220 33245 <10063dea-8668-4096-a0da-58a142229e13@isocpp.org> article Path: news.gmane.org!.POSTED!not-for-mail From: federico.kircheis@gmail.com Newsgroups: gmane.comp.lang.c++.isocpp.proposals Subject: Re: safe integrals comparison Date: Tue, 18 Jul 2017 09:57:57 -0700 (PDT) Lines: 400 Approved: news@gmane.org Message-ID: <10063dea-8668-4096-a0da-58a142229e13@isocpp.org> References: <66f9bab2-7220-4bf1-afb7-77c5efa1bac3@isocpp.org> <4c552140-4029-4b28-af22-9e2843993516@isocpp.org> Reply-To: std-proposals@isocpp.org NNTP-Posting-Host: blaine.gmane.org Mime-Version: 1.0 Content-Type: multipart/mixed; boundary="----=_Part_2200_1803443752.1500397077513" X-Trace: blaine.gmane.org 1500397086 25847 195.159.176.226 (18 Jul 2017 16:58:06 GMT) X-Complaints-To: usenet@blaine.gmane.org NNTP-Posting-Date: Tue, 18 Jul 2017 16:58:06 +0000 (UTC) Cc: federico.kircheis@gmail.com To: ISO C++ Standard - Future Proposals Original-X-From: std-proposals+bncBCZ3PBGHYEBBBFX4XDFQKGQEIOP2Z7Y@isocpp.org Tue Jul 18 18:58:00 2017 Return-path: Envelope-to: gclcip-std-proposals@m.gmane.org Original-Received: from mail-pf0-f200.google.com ([209.85.192.200]) by blaine.gmane.org with esmtp (Exim 4.84_2) (envelope-from ) id 1dXVoo-00065m-7M for gclcip-std-proposals@m.gmane.org; Tue, 18 Jul 2017 18:57:54 +0200 Original-Received: by mail-pf0-f200.google.com with SMTP id p1sf25782017pfl.2 for ; Tue, 18 Jul 2017 09:58:00 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=isocpp-org.20150623.gappssmtp.com; s=20150623; h=date:from:to:cc:message-id:in-reply-to:references:subject :mime-version:x-original-sender:reply-to:precedence:mailing-list :list-id:list-post:list-help:list-archive:list-subscribe :list-unsubscribe; bh=dHnE2iSbNAnV4TQT2lu4ff2po6GU9qctPsxNWVHcq1I=; b=DKeXjBvzqDqPe6MkalEmxPngkPLxtBQKzGijRqnVEUCz6DZV3DVFv+Nrzh+vGOhOkl 9mrWeiU+mFGEaTA4kZlV2JC5nFJSG5vhUKNlQTQqIV36j6sHbnaWnZaSEbCXyA73WeP2 JFUq8G8+0SDdPdv77aa6iQEa7psW4ViOrhOpYO8QD9PYdlbfCSzT5gCRZKzHy77VcdWE DKPfoliQg7gXmnPYv8acaqNVSLQHQHAu/BnqqT3CDm0qwK3e7fz3hHiMO1AnhgrrnZRt e+auXndnjLH+ynRtNV1GbK/O8S+NbZMLuBGZT2NYfaJGqxnxLXSdc3v/ZSUIIxt8dHCb zuMw== DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=date:from:to:cc:message-id:in-reply-to:references:subject :mime-version:x-original-sender:reply-to:precedence:mailing-list :list-id:list-post:list-help:list-archive:list-subscribe :list-unsubscribe; bh=dHnE2iSbNAnV4TQT2lu4ff2po6GU9qctPsxNWVHcq1I=; b=GE6exqWH8i/vHy+2xiNgAEiqM0zacW+dLImTTmuG27beE3m+Qr6BaNuVk+VJ+npVTG ME26ATrLawPoKPUdxRlE7+ZWJvnlmAy8bncL65/Mwqz6mdnFN/TDskA8XCg6kHkIA+3e bhJzMSy6Oh5FzeDWADcfFEYxnQMMGIUw7mu4RU4bi5MzMtU9lmn41hmX96zCPYvvLBer UNOg8Yyeh264wJPEfpCG+96f8B0V8eLlYnWH5MdOdBJ9WCppVSqitiFwZ0rBIFFcYDCl x1bYtd8PeKjt66/BOwNM21gXrsiHr+Jl94QxjPjMocpnuoljrsAdrNIyXZuwNZ3qPZHi +p/Q== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:date:from:to:cc:message-id:in-reply-to :references:subject:mime-version:x-original-sender:reply-to :precedence:mailing-list:list-id:x-spam-checked-in-group:list-post :list-help:list-archive:list-subscribe:list-unsubscribe; bh=dHnE2iSbNAnV4TQT2lu4ff2po6GU9qctPsxNWVHcq1I=; b=JBmbyuvS/5i8W6BoC+VwC4lLjnIxaS2eZ6kKdf78WJEJlGGiP5RWoTdnnSR6u+8CVI EqmWgdnEtjy98hHiE5tdffuWrQlRrcICWZG0F9AKE1RUXcd7EmKVEE6Gr+94TyIAO7f0 OGPjWDlRr5xliWpheqnVFmHNIik9yVGFnE3WwzB/pqKsLNKxO4Q0SfC+/nXkWrj7m++b OgvOP9TbVVlP1SnqNb8FXPNL7XP+SUEcJbF+SXb9zk+K+jm2NE1XmCOgm1Cu9bnexJ7B dmdu4bwpYRoCye+St9vt02E66mzuqiDeGbCSQOLzW9OwVQFc6eESuH1WQ7hMI0x3jS65 PSqA== X-Gm-Message-State: AIVw111tcF5/1o68I3nhjlkomUrq8fu8BjRfgg4XpTi5/UnMRA8qypgN mn2qGfFNEp4iC/2s X-Received: by 10.99.177.67 with SMTP id g3mr1576954pgp.104.1500397079381; Tue, 18 Jul 2017 09:57:59 -0700 (PDT) X-BeenThere: std-proposals@isocpp.org Original-Received: by 10.36.74.139 with SMTP id k133ls5676588itb.7.canary-gmail; Tue, 18 Jul 2017 09:57:58 -0700 (PDT) X-Received: by 10.31.174.216 with SMTP id x207mr9101vke.10.1500397078258; Tue, 18 Jul 2017 09:57:58 -0700 (PDT) In-Reply-To: <4c552140-4029-4b28-af22-9e2843993516@isocpp.org> X-Original-Sender: federico.kircheis@gmail.com Precedence: list Mailing-list: list std-proposals@isocpp.org; contact std-proposals+owners@isocpp.org List-ID: X-Google-Group-Id: 399137483710 List-Post: , List-Help: , List-Archive: List-Subscribe: , List-Unsubscribe: , Xref: news.gmane.org gmane.comp.lang.c++.isocpp.proposals:33245 Archived-At: ------=_Part_2200_1803443752.1500397077513 Content-Type: multipart/alternative; boundary="----=_Part_2201_1963458137.1500397077514" ------=_Part_2201_1963458137.1500397077514 Content-Type: text/plain; charset="UTF-8" Forgot to attach the new proposal ;-) On Tuesday, July 18, 2017 at 6:57:04 PM UTC+2, federico...@gmail.com wrote: > > Updated the proposal again, > > I've removed the precision function, John McFarian was right about > "std::numeric_limits::digits" and set the version number to D0586R1, > since it is still a draft. > > > is_losslessly_convertible might be a nice compile-time function, but I > think that in_range with the std::numeric_limits::max and > std::numeric_limits::min value will gave you the same result (and it can > of course be used at compile-time too). > -- You received this message because you are subscribed to the Google Groups "ISO C++ Standard - Future Proposals" group. To unsubscribe from this group and stop receiving emails from it, send an email to std-proposals+unsubscribe@isocpp.org. To post to this group, send email to std-proposals@isocpp.org. To view this discussion on the web visit https://groups.google.com/a/isocpp.org/d/msgid/std-proposals/10063dea-8668-4096-a0da-58a142229e13%40isocpp.org. ------=_Part_2201_1963458137.1500397077514 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
Forgot to attach the new proposal ;-)

On Tuesday, J= uly 18, 2017 at 6:57:04 PM UTC+2, federico...@gmail.com wrote:
Updated the proposal again= ,

I've removed the precision function, John McFarian was right a= bout "std::numeric_limits<T>::digits" and set the vers= ion number to D0586R1, since it is still a draft.


is_losslessly_= convertible might be a nice compile-time function, but I think that in_rang= e with the std::numeric_limits<T>::max and std::numeric_limits<T&g= t;::min value will gave you the same result (and it can of course be used a= t compile-time too).

--
You received this message because you are subscribed to the Google Groups &= quot;ISO C++ Standard - Future Proposals" group.
To unsubscribe from this group and stop receiving emails from it, send an e= mail to std-proposa= ls+unsubscribe@isocpp.org.
To post to this group, send email to std-proposals@isocpp.org.
To view this discussion on the web visit https://groups.google.= com/a/isocpp.org/d/msgid/std-proposals/10063dea-8668-4096-a0da-58a142229e13= %40isocpp.org.
------=_Part_2201_1963458137.1500397077514-- ------=_Part_2200_1803443752.1500397077513 Content-Type: text/html; charset=US-ASCII; name=proposal.html Content-Transfer-Encoding: 7bit Content-Disposition: attachment; filename=proposal.html X-Attachment-Id: c59e2312-90c2-4802-b4cb-a663187335f7 Content-ID: Safe integral comparisons
Document number: D0586R1
Date: 2017-02-04
Project: Programming Language C++
Reply-to: Federico Kircheis

Safe integral comparisons

I. Table of Contents

II. Motivation

Comparing integrals of different types may be a more complex task than expected. Most of the time we expect that a simple 

	if(a < b){
		// ...
	} else {
		// ...
	}

should work in all cases, but if a and b are of different types, things are more complicated.
If a is a signed type, and b unsigned, then a is converted to the unsigned type. If a held a number less than zero, then the result may be unexpected, since the expression a < b could evaluate to false, even if a strictly negative number is always lower than a positive one.

Also converting integrals between different types can be challenging, for simplicity, most of the time we assume that values are in range, and write 

	a = static_cast<decltype(a)>(b);

If we want to write a safe conversion, we need to check if b has a value between std::numeric_limits<decltype(a)>::min() and std::numeric_limits<decltype(a)>::max(). We also need to pay attention that no implicit conversion (for example between unsigned and signed types) invalidates our comparison.

Comparing and converting numbers, even of different numeric types, should be a trivial task. Unfortunately it is not, and because of implicit conversions we may write, without noticing it, unsafe code.

III. Proposal

This paper proposes to add a set of constexpr and noexcept functions for converting and comparing integrals of different signeddes (except for bool):

  • Two functions to compare if two variables represent the same value or not 
    	template <typename T, typename U>
	constexpr bool std::cmp_equal(T t, U u) noexcept;

	template <typename T, typename U>
	constexpr bool std::cmp_unequal(T t, U u) noexcept;
  • A set of functions that can be used to determine the relative order of two values 
    	template <typename T, typename U>
	constexpr bool std::cmp_less(T t, U u) noexcept;

	template <typename T, typename U>
	constexpr bool std::cmp_greater(T t, U u) noexcept;

	template <typename T, typename U>
	constexpr bool std::cmp_less_or_equal(T t, U u) noexcept;

	template <typename T, typename U>
	constexpr bool std::cmp_greater_or_equal(T t, U u) noexcept;
  • One function to determine if a specific value is inside the range of possible values of another type (i.e. if we can convert the value to the other type safely) 
    	template <typename R, typename T>
	constexpr bool in_range(T t) noexcept;

    IV. Examples

    Examples without current proposal

    Comparing an unsigned int with an int:

    	int a = ...
	unsigned int b = ...
	// added static_cast to avoid compiler warnings since we are doing a "safe" comparison
	if(a < 0 || static_cast<unsigned int>(a) < b){
		// do X
	} else {
		// do Y
	}

    Comparing an uint32_t with an int16_t:

    	int32_t a = ...
	uint16_t b = ...
	// added static_cast to avoid compiler warnings since we are doing a "safe" comparison
	if(a < static_cast<int32_t>(b)){
		// do X
	} else {
		// do Y
	}

    Comparing an int with an intptr_t:

    	int a = ...
	intptr_t b = ...
	if(???){ // no idea how to do it in one readable line without some assumption about int and intptr_t
		// do X
	} else {
		// do Y
	}

    Example with current proposal

    Comparing one integral type A with another integral type B (both non bool): 

    	A a = ...
	B b = ...
	// no need for any cast since std::cmp_less is taking care of everything
	if( std::cmp_less(a,b)){
		// do X
	} else {
		// do Y
	}

    V. Possible implementation

    This section shows an example of how cmp_equal, cmp_less and in_range can be implemented with any standard conforming C++11 compiler. The only dependencies are the std::numeric_limits function from the limits header and some traits from the type_traits header. This implementation can also be found on github. 

    
	#include <limits>
	#include <type_traits>

	namespace details{
	#if defined(ERR_MSG_xxx_NEEDS_INTEGRAL_NOT_BOOL) || defined(ASSERT_INTEGRAL_NOT_BOOL_TYPE)
	#error "ERR_MSG_xxx_NEEDS_INTEGRAL_NOT_BOOL or ASSERT_INTEGRAL_NOT_BOOL_TYPE already defined"
	#endif
	#define ERR_MSG_xxx_NEEDS_INTEGRAL_NOT_BOOL " needs to be an integral (not bool) value type"
	#define ASSERT_INTEGRAL_NOT_BOOL_TYPE(T) static_assert(is_integral_not_bool<T>(), #T ERR_MSG_xxx_NEEDS_INTEGRAL_NOT_BOOL);

	template <typename T>
	constexpr bool is_integral_not_bool(){
		using value_type = typename std::remove_cv<T>::type;
		return !std::is_same<value_type,bool>::value && std::is_integral<T>::value;
	}

	// could use the same implementation of in_range_signed_signed, but compiler may generate warning that t is always bigger than 0
	template <typename R, typename T>
	constexpr bool in_range_unsigned_unsigned(const T t) noexcept {
		ASSERT_INTEGRAL_NOT_BOOL_TYPE(T);
		ASSERT_INTEGRAL_NOT_BOOL_TYPE(R);
		return (std::numeric_limits<T>::digits  > std::numeric_limits<R>::digits ) ?
		    (t < static_cast<T>(std::numeric_limits<R>::max())) :
		    (static_cast<R>(t) <std::numeric_limits<R>::max());
	}

	template <typename R, typename T>
	constexpr bool in_range_signed_signed(const T t) noexcept {
		ASSERT_INTEGRAL_NOT_BOOL_TYPE(T);
		ASSERT_INTEGRAL_NOT_BOOL_TYPE(R);
		return (std::numeric_limits<T>::digits  > std::numeric_limits<R>::digits ) ?
		    (t <= static_cast<T>(std::numeric_limits<R>::max()) && t >= static_cast<T>(std::numeric_limits<R>::min())) :
		    (static_cast<R>(t) <= std::numeric_limits<R>::max() && static_cast<R>(t) >= std::numeric_limits<R>::max());
	}

	template <typename R, typename T>
	constexpr bool in_range_signed_unsigned(const T t) noexcept {
		ASSERT_INTEGRAL_NOT_BOOL_TYPE(T);
		ASSERT_INTEGRAL_NOT_BOOL_TYPE(R);
		return (t < T{ 0 }) ? false :
		    (std::numeric_limits<T>::digits  / 2 <= std::numeric_limits<R>::digits ) ? true :
		    (t <= static_cast<T>(std::numeric_limits<R>::max()));
	}

	template <typename R, typename T>
	constexpr bool in_range_unsigned_signed(const T t) noexcept {
		ASSERT_INTEGRAL_NOT_BOOL_TYPE(T);
		ASSERT_INTEGRAL_NOT_BOOL_TYPE(R);
		return (std::numeric_limits<T>::digits  >= std::numeric_limits<R>::digits  / 2) ? (t <= static_cast<T>(std::numeric_limits<R>::max())) : true;
	}

	template <typename R, typename T>
	constexpr bool in_range_unsigned(const T t) noexcept {
		return std::is_unsigned<R>::value ? in_range_unsigned_unsigned<R>(t) : in_range_unsigned_signed<R>(t);
	}

	template <typename R, typename T>
	constexpr bool in_range_signed(const T t) noexcept {
		return std::is_signed<R>::value ? in_range_signed_signed<R>(t) : in_range_signed_unsigned<R>(t);
	}

	template <typename T, typename U>
	constexpr bool cmp_equal_same_sign(const T t, const U u) noexcept {
		ASSERT_INTEGRAL_NOT_BOOL_TYPE(T);
		ASSERT_INTEGRAL_NOT_BOOL_TYPE(U);
		return (std::numeric_limits<T>::digits > std::numeric_limits<U>::digits ) ? (t == static_cast<T>(u)) : (static_cast<U>(t) == u);
	}

	template <typename T, typename U>
	constexpr bool cmp_equal_signed_unsigned(const T t, const U u) noexcept {
		ASSERT_INTEGRAL_NOT_BOOL_TYPE(T);
		ASSERT_INTEGRAL_NOT_BOOL_TYPE(U);
		return (t<T{ 0 }) ? false : (std::numeric_limits<T>::digits  / 2> std::numeric_limits<U>::digits  ) ? (t == static_cast<T>(u)) : (static_cast<U>(t) == u);
	}

	template <typename T, typename U>
	constexpr bool cmp_less_same_sign(const T t, const U u) noexcept {
		ASSERT_INTEGRAL_NOT_BOOL_TYPE(T);
		ASSERT_INTEGRAL_NOT_BOOL_TYPE(U);
		return (std::numeric_limits<T>::digits >std::numeric_limits<U>::digits ) ? (t < static_cast<T>(u)) : (static_cast<U>(t) < u);
	}

	template <typename T, typename U>
	constexpr bool cmp_less_signed_unsigned(const T t, const U u) noexcept {
		ASSERT_INTEGRAL_NOT_BOOL_TYPE(T);
		ASSERT_INTEGRAL_NOT_BOOL_TYPE(U);
		return (t<T{ 0 }) ? true : (std::numeric_limits<T>::digits  / 2>std::numeric_limits<U>::digits ) ? (t < static_cast<T>(u)) : (static_cast<U>(t) < u);
	}

	template <typename T, typename U>
	constexpr bool cmp_less_unsigned_signed(const T t, const U u) noexcept {
		ASSERT_INTEGRAL_NOT_BOOL_TYPE(T);
		ASSERT_INTEGRAL_NOT_BOOL_TYPE(U);
		return (u<U{ 0 }) ? false : (std::numeric_limits<U>::digits  / 2>std::numeric_limits<T>::digits ) ? (static_cast<U>(t) < u) : (t < static_cast<T>(u));
	}

	#undef ERR_MSG_xxx_NEEDS_INTEGRAL_NOT_BOOL
	#undef ASSERT_INTEGRAL_NOT_BOOL_TYPE
	} // end details

	/// Usage:
	/// size_t i = ...
	/// if(in_range<DWORD>(i)){
	///  // safe to use i as a DWORD value, parameter...
	/// } else {
	///  // not possible to rappresent i as a DWORD
	/// }
	template <typename R, typename T>
	constexpr bool in_range(const T t) noexcept {
		return std::is_unsigned<T>::value ? details::in_range_unsigned<R>(t) : details::in_range_signed<R>(t);
	}

	// equivalent of operator== for different types
	/// Usage:
	/// size_t i = ...
	/// DWORD j = ...
	/// if(cmp_equal(i,j)){
	///  // i and j rappresent the same quantity
	/// } else {
	///  // i and j rappresents different quantities
	/// }
	template <typename T, typename U>
	constexpr bool cmp_equal(const T t, const U u) noexcept {
		return
		    (std::is_signed<T>::value == std::is_signed<U>::value) ? details::cmp_equal_same_sign(t, u) :
		    (std::is_signed<T>::value) ? details::cmp_equal_signed_unsigned(t, u) : details::cmp_equal_signed_unsigned(u,t);
	}

	// equivalent of operator< for different integral types
	/// Usage:
	/// size_t i = ...
	/// DWORD j = ...
	/// if(cmp_less(i,j)){
	///  // i < j
	/// } else {
	///  // i >= j
	/// }
	template <typename T, typename U>
	constexpr bool cmp_less(const T t, const U u) noexcept {
		return
		    (std::is_signed<T>::value == std::is_signed<U>::value) ? details::cmp_less_same_sign(t,u) :
		    (std::is_signed<T>::value) ? details::cmp_less_signed_unsigned(t, u) : details::cmp_less_unsigned_signed(t, u);
	}

    VI. Effects on Existing Code

    Since the proposed functions are not defined in any standard header, no currently existing code behavior will be changed.

    VII. Design Decisions

    Since there is no reason to compare true and false with other integral types, there isn't one to provide an overload for the bool integral type either.
    The name of the functions (cmp_equal, cmp_less and others) are open to discussion, but the function names std::less and std::greater should not be used, since these do already exist, and have a different meaning.

    In 2016, Robert Ramey did a much bigger proposal (see p0228r0) regaridng safe integer types. He also used similar functions proposed in this paper for implementing his classes and operators, therefore an alternative implementation can be found on his github repository. This proposal addresses a smaller problem, namely comparing integral values, and is therefore much smaller.
    The functions provided can be also used for creating safe integer types.

    Another work, by Herb Sutter (see p0515r0), is about a new comparison operator (<=>). As far as I've understood the proposal the operator<=> should compare correctly different integral types, making part of this proposal obsolete if the operator is added to the language. While it would be a nice thing to have, having a new comparison operator that operates differently from the old operators may be counterintuitive and cause confusion, even if the new behaviour is more correct.

    ------=_Part_2200_1803443752.1500397077513-- .