Fixed an overflow bug in the compare function used by the heap histogram sorting.

runtime/vm/heap_histogram.cc

 // Copyright (c) 2013, the Dart project authors.  Please see the AUTHORS file
 // for details. All rights reserved. Use of this source code is governed by a
 // BSD-style license that can be found in the LICENSE file.
 
 #include "vm/heap_histogram.h"
 
 #include "platform/assert.h"
 #include "vm/flags.h"
 #include "vm/object.h"
 #include "vm/json_stream.h"
@@ skipping 60 matching lines @@
 
 void ObjectHistogram::Add(RawObject* obj) {
   intptr_t class_id = obj->GetClassId();
   if (class_id == kFreeListElement) return;
   ASSERT(class_id < table_length_);
   table_[class_id].Add(obj->Size());
 }
 
 
 int ObjectHistogram::compare(const Element** a, const Element** b) {
-  return (*b)->size_ - (*a)->size_;
+  // Be careful to return a 32bit integer.
+  intptr_t a_size = (*a)->size_;
+  intptr_t b_size = (*b)->size_;
+  if (a_size > b_size) return -1;
+  if (a_size < b_size) return  1;
+  return 0;
 }
 
 
 ObjectHistogram::Element** ObjectHistogram::GetSortedArray(
       intptr_t* array_length) {
   intptr_t length = 0;
   for (intptr_t index = 0; index < table_length_; index++) {
     if (table_[index].count_ > 0) length++;
   }
   // Then add them to a new array and sort.
@@ skipping 107 matching lines @@
   JSONObject sums(&jsobj, "sums");
   sums.AddProperty("size", size_sum);
   sums.AddProperty("count", count_sum);
 
   // Deallocate the array for sorting.
   free(array);
 }
 
 
 }  // namespace dart