Fixing Win98 GDI leak: Select new HBRUSH before deleting the old one.

sr=roc+moz@cs.cmu.edu
r=ere@atp.fi
# 159298

gfx/src/windows/nsRenderingContextWin.cpp

@@ -2554,7 +2554,7 @@ public:
   SolidBrushCache();
   ~SolidBrushCache();
 
-  HBRUSH  GetSolidBrush(COLORREF aColor);
+  HBRUSH  GetSolidBrush(HDC theHDC, COLORREF aColor);
 
 private:
   struct CacheEntry {
@@ -2587,7 +2587,7 @@ SolidBrushCache::~SolidBrushCache()
 }
 
 HBRUSH
-SolidBrushCache::GetSolidBrush(COLORREF aColor)
+SolidBrushCache::GetSolidBrush(HDC theHDC, COLORREF aColor)
 {
   int     i;
   HBRUSH  result = NULL;
@@ -2597,6 +2597,7 @@ SolidBrushCache::GetSolidBrush(COLORREF aColor)
     if (mCache[i].mBrush && (mCache[i].mBrushColor == aColor)) {
       // Found an existing brush
       result = mCache[i].mBrush;
+      ::SelectObject(theHDC, result);
       break;
     }
   }
@@ -2606,6 +2607,10 @@ SolidBrushCache::GetSolidBrush(COLORREF aColor)
     // new brush
     result = (HBRUSH)::CreateSolidBrush(PALETTERGB_COLORREF(aColor));
 
+    // Select the brush.  NOTE: we want to select the new brush before
+    // deleting the old brush to prevent any win98 GDI leaks (bug 159298)
+    ::SelectObject(theHDC, result);
+
     // If there's an empty slot in the cache, then just add it there
     if (i >= BRUSH_CACHE_SIZE) {
       // Nope. The cache is full so we need to replace the oldest entry
@@ -2631,9 +2636,8 @@ HBRUSH nsRenderingContextWin :: SetupSolidBrush(void)
 {
   if ((mCurrentColor != mCurrBrushColor) || (NULL == mCurrBrush))
   {
-    HBRUSH tbrush = gSolidBrushCache.GetSolidBrush(mColor);
+    HBRUSH tbrush = gSolidBrushCache.GetSolidBrush(mDC, mColor);
 
-    ::SelectObject(mDC, tbrush);
     mCurrBrush = tbrush;
     mCurrBrushColor = mCurrentColor;
   }