OLD | NEW |
---|---|
(Empty) | |
1 // Copyright 2014 The Chromium Authors. All rights reserved. | |
2 // Use of this source code is governed by a BSD-style license that can be | |
3 // found in the LICENSE file. | |
4 | |
5 #ifndef BASE_SAFE_MATH_H_ | |
6 #define BASE_SAFE_MATH_H_ | |
7 | |
8 #include "base/numerics/safe_math_impl.h" | |
9 | |
10 namespace base { | |
11 | |
12 namespace internal { | |
13 | |
14 // CheckedNumeric implements all the logic and operators for detecting integer | |
15 // boundary conditions such as overflow, underflow, and invalid conversions. | |
16 // The CheckedNumeric type implicitly converts from floating point and integer | |
17 // dat types, and contains overloads for basic arithmetic operations (i.e.: +, | |
Ryan Sleevi
2014/02/10 23:42:41
typo: data
jschuh
2014/02/11 00:43:28
Done.
| |
18 // -, *, /, %). | |
19 // | |
20 // The following methods convert from CheckedNumeric to standard numeric values: | |
21 // IsValid() - Returns true if the underlying numeric value is valid (i.e. has | |
22 // has not wrapped and is not the result of an invalid conversion). | |
23 // ValueOrDie() - Returns the underlying value. If the state is not valid this | |
24 // call will crash on a CHECK. | |
25 // ValueOrDefault() - Returns the current value, or the supplied default if the | |
26 // state is not valid. | |
27 // ValueFloating() - Returns the underlying floating point value (valid only | |
28 // only for floating point CheckedNumeric types). | |
29 // | |
30 // Bitwise operations are explicitly not supported, because correct | |
31 // handling of some cases (e.g. sign manipulation) is ambiguous. Comparison | |
32 // operations are explicitly not supported because they could result in a crash | |
33 // on a CHECK condition. You should use patterns like the following for these | |
34 // operations: | |
35 // Bitwise operation: | |
36 // int x = checked_int.ValueOrDefault(0) | kFlagValues; | |
37 // Comparison: | |
38 // if (checked_size.IsValid() && checked_size.ValueOrDie() < buffer_size) | |
39 // Do stuff... | |
40 template <typename T> | |
41 class CheckedNumeric { | |
42 private: | |
43 CheckedNumericState<T> state_; | |
44 | |
45 public: | |
46 typedef T type; | |
47 template <typename Src> | |
48 friend class CheckedNumeric; | |
Ryan Sleevi
2014/02/10 23:42:41
Does this actually work? I didn't think generic fr
jschuh
2014/02/11 00:43:28
Yep, works correct in msvc, gcc, and clang.
| |
49 | |
50 CheckedNumeric() {} | |
51 | |
52 // Copy constructor. | |
53 template <typename Src> | |
54 CheckedNumeric(const CheckedNumeric<Src>& rhs) : | |
55 state_(rhs.state_.value(), rhs.state_.validity()) {} | |
Ryan Sleevi
2014/02/10 23:42:41
git-cl-format this
CheckedNumeric(const CheckedNu
jschuh
2014/02/11 00:43:28
Done.
| |
56 | |
57 template <typename Src> | |
58 CheckedNumeric(Src value, RangeCheckId validity) : state_(value, validity) {} | |
59 | |
60 // This is not an explicit constructor because we implicitly upgrade regular | |
61 // numerics to CheckedNumerics to make them easier to use. | |
62 template <typename Src> | |
63 CheckedNumeric(Src value) : state_(value) { | |
64 COMPILE_ASSERT(numeric_limits<Src>::is_specialized, | |
65 argument_must_be_numeric); | |
66 } | |
67 | |
68 // validity() - DO NOT USE THIS IN EXTERNAL CODE - It is public right now for | |
69 // tests and to avoid a big matrix of friend operator overloads. But the | |
70 // values it returns are likely to change in the future. | |
71 // Returns: current validity state (i.e. valid, overflow, underflow, nan). | |
72 // TODO(jschuh): crbug.com/332611 Figure out and implement semantics for | |
73 // saturation/wrapping so we can expose this state consistently and implement | |
74 // saturated arithmetic. | |
75 RangeCheckId validity() const { return state_.validity(); } | |
Ryan Sleevi
2014/02/10 23:42:41
if it's only for tests, you can call it validity()
jschuh
2014/02/11 00:43:28
So... that doesn't solve the nasty mess of friend
| |
76 | |
77 // IsValid() is the public API to test if a CheckedNumeric is currently valid. | |
78 bool IsValid() const { return validity() == TYPE_VALID; } | |
79 | |
80 // ValueUnsafe() - DO NOT USE THIS IN EXTERNAL CODE - It is public right now | |
81 // for tests and to avoid a big matrix of friend operator overloads. But the | |
82 // values it returns are likely to change in the future. | |
83 // Returns: the raw numeric value, regardless of the current state. | |
84 // TODO(jschuh): crbug.com/332611 Figure out and implement semantics for | |
85 // saturation/wrapping so we can expose this state consistently and implement | |
86 // saturated arithmetic. | |
87 T ValueUnsafe() const { return state_.value(); } | |
Ryan Sleevi
2014/02/10 23:42:41
Ditto
| |
88 | |
89 // ValueOrDie() The primary accessor for the underlying value. If the current | |
90 // state is not valid it will CHECK and crash. | |
91 T ValueOrDie() const { | |
92 CHECK(IsValid()); | |
93 return state_.value(); | |
94 } | |
95 | |
96 // ValueOrDefault(T default_value) A convenience method that returns the | |
97 // current value if the state is valid, and the supplied default_value for | |
98 // any other state. | |
99 T ValueOrDefault(T default_value) const { | |
100 return IsValid() ? state_.value() : default_value; | |
101 } | |
102 | |
103 // ValueFloating() - Since floating point values include their validity state, | |
104 // we provide an easy method for extracting them directly, without a risk of | |
105 // crashing on a CHECK. | |
106 T ValueFloating() { | |
107 COMPILE_ASSERT(numeric_limits<T>::is_iec559, argument_must_be_float); | |
108 return CheckedNumeric<T>::cast(*this).ValueUnsafe(); | |
109 } | |
110 | |
111 // Prototypes for the supported arithmetic operator overloads. | |
112 template <typename Src> CheckedNumeric& operator +=(Src rhs); | |
113 template <typename Src> CheckedNumeric& operator -=(Src rhs); | |
114 template <typename Src> CheckedNumeric& operator *=(Src rhs); | |
115 template <typename Src> CheckedNumeric& operator /=(Src rhs); | |
116 template <typename Src> CheckedNumeric& operator %=(Src rhs); | |
117 | |
118 CheckedNumeric operator -() const { | |
119 RangeCheckId validity; | |
120 T value = CheckedNeg(state_.value(), &validity); | |
121 // Negation is always valid for floating point. | |
122 if (numeric_limits<T>::is_iec559) | |
123 return CheckedNumeric<T>(value); | |
124 | |
125 validity = static_cast<RangeCheckId>(state_.validity() | validity); | |
126 return CheckedNumeric<T>(value, validity); | |
127 } | |
128 | |
129 CheckedNumeric Abs() const { | |
130 RangeCheckId validity; | |
131 T value = CheckedAbs(state_.value(), &validity); | |
132 // Absolute value is always valid for floating point. | |
133 if (numeric_limits<T>::is_iec559) | |
134 return CheckedNumeric<T>(value); | |
135 | |
136 validity = static_cast<RangeCheckId>(state_.validity() | validity); | |
137 return CheckedNumeric<T>(value, validity); | |
138 } | |
139 | |
140 CheckedNumeric& operator++() { | |
141 *this += 1; | |
142 return *this; | |
143 } | |
144 | |
145 CheckedNumeric operator++(int) { | |
146 CheckedNumeric value = *this; | |
147 *this += 1; | |
148 return value; | |
149 } | |
150 | |
151 CheckedNumeric& operator--() { | |
152 *this -= 1; | |
153 return *this; | |
154 } | |
155 | |
156 CheckedNumeric operator--(int) { | |
157 CheckedNumeric value = *this; | |
158 *this -= 1; | |
159 return value; | |
160 } | |
161 | |
162 // These static methods behave like a convenience cast operator targeting | |
163 // the desired CheckedNumeric type. As an optimization, a reference is | |
164 // returned when Src is the same type as T. | |
165 template <typename Src> | |
166 static CheckedNumeric<T> cast(Src u, | |
167 typename enable_if<numeric_limits<Src>::is_specialized, int>::type = 0) { | |
168 return u; | |
169 } | |
170 | |
171 template <typename Src> | |
172 static CheckedNumeric<T> cast(const CheckedNumeric<Src>& u, | |
173 typename enable_if<!is_same<Src, T>::value, int>::type = 0) { | |
174 return u; | |
175 } | |
176 | |
177 static const CheckedNumeric<T>& cast(const CheckedNumeric<T>& u) { | |
178 return u; | |
179 } | |
180 }; | |
181 | |
182 // This is the boilerplate for the standard arithmetic operator overloads. A | |
183 // macro isn't the prettiest solution, but it beats rewriting these five times. | |
184 // Some details worth noting are: | |
185 // * We apply the standard arithmetic promotions. | |
186 // * We skip range checks for floating points. | |
187 // * We skip range checks for destination integers with sufficient range. | |
188 #define BASE_NUMERIC_ARITHMETIC_OPERATORS(NAME,OP,COMPOUND_OP) \ | |
189 /* Binary arithmetic operator for CheckedNumerics of the same type. */ \ | |
190 template <typename T> \ | |
191 CheckedNumeric<typename ArithmeticPromotion<T>::type> \ | |
192 operator OP(const CheckedNumeric<T> &lhs, const CheckedNumeric<T> &rhs) { \ | |
193 typedef typename ArithmeticPromotion<T>::type Promotion; \ | |
194 /* Floating point always takes the fast path */ \ | |
195 if (numeric_limits<T>::is_iec559) \ | |
196 return CheckedNumeric<T>(lhs.ValueUnsafe() OP rhs.ValueUnsafe()); \ | |
197 if (IsIntegerArithmeticSafe<Promotion, T, T>::value) \ | |
198 return CheckedNumeric<Promotion>(lhs.ValueUnsafe() OP rhs.ValueUnsafe(), \ | |
199 static_cast<RangeCheckId>(rhs.validity() | lhs.validity())); \ | |
200 RangeCheckId validity = TYPE_VALID; \ | |
201 T result = \ | |
202 Checked##NAME(static_cast<Promotion>(lhs.ValueUnsafe()), \ | |
203 static_cast<Promotion>(rhs.ValueUnsafe()), &validity); \ | |
204 return CheckedNumeric<Promotion>(result, static_cast<RangeCheckId>( \ | |
205 validity | lhs.validity() | rhs.validity())); \ | |
206 } \ | |
207 /* Assignment arithmetic operator implementation from CheckedNumeric above. */ \ | |
208 template <typename T> \ | |
209 template <typename Src> \ | |
210 CheckedNumeric<T>& \ | |
211 CheckedNumeric<T>::operator COMPOUND_OP(Src rhs) { \ | |
212 *this = CheckedNumeric<T>::cast(*this) OP CheckedNumeric<Src>::cast(rhs); \ | |
213 return *this; \ | |
214 } \ | |
215 /* Binary arithmetic operator for CheckedNumeric of different type. */ \ | |
216 template <typename T, typename Src> \ | |
217 CheckedNumeric<typename ArithmeticPromotion<T, Src>::type> \ | |
218 operator OP(const CheckedNumeric<Src> &lhs, const CheckedNumeric<T> &rhs) { \ | |
219 typedef typename ArithmeticPromotion<T, Src>::type Promotion; \ | |
220 if (IsIntegerArithmeticSafe<Promotion, T, Src>::value) \ | |
221 return CheckedNumeric<Promotion>(lhs.ValueUnsafe() OP rhs.ValueUnsafe(), \ | |
222 static_cast<RangeCheckId>(rhs.validity() | lhs.validity())); \ | |
223 return CheckedNumeric<Promotion>::cast(lhs) OP \ | |
224 CheckedNumeric<Promotion>::cast(rhs); \ | |
225 } \ | |
226 /* Binary arithmetic operator for left CheckedNumeric and right numeric. */ \ | |
227 template <typename T, typename Src> \ | |
228 CheckedNumeric<typename ArithmeticPromotion<T, Src>::type> \ | |
229 operator OP(const CheckedNumeric<T> &lhs, Src rhs) { \ | |
230 typedef typename ArithmeticPromotion<T, Src>::type Promotion; \ | |
231 if (IsIntegerArithmeticSafe<Promotion, T, Src>::value) \ | |
232 return CheckedNumeric<Promotion>(lhs.ValueUnsafe() OP \ | |
233 rhs, lhs.validity()); \ | |
234 return CheckedNumeric<Promotion>::cast(lhs) OP \ | |
235 CheckedNumeric<Promotion>::cast(rhs); \ | |
236 } \ | |
237 /* Binary arithmetic operator for right numeric and left CheckedNumeric. */ \ | |
238 template <typename T, typename Src> \ | |
239 CheckedNumeric<typename ArithmeticPromotion<T, Src>::type> \ | |
240 operator OP(Src lhs, const CheckedNumeric<T> &rhs) { \ | |
241 typedef typename ArithmeticPromotion<T, Src>::type Promotion; \ | |
242 if (IsIntegerArithmeticSafe<Promotion, T, Src>::value) \ | |
243 return CheckedNumeric<Promotion>(lhs OP rhs.ValueUnsafe(), \ | |
244 rhs.validity()); \ | |
245 return CheckedNumeric<Promotion>::cast(lhs) OP \ | |
246 CheckedNumeric<Promotion>::cast(rhs); \ | |
247 } | |
248 | |
249 BASE_NUMERIC_ARITHMETIC_OPERATORS(Add, +, +=) | |
250 BASE_NUMERIC_ARITHMETIC_OPERATORS(Sub, -, -=) | |
251 BASE_NUMERIC_ARITHMETIC_OPERATORS(Mul, *, *=) | |
252 BASE_NUMERIC_ARITHMETIC_OPERATORS(Div, /, /=) | |
253 BASE_NUMERIC_ARITHMETIC_OPERATORS(Mod, %, %=) | |
254 | |
255 #undef BASE_NUMERIC_ARITHMETIC_OPERATORS | |
256 | |
257 } // namespace internal | |
258 | |
259 using internal::CheckedNumeric; | |
260 | |
261 } // namespace base | |
262 | |
263 #endif // BASE_SAFE_MATH_H_ | |
264 | |
OLD | NEW |