From 90471caf4fbc9cbe25093d627100b486863e1c4e Mon Sep 17 00:00:00 2001
From: Tim Fennis <fennis.tim@gmail.com>
Date: Tue, 2 Jun 2026 08:51:42 +0200
Subject: [PATCH 1/3] =?UTF-8?q?fix(stdlib):=20error=20instead=20of=20panic?=
 =?UTF-8?q?king=20on=20reversed=20slice=20ranges=20=F0=9F=94=AA?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---
 manual/src/snippets/slices.md                             | 4 ++++
 ndc_stdlib/src/index.rs                                   | 5 +++++
 .../programs/009_slicing/008_reversed_string_slice.ndc    | 4 ++++
 .../programs/009_slicing/009_reversed_deque_slice.ndc     | 8 ++++++++
 .../009_slicing/010_reversed_slice_assignment.ndc         | 5 +++++
 5 files changed, 26 insertions(+)
 create mode 100644 tests/functional/programs/009_slicing/008_reversed_string_slice.ndc
 create mode 100644 tests/functional/programs/009_slicing/009_reversed_deque_slice.ndc
 create mode 100644 tests/functional/programs/009_slicing/010_reversed_slice_assignment.ndc

diff --git a/manual/src/snippets/slices.md b/manual/src/snippets/slices.md
index 88296dce..b4997de9 100644
--- a/manual/src/snippets/slices.md
+++ b/manual/src/snippets/slices.md
@@ -12,3 +12,7 @@ assert_eq([30, 40, 50, 60], my_list[3..=6]);
 // Negative indices: Counting from the end of the list
 assert_eq([80, 90], my_list[-3..-1]);
 ```
+
+A range whose start lands after its end (for example `my_list[6..3]`) is out of
+bounds and raises an error rather than returning a reversed or empty slice. This
+holds for lists, strings, tuples and deques alike.
diff --git a/ndc_stdlib/src/index.rs b/ndc_stdlib/src/index.rs
index 88cf0fc6..8dca3857 100644
--- a/ndc_stdlib/src/index.rs
+++ b/ndc_stdlib/src/index.rs
@@ -230,6 +230,11 @@ fn extract_vm_offset(index_value: &Value, size: usize) -> Result<VmOffset, VmErr
             } else {
                 to_idx
             };
+            if to_idx < from_idx {
+                return Err(VmError::native(format!(
+                    "{from_idx}..{to_idx} out of bounds"
+                )));
+            }
             return Ok(VmOffset::Range(from_idx, to_idx));
         }
         if let Some(start) = iter_ref.unbounded_range_start() {
diff --git a/tests/functional/programs/009_slicing/008_reversed_string_slice.ndc b/tests/functional/programs/009_slicing/008_reversed_string_slice.ndc
new file mode 100644
index 00000000..fe7dae02
--- /dev/null
+++ b/tests/functional/programs/009_slicing/008_reversed_string_slice.ndc
@@ -0,0 +1,4 @@
+// expect-error: 3..1 out of bounds
+// A reversed range on a string used to panic with "attempt to subtract with
+// overflow"; it must now error gracefully like list/tuple slices do.
+"hello"[3..1]
diff --git a/tests/functional/programs/009_slicing/009_reversed_deque_slice.ndc b/tests/functional/programs/009_slicing/009_reversed_deque_slice.ndc
new file mode 100644
index 00000000..879744cd
--- /dev/null
+++ b/tests/functional/programs/009_slicing/009_reversed_deque_slice.ndc
@@ -0,0 +1,8 @@
+// expect-error: 1..0 out of bounds
+// A reversed range on a deque used to panic with "attempt to subtract with
+// overflow"; it must now error gracefully.
+let d = Deque();
+d.push_back(1);
+d.push_back(2);
+d.push_back(3);
+d[1..0]
diff --git a/tests/functional/programs/009_slicing/010_reversed_slice_assignment.ndc b/tests/functional/programs/009_slicing/010_reversed_slice_assignment.ndc
new file mode 100644
index 00000000..3c94db8f
--- /dev/null
+++ b/tests/functional/programs/009_slicing/010_reversed_slice_assignment.ndc
@@ -0,0 +1,5 @@
+// expect-error: 3..1 out of bounds
+// Assigning into a reversed slice used to panic with "attempt to subtract with
+// overflow"; it must now error gracefully.
+let x = [1, 2, 3, 4];
+x[3..1] = [9]

From 1bf004cc13098962a1aca0f052b38c0067a26036 Mon Sep 17 00:00:00 2001
From: Tim Fennis <fennis.tim@gmail.com>
Date: Tue, 2 Jun 2026 09:02:54 +0200
Subject: [PATCH 2/3] =?UTF-8?q?fix(stdlib):=20reject=20inclusive=20reverse?=
 =?UTF-8?q?d=20ranges=20before=20widening=20end=20=F0=9F=94=AA?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The reversed-range check ran after the inclusive +1 adjustment, so an
off-by-one inclusive range like `1..=0` survived it and silently returned
an empty slice instead of erroring. Move the check before the widening.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---
 ndc_stdlib/src/index.rs                             | 13 ++++++++-----
 .../009_slicing/011_reversed_inclusive_slice.ndc    |  4 ++++
 2 files changed, 12 insertions(+), 5 deletions(-)
 create mode 100644 tests/functional/programs/009_slicing/011_reversed_inclusive_slice.ndc

diff --git a/ndc_stdlib/src/index.rs b/ndc_stdlib/src/index.rs
index 8dca3857..806614b3 100644
--- a/ndc_stdlib/src/index.rs
+++ b/ndc_stdlib/src/index.rs
@@ -225,16 +225,19 @@ fn extract_vm_offset(index_value: &Value, size: usize) -> Result<VmOffset, VmErr
         if let Some((start, end, inclusive)) = iter_ref.range_bounds() {
             let from_idx = to_forward_index(start, size, true)?;
             let to_idx = to_forward_index(end, size, true)?;
-            let to_idx = if inclusive {
-                (to_idx + 1).min(size)
-            } else {
-                to_idx
-            };
+            // Reject reversed ranges before widening an inclusive end, otherwise
+            // an off-by-one inclusive range like `1..=0` would survive the `+1`
+            // and silently produce an empty slice instead of an error.
             if to_idx < from_idx {
                 return Err(VmError::native(format!(
                     "{from_idx}..{to_idx} out of bounds"
                 )));
             }
+            let to_idx = if inclusive {
+                (to_idx + 1).min(size)
+            } else {
+                to_idx
+            };
             return Ok(VmOffset::Range(from_idx, to_idx));
         }
         if let Some(start) = iter_ref.unbounded_range_start() {
diff --git a/tests/functional/programs/009_slicing/011_reversed_inclusive_slice.ndc b/tests/functional/programs/009_slicing/011_reversed_inclusive_slice.ndc
new file mode 100644
index 00000000..d3a972b5
--- /dev/null
+++ b/tests/functional/programs/009_slicing/011_reversed_inclusive_slice.ndc
@@ -0,0 +1,4 @@
+// expect-error: 2..1 out of bounds
+// An inclusive range whose start is after its end (off-by-one, so the `+1`
+// widening would otherwise mask it) must error, not return an empty slice.
+"hello"[2..=1]

From 27cfa4462471e9a0afc5a66d011bb2f243128874 Mon Sep 17 00:00:00 2001
From: Tim Fennis <fennis.tim@gmail.com>
Date: Tue, 2 Jun 2026 09:11:33 +0200
Subject: [PATCH 3/3] =?UTF-8?q?fix(stdlib):=20detect=20reversed=20slices?=
 =?UTF-8?q?=20from=20unclamped=20endpoints=20=F0=9F=94=AA?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The pre-widening check compared clamped indices, so a reversed range
whose endpoints both sit at or beyond the length (e.g. `6..=5` on a
5-char string) collapsed to equal indices and returned an empty slice
instead of erroring. Detect reversal from the unclamped endpoints.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---
 ndc_stdlib/src/index.rs                       | 25 +++++++++++++------
 .../012_reversed_slice_beyond_length.ndc      |  5 ++++
 2 files changed, 23 insertions(+), 7 deletions(-)
 create mode 100644 tests/functional/programs/009_slicing/012_reversed_slice_beyond_length.ndc

diff --git a/ndc_stdlib/src/index.rs b/ndc_stdlib/src/index.rs
index 806614b3..968c4ced 100644
--- a/ndc_stdlib/src/index.rs
+++ b/ndc_stdlib/src/index.rs
@@ -212,6 +212,14 @@ fn to_forward_index(i: i64, size: usize, for_slice: bool) -> Result<usize, VmErr
     }
 }
 
+/// Resolves a (possibly negative) slice endpoint to a forward position without
+/// clamping it into `0..=size`. Used purely to detect reversed ranges: clamping
+/// would collapse out-of-range endpoints to the boundary (e.g. `6` and `5` both
+/// becoming `size` on a 5-element string), masking a reversal like `6..=5`.
+fn unclamped_slice_index(i: i64, size: usize) -> i64 {
+    if i < 0 { size as i64 + i } else { i }
+}
+
 enum VmOffset {
     Element(usize),
     Range(usize, usize),
@@ -223,16 +231,19 @@ fn extract_vm_offset(index_value: &Value, size: usize) -> Result<VmOffset, VmErr
     {
         let iter_ref = iter.borrow();
         if let Some((start, end, inclusive)) = iter_ref.range_bounds() {
-            let from_idx = to_forward_index(start, size, true)?;
-            let to_idx = to_forward_index(end, size, true)?;
-            // Reject reversed ranges before widening an inclusive end, otherwise
-            // an off-by-one inclusive range like `1..=0` would survive the `+1`
-            // and silently produce an empty slice instead of an error.
-            if to_idx < from_idx {
+            // Detect reversal from the unclamped endpoints, so an out-of-range
+            // reversed range can't collapse to equality once clamped (e.g.
+            // `6..=5` on a 5-element string would otherwise clamp both ends to
+            // 5 and silently yield an empty slice instead of an error).
+            let from_unclamped = unclamped_slice_index(start, size);
+            let end_unclamped = unclamped_slice_index(end, size);
+            if end_unclamped < from_unclamped {
                 return Err(VmError::native(format!(
-                    "{from_idx}..{to_idx} out of bounds"
+                    "{from_unclamped}..{end_unclamped} out of bounds"
                 )));
             }
+            let from_idx = to_forward_index(start, size, true)?;
+            let to_idx = to_forward_index(end, size, true)?;
             let to_idx = if inclusive {
                 (to_idx + 1).min(size)
             } else {
diff --git a/tests/functional/programs/009_slicing/012_reversed_slice_beyond_length.ndc b/tests/functional/programs/009_slicing/012_reversed_slice_beyond_length.ndc
new file mode 100644
index 00000000..92afc73c
--- /dev/null
+++ b/tests/functional/programs/009_slicing/012_reversed_slice_beyond_length.ndc
@@ -0,0 +1,5 @@
+// expect-error: 6..5 out of bounds
+// A reversed range whose endpoints are both at or beyond the length used to
+// clamp to equal indices and return an empty slice. Reversal is now detected
+// from the unclamped endpoints, so it errors.
+"hello"[6..=5]