cmd/compile: handle propagating an out-of-range jump table index

For an out-of-range jump table index, the constant facts should not be
propagated to the destinations.

Fixes #76950

Change-Id: Iff29814cb466c7aaa432cec212e5387665c45afc
Reviewed-on: https://go-review.googlesource.com/c/go/+/731860
Auto-Submit: Cuong Manh Le <cuong.manhle.vn@gmail.com>
Reviewed-by: David Chase <drchase@google.com>
Reviewed-by: Cherry Mui <cherryyz@google.com>
LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>

diff --git a/src/cmd/compile/internal/ssa/sccp.go b/src/cmd/compile/internal/ssa/sccp.go
index 9b958d045479c360c520dfc4f692c167d63256f0..7ef8d6b7c1976ee1fe2148e4df40495020f9ca53 100644 (file)
--- a/src/cmd/compile/internal/ssa/sccp.go
+++ b/src/cmd/compile/internal/ssa/sccp.go
@@ -507,6 +507,10 @@ func (t *worklist) propagate(block *Block) {
                                branchIdx = 1 - condLattice.val.AuxInt
                        } else {
                                branchIdx = condLattice.val.AuxInt
+                               if branchIdx < 0 || branchIdx >= int64(len(block.Succs)) {
+                                       // unreachable code, do nothing then
+                                       break
+                               }
                        }
                        t.edges = append(t.edges, block.Succs[branchIdx])
                } else {

diff --git a/test/fixedbugs/issue76950.go b/test/fixedbugs/issue76950.go
new file mode 100644 (file)
index 0000000..b5716e0
--- /dev/null
+++ b/test/fixedbugs/issue76950.go
@@ -0,0 +1,67 @@
+// compile
+
+// Copyright 2025 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+package p
+
+func MatchLog(input string) bool {
+       pos := 0
+       n := len(input)
+       matchState := -1
+       var c byte
+
+       goto State12
+
+State8:
+       goto State65
+
+State12:
+       if pos >= n {
+               goto End
+       }
+       c = input[pos]
+       switch {
+       case c >= 0x09 && c <= 0x0A || c >= 0x0C && c <= 0x0D || c == ' ':
+       case c >= '0' && c <= '9':
+       case c >= 'A' && c <= 'Z' || c == '_' || c >= 'b' && c <= 'z':
+       case c == '[':
+               goto State8
+       case c == 'a':
+       default:
+               goto End
+       }
+
+State64:
+       matchState = 179
+       if pos >= n {
+               goto End
+       }
+       pos = n
+       goto State64
+
+State65:
+
+State66:
+       matchState = 181
+       if pos >= n {
+               goto End
+       }
+       pos = n
+       goto State66
+
+End:
+       if matchState != -1 {
+               switch matchState {
+               case 178:
+               case 156:
+               case 157, 158, 159, 160, 161, 162, 163, 164, 165, 166, 167, 168, 169, 170, 171, 172, 173, 174, 175:
+               case 176, 177, 181, 182, 183:
+               case 179, 184:
+               case 180:
+               }
+               return true
+       }
+       return false
+}