Use GCC/Clang builtins for Checked(Add|Sub|Mul)

base/numerics/safe_math_impl.h

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #ifndef BASE_NUMERICS_SAFE_MATH_IMPL_H_
 #define BASE_NUMERICS_SAFE_MATH_IMPL_H_
 
 #include <stddef.h>
 #include <stdint.h>
 
@@ skipping 238 matching lines @@
 struct IsIntegerArithmeticSafe {
   static const bool value = !std::numeric_limits<T>::is_iec559 &&
                             StaticDstRangeRelationToSrcRange<T, Lhs>::value ==
                                 NUMERIC_RANGE_CONTAINED &&
                             sizeof(T) >= (2 * sizeof(Lhs)) &&
                             StaticDstRangeRelationToSrcRange<T, Rhs>::value !=
                                 NUMERIC_RANGE_CONTAINED &&
                             sizeof(T) >= (2 * sizeof(Rhs));
 };
 
+// Probe for builtin math overflow support on Clang and version check on GCC.
+#if defined(__has_builtin)
+#define USE_OVERFLOW_BUILTINS (__has_builtin(__builtin_add_overflow))
+#elif defined(__GNUC__)
+#define USE_OVERFLOW_BUILTINS (__GNUC__ >= 5)
+#else
+#define USE_OVERFLOW_BUILTINS (0)
+#endif
+
 // Here are the actual portable checked integer math implementations.
 // TODO(jschuh): Break this code out from the enable_if pattern and find a clean
 // way to coalesce things into the CheckedNumericState specializations below.
 
 template <typename T>
 typename std::enable_if<std::numeric_limits<T>::is_integer, bool>::type
 CheckedAddImpl(T x, T y, T* result) {
   // Since the value of x+y is undefined if we have a signed type, we compute
   // it using the unsigned type of the same size.
   typedef typename UnsignedIntegerForSize<T>::type UnsignedDst;
   UnsignedDst ux = static_cast<UnsignedDst>(x);
   UnsignedDst uy = static_cast<UnsignedDst>(y);
   UnsignedDst uresult = static_cast<UnsignedDst>(ux + uy);
   *result = static_cast<T>(uresult);
   // Addition is valid if the sign of (x + y) is equal to either that of x or
   // that of y.
   return (std::numeric_limits<T>::is_signed)
              ? HasSignBit(BinaryComplement(
                    static_cast<UnsignedDst>((uresult ^ ux) & (uresult ^ uy))))
              : (BinaryComplement(x) >=
                 y);  // Unsigned is either valid or underflow.
 }
 
 template <typename T, typename U, typename V>
 typename std::enable_if<std::numeric_limits<T>::is_integer &&
                             std::numeric_limits<U>::is_integer &&
                             std::numeric_limits<V>::is_integer,
                         bool>::type
 CheckedAdd(T x, U y, V* result) {
+#if USE_OVERFLOW_BUILTINS
+  return !__builtin_add_overflow(x, y, result);
+#else
   using Promotion =
       typename ArithmeticPromotion<BIG_ENOUGH_PROMOTION, T, U>::type;
   Promotion presult;
   // Fail if either operand is out of range for the promoted type.
   // TODO(jschuh): This could be made to work for a broader range of values.
   bool is_valid = IsValueInRangeForNumericType<Promotion>(x) &&
                   IsValueInRangeForNumericType<Promotion>(y);
 
   if (IsIntegerArithmeticSafe<Promotion, U, V>::value) {
     presult = static_cast<Promotion>(x) + static_cast<Promotion>(y);
   } else {
     is_valid &= CheckedAddImpl(static_cast<Promotion>(x),
                                static_cast<Promotion>(y), &presult);
   }
   *result = static_cast<V>(presult);
   return is_valid && IsValueInRangeForNumericType<V>(presult);
+#endif
 }
 
 template <typename T>
 typename std::enable_if<std::numeric_limits<T>::is_integer, bool>::type
 CheckedSubImpl(T x, T y, T* result) {
   // Since the value of x+y is undefined if we have a signed type, we compute
   // it using the unsigned type of the same size.
   typedef typename UnsignedIntegerForSize<T>::type UnsignedDst;
   UnsignedDst ux = static_cast<UnsignedDst>(x);
   UnsignedDst uy = static_cast<UnsignedDst>(y);
   UnsignedDst uresult = static_cast<UnsignedDst>(ux - uy);
   *result = static_cast<T>(uresult);
   // Subtraction is valid if either x and y have same sign, or (x-y) and x have
   // the same sign.
   return (std::numeric_limits<T>::is_signed)
              ? HasSignBit(BinaryComplement(
                    static_cast<UnsignedDst>((uresult ^ ux) & (ux ^ uy))))
              : (x >= y);
 }
 
 template <typename T, typename U, typename V>
 typename std::enable_if<std::numeric_limits<T>::is_integer &&
                             std::numeric_limits<U>::is_integer &&
                             std::numeric_limits<V>::is_integer,
                         bool>::type
 CheckedSub(T x, U y, V* result) {
+#if USE_OVERFLOW_BUILTINS
+  return !__builtin_sub_overflow(x, y, result);
+#else
   using Promotion =
       typename ArithmeticPromotion<BIG_ENOUGH_PROMOTION, T, U>::type;
   Promotion presult;
   // Fail if either operand is out of range for the promoted type.
   // TODO(jschuh): This could be made to work for a broader range of values.
   bool is_valid = IsValueInRangeForNumericType<Promotion>(x) &&
                   IsValueInRangeForNumericType<Promotion>(y);
 
   if (IsIntegerArithmeticSafe<Promotion, U, V>::value) {
     presult = static_cast<Promotion>(x) - static_cast<Promotion>(y);
   } else {
     is_valid &= CheckedSubImpl(static_cast<Promotion>(x),
                                static_cast<Promotion>(y), &presult);
   }
   *result = static_cast<V>(presult);
   return is_valid && IsValueInRangeForNumericType<V>(presult);
+#endif
 }
 
 // Integer multiplication is a bit complicated. In the fast case we just
 // we just promote to a twice wider type, and range check the result. In the
 // slow case we need to manually check that the result won't be truncated by
 // checking with division against the appropriate bound.
 template <typename T>
 typename std::enable_if<std::numeric_limits<T>::is_integer &&
                             sizeof(T) * 2 <= sizeof(uintmax_t),
                         bool>::type
@@ skipping 43 matching lines @@
   *result = x * y;
   return (y == 0 || x <= std::numeric_limits<T>::max() / y);
 }
 
 template <typename T, typename U, typename V>
 typename std::enable_if<std::numeric_limits<T>::is_integer &&
                             std::numeric_limits<U>::is_integer &&
                             std::numeric_limits<V>::is_integer,
                         bool>::type
 CheckedMul(T x, U y, V* result) {
+#if USE_OVERFLOW_BUILTINS
+#if defined(__clang__)
+  // TODO(jschuh): Get the Clang runtime library issues sorted out so we can
+  // support full-width, mixed-sign multiply builtins. https://crbug.com/613003
+  static const bool kUseMaxInt =
+      sizeof(__typeof__(x * y)) < sizeof(intptr_t) ||
+      (sizeof(__typeof__(x * y)) == sizeof(intptr_t) &&
+       std::is_signed<T>::value == std::is_signed<U>::value);
+#else
+  static const bool kUseMaxInt = true;
+#endif
+  if (kUseMaxInt)
+    return !__builtin_mul_overflow(x, y, result);
+#endif
   using Promotion =
       typename ArithmeticPromotion<BIG_ENOUGH_PROMOTION, T, U>::type;
   Promotion presult;
   // Fail if either operand is out of range for the promoted type.
   // TODO(jschuh): This could be made to work for a broader range of values.
   bool is_valid = IsValueInRangeForNumericType<Promotion>(x) &&
                   IsValueInRangeForNumericType<Promotion>(y);
 
   if (IsIntegerArithmeticSafe<Promotion, U, V>::value) {
     presult = static_cast<Promotion>(x) * static_cast<Promotion>(y);
   } else {
     is_valid &= CheckedMulImpl(static_cast<Promotion>(x),
                                static_cast<Promotion>(y), &presult);
   }
   *result = static_cast<V>(presult);
   return is_valid && IsValueInRangeForNumericType<V>(presult);
 }
 
+// Avoid poluting the namespace once we're done with the macro.
+#undef USE_OVERFLOW_BUILTINS
+
 // Division just requires a check for a zero denominator or an invalid negation
 // on signed min/-1.
 template <typename T>
 typename std::enable_if<std::numeric_limits<T>::is_integer, bool>::type
 CheckedDivImpl(T x, T y, T* result) {
   if (y && (!std::numeric_limits<T>::is_signed ||
             x != std::numeric_limits<T>::min() || y != static_cast<T>(-1))) {
     *result = x / y;
     return true;
   }
@@ skipping 313 matching lines @@
       : value_(static_cast<T>(rhs.value())) {}
 
   bool is_valid() const { return std::isfinite(value_); }
   T value() const { return value_; }
 };
 
 }  // namespace internal
 }  // namespace base
 
 #endif  // BASE_NUMERICS_SAFE_MATH_IMPL_H_