cc: Handle overflow/underflow in MathUtil::RoundUp/RoundDown functions.

cc/base/math_util.h

 // Copyright 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #ifndef CC_BASE_MATH_UTIL_H_
 #define CC_BASE_MATH_UTIL_H_
 
 #include <algorithm>
 #include <cmath>
 #include <vector>
@@ skipping 78 matching lines @@
   static float Deg2Rad(float deg) { return deg * kPiFloat / 180.0f; }
   static float Rad2Deg(float rad) { return rad * 180.0f / kPiFloat; }
 
   static float Round(float f) {
     return (f > 0.f) ? std::floor(f + 0.5f) : std::ceil(f - 0.5f);
   }
   static double Round(double d) {
     return (d > 0.0) ? std::floor(d + 0.5) : std::ceil(d - 0.5);
   }
 
-  // RoundUp rounds up a given |n| to be a multiple of |mul|.
+  // Returns true if rounded up value does not overflow, false otherwise.
+  template <typename T>
+  static bool VerifyRoundup(T n, T mul) {
+    return mul

[vmpstr, 2015/08/04 18:17:23]

"a ? b : false" is better written as "a && b"

+               ? n <= (std::numeric_limits<T>::max() -
+                       (std::numeric_limits<T>::max() % mul))
+               : false;
+  }
+
+  // Rounds up a given |n| to be a multiple of |mul|, but may overflow.
   // Examples:
   //    - RoundUp(123, 50) returns 150.
   //    - RoundUp(-123, 50) returns -100.
   template <typename T>
-  static T RoundUp(T n, T mul) {
+  static T UncheckedRoundUp(T n, T mul) {
     static_assert(std::numeric_limits<T>::is_integer,
                   "T must be an integer type");
-    return (n > 0) ? ((n + mul - 1) / mul) * mul : (n / mul) * mul;
+    DCHECK(VerifyRoundup(n, mul));
+    return RoundUpInternal(n, mul);
   }
 
-  // RoundDown rounds down a given |n| to be a multiple of |mul|.
+  // Dies with a CRASH(), if rounding up a given |n| overflows T.

[vmpstr, 2015/08/04 18:17:23]

nit: You should say something like "Similar to UncheckedRoundUp, but dies with a
CRASH(), ..."

just so you document what the function does as well as the difference from the
unchecked version. 

+  template <typename T>
+  static T CheckedRoundUp(T n, T mul) {
+    static_assert(std::numeric_limits<T>::is_integer,
+                  "T must be an integer type");
+    CHECK(VerifyRoundup(n, mul));
+    return RoundUpInternal(n, mul);
+  }
+
+  // Returns true if rounded down value does not underflow, false otherwise.
+  template <typename T>
+  static bool VerifyRoundDown(T n, T mul) {
+    return mul

[vmpstr, 2015/08/04 18:17:23]

Same here

+               ? n >= (std::numeric_limits<T>::min() -
+                       (std::numeric_limits<T>::min() % mul))
+               : false;
+  }
+
+  // Rounds down a given |n| to be a multiple of |mul|, but may underflow.
   // Examples:
   //    - RoundDown(123, 50) returns 100.
   //    - RoundDown(-123, 50) returns -150.
   template <typename T>
-  static T RoundDown(T n, T mul) {
+  static T UncheckedRoundDown(T n, T mul) {
     static_assert(std::numeric_limits<T>::is_integer,
                   "T must be an integer type");
-    return (n > 0) ? (n / mul) * mul : (n == 0) ? 0
-                                                : ((n - mul + 1) / mul) * mul;
+    DCHECK(VerifyRoundDown(n, mul));
+    return RoundDownInternal(n, mul);
+  }
+
+  // Dies with a CRASH(), if rounding down a given |n| underflows T.
+  template <typename T>
+  static T CheckedRoundDown(T n, T mul) {
+    static_assert(std::numeric_limits<T>::is_integer,
+                  "T must be an integer type");
+    CHECK(VerifyRoundDown(n, mul));
+    return RoundDownInternal(n, mul);
   }
 
   template <typename T> static T ClampToRange(T value, T min, T max) {
     return std::min(std::max(value, min), max);
   }
 
   // Background: Existing transform code does not do the right thing in
   // MapRect / MapQuad / ProjectQuad when there is a perspective projection that
   // causes one of the transformed vertices to go to w < 0. In those cases, it
   // is necessary to perform clipping in homogeneous coordinates, after applying
@@ skipping 133 matching lines @@
   // Returns a base::Value representation of the floating point value.
   // If the value is inf, returns max double/float representation.
   static double AsDoubleSafely(double value);
   static float AsFloatSafely(float value);
 
   // Returns vector that x axis (1,0,0) transforms to under given transform.
   static gfx::Vector3dF GetXAxis(const gfx::Transform& transform);
 
   // Returns vector that y axis (0,1,0) transforms to under given transform.
   static gfx::Vector3dF GetYAxis(const gfx::Transform& transform);
+
+ private:
+  template <typename T>
+  static T RoundUpInternal(T n, T mul) {
+    return (n > 0) ? ((n + mul - 1) / mul) * mul : (n / mul) * mul;
+  }
+
+  template <typename T>
+  static T RoundDownInternal(T n, T mul) {
+    return (n > 0) ? (n / mul) * mul : (n == 0) ? 0
+                                                : ((n - mul + 1) / mul) * mul;
+  }
 };
 
 }  // namespace cc
 
 #endif  // CC_BASE_MATH_UTIL_H_