diff --git a/libcxx/include/span b/libcxx/include/span
--- a/libcxx/include/span
+++ b/libcxx/include/span
@@ -279,6 +279,7 @@
         -> span<element_type, _Count != dynamic_extent ? _Count : _Extent - _Offset>
     {
         static_assert(_Offset <= _Extent, "Offset out of range in span::subspan()");
+        static_assert(_Count == dynamic_extent || _Count <= _Extent - _Offset, "Offset + count out of range in span::subspan()");
         return {data() + _Offset, _Count == dynamic_extent ? size() - _Offset : _Count};
     }
 
@@ -291,7 +292,7 @@
         _LIBCPP_ASSERT(__count  <= size() || __count == dynamic_extent, "Count out of range in span::subspan(offset, count)");
         if (__count == dynamic_extent)
             return {data() + __offset, size() - __offset};
-        _LIBCPP_ASSERT(__offset <= size() - __count, "count + offset out of range in span::subspan(offset, count)");
+        _LIBCPP_ASSERT(__count <= size() - __offset, "Offset + count out of range in span::subspan(offset, count)");
         return {data() + __offset, __count};
     }
 
@@ -445,10 +446,10 @@
 
     template <size_t _Offset, size_t _Count = dynamic_extent>
     _LIBCPP_INLINE_VISIBILITY
-    constexpr span<_Tp, dynamic_extent> subspan() const noexcept
+    constexpr span<element_type, _Count> subspan() const noexcept
     {
         _LIBCPP_ASSERT(_Offset <= size(), "Offset out of range in span::subspan()");
-        _LIBCPP_ASSERT(_Count == dynamic_extent || _Offset + _Count <= size(), "Count out of range in span::subspan()");
+        _LIBCPP_ASSERT(_Count == dynamic_extent || _Count <= size() - _Offset, "Offset + count out of range in span::subspan()");
         return {data() + _Offset, _Count == dynamic_extent ? size() - _Offset : _Count};
     }
 
@@ -460,7 +461,7 @@
         _LIBCPP_ASSERT(__count  <= size() || __count == dynamic_extent, "count out of range in span::subspan(offset, count)");
         if (__count == dynamic_extent)
             return {data() + __offset, size() - __offset};
-        _LIBCPP_ASSERT(__offset <= size() - __count, "Offset + count out of range in span::subspan(offset, count)");
+        _LIBCPP_ASSERT(__count <= size() - __offset, "Offset + count out of range in span::subspan(offset, count)");
         return {data() + __offset, __count};
     }
 
diff --git a/libcxx/test/std/containers/views/span.sub/subspan.fail.cpp b/libcxx/test/std/containers/views/span.sub/subspan.fail.cpp
new file mode 100644
--- /dev/null
+++ b/libcxx/test/std/containers/views/span.sub/subspan.fail.cpp
@@ -0,0 +1,52 @@
+// -*- C++ -*-
+//===------------------------------ span ---------------------------------===//
+//
+// Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
+// See https://llvm.org/LICENSE.txt for license information.
+// SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
+//
+//===---------------------------------------------------------------------===//
+// UNSUPPORTED: c++98, c++03, c++11, c++14, c++17
+
+// <span>
+
+// template<size_t Offset, size_t Count = dynamic_extent>
+//   constexpr span<element_type, see below> subspan() const;
+//
+// constexpr span<element_type, dynamic_extent> subspan(
+//   index_type offset, index_type count = dynamic_extent) const;
+//
+//  Requires: offset <= size() &&
+//            (count == dynamic_extent || count <= size() - offset)
+
+#include <span>
+
+#include "test_macros.h"
+
+constexpr int carr[] = {1, 2, 3, 4};
+
+int main(int, char**) {
+  std::span<const int, 4> sp(carr);
+
+  //  Offset too large templatized
+  {
+    [[maybe_unused]] auto s1 = sp.subspan<5>(); // expected-error-re@span:* {{static_assert failed{{( due to requirement '.*')?}} "Offset out of range in span::subspan()"}}
+  }
+
+  //  Count too large templatized
+  {
+    [[maybe_unused]] auto s1 = sp.subspan<0, 5>(); // expected-error-re@span:* {{static_assert failed{{( due to requirement '.*')?}} "Offset + count out of range in span::subspan()"}}
+  }
+
+  //  Offset + Count too large templatized
+  {
+    [[maybe_unused]] auto s1 = sp.subspan<2, 3>(); // expected-error-re@span:* {{static_assert failed{{( due to requirement '.*')?}} "Offset + count out of range in span::subspan()"}}
+  }
+
+  //  Offset + Count overflow templatized
+  {
+    [[maybe_unused]] auto s1 = sp.subspan<3, std::size_t(-2)>(); // expected-error-re@span:* {{static_assert failed{{( due to requirement '.*')?}} "Offset + count out of range in span::subspan()"}}, expected-error-re@span:* {{array is too large{{(.* elements)}}}}
+  }
+
+  return 0;
+}
diff --git a/libcxx/test/std/containers/views/span.sub/subspan.pass.cpp b/libcxx/test/std/containers/views/span.sub/subspan.pass.cpp
--- a/libcxx/test/std/containers/views/span.sub/subspan.pass.cpp
+++ b/libcxx/test/std/containers/views/span.sub/subspan.pass.cpp
@@ -37,8 +37,11 @@
     using S2 = decltype(s2);
     ASSERT_SAME_TYPE(typename Span::value_type, typename S1::value_type);
     ASSERT_SAME_TYPE(typename Span::value_type, typename S2::value_type);
-    static_assert(S1::extent == (Span::extent == std::dynamic_extent ? std::dynamic_extent : Count), "");
-    static_assert(S2::extent == std::dynamic_extent, "");
+    static_assert(S1::extent ==
+			((Count != std::dynamic_extent) ? Count
+											: ((Span::extent != std::dynamic_extent) ? Span::extent - Offset
+																					 : std::dynamic_extent)), "");
+	static_assert(S2::extent == std::dynamic_extent, "");
     return
         s1.data() == s2.data()
      && s1.size() == s2.size()
@@ -76,7 +79,10 @@
     using S2 = decltype(s2);
     ASSERT_SAME_TYPE(typename Span::value_type, typename S1::value_type);
     ASSERT_SAME_TYPE(typename Span::value_type, typename S2::value_type);
-    static_assert(S1::extent == (Span::extent == std::dynamic_extent ? std::dynamic_extent : Count), "");
+    static_assert(S1::extent ==
+			((Count != std::dynamic_extent) ? Count
+											: ((Span::extent != std::dynamic_extent) ? Span::extent - Offset
+																					 : std::dynamic_extent)), "");
     static_assert(S2::extent == std::dynamic_extent, "");
     assert(s1.data() == s2.data());
     assert(s1.size() == s2.size());