Skip to content

Commit ba5d72d

Browse files
real-or-randomreal-or-random
committed
assumptions: Use new STATIC_ASSERT macro
This also splits the big "&&" expression into separate expressions. If we ever see an assertion fail, the error message will tell it precisely which one failed.
1 parent e53c2d9 commit ba5d72d

File tree

1 file changed

+52
-48
lines changed

1 file changed

+52
-48
lines changed

‎src/assumptions.h

+52-48
Original file line numberDiff line numberDiff line change
@@ -19,65 +19,69 @@
1919
reduce the odds of experiencing an unwelcome surprise.
2020
*/
2121

22-
struct secp256k1_assumption_checker {
23-
/* This uses a trick to implement a static assertion in C89: a type with an array of negative size is not
24-
allowed. */
25-
int dummy_array[(
26-
/* Bytes are 8 bits. */
27-
(CHAR_BIT == 8) &&
22+
#if defined(__has_attribute)
23+
# if __has_attribute(__unavailable__)
24+
__attribute__((__unavailable__("Don't call this function. It only exists because STATIC_ASSERT cannot be used outside a function.")))
25+
# endif
26+
#endif
27+
static void secp256k1_assumption_checker(void) {
28+
/* Bytes are 8 bits. */
29+
STATIC_ASSERT(CHAR_BIT == 8);
2830

29-
/* No integer promotion for uint32_t. This ensures that we can multiply uintXX_t values where XX >= 32
30-
without signed overflow, which would be undefined behaviour. */
31-
(UINT_MAX <= UINT32_MAX) &&
31+
/* No integer promotion for uint32_t. This ensures that we can multiply uintXX_t values where XX >= 32
32+
without signed overflow, which would be undefined behaviour. */
33+
STATIC_ASSERT(UINT_MAX <= UINT32_MAX);
3234

33-
/* Conversions from unsigned to signed outside of the bounds of the signed type are
34-
implementation-defined. Verify that they function as reinterpreting the lower
35-
bits of the input in two's complement notation. Do this for conversions:
36-
- from uint(N)_t to int(N)_t with negative result
37-
- from uint(2N)_t to int(N)_t with negative result
38-
- from int(2N)_t to int(N)_t with negative result
39-
- from int(2N)_t to int(N)_t with positive result */
35+
/* Conversions from unsigned to signed outside of the bounds of the signed type are
36+
implementation-defined. Verify that they function as reinterpreting the lower
37+
bits of the input in two's complement notation. Do this for conversions:
38+
- from uint(N)_t to int(N)_t with negative result
39+
- from uint(2N)_t to int(N)_t with negative result
40+
- from int(2N)_t to int(N)_t with negative result
41+
- from int(2N)_t to int(N)_t with positive result */
4042

41-
/* To int8_t. */
42-
((int8_t)(uint8_t)0xAB == (int8_t)-(int8_t)0x55) &&
43-
((int8_t)(uint16_t)0xABCD == (int8_t)-(int8_t)0x33) &&
44-
((int8_t)(int16_t)(uint16_t)0xCDEF == (int8_t)(uint8_t)0xEF) &&
45-
((int8_t)(int16_t)(uint16_t)0x9234 == (int8_t)(uint8_t)0x34) &&
43+
/* To int8_t. */
44+
STATIC_ASSERT(((int8_t)(uint8_t)0xAB == (int8_t)-(int8_t)0x55));
45+
STATIC_ASSERT((int8_t)(uint16_t)0xABCD == (int8_t)-(int8_t)0x33);
46+
STATIC_ASSERT((int8_t)(int16_t)(uint16_t)0xCDEF == (int8_t)(uint8_t)0xEF);
47+
STATIC_ASSERT((int8_t)(int16_t)(uint16_t)0x9234 == (int8_t)(uint8_t)0x34);
4648

47-
/* To int16_t. */
48-
((int16_t)(uint16_t)0xBCDE == (int16_t)-(int16_t)0x4322) &&
49-
((int16_t)(uint32_t)0xA1B2C3D4 == (int16_t)-(int16_t)0x3C2C) &&
50-
((int16_t)(int32_t)(uint32_t)0xC1D2E3F4 == (int16_t)(uint16_t)0xE3F4) &&
51-
((int16_t)(int32_t)(uint32_t)0x92345678 == (int16_t)(uint16_t)0x5678) &&
49+
/* To int16_t. */
50+
STATIC_ASSERT((int16_t)(uint16_t)0xBCDE == (int16_t)-(int16_t)0x4322);
51+
STATIC_ASSERT((int16_t)(uint32_t)0xA1B2C3D4 == (int16_t)-(int16_t)0x3C2C);
52+
STATIC_ASSERT((int16_t)(int32_t)(uint32_t)0xC1D2E3F4 == (int16_t)(uint16_t)0xE3F4);
53+
STATIC_ASSERT((int16_t)(int32_t)(uint32_t)0x92345678 == (int16_t)(uint16_t)0x5678);
5254

53-
/* To int32_t. */
54-
((int32_t)(uint32_t)0xB2C3D4E5 == (int32_t)-(int32_t)0x4D3C2B1B) &&
55-
((int32_t)(uint64_t)0xA123B456C789D012ULL == (int32_t)-(int32_t)0x38762FEE) &&
56-
((int32_t)(int64_t)(uint64_t)0xC1D2E3F4A5B6C7D8ULL == (int32_t)(uint32_t)0xA5B6C7D8) &&
57-
((int32_t)(int64_t)(uint64_t)0xABCDEF0123456789ULL == (int32_t)(uint32_t)0x23456789) &&
55+
/* To int32_t. */
56+
STATIC_ASSERT((int32_t)(uint32_t)0xB2C3D4E5 == (int32_t)-(int32_t)0x4D3C2B1B);
57+
STATIC_ASSERT((int32_t)(uint64_t)0xA123B456C789D012ULL == (int32_t)-(int32_t)0x38762FEE);
58+
STATIC_ASSERT((int32_t)(int64_t)(uint64_t)0xC1D2E3F4A5B6C7D8ULL == (int32_t)(uint32_t)0xA5B6C7D8);
59+
STATIC_ASSERT((int32_t)(int64_t)(uint64_t)0xABCDEF0123456789ULL == (int32_t)(uint32_t)0x23456789);
5860

59-
/* To int64_t. */
60-
((int64_t)(uint64_t)0xB123C456D789E012ULL == (int64_t)-(int64_t)0x4EDC3BA928761FEEULL) &&
61+
/* To int64_t. */
62+
STATIC_ASSERT((int64_t)(uint64_t)0xB123C456D789E012ULL == (int64_t)-(int64_t)0x4EDC3BA928761FEEULL);
6163
#if defined(SECP256K1_INT128_NATIVE)
62-
((int64_t)(((uint128_t)0xA1234567B8901234ULL << 64) + 0xC5678901D2345678ULL) == (int64_t)-(int64_t)0x3A9876FE2DCBA988ULL) &&
63-
(((int64_t)(int128_t)(((uint128_t)0xB1C2D3E4F5A6B7C8ULL << 64) + 0xD9E0F1A2B3C4D5E6ULL)) == (int64_t)(uint64_t)0xD9E0F1A2B3C4D5E6ULL) &&
64-
(((int64_t)(int128_t)(((uint128_t)0xABCDEF0123456789ULL << 64) + 0x0123456789ABCDEFULL)) == (int64_t)(uint64_t)0x0123456789ABCDEFULL) &&
64+
STATIC_ASSERT((int64_t)(((uint128_t)0xA1234567B8901234ULL << 64) + 0xC5678901D2345678ULL) == (int64_t)-(int64_t)0x3A9876FE2DCBA988ULL);
65+
STATIC_ASSERT(((int64_t)(int128_t)(((uint128_t)0xB1C2D3E4F5A6B7C8ULL << 64) + 0xD9E0F1A2B3C4D5E6ULL)) == (int64_t)(uint64_t)0xD9E0F1A2B3C4D5E6ULL);
66+
STATIC_ASSERT(((int64_t)(int128_t)(((uint128_t)0xABCDEF0123456789ULL << 64) + 0x0123456789ABCDEFULL)) == (int64_t)(uint64_t)0x0123456789ABCDEFULL);
6567

66-
/* To int128_t. */
67-
((int128_t)(((uint128_t)0xB1234567C8901234ULL << 64) + 0xD5678901E2345678ULL) == (int128_t)(-(int128_t)0x8E1648B3F50E80DCULL * 0x8E1648B3F50E80DDULL + 0x5EA688D5482F9464ULL)) &&
68+
/* To int128_t. */
69+
STATIC_ASSERT((int128_t)(((uint128_t)0xB1234567C8901234ULL << 64) + 0xD5678901E2345678ULL) == (int128_t)(-(int128_t)0x8E1648B3F50E80DCULL * 0x8E1648B3F50E80DDULL + 0x5EA688D5482F9464ULL));
6870
#endif
6971

70-
/* Right shift on negative signed values is implementation defined. Verify that it
71-
acts as a right shift in two's complement with sign extension (i.e duplicating
72-
the top bit into newly added bits). */
73-
((((int8_t)0xE8) >> 2) == (int8_t)(uint8_t)0xFA) &&
74-
((((int16_t)0xE9AC) >> 4) == (int16_t)(uint16_t)0xFE9A) &&
75-
((((int32_t)0x937C918A) >> 9) == (int32_t)(uint32_t)0xFFC9BE48) &&
76-
((((int64_t)0xA8B72231DF9CF4B9ULL) >> 19) == (int64_t)(uint64_t)0xFFFFF516E4463BF3ULL) &&
72+
/* Right shift on negative signed values is implementation defined. Verify that it
73+
acts as a right shift in two's complement with sign extension (i.e duplicating
74+
the top bit into newly added bits). */
75+
STATIC_ASSERT((((int8_t)0xE8) >> 2) == (int8_t)(uint8_t)0xFA);
76+
STATIC_ASSERT((((int16_t)0xE9AC) >> 4) == (int16_t)(uint16_t)0xFE9A);
77+
STATIC_ASSERT((((int32_t)0x937C918A) >> 9) == (int32_t)(uint32_t)0xFFC9BE48);
78+
STATIC_ASSERT((((int64_t)0xA8B72231DF9CF4B9ULL) >> 19) == (int64_t)(uint64_t)0xFFFFF516E4463BF3ULL);
7779
#if defined(SECP256K1_INT128_NATIVE)
78-
((((int128_t)(((uint128_t)0xCD833A65684A0DBCULL << 64) + 0xB349312F71EA7637ULL)) >> 39) == (int128_t)(((uint128_t)0xFFFFFFFFFF9B0674ULL << 64) + 0xCAD0941B79669262ULL)) &&
80+
STATIC_ASSERT((((int128_t)(((uint128_t)0xCD833A65684A0DBCULL << 64) + 0xB349312F71EA7637ULL)) >> 39) == (int128_t)(((uint128_t)0xFFFFFFFFFF9B0674ULL << 64) + 0xCAD0941B79669262ULL));
7981
#endif
80-
1) * 2 - 1];
81-
};
82+
83+
/* This function is not supposed to be called. */
84+
VERIFY_CHECK(0);
85+
}
8286

8387
#endif /* SECP256K1_ASSUMPTIONS_H */

0 commit comments

Comments
 (0)