michael@0: /* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
michael@0: /* vim: set ts=8 sts=2 et sw=2 tw=80: */
michael@0: /* This Source Code Form is subject to the terms of the Mozilla Public
michael@0:  * License, v. 2.0. If a copy of the MPL was not distributed with this
michael@0:  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
michael@0: 
michael@0: /* Provides checked integers, detecting integer overflow and divide-by-0. */
michael@0: 
michael@0: #ifndef mozilla_CheckedInt_h
michael@0: #define mozilla_CheckedInt_h
michael@0: 
michael@0: #include <stdint.h>
michael@0: #include "mozilla/Assertions.h"
michael@0: #include "mozilla/IntegerTypeTraits.h"
michael@0: 
michael@0: namespace mozilla {
michael@0: 
michael@0: template<typename T> class CheckedInt;
michael@0: 
michael@0: namespace detail {
michael@0: 
michael@0: /*
michael@0:  * Step 1: manually record supported types
michael@0:  *
michael@0:  * What's nontrivial here is that there are different families of integer
michael@0:  * types: basic integer types and stdint types. It is merrily undefined which
michael@0:  * types from one family may be just typedefs for a type from another family.
michael@0:  *
michael@0:  * For example, on GCC 4.6, aside from the basic integer types, the only other
michael@0:  * type that isn't just a typedef for some of them, is int8_t.
michael@0:  */
michael@0: 
michael@0: struct UnsupportedType {};
michael@0: 
michael@0: template<typename IntegerType>
michael@0: struct IsSupportedPass2
michael@0: {
michael@0:     static const bool value = false;
michael@0: };
michael@0: 
michael@0: template<typename IntegerType>
michael@0: struct IsSupported
michael@0: {
michael@0:     static const bool value = IsSupportedPass2<IntegerType>::value;
michael@0: };
michael@0: 
michael@0: template<>
michael@0: struct IsSupported<int8_t>
michael@0: { static const bool value = true; };
michael@0: 
michael@0: template<>
michael@0: struct IsSupported<uint8_t>
michael@0: { static const bool value = true; };
michael@0: 
michael@0: template<>
michael@0: struct IsSupported<int16_t>
michael@0: { static const bool value = true; };
michael@0: 
michael@0: template<>
michael@0: struct IsSupported<uint16_t>
michael@0: { static const bool value = true; };
michael@0: 
michael@0: template<>
michael@0: struct IsSupported<int32_t>
michael@0: { static const bool value = true; };
michael@0: 
michael@0: template<>
michael@0: struct IsSupported<uint32_t>
michael@0: { static const bool value = true; };
michael@0: 
michael@0: template<>
michael@0: struct IsSupported<int64_t>
michael@0: { static const bool value = true; };
michael@0: 
michael@0: template<>
michael@0: struct IsSupported<uint64_t>
michael@0: { static const bool value = true; };
michael@0: 
michael@0: 
michael@0: template<>
michael@0: struct IsSupportedPass2<char>
michael@0: { static const bool value = true; };
michael@0: 
michael@0: template<>
michael@0: struct IsSupportedPass2<signed char>
michael@0: { static const bool value = true; };
michael@0: 
michael@0: template<>
michael@0: struct IsSupportedPass2<unsigned char>
michael@0: { static const bool value = true; };
michael@0: 
michael@0: template<>
michael@0: struct IsSupportedPass2<short>
michael@0: { static const bool value = true; };
michael@0: 
michael@0: template<>
michael@0: struct IsSupportedPass2<unsigned short>
michael@0: { static const bool value = true; };
michael@0: 
michael@0: template<>
michael@0: struct IsSupportedPass2<int>
michael@0: { static const bool value = true; };
michael@0: 
michael@0: template<>
michael@0: struct IsSupportedPass2<unsigned int>
michael@0: { static const bool value = true; };
michael@0: 
michael@0: template<>
michael@0: struct IsSupportedPass2<long>
michael@0: { static const bool value = true; };
michael@0: 
michael@0: template<>
michael@0: struct IsSupportedPass2<unsigned long>
michael@0: { static const bool value = true; };
michael@0: 
michael@0: template<>
michael@0: struct IsSupportedPass2<long long>
michael@0: { static const bool value = true; };
michael@0: 
michael@0: template<>
michael@0: struct IsSupportedPass2<unsigned long long>
michael@0: { static const bool value = true; };
michael@0: 
michael@0: /*
michael@0:  * Step 2: Implement the actual validity checks.
michael@0:  *
michael@0:  * Ideas taken from IntegerLib, code different.
michael@0:  */
michael@0: 
michael@0: template<typename IntegerType, size_t Size = sizeof(IntegerType)>
michael@0: struct TwiceBiggerType
michael@0: {
michael@0:     typedef typename detail::StdintTypeForSizeAndSignedness<
michael@0:                        sizeof(IntegerType) * 2,
michael@0:                        IsSigned<IntegerType>::value
michael@0:                      >::Type Type;
michael@0: };
michael@0: 
michael@0: template<typename IntegerType>
michael@0: struct TwiceBiggerType<IntegerType, 8>
michael@0: {
michael@0:     typedef UnsupportedType Type;
michael@0: };
michael@0: 
michael@0: template<typename T>
michael@0: inline bool
michael@0: HasSignBit(T x)
michael@0: {
michael@0:   // In C++, right bit shifts on negative values is undefined by the standard.
michael@0:   // Notice that signed-to-unsigned conversions are always well-defined in the
michael@0:   // standard, as the value congruent modulo 2**n as expected. By contrast,
michael@0:   // unsigned-to-signed is only well-defined if the value is representable.
michael@0:   return bool(typename MakeUnsigned<T>::Type(x) >> PositionOfSignBit<T>::value);
michael@0: }
michael@0: 
michael@0: // Bitwise ops may return a larger type, so it's good to use this inline
michael@0: // helper guaranteeing that the result is really of type T.
michael@0: template<typename T>
michael@0: inline T
michael@0: BinaryComplement(T x)
michael@0: {
michael@0:   return ~x;
michael@0: }
michael@0: 
michael@0: template<typename T,
michael@0:          typename U,
michael@0:          bool IsTSigned = IsSigned<T>::value,
michael@0:          bool IsUSigned = IsSigned<U>::value>
michael@0: struct DoesRangeContainRange
michael@0: {
michael@0: };
michael@0: 
michael@0: template<typename T, typename U, bool Signedness>
michael@0: struct DoesRangeContainRange<T, U, Signedness, Signedness>
michael@0: {
michael@0:     static const bool value = sizeof(T) >= sizeof(U);
michael@0: };
michael@0: 
michael@0: template<typename T, typename U>
michael@0: struct DoesRangeContainRange<T, U, true, false>
michael@0: {
michael@0:     static const bool value = sizeof(T) > sizeof(U);
michael@0: };
michael@0: 
michael@0: template<typename T, typename U>
michael@0: struct DoesRangeContainRange<T, U, false, true>
michael@0: {
michael@0:     static const bool value = false;
michael@0: };
michael@0: 
michael@0: template<typename T,
michael@0:          typename U,
michael@0:          bool IsTSigned = IsSigned<T>::value,
michael@0:          bool IsUSigned = IsSigned<U>::value,
michael@0:          bool DoesTRangeContainURange = DoesRangeContainRange<T, U>::value>
michael@0: struct IsInRangeImpl {};
michael@0: 
michael@0: template<typename T, typename U, bool IsTSigned, bool IsUSigned>
michael@0: struct IsInRangeImpl<T, U, IsTSigned, IsUSigned, true>
michael@0: {
michael@0:     static bool run(U)
michael@0:     {
michael@0:        return true;
michael@0:     }
michael@0: };
michael@0: 
michael@0: template<typename T, typename U>
michael@0: struct IsInRangeImpl<T, U, true, true, false>
michael@0: {
michael@0:     static bool run(U x)
michael@0:     {
michael@0:       return x <= MaxValue<T>::value && x >= MinValue<T>::value;
michael@0:     }
michael@0: };
michael@0: 
michael@0: template<typename T, typename U>
michael@0: struct IsInRangeImpl<T, U, false, false, false>
michael@0: {
michael@0:     static bool run(U x)
michael@0:     {
michael@0:       return x <= MaxValue<T>::value;
michael@0:     }
michael@0: };
michael@0: 
michael@0: template<typename T, typename U>
michael@0: struct IsInRangeImpl<T, U, true, false, false>
michael@0: {
michael@0:     static bool run(U x)
michael@0:     {
michael@0:       return sizeof(T) > sizeof(U) || x <= U(MaxValue<T>::value);
michael@0:     }
michael@0: };
michael@0: 
michael@0: template<typename T, typename U>
michael@0: struct IsInRangeImpl<T, U, false, true, false>
michael@0: {
michael@0:     static bool run(U x)
michael@0:     {
michael@0:       return sizeof(T) >= sizeof(U)
michael@0:              ? x >= 0
michael@0:              : x >= 0 && x <= U(MaxValue<T>::value);
michael@0:     }
michael@0: };
michael@0: 
michael@0: template<typename T, typename U>
michael@0: inline bool
michael@0: IsInRange(U x)
michael@0: {
michael@0:   return IsInRangeImpl<T, U>::run(x);
michael@0: }
michael@0: 
michael@0: template<typename T>
michael@0: inline bool
michael@0: IsAddValid(T x, T y)
michael@0: {
michael@0:   // Addition is valid if the sign of x+y is equal to either that of x or that
michael@0:   // of y. Since the value of x+y is undefined if we have a signed type, we
michael@0:   // compute it using the unsigned type of the same size.
michael@0:   // Beware! These bitwise operations can return a larger integer type,
michael@0:   // if T was a small type like int8_t, so we explicitly cast to T.
michael@0: 
michael@0:   typename MakeUnsigned<T>::Type ux = x;
michael@0:   typename MakeUnsigned<T>::Type uy = y;
michael@0:   typename MakeUnsigned<T>::Type result = ux + uy;
michael@0:   return IsSigned<T>::value
michael@0:          ? HasSignBit(BinaryComplement(T((result ^ x) & (result ^ y))))
michael@0:          : BinaryComplement(x) >= y;
michael@0: }
michael@0: 
michael@0: template<typename T>
michael@0: inline bool
michael@0: IsSubValid(T x, T y)
michael@0: {
michael@0:   // Subtraction is valid if either x and y have same sign, or x-y and x have
michael@0:   // same sign. Since the value of x-y is undefined if we have a signed type,
michael@0:   // we compute it using the unsigned type of the same size.
michael@0:   typename MakeUnsigned<T>::Type ux = x;
michael@0:   typename MakeUnsigned<T>::Type uy = y;
michael@0:   typename MakeUnsigned<T>::Type result = ux - uy;
michael@0: 
michael@0:   return IsSigned<T>::value
michael@0:          ? HasSignBit(BinaryComplement(T((result ^ x) & (x ^ y))))
michael@0:          : x >= y;
michael@0: }
michael@0: 
michael@0: template<typename T,
michael@0:          bool IsTSigned = IsSigned<T>::value,
michael@0:          bool TwiceBiggerTypeIsSupported =
michael@0:            IsSupported<typename TwiceBiggerType<T>::Type>::value>
michael@0: struct IsMulValidImpl {};
michael@0: 
michael@0: template<typename T, bool IsTSigned>
michael@0: struct IsMulValidImpl<T, IsTSigned, true>
michael@0: {
michael@0:     static bool run(T x, T y)
michael@0:     {
michael@0:       typedef typename TwiceBiggerType<T>::Type TwiceBiggerType;
michael@0:       TwiceBiggerType product = TwiceBiggerType(x) * TwiceBiggerType(y);
michael@0:       return IsInRange<T>(product);
michael@0:     }
michael@0: };
michael@0: 
michael@0: template<typename T>
michael@0: struct IsMulValidImpl<T, true, false>
michael@0: {
michael@0:     static bool run(T x, T y)
michael@0:     {
michael@0:       const T max = MaxValue<T>::value;
michael@0:       const T min = MinValue<T>::value;
michael@0: 
michael@0:       if (x == 0 || y == 0)
michael@0:         return true;
michael@0: 
michael@0:       if (x > 0) {
michael@0:         return y > 0
michael@0:                ? x <= max / y
michael@0:                : y >= min / x;
michael@0:       }
michael@0: 
michael@0:       // If we reach this point, we know that x < 0.
michael@0:       return y > 0
michael@0:              ? x >= min / y
michael@0:              : y >= max / x;
michael@0:     }
michael@0: };
michael@0: 
michael@0: template<typename T>
michael@0: struct IsMulValidImpl<T, false, false>
michael@0: {
michael@0:     static bool run(T x, T y)
michael@0:     {
michael@0:       return y == 0 ||  x <= MaxValue<T>::value / y;
michael@0:     }
michael@0: };
michael@0: 
michael@0: template<typename T>
michael@0: inline bool
michael@0: IsMulValid(T x, T y)
michael@0: {
michael@0:   return IsMulValidImpl<T>::run(x, y);
michael@0: }
michael@0: 
michael@0: template<typename T>
michael@0: inline bool
michael@0: IsDivValid(T x, T y)
michael@0: {
michael@0:   // Keep in mind that in the signed case, min/-1 is invalid because abs(min)>max.
michael@0:   return y != 0 &&
michael@0:          !(IsSigned<T>::value && x == MinValue<T>::value && y == T(-1));
michael@0: }
michael@0: 
michael@0: template<typename T, bool IsTSigned = IsSigned<T>::value>
michael@0: struct IsModValidImpl;
michael@0: 
michael@0: template<typename T>
michael@0: inline bool
michael@0: IsModValid(T x, T y)
michael@0: {
michael@0:   return IsModValidImpl<T>::run(x, y);
michael@0: }
michael@0: 
michael@0: /*
michael@0:  * Mod is pretty simple.
michael@0:  * For now, let's just use the ANSI C definition:
michael@0:  * If x or y are negative, the results are implementation defined.
michael@0:  *   Consider these invalid.
michael@0:  * Undefined for y=0.
michael@0:  * The result will never exceed either x or y.
michael@0:  *
michael@0:  * Checking that x>=0 is a warning when T is unsigned.
michael@0:  */
michael@0: 
michael@0: template<typename T>
michael@0: struct IsModValidImpl<T, false> {
michael@0:   static inline bool run(T x, T y) {
michael@0:     return y >= 1;
michael@0:   }
michael@0: };
michael@0: 
michael@0: template<typename T>
michael@0: struct IsModValidImpl<T, true> {
michael@0:   static inline bool run(T x, T y) {
michael@0:     if (x < 0)
michael@0:       return false;
michael@0: 
michael@0:     return y >= 1;
michael@0:   }
michael@0: };
michael@0: 
michael@0: template<typename T, bool IsSigned = IsSigned<T>::value>
michael@0: struct NegateImpl;
michael@0: 
michael@0: template<typename T>
michael@0: struct NegateImpl<T, false>
michael@0: {
michael@0:     static CheckedInt<T> negate(const CheckedInt<T>& val)
michael@0:     {
michael@0:       // Handle negation separately for signed/unsigned, for simpler code and to
michael@0:       // avoid an MSVC warning negating an unsigned value.
michael@0:       return CheckedInt<T>(0, val.isValid() && val.mValue == 0);
michael@0:     }
michael@0: };
michael@0: 
michael@0: template<typename T>
michael@0: struct NegateImpl<T, true>
michael@0: {
michael@0:     static CheckedInt<T> negate(const CheckedInt<T>& val)
michael@0:     {
michael@0:       // Watch out for the min-value, which (with twos-complement) can't be
michael@0:       // negated as -min-value is then (max-value + 1).
michael@0:       if (!val.isValid() || val.mValue == MinValue<T>::value)
michael@0:         return CheckedInt<T>(val.mValue, false);
michael@0:       return CheckedInt<T>(-val.mValue, true);
michael@0:     }
michael@0: };
michael@0: 
michael@0: } // namespace detail
michael@0: 
michael@0: 
michael@0: /*
michael@0:  * Step 3: Now define the CheckedInt class.
michael@0:  */
michael@0: 
michael@0: /**
michael@0:  * @class CheckedInt
michael@0:  * @brief Integer wrapper class checking for integer overflow and other errors
michael@0:  * @param T the integer type to wrap. Can be any type among the following:
michael@0:  *            - any basic integer type such as |int|
michael@0:  *            - any stdint type such as |int8_t|
michael@0:  *
michael@0:  * This class implements guarded integer arithmetic. Do a computation, check
michael@0:  * that isValid() returns true, you then have a guarantee that no problem, such
michael@0:  * as integer overflow, happened during this computation, and you can call
michael@0:  * value() to get the plain integer value.
michael@0:  *
michael@0:  * The arithmetic operators in this class are guaranteed not to raise a signal
michael@0:  * (e.g. in case of a division by zero).
michael@0:  *
michael@0:  * For example, suppose that you want to implement a function that computes
michael@0:  * (x+y)/z, that doesn't crash if z==0, and that reports on error (divide by
michael@0:  * zero or integer overflow). You could code it as follows:
michael@0:    @code
michael@0:    bool computeXPlusYOverZ(int x, int y, int z, int *result)
michael@0:    {
michael@0:        CheckedInt<int> checkedResult = (CheckedInt<int>(x) + y) / z;
michael@0:        if (checkedResult.isValid()) {
michael@0:            *result = checkedResult.value();
michael@0:            return true;
michael@0:        } else {
michael@0:            return false;
michael@0:        }
michael@0:    }
michael@0:    @endcode
michael@0:  *
michael@0:  * Implicit conversion from plain integers to checked integers is allowed. The
michael@0:  * plain integer is checked to be in range before being casted to the
michael@0:  * destination type. This means that the following lines all compile, and the
michael@0:  * resulting CheckedInts are correctly detected as valid or invalid:
michael@0:  * @code
michael@0:    // 1 is of type int, is found to be in range for uint8_t, x is valid
michael@0:    CheckedInt<uint8_t> x(1);
michael@0:    // -1 is of type int, is found not to be in range for uint8_t, x is invalid
michael@0:    CheckedInt<uint8_t> x(-1);
michael@0:    // -1 is of type int, is found to be in range for int8_t, x is valid
michael@0:    CheckedInt<int8_t> x(-1);
michael@0:    // 1000 is of type int16_t, is found not to be in range for int8_t,
michael@0:    // x is invalid
michael@0:    CheckedInt<int8_t> x(int16_t(1000));
michael@0:    // 3123456789 is of type uint32_t, is found not to be in range for int32_t,
michael@0:    // x is invalid
michael@0:    CheckedInt<int32_t> x(uint32_t(3123456789));
michael@0:  * @endcode
michael@0:  * Implicit conversion from
michael@0:  * checked integers to plain integers is not allowed. As shown in the
michael@0:  * above example, to get the value of a checked integer as a normal integer,
michael@0:  * call value().
michael@0:  *
michael@0:  * Arithmetic operations between checked and plain integers is allowed; the
michael@0:  * result type is the type of the checked integer.
michael@0:  *
michael@0:  * Checked integers of different types cannot be used in the same arithmetic
michael@0:  * expression.
michael@0:  *
michael@0:  * There are convenience typedefs for all stdint types, of the following form
michael@0:  * (these are just 2 examples):
michael@0:    @code
michael@0:    typedef CheckedInt<int32_t> CheckedInt32;
michael@0:    typedef CheckedInt<uint16_t> CheckedUint16;
michael@0:    @endcode
michael@0:  */
michael@0: template<typename T>
michael@0: class CheckedInt
michael@0: {
michael@0:   protected:
michael@0:     T mValue;
michael@0:     bool mIsValid;
michael@0: 
michael@0:     template<typename U>
michael@0:     CheckedInt(U aValue, bool aIsValid) : mValue(aValue), mIsValid(aIsValid)
michael@0:     {
michael@0:       static_assert(detail::IsSupported<T>::value &&
michael@0:                     detail::IsSupported<U>::value,
michael@0:                     "This type is not supported by CheckedInt");
michael@0:     }
michael@0: 
michael@0:     friend struct detail::NegateImpl<T>;
michael@0: 
michael@0:   public:
michael@0:     /**
michael@0:      * Constructs a checked integer with given @a value. The checked integer is
michael@0:      * initialized as valid or invalid depending on whether the @a value
michael@0:      * is in range.
michael@0:      *
michael@0:      * This constructor is not explicit. Instead, the type of its argument is a
michael@0:      * separate template parameter, ensuring that no conversion is performed
michael@0:      * before this constructor is actually called. As explained in the above
michael@0:      * documentation for class CheckedInt, this constructor checks that its
michael@0:      * argument is valid.
michael@0:      */
michael@0:     template<typename U>
michael@0:     CheckedInt(U aValue)
michael@0:       : mValue(T(aValue)),
michael@0:         mIsValid(detail::IsInRange<T>(aValue))
michael@0:     {
michael@0:       static_assert(detail::IsSupported<T>::value &&
michael@0:                     detail::IsSupported<U>::value,
michael@0:                     "This type is not supported by CheckedInt");
michael@0:     }
michael@0: 
michael@0:     template<typename U>
michael@0:     friend class CheckedInt;
michael@0: 
michael@0:     template<typename U>
michael@0:     CheckedInt<U> toChecked() const
michael@0:     {
michael@0:       CheckedInt<U> ret(mValue);
michael@0:       ret.mIsValid = ret.mIsValid && mIsValid;
michael@0:       return ret;
michael@0:     }
michael@0: 
michael@0:     /** Constructs a valid checked integer with initial value 0 */
michael@0:     CheckedInt() : mValue(0), mIsValid(true)
michael@0:     {
michael@0:       static_assert(detail::IsSupported<T>::value,
michael@0:                     "This type is not supported by CheckedInt");
michael@0:     }
michael@0: 
michael@0:     /** @returns the actual value */
michael@0:     T value() const
michael@0:     {
michael@0:       MOZ_ASSERT(mIsValid, "Invalid checked integer (division by zero or integer overflow)");
michael@0:       return mValue;
michael@0:     }
michael@0: 
michael@0:     /**
michael@0:      * @returns true if the checked integer is valid, i.e. is not the result
michael@0:      * of an invalid operation or of an operation involving an invalid checked
michael@0:      * integer
michael@0:      */
michael@0:     bool isValid() const
michael@0:     {
michael@0:       return mIsValid;
michael@0:     }
michael@0: 
michael@0:     template<typename U>
michael@0:     friend CheckedInt<U> operator +(const CheckedInt<U>& lhs,
michael@0:                                     const CheckedInt<U>& rhs);
michael@0:     template<typename U>
michael@0:     CheckedInt& operator +=(U rhs);
michael@0: 
michael@0:     template<typename U>
michael@0:     friend CheckedInt<U> operator -(const CheckedInt<U>& lhs,
michael@0:                                     const CheckedInt<U>& rhs);
michael@0:     template<typename U>
michael@0:     CheckedInt& operator -=(U rhs);
michael@0: 
michael@0:     template<typename U>
michael@0:     friend CheckedInt<U> operator *(const CheckedInt<U>& lhs,
michael@0:                                     const CheckedInt<U>& rhs);
michael@0:     template<typename U>
michael@0:     CheckedInt& operator *=(U rhs);
michael@0: 
michael@0:     template<typename U>
michael@0:     friend CheckedInt<U> operator /(const CheckedInt<U>& lhs,
michael@0:                                     const CheckedInt<U>& rhs);
michael@0:     template<typename U>
michael@0:     CheckedInt& operator /=(U rhs);
michael@0: 
michael@0:     template<typename U>
michael@0:     friend CheckedInt<U> operator %(const CheckedInt<U>& lhs,
michael@0:                                     const CheckedInt<U>& rhs);
michael@0:     template<typename U>
michael@0:     CheckedInt& operator %=(U rhs);
michael@0: 
michael@0:     CheckedInt operator -() const
michael@0:     {
michael@0:       return detail::NegateImpl<T>::negate(*this);
michael@0:     }
michael@0: 
michael@0:     /**
michael@0:      * @returns true if the left and right hand sides are valid
michael@0:      * and have the same value.
michael@0:      *
michael@0:      * Note that these semantics are the reason why we don't offer
michael@0:      * a operator!=. Indeed, we'd want to have a!=b be equivalent to !(a==b)
michael@0:      * but that would mean that whenever a or b is invalid, a!=b
michael@0:      * is always true, which would be very confusing.
michael@0:      *
michael@0:      * For similar reasons, operators <, >, <=, >= would be very tricky to
michael@0:      * specify, so we just avoid offering them.
michael@0:      *
michael@0:      * Notice that these == semantics are made more reasonable by these facts:
michael@0:      *  1. a==b implies equality at the raw data level
michael@0:      *     (the converse is false, as a==b is never true among invalids)
michael@0:      *  2. This is similar to the behavior of IEEE floats, where a==b
michael@0:      *     means that a and b have the same value *and* neither is NaN.
michael@0:      */
michael@0:     bool operator ==(const CheckedInt& other) const
michael@0:     {
michael@0:       return mIsValid && other.mIsValid && mValue == other.mValue;
michael@0:     }
michael@0: 
michael@0:     /** prefix ++ */
michael@0:     CheckedInt& operator++()
michael@0:     {
michael@0:       *this += 1;
michael@0:       return *this;
michael@0:     }
michael@0: 
michael@0:     /** postfix ++ */
michael@0:     CheckedInt operator++(int)
michael@0:     {
michael@0:       CheckedInt tmp = *this;
michael@0:       *this += 1;
michael@0:       return tmp;
michael@0:     }
michael@0: 
michael@0:     /** prefix -- */
michael@0:     CheckedInt& operator--()
michael@0:     {
michael@0:       *this -= 1;
michael@0:       return *this;
michael@0:     }
michael@0: 
michael@0:     /** postfix -- */
michael@0:     CheckedInt operator--(int)
michael@0:     {
michael@0:       CheckedInt tmp = *this;
michael@0:       *this -= 1;
michael@0:       return tmp;
michael@0:     }
michael@0: 
michael@0:   private:
michael@0:     /**
michael@0:      * The !=, <, <=, >, >= operators are disabled:
michael@0:      * see the comment on operator==.
michael@0:      */
michael@0:     template<typename U>
michael@0:     bool operator !=(U other) const MOZ_DELETE;
michael@0:     template<typename U>
michael@0:     bool operator <(U other) const MOZ_DELETE;
michael@0:     template<typename U>
michael@0:     bool operator <=(U other) const MOZ_DELETE;
michael@0:     template<typename U>
michael@0:     bool operator >(U other) const MOZ_DELETE;
michael@0:     template<typename U>
michael@0:     bool operator >=(U other) const MOZ_DELETE;
michael@0: };
michael@0: 
michael@0: #define MOZ_CHECKEDINT_BASIC_BINARY_OPERATOR(NAME, OP)                \
michael@0: template<typename T>                                                  \
michael@0: inline CheckedInt<T> operator OP(const CheckedInt<T> &lhs,            \
michael@0:                                  const CheckedInt<T> &rhs)            \
michael@0: {                                                                     \
michael@0:   if (!detail::Is##NAME##Valid(lhs.mValue, rhs.mValue))               \
michael@0:     return CheckedInt<T>(0, false);                                   \
michael@0:                                                                       \
michael@0:   return CheckedInt<T>(lhs.mValue OP rhs.mValue,                      \
michael@0:                        lhs.mIsValid && rhs.mIsValid);                 \
michael@0: }
michael@0: 
michael@0: MOZ_CHECKEDINT_BASIC_BINARY_OPERATOR(Add, +)
michael@0: MOZ_CHECKEDINT_BASIC_BINARY_OPERATOR(Sub, -)
michael@0: MOZ_CHECKEDINT_BASIC_BINARY_OPERATOR(Mul, *)
michael@0: MOZ_CHECKEDINT_BASIC_BINARY_OPERATOR(Div, /)
michael@0: MOZ_CHECKEDINT_BASIC_BINARY_OPERATOR(Mod, %)
michael@0: 
michael@0: #undef MOZ_CHECKEDINT_BASIC_BINARY_OPERATOR
michael@0: 
michael@0: // Implement castToCheckedInt<T>(x), making sure that
michael@0: //  - it allows x to be either a CheckedInt<T> or any integer type
michael@0: //    that can be casted to T
michael@0: //  - if x is already a CheckedInt<T>, we just return a reference to it,
michael@0: //    instead of copying it (optimization)
michael@0: 
michael@0: namespace detail {
michael@0: 
michael@0: template<typename T, typename U>
michael@0: struct CastToCheckedIntImpl
michael@0: {
michael@0:     typedef CheckedInt<T> ReturnType;
michael@0:     static CheckedInt<T> run(U u) { return u; }
michael@0: };
michael@0: 
michael@0: template<typename T>
michael@0: struct CastToCheckedIntImpl<T, CheckedInt<T> >
michael@0: {
michael@0:     typedef const CheckedInt<T>& ReturnType;
michael@0:     static const CheckedInt<T>& run(const CheckedInt<T>& u) { return u; }
michael@0: };
michael@0: 
michael@0: } // namespace detail
michael@0: 
michael@0: template<typename T, typename U>
michael@0: inline typename detail::CastToCheckedIntImpl<T, U>::ReturnType
michael@0: castToCheckedInt(U u)
michael@0: {
michael@0:   static_assert(detail::IsSupported<T>::value &&
michael@0:                 detail::IsSupported<U>::value,
michael@0:                 "This type is not supported by CheckedInt");
michael@0:   return detail::CastToCheckedIntImpl<T, U>::run(u);
michael@0: }
michael@0: 
michael@0: #define MOZ_CHECKEDINT_CONVENIENCE_BINARY_OPERATORS(OP, COMPOUND_OP)  \
michael@0: template<typename T>                                              \
michael@0: template<typename U>                                              \
michael@0: CheckedInt<T>& CheckedInt<T>::operator COMPOUND_OP(U rhs)         \
michael@0: {                                                                 \
michael@0:   *this = *this OP castToCheckedInt<T>(rhs);                      \
michael@0:   return *this;                                                   \
michael@0: }                                                                 \
michael@0: template<typename T, typename U>                                  \
michael@0: inline CheckedInt<T> operator OP(const CheckedInt<T> &lhs, U rhs) \
michael@0: {                                                                 \
michael@0:   return lhs OP castToCheckedInt<T>(rhs);                         \
michael@0: }                                                                 \
michael@0: template<typename T, typename U>                                  \
michael@0: inline CheckedInt<T> operator OP(U lhs, const CheckedInt<T> &rhs) \
michael@0: {                                                                 \
michael@0:   return castToCheckedInt<T>(lhs) OP rhs;                         \
michael@0: }
michael@0: 
michael@0: MOZ_CHECKEDINT_CONVENIENCE_BINARY_OPERATORS(+, +=)
michael@0: MOZ_CHECKEDINT_CONVENIENCE_BINARY_OPERATORS(*, *=)
michael@0: MOZ_CHECKEDINT_CONVENIENCE_BINARY_OPERATORS(-, -=)
michael@0: MOZ_CHECKEDINT_CONVENIENCE_BINARY_OPERATORS(/, /=)
michael@0: MOZ_CHECKEDINT_CONVENIENCE_BINARY_OPERATORS(%, %=)
michael@0: 
michael@0: #undef MOZ_CHECKEDINT_CONVENIENCE_BINARY_OPERATORS
michael@0: 
michael@0: template<typename T, typename U>
michael@0: inline bool
michael@0: operator ==(const CheckedInt<T> &lhs, U rhs)
michael@0: {
michael@0:   return lhs == castToCheckedInt<T>(rhs);
michael@0: }
michael@0: 
michael@0: template<typename T, typename U>
michael@0: inline bool
michael@0: operator ==(U  lhs, const CheckedInt<T> &rhs)
michael@0: {
michael@0:   return castToCheckedInt<T>(lhs) == rhs;
michael@0: }
michael@0: 
michael@0: // Convenience typedefs.
michael@0: typedef CheckedInt<int8_t>   CheckedInt8;
michael@0: typedef CheckedInt<uint8_t>  CheckedUint8;
michael@0: typedef CheckedInt<int16_t>  CheckedInt16;
michael@0: typedef CheckedInt<uint16_t> CheckedUint16;
michael@0: typedef CheckedInt<int32_t>  CheckedInt32;
michael@0: typedef CheckedInt<uint32_t> CheckedUint32;
michael@0: typedef CheckedInt<int64_t>  CheckedInt64;
michael@0: typedef CheckedInt<uint64_t> CheckedUint64;
michael@0: 
michael@0: } // namespace mozilla
michael@0: 
michael@0: #endif /* mozilla_CheckedInt_h */