Harden NativeThemeWin::PaintIndirect()

ui/native_theme/native_theme_win.cc

Index: ui/native_theme/native_theme_win.cc
diff --git a/ui/native_theme/native_theme_win.cc b/ui/native_theme/native_theme_win.cc
index 043a3d47278a278e01d1c455157a9ae06ceec4b9..a514d057e069e21ca0bac13740d736a8ea588c61 100644
--- a/ui/native_theme/native_theme_win.cc
+++ b/ui/native_theme/native_theme_win.cc
@@ -667,9 +667,14 @@ void NativeThemeWin::PaintIndirect(SkCanvas* destination_canvas,
   // Create an offscreen canvas that is backed by an HDC.
   base::win::ScopedCreateDC offscreen_hdc(
       skia::CreateOffscreenSurface(rect.width(), rect.height()));
+  if (!offscreen_hdc.IsValid())
+    return;

[Peter Kasting, 2016/09/21 20:50:44]

Nit: It's probably worth a comment or two on these explaining what sort of thing
can cause failure, especially if those things are different (e.g. GDI handle
exhaustion for one but only OOM for the other) and/or if those things wouldn't
cause Chrome crashes anyway (e.g. mention why OOM would not have killed the
browser already, if that's something that could cause this).

[tomhudson, 2016/09/21 21:19:20]

Done, although we don't know as much as we'd like to. Since Microsoft doesn't
document much of what can cause the really low-level calls to fail, this mostly
boils down to "Will be null if lower-level Windows calls fail."

Somewhat frighteningly, even the first version of this code was expected to fail
if we didn't have access to GDI - presumably due to sandboxing.
(BitmapPlatformDevice::Create() could take a Windows shared section, but this
function always passed in NULL.)

+
   sk_sp<SkSurface> offscreen_surface =
       skia::MapPlatformSurface(offscreen_hdc.Get());
-  DCHECK(offscreen_surface);
+  if (!offscreen_surface)
+    return;
+
   SkCanvas* offscreen_canvas = offscreen_surface->getCanvas();
   DCHECK(offscreen_canvas);