Explicitly store the stack of saved DCs in the DC structure instead of

using the 16-bit hNext field in the object header.

dlls/gdi/dc.c

@@ -64,6 +64,7 @@ DC *DC_AllocDC( const DC_FUNCTIONS *funcs, WORD magic )
     dc->funcs               = funcs;
     dc->physDev             = NULL;
     dc->saveLevel           = 0;
+    dc->saved_dc            = 0;
     dc->dwHookData          = 0;
     dc->hookProc            = NULL;
     dc->hookThunk           = NULL;
@@ -335,6 +336,7 @@ HDC WINAPI GetDCState( HDC hdc )
 
     newdc->hSelf = (HDC)handle;
     newdc->saveLevel = 0;
+    newdc->saved_dc  = 0;
 
     PATH_InitGdiPath( &newdc->path );
 
@@ -506,8 +508,8 @@ INT WINAPI SaveDC( HDC hdc )
 	return 0;
     }
 
-    dcs->header.hNext = dc->header.hNext;
-    dc->header.hNext = HDC_16(hdcs);
+    dcs->saved_dc = dc->saved_dc;
+    dc->saved_dc = hdcs;
     TRACE("(%p): returning %d\n", hdc, dc->saveLevel+1 );
     ret = ++dc->saveLevel;
     GDI_ReleaseObj( hdcs );
@@ -550,13 +552,14 @@ BOOL WINAPI RestoreDC( HDC hdc, INT level )
     success=TRUE;
     while (dc->saveLevel >= level)
     {
-	HDC hdcs = HDC_32(dc->header.hNext);
+        HDC hdcs = dc->saved_dc;
 	if (!(dcs = DC_GetDCPtr( hdcs )))
 	{
 	  GDI_ReleaseObj( hdc );
 	  return FALSE;
 	}
-	dc->header.hNext = dcs->header.hNext;
+        dc->saved_dc = dcs->saved_dc;
+        dcs->saved_dc = 0;
 	if (--dc->saveLevel < level)
 	{
 	    SetDCState( hdc, hdcs );
@@ -768,11 +771,11 @@ BOOL WINAPI DeleteDC( HDC hdc )
 
     while (dc->saveLevel)
     {
-	DC * dcs;
-	HDC hdcs = HDC_32(dc->header.hNext);
-	if (!(dcs = DC_GetDCPtr( hdcs ))) break;
-	dc->header.hNext = dcs->header.hNext;
-	dc->saveLevel--;
+        DC * dcs;
+        HDC hdcs = dc->saved_dc;
+        if (!(dcs = DC_GetDCPtr( hdcs ))) break;
+        dc->saved_dc = dcs->saved_dc;
+        dc->saveLevel--;
         if (dcs->hClipRgn) DeleteObject( dcs->hClipRgn );
         if (dcs->hVisRgn) DeleteObject( dcs->hVisRgn );
         PATH_DestroyGdiPath(&dcs->path);

dlls/gdi/gdi_private.h

@@ -209,6 +209,7 @@ typedef struct tagDC
     const struct tagDC_FUNCS *funcs; /* DC function table */
     PHYSDEV      physDev;         /* Physical device (driver-specific) */
     INT          saveLevel;
+    HDC          saved_dc;
     DWORD        dwHookData;
     FARPROC16    hookProc;         /* the original SEGPTR ... */
     DCHOOKPROC   hookThunk;        /* ... and the thunk to call it */

dlls/gdi/gdiobj.c

@@ -723,7 +723,8 @@ void *GDI_AllocObject( WORD size, WORD magic, HGDIOBJ *handle, const struct gdi_
     _EnterSysLevel( &GDI_level );
     switch(magic)
     {
-    default:
+    case PEN_MAGIC:
+    case BRUSH_MAGIC:
         if (GDI_HeapSel)
         {
             if (!(hlocal = LOCAL_Alloc( GDI_HeapSel, LMEM_MOVEABLE, size ))) goto error;
@@ -733,23 +734,11 @@ void *GDI_AllocObject( WORD size, WORD magic, HGDIOBJ *handle, const struct gdi_
             break;
         }
         /* fall through */
-    case DC_MAGIC:
-    case DISABLED_DC_MAGIC:
-    case META_DC_MAGIC:
-    case METAFILE_MAGIC:
-    case METAFILE_DC_MAGIC:
-    case ENHMETAFILE_MAGIC:
-    case ENHMETAFILE_DC_MAGIC:
-    case MEMORY_DC_MAGIC:
-    case BITMAP_MAGIC:
-    case PALETTE_MAGIC:
-    case FONT_MAGIC:
-    case REGION_MAGIC:
+    default:
         if (!(obj = alloc_large_heap( size, handle ))) goto error;
         break;
     }
 
-    obj->hNext   = 0;
     obj->wMagic  = magic|OBJECT_NOSYSTEM;
     obj->dwCount = 0;
     obj->funcs   = funcs;

include/gdi.h

@@ -59,7 +59,6 @@ struct hdc_list;
 
 typedef struct tagGDIOBJHDR
 {
-    HANDLE16    hNext;
     WORD        wMagic;
     DWORD       dwCount;
     const struct gdi_obj_funcs *funcs;