220 32913 <98e56e58-69bd-49f0-945c-aa6e7b6b4abb@isocpp.org> article Path: news.gmane.org!.POSTED!not-for-mail From: federico.kircheis@gmail.com Newsgroups: gmane.comp.lang.c++.isocpp.proposals Subject: Re: safe integrals comparison Date: Tue, 27 Jun 2017 10:00:55 -0700 (PDT) Lines: 396 Approved: news@gmane.org Message-ID: <98e56e58-69bd-49f0-945c-aa6e7b6b4abb@isocpp.org> References: <66f9bab2-7220-4bf1-afb7-77c5efa1bac3@isocpp.org> Reply-To: std-proposals@isocpp.org NNTP-Posting-Host: blaine.gmane.org Mime-Version: 1.0 Content-Type: multipart/mixed; boundary="----=_Part_2355_81630189.1498582855788" X-Trace: blaine.gmane.org 1498582864 27852 195.159.176.226 (27 Jun 2017 17:01:04 GMT) X-Complaints-To: usenet@blaine.gmane.org NNTP-Posting-Date: Tue, 27 Jun 2017 17:01:04 +0000 (UTC) Cc: federico.kircheis@gmail.com To: ISO C++ Standard - Future Proposals Original-X-From: std-proposals+bncBCZ3PBGHYEBBBSE6ZLFAKGQEFQYOVOY@isocpp.org Tue Jun 27 19:00:57 2017 Return-path: Envelope-to: gclcip-std-proposals@m.gmane.org Original-Received: from mail-yw0-f200.google.com ([209.85.161.200]) by blaine.gmane.org with esmtp (Exim 4.84_2) (envelope-from ) id 1dPtrB-0006fM-Dt for gclcip-std-proposals@m.gmane.org; Tue, 27 Jun 2017 19:00:53 +0200 Original-Received: by mail-yw0-f200.google.com with SMTP id c13sf23792156ywa.13 for ; Tue, 27 Jun 2017 10:00:59 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=isocpp-org.20150623.gappssmtp.com; s=20150623; h=date:from:to:cc:message-id:in-reply-to:references:subject :mime-version:x-original-sender:reply-to:precedence:mailing-list :list-id:list-post:list-help:list-archive:list-subscribe :list-unsubscribe; bh=2gQgqI9U6Mhd0/TCF+NUD2qvVdC36MeM1wlXHWbCHFI=; b=BxjDkK7oqI40xyHyDvlqIZz0CYkJxkxsWlemr5QDboNmWR/XwoG7cOJHgU1XVq8rwg OvFwAFaxqvcCxLyMzB0apgkFaRXjkTdeAryz0Ekbeobrl4zVmZPsqiO5shEAEG2HW0mh oiBJtdBOqSlk8krx678dGkcP+NL9KLhUyAVSgp7vZJPkxbOL0FPkS5AlPXWjcFhyO9wB F0zlPhxRoQs3gZ+YRMhqMhlqO5hOPfa8PAoqRrtFK1JZUVarNV5BCAj6iU11x2W/gprv 7X7NdvhQgDyRtJt1EdqsZdtW1/VtZrrSWyR46TUllId4FxbDBClB+4ltnHdWTT4eGhRv Ofjg== DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=date:from:to:cc:message-id:in-reply-to:references:subject :mime-version:x-original-sender:reply-to:precedence:mailing-list :list-id:list-post:list-help:list-archive:list-subscribe :list-unsubscribe; bh=2gQgqI9U6Mhd0/TCF+NUD2qvVdC36MeM1wlXHWbCHFI=; b=tph+OjPRAA8jJte+ZLfWX9chw8hgvexFfbmGGTYaWaZ8o09Oc6jzfoo5xHtHR6lKbs ZfwWBMQdM6f3jGa855GT9krD1OVt1mLGGkglkVOCwlAjeqVXKrWQ9QC1A6jhi5BD+sPz jUNAxaJbClq/qcL8/4fSkBvFolks+1dfR62Dno6JCXKOP1icl1IJhzVYsmS9mZ+AKLH0 nTCXM7yM/t8ULbYu+Qh0X52txdLYvnOxQQks3neAOkZII/XOuZ5rhSugSsrucwrvVHJ8 wZCuc7SN2LgALT21MSvbYF37Y+Tx3h5/HtHojQ+yTHr47cODq2EKBQl+XrYyewXFXyWn yi3w== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:date:from:to:cc:message-id:in-reply-to :references:subject:mime-version:x-original-sender:reply-to :precedence:mailing-list:list-id:x-spam-checked-in-group:list-post :list-help:list-archive:list-subscribe:list-unsubscribe; bh=2gQgqI9U6Mhd0/TCF+NUD2qvVdC36MeM1wlXHWbCHFI=; b=l5E4LGmVus0WBXZo8pfRYQIOlp929CMHJWMMazEWt7WG5mKS6cqV7HJjrtT0OZd5GB gv0E5lnw5ONvkTHstBo/0cCiiZSP6BM/nzyjj8ueetxB9hvIxykAbfV40aUhrOSXQt0l 1D4ZLh77hpJVCPiP/NIBEVUdaiMlszBaclECriTGPJQdgTc0C+JXJ3asIm50Jt1X/h9n PbjfuEHrh2kJ2q+lIhNmBTxtFTZPQvb0djF95DZ0wzVbH1k8b8JEFFvg4OuCizOuSWOY mRRWcVfk4NFhkEVYLi8G+NbvATinX+twfswsfbkswLu0qx27CBrEDMl1q3PEXl0Hhi20 a9LQ== X-Gm-Message-State: AKS2vOzGmmy7q3D5HpwqHYQcvnE4WYLmj5AgTKtIMcIWqsSXaiQ44EOZ +2/MnD/citLxMAfP X-Received: by 10.129.33.130 with SMTP id h124mr3639663ywh.125.1498582858350; Tue, 27 Jun 2017 10:00:58 -0700 (PDT) X-BeenThere: std-proposals@isocpp.org Original-Received: by 10.36.58.17 with SMTP id m17ls912347itm.16.canary-gmail; Tue, 27 Jun 2017 10:00:56 -0700 (PDT) X-Received: by 10.36.79.144 with SMTP id c138mr50250itb.2.1498582856485; Tue, 27 Jun 2017 10:00:56 -0700 (PDT) In-Reply-To: <66f9bab2-7220-4bf1-afb7-77c5efa1bac3@isocpp.org> X-Original-Sender: federico.kircheis@gmail.com Precedence: list Mailing-list: list std-proposals@isocpp.org; contact std-proposals+owners@isocpp.org List-ID: X-Google-Group-Id: 399137483710 List-Post: , List-Help: , List-Archive: List-Subscribe: , List-Unsubscribe: , Xref: news.gmane.org gmane.comp.lang.c++.isocpp.proposals:32913 Archived-At: ------=_Part_2355_81630189.1498582855788 Content-Type: multipart/alternative; boundary="----=_Part_2356_678608755.1498582855788" ------=_Part_2356_678608755.1498582855788 Content-Type: text/plain; charset="UTF-8" I've updated my proposal (Proposal number is P0586R0). Just fixed some minor issues and added the proposal number, the content is the same. -- You received this message because you are subscribed to the Google Groups "ISO C++ Standard - Future Proposals" group. To unsubscribe from this group and stop receiving emails from it, send an email to std-proposals+unsubscribe@isocpp.org. To post to this group, send email to std-proposals@isocpp.org. To view this discussion on the web visit https://groups.google.com/a/isocpp.org/d/msgid/std-proposals/98e56e58-69bd-49f0-945c-aa6e7b6b4abb%40isocpp.org. ------=_Part_2356_678608755.1498582855788 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
I've updated my proposal (Proposal number is P0586R0).=

Just fixed some minor issues and added the proposal number, the con= tent is the same.

--
You received this message because you are subscribed to the Google Groups &= quot;ISO C++ Standard - Future Proposals" group.
To unsubscribe from this group and stop receiving emails from it, send an e= mail to std-proposa= ls+unsubscribe@isocpp.org.
To post to this group, send email to std-proposals@isocpp.org.
To view this discussion on the web visit https://groups.google.= com/a/isocpp.org/d/msgid/std-proposals/98e56e58-69bd-49f0-945c-aa6e7b6b4abb= %40isocpp.org.
------=_Part_2356_678608755.1498582855788-- ------=_Part_2355_81630189.1498582855788 Content-Type: text/html; charset=US-ASCII; name=proposal.html Content-Transfer-Encoding: 7bit Content-Disposition: attachment; filename=proposal.html X-Attachment-Id: c20d09fd-08a4-4bc3-b11f-36e733ccb8a1 Content-ID: Safe integral comparisons
Document number: P0586R0
Date: 2017-02-04
Project: Programming Language C++
Reply-to: Federico Kircheis

Safe integral comparisons

I. Table of Contents

II. Motivation

Comparing integrals of different types may be a more complex task than expected. Most of the time we expect that a simple 

if(a < b){
	// ...
} else {
	// ...
}
should work in all cases, but if a and b are of different types, things are more complicated.
If a is a signed type, and b unsigned, then a is converted to the unsigned type. If a held a number less than zero, then the result may be unexpected, since the expression a < b could evaluate to false, even if a strictly negative number is always lower than a positive one.

Also converting integrals between different types can be challenging, for simplicity, most of the time we assume that values are in range, and write 

a = static_cast<decltype(a)>(b);
If we want to write a safe conversion, we need to check if b has a value between std::numeric_limits<decltype(a)>::min() and std::numeric_limits<decltype(a)>::max(). We also need to pay attention that no implicit conversion (for example between unsigned and signed types) invalidates our comparison.

Comparing and converting numbers, even of different numeric types, should be a trivial task. Unfortunately it is not, and because of implicit conversions we may write, without noticing it, unsafe code.

III. Proposal

This paper proposes to add a set of constexpr and noexcept functions for converting and comparing integrals of different signeddes and precision (except for bool):

  • Two functions to compare if two variables represent the same value or not 
    template <typename T, typename U>
constexpr bool std::cmp_equal(T t, U u) noexcept;

template <typename T, typename U>
constexpr bool std::cmp_unequal(T t, U u) noexcept;
  • A set of functions that can be used to determine the relative order of two values 
    template <typename T, typename U>
constexpr bool std::cmp_less(T t, U u) noexcept;

template <typename T, typename U>
constexpr bool std::cmp_greater(T t, U u) noexcept;

template <typename T, typename U>
constexpr bool std::cmp_less_or_equal(T t, U u) noexcept;

template <typename T, typename U>
constexpr bool std::cmp_greater_or_equal(T t, U u) noexcept;
  • One function to determine if a specific value is inside the range of possible values of another type (i.e. if we can convert the value to the other type safely) 
    template <typename R, typename T>
constexpr bool in_range(T t) noexcept;
  • One function for retrieving the precision of a given numeric type 
    template <typename T>
constexpr std::size_t std::precision() noexcept;
The function precision is part of the proposal because we cannot use the operator sizeof to determine between two types which one has a wider range (quote from SecureCoding):
Integer types in C have both a size and a precision. The size indicates the number of bytes used by an object and can be retrieved for any object or type using the sizeof operator. The precision of an integer type is the number of bits it uses to represent values, excluding any sign and padding bits. Padding bits contribute to the integer's size, but not to its precision. Consequently, inferring the precision of an integer type from its size may result in too large a value, which can then lead to incorrect assumptions about the numeric range of these types. Programmers should use correct integer precisions in their code, and in particular, should not use the sizeof operator to compute the precision of an integer type on architectures that use padding bits or in strictly conforming (that is, portable) programs.

IV. Examples

Examples without current proposal

Comparing an unsigned int with an int: 

int a = ...
unsigned int b = ...
// added static_cast to avoid compiler warnings since we are doing a "safe" comparison
if(a < 0 || static_cast<unsigned int>(a) < b){
	// do X
} else {
	// do Y
}
Comparing an uint32_t with an int16_t: 
int32_t a = ...
uint16_t b = ...
// added static_cast to avoid compiler warnings since we are doing a "safe" comparison
if(a < static_cast<int32_t>(b)){
	// do X
} else {
	// do Y
}
Comparing an int with an intptr_t: 
int a = ...
intptr_t b = ...
if(???){ // no idea how to do it in one readable line without some assumption about int and intptr_t
	// do X
} else {
	// do Y
}

Example with current proposal

Comparing one integral type A with another integral type B (both non bool): 
A a = ...
B b = ...
// no need for any cast since std::cmp_less is taking care of everything
if( std::cmp_less(a,b)){
	// do X
} else {
	// do Y
}

V. Sample implementation

This section shows an example of how precision, cmp_equal, cmp_less and in_range can be implemented with any standard conforming C++11 compiler, without any language extension. The only dependencies are the std::numeric_limits function from the limits header and some traits from the type_traits header. 


#include <limits>
#include <type_traits>

template <typename T>
constexpr std::size_t precision() noexcept;

namespace details{
#if defined(ERR_MSG_xxx_NEEDS_INTEGRAL_NOT_BOOL) || defined(ASSERT_INTEGRAL_NOT_BOOL_TYPE)
#error "ERR_MSG_xxx_NEEDS_INTEGRAL_NOT_BOOL or ASSERT_INTEGRAL_NOT_BOOL_TYPE already defined"
#endif
#define ERR_MSG_xxx_NEEDS_INTEGRAL_NOT_BOOL " needs to be an integral (not bool) value type"
#define ASSERT_INTEGRAL_NOT_BOOL_TYPE(T) static_assert(is_integral_not_bool<T>(), #T ERR_MSG_xxx_NEEDS_INTEGRAL_NOT_BOOL);

template <typename T>
constexpr bool is_integral_not_bool(){
	using value_type = typename std::remove_cv<T>::type;
	return !std::is_same<value_type,bool>::value && std::is_integral<T>::value;
}

template <class T>
constexpr std::size_t pop(const std::size_t precision, const T num) {
	ASSERT_INTEGRAL_NOT_BOOL_TYPE(T);
	return (num == T{0}) ? precision : pop(((num % 2 != 0) ? precision+1 : precision), num >> 1);
}


// could use the same implementation of in_range_signed_signed, but compiler may generate warning that t is always bigger than 0
template <typename R, typename T>
constexpr bool in_range_unsigned_unsigned(const T t) noexcept {
	ASSERT_INTEGRAL_NOT_BOOL_TYPE(T);
	ASSERT_INTEGRAL_NOT_BOOL_TYPE(R);
	return (precision<T>() > precision<R>()) ?
	    (t < static_cast<T>(std::numeric_limits<R>::max())) :
	    (static_cast<R>(t) <std::numeric_limits<R>::max());
}

template <typename R, typename T>
constexpr bool in_range_signed_signed(const T t) noexcept {
	ASSERT_INTEGRAL_NOT_BOOL_TYPE(T);
	ASSERT_INTEGRAL_NOT_BOOL_TYPE(R);
	return (precision<T>() > precision<R>()) ?
	    (t <= static_cast<T>(std::numeric_limits<R>::max()) && t >= static_cast<T>(std::numeric_limits<R>::min())) :
	    (static_cast<R>(t) <= std::numeric_limits<R>::max() && static_cast<R>(t) >= std::numeric_limits<R>::max());
}

template <typename R, typename T>
constexpr bool in_range_signed_unsigned(const T t) noexcept {
	ASSERT_INTEGRAL_NOT_BOOL_TYPE(T);
	ASSERT_INTEGRAL_NOT_BOOL_TYPE(R);
	return (t < T{ 0 }) ? false :
	    (precision<T>() / 2 <= precision<R>()) ? true :
	    (t <= static_cast<T>(std::numeric_limits<R>::max()));
}

template <typename R, typename T>
constexpr bool in_range_unsigned_signed(const T t) noexcept {
	ASSERT_INTEGRAL_NOT_BOOL_TYPE(T);
	ASSERT_INTEGRAL_NOT_BOOL_TYPE(R);
	return (precision<T>() >= precision<R>() / 2) ? (t <= static_cast<T>(std::numeric_limits<R>::max())) : true;
}

template <typename R, typename T>
constexpr bool in_range_unsigned(const T t) noexcept {
	return std::is_unsigned<R>::value ? in_range_unsigned_unsigned<R>(t) : in_range_unsigned_signed<R>(t);
}

template <typename R, typename T>
constexpr bool in_range_signed(const T t) noexcept {
	return std::is_signed<R>::value ? in_range_signed_signed<R>(t) : in_range_signed_unsigned<R>(t);
}

template <typename T, typename U>
constexpr bool cmp_equal_same_sign(const T t, const U u) noexcept {
	ASSERT_INTEGRAL_NOT_BOOL_TYPE(T);
	ASSERT_INTEGRAL_NOT_BOOL_TYPE(U);
	return (precision<T>()>precision<U>()) ? (t == static_cast<T>(u)) : (static_cast<U>(t) == u);
}

template <typename T, typename U>
constexpr bool cmp_equal_signed_unsigned(const T t, const U u) noexcept {
	ASSERT_INTEGRAL_NOT_BOOL_TYPE(T);
	ASSERT_INTEGRAL_NOT_BOOL_TYPE(U);
	return (t<T{ 0 }) ? false : (precision<T>() / 2>precision<U>()) ? (t == static_cast<T>(u)) : (static_cast<U>(t) == u);
}

template <typename T, typename U>
constexpr bool cmp_less_same_sign(const T t, const U u) noexcept {
	ASSERT_INTEGRAL_NOT_BOOL_TYPE(T);
	ASSERT_INTEGRAL_NOT_BOOL_TYPE(U);
	return (precision<T>()>precision<U>()) ? (t < static_cast<T>(u)) : (static_cast<U>(t) < u);
}

template <typename T, typename U>
constexpr bool cmp_less_signed_unsigned(const T t, const U u) noexcept {
	ASSERT_INTEGRAL_NOT_BOOL_TYPE(T);
	ASSERT_INTEGRAL_NOT_BOOL_TYPE(U);
	return (t<T{ 0 }) ? true : (precision<T>() / 2>precision<U>()) ? (t < static_cast<T>(u)) : (static_cast<U>(t) < u);
}

template <typename T, typename U>
constexpr bool cmp_less_unsigned_signed(const T t, const U u) noexcept {
	ASSERT_INTEGRAL_NOT_BOOL_TYPE(T);
	ASSERT_INTEGRAL_NOT_BOOL_TYPE(U);
	return (u<U{ 0 }) ? false : (precision<U>() / 2>precision<T>()) ? (static_cast<U>(t) < u) : (t < static_cast<T>(u));
}

#undef ERR_MSG_xxx_NEEDS_INTEGRAL_NOT_BOOL
#undef ASSERT_INTEGRAL_NOT_BOOL_TYPE
} // end details

template <typename T>
constexpr std::size_t precision() noexcept {
	return details::pop(0, std::numeric_limits<T>::max());
}

/// Usage:
/// size_t i = ...
/// if(in_range<DWORD>(i)){
///  // safe to use i as a DWORD value, parameter...
/// } else {
///  // not possible to rappresent i as a DWORD
/// }
template <typename R, typename T>
constexpr bool in_range(const T t) noexcept {
	return std::is_unsigned<T>::value ? details::in_range_unsigned<R>(t) : details::in_range_signed<R>(t);
}

// equivalent of operator== for different types
/// Usage:
/// size_t i = ...
/// DWORD j = ...
/// if(cmp_equal(i,j)){
///  // i and j rappresent the same quantity
/// } else {
///  // i and j rappresents different quantities
/// }
template <typename T, typename U>
constexpr bool cmp_equal(const T t, const U u) noexcept {
	return
	    (std::is_signed<T>::value == std::is_signed<U>::value) ? details::cmp_equal_same_sign(t, u) :
	    (std::is_signed<T>::value) ? details::cmp_equal_signed_unsigned(t, u) : details::cmp_equal_signed_unsigned(u,t);
}

// equivalent of operator< for different integral types
/// Usage:
/// size_t i = ...
/// DWORD j = ...
/// if(cmp_less(i,j)){
///  // i < j
/// } else {
///  // i >= j
/// }
template <typename T, typename U>
constexpr bool cmp_less(const T t, const U u) noexcept {
	return
	    (std::is_signed<T>::value == std::is_signed<U>::value) ? details::cmp_less_same_sign(t,u) :
	    (std::is_signed<T>::value) ? details::cmp_less_signed_unsigned(t, u) : details::cmp_less_unsigned_signed(t, u);
}

VI. Effects on Existing Code

Since the proposed functions are not defined in any standard header, no currently existing code behavior will be changed.

VII. Design Decisions

Since there is no reason to compare true and false with other integral types, there isn't one to provide an overload for the bool integral type either.
The name of the functions (cmp_equal, cmp_less and others) are open to discussion, but the function names std::less and std::greater should not be used, since these do already exist, and have a different meaning.

------=_Part_2355_81630189.1498582855788-- .