Add support for safe math operations in base/numerics

base/numerics/safe_conversions_impl.h

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #ifndef BASE_SAFE_CONVERSIONS_IMPL_H_
 #define BASE_SAFE_CONVERSIONS_IMPL_H_
 
 #include <limits>
 
 #include "base/macros.h"
+#include "base/template_util.h"
 
 namespace base {
 namespace internal {
 
-enum DstSign {
-  DST_UNSIGNED,
-  DST_SIGNED
+using std::numeric_limits;
+
+enum DstSignId {
+  DST_UNSIGNED = 0,
+  DST_SIGNED   = 1
 };
 
-enum SrcSign {
-  SRC_UNSIGNED,
-  SRC_SIGNED
+enum SrcSignId {
+  SRC_UNSIGNED = 0,
+  SRC_SIGNED   = 1

[Ryan Sleevi, 2014/02/10 23:42:41]

Why use these enums versus a bool?

[jschuh, 2014/02/11 00:43:28]

It makes the template instantiations easier to follow (and was suggested by
earlier reviewers).

 };
 
-enum DstRange {
+enum DstRangeId {
   OVERLAPS_RANGE,
   CONTAINS_RANGE

[Ryan Sleevi, 2014/02/10 23:42:41]

Why no literals for these, compared with 19/20 and 24/25?

[jschuh, 2014/02/11 00:43:28]

Forgot.

 };
 
+// Retrieve the max exponent for floating types and compute it for integrals.
+template <typename NumericType>
+struct MaxExponent {
+  static const int value = numeric_limits<NumericType>::is_iec559 ?
+                           numeric_limits<NumericType>::max_exponent :
+                           (sizeof(NumericType) * 8 + 1 -
+                            numeric_limits<NumericType>::is_signed);
+};
+
 // Helper templates to statically determine if our destination type can contain
-// all values represented by the source type.
+// maximum and minimum values represented by the source type.
 
 template <typename Dst, typename Src,

[Ryan Sleevi, 2014/02/10 23:42:41]

We traditionally format template arguments as with function declarations,
although I realize internal style has changed.

Namely

template <typename Dst,
                 typename Src,
                 DstSignId ...

[jschuh, 2014/02/11 00:43:28]

Done.

-          DstSign IsDstSigned = std::numeric_limits<Dst>::is_signed ?
-                                DST_SIGNED : DST_UNSIGNED,
-          SrcSign IsSrcSigned = std::numeric_limits<Src>::is_signed ?
-                                SRC_SIGNED : SRC_UNSIGNED>
+          DstSignId DstSign = numeric_limits<Dst>::is_signed ?
+                              DST_SIGNED : DST_UNSIGNED,
+          SrcSignId SrcSign = numeric_limits<Src>::is_signed ?
+                              SRC_SIGNED : SRC_UNSIGNED>
 struct StaticRangeCheck {};
 
+// Both signed, narrowing.
 template <typename Dst, typename Src>
 struct StaticRangeCheck<Dst, Src, DST_SIGNED, SRC_SIGNED> {
-  typedef std::numeric_limits<Dst> DstLimits;
-  typedef std::numeric_limits<Src> SrcLimits;
-  // Compare based on max_exponent, which we must compute for integrals.
-  static const size_t kDstMaxExponent = DstLimits::is_iec559 ?
-                                        DstLimits::max_exponent :
-                                        (sizeof(Dst) * 8 - 1);
-  static const size_t kSrcMaxExponent = SrcLimits::is_iec559 ?
-                                        SrcLimits::max_exponent :
-                                        (sizeof(Src) * 8 - 1);
-  static const DstRange value = kDstMaxExponent >= kSrcMaxExponent ?
-                                CONTAINS_RANGE : OVERLAPS_RANGE;
+  static const DstRangeId value = MaxExponent<Dst>::value >=
+                                  MaxExponent<Src>::value ?
+                                      CONTAINS_RANGE : OVERLAPS_RANGE;
 };
 
+// Both unsigned, narrowing (handled same as both signed narrowing).
 template <typename Dst, typename Src>
-struct StaticRangeCheck<Dst, Src, DST_UNSIGNED, SRC_UNSIGNED> {
-  static const DstRange value = sizeof(Dst) >= sizeof(Src) ?
-                                CONTAINS_RANGE : OVERLAPS_RANGE;
+struct StaticRangeCheck<Dst, Src, DST_UNSIGNED, SRC_UNSIGNED> :
+       StaticRangeCheck<Dst, Src, DST_SIGNED, SRC_SIGNED> {};

[Ryan Sleevi, 2014/02/10 23:42:41]

Doesn't this actually leave ::value unspecified?

[jschuh, 2014/02/11 00:43:28]

No, it's inheriting value from the DST_SIGNED, SRC_SIGNED version.

+
+// Unsigned to signed, overlapping.
+template <typename Dst, typename Src>
+struct StaticRangeCheck<Dst, Src, DST_SIGNED, SRC_UNSIGNED> {
+  typedef numeric_limits<Dst> DstLimits;
+  typedef numeric_limits<Src> SrcLimits;

[Ryan Sleevi, 2014/02/10 23:42:41]

Unused?

[jschuh, 2014/02/11 00:43:28]

Done.

+  static const DstRangeId value = MaxExponent<Dst>::value >
+                                  MaxExponent<Src>::value ?
+                                    CONTAINS_RANGE : OVERLAPS_RANGE;
 };
 
-template <typename Dst, typename Src>
-struct StaticRangeCheck<Dst, Src, DST_SIGNED, SRC_UNSIGNED> {
-  typedef std::numeric_limits<Dst> DstLimits;
-  typedef std::numeric_limits<Src> SrcLimits;
-  // Compare based on max_exponent, which we must compute for integrals.
-  static const size_t kDstMaxExponent = DstLimits::is_iec559 ?
-                                        DstLimits::max_exponent :
-                                        (sizeof(Dst) * 8 - 1);
-  static const size_t kSrcMaxExponent = sizeof(Src) * 8;
-  static const DstRange value = kDstMaxExponent >= kSrcMaxExponent ?
-                                CONTAINS_RANGE : OVERLAPS_RANGE;
-};
-
+// Signed to unsigned, overlapping.
 template <typename Dst, typename Src>
 struct StaticRangeCheck<Dst, Src, DST_UNSIGNED, SRC_SIGNED> {
-  static const DstRange value = OVERLAPS_RANGE;
+  static const DstRangeId value = OVERLAPS_RANGE;
 };
 
 
-enum RangeCheckResult {
+enum RangeCheckId {
   TYPE_VALID = 0,      // Value can be represented by the destination type.
   TYPE_UNDERFLOW = 1,  // Value would overflow.
   TYPE_OVERFLOW = 2,   // Value would underflow.
   TYPE_INVALID = 3     // Source value is invalid (i.e. NaN).
 };
 
-// This macro creates a RangeCheckResult from an upper and lower bound
+// This macro creates a RangeCheckId from an upper and lower bound
 // check by taking advantage of the fact that only NaN can be out of range in
 // both directions at once.
 #define BASE_NUMERIC_RANGE_CHECK_RESULT(is_in_upper_bound, is_in_lower_bound) \
-    RangeCheckResult(((is_in_upper_bound) ? 0 : TYPE_OVERFLOW) | \
+    RangeCheckId(((is_in_upper_bound) ? 0 : TYPE_OVERFLOW) | \
                             ((is_in_lower_bound) ? 0 : TYPE_UNDERFLOW))
 
 template <typename Dst,
           typename Src,
-          DstSign IsDstSigned = std::numeric_limits<Dst>::is_signed ?
-                                DST_SIGNED : DST_UNSIGNED,
-          SrcSign IsSrcSigned = std::numeric_limits<Src>::is_signed ?
-                                SRC_SIGNED : SRC_UNSIGNED,
-          DstRange IsSrcRangeContained = StaticRangeCheck<Dst, Src>::value>
+          DstSignId DstSign = numeric_limits<Dst>::is_signed ?
+                              DST_SIGNED : DST_UNSIGNED,
+          SrcSignId SrcSign = numeric_limits<Src>::is_signed ?
+                              SRC_SIGNED : SRC_UNSIGNED,
+          DstRangeId DstRange = StaticRangeCheck<Dst, Src>::value>
 struct RangeCheckImpl {};
 
 // The following templates are for ranges that must be verified at runtime. We
 // split it into checks based on signedness to avoid confusing casts and
 // compiler warnings on signed an unsigned comparisons.
 
 // Dst range always contains the result: nothing to check.
-template <typename Dst, typename Src, DstSign IsDstSigned, SrcSign IsSrcSigned>
-struct RangeCheckImpl<Dst, Src, IsDstSigned, IsSrcSigned, CONTAINS_RANGE> {
-  static RangeCheckResult Check(Src value) {
+template <typename Dst, typename Src, DstSignId DstSign, SrcSignId SrcSign>
+struct RangeCheckImpl<Dst, Src, DstSign, SrcSign, CONTAINS_RANGE> {
+  static RangeCheckId Check(Src value) {
     return TYPE_VALID;
   }
 };
 
 // Signed to signed narrowing.
 template <typename Dst, typename Src>
 struct RangeCheckImpl<Dst, Src, DST_SIGNED, SRC_SIGNED, OVERLAPS_RANGE> {
-  static RangeCheckResult Check(Src value) {
-    typedef std::numeric_limits<Dst> DstLimits;
-    return DstLimits::is_iec559 ?
+  static RangeCheckId Check(Src value) {
+    return numeric_limits<Dst>::is_iec559 ?
            BASE_NUMERIC_RANGE_CHECK_RESULT(
-               value <= static_cast<Src>(DstLimits::max()),
-               value >= static_cast<Src>(DstLimits::max() * -1)) :
+               value <= numeric_limits<Dst>::max(),
+               value >= -numeric_limits<Dst>::max()) :
            BASE_NUMERIC_RANGE_CHECK_RESULT(
-               value <= static_cast<Src>(DstLimits::max()),
-               value >= static_cast<Src>(DstLimits::min()));
+               value <= numeric_limits<Dst>::max(),
+               value >= numeric_limits<Dst>::min());
   }
 };
 
 // Unsigned to unsigned narrowing.
 template <typename Dst, typename Src>
 struct RangeCheckImpl<Dst, Src, DST_UNSIGNED, SRC_UNSIGNED, OVERLAPS_RANGE> {
-  static RangeCheckResult Check(Src value) {
-    typedef std::numeric_limits<Dst> DstLimits;
+  static RangeCheckId Check(Src value) {
     return BASE_NUMERIC_RANGE_CHECK_RESULT(
-               value <= static_cast<Src>(DstLimits::max()), true);
+               value <= numeric_limits<Dst>::max(), true);
   }
 };
 
 // Unsigned to signed.
 template <typename Dst, typename Src>
 struct RangeCheckImpl<Dst, Src, DST_SIGNED, SRC_UNSIGNED, OVERLAPS_RANGE> {
-  static RangeCheckResult Check(Src value) {
-    typedef std::numeric_limits<Dst> DstLimits;
+  static RangeCheckId Check(Src value) {
     return sizeof(Dst) > sizeof(Src) ? TYPE_VALID :
            BASE_NUMERIC_RANGE_CHECK_RESULT(
-               value <= static_cast<Src>(DstLimits::max()), true);
+               value <= static_cast<Src>(numeric_limits<Dst>::max()),
+                                         true);
   }
 };
 
 // Signed to unsigned.
 template <typename Dst, typename Src>
 struct RangeCheckImpl<Dst, Src, DST_UNSIGNED, SRC_SIGNED, OVERLAPS_RANGE> {
-  static RangeCheckResult Check(Src value) {
-    typedef std::numeric_limits<Dst> DstLimits;
-    typedef std::numeric_limits<Src> SrcLimits;
-    // Compare based on max_exponent, which we must compute for integrals.
-    static const size_t kDstMaxExponent = sizeof(Dst) * 8;
-    static const size_t kSrcMaxExponent = SrcLimits::is_iec559 ?
-                                          SrcLimits::max_exponent :
-                                          (sizeof(Src) * 8 - 1);
-    return (kDstMaxExponent >= kSrcMaxExponent) ?
+  static RangeCheckId Check(Src value) {
+    return (MaxExponent<Dst>::value >= MaxExponent<Src>::value) ?
            BASE_NUMERIC_RANGE_CHECK_RESULT(true, value >= static_cast<Src>(0)) :
            BASE_NUMERIC_RANGE_CHECK_RESULT(
-               value <= static_cast<Src>(DstLimits::max()),
+               value <= static_cast<Src>(numeric_limits<Dst>::max()),
                value >= static_cast<Src>(0));
   }
 };
 
 template <typename Dst, typename Src>
-inline RangeCheckResult RangeCheck(Src value) {
-  COMPILE_ASSERT(std::numeric_limits<Src>::is_specialized,
-                 argument_must_be_numeric);
-  COMPILE_ASSERT(std::numeric_limits<Dst>::is_specialized,
-                 result_must_be_numeric);
+inline RangeCheckId RangeCheck(Src value) {
+  COMPILE_ASSERT(numeric_limits<Src>::is_specialized, argument_must_be_numeric);
+  COMPILE_ASSERT(numeric_limits<Dst>::is_specialized, result_must_be_numeric);
   return RangeCheckImpl<Dst, Src>::Check(value);
 }
 
 }  // namespace internal
 }  // namespace base
 
 #endif  // BASE_SAFE_CONVERSIONS_IMPL_H_