Refix bug 497949 in a more efficient way that also doesn't rebreak bug 442384.

chrome/browser/ui/webui/theme_source.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/browser/ui/webui/theme_source.h"
 
 #include "base/memory/ref_counted_memory.h"
 #include "base/message_loop/message_loop.h"
 #include "base/strings/string_number_conversions.h"
 #include "chrome/browser/profiles/profile.h"
@@ skipping 74 matching lines @@
 
 void ThemeSource::StartDataRequest(
     const std::string& path,
     int render_process_id,
     int render_frame_id,
     const content::URLDataSource::GotDataCallback& callback) {
   // Default scale factor if not specified.
   float scale = 1.0f;
   std::string parsed_path;
   webui::ParsePathAndScale(GetThemeURL(path), &parsed_path, &scale);
-  scale = ui::GetScaleForScaleFactor(ui::GetSupportedScaleFactor(scale));
 
   if (IsNewTabCSSPath(parsed_path)) {
     DCHECK_CURRENTLY_ON(content::BrowserThread::IO);
     callback.Run(css_bytes_.get());
     return;
   }
 
   int resource_id = -1;
   if (parsed_path == "current-channel-logo") {
     switch (chrome::GetChannel()) {
@@ skipping 18 matching lines @@
         NOTREACHED();
 #endif
       case version_info::Channel::UNKNOWN:
         resource_id = IDR_PRODUCT_LOGO_32;
         break;
     }
   } else {
     resource_id = ResourcesUtil::GetThemeResourceId(parsed_path);
   }
 
+  // Limit the maximum scale we'll respond to.  Very large scale factors can
+  // take significant time to serve or, at worst, crash the browser due to OOM.
+  // We don't want to clamp to the max scale factor, though, for devices that
+  // use 2x scale without 2x data packs, as well as omnibox requests for larger
+  // (but still reasonable) scales (see below).
   const float max_scale = ui::GetScaleForScaleFactor(
       ResourceBundle::GetSharedInstance().GetMaxScaleFactor());
-  if (resource_id == -1) {
-    // We have no data to send back.  This shouldn't happen normally, as
-    // chrome://theme/ URLs are only used by WebUI pages and component
-    // extensions.  However, the user can also enter these into the omnibox, so
-    // we need to fail gracefully.
+  const float unreasonable_scale = max_scale * 32;
+  if ((resource_id == -1) || (scale >= unreasonable_scale)) {
+    // Either we have no data to send back, or the requested scale is
+    // unreasonably large.  This shouldn't happen normally, as chrome://theme/
+    // URLs are only used by WebUI pages and component extensions.  However, the
+    // user can also enter these into the omnibox, so we need to fail
+    // gracefully.
     callback.Run(nullptr);
   } else if ((GetMimeType(path) == "image/png") && (scale > max_scale)) {
     SendThemeImage(callback, resource_id, scale);
   } else {
     SendThemeBitmap(callback, resource_id, scale);
   }
 }
 
 std::string ThemeSource::GetMimeType(const std::string& path) const {
   std::string parsed_path;
@@ skipping 65 matching lines @@
   } else {
     DCHECK_CURRENTLY_ON(content::BrowserThread::IO);
     // Fetching image data in ResourceBundle should happen on the UI thread. See
     // crbug.com/449277
     content::BrowserThread::PostTaskAndReply(
         content::BrowserThread::UI, FROM_HERE,
         base::Bind(&ProcessResourceOnUIThread, resource_id, scale, data),
         base::Bind(callback, data));
   }
 }