Fix possible integer overflow in SkTSearch's midpoint calculation

include/core/SkTSearch.h

 
 /*
  * Copyright 2006 The Android Open Source Project
  *
  * Use of this source code is governed by a BSD-style license that can be
  * found in the LICENSE file.
  */
 
 
 #ifndef SkTSearch_DEFINED
@@ skipping 31 matching lines @@
     if (count <= 0) {
         return ~0;
     }
 
     SkASSERT(base != NULL); // base may be NULL if count is zero
 
     int lo = 0;
     int hi = count - 1;
 
     while (lo < hi) {
-        int mid = (hi + lo) >> 1;
+        int mid = lo + ((hi - lo) >> 1);
         const T* elem = (const T*)((const char*)base + mid * elemSize);
 
         if (less(*elem, key))
             lo = mid + 1;
         else
             hi = mid;
     }
 
     const T* elem = (const T*)((const char*)base + hi * elemSize);
     if (less(*elem, key)) {
@@ skipping 74 matching lines @@
     enum {
         STORAGE = 64
     };
     char    fStorage[STORAGE+1];
 };
 
 // Helper when calling qsort with a compare proc that has typed its arguments
 #define SkCastForQSort(compare) reinterpret_cast<int (*)(const void*, const void*)>(compare)
 
 #endif