webview_universal/windows/wil/safecast.h

//*********************************************************
//
//    Copyright (c) Microsoft. All rights reserved.
//    This code is licensed under the MIT License.
//    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF
//    ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED
//    TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A
//    PARTICULAR PURPOSE AND NONINFRINGEMENT.
//
//*********************************************************
#ifndef __WIL_SAFECAST_INCLUDED
#define __WIL_SAFECAST_INCLUDED

#include "result_macros.h"
#include <intsafe.h>
#include "wistd_config.h"
#include "wistd_type_traits.h"

namespace wil
{
    namespace details
    {
        // Default error case for undefined conversions in intsafe.h
        template<typename OldT, typename NewT> constexpr wistd::nullptr_t intsafe_conversion = nullptr;

        // is_known_safe_static_cast_v determines if a conversion is known to be safe or not. Known
        // safe conversions can be handled by static_cast, this includes conversions between the same
        // type, when the new type is larger than the old type but is not a signed to unsigned
        // conversion, and when the two types are the same size and signed/unsigned. All other
        // conversions will be assumed to be potentially unsafe, and the conversion must be handled
        // by intsafe and checked.
        template <typename NewT, typename OldT>
        constexpr bool is_known_safe_static_cast_v =
            (sizeof(NewT) > sizeof(OldT) && !(wistd::is_signed_v<OldT> && wistd::is_unsigned_v<NewT>)) ||
            (sizeof(NewT) == sizeof(OldT) && ((wistd::is_signed_v<NewT> && wistd::is_signed_v<OldT>) || (wistd::is_unsigned_v<NewT> && wistd::is_unsigned_v<OldT>)));

        // Helper template to determine that NewT and OldT are both integral types. The safe_cast
        // operation only supports conversions between integral types.
        template <typename NewT, typename OldT>
        constexpr bool both_integral_v = wistd::is_integral<NewT>::value && wistd::is_integral<OldT>::value;

        // Note on native wchar_t (__wchar_t):
        //      Intsafe.h does not currently handle native wchar_t. When compiling with /Zc:wchar_t-, this is fine as wchar_t is
        //      typedef'd to unsigned short. However, when compiling with /Zc:wchar_t or wchar_t as a native type, the lack of
        //      support for native wchar_t in intsafe.h becomes an issue. To work around this, we treat native wchar_t as an
        //      unsigned short when passing it to intsafe.h, because the two on the Windows platform are the same size and
        //      share the same range according to MSDN. If the cast is to a native wchar_t, the result from intsafe.h is cast
        //      to a native wchar_t.

        // Intsafe does not have a defined conversion for native wchar_t
        template <typename NewT, typename OldT>
        constexpr bool neither_native_wchar_v = !wistd::is_same<NewT, __wchar_t>::value && !wistd::is_same<OldT, __wchar_t>::value;

        // Check to see if the cast is a conversion to native wchar_t
        template <typename NewT, typename OldT>
        constexpr bool is_cast_to_wchar_v = wistd::is_same<NewT, __wchar_t>::value && !wistd::is_same<OldT, __wchar_t>::value;

        // Check to see if the cast is a conversion from native wchar_t
        template <typename NewT, typename OldT>
        constexpr bool is_cast_from_wchar_v = !wistd::is_same<NewT, __wchar_t>::value && wistd::is_same<OldT, __wchar_t>::value;

        // Validate the conversion to be performed has a defined mapping to an intsafe conversion
        template <typename NewT, typename OldT>
        constexpr bool is_supported_intsafe_cast_v = intsafe_conversion<OldT, NewT> != nullptr;

        // True when the conversion is between integral types and can be handled by static_cast
        template <typename NewT, typename OldT>
        constexpr bool is_supported_safe_static_cast_v = both_integral_v<NewT, OldT> && is_known_safe_static_cast_v<NewT, OldT>;

        // True when the conversion is between integral types, does not involve native wchar, has
        // a mapped intsafe conversion, and is unsafe.
        template <typename NewT, typename OldT>
        constexpr bool is_supported_unsafe_cast_no_wchar_v =
            both_integral_v<NewT, OldT> &&
            !is_known_safe_static_cast_v<NewT, OldT> &&
            neither_native_wchar_v<NewT, OldT> &&
            is_supported_intsafe_cast_v<NewT, OldT>;

        // True when the conversion is between integral types, is a cast to native wchar_t, has
        // a mapped intsafe conversion, and is unsafe.
        template <typename NewT, typename OldT>
        constexpr bool is_supported_unsafe_cast_to_wchar_v =
            both_integral_v<NewT, OldT> &&
            !is_known_safe_static_cast_v<NewT, OldT> &&
            is_cast_to_wchar_v<NewT, OldT> &&
            is_supported_intsafe_cast_v<unsigned short, OldT>;

        // True when the conversion is between integral types, is a cast from native wchar_t, has
        // a mapped intsafe conversion, and is unsafe.
        template <typename NewT, typename OldT>
        constexpr bool is_supported_unsafe_cast_from_wchar_v =
            both_integral_v<NewT, OldT> &&
            !is_known_safe_static_cast_v<NewT, OldT> &&
            is_cast_from_wchar_v<NewT, OldT> &&
            is_supported_intsafe_cast_v<NewT, unsigned short>;

        // True when the conversion is supported and unsafe, and may or may not involve
        // native wchar_t.
        template <typename NewT, typename OldT>
        constexpr bool is_supported_unsafe_cast_v =
            is_supported_unsafe_cast_no_wchar_v<NewT, OldT> ||
            is_supported_unsafe_cast_to_wchar_v<NewT, OldT> ||
            is_supported_unsafe_cast_from_wchar_v<NewT, OldT>;

        // True when T is any one of the primitive types that the variably sized types are defined as.
        template <typename T>
        constexpr bool is_potentially_variably_sized_type_v =
            wistd::is_same<T, int>::value ||
            wistd::is_same<T, unsigned int>::value ||
            wistd::is_same<T, long>::value ||
            wistd::is_same<T, unsigned long>::value ||
            wistd::is_same<T, __int64>::value ||
            wistd::is_same<T, unsigned __int64>::value;

        // True when either type is potentialy variably sized (e.g. size_t, ptrdiff_t)
        template <typename OldT, typename NewT>
        constexpr bool is_potentially_variably_sized_cast_v =
            is_potentially_variably_sized_type_v<OldT> ||
            is_potentially_variably_sized_type_v<NewT>;

        // Mappings of all conversions defined in intsafe.h to intsafe_conversion
        // Note: Uppercase types (UINT, DWORD, SIZE_T, etc) and architecture dependent types resolve
        // to the base types. The base types are used since they do not vary based on architecture.
        template<> constexpr auto intsafe_conversion<__int64, char> = LongLongToChar;
        template<> constexpr auto intsafe_conversion<__int64, int> = LongLongToInt;
        template<> constexpr auto intsafe_conversion<__int64, long> = LongLongToLong;
        template<> constexpr auto intsafe_conversion<__int64, short> = LongLongToShort;
        template<> constexpr auto intsafe_conversion<__int64, signed char> = LongLongToInt8;
        template<> constexpr auto intsafe_conversion<__int64, unsigned __int64> = LongLongToULongLong;
        template<> constexpr auto intsafe_conversion<__int64, unsigned char> = LongLongToUChar;
        template<> constexpr auto intsafe_conversion<__int64, unsigned int> = LongLongToUInt;
        template<> constexpr auto intsafe_conversion<__int64, unsigned long> = LongLongToULong;
        template<> constexpr auto intsafe_conversion<__int64, unsigned short> = LongLongToUShort;
        template<> constexpr auto intsafe_conversion<int, char> = IntToChar;
        template<> constexpr auto intsafe_conversion<int, short> = IntToShort;
        template<> constexpr auto intsafe_conversion<int, signed char> = IntToInt8;
        template<> constexpr auto intsafe_conversion<int, unsigned __int64> = IntToULongLong;
        template<> constexpr auto intsafe_conversion<int, unsigned char> = IntToUChar;
        template<> constexpr auto intsafe_conversion<int, unsigned int> = IntToUInt;
        template<> constexpr auto intsafe_conversion<int, unsigned long> = IntToULong;
        template<> constexpr auto intsafe_conversion<int, unsigned short> = IntToUShort;
        template<> constexpr auto intsafe_conversion<long, char> = LongToChar;
        template<> constexpr auto intsafe_conversion<long, int> = LongToInt;
        template<> constexpr auto intsafe_conversion<long, short> = LongToShort;
        template<> constexpr auto intsafe_conversion<long, signed char> = LongToInt8;
        template<> constexpr auto intsafe_conversion<long, unsigned __int64> = LongToULongLong;
        template<> constexpr auto intsafe_conversion<long, unsigned char> = LongToUChar;
        template<> constexpr auto intsafe_conversion<long, unsigned int> = LongToUInt;
        template<> constexpr auto intsafe_conversion<long, unsigned long> = LongToULong;
        template<> constexpr auto intsafe_conversion<long, unsigned short> = LongToUShort;
        template<> constexpr auto intsafe_conversion<short, char> = ShortToChar;
        template<> constexpr auto intsafe_conversion<short, signed char> = ShortToInt8;
        template<> constexpr auto intsafe_conversion<short, unsigned __int64> = ShortToULongLong;
        template<> constexpr auto intsafe_conversion<short, unsigned char> = ShortToUChar;
        template<> constexpr auto intsafe_conversion<short, unsigned int> = ShortToUInt;
        template<> constexpr auto intsafe_conversion<short, unsigned long> = ShortToULong;
        template<> constexpr auto intsafe_conversion<short, unsigned short> = ShortToUShort;
        template<> constexpr auto intsafe_conversion<signed char, unsigned __int64> = Int8ToULongLong;
        template<> constexpr auto intsafe_conversion<signed char, unsigned char> = Int8ToUChar;
        template<> constexpr auto intsafe_conversion<signed char, unsigned int> = Int8ToUInt;
        template<> constexpr auto intsafe_conversion<signed char, unsigned long> = Int8ToULong;
        template<> constexpr auto intsafe_conversion<signed char, unsigned short> = Int8ToUShort;
        template<> constexpr auto intsafe_conversion<unsigned __int64, __int64> = ULongLongToLongLong;
        template<> constexpr auto intsafe_conversion<unsigned __int64, char> = ULongLongToChar;
        template<> constexpr auto intsafe_conversion<unsigned __int64, int> = ULongLongToInt;
        template<> constexpr auto intsafe_conversion<unsigned __int64, long> = ULongLongToLong;
        template<> constexpr auto intsafe_conversion<unsigned __int64, short> = ULongLongToShort;
        template<> constexpr auto intsafe_conversion<unsigned __int64, signed char> = ULongLongToInt8;
        template<> constexpr auto intsafe_conversion<unsigned __int64, unsigned char> = ULongLongToUChar;
        template<> constexpr auto intsafe_conversion<unsigned __int64, unsigned int> = ULongLongToUInt;
        template<> constexpr auto intsafe_conversion<unsigned __int64, unsigned long> = ULongLongToULong;
        template<> constexpr auto intsafe_conversion<unsigned __int64, unsigned short> = ULongLongToUShort;
        template<> constexpr auto intsafe_conversion<unsigned char, char> = UInt8ToChar;
        template<> constexpr auto intsafe_conversion<unsigned char, signed char> = UIntToInt8;
        template<> constexpr auto intsafe_conversion<unsigned int, char> = UIntToChar;
        template<> constexpr auto intsafe_conversion<unsigned int, int> = UIntToInt;
        template<> constexpr auto intsafe_conversion<unsigned int, long> = UIntToLong;
        template<> constexpr auto intsafe_conversion<unsigned int, short> = UIntToShort;
        template<> constexpr auto intsafe_conversion<unsigned int, signed char> = UIntToInt8;
        template<> constexpr auto intsafe_conversion<unsigned int, unsigned char> = UIntToUChar;
        template<> constexpr auto intsafe_conversion<unsigned int, unsigned short> = UIntToUShort;
        template<> constexpr auto intsafe_conversion<unsigned long, char> = ULongToChar;
        template<> constexpr auto intsafe_conversion<unsigned long, int> = ULongToInt;
        template<> constexpr auto intsafe_conversion<unsigned long, long> = ULongToLong;
        template<> constexpr auto intsafe_conversion<unsigned long, short> = ULongToShort;
        template<> constexpr auto intsafe_conversion<unsigned long, signed char> = ULongToInt8;
        template<> constexpr auto intsafe_conversion<unsigned long, unsigned char> = ULongToUChar;
        template<> constexpr auto intsafe_conversion<unsigned long, unsigned int> = ULongToUInt;
        template<> constexpr auto intsafe_conversion<unsigned long, unsigned short> = ULongToUShort;
        template<> constexpr auto intsafe_conversion<unsigned short, char> = UShortToChar;
        template<> constexpr auto intsafe_conversion<unsigned short, short> = UShortToShort;
        template<> constexpr auto intsafe_conversion<unsigned short, signed char> = UShortToInt8;
        template<> constexpr auto intsafe_conversion<unsigned short, unsigned char> = UShortToUChar;
    }

    // Unsafe conversion where failure results in fail fast.
    template <
        typename NewT,
        typename OldT,
        wistd::enable_if_t<details::is_supported_unsafe_cast_no_wchar_v<NewT, OldT>, int> = 0
    >
    NewT safe_cast_failfast(const OldT var)
    {
        NewT newVar;
        FAIL_FAST_IF_FAILED((details::intsafe_conversion<OldT, NewT>(var, &newVar)));
        return newVar;
    }

    // Unsafe conversion where failure results in fail fast.
    template <
        typename NewT,
        typename OldT,
        wistd::enable_if_t<details::is_supported_unsafe_cast_from_wchar_v<NewT, OldT>, int> = 0
    >
    NewT safe_cast_failfast(const OldT var)
    {
        NewT newVar;
        FAIL_FAST_IF_FAILED((details::intsafe_conversion<unsigned short, NewT>(static_cast<unsigned short>(var), &newVar)));
        return newVar;
    }

    // Unsafe conversion where failure results in fail fast.
    template <
        typename NewT,
        typename OldT,
        wistd::enable_if_t<details::is_supported_unsafe_cast_to_wchar_v<NewT, OldT>, int> = 0
    >
    NewT safe_cast_failfast(const OldT var)
    {
        unsigned short newVar;
        FAIL_FAST_IF_FAILED((details::intsafe_conversion<OldT, unsigned short>(var, &newVar)));
        return static_cast<__wchar_t>(newVar);
    }

    // This conversion is always safe, therefore a static_cast is fine.
    template <
        typename NewT,
        typename OldT,
        wistd::enable_if_t<details::is_supported_safe_static_cast_v<NewT, OldT>, int> = 0
    >
    NewT safe_cast_failfast(const OldT var)
    {
        return static_cast<NewT>(var);
    }

#ifdef WIL_ENABLE_EXCEPTIONS
    // Unsafe conversion where failure results in a thrown exception.
    template <
        typename NewT,
        typename OldT,
        wistd::enable_if_t<details::is_supported_unsafe_cast_no_wchar_v<NewT, OldT>, int> = 0
    >
    NewT safe_cast(const OldT var)
    {
        NewT newVar;
        THROW_IF_FAILED((details::intsafe_conversion<OldT, NewT>(var, &newVar)));
        return newVar;
    }

    // Unsafe conversion where failure results in a thrown exception.
    template <
        typename NewT,
        typename OldT,
        wistd::enable_if_t<details::is_supported_unsafe_cast_from_wchar_v<NewT, OldT>, int> = 0
    >
    NewT safe_cast(const OldT var)
    {
        NewT newVar;
        THROW_IF_FAILED((details::intsafe_conversion<unsigned short, NewT>(static_cast<unsigned short>(var), &newVar)));
        return newVar;
    }

    // Unsafe conversion where failure results in a thrown exception.
    template <
        typename NewT,
        typename OldT,
        wistd::enable_if_t<details::is_supported_unsafe_cast_to_wchar_v<NewT, OldT>, int> = 0
    >
    NewT safe_cast(const OldT var)
    {
        unsigned short newVar;
        THROW_IF_FAILED((details::intsafe_conversion<OldT, unsigned short>(var, &newVar)));
        return static_cast<__wchar_t>(newVar);
    }

    // This conversion is always safe, therefore a static_cast is fine.
    template <
        typename NewT,
        typename OldT,
        wistd::enable_if_t<details::is_supported_safe_static_cast_v<NewT, OldT>, int> = 0
    >
    NewT safe_cast(const OldT var)
    {
        return static_cast<NewT>(var);
    }
#endif

    // This conversion is unsafe, therefore the two parameter version of safe_cast_nothrow must be used
    template <
        typename NewT,
        typename OldT,
        wistd::enable_if_t<details::is_supported_unsafe_cast_v<NewT, OldT>, int> = 0
    >
    NewT safe_cast_nothrow(const OldT /*var*/)
    {
        static_assert(!wistd::is_same_v<NewT, NewT>, "This cast has the potential to fail, use the two parameter safe_cast_nothrow instead");
    }

    // This conversion is always safe, therefore a static_cast is fine.
    template <
        typename NewT,
        typename OldT,
        wistd::enable_if_t<details::is_supported_safe_static_cast_v<NewT, OldT>, int> = 0
    >
    NewT safe_cast_nothrow(const OldT var)
    {
        return static_cast<NewT>(var);
    }

    // Unsafe conversion where an HRESULT is returned. It is up to the callee to check and handle the HRESULT
    template <
        typename NewT,
        typename OldT,
        wistd::enable_if_t<details::is_supported_unsafe_cast_no_wchar_v<NewT, OldT>, int> = 0
    >
    HRESULT safe_cast_nothrow(const OldT var, NewT* newTResult)
    {
        return details::intsafe_conversion<OldT, NewT>(var, newTResult);
    }

    // Unsafe conversion where an HRESULT is returned. It is up to the callee to check and handle the HRESULT
    template <
        typename NewT,
        typename OldT,
        wistd::enable_if_t<details::is_supported_unsafe_cast_from_wchar_v<NewT, OldT>, int> = 0
    >
    HRESULT safe_cast_nothrow(const OldT var, NewT* newTResult)
    {
        return details::intsafe_conversion<unsigned short, NewT>(static_cast<unsigned short>(var), newTResult);
    }

    // Unsafe conversion where an HRESULT is returned. It is up to the callee to check and handle the HRESULT
    template <
        typename NewT,
        typename OldT,
        wistd::enable_if_t<details::is_supported_unsafe_cast_to_wchar_v<NewT, OldT>, int> = 0
    >
    HRESULT safe_cast_nothrow(const OldT var, NewT* newTResult)
    {
        return details::intsafe_conversion<OldT, unsigned short>(var, reinterpret_cast<unsigned short *>(newTResult));
    }

    // This conversion is always safe, therefore a static_cast is fine. If it can be determined the conversion
    // does not involve a variably sized type, then the compilation will fail and say the single parameter version
    // of safe_cast_nothrow should be used instead.
    template <
        typename NewT,
        typename OldT,
        wistd::enable_if_t<details::is_supported_safe_static_cast_v<NewT, OldT>, int> = 0
    >
    HRESULT safe_cast_nothrow(const OldT var, NewT* newTResult)
    {
        static_assert(details::is_potentially_variably_sized_cast_v<OldT, NewT>, "This cast is always safe; use safe_cast_nothrow<T>(value) to avoid unnecessary error handling.");
        *newTResult = static_cast<NewT>(var);
        return S_OK;
    }
}

#endif // __WIL_SAFECAST_INCLUDED