Make overflow checks optional at compile time

.github/workflows/ci.yml

@@ -39,6 +39,16 @@ jobs:
             installed_clang_version: 14
           }
 
+        - {
+            name: "Ubuntu Clang-16 Sanitizer",
+            os: ubuntu-latest,
+            build_type: "Release",
+            cc: "clang-16",
+            cxx: "clang++-16",
+            clang_version: 16,
+            installed_clang_version: 14
+          }
+
         - {
             name: "Ubuntu Clang-17 Debug",
             os: ubuntu-latest,
@@ -75,7 +85,7 @@ jobs:
             build_type: "Release",
             cc: "gcc-13",
             cxx: "g++-13",
-            clang_version: 17,
+            clang_version: 16,
             installed_clang_version: 14
           }
 

.github/workflows/hdoc.yml

@@ -10,7 +10,7 @@ jobs:
     if: github.repository == 'chromium/subspace'
     runs-on: ubuntu-latest
     env:
-      clang_version: 17
+      clang_version: 16
       installed_clang_version: 14
 
     steps:

.github/workflows/subdoc.yml

@@ -10,7 +10,7 @@ jobs:
     if: github.repository == 'chromium/subspace'
     runs-on: ubuntu-latest
     env:
-      clang_version: 17
+      clang_version: 16
       installed_clang_version: 14
 
     steps:

.github/workflows/try.yml

@@ -42,6 +42,16 @@ jobs:
             installed_clang_version: 14
           }
 
+        - {
+            name: "Ubuntu Clang-16 Sanitizer",
+            os: ubuntu-latest,
+            build_type: "Release",
+            cc: "clang-16",
+            cxx: "clang++-16",
+            clang_version: 16,
+            installed_clang_version: 14
+          }
+
         - {
             name: "Ubuntu Clang-17 Debug",
             os: ubuntu-latest,
@@ -78,7 +88,7 @@ jobs:
             build_type: "Release",
             cc: "gcc-13",
             cxx: "g++-13",
-            clang_version: 17,
+            clang_version: 16,
             installed_clang_version: 14
           }
 
@@ -258,7 +268,7 @@ jobs:
     name: Generate Subdoc
     runs-on: ubuntu-latest
     env:
-      clang_version: 17
+      clang_version: 16
       installed_clang_version: 14
 
     steps:

sus/CMakeLists.txt

@@ -157,6 +157,7 @@ target_sources(subspace PUBLIC
     "mem/size_of.h"
     "mem/swap.h"
     "mem/take.h"
+    "num/__private/check_integer_overflow.h"
     "num/__private/float_consts.inc"
     "num/__private/float_methods.inc"
     "num/__private/float_methods_impl.inc"
@@ -325,6 +326,20 @@ if(${SUBSPACE_BUILD_TESTS})
         "tuple/tuple_unittest.cc"
     )
 
+    add_executable(subspace_overflow_unittests
+        "num/i8_overflow_unittest.cc"
+        "num/i16_overflow_unittest.cc"
+        "num/i32_overflow_unittest.cc"
+        "num/i64_overflow_unittest.cc"
+        "num/isize_overflow_unittest.cc"
+        "num/u8_overflow_unittest.cc"
+        "num/u16_overflow_unittest.cc"
+        "num/u32_overflow_unittest.cc"
+        "num/u64_overflow_unittest.cc"
+        "num/uptr_overflow_unittest.cc"
+        "num/usize_overflow_unittest.cc"
+    )
+
     # Subspace test support
     subspace_test_default_compile_options(subspace_test_support)
     target_link_libraries(subspace_test_support subspace::lib)
@@ -336,7 +351,18 @@ if(${SUBSPACE_BUILD_TESTS})
         subspace::test_support
         gtest_main
     )
-
     gtest_discover_tests(subspace_unittests)
+
+    # Subspace overflow unittests
+    subspace_test_default_compile_options(subspace_overflow_unittests)
+    target_compile_options(subspace_overflow_unittests PUBLIC
+        -DSUS_CHECK_INTEGER_OVERFLOW=false
+    )
+    target_link_libraries(subspace_overflow_unittests
+        subspace::lib
+        subspace::test_support
+        gtest_main
+    )
+    gtest_discover_tests(subspace_overflow_unittests)
 endif()
 

sus/num/__private/check_integer_overflow.h

@@ -0,0 +1,25 @@
+// Copyright 2023 Google LLC
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     https://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+// IWYU pragma: private
+// IWYU pragma: friend "sus/.*"
+#pragma once
+
+// SUS_CHECK_INTEGER_OVERFLOW can be defined to false to disable overflow checks
+// in integer arithmetic and shifting operations.
+#if !defined(SUS_CHECK_INTEGER_OVERFLOW)
+#define SUS_CHECK_INTEGER_OVERFLOW true
+#endif
+static_assert(SUS_CHECK_INTEGER_OVERFLOW == false ||
+              SUS_CHECK_INTEGER_OVERFLOW == true);

sus/num/__private/intrinsics.h

@@ -459,6 +459,13 @@ sus_pure_const sus_always_inline constexpr T unchecked_shl(
   return static_cast<T>(MathType<T>{x} << y);
 }
 
+template <class T>
+  requires(std::is_integral_v<T> && std::is_signed_v<T>)
+sus_pure_const sus_always_inline constexpr T unchecked_shl(
+    T x, uint64_t y) noexcept {
+  return static_cast<T>(MathType<T>{x} << y);
+}
+
 template <class T>
   requires(std::is_integral_v<T> && !std::is_signed_v<T>)
 sus_pure_const sus_always_inline constexpr T unchecked_shr(
@@ -698,8 +705,8 @@ sus_pure_const sus_always_inline constexpr T reverse_bits(T value) noexcept {
 
 template <class T>
   requires(std::is_integral_v<T> && std::is_unsigned_v<T>)
-sus_pure_const inline constexpr T rotate_left(T value, uint32_t n) noexcept {
-  const uint32_t num_bits = unchecked_mul(unchecked_sizeof<T>(), uint32_t{8});
+sus_pure_const inline constexpr T rotate_left(T value, uint64_t n) noexcept {
+  const uint64_t num_bits = unchecked_mul(unchecked_sizeof<T>(), uint32_t{8});
   // Try avoid slow % operation if we can. Comparisons are much faster than %.
   if (n >= num_bits) n %= num_bits;
   if (n == 0) return value;
@@ -709,8 +716,8 @@ sus_pure_const inline constexpr T rotate_left(T value, uint32_t n) noexcept {
 
 template <class T>
   requires(std::is_integral_v<T> && std::is_unsigned_v<T>)
-sus_pure_const inline constexpr T rotate_right(T value, uint32_t n) noexcept {
-  const uint32_t num_bits = unchecked_mul(unchecked_sizeof<T>(), uint32_t{8});
+sus_pure_const inline constexpr T rotate_right(T value, uint64_t n) noexcept {
+  const uint64_t num_bits = unchecked_mul(unchecked_sizeof<T>(), uint32_t{8});
   // Try avoid slow % operation if we can. Comparisons are much faster than %.
   if (n >= num_bits) n %= num_bits;
   if (n == 0) return value;
@@ -1052,6 +1059,10 @@ sus_pure_const inline constexpr OverflowOut<T> pow_with_overflow(
       .overflow = overflow || r.overflow, .value = r.value};
 }
 
+/// Shift left operation, wrapping the rhs if it's as large or larger than
+/// num_bits<T>.
+///
+/// Returns the wrapped result along with whether the rhs overflowed.
 template <class T>
   requires(std::is_integral_v<T> && !std::is_signed_v<T> &&
            (::sus::mem::size_of<T>() == 1 || ::sus::mem::size_of<T>() == 2 ||
@@ -1068,6 +1079,10 @@ sus_pure_const inline constexpr OverflowOut<T> shl_with_overflow(
                                               .value = unchecked_shl(x, shift)};
 }
 
+/// Shift left operation, wrapping the rhs if it's as large or larger than
+/// num_bits<T>.
+///
+/// Returns the wrapped result along with whether the rhs overflowed.
 template <class T>
   requires(std::is_integral_v<T> && std::is_signed_v<T> &&
            (::sus::mem::size_of<T>() == 1 || ::sus::mem::size_of<T>() == 2 ||
@@ -1080,11 +1095,14 @@ sus_pure_const inline constexpr OverflowOut<T> shl_with_overflow(
   const bool overflow = shift >= num_bits<T>();
   if (overflow) [[unlikely]]
     shift = shift & (unchecked_sub(num_bits<T>(), uint32_t{1}));
-  return OverflowOut sus_clang_bug_56394(<T>){
-      .overflow = overflow,
-      .value = into_signed(unchecked_shl(into_unsigned(x), shift))};
+  return OverflowOut sus_clang_bug_56394(<T>){.overflow = overflow,
+                                              .value = unchecked_shl(x, shift)};
 }
 
+/// Shift right operation, wrapping the rhs if it's as large or larger than
+/// num_bits<T>.
+///
+/// Returns the wrapped result along with whether the rhs overflowed.
 template <class T>
   requires(std::is_integral_v<T> && !std::is_signed_v<T> &&
            (::sus::mem::size_of<T>() == 1 || ::sus::mem::size_of<T>() == 2 ||
@@ -1101,6 +1119,10 @@ sus_pure_const inline constexpr OverflowOut<T> shr_with_overflow(
                                               .value = unchecked_shr(x, shift)};
 }
 
+/// Shift right operation, wrapping the rhs if it's as large or larger than
+/// num_bits<T>.
+///
+/// Returns the wrapped result along with whether the rhs overflowed.
 template <class T>
   requires(std::is_integral_v<T> && std::is_signed_v<T> &&
            (::sus::mem::size_of<T>() == 1 || ::sus::mem::size_of<T>() == 2 ||