Fix for crash in histogram BucketIndex

base/metrics/histogram.cc

 // Copyright (c) 2010 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 // Histogram is an object that aggregates statistics, and can summarize them in
 // various forms, including ASCII graphical, HTML, and numerically (as a
 // vector of numbers corresponding to each of the aggregating buckets).
 // See header file for details and examples.
 
 #include "base/metrics/histogram.h"
 
 #include <math.h>
 
 #include <algorithm>
 #include <string>
 
 #include "base/logging.h"
 #include "base/pickle.h"
 #include "base/stringprintf.h"
 #include "base/synchronization/lock.h"
 
 namespace base {
 
 typedef Histogram::Count Count;
 
+// static
+const size_t Histogram::kBucketCount_MAX = 10000u;
+
 scoped_refptr<Histogram> Histogram::FactoryGet(const std::string& name,
     Sample minimum, Sample maximum, size_t bucket_count, Flags flags) {
   scoped_refptr<Histogram> histogram(NULL);
 
   // Defensive code.
   if (minimum < 1)
     minimum = 1;
   if (maximum > kSampleType_MAX - 1)
     maximum = kSampleType_MAX - 1;
 
@@ skipping 370 matching lines @@
   // Use simple binary search.  This is very general, but there are better
   // approaches if we knew that the buckets were linearly distributed.
   DCHECK_LE(ranges(0), value);
   DCHECK_GT(ranges(bucket_count()), value);
   size_t under = 0;
   size_t over = bucket_count();
   size_t mid;
 
   do {
     DCHECK_GE(over, under);
-    mid = (over + under)/2;
+    mid = under + (over - under)/2;
     if (mid == under)
       break;
     if (ranges(mid) <= value)
       under = mid;
     else
       over = mid;
   } while (true);
 
   DCHECK_LE(ranges(mid), value);
-  DCHECK_GT(ranges(mid+1), value);
+  CHECK_GT(ranges(mid+1), value);
   return mid;
 }
 
 // Use the actual bucket widths (like a linear histogram) until the widths get
 // over some transition value, and then use that transition width.  Exponentials
 // get so big so fast (and we don't expect to see a lot of entries in the large
 // buckets), so we need this to make it possible to see what is going on and
 // not have 0-graphical-height buckets.
 double Histogram::GetBucketSize(Count current, size_t i) const {
   DCHECK_GT(ranges(i + 1), ranges(i));
@@ skipping 39 matching lines @@
 }
 
 void Histogram::Initialize() {
   sample_.Resize(*this);
   if (declared_min_ < 1)
     declared_min_ = 1;
   if (declared_max_ > kSampleType_MAX - 1)
     declared_max_ = kSampleType_MAX - 1;
   DCHECK_LE(declared_min_, declared_max_);
   DCHECK_GT(bucket_count_, 1u);
+  CHECK_LT(bucket_count_, kBucketCount_MAX);
   size_t maximal_bucket_count = declared_max_ - declared_min_ + 2;
   DCHECK_LE(bucket_count_, maximal_bucket_count);
   DCHECK_EQ(0, ranges_[0]);
   ranges_[bucket_count_] = kSampleType_MAX;
   InitializeBucketRange();
   DCHECK(ValidateBucketRanges());
   StatisticsRecorder::Register(this);
 }
 
 bool Histogram::HasValidRangeChecksum() const {
@@ skipping 547 matching lines @@
 }
 
 // static
 StatisticsRecorder::HistogramMap* StatisticsRecorder::histograms_ = NULL;
 // static
 base::Lock* StatisticsRecorder::lock_ = NULL;
 // static
 bool StatisticsRecorder::dump_on_exit_ = false;
 
 }  // namespace base