From e03f47301da8395a35913c65a9284621ad8c2eee Mon Sep 17 00:00:00 2001 From: "sky@google.com" Date: Wed, 17 Dec 2008 21:24:18 +0000 Subject: Fixes crash in download tab view that resulted from attempting to paint a download at downloads_.size(). This happened if the last download is visible, in which case row_stop == downloads_.size() and because the loop iterates to row_stop we try accessing downloads_[downloads_.size()]. BUG=5520 TEST=Bring up the downloads view and make sure you can scroll to the end of your downloads without crashing. Review URL: http://codereview.chromium.org/14806 git-svn-id: svn://svn.chromium.org/chrome/trunk/src@7161 0039d316-1c4b-4281-b951-d872f2087c98 --- chrome/browser/views/download_tab_view.cc | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) (limited to 'chrome') diff --git a/chrome/browser/views/download_tab_view.cc b/chrome/browser/views/download_tab_view.cc index 6a83bd8..b0d7c77 100644 --- a/chrome/browser/views/download_tab_view.cc +++ b/chrome/browser/views/download_tab_view.cc @@ -877,7 +877,10 @@ void DownloadTabView::Paint(ChromeCanvas* canvas) { if (canvas->getClipBounds(&clip)) { int row_start = (SkScalarRound(clip.fTop) - kSpacer) / (big_icon_size_ + kSpacer); - int row_stop = SkScalarRound(clip.fBottom) / (big_icon_size_ + kSpacer); + int row_stop = + std::min(static_cast(downloads_.size()) - 1, + (SkScalarRound(clip.fBottom) - kSpacer) / + (big_icon_size_ + kSpacer)); SkRect download_rect; for (int i = row_start; i <= row_stop; ++i) { int y = i * (big_icon_size_ + kSpacer) + kSpacer; -- cgit v1.1