Add ClampedNumeric templates

base/numerics/safe_numerics_unittest.cc

 // Copyright 2013 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include <stddef.h>
 #include <stdint.h>
 
 #include <limits>
 #include <type_traits>
 
 #include "base/compiler_specific.h"
 #include "base/logging.h"
 #include "base/numerics/safe_conversions.h"
 #include "base/numerics/safe_math.h"
 #include "base/test/gtest_util.h"
 #include "build/build_config.h"
 #include "testing/gtest/include/gtest/gtest.h"
 
 #if defined(COMPILER_MSVC) && defined(ARCH_CPU_32_BITS)
 #include <mmintrin.h>
 #endif
 
 using std::numeric_limits;
 using base::CheckedNumeric;
+using base::ClampedNumeric;

[dcheng, 2017/06/28 07:25:06]

FWIW, I think we usually dump tests into the same namespace as they're testing
for this reason.

[jschuh, 2017/06/28 12:32:38]

Now you tell me.

 using base::IsValidForType;
 using base::ValueOrDieForType;
 using base::ValueOrDefaultForType;
 using base::MakeCheckedNum;
+using base::MakeClampedNum;
 using base::CheckMax;
 using base::CheckMin;
 using base::CheckAdd;
 using base::CheckSub;
 using base::CheckMul;
 using base::CheckDiv;
 using base::CheckMod;
 using base::CheckLsh;
 using base::CheckRsh;
+using base::ClampMax;
+using base::ClampMin;
+using base::ClampAdd;
+using base::ClampSub;
+using base::ClampMul;
+using base::ClampDiv;
+using base::ClampMod;
+using base::ClampLsh;
+using base::ClampRsh;
+using base::as_unsigned;
 using base::checked_cast;
 using base::IsValueInRangeForNumericType;
 using base::IsValueNegative;
+using base::SaturationDefaultLimits;
 using base::SizeT;
 using base::StrictNumeric;
 using base::MakeStrictNum;
 using base::saturated_cast;
 using base::strict_cast;
 using base::internal::MaxExponent;
 using base::internal::IntegerBitsPlusSign;
 using base::internal::RangeCheck;
 
 // These tests deliberately cause arithmetic boundary errors. If the compiler is
@@ skipping 73 matching lines @@
               "");
 static_assert(!FastIntegerArithmeticPromotion<intmax_t, int8_t>::is_contained,
               "");
 static_assert(!FastIntegerArithmeticPromotion<uintmax_t, int8_t>::is_contained,
               "");
 
 template <typename U>
 U GetNumericValueForTest(const CheckedNumeric<U>& src) {
   return src.state_.value();
 }
+
+template <typename U>
+U GetNumericValueForTest(const ClampedNumeric<U>& src) {
+  return static_cast<U>(src);
+}
+
+template <typename U>
+U GetNumericValueForTest(const U& src) {
+  return src;
+}
+
 }  // namespace internal.
 }  // namespace base.
 
 using base::internal::GetNumericValueForTest;
 
 // Logs the ValueOrDie() failure instead of crashing.
 struct LogOnFailure {
   template <typename T>
   static T HandleFailure() {
     LOG(WARNING) << "ValueOrDie() failed unexpectedly.";
     return T();
   }
 };
 
+template <typename T>
+constexpr T GetValue(const T& src) {
+  return src;
+}
+
+template <typename T, typename U>
+constexpr T GetValueAsDest(const U& src) {
+  return static_cast<T>(src);
+}
+
+template <typename T>
+constexpr T GetValue(const CheckedNumeric<T>& src) {
+  return src.template ValueOrDie<T, LogOnFailure>();
+}
+
+template <typename T, typename U>
+constexpr T GetValueAsDest(const CheckedNumeric<U>& src) {
+  return src.template ValueOrDie<T, LogOnFailure>();
+}
+
+template <typename T>
+constexpr T GetValue(const ClampedNumeric<T>& src) {
+  return static_cast<T>(src);
+}
+
+template <typename T, typename U>
+constexpr T GetValueAsDest(const ClampedNumeric<U>& src) {
+  return static_cast<T>(src);
+}
+
 // Helper macros to wrap displaying the conversion types and line numbers.
 #define TEST_EXPECTED_VALIDITY(expected, actual)                           \
   EXPECT_EQ(expected, (actual).template Cast<Dst>().IsValid())             \
       << "Result test: Value " << GetNumericValueForTest(actual) << " as " \
       << dst << " on line " << line
 
 #define TEST_EXPECTED_SUCCESS(actual) TEST_EXPECTED_VALIDITY(true, actual)
 #define TEST_EXPECTED_FAILURE(actual) TEST_EXPECTED_VALIDITY(false, actual)
 
 // We have to handle promotions, so infer the underlying type below from actual.
 #define TEST_EXPECTED_VALUE(expected, actual)                               \
-  EXPECT_EQ(static_cast<typename std::decay<decltype(actual)>::type::type>( \
-                expected),                                                  \
-            ((actual)                                                       \
-                 .template ValueOrDie<                                      \
-                     typename std::decay<decltype(actual)>::type::type,     \
-                     LogOnFailure>()))                                      \
+  EXPECT_EQ(GetValue(expected), GetValueAsDest<decltype(expected)>(actual)) \
       << "Result test: Value " << GetNumericValueForTest(actual) << " as "  \
       << dst << " on line " << line
 
 // Test the simple pointer arithmetic overrides.
 template <typename Dst>
 void TestStrictPointerMath() {
   Dst dummy_value = 0;
   Dst* dummy_ptr = &dummy_value;
   static const Dst kDummyOffset = 2;  // Don't want to go too far.
   EXPECT_EQ(dummy_ptr + kDummyOffset,
             dummy_ptr + StrictNumeric<Dst>(kDummyOffset));
   EXPECT_EQ(dummy_ptr - kDummyOffset,
             dummy_ptr - StrictNumeric<Dst>(kDummyOffset));
   EXPECT_NE(dummy_ptr, dummy_ptr + StrictNumeric<Dst>(kDummyOffset));
   EXPECT_NE(dummy_ptr, dummy_ptr - StrictNumeric<Dst>(kDummyOffset));
   EXPECT_DEATH_IF_SUPPORTED(
       dummy_ptr + StrictNumeric<size_t>(std::numeric_limits<size_t>::max()),
       "");
 }
 
 // Signed integer arithmetic.
 template <typename Dst>
 static void TestSpecializedArithmetic(
     const char* dst,
     int line,
     typename std::enable_if<numeric_limits<Dst>::is_integer &&
                                 numeric_limits<Dst>::is_signed,
                             int>::type = 0) {
-  using DstLimits = numeric_limits<Dst>;
+  using DstLimits = SaturationDefaultLimits<Dst>;
   TEST_EXPECTED_FAILURE(-CheckedNumeric<Dst>(DstLimits::lowest()));
   TEST_EXPECTED_FAILURE(CheckedNumeric<Dst>(DstLimits::lowest()).Abs());
   TEST_EXPECTED_VALUE(1, CheckedNumeric<Dst>(-1).Abs());
   TEST_EXPECTED_VALUE(DstLimits::max(),
                       MakeCheckedNum(-DstLimits::max()).Abs());
 
+  TEST_EXPECTED_VALUE(DstLimits::Overflow(),
+                      -ClampedNumeric<Dst>(DstLimits::lowest()));
+  TEST_EXPECTED_VALUE(DstLimits::Overflow(),
+                      ClampedNumeric<Dst>(DstLimits::lowest()).Abs());
+  TEST_EXPECTED_VALUE(1, ClampedNumeric<Dst>(-1).Abs());
+  TEST_EXPECTED_VALUE(DstLimits::max(),
+                      MakeClampedNum(-DstLimits::max()).Abs());
+
   TEST_EXPECTED_SUCCESS(CheckedNumeric<Dst>(DstLimits::max()) + -1);
   TEST_EXPECTED_FAILURE(CheckedNumeric<Dst>(DstLimits::lowest()) + -1);
   TEST_EXPECTED_FAILURE(CheckedNumeric<Dst>(DstLimits::lowest()) +
                         DstLimits::lowest());
 
+  TEST_EXPECTED_VALUE(DstLimits::max() - 1,
+                      ClampedNumeric<Dst>(DstLimits::max()) + -1);
+  TEST_EXPECTED_VALUE(DstLimits::Underflow(),
+                      ClampedNumeric<Dst>(DstLimits::lowest()) + -1);
+  TEST_EXPECTED_VALUE(
+      DstLimits::Underflow(),
+      ClampedNumeric<Dst>(DstLimits::lowest()) + DstLimits::lowest());
+
   TEST_EXPECTED_FAILURE(CheckedNumeric<Dst>(DstLimits::lowest()) - 1);
   TEST_EXPECTED_SUCCESS(CheckedNumeric<Dst>(DstLimits::lowest()) - -1);
   TEST_EXPECTED_FAILURE(CheckedNumeric<Dst>(DstLimits::max()) -
                         DstLimits::lowest());
   TEST_EXPECTED_FAILURE(CheckedNumeric<Dst>(DstLimits::lowest()) -
                         DstLimits::max());
 
+  TEST_EXPECTED_VALUE(DstLimits::Underflow(),
+                      ClampedNumeric<Dst>(DstLimits::lowest()) - 1);
+  TEST_EXPECTED_VALUE(DstLimits::lowest() + 1,
+                      ClampedNumeric<Dst>(DstLimits::lowest()) - -1);
+  TEST_EXPECTED_VALUE(
+      DstLimits::Overflow(),
+      ClampedNumeric<Dst>(DstLimits::max()) - DstLimits::lowest());
+  TEST_EXPECTED_VALUE(
+      DstLimits::Underflow(),
+      ClampedNumeric<Dst>(DstLimits::lowest()) - DstLimits::max());
+
   TEST_EXPECTED_FAILURE(CheckedNumeric<Dst>(DstLimits::lowest()) * 2);
+  TEST_EXPECTED_VALUE(DstLimits::Underflow(),
+                      ClampedNumeric<Dst>(DstLimits::lowest()) * 2);
 
   TEST_EXPECTED_FAILURE(CheckedNumeric<Dst>(DstLimits::lowest()) / -1);
   TEST_EXPECTED_VALUE(0, CheckedNumeric<Dst>(-1) / 2);
   TEST_EXPECTED_FAILURE(CheckedNumeric<Dst>(DstLimits::lowest()) * -1);
   TEST_EXPECTED_VALUE(DstLimits::max(),
                       CheckedNumeric<Dst>(DstLimits::lowest() + 1) * Dst(-1));
   TEST_EXPECTED_VALUE(DstLimits::max(),
                       CheckedNumeric<Dst>(-1) * Dst(DstLimits::lowest() + 1));
   TEST_EXPECTED_VALUE(DstLimits::lowest(),
                       CheckedNumeric<Dst>(DstLimits::lowest()) * Dst(1));
   TEST_EXPECTED_VALUE(DstLimits::lowest(),
                       CheckedNumeric<Dst>(1) * Dst(DstLimits::lowest()));
-  TEST_EXPECTED_VALUE(DstLimits::lowest(),
-                      MakeCheckedNum(DstLimits::lowest()).UnsignedAbs());
+  TEST_EXPECTED_VALUE(
+      typename std::make_unsigned<Dst>::type(0) - DstLimits::lowest(),
+      MakeCheckedNum(DstLimits::lowest()).UnsignedAbs());
   TEST_EXPECTED_VALUE(DstLimits::max(),
                       MakeCheckedNum(DstLimits::max()).UnsignedAbs());
   TEST_EXPECTED_VALUE(0, CheckedNumeric<Dst>(0).UnsignedAbs());
   TEST_EXPECTED_VALUE(1, CheckedNumeric<Dst>(1).UnsignedAbs());
   TEST_EXPECTED_VALUE(1, CheckedNumeric<Dst>(-1).UnsignedAbs());
 
+  TEST_EXPECTED_VALUE(DstLimits::Overflow(),
+                      ClampedNumeric<Dst>(DstLimits::lowest()) / -1);
+  TEST_EXPECTED_VALUE(0, ClampedNumeric<Dst>(-1) / 2);
+  TEST_EXPECTED_VALUE(DstLimits::Overflow(),
+                      ClampedNumeric<Dst>(DstLimits::lowest()) * -1);
+  TEST_EXPECTED_VALUE(DstLimits::max(),
+                      ClampedNumeric<Dst>(DstLimits::lowest() + 1) * Dst(-1));
+  TEST_EXPECTED_VALUE(DstLimits::max(),
+                      ClampedNumeric<Dst>(-1) * Dst(DstLimits::lowest() + 1));
+  TEST_EXPECTED_VALUE(DstLimits::lowest(),
+                      ClampedNumeric<Dst>(DstLimits::lowest()) * Dst(1));
+  TEST_EXPECTED_VALUE(DstLimits::lowest(),
+                      ClampedNumeric<Dst>(1) * Dst(DstLimits::lowest()));
+  TEST_EXPECTED_VALUE(
+      typename std::make_unsigned<Dst>::type(0) - DstLimits::lowest(),
+      MakeClampedNum(DstLimits::lowest()).UnsignedAbs());
+  TEST_EXPECTED_VALUE(DstLimits::max(),
+                      MakeClampedNum(DstLimits::max()).UnsignedAbs());
+  TEST_EXPECTED_VALUE(0, ClampedNumeric<Dst>(0).UnsignedAbs());
+  TEST_EXPECTED_VALUE(1, ClampedNumeric<Dst>(1).UnsignedAbs());
+  TEST_EXPECTED_VALUE(1, ClampedNumeric<Dst>(-1).UnsignedAbs());
+
   // Modulus is legal only for integers.
   TEST_EXPECTED_VALUE(0, CheckedNumeric<Dst>() % 1);
   TEST_EXPECTED_VALUE(0, CheckedNumeric<Dst>(1) % 1);
   TEST_EXPECTED_VALUE(-1, CheckedNumeric<Dst>(-1) % 2);
-  TEST_EXPECTED_FAILURE(CheckedNumeric<Dst>(-1) % -2);
+  TEST_EXPECTED_VALUE(-1, CheckedNumeric<Dst>(-1) % -2);
   TEST_EXPECTED_VALUE(0, CheckedNumeric<Dst>(DstLimits::lowest()) % 2);
   TEST_EXPECTED_VALUE(1, CheckedNumeric<Dst>(DstLimits::max()) % 2);
   // Test all the different modulus combinations.
   TEST_EXPECTED_VALUE(0, CheckedNumeric<Dst>(1) % CheckedNumeric<Dst>(1));
   TEST_EXPECTED_VALUE(0, 1 % CheckedNumeric<Dst>(1));
   TEST_EXPECTED_VALUE(0, CheckedNumeric<Dst>(1) % 1);
   CheckedNumeric<Dst> checked_dst = 1;
   TEST_EXPECTED_VALUE(0, checked_dst %= 1);
   // Test that div by 0 is avoided but returns invalid result.
   TEST_EXPECTED_FAILURE(CheckedNumeric<Dst>(1) % 0);
   // Test bit shifts.
   volatile Dst negative_one = -1;
   TEST_EXPECTED_FAILURE(CheckedNumeric<Dst>(1) << negative_one);
   TEST_EXPECTED_FAILURE(CheckedNumeric<Dst>(1)
                         << (IntegerBitsPlusSign<Dst>::value - 1));
-  TEST_EXPECTED_FAILURE(CheckedNumeric<Dst>(0)
-                        << IntegerBitsPlusSign<Dst>::value);
+  TEST_EXPECTED_VALUE(Dst(0), CheckedNumeric<Dst>(0)
+                                  << IntegerBitsPlusSign<Dst>::value);
   TEST_EXPECTED_FAILURE(CheckedNumeric<Dst>(DstLimits::max()) << 1);
   TEST_EXPECTED_VALUE(
       static_cast<Dst>(1) << (IntegerBitsPlusSign<Dst>::value - 2),
       CheckedNumeric<Dst>(1) << (IntegerBitsPlusSign<Dst>::value - 2));
   TEST_EXPECTED_VALUE(0, CheckedNumeric<Dst>(0)
                              << (IntegerBitsPlusSign<Dst>::value - 1));
   TEST_EXPECTED_VALUE(1, CheckedNumeric<Dst>(1) << 0);
   TEST_EXPECTED_VALUE(2, CheckedNumeric<Dst>(1) << 1);
   TEST_EXPECTED_FAILURE(CheckedNumeric<Dst>(1) >>
                         IntegerBitsPlusSign<Dst>::value);
   TEST_EXPECTED_VALUE(
       0, CheckedNumeric<Dst>(1) >> (IntegerBitsPlusSign<Dst>::value - 1));
   TEST_EXPECTED_FAILURE(CheckedNumeric<Dst>(1) >> negative_one);
 
+  // Modulus is legal only for integers.
+  TEST_EXPECTED_VALUE(0, ClampedNumeric<Dst>() % 1);
+  TEST_EXPECTED_VALUE(0, ClampedNumeric<Dst>(1) % 1);
+  TEST_EXPECTED_VALUE(-1, ClampedNumeric<Dst>(-1) % 2);
+  TEST_EXPECTED_VALUE(-1, ClampedNumeric<Dst>(-1) % -2);
+  TEST_EXPECTED_VALUE(0, ClampedNumeric<Dst>(DstLimits::lowest()) % 2);
+  TEST_EXPECTED_VALUE(1, ClampedNumeric<Dst>(DstLimits::max()) % 2);
+  // Test all the different modulus combinations.
+  TEST_EXPECTED_VALUE(0, ClampedNumeric<Dst>(1) % ClampedNumeric<Dst>(1));
+  TEST_EXPECTED_VALUE(0, 1 % ClampedNumeric<Dst>(1));
+  TEST_EXPECTED_VALUE(0, ClampedNumeric<Dst>(1) % 1);
+  ClampedNumeric<Dst> clamped_dst = 1;
+  TEST_EXPECTED_VALUE(0, clamped_dst %= 1);
+  TEST_EXPECTED_VALUE(Dst(1), ClampedNumeric<Dst>(1) % 0);
+  // Test bit shifts.
+  TEST_EXPECTED_VALUE(DstLimits::Overflow(),
+                      ClampedNumeric<Dst>(1)
+                          << (IntegerBitsPlusSign<Dst>::value - 1U));
+  TEST_EXPECTED_VALUE(Dst(0), ClampedNumeric<Dst>(0)
+                                  << (IntegerBitsPlusSign<Dst>::value + 0U));
+  TEST_EXPECTED_VALUE(DstLimits::Overflow(),
+                      ClampedNumeric<Dst>(DstLimits::max()) << 1U);
+  TEST_EXPECTED_VALUE(
+      static_cast<Dst>(1) << (IntegerBitsPlusSign<Dst>::value - 2U),
+      ClampedNumeric<Dst>(1) << (IntegerBitsPlusSign<Dst>::value - 2U));
+  TEST_EXPECTED_VALUE(0, ClampedNumeric<Dst>(0)
+                             << (IntegerBitsPlusSign<Dst>::value - 1U));
+  TEST_EXPECTED_VALUE(1, ClampedNumeric<Dst>(1) << 0U);
+  TEST_EXPECTED_VALUE(2, ClampedNumeric<Dst>(1) << 1U);
+  TEST_EXPECTED_VALUE(
+      0, ClampedNumeric<Dst>(1) >> (IntegerBitsPlusSign<Dst>::value + 0U));
+  TEST_EXPECTED_VALUE(
+      0, ClampedNumeric<Dst>(1) >> (IntegerBitsPlusSign<Dst>::value - 1U));
+
   TestStrictPointerMath<Dst>();
 }
 
 // Unsigned integer arithmetic.
 template <typename Dst>
 static void TestSpecializedArithmetic(
     const char* dst,
     int line,
     typename std::enable_if<numeric_limits<Dst>::is_integer &&
                                 !numeric_limits<Dst>::is_signed,
                             int>::type = 0) {
-  using DstLimits = numeric_limits<Dst>;
+  using DstLimits = SaturationDefaultLimits<Dst>;
   TEST_EXPECTED_SUCCESS(-CheckedNumeric<Dst>(DstLimits::lowest()));
   TEST_EXPECTED_SUCCESS(CheckedNumeric<Dst>(DstLimits::lowest()).Abs());
   TEST_EXPECTED_FAILURE(CheckedNumeric<Dst>(DstLimits::lowest()) + -1);
   TEST_EXPECTED_FAILURE(CheckedNumeric<Dst>(DstLimits::lowest()) - 1);
   TEST_EXPECTED_VALUE(0, CheckedNumeric<Dst>(DstLimits::lowest()) * 2);
   TEST_EXPECTED_VALUE(0, CheckedNumeric<Dst>(1) / 2);
   TEST_EXPECTED_SUCCESS(CheckedNumeric<Dst>(DstLimits::lowest()).UnsignedAbs());
   TEST_EXPECTED_SUCCESS(
       CheckedNumeric<typename std::make_signed<Dst>::type>(
           std::numeric_limits<typename std::make_signed<Dst>::type>::lowest())
           .UnsignedAbs());
   TEST_EXPECTED_VALUE(DstLimits::lowest(),
                       MakeCheckedNum(DstLimits::lowest()).UnsignedAbs());
   TEST_EXPECTED_VALUE(DstLimits::max(),
                       MakeCheckedNum(DstLimits::max()).UnsignedAbs());
   TEST_EXPECTED_VALUE(0, CheckedNumeric<Dst>(0).UnsignedAbs());
   TEST_EXPECTED_VALUE(1, CheckedNumeric<Dst>(1).UnsignedAbs());
 
+  TEST_EXPECTED_VALUE(0, -ClampedNumeric<Dst>(DstLimits::lowest()));
+  TEST_EXPECTED_VALUE(0, ClampedNumeric<Dst>(DstLimits::lowest()).Abs());
+  TEST_EXPECTED_VALUE(DstLimits::Underflow(),
+                      ClampedNumeric<Dst>(DstLimits::lowest()) + -1);
+  TEST_EXPECTED_VALUE(DstLimits::Underflow(),
+                      ClampedNumeric<Dst>(DstLimits::lowest()) - 1);
+  TEST_EXPECTED_VALUE(0, ClampedNumeric<Dst>(DstLimits::lowest()) * 2);
+  TEST_EXPECTED_VALUE(0, ClampedNumeric<Dst>(1) / 2);
+  TEST_EXPECTED_VALUE(0,
+                      ClampedNumeric<Dst>(DstLimits::lowest()).UnsignedAbs());
+  TEST_EXPECTED_VALUE(
+      as_unsigned(
+          std::numeric_limits<typename std::make_signed<Dst>::type>::lowest()),
+      ClampedNumeric<typename std::make_signed<Dst>::type>(
+          std::numeric_limits<typename std::make_signed<Dst>::type>::lowest())
+          .UnsignedAbs());
+  TEST_EXPECTED_VALUE(DstLimits::lowest(),
+                      MakeClampedNum(DstLimits::lowest()).UnsignedAbs());
+  TEST_EXPECTED_VALUE(DstLimits::max(),
+                      MakeClampedNum(DstLimits::max()).UnsignedAbs());
+  TEST_EXPECTED_VALUE(0, ClampedNumeric<Dst>(0).UnsignedAbs());
+  TEST_EXPECTED_VALUE(1, ClampedNumeric<Dst>(1).UnsignedAbs());
+
   // Modulus is legal only for integers.
   TEST_EXPECTED_VALUE(0, CheckedNumeric<Dst>() % 1);
   TEST_EXPECTED_VALUE(0, CheckedNumeric<Dst>(1) % 1);
   TEST_EXPECTED_VALUE(1, CheckedNumeric<Dst>(1) % 2);
   TEST_EXPECTED_VALUE(0, CheckedNumeric<Dst>(DstLimits::lowest()) % 2);
   TEST_EXPECTED_VALUE(1, CheckedNumeric<Dst>(DstLimits::max()) % 2);
   // Test all the different modulus combinations.
   TEST_EXPECTED_VALUE(0, CheckedNumeric<Dst>(1) % CheckedNumeric<Dst>(1));
   TEST_EXPECTED_VALUE(0, 1 % CheckedNumeric<Dst>(1));
   TEST_EXPECTED_VALUE(0, CheckedNumeric<Dst>(1) % 1);
   CheckedNumeric<Dst> checked_dst = 1;
   TEST_EXPECTED_VALUE(0, checked_dst %= 1);
   // Test that div by 0 is avoided but returns invalid result.
   TEST_EXPECTED_FAILURE(CheckedNumeric<Dst>(1) % 0);
   TEST_EXPECTED_FAILURE(CheckedNumeric<Dst>(1)
                         << IntegerBitsPlusSign<Dst>::value);
   // Test bit shifts.
   volatile int negative_one = -1;
   TEST_EXPECTED_FAILURE(CheckedNumeric<Dst>(1) << negative_one);
   TEST_EXPECTED_FAILURE(CheckedNumeric<Dst>(1)
                         << IntegerBitsPlusSign<Dst>::value);
-  TEST_EXPECTED_FAILURE(CheckedNumeric<Dst>(0)
-                        << IntegerBitsPlusSign<Dst>::value);
+  TEST_EXPECTED_VALUE(Dst(0), CheckedNumeric<Dst>(0)
+                                  << IntegerBitsPlusSign<Dst>::value);
   TEST_EXPECTED_FAILURE(CheckedNumeric<Dst>(DstLimits::max()) << 1);
   TEST_EXPECTED_VALUE(
       static_cast<Dst>(1) << (IntegerBitsPlusSign<Dst>::value - 1),
       CheckedNumeric<Dst>(1) << (IntegerBitsPlusSign<Dst>::value - 1));
   TEST_EXPECTED_VALUE(1, CheckedNumeric<Dst>(1) << 0);
   TEST_EXPECTED_VALUE(2, CheckedNumeric<Dst>(1) << 1);
   TEST_EXPECTED_FAILURE(CheckedNumeric<Dst>(1) >>
                         IntegerBitsPlusSign<Dst>::value);
   TEST_EXPECTED_VALUE(
       0, CheckedNumeric<Dst>(1) >> (IntegerBitsPlusSign<Dst>::value - 1));
@@ skipping 11 matching lines @@
   TEST_EXPECTED_VALUE(std::numeric_limits<Dst>::max(),
                       CheckedNumeric<Dst>(0) | static_cast<Dst>(-1));
   TEST_EXPECTED_VALUE(0, CheckedNumeric<Dst>(1) ^ 1);
   TEST_EXPECTED_VALUE(1, CheckedNumeric<Dst>(1) ^ 0);
   TEST_EXPECTED_VALUE(1, CheckedNumeric<Dst>(0) ^ 1);
   TEST_EXPECTED_VALUE(0, CheckedNumeric<Dst>(0) ^ 0);
   TEST_EXPECTED_VALUE(std::numeric_limits<Dst>::max(),
                       CheckedNumeric<Dst>(0) ^ static_cast<Dst>(-1));
   TEST_EXPECTED_VALUE(DstLimits::max(), ~CheckedNumeric<Dst>(0));
 
+  // Modulus is legal only for integers.
+  TEST_EXPECTED_VALUE(0, ClampedNumeric<Dst>() % 1);
+  TEST_EXPECTED_VALUE(0, ClampedNumeric<Dst>(1) % 1);
+  TEST_EXPECTED_VALUE(1, ClampedNumeric<Dst>(1) % 2);
+  TEST_EXPECTED_VALUE(0, ClampedNumeric<Dst>(DstLimits::lowest()) % 2);
+  TEST_EXPECTED_VALUE(1, ClampedNumeric<Dst>(DstLimits::max()) % 2);
+  // Test all the different modulus combinations.
+  TEST_EXPECTED_VALUE(0, ClampedNumeric<Dst>(1) % ClampedNumeric<Dst>(1));
+  TEST_EXPECTED_VALUE(0, 1 % ClampedNumeric<Dst>(1));
+  TEST_EXPECTED_VALUE(0, ClampedNumeric<Dst>(1) % 1);
+  ClampedNumeric<Dst> clamped_dst = 1;
+  TEST_EXPECTED_VALUE(0, clamped_dst %= 1);
+  // Test that div by 0 is avoided but returns invalid result.
+  TEST_EXPECTED_VALUE(Dst(1), ClampedNumeric<Dst>(1) % 0);
+  TEST_EXPECTED_VALUE(DstLimits::Overflow(),
+                      ClampedNumeric<Dst>(1)
+                          << as_unsigned(IntegerBitsPlusSign<Dst>::value));
+  // Test bit shifts.
+  TEST_EXPECTED_VALUE(DstLimits::Overflow(),
+                      ClampedNumeric<Dst>(1)
+                          << as_unsigned(IntegerBitsPlusSign<Dst>::value));
+  TEST_EXPECTED_VALUE(Dst(0), ClampedNumeric<Dst>(0) << as_unsigned(
+                                  IntegerBitsPlusSign<Dst>::value));
+  TEST_EXPECTED_VALUE(DstLimits::Overflow(),
+                      ClampedNumeric<Dst>(DstLimits::max()) << 1U);
+  TEST_EXPECTED_VALUE(
+      static_cast<Dst>(1) << (IntegerBitsPlusSign<Dst>::value - 1U),
+      ClampedNumeric<Dst>(1) << (IntegerBitsPlusSign<Dst>::value - 1U));
+  TEST_EXPECTED_VALUE(1, ClampedNumeric<Dst>(1) << 0U);
+  TEST_EXPECTED_VALUE(2, ClampedNumeric<Dst>(1) << 1U);
+  TEST_EXPECTED_VALUE(0, ClampedNumeric<Dst>(1) >>
+                             as_unsigned(IntegerBitsPlusSign<Dst>::value));
+  TEST_EXPECTED_VALUE(
+      0, ClampedNumeric<Dst>(1) >> (IntegerBitsPlusSign<Dst>::value - 1U));
+  TEST_EXPECTED_VALUE(1, ClampedNumeric<Dst>(1) & 1);
+  TEST_EXPECTED_VALUE(0, ClampedNumeric<Dst>(1) & 0);
+  TEST_EXPECTED_VALUE(0, ClampedNumeric<Dst>(0) & 1);
+  TEST_EXPECTED_VALUE(0, ClampedNumeric<Dst>(1) & 0);
+  TEST_EXPECTED_VALUE(std::numeric_limits<Dst>::max(),
+                      MakeCheckedNum(DstLimits::max()) & -1);
+  TEST_EXPECTED_VALUE(1, ClampedNumeric<Dst>(1) | 1);
+  TEST_EXPECTED_VALUE(1, ClampedNumeric<Dst>(1) | 0);
+  TEST_EXPECTED_VALUE(1, ClampedNumeric<Dst>(0) | 1);
+  TEST_EXPECTED_VALUE(0, ClampedNumeric<Dst>(0) | 0);
+  TEST_EXPECTED_VALUE(std::numeric_limits<Dst>::max(),
+                      ClampedNumeric<Dst>(0) | static_cast<Dst>(-1));
+  TEST_EXPECTED_VALUE(0, ClampedNumeric<Dst>(1) ^ 1);
+  TEST_EXPECTED_VALUE(1, ClampedNumeric<Dst>(1) ^ 0);
+  TEST_EXPECTED_VALUE(1, ClampedNumeric<Dst>(0) ^ 1);
+  TEST_EXPECTED_VALUE(0, ClampedNumeric<Dst>(0) ^ 0);
+  TEST_EXPECTED_VALUE(std::numeric_limits<Dst>::max(),
+                      ClampedNumeric<Dst>(0) ^ static_cast<Dst>(-1));
+  TEST_EXPECTED_VALUE(DstLimits::max(), ~ClampedNumeric<Dst>(0));
+
   TestStrictPointerMath<Dst>();
 }
 
 // Floating point arithmetic.
 template <typename Dst>
 void TestSpecializedArithmetic(
     const char* dst,
     int line,
     typename std::enable_if<numeric_limits<Dst>::is_iec559, int>::type = 0) {
-  using DstLimits = numeric_limits<Dst>;
+  using DstLimits = SaturationDefaultLimits<Dst>;
   TEST_EXPECTED_SUCCESS(-CheckedNumeric<Dst>(DstLimits::lowest()));
 
   TEST_EXPECTED_SUCCESS(CheckedNumeric<Dst>(DstLimits::lowest()).Abs());
   TEST_EXPECTED_VALUE(1, CheckedNumeric<Dst>(-1).Abs());
 
   TEST_EXPECTED_SUCCESS(CheckedNumeric<Dst>(DstLimits::lowest()) + -1);
   TEST_EXPECTED_SUCCESS(CheckedNumeric<Dst>(DstLimits::max()) + 1);
   TEST_EXPECTED_FAILURE(CheckedNumeric<Dst>(DstLimits::lowest()) +
                         DstLimits::lowest());
 
   TEST_EXPECTED_FAILURE(CheckedNumeric<Dst>(DstLimits::max()) -
                         DstLimits::lowest());
   TEST_EXPECTED_FAILURE(CheckedNumeric<Dst>(DstLimits::lowest()) -
                         DstLimits::max());
 
   TEST_EXPECTED_FAILURE(CheckedNumeric<Dst>(DstLimits::lowest()) * 2);
 
   TEST_EXPECTED_VALUE(-0.5, CheckedNumeric<Dst>(-1.0) / 2);
+
+  TEST_EXPECTED_VALUE(DstLimits::max(),
+                      -ClampedNumeric<Dst>(DstLimits::lowest()));
+
+  TEST_EXPECTED_VALUE(DstLimits::max(),
+                      ClampedNumeric<Dst>(DstLimits::lowest()).Abs());
+  TEST_EXPECTED_VALUE(1, ClampedNumeric<Dst>(-1).Abs());
+
+  TEST_EXPECTED_VALUE(DstLimits::lowest() - 1,
+                      ClampedNumeric<Dst>(DstLimits::lowest()) + -1);
+  TEST_EXPECTED_VALUE(DstLimits::max() + 1,
+                      ClampedNumeric<Dst>(DstLimits::max()) + 1);
+  TEST_EXPECTED_VALUE(
+      DstLimits::Underflow(),
+      ClampedNumeric<Dst>(DstLimits::lowest()) + DstLimits::lowest());
+
+  TEST_EXPECTED_VALUE(
+      DstLimits::Overflow(),
+      ClampedNumeric<Dst>(DstLimits::max()) - DstLimits::lowest());
+  TEST_EXPECTED_VALUE(
+      DstLimits::Underflow(),
+      ClampedNumeric<Dst>(DstLimits::lowest()) - DstLimits::max());
+
+  TEST_EXPECTED_VALUE(DstLimits::Underflow(),
+                      ClampedNumeric<Dst>(DstLimits::lowest()) * 2);
+
+  TEST_EXPECTED_VALUE(-0.5, ClampedNumeric<Dst>(-1.0) / 2);
 }
 
 // Generic arithmetic tests.
 template <typename Dst>
 static void TestArithmetic(const char* dst, int line) {
-  using DstLimits = numeric_limits<Dst>;
+  using DstLimits = SaturationDefaultLimits<Dst>;
 
   EXPECT_EQ(true, CheckedNumeric<Dst>().IsValid());
   EXPECT_EQ(false,
             CheckedNumeric<Dst>(CheckedNumeric<Dst>(DstLimits::max()) *
                                 DstLimits::max()).IsValid());
   EXPECT_EQ(static_cast<Dst>(0), CheckedNumeric<Dst>().ValueOrDie());
   EXPECT_EQ(static_cast<Dst>(0), CheckedNumeric<Dst>().ValueOrDefault(1));
   EXPECT_EQ(static_cast<Dst>(1),
             CheckedNumeric<Dst>(CheckedNumeric<Dst>(DstLimits::max()) *
                                 DstLimits::max()).ValueOrDefault(1));
@@ skipping 13 matching lines @@
   TEST_EXPECTED_VALUE(1, CheckedNumeric<Dst>(1) / 1);
   CheckedNumeric<Dst> checked_dst = 1;
   TEST_EXPECTED_VALUE(2, checked_dst += 1);
   checked_dst = 1;
   TEST_EXPECTED_VALUE(0, checked_dst -= 1);
   checked_dst = 1;
   TEST_EXPECTED_VALUE(1, checked_dst *= 1);
   checked_dst = 1;
   TEST_EXPECTED_VALUE(1, checked_dst /= 1);
 
+  TEST_EXPECTED_VALUE(2, ClampedNumeric<Dst>(1) + ClampedNumeric<Dst>(1));
+  TEST_EXPECTED_VALUE(0, ClampedNumeric<Dst>(1) - ClampedNumeric<Dst>(1));
+  TEST_EXPECTED_VALUE(1, ClampedNumeric<Dst>(1) * ClampedNumeric<Dst>(1));
+  TEST_EXPECTED_VALUE(1, ClampedNumeric<Dst>(1) / ClampedNumeric<Dst>(1));
+  TEST_EXPECTED_VALUE(2, 1 + ClampedNumeric<Dst>(1));
+  TEST_EXPECTED_VALUE(0, 1 - ClampedNumeric<Dst>(1));
+  TEST_EXPECTED_VALUE(1, 1 * ClampedNumeric<Dst>(1));
+  TEST_EXPECTED_VALUE(1, 1 / ClampedNumeric<Dst>(1));
+  TEST_EXPECTED_VALUE(2, ClampedNumeric<Dst>(1) + 1);
+  TEST_EXPECTED_VALUE(0, ClampedNumeric<Dst>(1) - 1);
+  TEST_EXPECTED_VALUE(1, ClampedNumeric<Dst>(1) * 1);
+  TEST_EXPECTED_VALUE(1, ClampedNumeric<Dst>(1) / 1);
+  ClampedNumeric<Dst> clamped_dst = 1;
+  TEST_EXPECTED_VALUE(2, clamped_dst += 1);
+  clamped_dst = 1;
+  TEST_EXPECTED_VALUE(0, clamped_dst -= 1);
+  clamped_dst = 1;
+  TEST_EXPECTED_VALUE(1, clamped_dst *= 1);
+  clamped_dst = 1;
+  TEST_EXPECTED_VALUE(1, clamped_dst /= 1);
+
   // Generic negation.
   if (DstLimits::is_signed) {
     TEST_EXPECTED_VALUE(0, -CheckedNumeric<Dst>());
     TEST_EXPECTED_VALUE(-1, -CheckedNumeric<Dst>(1));
     TEST_EXPECTED_VALUE(1, -CheckedNumeric<Dst>(-1));
     TEST_EXPECTED_VALUE(static_cast<Dst>(DstLimits::max() * -1),
                         -CheckedNumeric<Dst>(DstLimits::max()));
+
+    TEST_EXPECTED_VALUE(0, -ClampedNumeric<Dst>());
+    TEST_EXPECTED_VALUE(-1, -ClampedNumeric<Dst>(1));
+    TEST_EXPECTED_VALUE(1, -ClampedNumeric<Dst>(-1));
+    TEST_EXPECTED_VALUE(static_cast<Dst>(DstLimits::max() * -1),
+                        -ClampedNumeric<Dst>(DstLimits::max()));
   }
 
   // Generic absolute value.
   TEST_EXPECTED_VALUE(0, CheckedNumeric<Dst>().Abs());
   TEST_EXPECTED_VALUE(1, CheckedNumeric<Dst>(1).Abs());
   TEST_EXPECTED_VALUE(DstLimits::max(),
                       CheckedNumeric<Dst>(DstLimits::max()).Abs());
 
+  TEST_EXPECTED_VALUE(0, ClampedNumeric<Dst>().Abs());
+  TEST_EXPECTED_VALUE(1, ClampedNumeric<Dst>(1).Abs());
+  TEST_EXPECTED_VALUE(DstLimits::max(),
+                      ClampedNumeric<Dst>(DstLimits::max()).Abs());
+
   // Generic addition.
   TEST_EXPECTED_VALUE(1, (CheckedNumeric<Dst>() + 1));
   TEST_EXPECTED_VALUE(2, (CheckedNumeric<Dst>(1) + 1));
   if (numeric_limits<Dst>::is_signed)
     TEST_EXPECTED_VALUE(0, (CheckedNumeric<Dst>(-1) + 1));
   TEST_EXPECTED_SUCCESS(CheckedNumeric<Dst>(DstLimits::lowest()) + 1);
   TEST_EXPECTED_FAILURE(CheckedNumeric<Dst>(DstLimits::max()) +
                         DstLimits::max());
 
+  TEST_EXPECTED_VALUE(1, (ClampedNumeric<Dst>() + 1));
+  TEST_EXPECTED_VALUE(2, (ClampedNumeric<Dst>(1) + 1));
+  if (numeric_limits<Dst>::is_signed)
+    TEST_EXPECTED_VALUE(0, (ClampedNumeric<Dst>(-1) + 1));
+  TEST_EXPECTED_VALUE(DstLimits::lowest() + 1,
+                      ClampedNumeric<Dst>(DstLimits::lowest()) + 1);
+  TEST_EXPECTED_VALUE(DstLimits::Overflow(),
+                      ClampedNumeric<Dst>(DstLimits::max()) + DstLimits::max());
+
   // Generic subtraction.
   TEST_EXPECTED_VALUE(0, (CheckedNumeric<Dst>(1) - 1));
   TEST_EXPECTED_SUCCESS(CheckedNumeric<Dst>(DstLimits::max()) - 1);
   if (numeric_limits<Dst>::is_signed) {
     TEST_EXPECTED_VALUE(-1, (CheckedNumeric<Dst>() - 1));
     TEST_EXPECTED_VALUE(-2, (CheckedNumeric<Dst>(-1) - 1));
   } else {
     TEST_EXPECTED_FAILURE(CheckedNumeric<Dst>(DstLimits::max()) - -1);
   }
 
+  TEST_EXPECTED_VALUE(0, (ClampedNumeric<Dst>(1) - 1));
+  TEST_EXPECTED_VALUE(DstLimits::max() - 1,
+                      ClampedNumeric<Dst>(DstLimits::max()) - 1);
+  if (numeric_limits<Dst>::is_signed) {
+    TEST_EXPECTED_VALUE(-1, (ClampedNumeric<Dst>() - 1));
+    TEST_EXPECTED_VALUE(-2, (ClampedNumeric<Dst>(-1) - 1));
+  } else {
+    TEST_EXPECTED_VALUE(DstLimits::max(),
+                        ClampedNumeric<Dst>(DstLimits::max()) - -1);
+  }
+
   // Generic multiplication.
   TEST_EXPECTED_VALUE(0, (CheckedNumeric<Dst>() * 1));
   TEST_EXPECTED_VALUE(1, (CheckedNumeric<Dst>(1) * 1));
   TEST_EXPECTED_VALUE(0, (CheckedNumeric<Dst>(0) * 0));
   if (numeric_limits<Dst>::is_signed) {
     TEST_EXPECTED_VALUE(0, (CheckedNumeric<Dst>(-1) * 0));
     TEST_EXPECTED_VALUE(0, (CheckedNumeric<Dst>(0) * -1));
     TEST_EXPECTED_VALUE(-2, (CheckedNumeric<Dst>(-1) * 2));
   } else {
     TEST_EXPECTED_FAILURE(CheckedNumeric<Dst>(DstLimits::max()) * -2);
     TEST_EXPECTED_FAILURE(CheckedNumeric<Dst>(DstLimits::max()) *
                           CheckedNumeric<uintmax_t>(-2));
   }
   TEST_EXPECTED_FAILURE(CheckedNumeric<Dst>(DstLimits::max()) *
                         DstLimits::max());
 
+  TEST_EXPECTED_VALUE(0, (ClampedNumeric<Dst>() * 1));
+  TEST_EXPECTED_VALUE(1, (ClampedNumeric<Dst>(1) * 1));
+  TEST_EXPECTED_VALUE(0, (ClampedNumeric<Dst>(0) * 0));
+  if (numeric_limits<Dst>::is_signed) {
+    TEST_EXPECTED_VALUE(0, (ClampedNumeric<Dst>(-1) * 0));
+    TEST_EXPECTED_VALUE(0, (ClampedNumeric<Dst>(0) * -1));
+    TEST_EXPECTED_VALUE(-2, (ClampedNumeric<Dst>(-1) * 2));
+  } else {
+    TEST_EXPECTED_VALUE(DstLimits::Underflow(),
+                        ClampedNumeric<Dst>(DstLimits::max()) * -2);
+    TEST_EXPECTED_VALUE(0, ClampedNumeric<Dst>(DstLimits::max()) *
+                               ClampedNumeric<uintmax_t>(-2));
+  }
+  TEST_EXPECTED_VALUE(DstLimits::Overflow(),
+                      ClampedNumeric<Dst>(DstLimits::max()) * DstLimits::max());
+
   // Generic division.
   TEST_EXPECTED_VALUE(0, CheckedNumeric<Dst>() / 1);
   TEST_EXPECTED_VALUE(1, CheckedNumeric<Dst>(1) / 1);
   TEST_EXPECTED_VALUE(DstLimits::lowest() / 2,
                       CheckedNumeric<Dst>(DstLimits::lowest()) / 2);
   TEST_EXPECTED_VALUE(DstLimits::max() / 2,
                       CheckedNumeric<Dst>(DstLimits::max()) / 2);
 
+  TEST_EXPECTED_VALUE(0, ClampedNumeric<Dst>() / 1);
+  TEST_EXPECTED_VALUE(1, ClampedNumeric<Dst>(1) / 1);
+  TEST_EXPECTED_VALUE(DstLimits::lowest() / 2,
+                      ClampedNumeric<Dst>(DstLimits::lowest()) / 2);
+  TEST_EXPECTED_VALUE(DstLimits::max() / 2,
+                      ClampedNumeric<Dst>(DstLimits::max()) / 2);
+
   TestSpecializedArithmetic<Dst>(dst, line);
 }
 
 // Helper macro to wrap displaying the conversion types and line numbers.
 #define TEST_ARITHMETIC(Dst) TestArithmetic<Dst>(#Dst, __LINE__)
 
 TEST(SafeNumerics, SignedIntegerMath) {
   TEST_ARITHMETIC(int8_t);
   TEST_ARITHMETIC(int);
   TEST_ARITHMETIC(intptr_t);
@@ skipping 110 matching lines @@
                                           DstLimits::max(), SrcLimits::lowest())
                                      .ValueOrDie());
   EXPECT_EQ(DstLimits::max(), CheckMax(MakeStrictNum(1), MakeCheckedNum(0),
                                        DstLimits::max(), SrcLimits::lowest())
                                   .ValueOrDie());
 }
 
 template <typename Dst, typename Src>
 struct TestNumericConversion<Dst, Src, SIGN_PRESERVING_VALUE_PRESERVING> {
   static void Test(const char *dst, const char *src, int line) {
-    using SrcLimits = numeric_limits<Src>;
-    using DstLimits = numeric_limits<Dst>;
+    using SrcLimits = SaturationDefaultLimits<Src>;
+    using DstLimits = SaturationDefaultLimits<Dst>;
     // Integral to floating.
     static_assert((DstLimits::is_iec559 && SrcLimits::is_integer) ||
                       // Not floating to integral and...
                       (!(DstLimits::is_integer && SrcLimits::is_iec559) &&
                        // Same sign, same numeric, source is narrower or same.
                        ((SrcLimits::is_signed == DstLimits::is_signed &&
                          MaxExponent<Dst>::value >= MaxExponent<Src>::value) ||
                         // Or signed destination and source is smaller
                         (DstLimits::is_signed &&
                          MaxExponent<Dst>::value >= MaxExponent<Src>::value))),
                   "Comparison must be sign preserving and value preserving");
 
     TestStrictComparison<Dst, Src>();
 
     const CheckedNumeric<Dst> checked_dst = SrcLimits::max();
+    const ClampedNumeric<Dst> clamped_dst = SrcLimits::max();
     TEST_EXPECTED_SUCCESS(checked_dst);
+    TEST_EXPECTED_VALUE(Dst(SrcLimits::max()), clamped_dst);
     if (MaxExponent<Dst>::value > MaxExponent<Src>::value) {
       if (MaxExponent<Dst>::value >= MaxExponent<Src>::value * 2 - 1) {
         // At least twice larger type.
         TEST_EXPECTED_SUCCESS(SrcLimits::max() * checked_dst);
-
+        TEST_EXPECTED_VALUE(SrcLimits::max() * clamped_dst,
+                            Dst(SrcLimits::max()) * SrcLimits::max());
       } else {  // Larger, but not at least twice as large.
         TEST_EXPECTED_FAILURE(SrcLimits::max() * checked_dst);
         TEST_EXPECTED_SUCCESS(checked_dst + 1);
+        TEST_EXPECTED_VALUE(DstLimits::Overflow(),
+                            SrcLimits::max() * clamped_dst);
+        TEST_EXPECTED_VALUE(Dst(SrcLimits::max()) + Dst(1),
+                            clamped_dst + Dst(1));
       }
     } else {  // Same width type.
       TEST_EXPECTED_FAILURE(checked_dst + 1);
+      TEST_EXPECTED_VALUE(DstLimits::Overflow(), clamped_dst + Dst(1));
     }
 
     TEST_EXPECTED_RANGE(RANGE_VALID, SrcLimits::max());
     TEST_EXPECTED_RANGE(RANGE_VALID, static_cast<Src>(1));
     if (SrcLimits::is_iec559) {
       TEST_EXPECTED_RANGE(RANGE_VALID, SrcLimits::max() * static_cast<Src>(-1));
       TEST_EXPECTED_RANGE(RANGE_OVERFLOW, SrcLimits::infinity());
       TEST_EXPECTED_RANGE(RANGE_UNDERFLOW, SrcLimits::infinity() * -1);
       TEST_EXPECTED_RANGE(RANGE_INVALID, SrcLimits::quiet_NaN());
     } else if (numeric_limits<Src>::is_signed) {
       TEST_EXPECTED_RANGE(RANGE_VALID, static_cast<Src>(-1));
       TEST_EXPECTED_RANGE(RANGE_VALID, SrcLimits::lowest());
     }
   }
 };
 
 template <typename Dst, typename Src>
 struct TestNumericConversion<Dst, Src, SIGN_PRESERVING_NARROW> {
   static void Test(const char *dst, const char *src, int line) {
-    using SrcLimits = numeric_limits<Src>;
-    using DstLimits = numeric_limits<Dst>;
+    using SrcLimits = SaturationDefaultLimits<Src>;
+    using DstLimits = SaturationDefaultLimits<Dst>;
     static_assert(SrcLimits::is_signed == DstLimits::is_signed,
                   "Destination and source sign must be the same");
     static_assert(MaxExponent<Dst>::value <= MaxExponent<Src>::value,
                   "Destination must be narrower than source");
 
     TestStrictComparison<Dst, Src>();
 
     const CheckedNumeric<Dst> checked_dst;
     TEST_EXPECTED_FAILURE(checked_dst + SrcLimits::max());
-    TEST_EXPECTED_VALUE(1, checked_dst + static_cast<Src>(1));
+    TEST_EXPECTED_VALUE(1, checked_dst + Src(1));
     TEST_EXPECTED_FAILURE(checked_dst - SrcLimits::max());
 
+    const ClampedNumeric<Dst> clamped_dst;
+    TEST_EXPECTED_VALUE(DstLimits::Overflow(), clamped_dst + SrcLimits::max());
+    TEST_EXPECTED_VALUE(1, clamped_dst + Src(1));
+    TEST_EXPECTED_VALUE(DstLimits::Underflow(), clamped_dst - SrcLimits::max());
+
     TEST_EXPECTED_RANGE(RANGE_OVERFLOW, SrcLimits::max());
     TEST_EXPECTED_RANGE(RANGE_VALID, static_cast<Src>(1));
     if (SrcLimits::is_iec559) {
       TEST_EXPECTED_RANGE(RANGE_UNDERFLOW, SrcLimits::max() * -1);
       TEST_EXPECTED_RANGE(RANGE_VALID, static_cast<Src>(-1));
       TEST_EXPECTED_RANGE(RANGE_OVERFLOW, SrcLimits::infinity());
       TEST_EXPECTED_RANGE(RANGE_UNDERFLOW, SrcLimits::infinity() * -1);
       TEST_EXPECTED_RANGE(RANGE_INVALID, SrcLimits::quiet_NaN());
       if (DstLimits::is_integer) {
         if (SrcLimits::digits < DstLimits::digits) {
           TEST_EXPECTED_RANGE(RANGE_OVERFLOW,
                               static_cast<Src>(DstLimits::max()));
         } else {
           TEST_EXPECTED_RANGE(RANGE_VALID, static_cast<Src>(DstLimits::max()));
         }
         TEST_EXPECTED_RANGE(
             RANGE_VALID,
             static_cast<Src>(GetMaxConvertibleToFloat<Src, Dst>()));
         TEST_EXPECTED_RANGE(RANGE_VALID, static_cast<Src>(DstLimits::lowest()));
       }
     } else if (SrcLimits::is_signed) {
       TEST_EXPECTED_VALUE(-1, checked_dst - static_cast<Src>(1));
+      TEST_EXPECTED_VALUE(-1, clamped_dst - static_cast<Src>(1));
       TEST_EXPECTED_RANGE(RANGE_UNDERFLOW, SrcLimits::lowest());
       TEST_EXPECTED_RANGE(RANGE_VALID, static_cast<Src>(-1));
     } else {
       TEST_EXPECTED_FAILURE(checked_dst - static_cast<Src>(1));
+      TEST_EXPECTED_VALUE(Dst(0), clamped_dst - static_cast<Src>(1));
       TEST_EXPECTED_RANGE(RANGE_VALID, SrcLimits::lowest());
     }
   }
 };
 
 template <typename Dst, typename Src>
 struct TestNumericConversion<Dst, Src, SIGN_TO_UNSIGN_WIDEN_OR_EQUAL> {
   static void Test(const char *dst, const char *src, int line) {
-    using SrcLimits = numeric_limits<Src>;
-    using DstLimits = numeric_limits<Dst>;
+    using SrcLimits = SaturationDefaultLimits<Src>;
+    using DstLimits = SaturationDefaultLimits<Dst>;
     static_assert(MaxExponent<Dst>::value >= MaxExponent<Src>::value,
                   "Destination must be equal or wider than source.");
     static_assert(SrcLimits::is_signed, "Source must be signed");
     static_assert(!DstLimits::is_signed, "Destination must be unsigned");
 
     TestStrictComparison<Dst, Src>();
 
     const CheckedNumeric<Dst> checked_dst;
     TEST_EXPECTED_VALUE(SrcLimits::max(), checked_dst + SrcLimits::max());
     TEST_EXPECTED_FAILURE(checked_dst + static_cast<Src>(-1));
+    TEST_EXPECTED_SUCCESS(checked_dst * static_cast<Src>(-1));
     TEST_EXPECTED_FAILURE(checked_dst + SrcLimits::lowest());
 
+    const ClampedNumeric<Dst> clamped_dst;
+    TEST_EXPECTED_VALUE(SrcLimits::max(), clamped_dst + SrcLimits::max());
+    TEST_EXPECTED_VALUE(DstLimits::Underflow(),
+                        clamped_dst + static_cast<Src>(-1));
+    TEST_EXPECTED_VALUE(0, clamped_dst * static_cast<Src>(-1));
+    TEST_EXPECTED_VALUE(DstLimits::Underflow(),
+                        clamped_dst + SrcLimits::lowest());
+
     TEST_EXPECTED_RANGE(RANGE_UNDERFLOW, SrcLimits::lowest());
     TEST_EXPECTED_RANGE(RANGE_VALID, SrcLimits::max());
     TEST_EXPECTED_RANGE(RANGE_VALID, static_cast<Src>(1));
     TEST_EXPECTED_RANGE(RANGE_UNDERFLOW, static_cast<Src>(-1));
   }
 };
 
 template <typename Dst, typename Src>
 struct TestNumericConversion<Dst, Src, SIGN_TO_UNSIGN_NARROW> {
   static void Test(const char *dst, const char *src, int line) {
-    using SrcLimits = numeric_limits<Src>;
-    using DstLimits = numeric_limits<Dst>;
+    using SrcLimits = SaturationDefaultLimits<Src>;
+    using DstLimits = SaturationDefaultLimits<Dst>;
     static_assert(MaxExponent<Dst>::value < MaxExponent<Src>::value,
                   "Destination must be narrower than source.");
     static_assert(SrcLimits::is_signed, "Source must be signed.");
     static_assert(!DstLimits::is_signed, "Destination must be unsigned.");
 
     TestStrictComparison<Dst, Src>();
 
     const CheckedNumeric<Dst> checked_dst;
     TEST_EXPECTED_VALUE(1, checked_dst + static_cast<Src>(1));
     TEST_EXPECTED_FAILURE(checked_dst + SrcLimits::max());
     TEST_EXPECTED_FAILURE(checked_dst + static_cast<Src>(-1));
     TEST_EXPECTED_FAILURE(checked_dst + SrcLimits::lowest());
 
+    const ClampedNumeric<Dst> clamped_dst;
+    TEST_EXPECTED_VALUE(1, clamped_dst + static_cast<Src>(1));
+    TEST_EXPECTED_VALUE(DstLimits::Overflow(), clamped_dst + SrcLimits::max());
+    TEST_EXPECTED_VALUE(DstLimits::Underflow(),
+                        clamped_dst + static_cast<Src>(-1));
+    TEST_EXPECTED_VALUE(DstLimits::Underflow(),
+                        clamped_dst + SrcLimits::lowest());
+
     TEST_EXPECTED_RANGE(RANGE_OVERFLOW, SrcLimits::max());
     TEST_EXPECTED_RANGE(RANGE_VALID, static_cast<Src>(1));
     TEST_EXPECTED_RANGE(RANGE_UNDERFLOW, static_cast<Src>(-1));
 
     // Additional saturation tests.
-    EXPECT_EQ(DstLimits::max(), saturated_cast<Dst>(SrcLimits::max())) << src;
+    EXPECT_EQ(DstLimits::max(), saturated_cast<Dst>(SrcLimits::max()));
     EXPECT_EQ(DstLimits::lowest(), saturated_cast<Dst>(SrcLimits::lowest()));
 
     if (SrcLimits::is_iec559) {
       EXPECT_EQ(Dst(0), saturated_cast<Dst>(SrcLimits::quiet_NaN()));
 
       TEST_EXPECTED_RANGE(RANGE_UNDERFLOW, SrcLimits::max() * -1);
       TEST_EXPECTED_RANGE(RANGE_OVERFLOW, SrcLimits::infinity());
       TEST_EXPECTED_RANGE(RANGE_UNDERFLOW, SrcLimits::infinity() * -1);
       TEST_EXPECTED_RANGE(RANGE_INVALID, SrcLimits::quiet_NaN());
       if (DstLimits::is_integer) {
@@ skipping 10 matching lines @@
       }
     } else {
       TEST_EXPECTED_RANGE(RANGE_UNDERFLOW, SrcLimits::lowest());
     }
   }
 };
 
 template <typename Dst, typename Src>
 struct TestNumericConversion<Dst, Src, UNSIGN_TO_SIGN_NARROW_OR_EQUAL> {
   static void Test(const char *dst, const char *src, int line) {
-    using SrcLimits = numeric_limits<Src>;
-    using DstLimits = numeric_limits<Dst>;
+    using SrcLimits = SaturationDefaultLimits<Src>;
+    using DstLimits = SaturationDefaultLimits<Dst>;
     static_assert(MaxExponent<Dst>::value <= MaxExponent<Src>::value,
                   "Destination must be narrower or equal to source.");
     static_assert(!SrcLimits::is_signed, "Source must be unsigned.");
     static_assert(DstLimits::is_signed, "Destination must be signed.");
 
     TestStrictComparison<Dst, Src>();
 
     const CheckedNumeric<Dst> checked_dst;
     TEST_EXPECTED_VALUE(1, checked_dst + static_cast<Src>(1));
     TEST_EXPECTED_FAILURE(checked_dst + SrcLimits::max());
     TEST_EXPECTED_VALUE(SrcLimits::lowest(), checked_dst + SrcLimits::lowest());
 
+    const ClampedNumeric<Dst> clamped_dst;
+    TEST_EXPECTED_VALUE(1, clamped_dst + static_cast<Src>(1));
+    TEST_EXPECTED_VALUE(DstLimits::Overflow(), clamped_dst + SrcLimits::max());
+    TEST_EXPECTED_VALUE(SrcLimits::lowest(), clamped_dst + SrcLimits::lowest());
+
     TEST_EXPECTED_RANGE(RANGE_VALID, SrcLimits::lowest());
     TEST_EXPECTED_RANGE(RANGE_OVERFLOW, SrcLimits::max());
     TEST_EXPECTED_RANGE(RANGE_VALID, static_cast<Src>(1));
 
     // Additional saturation tests.
     EXPECT_EQ(DstLimits::max(), saturated_cast<Dst>(SrcLimits::max()));
     EXPECT_EQ(Dst(0), saturated_cast<Dst>(SrcLimits::lowest()));
   }
 };
 
@@ skipping 357 matching lines @@
   EXPECT_TRUE(too_large.IsValid());
   too_large += d;
   EXPECT_FALSE(too_large.IsValid());
   too_large -= d;
   EXPECT_FALSE(too_large.IsValid());
   too_large /= d;
   EXPECT_FALSE(too_large.IsValid());
 }
 
 TEST(SafeNumerics, VariadicNumericOperations) {
-  auto a = CheckAdd(1, 2UL, MakeCheckedNum(3LL), 4).ValueOrDie();
-  EXPECT_EQ(static_cast<decltype(a)::type>(10), a);
-  auto b = CheckSub(MakeCheckedNum(20.0), 2UL, 4).ValueOrDie();
-  EXPECT_EQ(static_cast<decltype(b)::type>(14.0), b);
-  auto c = CheckMul(20.0, MakeCheckedNum(1), 5, 3UL).ValueOrDie();
-  EXPECT_EQ(static_cast<decltype(c)::type>(300.0), c);
-  auto d = CheckDiv(20.0, 2.0, MakeCheckedNum(5LL), -4).ValueOrDie();
-  EXPECT_EQ(static_cast<decltype(d)::type>(-.5), d);
-  auto e = CheckMod(MakeCheckedNum(20), 3).ValueOrDie();
-  EXPECT_EQ(static_cast<decltype(e)::type>(2), e);
-  auto f = CheckLsh(1, MakeCheckedNum(2)).ValueOrDie();
-  EXPECT_EQ(static_cast<decltype(f)::type>(4), f);
-  auto g = CheckRsh(4, MakeCheckedNum(2)).ValueOrDie();
-  EXPECT_EQ(static_cast<decltype(g)::type>(1), g);
-  auto h = CheckRsh(CheckAdd(1, 1, 1, 1), CheckSub(4, 2)).ValueOrDie();
-  EXPECT_EQ(static_cast<decltype(h)::type>(1), h);
+  {  // Synthetic scope to avoid variable naming collisions.
+    auto a = CheckAdd(1, 2UL, MakeCheckedNum(3LL), 4).ValueOrDie();
+    EXPECT_EQ(static_cast<decltype(a)::type>(10), a);
+    auto b = CheckSub(MakeCheckedNum(20.0), 2UL, 4).ValueOrDie();
+    EXPECT_EQ(static_cast<decltype(b)::type>(14.0), b);
+    auto c = CheckMul(20.0, MakeCheckedNum(1), 5, 3UL).ValueOrDie();
+    EXPECT_EQ(static_cast<decltype(c)::type>(300.0), c);
+    auto d = CheckDiv(20.0, 2.0, MakeCheckedNum(5LL), -4).ValueOrDie();
+    EXPECT_EQ(static_cast<decltype(d)::type>(-.5), d);
+    auto e = CheckMod(MakeCheckedNum(20), 3).ValueOrDie();
+    EXPECT_EQ(static_cast<decltype(e)::type>(2), e);
+    auto f = CheckLsh(1, MakeCheckedNum(2)).ValueOrDie();
+    EXPECT_EQ(static_cast<decltype(f)::type>(4), f);
+    auto g = CheckRsh(4, MakeCheckedNum(2)).ValueOrDie();
+    EXPECT_EQ(static_cast<decltype(g)::type>(1), g);
+    auto h = CheckRsh(CheckAdd(1, 1, 1, 1), CheckSub(4, 2)).ValueOrDie();
+    EXPECT_EQ(static_cast<decltype(h)::type>(1), h);
+  }
+
+  {
+    auto a = ClampAdd(1, 2UL, MakeClampedNum(3LL), 4);
+    EXPECT_EQ(static_cast<decltype(a)::type>(10), a);
+    auto b = ClampSub(MakeClampedNum(20.0), 2UL, 4);
+    EXPECT_EQ(static_cast<decltype(b)::type>(14.0), b);
+    auto c = ClampMul(20.0, MakeClampedNum(1), 5, 3UL);
+    EXPECT_EQ(static_cast<decltype(c)::type>(300.0), c);
+    auto d = ClampDiv(20.0, 2.0, MakeClampedNum(5LL), -4);
+    EXPECT_EQ(static_cast<decltype(d)::type>(-.5), d);
+    auto e = ClampMod(MakeClampedNum(20), 3);
+    EXPECT_EQ(static_cast<decltype(e)::type>(2), e);
+    auto f = ClampLsh(1, MakeClampedNum(2U));

[dcheng, 2017/06/28 07:25:06]

How come this needs an explicit U while the checked num version doesn't?

[jschuh, 2017/06/28 12:32:38]

Conscious API decision. Negative shift is always wrong, but for maximum
flexibility the checked types can accept it and just treat it as an error.
Whereas I couldn't figure out what the saturated types should do (since they
can't throw an error) so I just require unsigned or trigger a compile error.

+    EXPECT_EQ(static_cast<decltype(f)::type>(4), f);
+    auto g = ClampRsh(4, MakeClampedNum(2U));
+    EXPECT_EQ(static_cast<decltype(g)::type>(1), g);
+    auto h = ClampRsh(ClampAdd(1, 1, 1, 1), ClampSub(4U, 2));
+    EXPECT_EQ(static_cast<decltype(h)::type>(1), h);
+  }
 }