Adding upstream version 1:115.7.0.upstream/1%115.7.0upstream

Signed-off-by: Daniel Baumann <daniel.baumann@progress-linux.org>

1 files changed, 804 insertions, 0 deletions

diff --git a/mfbt/CheckedInt.h b/mfbt/CheckedInt.h
new file mode 100644
index 0000000000..d784376d8c
--- /dev/null
+++ b/mfbt/CheckedInt.h
@@ -0,0 +1,804 @@
+/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* vim: set ts=8 sts=2 et sw=2 tw=80: */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+/* Provides checked integers, detecting integer overflow and divide-by-0. */
+
+#ifndef mozilla_CheckedInt_h
+#define mozilla_CheckedInt_h
+
+#include <stdint.h>
+#include "mozilla/Assertions.h"
+#include "mozilla/Attributes.h"
+#include "mozilla/IntegerTypeTraits.h"
+#include <limits>
+#include <type_traits>
+
+#define MOZILLA_CHECKEDINT_COMPARABLE_VERSION(major, minor, patch) \
+  (major << 16 | minor << 8 | patch)
+
+// Probe for builtin math overflow support.  Disabled for 32-bit builds for now
+// since "gcc -m32" claims to support these but its implementation is buggy.
+// https://gcc.gnu.org/bugzilla/show_bug.cgi?id=82274
+// Also disabled for clang before version 7 (resp. Xcode clang 10.0.1): while
+// clang 5 and 6 have a working __builtin_add_overflow, it is not constexpr.
+#if defined(HAVE_64BIT_BUILD)
+#  if defined(__has_builtin) &&                                        \
+      (!defined(__clang_major__) ||                                    \
+       (!defined(__apple_build_version__) && __clang_major__ >= 7) ||  \
+       (defined(__apple_build_version__) &&                            \
+        MOZILLA_CHECKEDINT_COMPARABLE_VERSION(                         \
+            __clang_major__, __clang_minor__, __clang_patchlevel__) >= \
+            MOZILLA_CHECKEDINT_COMPARABLE_VERSION(10, 0, 1)))
+#    define MOZ_HAS_BUILTIN_OP_OVERFLOW (__has_builtin(__builtin_add_overflow))
+#  elif defined(__GNUC__)
+// (clang also defines __GNUC__ but it supports __has_builtin since at least
+//  v3.1 (released in 2012) so it won't get here.)
+#    define MOZ_HAS_BUILTIN_OP_OVERFLOW (__GNUC__ >= 5)
+#  else
+#    define MOZ_HAS_BUILTIN_OP_OVERFLOW (0)
+#  endif
+#else
+#  define MOZ_HAS_BUILTIN_OP_OVERFLOW (0)
+#endif
+
+#undef MOZILLA_CHECKEDINT_COMPARABLE_VERSION
+
+namespace mozilla {
+
+template <typename T>
+class CheckedInt;
+
+namespace detail {
+
+/*
+ * Step 1: manually record supported types
+ *
+ * What's nontrivial here is that there are different families of integer
+ * types: basic integer types and stdint types. It is merrily undefined which
+ * types from one family may be just typedefs for a type from another family.
+ *
+ * For example, on GCC 4.6, aside from the basic integer types, the only other
+ * type that isn't just a typedef for some of them, is int8_t.
+ */
+
+struct UnsupportedType {};
+
+template <typename IntegerType>
+struct IsSupportedPass2 {
+  static const bool value = false;
+};
+
+template <typename IntegerType>
+struct IsSupported {
+  static const bool value = IsSupportedPass2<IntegerType>::value;
+};
+
+template <>
+struct IsSupported<int8_t> {
+  static const bool value = true;
+};
+
+template <>
+struct IsSupported<uint8_t> {
+  static const bool value = true;
+};
+
+template <>
+struct IsSupported<int16_t> {
+  static const bool value = true;
+};
+
+template <>
+struct IsSupported<uint16_t> {
+  static const bool value = true;
+};
+
+template <>
+struct IsSupported<int32_t> {
+  static const bool value = true;
+};
+
+template <>
+struct IsSupported<uint32_t> {
+  static const bool value = true;
+};
+
+template <>
+struct IsSupported<int64_t> {
+  static const bool value = true;
+};
+
+template <>
+struct IsSupported<uint64_t> {
+  static const bool value = true;
+};
+
+template <>
+struct IsSupportedPass2<char> {
+  static const bool value = true;
+};
+
+template <>
+struct IsSupportedPass2<signed char> {
+  static const bool value = true;
+};
+
+template <>
+struct IsSupportedPass2<unsigned char> {
+  static const bool value = true;
+};
+
+template <>
+struct IsSupportedPass2<short> {
+  static const bool value = true;
+};
+
+template <>
+struct IsSupportedPass2<unsigned short> {
+  static const bool value = true;
+};
+
+template <>
+struct IsSupportedPass2<int> {
+  static const bool value = true;
+};
+
+template <>
+struct IsSupportedPass2<unsigned int> {
+  static const bool value = true;
+};
+
+template <>
+struct IsSupportedPass2<long> {
+  static const bool value = true;
+};
+
+template <>
+struct IsSupportedPass2<unsigned long> {
+  static const bool value = true;
+};
+
+template <>
+struct IsSupportedPass2<long long> {
+  static const bool value = true;
+};
+
+template <>
+struct IsSupportedPass2<unsigned long long> {
+  static const bool value = true;
+};
+
+/*
+ * Step 2: Implement the actual validity checks.
+ *
+ * Ideas taken from IntegerLib, code different.
+ */
+
+template <typename IntegerType, size_t Size = sizeof(IntegerType)>
+struct TwiceBiggerType {
+  typedef typename detail::StdintTypeForSizeAndSignedness<
+      sizeof(IntegerType) * 2, std::is_signed_v<IntegerType>>::Type Type;
+};
+
+template <typename IntegerType>
+struct TwiceBiggerType<IntegerType, 8> {
+  typedef UnsupportedType Type;
+};
+
+template <typename T>
+constexpr bool HasSignBit(T aX) {
+  // In C++, right bit shifts on negative values is undefined by the standard.
+  // Notice that signed-to-unsigned conversions are always well-defined in the
+  // standard, as the value congruent modulo 2**n as expected. By contrast,
+  // unsigned-to-signed is only well-defined if the value is representable.
+  return bool(std::make_unsigned_t<T>(aX) >> PositionOfSignBit<T>::value);
+}
+
+// Bitwise ops may return a larger type, so it's good to use this inline
+// helper guaranteeing that the result is really of type T.
+template <typename T>
+constexpr T BinaryComplement(T aX) {
+  return ~aX;
+}
+
+template <typename T, typename U, bool IsTSigned = std::is_signed_v<T>,
+          bool IsUSigned = std::is_signed_v<U>>
+struct DoesRangeContainRange {};
+
+template <typename T, typename U, bool Signedness>
+struct DoesRangeContainRange<T, U, Signedness, Signedness> {
+  static const bool value = sizeof(T) >= sizeof(U);
+};
+
+template <typename T, typename U>
+struct DoesRangeContainRange<T, U, true, false> {
+  static const bool value = sizeof(T) > sizeof(U);
+};
+
+template <typename T, typename U>
+struct DoesRangeContainRange<T, U, false, true> {
+  static const bool value = false;
+};
+
+template <typename T, typename U, bool IsTSigned = std::is_signed_v<T>,
+          bool IsUSigned = std::is_signed_v<U>,
+          bool DoesTRangeContainURange = DoesRangeContainRange<T, U>::value>
+struct IsInRangeImpl {};
+
+template <typename T, typename U, bool IsTSigned, bool IsUSigned>
+struct IsInRangeImpl<T, U, IsTSigned, IsUSigned, true> {
+  static constexpr bool run(U) { return true; }
+};
+
+template <typename T, typename U>
+struct IsInRangeImpl<T, U, true, true, false> {
+  static constexpr bool run(U aX) {
+    return aX <= std::numeric_limits<T>::max() &&
+           aX >= std::numeric_limits<T>::min();
+  }
+};
+
+template <typename T, typename U>
+struct IsInRangeImpl<T, U, false, false, false> {
+  static constexpr bool run(U aX) {
+    return aX <= std::numeric_limits<T>::max();
+  }
+};
+
+template <typename T, typename U>
+struct IsInRangeImpl<T, U, true, false, false> {
+  static constexpr bool run(U aX) {
+    return sizeof(T) > sizeof(U) || aX <= U(std::numeric_limits<T>::max());
+  }
+};
+
+template <typename T, typename U>
+struct IsInRangeImpl<T, U, false, true, false> {
+  static constexpr bool run(U aX) {
+    return sizeof(T) >= sizeof(U)
+               ? aX >= 0
+               : aX >= 0 && aX <= U(std::numeric_limits<T>::max());
+  }
+};
+
+template <typename T, typename U>
+constexpr bool IsInRange(U aX) {
+  return IsInRangeImpl<T, U>::run(aX);
+}
+
+template <typename T>
+constexpr bool IsAddValid(T aX, T aY) {
+#if MOZ_HAS_BUILTIN_OP_OVERFLOW
+  T dummy;
+  return !__builtin_add_overflow(aX, aY, &dummy);
+#else
+  // Addition is valid if the sign of aX+aY is equal to either that of aX or
+  // that of aY. Since the value of aX+aY is undefined if we have a signed
+  // type, we compute it using the unsigned type of the same size.  Beware!
+  // These bitwise operations can return a larger integer type, if T was a
+  // small type like int8_t, so we explicitly cast to T.
+
+  std::make_unsigned_t<T> ux = aX;
+  std::make_unsigned_t<T> uy = aY;
+  std::make_unsigned_t<T> result = ux + uy;
+  return std::is_signed_v<T>
+             ? HasSignBit(BinaryComplement(T((result ^ aX) & (result ^ aY))))
+             : BinaryComplement(aX) >= aY;
+#endif
+}
+
+template <typename T>
+constexpr bool IsSubValid(T aX, T aY) {
+#if MOZ_HAS_BUILTIN_OP_OVERFLOW
+  T dummy;
+  return !__builtin_sub_overflow(aX, aY, &dummy);
+#else
+  // Subtraction is valid if either aX and aY have same sign, or aX-aY and aX
+  // have same sign. Since the value of aX-aY is undefined if we have a signed
+  // type, we compute it using the unsigned type of the same size.
+  std::make_unsigned_t<T> ux = aX;
+  std::make_unsigned_t<T> uy = aY;
+  std::make_unsigned_t<T> result = ux - uy;
+
+  return std::is_signed_v<T>
+             ? HasSignBit(BinaryComplement(T((result ^ aX) & (aX ^ aY))))
+             : aX >= aY;
+#endif
+}
+
+template <typename T, bool IsTSigned = std::is_signed_v<T>,
+          bool TwiceBiggerTypeIsSupported =
+              IsSupported<typename TwiceBiggerType<T>::Type>::value>
+struct IsMulValidImpl {};
+
+template <typename T, bool IsTSigned>
+struct IsMulValidImpl<T, IsTSigned, true> {
+  static constexpr bool run(T aX, T aY) {
+    typedef typename TwiceBiggerType<T>::Type TwiceBiggerType;
+    TwiceBiggerType product = TwiceBiggerType(aX) * TwiceBiggerType(aY);
+    return IsInRange<T>(product);
+  }
+};
+
+template <typename T>
+struct IsMulValidImpl<T, true, false> {
+  static constexpr bool run(T aX, T aY) {
+    const T max = std::numeric_limits<T>::max();
+    const T min = std::numeric_limits<T>::min();
+
+    if (aX == 0 || aY == 0) {
+      return true;
+    }
+    if (aX > 0) {
+      return aY > 0 ? aX <= max / aY : aY >= min / aX;
+    }
+
+    // If we reach this point, we know that aX < 0.
+    return aY > 0 ? aX >= min / aY : aY >= max / aX;
+  }
+};
+
+template <typename T>
+struct IsMulValidImpl<T, false, false> {
+  static constexpr bool run(T aX, T aY) {
+    return aY == 0 || aX <= std::numeric_limits<T>::max() / aY;
+  }
+};
+
+template <typename T>
+constexpr bool IsMulValid(T aX, T aY) {
+#if MOZ_HAS_BUILTIN_OP_OVERFLOW
+  T dummy;
+  return !__builtin_mul_overflow(aX, aY, &dummy);
+#else
+  return IsMulValidImpl<T>::run(aX, aY);
+#endif
+}
+
+template <typename T>
+constexpr bool IsDivValid(T aX, T aY) {
+  // Keep in mind that in the signed case, min/-1 is invalid because
+  // abs(min)>max.
+  return aY != 0 && !(std::is_signed_v<T> &&
+                      aX == std::numeric_limits<T>::min() && aY == T(-1));
+}
+
+template <typename T, bool IsTSigned = std::is_signed_v<T>>
+struct IsModValidImpl;
+
+template <typename T>
+constexpr bool IsModValid(T aX, T aY) {
+  return IsModValidImpl<T>::run(aX, aY);
+}
+
+/*
+ * Mod is pretty simple.
+ * For now, let's just use the ANSI C definition:
+ * If aX or aY are negative, the results are implementation defined.
+ *   Consider these invalid.
+ * Undefined for aY=0.
+ * The result will never exceed either aX or aY.
+ *
+ * Checking that aX>=0 is a warning when T is unsigned.
+ */
+
+template <typename T>
+struct IsModValidImpl<T, false> {
+  static constexpr bool run(T aX, T aY) { return aY >= 1; }
+};
+
+template <typename T>
+struct IsModValidImpl<T, true> {
+  static constexpr bool run(T aX, T aY) {
+    if (aX < 0) {
+      return false;
+    }
+    return aY >= 1;
+  }
+};
+
+template <typename T, bool IsSigned = std::is_signed_v<T>>
+struct NegateImpl;
+
+template <typename T>
+struct NegateImpl<T, false> {
+  static constexpr CheckedInt<T> negate(const CheckedInt<T>& aVal) {
+    // Handle negation separately for signed/unsigned, for simpler code and to
+    // avoid an MSVC warning negating an unsigned value.
+    static_assert(detail::IsInRange<T>(0), "Integer type can't represent 0");
+    return CheckedInt<T>(T(0), aVal.isValid() && aVal.mValue == 0);
+  }
+};
+
+template <typename T>
+struct NegateImpl<T, true> {
+  static constexpr CheckedInt<T> negate(const CheckedInt<T>& aVal) {
+    // Watch out for the min-value, which (with twos-complement) can't be
+    // negated as -min-value is then (max-value + 1).
+    if (!aVal.isValid() || aVal.mValue == std::numeric_limits<T>::min()) {
+      return CheckedInt<T>(aVal.mValue, false);
+    }
+    /* For some T, arithmetic ops automatically promote to a wider type, so
+     * explitly do the narrowing cast here.  The narrowing cast is valid because
+     * we did the check for min value above. */
+    return CheckedInt<T>(T(-aVal.mValue), true);
+  }
+};
+
+}  // namespace detail
+
+/*
+ * Step 3: Now define the CheckedInt class.
+ */
+
+/**
+ * @class CheckedInt
+ * @brief Integer wrapper class checking for integer overflow and other errors
+ * @param T the integer type to wrap. Can be any type among the following:
+ *            - any basic integer type such as |int|
+ *            - any stdint type such as |int8_t|
+ *
+ * This class implements guarded integer arithmetic. Do a computation, check
+ * that isValid() returns true, you then have a guarantee that no problem, such
+ * as integer overflow, happened during this computation, and you can call
+ * value() to get the plain integer value.
+ *
+ * The arithmetic operators in this class are guaranteed not to raise a signal
+ * (e.g. in case of a division by zero).
+ *
+ * For example, suppose that you want to implement a function that computes
+ * (aX+aY)/aZ, that doesn't crash if aZ==0, and that reports on error (divide by
+ * zero or integer overflow). You could code it as follows:
+   @code
+   bool computeXPlusYOverZ(int aX, int aY, int aZ, int* aResult)
+   {
+     CheckedInt<int> checkedResult = (CheckedInt<int>(aX) + aY) / aZ;
+     if (checkedResult.isValid()) {
+       *aResult = checkedResult.value();
+       return true;
+     } else {
+       return false;
+     }
+   }
+   @endcode
+ *
+ * Implicit conversion from plain integers to checked integers is allowed. The
+ * plain integer is checked to be in range before being casted to the
+ * destination type. This means that the following lines all compile, and the
+ * resulting CheckedInts are correctly detected as valid or invalid:
+ * @code
+   // 1 is of type int, is found to be in range for uint8_t, x is valid
+   CheckedInt<uint8_t> x(1);
+   // -1 is of type int, is found not to be in range for uint8_t, x is invalid
+   CheckedInt<uint8_t> x(-1);
+   // -1 is of type int, is found to be in range for int8_t, x is valid
+   CheckedInt<int8_t> x(-1);
+   // 1000 is of type int16_t, is found not to be in range for int8_t,
+   // x is invalid
+   CheckedInt<int8_t> x(int16_t(1000));
+   // 3123456789 is of type uint32_t, is found not to be in range for int32_t,
+   // x is invalid
+   CheckedInt<int32_t> x(uint32_t(3123456789));
+ * @endcode
+ * Implicit conversion from
+ * checked integers to plain integers is not allowed. As shown in the
+ * above example, to get the value of a checked integer as a normal integer,
+ * call value().
+ *
+ * Arithmetic operations between checked and plain integers is allowed; the
+ * result type is the type of the checked integer.
+ *
+ * Checked integers of different types cannot be used in the same arithmetic
+ * expression.
+ *
+ * There are convenience typedefs for all stdint types, of the following form
+ * (these are just 2 examples):
+   @code
+   typedef CheckedInt<int32_t> CheckedInt32;
+   typedef CheckedInt<uint16_t> CheckedUint16;
+   @endcode
+ */
+template <typename T>
+class CheckedInt {
+ protected:
+  T mValue;
+  bool mIsValid;
+
+  template <typename U>
+  constexpr CheckedInt(U aValue, bool aIsValid)
+      : mValue(aValue), mIsValid(aIsValid) {
+    static_assert(std::is_same_v<T, U>,
+                  "this constructor must accept only T values");
+    static_assert(detail::IsSupported<T>::value,
+                  "This type is not supported by CheckedInt");
+  }
+
+  friend struct detail::NegateImpl<T>;
+
+ public:
+  /**
+   * Constructs a checked integer with given @a value. The checked integer is
+   * initialized as valid or invalid depending on whether the @a value
+   * is in range.
+   *
+   * This constructor is not explicit. Instead, the type of its argument is a
+   * separate template parameter, ensuring that no conversion is performed
+   * before this constructor is actually called. As explained in the above
+   * documentation for class CheckedInt, this constructor checks that its
+   * argument is valid.
+   */
+  template <typename U>
+  MOZ_IMPLICIT MOZ_NO_ARITHMETIC_EXPR_IN_ARGUMENT constexpr CheckedInt(U aValue)
+      : mValue(T(aValue)), mIsValid(detail::IsInRange<T>(aValue)) {
+    static_assert(
+        detail::IsSupported<T>::value && detail::IsSupported<U>::value,
+        "This type is not supported by CheckedInt");
+  }
+
+  template <typename U>
+  friend class CheckedInt;
+
+  template <typename U>
+  constexpr CheckedInt<U> toChecked() const {
+    CheckedInt<U> ret(mValue);
+    ret.mIsValid = ret.mIsValid && mIsValid;
+    return ret;
+  }
+
+  /** Constructs a valid checked integer with initial value 0 */
+  constexpr CheckedInt() : mValue(T(0)), mIsValid(true) {
+    static_assert(detail::IsSupported<T>::value,
+                  "This type is not supported by CheckedInt");
+    static_assert(detail::IsInRange<T>(0), "Integer type can't represent 0");
+  }
+
+  /** @returns the actual value */
+  constexpr T value() const {
+    MOZ_DIAGNOSTIC_ASSERT(
+        mIsValid,
+        "Invalid checked integer (division by zero or integer overflow)");
+    return mValue;
+  }
+
+  /**
+   * @returns true if the checked integer is valid, i.e. is not the result
+   * of an invalid operation or of an operation involving an invalid checked
+   * integer
+   */
+  constexpr bool isValid() const { return mIsValid; }
+
+  template <typename U>
+  friend constexpr CheckedInt<U> operator+(const CheckedInt<U>& aLhs,
+                                           const CheckedInt<U>& aRhs);
+  template <typename U>
+  constexpr CheckedInt& operator+=(U aRhs);
+  constexpr CheckedInt& operator+=(const CheckedInt<T>& aRhs);
+
+  template <typename U>
+  friend constexpr CheckedInt<U> operator-(const CheckedInt<U>& aLhs,
+                                           const CheckedInt<U>& aRhs);
+  template <typename U>
+  constexpr CheckedInt& operator-=(U aRhs);
+  constexpr CheckedInt& operator-=(const CheckedInt<T>& aRhs);
+
+  template <typename U>
+  friend constexpr CheckedInt<U> operator*(const CheckedInt<U>& aLhs,
+                                           const CheckedInt<U>& aRhs);
+  template <typename U>
+  constexpr CheckedInt& operator*=(U aRhs);
+  constexpr CheckedInt& operator*=(const CheckedInt<T>& aRhs);
+
+  template <typename U>
+  friend constexpr CheckedInt<U> operator/(const CheckedInt<U>& aLhs,
+                                           const CheckedInt<U>& aRhs);
+  template <typename U>
+  constexpr CheckedInt& operator/=(U aRhs);
+  constexpr CheckedInt& operator/=(const CheckedInt<T>& aRhs);
+
+  template <typename U>
+  friend constexpr CheckedInt<U> operator%(const CheckedInt<U>& aLhs,
+                                           const CheckedInt<U>& aRhs);
+  template <typename U>
+  constexpr CheckedInt& operator%=(U aRhs);
+  constexpr CheckedInt& operator%=(const CheckedInt<T>& aRhs);
+
+  constexpr CheckedInt operator-() const {
+    return detail::NegateImpl<T>::negate(*this);
+  }
+
+  /**
+   * @returns true if the left and right hand sides are valid
+   * and have the same value.
+   *
+   * Note that these semantics are the reason why we don't offer
+   * a operator!=. Indeed, we'd want to have a!=b be equivalent to !(a==b)
+   * but that would mean that whenever a or b is invalid, a!=b
+   * is always true, which would be very confusing.
+   *
+   * For similar reasons, operators <, >, <=, >= would be very tricky to
+   * specify, so we just avoid offering them.
+   *
+   * Notice that these == semantics are made more reasonable by these facts:
+   *  1. a==b implies equality at the raw data level
+   *     (the converse is false, as a==b is never true among invalids)
+   *  2. This is similar to the behavior of IEEE floats, where a==b
+   *     means that a and b have the same value *and* neither is NaN.
+   */
+  constexpr bool operator==(const CheckedInt& aOther) const {
+    return mIsValid && aOther.mIsValid && mValue == aOther.mValue;
+  }
+
+  /** prefix ++ */
+  constexpr CheckedInt& operator++() {
+    *this += 1;
+    return *this;
+  }
+
+  /** postfix ++ */
+  constexpr CheckedInt operator++(int) {
+    CheckedInt tmp = *this;
+    *this += 1;
+    return tmp;
+  }
+
+  /** prefix -- */
+  constexpr CheckedInt& operator--() {
+    *this -= 1;
+    return *this;
+  }
+
+  /** postfix -- */
+  constexpr CheckedInt operator--(int) {
+    CheckedInt tmp = *this;
+    *this -= 1;
+    return tmp;
+  }
+
+ private:
+  /**
+   * The !=, <, <=, >, >= operators are disabled:
+   * see the comment on operator==.
+   */
+  template <typename U>
+  bool operator!=(U aOther) const = delete;
+  template <typename U>
+  bool operator<(U aOther) const = delete;
+  template <typename U>
+  bool operator<=(U aOther) const = delete;
+  template <typename U>
+  bool operator>(U aOther) const = delete;
+  template <typename U>
+  bool operator>=(U aOther) const = delete;
+};
+
+#define MOZ_CHECKEDINT_BASIC_BINARY_OPERATOR(NAME, OP)                      \
+  template <typename T>                                                     \
+  constexpr CheckedInt<T> operator OP(const CheckedInt<T>& aLhs,            \
+                                      const CheckedInt<T>& aRhs) {          \
+    if (!detail::Is##NAME##Valid(aLhs.mValue, aRhs.mValue)) {               \
+      static_assert(detail::IsInRange<T>(0),                                \
+                    "Integer type can't represent 0");                      \
+      return CheckedInt<T>(T(0), false);                                    \
+    }                                                                       \
+    /* For some T, arithmetic ops automatically promote to a wider type, so \
+     * explitly do the narrowing cast here.  The narrowing cast is valid    \
+     * because we did the "Is##NAME##Valid" check above. */                 \
+    return CheckedInt<T>(T(aLhs.mValue OP aRhs.mValue),                     \
+                         aLhs.mIsValid && aRhs.mIsValid);                   \
+  }
+
+#if MOZ_HAS_BUILTIN_OP_OVERFLOW
+#  define MOZ_CHECKEDINT_BASIC_BINARY_OPERATOR2(NAME, OP, FUN)       \
+    template <typename T>                                            \
+    constexpr CheckedInt<T> operator OP(const CheckedInt<T>& aLhs,   \
+                                        const CheckedInt<T>& aRhs) { \
+      auto result = T{};                                             \
+      if (FUN(aLhs.mValue, aRhs.mValue, &result)) {                  \
+        static_assert(detail::IsInRange<T>(0),                       \
+                      "Integer type can't represent 0");             \
+        return CheckedInt<T>(T(0), false);                           \
+      }                                                              \
+      return CheckedInt<T>(result, aLhs.mIsValid && aRhs.mIsValid);  \
+    }
+MOZ_CHECKEDINT_BASIC_BINARY_OPERATOR2(Add, +, __builtin_add_overflow)
+MOZ_CHECKEDINT_BASIC_BINARY_OPERATOR2(Sub, -, __builtin_sub_overflow)
+MOZ_CHECKEDINT_BASIC_BINARY_OPERATOR2(Mul, *, __builtin_mul_overflow)
+#  undef MOZ_CHECKEDINT_BASIC_BINARY_OPERATOR2
+#else
+MOZ_CHECKEDINT_BASIC_BINARY_OPERATOR(Add, +)
+MOZ_CHECKEDINT_BASIC_BINARY_OPERATOR(Sub, -)
+MOZ_CHECKEDINT_BASIC_BINARY_OPERATOR(Mul, *)
+#endif
+
+MOZ_CHECKEDINT_BASIC_BINARY_OPERATOR(Div, /)
+MOZ_CHECKEDINT_BASIC_BINARY_OPERATOR(Mod, %)
+#undef MOZ_CHECKEDINT_BASIC_BINARY_OPERATOR
+
+// Implement castToCheckedInt<T>(x), making sure that
+//  - it allows x to be either a CheckedInt<T> or any integer type
+//    that can be casted to T
+//  - if x is already a CheckedInt<T>, we just return a reference to it,
+//    instead of copying it (optimization)
+
+namespace detail {
+
+template <typename T, typename U>
+struct CastToCheckedIntImpl {
+  typedef CheckedInt<T> ReturnType;
+  static constexpr CheckedInt<T> run(U aU) { return aU; }
+};
+
+template <typename T>
+struct CastToCheckedIntImpl<T, CheckedInt<T>> {
+  typedef const CheckedInt<T>& ReturnType;
+  static constexpr const CheckedInt<T>& run(const CheckedInt<T>& aU) {
+    return aU;
+  }
+};
+
+}  // namespace detail
+
+template <typename T, typename U>
+constexpr typename detail::CastToCheckedIntImpl<T, U>::ReturnType
+castToCheckedInt(U aU) {
+  static_assert(detail::IsSupported<T>::value && detail::IsSupported<U>::value,
+                "This type is not supported by CheckedInt");
+  return detail::CastToCheckedIntImpl<T, U>::run(aU);
+}
+
+#define MOZ_CHECKEDINT_CONVENIENCE_BINARY_OPERATORS(OP, COMPOUND_OP)       \
+  template <typename T>                                                    \
+  template <typename U>                                                    \
+  constexpr CheckedInt<T>& CheckedInt<T>::operator COMPOUND_OP(U aRhs) {   \
+    *this = *this OP castToCheckedInt<T>(aRhs);                            \
+    return *this;                                                          \
+  }                                                                        \
+  template <typename T>                                                    \
+  constexpr CheckedInt<T>& CheckedInt<T>::operator COMPOUND_OP(            \
+      const CheckedInt<T>& aRhs) {                                         \
+    *this = *this OP aRhs;                                                 \
+    return *this;                                                          \
+  }                                                                        \
+  template <typename T, typename U>                                        \
+  constexpr CheckedInt<T> operator OP(const CheckedInt<T>& aLhs, U aRhs) { \
+    return aLhs OP castToCheckedInt<T>(aRhs);                              \
+  }                                                                        \
+  template <typename T, typename U>                                        \
+  constexpr CheckedInt<T> operator OP(U aLhs, const CheckedInt<T>& aRhs) { \
+    return castToCheckedInt<T>(aLhs) OP aRhs;                              \
+  }
+
+MOZ_CHECKEDINT_CONVENIENCE_BINARY_OPERATORS(+, +=)
+MOZ_CHECKEDINT_CONVENIENCE_BINARY_OPERATORS(*, *=)
+MOZ_CHECKEDINT_CONVENIENCE_BINARY_OPERATORS(-, -=)
+MOZ_CHECKEDINT_CONVENIENCE_BINARY_OPERATORS(/, /=)
+MOZ_CHECKEDINT_CONVENIENCE_BINARY_OPERATORS(%, %=)
+
+#undef MOZ_CHECKEDINT_CONVENIENCE_BINARY_OPERATORS
+
+template <typename T, typename U>
+constexpr bool operator==(const CheckedInt<T>& aLhs, U aRhs) {
+  return aLhs == castToCheckedInt<T>(aRhs);
+}
+
+template <typename T, typename U>
+constexpr bool operator==(U aLhs, const CheckedInt<T>& aRhs) {
+  return castToCheckedInt<T>(aLhs) == aRhs;
+}
+
+// Convenience typedefs.
+typedef CheckedInt<int8_t> CheckedInt8;
+typedef CheckedInt<uint8_t> CheckedUint8;
+typedef CheckedInt<int16_t> CheckedInt16;
+typedef CheckedInt<uint16_t> CheckedUint16;
+typedef CheckedInt<int32_t> CheckedInt32;
+typedef CheckedInt<uint32_t> CheckedUint32;
+typedef CheckedInt<int64_t> CheckedInt64;
+typedef CheckedInt<uint64_t> CheckedUint64;
+
+}  // namespace mozilla
+
+#endif /* mozilla_CheckedInt_h */