cmd/compile: fix slice bounds check elimination after function inlining

When creating a dynamically-sized slice, the compiler attempts to use a
stack-allocated buffer if the slice does not escape and its buffer size
is ≤ 32 bytes.

In this case, the SSA will contain a (OpPhi (OpSliceMake) (OpSliceMake))
value: one OpSliceMake uses the stack-allocated buffer, and the other
uses the heap-allocated buffer. The len and cap arguments for these two
OpSliceMake values are expected to be identical.

This CL enables the prove pass to recognize this scenario and handle
OpSliceLen and OpSliceCap as intended.

Fixes #77375

Change-Id: Id77a2473caf66d366f5c94108aa6cb6d3df5b887
Reviewed-on: https://go-review.googlesource.com/c/go/+/740840
Reviewed-by: Keith Randall <khr@golang.org>
Reviewed-by: Junyang Shao <shaojunyang@google.com>
LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>
Auto-Submit: Keith Randall <khr@golang.org>
Reviewed-by: Keith Randall <khr@google.com>

1 files changed, 39 insertions, 0 deletions

diff --git a/test/codegen/issue77375.go b/test/codegen/issue77375.go
new file mode 100644
index 0000000000..f74ce399fa
--- /dev/null
+++ b/test/codegen/issue77375.go
@@ -0,0 +1,39 @@
+// asmcheck
+
+// Copyright 2026 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+package codegen
+
+func Range(n int) []int {
+	m := make([]int, n)
+
+	for i := 0; i < n; i++ {
+		m[i] = i
+	}
+
+	for i := range n {
+		m[i] = i
+	}
+
+	for i := range len(m) {
+		m[i] = i
+	}
+
+	for i := range m {
+		m[i] = i
+	}
+
+	return m
+}
+
+func F(size int) {
+	// amd64:-`.*panicBounds`
+	// arm64:-`.*panicBounds`
+	Range(size)
+}
+
+func main() {
+	F(-1)
+}