diff options
| author | sky@google.com <sky@google.com@0039d316-1c4b-4281-b951-d872f2087c98> | 2008-12-17 21:24:18 +0000 |
|---|---|---|
| committer | sky@google.com <sky@google.com@0039d316-1c4b-4281-b951-d872f2087c98> | 2008-12-17 21:24:18 +0000 |
| commit | e03f47301da8395a35913c65a9284621ad8c2eee (patch) | |
| tree | 06cc677a8095dadee44bb55f9465e48613153737 /chrome | |
| parent | 14bac21d0b669394be472b9c2c017ff69d1d9da2 (diff) | |
| download | chromium_src-e03f47301da8395a35913c65a9284621ad8c2eee.zip chromium_src-e03f47301da8395a35913c65a9284621ad8c2eee.tar.gz chromium_src-e03f47301da8395a35913c65a9284621ad8c2eee.tar.bz2 | |
Fixes crash in download tab view that resulted from attempting to
paint a download at downloads_.size(). This happened if the last
download is visible, in which case row_stop == downloads_.size() and
because the loop iterates to row_stop we try accessing
downloads_[downloads_.size()].
BUG=5520
TEST=Bring up the downloads view and make sure you can scroll to the
end of your downloads without crashing.
Review URL: http://codereview.chromium.org/14806
git-svn-id: svn://svn.chromium.org/chrome/trunk/src@7161 0039d316-1c4b-4281-b951-d872f2087c98
Diffstat (limited to 'chrome')
| -rw-r--r-- | chrome/browser/views/download_tab_view.cc | 5 |
1 files changed, 4 insertions, 1 deletions
diff --git a/chrome/browser/views/download_tab_view.cc b/chrome/browser/views/download_tab_view.cc index 6a83bd8..b0d7c77 100644 --- a/chrome/browser/views/download_tab_view.cc +++ b/chrome/browser/views/download_tab_view.cc @@ -877,7 +877,10 @@ void DownloadTabView::Paint(ChromeCanvas* canvas) { if (canvas->getClipBounds(&clip)) { int row_start = (SkScalarRound(clip.fTop) - kSpacer) / (big_icon_size_ + kSpacer); - int row_stop = SkScalarRound(clip.fBottom) / (big_icon_size_ + kSpacer); + int row_stop = + std::min(static_cast<int>(downloads_.size()) - 1, + (SkScalarRound(clip.fBottom) - kSpacer) / + (big_icon_size_ + kSpacer)); SkRect download_rect; for (int i = row_start; i <= row_stop; ++i) { int y = i * (big_icon_size_ + kSpacer) + kSpacer; |