1// Copyright 2014 The Chromium Authors. All rights reserved.
2// Use of this source code is governed by a BSD-style license that can be
3// found in the LICENSE file.
4
5#ifndef BASE_NUMERICS_SAFE_CONVERSIONS_H_
6#define BASE_NUMERICS_SAFE_CONVERSIONS_H_
7
8#include <stddef.h>
9
10#include <limits>
11#include <type_traits>
12
13#include "base/logging.h"
14#include "base/numerics/safe_conversions_impl.h"
15
16namespace base {
17
18// Convenience function that returns true if the supplied value is in range
19// for the destination type.
20template <typename Dst, typename Src>
21constexpr bool IsValueInRangeForNumericType(Src value) {
22  return internal::DstRangeRelationToSrcRange<Dst>(value) ==
23         internal::RANGE_VALID;
24}
25
26// Convenience function for determining if a numeric value is negative without
27// throwing compiler warnings on: unsigned(value) < 0.
28template <typename T>
29constexpr typename std::enable_if<std::numeric_limits<T>::is_signed, bool>::type
30IsValueNegative(T value) {
31  static_assert(std::numeric_limits<T>::is_specialized,
32                "Argument must be numeric.");
33  return value < 0;
34}
35
36template <typename T>
37constexpr typename std::enable_if<!std::numeric_limits<T>::is_signed,
38                                  bool>::type IsValueNegative(T) {
39  static_assert(std::numeric_limits<T>::is_specialized,
40                "Argument must be numeric.");
41  return false;
42}
43
44// checked_cast<> is analogous to static_cast<> for numeric types,
45// except that it CHECKs that the specified numeric conversion will not
46// overflow or underflow. NaN source will always trigger a CHECK.
47template <typename Dst, typename Src>
48inline Dst checked_cast(Src value) {
49  CHECK(IsValueInRangeForNumericType<Dst>(value));
50  return static_cast<Dst>(value);
51}
52
53// HandleNaN will cause this class to CHECK(false).
54struct SaturatedCastNaNBehaviorCheck {
55  template <typename T>
56  static T HandleNaN() {
57    CHECK(false);
58    return T();
59  }
60};
61
62// HandleNaN will return 0 in this case.
63struct SaturatedCastNaNBehaviorReturnZero {
64  template <typename T>
65  static constexpr T HandleNaN() {
66    return T();
67  }
68};
69
70namespace internal {
71// This wrapper is used for C++11 constexpr support by avoiding the declaration
72// of local variables in the saturated_cast template function.
73template <typename Dst, class NaNHandler, typename Src>
74constexpr Dst saturated_cast_impl(const Src value,
75                                  const RangeConstraint constraint) {
76  return constraint == RANGE_VALID
77             ? static_cast<Dst>(value)
78             : (constraint == RANGE_UNDERFLOW
79                    ? std::numeric_limits<Dst>::min()
80                    : (constraint == RANGE_OVERFLOW
81                           ? std::numeric_limits<Dst>::max()
82                           : (constraint == RANGE_INVALID
83                                  ? NaNHandler::template HandleNaN<Dst>()
84                                  : (NOTREACHED(), static_cast<Dst>(value)))));
85}
86}  // namespace internal
87
88// saturated_cast<> is analogous to static_cast<> for numeric types, except
89// that the specified numeric conversion will saturate rather than overflow or
90// underflow. NaN assignment to an integral will defer the behavior to a
91// specified class. By default, it will return 0.
92template <typename Dst,
93          class NaNHandler = SaturatedCastNaNBehaviorReturnZero,
94          typename Src>
95constexpr Dst saturated_cast(Src value) {
96  return std::numeric_limits<Dst>::is_iec559
97             ? static_cast<Dst>(value)  // Floating point optimization.
98             : internal::saturated_cast_impl<Dst, NaNHandler>(
99                   value, internal::DstRangeRelationToSrcRange<Dst>(value));
100}
101
102// strict_cast<> is analogous to static_cast<> for numeric types, except that
103// it will cause a compile failure if the destination type is not large enough
104// to contain any value in the source type. It performs no runtime checking.
105template <typename Dst, typename Src>
106constexpr Dst strict_cast(Src value) {
107  static_assert(std::numeric_limits<Src>::is_specialized,
108                "Argument must be numeric.");
109  static_assert(std::numeric_limits<Dst>::is_specialized,
110                "Result must be numeric.");
111  static_assert((internal::StaticDstRangeRelationToSrcRange<Dst, Src>::value ==
112                 internal::NUMERIC_RANGE_CONTAINED),
113                "The numeric conversion is out of range for this type. You "
114                "should probably use one of the following conversion "
115                "mechanisms on the value you want to pass:\n"
116                "- base::checked_cast\n"
117                "- base::saturated_cast\n"
118                "- base::CheckedNumeric");
119
120  return static_cast<Dst>(value);
121}
122
123// StrictNumeric implements compile time range checking between numeric types by
124// wrapping assignment operations in a strict_cast. This class is intended to be
125// used for function arguments and return types, to ensure the destination type
126// can always contain the source type. This is essentially the same as enforcing
127// -Wconversion in gcc and C4302 warnings on MSVC, but it can be applied
128// incrementally at API boundaries, making it easier to convert code so that it
129// compiles cleanly with truncation warnings enabled.
130// This template should introduce no runtime overhead, but it also provides no
131// runtime checking of any of the associated mathematical operations. Use
132// CheckedNumeric for runtime range checks of the actual value being assigned.
133template <typename T>
134class StrictNumeric {
135 public:
136  typedef T type;
137
138  constexpr StrictNumeric() : value_(0) {}
139
140  // Copy constructor.
141  template <typename Src>
142  constexpr StrictNumeric(const StrictNumeric<Src>& rhs)
143      : value_(strict_cast<T>(rhs.value_)) {}
144
145  // This is not an explicit constructor because we implicitly upgrade regular
146  // numerics to StrictNumerics to make them easier to use.
147  template <typename Src>
148  constexpr StrictNumeric(Src value)
149      : value_(strict_cast<T>(value)) {}
150
151  // The numeric cast operator basically handles all the magic.
152  template <typename Dst>
153  constexpr operator Dst() const {
154    return strict_cast<Dst>(value_);
155  }
156
157 private:
158  const T value_;
159};
160
161// Explicitly make a shorter size_t typedef for convenience.
162typedef StrictNumeric<size_t> SizeT;
163
164}  // namespace base
165
166#endif  // BASE_NUMERICS_SAFE_CONVERSIONS_H_
167