OLD | NEW |
---|---|
1 // Copyright 2014 The Chromium Authors. All rights reserved. | 1 // Copyright 2014 The Chromium Authors. All rights reserved. |
2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
4 | 4 |
5 #ifndef BASE_SAFE_CONVERSIONS_IMPL_H_ | 5 #ifndef BASE_SAFE_CONVERSIONS_IMPL_H_ |
6 #define BASE_SAFE_CONVERSIONS_IMPL_H_ | 6 #define BASE_SAFE_CONVERSIONS_IMPL_H_ |
7 | 7 |
8 #include <limits> | 8 #include <limits> |
9 | 9 |
10 #include "base/macros.h" | 10 #include "base/macros.h" |
11 #include "base/template_util.h" | |
11 | 12 |
12 namespace base { | 13 namespace base { |
13 namespace internal { | 14 namespace internal { |
14 | 15 |
15 enum DstSign { | 16 // The std library doesn't provide a binary max_exponent for integers, however |
16 DST_UNSIGNED, | 17 // we can compute one by adding one to the number of non-sign bits. This allows |
17 DST_SIGNED | 18 // for accurate range comparisons between floating point and integer types. |
18 }; | 19 template <typename NumericType> |
19 | 20 struct MaxExponent { |
20 enum SrcSign { | 21 static const int value = std::numeric_limits<NumericType>::is_iec559 |
21 SRC_UNSIGNED, | 22 ? std::numeric_limits<NumericType>::max_exponent |
22 SRC_SIGNED | 23 : (sizeof(NumericType) * 8 + 1 - |
23 }; | 24 std::numeric_limits<NumericType>::is_signed); |
24 | 25 }; |
25 enum DstRange { | 26 |
26 OVERLAPS_RANGE, | 27 enum IntegerSignRepresentation { |
awong
2014/02/21 22:27:41
s/IntegerSignRepresentation/IntegerRepresentation/
jschuh
2014/02/25 22:34:43
Done.
| |
27 CONTAINS_RANGE | 28 INTEGER_REPRESENTATION_UNSIGNED, |
29 INTEGER_REPRESENTATION_SIGNED | |
30 }; | |
31 | |
32 // A range for a given nunmeric Src type is contained for a given numeric Dst | |
33 // type if both numeric_limits<Src>::max() <= numeric_limits<Dst>::max() and | |
34 // numeric_limits<Src>::min() >= numeric_limits<Dst>::min() are true. | |
35 // We implement this as template specializations rather than simple static | |
36 // comparisons to ensure type correctness in our comparisons. | |
37 enum NumericRangeRepresentation { | |
38 NUMERIC_RANGE_NOT_CONTAINED = 0, | |
39 NUMERIC_RANGE_CONTAINED = 1 | |
28 }; | 40 }; |
29 | 41 |
30 // Helper templates to statically determine if our destination type can contain | 42 // Helper templates to statically determine if our destination type can contain |
31 // all values represented by the source type. | 43 // maximum and minimum values represented by the source type. |
32 | 44 |
33 template <typename Dst, typename Src, | 45 template < |
34 DstSign IsDstSigned = std::numeric_limits<Dst>::is_signed ? | 46 typename Dst, |
35 DST_SIGNED : DST_UNSIGNED, | 47 typename Src, |
36 SrcSign IsSrcSigned = std::numeric_limits<Src>::is_signed ? | 48 IntegerSignRepresentation DstSign = std::numeric_limits<Dst>::is_signed |
37 SRC_SIGNED : SRC_UNSIGNED> | 49 ? INTEGER_REPRESENTATION_SIGNED |
38 struct StaticRangeCheck {}; | 50 : INTEGER_REPRESENTATION_UNSIGNED, |
39 | 51 IntegerSignRepresentation SrcSign = |
40 template <typename Dst, typename Src> | 52 std::numeric_limits<Src>::is_signed |
41 struct StaticRangeCheck<Dst, Src, DST_SIGNED, SRC_SIGNED> { | 53 ? INTEGER_REPRESENTATION_SIGNED |
42 typedef std::numeric_limits<Dst> DstLimits; | 54 : INTEGER_REPRESENTATION_UNSIGNED > |
43 typedef std::numeric_limits<Src> SrcLimits; | 55 struct StaticDstRangeRelationToSrcRange; |
awong
2014/02/21 22:27:41
This "struct" should be at the indent level of "ty
jschuh
2014/02/25 22:34:43
Done.
| |
44 // Compare based on max_exponent, which we must compute for integrals. | 56 |
45 static const size_t kDstMaxExponent = DstLimits::is_iec559 ? | 57 // Same sign: Dst is guaranteed to contain Src only if its range is equal or |
46 DstLimits::max_exponent : | 58 // larger. |
47 (sizeof(Dst) * 8 - 1); | 59 template <typename Dst, typename Src, IntegerSignRepresentation Sign> |
48 static const size_t kSrcMaxExponent = SrcLimits::is_iec559 ? | 60 struct StaticDstRangeRelationToSrcRange<Dst, Src, Sign, Sign> { |
49 SrcLimits::max_exponent : | 61 static const NumericRangeRepresentation value = |
50 (sizeof(Src) * 8 - 1); | 62 MaxExponent<Dst>::value >= MaxExponent<Src>::value |
51 static const DstRange value = kDstMaxExponent >= kSrcMaxExponent ? | 63 ? NUMERIC_RANGE_CONTAINED |
52 CONTAINS_RANGE : OVERLAPS_RANGE; | 64 : NUMERIC_RANGE_NOT_CONTAINED; |
53 }; | 65 }; |
54 | 66 |
55 template <typename Dst, typename Src> | 67 // Unsigned to signed: Dst is guaranteed to contain source only if its range is |
56 struct StaticRangeCheck<Dst, Src, DST_UNSIGNED, SRC_UNSIGNED> { | 68 // larger. |
57 static const DstRange value = sizeof(Dst) >= sizeof(Src) ? | 69 template <typename Dst, typename Src> |
58 CONTAINS_RANGE : OVERLAPS_RANGE; | 70 struct StaticDstRangeRelationToSrcRange<Dst, |
59 }; | 71 Src, |
60 | 72 INTEGER_REPRESENTATION_SIGNED, |
61 template <typename Dst, typename Src> | 73 INTEGER_REPRESENTATION_UNSIGNED> { |
62 struct StaticRangeCheck<Dst, Src, DST_SIGNED, SRC_UNSIGNED> { | 74 static const NumericRangeRepresentation value = |
63 typedef std::numeric_limits<Dst> DstLimits; | 75 MaxExponent<Dst>::value > MaxExponent<Src>::value |
64 typedef std::numeric_limits<Src> SrcLimits; | 76 ? NUMERIC_RANGE_CONTAINED |
65 // Compare based on max_exponent, which we must compute for integrals. | 77 : NUMERIC_RANGE_NOT_CONTAINED; |
66 static const size_t kDstMaxExponent = DstLimits::is_iec559 ? | 78 }; |
67 DstLimits::max_exponent : | 79 |
68 (sizeof(Dst) * 8 - 1); | 80 // Signed to unsigned: Dst cannot be statically determined to contain Src. |
69 static const size_t kSrcMaxExponent = sizeof(Src) * 8; | 81 template <typename Dst, typename Src> |
70 static const DstRange value = kDstMaxExponent >= kSrcMaxExponent ? | 82 struct StaticDstRangeRelationToSrcRange<Dst, |
71 CONTAINS_RANGE : OVERLAPS_RANGE; | 83 Src, |
72 }; | 84 INTEGER_REPRESENTATION_UNSIGNED, |
73 | 85 INTEGER_REPRESENTATION_SIGNED> { |
74 template <typename Dst, typename Src> | 86 static const NumericRangeRepresentation value = NUMERIC_RANGE_NOT_CONTAINED; |
75 struct StaticRangeCheck<Dst, Src, DST_UNSIGNED, SRC_SIGNED> { | 87 }; |
76 static const DstRange value = OVERLAPS_RANGE; | 88 |
77 }; | 89 enum RangeConstraint { |
78 | 90 RANGE_VALID = 0, // Value can be represented by the destination type. |
79 | 91 RANGE_UNDERFLOW = 1, // Value would overflow. |
80 enum RangeCheckResult { | 92 RANGE_OVERFLOW = 2, // Value would underflow. |
81 TYPE_VALID = 0, // Value can be represented by the destination type. | 93 RANGE_INVALID = 3 // Source value is invalid (i.e. NaN). |
82 TYPE_UNDERFLOW = 1, // Value would overflow. | 94 }; |
83 TYPE_OVERFLOW = 2, // Value would underflow. | 95 |
84 TYPE_INVALID = 3 // Source value is invalid (i.e. NaN). | 96 // Helper function for coercing an int back to a RangeContraint. |
85 }; | 97 RangeConstraint MakeRangeConstraint(int integer_range_constraint) { |
86 | 98 DCHECK(integer_range_constraint >= RANGE_VALID && |
87 // This macro creates a RangeCheckResult from an upper and lower bound | 99 integer_range_constraint <= RANGE_INVALID); |
100 return static_cast<RangeConstraint>(integer_range_constraint); | |
101 } | |
102 | |
103 // This function creates a RangeConstraint from an upper and lower bound | |
88 // check by taking advantage of the fact that only NaN can be out of range in | 104 // check by taking advantage of the fact that only NaN can be out of range in |
89 // both directions at once. | 105 // both directions at once. |
90 #define BASE_NUMERIC_RANGE_CHECK_RESULT(is_in_upper_bound, is_in_lower_bound) \ | 106 RangeConstraint MakeRangeConstraint(bool is_in_upper_bound, |
awong
2014/02/21 22:27:41
MakeRangeConstraint() -> GetRangeConstraint()
Mak
jschuh
2014/02/25 22:34:43
Done.
| |
91 RangeCheckResult(((is_in_upper_bound) ? 0 : TYPE_OVERFLOW) | \ | 107 bool is_in_lower_bound) { |
awong
2014/02/21 22:27:41
Change the enum definition to something that looks
jschuh
2014/02/25 22:34:43
Done.
| |
92 ((is_in_lower_bound) ? 0 : TYPE_UNDERFLOW)) | 108 return MakeRangeConstraint((is_in_upper_bound ? 0 : RANGE_OVERFLOW) | |
93 | 109 (is_in_lower_bound ? 0 : RANGE_UNDERFLOW)); |
94 template <typename Dst, | 110 } |
95 typename Src, | 111 |
96 DstSign IsDstSigned = std::numeric_limits<Dst>::is_signed ? | 112 template < |
97 DST_SIGNED : DST_UNSIGNED, | 113 typename Dst, |
98 SrcSign IsSrcSigned = std::numeric_limits<Src>::is_signed ? | 114 typename Src, |
99 SRC_SIGNED : SRC_UNSIGNED, | 115 IntegerSignRepresentation DstSign = std::numeric_limits<Dst>::is_signed |
100 DstRange IsSrcRangeContained = StaticRangeCheck<Dst, Src>::value> | 116 ? INTEGER_REPRESENTATION_SIGNED |
101 struct RangeCheckImpl {}; | 117 : INTEGER_REPRESENTATION_UNSIGNED, |
118 IntegerSignRepresentation SrcSign = std::numeric_limits<Src>::is_signed | |
119 ? INTEGER_REPRESENTATION_SIGNED | |
120 : INTEGER_REPRESENTATION_UNSIGNED, | |
121 NumericRangeRepresentation DstRange = | |
122 StaticDstRangeRelationToSrcRange<Dst, Src>::value > | |
123 struct DstRangeRelationToSrcRangeImpl; | |
awong
2014/02/21 22:27:41
backup the struct to the typedef indentation level
jschuh
2014/02/25 22:34:43
Done. Sorry, missed this one after the auto-format
| |
102 | 124 |
103 // The following templates are for ranges that must be verified at runtime. We | 125 // The following templates are for ranges that must be verified at runtime. We |
104 // split it into checks based on signedness to avoid confusing casts and | 126 // split it into checks based on signedness to avoid confusing casts and |
105 // compiler warnings on signed an unsigned comparisons. | 127 // compiler warnings on signed an unsigned comparisons. |
106 | 128 |
107 // Dst range always contains the result: nothing to check. | 129 // Dst range is statically determine to contain Src: Nothing to check. |
awong
2014/02/21 22:27:41
nit: determine -> determined
jschuh
2014/02/25 22:34:43
Done.
| |
108 template <typename Dst, typename Src, DstSign IsDstSigned, SrcSign IsSrcSigned> | 130 template <typename Dst, |
109 struct RangeCheckImpl<Dst, Src, IsDstSigned, IsSrcSigned, CONTAINS_RANGE> { | 131 typename Src, |
110 static RangeCheckResult Check(Src value) { | 132 IntegerSignRepresentation DstSign, |
111 return TYPE_VALID; | 133 IntegerSignRepresentation SrcSign> |
112 } | 134 struct DstRangeRelationToSrcRangeImpl<Dst, |
113 }; | 135 Src, |
114 | 136 DstSign, |
115 // Signed to signed narrowing. | 137 SrcSign, |
116 template <typename Dst, typename Src> | 138 NUMERIC_RANGE_CONTAINED> { |
117 struct RangeCheckImpl<Dst, Src, DST_SIGNED, SRC_SIGNED, OVERLAPS_RANGE> { | 139 static RangeConstraint Check(Src value) { return RANGE_VALID; } |
118 static RangeCheckResult Check(Src value) { | 140 }; |
119 typedef std::numeric_limits<Dst> DstLimits; | 141 |
120 return DstLimits::is_iec559 ? | 142 // Signed to signed narrowing: Both the upper and lower boundaries may be |
121 BASE_NUMERIC_RANGE_CHECK_RESULT( | 143 // exceeded. |
122 value <= static_cast<Src>(DstLimits::max()), | 144 template <typename Dst, typename Src> |
123 value >= static_cast<Src>(DstLimits::max() * -1)) : | 145 struct DstRangeRelationToSrcRangeImpl<Dst, |
124 BASE_NUMERIC_RANGE_CHECK_RESULT( | 146 Src, |
125 value <= static_cast<Src>(DstLimits::max()), | 147 INTEGER_REPRESENTATION_SIGNED, |
126 value >= static_cast<Src>(DstLimits::min())); | 148 INTEGER_REPRESENTATION_SIGNED, |
127 } | 149 NUMERIC_RANGE_NOT_CONTAINED> { |
128 }; | 150 static RangeConstraint Check(Src value) { |
129 | 151 return std::numeric_limits<Dst>::is_iec559 |
awong
2014/02/21 22:27:41
Should this be using lowest()?
Don't block submit
jschuh
2014/02/25 22:34:43
It should, but lowest() is C++11, so I explicitly
| |
130 // Unsigned to unsigned narrowing. | 152 ? MakeRangeConstraint(value <= std::numeric_limits<Dst>::max(), |
131 template <typename Dst, typename Src> | 153 value >= -std::numeric_limits<Dst>::max()) |
132 struct RangeCheckImpl<Dst, Src, DST_UNSIGNED, SRC_UNSIGNED, OVERLAPS_RANGE> { | 154 : MakeRangeConstraint(value <= std::numeric_limits<Dst>::max(), |
133 static RangeCheckResult Check(Src value) { | 155 value >= std::numeric_limits<Dst>::min()); |
134 typedef std::numeric_limits<Dst> DstLimits; | 156 } |
135 return BASE_NUMERIC_RANGE_CHECK_RESULT( | 157 }; |
136 value <= static_cast<Src>(DstLimits::max()), true); | 158 |
137 } | 159 // Unsigned to unsigned narrowing: Only the upper boundary can be exceeded. |
138 }; | 160 template <typename Dst, typename Src> |
139 | 161 struct DstRangeRelationToSrcRangeImpl<Dst, |
140 // Unsigned to signed. | 162 Src, |
141 template <typename Dst, typename Src> | 163 INTEGER_REPRESENTATION_UNSIGNED, |
142 struct RangeCheckImpl<Dst, Src, DST_SIGNED, SRC_UNSIGNED, OVERLAPS_RANGE> { | 164 INTEGER_REPRESENTATION_UNSIGNED, |
143 static RangeCheckResult Check(Src value) { | 165 NUMERIC_RANGE_NOT_CONTAINED> { |
144 typedef std::numeric_limits<Dst> DstLimits; | 166 static RangeConstraint Check(Src value) { |
145 return sizeof(Dst) > sizeof(Src) ? TYPE_VALID : | 167 return MakeRangeConstraint(value <= std::numeric_limits<Dst>::max(), true); |
146 BASE_NUMERIC_RANGE_CHECK_RESULT( | 168 } |
147 value <= static_cast<Src>(DstLimits::max()), true); | 169 }; |
148 } | 170 |
149 }; | 171 // Unsigned to signed: The upper boundary may be exceeded. |
150 | 172 template <typename Dst, typename Src> |
151 // Signed to unsigned. | 173 struct DstRangeRelationToSrcRangeImpl<Dst, |
152 template <typename Dst, typename Src> | 174 Src, |
153 struct RangeCheckImpl<Dst, Src, DST_UNSIGNED, SRC_SIGNED, OVERLAPS_RANGE> { | 175 INTEGER_REPRESENTATION_SIGNED, |
154 static RangeCheckResult Check(Src value) { | 176 INTEGER_REPRESENTATION_UNSIGNED, |
155 typedef std::numeric_limits<Dst> DstLimits; | 177 NUMERIC_RANGE_NOT_CONTAINED> { |
156 typedef std::numeric_limits<Src> SrcLimits; | 178 static RangeConstraint Check(Src value) { |
157 // Compare based on max_exponent, which we must compute for integrals. | 179 return sizeof(Dst) > sizeof(Src) |
158 static const size_t kDstMaxExponent = sizeof(Dst) * 8; | 180 ? RANGE_VALID |
159 static const size_t kSrcMaxExponent = SrcLimits::is_iec559 ? | 181 : MakeRangeConstraint( |
160 SrcLimits::max_exponent : | 182 value <= static_cast<Src>(std::numeric_limits<Dst>::max()), |
awong
2014/02/21 22:27:41
Checking my understanding...the reason this cast i
jschuh
2014/02/25 22:34:43
Yep.
| |
161 (sizeof(Src) * 8 - 1); | 183 true); |
162 return (kDstMaxExponent >= kSrcMaxExponent) ? | 184 } |
163 BASE_NUMERIC_RANGE_CHECK_RESULT(true, value >= static_cast<Src>(0)) : | 185 }; |
164 BASE_NUMERIC_RANGE_CHECK_RESULT( | 186 |
165 value <= static_cast<Src>(DstLimits::max()), | 187 // Signed to unsigned: The upper boundary may be exceeded for a narrower Dst, |
166 value >= static_cast<Src>(0)); | 188 // and any negative value exceeds the lower boundary. |
167 } | 189 template <typename Dst, typename Src> |
168 }; | 190 struct DstRangeRelationToSrcRangeImpl<Dst, |
169 | 191 Src, |
170 template <typename Dst, typename Src> | 192 INTEGER_REPRESENTATION_UNSIGNED, |
171 inline RangeCheckResult RangeCheck(Src value) { | 193 INTEGER_REPRESENTATION_SIGNED, |
194 NUMERIC_RANGE_NOT_CONTAINED> { | |
195 static RangeConstraint Check(Src value) { | |
196 return (MaxExponent<Dst>::value >= MaxExponent<Src>::value) | |
awong
2014/02/21 22:27:41
Okay, I don't understand, but I'll trust you did t
| |
197 ? MakeRangeConstraint(true, value >= static_cast<Src>(0)) | |
198 : MakeRangeConstraint( | |
199 value <= static_cast<Src>(std::numeric_limits<Dst>::max()), | |
200 value >= static_cast<Src>(0)); | |
201 } | |
202 }; | |
203 | |
204 template <typename Dst, typename Src> | |
205 inline RangeConstraint DstRangeRelationToSrcRange(Src value) { | |
172 COMPILE_ASSERT(std::numeric_limits<Src>::is_specialized, | 206 COMPILE_ASSERT(std::numeric_limits<Src>::is_specialized, |
173 argument_must_be_numeric); | 207 argument_must_be_numeric); |
174 COMPILE_ASSERT(std::numeric_limits<Dst>::is_specialized, | 208 COMPILE_ASSERT(std::numeric_limits<Dst>::is_specialized, |
175 result_must_be_numeric); | 209 result_must_be_numeric); |
176 return RangeCheckImpl<Dst, Src>::Check(value); | 210 return DstRangeRelationToSrcRangeImpl<Dst, Src>::Check(value); |
177 } | 211 } |
178 | 212 |
179 } // namespace internal | 213 } // namespace internal |
180 } // namespace base | 214 } // namespace base |
181 | 215 |
182 #endif // BASE_SAFE_CONVERSIONS_IMPL_H_ | 216 #endif // BASE_SAFE_CONVERSIONS_IMPL_H_ |
183 | 217 |
OLD | NEW |