1 | /* |
2 | * Copyright 2013 Google Inc. |
3 | * |
4 | * Use of this source code is governed by a BSD-style license that can be |
5 | * found in the LICENSE file. |
6 | */ |
7 | |
8 | #ifndef SkTFitsIn_DEFINED |
9 | #define SkTFitsIn_DEFINED |
10 | |
11 | #include "include/private/base/SkDebug.h" |
12 | |
13 | #include <cstdint> |
14 | #include <limits> |
15 | #include <type_traits> |
16 | |
17 | /** |
18 | * std::underlying_type is only defined for enums. For integral types, we just want the type. |
19 | */ |
20 | template <typename T, class Enable = void> |
21 | struct sk_strip_enum { |
22 | typedef T type; |
23 | }; |
24 | |
25 | template <typename T> |
26 | struct sk_strip_enum<T, typename std::enable_if<std::is_enum<T>::value>::type> { |
27 | typedef typename std::underlying_type<T>::type type; |
28 | }; |
29 | |
30 | |
31 | /** |
32 | * In C++ an unsigned to signed cast where the source value cannot be represented in the destination |
33 | * type results in an implementation defined destination value. Unlike C, C++ does not allow a trap. |
34 | * This makes "(S)(D)s == s" a possibly useful test. However, there are two cases where this is |
35 | * incorrect: |
36 | * |
37 | * when testing if a value of a smaller signed type can be represented in a larger unsigned type |
38 | * (int8_t)(uint16_t)-1 == -1 => (int8_t)0xFFFF == -1 => [implementation defined] == -1 |
39 | * |
40 | * when testing if a value of a larger unsigned type can be represented in a smaller signed type |
41 | * (uint16_t)(int8_t)0xFFFF == 0xFFFF => (uint16_t)-1 == 0xFFFF => 0xFFFF == 0xFFFF => true. |
42 | * |
43 | * Consider the cases: |
44 | * u = unsigned, less digits |
45 | * U = unsigned, more digits |
46 | * s = signed, less digits |
47 | * S = signed, more digits |
48 | * v is the value we're considering. |
49 | * |
50 | * u -> U: (u)(U)v == v, trivially true |
51 | * U -> u: (U)(u)v == v, both casts well defined, test works |
52 | * s -> S: (s)(S)v == v, trivially true |
53 | * S -> s: (S)(s)v == v, first cast implementation value, second cast defined, test works |
54 | * s -> U: (s)(U)v == v, *this is bad*, the second cast results in implementation defined value |
55 | * S -> u: (S)(u)v == v, the second cast is required to prevent promotion of rhs to unsigned |
56 | * u -> S: (u)(S)v == v, trivially true |
57 | * U -> s: (U)(s)v == v, *this is bad*, |
58 | * first cast results in implementation defined value, |
59 | * second cast is defined. However, this creates false positives |
60 | * uint16_t x = 0xFFFF |
61 | * (uint16_t)(int8_t)x == x |
62 | * => (uint16_t)-1 == x |
63 | * => 0xFFFF == x |
64 | * => true |
65 | * |
66 | * So for the eight cases three are trivially true, three more are valid casts, and two are special. |
67 | * The two 'full' checks which otherwise require two comparisons are valid cast checks. |
68 | * The two remaining checks s -> U [v >= 0] and U -> s [v <= max(s)] can be done with one op. |
69 | */ |
70 | |
71 | template <typename D, typename S> |
72 | static constexpr inline |
73 | typename std::enable_if<(std::is_integral<S>::value || std::is_enum<S>::value) && |
74 | (std::is_integral<D>::value || std::is_enum<D>::value), bool>::type |
75 | /*bool*/ SkTFitsIn(S src) { |
76 | // Ensure that is_signed and is_unsigned are passed the arithmetic underlyng types of enums. |
77 | using Sa = typename sk_strip_enum<S>::type; |
78 | using Da = typename sk_strip_enum<D>::type; |
79 | |
80 | // SkTFitsIn() is used in public headers, so needs to be written targeting at most C++11. |
81 | return |
82 | |
83 | // E.g. (int8_t)(uint8_t) int8_t(-1) == -1, but the uint8_t == 255, not -1. |
84 | (std::is_signed<Sa>::value && std::is_unsigned<Da>::value && sizeof(Sa) <= sizeof(Da)) ? |
85 | (S)0 <= src : |
86 | |
87 | // E.g. (uint8_t)(int8_t) uint8_t(255) == 255, but the int8_t == -1. |
88 | (std::is_signed<Da>::value && std::is_unsigned<Sa>::value && sizeof(Da) <= sizeof(Sa)) ? |
89 | src <= (S)std::numeric_limits<Da>::max() : |
90 | |
91 | #if !defined(SK_DEBUG) && !defined(__MSVC_RUNTIME_CHECKS ) |
92 | // Correct (simple) version. This trips up MSVC's /RTCc run-time checking. |
93 | (S)(D)src == src; |
94 | #else |
95 | // More complex version that's safe with /RTCc. Used in all debug builds, for coverage. |
96 | (std::is_signed<Sa>::value) ? |
97 | (intmax_t)src >= (intmax_t)std::numeric_limits<Da>::min() && |
98 | (intmax_t)src <= (intmax_t)std::numeric_limits<Da>::max() : |
99 | |
100 | // std::is_unsigned<S> ? |
101 | (uintmax_t)src <= (uintmax_t)std::numeric_limits<Da>::max(); |
102 | #endif |
103 | } |
104 | |
105 | #endif |
106 | |