Handle negative float to uint conversion robustly

src/compiler/translator/ConstantUnion.cpp

@@ -157,7 +157,16 @@ bool TConstantUnion::cast(TBasicType newType, const TConstantUnion &constant)
                     setUConst(static_cast<unsigned int>(constant.getBConst()));
                     break;
                 case EbtFloat:
-                    setUConst(static_cast<unsigned int>(constant.getFConst()));
+                    if (constant.getFConst() < 0.0f)
+                    {
+                        // Avoid undefined behavior in C++ by first casting to signed int.
+                        setUConst(
+                            static_cast<unsigned int>(static_cast<int>(constant.getFConst())));
+                    }
+                    else
+                    {
+                        setUConst(static_cast<unsigned int>(constant.getFConst()));
+                    }
                     break;
                 default:
                     return false;

src/compiler/translator/IntermNode.cpp

@@ -1711,6 +1711,32 @@ TIntermTyped *TIntermAggregate::fold(TDiagnostics *diagnostics)
         if (mType.canReplaceWithConstantUnion())
         {
             constArray = getConstantValue();
+            if (constArray && mType.getBasicType() == EbtUInt)
+            {
+                // Check if we converted a negative float to uint and issue a warning in that case.
+                size_t sizeRemaining = mType.getObjectSize();
+                for (TIntermNode *arg : mArguments)
+                {
+                    TIntermTyped *typedArg = arg->getAsTyped();
+                    if (typedArg->getBasicType() == EbtFloat)
+                    {
+                        const TConstantUnion *argValue = typedArg->getConstantValue();
+                        size_t castSize =
+                            std::min(typedArg->getType().getObjectSize(), sizeRemaining);
+                        for (size_t i = 0; i < castSize; ++i)
+                        {
+                            if (argValue[i].getFConst() < 0.0f)
+                            {
+                                // ESSL 3.00.6 section 5.4.1.
+                                diagnostics->warning(
+                                    mLine, "casting a negative float to uint is undefined",
+                                    mType.getBuiltInTypeNameString());
+                            }
+                        }
+                    }
+                    sizeRemaining -= typedArg->getType().getObjectSize();
+                }
+            }
         }
     }
     else if (CanFoldAggregateBuiltInOp(mOp))

src/tests/compiler_tests/ConstantFolding_test.cpp

@@ -1607,3 +1607,41 @@ TEST_F(ConstantFoldingTest, FoldArrayOfArraysConstructorEquality)
     ASSERT_TRUE(constantFoundInAST(5.0f));
     ASSERT_FALSE(constantFoundInAST(4.0f));
 }
+
+// Test that casting a negative float to uint results in a warning. ESSL 3.00.6 section 5.4.1
+// specifies this as an undefined conversion.
+TEST_F(ConstantFoldingExpressionTest, FoldNegativeFloatToUint)
+{
+    const std::string &uintString = "uint(-1.0)";
+    evaluateUint(uintString);
+    ASSERT_TRUE(constantFoundInAST(std::numeric_limits<unsigned int>::max()));
+    ASSERT_TRUE(hasWarning());
+}
+
+// Test that casting a negative float to uint inside a uvec constructor results in a warning. ESSL
+// 3.00.6 section 5.4.1 specifies this as an undefined conversion.
+TEST_F(ConstantFoldingExpressionTest, FoldNegativeFloatToUvec)
+{
+    const std::string &uintString = "uvec4(2.0, 1.0, vec2(0.0, -1.0)).w";
+    evaluateUint(uintString);
+    ASSERT_TRUE(constantFoundInAST(std::numeric_limits<unsigned int>::max()));
+    ASSERT_TRUE(hasWarning());
+}
+
+// Test that a negative float doesn't result in a warning when it is inside a constructor but isn't
+// actually converted.
+TEST_F(ConstantFoldingExpressionTest, NegativeFloatInsideUvecConstructorButOutOfRange)
+{
+    const std::string &uintString = "uvec2(1.0, vec2(0.0, -1.0)).x";
+    evaluateUint(uintString);
+    ASSERT_FALSE(hasWarning());
+}
+
+// Test that a large float (above max int32_t) is converted to unsigned integer correctly.
+TEST_F(ConstantFoldingExpressionTest, LargeFloatToUint)
+{
+    const std::string &uintString = "uint(3221225472.0)";
+    evaluateUint(uintString);
+    ASSERT_TRUE(constantFoundInAST(3221225472u));
+    ASSERT_FALSE(hasWarning());
+}