File: src\Framework\System\Windows\Interop\HwndHost.cs
Project: wpf\PresentationFramework.csproj (PresentationFramework)
using System;
using System.Diagnostics;
using System.Windows.Automation.Peers;
using System.Windows.Automation.Provider;
using System.Windows.Input;
using System.Collections;
using MS.Win32;
using MS.Internal;
using MS.Internal.Interop;
using System.Security;
using System.Security.Permissions;
using Microsoft.Win32;
using System.Windows.Media;
using System.Windows.Interop;
using System.Runtime.InteropServices;
using System.Windows.Threading;
using System.Diagnostics.CodeAnalysis;
 
// Disable pragma warnings to enable PREsharp pragmas
#pragma warning disable 1634, 1691
 
namespace System.Windows.Interop
{
    /// <summary>
    ///     The HwndHost class hosts an HWND inside of an Avalon tree.
    /// </summary>
    ///<remarks> Subclassing requires unmanaged code permission</remarks>
    ///<SecurityNote>
    ///
    ///     Inheritance demand put in place - as to host activeX controls you should have Unmanaged code permission.
    ///
    ///</SecurityNote>
 
    [SecurityPermission(SecurityAction.InheritanceDemand, Flags=SecurityPermissionFlag.UnmanagedCode)]
    public abstract class HwndHost : FrameworkElement, IDisposable, IWin32Window, IKeyboardInputSink
    {
        static HwndHost()
        {
            FocusableProperty.OverrideMetadata(typeof(HwndHost), new FrameworkPropertyMetadata(true));
            HwndHost.DpiChangedEvent = Window.DpiChangedEvent.AddOwner(typeof(HwndHost));
        }
 
        /// <summary>
        ///     Constructs an instance of the HwndHost class.
        /// </summary>
        ///<remarks> Not available in Internet zone</remarks>
        ///<SecurityNote>
        ///     Critical - calls critical code, sets critical _fTrusted flag.
        ///     PublicOk - trusted flag is set to false.
        ///</SecurityNote>
        [ SecurityCritical ]
        protected HwndHost()
        {
            Initialize( false ) ;
        }
 
        ///<SecurityNote>
        ///     Critical sets fTrustedBit.
        ///</SecurityNote>
        [SecurityCritical]
        internal HwndHost(bool fTrusted )
        {
            Initialize( fTrusted ) ;
        }
 
        /// <summary>
        ///    Because we own an HWND, we implement a finalizer to make sure that we destroy it.
        /// </summary>
        ~HwndHost()
        {
            Dispose(false);
        }
 
        /// <summary>
        ///     Disposes this object.
        /// </summary>
        public void Dispose()
        {
            Dispose(true);
            GC.SuppressFinalize(this);
        }
 
        /// <summary>
        ///     The Win32 handle of the hosted window.
        /// </summary>
        /// <remarks>
        ///     Callers must have UnmanagedCode permission to call this API.
        /// </remarks>
        /// <SecurityNote>
        ///     Critical: This code accesses IsWindow, returns hwndHandle.
        ///     PublicOk: There is a demand
        /// </SecurityNote>
        public IntPtr Handle
        {
            [SecurityCritical]
            get
            {
                SecurityHelper.DemandUnmanagedCode();
 
                return CriticalHandle;
            }
        }
 
        /// <summary>
        ///     An event that is notified of all unhandled messages received
        ///     by the hosted window.
        /// </summary>
        /// <SecurityNote>
        ///     Critical : Allows callers to sublc---- win32 HWnds which is considered a privilaged operation
        ///     Safe     : Demands unmanaged code permission.
        ///</SecurityNote>
        public event HwndSourceHook MessageHook
        {
            [SecuritySafeCritical]
            add
            {
                SecurityHelper.DemandUnmanagedCode();
 
                if(_hooks == null)
                {
                    _hooks = new ArrayList(8);
                }
 
                _hooks.Add(value);
            }
 
            [SecuritySafeCritical]
            remove
            {
                SecurityHelper.DemandUnmanagedCode();
 
                if(_hooks != null)
                {
                    _hooks.Remove(value);
 
                    if(_hooks.Count == 0)
                    {
                        _hooks = null;
                    }
                }
            }
        }
 
        /// <summary>
        ///     This event is raised after the DPI of the screen on which the HwndHost is displayed, changes.
        /// </summary>
        public event DpiChangedEventHandler DpiChanged
        {
            add { AddHandler(HwndHost.DpiChangedEvent, value); }
            remove { RemoveHandler(HwndHost.DpiChangedEvent, value); }
        }
 
        /// <summary>
        /// RoutedEvent for when DPI of the screen the HwndHost is on, changes.
        /// </summary>
        public static readonly RoutedEvent DpiChangedEvent;
 
        /// <summary>
        /// </summary>
        /// <param name="e"></param>
        ///<SecurityNote>
        /// Critical - Calls ComponentDispatcher.UnsecureCurrentKeyboardMessage.
        /// TreatAsSafe - Only calls for trusted controls
        ///</SecurityNote>
        [SecurityCritical, SecurityTreatAsSafe]
        protected override void OnKeyUp(KeyEventArgs e)
        {
            MSG msg;
            if (_fTrusted.Value)
            {
                msg = ComponentDispatcher.UnsecureCurrentKeyboardMessage;
            }
            else
            {
                msg = ComponentDispatcher.CurrentKeyboardMessage;
            }
 
            ModifierKeys modifiers = HwndKeyboardInputProvider.GetSystemModifierKeys();
 
            bool handled = ((IKeyboardInputSink)this).TranslateAccelerator(ref msg, modifiers);
 
            if(handled)
                e.Handled = handled;
 
            base.OnKeyUp(e);
        }
 
        /// <summary>
        /// OnDpiChanged is called when the DPI at which this HwndHost is rendered, changes.
        /// </summary>
        [SecuritySafeCritical]
        protected override void OnDpiChanged(DpiScale oldDpi, DpiScale newDpi)
        {
            RaiseEvent(new DpiChangedEventArgs(oldDpi, newDpi, HwndHost.DpiChangedEvent, this));
            UpdateWindowPos();
        }
 
        /// <summary>
        /// </summary>
        /// <param name="e"></param>
        ///<SecurityNote>
        /// Critical - Calls ComponentDispatcher.UnsecureCurrentKeyboardMessage.
        /// TreatAsSafe - Only calls for trusted controls
        ///</SecurityNote>
        [SecurityCritical, SecurityTreatAsSafe]
        protected override void OnKeyDown(KeyEventArgs e)
        {
            MSG msg;
            if (_fTrusted.Value)
            {
                msg = ComponentDispatcher.UnsecureCurrentKeyboardMessage;
            }
            else
            {
                msg = ComponentDispatcher.CurrentKeyboardMessage;
            }
 
 
            ModifierKeys modifiers = HwndKeyboardInputProvider.GetSystemModifierKeys();
 
            bool handled = ((IKeyboardInputSink)this).TranslateAccelerator(ref msg, modifiers);
 
            if(handled)
                e.Handled = handled;
 
            base.OnKeyDown(e);
        }
 
 
#region IKeyboardInputSink
 
        // General security note on the implementation pattern of this interface. In Dev10 it was chosen
        // to expose the interface implementation for overriding to customers. We did so by keeping the
        // explicit interface implementations (that do have the property of being hidden from the public
        // contract, which limits IntelliSense on derived types like WebBrowser) while sticking protected
        // virtuals next to them. Those virtuals contain our base implementation, while the explicit
        // interface implementation methods do call trivially into the virtuals.
        //
        // This comment outlines the security rationale applied to those methods.
        //
        // <SecurityNote Name="IKeyboardInputSink_Implementation">
        //     The security attributes on the virtual methods within this region mirror the corresponding
        //     IKeyboardInputSink methods; customers can override those methods, so we insert a LinkDemand
        //     to encourage them to have a LinkDemand too (via FxCop).
        // </SecurityNote>
 
        /// <summary>
        ///     Registers a IKeyboardInputSink with the HwndSource in order
        ///     to retreive a unique IKeyboardInputSite for it.
        /// </summary>
        /// <SecurityNote>
        ///     Critical: This API can be used for input spoofing.
        ///     PublicOK: This method has a demand on it.
        ///
        ///     The security attributes on this method mirror the corresponding IKeyboardInputSink method;
        ///     customers can override this method, so we insert a LinkDemand.
        /// </SecurityNote>
        [SecurityCritical, UIPermissionAttribute(SecurityAction.LinkDemand, Unrestricted=true)]
        protected virtual IKeyboardInputSite RegisterKeyboardInputSinkCore(IKeyboardInputSink sink)
        {
            throw new InvalidOperationException(SR.Get(SRID.HwndHostDoesNotSupportChildKeyboardSinks));
        }
 
        /// <SecurityNote>
        ///     Critical: Calls a method with a LinkDemand on it.
        ///     PublicOK: The interface declaration for this method has a demand on it.
        /// </SecurityNote>
        [SuppressMessage("Microsoft.Security", "CA2122:DoNotIndirectlyExposeMethodsWithLinkDemands")]
        [SecurityCritical]
        IKeyboardInputSite IKeyboardInputSink.RegisterKeyboardInputSink(IKeyboardInputSink sink)
        {
            return RegisterKeyboardInputSinkCore(sink);
        }
 
        /// <summary>
        ///     Gives the component a chance to process keyboard input.
        ///     Return value is true if handled, false if not.  Components
        ///     will generally call a child component's TranslateAccelerator
        ///     if they can't handle the input themselves.  The message must
        ///     either be WM_KEYDOWN or WM_SYSKEYDOWN.  It is illegal to
        ///     modify the MSG structure, it's passed by reference only as
        ///     a performance optimization.
        /// </summary>
        /// <SecurityNote>
        ///     Critical: This API can be used for input spoofing.
        ///     PublicOK: This method has a demand on it.
        ///
        ///     The security attributes on this method mirror the corresponding IKeyboardInputSink method;
        ///     customers can override this method, so we insert a LinkDemand.
        /// </SecurityNote>
        [SecurityCritical, UIPermissionAttribute(SecurityAction.LinkDemand, Unrestricted=true)]
        protected virtual bool TranslateAcceleratorCore(ref MSG msg, ModifierKeys modifiers)
        {
            return false;
        }
 
        /// <SecurityNote>
        ///     Critical: Calls a method with a LinkDemand on it.
        ///     PublicOk: The interface declaration for this method has a demand on it.
        /// </SecurityNote>
        [SuppressMessage("Microsoft.Security", "CA2122:DoNotIndirectlyExposeMethodsWithLinkDemands")]
        [SecurityCritical]
        bool IKeyboardInputSink.TranslateAccelerator(ref MSG msg, ModifierKeys modifiers)
        {
            return TranslateAcceleratorCore(ref msg, modifiers);
        }
 
        /// <summary>
        ///     Set focus to the first or last tab stop (according to the
        ///     TraversalRequest).  If it can't, because it has no tab stops,
        ///     the return value is false.
        /// </summary>
        protected virtual bool TabIntoCore(TraversalRequest request)
        {
            return false;
        }
 
        bool IKeyboardInputSink.TabInto(TraversalRequest request)
        {
            return TabIntoCore(request);
        }
 
        /// <summary>
        ///     The property should start with a null value.  The component's
        ///     container will set this property to a non-null value before
        ///     any other methods are called.  It may be set multiple times,
        ///     and should be set to null before disposal.
        /// </summary>
        /// <SecurityNote>
        ///     Critical: This API can be used for input spoofing
        ///     PublicOK: The interface declaration for this method has a demand on it.
        /// </SecurityNote>
        IKeyboardInputSite IKeyboardInputSink.KeyboardInputSite { get; [SecurityCritical] set; }
 
        /// <summary>
        ///     This method is called whenever one of the component's
        ///     mnemonics is invoked.  The message must either be WM_KEYDOWN
        ///     or WM_SYSKEYDOWN.  It's illegal to modify the MSG structrure,
        ///     it's passed by reference only as a performance optimization.
        ///     If this component contains child components, the container
        ///     OnMnemonic will need to call the child's OnMnemonic method.
        /// </summary>
        /// <SecurityNote>
        ///     Critical: This API can be used for input spoofing.
        ///     PublicOK: This method has a demand on it.
        ///
        ///     The security attributes on this method mirror the corresponding IKeyboardInputSink method;
        ///     customers can override this method, so we insert a LinkDemand.
        /// </SecurityNote>
        [SecurityCritical, UIPermissionAttribute(SecurityAction.LinkDemand, Unrestricted=true)]
        protected virtual bool OnMnemonicCore(ref MSG msg, ModifierKeys modifiers)
        {
            return false;
        }
 
        /// <SecurityNote>
        ///     Critical: Calls a method with a LinkDemand on it.
        ///     PublicOK: The interface declaration for this method has a demand on it.
        /// </SecurityNote>
        [SuppressMessage("Microsoft.Security", "CA2122:DoNotIndirectlyExposeMethodsWithLinkDemands")]
        [SecurityCritical]
        bool IKeyboardInputSink.OnMnemonic(ref MSG msg, ModifierKeys modifiers)
        {
            return OnMnemonicCore(ref msg, modifiers);
        }
 
        /// <summary>
        ///     Gives the component a chance to process keyboard input messages
        ///     WM_CHAR, WM_SYSCHAR, WM_DEADCHAR or WM_SYSDEADCHAR before calling OnMnemonic.
        ///     Will return true if "handled" meaning don't pass it to OnMnemonic.
        ///     The message must be WM_CHAR, WM_SYSCHAR, WM_DEADCHAR or WM_SYSDEADCHAR.
        ///     It is illegal to modify the MSG structure, it's passed by reference
        ///     only as a performance optimization.
        /// </summary>
        /// <SecurityNote>
        ///     Critical: This API can be used for input spoofing.
        ///     PublicOK: This method has a demand on it.
        ///
        ///     The security attributes on this method mirror the corresponding IKeyboardInputSink method;
        ///     customers can override this method, so we insert a LinkDemand.
        /// </SecurityNote>
        [SecurityCritical, UIPermissionAttribute(SecurityAction.LinkDemand, Unrestricted=true)]
        protected virtual bool TranslateCharCore(ref MSG msg, ModifierKeys modifiers)
        {
            return false;
        }
 
        /// <SecurityNote>
        ///     Critical: Calls a method with a LinkDemand on it.
        ///     PublicOK: The interface declaration for this method has a demand on it.
        /// </SecurityNote>
        [SuppressMessage("Microsoft.Security", "CA2122:DoNotIndirectlyExposeMethodsWithLinkDemands")]
        [SecurityCritical]
        bool IKeyboardInputSink.TranslateChar(ref MSG msg, ModifierKeys modifiers)
        {
            return TranslateCharCore(ref msg, modifiers);
        }
 
        /// <summary>
        ///     This returns true if the sink, or a child of it, has focus. And false otherwise.
        /// </summary>
        ///<SecurityNote>
        ///     Critical: Calls a method with a SUC - GetFocus.
        ///     TreatAsSafe: No critical information exposed.
        ///                  It's ok to return whether hwndHost has focus within itself in PT.
        ///</SecurityNote>
        [SecurityCritical, SecurityTreatAsSafe]
        protected virtual bool HasFocusWithinCore()
        {
            HandleRef hwndFocus = new HandleRef(this, UnsafeNativeMethods.GetFocus());
            if (_hwnd.Handle != IntPtr.Zero && (hwndFocus.Handle == _hwnd.Handle || UnsafeNativeMethods.IsChild(_hwnd, hwndFocus)))
            {
                return true;
            }
            return false;
        }
 
        /// <SecurityNote>
        ///     PublicOK: It's ok to return whether hwndHost has focus within itself in PT.
        /// </SecurityNote>
        bool IKeyboardInputSink.HasFocusWithin()
        {
            return HasFocusWithinCore();
        }
 
#endregion IKeyboardInputSink
 
        /// <summary>
        ///     Updates the child window to reflect the state of this element.
        /// </summary>
        /// <remarks>
        ///     This includes the size of the window, the position of the
        ///     window, and the visibility of the window.
        /// </remarks>
        ///<remarks> Not available in Internet zone</remarks>
        ///<SecurityNote>
        ///     Critical: This code accesses critical code and also calls into PresentationSource
        ///     PublicOk : Repositioning the activeX control is ok.
        ///                Net effect is to make window location consistent with what layout calculated.
        ///</SecurityNote>
        [SecurityCritical]
        public void UpdateWindowPos()
        {
            // Verify the thread has access to the context.
            // VerifyAccess();
 
            if (_isDisposed)
            {
                return;
            }
 
            // Position the child HWND where layout put it.  To do this we
            // have to get coordinates relative to the parent window.
 
            PresentationSource source = null;
            CompositionTarget vt = null;
            if (( CriticalHandle != IntPtr.Zero) && IsVisible)
            {
                source = PresentationSource.CriticalFromVisual(this, false /* enable2DTo3DTransition */);
                if(source != null)
                {
                    vt = source.CompositionTarget;
                }
            }
 
            if(vt != null && vt.RootVisual != null)
            {
                // Translate the layout information assigned to us from the co-ordinate
                // space of this element, through the root visual, to the Win32 client
                // co-ordinate space
                NativeMethods.RECT rcClientRTLAdjusted = CalculateAssignedRC(source);
 
                // Set the Win32 position for the child window.
                //
                // Note, we can't check the existing position because we use
                // SWP_ASYNCWINDOWPOS, which means we could have pending position
                // change requests that haven't been applied yet.  If we need
                // this functionality (to avoid the extra SetWindowPos calls),
                // we'll have to track the last RECT we sent Win32 ourselves.
                //
                Rect rectClientRTLAdjusted = PointUtil.ToRect(rcClientRTLAdjusted);
                OnWindowPositionChanged(rectClientRTLAdjusted);
 
                // Show the window
                // Based on Dwayne, the reason we also show/hide window in UpdateWindowPos is for the 
                // following kind of scenario: When applying RenderTransform to HwndHost, the hwnd
                // will be left behind. Developer can workaround by hide the hwnd first using pinvoke. 
                // After the RenderTransform is applied to the HwndHost, call UpdateWindowPos to sync up
                // the hwnd's location, size and visibility with WPF.
                UnsafeNativeMethods.ShowWindowAsync(_hwnd, NativeMethods.SW_SHOW);
            }
            else
            {
                // For some reason we shouldn't be displayed: either we don't
                // have a parent, or the parent no longer has a root visual,
                // or we are marked as not being visible.
                //
                // Just hide the window to get it out of the way.
                UnsafeNativeMethods.ShowWindowAsync(_hwnd, NativeMethods.SW_HIDE);
            }
        }
 
        // Translate the layout information assigned to us from the co-ordinate
        // space of this element, through the root visual, to the Win32 client
        // co-ordinate space
        ///<SecurityNote>
        ///     Critical: This code accesses critical code and also calls into PresentationSource
        ///     TAS : Calculate the new position of the activeX control is ok.
        ///                Net effect is to make window location consistent with what layout calculated.
        ///</SecurityNote>
        [SecurityCritical, SecurityTreatAsSafe]
        private NativeMethods.RECT CalculateAssignedRC(PresentationSource source)
        {
            Rect rectElement = new Rect(RenderSize);
            Rect rectRoot = PointUtil.ElementToRoot(rectElement, this, source);
            Rect rectClient = PointUtil.RootToClient(rectRoot, source);
 
            // Adjust for Right-To-Left oriented windows
            IntPtr hwndParent = UnsafeNativeMethods.GetParent(_hwnd);
            NativeMethods.RECT rcClient = PointUtil.FromRect(rectClient);
            NativeMethods.RECT rcClientRTLAdjusted = PointUtil.AdjustForRightToLeft(rcClient, new HandleRef(null, hwndParent));
 
            if (!CoreAppContextSwitches.DoNotUsePresentationDpiCapabilityTier2OrGreater)
            {
                //Adjust for differences in DPI between _hwnd and hwndParent
                rcClientRTLAdjusted = AdjustRectForDpi(rcClientRTLAdjusted);
            }
 
            return rcClientRTLAdjusted;
        }
 
        /// <summary>
        /// Gets the ratio of the DPI between the parent of <see cref="_hwnd"/>
        /// and <see cref="_hwnd"/>. Normally, this ratio is 1. 
        /// </summary>
        /// <SecurityNote>
        ///     Critical: Calls native methods
        ///     Safe: Returns only non-Critical information
        /// </SecurityNote>
        private double DpiParentToChildRatio
        {
            [SecuritySafeCritical]
            get
            {
                if (!_hasDpiAwarenessContextTransition) return 1;
                DpiScale2 dpi = DpiUtil.GetWindowDpi(_hwnd.Handle, fallbackToNearestMonitorHeuristic: false);
                DpiScale2 dpiParent = DpiUtil.GetWindowDpi(UnsafeNativeMethods.GetParent(_hwnd), fallbackToNearestMonitorHeuristic: false);
 
                if (dpi == null || dpiParent == null)
                {
                    // if DPI of the window can not be queried directly, then the platform
                    // is too old to support mixed mode DPI. The DPI ratio is 1.0
                    return 1.0d;
                }
 
                return dpiParent.DpiScaleX / dpi.DpiScaleX;
            }
        }
 
        /// <summary>
        /// Adjusts a rectangle to factor in the differences in DPI between 
        /// the parent of <see cref="_hwnd"/> and <see cref="_hwnd"/>
        /// </summary>
        /// <param name="rcRect">The rectangle to adjust</param>
        /// <returns>The adjusted rectangle</returns>
        private NativeMethods.RECT AdjustRectForDpi(NativeMethods.RECT rcRect)
        {
            if (_hasDpiAwarenessContextTransition)
            {
                double dpiRatio = DpiParentToChildRatio;
                rcRect.left = (int)(rcRect.left / dpiRatio);
                rcRect.top = (int)(rcRect.top / dpiRatio);
                rcRect.right = (int)(rcRect.right / dpiRatio);
                rcRect.bottom = (int)(rcRect.bottom / dpiRatio);
            }
 
            return rcRect;
        }
        
        /// <summary>
        ///     Disposes this object.
        /// </summary>
        /// <param name="disposing">
        ///     true if called from explisit Dispose; and we free all objects managed and un-managed.
        ///     false if called from the finalizer; and we free only un-managed objects.
        /// </param>
        /// <remarks>
        ///     Derived classes should override this if they have additional
        ///     cleanup to do.  The base class implementation should be called.
        ///     Note that the calling thread must be the dispatcher thread.
        ///     If a window is being hosted, that window is destroyed.
        /// </remarks>
        ///<SecurityNote>
        ///     Critical - call to RemoveSourceChangeHandler invokes critical delegate.
        ///     SecurityTreatAsSafe : - disposing the HwndHost is considered ok.
        ///</SecurityNote>
        [ SecurityCritical, SecurityTreatAsSafe ]
        protected virtual void Dispose(bool disposing)
        {
            if (_isDisposed == true)
            {
                return;
            }
 
 
            if(disposing)
            {
                // Verify the thread has access to the context.
#pragma warning suppress 6519
                 VerifyAccess();
 
 
                // Remove our subclass.  Even if this fails, it will be forcably removed
                // when the window is destroyed.
                if (_hwndSubclass != null)
                {
                    // Check if it is trusted (WebOC and AddInHost), call CriticalDetach to avoid the Demand.
                    if (_fTrusted.Value == true)
                    {
                        _hwndSubclass.CriticalDetach(false);
                    }
                    else
                    {
                        _hwndSubclass.RequestDetach(false);
                    }
 
                    _hwndSubclass = null;
                }
 
                // Drop the hooks so that they can be garbage-collected.
                _hooks = null;
 
                // We no longer need to know about the source changing.
                PresentationSource.RemoveSourceChangedHandler(this, new SourceChangedEventHandler(OnSourceChanged));
            }
 
            if (_weakEventDispatcherShutdown != null) // Can be null if the static ctor failed ... see WebBrowser.
            {
                _weakEventDispatcherShutdown.Dispose();
                _weakEventDispatcherShutdown = null;
            }
 
            DestroyWindow();
 
            _isDisposed = true;
        }
 
        private void OnDispatcherShutdown(object sender, EventArgs e)
        {
            Dispose();
        }
 
        /// <summary>
        ///     Derived classes override this method to actually build the
        ///     window being hosted.
        /// </summary>
        /// <param name="hwndParent">
        ///     The parent HWND for the child window.
        /// </param>
        /// <returns>
        ///     The HWND handle to the child window that was created.
        /// </returns>
        /// <remarks>
        ///     The window that is returned must be a child window of the
        ///     specified parent window.
        ///     <para/>
        ///     In addition, the child window will only be subclassed if
        ///     the window is owned by the calling thread.
        /// </remarks>
        protected abstract HandleRef BuildWindowCore(HandleRef hwndParent);
 
        /// <summary>
        ///     Derived classes override this method to destroy the
        ///     window being hosted.
        /// </summary>
        protected abstract void DestroyWindowCore(HandleRef hwnd);
 
        /// <summary>
        ///     A protected override for accessing the window proc of the
        ///     hosted child window.
        /// </summary>
        ///<remarks> Not available in Internet zone</remarks>
        ///<SecurityNote>
        ///     Critical - accesses _hwnd Critical member.
        ///     PublicOk - Inheritance Demand for unmanaged codepermission to buslclass.
        ///                any caller of the protected must have Unmanaged code permission.
        ///     DemandIfUntrusted is there as a defense in depth measure.
        /// </SecurityNote>
        [ SecurityCritical ]
        protected virtual IntPtr WndProc(IntPtr hwnd, int msg, IntPtr wParam, IntPtr lParam, ref bool handled)
        {
            DemandIfUntrusted();
 
            switch ((WindowMessage)msg)
            {
                case WindowMessage.WM_NCDESTROY:
                    _hwnd = new HandleRef(null, IntPtr.Zero);
                    break;
 
                // When layout happens, we first calculate the right size/location then call SetWindowPos.
                // We only allow the changes that are coming from Avalon layout. The hwnd is not allowed to change by itself.
                // So the size of the hwnd should always be RenderSize and the position be where layout puts it.
                case WindowMessage.WM_WINDOWPOSCHANGING:
                    PresentationSource source = PresentationSource.CriticalFromVisual(this, false /* enable2DTo3DTransition */);
 
                    if (source != null)
                    {
                        // Get the rect assigned by layout to us.
                        NativeMethods.RECT assignedRC = CalculateAssignedRC(source);
                        
                        // The lParam is a pointer to a WINDOWPOS structure
                        // that contains information about the size and
                        // position that the window is changing to.  Note that
                        // modifying this structure during WM_WINDOWPOSCHANGING
                        // will change what happens to the window.
                        unsafe
                        {
                            NativeMethods.WINDOWPOS * windowPos = (NativeMethods.WINDOWPOS *)lParam;
 
                            // Always force the size of the window to be the
                            // size of our assigned rectangle.  Note that we
                            // have to always clear the SWP_NOSIZE flag.
                            windowPos->cx = assignedRC.right - assignedRC.left;
                            windowPos->cy = assignedRC.bottom - assignedRC.top;
                            windowPos->flags &= ~NativeMethods.SWP_NOSIZE;
 
                            // Always force the position of the window to be
                            // the upper-left corner of our assigned rectangle.
                            // Note that we have to always clear the
                            // SWP_NOMOVE flag.
                            windowPos->x = assignedRC.left;
                            windowPos->y = assignedRC.top;
                            windowPos->flags &= ~NativeMethods.SWP_NOMOVE;
 
                            // Windows has an optimization to copy pixels
                            // around to reduce the amount of repainting
                            // needed when moving or resizing a window.
                            // Unfortunately, this is not compatible with WPF
                            // in many cases due to our use of DirectX for
                            // rendering from our rendering thread.
                            // To be safe, we disable this optimization and
                            // pay the cost of repainting.
                            windowPos->flags |= NativeMethods.SWP_NOCOPYBITS;
                        }
                    }
 
                    break;
 
 
                case WindowMessage.WM_GETOBJECT:
                    handled = true;
                    return OnWmGetObject(wParam, lParam);
            }
 
            return IntPtr.Zero ;
        }
 
        #region Automation
 
        /// <summary>
        /// Creates AutomationPeer (<see cref="UIElement.OnCreateAutomationPeer"/>)
        /// </summary>
        protected override AutomationPeer OnCreateAutomationPeer()
        {
            return new HwndHostAutomationPeer(this);
        }
 
        /// <SecurityNote>
        ///     Critical    - Calls critical HwndHost.CriticalHandle.
        /// </SecurityNote>
        [SecurityCritical]
        private IntPtr OnWmGetObject(IntPtr wparam, IntPtr lparam)
        {
            IntPtr result = IntPtr.Zero;
 
            AutomationPeer containerPeer = UIElementAutomationPeer.CreatePeerForElement(this);
            if (containerPeer != null)
            {
                // get the element proxy
                IRawElementProviderSimple el = containerPeer.GetInteropChild();
                result = AutomationInteropProvider.ReturnRawElementProvider(CriticalHandle, wparam, lparam, el);
            }
            return result;
        }
 
        #endregion Automation
 
        //
 
 
 
 
 
 
 
 
 
 
 
        [ SecurityCritical ]
        protected virtual void OnWindowPositionChanged(Rect rcBoundingBox)
        {
            if (_isDisposed)
            {
                return;
            }
 
            UnsafeNativeMethods.SetWindowPos(_hwnd,
                                           new HandleRef(null, IntPtr.Zero),
                                           (int)rcBoundingBox.X,
                                           (int)rcBoundingBox.Y,
                                           (int)rcBoundingBox.Width,
                                           (int)rcBoundingBox.Height,
                                           NativeMethods.SWP_ASYNCWINDOWPOS
                                           | NativeMethods.SWP_NOZORDER
                                           | NativeMethods.SWP_NOCOPYBITS
                                           | NativeMethods.SWP_NOACTIVATE);
        }
 
        /// <summary>
        ///     Return the desired size of the HWND.
        /// </summary>
        /// <remarks>
        ///     HWNDs usually expect a very simplisitic layout model where
        ///     a window gets to be whatever size it wants to be.  To respect
        ///     this we request the initial size that the window was created
        ///     at.  A window created with a 0 dimension will adopt whatever
        ///     size the containing layout wants it to be.  Layouts are free
        ///     to actually size the window to whatever they want, and the
        ///     child window will always be sized accordingly.
        ///     <para/>
        ///     Derived classes should only override this method if they
        ///     have special knowlege about the size the window wants to be.
        ///     Examples of such may be special HWND types like combo boxes.
        ///     In such cases, the base class must still be called, but the
        ///     return value can be changed appropriately.
        /// </remarks>
        ///<remarks> Not available in Internet zone</remarks>
        ///<SecurityNote>
        ///     Critical - calls CriticalHandle
        ///     TreatAsSafe - CriticalHandle used for a null check, not leaked out.
        ///                   Ok to Override MeasureOverride and return a size in PT.
        /// Demand put in place as a defense in depth measure.
        ///
        ///</SecurityNote>
        [ SecurityCritical, SecurityTreatAsSafe ]
        protected override Size MeasureOverride(Size constraint)
        {
            DemandIfUntrusted();
 
            Size desiredSize = new Size(0,0);
 
            // Measure to our desired size.  If we have a 0-length dimension,
            // the system will assume we don't care about that dimension.
            if(CriticalHandle != IntPtr.Zero)
            {
                desiredSize.Width = Math.Min(_desiredSize.Width, constraint.Width);
                desiredSize.Height = Math.Min(_desiredSize.Height, constraint.Height);
            }
 
            return desiredSize;
        }
 
        /// <summary>
        ///     GetDrawing - Returns the drawing content of this Visual.
        /// </summary>
        /// <remarks>
        ///     This returns a bitmap obtained by calling the PrintWindow Win32 API.
        /// </remarks>
        internal override DrawingGroup GetDrawing()
        {
            return GetDrawingHelper();
        }
 
        /// <summary>
        /// Returns the bounding box of the content.
        /// </summary>
        internal override Rect GetContentBounds()
        {
            return new Rect(RenderSize);
        }
 
        ///<SecurityNote>
        ///     Critical - calls many native methods, accesses critical data
        ///     TreatAsSafe - Demands UIWindow permission before giving out a bitmap of this window.
        ///</SecurityNote>
        [SecurityCritical, SecurityTreatAsSafe]
        private DrawingGroup GetDrawingHelper()
        {
            // Printing an HWND requires UIPermissionWindow.AllWindows to give out its pixels.
            SecurityHelper.DemandUIWindowPermission();
 
            DrawingGroup drawingGroup = null;
 
            if(_hwnd.Handle != IntPtr.Zero && UnsafeNativeMethods.IsWindow(_hwnd))
            {
                NativeMethods.RECT rc = new NativeMethods.RECT();
                SafeNativeMethods.GetWindowRect(_hwnd, ref rc);
                int width = rc.right - rc.left;
                int height = rc.bottom - rc.top;
 
                HandleRef hdcScreen = new HandleRef(this, UnsafeNativeMethods.GetDC(new HandleRef(this, IntPtr.Zero)));
                if(hdcScreen.Handle != IntPtr.Zero)
                {
                    HandleRef hdcBitmap = new HandleRef(this, IntPtr.Zero);
                    HandleRef hBitmap = new HandleRef(this, IntPtr.Zero);
 
                    try
                    {
                        hdcBitmap = new HandleRef(this, UnsafeNativeMethods.CriticalCreateCompatibleDC(hdcScreen));
                        if(hdcBitmap.Handle != IntPtr.Zero)
                        {
                            hBitmap = new HandleRef(this, UnsafeNativeMethods.CriticalCreateCompatibleBitmap(hdcScreen, width, height));
 
                            if(hBitmap.Handle != IntPtr.Zero)
                            {
                                // Select the bitmap into the DC so that we draw to it.
                                IntPtr hOldBitmap = UnsafeNativeMethods.CriticalSelectObject(hdcBitmap, hBitmap.Handle);
                                try
                                {
                                    // Clear the bitmap to white (so we don't waste toner printing a black bitmap something fails).
                                    NativeMethods.RECT rcPaint = new NativeMethods.RECT(0,0,width, height);
                                    IntPtr hbrWhite = UnsafeNativeMethods.CriticalGetStockObject(NativeMethods.WHITE_BRUSH);
                                    UnsafeNativeMethods.CriticalFillRect(hdcBitmap.Handle, ref rcPaint, hbrWhite);
 
                                    // First try to use the PrintWindow API.
                                    bool result = UnsafeNativeMethods.CriticalPrintWindow(_hwnd, hdcBitmap, 0);
                                    if(result == false)
                                    {
                                        // Fall back to sending a WM_PRINT message to the window.
                                        //
                                        // Note: there are known cases where WM_PRINT is not implemented
                                        // to provide visual parity with WM_PAINT.  However, since the
                                        // GetDrawing method is virtual, the derived class can override
                                        // this default implementation and provide a better implementation.
                                        UnsafeNativeMethods.SendMessage(_hwnd.Handle, WindowMessage.WM_PRINT, hdcBitmap.Handle, (IntPtr) (NativeMethods.PRF_CHILDREN | NativeMethods.PRF_CLIENT | NativeMethods.PRF_ERASEBKGND | NativeMethods.PRF_NONCLIENT));
                                    }
                                    else
                                    {
                                        // There is a know issue where calling PrintWindow on a window will
                                        // clear all dirty regions (but since it is redirected, the screen
                                        // won't be updated).  As a result we can leave unpainted pixels on
                                        // the screen if PrintWindow is called when the window was dirty.
                                        //
                                        // To fix this, we just force the child window to repaint.
                                        //
                                        UnsafeNativeMethods.CriticalRedrawWindow(_hwnd, IntPtr.Zero, IntPtr.Zero, NativeMethods.RDW_INVALIDATE | NativeMethods.RDW_ALLCHILDREN);
                                    }
 
                                    // Create a DrawingGroup that only contains an ImageDrawing that wraps the bitmap.
                                    drawingGroup = new DrawingGroup();
                                    System.Windows.Media.Imaging.BitmapSource bitmapSource = Imaging.CriticalCreateBitmapSourceFromHBitmap(hBitmap.Handle, IntPtr.Zero, Int32Rect.Empty, null, WICBitmapAlphaChannelOption.WICBitmapIgnoreAlpha);
                                    Rect rectElement    = new Rect(RenderSize);
                                    drawingGroup.Children.Add(new ImageDrawing(bitmapSource, rectElement));
                                    drawingGroup.Freeze();
                                }
                                finally
                                {
                                    // Put the old bitmap back into the DC.
                                    UnsafeNativeMethods.CriticalSelectObject(hdcBitmap, hOldBitmap);
                                }
                            }
                        }
                    }
                    finally
                    {
                        UnsafeNativeMethods.ReleaseDC(new HandleRef(this, IntPtr.Zero), hdcScreen);
                        hdcScreen = new HandleRef(null, IntPtr.Zero);
 
                        if(hBitmap.Handle != IntPtr.Zero)
                        {
                            UnsafeNativeMethods.DeleteObject(hBitmap);
                            hBitmap = new HandleRef(this, IntPtr.Zero);
                        }
 
                        if(hdcBitmap.Handle != IntPtr.Zero)
                        {
                            UnsafeNativeMethods.CriticalDeleteDC(hdcBitmap);
                            hdcBitmap = new HandleRef(this, IntPtr.Zero);
                        }
                    }
                }
            }
 
            return drawingGroup;
        }
 
        ///<SecurityNote>
        ///     Critical - calls a method that linkdemands.
        ///                creates critical for set data.
        ///</SecurityNote>
        [ SecurityCritical ]
        private void Initialize( bool fTrusted )
        {
            _fTrusted = new SecurityCriticalDataForSet<bool> ( fTrusted ) ;
 
            _hwndSubclassHook = new HwndWrapperHook(SubclassWndProc);
            _handlerLayoutUpdated = new EventHandler(OnLayoutUpdated);
            _handlerEnabledChanged = new DependencyPropertyChangedEventHandler(OnEnabledChanged);
            _handlerVisibleChanged = new DependencyPropertyChangedEventHandler(OnVisibleChanged);
            PresentationSource.AddSourceChangedHandler(this, new SourceChangedEventHandler(OnSourceChanged));
 
            _weakEventDispatcherShutdown = new WeakEventDispatcherShutdown(this, this.Dispatcher);
        }
 
        ///<summary>
        ///     Use this method as a defense-in-depth measure only.
        ///</summary>
        ///<SecurityNote>
        ///     Critical : Demands which is critical
        ///</SecurityNote>
        [SecurityCritical]
        private void DemandIfUntrusted()
        {
            if ( ! _fTrusted.Value )
            {
                SecurityHelper.DemandUnmanagedCode();
            }
        }
 
        ///<SecurityNote>
        /// Critical - calls CriticalFromVisual.
        /// TreatAsSafe - does not expose the HwndSource obtained.
        ///</SecurityNote>
        [SecurityCritical , SecurityTreatAsSafe ]
        private void OnSourceChanged(object sender, SourceChangedEventArgs e)
        {
            // Remove ourselves as an IKeyboardInputSinks child of our previous
            // containing window.
            IKeyboardInputSite keyboardInputSite = ((IKeyboardInputSink)this).KeyboardInputSite;
            if (keyboardInputSite != null)
            {
                if (_fTrusted.Value == true)
                {
                    new UIPermission(PermissionState.Unrestricted).Assert(); //BlessedAssert:
                }
 
                try
                {
                    // Derived classes that implement IKeyboardInputSink should support setting it to null.
                    ((IKeyboardInputSink)this).KeyboardInputSite = null;
 
                    keyboardInputSite.Unregister();
                }
                finally
                {
                    if (_fTrusted.Value == true)
                    {
                        CodeAccessPermission.RevertAssert();
                    }
                }
            }
 
            // Add ourselves as an IKeyboardInputSinks child of our containing window.
            IKeyboardInputSink source = PresentationSource.CriticalFromVisual(this, false /* enable2DTo3DTransition */) as IKeyboardInputSink;
            if(source != null)
            {
                if (_fTrusted.Value == true)
                {
                    new UIPermission(PermissionState.Unrestricted).Assert(); //BlessedAssert:
                }
 
                try
                {
                    ((IKeyboardInputSink)this).KeyboardInputSite = source.RegisterKeyboardInputSink(this);
                }
                finally
                {
                    if (_fTrusted.Value == true)
                    {
                        CodeAccessPermission.RevertAssert();
                    }
                }
            }
 
            BuildOrReparentWindow();
        }
 
        private void OnLayoutUpdated(object sender, EventArgs e)
        {
            UpdateWindowPos();
        }
 
        /// <SecurityNote>
        ///     Critical: This code calls into critical method EnableWindow
        ///     TreatAsSafe: Changing window to being enabled is safe.
        /// </SecurityNote>
        [SecurityCritical, SecurityTreatAsSafe]
        private void OnEnabledChanged(object sender, DependencyPropertyChangedEventArgs e)
        {
            if (_isDisposed)
            {
                return;
            }
 
            bool boolNewValue = (bool)e.NewValue;
            UnsafeNativeMethods.EnableWindow(_hwnd, boolNewValue);
        }
 
        /// <SecurityNote>
        ///     Critical: This code calls into critical method show window
        ///     TreatAsSafe: Changing window visibility is safe.
        ///                  Window is always a child window.
        /// </SecurityNote>
        [SecurityCritical,SecurityTreatAsSafe]
        private void OnVisibleChanged(object sender, DependencyPropertyChangedEventArgs e)
        {
            if (_isDisposed)
            {
                return;
            }
 
            bool vis = (bool)e.NewValue;
 
            // 
 
 
 
 
 
            if(vis)
                UnsafeNativeMethods.ShowWindowAsync(_hwnd, NativeMethods.SW_SHOWNA);
            else
                UnsafeNativeMethods.ShowWindowAsync(_hwnd, NativeMethods.SW_HIDE);
        }
 
        // This routine handles the following cases:
        // 1) a parent window is present, build the child window
        // 2) a parent is present, reparent the child window to it
        // 3) a parent window is not present, hide the child window by parenting it to SystemResources.Hwnd window.
        /// <SecurityNote>
        /// Critical - calls Critical GetParent and <see cref="SystemResources.GetDpiAwarenessCompatibleNotificationWindow(HandleRef)"/>
        /// Safe - it doesn't disclose GetParent returned information. also
        ///               as a defense in depth measure - we demand if not trusted. Setting trusted is critical
        /// </SecurityNote>
        [SecuritySafeCritical]
        private void BuildOrReparentWindow()
        {
            DemandIfUntrusted();
 
            // Verify the thread has access to the context.
            // VerifyAccess();
 
            // Prevent reentry while building a child window,
            // also prevent the reconstruction of Disposed objects.
            if(_isBuildingWindow || _isDisposed)
            {
                return;
            }
 
            _isBuildingWindow = true;
 
            // Find the source window, this must be the parent window of
            // the child window.
            IntPtr hwndParent = IntPtr.Zero;
            PresentationSource source = PresentationSource.CriticalFromVisual(this, false /* enable2DTo3DTransition */);
            if(source != null)
            {
                HwndSource hwndSource = source as HwndSource ;
                if(hwndSource != null)
                {
                    hwndParent = hwndSource.CriticalHandle;
                }
            }
            else
            {
                // attempt to also walk through 3D - if we get a non-null result then we know we are inside of
                // a 3D scene which is not supported
                PresentationSource goingThrough3DSource = PresentationSource.CriticalFromVisual(this, true /* enable2DTo3DTransition */);
                if (goingThrough3DSource != null)
                {
                    if (TraceHwndHost.IsEnabled)
                    {
                        TraceHwndHost.Trace(TraceEventType.Warning, TraceHwndHost.HwndHostIn3D);
                    }
                }
            }
 
            try
            {
                if(hwndParent != IntPtr.Zero)
                {
                    if(_hwnd.Handle == IntPtr.Zero)
                    {
                        // We now have a parent window, so we can create the child
                        // window.
                        BuildWindow(new HandleRef(null, hwndParent));
                        this.LayoutUpdated += _handlerLayoutUpdated;
                        this.IsEnabledChanged += _handlerEnabledChanged;
                        this.IsVisibleChanged += _handlerVisibleChanged;
                    }
                    else if(hwndParent != UnsafeNativeMethods.GetParent(_hwnd))
                    {
                        // We have a different parent window.  Just reparent the
                        // child window under the new parent window.
                        UnsafeNativeMethods.SetParent(_hwnd, new HandleRef(null,hwndParent));
                    }
                }
                else if (!FrameworkAppContextSwitches.Enable2019_12_B || _hwnd.Handle != IntPtr.Zero) // When the "knob" is disabled, it would be as if this condition didn't exist - which is equivalent to the code prior to this change. 
                {
                    // Reparent the window to notification-only window provided by SystemResources
                    // This keeps the child window around, but it is not visible.  We can reparent the 
                    // window later when a new parent is available
                    var hwnd = SystemResources.GetDpiAwarenessCompatibleNotificationWindow(_hwnd);
                    UnsafeNativeMethods.SetParent(_hwnd, new HandleRef(null, hwnd.Handle));
                    // ...But we have a potential problem: If the SystemResources listener window gets 
                    // destroyed ahead of the call to HwndHost.OnDispatcherShutdown(), the HwndHost's window
                    // will be destroyed too, before the "logical" Dispose has had a chance to do proper
                    // shutdown. This turns out to be very significant for WebBrowser/ActiveXHost, which shuts
                    // down the hosted control through the COM interfaces, and the control destroys its
                    // window internally. Evidently, the WebOC fails to do full, proper cleanup if its
                    // window is destroyed unexpectedly.
                    // To avoid this situation, we make sure SystemResources responds to the Dispatcher 
                    // shutdown event after this HwndHost.
                    SystemResources.DelayHwndShutdown();
                }
            }
            finally
            {
                // Be careful to clear our guard bit.
                _isBuildingWindow = false;
            }
        }
 
 
        /// <SecurityNote>
        /// Critical: Calls critical methods - eg. GetWindowLong, IsParent, GetParent etc.
        /// TreatAsSafe: We demand if the trusted bit is not set.
        ///                      Setting the trusted bit is criical.
        /// </SecurityNote>
        [ SecurityCritical, SecurityTreatAsSafe ]
        private void BuildWindow(HandleRef hwndParent)
        {
            // Demand unmanaged code to the caller. IT'S RISKY TO REMOVE THIS
            DemandIfUntrusted();
 
            // Allow the derived class to build our HWND.
            _hwnd = BuildWindowCore(hwndParent);
 
            if(_hwnd.Handle == IntPtr.Zero || !UnsafeNativeMethods.IsWindow(_hwnd))
            {
                throw new InvalidOperationException(SR.Get(SRID.ChildWindowNotCreated));
            }
 
            // Make sure that the window that was created is indeed a child window.
            int windowStyle = UnsafeNativeMethods.GetWindowLong(new HandleRef(this,_hwnd.Handle), NativeMethods.GWL_STYLE);
            if((windowStyle & NativeMethods.WS_CHILD) == 0)
            {
                throw new InvalidOperationException(SR.Get(SRID.HostedWindowMustBeAChildWindow));
            }
 
            // Make sure the child window is the child of the expected parent window.
            if(hwndParent.Handle != UnsafeNativeMethods.GetParent(_hwnd))
            {
                throw new InvalidOperationException(SR.Get(SRID.ChildWindowMustHaveCorrectParent));
            }
 
            // Test to see if hwndParent and _hwnd have different DPI_AWARENESS_CONTEXT's
            if (DpiUtil.GetDpiAwarenessContext(_hwnd.Handle) != DpiUtil.GetDpiAwarenessContext(hwndParent.Handle))
            {
                _hasDpiAwarenessContextTransition = true;
            }
 
            // Only subclass the child HWND if it is owned by our thread.
            int idWindowProcess;
            int idWindowThread = UnsafeNativeMethods.GetWindowThreadProcessId(_hwnd, out idWindowProcess);
 
#if WCP_SERVER2003_OR_LATER_ENABLED
            IntPtr hCurrentThread = UnsafeNativeMethods.GetCurrentThread();
            if ((idWindowThread == SafeNativeMethods.GetThreadId(hCurrentThread)) &&
                (idWindowProcess == UnsafeNativeMethods.GetProcessIdOfThread(hCurrentThread)))
#else
            if ((idWindowThread == SafeNativeMethods.GetCurrentThreadId()) &&
                (idWindowProcess == SafeNativeMethods.GetCurrentProcessId()))
#endif
            {
                _hwndSubclass = new HwndSubclass(_hwndSubclassHook);
                _hwndSubclass.CriticalAttach(_hwnd.Handle);
            }
 
            // Initially make sure the window is hidden.  We will show it later during rendering.
            UnsafeNativeMethods.ShowWindowAsync(_hwnd, NativeMethods.SW_HIDE);
 
            // Assume the desired size is the initial size.  If the window was
            // created with a 0-length dimension, we assume this means we
            // should fill all available space.
            NativeMethods.RECT rc = new NativeMethods.RECT();
            SafeNativeMethods.GetWindowRect(_hwnd, ref rc);
 
            // Convert from pixels to measure units.
            // PresentationSource can't be null if we get here.
            PresentationSource source = PresentationSource.CriticalFromVisual(this, false /* enable2DTo3DTransition */);
            Point ptUpperLeft = new Point(rc.left, rc.top);
            Point ptLowerRight = new Point(rc.right, rc.bottom);
            ptUpperLeft = source.CompositionTarget.TransformFromDevice.Transform(ptUpperLeft);
            ptLowerRight = source.CompositionTarget.TransformFromDevice.Transform(ptLowerRight);
            _desiredSize = new Size(ptLowerRight.X - ptUpperLeft.X, ptLowerRight.Y - ptUpperLeft.Y);
 
            // We have a new desired size, so invalidate measure.
            InvalidateMeasure();
        }
 
        /// <SecurityNote>
        ///     Critical - calls CriticalHandle.
        ///     TreatAsSafe - destroying a window previously created considered safe.
        /// </SecurityNote>
        [ SecurityCritical, SecurityTreatAsSafe  ]
        private void DestroyWindow()
        {
            // Destroy the window if we are hosting one.
            if( CriticalHandle == IntPtr.Zero)
                return;
 
            if(!CheckAccess())
            {
                // I understand we can get in here on the finalizer thread.  And
                // touching other GC'ed objects in the finalizer is typically bad.
                // But a Context object can be accessed after finalization.
                // We need to touch the Context to switch to the right thread.
                // If the Context has been finalized then we won't get switched
                // and that is OK.
                Dispatcher.BeginInvoke(DispatcherPriority.Normal, new DispatcherOperationCallback(AsyncDestroyWindow), null);
                return;
            }
 
            HandleRef hwnd = _hwnd;
            _hwnd = new HandleRef(null, IntPtr.Zero);
 
            DestroyWindowCore(hwnd);
        }
 
        private object AsyncDestroyWindow(object arg)
        {
            DestroyWindow();
            return null;
        }
 
        ///<SecurityNote>
        ///     Critical - returns Handle
        ///</SecurityNote>
        internal IntPtr CriticalHandle
        {
            [SecurityCritical]
            get
            {
                if(_hwnd.Handle != IntPtr.Zero)
                {
                    if(!UnsafeNativeMethods.IsWindow(_hwnd))
                    {
                        _hwnd = new HandleRef(null, IntPtr.Zero);
                    }
                }
 
                return _hwnd.Handle;
            }
        }
 
        ///<SecurityNote>
        ///     Critical - can be used to spoof messages.
        ///</SecurityNote>
        [ SecurityCritical ]
        private IntPtr SubclassWndProc(IntPtr hwnd, int msg, IntPtr wParam, IntPtr lParam, ref bool handled)
        {
            IntPtr result = IntPtr.Zero ;
 
            // Call the virtual first.
            result = WndProc(hwnd, msg, wParam, lParam, ref handled);
 
            // Call the handlers for the MessageHook event.
            if(!handled && _hooks != null)
            {
                for(int i = 0, nCount = _hooks.Count; i < nCount; i++)
                {
                    result = ((HwndSourceHook)_hooks[i])(hwnd, msg, wParam, lParam, ref handled);
                    if(handled)
                    {
                        break;
                    }
                }
            }
 
            return result;
        }
 
        private DependencyPropertyChangedEventHandler _handlerEnabledChanged;
        private DependencyPropertyChangedEventHandler _handlerVisibleChanged;
        private EventHandler _handlerLayoutUpdated;
 
        ///<SecurityNote>
        ///     Critical - ctor was critical. Manipulating/Handing this out to PT would be unsafe.
        ///</SecurityNote>
        [ SecurityCritical ]
        private HwndSubclass _hwndSubclass;
 
        ///<SecurityNote>
        ///     Critical - ctor was critical. Manipulating/Handing this out to PT would be unsafe.
        ///</SecurityNote>
        [ SecurityCritical ]
        private HwndWrapperHook _hwndSubclassHook;
 
        ///<SecurityNote>
        ///     Critical - ctor was critical. Manipulating/Handing this out to PT would be unsafe.
        ///</SecurityNote>
        [ SecurityCritical ]
        private HandleRef _hwnd;
 
        private ArrayList _hooks;
        private Size _desiredSize;
 
        /// <summary>
        /// True when the parent of <see cref="_hwnd"/> and <see cref="_hwnd"/>
        /// have different DPI_AWARENESS_CONTEXT values. This indicates that 
        /// DPI transitions are possible in content hosted by this <see cref="HwndHost"/>. 
        /// </summary>
        private bool _hasDpiAwarenessContextTransition = false;
 
        private SecurityCriticalDataForSet<bool> _fTrusted ;
 
        private bool _isBuildingWindow = false;
 
        private bool _isDisposed = false;
 
        private class WeakEventDispatcherShutdown: WeakReference
        {
            public WeakEventDispatcherShutdown(HwndHost hwndHost, Dispatcher that): base(hwndHost)
            {
                _that = that;
                _that.ShutdownFinished += new EventHandler(this.OnShutdownFinished);
            }
 
            public void OnShutdownFinished(object sender, EventArgs e)
            {
                HwndHost hwndHost = this.Target as HwndHost;
                if(null != hwndHost)
                {
                    hwndHost.OnDispatcherShutdown(sender, e);
                }
                else
                {
                    Dispose();
                }
            }
 
            public void Dispose()
            {
                if(null != _that)
                {
                    _that.ShutdownFinished-= new EventHandler(this.OnShutdownFinished);
                }
            }
 
            private Dispatcher _that;
        }
        WeakEventDispatcherShutdown _weakEventDispatcherShutdown;
    }
}