Fixes a crash when scrolling quickly on Mac....

chrome/browser/renderer_host/backing_store_mac.cc

Index: chrome/browser/renderer_host/backing_store_mac.cc
===================================================================
--- chrome/browser/renderer_host/backing_store_mac.cc	(revision 18624)
+++ chrome/browser/renderer_host/backing_store_mac.cc	(working copy)
@@ -65,32 +65,43 @@
   uint8_t* x = static_cast<uint8_t*>(backing_bitmap.getPixels());
 
   if (dx) {
-    // Horizontal scroll. According to msdn, positive values of |dx| scroll
-    // left, but in practice this seems reversed. TODO(port): figure this
-    // out. For now just reverse the sign.
-    dx *= -1;
+    // Do not memmove any data if the scroll distance (|dx|) is greater
+    // than |clip_rect.width()|.  If this is true, then none of the
+    // previous pixels will still be on the screen after the scroll.
+    // The call to PaintRect() below will redraw the entire area.
+    if (abs(dx) < clip_rect.width()) {
+      // Horizontal scroll. According to msdn, positive values of |dx| scroll
+      // left, but in practice this seems reversed. TODO(port): figure this
+      // out. For now just reverse the sign.
+      dx *= -1;
 
-    // This is the number of bytes to move per line at 4 bytes per pixel.
-    const int len = (clip_rect.width() - abs(dx)) * 4;
+      // This is the number of bytes to move per line at 4 bytes per pixel.
+      const int len = (clip_rect.width() - abs(dx)) * 4;
 
-    // Move |x| to the first pixel of the first row.
-    x += clip_rect.y() * stride;
-    x += clip_rect.x() * 4;
+      // Move |x| to the first pixel of the first row.
+      x += clip_rect.y() * stride;
+      x += clip_rect.x() * 4;
 
-    // If we are scrolling left, move |x| to the |dx|^th pixel.
-    if (dx < 0) {
-      x -= dx * 4;
+      // If we are scrolling left, move |x| to the |dx|^th pixel.
+      if (dx < 0) {
+        x -= dx * 4;
+      }
+
+      for (int i = clip_rect.y(); i < clip_rect.bottom(); ++i) {
+        // Note that overlapping regions requires memmove, not memcpy.
+        memmove(x, x + dx * 4, len);
+        x += stride;
+      }
     }
+  } else if (dy) {
+    // Vertical scroll.  The above warning about not copying data if
+    // |dy| > |clip_rect.height()| technically applies here too, but
+    // is implicitly taken care of by the termination condition in the
+    // for loop, so we do not need to explicitly check against |dy|.
 
-    for (int i = clip_rect.y(); i < clip_rect.bottom(); ++i) {
-      // Note that overlapping regions requires memmove, not memcpy.
-      memmove(x, x + dx * 4, len);
-      x += stride;
-    }
-  } else {
-    // Vertical scroll. According to msdn, positive values of |dy| scroll down,
-    // but in practice this seems reversed. TODO(port): figure this out. For now
-    // just reverse the sign.
+    // TODO(port): According to msdn, positive values of |dy| scroll
+    // down, but in practice this seems reversed.  Figure this
+    // out. For now just reverse the sign.
     dy *= -1;
 
     const int len = clip_rect.width() * 4;