safe_conversions.h | Explore in Territory

// Copyright 2014 The Chromium Authors
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.

#ifndef PARTITION_ALLOC_PARTITION_ALLOC_BASE_NUMERICS_SAFE_CONVERSIONS_H_
#define PARTITION_ALLOC_PARTITION_ALLOC_BASE_NUMERICS_SAFE_CONVERSIONS_H_

#include <cmath>
#include <cstddef>
#include <limits>
#include <type_traits>

#include "partition_alloc/partition_alloc_base/numerics/safe_conversions_impl.h"

#if defined(__ARMEL__) && !defined(__native_client__)
#include "partition_alloc/partition_alloc_base/numerics/safe_conversions_arm_impl.h"
#define PA_BASE_HAS_OPTIMIZED_SAFE_CONVERSIONS …
#else
#define PA_BASE_HAS_OPTIMIZED_SAFE_CONVERSIONS …
#endif

#if !PA_BASE_NUMERICS_DISABLE_OSTREAM_OPERATORS
#include <ostream>
#endif

namespace partition_alloc::internal::base {
namespace internal {

#if !PA_BASE_HAS_OPTIMIZED_SAFE_CONVERSIONS
template <typename Dst, typename Src>
struct SaturateFastAsmOp { … };
#endif  // PA_BASE_HAS_OPTIMIZED_SAFE_CONVERSIONS
#undef PA_BASE_HAS_OPTIMIZED_SAFE_CONVERSIONS

// The following special case a few specific integer conversions where we can
// eke out better performance than range checking.
template <typename Dst, typename Src, typename Enable = void>
struct IsValueInRangeFastOp { … };

// Signed to signed range comparison.
IsValueInRangeFastOp<Dst, Src, typename std::enable_if<std::is_integral_v<Dst> && std::is_integral_v<Src> && std::is_signed_v<Dst> && std::is_signed_v<Src> && !IsTypeInRangeForNumericType<Dst, Src>::value>::type>;

// Signed to unsigned range comparison.
IsValueInRangeFastOp<Dst, Src, typename std::enable_if<std::is_integral_v<Dst> && std::is_integral_v<Src> && !std::is_signed_v<Dst> && std::is_signed_v<Src> && !IsTypeInRangeForNumericType<Dst, Src>::value>::type>;

// Convenience function that returns true if the supplied value is in range
// for the destination type.
template <typename Dst, typename Src>
constexpr bool IsValueInRangeForNumericType(Src value) { … }

// checked_cast<> is analogous to static_cast<> for numeric types,
// except that it CHECKs that the specified numeric conversion will not
// overflow or underflow. NaN source will always trigger a CHECK.
template <typename Dst,
          class CheckHandler = internal::CheckOnFailure,
          typename Src>
constexpr Dst checked_cast(Src value) { … }

// Default boundaries for integral/float: max/infinity, lowest/-infinity, 0/NaN.
// You may provide your own limits (e.g. to saturated_cast) so long as you
// implement all of the static constexpr member functions in the class below.
template <typename T>
struct SaturationDefaultLimits : public std::numeric_limits<T> { … };

template <typename Dst, template <typename> class S, typename Src>
constexpr Dst saturated_cast_impl(Src value, RangeCheck constraint) { … }

// We can reduce the number of conditions and get slightly better performance
// for normal signed and unsigned integer ranges. And in the specific case of
// Arm, we can use the optimized saturation instructions.
template <typename Dst, typename Src, typename Enable = void>
struct SaturateFastOp { … };

SaturateFastOp<Dst, Src, typename std::enable_if<std::is_integral_v<Src> && std::is_integral_v<Dst> && SaturateFastAsmOp<Dst, Src>::is_supported>::type>;

SaturateFastOp<Dst, Src, typename std::enable_if<std::is_integral_v<Src> && std::is_integral_v<Dst> && !SaturateFastAsmOp<Dst, Src>::is_supported>::type>;

// saturated_cast<> is analogous to static_cast<> for numeric types, except
// that the specified numeric conversion will saturate by default rather than
// overflow or underflow, and NaN assignment to an integral will return 0.
// All boundary condition behaviors can be overridden with a custom handler.
template <typename Dst,
          template <typename> class SaturationHandler = SaturationDefaultLimits,
          typename Src>
constexpr Dst saturated_cast(Src value) { … }

// strict_cast<> is analogous to static_cast<> for numeric types, except that
// it will cause a compile failure if the destination type is not large enough
// to contain any value in the source type. It performs no runtime checking.
template <typename Dst, typename Src>
constexpr Dst strict_cast(Src value) { … }

// Some wrappers to statically check that a type is in range.
template <typename Dst, typename Src, class Enable = void>
struct IsNumericRangeContained { … };

IsNumericRangeContained<Dst, Src, typename std::enable_if<ArithmeticOrUnderlyingEnum<Dst>::value && ArithmeticOrUnderlyingEnum<Src>::value>::type>;

// StrictNumeric implements compile time range checking between numeric types by
// wrapping assignment operations in a strict_cast. This class is intended to be
// used for function arguments and return types, to ensure the destination type
// can always contain the source type. This is essentially the same as enforcing
// -Wconversion in gcc and C4302 warnings on MSVC, but it can be applied
// incrementally at API boundaries, making it easier to convert code so that it
// compiles cleanly with truncation warnings enabled.
// This template should introduce no runtime overhead, but it also provides no
// runtime checking of any of the associated mathematical operations. Use
// CheckedNumeric for runtime range checks of the actual value being assigned.
template <typename T>
class StrictNumeric { … };

// Convenience wrapper returns a StrictNumeric from the provided arithmetic
// type.
template <typename T>
constexpr StrictNumeric<typename UnderlyingType<T>::type> MakeStrictNum(
    const T value) { … }

#define PA_BASE_NUMERIC_COMPARISON_OPERATORS(CLASS, NAME, OP) …

PA_BASE_NUMERIC_COMPARISON_OPERATORS(Strict, IsLess, <)
PA_BASE_NUMERIC_COMPARISON_OPERATORS(Strict, IsLessOrEqual, <=)
PA_BASE_NUMERIC_COMPARISON_OPERATORS(Strict, IsGreater, >)
PA_BASE_NUMERIC_COMPARISON_OPERATORS(Strict, IsGreaterOrEqual, >=)
PA_BASE_NUMERIC_COMPARISON_OPERATORS(Strict, IsEqual, ==)
PA_BASE_NUMERIC_COMPARISON_OPERATORS(Strict, IsNotEqual, !=)

}  // namespace internal

as_signed;
as_unsigned;
checked_cast;
IsTypeInRangeForNumericType;
IsValueInRangeForNumericType;
IsValueNegative;
MakeStrictNum;
SafeUnsignedAbs;
saturated_cast;
strict_cast;
StrictNumeric;

// Explicitly make a shorter size_t alias for convenience.
SizeT;

// floating -> integral conversions that saturate and thus can actually return
// an integral type.  In most cases, these should be preferred over the std::
// versions.
template <typename Dst = int,
          typename Src,
          typename = std::enable_if_t<std::is_integral_v<Dst> &&
                                      std::is_floating_point_v<Src>>>
Dst ClampFloor(Src value) { … }
template <typename Dst = int,
          typename Src,
          typename = std::enable_if_t<std::is_integral_v<Dst> &&
                                      std::is_floating_point_v<Src>>>
Dst ClampCeil(Src value) { … }
template <typename Dst = int,
          typename Src,
          typename = std::enable_if_t<std::is_integral_v<Dst> &&
                                      std::is_floating_point_v<Src>>>
Dst ClampRound(Src value) { … }

}  // namespace partition_alloc::internal::base

#endif  // PARTITION_ALLOC_PARTITION_ALLOC_BASE_NUMERICS_SAFE_CONVERSIONS_H_
chromium/base/allocator/partition_allocator/src/partition_alloc/partition_alloc_base/numerics/safe_conversions.h
