Index: include/span
===================================================================
--- include/span
+++ include/span
@@ -279,6 +279,7 @@
         -> span<element_type, _Count != dynamic_extent ? _Count : _Extent - _Offset>
     {
         static_assert(_Offset <= _Extent, "Offset out of range in span::subspan()");
+		static_assert(_Count == dynamic_extent || _Count <= _Extent - _Offset, "Offset + count out of range in span::subspan()");
         return {data() + _Offset, _Count == dynamic_extent ? size() - _Offset : _Count};
     }
 
@@ -291,7 +292,7 @@
         _LIBCPP_ASSERT(__count  <= size() || __count == dynamic_extent, "Count out of range in span::subspan(offset, count)");
         if (__count == dynamic_extent)
             return {data() + __offset, size() - __offset};
-        _LIBCPP_ASSERT(__offset <= size() - __count, "count + offset out of range in span::subspan(offset, count)");
+        _LIBCPP_ASSERT(__count <= size() - __offset, "Offset + count out of range in span::subspan(offset, count)");
         return {data() + __offset, __count};
     }
 
@@ -445,10 +446,10 @@
 
     template <size_t _Offset, size_t _Count = dynamic_extent>
     _LIBCPP_INLINE_VISIBILITY
-    constexpr span<_Tp, dynamic_extent> subspan() const noexcept
+    constexpr span<element_type, _Count> subspan() const noexcept
     {
         _LIBCPP_ASSERT(_Offset <= size(), "Offset out of range in span::subspan()");
-        _LIBCPP_ASSERT(_Count == dynamic_extent || _Offset + _Count <= size(), "Count out of range in span::subspan()");
+        _LIBCPP_ASSERT(_Count == dynamic_extent || _Count <= size() - _Offset, "Offset + count out of range in span::subspan()");
         return {data() + _Offset, _Count == dynamic_extent ? size() - _Offset : _Count};
     }
 
@@ -460,7 +461,7 @@
         _LIBCPP_ASSERT(__count  <= size() || __count == dynamic_extent, "count out of range in span::subspan(offset, count)");
         if (__count == dynamic_extent)
             return {data() + __offset, size() - __offset};
-        _LIBCPP_ASSERT(__offset <= size() - __count, "Offset + count out of range in span::subspan(offset, count)");
+        _LIBCPP_ASSERT(__count <= size() - __offset, "Offset + count out of range in span::subspan(offset, count)");
         return {data() + __offset, __count};
     }
 
Index: test/std/containers/views/span.sub/subspan.fail.cpp
===================================================================
--- /dev/null
+++ test/std/containers/views/span.sub/subspan.fail.cpp
@@ -0,0 +1,81 @@
+// -*- C++ -*-
+//===------------------------------ span ---------------------------------===//
+//
+// Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
+// See https://llvm.org/LICENSE.txt for license information.
+// SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
+//
+//===---------------------------------------------------------------------===//
+// UNSUPPORTED: c++98, c++03, c++11, c++14, c++17
+
+// <span>
+
+// template<size_t Offset, size_t Count = dynamic_extent>
+//   constexpr span<element_type, see below> subspan() const;
+//
+// constexpr span<element_type, dynamic_extent> subspan(
+//   index_type offset, index_type count = dynamic_extent) const;
+//
+//  Requires: offset <= size() && 
+//            (count == dynamic_extent || count <= size() - offset)
+
+#include <span>
+
+#include "test_macros.h"
+
+constexpr int carr1[] = { 1,2,3,4 };
+
+int main(int, char**)
+{
+	span<int, 4> sp_static{ carr1 };
+	span<int> sp_dynamic{ carr1 };
+	
+	//  Offset too large templatized
+	{
+		auto s1 = sp_static.template subspan<5>(); // expected-error {{Offset out of range in span::subspan()}}
+		auto s2 = sp_dynamic.template subspan<5>(); // expected-error {{Offset out of range in span::subspan()}}
+	}
+
+	//  Count too large templatized
+	{
+		auto s1 = sp_static.template subspan<0, 5>(); // expected-error {{Offset + count out of range in span::subspan()}}
+		auto s2 = sp_dynamic.template subspan<0, 5>(); // expected-error {{Offset + count out of range in span::subspan()}}
+	}
+
+	//  Offset + Count too large templatized
+	{
+		auto s1 = sp_static.template subspan<2, 3>(); // expected-error {{Offset + count out of range in span::subspan()}}
+		auto s2 = sp_dynamic.template subspan<2, 3>(); // expected-error {{Offset + count out of range in span::subspan()}}
+	}
+	
+	//  Offset + Count overflow templatized
+	{
+		auto s1 = sp_static.template subspan<3, std::size_t(-2)>(); // expected-error {{Offset + count out of range in span::subspan()}}
+		auto s2 = sp_dynamic.template subspan<3, std::size_t(-2)>(); // expected-error {{Offset + count out of range in span::subspan()}}
+	}
+
+	//  Offset too large dynamic
+	{
+		auto s1 = sp_static.subspan(5); // expected-error {{Offset out of range in span::subspan(offset, count)}}
+		auto s2 = sp_dynamic.subspan(5); // expected-error {{Offset out of range in span::subspan(offset, count)}}
+	}
+
+	//  Count too large dynamic
+	{
+		auto s1 = sp_static.subspan(0, 5); // expected-error {{Count out of range in span::subspan(offset, count)}}
+		auto s2 = sp_dynamic.subspan(0, 5); // expected-error {{Count out of range in span::subspan(offset, count)}}
+	}
+
+	//  Offset + Count too large dynamic
+	{
+		auto s1 = sp_static.subspan(2, 3); // expected-error {{Offset + count out of range in span::subspan(offset, count)}}
+		auto s2 = sp_dynamic.subspan(2, 3); // expected-error {{Offset + count out of range in span::subspan(offset, count)}}
+	}
+
+	//  Offset + Count overflow dynamic
+	{
+		auto s1 = sp_static.subspan(3, std::size_t(-2)); // expected-error {{Count out of range in span::subspan(offset, count)}}
+		auto s2 = sp_dynamic.subspan(3, std::size_t(-2)); // expected-error {{Count out of range in span::subspan(offset, count)}}
+	}
+	return 0;
+}