Compiler Explorer

Source code

//amalgated source of lib safe_compare
#pragma once
#include <cassert>
#include <cstdlib>
#include <iostream>
#include <limits>
#include <sstream>
#include <stdexcept>
#include <type_traits>
// begin include of file safe_compare/detail/wrapped_integer.hpp
/*
 * This is a placeholder for where to put internal details of the library.
 *
 * By Paul Dreik 20181003
 *
 * License:
 * dual license, pick your choice. Either Boost license 1.0, or GPL(v2 or later,
 * at your option).
 */

namespace safe_compare {
inline namespace v1 {

template<class Integer,
         std::enable_if_t<std::is_integral<Integer>::value, Integer> = 0>
struct Value
{
  enum properties
  {
    is_signed = std::numeric_limits<Integer>::is_signed
  };
  Integer m_value;
};

namespace detail {
template<class Integer>
std::make_unsigned_t<Integer>
make_unsigned(Integer x)
{
  assert(x >= 0 && "internal programming error - call only on positive values");
  return x;
}
}

// disable warnings for signed/unsigned
#pragma warning(push)
#pragma warning(disable : 4018)

template<class Integer1, class Integer2>
bool
operator<(const Value<Integer1>& left, const Value<Integer2>& right)
{
  if (+Value<Integer1>::is_signed == +Value<Integer2>::is_signed) {
    // both are signed, or both are unsigned. c++ default rules will work
    // fine here.
    return left.m_value < right.m_value;
  }

if (Value<Integer1>::is_signed) {
    // left is signed - right is unsigned. careful check needed.
    return left.m_value < 0 ||
           detail::make_unsigned(left.m_value) < right.m_value;
  } else {
    // left is unsigned - right is signed. careful check needed.
    return right.m_value >= 0 &&
           left.m_value < detail::make_unsigned(right.m_value);
  }
}

template<class Integer1, class Integer2>
bool
operator<=(const Value<Integer1>& left, const Value<Integer2>& right)
{
  if (+Value<Integer1>::is_signed == +Value<Integer2>::is_signed) {
    // both are signed, or both are unsigned. c++ default rules will work
    // fine here.
    return left.m_value <= right.m_value;
  }

if (Value<Integer1>::is_signed) {
    // left is signed - right is unsigned. careful check needed.
    return left.m_value <= 0 ||
           detail::make_unsigned(left.m_value) <= right.m_value;
  } else {
    // left is unsigned - right is signed. careful check needed.
    return right.m_value >= 0 &&
           left.m_value <= detail::make_unsigned(right.m_value);
  }
}

template<class Integer1, class Integer2>
bool
operator>(const Value<Integer1>& left, const Value<Integer2>& right)
{
  if (+Value<Integer1>::is_signed == +Value<Integer2>::is_signed) {
    // both are signed, or both are unsigned. c++ default rules will work
    // fine here.
    return left.m_value > right.m_value;
  }

if (Value<Integer1>::is_signed) {
    // left is signed - right is unsigned. careful check needed.
    // 1>1U
    return left.m_value > 0 &&
           detail::make_unsigned(left.m_value) > right.m_value;
  } else {
    // left is unsigned - right is signed. careful check needed.
    // 1U>1
    return right.m_value < 0 ||
           left.m_value > detail::make_unsigned(right.m_value);
  }
}

template<class Integer1, class Integer2>
bool
operator>=(const Value<Integer1>& left, const Value<Integer2>& right)
{
  if (+Value<Integer1>::is_signed == +Value<Integer2>::is_signed) {
    // both are signed, or both are unsigned. c++ default rules will work
    // fine here.
    return left.m_value >= right.m_value;
  }

if (Value<Integer1>::is_signed) {
    // left is signed - right is unsigned. careful check needed.
    // 1>=1U
    return left.m_value >= 0 &&
           detail::make_unsigned(left.m_value) >= right.m_value;
  } else {
    // left is unsigned - right is signed. careful check needed.
    // 1U>=1
    return right.m_value < 0 ||
           left.m_value >= detail::make_unsigned(right.m_value);
  }
}

template<class Integer1, class Integer2>
bool
operator==(const Value<Integer1>& left, const Value<Integer2>& right)
{
  if (+Value<Integer1>::is_signed == +Value<Integer2>::is_signed) {
    // both are signed, or both are unsigned. c++ default rules will work
    // fine here.
    return left.m_value == right.m_value;
  }

if (Value<Integer1>::is_signed) {
    // left is signed - right is unsigned. careful check needed.
    // 1==1U
    return left.m_value >= 0 &&
           detail::make_unsigned(left.m_value) == right.m_value;
  } else {
    // left is unsigned - right is signed. careful check needed.
    // 1U==1
    return right.m_value >= 0 &&
           left.m_value == detail::make_unsigned(right.m_value);
  }
}
template<class Integer1, class Integer2>
bool
operator!=(const Value<Integer1>& left, const Value<Integer2>& right)
{
  if (+Value<Integer1>::is_signed == +Value<Integer2>::is_signed) {
    // both are signed, or both are unsigned. c++ default rules will work
    // fine here.
    return left.m_value != right.m_value;
  }

if (Value<Integer1>::is_signed) {
    // left is signed - right is unsigned. careful check needed.
    // 1==1U
    return left.m_value < 0 ||
           detail::make_unsigned(left.m_value) != right.m_value;
  } else {
    // left is unsigned - right is signed. careful check needed.
    // 1U==1
    return right.m_value < 0 ||
           left.m_value != detail::make_unsigned(right.m_value);
  }
}
#pragma warning(pop)

} // v1
} // namespace safe_compare
// end include of file safe_compare/detail/wrapped_integer.hpp
// begin include of file safe_compare/detail/operations.hpp
/*
 * This contains functions to do safe compare
 *
 * By Paul Dreik 20181003
 *
 * License:
 * dual license, pick your choice. Either Boost license 1.0, or GPL(v2 or later,
 * at your option).
 */

namespace safe_compare {
inline namespace v1 {

namespace detail {

/**
 * for making it easy to do tag dispatch, and at the same time get a readable
 * name of the comparison.
 */
template<char ch1, char ch2 = '\0'>
struct CmpTag
{
  static const char* getName()
  {
    static const char name[] = { ch1, ch2, '\0' };
    return name;
  }
};
using EQ = CmpTag<'=', '='>;
using NE = CmpTag<'!', '='>;
using GT = CmpTag<'>'>;
using GE = CmpTag<'>', '='>;
using LT = CmpTag<'<'>;
using LE = CmpTag<'<', '='>;

template<typename I1, typename I2>
struct Correct
{
  inline static bool cmp(EQ, I1 a, I2 b)
  {
    return Value<I1>{ a } == Value<I2>{ b };
  }
  inline static bool cmp(NE, I1 a, I2 b)
  {
    return Value<I1>{ a } != Value<I2>{ b };
  }
  inline static bool cmp(GT, I1 a, I2 b)
  {
    return Value<I1>{ a } > Value<I2>{ b };
  }
  inline static bool cmp(GE, I1 a, I2 b)
  {
    return Value<I1>{ a } >= Value<I2>{ b };
  }
  inline static bool cmp(LT, I1 a, I2 b)
  {
    return Value<I1>{ a } < Value<I2>{ b };
  }
  inline static bool cmp(LE, I1 a, I2 b)
  {
    return Value<I1>{ a } <= Value<I2>{ b };
  }
}; // struct correct

// MSVC disable warnings for signed/unsigned
#pragma warning(push)
#pragma warning(disable : 4018)

template<typename I1, typename I2>
struct Naive
{
  inline static bool cmp(EQ, I1 a, I2 b) { return a == b; }
  inline static bool cmp(NE, I1 a, I2 b) { return a != b; }
  inline static bool cmp(GT, I1 a, I2 b) { return a > b; }
  inline static bool cmp(GE, I1 a, I2 b) { return a >= b; }
  inline static bool cmp(LT, I1 a, I2 b) { return a < b; }
  inline static bool cmp(LE, I1 a, I2 b) { return a <= b; }
}; // struct naive

#pragma warning(pop)

/**
 * This policy does nothing - no abort, assert, throw.
 */
struct NullPolicy
{
  template<typename Tag, typename I1, typename I2>
  inline static void report(Tag, I1 a, I2 b, bool naive, bool correct)
  {}
};

/**
 * base class for comparing naive and correct results, and if there is a
 * difference forward to Policy::report for actions on what to do.
 */
template<typename Policy>
struct SwitcherBase
{
  // overload when types are equal - no need to do anything.
  template<typename I1, /* typename I2, */ typename Tag>
  inline static bool cmp(Tag, I1 a, I1 b)
  {
    return Naive<I1, I1>::cmp(Tag{}, a, b);
  }

template<typename I1, typename I2, typename Tag>
  static bool cmp(Tag, I1 a, I2 b)
  {
    const bool naive = Naive<I1, I2>::cmp(Tag{}, a, b);
    const bool correct = Correct<I1, I2>::cmp(Tag{}, a, b);
    if (naive != correct) {
      Policy::report(Tag{}, a, b, naive, correct);
    }
    return correct;
  }
};

/**
 * for performance, without safety.
 */
struct UnsafeBase
{
  template<typename I1, typename I2, typename Tag>
  inline static bool cmp(Tag, I1 a, I2 b)
  {
    return Naive<I1, I2>::cmp(Tag{}, a, b);
  }
};

template<typename Base>
struct Dispatcher : private Base
{
  using Base::cmp;
  template<typename I1, typename I2>
  static bool eq(I1 a, I2 b)
  {
    return cmp(EQ{}, a, b);
  }
  template<typename I1, typename I2>
  static bool ne(I1 a, I2 b)
  {
    return cmp(NE{}, a, b);
  }
  template<typename I1, typename I2>
  static bool gt(I1 a, I2 b)
  {
    return cmp(GT{}, a, b);
  }
  template<typename I1, typename I2>
  static bool ge(I1 a, I2 b)
  {
    return cmp(GE{}, a, b);
  }
  template<typename I1, typename I2>
  static bool lt(I1 a, I2 b)
  {
    return cmp(LT{}, a, b);
  }
  template<typename I1, typename I2>
  static bool le(I1 a, I2 b)
  {
    return cmp(LE{}, a, b);
  }
}; // struct Dispatcher

} // detail

} // namespace v1
} // namespace safe_compare
// end include of file safe_compare/detail/operations.hpp
// begin include of file safe_compare/detail/misusage_types.hpp
/*
 * Types to get better error messages.
 *
 * By Paul Dreik 2018
 *
 * License:
 * dual license, pick your choice. Either Boost license 1.0, or GPL(v2 or later,
 * at your option).
 */

namespace safe_compare {
inline namespace v1 {

namespace detail {
struct illegal_use_of_bool_as_integer
{};
struct illegal_use_of_float_as_integer
{};
struct illegal_use_of_double_as_integer
{};
struct illegal_use_of_long_double_as_integer
{};
}
}
}
// end include of file safe_compare/detail/misusage_types.hpp
// begin include of file safe_compare/unsafe_operations.hpp
/*
 * This contains functions to do unsafe compare,
 * useful to switch between audit and performance in
 * a central place of the user's code base.
 *
 * By Paul Dreik 20181008
 *
 * License:
 * dual license, pick your choice. Either Boost license 1.0, or GPL(v2 or later,
 * at your option).
 */

namespace safe_compare {
inline namespace v1 {
/**
 * gives a type whose static methods will do exactly what naive
 * C++ does - unsafe, and performant! Only use this if you
 * know your input data is ok to compare with unsafe (for instance,
 * all your input is guaranteed to be positive).
 * There is no error checking, throwing, aborting. But it will be just
 * as fast as default C++ (after optimization).
 */
using UnsafeCompare = detail::Dispatcher<detail::UnsafeBase>;
} // namespace v1
} // namespace safe_compare
// end include of file safe_compare/unsafe_operations.hpp
// begin include of file safe_compare/throwing_operations.hpp
/*
 * This contains functions to do safe compare
 *
 * By Paul Dreik 20181003
 *
 * License:
 * dual license, pick your choice. Either Boost license 1.0, or GPL(v2 or later,
 * at your option).
 */

namespace safe_compare {
inline namespace v1 {
namespace detail {

struct ThrowingPolicy
{
  template<typename Tag, typename I1, typename I2>
  static void report(Tag, I1 a, I2 b, bool naive, bool correct)
  {
    std::ostringstream oss;
    oss << "safe_compare::ThrowingPolicy: Naive comparison " << Tag::getName()
        << " gives the wrong result " << naive
        << ", which differs from the correct result " << correct
        << " for values " << +a << " and " << +b;
    throw std::runtime_error(oss.str());
  }
};
} // namespace detail

/**
 * gives a type whose static methods will throw in case a naive comparison
 * had given the incorrect answer.
 */
using ThrowingCompare =
  detail::Dispatcher<detail::SwitcherBase<detail::ThrowingPolicy>>;
} // namespace v1
} // namespace safe_compare
// end include of file safe_compare/throwing_operations.hpp
// begin include of file safe_compare/safe_operations.hpp
/*
 * This contains functions to do safe compare
 *
 * By Paul Dreik 20181003
 *
 * License:
 * dual license, pick your choice. Either Boost license 1.0, or GPL(v2 or later,
 * at your option).
 */

namespace safe_compare {
inline namespace v1 {
/**
 * gives a type whose static methods will give the correct answer, without
 * any error reporting at all.
 */
using CorrectCompare =
  detail::Dispatcher<detail::SwitcherBase<detail::NullPolicy>>;
} // namespace v1
} // namespace safe_compare
// end include of file safe_compare/safe_operations.hpp
// begin include of file safe_compare/safe_compare.hpp
/*
 * License: dual license, pick your choice. Either Boost license 1.0, or GPL(v2
 * or later, at your option).
 * by Paul Dreik 20180919
 */

namespace safe_compare {

inline namespace v1 {

/**
 * converts an integer into a wrapped integer, returning an object
 * that when compared to another wrapped integer will do the mathematically
 * correct thing when compared. There will be no throwing or asserting, just
 * the correct comparison.
 * @param x
 * @return
 */
template<class Integer>
Value<Integer>
make_safe(Integer x)
{
  return Value<Integer>{ x };
}

detail::illegal_use_of_bool_as_integer
make_safe(bool) = delete;

safe_compare::detail::illegal_use_of_float_as_integer
make_safe(float) = delete;

safe_compare::detail::illegal_use_of_double_as_integer
make_safe(double) = delete;

safe_compare::detail::illegal_use_of_long_double_as_integer
make_safe(long double) = delete;
} // namespace v1
} // namespace safe_compare
// end include of file safe_compare/safe_compare.hpp
// begin include of file safe_compare/aborting_operations.hpp
/*
 * This contains functions to do safe compare
 *
 * By Paul Dreik 20181003
 *
 * License:
 * dual license, pick your choice. Either Boost license 1.0, or GPL(v2 or later,
 * at your option).
 */

namespace safe_compare {
inline namespace v1 {
namespace detail {

struct AbortingPolicy
{
  template<typename Tag, typename I1, typename I2>
  static void report(Tag, I1 a, I2 b, bool naive, bool correct)
  {
    std::cerr << "safe_compare::AbortingPolicy: Naive comparison "
              << Tag::getName() << " gives the wrong result " << naive
              << ", which differs from the correct result " << correct
              << " for values " << +a << " and " << +b << std::endl;
    std::abort();
  }
};
} // namespace detail

/**
 * gives a type whose static methods will abort in case a naive comparison
 * had given the incorrect answer. Useful for smoking out bugs during testing.
 */
using AbortingCompare =
  detail::Dispatcher<detail::SwitcherBase<detail::AbortingPolicy>>;
} // namespace v1
} // namespace safe_compare
// end include of file safe_compare/aborting_operations.hpp

//////////start of user code/////////////////////

int plain_cpp(signed a, signed b) {
    return a<b;
}
int plain_cpp(unsigned a, signed b) {
    return a<b;
}
int unsafe(signed a,signed b) {
    return safe_compare::UnsafeCompare::lt(a,b);
}
int unsafe(unsigned a,signed b) {
    return safe_compare::UnsafeCompare::lt(a,b);
}
int correct(signed a,signed b) {
    return safe_compare::CorrectCompare::lt(a,b);
}
int correct(unsigned a,signed b) {
    return safe_compare::CorrectCompare::lt(a,b);
}
int throwing(signed a,signed b) {
    return safe_compare::ThrowingCompare::lt(a,b);
}
int throwing(unsigned a,signed b) {
    return safe_compare::ThrowingCompare::lt(a,b);
}