From b6b8b2fe6ef8ceb727c7a157750cdd4e61393489 Mon Sep 17 00:00:00 2001
From: Cuong Manh Le <cuong.manhle.vn@gmail.com>
Date: Mon, 22 Dec 2025 18:49:17 +0700
Subject: [PATCH] cmd/compile: handle propagating an out-of-range jump table
 index

For an out-of-range jump table index, the constant facts should not be
propagated to the destinations.

Fixes #76950

Change-Id: Iff29814cb466c7aaa432cec212e5387665c45afc
Reviewed-on: https://go-review.googlesource.com/c/go/+/731860
Auto-Submit: Cuong Manh Le <cuong.manhle.vn@gmail.com>
Reviewed-by: David Chase <drchase@google.com>
Reviewed-by: Cherry Mui <cherryyz@google.com>
LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>
---
 src/cmd/compile/internal/ssa/sccp.go |  4 ++
 test/fixedbugs/issue76950.go         | 67 ++++++++++++++++++++++++++++
 2 files changed, 71 insertions(+)
 create mode 100644 test/fixedbugs/issue76950.go

diff --git a/src/cmd/compile/internal/ssa/sccp.go b/src/cmd/compile/internal/ssa/sccp.go
index 9b958d0454..7ef8d6b7c1 100644
--- a/src/cmd/compile/internal/ssa/sccp.go
+++ b/src/cmd/compile/internal/ssa/sccp.go
@@ -507,6 +507,10 @@ func (t *worklist) propagate(block *Block) {
 				branchIdx = 1 - condLattice.val.AuxInt
 			} else {
 				branchIdx = condLattice.val.AuxInt
+				if branchIdx < 0 || branchIdx >= int64(len(block.Succs)) {
+					// unreachable code, do nothing then
+					break
+				}
 			}
 			t.edges = append(t.edges, block.Succs[branchIdx])
 		} else {
diff --git a/test/fixedbugs/issue76950.go b/test/fixedbugs/issue76950.go
new file mode 100644
index 0000000000..b5716e0fc6
--- /dev/null
+++ b/test/fixedbugs/issue76950.go
@@ -0,0 +1,67 @@
+// compile
+
+// Copyright 2025 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+package p
+
+func MatchLog(input string) bool {
+	pos := 0
+	n := len(input)
+	matchState := -1
+	var c byte
+
+	goto State12
+
+State8:
+	goto State65
+
+State12:
+	if pos >= n {
+		goto End
+	}
+	c = input[pos]
+	switch {
+	case c >= 0x09 && c <= 0x0A || c >= 0x0C && c <= 0x0D || c == ' ':
+	case c >= '0' && c <= '9':
+	case c >= 'A' && c <= 'Z' || c == '_' || c >= 'b' && c <= 'z':
+	case c == '[':
+		goto State8
+	case c == 'a':
+	default:
+		goto End
+	}
+
+State64:
+	matchState = 179
+	if pos >= n {
+		goto End
+	}
+	pos = n
+	goto State64
+
+State65:
+
+State66:
+	matchState = 181
+	if pos >= n {
+		goto End
+	}
+	pos = n
+	goto State66
+
+End:
+	if matchState != -1 {
+		switch matchState {
+		case 178:
+		case 156:
+		case 157, 158, 159, 160, 161, 162, 163, 164, 165, 166, 167, 168, 169, 170, 171, 172, 173, 174, 175:
+		case 176, 177, 181, 182, 183:
+		case 179, 184:
+		case 180:
+		}
+		return true
+	}
+	return false
+}
-- 
2.52.0