[release-branch.go1.25] cmd/compile: handle propagating an out-of-range jump table index

For an out-of-range jump table index, the constant facts should not be
propagated to the destinations.

Fixes #76967

Change-Id: Iff29814cb466c7aaa432cec212e5387665c45afc
Reviewed-on: https://go-review.googlesource.com/c/go/+/731860
Auto-Submit: Cuong Manh Le <cuong.manhle.vn@gmail.com>
Reviewed-by: David Chase <drchase@google.com>
Reviewed-by: Cherry Mui <cherryyz@google.com>
LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>
Reviewed-on: https://go-review.googlesource.com/c/go/+/732460
Reviewed-by: Junyang Shao <shaojunyang@google.com>
Commit-Queue: Junyang Shao <shaojunyang@google.com>
Auto-Submit: Junyang Shao <shaojunyang@google.com>
Reviewed-by: Michael Knyszek <mknyszek@google.com>

2 files changed, 71 insertions, 0 deletions

diff --git a/src/cmd/compile/internal/ssa/sccp.go b/src/cmd/compile/internal/ssa/sccp.go
index ecc0f94e5b..17f54525e1 100644
--- a/src/cmd/compile/internal/ssa/sccp.go
+++ b/src/cmd/compile/internal/ssa/sccp.go
@@ -511,6 +511,10 @@ func (t *worklist) propagate(block *Block) {
 				branchIdx = 1 - condLattice.val.AuxInt
 			} else {
 				branchIdx = condLattice.val.AuxInt
+				if branchIdx < 0 || branchIdx >= int64(len(block.Succs)) {
+					// unreachable code, do nothing then
+					break
+				}
 			}
 			t.edges = append(t.edges, block.Succs[branchIdx])
 		} else {
diff --git a/test/fixedbugs/issue76950.go b/test/fixedbugs/issue76950.go
new file mode 100644
index 0000000000..b5716e0fc6
--- /dev/null
+++ b/test/fixedbugs/issue76950.go
@@ -0,0 +1,67 @@
+// compile
+
+// Copyright 2025 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+package p
+
+func MatchLog(input string) bool {
+	pos := 0
+	n := len(input)
+	matchState := -1
+	var c byte
+
+	goto State12
+
+State8:
+	goto State65
+
+State12:
+	if pos >= n {
+		goto End
+	}
+	c = input[pos]
+	switch {
+	case c >= 0x09 && c <= 0x0A || c >= 0x0C && c <= 0x0D || c == ' ':
+	case c >= '0' && c <= '9':
+	case c >= 'A' && c <= 'Z' || c == '_' || c >= 'b' && c <= 'z':
+	case c == '[':
+		goto State8
+	case c == 'a':
+	default:
+		goto End
+	}
+
+State64:
+	matchState = 179
+	if pos >= n {
+		goto End
+	}
+	pos = n
+	goto State64
+
+State65:
+
+State66:
+	matchState = 181
+	if pos >= n {
+		goto End
+	}
+	pos = n
+	goto State66
+
+End:
+	if matchState != -1 {
+		switch matchState {
+		case 178:
+		case 156:
+		case 157, 158, 159, 160, 161, 162, 163, 164, 165, 166, 167, 168, 169, 170, 171, 172, 173, 174, 175:
+		case 176, 177, 181, 182, 183:
+		case 179, 184:
+		case 180:
+		}
+		return true
+	}
+	return false
+}