base/numerics/safe_conversions.h

   1 // Copyright 2014 The Chromium Authors. All rights reserved.
   2 // Use of this source code is governed by a BSD-style license that can be
   3 // found in the LICENSE file.
   4
   5 #ifndef BASE_NUMERICS_SAFE_CONVERSIONS_H_
   6 #define BASE_NUMERICS_SAFE_CONVERSIONS_H_
   7
   8 #include <limits>
   9
  10 #include "base/logging.h"
  11 #include "base/numerics/safe_conversions_impl.h"
  12
  13 namespace base {
  14
  15 // Convenience function that returns true if the supplied value is in range
  16 // for the destination type.
  17 template <typename Dst, typename Src>
  18 inline bool IsValueInRangeForNumericType(Src value) {
  19   return internal::DstRangeRelationToSrcRange<Dst>(value) ==
  20          internal::RANGE_VALID;
  21 }
  22
  23 // checked_cast<> is analogous to static_cast<> for numeric types,
  24 // except that it CHECKs that the specified numeric conversion will not
  25 // overflow or underflow. NaN source will always trigger a CHECK.
  26 template <typename Dst, typename Src>
  27 inline Dst checked_cast(Src value) {
  28   CHECK(IsValueInRangeForNumericType<Dst>(value));
  29   return static_cast<Dst>(value);
  30 }
  31
  32 // saturated_cast<> is analogous to static_cast<> for numeric types, except
  33 // that the specified numeric conversion will saturate rather than overflow or
  34 // underflow. NaN assignment to an integral will trigger a CHECK condition.
  35 template <typename Dst, typename Src>
  36 inline Dst saturated_cast(Src value) {
  37   // Optimization for floating point values, which already saturate.
  38   if (std::numeric_limits<Dst>::is_iec559)
  39     return static_cast<Dst>(value);
  40
  41   switch (internal::DstRangeRelationToSrcRange<Dst>(value)) {
  42     case internal::RANGE_VALID:
  43       return static_cast<Dst>(value);
  44
  45     case internal::RANGE_UNDERFLOW:
  46       return std::numeric_limits<Dst>::min();
  47
  48     case internal::RANGE_OVERFLOW:
  49       return std::numeric_limits<Dst>::max();
  50
  51     // Should fail only on attempting to assign NaN to a saturated integer.
  52     case internal::RANGE_INVALID:
  53       CHECK(false);
  54       return std::numeric_limits<Dst>::max();
  55   }
  56
  57   NOTREACHED();
  58   return static_cast<Dst>(value);
  59 }
  60
  61 // strict_cast<> is analogous to static_cast<> for numeric types, except that
  62 // it will cause a compile failure if the destination type is not large enough
  63 // to contain any value in the source type. It performs no runtime checking.
  64 template <typename Dst, typename Src>
  65 inline Dst strict_cast(Src value) {
  66   static_assert(std::numeric_limits<Src>::is_specialized,
  67                 "Argument must be numeric.");
  68   static_assert(std::numeric_limits<Dst>::is_specialized,
  69                 "Result must be numeric.");
  70   static_assert((internal::StaticDstRangeRelationToSrcRange<Dst, Src>::value ==
  71                  internal::NUMERIC_RANGE_CONTAINED),
  72                 "The numeric conversion is out of range for this type. You "
  73                 "should probably use one of the following conversion "
  74                 "mechanisms on the value you want to pass:\n"
  75                 "- base::checked_cast\n"
  76                 "- base::saturated_cast\n"
  77                 "- base::CheckedNumeric");
  78
  79   return static_cast<Dst>(value);
  80 }
  81
  82 // StrictNumeric implements compile time range checking between numeric types by
  83 // wrapping assignment operations in a strict_cast. This class is intended to be
  84 // used for function arguments and return types, to ensure the destination type
  85 // can always contain the source type. This is essentially the same as enforcing
  86 // -Wconversion in gcc and C4302 warnings on MSVC, but it can be applied
  87 // incrementally at API boundaries, making it easier to convert code so that it
  88 // compiles cleanly with truncation warnings enabled.
  89 // This template should introduce no runtime overhead, but it also provides no
  90 // runtime checking of any of the associated mathematical operations. Use
  91 // CheckedNumeric for runtime range checks of tha actual value being assigned.
  92 template <typename T>
  93 class StrictNumeric {
  94  public:
  95   typedef T type;
  96
  97   StrictNumeric() : value_(0) {}
  98
  99   // Copy constructor.
 100   template <typename Src>
 101   StrictNumeric(const StrictNumeric<Src>& rhs)
 102       : value_(strict_cast<T>(rhs.value_)) {}
 103
 104   // This is not an explicit constructor because we implicitly upgrade regular
 105   // numerics to StrictNumerics to make them easier to use.
 106   template <typename Src>
 107   StrictNumeric(Src value)
 108       : value_(strict_cast<T>(value)) {}
 109
 110   // The numeric cast operator basically handles all the magic.
 111   template <typename Dst>
 112   operator Dst() const {
 113     return strict_cast<Dst>(value_);
 114   }
 115
 116  private:
 117   T value_;
 118 };
 119
 120 // Explicitly make a shorter size_t typedef for convenience.
 121 typedef StrictNumeric<size_t> SizeT;
 122
 123 }  // namespace base
 124
 125 #endif  // BASE_NUMERICS_SAFE_CONVERSIONS_H_