[ShaddyDC]

Unlike the pointer overload offset_of(const int *), which loops strictly over 0 <= i < this->dimensions(), the variadic Halide::Runtime::Buffer::offset_of(int d, int first, Args... rest) overload previously indexed this->buf.dim[d] without checking whether d had already reached this->dimensions(). For Buffer<T, AnyDims>, passing more coordinates than dimensions() reads uninitialized shape[d] storage (for d < InClassDimStorage) or reads out-of-bounds past buf.dim (for d >= InClassDimStorage or external halide_buffer_t descriptors).

Guard offset_of when d >= this->dimensions() so it asserts under HALIDE_RUNTIME_BUFFER_CHECK_INDICES (matching the compile-time static_assert on fixed-rank Buffer<T, Dims>) and returns 0 without reading this->buf.dim[d] when runtime index checks are disabled. Also update the 0-D scalar buffer check in correctness_lerp (test/correctness/lerp.cpp) from result(0) to result().

Generated with Gemini 4 gemini-code-assist@google.com

[abadams]

Thanks for the PR! This code is intended to go in hot loops, and any kind of branching here is likely to break autovectorization of those loops. Please just assert d < dimensions() in the existing ifdef block