[libc++] Use bounded iterators in std::span when the debug mode is enabled

[ldionne]

Summary

Previously, we'd use raw pointers when the debug mode was enabled,
which means we wouldn't get out-of-range checking with std::span's
iterators.

This patch introduces a new class called __bounded_iter which can
be used to wrap iterators and make them carry around bounds-related
information. This allows iterators to assert when they are dereferenced
outside of their bounds.

As a fly-by change, this commit removes the _LIBCPP_ABI_SPAN_POINTER_ITERATORS
knob. Indeed, not using a raw pointer as the iterator type is useful to
avoid users depending on properties of raw pointers in their code.

This is an alternative to D127401.

[ldionne]

This approach has the benefit that we don't need to modify the container (std::span) at all, unlike with the usual __wrap_iter and __debug_insert_c() methods. It doesn't use a global locking mechanism and the internal debug "database". As a result, std::span can stay trivially copyable and trivially destructible, which could be important for the correctness of user programs.

On the downside, we also can't track any potential changes to the size of the container. Once an iterator is obtained, the bounds it considers will never change, even if the underlying container could potentially change its bounds. This is not a major issue for std::span, however it could potentially be an issue for other containers.

[philnik]

libcxx/include/span

214

What do you think about introducing a constexpr bool _InDebugMode and make this using iterator = _If<_InDebugMode, __bounded_iter<pointer>, __wrap_iter<pointer>>? With that it would also be possible to use if constexpr (_InDebugMode) and void func() requires _InDebugMode. This only works for C++11, C++17 and C++20 code respectively, but is a lot nicer to read IMO.

386–390

For example this could change to

if constexpr (_InDebugMode) {
    return iterator(data(), data(), data() + size());
} else {
    return iterator(this, data());
}

libcxx/test/libcxx/containers/views/views.span/span.elem/assert.back.pass.cpp

28

Maybe array.data() or std::data(array)?

[philnik]

This approach has the benefit that we don't need to modify the container (std::span) at all, unlike with the usual __wrap_iter and __debug_insert_c() methods. It doesn't use a global locking mechanism and the internal debug "database". As a result, std::span can stay trivially copyable and trivially destructible, which could be important for the correctness of user programs.

I wouldn't call std::span a container.

On the downside, we also can't track any potential changes to the size of the container. Once an iterator is obtained, the bounds it considers will never change, even if the underlying container could potentially change its bounds. This is not a major issue for std::span, however it could potentially be an issue for other containers.

I think this approach is good for views like std::span and std::string_view and fixed-size containers like std::array which are normally (conditionally) trivially copyable. I don't think there is any resizable container which is trivially destructible or copyable, so there it isn't a huge problem that we have to add and remove them from the database. I don't see any problem with having two ways to do two related but still quite different things.

[jkorous]

libcxx/include/span

218

This gets rbegin() and rend() covered as well, right? Shall we add some tests to make the guarantee explicit?

[Mordante]

Thanks for working on this, I like the general direction!

I think we should add more tests to validate whether the bound iterator's operations work as expected. Also in language modes other than C++20.

libcxx/include/__iterator/bounded_iter.h

66

Why not adding move construction and assignment?

85

How about including <span> ?

I don't feel adding all options here is the cleanest approach. But I expect this list to remain very short so I don't object.

143

Same for the other places.

191

Copy paste == and in the next operators.

200

Can we make all these operators only available before C++20 and add operator<=> for C++20 and later.

210

libcxx/test/libcxx/containers/views/views.span/debug.iterator-indexing.pass.cpp

13

c++03 is already unsupported at line 8.

26

libcxx/test/libcxx/containers/views/views.span/span.elem/assert.back.pass.cpp

17

Please have a look at the other tests too.

[ldionne]

Add tests for __bounded_iter itself. Address most review comments. Use clang-format.

[ldionne]

In D127418#3570877, @philnik wrote:

This approach has the benefit that we don't need to modify the container (std::span) at all, unlike with the usual __wrap_iter and __debug_insert_c() methods. It doesn't use a global locking mechanism and the internal debug "database". As a result, std::span can stay trivially copyable and trivially destructible, which could be important for the correctness of user programs.

I wouldn't call std::span a container.

Yeah, I'm being sloppy in my choice of terms here, indeed.

In D127418#3578865, @Mordante wrote:

I think we should add more tests to validate whether the bound iterator's operations work as expected. Also in language modes other than C++20.

Agreed, and done!

libcxx/include/__iterator/bounded_iter.h

85

We can't include <span> because it includes this header! That being said, I changed this to a free function that creates these __bounded_iters instead, since it allows me to test them.

143

I don't think we've decided on an official east-const vs west-const policy, so I'll leave as-is. It's consistent within the file and tests.

191

Ooooh, thanks. I added tests, too.

200

I'm really not sure it's worth the added complexity. Am I missing a benefit this would provide, like efficiency or something else? If not, given that we *have* to define the operators to support older C++ Standards anyway, it seems to me that supporting <=> would only add additional complexity.

210

Will leave as-is. I intended to put them on the same line since the comment then applies to both begin and end, which is what I wanted.

libcxx/include/span

214

I am ambivalent about this. I don't think it's a bad idea, but I'm not sure there is much of an actual benefit beyond being more "modern". I'll give it a shot and report on what I think.

218

Yes, it covers it. Added tests.

libcxx/test/libcxx/containers/views/views.span/span.elem/assert.back.pass.cpp

17

Yeah, thanks, I fixed all of them.

[Mordante]

LGTM after the CI passes. I leave the final approval to @philnik since he also had some comments.

libcxx/include/__iterator/bounded_iter.h

85

Thanks! I even wonder whether the previous dependencies would work for modules.

200

Mainly for consistency with other containers and iterators. I don't know whether there are places in the Standard that would mandate this. (I haven't spend much time reading the spaceship wording.) But I don't see it as a blocker.

libcxx/test/libcxx/iterators/bounded_iter/types.compile.pass.cpp

39 ↗

(On Diff #437713)

I really like this set of __bounded_iter tests!

[ldionne]

Fix modules test.

[ldionne]

Fix CI failures. I had to remove uses of std::array in bounded_iter's tests because of constexpr requirements.

[ldionne]

Implement to_address.

[ldionne]

Fix CI in C++03 and C++11.

[ldionne]

Rebase onto main.

libcxx/include/CMakeLists.txt

set(files
   __functional/weak_result_type.h
   __fwd/span.h
   __fwd/string_view.h
   __hash_table
   __ios/fpos.h
   __iterator/access.h
   __iterator/advance.h
   __iterator/back_insert_iterator.h
+  __iterator/bounded_iter.h
   __iterator/common_iterator.h
   __iterator/concepts.h
   __iterator/counted_iterator.h
   __iterator/data.h
   __iterator/default_sentinel.h
   __iterator/distance.h
   __iterator/empty.h
   __iterator/erase_if_container.h

libcxx/include/__config

 #  define _LIBCPP_ABI_NO_ITERATOR_BASES
 // Use the smallest possible integer type to represent the index of the variant.
 // Previously libc++ used "unsigned int" exclusively.
 #  define _LIBCPP_ABI_VARIANT_INDEX_TYPE_OPTIMIZATION
 // Unstable attempt to provide a more optimized std::function
 #  define _LIBCPP_ABI_OPTIMIZED_FUNCTION
 // All the regex constants must be distinct and nonzero.
 #  define _LIBCPP_ABI_REGEX_CONSTANTS_NONZERO
-// Use raw pointers, not wrapped ones, for std::span's iterator type.
-#  define _LIBCPP_ABI_SPAN_POINTER_ITERATORS
 // Re-worked external template instantiations for std::string with a focus on
 // performance and fast-path inlining.
 #  define _LIBCPP_ABI_STRING_OPTIMIZED_EXTERNAL_INSTANTIATION
 // Enable clang::trivial_abi on std::unique_ptr.
 #  define _LIBCPP_ABI_ENABLE_UNIQUE_PTR_TRIVIAL_ABI
 // Enable clang::trivial_abi on std::shared_ptr and std::weak_ptr
 #  define _LIBCPP_ABI_ENABLE_SHARED_PTR_TRIVIAL_ABI
 // std::random_device holds some state when it uses an implementation that gets

libcxx/include/__iterator/bounded_iter.h

+// -*- C++ -*-
+//===----------------------------------------------------------------------===//
+//
+// Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
+// See https://llvm.org/LICENSE.txt for license information.
+// SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
+//
+//===----------------------------------------------------------------------===//
+
+#ifndef _LIBCPP___ITERATOR_BOUNDED_ITER_H
+#define _LIBCPP___ITERATOR_BOUNDED_ITER_H
+
+#include <__assert>
+#include <__config>
+#include <__iterator/iterator_traits.h>
+#include <__memory/pointer_traits.h>
+#include <type_traits>
+
+#if !defined(_LIBCPP_HAS_NO_PRAGMA_SYSTEM_HEADER)
+#  pragma GCC system_header
+#endif
+
+_LIBCPP_BEGIN_NAMESPACE_STD
+
+// Iterator wrapper that carries the valid range it is allowed to access.
+//
+// This is a simple iterator wrapper for contiguous iterators that points
+// within a [begin, end) range and carries these bounds with it. The iterator
+// ensures that it is pointing within that [begin, end) range when it is
+// dereferenced.
+//
+// Arithmetic operations are allowed and the bounds of the resulting iterator
+// are not checked. Hence, it is possible to create an iterator pointing outside
+// its range, but it is not possible to dereference it.
+template <class _Iterator, class = __enable_if_t<
+    __is_cpp17_contiguous_iterator<_Iterator>::value
+> >
+struct __bounded_iter {
+    using value_type = typename iterator_traits<_Iterator>::value_type;
+    using difference_type = typename iterator_traits<_Iterator>::difference_type;
+    using pointer = typename iterator_traits<_Iterator>::pointer;
+    using reference = typename iterator_traits<_Iterator>::reference;
+    using iterator_category = typename iterator_traits<_Iterator>::iterator_category;
+#if _LIBCPP_STD_VER > 17
+    using iterator_concept = contiguous_iterator_tag;
+#endif
+
+    // Create a singular iterator.
+    //
+    // Such an iterator does not point to any object and is conceptually out of bounds, so it is
+    // not dereferenceable. Observing operations like comparison and assignment are valid.
+    _LIBCPP_HIDE_FROM_ABI __bounded_iter() = default;
+
+    _LIBCPP_HIDE_FROM_ABI __bounded_iter(__bounded_iter const&) = default;
+
+    template <class _OtherIterator, class = __enable_if_t<
+        is_convertible<_OtherIterator, _Iterator>::value
+    > >
+    _LIBCPP_HIDE_FROM_ABI _LIBCPP_CONSTEXPR
+    __bounded_iter(__bounded_iter<_OtherIterator> const& __other) _NOEXCEPT
+        : __current_(__other.__current_), __begin_(__other.__begin_), __end_(__other.__end_)
+    { }
+
+    // Assign a bounded iterator to another one, rebinding the bounds of the iterator as well.
+    _LIBCPP_HIDE_FROM_ABI __bounded_iter& operator=(__bounded_iter const&) = default;
+
+private:
+    // Create an iterator wrapping the given iterator, and whose bounds are described
+    // by the provided [begin, end) range.
+    //
+    // This constructor does not check whether the resulting iterator is within its bounds.
+    // However, it does check that the provided [begin, end) range is a valid range (that
+    // is, begin <= end).
+    //
+    // Since it is non-standard for iterators to have this constructor, __bounded_iter
+    // must be befriended by containers who wish to use it.
+    _LIBCPP_HIDE_FROM_ABI _LIBCPP_CONSTEXPR_AFTER_CXX11
+    explicit __bounded_iter(_Iterator __current, _Iterator __begin, _Iterator __end)
+        : __current_(__current), __begin_(__begin), __end_(__end)
+    {
+        _LIBCPP_ASSERT(__begin <= __end, "__bounded_iter(current, begin, end): [begin, end) is not a valid range");
+    }
+
+    // Classes allowed to use this iterator:
+    template <class, size_t> friend class _LIBCPP_TEMPLATE_VIS span;
+
+public:
+    // Dereference and indexing operations.
+    //
+    // These operations check that the iterator is dereferenceable, that is within [begin, end).
+    _LIBCPP_HIDE_FROM_ABI _LIBCPP_CONSTEXPR_AFTER_CXX11
+    reference operator*() const _NOEXCEPT {
+        _LIBCPP_ASSERT(__in_bounds(__current_), "__bounded_iter::operator*: Attempt to dereference an out-of-range iterator");
+        return *__current_;
+    }
+
+    _LIBCPP_HIDE_FROM_ABI _LIBCPP_CONSTEXPR_AFTER_CXX11
+    pointer operator->() const _NOEXCEPT {
+        _LIBCPP_ASSERT(__in_bounds(__current_), "__bounded_iter::operator->: Attempt to dereference an out-of-range iterator");
+        return std::__to_address(__current_);
+    }
+
+    _LIBCPP_HIDE_FROM_ABI _LIBCPP_CONSTEXPR_AFTER_CXX11
+    reference operator[](difference_type __n) const _NOEXCEPT {
+        _LIBCPP_ASSERT(__in_bounds(__current_ + __n), "__bounded_iter::operator[]: Attempt to index an iterator out-of-range");
+        return __current_[__n];
+    }
+
+    // Arithmetic operations.
+    //
+    // These operations do not check that the resulting iterator is within the bounds, since that
+    // would make it impossible to create a past-the-end iterator.
+    _LIBCPP_HIDE_FROM_ABI _LIBCPP_CONSTEXPR_AFTER_CXX11
+    __bounded_iter& operator++() _NOEXCEPT {
+        ++__current_;
+        return *this;
+    }
+    _LIBCPP_HIDE_FROM_ABI _LIBCPP_CONSTEXPR_AFTER_CXX11
+    __bounded_iter operator++(int) _NOEXCEPT {
+        __bounded_iter __tmp(*this);
+        ++*this;
+        return __tmp;
+    }
+
+    _LIBCPP_HIDE_FROM_ABI _LIBCPP_CONSTEXPR_AFTER_CXX11
+    __bounded_iter& operator--() _NOEXCEPT {
+        --__current_;
+        return *this;
+    }
+    _LIBCPP_HIDE_FROM_ABI _LIBCPP_CONSTEXPR_AFTER_CXX11
+    __bounded_iter operator--(int) _NOEXCEPT {
+        __bounded_iter __tmp(*this);
+        --*this;
+        return __tmp;
+    }
+
+    _LIBCPP_HIDE_FROM_ABI _LIBCPP_CONSTEXPR_AFTER_CXX11
+    __bounded_iter& operator+=(difference_type __n) _NOEXCEPT {
+        __current_ += __n;
+        return *this;
+    }
+    _LIBCPP_HIDE_FROM_ABI _LIBCPP_CONSTEXPR_AFTER_CXX11
+    friend __bounded_iter operator+(__bounded_iter const& __self, difference_type __n) _NOEXCEPT {
+        __bounded_iter __tmp(__self);
+        __tmp += __n;
+        return __tmp;
+    }
+    _LIBCPP_HIDE_FROM_ABI _LIBCPP_CONSTEXPR_AFTER_CXX11
+    friend __bounded_iter operator+(difference_type __n, __bounded_iter const& __self) _NOEXCEPT {
+        __bounded_iter __tmp(__self);
+        __tmp += __n;
+        return __tmp;
+    }
+
+    _LIBCPP_HIDE_FROM_ABI _LIBCPP_CONSTEXPR_AFTER_CXX11
+    __bounded_iter& operator-=(difference_type __n) _NOEXCEPT {
+        __current_ -= __n;
+        return *this;
+    }
+    _LIBCPP_HIDE_FROM_ABI _LIBCPP_CONSTEXPR_AFTER_CXX11
+    friend __bounded_iter operator-(__bounded_iter const& __self, difference_type __n) _NOEXCEPT {
+        __bounded_iter __tmp(__self);
+        __tmp -= __n;
+        return __tmp;
+    }
+    _LIBCPP_HIDE_FROM_ABI _LIBCPP_CONSTEXPR_AFTER_CXX11
+    friend difference_type operator-(__bounded_iter const& __x, __bounded_iter const& __y) _NOEXCEPT {
+        return __x.__current_ - __y.__current_;
+    }
+
+    // Comparison operations.
+    //
+    // These operations do not check whether the iterators are within their bounds.
+    // The valid range for each iterator is also not considered as part of the comparison,
+    // i.e. two iterators pointing to the same location will be considered equal even
+    // if they have different validity ranges.
+    _LIBCPP_HIDE_FROM_ABI _LIBCPP_CONSTEXPR
+    friend bool operator==(__bounded_iter const& __x, __bounded_iter const& __y) _NOEXCEPT {
+        return __x.__current_ == __y.__current_;
+    }
+    _LIBCPP_HIDE_FROM_ABI _LIBCPP_CONSTEXPR
+    friend bool operator!=(__bounded_iter const& __x, __bounded_iter const& __y) _NOEXCEPT {
+        return __x.__current_ != __y.__current_;
+    }
+    _LIBCPP_HIDE_FROM_ABI _LIBCPP_CONSTEXPR
+    friend bool operator<(__bounded_iter const& __x, __bounded_iter const& __y) _NOEXCEPT {
+        return __x.__current_ < __y.__current_;
+    }
+    _LIBCPP_HIDE_FROM_ABI _LIBCPP_CONSTEXPR
+    friend bool operator>(__bounded_iter const& __x, __bounded_iter const& __y) _NOEXCEPT {
+        return __x.__current_ == __y.__current_;
+    }
+    _LIBCPP_HIDE_FROM_ABI _LIBCPP_CONSTEXPR
+    friend bool operator<=(__bounded_iter const& __x, __bounded_iter const& __y) _NOEXCEPT {
+        return __x.__current_ == __y.__current_;
+    }
+    _LIBCPP_HIDE_FROM_ABI _LIBCPP_CONSTEXPR
+    friend bool operator>=(__bounded_iter const& __x, __bounded_iter const& __y) _NOEXCEPT {
+        return __x.__current_ == __y.__current_;
+    }
+
+private:
+    // Return whether the given iterator is in the bounds of this __bounded_iter.
+    _LIBCPP_HIDE_FROM_ABI _LIBCPP_CONSTEXPR
+    bool __in_bounds(_Iterator const& __iter) const {
+        return __iter >= __begin_ && __iter < __end_;
+    }
+
+    _Iterator __current_; // current iterator
+    _Iterator __begin_, __end_; // valid range represented as [begin, end)
+};
+
+_LIBCPP_END_NAMESPACE_STD
+
+#endif // _LIBCPP___ITERATOR_BOUNDED_ITER_H

libcxx/include/iterator

 */
 
 #include <__assert> // all public C++ headers provide the assertion handler
 #include <__config>
 #include <__debug>
 #include <__iterator/access.h>
 #include <__iterator/advance.h>
 #include <__iterator/back_insert_iterator.h>
+#include <__iterator/bounded_iter.h>
 #include <__iterator/common_iterator.h>
 #include <__iterator/concepts.h>
 #include <__iterator/counted_iterator.h>
 #include <__iterator/data.h>
 #include <__iterator/default_sentinel.h>
 #include <__iterator/distance.h>
 #include <__iterator/empty.h>
 #include <__iterator/erase_if_container.h>

libcxx/include/span

 } // namespace std
 
 */
 
 #include <__assert> // all public C++ headers provide the assertion handler
 #include <__config>
 #include <__debug>
 #include <__fwd/span.h>
+#include <__iterator/bounded_iter.h>
 #include <__iterator/concepts.h>
 #include <__iterator/wrap_iter.h>
 #include <__ranges/concepts.h>
 #include <__ranges/data.h>
 #include <__ranges/enable_borrowed_range.h>
 #include <__ranges/enable_view.h>
 #include <__ranges/size.h>
 #include <__utility/forward.h>
concept __span_compatible_range =
   ranges::sized_range<_Range> &&
   (ranges::borrowed_range<_Range> || is_const_v<_ElementType>) &&
   !__is_std_span<remove_cvref_t<_Range>>::value  &&
   !__is_std_array<remove_cvref_t<_Range>>::value &&
   !is_array_v<remove_cvref_t<_Range>> &&
   is_convertible_v<remove_reference_t<ranges::range_reference_t<_Range>>(*)[], _ElementType(*)[]>;
 #endif // !defined(_LIBCPP_HAS_NO_INCOMPLETE_RANGES)
 
-#if defined(_LIBCPP_ENABLE_DEBUG_MODE) || defined(_LIBCPP_ABI_SPAN_POINTER_ITERATORS)
-#   define _LIBCPP_SPAN_USE_POINTER_ITERATOR
-#endif
-
 template <typename _Tp, size_t _Extent>
 class _LIBCPP_TEMPLATE_VIS span {
 public:
 //  constants and types
     using element_type           = _Tp;
     using value_type             = remove_cv_t<_Tp>;
     using size_type              = size_t;
     using difference_type        = ptrdiff_t;
     using pointer                = _Tp *;
     using const_pointer          = const _Tp *;
     using reference              = _Tp &;
     using const_reference        = const _Tp &;
-#ifdef _LIBCPP_SPAN_USE_POINTER_ITERATOR
-    using iterator               = pointer;
+#ifdef _LIBCPP_ENABLE_DEBUG_MODE
+    using iterator               = __bounded_iter<pointer>;
 #else
     using iterator               = __wrap_iter<pointer>;
 #endif
     using reverse_iterator       = _VSTD::reverse_iterator<iterator>;
 
     static constexpr size_type extent = _Extent;
 
 // [span.cons], span constructors, copy, assignment, and destructor
     template <size_t _Sz = _Extent, enable_if_t<_Sz == 0, nullptr_t> = nullptr>
     _LIBCPP_INLINE_VISIBILITY constexpr span() noexcept : __data{nullptr} {}
 
     constexpr span           (const span&) noexcept = default;

 
 
 //  ~span() noexcept = default;
 
     template <size_t _Count>
     _LIBCPP_INLINE_VISIBILITY
     constexpr span<element_type, _Count> first() const noexcept
     {
-        static_assert(_Count <= _Extent, "Count out of range in span::first()");
+        static_assert(_Count <= _Extent, "span<T, N>::first<Count>(): Count out of range");
         return span<element_type, _Count>{data(), _Count};
     }
 
     template <size_t _Count>
     _LIBCPP_INLINE_VISIBILITY
     constexpr span<element_type, _Count> last() const noexcept
     {
-        static_assert(_Count <= _Extent, "Count out of range in span::last()");
+        static_assert(_Count <= _Extent, "span<T, N>::last<Count>(): Count out of range");
         return span<element_type, _Count>{data() + size() - _Count, _Count};
     }
 
     _LIBCPP_INLINE_VISIBILITY
     constexpr span<element_type, dynamic_extent> first(size_type __count) const noexcept
     {
-        _LIBCPP_ASSERT(__count <= size(), "Count out of range in span::first(count)");
+        _LIBCPP_ASSERT(__count <= size(), "span<T, N>::first(count): count out of range");
         return {data(), __count};
     }
 
     _LIBCPP_INLINE_VISIBILITY
     constexpr span<element_type, dynamic_extent> last(size_type __count) const noexcept
     {
-        _LIBCPP_ASSERT(__count <= size(), "Count out of range in span::last(count)");
+        _LIBCPP_ASSERT(__count <= size(), "span<T, N>::last(count): count out of range");
         return {data() + size() - __count, __count};
     }
 
     template <size_t _Offset, size_t _Count = dynamic_extent>
     _LIBCPP_INLINE_VISIBILITY
     constexpr auto subspan() const noexcept
         -> span<element_type, _Count != dynamic_extent ? _Count : _Extent - _Offset>
     {
-        static_assert(_Offset <= _Extent, "Offset out of range in span::subspan()");
-        static_assert(_Count == dynamic_extent || _Count <= _Extent - _Offset, "Offset + count out of range in span::subspan()");
+        static_assert(_Offset <= _Extent, "span<T, N>::subspan<Offset, Count>(): Offset out of range");
+        static_assert(_Count == dynamic_extent || _Count <= _Extent - _Offset, "span<T, N>::subspan<Offset, Count>(): Offset + Count out of range");
 
         using _ReturnType = span<element_type, _Count != dynamic_extent ? _Count : _Extent - _Offset>;
         return _ReturnType{data() + _Offset, _Count == dynamic_extent ? size() - _Offset : _Count};
     }
 
 
     _LIBCPP_INLINE_VISIBILITY
     constexpr span<element_type, dynamic_extent>
        subspan(size_type __offset, size_type __count = dynamic_extent) const noexcept
     {
-        _LIBCPP_ASSERT(__offset <= size(), "Offset out of range in span::subspan(offset, count)");
-        _LIBCPP_ASSERT(__count  <= size() || __count == dynamic_extent, "Count out of range in span::subspan(offset, count)");
+        _LIBCPP_ASSERT(__offset <= size(), "span<T, N>::subspan(offset, count): offset out of range");
+        _LIBCPP_ASSERT(__count  <= size() || __count == dynamic_extent, "span<T, N>::subspan(offset, count): count out of range");
         if (__count == dynamic_extent)
             return {data() + __offset, size() - __offset};
-        _LIBCPP_ASSERT(__count <= size() - __offset, "Offset + count out of range in span::subspan(offset, count)");
+        _LIBCPP_ASSERT(__count <= size() - __offset, "span<T, N>::subspan(offset, count): offset + count out of range");
         return {data() + __offset, __count};
     }
 
     _LIBCPP_INLINE_VISIBILITY constexpr size_type size()           const noexcept { return _Extent; }
     _LIBCPP_INLINE_VISIBILITY constexpr size_type size_bytes()     const noexcept { return _Extent * sizeof(element_type); }
     [[nodiscard]] _LIBCPP_INLINE_VISIBILITY constexpr bool empty() const noexcept { return _Extent == 0; }
 
     _LIBCPP_INLINE_VISIBILITY constexpr reference operator[](size_type __idx) const noexcept
     {
-        _LIBCPP_ASSERT(__idx < size(), "span<T,N>[] index out of bounds");
+        _LIBCPP_ASSERT(__idx < size(), "span<T, N>::operator[](index): index out of range");
         return __data[__idx];
     }
 
     _LIBCPP_INLINE_VISIBILITY constexpr reference front() const noexcept
     {
         _LIBCPP_ASSERT(!empty(), "span<T, N>::front() on empty span");
         return __data[0];
     }
 
     _LIBCPP_INLINE_VISIBILITY constexpr reference back() const noexcept
     {
         _LIBCPP_ASSERT(!empty(), "span<T, N>::back() on empty span");
         return __data[size()-1];
     }
 
     _LIBCPP_INLINE_VISIBILITY constexpr pointer data()                         const noexcept { return __data; }
 
 // [span.iter], span iterator support
     _LIBCPP_INLINE_VISIBILITY constexpr iterator begin() const noexcept {
-#ifdef _LIBCPP_SPAN_USE_POINTER_ITERATOR
-        return iterator(data());
+#ifdef _LIBCPP_ENABLE_DEBUG_MODE
+        return iterator(data(), data(), data() + size());
 #else
         return iterator(this, data());
 #endif
     }
     _LIBCPP_INLINE_VISIBILITY constexpr iterator end() const noexcept {
-#ifdef _LIBCPP_SPAN_USE_POINTER_ITERATOR
-        return iterator(data() + size());
+#ifdef _LIBCPP_ENABLE_DEBUG_MODE
+        return iterator(data() + size(), data(), data() + size());
 #else
         return iterator(this, data() + size());
 #endif
     }
     _LIBCPP_INLINE_VISIBILITY constexpr reverse_iterator        rbegin() const noexcept { return reverse_iterator(end()); }
     _LIBCPP_INLINE_VISIBILITY constexpr reverse_iterator          rend() const noexcept { return reverse_iterator(begin()); }
 
     _LIBCPP_INLINE_VISIBILITY span<const byte, _Extent * sizeof(element_type)> __as_bytes() const noexcept
//  constants and types
     using element_type           = _Tp;
     using value_type             = remove_cv_t<_Tp>;
     using size_type              = size_t;
     using difference_type        = ptrdiff_t;
     using pointer                = _Tp *;
     using const_pointer          = const _Tp *;
     using reference              = _Tp &;
     using const_reference        = const _Tp &;
-#ifdef _LIBCPP_SPAN_USE_POINTER_ITERATOR
-    using iterator               = pointer;
+#ifdef _LIBCPP_ENABLE_DEBUG_MODE
+    using iterator               = __bounded_iter<pointer>;
 #else
     using iterator               = __wrap_iter<pointer>;
 #endif
     using reverse_iterator       = _VSTD::reverse_iterator<iterator>;
 
     static constexpr size_type extent = dynamic_extent;
 
 // [span.cons], span constructors, copy, assignment, and destructor
_LIBCPP_INLINE_VISIBILITY
         : __data{__other.data()}, __size{__other.size()} {}
 
 //    ~span() noexcept = default;
 
     template <size_t _Count>
     _LIBCPP_INLINE_VISIBILITY
     constexpr span<element_type, _Count> first() const noexcept
     {
-        _LIBCPP_ASSERT(_Count <= size(), "Count out of range in span::first()");
+        _LIBCPP_ASSERT(_Count <= size(), "span<T>::first<Count>(): Count out of range");
         return span<element_type, _Count>{data(), _Count};
     }
 
     template <size_t _Count>
     _LIBCPP_INLINE_VISIBILITY
     constexpr span<element_type, _Count> last() const noexcept
     {
-        _LIBCPP_ASSERT(_Count <= size(), "Count out of range in span::last()");
+        _LIBCPP_ASSERT(_Count <= size(), "span<T>::last<Count>(): Count out of range");
         return span<element_type, _Count>{data() + size() - _Count, _Count};
     }
 
     _LIBCPP_INLINE_VISIBILITY
     constexpr span<element_type, dynamic_extent> first(size_type __count) const noexcept
     {
-        _LIBCPP_ASSERT(__count <= size(), "Count out of range in span::first(count)");
+        _LIBCPP_ASSERT(__count <= size(), "span<T>::first(count): count out of range");
         return {data(), __count};
     }
 
     _LIBCPP_INLINE_VISIBILITY
     constexpr span<element_type, dynamic_extent> last (size_type __count) const noexcept
     {
-        _LIBCPP_ASSERT(__count <= size(), "Count out of range in span::last(count)");
+        _LIBCPP_ASSERT(__count <= size(), "span<T>::last(count): count out of range");
         return {data() + size() - __count, __count};
     }
 
     template <size_t _Offset, size_t _Count = dynamic_extent>
     _LIBCPP_INLINE_VISIBILITY
     constexpr span<element_type, _Count> subspan() const noexcept
     {
-        _LIBCPP_ASSERT(_Offset <= size(), "Offset out of range in span::subspan()");
-        _LIBCPP_ASSERT(_Count == dynamic_extent || _Count <= size() - _Offset, "Offset + count out of range in span::subspan()");
+        _LIBCPP_ASSERT(_Offset <= size(), "span<T>::subspan<Offset, Count>(): Offset out of range");
+        _LIBCPP_ASSERT(_Count == dynamic_extent || _Count <= size() - _Offset, "span<T>::subspan<Offset, Count>(): Offset + Count out of range");
         return span<element_type, _Count>{data() + _Offset, _Count == dynamic_extent ? size() - _Offset : _Count};
     }
 
     constexpr span<element_type, dynamic_extent>
     _LIBCPP_INLINE_VISIBILITY
     subspan(size_type __offset, size_type __count = dynamic_extent) const noexcept
     {
-        _LIBCPP_ASSERT(__offset <= size(), "Offset out of range in span::subspan(offset, count)");
-        _LIBCPP_ASSERT(__count  <= size() || __count == dynamic_extent, "count out of range in span::subspan(offset, count)");
+        _LIBCPP_ASSERT(__offset <= size(), "span<T>::subspan(offset, count): offset out of range");
+        _LIBCPP_ASSERT(__count <= size() || __count == dynamic_extent, "span<T>::subspan(offset, count): count out of range");
         if (__count == dynamic_extent)
             return {data() + __offset, size() - __offset};
-        _LIBCPP_ASSERT(__count <= size() - __offset, "Offset + count out of range in span::subspan(offset, count)");
+        _LIBCPP_ASSERT(__count <= size() - __offset, "span<T>::subspan(offset, count): offset + count out of range");
         return {data() + __offset, __count};
     }
 
     _LIBCPP_INLINE_VISIBILITY constexpr size_type size()           const noexcept { return __size; }
     _LIBCPP_INLINE_VISIBILITY constexpr size_type size_bytes()     const noexcept { return __size * sizeof(element_type); }
     [[nodiscard]] _LIBCPP_INLINE_VISIBILITY constexpr bool empty() const noexcept { return __size == 0; }
 
     _LIBCPP_INLINE_VISIBILITY constexpr reference operator[](size_type __idx) const noexcept
     {
-        _LIBCPP_ASSERT(__idx < size(), "span<T>[] index out of bounds");
+        _LIBCPP_ASSERT(__idx < size(), "span<T>::operator[](index): index out of range");
         return __data[__idx];
     }
 
     _LIBCPP_INLINE_VISIBILITY constexpr reference front() const noexcept
     {
-        _LIBCPP_ASSERT(!empty(), "span<T>[].front() on empty span");
+        _LIBCPP_ASSERT(!empty(), "span<T>::front() on empty span");
         return __data[0];
     }
 
     _LIBCPP_INLINE_VISIBILITY constexpr reference back() const noexcept
     {
-        _LIBCPP_ASSERT(!empty(), "span<T>[].back() on empty span");
+        _LIBCPP_ASSERT(!empty(), "span<T>::back() on empty span");
         return __data[size()-1];
     }
 
 
     _LIBCPP_INLINE_VISIBILITY constexpr pointer data()                         const noexcept { return __data; }
 
 // [span.iter], span iterator support
     _LIBCPP_INLINE_VISIBILITY constexpr iterator begin() const noexcept {
-#ifdef _LIBCPP_SPAN_USE_POINTER_ITERATOR
-        return iterator(data());
+#ifdef _LIBCPP_ENABLE_DEBUG_MODE
+        return iterator(data(), data(), data() + size());
 #else
         return iterator(this, data());
 #endif
     }
     _LIBCPP_INLINE_VISIBILITY constexpr iterator end() const noexcept {
-#ifdef _LIBCPP_SPAN_USE_POINTER_ITERATOR
-        return iterator(data() + size());
+#ifdef _LIBCPP_ENABLE_DEBUG_MODE
+        return iterator(data() + size(), data(), data() + size());
 #else
         return iterator(this, data() + size());
 #endif
     }
     _LIBCPP_INLINE_VISIBILITY constexpr reverse_iterator        rbegin() const noexcept { return reverse_iterator(end()); }
     _LIBCPP_INLINE_VISIBILITY constexpr reverse_iterator          rend() const noexcept { return reverse_iterator(begin()); }
 
     _LIBCPP_INLINE_VISIBILITY span<const byte, dynamic_extent> __as_bytes() const noexcept

libcxx/test/libcxx/containers/views/views.span/debug.iterator-indexing.pass.cpp

+//===----------------------------------------------------------------------===//
+//
+// Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
+// See https://llvm.org/LICENSE.txt for license information.
+// SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
+//
+//===----------------------------------------------------------------------===//
+// UNSUPPORTED: c++03, c++11, c++14, c++17
+
+// Make sure that std::span's iterators check for OOB accesses when the debug mode is enabled.
+
+// REQUIRES: has-unix-headers
+// UNSUPPORTED: !libcpp-has-debug-mode, c++03
+
+#include <span>
+
+#include "check_assertion.h"
+
+struct Foo {
+    int x;
+};
+
+int main(int, char**) {
+    {
+        Foo array[] = {{0}, {1}, {2}};
+        std::span<Foo> const span(array, 3);
+        {
+            auto it = span.end();
+            TEST_LIBCPP_ASSERT_FAILURE(*it, "Attempt to dereference an out-of-range iterator");
+        }
+        {
+            auto it = span.end();
+            TEST_LIBCPP_ASSERT_FAILURE(it->x, "Attempt to dereference an out-of-range iterator");
+        }
+        {
+            auto it = span.begin();
+            TEST_LIBCPP_ASSERT_FAILURE(it[3], "Attempt to index an iterator out-of-range");
+        }
+    }
+    {
+        Foo array[] = {{0}, {1}, {2}};
+        std::span<Foo, 3> const span(array, 3);
+        {
+            auto it = span.end();
+            TEST_LIBCPP_ASSERT_FAILURE(*it, "Attempt to dereference an out-of-range iterator");
+        }
+        {
+            auto it = span.end();
+            TEST_LIBCPP_ASSERT_FAILURE(it->x, "Attempt to dereference an out-of-range iterator");
+        }
+        {
+            auto it = span.begin();
+            TEST_LIBCPP_ASSERT_FAILURE(it[3], "Attempt to index an iterator out-of-range");
+        }
+    }
+
+    return 0;
+}

libcxx/test/libcxx/containers/views/views.span/span.elem/assert.back.pass.cpp

+//===----------------------------------------------------------------------===//
+//
+// Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
+// See https://llvm.org/LICENSE.txt for license information.
+// SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
+//
+//===----------------------------------------------------------------------===//
+// UNSUPPORTED: c++03, c++11, c++14, c++17
+
+// <span>
+//
+// constexpr reference back() const noexcept;
+
+// Make sure that accessing a span out-of-bounds triggers an assertion.
+
+// REQUIRES: has-unix-headers
+// UNSUPPORTED: c++03
+// XFAIL: use_system_cxx_lib && target={{.+}}-apple-macosx{{10.9|10.10|10.11|10.12|10.13|10.14|10.15|11.0|12.0}}
+// ADDITIONAL_COMPILE_FLAGS: -D_LIBCPP_ENABLE_ASSERTIONS=1
+
+#include <span>
+
+#include "check_assertion.h"
+
+int main(int, char**) {
+    {
+        int array[] = {0, 1, 2};
+        std::span<int> const s(&array[0], 0);
+        TEST_LIBCPP_ASSERT_FAILURE(s.back(), "span<T>::back() on empty span");
+    }
+
+    {
+        int array[] = {0, 1, 2};
+        std::span<int, 0> const s(&array[0], 0);
+        TEST_LIBCPP_ASSERT_FAILURE(s.back(), "span<T, N>::back() on empty span");
+    }
+
+    return 0;
+}

libcxx/test/libcxx/containers/views/views.span/span.elem/assert.front.pass.cpp

+//===----------------------------------------------------------------------===//
+//
+// Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
+// See https://llvm.org/LICENSE.txt for license information.
+// SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
+//
+//===----------------------------------------------------------------------===//
+// UNSUPPORTED: c++03, c++11, c++14, c++17
+
+// <span>
+//
+// constexpr reference front() const noexcept;
+
+// Make sure that accessing a span out-of-bounds triggers an assertion.
+
+// REQUIRES: has-unix-headers
+// UNSUPPORTED: c++03
+// XFAIL: use_system_cxx_lib && target={{.+}}-apple-macosx{{10.9|10.10|10.11|10.12|10.13|10.14|10.15|11.0|12.0}}
+// ADDITIONAL_COMPILE_FLAGS: -D_LIBCPP_ENABLE_ASSERTIONS=1
+
+#include <span>
+
+#include "check_assertion.h"
+
+int main(int, char**) {
+    {
+        int array[] = {0, 1, 2};
+        std::span<int> const s(&array[0], 0);
+        TEST_LIBCPP_ASSERT_FAILURE(s.front(), "span<T>::front() on empty span");
+    }
+
+    {
+        int array[] = {0, 1, 2};
+        std::span<int, 0> const s(&array[0], 0);
+        TEST_LIBCPP_ASSERT_FAILURE(s.front(), "span<T, N>::front() on empty span");
+    }
+
+    return 0;
+}

libcxx/test/libcxx/containers/views/views.span/span.elem/assert.op_idx.pass.cpp

+//===----------------------------------------------------------------------===//
+//
+// Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
+// See https://llvm.org/LICENSE.txt for license information.
+// SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
+//
+//===----------------------------------------------------------------------===//
+// UNSUPPORTED: c++03, c++11, c++14, c++17
+
+// <span>
+//
+// constexpr reference operator[](size_type idx) const;
+
+// Make sure that accessing a span out-of-bounds triggers an assertion.
+
+// REQUIRES: has-unix-headers
+// UNSUPPORTED: c++03
+// XFAIL: use_system_cxx_lib && target={{.+}}-apple-macosx{{10.9|10.10|10.11|10.12|10.13|10.14|10.15|11.0|12.0}}
+// ADDITIONAL_COMPILE_FLAGS: -D_LIBCPP_ENABLE_ASSERTIONS=1
+
+#include <span>
+
+#include "check_assertion.h"
+
+int main(int, char**) {
+    {
+        int array[] = {0, 1, 2};
+        std::span<int> const s(array, 3);
+        TEST_LIBCPP_ASSERT_FAILURE(s[3], "span<T>::operator[](index): index out of range");
+    }
+
+    {
+        int array[] = {0, 1, 2};
+        std::span<int, 3> const s(array, 3);
+        TEST_LIBCPP_ASSERT_FAILURE(s[3], "span<T, N>::operator[](index): index out of range");
+    }
+
+    return 0;
+}

libcxx/test/libcxx/containers/views/views.span/span.sub/assert.first.pass.cpp

+//===----------------------------------------------------------------------===//
+//
+// Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
+// See https://llvm.org/LICENSE.txt for license information.
+// SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
+//
+//===----------------------------------------------------------------------===//
+// UNSUPPORTED: c++03, c++11, c++14, c++17
+
+// <span>
+//
+// constexpr span<element_type, dynamic_extent> first(size_type count) const;
+
+// Make sure that creating a sub-span with an incorrect number of elements triggers an assertion.
+
+// REQUIRES: has-unix-headers
+// UNSUPPORTED: c++03
+// XFAIL: use_system_cxx_lib && target={{.+}}-apple-macosx{{10.9|10.10|10.11|10.12|10.13|10.14|10.15|11.0|12.0}}
+// ADDITIONAL_COMPILE_FLAGS: -D_LIBCPP_ENABLE_ASSERTIONS=1
+
+#include <span>
+
+#include "check_assertion.h"
+
+int main(int, char**) {
+    {
+        int array[] = {0, 1, 2};
+        std::span<int> const s(&array[0], 3);
+        TEST_LIBCPP_ASSERT_FAILURE(s.first(4), "span<T>::first(count): count out of range");
+        TEST_LIBCPP_ASSERT_FAILURE(s.first<4>(), "span<T>::first<Count>(): Count out of range");
+    }
+    {
+        int array[] = {0, 1, 2};
+        std::span<int, 3> const s(&array[0], 3);
+        TEST_LIBCPP_ASSERT_FAILURE(s.first(4), "span<T, N>::first(count): count out of range");
+        // s.first<4>() caught at compile-time (tested elsewhere)
+    }
+
+    return 0;
+}

libcxx/test/libcxx/containers/views/views.span/span.sub/assert.last.pass.cpp

+//===----------------------------------------------------------------------===//
+//
+// Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
+// See https://llvm.org/LICENSE.txt for license information.
+// SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
+//
+//===----------------------------------------------------------------------===//
+// UNSUPPORTED: c++03, c++11, c++14, c++17
+
+// <span>
+//
+// constexpr span<element_type, dynamic_extent> last(size_type count) const;
+
+// Make sure that creating a sub-span with an incorrect number of elements triggers an assertion.
+
+// REQUIRES: has-unix-headers
+// UNSUPPORTED: c++03
+// XFAIL: use_system_cxx_lib && target={{.+}}-apple-macosx{{10.9|10.10|10.11|10.12|10.13|10.14|10.15|11.0|12.0}}
+// ADDITIONAL_COMPILE_FLAGS: -D_LIBCPP_ENABLE_ASSERTIONS=1
+
+#include <span>
+
+#include "check_assertion.h"
+
+int main(int, char**) {
+    {
+        int array[] = {0, 1, 2};
+        std::span<int> const s(&array[0], 3);
+        TEST_LIBCPP_ASSERT_FAILURE(s.last(4), "span<T>::last(count): count out of range");
+        TEST_LIBCPP_ASSERT_FAILURE(s.last<4>(), "span<T>::last<Count>(): Count out of range");
+    }
+    {
+        int array[] = {0, 1, 2};
+        std::span<int, 3> const s(&array[0], 3);
+        TEST_LIBCPP_ASSERT_FAILURE(s.last(4), "span<T, N>::last(count): count out of range");
+        // s.last<4>() caught at compile-time (tested elsewhere)
+    }
+
+    return 0;
+}

libcxx/test/libcxx/containers/views/views.span/span.sub/assert.subspan.pass.cpp

+//===----------------------------------------------------------------------===//
+//
+// Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
+// See https://llvm.org/LICENSE.txt for license information.
+// SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
+//
+//===----------------------------------------------------------------------===//
+// UNSUPPORTED: c++03, c++11, c++14, c++17
+
+// <span>
+//
+// constexpr span<element_type, dynamic_extent> subspan(
+//   size_type offset, size_type count = dynamic_extent) const;
+//
+//  Requires: (0 <= Offset && Offset <= size())
+//      && (Count == dynamic_extent || Count >= 0 && Offset + Count <= size())
+
+// Make sure that creating a sub-span with an incorrect number of elements triggers an assertion.
+
+// REQUIRES: has-unix-headers
+// UNSUPPORTED: c++03
+// XFAIL: use_system_cxx_lib && target={{.+}}-apple-macosx{{10.9|10.10|10.11|10.12|10.13|10.14|10.15|11.0|12.0}}
+// ADDITIONAL_COMPILE_FLAGS: -D_LIBCPP_ENABLE_ASSERTIONS=1
+
+#include <span>
+#include <cstddef>
+
+#include "check_assertion.h"
+
+int main(int, char**) {
+    {
+        int array[] = {0, 1, 2};
+        std::span<int> const s(&array[0], 3);
+        TEST_LIBCPP_ASSERT_FAILURE(s.subspan(4), "span<T>::subspan(offset, count): offset out of range");
+        TEST_LIBCPP_ASSERT_FAILURE(s.subspan<4>(), "span<T>::subspan<Offset, Count>(): Offset out of range");
+
+        TEST_LIBCPP_ASSERT_FAILURE(s.subspan(0, 4), "span<T>::subspan(offset, count): count out of range");
+        TEST_LIBCPP_ASSERT_FAILURE((s.subspan<0, 4>()), "span<T>::subspan<Offset, Count>(): Offset + Count out of range");
+
+        TEST_LIBCPP_ASSERT_FAILURE(s.subspan(1, 3), "span<T>::subspan(offset, count): offset + count out of range");
+        TEST_LIBCPP_ASSERT_FAILURE((s.subspan<1, 3>()), "span<T>::subspan<Offset, Count>(): Offset + Count out of range");
+    }
+    {
+        int array[] = {0, 1, 2};
+        std::span<int, 3> const s(&array[0], 3);
+        TEST_LIBCPP_ASSERT_FAILURE(s.subspan(4), "span<T, N>::subspan(offset, count): offset out of range");
+        // s.subspan<4>() caught at compile-time (tested elsewhere)
+
+        TEST_LIBCPP_ASSERT_FAILURE(s.subspan(0, 4), "span<T, N>::subspan(offset, count): count out of range");
+        // s.subspan<0, 4>() caught at compile-time (tested elsewhere)
+
+        TEST_LIBCPP_ASSERT_FAILURE(s.subspan(1, 3), "span<T, N>::subspan(offset, count): offset + count out of range");
+        // s.subspan<1, 3>() caught at compile-time (tested elsewhere)
+    }
+
+    return 0;
+}

libcxx/test/libcxx/private_headers.verify.cpp

 #include <__functional/unwrap_ref.h> // expected-error@*:* {{use of private header from outside its module: '__functional/unwrap_ref.h'}}
 #include <__functional/weak_result_type.h> // expected-error@*:* {{use of private header from outside its module: '__functional/weak_result_type.h'}}
 #include <__fwd/span.h> // expected-error@*:* {{use of private header from outside its module: '__fwd/span.h'}}
 #include <__fwd/string_view.h> // expected-error@*:* {{use of private header from outside its module: '__fwd/string_view.h'}}
 #include <__ios/fpos.h> // expected-error@*:* {{use of private header from outside its module: '__ios/fpos.h'}}
 #include <__iterator/access.h> // expected-error@*:* {{use of private header from outside its module: '__iterator/access.h'}}
 #include <__iterator/advance.h> // expected-error@*:* {{use of private header from outside its module: '__iterator/advance.h'}}
 #include <__iterator/back_insert_iterator.h> // expected-error@*:* {{use of private header from outside its module: '__iterator/back_insert_iterator.h'}}
+#include <__iterator/bounded_iter.h> // expected-error@*:* {{use of private header from outside its module: '__iterator/bounded_iter.h'}}
 #include <__iterator/common_iterator.h> // expected-error@*:* {{use of private header from outside its module: '__iterator/common_iterator.h'}}
 #include <__iterator/concepts.h> // expected-error@*:* {{use of private header from outside its module: '__iterator/concepts.h'}}
 #include <__iterator/counted_iterator.h> // expected-error@*:* {{use of private header from outside its module: '__iterator/counted_iterator.h'}}
 #include <__iterator/data.h> // expected-error@*:* {{use of private header from outside its module: '__iterator/data.h'}}
 #include <__iterator/default_sentinel.h> // expected-error@*:* {{use of private header from outside its module: '__iterator/default_sentinel.h'}}
 #include <__iterator/distance.h> // expected-error@*:* {{use of private header from outside its module: '__iterator/distance.h'}}
 #include <__iterator/empty.h> // expected-error@*:* {{use of private header from outside its module: '__iterator/empty.h'}}
 #include <__iterator/erase_if_container.h> // expected-error@*:* {{use of private header from outside its module: '__iterator/erase_if_container.h'}}

libcxx/test/std/containers/views/views.span/span.sub/first.verify.cpp

 //===----------------------------------------------------------------------===//
 //
 // Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
 // See https://llvm.org/LICENSE.txt for license information.
 // SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
 //
 //===----------------------------------------------------------------------===//
 // UNSUPPORTED: c++03, c++11, c++14, c++17
 
 // <span>
 
 // template<size_t Count>
 //  constexpr span<element_type, Count> first() const;
 //
-// constexpr span<element_type, dynamic_extent> first(size_type count) const;
-//
 //  Requires: Count <= size().
 
 #include <span>
-
 #include <cstddef>
 
-#include "test_macros.h"
-
-constexpr int carr[] = {1, 2, 3, 4};
-
-int main(int, char**) {
-  std::span<const int, 4> sp(carr);
+void f() {
+  int array[] = {1, 2, 3, 4};
+  std::span<const int, 4> sp(array);
 
   //  Count too large
-  {
-    [[maybe_unused]] auto s1 = sp.first<5>(); // expected-error-re@span:* {{static_assert failed{{( due to requirement '.*')?}} "Count out of range in span::first()"}}
-  }
+  [[maybe_unused]] auto s1 = sp.first<5>(); // expected-error@span:* {{span<T, N>::first<Count>(): Count out of range}}
 
   //  Count numeric_limits
-  {
-    [[maybe_unused]] auto s1 = sp.first<std::size_t(-1)>(); // expected-error-re@span:* {{static_assert failed{{( due to requirement '.*')?}} "Count out of range in span::first()"}}
-  }
-
-  return 0;
+  [[maybe_unused]] auto s2 = sp.first<std::size_t(-1)>(); // expected-error@span:* {{span<T, N>::first<Count>(): Count out of range}}
 }

libcxx/test/std/containers/views/views.span/span.sub/last.verify.cpp

 //===----------------------------------------------------------------------===//
 //
 // Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
 // See https://llvm.org/LICENSE.txt for license information.
 // SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
 //
 //===----------------------------------------------------------------------===//
 // UNSUPPORTED: c++03, c++11, c++14, c++17
 
 // <span>
 
 // template<size_t Count>
 //  constexpr span<element_type, Count> last() const;
 //
-// constexpr span<element_type, dynamic_extent> last(size_type count) const;
-//
 //  Requires: Count <= size().
 
 #include <span>
-
 #include <cstddef>
 
-#include "test_macros.h"
-
-constexpr int carr[] = {1, 2, 3, 4};
-
-int main(int, char**) {
-  std::span<const int, 4> sp(carr);
+void f() {
+  int array[] = {1, 2, 3, 4};
+  std::span<const int, 4> sp(array);
 
   //  Count too large
-  {
-    [[maybe_unused]] auto s1 = sp.last<5>(); // expected-error-re@span:* {{static_assert failed{{( due to requirement '.*')?}} "Count out of range in span::last()"}}
-  }
+  [[maybe_unused]] auto s1 = sp.last<5>(); // expected-error@span:* {{span<T, N>::last<Count>(): Count out of range}}
 
   //  Count numeric_limits
-  {
-    [[maybe_unused]] auto s1 = sp.last<std::size_t(-1)>(); // expected-error-re@span:* {{static_assert failed{{( due to requirement '.*')?}} "Count out of range in span::last()"}}
-  }
-
-  return 0;
+  [[maybe_unused]] auto s2 = sp.last<std::size_t(-1)>(); // expected-error@span:* {{span<T, N>::last<Count>(): Count out of range}}
 }

libcxx/test/std/containers/views/views.span/span.sub/subspan.fail.cpp

-//===----------------------------------------------------------------------===//
-//
-// Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
-// See https://llvm.org/LICENSE.txt for license information.
-// SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
-//
-//===----------------------------------------------------------------------===//
-// UNSUPPORTED: c++03, c++11, c++14, c++17
-
-// <span>
-
-// template<size_t Offset, size_t Count = dynamic_extent>
-//   constexpr span<element_type, see below> subspan() const;
-//
-// constexpr span<element_type, dynamic_extent> subspan(
-//   size_type offset, size_type count = dynamic_extent) const;
-//
-//  Requires: offset <= size() &&
-//            (count == dynamic_extent || count <= size() - offset)
-
-#include <span>
-
-#include <cstddef>
-
-#include "test_macros.h"
-
-constexpr int carr[] = {1, 2, 3, 4};
-
-int main(int, char**) {
-  std::span<const int, 4> sp(carr);
-
-  //  Offset too large templatized
-  {
-    [[maybe_unused]] auto s1 = sp.subspan<5>(); // expected-error-re@span:* {{static_assert failed{{( due to requirement '.*')?}} "Offset out of range in span::subspan()"}}
-  }
-
-  //  Count too large templatized
-  {
-    [[maybe_unused]] auto s1 = sp.subspan<0, 5>(); // expected-error-re@span:* {{static_assert failed{{( due to requirement '.*')?}} "Offset + count out of range in span::subspan()"}}
-  }
-
-  //  Offset + Count too large templatized
-  {
-    [[maybe_unused]] auto s1 = sp.subspan<2, 3>(); // expected-error-re@span:* {{static_assert failed{{( due to requirement '.*')?}} "Offset + count out of range in span::subspan()"}}
-  }
-
-  //  Offset + Count overflow templatized
-  {
-    [[maybe_unused]] auto s1 = sp.subspan<3, std::size_t(-2)>(); // expected-error-re@span:* {{static_assert failed{{( due to requirement '.*')?}} "Offset + count out of range in span::subspan()"}}, expected-error-re@span:* {{array is too large{{(.* elements)}}}}
-  }
-
-  return 0;
-}

libcxx/test/std/containers/views/views.span/span.sub/subspan.verify.cpp

+//===----------------------------------------------------------------------===//
+//
+// Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
+// See https://llvm.org/LICENSE.txt for license information.
+// SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
+//
+//===----------------------------------------------------------------------===//
+// UNSUPPORTED: c++03, c++11, c++14, c++17
+
+// This test also generates spurious warnings when instantiating std::span
+// with a very large extent (like size_t(-2)) -- silence those.
+// ADDITIONAL_COMPILE_FLAGS: -Xclang -verify-ignore-unexpected=warning
+
+// <span>
+
+// template<size_t Offset, size_t Count = dynamic_extent>
+//   constexpr span<element_type, see below> subspan() const;
+//
+//  Requires: offset <= size() &&
+//            (count == dynamic_extent || count <= size() - offset)
+
+#include <span>
+#include <cstddef>
+
+void f() {
+  int array[] = {1, 2, 3, 4};
+  std::span<const int, 4> sp(array);
+
+  //  Offset too large templatized
+  [[maybe_unused]] auto s1 = sp.subspan<5>(); // expected-error@span:* {{span<T, N>::subspan<Offset, Count>(): Offset out of range"}}
+
+  //  Count too large templatized
+  [[maybe_unused]] auto s2 = sp.subspan<0, 5>(); // expected-error@span:* {{span<T, N>::subspan<Offset, Count>(): Offset + Count out of range"}}
+
+  //  Offset + Count too large templatized
+  [[maybe_unused]] auto s3 = sp.subspan<2, 3>(); // expected-error@span:* {{span<T, N>::subspan<Offset, Count>(): Offset + Count out of range"}}
+
+  //  Offset + Count overflow templatized
+  [[maybe_unused]] auto s4 = sp.subspan<3, std::size_t(-2)>(); // expected-error@span:* {{span<T, N>::subspan<Offset, Count>(): Offset + Count out of range"}}, expected-error-re@span:* {{array is too large{{(.* elements)}}}}
+}