Merge multiple histogram snapshots into single one for reporting.

base/metrics/histogram_persistence.cc

 // Copyright (c) 2015 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "base/metrics/histogram_persistence.h"
 
 #include "base/lazy_instance.h"
 #include "base/logging.h"
 #include "base/memory/scoped_ptr.h"
 #include "base/metrics/histogram.h"
@@ skipping 58 matching lines @@
 struct PersistentHistogramData {
   int histogram_type;
   int flags;
   int minimum;
   int maximum;
   uint32_t bucket_count;
   PersistentMemoryAllocator::Reference ranges_ref;
   uint32_t ranges_checksum;
   PersistentMemoryAllocator::Reference counts_ref;
   HistogramSamples::Metadata samples_metadata;
+  HistogramSamples::Metadata logged_metadata;
 
   // Space for the histogram name will be added during the actual allocation
   // request. This must be the last field of the structure. A zero-size array
   // or a "flexible" array would be preferred but is not (yet) valid C++.
   char name[1];
 };
 
 // The object held here will obviously not be destructed at process exit
 // but that's okay since PersistentMemoryAllocator objects are explicitly
 // forbidden from doing anything essential at exit anyway due to the fact
@@ skipping 15 matching lines @@
     ranges->set_range(i, ranges_data[i]);
   }
 
   ranges->ResetChecksum();
   if (ranges->checksum() != ranges_checksum)
     return nullptr;
 
   return ranges.release();
 }
 
+// Calculate the number of bytes required to store all of a histogram's
+// "counts". This will return zero (0) if |bucket_count| is not valid.
+size_t CalculateRequiredCountsBytes(size_t bucket_count) {
+  // 2 because each "sample count" also requires a backup "logged count"
+  // used for calculating the delta during snapshot operations.
+  const unsigned kBytesPerBucket = 2 * sizeof(HistogramBase::AtomicCount);
+
+  // If the |bucket_count| is such that it would overflow the return type,
+  // perhaps as the result of a malicious actor, then return zero to
+  // indicate the problem to the caller.
+  if (bucket_count > std::numeric_limits<uint32_t>::max() / kBytesPerBucket)
+    return 0;
+
+  return bucket_count * kBytesPerBucket;
+}
+
 }  // namespace
 
 const Feature kPersistentHistogramsFeature{
   "PersistentHistograms", FEATURE_DISABLED_BY_DEFAULT
 };
 
 // Get the histogram in which create results are stored. This is copied almost
 // exactly from the STATIC_HISTOGRAM_POINTER_BLOCK macro but with added code
 // to prevent recursion (a likely occurance because the creation of a new
 // histogram can end up calling this.)
@@ skipping 113 matching lines @@
   if (!ranges) {
     RecordCreateHistogramResult(CREATE_HISTOGRAM_INVALID_RANGES_ARRAY);
     NOTREACHED();
     return nullptr;
   }
   ranges = StatisticsRecorder::RegisterOrDeleteDuplicateRanges(ranges);
 
   HistogramBase::AtomicCount* counts_data =
       allocator->GetAsObject<HistogramBase::AtomicCount>(
           histogram_data.counts_ref, kTypeIdCountsArray);
-  if (!counts_data ||
-      allocator->GetAllocSize(histogram_data.counts_ref) <
-          histogram_data.bucket_count * sizeof(HistogramBase::AtomicCount)) {
+  size_t counts_bytes =
+      CalculateRequiredCountsBytes(histogram_data.bucket_count);
+  if (!counts_data || !counts_bytes ||
+      allocator->GetAllocSize(histogram_data.counts_ref) < counts_bytes) {
     RecordCreateHistogramResult(CREATE_HISTOGRAM_INVALID_COUNTS_ARRAY);
     NOTREACHED();
     return nullptr;
   }
 
+  // After the main "counts" array is a second array using for storing what
+  // was previously logged. This is used to calculate the "delta" during
+  // snapshot operations.
+  HistogramBase::AtomicCount* logged_data =
+      counts_data + histogram_data.bucket_count;
+
   std::string name(histogram_data_ptr->name);
   HistogramBase* histogram = nullptr;
   switch (histogram_data.histogram_type) {
     case HISTOGRAM:
       histogram = Histogram::PersistentGet(
           name,
           histogram_data.minimum,
           histogram_data.maximum,
           ranges,
           counts_data,
+          logged_data,
           histogram_data.bucket_count,
-          &histogram_data_ptr->samples_metadata);
+          &histogram_data_ptr->samples_metadata,
+          &histogram_data_ptr->logged_metadata);
       DCHECK(histogram);
       break;
     case LINEAR_HISTOGRAM:
       histogram = LinearHistogram::PersistentGet(
           name,
           histogram_data.minimum,
           histogram_data.maximum,
           ranges,
           counts_data,
+          logged_data,
           histogram_data.bucket_count,
-          &histogram_data_ptr->samples_metadata);
+          &histogram_data_ptr->samples_metadata,
+          &histogram_data_ptr->logged_metadata);
       DCHECK(histogram);
       break;
     case BOOLEAN_HISTOGRAM:
       histogram = BooleanHistogram::PersistentGet(
           name,
           ranges,
           counts_data,
-          &histogram_data_ptr->samples_metadata);
+          logged_data,
+          &histogram_data_ptr->samples_metadata,
+          &histogram_data_ptr->logged_metadata);
       DCHECK(histogram);
       break;
     case CUSTOM_HISTOGRAM:
       histogram = CustomHistogram::PersistentGet(
           name,
           ranges,
           counts_data,
+          logged_data,
           histogram_data.bucket_count,
-          &histogram_data_ptr->samples_metadata);
+          &histogram_data_ptr->samples_metadata,
+          &histogram_data_ptr->logged_metadata);
       DCHECK(histogram);
       break;
     default:
       NOTREACHED();
   }
 
   if (histogram) {
     DCHECK_EQ(histogram_data.histogram_type, histogram->GetHistogramType());
     histogram->SetFlags(histogram_data.flags);
     RecordCreateHistogramResult(CREATE_HISTOGRAM_SUCCESS);
@@ skipping 63 matching lines @@
 
   // If the allocator is corrupt, don't waste time trying anything else.
   // This also allows differentiating on the dashboard between allocations
   // failed due to a corrupt allocator and the number of process instances
   // with one, the latter being idicated by "newly corrupt", below.
   if (allocator->IsCorrupt()) {
     RecordCreateHistogramResult(CREATE_HISTOGRAM_ALLOCATOR_CORRUPT);
     return nullptr;
   }
 
+  // If CalculateRequiredCountsBytes() returns zero then the bucket_count
+  // was not valid.
   size_t bucket_count = bucket_ranges->bucket_count();
-  // An overflow such as this, perhaps as the result of a milicious actor,
-  // could lead to writing beyond the allocation boundary and into other
-  // memory. Just fail the allocation and let the caller deal with it.
-  if (bucket_count > std::numeric_limits<int32_t>::max() /
-                     sizeof(HistogramBase::AtomicCount)) {
+  size_t counts_bytes = CalculateRequiredCountsBytes(bucket_count);
+  if (!counts_bytes) {
     NOTREACHED();
     return nullptr;
   }
-  size_t counts_bytes = bucket_count * sizeof(HistogramBase::AtomicCount);
+
   size_t ranges_bytes = (bucket_count + 1) * sizeof(HistogramBase::Sample);
   PersistentMemoryAllocator::Reference ranges_ref =
       allocator->Allocate(ranges_bytes, kTypeIdRangesArray);
   PersistentMemoryAllocator::Reference counts_ref =
       allocator->Allocate(counts_bytes, kTypeIdCountsArray);
   PersistentMemoryAllocator::Reference histogram_ref =
       allocator->Allocate(offsetof(PersistentHistogramData, name) +
                           name.length() + 1, kTypeIdHistogram);
   HistogramBase::Sample* ranges_data =
       allocator->GetAsObject<HistogramBase::Sample>(ranges_ref,
@@ skipping 66 matching lines @@
     for (;;) {
       HistogramBase* histogram = GetNextPersistentHistogram(g_allocator, &iter);
       if (!histogram)
         break;
       StatisticsRecorder::RegisterOrDeleteDuplicate(histogram);
     }
   }
 }
 
 }  // namespace base