Durations's Arbitrary instance is dependant on Gen's size

[avandecreme]

According to Gen::new doc:

The size parameter controls the size of random values generated. For example, it specifies the maximum length of a randomly generated vector, but is and should not be used to control the range of a randomly generated number. (Unless that number is used to control the size of a data structure.)

However Duration's Arbitrary is defined like this:

quickcheck/src/arbitrary.rs

Lines 1068 to 1072 in aa968a9

	fn arbitrary(gen: &mut Gen) -> Self {
	let seconds = gen.gen_range(0..gen.size() as u64);
	let nanoseconds = gen.gen_range(0..1_000_000);
	Duration::new(seconds, nanoseconds)
	}

The way seconds is generated seems in violation of the above rule to me and has the consequence of generating very short duration only (with the default size of 100).

According to https://doc.rust-lang.org/nightly/core/time/struct.Duration.html#method.new it seems that we should be able to use the full u64 range without issue for seconds since we are already capping the nano seconds to one billion.

However from my testing this break SystemTime's instance because we can get overflows in the following implementation:

quickcheck/src/arbitrary.rs

Lines 1104 to 1112 in aa968a9

	fn arbitrary(gen: &mut Gen) -> Self {
	let after_epoch = bool::arbitrary(gen);
	let duration = Duration::arbitrary(gen);
	if after_epoch {
	UNIX_EPOCH + duration
	} else {
	UNIX_EPOCH - duration
	}
	}

Any idea how we should fix this?

[neithernut]

We could use SystemTime::checked_add and checked_sub, and divide the duration by two if that fails. Maybe just do that in a loop until we end up with a valid SystemTime.