Clamp Shape slice bounds before eliminating Shape

[Yuhx141]

Summary

Clamp normalized Shape start/end attributes to the input rank in the shared range helper. This preserves ONNX slicing semantics for bounds outside the rank and prevents eliminate_shape_op from advancing past the stored dimensions.

For a rank-2 input, Shape(start=5) should produce an empty int64[0] tensor. Before this change, the pass computes sizes.cbegin() + 5; an ASan run through onnxsim.simplify reports a heap-buffer-overflow in eliminate_shape_op.h.

Changes

• Clamp normalized start and end to [0, rank].
• Treat a reversed forward interval as empty.
• Add a regression test for start greater than rank.

Validation

• Built from onnx/optimizer main at c8d77f3.
• Targeted test: 1 passed, 171 deselected.
• Native ASan/alignment replay exits 0 after the fix with no sanitizer report.
• ONNX Runtime 1.30.0 with graph optimizations disabled returns the same empty int64[0] output before and after optimization.

Related: onnxsim/onnxsim#2015

[Yuhx141]

The unrelated sequence-test change remains removed from this Shape fix. I moved the self-contained replacement to #355, where it can be reviewed and tested independently.