Fix SharedSampler to cope correctly with zero-thread processes.

chrome/browser/task_manager/sampling/shared_sampler_win.cc

 // Copyright 2016 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/browser/task_manager/sampling/shared_sampler.h"
 
 #include <windows.h>
 #include <winternl.h>
 
 #include <algorithm>
@@ skipping 439 matching lines @@
   snapshot->timestamp = base::TimeTicks::Now();
 
   for (size_t offset = 0; offset < data_buffer.size(); ) {
     auto pi = reinterpret_cast<const SYSTEM_PROCESS_INFORMATION*>(
       data_buffer.data() + offset);
 
     // Validate that the offset is valid and all needed data is within
     // the buffer boundary.
     if (offset + sizeof(SYSTEM_PROCESS_INFORMATION) > data_buffer.size())
       break;
-    if (offset + sizeof(SYSTEM_PROCESS_INFORMATION) +
-            (pi->NumberOfThreads - 1) * sizeof(SYSTEM_THREAD_INFORMATION) >
-      data_buffer.size())
+    if (pi->NumberOfThreads >= 0 &&

[stanisc, 2016/12/13 17:12:20]

This is to prevent underflow when subtracting 1, right? Should this be > 0?

[Wez, 2016/12/13 21:30:48]

*facepalm* Beware late-night coding - fixed!

Best of all, Clang actually caught this as a tautologous check (since
NumberOfThreads is unsigned). :D

+        (offset + sizeof(SYSTEM_PROCESS_INFORMATION) +
+             (pi->NumberOfThreads - 1) * sizeof(SYSTEM_THREAD_INFORMATION) >
+         data_buffer.size())) {
       break;
+    }
 
     if (pi->ImageName.Buffer) {
       // Validate that the image name is within the buffer boundary.
       // ImageName.Length seems to be in bytes rather than characters.
       ULONG image_name_offset =
           reinterpret_cast<BYTE*>(pi->ImageName.Buffer) - data_buffer.data();
       if (image_name_offset + pi->ImageName.Length > data_buffer.size())
         break;
 
       // Check if this is a chrome process. Ignore all other processes.
@@ skipping 154 matching lines @@
       callback_entry.second.on_physical_memory.Run(physical_bytes);
     }
   }
 
   // Reset refresh_results_ to trigger RefreshOnWorkerThread next time Refresh
   // is called.
   refresh_flags_ = 0;
 }
 
 }  // namespace task_manager