Source code

Revision control

Other Tools

1
/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
2
/* vim: set ts=8 sts=2 et sw=2 tw=80: */
3
/* This Source Code Form is subject to the terms of the Mozilla Public
4
* License, v. 2.0. If a copy of the MPL was not distributed with this
5
* file, You can obtain one at http://mozilla.org/MPL/2.0/. */
6
7
/* Provides checked integers, detecting integer overflow and divide-by-0. */
8
9
#ifndef mozilla_CheckedInt_h
10
#define mozilla_CheckedInt_h
11
12
#include <stdint.h>
13
#include "mozilla/Assertions.h"
14
#include "mozilla/Attributes.h"
15
#include "mozilla/IntegerTypeTraits.h"
16
#include <limits>
17
18
#define MOZILLA_CHECKEDINT_COMPARABLE_VERSION(major, minor, patch) \
19
(major << 16 | minor << 8 | patch)
20
21
// Probe for builtin math overflow support. Disabled for 32-bit builds for now
22
// since "gcc -m32" claims to support these but its implementation is buggy.
24
// Also disabled for clang before version 7 (resp. Xcode clang 10.0.1): while
25
// clang 5 and 6 have a working __builtin_add_overflow, it is not constexpr.
26
#if defined(HAVE_64BIT_BUILD)
27
# if defined(__has_builtin) && \
28
(!defined(__clang_major__) || \
29
(!defined(__apple_build_version__) && __clang_major__ >= 7) || \
30
(defined(__apple_build_version__) && \
31
MOZILLA_CHECKEDINT_COMPARABLE_VERSION( \
32
__clang_major__, __clang_minor__, __clang_patchlevel__) >= \
33
MOZILLA_CHECKEDINT_COMPARABLE_VERSION(10, 0, 1)))
34
# define MOZ_HAS_BUILTIN_OP_OVERFLOW (__has_builtin(__builtin_add_overflow))
35
# elif defined(__GNUC__)
36
// (clang also defines __GNUC__ but it supports __has_builtin since at least
37
// v3.1 (released in 2012) so it won't get here.)
38
# define MOZ_HAS_BUILTIN_OP_OVERFLOW (__GNUC__ >= 5)
39
# else
40
# define MOZ_HAS_BUILTIN_OP_OVERFLOW (0)
41
# endif
42
#else
43
# define MOZ_HAS_BUILTIN_OP_OVERFLOW (0)
44
#endif
45
46
#undef MOZILLA_CHECKEDINT_COMPARABLE_VERSION
47
48
namespace mozilla {
49
50
template <typename T>
51
class CheckedInt;
52
53
namespace detail {
54
55
/*
56
* Step 1: manually record supported types
57
*
58
* What's nontrivial here is that there are different families of integer
59
* types: basic integer types and stdint types. It is merrily undefined which
60
* types from one family may be just typedefs for a type from another family.
61
*
62
* For example, on GCC 4.6, aside from the basic integer types, the only other
63
* type that isn't just a typedef for some of them, is int8_t.
64
*/
65
66
struct UnsupportedType {};
67
68
template <typename IntegerType>
69
struct IsSupportedPass2 {
70
static const bool value = false;
71
};
72
73
template <typename IntegerType>
74
struct IsSupported {
75
static const bool value = IsSupportedPass2<IntegerType>::value;
76
};
77
78
template <>
79
struct IsSupported<int8_t> {
80
static const bool value = true;
81
};
82
83
template <>
84
struct IsSupported<uint8_t> {
85
static const bool value = true;
86
};
87
88
template <>
89
struct IsSupported<int16_t> {
90
static const bool value = true;
91
};
92
93
template <>
94
struct IsSupported<uint16_t> {
95
static const bool value = true;
96
};
97
98
template <>
99
struct IsSupported<int32_t> {
100
static const bool value = true;
101
};
102
103
template <>
104
struct IsSupported<uint32_t> {
105
static const bool value = true;
106
};
107
108
template <>
109
struct IsSupported<int64_t> {
110
static const bool value = true;
111
};
112
113
template <>
114
struct IsSupported<uint64_t> {
115
static const bool value = true;
116
};
117
118
template <>
119
struct IsSupportedPass2<char> {
120
static const bool value = true;
121
};
122
123
template <>
124
struct IsSupportedPass2<signed char> {
125
static const bool value = true;
126
};
127
128
template <>
129
struct IsSupportedPass2<unsigned char> {
130
static const bool value = true;
131
};
132
133
template <>
134
struct IsSupportedPass2<short> {
135
static const bool value = true;
136
};
137
138
template <>
139
struct IsSupportedPass2<unsigned short> {
140
static const bool value = true;
141
};
142
143
template <>
144
struct IsSupportedPass2<int> {
145
static const bool value = true;
146
};
147
148
template <>
149
struct IsSupportedPass2<unsigned int> {
150
static const bool value = true;
151
};
152
153
template <>
154
struct IsSupportedPass2<long> {
155
static const bool value = true;
156
};
157
158
template <>
159
struct IsSupportedPass2<unsigned long> {
160
static const bool value = true;
161
};
162
163
template <>
164
struct IsSupportedPass2<long long> {
165
static const bool value = true;
166
};
167
168
template <>
169
struct IsSupportedPass2<unsigned long long> {
170
static const bool value = true;
171
};
172
173
/*
174
* Step 2: Implement the actual validity checks.
175
*
176
* Ideas taken from IntegerLib, code different.
177
*/
178
179
template <typename IntegerType, size_t Size = sizeof(IntegerType)>
180
struct TwiceBiggerType {
181
typedef typename detail::StdintTypeForSizeAndSignedness<
182
sizeof(IntegerType) * 2, IsSigned<IntegerType>::value>::Type Type;
183
};
184
185
template <typename IntegerType>
186
struct TwiceBiggerType<IntegerType, 8> {
187
typedef UnsupportedType Type;
188
};
189
190
template <typename T>
191
constexpr bool HasSignBit(T aX) {
192
// In C++, right bit shifts on negative values is undefined by the standard.
193
// Notice that signed-to-unsigned conversions are always well-defined in the
194
// standard, as the value congruent modulo 2**n as expected. By contrast,
195
// unsigned-to-signed is only well-defined if the value is representable.
196
return bool(typename MakeUnsigned<T>::Type(aX) >>
197
PositionOfSignBit<T>::value);
198
}
199
200
// Bitwise ops may return a larger type, so it's good to use this inline
201
// helper guaranteeing that the result is really of type T.
202
template <typename T>
203
constexpr T BinaryComplement(T aX) {
204
return ~aX;
205
}
206
207
template <typename T, typename U, bool IsTSigned = IsSigned<T>::value,
208
bool IsUSigned = IsSigned<U>::value>
209
struct DoesRangeContainRange {};
210
211
template <typename T, typename U, bool Signedness>
212
struct DoesRangeContainRange<T, U, Signedness, Signedness> {
213
static const bool value = sizeof(T) >= sizeof(U);
214
};
215
216
template <typename T, typename U>
217
struct DoesRangeContainRange<T, U, true, false> {
218
static const bool value = sizeof(T) > sizeof(U);
219
};
220
221
template <typename T, typename U>
222
struct DoesRangeContainRange<T, U, false, true> {
223
static const bool value = false;
224
};
225
226
template <typename T, typename U, bool IsTSigned = IsSigned<T>::value,
227
bool IsUSigned = IsSigned<U>::value,
228
bool DoesTRangeContainURange = DoesRangeContainRange<T, U>::value>
229
struct IsInRangeImpl {};
230
231
template <typename T, typename U, bool IsTSigned, bool IsUSigned>
232
struct IsInRangeImpl<T, U, IsTSigned, IsUSigned, true> {
233
static constexpr bool run(U) { return true; }
234
};
235
236
template <typename T, typename U>
237
struct IsInRangeImpl<T, U, true, true, false> {
238
static constexpr bool run(U aX) {
239
return aX <= std::numeric_limits<T>::max() &&
240
aX >= std::numeric_limits<T>::min();
241
}
242
};
243
244
template <typename T, typename U>
245
struct IsInRangeImpl<T, U, false, false, false> {
246
static constexpr bool run(U aX) {
247
return aX <= std::numeric_limits<T>::max();
248
}
249
};
250
251
template <typename T, typename U>
252
struct IsInRangeImpl<T, U, true, false, false> {
253
static constexpr bool run(U aX) {
254
return sizeof(T) > sizeof(U) || aX <= U(std::numeric_limits<T>::max());
255
}
256
};
257
258
template <typename T, typename U>
259
struct IsInRangeImpl<T, U, false, true, false> {
260
static constexpr bool run(U aX) {
261
return sizeof(T) >= sizeof(U)
262
? aX >= 0
263
: aX >= 0 && aX <= U(std::numeric_limits<T>::max());
264
}
265
};
266
267
template <typename T, typename U>
268
constexpr bool IsInRange(U aX) {
269
return IsInRangeImpl<T, U>::run(aX);
270
}
271
272
template <typename T>
273
constexpr bool IsAddValid(T aX, T aY) {
274
#if MOZ_HAS_BUILTIN_OP_OVERFLOW
275
T dummy;
276
return !__builtin_add_overflow(aX, aY, &dummy);
277
#else
278
// Addition is valid if the sign of aX+aY is equal to either that of aX or
279
// that of aY. Since the value of aX+aY is undefined if we have a signed
280
// type, we compute it using the unsigned type of the same size. Beware!
281
// These bitwise operations can return a larger integer type, if T was a
282
// small type like int8_t, so we explicitly cast to T.
283
284
typename MakeUnsigned<T>::Type ux = aX;
285
typename MakeUnsigned<T>::Type uy = aY;
286
typename MakeUnsigned<T>::Type result = ux + uy;
287
return IsSigned<T>::value
288
? HasSignBit(BinaryComplement(T((result ^ aX) & (result ^ aY))))
289
: BinaryComplement(aX) >= aY;
290
#endif
291
}
292
293
template <typename T>
294
constexpr bool IsSubValid(T aX, T aY) {
295
#if MOZ_HAS_BUILTIN_OP_OVERFLOW
296
T dummy;
297
return !__builtin_sub_overflow(aX, aY, &dummy);
298
#else
299
// Subtraction is valid if either aX and aY have same sign, or aX-aY and aX
300
// have same sign. Since the value of aX-aY is undefined if we have a signed
301
// type, we compute it using the unsigned type of the same size.
302
typename MakeUnsigned<T>::Type ux = aX;
303
typename MakeUnsigned<T>::Type uy = aY;
304
typename MakeUnsigned<T>::Type result = ux - uy;
305
306
return IsSigned<T>::value
307
? HasSignBit(BinaryComplement(T((result ^ aX) & (aX ^ aY))))
308
: aX >= aY;
309
#endif
310
}
311
312
template <typename T, bool IsTSigned = IsSigned<T>::value,
313
bool TwiceBiggerTypeIsSupported =
314
IsSupported<typename TwiceBiggerType<T>::Type>::value>
315
struct IsMulValidImpl {};
316
317
template <typename T, bool IsTSigned>
318
struct IsMulValidImpl<T, IsTSigned, true> {
319
static constexpr bool run(T aX, T aY) {
320
typedef typename TwiceBiggerType<T>::Type TwiceBiggerType;
321
TwiceBiggerType product = TwiceBiggerType(aX) * TwiceBiggerType(aY);
322
return IsInRange<T>(product);
323
}
324
};
325
326
template <typename T>
327
struct IsMulValidImpl<T, true, false> {
328
static constexpr bool run(T aX, T aY) {
329
const T max = std::numeric_limits<T>::max();
330
const T min = std::numeric_limits<T>::min();
331
332
if (aX == 0 || aY == 0) {
333
return true;
334
}
335
if (aX > 0) {
336
return aY > 0 ? aX <= max / aY : aY >= min / aX;
337
}
338
339
// If we reach this point, we know that aX < 0.
340
return aY > 0 ? aX >= min / aY : aY >= max / aX;
341
}
342
};
343
344
template <typename T>
345
struct IsMulValidImpl<T, false, false> {
346
static constexpr bool run(T aX, T aY) {
347
return aY == 0 || aX <= std::numeric_limits<T>::max() / aY;
348
}
349
};
350
351
template <typename T>
352
inline bool IsMulValid(T aX, T aY) {
353
#if MOZ_HAS_BUILTIN_OP_OVERFLOW
354
T dummy;
355
return !__builtin_mul_overflow(aX, aY, &dummy);
356
#else
357
return IsMulValidImpl<T>::run(aX, aY);
358
#endif
359
}
360
361
template <typename T>
362
constexpr bool IsDivValid(T aX, T aY) {
363
// Keep in mind that in the signed case, min/-1 is invalid because
364
// abs(min)>max.
365
return aY != 0 && !(IsSigned<T>::value &&
366
aX == std::numeric_limits<T>::min() && aY == T(-1));
367
}
368
369
template <typename T, bool IsTSigned = IsSigned<T>::value>
370
struct IsModValidImpl;
371
372
template <typename T>
373
constexpr bool IsModValid(T aX, T aY) {
374
return IsModValidImpl<T>::run(aX, aY);
375
}
376
377
/*
378
* Mod is pretty simple.
379
* For now, let's just use the ANSI C definition:
380
* If aX or aY are negative, the results are implementation defined.
381
* Consider these invalid.
382
* Undefined for aY=0.
383
* The result will never exceed either aX or aY.
384
*
385
* Checking that aX>=0 is a warning when T is unsigned.
386
*/
387
388
template <typename T>
389
struct IsModValidImpl<T, false> {
390
static constexpr bool run(T aX, T aY) { return aY >= 1; }
391
};
392
393
template <typename T>
394
struct IsModValidImpl<T, true> {
395
static constexpr bool run(T aX, T aY) {
396
if (aX < 0) {
397
return false;
398
}
399
return aY >= 1;
400
}
401
};
402
403
template <typename T, bool IsSigned = IsSigned<T>::value>
404
struct NegateImpl;
405
406
template <typename T>
407
struct NegateImpl<T, false> {
408
static constexpr CheckedInt<T> negate(const CheckedInt<T>& aVal) {
409
// Handle negation separately for signed/unsigned, for simpler code and to
410
// avoid an MSVC warning negating an unsigned value.
411
return CheckedInt<T>(0, aVal.isValid() && aVal.mValue == 0);
412
}
413
};
414
415
template <typename T>
416
struct NegateImpl<T, true> {
417
static constexpr CheckedInt<T> negate(const CheckedInt<T>& aVal) {
418
// Watch out for the min-value, which (with twos-complement) can't be
419
// negated as -min-value is then (max-value + 1).
420
if (!aVal.isValid() || aVal.mValue == std::numeric_limits<T>::min()) {
421
return CheckedInt<T>(aVal.mValue, false);
422
}
423
return CheckedInt<T>(-aVal.mValue, true);
424
}
425
};
426
427
} // namespace detail
428
429
/*
430
* Step 3: Now define the CheckedInt class.
431
*/
432
433
/**
434
* @class CheckedInt
435
* @brief Integer wrapper class checking for integer overflow and other errors
436
* @param T the integer type to wrap. Can be any type among the following:
437
* - any basic integer type such as |int|
438
* - any stdint type such as |int8_t|
439
*
440
* This class implements guarded integer arithmetic. Do a computation, check
441
* that isValid() returns true, you then have a guarantee that no problem, such
442
* as integer overflow, happened during this computation, and you can call
443
* value() to get the plain integer value.
444
*
445
* The arithmetic operators in this class are guaranteed not to raise a signal
446
* (e.g. in case of a division by zero).
447
*
448
* For example, suppose that you want to implement a function that computes
449
* (aX+aY)/aZ, that doesn't crash if aZ==0, and that reports on error (divide by
450
* zero or integer overflow). You could code it as follows:
451
@code
452
bool computeXPlusYOverZ(int aX, int aY, int aZ, int* aResult)
453
{
454
CheckedInt<int> checkedResult = (CheckedInt<int>(aX) + aY) / aZ;
455
if (checkedResult.isValid()) {
456
*aResult = checkedResult.value();
457
return true;
458
} else {
459
return false;
460
}
461
}
462
@endcode
463
*
464
* Implicit conversion from plain integers to checked integers is allowed. The
465
* plain integer is checked to be in range before being casted to the
466
* destination type. This means that the following lines all compile, and the
467
* resulting CheckedInts are correctly detected as valid or invalid:
468
* @code
469
// 1 is of type int, is found to be in range for uint8_t, x is valid
470
CheckedInt<uint8_t> x(1);
471
// -1 is of type int, is found not to be in range for uint8_t, x is invalid
472
CheckedInt<uint8_t> x(-1);
473
// -1 is of type int, is found to be in range for int8_t, x is valid
474
CheckedInt<int8_t> x(-1);
475
// 1000 is of type int16_t, is found not to be in range for int8_t,
476
// x is invalid
477
CheckedInt<int8_t> x(int16_t(1000));
478
// 3123456789 is of type uint32_t, is found not to be in range for int32_t,
479
// x is invalid
480
CheckedInt<int32_t> x(uint32_t(3123456789));
481
* @endcode
482
* Implicit conversion from
483
* checked integers to plain integers is not allowed. As shown in the
484
* above example, to get the value of a checked integer as a normal integer,
485
* call value().
486
*
487
* Arithmetic operations between checked and plain integers is allowed; the
488
* result type is the type of the checked integer.
489
*
490
* Checked integers of different types cannot be used in the same arithmetic
491
* expression.
492
*
493
* There are convenience typedefs for all stdint types, of the following form
494
* (these are just 2 examples):
495
@code
496
typedef CheckedInt<int32_t> CheckedInt32;
497
typedef CheckedInt<uint16_t> CheckedUint16;
498
@endcode
499
*/
500
template <typename T>
501
class CheckedInt {
502
protected:
503
T mValue;
504
bool mIsValid;
505
506
template <typename U>
507
constexpr CheckedInt(U aValue, bool aIsValid)
508
: mValue(aValue), mIsValid(aIsValid) {
509
static_assert(
510
detail::IsSupported<T>::value && detail::IsSupported<U>::value,
511
"This type is not supported by CheckedInt");
512
}
513
514
friend struct detail::NegateImpl<T>;
515
516
public:
517
/**
518
* Constructs a checked integer with given @a value. The checked integer is
519
* initialized as valid or invalid depending on whether the @a value
520
* is in range.
521
*
522
* This constructor is not explicit. Instead, the type of its argument is a
523
* separate template parameter, ensuring that no conversion is performed
524
* before this constructor is actually called. As explained in the above
525
* documentation for class CheckedInt, this constructor checks that its
526
* argument is valid.
527
*/
528
template <typename U>
529
MOZ_IMPLICIT MOZ_NO_ARITHMETIC_EXPR_IN_ARGUMENT constexpr CheckedInt(U aValue)
530
: mValue(T(aValue)), mIsValid(detail::IsInRange<T>(aValue)) {
531
static_assert(
532
detail::IsSupported<T>::value && detail::IsSupported<U>::value,
533
"This type is not supported by CheckedInt");
534
}
535
536
template <typename U>
537
friend class CheckedInt;
538
539
template <typename U>
540
constexpr CheckedInt<U> toChecked() const {
541
CheckedInt<U> ret(mValue);
542
ret.mIsValid = ret.mIsValid && mIsValid;
543
return ret;
544
}
545
546
/** Constructs a valid checked integer with initial value 0 */
547
constexpr CheckedInt() : mValue(0), mIsValid(true) {
548
static_assert(detail::IsSupported<T>::value,
549
"This type is not supported by CheckedInt");
550
}
551
552
/** @returns the actual value */
553
constexpr T value() const {
554
MOZ_DIAGNOSTIC_ASSERT(
555
mIsValid,
556
"Invalid checked integer (division by zero or integer overflow)");
557
return mValue;
558
}
559
560
/**
561
* @returns true if the checked integer is valid, i.e. is not the result
562
* of an invalid operation or of an operation involving an invalid checked
563
* integer
564
*/
565
constexpr bool isValid() const { return mIsValid; }
566
567
template <typename U>
568
friend constexpr CheckedInt<U> operator+(const CheckedInt<U>& aLhs,
569
const CheckedInt<U>& aRhs);
570
template <typename U>
571
constexpr CheckedInt& operator+=(U aRhs);
572
constexpr CheckedInt& operator+=(const CheckedInt<T>& aRhs);
573
574
template <typename U>
575
friend constexpr CheckedInt<U> operator-(const CheckedInt<U>& aLhs,
576
const CheckedInt<U>& aRhs);
577
template <typename U>
578
constexpr CheckedInt& operator-=(U aRhs);
579
constexpr CheckedInt& operator-=(const CheckedInt<T>& aRhs);
580
581
template <typename U>
582
friend constexpr CheckedInt<U> operator*(const CheckedInt<U>& aLhs,
583
const CheckedInt<U>& aRhs);
584
template <typename U>
585
constexpr CheckedInt& operator*=(U aRhs);
586
constexpr CheckedInt& operator*=(const CheckedInt<T>& aRhs);
587
588
template <typename U>
589
friend constexpr CheckedInt<U> operator/(const CheckedInt<U>& aLhs,
590
const CheckedInt<U>& aRhs);
591
template <typename U>
592
constexpr CheckedInt& operator/=(U aRhs);
593
constexpr CheckedInt& operator/=(const CheckedInt<T>& aRhs);
594
595
template <typename U>
596
friend constexpr CheckedInt<U> operator%(const CheckedInt<U>& aLhs,
597
const CheckedInt<U>& aRhs);
598
template <typename U>
599
constexpr CheckedInt& operator%=(U aRhs);
600
constexpr CheckedInt& operator%=(const CheckedInt<T>& aRhs);
601
602
constexpr CheckedInt operator-() const {
603
return detail::NegateImpl<T>::negate(*this);
604
}
605
606
/**
607
* @returns true if the left and right hand sides are valid
608
* and have the same value.
609
*
610
* Note that these semantics are the reason why we don't offer
611
* a operator!=. Indeed, we'd want to have a!=b be equivalent to !(a==b)
612
* but that would mean that whenever a or b is invalid, a!=b
613
* is always true, which would be very confusing.
614
*
615
* For similar reasons, operators <, >, <=, >= would be very tricky to
616
* specify, so we just avoid offering them.
617
*
618
* Notice that these == semantics are made more reasonable by these facts:
619
* 1. a==b implies equality at the raw data level
620
* (the converse is false, as a==b is never true among invalids)
621
* 2. This is similar to the behavior of IEEE floats, where a==b
622
* means that a and b have the same value *and* neither is NaN.
623
*/
624
constexpr bool operator==(const CheckedInt& aOther) const {
625
return mIsValid && aOther.mIsValid && mValue == aOther.mValue;
626
}
627
628
/** prefix ++ */
629
constexpr CheckedInt& operator++() {
630
*this += 1;
631
return *this;
632
}
633
634
/** postfix ++ */
635
constexpr CheckedInt operator++(int) {
636
CheckedInt tmp = *this;
637
*this += 1;
638
return tmp;
639
}
640
641
/** prefix -- */
642
constexpr CheckedInt& operator--() {
643
*this -= 1;
644
return *this;
645
}
646
647
/** postfix -- */
648
constexpr CheckedInt operator--(int) {
649
CheckedInt tmp = *this;
650
*this -= 1;
651
return tmp;
652
}
653
654
private:
655
/**
656
* The !=, <, <=, >, >= operators are disabled:
657
* see the comment on operator==.
658
*/
659
template <typename U>
660
bool operator!=(U aOther) const = delete;
661
template <typename U>
662
bool operator<(U aOther) const = delete;
663
template <typename U>
664
bool operator<=(U aOther) const = delete;
665
template <typename U>
666
bool operator>(U aOther) const = delete;
667
template <typename U>
668
bool operator>=(U aOther) const = delete;
669
};
670
671
#define MOZ_CHECKEDINT_BASIC_BINARY_OPERATOR(NAME, OP) \
672
template <typename T> \
673
constexpr CheckedInt<T> operator OP(const CheckedInt<T>& aLhs, \
674
const CheckedInt<T>& aRhs) { \
675
if (!detail::Is##NAME##Valid(aLhs.mValue, aRhs.mValue)) { \
676
return CheckedInt<T>(0, false); \
677
} \
678
return CheckedInt<T>(aLhs.mValue OP aRhs.mValue, \
679
aLhs.mIsValid && aRhs.mIsValid); \
680
}
681
682
#if MOZ_HAS_BUILTIN_OP_OVERFLOW
683
# define MOZ_CHECKEDINT_BASIC_BINARY_OPERATOR2(NAME, OP, FUN) \
684
template <typename T> \
685
constexpr CheckedInt<T> operator OP(const CheckedInt<T>& aLhs, \
686
const CheckedInt<T>& aRhs) { \
687
auto result = T{}; \
688
if (FUN(aLhs.mValue, aRhs.mValue, &result)) { \
689
return CheckedInt<T>(0, false); \
690
} \
691
return CheckedInt<T>(result, aLhs.mIsValid && aRhs.mIsValid); \
692
}
693
MOZ_CHECKEDINT_BASIC_BINARY_OPERATOR2(Add, +, __builtin_add_overflow)
694
MOZ_CHECKEDINT_BASIC_BINARY_OPERATOR2(Sub, -, __builtin_sub_overflow)
695
MOZ_CHECKEDINT_BASIC_BINARY_OPERATOR2(Mul, *, __builtin_mul_overflow)
696
# undef MOZ_CHECKEDINT_BASIC_BINARY_OPERATOR2
697
#else
698
MOZ_CHECKEDINT_BASIC_BINARY_OPERATOR(Add, +)
699
MOZ_CHECKEDINT_BASIC_BINARY_OPERATOR(Sub, -)
700
MOZ_CHECKEDINT_BASIC_BINARY_OPERATOR(Mul, *)
701
#endif
702
703
MOZ_CHECKEDINT_BASIC_BINARY_OPERATOR(Div, /)
704
MOZ_CHECKEDINT_BASIC_BINARY_OPERATOR(Mod, %)
705
#undef MOZ_CHECKEDINT_BASIC_BINARY_OPERATOR
706
707
// Implement castToCheckedInt<T>(x), making sure that
708
// - it allows x to be either a CheckedInt<T> or any integer type
709
// that can be casted to T
710
// - if x is already a CheckedInt<T>, we just return a reference to it,
711
// instead of copying it (optimization)
712
713
namespace detail {
714
715
template <typename T, typename U>
716
struct CastToCheckedIntImpl {
717
typedef CheckedInt<T> ReturnType;
718
static constexpr CheckedInt<T> run(U aU) { return aU; }
719
};
720
721
template <typename T>
722
struct CastToCheckedIntImpl<T, CheckedInt<T> > {
723
typedef const CheckedInt<T>& ReturnType;
724
static constexpr const CheckedInt<T>& run(const CheckedInt<T>& aU) {
725
return aU;
726
}
727
};
728
729
} // namespace detail
730
731
template <typename T, typename U>
732
constexpr typename detail::CastToCheckedIntImpl<T, U>::ReturnType
733
castToCheckedInt(U aU) {
734
static_assert(detail::IsSupported<T>::value && detail::IsSupported<U>::value,
735
"This type is not supported by CheckedInt");
736
return detail::CastToCheckedIntImpl<T, U>::run(aU);
737
}
738
739
#define MOZ_CHECKEDINT_CONVENIENCE_BINARY_OPERATORS(OP, COMPOUND_OP) \
740
template <typename T> \
741
template <typename U> \
742
constexpr CheckedInt<T>& CheckedInt<T>::operator COMPOUND_OP(U aRhs) { \
743
*this = *this OP castToCheckedInt<T>(aRhs); \
744
return *this; \
745
} \
746
template <typename T> \
747
constexpr CheckedInt<T>& CheckedInt<T>::operator COMPOUND_OP( \
748
const CheckedInt<T>& aRhs) { \
749
*this = *this OP aRhs; \
750
return *this; \
751
} \
752
template <typename T, typename U> \
753
constexpr CheckedInt<T> operator OP(const CheckedInt<T>& aLhs, U aRhs) { \
754
return aLhs OP castToCheckedInt<T>(aRhs); \
755
} \
756
template <typename T, typename U> \
757
constexpr CheckedInt<T> operator OP(U aLhs, const CheckedInt<T>& aRhs) { \
758
return castToCheckedInt<T>(aLhs) OP aRhs; \
759
}
760
761
MOZ_CHECKEDINT_CONVENIENCE_BINARY_OPERATORS(+, +=)
762
MOZ_CHECKEDINT_CONVENIENCE_BINARY_OPERATORS(*, *=)
763
MOZ_CHECKEDINT_CONVENIENCE_BINARY_OPERATORS(-, -=)
764
MOZ_CHECKEDINT_CONVENIENCE_BINARY_OPERATORS(/, /=)
765
MOZ_CHECKEDINT_CONVENIENCE_BINARY_OPERATORS(%, %=)
766
767
#undef MOZ_CHECKEDINT_CONVENIENCE_BINARY_OPERATORS
768
769
template <typename T, typename U>
770
inline bool operator==(const CheckedInt<T>& aLhs, U aRhs) {
771
return aLhs == castToCheckedInt<T>(aRhs);
772
}
773
774
template <typename T, typename U>
775
inline bool operator==(U aLhs, const CheckedInt<T>& aRhs) {
776
return castToCheckedInt<T>(aLhs) == aRhs;
777
}
778
779
// Convenience typedefs.
780
typedef CheckedInt<int8_t> CheckedInt8;
781
typedef CheckedInt<uint8_t> CheckedUint8;
782
typedef CheckedInt<int16_t> CheckedInt16;
783
typedef CheckedInt<uint16_t> CheckedUint16;
784
typedef CheckedInt<int32_t> CheckedInt32;
785
typedef CheckedInt<uint32_t> CheckedUint32;
786
typedef CheckedInt<int64_t> CheckedInt64;
787
typedef CheckedInt<uint64_t> CheckedUint64;
788
789
} // namespace mozilla
790
791
#endif /* mozilla_CheckedInt_h */