Disallow bit-shifting when the left operand is negative.

src/compiler/preprocessor/ExpressionParser.cpp

@@ -1492,7 +1492,7 @@ yyreduce:
   case 18:
 
     {
-        if ((yyvsp[0]) < 0)
+        if ((yyvsp[-1]) < 0 || (yyvsp[0]) < 0)
         {
             if (!context->isIgnoringErrors())
             {
@@ -1516,7 +1516,7 @@ yyreduce:
   case 19:
 
     {
-        if ((yyvsp[0]) < 0)
+        if ((yyvsp[-1]) < 0 || (yyvsp[0]) < 0)
         {
             if (!context->isIgnoringErrors())
             {

src/compiler/preprocessor/ExpressionParser.y

@@ -196,7 +196,7 @@ expression
         $$ = $1 < $3;
     }
     | expression TOK_OP_RIGHT expression {
-        if ($3 < 0)
+        if ($2 < 0 || $3 < 0)
         {
             if (!context->isIgnoringErrors())
             {
@@ -216,7 +216,7 @@ expression
         }
     }
     | expression TOK_OP_LEFT expression {
-        if ($3 < 0)
+        if ($2 < 0 || $3 < 0)
         {
             if (!context->isIgnoringErrors())
             {

src/tests/compiler_tests/MalformedShader_test.cpp

@@ -1701,6 +1701,26 @@ TEST_F(MalformedShaderTest, LineDirectiveNegativeShift)
     }
 }
 
+// Covers a bug in our parsing of malformed shift preprocessor expressions.
+TEST_F(MalformedShaderTest, IfDirectiveNegativeLeftShift)
+{
+    const std::string &shaderString = "#if -1 << 1";
+    if (compile(shaderString))
+    {
+        FAIL() << "Shader compilation succeeded, expecting failure " << mInfoLog;
+    }
+}
+
+// Covers a bug in our parsing of malformed shift preprocessor expressions.
+TEST_F(MalformedShaderTest, IfDirectiveNegativeRightShift)
+{
+    const std::string &shaderString = "#if -1 >> 1";
+    if (compile(shaderString))
+    {
+        FAIL() << "Shader compilation succeeded, expecting failure " << mInfoLog;
+    }
+}
+
 // gl_MaxImageUnits is only available in ES 3.1 shaders.
 TEST_F(MalformedShaderTest, MaxImageUnitsInES3Shader)
 {