Attempt to fix crash that I don't fully understand and can't repro :(...

chrome/browser/autocomplete/autocomplete_popup_view_win.cc

 // Copyright (c) 2006-2008 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/browser/autocomplete/autocomplete_popup_view_win.h"
 
 // TODO(deanm): Clean up these includes, not going to fight it now.
 #include <atlbase.h>
 #include <atlapp.h>
 #include <atlcrack.h>
@@ skipping 327 matching lines @@
 
     // When the user has the left button down, update their selection
     // immediately (don't wait for mouseup).
     if (keys & MK_LBUTTON)
       model_->SetSelectedLine(new_hovered_line, false);
   }
 }
 
 void AutocompletePopupViewWin::OnPaint(HDC other_dc) {
   const AutocompleteResult& result = model_->result();
-  DCHECK(!result.empty());  // Shouldn't be drawing an empty popup.
+  CHECK(!result.empty());  // Shouldn't be drawing an empty popup; any empty
+                           // result set should have synchronously closed us.
 
   CPaintDC dc(m_hWnd);
 
   RECT rc;
   GetClientRect(&rc);
   mirroring_context_->Initialize(rc.left, rc.right,
       l10n_util::GetTextDirection() == l10n_util::RIGHT_TO_LEFT);
   DrawBorder(rc, dc);
 
   bool all_descriptions_empty = true;
   for (AutocompleteResult::const_iterator i(result.begin()); i != result.end();
        ++i) {
     if (!i->description.empty()) {
       all_descriptions_empty = false;
       break;
     }
   }
 
   // Only repaint the invalid lines.
+  // In rare cases, it seems possible to get line offsets off the end of the
+  // popup.  I suspect this can happen when the user invalidates a new line
+  // (e.g. by moving the mouse) and, before the paint request is serviced, hits
+  // a key that causes autocomplete to run, causing the results list to become
+  // shorter (at least initially).  So sanitize the line numbers here.
+  const size_t last_valid_line = result.size() - 1;
   const size_t first_line = PixelToLine(dc.m_ps.rcPaint.top);
-  const size_t last_line = PixelToLine(dc.m_ps.rcPaint.bottom);
+  if (first_line > last_valid_line)
+    return;
+  const size_t last_line =
+      std::min(PixelToLine(dc.m_ps.rcPaint.bottom), last_valid_line);
+
   for (size_t i = first_line; i <= last_line; ++i) {
     DrawLineInfo::LineStatus status;
     // Selection should take precedence over hover.
     if (i == model_->selected_line())
       status = DrawLineInfo::SELECTED;
     else if (i == model_->hovered_line())
       status = DrawLineInfo::HOVERED;
     else
       status = DrawLineInfo::NORMAL;
     DrawEntry(dc, rc, i, status, all_descriptions_empty,
@@ skipping 276 matching lines @@
 }
 
 void AutocompletePopupViewWin::DrawStar(HDC dc, int x, int y) const {
   ChromeCanvas canvas(star_->width(), star_->height(), false);
   // Make the background completely transparent.
   canvas.drawColor(SK_ColorBLACK, SkPorterDuff::kClear_Mode);
   canvas.DrawBitmapInt(*star_, 0, 0);
   canvas.getTopPlatformDevice().drawToHDC(
       dc, mirroring_context_->GetLeft(x, x + star_->width()), y, NULL);
 }