What version of the product are you using? On what operating system?

Clang 3.7, x86_64-unknown-linux-gnu

Please provide any additional information below.

Performing static analysis for ASan via Coverity Prevent tool, I've noticed, that thread_stats.malloced_by_size[class_id]
from can be overflowed in Allocate function from asan_allocator.cc.

Here:

$ cat lib/asan/asan_allocator.cc
....................................
  uptr class_id =
      Min(kNumberOfSizeClasses, SizeClassMap::ClassID(needed_size));
  thread_stats.malloced_by_size[class_id]++;

If class_id == kNumberOfSizeClasses == 255, than we access thread_stats.malloced_by_size[255]
and overflow thread_stats.malloced_by_size array.