Fix a bunch of undefined behavior in CheckedNumericState

base/numerics/safe_math_impl.h

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #ifndef BASE_NUMERICS_SAFE_MATH_IMPL_H_
 #define BASE_NUMERICS_SAFE_MATH_IMPL_H_
 
 #include <stddef.h>
 #include <stdint.h>
 
@@ skipping 782 matching lines @@
 };
 
 template <typename T, NumericRepresentation type =
                           GetNumericRepresentation<T>::value>
 class CheckedNumericState {};
 
 // Integrals require quite a bit of additional housekeeping to manage state.
 template <typename T>
 class CheckedNumericState<T, NUMERIC_INTEGER> {
  private:
+  // is_valid_ precedes value_ because member intializers in the constructors
+  // are evaluated in field order, and is_valid_ must be read when initializing
+  // value_.
+  bool is_valid_;
   T value_;
-  bool is_valid_;
 
  public:
   template <typename Src, NumericRepresentation type>
   friend class CheckedNumericState;
 
-  constexpr CheckedNumericState() : value_(0), is_valid_(true) {}
+  constexpr CheckedNumericState() : is_valid_(true), value_(0) {}
 
   template <typename Src>
   constexpr CheckedNumericState(Src value, bool is_valid)
-      : value_(static_cast<T>(value)),
-        is_valid_(is_valid && IsValueInRangeForNumericType<T>(value)) {
+      : is_valid_(is_valid && IsValueInRangeForNumericType<T>(value)),
+        value_(is_valid_ ? static_cast<T>(value) : 0) {
     static_assert(std::numeric_limits<Src>::is_specialized,
                   "Argument must be numeric.");
   }
 
   // Copy constructor.
   template <typename Src>
   constexpr CheckedNumericState(const CheckedNumericState<Src>& rhs)
-      : value_(static_cast<T>(rhs.value())), is_valid_(rhs.IsValid()) {}
+      : is_valid_(rhs.IsValid()),
+        value_(is_valid_ ? static_cast<T>(rhs.value()) : 0) {}
 
   template <typename Src>
   constexpr explicit CheckedNumericState(
       Src value,
       typename std::enable_if<std::numeric_limits<Src>::is_specialized,
                               int>::type = 0)
-      : value_(static_cast<T>(value)),
-        is_valid_(IsValueInRangeForNumericType<T>(value)) {}
+      : is_valid_(IsValueInRangeForNumericType<T>(value)),
+        value_(is_valid_ ? static_cast<T>(value) : 0) {}
 
   constexpr bool is_valid() const { return is_valid_; }
   constexpr T value() const { return value_; }
 };
 
 // Floating points maintain their own validity, but need translation wrappers.
 template <typename T>
 class CheckedNumericState<T, NUMERIC_FLOATING> {
  private:
   T value_;
@@ skipping 63 matching lines @@
   using math = M<typename UnderlyingType<L>::type,
                  typename UnderlyingType<R>::type,
                  void>;
   using type = typename math::result_type;
 };
 
 }  // namespace internal
 }  // namespace base
 
 #endif  // BASE_NUMERICS_SAFE_MATH_IMPL_H_