1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
|
/*
* Copyright 2017 Google Inc.
*
* Use of this source code is governed by a BSD-style license that can be
* found in the LICENSE file.
*/
#ifndef SkSafeMath_DEFINED
#define SkSafeMath_DEFINED
// SkSafeMath always check that a series of operations do not overflow.
// This must be correct for all platforms, because this is a check for safety at runtime.
class SkSafeMath {
public:
SkSafeMath() = default;
bool ok() const { return fOK; }
explicit operator bool() const { return fOK; }
size_t mul(size_t x, size_t y) {
return sizeof(size_t) == sizeof(uint64_t) ? mul64(x, y) : mul32(x, y);
}
size_t add(size_t x, size_t y) {
size_t result = x + y;
fOK &= result >= x;
return result;
}
/**
* Return a + b, unless this result is an overflow/underflow. In those cases, fOK will
* be set to false, and it is undefined what this returns.
*/
int addInt(int a, int b) {
if (b < 0 && a < std::numeric_limits<int>::min() - b) {
fOK = false;
return a;
} else if (b > 0 && a > std::numeric_limits<int>::max() - b) {
fOK = false;
return a;
}
return a + b;
}
size_t alignUp(size_t x, size_t alignment) {
SkASSERT(alignment && !(alignment & (alignment - 1)));
return add(x, alignment - 1) & ~(alignment - 1);
}
template <typename T> T castTo(size_t value) {
if (!SkTFitsIn<T>(value)) {
fOK = false;
}
return static_cast<T>(value);
}
// These saturate to their results
static size_t Add(size_t x, size_t y);
static size_t Mul(size_t x, size_t y);
static size_t Align4(size_t x) {
SkSafeMath safe;
return safe.alignUp(x, 4);
}
private:
uint32_t mul32(uint32_t x, uint32_t y) {
uint64_t bx = x;
uint64_t by = y;
uint64_t result = bx * by;
fOK &= result >> 32 == 0;
return result;
}
uint64_t mul64(uint64_t x, uint64_t y) {
if (x <= std::numeric_limits<uint64_t>::max() >> 32
&& y <= std::numeric_limits<uint64_t>::max() >> 32) {
return x * y;
} else {
auto hi = [](uint64_t x) { return x >> 32; };
auto lo = [](uint64_t x) { return x & 0xFFFFFFFF; };
uint64_t lx_ly = lo(x) * lo(y);
uint64_t hx_ly = hi(x) * lo(y);
uint64_t lx_hy = lo(x) * hi(y);
uint64_t hx_hy = hi(x) * hi(y);
uint64_t result = 0;
result = this->add(lx_ly, (hx_ly << 32));
result = this->add(result, (lx_hy << 32));
fOK &= (hx_hy + (hx_ly >> 32) + (lx_hy >> 32)) == 0;
#if defined(SK_DEBUG) && defined(__clang__) && defined(__x86_64__)
auto double_check = (unsigned __int128)x * y;
SkASSERT(result == (double_check & 0xFFFFFFFFFFFFFFFF));
SkASSERT(!fOK || (double_check >> 64 == 0));
#endif
return result;
}
}
bool fOK = true;
};
#endif//SkSafeMath_DEFINED
|
