encoding/utf8: enforce scalar and buffer bounds

lib/encoding/utf8/decode_test.ww

@@ -5,6 +5,7 @@ package utf8_test;
 
 import bytes;
 import encoding.utf8;
+import test;
 
 // ref/hare/encoding/utf8/decode.ha:27. Round-trip via the same byte
 // vectors used in encode.
@@ -487,6 +488,27 @@ import encoding.utf8;
 	assert(!(utf8.remaining(&d1).len != 0));
 };
 
+// Pointer equality alone does not establish that two decoders have the same
+// source: differently bounded views over one allocation have different valid
+// offset ranges.
+@test fn slice_mismatched_source_length_aborts() void = {
+	test.expectabort();
+	let src: [4]u8;
+	let begin: utf8.decoder = utf8.decode(src[0:1]);
+	let end: utf8.decoder = utf8.decode(src[0:4]);
+	utf8.slice(&begin, &end);
+};
+
+@test fn slice_offset_past_source_aborts() void = {
+	test.expectabort();
+	let src: [1]u8;
+	let begin: utf8.decoder = utf8.decode(src[0:1]);
+	let end: utf8.decoder = utf8.decode(src[0:1]);
+	begin.offs = 2;
+	end.offs = 2;
+	utf8.slice(&begin, &end);
+};
+
 @test fn roundtrip() void = {
 	let runes: [4]u32;
 	runes[0] = 0x41u32;