SubbinSizes::exclusive_scan out-of-bounds read with negative index #3879

lib/core/subbin_sizes.cpp:106

const auto prev = delta + i >= osize ? 0 : m_sizes[delta + i];

When delta is negative (i.e., x.offset() < offset()), delta + i can be negative. The check >= osize is false for negative values, so the code reads m_sizes at a negative index -- undefined behavior, potential crash or data corruption.