Fixes possible crash in CursorHeightProvider

ui/views/corewm/cursor_height_provider_win.cc

Index: ui/views/corewm/cursor_height_provider_win.cc
diff --git a/ui/views/corewm/cursor_height_provider_win.cc b/ui/views/corewm/cursor_height_provider_win.cc
index e0f79e69371698a3863c96c7becb3ba5f6922a7f..97ed7a3465e5ab6fac56d1a4497c8d01e7fabb5b 100644
--- a/ui/views/corewm/cursor_height_provider_win.cc
+++ b/ui/views/corewm/cursor_height_provider_win.cc
@@ -5,6 +5,7 @@
 #include "ui/views/corewm/cursor_height_provider_win.h"
 
 #include <windows.h>
+#include <algorithm>
 #include <map>
 
 #include "base/basictypes.h"
@@ -105,7 +106,9 @@ int CalculateCursorHeight(HCURSOR cursor_handle) {
     return kDefaultHeight;
 
   const int cursor_height = GetSystemMetrics(SM_CYCURSOR);
-  int i = bitmap_info.bmiHeader.biHeight - cursor_height;
+  // Crash data seems to indicate cursor_height may be bigger than the bitmap.
+  int i = std::max(0, static_cast<int>(bitmap_info.bmiHeader.biHeight) -
+                   cursor_height);
   for (; i < bitmap_info.bmiHeader.biHeight; ++i) {
     if (!IsRowTransparent(data, row_size, last_byte_mask, i)) {
       i--;