Make Checked* functions better align with GCC/Clang intrinsics

base/numerics/safe_math_impl.h

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #ifndef BASE_NUMERICS_SAFE_MATH_IMPL_H_
 #define BASE_NUMERICS_SAFE_MATH_IMPL_H_
 
 #include <stddef.h>
 #include <stdint.h>
 
@@ skipping 77 matching lines @@
 
 template <typename Integer>
 struct PositionOfSignBit {
   static const typename std::enable_if<std::numeric_limits<Integer>::is_integer,
                                        size_t>::type value =
       CHAR_BIT * sizeof(Integer) - 1;
 };
 
 // This is used for UnsignedAbs, where we need to support floating-point
 // template instantiations even though we don't actually support the operations.
-// However, there is no corresponding implementation of e.g. CheckedUnsignedAbs,
+// However, there is no corresponding implementation of e.g. SafeUnsignedAbs,
 // so the float versions will not compile.
 template <typename Numeric,
           bool IsInteger = std::numeric_limits<Numeric>::is_integer,
           bool IsFloat = std::numeric_limits<Numeric>::is_iec559>
 struct UnsignedOrFloatForSize;
 
 template <typename Numeric>
 struct UnsignedOrFloatForSize<Numeric, true, false> {
   typedef typename UnsignedIntegerForSize<Numeric>::type type;
 };
@@ skipping 16 matching lines @@
 template <typename T>
 constexpr T BinaryComplement(T x) {
   return static_cast<T>(~x);
 }
 
 // Here are the actual portable checked integer math implementations.
 // TODO(jschuh): Break this code out from the enable_if pattern and find a clean
 // way to coalesce things into the CheckedNumericState specializations below.
 
 template <typename T>
-typename std::enable_if<std::numeric_limits<T>::is_integer, T>::type
-CheckedAdd(T x, T y, bool* validity) {
+typename std::enable_if<std::numeric_limits<T>::is_integer, bool>::type
+CheckedAdd(T x, T y, T* result) {
   // Since the value of x+y is undefined if we have a signed type, we compute
   // it using the unsigned type of the same size.
   typedef typename UnsignedIntegerForSize<T>::type UnsignedDst;
   UnsignedDst ux = static_cast<UnsignedDst>(x);
   UnsignedDst uy = static_cast<UnsignedDst>(y);
   UnsignedDst uresult = static_cast<UnsignedDst>(ux + uy);
+  *result = static_cast<T>(uresult);
   // Addition is valid if the sign of (x + y) is equal to either that of x or
   // that of y.
-  if (std::numeric_limits<T>::is_signed) {
-    *validity = HasSignBit(BinaryComplement(
-        static_cast<UnsignedDst>((uresult ^ ux) & (uresult ^ uy))));
-  } else {  // Unsigned is either valid or overflow.
-    *validity = BinaryComplement(x) >= y;
-  }
-  return static_cast<T>(uresult);
+  return (std::numeric_limits<T>::is_signed)
+             ? HasSignBit(BinaryComplement(
+                   static_cast<UnsignedDst>((uresult ^ ux) & (uresult ^ uy))))
+             : (BinaryComplement(x) >=
+                y);  // Unsigned is either valid or underflow.
 }
 
 template <typename T>
-typename std::enable_if<std::numeric_limits<T>::is_integer, T>::type
-CheckedSub(T x, T y, bool* validity) {
+typename std::enable_if<std::numeric_limits<T>::is_integer, bool>::type
+CheckedSub(T x, T y, T* result) {
   // Since the value of x+y is undefined if we have a signed type, we compute
   // it using the unsigned type of the same size.
   typedef typename UnsignedIntegerForSize<T>::type UnsignedDst;
   UnsignedDst ux = static_cast<UnsignedDst>(x);
   UnsignedDst uy = static_cast<UnsignedDst>(y);
   UnsignedDst uresult = static_cast<UnsignedDst>(ux - uy);
+  *result = static_cast<T>(uresult);
   // Subtraction is valid if either x and y have same sign, or (x-y) and x have
   // the same sign.
-  if (std::numeric_limits<T>::is_signed) {
-    *validity = HasSignBit(
-        BinaryComplement(static_cast<UnsignedDst>((uresult ^ ux) & (ux ^ uy))));
-  } else {  // Unsigned is either valid or underflow.
-    *validity = x >= y;
-  }
-  return static_cast<T>(uresult);
+  return (std::numeric_limits<T>::is_signed)
+             ? HasSignBit(BinaryComplement(
+                   static_cast<UnsignedDst>((uresult ^ ux) & (ux ^ uy))))
+             : (x >= y);
 }
 
 // Integer multiplication is a bit complicated. In the fast case we just
 // we just promote to a twice wider type, and range check the result. In the
 // slow case we need to manually check that the result won't be truncated by
 // checking with division against the appropriate bound.
 template <typename T>
 typename std::enable_if<std::numeric_limits<T>::is_integer &&
                             sizeof(T) * 2 <= sizeof(uintmax_t),
-                        T>::type
-CheckedMul(T x, T y, bool* validity) {
+                        bool>::type
+CheckedMul(T x, T y, T* result) {
   typedef typename TwiceWiderInteger<T>::type IntermediateType;
   IntermediateType tmp =
       static_cast<IntermediateType>(x) * static_cast<IntermediateType>(y);
-  *validity = DstRangeRelationToSrcRange<T>(tmp) == RANGE_VALID;
-  return static_cast<T>(tmp);
+  *result = static_cast<T>(tmp);
+  return DstRangeRelationToSrcRange<T>(tmp) == RANGE_VALID;
 }
 
 template <typename T>
 typename std::enable_if<std::numeric_limits<T>::is_integer &&
                             std::numeric_limits<T>::is_signed &&
                             (sizeof(T) * 2 > sizeof(uintmax_t)),
-                        T>::type
-CheckedMul(T x, T y, bool* validity) {
-  // If either side is zero then the result will be zero.
-  if (!x || !y) {
-    *validity = true;
-    return static_cast<T>(0);
-  }
-  if (x > 0) {
-    if (y > 0) {
-      *validity = x <= std::numeric_limits<T>::max() / y;
+                        bool>::type
+CheckedMul(T x, T y, T* result) {
+  if (x && y) {
+    if (x > 0) {
+      if (y > 0) {
+        if (x > std::numeric_limits<T>::max() / y)
+          return false;
+      } else {
+        if (y < std::numeric_limits<T>::min() / x)
+          return false;
+      }
     } else {
-      *validity = y >= std::numeric_limits<T>::min() / x;
-    }
-  } else {
-    if (y > 0) {
-      *validity = x >= std::numeric_limits<T>::min() / y;
-    } else {
-      *validity = y >= std::numeric_limits<T>::max() / x;
+      if (y > 0) {
+        if (x < std::numeric_limits<T>::min() / y)
+          return false;
+      } else {
+        if (y < std::numeric_limits<T>::max() / x)
+          return false;
+      }
     }
   }
-  return static_cast<T>(*validity ? x * y : 0);
+  *result = x * y;
+  return true;
 }
 
 template <typename T>
 typename std::enable_if<std::numeric_limits<T>::is_integer &&
                             !std::numeric_limits<T>::is_signed &&
                             (sizeof(T) * 2 > sizeof(uintmax_t)),
-                        T>::type
-CheckedMul(T x, T y, bool* validity) {
-  *validity = (y == 0 || x <= std::numeric_limits<T>::max() / y);
-  return static_cast<T>(*validity ? x * y : 0);
+                        bool>::type
+CheckedMul(T x, T y, T* result) {
+  *result = x * y;
+  return (y == 0 || x <= std::numeric_limits<T>::max() / y);
 }
 
 // Division just requires a check for a zero denominator or an invalid negation
 // on signed min/-1.
 template <typename T>
-T CheckedDiv(T x,
-             T y,
-             bool* validity,
-             typename std::enable_if<std::numeric_limits<T>::is_integer,
-                                     int>::type = 0) {
-  if ((y == 0) ||
-      (std::numeric_limits<T>::is_signed &&
-       x == std::numeric_limits<T>::min() && y == static_cast<T>(-1))) {
-    *validity = false;
-    return static_cast<T>(0);
+typename std::enable_if<std::numeric_limits<T>::is_integer, bool>::type
+CheckedDiv(T x, T y, T* result) {
+  if (y && (!std::numeric_limits<T>::is_signed ||
+            x != std::numeric_limits<T>::min() || y != static_cast<T>(-1))) {
+    *result = x / y;
+    return true;
   }
-
-  *validity = true;
-  return static_cast<T>(x / y);
+  return false;
 }
 
 template <typename T>
 typename std::enable_if<std::numeric_limits<T>::is_integer &&
                             std::numeric_limits<T>::is_signed,
-                        T>::type
-CheckedMod(T x, T y, bool* validity) {
-  *validity = y > 0;
-  return static_cast<T>(*validity ? x % y : 0);
+                        bool>::type
+CheckedMod(T x, T y, T* result) {
+  if (y > 0) {
+    *result = static_cast<T>(x % y);
+    return true;
+  }
+  return false;
 }
 
 template <typename T>
 typename std::enable_if<std::numeric_limits<T>::is_integer &&
                             !std::numeric_limits<T>::is_signed,
-                        T>::type
-CheckedMod(T x, T y, bool* validity) {
-  *validity = y != 0;
-  return static_cast<T>(*validity ? x % y : 0);
+                        bool>::type
+CheckedMod(T x, T y, T* result) {
+  if (y != 0) {
+    *result = static_cast<T>(x % y);
+    return true;
+  }
+  return false;
 }
 
 template <typename T>
 typename std::enable_if<std::numeric_limits<T>::is_integer &&
                             std::numeric_limits<T>::is_signed,
-                        T>::type
-CheckedNeg(T value, bool* validity) {
-  *validity = value != std::numeric_limits<T>::min();
+                        bool>::type
+CheckedNeg(T value, T* result) {
   // The negation of signed min is min, so catch that one.
-  return static_cast<T>(*validity ? -value : 0);
+  if (value != std::numeric_limits<T>::min()) {
+    *result = static_cast<T>(-value);
+    return true;
+  }
+  return false;
 }
 
 template <typename T>
 typename std::enable_if<std::numeric_limits<T>::is_integer &&
                             !std::numeric_limits<T>::is_signed,
-                        T>::type
-CheckedNeg(T value, bool* validity) {
-  // The only legal unsigned negation is zero.
-  *validity = !value;
-  return static_cast<T>(
-      *validity ? -static_cast<typename SignedIntegerForSize<T>::type>(value)
-                : 0);
+                        bool>::type
+CheckedNeg(T value, T* result) {
+  if (!value) {  // The only legal unsigned negation is zero.
+    *result = static_cast<T>(0);
+    return true;
+  }
+  return false;
 }
 
 template <typename T>
 typename std::enable_if<std::numeric_limits<T>::is_integer &&
                             std::numeric_limits<T>::is_signed,
-                        T>::type
-CheckedAbs(T value, bool* validity) {
-  *validity = value != std::numeric_limits<T>::min();
-  return static_cast<T>(*validity ? std::abs(value) : 0);
+                        bool>::type
+CheckedAbs(T value, T* result) {
+  if (value != std::numeric_limits<T>::min()) {
+    *result = std::abs(value);
+    return true;
+  }
+  return false;
 }
 
 template <typename T>
 typename std::enable_if<std::numeric_limits<T>::is_integer &&
                             !std::numeric_limits<T>::is_signed,
-                        T>::type
-CheckedAbs(T value, bool* validity) {
+                        bool>::type
+CheckedAbs(T value, T* result) {
   // T is unsigned, so |value| must already be positive.
-  *validity = true;
-  return value;
+  *result = value;
+  return true;
 }
 
 template <typename T>
 typename std::enable_if<std::numeric_limits<T>::is_integer &&
                             std::numeric_limits<T>::is_signed,
                         typename UnsignedIntegerForSize<T>::type>::type
-CheckedUnsignedAbs(T value) {
+SafeUnsignedAbs(T value) {
   typedef typename UnsignedIntegerForSize<T>::type UnsignedT;
   return value == std::numeric_limits<T>::min()
              ? static_cast<UnsignedT>(std::numeric_limits<T>::max()) + 1
              : static_cast<UnsignedT>(std::abs(value));
 }
 
 template <typename T>
 typename std::enable_if<std::numeric_limits<T>::is_integer &&
                             !std::numeric_limits<T>::is_signed,
                         T>::type
-CheckedUnsignedAbs(T value) {
+SafeUnsignedAbs(T value) {
   // T is unsigned, so |value| must already be positive.
   return static_cast<T>(value);
 }
 
-// These are the floating point stubs that the compiler needs to see. Only the
-// negation operation is ever called.
-#define BASE_FLOAT_ARITHMETIC_STUBS(NAME)                             \
-  template <typename T>                                               \
-  typename std::enable_if<std::numeric_limits<T>::is_iec559, T>::type \
-      Checked##NAME(T, T, bool*) {                                    \
-    NOTREACHED();                                                     \
-    return static_cast<T>(0);                                         \
+template <typename T>
+typename std::enable_if<std::numeric_limits<T>::is_iec559, T>::type CheckedNeg(
+    T value,
+    bool*) {
+  NOTREACHED();
+  return static_cast<T>(-value);
+}
+
+template <typename T>
+typename std::enable_if<std::numeric_limits<T>::is_iec559, T>::type CheckedAbs(
+    T value,
+    bool*) {
+  NOTREACHED();
+  return static_cast<T>(std::abs(value));
+}
+
+// These are the floating point stubs that the compiler needs to see.
+#define BASE_FLOAT_ARITHMETIC_STUBS(NAME)                                \
+  template <typename T>                                                  \
+  typename std::enable_if<std::numeric_limits<T>::is_iec559, bool>::type \
+      Checked##NAME(T, T, T*) {                                          \
+    NOTREACHED();                                                        \
+    return static_cast<T>(false);                                        \
   }
 
 BASE_FLOAT_ARITHMETIC_STUBS(Add)
 BASE_FLOAT_ARITHMETIC_STUBS(Sub)
 BASE_FLOAT_ARITHMETIC_STUBS(Mul)
 BASE_FLOAT_ARITHMETIC_STUBS(Div)
 BASE_FLOAT_ARITHMETIC_STUBS(Mod)
 
 #undef BASE_FLOAT_ARITHMETIC_STUBS
 
 template <typename T>
-typename std::enable_if<std::numeric_limits<T>::is_iec559, T>::type CheckedNeg(
-    T value,
-    bool*) {
-  return static_cast<T>(-value);
+typename std::enable_if<std::numeric_limits<T>::is_iec559, bool>::type
+CheckedNeg(T value, T* result) {
+  *result = static_cast<T>(-value);
+  return true;
 }
 
 template <typename T>
-typename std::enable_if<std::numeric_limits<T>::is_iec559, T>::type CheckedAbs(
-    T value,
-    bool*) {
-  return static_cast<T>(std::abs(value));
+typename std::enable_if<std::numeric_limits<T>::is_iec559, bool>::type
+CheckedAbs(T value, T* result) {
+  *result = static_cast<T>(std::abs(value));
+  return true;
 }
 
 // Floats carry around their validity state with them, but integers do not. So,
 // we wrap the underlying value in a specialization in order to hide that detail
 // and expose an interface via accessors.
 enum NumericRepresentation {
   NUMERIC_INTEGER,
   NUMERIC_FLOATING,
   NUMERIC_UNKNOWN
 };
@@ skipping 123 matching lines @@
                             sizeof(T) >= (2 * sizeof(Lhs)) &&
                             StaticDstRangeRelationToSrcRange<T, Rhs>::value !=
                                 NUMERIC_RANGE_CONTAINED &&
                             sizeof(T) >= (2 * sizeof(Rhs));
 };
 
 }  // namespace internal
 }  // namespace base
 
 #endif  // BASE_NUMERICS_SAFE_MATH_IMPL_H_