Fix std.bytes decode functions crashing on a negative offset

decodeAt's multi-byte variants (u16be_at through f64le_at — everything
but byte_at) cast the offset argument straight to usize with @intcast,
without checking its sign first. A negative offset made that cast a
Zig safety-check failure, aborting the whole process, instead of
raising the catchable RangeError the docs promise for "insufficient
bytes at i" (byte_at already handled this correctly).

Fixed with a shared offsetToUsize helper that raises RangeError for
a negative offset before ever reaching the read functions' own
upper-bound checks.

Author: ganehag

src/compiler_test.zig

@@ -3075,6 +3075,21 @@ test "compiler: std.bytes decode family matches the native-call path byte for by
     );
 }
 
+// A negative offset used to reach @intCast on a negative i64 (a Zig
+// safety-check panic that aborts the process) instead of raising a
+// catchable RangeError like every other out-of-bounds offset — decodeAt's
+// multi-byte variants (everything but byte_at) cast straight to usize
+// without checking the sign first. Fixed with offsetToUsize (bytes.zig).
+test "compiler: std.bytes decode family raises RangeError (not a crash) on a negative offset" {
+    var rt = try setup();
+    defer rt.deinit();
+    try runSrc(&rt,
+        \\std := import("std")
+        \\func f() int { return std.bytes.u32be_at(std.bytes.u32be(1234), -1) }
+    );
+    try std.testing.expectError(error.RangeError, rt.callGlobal("f", &.{}));
+}
+
 test "compiler: field = field + const fuses into field_add_const" {
     // The "c.tx_id = c.tx_id + 1" idiom (found independently in gengo-modbus
     // and gengo-mqtt as a transaction/packet-ID counter), issue #207.

src/lang/native/bytes.zig

@@ -117,23 +117,32 @@ pub const DecodeKind = enum(u8) {
     f64le = 10,
 };
 
+// A negative offset must raise RangeError like every other out-of-bounds
+// case, not panic: @intCast from a negative i64 straight to usize is a Zig
+// safety-check failure (process abort), not a catchable Gengo error.
+fn offsetToUsize(offset_arg: Value) !usize {
+    const idx = try argAsI64(offset_arg);
+    if (idx < 0) return error.RangeError;
+    return @intCast(idx);
+}
+
 pub fn decodeAt(kind: DecodeKind, s: []const u8, offset_arg: Value) !Value {
     switch (kind) {
         .byte_at => {
             const idx = try argAsI64(offset_arg);
             if (idx < 0 or idx >= @as(i64, @intCast(s.len))) return error.RangeError;
             return .{ .int = @as(i64, s[@as(usize, @intCast(idx))]) };
         },
-        .u16be => return .{ .int = try readU16be(s, @intCast(try argAsI64(offset_arg))) },
-        .u16le => return .{ .int = try readU16le(s, @intCast(try argAsI64(offset_arg))) },
-        .u32be => return .{ .int = try readU32be(s, @intCast(try argAsI64(offset_arg))) },
-        .u32le => return .{ .int = try readU32le(s, @intCast(try argAsI64(offset_arg))) },
-        .u64be => return .{ .int = try readU64be(s, @intCast(try argAsI64(offset_arg))) },
-        .u64le => return .{ .int = try readU64le(s, @intCast(try argAsI64(offset_arg))) },
-        .f32be => return .{ .float = try readF32be(s, @intCast(try argAsI64(offset_arg))) },
-        .f32le => return .{ .float = try readF32le(s, @intCast(try argAsI64(offset_arg))) },
-        .f64be => return .{ .float = try readF64be(s, @intCast(try argAsI64(offset_arg))) },
-        .f64le => return .{ .float = try readF64le(s, @intCast(try argAsI64(offset_arg))) },
+        .u16be => return .{ .int = try readU16be(s, try offsetToUsize(offset_arg)) },
+        .u16le => return .{ .int = try readU16le(s, try offsetToUsize(offset_arg)) },
+        .u32be => return .{ .int = try readU32be(s, try offsetToUsize(offset_arg)) },
+        .u32le => return .{ .int = try readU32le(s, try offsetToUsize(offset_arg)) },
+        .u64be => return .{ .int = try readU64be(s, try offsetToUsize(offset_arg)) },
+        .u64le => return .{ .int = try readU64le(s, try offsetToUsize(offset_arg)) },
+        .f32be => return .{ .float = try readF32be(s, try offsetToUsize(offset_arg)) },
+        .f32le => return .{ .float = try readF32le(s, try offsetToUsize(offset_arg)) },
+        .f64be => return .{ .float = try readF64be(s, try offsetToUsize(offset_arg)) },
+        .f64le => return .{ .float = try readF64le(s, try offsetToUsize(offset_arg)) },
     }
 }