a357e518d1f5fcd0211177fa7cdacce5862eecb6
[pdfium.git] / third_party / numerics / safe_conversions_impl.h
1 // Copyright 2014 The Chromium Authors. All rights reserved.
2 // Use of this source code is governed by a BSD-style license that can be
3 // found in the LICENSE file.
4
5 #ifndef BASE_SAFE_CONVERSIONS_IMPL_H_
6 #define BASE_SAFE_CONVERSIONS_IMPL_H_
7
8 #include <limits>
9
10 #include "../macros.h"
11 #include "../template_util.h"
12
13 namespace base {
14 namespace internal {
15
16 // The std library doesn't provide a binary max_exponent for integers, however
17 // we can compute one by adding one to the number of non-sign bits. This allows
18 // for accurate range comparisons between floating point and integer types.
19 template <typename NumericType>
20 struct MaxExponent {
21   static const int value = std::numeric_limits<NumericType>::is_iec559
22                                ? std::numeric_limits<NumericType>::max_exponent
23                                : (sizeof(NumericType) * 8 + 1 -
24                                   std::numeric_limits<NumericType>::is_signed);
25 };
26
27 enum IntegerRepresentation {
28   INTEGER_REPRESENTATION_UNSIGNED,
29   INTEGER_REPRESENTATION_SIGNED
30 };
31
32 // A range for a given nunmeric Src type is contained for a given numeric Dst
33 // type if both numeric_limits<Src>::max() <= numeric_limits<Dst>::max() and
34 // numeric_limits<Src>::min() >= numeric_limits<Dst>::min() are true.
35 // We implement this as template specializations rather than simple static
36 // comparisons to ensure type correctness in our comparisons.
37 enum NumericRangeRepresentation {
38   NUMERIC_RANGE_NOT_CONTAINED,
39   NUMERIC_RANGE_CONTAINED
40 };
41
42 // Helper templates to statically determine if our destination type can contain
43 // maximum and minimum values represented by the source type.
44
45 template <
46     typename Dst,
47     typename Src,
48     IntegerRepresentation DstSign = std::numeric_limits<Dst>::is_signed
49                                             ? INTEGER_REPRESENTATION_SIGNED
50                                             : INTEGER_REPRESENTATION_UNSIGNED,
51     IntegerRepresentation SrcSign =
52         std::numeric_limits<Src>::is_signed
53             ? INTEGER_REPRESENTATION_SIGNED
54             : INTEGER_REPRESENTATION_UNSIGNED >
55 struct StaticDstRangeRelationToSrcRange;
56
57 // Same sign: Dst is guaranteed to contain Src only if its range is equal or
58 // larger.
59 template <typename Dst, typename Src, IntegerRepresentation Sign>
60 struct StaticDstRangeRelationToSrcRange<Dst, Src, Sign, Sign> {
61   static const NumericRangeRepresentation value =
62       MaxExponent<Dst>::value >= MaxExponent<Src>::value
63           ? NUMERIC_RANGE_CONTAINED
64           : NUMERIC_RANGE_NOT_CONTAINED;
65 };
66
67 // Unsigned to signed: Dst is guaranteed to contain source only if its range is
68 // larger.
69 template <typename Dst, typename Src>
70 struct StaticDstRangeRelationToSrcRange<Dst,
71                                         Src,
72                                         INTEGER_REPRESENTATION_SIGNED,
73                                         INTEGER_REPRESENTATION_UNSIGNED> {
74   static const NumericRangeRepresentation value =
75       MaxExponent<Dst>::value > MaxExponent<Src>::value
76           ? NUMERIC_RANGE_CONTAINED
77           : NUMERIC_RANGE_NOT_CONTAINED;
78 };
79
80 // Signed to unsigned: Dst cannot be statically determined to contain Src.
81 template <typename Dst, typename Src>
82 struct StaticDstRangeRelationToSrcRange<Dst,
83                                         Src,
84                                         INTEGER_REPRESENTATION_UNSIGNED,
85                                         INTEGER_REPRESENTATION_SIGNED> {
86   static const NumericRangeRepresentation value = NUMERIC_RANGE_NOT_CONTAINED;
87 };
88
89 enum RangeConstraint {
90   RANGE_VALID = 0x0,  // Value can be represented by the destination type.
91   RANGE_UNDERFLOW = 0x1,  // Value would overflow.
92   RANGE_OVERFLOW = 0x2,  // Value would underflow.
93   RANGE_INVALID = RANGE_UNDERFLOW | RANGE_OVERFLOW  // Invalid (i.e. NaN).
94 };
95
96 // Helper function for coercing an int back to a RangeContraint.
97 inline RangeConstraint GetRangeConstraint(int integer_range_constraint) {
98   assert(integer_range_constraint >= RANGE_VALID &&
99          integer_range_constraint <= RANGE_INVALID);
100   return static_cast<RangeConstraint>(integer_range_constraint);
101 }
102
103 // This function creates a RangeConstraint from an upper and lower bound
104 // check by taking advantage of the fact that only NaN can be out of range in
105 // both directions at once.
106 inline RangeConstraint GetRangeConstraint(bool is_in_upper_bound,
107                                    bool is_in_lower_bound) {
108   return GetRangeConstraint((is_in_upper_bound ? 0 : RANGE_OVERFLOW) |
109                             (is_in_lower_bound ? 0 : RANGE_UNDERFLOW));
110 }
111
112 template <
113     typename Dst,
114     typename Src,
115     IntegerRepresentation DstSign = std::numeric_limits<Dst>::is_signed
116                                             ? INTEGER_REPRESENTATION_SIGNED
117                                             : INTEGER_REPRESENTATION_UNSIGNED,
118     IntegerRepresentation SrcSign = std::numeric_limits<Src>::is_signed
119                                             ? INTEGER_REPRESENTATION_SIGNED
120                                             : INTEGER_REPRESENTATION_UNSIGNED,
121     NumericRangeRepresentation DstRange =
122         StaticDstRangeRelationToSrcRange<Dst, Src>::value >
123 struct DstRangeRelationToSrcRangeImpl;
124
125 // The following templates are for ranges that must be verified at runtime. We
126 // split it into checks based on signedness to avoid confusing casts and
127 // compiler warnings on signed an unsigned comparisons.
128
129 // Dst range is statically determined to contain Src: Nothing to check.
130 template <typename Dst,
131           typename Src,
132           IntegerRepresentation DstSign,
133           IntegerRepresentation SrcSign>
134 struct DstRangeRelationToSrcRangeImpl<Dst,
135                                       Src,
136                                       DstSign,
137                                       SrcSign,
138                                       NUMERIC_RANGE_CONTAINED> {
139   static RangeConstraint Check(Src value) { return RANGE_VALID; }
140 };
141
142 // Signed to signed narrowing: Both the upper and lower boundaries may be
143 // exceeded.
144 template <typename Dst, typename Src>
145 struct DstRangeRelationToSrcRangeImpl<Dst,
146                                       Src,
147                                       INTEGER_REPRESENTATION_SIGNED,
148                                       INTEGER_REPRESENTATION_SIGNED,
149                                       NUMERIC_RANGE_NOT_CONTAINED> {
150   static RangeConstraint Check(Src value) {
151     return std::numeric_limits<Dst>::is_iec559
152                ? GetRangeConstraint(value <= std::numeric_limits<Dst>::max(),
153                                     value >= -std::numeric_limits<Dst>::max())
154                : GetRangeConstraint(value <= std::numeric_limits<Dst>::max(),
155                                     value >= std::numeric_limits<Dst>::min());
156   }
157 };
158
159 // Unsigned to unsigned narrowing: Only the upper boundary can be exceeded.
160 template <typename Dst, typename Src>
161 struct DstRangeRelationToSrcRangeImpl<Dst,
162                                       Src,
163                                       INTEGER_REPRESENTATION_UNSIGNED,
164                                       INTEGER_REPRESENTATION_UNSIGNED,
165                                       NUMERIC_RANGE_NOT_CONTAINED> {
166   static RangeConstraint Check(Src value) {
167     return GetRangeConstraint(value <= std::numeric_limits<Dst>::max(), true);
168   }
169 };
170
171 // Unsigned to signed: The upper boundary may be exceeded.
172 template <typename Dst, typename Src>
173 struct DstRangeRelationToSrcRangeImpl<Dst,
174                                       Src,
175                                       INTEGER_REPRESENTATION_SIGNED,
176                                       INTEGER_REPRESENTATION_UNSIGNED,
177                                       NUMERIC_RANGE_NOT_CONTAINED> {
178   static RangeConstraint Check(Src value) {
179     return sizeof(Dst) > sizeof(Src)
180                ? RANGE_VALID
181                : GetRangeConstraint(
182                      value <= static_cast<Src>(std::numeric_limits<Dst>::max()),
183                      true);
184   }
185 };
186
187 // Signed to unsigned: The upper boundary may be exceeded for a narrower Dst,
188 // and any negative value exceeds the lower boundary.
189 template <typename Dst, typename Src>
190 struct DstRangeRelationToSrcRangeImpl<Dst,
191                                       Src,
192                                       INTEGER_REPRESENTATION_UNSIGNED,
193                                       INTEGER_REPRESENTATION_SIGNED,
194                                       NUMERIC_RANGE_NOT_CONTAINED> {
195   static RangeConstraint Check(Src value) {
196     return (MaxExponent<Dst>::value >= MaxExponent<Src>::value)
197                ? GetRangeConstraint(true, value >= static_cast<Src>(0))
198                : GetRangeConstraint(
199                      value <= static_cast<Src>(std::numeric_limits<Dst>::max()),
200                      value >= static_cast<Src>(0));
201   }
202 };
203
204 template <typename Dst, typename Src>
205 inline RangeConstraint DstRangeRelationToSrcRange(Src value) {
206   COMPILE_ASSERT(std::numeric_limits<Src>::is_specialized,
207                  argument_must_be_numeric);
208   COMPILE_ASSERT(std::numeric_limits<Dst>::is_specialized,
209                  result_must_be_numeric);
210   return DstRangeRelationToSrcRangeImpl<Dst, Src>::Check(value);
211 }
212
213 }  // namespace internal
214 }  // namespace base
215
216 #endif  // BASE_SAFE_CONVERSIONS_IMPL_H_
217