Fixes crash in download tab view that resulted from attempting to...

chrome/browser/views/download_tab_view.cc

 // Copyright (c) 2006-2008 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/browser/views/download_tab_view.h"
 
 #include <time.h>
 
 #include <algorithm>
 #include <functional>
@@ skipping 859 matching lines @@
 void DownloadTabView::Paint(ChromeCanvas* canvas) {
   views::View::Paint(canvas);
 
   if (download_util::kBigIconSize == 0 || downloads_.size() == 0)
     return;
 
   SkRect clip;
   if (canvas->getClipBounds(&clip)) {
     int row_start = (SkScalarRound(clip.fTop) - kSpacer) /
                     (big_icon_size_ + kSpacer);
-    int row_stop = SkScalarRound(clip.fBottom) / (big_icon_size_ + kSpacer);
+    int row_stop =
+        std::min(static_cast<int>(downloads_.size()) - 1,
+                 (SkScalarRound(clip.fBottom) - kSpacer) /
+                 (big_icon_size_ + kSpacer));
     SkRect download_rect;
     for (int i = row_start; i <= row_stop; ++i) {
       int y = i * (big_icon_size_ + kSpacer) + kSpacer;
       if (HasFloatingViewForPoint(0, y))
         continue;
       download_rect.set(SkIntToScalar(0),
                         SkIntToScalar(y),
                         SkIntToScalar(width()),
                         SkIntToScalar(y + big_icon_size_));
       if (SkRect::Intersects(clip, download_rect)) {
@@ skipping 435 matching lines @@
     case NOTIFY_DOWNLOAD_STOP:
       DCHECK(profile()->HasCreatedDownloadManager());
       contents_->SetIsLoading(
           profile()->GetDownloadManager()->in_progress_count() > 0,
           NULL);
       break;
     default:
       break;
   }
 }