cmd/compile: fix loopbce overflow check logic

addWillOverflow and subWillOverflow has an implicit assumption that y is
positive, using it outside of addU and subU is really incorrect. This CL
fixes those incorrect usage to use the correct logic in place.

Thanks to Jakub Ciolek for reporting this issue.

Fixes #78333
Fixes CVE-2026-27143

Change-Id: I263e8e7ac227e2a68109eb7bbd45f66569ed22ec
Reviewed-on: https://go-internal-review.googlesource.com/c/go/+/3700
Reviewed-by: Damien Neil <dneil@google.com>
Reviewed-by: Neal Patel <nealpatel@google.com>
Reviewed-on: https://go-review.googlesource.com/c/go/+/763765
Reviewed-by: Jakub Ciolek <jakub@ciolek.dev>
Reviewed-by: Russ Cox <rsc@golang.org>
LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>
Auto-Submit: David Chase <drchase@google.com>

1 files changed, 28 insertions, 0 deletions

diff --git a/test/loopbce.go b/test/loopbce.go
index ca09e7e7f7..3ef08a2b8d 100644
--- a/test/loopbce.go
+++ b/test/loopbce.go
@@ -469,6 +469,34 @@ func stride2(x *[7]int) int {
 	return s
 }
 
+// This loop should not be proved anything.
+func smallIntUp(arr *[128]int) {
+	for i := int8(0); i <= int8(120); i += int8(10) {
+		arr[i] = int(i)
+	}
+}
+
+// This loop should not be proved anything.
+func smallIntDown(arr *[128]int) {
+	for i := int8(0); i >= int8(-120); i -= int8(10) {
+		arr[127+i] = int(i)
+	}
+}
+
+// This loop should not be proved anything.
+func smallUintUp(arr *[128]int) {
+	for i := uint8(0); i <= uint8(250); i += uint8(10) {
+		arr[i] = int(i)
+	}
+}
+
+// This loop should not be proved anything.
+func smallUintDown(arr *[128]int) {
+	for i := uint8(255); i >= uint8(0); i -= uint8(10) {
+		arr[127+i] = int(i)
+	}
+}
+
 //go:noinline
 func useString(a string) {
 }