Add assert in `constexpr string_view::operator[]`

[palmer]

Summary

Bounds checking.

[miscco]

I wanted to cry at the use of a comma operator, but all the other member functions do the same...

We might want to directly use __size rather than size() here to avoid the function call in DEBUG mode

[miscco]

Note that I am not a maintainer and you should hold on until one accepts it too

[ldionne]

What Author Name <email@domain> do you want this committed as?

[palmer]

Thanks, everyone. Please commit it as "Chris Palmer <[e-mail]>".

I suspect size() is always inlined, but I can change it to __size if you like. Other code, such as at, uses size().

[jdoerrie]

Late LGTM.

In D88864#2313700, @miscco wrote:

I wanted to cry at the use of a comma operator, but all the other member functions do the same...

We discussed this over in https://reviews.llvm.org/D70343. IIUC this is required because libc++'s string_view is available in all dialects, and C++11 only allows you to have a single return statement in a constexpr function.

libcxx/include/string_view

#endif
     _LIBCPP_CONSTEXPR _LIBCPP_INLINE_VISIBILITY
     size_type max_size() const _NOEXCEPT { return numeric_limits<size_type>::max(); }
 
     _LIBCPP_NODISCARD_AFTER_CXX17 _LIBCPP_INLINE_VISIBILITY _LIBCPP_CONSTEXPR
     bool empty()         const _NOEXCEPT { return __size == 0; }
 
     // [string.view.access], element access
     _LIBCPP_CONSTEXPR _LIBCPP_INLINE_VISIBILITY
-    const_reference operator[](size_type __pos) const _NOEXCEPT { return __data[__pos]; }
+    const_reference operator[](size_type __pos) const _NOEXCEPT {
+      return _LIBCPP_ASSERT(__pos < size(), "string_view[] index out of bounds"), __data[__pos];
+    }
 
     _LIBCPP_CONSTEXPR _LIBCPP_INLINE_VISIBILITY
     const_reference at(size_type __pos) const
     {
         return __pos >= size()
             ? (__throw_out_of_range("string_view::at"), __data[0])
             : __data[__pos];
     }