Harden NativeThemeWin::PaintIndirect()

ui/native_theme/native_theme_win.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "ui/native_theme/native_theme_win.h"
 
 #include <windows.h>
 #include <stddef.h>
 #include <uxtheme.h>
 #include <vsstyle.h>
@@ skipping 649 matching lines @@
                                    const gfx::Rect& rect,
                                    const ExtraParams& extra) const {
   // TODO(asvitkine): This path is pretty inefficient - for each paint operation
   //                  it creates a new offscreen bitmap Skia canvas. This can
   //                  be sped up by doing it only once per part/state and
   //                  keeping a cache of the resulting bitmaps.
 
   // Create an offscreen canvas that is backed by an HDC.
   base::win::ScopedCreateDC offscreen_hdc(
       skia::CreateOffscreenSurface(rect.width(), rect.height()));
+  if (!offscreen_hdc.IsValid())
+    return;

[Peter Kasting, 2016/09/21 20:50:44]

Nit: It's probably worth a comment or two on these explaining what sort of thing
can cause failure, especially if those things are different (e.g. GDI handle
exhaustion for one but only OOM for the other) and/or if those things wouldn't
cause Chrome crashes anyway (e.g. mention why OOM would not have killed the
browser already, if that's something that could cause this).

[tomhudson, 2016/09/21 21:19:20]

Done, although we don't know as much as we'd like to. Since Microsoft doesn't
document much of what can cause the really low-level calls to fail, this mostly
boils down to "Will be null if lower-level Windows calls fail."

Somewhat frighteningly, even the first version of this code was expected to fail
if we didn't have access to GDI - presumably due to sandboxing.
(BitmapPlatformDevice::Create() could take a Windows shared section, but this
function always passed in NULL.)

+
   sk_sp<SkSurface> offscreen_surface =
       skia::MapPlatformSurface(offscreen_hdc.Get());
-  DCHECK(offscreen_surface);
+  if (!offscreen_surface)
+    return;
+
   SkCanvas* offscreen_canvas = offscreen_surface->getCanvas();
   DCHECK(offscreen_canvas);
 
   // Some of the Windows theme drawing operations do not write correct alpha
   // values for fully-opaque pixels; instead the pixels get alpha 0. This is
   // especially a problem on Windows XP or when using the Classic theme.
   //
   // To work-around this, mark all pixels with a placeholder value, to detect
   // which pixels get touched by the paint operation. After paint, set any
   // pixels that have alpha 0 to opaque and placeholders to fully-transparent.
@@ skipping 1379 matching lines @@
     break;
   case LAST:
     NOTREACHED();
     break;
   }
   theme_handles_[theme_name] = handle;
   return handle;
 }
 
 }  // namespace ui