmp(b, b2, (len + 1) * 2), "strings differ\n");
 585     init_user_marshal_cb(&umcb, &stub_msg, &rpc_msg, NULL, 0, MSHCTX_DIFFERENTMACHINE);
 586     BSTR_UserFree(&umcb.Flags, &b2);
 587
 588     HeapFree(GetProcessHeap(), 0, buffer);
 589     SysFreeString(b);
 590
 591     b = NULL;
 592     init_user_marshal_cb(&umcb, &stub_msg, &rpc_msg, NULL, 0, MSHCTX_DIFFERENTMACHINE);
 593     size = BSTR_UserSize(&umcb.Flags, 0, &b);
 594     ok(size == 12, "size %d\n", size);
 595
 596     buffer = HeapAlloc(GetProcessHeap(), 0, size);
 597     init_user_marshal_cb(&umcb, &stub_msg, &rpc_msg, buffer, size, MSHCTX_DIFFERENTMACHINE);
 598     next = BSTR_UserMarshal(&umcb.Flags, buffer, &b);
 599     ok(next == buffer + size, "got %p expect %p\n", next, buffer + size);
 600
 601     check_bstr(buffer, b);
 602     b2 = NULL;
 603     init_user_marshal_cb(&umcb, &stub_msg, &rpc_msg, buffer, size, MSHCTX_DIFFERENTMACHINE);
 604     next = BSTR_UserUnmarshal(&umcb.Flags, buffer, &b2);
 605     ok(next == buffer + size, "got %p expect %p\n", next, buffer + size);
 606     ok(b2 == NULL, "NULL BSTR didn't unmarshal\n");
 607     init_user_marshal_cb(&umcb, &stub_msg, &rpc_msg, NULL, 0, MSHCTX_DIFFERENTMACHINE);
 608     BSTR_UserFree(&umcb.Flags, &b2);
 609     HeapFree(GetProcessHeap(), 0, buffer);
 610
 611     b = SysAllocStringByteLen("abc", 3);
 612     *(((char*)b) + 3) = 'd';
 613     len = SysStringLen(b);
 614     ok(len == 1, "get %d\n", len);
 615     len = SysStringByteLen(b);
 616     ok(len == 3, "get %d\n", len);
 617
 618     init_user_marshal_cb(&umcb, &stub_msg, &rpc_msg, NULL, 0, MSHCTX_DIFFERENTMACHINE);
 619     size = BSTR_UserSize(&umcb.Flags, 0, &b);
 620     ok(size == 16, "size %d\n", size);
 621
 622     buffer = HeapAlloc(GetProcessHeap(), 0, size);
 623     memset(buffer, 0xcc, size);
 624     init_user_marshal_cb(&umcb, &stub_msg, &rpc_msg, buffer, size, MSHCTX_DIFFERENTMACHINE);
 625     next = BSTR_UserMarshal(&umcb.Flags, buffer, &b);
 626     ok(next == buffer + size, "got %p expect %p\n", next, buffer + size);
 627     check_bstr(buffer, b);
 628     ok(buffer[15] == 'd', "buffer[15] %02x\n", buffer[15]);
 629
 630     b2 = NULL;
 631     init_user_marshal_cb(&umcb, &stub_msg, &rpc_msg, buffer, size, MSHCTX_DIFFERENTMACHINE);
 632     next = BSTR_UserUnmarshal(&umcb.Flags, buffer, &b2);
 633     ok(next == buffer + size, "got %p expect %p\n", next, buffer + size);
 634     ok(b2 != NULL, "BSTR didn't unmarshal\n");
 635     ok(!memcmp(b, b2, len), "strings differ\n");
 636     init_user_marshal_cb(&umcb, &stub_msg, &rpc_msg, NULL, 0, MSHCTX_DIFFERENTMACHINE);
 637     BSTR_UserFree(&umcb.Flags, &b2);
 638     HeapFree(GetProcessHeap(), 0, buffer);
 639     SysFreeString(b);
 640
 641     b = SysAllocStringByteLen("", 0);
 642     len = SysStringLen(b);
 643     ok(len == 0, "get %d\n", len);
 644     len = SysStringByteLen(b);
 645     ok(len == 0, "get %d\n", len);
 646
 647     init_user_marshal_cb(&umcb, &stub_msg, &rpc_msg, NULL, 0, MSHCTX_DIFFERENTMACHINE);
 648     size = BSTR_UserSize(&umcb.Flags, 0, &b);
 649     ok(size == 12, "size %d\n", size);
 650
 651     buffer = HeapAlloc(GetProcessHeap(), 0, size);
 652     init_user_marshal_cb(&umcb, &stub_msg, &rpc_msg, buffer, size, MSHCTX_DIFFERENTMACHINE);
 653     next = BSTR_UserMarshal(&umcb.Flags, buffer, &b);
 654     ok(next == buffer + size, "got %p expect %p\n", next, buffer + size);
 655     check_bstr(buffer, b);
 656
 657     b2 = NULL;
 658     init_user_marshal_cb(&umcb, &stub_msg, &rpc_msg, buffer, size, MSHCTX_DIFFERENTMACHINE);
 659     next = BSTR_UserUnmarshal(&umcb.Flags, buffer, &b2);
 660     ok(next == buffer + size, "got %p expect %p\n", next, buffer + size);
 661     ok(b2 != NULL, "NULL LPSAFEARRAY didn't unmarshal\n");
 662     len = SysStringByteLen(b2);
 663     ok(len == 0, "byte len %d\n", len);
 664     init_user_marshal_cb(&umcb, &stub_msg, &rpc_msg, NULL, 0, MSHCTX_DIFFERENTMACHINE);
 665     BSTR_UserFree(&umcb.Flags, &b2);
 666     HeapFree(GetProcessHeap(), 0, buffer);
 667     SysFreeString(b);
 668 }
 669
 670 typedef struct
 671 {
 672     IUnknown IUnknown_iface;
 673     ULONG refs;
 674 } HeapUnknown;
 675
 676 static inline HeapUnknown *impl_from_IUnknown(IUnknown *iface)
 677 {
 678     return CONTAINING_RECORD(iface, HeapUnknown, IUnknown_iface);
 679 }
 680
 681 static HRESULT WINAPI HeapUnknown_QueryInterface(IUnknown *iface, REFIID riid, void **ppv)
 682 {
 683     if (IsEqualIID(riid, &IID_IUnknown))
 684     {
 685         IUnknown_AddRef(iface);
 686         *ppv = iface;
 687         return S_OK;
 688     }
 689     *ppv = NULL;
 690     return E_NOINTERFACE;
 691 }
 692
 693 static ULONG WINAPI HeapUnknown_AddRef(IUnknown *iface)
 694 {
 695     HeapUnknown *This = impl_from_IUnknown(iface);
 696     return InterlockedIncrement((LONG*)&This->refs);
 697 }
 698
 699 static ULONG WINAPI HeapUnknown_Release(IUnknown *iface)
 700 {
 701     HeapUnknown *This = impl_from_IUnknown(iface);
 702     ULONG refs = InterlockedDecrement((LONG*)&This->refs);
 703     if (!refs) HeapFree(GetProcessHeap(), 0, This);
 704     return refs;
 705 }
 706
 707 static const IUnknownVtbl HeapUnknown_Vtbl =
 708 {
 709     HeapUnknown_QueryInterface,
 710     HeapUnknown_AddRef,
 711     HeapUnknown_Release
 712 };
 713
 714 typedef struct
 715 {
 716     DWORD clSize;
 717     DWORD rpcReserved;
 718     USHORT vt;
 719     USHORT wReserved1;
 720     USHORT wReserved2;
 721     USHORT wReserved3;
 722     DWORD switch_is;
 723 } variant_wire_t;
 724
 725 static DWORD *check_variant_header(DWORD *wirev, VARIANT *v, ULONG size)
 726 {
 727     const variant_wire_t *header = (const variant_wire_t*)wirev;
 728     DWORD switch_is;
 729
 730     ok(header->clSize == (size + 7) >> 3, "wv[0] %08x, expected %08x\n", header->clSize, (size + 7) >> 3);
 731     ok(header->rpcReserved == 0, "wv[1] %08x\n", header->rpcReserved);
 732     ok(header->vt == V_VT(v), "vt %04x expected %04x\n", header->vt, V_VT(v));
 733     ok(header->wReserved1 == V_U2(v).wReserved1, "res1 %04x expected %04x\n", header->wReserved1, V_U2(v).wReserved1);
 734     ok(header->wReserved2 == V_U2(v).wReserved2, "res2 %04x expected %04x\n", header->wReserved2, V_U2(v).wReserved2);
 735     ok(header->wReserved3 == V_U2(v).wReserved3, "res3 %04x expected %04x\n", header->wReserved3, V_U2(v).wReserved3);
 736
 737     switch_is = V_VT(v);
 738     if(switch_is & VT_ARRAY)
 739         switch_is &= ~VT_TYPEMASK;
 740     ok(header->switch_is == switch_is, "switch_is %08x expected %08x\n", header->switch_is, switch_is);
 741
 742     return (DWORD*)((unsigned char*)wirev + sizeof(variant_wire_t));
 743 }
 744
 745 /* Win9x and WinME don't always align as needed. Variants have
 746  * an alignment of 8.
 747  */
 748 static void *alloc_aligned(SIZE_T size, void **buf)
 749 {
 750     *buf = HeapAlloc(GetProcessHeap(), 0, size + 7);
 751     return (void *)(((UINT_PTR)*buf + 7) & ~7);
 752 }
 753
 754 static void test_marshal_VARIANT(void)
 755 {
 756     VARIANT v, v2, v3;
 757     MIDL_STUB_MESSAGE stubMsg = { 0 };
 758     RPC_MESSAGE rpcMsg = { 0 };
 759     USER_MARSHAL_CB umcb = { 0 };
 760     unsigned char *buffer, *next;
 761     void *oldbuffer;
 762     ULONG ul;
 763     short s;
 764     double d;
 765     void *mem;
 766     DWORD *wirev;
 767     BSTR b, b2;
 768     WCHAR str[] = {'m','a','r','s','h','a','l',' ','t','e','s','t',0};
 769     SAFEARRAYBOUND sab;
 770     LPSAFEARRAY lpsa, lpsa2, lpsa_copy;
 771     DECIMAL dec, dec2;
 772     HeapUnknown *heap_unknown;
 773     DWORD expected;
 774     HRESULT hr;
 775     LONG bound, bound2;
 776     VARTYPE vt, vt2;
 777     IUnknown *unk;
 778
 779     stubMsg.RpcMsg = &rpcMsg;
 780
 781     umcb.Flags = MAKELONG(MSHCTX_DIFFERENTMACHINE, NDR_LOCAL_DATA_REPRESENTATION);
 782     umcb.pStubMsg = &stubMsg;
 783     umcb.pReserve = NULL;
 784     umcb.Signature = USER_MARSHAL_CB_SIGNATURE;
 785     umcb.CBType = USER_MARSHAL_CB_UNMARSHALL;
 786
 787     /*** I1 ***/
 788     VariantInit(&v);
 789     V_VT(&v) = VT_I1;
 790     V_I1(&v) = 0x12;
 791
 792     /* check_variant_header tests wReserved[123], so initialize to unique values.
 793      * (Could probably also do this by setting the variant to a known DECIMAL.)
 794      */
 795     V_U2(&v).wReserved1 = 0x1234;
 796     V_U2(&v).wReserved2 = 0x5678;
 797     V_U2(&v).wReserved3 = 0x9abc;
 798
 799     /* Variants have an alignment of 8 */
 800     rpcMsg.BufferLength = stubMsg.BufferLength = VARIANT_UserSize(&umcb.Flags, 1, &v);
 801     ok(stubMsg.BufferLength == 29, "size %d\n", stubMsg.BufferLength);
 802
 803     rpcMsg.BufferLength = stubMsg.BufferLength = VARIANT_UserSize(&umcb.Flags, 0, &v);
 804     ok(stubMsg.BufferLength == 21, "size %d\n", stubMsg.BufferLength);
 805
 806     buffer = rpcMsg.Buffer = stubMsg.Buffer = stubMsg.BufferStart = alloc_aligned(stubMsg.BufferLength, &oldbuffer);
 807     stubMsg.BufferEnd = stubMsg.Buffer + stubMsg.BufferLength;
 808     next = VARIANT_UserMarshal(&umcb.Flags, buffer, &v);
 809     ok(next == buffer + stubMsg.BufferLength, "got %p expect %p\n", next, buffer + stubMsg.BufferLength);
 810     wirev = (DWORD*)buffer;
 811
 812     wirev = check_variant_header(wirev, &v, stubMsg.BufferLength);
 813     ok(*(char*)wirev == V_I1(&v), "wv[5] %08x\n", *wirev);
 814     VariantInit(&v2);
 815     stubMsg.Buffer = buffer;
 816     next = VARIANT_UserUnmarshal(&umcb.Flags, buffer, &v2);
 817     ok(next == buffer + stubMsg.BufferLength, "got %p expect %p\n", next, buffer + stubMsg.BufferLength);
 818     ok(V_VT(&v) == V_VT(&v2), "got vt %d expect %d\n", V_VT(&v), V_VT(&v2));
 819     ok(V_I1(&v) == V_I1(&v2), "got i1 %x expect %x\n", V_I1(&v), V_I1(&v2));
 820
 821     VARIANT_UserFree(&umcb.Flags, &v2);
 822     HeapFree(GetProcessHeap(), 0, oldbuffer);
 823
 824     /*** I2 ***/
 825     VariantInit(&v);
 826     V_VT(&v) = VT_I2;
 827     V_I2(&v) = 0x1234;
 828
 829     rpcMsg.BufferLength = stubMsg.BufferLength = VARIANT_UserSize(&umcb.Flags, 0, &v);
 830     ok(stubMsg.BufferLength == 22, "size %d\n", stubMsg.BufferLength);
 831
 832     buffer = rpcMsg.Buffer = stubMsg.Buffer = stubMsg.BufferStart = alloc_aligned(stubMsg.BufferLength, &oldbuffer);
 833     stubMsg.BufferEnd = stubMsg.Buffer + stubMsg.BufferLength;
 834     next = VARIANT_UserMarshal(&umcb.Flags, buffer, &v);
 835     ok(next == buffer + stubMsg.BufferLength, "got %p expect %p\n", next, buffer + stubMsg.BufferLength);
 836     wirev = (DWORD*)buffer;
 837
 838     wirev = check_variant_header(wirev, &v, stubMsg.BufferLength);
 839     ok(*(short*)wirev == V_I2(&v), "wv[5] %08x\n", *wirev);
 840     VariantInit(&v2);
 841     stubMsg.Buffer = buffer;
 842     next = VARIANT_UserUnmarshal(&umcb.Flags, buffer, &v2);
 843     ok(next == buffer + stubMsg.BufferLength, "got %p expect %p\n", next, buffer + stubMsg.BufferLength);
 844     ok(V_VT(&v) == V_VT(&v2), "got vt %d expect %d\n", V_VT(&v), V_VT(&v2));
 845     ok(V_I2(&v) == V_I2(&v2), "got i2 %x expect %x\n", V_I2(&v), V_I2(&v2));
 846
 847     VARIANT_UserFree(&umcb.Flags, &v2);
 848     HeapFree(GetProcessHeap(), 0, oldbuffer);
 849
 850     /*** I2 BYREF ***/
 851     VariantInit(&v);
 852     V_VT(&v) = VT_I2 | VT_BYREF;
 853     s = 0x1234;
 854     V_I2REF(&v) = &s;
 855
 856     rpcMsg.BufferLength = stubMsg.BufferLength = VARIANT_UserSize(&umcb.Flags, 0, &v);
 857     ok(stubMsg.BufferLength == 26, "size %d\n", stubMsg.BufferLength);
 858
 859     buffer = rpcMsg.Buffer = stubMsg.Buffer = stubMsg.BufferStart = alloc_aligned(stubMsg.BufferLength, &oldbuffer);
 860     stubMsg.BufferEnd = stubMsg.Buffer + stubMsg.BufferLength;
 861     next = VARIANT_UserMarshal(&umcb.Flags, buffer, &v);
 862     ok(next == buffer + stubMsg.BufferLength, "got %p expect %p\n", next, buffer + stubMsg.BufferLength);
 863     wirev = (DWORD*)buffer;
 864
 865     wirev = check_variant_header(wirev, &v, stubMsg.BufferLength);
 866     ok(*wirev == 0x4, "wv[5] %08x\n", *wirev);
 867     wirev++;
 868     ok(*(short*)wirev == s, "wv[6] %08x\n", *wirev);
 869     VariantInit(&v2);
 870     V_VT(&v2) = VT_I2 | VT_BYREF;
 871     V_BYREF(&v2) = mem = CoTaskMemAlloc(sizeof(V_I2(&v2)));
 872     stubMsg.Buffer = buffer;
 873     next = VARIANT_UserUnmarshal(&umcb.Flags, buffer, &v2);
 874     ok(next == buffer + stubMsg.BufferLength, "got %p expect %p\n", next, buffer + stubMsg.BufferLength);
 875     ok(V_VT(&v) == V_VT(&v2), "got vt %d expect %d\n", V_VT(&v), V_VT(&v2));
 876     ok(V_BYREF(&v2) == mem, "didn't reuse existing memory\n");
 877     ok(*V_I2REF(&v) == *V_I2REF(&v2), "got i2 ref %x expect ui4 ref %x\n", *V_I2REF(&v), *V_I2REF(&v2));
 878
 879     VARIANT_UserFree(&umcb.Flags, &v2);
 880     HeapFree(GetProcessHeap(), 0, oldbuffer);
 881
 882     /*** I4 ***/
 883     VariantInit(&v);
 884     V_VT(&v) = VT_I4;
 885     V_I4(&v) = 0x1234;
 886
 887     rpcMsg.BufferLength = stubMsg.BufferLength = VARIANT_UserSize(&umcb.Flags, 0, &v);
 888     ok(stubMsg.BufferLength == 24, "size %d\n", stubMsg.BufferLength);
 889
 890     buffer = rpcMsg.Buffer = stubMsg.Buffer = stubMsg.BufferStart = alloc_aligned(stubMsg.BufferLength, &oldbuffer);
 891     stubMsg.BufferEnd = stubMsg.Buffer + stubMsg.BufferLength;
 892     next = VARIANT_UserMarshal(&umcb.Flags, buffer, &v);
 893     ok(next == buffer + stubMsg.BufferLength, "got %p expect %p\n", next, buffer + stubMsg.BufferLength);
 894     wirev = (DWORD*)buffer;
 895
 896     wirev = check_variant_header(wirev, &v, stubMsg.BufferLength);
 897     ok(*wirev == V_I4(&v), "wv[5] %08x\n", *wirev);
 898
 899     VariantInit(&v2);
 900     stubMsg.Buffer = buffer;
 901     next = VARIANT_UserUnmarshal(&umcb.Flags, buffer, &v2);
 902     ok(next == buffer + stubMsg.BufferLength, "got %p expect %p\n", next, buffer + stubMsg.BufferLength);
 903     ok(V_VT(&v) == V_VT(&v2), "got vt %d expect %d\n", V_VT(&v), V_VT(&v2));
 904     ok(V_I4(&v) == V_I4(&v2), "got i4 %x expect %x\n", V_I4(&v), V_I4(&v2));
 905
 906     VARIANT_UserFree(&umcb.Flags, &v2);
 907     HeapFree(GetProcessHeap(), 0, oldbuffer);
 908
 909     /*** UI4 ***/
 910     VariantInit(&v);
 911     V_VT(&v) = VT_UI4;
 912     V_UI4(&v) = 0x1234;
 913
 914     rpcMsg.BufferLength = stubMsg.BufferLength = VARIANT_UserSize(&umcb.Flags, 0, &v);
 915     ok(stubMsg.BufferLength == 24, "size %d\n", stubMsg.BufferLength);
 916
 917     buffer = rpcMsg.Buffer = stubMsg.Buffer = stubMsg.BufferStart = alloc_aligned(stubMsg.BufferLength, &oldbuffer);
 918     stubMsg.BufferEnd = stubMsg.Buffer + stubMsg.BufferLength;
 919     next = VARIANT_UserMarshal(&umcb.Flags, buffer, &v);
 920     ok(next == buffer + stubMsg.BufferLength, "got %p expect %p\n", next, buffer + stubMsg.BufferLength);
 921     wirev = (DWORD*)buffer;
 922
 923     wirev = check_variant_header(wirev, &v, stubMsg.BufferLength);
 924     ok(*wirev == 0x1234, "wv[5] %08x\n", *wirev);
 925     VariantInit(&v2);
 926     stubMsg.Buffer = buffer;
 927     next = VARIANT_UserUnmarshal(&umcb.Flags, buffer, &v2);
 928     ok(next == buffer + stubMsg.BufferLength, "got %p expect %p\n", next, buffer + stubMsg.BufferLength);
 929     ok(V_VT(&v) == V_VT(&v2), "got vt %d expect %d\n", V_VT(&v), V_VT(&v2));
 930     ok(V_UI4(&v) == V_UI4(&v2), "got ui4 %x expect %x\n", V_UI4(&v), V_UI4(&v2));
 931
 932     VARIANT_UserFree(&umcb.Flags, &v2);
 933     HeapFree(GetProcessHeap(), 0, oldbuffer);
 934
 935     /*** UI4 BYREF ***/
 936     VariantInit(&v);
 937     V_VT(&v) = VT_UI4 | VT_BYREF;
 938     ul = 0x1234;
 939     V_UI4REF(&v) = &ul;
 940
 941     rpcMsg.BufferLength = stubMsg.BufferLength = VARIANT_UserSize(&umcb.Flags, 0, &v);
 942     ok(stubMsg.BufferLength == 28, "size %d\n", stubMsg.BufferLength);
 943
 944     buffer = rpcMsg.Buffer = stubMsg.Buffer = stubMsg.BufferStart = alloc_aligned(stubMsg.BufferLength, &oldbuffer);
 945     stubMsg.BufferEnd = stubMsg.Buffer + stubMsg.BufferLength;
 946     next = VARIANT_UserMarshal(&umcb.Flags, buffer, &v);
 947     ok(next == buffer + stubMsg.BufferLength, "got %p expect %p\n", next, buffer + stubMsg.BufferLength);
 948     wirev = (DWORD*)buffer;
 949
 950     wirev = check_variant_header(wirev, &v, stubMsg.BufferLength);
 951     ok(*wirev == 0x4, "wv[5] %08x\n", *wirev);
 952     wirev++;
 953     ok(*wirev == ul, "wv[6] %08x\n", *wirev);
 954
 955     VariantInit(&v2);
 956     stubMsg.Buffer = buffer;
 957     next = VARIANT_UserUnmarshal(&umcb.Flags, buffer, &v2);
 958     ok(next == buffer + stubMsg.BufferLength, "got %p expect %p\n", next, buffer + stubMsg.BufferLength);
 959     ok(V_VT(&v) == V_VT(&v2), "got vt %d expect %d\n", V_VT(&v), V_VT(&v2));
 960     ok(*V_UI4REF(&v) == *V_UI4REF(&v2), "got ui4 ref %x expect ui4 ref %x\n", *V_UI4REF(&v), *V_UI4REF(&v2));
 961
 962     VARIANT_UserFree(&umcb.Flags, &v2);
 963     HeapFree(GetProcessHeap(), 0, oldbuffer);
 964
 965     /*** I8 ***/
 966     VariantInit(&v);
 967     V_VT(&v) = VT_I8;
 968     V_I8(&v) = (LONGLONG)1000000 * 1000000;
 969
 970     rpcMsg.BufferLength = stubMsg.BufferLength = VARIANT_UserSize(&umcb.Flags, 0, &v);
 971     ok(stubMsg.BufferLength == 32, "size %d\n", stubMsg.BufferLength);
 972
 973     buffer = rpcMsg.Buffer = stubMsg.Buffer = stubMsg.BufferStart = alloc_aligned(stubMsg.BufferLength, &oldbuffer);
 974     stubMsg.BufferEnd = stubMsg.Buffer + stubMsg.BufferLength;
 975     memset(buffer, 0xcc, stubMsg.BufferLength);
 976     next = VARIANT_UserMarshal(&umcb.Flags, buffer, &v);
 977     ok(next == buffer + stubMsg.BufferLength, "got %p expect %p\n", next, buffer + stubMsg.BufferLength);
 978     wirev = (DWORD*)buffer;
 979
 980     wirev = check_variant_header(wirev, &v, stubMsg.BufferLength);
 981     ok(*wirev == 0xcccccccc, "wv[5] %08x\n", *wirev); /* pad */
 982     wirev++;
 983     ok(*(LONGLONG *)wirev == V_I8(&v), "wv[6] %s\n", wine_dbgstr_longlong(*(LONGLONG *)wirev));
 984     VariantInit(&v2);
 985     stubMsg.Buffer = buffer;
 986     next = VARIANT_UserUnmarshal(&umcb.Flags, buffer, &v2);
 987     ok(next == buffer + stubMsg.BufferLength, "got %p expect %p\n", next, buffer + stubMsg.BufferLength);
 988     ok(V_VT(&v) == V_VT(&v2), "got vt %d expect %d\n", V_VT(&v), V_VT(&v2));
 989     ok(V_I8(&v) == V_I8(&v2), "got i8 %s expect %s\n",
 990             wine_dbgstr_longlong(V_I8(&v)), wine_dbgstr_longlong(V_I8(&v2)));
 991
 992     VARIANT_UserFree(&umcb.Flags, &v2);
 993     HeapFree(GetProcessHeap(), 0, oldbuffer);
 994
 995     /*** R4 ***/
 996     VariantInit(&v);
 997     V_VT(&v) = VT_R4;
 998     V_R8(&v) = 3.1415;
 999
1000     rpcMsg.BufferLength = stubMsg.BufferLength = VARIANT_UserSize(&umcb.Flags, 0, &v);
1001     ok(stubMsg.BufferLength == 24, "size %d\n", stubMsg.BufferLength);
1002
1003     buffer = rpcMsg.Buffer = stubMsg.Buffer = stubMsg.BufferStart = alloc_aligned(stubMsg.BufferLength, &oldbuffer);
1004     stubMsg.BufferEnd = stubMsg.Buffer + stubMsg.BufferLength;
1005     next = VARIANT_UserMarshal(&umcb.Flags, buffer, &v);
1006     ok(next == buffer + stubMsg.BufferLength, "got %p expect %p\n", next, buffer + stubMsg.BufferLength);
1007     wirev = (DWORD*)buffer;
1008
1009     wirev = check_variant_header(wirev, &v, stubMsg.BufferLength);
1010     ok(*(float*)wirev == V_R4(&v), "wv[5] %08x\n", *wirev);
1011     VariantInit(&v2);
1012     stubMsg.Buffer = buffer;
1013     next = VARIANT_UserUnmarshal(&umcb.Flags, buffer, &v2);
1014     ok(next == buffer + stubMsg.BufferLength, "got %p expect %p\n", next, buffer + stubMsg.BufferLength);
1015     ok(V_VT(&v) == V_VT(&v2), "got vt %d expect %d\n", V_VT(&v), V_VT(&v2));
1016     ok(V_R4(&v) == V_R4(&v2), "got r4 %f expect %f\n", V_R4(&v), V_R4(&v2));
1017
1018     VARIANT_UserFree(&umcb.Flags, &v2);
1019     HeapFree(GetProcessHeap(), 0, oldbuffer);
1020
1021     /*** R8 ***/
1022     VariantInit(&v);
1023     V_VT(&v) = VT_R8;
1024     V_R8(&v) = 3.1415;
1025
1026     rpcMsg.BufferLength = stubMsg.BufferLength = VARIANT_UserSize(&umcb.Flags, 0, &v);
1027     ok(stubMsg.BufferLength == 32, "size %d\n", stubMsg.BufferLength);
1028
1029     buffer = rpcMsg.Buffer = stubMsg.Buffer = stubMsg.BufferStart = alloc_aligned(stubMsg.BufferLength, &oldbuffer);
1030     stubMsg.BufferEnd = stubMsg.Buffer + stubMsg.BufferLength;
1031     memset(buffer, 0xcc, stubMsg.BufferLength);
1032     next = VARIANT_UserMarshal(&umcb.Flags, buffer, &v);
1033     ok(next == buffer + stubMsg.BufferLength, "got %p expect %p\n", next, buffer + stubMsg.BufferLength);
1034     wirev = (DWORD*)buffer;
1035
1036     wirev = check_variant_header(wirev, &v, stubMsg.BufferLength);
1037     ok(*wirev == 0xcccccccc, "wv[5] %08x\n", *wirev); /* pad */
1038     wirev++;
1039     ok(*(double*)wirev == V_R8(&v), "wv[6] %08x, wv[7] %08x\n", *wirev, *(wirev+1));
1040     VariantInit(&v2);
1041     stubMsg.Buffer = buffer;
1042     next = VARIANT_UserUnmarshal(&umcb.Flags, buffer, &v2);
1043     ok(next == buffer + stubMsg.BufferLength, "got %p expect %p\n", next, buffer + stubMsg.BufferLength);
1044     ok(V_VT(&v) == V_VT(&v2), "got vt %d expect %d\n", V_VT(&v), V_VT(&v2));
1045     ok(V_R8(&v) == V_R8(&v2), "got r8 %f expect %f\n", V_R8(&v), V_R8(&v2));
1046
1047     VARIANT_UserFree(&umcb.Flags, &v2);
1048     HeapFree(GetProcessHeap(), 0, oldbuffer);
1049
1050     /*** R8 BYREF ***/
1051     VariantInit(&v);
1052     V_VT(&v) = VT_R8 | VT_BYREF;
1053     d = 3.1415;
1054     V_R8REF(&v) = &d;
1055
1056     rpcMsg.BufferLength = stubMsg.BufferLength = VARIANT_UserSize(&umcb.Flags, 0, &v);
1057     ok(stubMsg.BufferLength == 32, "size %d\n", stubMsg.BufferLength);
1058
1059     buffer = rpcMsg.Buffer = stubMsg.Buffer = stubMsg.BufferStart = alloc_aligned(stubMsg.BufferLength, &oldbuffer);
1060     stubMsg.BufferEnd = stubMsg.Buffer + stubMsg.BufferLength;
1061     next = VARIANT_UserMarshal(&umcb.Flags, buffer, &v);
1062     ok(next == buffer + stubMsg.BufferLength, "got %p expect %p\n", next, buffer + stubMsg.BufferLength);
1063     wirev = (DWORD*)buffer;
1064
1065     wirev = check_variant_header(wirev, &v, stubMsg.BufferLength);
1066     ok(*wirev == 8, "wv[5] %08x\n", *wirev);
1067     wirev++;
1068     ok(*(double*)wirev == d, "wv[6] %08x wv[7] %08x\n", *wirev, *(wirev+1));
1069     VariantInit(&v2);
1070     stubMsg.Buffer = buffer;
1071     next = VARIANT_UserUnmarshal(&umcb.Flags, buffer, &v2);
1072     ok(next == buffer + stubMsg.BufferLength, "got %p expect %p\n", next, buffer + stubMsg.BufferLength);
1073     ok(V_VT(&v) == V_VT(&v2), "got vt %d expect %d\n", V_VT(&v), V_VT(&v2));
1074     ok(*V_R8REF(&v) == *V_R8REF(&v2), "got r8 ref %f expect %f\n", *V_R8REF(&v), *V_R8REF(&v2));
1075
1076     VARIANT_UserFree(&umcb.Flags, &v2);
1077     HeapFree(GetProcessHeap(), 0, oldbuffer);
1078
1079     /*** VARIANT_BOOL ***/
1080     VariantInit(&v);
1081     V_VT(&v) = VT_BOOL;
1082     V_BOOL(&v) = 0x1234;
1083
1084     rpcMsg.BufferLength = stubMsg.BufferLength = VARIANT_UserSize(&umcb.Flags, 0, &v);
1085     ok(stubMsg.BufferLength == 22, "size %d\n", stubMsg.BufferLength);
1086
1087     buffer = rpcMsg.Buffer = stubMsg.Buffer = stubMsg.BufferStart = alloc_aligned(stubMsg.BufferLength, &oldbuffer);
1088     stubMsg.BufferEnd = stubMsg.Buffer + stubMsg.BufferLength;
1089     next = VARIANT_UserMarshal(&umcb.Flags, buffer, &v);
1090     ok(next == buffer + stubMsg.BufferLength, "got %p expect %p\n", next, buffer + stubMsg.BufferLength);
1091     wirev = (DWORD*)buffer;
1092
1093     wirev = check_variant_header(wirev, &v, stubMsg.BufferLength);
1094     ok(*(short*)wirev == V_BOOL(&v), "wv[5] %04x\n", *(WORD*)wirev);
1095     VariantInit(&v2);
1096     stubMsg.Buffer = buffer;
1097     next = VARIANT_UserUnmarshal(&umcb.Flags, buffer, &v2);
1098     ok(next == buffer + stubMsg.BufferLength, "got %p expect %p\n", next, buffer + stubMsg.BufferLength);
1099     ok(V_VT(&v) == V_VT(&v2), "got vt %d expect %d\n", V_VT(&v), V_VT(&v2));
1100     ok(V_BOOL(&v) == V_BOOL(&v2), "got bool %x expect %x\n", V_BOOL(&v), V_BOOL(&v2));
1101
1102     VARIANT_UserFree(&umcb.Flags, &v2);
1103     HeapFree(GetProcessHeap(), 0, oldbuffer);
1104
1105     /*** DECIMAL ***/
1106     VarDecFromI4(0x12345678, &dec);
1107     dec.wReserved = 0xfedc;          /* Also initialize reserved field, as we check it later */
1108     VariantInit(&v);
1109     V_DECIMAL(&v) = dec;
1110     V_VT(&v) = VT_DECIMAL;
1111
1112     rpcMsg.BufferLength = stubMsg.BufferLength = VARIANT_UserSize(&umcb.Flags, 0, &v);
1113     ok(stubMsg.BufferLength == 40, "size %d\n", stubMsg.BufferLength);
1114
1115     buffer = rpcMsg.Buffer = stubMsg.Buffer = stubMsg.BufferStart = alloc_aligned(stubMsg.BufferLength, &oldbuffer);
1116     stubMsg.BufferEnd = stubMsg.Buffer + stubMsg.BufferLength;
1117     memset(buffer, 0xcc, stubMsg.BufferLength);
1118     next = VARIANT_UserMarshal(&umcb.Flags, buffer, &v);
1119     ok(next == buffer + stubMsg.BufferLength, "got %p expect %p\n", next, buffer + stubMsg.BufferLength);
1120     wirev = (DWORD*)buffer;
1121
1122     wirev = check_variant_header(wirev, &v, stubMsg.BufferLength);
1123     ok(*wirev == 0xcccccccc, "wirev[5] %08x\n", *wirev); /* pad */
1124     wirev++;
1125     dec2 = dec;
1126     dec2.wReserved = VT_DECIMAL;
1127     ok(!memcmp(wirev, &dec2, sizeof(dec2)), "wirev[6] %08x wirev[7] %08x wirev[8] %08x wirev[9] %08x\n",
1128        *wirev, *(wirev + 1), *(wirev + 2), *(wirev + 3));
1129     VariantInit(&v2);
1130     stubMsg.Buffer = buffer;
1131     next = VARIANT_UserUnmarshal(&umcb.Flags, buffer, &v2);
1132     ok(next == buffer + stubMsg.BufferLength, "got %p expect %p\n", next, buffer + stubMsg.BufferLength);
1133     ok(V_VT(&v) == V_VT(&v2), "got vt %d expect %d\n", V_VT(&v), V_VT(&v2));
1134     ok(!memcmp(&V_DECIMAL(&v), & V_DECIMAL(&v2), sizeof(DECIMAL)), "decimals differ\n");
1135
1136     VARIANT_UserFree(&umcb.Flags, &v2);
1137     HeapFree(GetProcessHeap(), 0, oldbuffer);
1138
1139     /*** DECIMAL BYREF ***/
1140     VariantInit(&v);
1141     V_VT(&v) = VT_DECIMAL | VT_BYREF;
1142     V_DECIMALREF(&v) = &dec;
1143
1144     rpcMsg.BufferLength = stubMsg.BufferLength = VARIANT_UserSize(&umcb.Flags, 0, &v);
1145     ok(stubMsg.BufferLength == 40, "size %d\n", stubMsg.BufferLength);
1146
1147     buffer = rpcMsg.Buffer = stubMsg.Buffer = stubMsg.BufferStart = alloc_aligned(stubMsg.BufferLength, &oldbuffer);
1148     stubMsg.BufferEnd = stubMsg.Buffer + stubMsg.BufferLength;
1149     next = VARIANT_UserMarshal(&umcb.Flags, buffer, &v);
1150     ok(next == buffer + stubMsg.BufferLength, "got %p expect %p\n", next, buffer + stubMsg.BufferLength);
1151     wirev = (DWORD*)buffer;
1152
1153     wirev = check_variant_header(wirev, &v, stubMsg.BufferLength);
1154     ok(*wirev == 16, "wv[5] %08x\n", *wirev);
1155     wirev++;
1156     ok(!memcmp(wirev, &dec, sizeof(dec)), "wirev[6] %08x wirev[7] %08x wirev[8] %08x wirev[9] %08x\n", *wirev, *(wirev + 1), *(wirev + 2), *(wirev + 3));
1157     VariantInit(&v2);
1158     /* check_variant_header tests wReserved[123], so initialize to unique values.
1159      * (Could probably also do this by setting the variant to a known DECIMAL.)
1160      */
1161     V_U2(&v2).wReserved1 = 0x0123;
1162     V_U2(&v2).wReserved2 = 0x4567;
1163     V_U2(&v2).wReserved3 = 0x89ab;
1164
1165     stubMsg.Buffer = buffer;
1166     next = VARIANT_UserUnmarshal(&umcb.Flags, buffer, &v2);
1167     ok(next == buffer + stubMsg.BufferLength, "got %p expect %p\n", next, buffer + stubMsg.BufferLength);
1168     ok(V_VT(&v) == V_VT(&v2), "got vt %d expect %d\n", V_VT(&v), V_VT(&v2));
1169     ok(!memcmp(V_DECIMALREF(&v), V_DECIMALREF(&v2), sizeof(DECIMAL)), "decimals differ\n");
1170
1171     VARIANT_UserFree(&umcb.Flags, &v2);
1172     HeapFree(GetProcessHeap(), 0, oldbuffer);
1173
1174     /*** EMPTY ***/
1175     VariantInit(&v);
1176     V_VT(&v) = VT_EMPTY;
1177
1178     rpcMsg.BufferLength = stubMsg.BufferLength = VARIANT_UserSize(&umcb.Flags, 0, &v);
1179     ok(stubMsg.BufferLength == 20, "size %d\n", stubMsg.BufferLength);
1180
1181     buffer = rpcMsg.Buffer = stubMsg.Buffer = stubMsg.BufferStart = alloc_aligned(stubMsg.BufferLength, &oldbuffer);
1182     stubMsg.BufferEnd = stubMsg.Buffer + stubMsg.BufferLength;
1183     next = VARIANT_UserMarshal(&umcb.Flags, buffer, &v);
1184     ok(next == buffer + stubMsg.BufferLength, "got %p expect %p\n", next, buffer + stubMsg.BufferLength);
1185     wirev = (DWORD*)buffer;
1186
1187     check_variant_header(wirev, &v, stubMsg.BufferLength);
1188     VariantInit(&v2);
1189     stubMsg.Buffer = buffer;
1190     next = VARIANT_UserUnmarshal(&umcb.Flags, buffer, &v2);
1191     ok(next == buffer + stubMsg.BufferLength, "got %p expect %p\n", next, buffer + stubMsg.BufferLength);
1192     ok(V_VT(&v) == V_VT(&v2), "got vt %d expect %d\n", V_VT(&v), V_VT(&v2));
1193
1194     VARIANT_UserFree(&umcb.Flags, &v2);
1195     HeapFree(GetProcessHeap(), 0, oldbuffer);
1196
1197     /*** NULL ***/
1198     VariantInit(&v);
1199     V_VT(&v) = VT_NULL;
1200
1201     rpcMsg.BufferLength = stubMsg.BufferLength = VARIANT_UserSize(&umcb.Flags, 0, &v);
1202     ok(stubMsg.BufferLength == 20, "size %d\n", stubMsg.BufferLength);
1203
1204     buffer = rpcMsg.Buffer = stubMsg.Buffer = stubMsg.BufferStart = alloc_aligned(stubMsg.BufferLength, &oldbuffer);
1205     stubMsg.BufferEnd = stubMsg.Buffer + stubMsg.BufferLength;
1206     next = VARIANT_UserMarshal(&umcb.Flags, buffer, &v);
1207     ok(next == buffer + stubMsg.BufferLength, "got %p expect %p\n", next, buffer + stubMsg.BufferLength);
1208     wirev = (DWORD*)buffer;
1209
1210     check_variant_header(wirev, &v, stubMsg.BufferLength);
1211     VariantInit(&v2);
1212     stubMsg.Buffer = buffer;
1213     next = VARIANT_UserUnmarshal(&umcb.Flags, buffer, &v2);
1214     ok(next == buffer + stubMsg.BufferLength, "got %p expect %p\n", next, buffer + stubMsg.BufferLength);
1215     ok(V_VT(&v) == V_VT(&v2), "got vt %d expect %d\n", V_VT(&v), V_VT(&v2));
1216
1217     VARIANT_UserFree(&umcb.Flags, &v2);
1218     HeapFree(GetProcessHeap(), 0, oldbuffer);
1219
1220     /*** BSTR ***/
1221     b = SysAllocString(str);
1222     VariantInit(&v);
1223     V_VT(&v) = VT_BSTR;
1224     V_BSTR(&v) = b;
1225
1226     rpcMsg.BufferLength = stubMsg.BufferLength = VARIANT_UserSize(&umcb.Flags, 0, &v);
1227     ok(stubMsg.BufferLength == 60, "size %d\n", stubMsg.BufferLength);
1228     buffer = rpcMsg.Buffer = stubMsg.Buffer = stubMsg.BufferStart = alloc_aligned(stubMsg.BufferLength, &oldbuffer);
1229     stubMsg.BufferEnd = stubMsg.Buffer + stubMsg.BufferLength;
1230     next = VARIANT_UserMarshal(&umcb.Flags, buffer, &v);
1231     ok(next == buffer + stubMsg.BufferLength, "got %p expect %p\n", next, buffer + stubMsg.BufferLength);
1232     wirev = (DWORD*)buffer;
1233
1234     wirev = check_variant_header(wirev, &v, stubMsg.BufferLength);
1235     ok(*wirev, "wv[5] %08x\n", *wirev); /* win2k: this is b. winxp: this is (char*)b + 1 */
1236     wirev++;
1237     check_bstr(wirev, V_BSTR(&v));
1238     VariantInit(&v2);
1239     stubMsg.Buffer = buffer;
1240     next = VARIANT_UserUnmarshal(&umcb.Flags, buffer, &v2);
1241     ok(next == buffer + stubMsg.BufferLength, "got %p expect %p\n", next, buffer + stubMsg.BufferLength);
1242     ok(V_VT(&v) == V_VT(&v2), "got vt %d expect %d\n", V_VT(&v), V_VT(&v2));
1243     ok(SysStringByteLen(V_BSTR(&v)) == SysStringByteLen(V_BSTR(&v2)), "bstr string lens differ\n");
1244     ok(!memcmp(V_BSTR(&v), V_BSTR(&v2), SysStringByteLen(V_BSTR(&v))), "bstrs differ\n");
1245
1246     VARIANT_UserFree(&umcb.Flags, &v2);
1247     HeapFree(GetProcessHeap(), 0, oldbuffer);
1248
1249     /*** BSTR BYREF ***/
1250     VariantInit(&v);
1251     V_VT(&v) = VT_BSTR | VT_BYREF;
1252     V_BSTRREF(&v) = &b;
1253
1254     rpcMsg.BufferLength = stubMsg.BufferLength = VARIANT_UserSize(&umcb.Flags, 0, &v);
1255     ok(stubMsg.BufferLength == 64, "size %d\n", stubMsg.BufferLength);
1256     buffer = rpcMsg.Buffer = stubMsg.Buffer = stubMsg.BufferStart = alloc_aligned(stubMsg.BufferLength, &oldbuffer);
1257     stubMsg.BufferEnd = stubMsg.Buffer + stubMsg.BufferLength;
1258     next = VARIANT_UserMarshal(&umcb.Flags, buffer, &v);
1259     ok(next == buffer + stubMsg.BufferLength, "got %p expect %p\n", next, buffer + stubMsg.BufferLength);
1260     wirev = (DWORD*)buffer;
1261
1262     wirev = check_variant_header(wirev, &v, stubMsg.BufferLength);
1263     ok(*wirev == 0x4, "wv[5] %08x\n", *wirev);
1264     wirev++;
1265     ok(*wirev, "wv[6] %08x\n", *wirev); /* win2k: this is b. winxp: this is (char*)b + 1 */
1266     wirev++;
1267     check_bstr(wirev, b);
1268     b2 = SysAllocString(str);
1269     b2[0] = 0;
1270     V_VT(&v2) = VT_BSTR | VT_BYREF;
1271     V_BSTRREF(&v2) = &b2;
1272     mem = b2;
1273     VariantInit(&v2);
1274     stubMsg.Buffer = buffer;
1275     next = VARIANT_UserUnmarshal(&umcb.Flags, buffer, &v2);
1276     ok(next == buffer + stubMsg.BufferLength, "got %p expect %p\n", next, buffer + stubMsg.BufferLength);
1277     ok(mem == b2, "BSTR should be reused\n");
1278     ok(V_VT(&v) == V_VT(&v2), "got vt %d expect %d\n", V_VT(&v), V_VT(&v2));
1279     ok(SysStringByteLen(*V_BSTRREF(&v)) == SysStringByteLen(*V_BSTRREF(&v2)), "bstr string lens differ\n");
1280     ok(!memcmp(*V_BSTRREF(&v), *V_BSTRREF(&v2), SysStringByteLen(*V_BSTRREF(&v))), "bstrs differ\n");
1281
1282     SysFreeString(b2);
1283     HeapFree(GetProcessHeap(), 0, oldbuffer);
1284     SysFreeString(b);
1285
1286     /*** ARRAY ***/
1287     sab.lLbound = 5;
1288     sab.cElements = 10;
1289
1290     lpsa = SafeArrayCreate(VT_R8, 1, &sab);
1291     *(DWORD *)lpsa->pvData = 0xcafebabe;
1292     *((DWORD *)lpsa->pvData + 1) = 0xdeadbeef;
1293
1294     VariantInit(&v);
1295     V_VT(&v) = VT_UI4 | VT_ARRAY;
1296     V_ARRAY(&v) = lpsa;
1297
1298     rpcMsg.BufferLength = stubMsg.BufferLength = VARIANT_UserSize(&umcb.Flags, 0, &v);
1299     expected = 152;
1300     ok(stubMsg.BufferLength == expected || stubMsg.BufferLength == expected + 8, /* win64 */
1301        "size %u instead of %u\n", stubMsg.BufferLength, expected);
1302     buffer = rpcMsg.Buffer = stubMsg.Buffer = stubMsg.BufferStart = alloc_aligned(stubMsg.BufferLength, &oldbuffer);
1303     stubMsg.BufferEnd = stubMsg.Buffer + stubMsg.BufferLength;
1304     next = VARIANT_UserMarshal(&umcb.Flags, buffer, &v);
1305     ok(next == buffer + expected, "got %p expect %p\n", next, buffer + expected);
1306     wirev = (DWORD*)buffer;
1307
1308     wirev = check_variant_header(wirev, &v, expected);
1309     ok(*wirev, "wv[5] %08x\n", *wirev); /* win2k: this is lpsa. winxp: this is (char*)lpsa + 1 */
1310     wirev++;
1311     check_safearray(wirev, lpsa);
1312     VariantInit(&v2);
1313     stubMsg.Buffer = buffer;
1314     next = VARIANT_UserUnmarshal(&umcb.Flags, buffer, &v2);
1315     ok(next == buffer + expected, "got %p expect %p\n", next, buffer + expected);
1316     ok(V_VT(&v) == V_VT(&v2), "got vt %d expect %d\n", V_VT(&v), V_VT(&v2));
1317     ok(SafeArrayGetDim(V_ARRAY(&v)) == SafeArrayGetDim(V_ARRAY(&v2)), "array dims differ\n");
1318     SafeArrayGetLBound(V_ARRAY(&v), 1, &bound);
1319     SafeArrayGetLBound(V_ARRAY(&v2), 1, &bound2);
1320     ok(bound == bound2, "array lbounds differ\n");
1321     SafeArrayGetUBound(V_ARRAY(&v), 1, &bound);
1322     SafeArrayGetUBound(V_ARRAY(&v2), 1, &bound2);
1323     ok(bound == bound2, "array ubounds differ\n");
1324     if (pSafeArrayGetVartype)
1325     {
1326         pSafeArrayGetVartype(V_ARRAY(&v), &vt);
1327         pSafeArrayGetVartype(V_ARRAY(&v2), &vt2);
1328         ok(vt == vt2, "array vts differ %x %x\n", vt, vt2);
1329     }
1330     VARIANT_UserFree(&umcb.Flags, &v2);
1331     HeapFree(GetProcessHeap(), 0, oldbuffer);
1332
1333     /*** ARRAY BYREF ***/
1334     VariantInit(&v);
1335     V_VT(&v) = VT_UI4 | VT_ARRAY | VT_BYREF;
1336     V_ARRAYREF(&v) = &lpsa;
1337
1338     rpcMsg.BufferLength = stubMsg.BufferLength = VARIANT_UserSize(&umcb.Flags, 0, &v);
1339     expected = 152;
1340     ok(stubMsg.BufferLength == expected || stubMsg.BufferLength == expected + 16, /* win64 */
1341        "size %u instead of %u\n", stubMsg.BufferLength, expected);
1342     buffer = rpcMsg.Buffer = stubMsg.Buffer = stubMsg.BufferStart = alloc_aligned(stubMsg.BufferLength, &oldbuffer);
1343     stubMsg.BufferEnd = stubMsg.Buffer + stubMsg.BufferLength;
1344     next = VARIANT_UserMarshal(&umcb.Flags, buffer, &v);
1345     ok(next == buffer + expected, "got %p expect %p\n", next, buffer + expected);
1346     wirev = (DWORD*)buffer;
1347
1348     wirev = check_variant_header(wirev, &v, expected);
1349     ok(*wirev == 4, "wv[5] %08x\n", *wirev);
1350     wirev++;
1351     ok(*wirev, "wv[6] %08x\n", *wirev); /* win2k: this is lpsa. winxp: this is (char*)lpsa + 1 */
1352     wirev++;
1353     check_safearray(wirev, lpsa);
1354     VariantInit(&v2);
1355     stubMsg.Buffer = buffer;
1356     next = VARIANT_UserUnmarshal(&umcb.Flags, buffer, &v2);
1357     ok(next == buffer + expected, "got %p expect %p\n", next, buffer + expected);
1358     ok(V_VT(&v) == V_VT(&v2), "got vt %d expect %d\n", V_VT(&v), V_VT(&v2));
1359     ok(SafeArrayGetDim(*V_ARRAYREF(&v)) == SafeArrayGetDim(*V_ARRAYREF(&v2)), "array dims differ\n");
1360     SafeArrayGetLBound(*V_ARRAYREF(&v), 1, &bound);
1361     SafeArrayGetLBound(*V_ARRAYREF(&v2), 1, &bound2);
1362     ok(bound == bound2, "array lbounds differ\n");
1363     SafeArrayGetUBound(*V_ARRAYREF(&v), 1, &bound);
1364     SafeArrayGetUBound(*V_ARRAYREF(&v2), 1, &bound2);
1365     ok(bound == bound2, "array ubounds differ\n");
1366     if (pSafeArrayGetVartype)
1367     {
1368         pSafeArrayGetVartype(*V_ARRAYREF(&v), &vt);
1369         pSafeArrayGetVartype(*V_ARRAYREF(&v2), &vt2);
1370         ok(vt == vt2, "array vts differ %x %x\n", vt, vt2);
1371     }
1372     VARIANT_UserFree(&umcb.Flags, &v2);
1373     HeapFree(GetProcessHeap(), 0, oldbuffer);
1374
1375     /*** ARRAY BYREF ***/
1376     VariantInit(&v);
1377     V_VT(&v) = VT_UI4 | VT_ARRAY | VT_BYREF;
1378     V_ARRAYREF(&v) = &lpsa;
1379     lpsa->fFeatures |= FADF_STATIC;
1380
1381     rpcMsg.BufferLength = stubMsg.BufferLength = VARIANT_UserSize(&umcb.Flags, 0, &v);
1382     expected = 152;
1383     ok(stubMsg.BufferLength == expected || stubMsg.BufferLength == expected + 16, /* win64 */
1384        "size %u instead of %u\n", stubMsg.BufferLength, expected);
1385     buffer = rpcMsg.Buffer = stubMsg.Buffer = stubMsg.BufferStart = alloc_aligned(stubMsg.BufferLength, &oldbuffer);
1386     stubMsg.BufferEnd = stubMsg.Buffer + stubMsg.BufferLength;
1387     next = VARIANT_UserMarshal(&umcb.Flags, buffer, &v);
1388     ok(next == buffer + expected, "got %p expect %p\n", next, buffer + expected);
1389     wirev = (DWORD*)buffer;
1390
1391     wirev = check_variant_header(wirev, &v, expected);
1392     ok(*wirev == 4, "wv[5] %08x\n", *wirev);
1393     wirev++;
1394     ok(*wirev, "wv[6] %08x\n", *wirev); /* win2k: this is lpsa. winxp: this is (char*)lpsa + 1 */
1395     wirev++;
1396     check_safearray(wirev, lpsa);
1397     lpsa_copy = lpsa2 = SafeArrayCreate(VT_I8, 1, &sab);
1398     /* set FADF_STATIC feature to make sure lpsa2->pvData pointer changes if new data buffer is allocated */
1399     lpsa2->fFeatures |= FADF_STATIC;
1400     mem = lpsa2->pvData;
1401     V_VT(&v2) = VT_UI4 | VT_ARRAY | VT_BYREF;
1402     V_ARRAYREF(&v2) = &lpsa2;
1403     stubMsg.Buffer = buffer;
1404     next = VARIANT_UserUnmarshal(&umcb.Flags, buffer, &v2);
1405     ok(next == buffer + expected, "got %p expect %p\n", next, buffer + expected);
1406     ok(V_VT(&v) == V_VT(&v2), "got vt %d expect %d\n", V_VT(&v), V_VT(&v2));
1407     ok(lpsa2 == lpsa_copy, "safearray should be reused\n");
1408     ok(mem == lpsa2->pvData, "safearray data should be reused\n");
1409     ok(SafeArrayGetDim(*V_ARRAYREF(&v)) == SafeArrayGetDim(*V_ARRAYREF(&v2)), "array dims differ\n");
1410     SafeArrayGetLBound(*V_ARRAYREF(&v), 1, &bound);
1411     SafeArrayGetLBound(*V_ARRAYREF(&v2), 1, &bound2);
1412     ok(bound == bound2, "array lbounds differ\n");
1413     SafeArrayGetUBound(*V_ARRAYREF(&v), 1, &bound);
1414     SafeArrayGetUBound(*V_ARRAYREF(&v2), 1, &bound2);
1415     ok(bound == bound2, "array ubounds differ\n");
1416     if (pSafeArrayGetVartype)
1417     {
1418         pSafeArrayGetVartype(*V_ARRAYREF(&v), &vt);
1419         pSafeArrayGetVartype(*V_ARRAYREF(&v2), &vt2);
1420         ok(vt == vt2, "array vts differ %x %x\n", vt, vt2);
1421     }
1422     lpsa2->fFeatures &= ~FADF_STATIC;
1423     hr = SafeArrayDestroy(*V_ARRAYREF(&v2));
1424     ok(hr == S_OK, "got 0x%08x\n", hr);
1425     HeapFree(GetProcessHeap(), 0, oldbuffer);
1426     lpsa->fFeatures &= ~FADF_STATIC;
1427     hr = SafeArrayDestroy(lpsa);
1428     ok(hr == S_OK, "got 0x%08x\n", hr);
1429
1430     /*** VARIANT BYREF ***/
1431     VariantInit(&v);
1432     VariantInit(&v2);
1433     V_VT(&v2) = VT_R8;
1434     V_R8(&v2) = 3.1415;
1435     V_VT(&v) = VT_VARIANT | VT_BYREF;
1436     V_VARIANTREF(&v) = &v2;
1437
1438     rpcMsg.BufferLength = stubMsg.BufferLength = VARIANT_UserSize(&umcb.Flags, 0, &v);
1439     ok(stubMsg.BufferLength == 64, "size %d\n", stubMsg.BufferLength);
1440     buffer = rpcMsg.Buffer = stubMsg.Buffer = stubMsg.BufferStart = alloc_aligned(stubMsg.BufferLength, &oldbuffer);
1441     stubMsg.BufferEnd = stubMsg.Buffer + stubMsg.BufferLength;
1442     memset(buffer, 0xcc, stubMsg.BufferLength);
1443     next = VARIANT_UserMarshal(&umcb.Flags, buffer, &v);
1444     ok(next == buffer + stubMsg.BufferLength, "got %p expect %p\n", next, buffer + stubMsg.BufferLength);
1445     wirev = (DWORD*)buffer;
1446     wirev = check_variant_header(wirev, &v, stubMsg.BufferLength);
1447
1448     ok(*wirev == sizeof(VARIANT), "wv[5] %08x\n", *wirev);
1449     wirev++;
1450     ok(*wirev == ('U' | 's' << 8 | 'e' << 16 | 'r' << 24), "wv[6] %08x\n", *wirev); /* 'User' */
1451     wirev++;
1452     ok(*wirev == 0xcccccccc, "wv[7] %08x\n", *wirev); /* pad */
1453     wirev++;
1454     wirev = check_variant_header(wirev, &v2, stubMsg.BufferLength - 32);
1455     ok(*wirev == 0xcccccccc, "wv[13] %08x\n", *wirev); /* pad for VT_R8 */
1456     wirev++;
1457     ok(*(double*)wirev == V_R8(&v2), "wv[6] %08x wv[7] %08x\n", *wirev, *(wirev+1));
1458     VariantInit(&v3);
1459     stubMsg.Buffer = buffer;
1460     next = VARIANT_UserUnmarshal(&umcb.Flags, buffer, &v3);
1461     ok(next == buffer + stubMsg.BufferLength, "got %p expect %p\n", next, buffer + stubMsg.BufferLength);
1462     ok(V_VT(&v) == V_VT(&v3), "got vt %d expect %d\n", V_VT(&v), V_VT(&v3));
1463     ok(V_VT(V_VARIANTREF(&v)) == V_VT(V_VARIANTREF(&v3)), "vts differ %x %x\n",
1464        V_VT(V_VARIANTREF(&v)), V_VT(V_VARIANTREF(&v3)));
1465     ok(V_R8(V_VARIANTREF(&v)) == V_R8(V_VARIANTREF(&v3)), "r8s differ\n");
1466     VARIANT_UserFree(&umcb.Flags, &v3);
1467     HeapFree(GetProcessHeap(), 0, oldbuffer);
1468
1469     /*** UNKNOWN ***/
1470     heap_unknown = HeapAlloc(GetProcessHeap(), 0, sizeof(*heap_unknown));
1471     heap_unknown->IUnknown_iface.lpVtbl = &HeapUnknown_Vtbl;
1472     heap_unknown->refs = 1;
1473     VariantInit(&v);
1474     VariantInit(&v2);
1475     V_VT(&v) = VT_UNKNOWN;
1476     V_UNKNOWN(&v) = &heap_unknown->IUnknown_iface;
1477
1478     rpcMsg.BufferLength = stubMsg.BufferLength = VARIANT_UserSize(&umcb.Flags, 0, &v);
1479     ok(stubMsg.BufferLength > 40, "size %d\n", stubMsg.BufferLength);
1480     buffer = rpcMsg.Buffer = stubMsg.Buffer = stubMsg.BufferStart = alloc_aligned(stubMsg.BufferLength, &oldbuffer);
1481     stubMsg.BufferEnd = stubMsg.Buffer + stubMsg.BufferLength;
1482     memset(buffer, 0xcc, stubMsg.BufferLength);
1483     next = VARIANT_UserMarshal(&umcb.Flags, buffer, &v);
1484 todo_wine
1485     ok(heap_unknown->refs == 2, "got refcount %d\n", heap_unknown->refs);
1486     wirev = (DWORD*)buffer;
1487     wirev = check_variant_header(wirev, &v, next - buffer);
1488
1489     ok(*wirev == (DWORD_PTR)V_UNKNOWN(&v) /* Win9x */ ||
1490        *wirev == (DWORD_PTR)V_UNKNOWN(&v) + 1 /* NT */, "wv[5] %08x\n", *wirev);
1491     wirev++;
1492     ok(*wirev == next - buffer - 0x20, "wv[6] %08x\n", *wirev);
1493     wirev++;
1494     ok(*wirev == next - buffer - 0x20, "wv[7] %08x\n", *wirev);
1495     wirev++;
1496     ok(*wirev == 0x574f454d, "wv[8] %08x\n", *wirev);
1497     VariantInit(&v3);
1498     V_VT(&v3) = VT_UNKNOWN;
1499     V_UNKNOWN(&v3) = &heap_unknown->IUnknown_iface;
1500     IUnknown_AddRef(V_UNKNOWN(&v3));
1501     stubMsg.Buffer = buffer;
1502 todo_wine
1503     ok(heap_unknown->refs == 3, "got refcount %d\n", heap_unknown->refs);
1504     next = VARIANT_UserUnmarshal(&umcb.Flags, buffer, &v3);
1505     ok(V_VT(&v) == V_VT(&v3), "got vt %d expect %d\n", V_VT(&v), V_VT(&v3));
1506     ok(V_UNKNOWN(&v) == V_UNKNOWN(&v3), "got %p expect %p\n", V_UNKNOWN(&v), V_UNKNOWN(&v3));
1507     VARIANT_UserFree(&umcb.Flags, &v3);
1508     ok(heap_unknown->refs == 1, "%d refcounts of IUnknown leaked\n", heap_unknown->refs - 1);
1509     IUnknown_Release(&heap_unknown->IUnknown_iface);
1510     HeapFree(GetProcessHeap(), 0, oldbuffer);
1511
1512     /*** NULL UNKNOWN ***/
1513     VariantInit(&v);
1514     V_VT(&v) = VT_UNKNOWN;
1515     V_UNKNOWN(&v) = NULL;
1516
1517     rpcMsg.BufferLength = stubMsg.BufferLength = VARIANT_UserSize(&umcb.Flags, 0, &v);
1518     ok(stubMsg.BufferLength >= 24, "size %d\n", stubMsg.BufferLength);
1519     buffer = rpcMsg.Buffer = stubMsg.Buffer = stubMsg.BufferStart = alloc_aligned(stubMsg.BufferLength, &oldbuffer);
1520     stubMsg.BufferEnd = stubMsg.Buffer + stubMsg.BufferLength;
1521     memset(buffer, 0xcc, stubMsg.BufferLength);
1522     next = VARIANT_UserMarshal(&umcb.Flags, buffer, &v);
1523     wirev = (DWORD*)buffer;
1524     wirev = check_variant_header(wirev, &v, next - buffer);
1525     ok(*wirev == 0, "wv[5] %08x\n", *wirev);
1526
1527     VariantInit(&v2);
1528     stubMsg.Buffer = buffer;
1529     next = VARIANT_UserUnmarshal(&umcb.Flags, buffer, &v2);
1530     ok(V_VT(&v) == V_VT(&v2), "got vt %d expect %d\n", V_VT(&v), V_VT(&v2));
1531     ok(V_UNKNOWN(&v2) == NULL, "got %p expect NULL\n", V_UNKNOWN(&v2));
1532     VARIANT_UserFree(&umcb.Flags, &v2);
1533     HeapFree(GetProcessHeap(), 0, oldbuffer);
1534
1535     /*** UNKNOWN BYREF ***/
1536     heap_unknown = HeapAlloc(GetProcessHeap(), 0, sizeof(*heap_unknown));
1537     heap_unknown->IUnknown_iface.lpVtbl = &HeapUnknown_Vtbl;
1538     heap_unknown->refs = 1;
1539     VariantInit(&v);
1540     VariantInit(&v2);
1541     V_VT(&v) = VT_UNKNOWN | VT_BYREF;
1542     V_UNKNOWNREF(&v) = (IUnknown **)&heap_unknown;
1543
1544     rpcMsg.BufferLength = stubMsg.BufferLength = VARIANT_UserSize(&umcb.Flags, 0, &v);
1545     ok(stubMsg.BufferLength >= 44, "size %d\n", stubMsg.BufferLength);
1546     buffer = rpcMsg.Buffer = stubMsg.Buffer = stubMsg.BufferStart = alloc_aligned(stubMsg.BufferLength, &oldbuffer);
1547     stubMsg.BufferEnd = stubMsg.Buffer + stubMsg.BufferLength;
1548     memset(buffer, 0xcc, stubMsg.BufferLength);
1549     ok(heap_unknown->refs == 1, "got refcount %d\n", heap_unknown->refs);
1550     next = VARIANT_UserMarshal(&umcb.Flags, buffer, &v);
1551 todo_wine
1552     ok(heap_unknown->refs == 2, "got refcount %d\n", heap_unknown->refs);
1553     wirev = (DWORD*)buffer;
1554     wirev = check_variant_header(wirev, &v, next - buffer);
1555
1556     ok(*wirev == 4, "wv[5] %08x\n", *wirev);
1557     wirev++;
1558     ok(*wirev == (DWORD_PTR)heap_unknown /* Win9x, Win2000 */ ||
1559        *wirev == (DWORD_PTR)heap_unknown + 1 /* XP */, "wv[6] %08x\n", *wirev);
1560     wirev++;
1561     ok(*wirev == next - buffer - 0x24, "wv[7] %08x\n", *wirev);
1562     wirev++;
1563     ok(*wirev == next - buffer - 0x24, "wv[8] %08x\n", *wirev);
1564     wirev++;
1565     ok(*wirev == 0x574f454d, "wv[9] %08x\n", *wirev);
1566
1567     VariantInit(&v3);
1568     V_VT(&v3) = VT_UNKNOWN;
1569     V_UNKNOWN(&v3) = &heap_unknown->IUnknown_iface;
1570     IUnknown_AddRef(V_UNKNOWN(&v3));
1571     stubMsg.Buffer = buffer;
1572     next = VARIANT_UserUnmarshal(&umcb.Flags, buffer, &v3);
1573     ok(heap_unknown->refs == 2, "got refcount %d\n", heap_unknown->refs);
1574     ok(V_VT(&v) == V_VT(&v3), "got vt %d expect %d\n", V_VT(&v), V_VT(&v3));
1575     ok(*V_UNKNOWNREF(&v) == *V_UNKNOWNREF(&v3), "got %p expect %p\n", *V_UNKNOWNREF(&v), *V_UNKNOWNREF(&v3));
1576     VARIANT_UserFree(&umcb.Flags, &v3);
1577     ok(heap_unknown->refs == 1, "%d refcounts of IUnknown leaked\n", heap_unknown->refs - 1);
1578     IUnknown_Release(&heap_unknown->IUnknown_iface);
1579     HeapFree(GetProcessHeap(), 0, oldbuffer);
1580
1581     unk = NULL;
1582     VariantInit(&v);
1583     V_VT(&v) = VT_UNKNOWN | VT_BYREF;
1584     V_UNKNOWNREF(&v) = &unk;
1585
1586     rpcMsg.BufferLength = stubMsg.BufferLength = VARIANT_UserSize(&umcb.Flags, 0, &v);
1587     ok(stubMsg.BufferLength >= 28, "size %d\n", stubMsg.BufferLength);
1588     buffer = rpcMsg.Buffer = stubMsg.Buffer = stubMsg.BufferStart = alloc_aligned(stubMsg.BufferLength, &oldbuffer);
1589     stubMsg.BufferEnd = stubMsg.Buffer + stubMsg.BufferLength;
1590     memset(buffer, 0xcc, stubMsg.BufferLength);
1591     next = VARIANT_UserMarshal(&umcb.Flags, buffer, &v);
1592     ok(next == buffer + stubMsg.BufferLength, "got %p expect %p\n", next, buffer + stubMsg.BufferLength);
1593     wirev = (DWORD*)buffer;
1594     wirev = check_variant_header(wirev, &v, stubMsg.BufferLength);
1595
1596     ok(*wirev == 4, "wv[5] %08x\n", *wirev);
1597
1598     VariantInit(&v2);
1599     stubMsg.Buffer = buffer;
1600     next = VARIANT_UserUnmarshal(&umcb.Flags, buffer, &v2);
1601     ok(next == buffer + stubMsg.BufferLength, "got %p expect %p\n", next, buffer + stubMsg.BufferLength);
1602     ok(V_VT(&v) == V_VT(&v2), "got vt %d expect %d\n", V_VT(&v2), V_VT(&v));
1603     ok(!*V_UNKNOWNREF(&v2), "got %p expect NULL\n", *V_UNKNOWNREF(&v2));
1604     VARIANT_UserFree(&umcb.Flags, &v2);
1605     HeapFree(GetProcessHeap(), 0, oldbuffer);
1606 }
1607
1608
1609 START_TEST(usrmarshal)
1610 {
1611     HANDLE hOleaut32 = GetModuleHandleA("oleaut32.dll");
1612 #define GETPTR(func) p##func = (void*)GetProcAddress(hOleaut32, #func)
1613     GETPTR(SafeArrayGetVartype);
1614 #undef GETPTR
1615
1616     if (!pSafeArrayGetVartype)
1617         win_skip("SafeArrayGetVartype is not available, some tests will be skipped\n");
1618
1619     CoInitialize(NULL);
1620
1621     test_marshal_LPSAFEARRAY();
1622     test_marshal_BSTR();
1623     test_marshal_VARIANT();
1624
1625     CoUninitialize();
1626 }