[sayed0200]

S2Cell::Decode reads a raw 64-bit S2CellId from the buffer and hands it straight to the S2Cell constructor, and S2CellUnion::Decode stores each decoded id the same way, without either one calling is_valid(). Those bytes come from whatever serialized data the caller is decoding, so an id with face bits 6 or 7, or one with no level marker bit such as 0, gets through and leaves the cell with face_ outside 0..5 or a level of -2. From there GetRectBound() looks up S2::GetUAxis(face_), which indexes the six-entry kFaceUVWAxes table out of bounds, and the bad level feeds an out-of-range shift in IJLevelToBoundUV; S2CellUnion reaches the same code because its region methods build an S2Cell from every stored id. I noticed it while comparing the region decoders, since S2LatLngRect::Decode and S2PointRegion::Decode already return false on invalid input and these two were the outliers, and decoding the eight bytes ff ff ff ff ff ff ff ff followed by GetRectBound() under UBSan reports "index 7 out of bounds for type 'const double[6][3][3]'" at s2coords.h:481. The fix makes both decoders reject any id that fails S2CellId::is_valid(), so every encoding produced by Encode() still round-trips unchanged and the check stays inside the decoders instead of relying on each caller. I added DecodeRejectsInvalidCellId tests to s2cell_test and s2cell_union_test, which fail before the change and pass after, and the full test suite is green locally.