Fix errors caused by unsafe conversions to/from size_t

third_party/WebKit/Source/wtf/StdLibExtras.h

 /*
  * Copyright (C) 2008 Apple Inc. All Rights Reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  * 1. Redistributions of source code must retain the above copyright
  *    notice, this list of conditions and the following disclaimer.
  * 2. Redistributions in binary form must reproduce the above copyright
  *    notice, this list of conditions and the following disclaimer in the
@@ skipping 135 matching lines @@
         FROM from;
         TO to;
     } u;
     u.from = from;
     return u.to;
 }
 
 template<typename To, typename From>
 inline To safeCast(From value)
 {
-    ASSERT(isInBounds<To>(value));
+    RELEASE_ASSERT(isInBounds<To>(value));
     return static_cast<To>(value);
 }
 
+// Use the following macros to prevent errors caused by accidental
+// implicit casting of function arguments.  For example, this can
+// be used to prevent overflows from non-promoting conversions.
+//
+// Example:
+//
+// HAS_STRICTLY_TYPED_ARG
+// void sendData(void* data, STRICTLY_TYPED_ARG(size))
+// {
+//    ALLOW_NUMERIC_ARG_TYPES_PROMOTABLE_TO(size_t);
+//    ...
+// }
+//
+// The previous example will prevent callers from passing, for example, an
+// 'int'. On a 32-bit build, it will prevent use of an 'unsigned long long'.
+#define HAS_STRICTLY_TYPED_ARG template<typename ActualArgType>
+#define STRICTLY_TYPED_ARG(argName) ActualArgType argName
+#define STRICT_ARG_TYPE(ExpectedArgType) \
+    static_assert(std::is_same<ActualArgType, ExpectedArgType>::value, \
+        "Strictly typed argument must be of type '" #ExpectedArgType "'." )
+#define ALLOW_NUMERIC_ARG_TYPES_PROMOTABLE_TO(ExpectedArgType) \
+    static_assert(std::numeric_limits<ExpectedArgType>::is_integer == std::numeric_limits<ActualArgType>::is_integer, \
+        "Conversion between integer and non-integer types not allowed."); \
+    static_assert(sizeof(ExpectedArgType) >= sizeof(ActualArgType), \
+        "Truncating conversions not allowed."); \
+    static_assert(!std::numeric_limits<ActualArgType>::is_signed || std::numeric_limits<ExpectedArgType>::is_signed, \
+        "Signed to unsigned conversion not allowed."); \
+    static_assert((sizeof(ExpectedArgType) != sizeof(ActualArgType)) || (std::numeric_limits<ActualArgType>::is_signed == std::numeric_limits<ExpectedArgType>::is_signed), \
+        "Unsigned to signed conversion not allowed for types with identical size (could overflow).");
+
 // Macro that returns a compile time constant with the length of an array, but gives an error if passed a non-array.
 template<typename T, size_t Size> char (&ArrayLengthHelperFunction(T (&)[Size]))[Size];
 // GCC needs some help to deduce a 0 length array.
 #if COMPILER(GCC)
 template<typename T> char (&ArrayLengthHelperFunction(T (&)[0]))[0];
 #endif
 #define WTF_ARRAY_LENGTH(array) sizeof(::WTF::ArrayLengthHelperFunction(array))
 
 } // namespace WTF
 
 // This version of placement new omits a 0 check.
 enum NotNullTag { NotNull };
 inline void* operator new(size_t, NotNullTag, void* location)
 {
     ASSERT(location);
     return location;
 }
 
 using WTF::bitwise_cast;
 using WTF::safeCast;
 
 #endif // WTF_StdLibExtras_h