If WM_DESTROY is guaranteed to be processed *before* child windows are completely deallocated, then does this imply that killing the message loop before destroying windows will prevent the child windows from being completely deallocated, i.e. resource leak?
The WM_DESTROY message is sent when a window is being destroyed. It is sent to the window procedure of the window being destroyed after the window is removed from the screen.
This message is sent first to the window being destroyed and then to the child windows (if any) as they are destroyed. During the processing of the message, it can be assumed that all child windows still exist.