New test and off-by-one fix for data persisted to disk.

base/metrics/persistent_memory_allocator.cc

Index: base/metrics/persistent_memory_allocator.cc
diff --git a/base/metrics/persistent_memory_allocator.cc b/base/metrics/persistent_memory_allocator.cc
index 4ab8f8c8c3f72cdeee6526318ca2c948715f0ddc..a1c28c659d3b2921c389b6efe794d65015658487 100644
--- a/base/metrics/persistent_memory_allocator.cc
+++ b/base/metrics/persistent_memory_allocator.cc
@@ -163,7 +163,6 @@ PersistentMemoryAllocator::PersistentMemoryAllocator(void* base,
 
   if (shared_meta()->cookie != kGlobalCookie) {
     if (readonly) {
-      NOTREACHED();
       SetCorrupt();
       return;
     }
@@ -215,10 +214,7 @@ PersistentMemoryAllocator::PersistentMemoryAllocator(void* base,
         strcpy(name_cstr, name.c_str());
     }
   } else {
-    if (readonly) {
-      // For read-only access, validate reasonable ctor parameters.
-      DCHECK_GE(mem_size_, shared_meta()->freeptr.load());
-    } else {
+    if (!readonly) {
       // The allocator is attaching to a previously initialized segment of
       // memory. Make sure the embedded data matches what has been passed.
       if (shared_meta()->size != mem_size_ ||
@@ -282,7 +278,7 @@ size_t PersistentMemoryAllocator::GetAllocSize(Reference ref) const {
   uint32_t size = block->size;
   // Header was verified by GetBlock() but a malicious actor could change
   // the value between there and here. Check it again.
-  if (size <= sizeof(BlockHeader) || ref + size >= mem_size_) {
+  if (size <= sizeof(BlockHeader) || ref + size > mem_size_) {
     SetCorrupt();
     return 0;
   }