jschuh@chromium.org | ecd4605 | 2014-01-16 15:57:25 +0900 | [diff] [blame] | 1 | // Copyright 2014 The Chromium Authors. All rights reserved. |
| 2 | // Use of this source code is governed by a BSD-style license that can be |
| 3 | // found in the LICENSE file. |
| 4 | |
danakj | 0393da3 | 2015-03-10 09:31:16 +0900 | [diff] [blame] | 5 | #ifndef BASE_NUMERICS_SAFE_CONVERSIONS_IMPL_H_ |
| 6 | #define BASE_NUMERICS_SAFE_CONVERSIONS_IMPL_H_ |
jschuh@chromium.org | ecd4605 | 2014-01-16 15:57:25 +0900 | [diff] [blame] | 7 | |
| 8 | #include <limits> |
| 9 | |
jschuh@chromium.org | 4fe236b | 2014-02-27 22:49:04 +0900 | [diff] [blame] | 10 | #include "base/template_util.h" |
jschuh@chromium.org | ecd4605 | 2014-01-16 15:57:25 +0900 | [diff] [blame] | 11 | |
| 12 | namespace base { |
| 13 | namespace internal { |
| 14 | |
jschuh@chromium.org | 4fe236b | 2014-02-27 22:49:04 +0900 | [diff] [blame] | 15 | // The std library doesn't provide a binary max_exponent for integers, however |
| 16 | // we can compute one by adding one to the number of non-sign bits. This allows |
| 17 | // for accurate range comparisons between floating point and integer types. |
| 18 | template <typename NumericType> |
| 19 | struct MaxExponent { |
| 20 | static const int value = std::numeric_limits<NumericType>::is_iec559 |
| 21 | ? std::numeric_limits<NumericType>::max_exponent |
| 22 | : (sizeof(NumericType) * 8 + 1 - |
| 23 | std::numeric_limits<NumericType>::is_signed); |
jschuh@chromium.org | ecd4605 | 2014-01-16 15:57:25 +0900 | [diff] [blame] | 24 | }; |
| 25 | |
jschuh@chromium.org | 4fe236b | 2014-02-27 22:49:04 +0900 | [diff] [blame] | 26 | enum IntegerRepresentation { |
| 27 | INTEGER_REPRESENTATION_UNSIGNED, |
| 28 | INTEGER_REPRESENTATION_SIGNED |
jschuh@chromium.org | ecd4605 | 2014-01-16 15:57:25 +0900 | [diff] [blame] | 29 | }; |
| 30 | |
jschuh@chromium.org | 4fe236b | 2014-02-27 22:49:04 +0900 | [diff] [blame] | 31 | // A range for a given nunmeric Src type is contained for a given numeric Dst |
| 32 | // type if both numeric_limits<Src>::max() <= numeric_limits<Dst>::max() and |
| 33 | // numeric_limits<Src>::min() >= numeric_limits<Dst>::min() are true. |
| 34 | // We implement this as template specializations rather than simple static |
| 35 | // comparisons to ensure type correctness in our comparisons. |
| 36 | enum NumericRangeRepresentation { |
| 37 | NUMERIC_RANGE_NOT_CONTAINED, |
| 38 | NUMERIC_RANGE_CONTAINED |
jschuh@chromium.org | ecd4605 | 2014-01-16 15:57:25 +0900 | [diff] [blame] | 39 | }; |
| 40 | |
| 41 | // Helper templates to statically determine if our destination type can contain |
jschuh@chromium.org | 4fe236b | 2014-02-27 22:49:04 +0900 | [diff] [blame] | 42 | // maximum and minimum values represented by the source type. |
jschuh@chromium.org | ecd4605 | 2014-01-16 15:57:25 +0900 | [diff] [blame] | 43 | |
jschuh@chromium.org | 4fe236b | 2014-02-27 22:49:04 +0900 | [diff] [blame] | 44 | template < |
| 45 | typename Dst, |
| 46 | typename Src, |
| 47 | IntegerRepresentation DstSign = std::numeric_limits<Dst>::is_signed |
| 48 | ? INTEGER_REPRESENTATION_SIGNED |
| 49 | : INTEGER_REPRESENTATION_UNSIGNED, |
| 50 | IntegerRepresentation SrcSign = |
| 51 | std::numeric_limits<Src>::is_signed |
| 52 | ? INTEGER_REPRESENTATION_SIGNED |
| 53 | : INTEGER_REPRESENTATION_UNSIGNED > |
| 54 | struct StaticDstRangeRelationToSrcRange; |
jschuh@chromium.org | ecd4605 | 2014-01-16 15:57:25 +0900 | [diff] [blame] | 55 | |
jschuh@chromium.org | 4fe236b | 2014-02-27 22:49:04 +0900 | [diff] [blame] | 56 | // Same sign: Dst is guaranteed to contain Src only if its range is equal or |
| 57 | // larger. |
| 58 | template <typename Dst, typename Src, IntegerRepresentation Sign> |
| 59 | struct StaticDstRangeRelationToSrcRange<Dst, Src, Sign, Sign> { |
| 60 | static const NumericRangeRepresentation value = |
| 61 | MaxExponent<Dst>::value >= MaxExponent<Src>::value |
| 62 | ? NUMERIC_RANGE_CONTAINED |
| 63 | : NUMERIC_RANGE_NOT_CONTAINED; |
| 64 | }; |
| 65 | |
| 66 | // Unsigned to signed: Dst is guaranteed to contain source only if its range is |
| 67 | // larger. |
jschuh@chromium.org | ecd4605 | 2014-01-16 15:57:25 +0900 | [diff] [blame] | 68 | template <typename Dst, typename Src> |
jschuh@chromium.org | 4fe236b | 2014-02-27 22:49:04 +0900 | [diff] [blame] | 69 | struct StaticDstRangeRelationToSrcRange<Dst, |
| 70 | Src, |
| 71 | INTEGER_REPRESENTATION_SIGNED, |
| 72 | INTEGER_REPRESENTATION_UNSIGNED> { |
| 73 | static const NumericRangeRepresentation value = |
| 74 | MaxExponent<Dst>::value > MaxExponent<Src>::value |
| 75 | ? NUMERIC_RANGE_CONTAINED |
| 76 | : NUMERIC_RANGE_NOT_CONTAINED; |
jschuh@chromium.org | ecd4605 | 2014-01-16 15:57:25 +0900 | [diff] [blame] | 77 | }; |
| 78 | |
jschuh@chromium.org | 4fe236b | 2014-02-27 22:49:04 +0900 | [diff] [blame] | 79 | // Signed to unsigned: Dst cannot be statically determined to contain Src. |
jschuh@chromium.org | ecd4605 | 2014-01-16 15:57:25 +0900 | [diff] [blame] | 80 | template <typename Dst, typename Src> |
jschuh@chromium.org | 4fe236b | 2014-02-27 22:49:04 +0900 | [diff] [blame] | 81 | struct StaticDstRangeRelationToSrcRange<Dst, |
| 82 | Src, |
| 83 | INTEGER_REPRESENTATION_UNSIGNED, |
| 84 | INTEGER_REPRESENTATION_SIGNED> { |
| 85 | static const NumericRangeRepresentation value = NUMERIC_RANGE_NOT_CONTAINED; |
jschuh@chromium.org | ecd4605 | 2014-01-16 15:57:25 +0900 | [diff] [blame] | 86 | }; |
| 87 | |
jschuh@chromium.org | 4fe236b | 2014-02-27 22:49:04 +0900 | [diff] [blame] | 88 | enum RangeConstraint { |
| 89 | RANGE_VALID = 0x0, // Value can be represented by the destination type. |
| 90 | RANGE_UNDERFLOW = 0x1, // Value would overflow. |
| 91 | RANGE_OVERFLOW = 0x2, // Value would underflow. |
| 92 | RANGE_INVALID = RANGE_UNDERFLOW | RANGE_OVERFLOW // Invalid (i.e. NaN). |
jschuh@chromium.org | ecd4605 | 2014-01-16 15:57:25 +0900 | [diff] [blame] | 93 | }; |
| 94 | |
jschuh@chromium.org | 4fe236b | 2014-02-27 22:49:04 +0900 | [diff] [blame] | 95 | // Helper function for coercing an int back to a RangeContraint. |
| 96 | inline RangeConstraint GetRangeConstraint(int integer_range_constraint) { |
| 97 | DCHECK(integer_range_constraint >= RANGE_VALID && |
| 98 | integer_range_constraint <= RANGE_INVALID); |
| 99 | return static_cast<RangeConstraint>(integer_range_constraint); |
| 100 | } |
jschuh@chromium.org | ecd4605 | 2014-01-16 15:57:25 +0900 | [diff] [blame] | 101 | |
jschuh@chromium.org | 4fe236b | 2014-02-27 22:49:04 +0900 | [diff] [blame] | 102 | // This function creates a RangeConstraint from an upper and lower bound |
jschuh@chromium.org | ecd4605 | 2014-01-16 15:57:25 +0900 | [diff] [blame] | 103 | // check by taking advantage of the fact that only NaN can be out of range in |
| 104 | // both directions at once. |
jschuh@chromium.org | 4fe236b | 2014-02-27 22:49:04 +0900 | [diff] [blame] | 105 | inline RangeConstraint GetRangeConstraint(bool is_in_upper_bound, |
| 106 | bool is_in_lower_bound) { |
| 107 | return GetRangeConstraint((is_in_upper_bound ? 0 : RANGE_OVERFLOW) | |
| 108 | (is_in_lower_bound ? 0 : RANGE_UNDERFLOW)); |
| 109 | } |
jschuh@chromium.org | ecd4605 | 2014-01-16 15:57:25 +0900 | [diff] [blame] | 110 | |
jschuh@chromium.org | 4fe236b | 2014-02-27 22:49:04 +0900 | [diff] [blame] | 111 | template < |
| 112 | typename Dst, |
| 113 | typename Src, |
| 114 | IntegerRepresentation DstSign = std::numeric_limits<Dst>::is_signed |
| 115 | ? INTEGER_REPRESENTATION_SIGNED |
| 116 | : INTEGER_REPRESENTATION_UNSIGNED, |
| 117 | IntegerRepresentation SrcSign = std::numeric_limits<Src>::is_signed |
| 118 | ? INTEGER_REPRESENTATION_SIGNED |
| 119 | : INTEGER_REPRESENTATION_UNSIGNED, |
| 120 | NumericRangeRepresentation DstRange = |
| 121 | StaticDstRangeRelationToSrcRange<Dst, Src>::value > |
| 122 | struct DstRangeRelationToSrcRangeImpl; |
jschuh@chromium.org | ecd4605 | 2014-01-16 15:57:25 +0900 | [diff] [blame] | 123 | |
| 124 | // The following templates are for ranges that must be verified at runtime. We |
| 125 | // split it into checks based on signedness to avoid confusing casts and |
| 126 | // compiler warnings on signed an unsigned comparisons. |
| 127 | |
jschuh@chromium.org | 4fe236b | 2014-02-27 22:49:04 +0900 | [diff] [blame] | 128 | // Dst range is statically determined to contain Src: Nothing to check. |
| 129 | template <typename Dst, |
| 130 | typename Src, |
| 131 | IntegerRepresentation DstSign, |
| 132 | IntegerRepresentation SrcSign> |
| 133 | struct DstRangeRelationToSrcRangeImpl<Dst, |
| 134 | Src, |
| 135 | DstSign, |
| 136 | SrcSign, |
| 137 | NUMERIC_RANGE_CONTAINED> { |
| 138 | static RangeConstraint Check(Src value) { return RANGE_VALID; } |
| 139 | }; |
| 140 | |
| 141 | // Signed to signed narrowing: Both the upper and lower boundaries may be |
| 142 | // exceeded. |
| 143 | template <typename Dst, typename Src> |
| 144 | struct DstRangeRelationToSrcRangeImpl<Dst, |
| 145 | Src, |
| 146 | INTEGER_REPRESENTATION_SIGNED, |
| 147 | INTEGER_REPRESENTATION_SIGNED, |
| 148 | NUMERIC_RANGE_NOT_CONTAINED> { |
| 149 | static RangeConstraint Check(Src value) { |
| 150 | return std::numeric_limits<Dst>::is_iec559 |
danakj | 5d945ad | 2015-06-06 03:15:10 +0900 | [diff] [blame] | 151 | ? GetRangeConstraint((value < std::numeric_limits<Dst>::max()), |
| 152 | (value > -std::numeric_limits<Dst>::max())) |
| 153 | : GetRangeConstraint((value < std::numeric_limits<Dst>::max()), |
| 154 | (value > std::numeric_limits<Dst>::min())); |
jschuh@chromium.org | ecd4605 | 2014-01-16 15:57:25 +0900 | [diff] [blame] | 155 | } |
| 156 | }; |
| 157 | |
jschuh@chromium.org | 4fe236b | 2014-02-27 22:49:04 +0900 | [diff] [blame] | 158 | // Unsigned to unsigned narrowing: Only the upper boundary can be exceeded. |
jschuh@chromium.org | ecd4605 | 2014-01-16 15:57:25 +0900 | [diff] [blame] | 159 | template <typename Dst, typename Src> |
jschuh@chromium.org | 4fe236b | 2014-02-27 22:49:04 +0900 | [diff] [blame] | 160 | struct DstRangeRelationToSrcRangeImpl<Dst, |
| 161 | Src, |
| 162 | INTEGER_REPRESENTATION_UNSIGNED, |
| 163 | INTEGER_REPRESENTATION_UNSIGNED, |
| 164 | NUMERIC_RANGE_NOT_CONTAINED> { |
| 165 | static RangeConstraint Check(Src value) { |
danakj | 5d945ad | 2015-06-06 03:15:10 +0900 | [diff] [blame] | 166 | return GetRangeConstraint(value < std::numeric_limits<Dst>::max(), true); |
jschuh@chromium.org | ecd4605 | 2014-01-16 15:57:25 +0900 | [diff] [blame] | 167 | } |
| 168 | }; |
| 169 | |
jschuh@chromium.org | 4fe236b | 2014-02-27 22:49:04 +0900 | [diff] [blame] | 170 | // Unsigned to signed: The upper boundary may be exceeded. |
jschuh@chromium.org | ecd4605 | 2014-01-16 15:57:25 +0900 | [diff] [blame] | 171 | template <typename Dst, typename Src> |
jschuh@chromium.org | 4fe236b | 2014-02-27 22:49:04 +0900 | [diff] [blame] | 172 | struct DstRangeRelationToSrcRangeImpl<Dst, |
| 173 | Src, |
| 174 | INTEGER_REPRESENTATION_SIGNED, |
| 175 | INTEGER_REPRESENTATION_UNSIGNED, |
| 176 | NUMERIC_RANGE_NOT_CONTAINED> { |
| 177 | static RangeConstraint Check(Src value) { |
| 178 | return sizeof(Dst) > sizeof(Src) |
| 179 | ? RANGE_VALID |
| 180 | : GetRangeConstraint( |
danakj | 5d945ad | 2015-06-06 03:15:10 +0900 | [diff] [blame] | 181 | value < static_cast<Src>(std::numeric_limits<Dst>::max()), |
jschuh@chromium.org | 4fe236b | 2014-02-27 22:49:04 +0900 | [diff] [blame] | 182 | true); |
jschuh@chromium.org | ecd4605 | 2014-01-16 15:57:25 +0900 | [diff] [blame] | 183 | } |
| 184 | }; |
| 185 | |
jschuh@chromium.org | 4fe236b | 2014-02-27 22:49:04 +0900 | [diff] [blame] | 186 | // Signed to unsigned: The upper boundary may be exceeded for a narrower Dst, |
| 187 | // and any negative value exceeds the lower boundary. |
jschuh@chromium.org | ecd4605 | 2014-01-16 15:57:25 +0900 | [diff] [blame] | 188 | template <typename Dst, typename Src> |
jschuh@chromium.org | 4fe236b | 2014-02-27 22:49:04 +0900 | [diff] [blame] | 189 | struct DstRangeRelationToSrcRangeImpl<Dst, |
| 190 | Src, |
| 191 | INTEGER_REPRESENTATION_UNSIGNED, |
| 192 | INTEGER_REPRESENTATION_SIGNED, |
| 193 | NUMERIC_RANGE_NOT_CONTAINED> { |
| 194 | static RangeConstraint Check(Src value) { |
| 195 | return (MaxExponent<Dst>::value >= MaxExponent<Src>::value) |
| 196 | ? GetRangeConstraint(true, value >= static_cast<Src>(0)) |
| 197 | : GetRangeConstraint( |
danakj | 5d945ad | 2015-06-06 03:15:10 +0900 | [diff] [blame] | 198 | value < static_cast<Src>(std::numeric_limits<Dst>::max()), |
jschuh@chromium.org | 4fe236b | 2014-02-27 22:49:04 +0900 | [diff] [blame] | 199 | value >= static_cast<Src>(0)); |
jschuh@chromium.org | ecd4605 | 2014-01-16 15:57:25 +0900 | [diff] [blame] | 200 | } |
| 201 | }; |
| 202 | |
| 203 | template <typename Dst, typename Src> |
jschuh@chromium.org | 4fe236b | 2014-02-27 22:49:04 +0900 | [diff] [blame] | 204 | inline RangeConstraint DstRangeRelationToSrcRange(Src value) { |
jschuh | d80eded | 2014-10-14 23:31:37 +0900 | [diff] [blame] | 205 | static_assert(std::numeric_limits<Src>::is_specialized, |
| 206 | "Argument must be numeric."); |
| 207 | static_assert(std::numeric_limits<Dst>::is_specialized, |
| 208 | "Result must be numeric."); |
jschuh@chromium.org | 4fe236b | 2014-02-27 22:49:04 +0900 | [diff] [blame] | 209 | return DstRangeRelationToSrcRangeImpl<Dst, Src>::Check(value); |
jschuh@chromium.org | ecd4605 | 2014-01-16 15:57:25 +0900 | [diff] [blame] | 210 | } |
| 211 | |
| 212 | } // namespace internal |
| 213 | } // namespace base |
| 214 | |
danakj | 0393da3 | 2015-03-10 09:31:16 +0900 | [diff] [blame] | 215 | #endif // BASE_NUMERICS_SAFE_CONVERSIONS_IMPL_H_ |