Harden NativeThemeWin::PaintIndirect()

ui/native_theme/native_theme_win.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "ui/native_theme/native_theme_win.h"
 
 #include <windows.h>
 #include <stddef.h>
 #include <uxtheme.h>
 #include <vsstyle.h>
@@ skipping 647 matching lines @@
                                    Part part,
                                    State state,
                                    const gfx::Rect& rect,
                                    const ExtraParams& extra) const {
   // TODO(asvitkine): This path is pretty inefficient - for each paint operation
   //                  it creates a new offscreen bitmap Skia canvas. This can
   //                  be sped up by doing it only once per part/state and
   //                  keeping a cache of the resulting bitmaps.
 
   // Create an offscreen canvas that is backed by an HDC.
+  // This can fail if we don't have access to GDI or if lower-level Windows
+  // calls fail, possibly due to GDI handle exhaustion.
   base::win::ScopedCreateDC offscreen_hdc(
       skia::CreateOffscreenSurface(rect.width(), rect.height()));
+  if (!offscreen_hdc.IsValid())
+    return;
+
+  // Will be NULL if lower-level Windows calls fail, or if the backing
+  // allocated is 0 pixels in size (which should never happen according to
+  // Windows documentation).
   sk_sp<SkSurface> offscreen_surface =
       skia::MapPlatformSurface(offscreen_hdc.Get());
-  DCHECK(offscreen_surface);
+  if (!offscreen_surface)
+    return;
+
   SkCanvas* offscreen_canvas = offscreen_surface->getCanvas();
   DCHECK(offscreen_canvas);
 
   // Some of the Windows theme drawing operations do not write correct alpha
   // values for fully-opaque pixels; instead the pixels get alpha 0. This is
   // especially a problem on Windows XP or when using the Classic theme.
   //
   // To work-around this, mark all pixels with a placeholder value, to detect
   // which pixels get touched by the paint operation. After paint, set any
   // pixels that have alpha 0 to opaque and placeholders to fully-transparent.
@@ skipping 1379 matching lines @@
     break;
   case LAST:
     NOTREACHED();
     break;
   }
   theme_handles_[theme_name] = handle;
   return handle;
 }
 
 }  // namespace ui