Fixes possible crash in CursorHeightProvider

ui/views/corewm/cursor_height_provider_win.cc

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "ui/views/corewm/cursor_height_provider_win.h"
 
 #include <windows.h>
+#include <algorithm>
 #include <map>
 
 #include "base/basictypes.h"
 #include "base/memory/scoped_ptr.h"
 #include "base/win/scoped_hdc.h"
 
 namespace {
 typedef scoped_ptr<uint32_t> PixelData;
 typedef std::map<HCURSOR, int> HeightStorage;
 
@@ skipping 80 matching lines @@
   else
     last_byte_mask = 0;
 
   const uint32_t row_size =
       (bitmap_info.bmiHeader.biWidth + kBitsPeruint32 - 1) / kBitsPeruint32;
   PixelData data(GetBitmapData(icon.hbmMask, bitmap_info, hdc));
   if (data == NULL)
     return kDefaultHeight;
 
   const int cursor_height = GetSystemMetrics(SM_CYCURSOR);
-  int i = bitmap_info.bmiHeader.biHeight - cursor_height;
+  // Crash data seems to indicate cursor_height may be bigger than the bitmap.
+  int i = std::max(0, static_cast<int>(bitmap_info.bmiHeader.biHeight) -
+                   cursor_height);
   for (; i < bitmap_info.bmiHeader.biHeight; ++i) {
     if (!IsRowTransparent(data, row_size, last_byte_mask, i)) {
       i--;
       break;
     }
   }
   return bitmap_info.bmiHeader.biHeight - i - icon.yHotspot;
 }
 
 }  // namespace
@@ skipping 15 matching lines @@
     return cached_height->second;
 
   const int height = CalculateCursorHeight(cursor.hCursor);
   (*cached_heights)[cursor.hCursor] = height;
 
   return height;
 }
 
 }  // namespace corewm
 }  // namespace views