Simplify CheckedNumeric macros

base/numerics/safe_math_impl.h

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #ifndef BASE_NUMERICS_SAFE_MATH_IMPL_H_
 #define BASE_NUMERICS_SAFE_MATH_IMPL_H_
 
 #include <stddef.h>
 #include <stdint.h>
 
@@ skipping 109 matching lines @@
   return !!(static_cast<typename UnsignedIntegerForSize<T>::type>(x) >>
             PositionOfSignBit<T>::value);
 }
 
 // This wrapper undoes the standard integer promotions.
 template <typename T>
 constexpr T BinaryComplement(T x) {
   return static_cast<T>(~x);
 }
 
+// For integers less than 128-bit and floats 32-bit or larger, we have the type
+// with the larger maximum exponent take precedence.
+enum ArithmeticPromotionCategory { LEFT_PROMOTION, RIGHT_PROMOTION };
+
+template <typename Lhs,
+          typename Rhs = Lhs,
+          ArithmeticPromotionCategory Promotion =
+              (MaxExponent<Lhs>::value > MaxExponent<Rhs>::value)
+                  ? LEFT_PROMOTION
+                  : RIGHT_PROMOTION>
+struct ArithmeticPromotion;
+
+template <typename Lhs, typename Rhs>
+struct ArithmeticPromotion<Lhs, Rhs, LEFT_PROMOTION> {
+  typedef Lhs type;
+};
+
+template <typename Lhs, typename Rhs>
+struct ArithmeticPromotion<Lhs, Rhs, RIGHT_PROMOTION> {
+  typedef Rhs type;
+};
+
 // Here are the actual portable checked integer math implementations.
 // TODO(jschuh): Break this code out from the enable_if pattern and find a clean
 // way to coalesce things into the CheckedNumericState specializations below.
 
 template <typename T>
 typename std::enable_if<std::numeric_limits<T>::is_integer, bool>::type
-CheckedAdd(T x, T y, T* result) {
+CheckedAddImpl(T x, T y, T* result) {
   // Since the value of x+y is undefined if we have a signed type, we compute
   // it using the unsigned type of the same size.
   typedef typename UnsignedIntegerForSize<T>::type UnsignedDst;
   UnsignedDst ux = static_cast<UnsignedDst>(x);
   UnsignedDst uy = static_cast<UnsignedDst>(y);
   UnsignedDst uresult = static_cast<UnsignedDst>(ux + uy);
   *result = static_cast<T>(uresult);
   // Addition is valid if the sign of (x + y) is equal to either that of x or
   // that of y.
   return (std::numeric_limits<T>::is_signed)
              ? HasSignBit(BinaryComplement(
                    static_cast<UnsignedDst>((uresult ^ ux) & (uresult ^ uy))))
              : (BinaryComplement(x) >=
                 y);  // Unsigned is either valid or underflow.
 }
 
+template <typename T, typename U, typename V>
+typename std::enable_if<std::numeric_limits<T>::is_integer &&
+                            std::numeric_limits<U>::is_integer &&
+                            std::numeric_limits<V>::is_integer,
+                        bool>::type
+CheckedAdd(T x, U y, V* result) {
+  using Promotion = typename ArithmeticPromotion<T, U>::type;
+  // Fail if either operand is out of range for the promoted type.
+  // TODO(jschuh): This could be made to work for a broader range of values.
+  if (!IsValueInRangeForNumericType<Promotion>(x) ||
+      !IsValueInRangeForNumericType<Promotion>(y)) {
+    return false;
+  }
+
+  Promotion presult;
+  bool is_valid = CheckedAddImpl(static_cast<Promotion>(x),
+                                 static_cast<Promotion>(y), &presult);
+  *result = static_cast<V>(presult);
+  return is_valid && IsValueInRangeForNumericType<V>(presult);
+}
+
 template <typename T>
 typename std::enable_if<std::numeric_limits<T>::is_integer, bool>::type
-CheckedSub(T x, T y, T* result) {
+CheckedSubImpl(T x, T y, T* result) {
   // Since the value of x+y is undefined if we have a signed type, we compute
   // it using the unsigned type of the same size.
   typedef typename UnsignedIntegerForSize<T>::type UnsignedDst;
   UnsignedDst ux = static_cast<UnsignedDst>(x);
   UnsignedDst uy = static_cast<UnsignedDst>(y);
   UnsignedDst uresult = static_cast<UnsignedDst>(ux - uy);
   *result = static_cast<T>(uresult);
   // Subtraction is valid if either x and y have same sign, or (x-y) and x have
   // the same sign.
   return (std::numeric_limits<T>::is_signed)
              ? HasSignBit(BinaryComplement(
                    static_cast<UnsignedDst>((uresult ^ ux) & (ux ^ uy))))
              : (x >= y);
 }
 
+template <typename T, typename U, typename V>
+typename std::enable_if<std::numeric_limits<T>::is_integer &&
+                            std::numeric_limits<U>::is_integer &&
+                            std::numeric_limits<V>::is_integer,
+                        bool>::type
+CheckedSub(T x, U y, V* result) {
+  using Promotion = typename ArithmeticPromotion<T, U>::type;
+  // Fail if either operand is out of range for the promoted type.
+  // TODO(jschuh): This could be made to work for a broader range of values.
+  if (!IsValueInRangeForNumericType<Promotion>(x) ||
+      !IsValueInRangeForNumericType<Promotion>(y)) {
+    return false;
+  }
+
+  Promotion presult;
+  bool is_valid = CheckedSubImpl(static_cast<Promotion>(x),
+                                 static_cast<Promotion>(y), &presult);
+  *result = static_cast<V>(presult);
+  return is_valid && IsValueInRangeForNumericType<V>(presult);
+}
+
 // Integer multiplication is a bit complicated. In the fast case we just
 // we just promote to a twice wider type, and range check the result. In the
 // slow case we need to manually check that the result won't be truncated by
 // checking with division against the appropriate bound.
 template <typename T>
 typename std::enable_if<std::numeric_limits<T>::is_integer &&
                             sizeof(T) * 2 <= sizeof(uintmax_t),
                         bool>::type
-CheckedMul(T x, T y, T* result) {
+CheckedMulImpl(T x, T y, T* result) {
   typedef typename TwiceWiderInteger<T>::type IntermediateType;
   IntermediateType tmp =
       static_cast<IntermediateType>(x) * static_cast<IntermediateType>(y);
   *result = static_cast<T>(tmp);
   return DstRangeRelationToSrcRange<T>(tmp) == RANGE_VALID;
 }
 
 template <typename T>
 typename std::enable_if<std::numeric_limits<T>::is_integer &&
                             std::numeric_limits<T>::is_signed &&
                             (sizeof(T) * 2 > sizeof(uintmax_t)),
                         bool>::type
-CheckedMul(T x, T y, T* result) {
+CheckedMulImpl(T x, T y, T* result) {
   if (x && y) {
     if (x > 0) {
       if (y > 0) {
         if (x > std::numeric_limits<T>::max() / y)
           return false;
       } else {
         if (y < std::numeric_limits<T>::min() / x)
           return false;
       }
     } else {
       if (y > 0) {
         if (x < std::numeric_limits<T>::min() / y)
           return false;
       } else {
         if (y < std::numeric_limits<T>::max() / x)
           return false;
       }
     }
   }
   *result = x * y;
   return true;
 }
 
 template <typename T>
 typename std::enable_if<std::numeric_limits<T>::is_integer &&
                             !std::numeric_limits<T>::is_signed &&
                             (sizeof(T) * 2 > sizeof(uintmax_t)),
                         bool>::type
-CheckedMul(T x, T y, T* result) {
+CheckedMulImpl(T x, T y, T* result) {
   *result = x * y;
   return (y == 0 || x <= std::numeric_limits<T>::max() / y);
 }
 
+template <typename T, typename U, typename V>
+typename std::enable_if<std::numeric_limits<T>::is_integer &&
+                            std::numeric_limits<U>::is_integer &&
+                            std::numeric_limits<V>::is_integer,
+                        bool>::type
+CheckedMul(T x, U y, V* result) {
+  using Promotion = typename ArithmeticPromotion<T, U>::type;
+  // Fail if either operand is out of range for the promoted type.
+  // TODO(jschuh): This could be made to work for a broader range of values.
+  if (!IsValueInRangeForNumericType<Promotion>(x) ||
+      !IsValueInRangeForNumericType<Promotion>(y)) {
+    return false;
+  }
+
+  Promotion presult;
+  bool is_valid = CheckedMulImpl(static_cast<Promotion>(x),
+                                 static_cast<Promotion>(y), &presult);
+  *result = static_cast<V>(presult);
+  return is_valid && IsValueInRangeForNumericType<V>(presult);
+}
+
 // Division just requires a check for a zero denominator or an invalid negation
 // on signed min/-1.
 template <typename T>
 typename std::enable_if<std::numeric_limits<T>::is_integer, bool>::type
-CheckedDiv(T x, T y, T* result) {
+CheckedDivImpl(T x, T y, T* result) {
   if (y && (!std::numeric_limits<T>::is_signed ||
             x != std::numeric_limits<T>::min() || y != static_cast<T>(-1))) {
     *result = x / y;
     return true;
   }
   return false;
 }
 
+template <typename T, typename U, typename V>
+typename std::enable_if<std::numeric_limits<T>::is_integer &&
+                            std::numeric_limits<U>::is_integer &&
+                            std::numeric_limits<V>::is_integer,
+                        bool>::type
+CheckedDiv(T x, U y, V* result) {
+  using Promotion = typename ArithmeticPromotion<T, U>::type;
+  // Fail if either operand is out of range for the promoted type.
+  // TODO(jschuh): This could be made to work for a broader range of values.
+  if (!IsValueInRangeForNumericType<Promotion>(x) ||
+      !IsValueInRangeForNumericType<Promotion>(y)) {
+    return false;
+  }
+
+  Promotion presult;
+  bool is_valid = CheckedDivImpl(static_cast<Promotion>(x),
+                                 static_cast<Promotion>(y), &presult);
+  *result = static_cast<V>(presult);
+  return is_valid && IsValueInRangeForNumericType<V>(presult);
+}
+
 template <typename T>
 typename std::enable_if<std::numeric_limits<T>::is_integer &&
                             std::numeric_limits<T>::is_signed,
                         bool>::type
-CheckedMod(T x, T y, T* result) {
+CheckedModImpl(T x, T y, T* result) {
   if (y > 0) {
     *result = static_cast<T>(x % y);
     return true;
   }
   return false;
 }
 
 template <typename T>
 typename std::enable_if<std::numeric_limits<T>::is_integer &&
                             !std::numeric_limits<T>::is_signed,
                         bool>::type
-CheckedMod(T x, T y, T* result) {
+CheckedModImpl(T x, T y, T* result) {
   if (y != 0) {
     *result = static_cast<T>(x % y);
     return true;
   }
   return false;
 }
 
+template <typename T, typename U, typename V>
+typename std::enable_if<std::numeric_limits<T>::is_integer &&
+                            std::numeric_limits<U>::is_integer &&
+                            std::numeric_limits<V>::is_integer,
+                        bool>::type
+CheckedMod(T x, U y, V* result) {
+  using Promotion = typename ArithmeticPromotion<T, U>::type;
+  Promotion presult;
+  bool is_valid = CheckedModImpl(static_cast<Promotion>(x),
+                                 static_cast<Promotion>(y), &presult);
+  *result = static_cast<V>(presult);
+  return is_valid && IsValueInRangeForNumericType<V>(presult);
+}
+
 template <typename T>
 typename std::enable_if<std::numeric_limits<T>::is_integer &&
                             std::numeric_limits<T>::is_signed,
                         bool>::type
 CheckedNeg(T value, T* result) {
   // The negation of signed min is min, so catch that one.
   if (value != std::numeric_limits<T>::min()) {
     *result = static_cast<T>(-value);
     return true;
   }
@@ skipping 64 matching lines @@
 
 template <typename T>
 typename std::enable_if<std::numeric_limits<T>::is_iec559, T>::type CheckedAbs(
     T value,
     bool*) {
   NOTREACHED();
   return static_cast<T>(std::abs(value));
 }
 
 // These are the floating point stubs that the compiler needs to see.
-#define BASE_FLOAT_ARITHMETIC_STUBS(NAME)                                \
-  template <typename T>                                                  \
-  typename std::enable_if<std::numeric_limits<T>::is_iec559, bool>::type \
-      Checked##NAME(T, T, T*) {                                          \
-    NOTREACHED();                                                        \
-    return static_cast<T>(false);                                        \
+#define BASE_FLOAT_ARITHMETIC_STUBS(NAME)                          \
+  template <typename T, typename U, typename V>                    \
+  typename std::enable_if<std::numeric_limits<T>::is_iec559 ||     \
+                              std::numeric_limits<U>::is_iec559 || \
+                              std::numeric_limits<V>::is_iec559,   \
+                          bool>::type Checked##NAME(T, U, V*) {    \
+    NOTREACHED();                                                  \
+    return static_cast<T>(false);                                  \
   }
 
 BASE_FLOAT_ARITHMETIC_STUBS(Add)
 BASE_FLOAT_ARITHMETIC_STUBS(Sub)
 BASE_FLOAT_ARITHMETIC_STUBS(Mul)
 BASE_FLOAT_ARITHMETIC_STUBS(Div)
 BASE_FLOAT_ARITHMETIC_STUBS(Mod)
 
 #undef BASE_FLOAT_ARITHMETIC_STUBS
 
@@ skipping 104 matching lines @@
 
   // Copy constructor.
   template <typename Src>
   CheckedNumericState(const CheckedNumericState<Src>& rhs)
       : value_(static_cast<T>(rhs.value())) {}
 
   bool is_valid() const { return std::isfinite(value_); }
   T value() const { return value_; }
 };
 
-// For integers less than 128-bit and floats 32-bit or larger, we have the type
-// with the larger maximum exponent take precedence.
-enum ArithmeticPromotionCategory { LEFT_PROMOTION, RIGHT_PROMOTION };
-
-template <typename Lhs,
-          typename Rhs = Lhs,
-          ArithmeticPromotionCategory Promotion =
-              (MaxExponent<Lhs>::value > MaxExponent<Rhs>::value)
-                  ? LEFT_PROMOTION
-                  : RIGHT_PROMOTION>
-struct ArithmeticPromotion;
-
-template <typename Lhs, typename Rhs>
-struct ArithmeticPromotion<Lhs, Rhs, LEFT_PROMOTION> {
-  typedef Lhs type;
-};
-
-template <typename Lhs, typename Rhs>
-struct ArithmeticPromotion<Lhs, Rhs, RIGHT_PROMOTION> {
-  typedef Rhs type;
-};
-
-// We can statically check if operations on the provided types can wrap, so we
-// can skip the checked operations if they're not needed. So, for an integer we
-// care if the destination type preserves the sign and is twice the width of
-// the source.
-template <typename T, typename Lhs, typename Rhs>
-struct IsIntegerArithmeticSafe {
-  static const bool value = !std::numeric_limits<T>::is_iec559 &&
-                            StaticDstRangeRelationToSrcRange<T, Lhs>::value ==
-                                NUMERIC_RANGE_CONTAINED &&
-                            sizeof(T) >= (2 * sizeof(Lhs)) &&
-                            StaticDstRangeRelationToSrcRange<T, Rhs>::value !=
-                                NUMERIC_RANGE_CONTAINED &&
-                            sizeof(T) >= (2 * sizeof(Rhs));
-};
-
 }  // namespace internal
 }  // namespace base
 
 #endif  // BASE_NUMERICS_SAFE_MATH_IMPL_H_