cmd/compile: handle min integer step in loop

Since negating min int will overflows back to itself, causing a panic
inside subWillUnderflow check.

Fixes #78641

Change-Id: Ibbf2fa3228b9890a1a76ac6f4ff504b7e125b29f
Reviewed-on: https://go-review.googlesource.com/c/go/+/766260
Auto-Submit: Cuong Manh Le <cuong.manhle.vn@gmail.com>
LUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>
Reviewed-by: David Chase <drchase@google.com>
Reviewed-by: Jorropo <jorropo.pgm@gmail.com>
Reviewed-by: Keith Randall <khr@google.com>

2 files changed, 31 insertions, 0 deletions

diff --git a/src/cmd/compile/internal/ssa/loopbce.go b/src/cmd/compile/internal/ssa/loopbce.go
index 0d3130fe9a..127018dfb0 100644
--- a/src/cmd/compile/internal/ssa/loopbce.go
+++ b/src/cmd/compile/internal/ssa/loopbce.go
@@ -159,6 +159,12 @@ nextblock:
 			if step == 0 {
 				continue
 			}
+			// step == minInt64 cannot be safely negated below, because -step
+			// overflows back to minInt64. The later underflow checks need a
+			// positive magnitude, so reject this case here.
+			if step == minSignedValue(ind.Type) {
+				continue
+			}
 
 			// startBody is the edge that eventually returns to the loop header.
 			var startBody Edge
diff --git a/test/fixedbugs/issue78641.go b/test/fixedbugs/issue78641.go
new file mode 100644
index 0000000000..be964354af
--- /dev/null
+++ b/test/fixedbugs/issue78641.go
@@ -0,0 +1,25 @@
+// run
+
+// Copyright 2026 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+package main
+
+const (
+	intSize = 32 << (^uint(0) >> 63)
+	minInt  = -1 << (intSize - 1)
+)
+
+func main() {
+	f()
+}
+
+func f() {
+	for i := 0; true; i += minInt {
+		if i < 0 {
+			return
+		}
+	}
+	panic("unreachable")
+}