Check better that handles are actual handles to a region.

objects/region.c

@@ -774,7 +774,7 @@ static void REGION_UnionRectWithRegion(const RECT *rect, WINEREGION *rgn)
  */
 BOOL REGION_UnionRectWithRgn( HRGN hrgn, const RECT *lpRect )
 {
-    RGNOBJ *obj = (RGNOBJ *) GDI_HEAP_LOCK( hrgn );
+    RGNOBJ *obj = (RGNOBJ *) GDI_GetObjPtr( hrgn, REGION_MAGIC );
 
     if(!obj) return FALSE;
     REGION_UnionRectWithRegion( lpRect, obj->rgn );
@@ -938,6 +938,8 @@ INT WINAPI CombineRgn(HRGN hDest, HRGN hSrc1, HRGN hSrc2, INT mode)
 	  REGION_DumpRegion(destObj->rgn);
 
 	GDI_HEAP_UNLOCK( hDest );
+    } else {
+       ERR("Invalid rgn=%04x\n", hDest);
     }
     return result;
 }
@@ -2745,7 +2747,7 @@ empty:
  * lpPt:	Points to offset the cropped region. Can be NULL (no offset).
  *
  * hDst: Region to hold the result (a new region is created if it's 0).
- *       Allowed to be the same region as hSrc in which case everyhting
+ *       Allowed to be the same region as hSrc in which case everything
  *	 will be done in place, with no memory reallocations.
  *
  * Returns: hDst if success, 0 otherwise.
@@ -2773,7 +2775,7 @@ HRGN REGION_CropRgn( HRGN hDst, HRGN hSrc, const RECT *lpRect, const POINT *lpPt
 
 */
 
-    RGNOBJ *objSrc = (RGNOBJ *) GDI_HEAP_LOCK( hSrc );
+    RGNOBJ *objSrc = (RGNOBJ *) GDI_GetObjPtr( hSrc, REGION_MAGIC );
 
     if(objSrc)
     {
@@ -2782,13 +2784,16 @@ HRGN REGION_CropRgn( HRGN hDst, HRGN hSrc, const RECT *lpRect, const POINT *lpPt
 
 	if( hDst )
 	{
-	    objDst = (RGNOBJ *) GDI_HEAP_LOCK( hDst );
+	    if (!(objDst = (RGNOBJ *) GDI_GetObjPtr( hDst, REGION_MAGIC )))
+	    {
+	       hDst = 0;
+	       goto done;
+	    }
 	    rgnDst = objDst->rgn;
 	}
 	else
 	{
-	    rgnDst = HeapAlloc(SystemHeap, 0, sizeof( WINEREGION ));
-	    if( rgnDst ) 
+	    if ((rgnDst = HeapAlloc(SystemHeap, 0, sizeof( WINEREGION ))))
 	    {
 	        rgnDst->size = rgnDst->numRects = 0;
 	        rgnDst->rects = NULL;	/* back end will allocate exact number */