take/part, negative range past head doesn't work, can crash REBOL

[rebolbot]

Submitted by: Gregg

TAKE/part of an offset block reference, using a negative range past the head, can end up with the reference now pointing to another block or to arbitrary memory, depending on when the expression is performed. If the reference is not to a valid block (by cooincidence), REBOL can crash with a system error.

What's more worrying is when it doesn't crash REBOL...

bc.. ; At first startup of 2.100.31

b: skip [1 2 3 4 5] 3 == [4 5] take/part b -5 == [1 2 3] b == [word! path! error! none! unset!] ; Immediately after.... b: skip [1 2 3 4 5] 3 == [4 5] take/part b -5 == [1 2 3] b == [ "Formatted print." fmt "Format" val "Value or block of values" ]

p.

^{CC - Data [ Version: alpha 31 Type: Bug Platform: All Category: n/a Reproduce: Always Fixed-in:alpha 35 ]}

[rebolbot]

Submitted by: admin

Fixed in 2.100.11

bc.. --------------

p. Sorry, it's not correct yet.. try this:

bc.. b: skip [1 2 3 4 5] 3 ;== [4 5] index? b ;== 4 take/part b -5 ;== [1 2 3] b ;== [1 2 3 4 5]

p. And what about this:

bc.. b: skip [1 2 3 4 5] 3 ;== [4 5] take/part b -1 ;== [3] ;correct b ;== [5] ;<---- I would rather expect [4 5] ;...oldes...

p.

[rebolbot]

Submitted by: BrianH

Changed the description to match the behavior of the current build, which is worse.

[rebolbot]

Submitted by: Carl

The first part (take past head clipping) is a bug in MOLD, and is fixable.

The second part must remain b = [5]. This is consistent with all other series removal functions.