Move UBSan warnings from a blacklist to the source

webrtc/rtc_base/random.cc

 /*
  *  Copyright (c) 2015 The WebRTC project authors. All Rights Reserved.
  *
  *  Use of this source code is governed by a BSD-style license
  *  that can be found in the LICENSE file in the root of the source
  *  tree. An additional intellectual property rights grant can be found
  *  in the file PATENTS.  All contributing project authors may
  *  be found in the AUTHORS file in the root of the source tree.
  */
 #include "webrtc/rtc_base/random.h"
@@ skipping 22 matching lines @@
   return result;
 }
 
 uint32_t Random::Rand(uint32_t low, uint32_t high) {
   RTC_DCHECK(low <= high);
   return Rand(high - low) + low;
 }
 
 int32_t Random::Rand(int32_t low, int32_t high) {
   RTC_DCHECK(low <= high);
-  // We rely on subtraction (and addition) to be the same for signed and
-  // unsigned numbers in two-complement representation. Thus, although
-  // high - low might be negative as an int, it is the correct difference
-  // when interpreted as an unsigned.
-  return Rand(high - low) + low;
+  const auto low_i64 = static_cast<int64_t>(low);

[kwiberg-webrtc, 2017/09/04 23:09:50]

This can be

  const int64_t low_i64{low};

[oprypin_webrtc, 2017/09/05 07:27:34]

I used the code you suggested in
https://bugs.chromium.org/p/webrtc/issues/detail?id=8189&desc=3#c7
I checked that with this change it's still the same byte-for-byte, so I agree.
https://godbolt.org/g/upEsVg
Changed.

[kwiberg-webrtc, 2017/09/05 08:37:30]

Excellent. That matches my results from when I wrote that bug comment.

+  return static_cast<int32_t>(Rand(static_cast<uint32_t>(high - low_i64)) +
+                              low_i64);

[kwiberg-webrtc, 2017/09/04 23:09:51]

Both of these static_casts can be proven to always preserve values, right? But
we don't expect the compiler to be able to prove it? In that case, they should
probably be dchecked_casts.

[oprypin_webrtc, 2017/09/05 07:27:34]

high - low_i64 always fits in uint32_t:
(2**31-1) - (-2**31) == (2**32-1)

Minimal result of Rand+low_i64 is 0 + (-2**31) == (-2**31)
Maximal result of Rand+low_i64 is (2**32-1) + (-2**31) == (2**31-1)

So seems like truncations are impossible here.
dchecked_cast will work. Changed.

[kwiberg-webrtc, 2017/09/05 08:37:31]

Thanks for double-checking the math!

 }
 
 template <>
 float Random::Rand<float>() {
   double result = NextOutput() - 1;
   result = result / 0xFFFFFFFFFFFFFFFEull;
   return static_cast<float>(result);
 }
 
 template <>
@@ skipping 19 matching lines @@
   double u2 = static_cast<double>(NextOutput()) / 0xFFFFFFFFFFFFFFFFull;
   return mean + standard_deviation * sqrt(-2 * log(u1)) * cos(2 * kPi * u2);
 }
 
 double Random::Exponential(double lambda) {
   double uniform = Rand<double>();
   return -log(uniform) / lambda;
 }
 
 }  // namespace webrtc