1 | // Copyright 2014 The Chromium Authors. All rights reserved. |
2 | // Use of this source code is governed by a BSD-style license that can be |
3 | // found in the LICENSE file. |
4 | |
5 | #ifndef ANGLEBASE_NUMERICS_SAFE_CONVERSIONS_IMPL_H_ |
6 | #define ANGLEBASE_NUMERICS_SAFE_CONVERSIONS_IMPL_H_ |
7 | |
8 | #include <limits.h> |
9 | #include <stdint.h> |
10 | |
11 | #include <climits> |
12 | #include <limits> |
13 | |
14 | namespace angle |
15 | { |
16 | |
17 | namespace base |
18 | { |
19 | namespace internal |
20 | { |
21 | |
22 | // The std library doesn't provide a binary max_exponent for integers, however |
23 | // we can compute one by adding one to the number of non-sign bits. This allows |
24 | // for accurate range comparisons between floating point and integer types. |
25 | template <typename NumericType> |
26 | struct MaxExponent |
27 | { |
28 | static_assert(std::is_arithmetic<NumericType>::value, "Argument must be numeric." ); |
29 | static const int value = |
30 | std::numeric_limits<NumericType>::is_iec559 |
31 | ? std::numeric_limits<NumericType>::max_exponent |
32 | : (sizeof(NumericType) * CHAR_BIT + 1 - std::numeric_limits<NumericType>::is_signed); |
33 | }; |
34 | |
35 | enum IntegerRepresentation |
36 | { |
37 | INTEGER_REPRESENTATION_UNSIGNED, |
38 | INTEGER_REPRESENTATION_SIGNED |
39 | }; |
40 | |
41 | // A range for a given nunmeric Src type is contained for a given numeric Dst |
42 | // type if both numeric_limits<Src>::max() <= numeric_limits<Dst>::max() and |
43 | // numeric_limits<Src>::min() >= numeric_limits<Dst>::min() are true. |
44 | // We implement this as template specializations rather than simple static |
45 | // comparisons to ensure type correctness in our comparisons. |
46 | enum NumericRangeRepresentation |
47 | { |
48 | NUMERIC_RANGE_NOT_CONTAINED, |
49 | NUMERIC_RANGE_CONTAINED |
50 | }; |
51 | |
52 | // Helper templates to statically determine if our destination type can contain |
53 | // maximum and minimum values represented by the source type. |
54 | |
55 | template <typename Dst, |
56 | typename Src, |
57 | IntegerRepresentation DstSign = std::numeric_limits<Dst>::is_signed |
58 | ? INTEGER_REPRESENTATION_SIGNED |
59 | : INTEGER_REPRESENTATION_UNSIGNED, |
60 | IntegerRepresentation SrcSign = std::numeric_limits<Src>::is_signed |
61 | ? INTEGER_REPRESENTATION_SIGNED |
62 | : INTEGER_REPRESENTATION_UNSIGNED> |
63 | struct StaticDstRangeRelationToSrcRange; |
64 | |
65 | // Same sign: Dst is guaranteed to contain Src only if its range is equal or |
66 | // larger. |
67 | template <typename Dst, typename Src, IntegerRepresentation Sign> |
68 | struct StaticDstRangeRelationToSrcRange<Dst, Src, Sign, Sign> |
69 | { |
70 | static const NumericRangeRepresentation value = |
71 | MaxExponent<Dst>::value >= MaxExponent<Src>::value ? NUMERIC_RANGE_CONTAINED |
72 | : NUMERIC_RANGE_NOT_CONTAINED; |
73 | }; |
74 | |
75 | // Unsigned to signed: Dst is guaranteed to contain source only if its range is |
76 | // larger. |
77 | template <typename Dst, typename Src> |
78 | struct StaticDstRangeRelationToSrcRange<Dst, |
79 | Src, |
80 | INTEGER_REPRESENTATION_SIGNED, |
81 | INTEGER_REPRESENTATION_UNSIGNED> |
82 | { |
83 | static const NumericRangeRepresentation value = |
84 | MaxExponent<Dst>::value > MaxExponent<Src>::value ? NUMERIC_RANGE_CONTAINED |
85 | : NUMERIC_RANGE_NOT_CONTAINED; |
86 | }; |
87 | |
88 | // Signed to unsigned: Dst cannot be statically determined to contain Src. |
89 | template <typename Dst, typename Src> |
90 | struct StaticDstRangeRelationToSrcRange<Dst, |
91 | Src, |
92 | INTEGER_REPRESENTATION_UNSIGNED, |
93 | INTEGER_REPRESENTATION_SIGNED> |
94 | { |
95 | static const NumericRangeRepresentation value = NUMERIC_RANGE_NOT_CONTAINED; |
96 | }; |
97 | |
98 | enum RangeConstraint : unsigned char |
99 | { |
100 | RANGE_VALID = 0x0, // Value can be represented by the destination type. |
101 | RANGE_UNDERFLOW = 0x1, // Value would overflow. |
102 | RANGE_OVERFLOW = 0x2, // Value would underflow. |
103 | RANGE_INVALID = RANGE_UNDERFLOW | RANGE_OVERFLOW // Invalid (i.e. NaN). |
104 | }; |
105 | |
106 | // Helper function for coercing an int back to a RangeContraint. |
107 | constexpr RangeConstraint GetRangeConstraint(int integer_range_constraint) |
108 | { |
109 | // TODO(jschuh): Once we get full C++14 support we want this |
110 | // assert(integer_range_constraint >= RANGE_VALID && |
111 | // integer_range_constraint <= RANGE_INVALID) |
112 | return static_cast<RangeConstraint>(integer_range_constraint); |
113 | } |
114 | |
115 | // This function creates a RangeConstraint from an upper and lower bound |
116 | // check by taking advantage of the fact that only NaN can be out of range in |
117 | // both directions at once. |
118 | constexpr inline RangeConstraint GetRangeConstraint(bool is_in_upper_bound, bool is_in_lower_bound) |
119 | { |
120 | return GetRangeConstraint((is_in_upper_bound ? 0 : RANGE_OVERFLOW) | |
121 | (is_in_lower_bound ? 0 : RANGE_UNDERFLOW)); |
122 | } |
123 | |
124 | // The following helper template addresses a corner case in range checks for |
125 | // conversion from a floating-point type to an integral type of smaller range |
126 | // but larger precision (e.g. float -> unsigned). The problem is as follows: |
127 | // 1. Integral maximum is always one less than a power of two, so it must be |
128 | // truncated to fit the mantissa of the floating point. The direction of |
129 | // rounding is implementation defined, but by default it's always IEEE |
130 | // floats, which round to nearest and thus result in a value of larger |
131 | // magnitude than the integral value. |
132 | // Example: float f = UINT_MAX; // f is 4294967296f but UINT_MAX |
133 | // // is 4294967295u. |
134 | // 2. If the floating point value is equal to the promoted integral maximum |
135 | // value, a range check will erroneously pass. |
136 | // Example: (4294967296f <= 4294967295u) // This is true due to a precision |
137 | // // loss in rounding up to float. |
138 | // 3. When the floating point value is then converted to an integral, the |
139 | // resulting value is out of range for the target integral type and |
140 | // thus is implementation defined. |
141 | // Example: unsigned u = (float)INT_MAX; // u will typically overflow to 0. |
142 | // To fix this bug we manually truncate the maximum value when the destination |
143 | // type is an integral of larger precision than the source floating-point type, |
144 | // such that the resulting maximum is represented exactly as a floating point. |
145 | template <typename Dst, typename Src> |
146 | struct NarrowingRange |
147 | { |
148 | typedef typename std::numeric_limits<Src> SrcLimits; |
149 | typedef typename std::numeric_limits<Dst> DstLimits; |
150 | // The following logic avoids warnings where the max function is |
151 | // instantiated with invalid values for a bit shift (even though |
152 | // such a function can never be called). |
153 | static const int shift = |
154 | (MaxExponent<Src>::value > MaxExponent<Dst>::value && |
155 | SrcLimits::digits < DstLimits::digits && SrcLimits::is_iec559 && DstLimits::is_integer) |
156 | ? (DstLimits::digits - SrcLimits::digits) |
157 | : 0; |
158 | |
159 | static constexpr Dst max() |
160 | { |
161 | // We use UINTMAX_C below to avoid compiler warnings about shifting floating |
162 | // points. Since it's a compile time calculation, it shouldn't have any |
163 | // performance impact. |
164 | return DstLimits::max() - static_cast<Dst>((UINTMAX_C(1) << shift) - 1); |
165 | } |
166 | |
167 | static constexpr Dst min() |
168 | { |
169 | return std::numeric_limits<Dst>::is_iec559 ? -DstLimits::max() : DstLimits::min(); |
170 | } |
171 | }; |
172 | |
173 | template <typename Dst, |
174 | typename Src, |
175 | IntegerRepresentation DstSign = std::numeric_limits<Dst>::is_signed |
176 | ? INTEGER_REPRESENTATION_SIGNED |
177 | : INTEGER_REPRESENTATION_UNSIGNED, |
178 | IntegerRepresentation SrcSign = std::numeric_limits<Src>::is_signed |
179 | ? INTEGER_REPRESENTATION_SIGNED |
180 | : INTEGER_REPRESENTATION_UNSIGNED, |
181 | NumericRangeRepresentation DstRange = StaticDstRangeRelationToSrcRange<Dst, Src>::value> |
182 | struct DstRangeRelationToSrcRangeImpl; |
183 | |
184 | // The following templates are for ranges that must be verified at runtime. We |
185 | // split it into checks based on signedness to avoid confusing casts and |
186 | // compiler warnings on signed an unsigned comparisons. |
187 | |
188 | // Dst range is statically determined to contain Src: Nothing to check. |
189 | template <typename Dst, typename Src, IntegerRepresentation DstSign, IntegerRepresentation SrcSign> |
190 | struct DstRangeRelationToSrcRangeImpl<Dst, Src, DstSign, SrcSign, NUMERIC_RANGE_CONTAINED> |
191 | { |
192 | static constexpr RangeConstraint Check(Src value) { return RANGE_VALID; } |
193 | }; |
194 | |
195 | // Signed to signed narrowing: Both the upper and lower boundaries may be |
196 | // exceeded. |
197 | template <typename Dst, typename Src> |
198 | struct DstRangeRelationToSrcRangeImpl<Dst, |
199 | Src, |
200 | INTEGER_REPRESENTATION_SIGNED, |
201 | INTEGER_REPRESENTATION_SIGNED, |
202 | NUMERIC_RANGE_NOT_CONTAINED> |
203 | { |
204 | static constexpr RangeConstraint Check(Src value) |
205 | { |
206 | return GetRangeConstraint((value <= NarrowingRange<Dst, Src>::max()), |
207 | (value >= NarrowingRange<Dst, Src>::min())); |
208 | } |
209 | }; |
210 | |
211 | // Unsigned to unsigned narrowing: Only the upper boundary can be exceeded. |
212 | template <typename Dst, typename Src> |
213 | struct DstRangeRelationToSrcRangeImpl<Dst, |
214 | Src, |
215 | INTEGER_REPRESENTATION_UNSIGNED, |
216 | INTEGER_REPRESENTATION_UNSIGNED, |
217 | NUMERIC_RANGE_NOT_CONTAINED> |
218 | { |
219 | static constexpr RangeConstraint Check(Src value) |
220 | { |
221 | return GetRangeConstraint(value <= NarrowingRange<Dst, Src>::max(), true); |
222 | } |
223 | }; |
224 | |
225 | // Unsigned to signed: The upper boundary may be exceeded. |
226 | template <typename Dst, typename Src> |
227 | struct DstRangeRelationToSrcRangeImpl<Dst, |
228 | Src, |
229 | INTEGER_REPRESENTATION_SIGNED, |
230 | INTEGER_REPRESENTATION_UNSIGNED, |
231 | NUMERIC_RANGE_NOT_CONTAINED> |
232 | { |
233 | static constexpr RangeConstraint Check(Src value) |
234 | { |
235 | return sizeof(Dst) > sizeof(Src) |
236 | ? RANGE_VALID |
237 | : GetRangeConstraint(value <= static_cast<Src>(NarrowingRange<Dst, Src>::max()), |
238 | true); |
239 | } |
240 | }; |
241 | |
242 | // Signed to unsigned: The upper boundary may be exceeded for a narrower Dst, |
243 | // and any negative value exceeds the lower boundary. |
244 | template <typename Dst, typename Src> |
245 | struct DstRangeRelationToSrcRangeImpl<Dst, |
246 | Src, |
247 | INTEGER_REPRESENTATION_UNSIGNED, |
248 | INTEGER_REPRESENTATION_SIGNED, |
249 | NUMERIC_RANGE_NOT_CONTAINED> |
250 | { |
251 | static constexpr RangeConstraint Check(Src value) |
252 | { |
253 | return (MaxExponent<Dst>::value >= MaxExponent<Src>::value) |
254 | ? GetRangeConstraint(true, value >= static_cast<Src>(0)) |
255 | : GetRangeConstraint(value <= static_cast<Src>(NarrowingRange<Dst, Src>::max()), |
256 | value >= static_cast<Src>(0)); |
257 | } |
258 | }; |
259 | |
260 | template <typename Dst, typename Src> |
261 | constexpr RangeConstraint DstRangeRelationToSrcRange(Src value) |
262 | { |
263 | static_assert(std::numeric_limits<Src>::is_specialized, "Argument must be numeric." ); |
264 | static_assert(std::numeric_limits<Dst>::is_specialized, "Result must be numeric." ); |
265 | return DstRangeRelationToSrcRangeImpl<Dst, Src>::Check(value); |
266 | } |
267 | |
268 | } // namespace internal |
269 | } // namespace base |
270 | |
271 | } // namespace angle |
272 | |
273 | #endif // ANGLEBASE_NUMERICS_SAFE_CONVERSIONS_IMPL_H_ |
274 | |