C++: Avoid undefined behaviour when casting float to int #6564
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
When the truncated float can't be represented as int, it's undefined behaviour to cast. Work around this by clamping. Unfortunately this has the side-effect of eliminating an implicit sign conversion that causes signed vs. unsigned comparison warning, when comparing images. The compiler is told that the width/height is Type::Int32, when we return it as uint32_t. This is eliminated with a private helper function.
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
ogoffart
reviewed
Oct 15, 2024
| @@ -129,6 +129,13 @@ inline void debug(const SharedString &str) | |||
| cbindgen_private::slint_debug(&str); | |||
| } | |||
|
|
|||
| constexpr inline int cast_float_to_int(float f) | |||
| { | |||
| // Casting > int_max, etc. is UB, so clamp. | |||
There was a problem hiding this comment.
Why not use std::clamp? Because of NaN?
There was a problem hiding this comment.
Just me being forgetful - thanks :). Maybe that also helps with the CI.
(best part, I even wrote clamp in the comment!)
ogoffart
approved these changes
Oct 15, 2024
ogoffart
reviewed
Oct 15, 2024
api/cpp/include/slint.h
Outdated
| { | ||
| // Casting > int_max, etc. is UB, so clamp. | ||
| return static_cast<int>(std::min(std::max(f, float(std::numeric_limits<int>::min())), | ||
| float(std::numeric_limits<int>::max()))); |
There was a problem hiding this comment.
It is possible that MAX_INT cannot be represented as a float and is still larger
|
Grmbl. This also fails. My excitement for this change is.. reducing. I'm going to start over fixing the test to use floats. |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
When the truncated float can't be represented as int, it's undefined behaviour to cast. Work around this by clamping.
Unfortunately this has the side-effect of eliminating an implicit sign conversion that causes signed vs. unsigned comparison warning, when comparing images. The compiler is told that the width/height is Type::Int32, when we return it as uint32_t. This is eliminated with a private helper function.