HalideBuffer::crop() lets you crop to illegal bounds

[steven-johnson]

If you give it a min,extent pair that is outside the current bounds of the Buffer, it will produce a buffer with illegal extents that will allow out of bounds writes. We should reality-check the input args and assert and/or clamp appropriately.

[abadams]

Asserting would remove the ability to un-crop in cases where you know the buffer you have is a small window on a larger thing. E.g. you might want to make an ROI and then march it along inside the larger thing by repeatedly cropping a little over to the right.

IMO this is an ugly thing to do and we should be OK with forbidding it, but I just wanted to note that there is a memory-safe use-case that we'd be intentionally ruling out.

[steven-johnson]

where you know the buffer you have is a small window on a larger thing

This sounds like a Bad Idea; if you know you need to do this, you should really restructure to pass the larger thing in.

[abadams]

Agreed, just wanted to leave a record that this is intentional.