[glampert]

RegisterAllocator::processBranchState ends each path's stretch of the program at the token after a branch. It does Token& token = *curr; curr++;, and then, for a branch, uses &*curr as the end of the path's trace and (*curr).lineNumber() in its backward-branch check. When the branch is the program's last token, curr is tokens.end(). The ps2gl fixtures hit this: they loop back with b main_loop_lid and have no --exit block.

Dereferencing end() is undefined behaviour. In practice it reads whatever lies past the list's sentinel node, and the ranges of values live across the branch end at that number. --show-reg-alloc on test/fixtures/general.vcl shows two ranges like [271-1842013280], with a different end on each run. On macOS the number is always past every line, so the allocation comes out the same. But what the read finds depends on the standard library and the memory layout. A small value would trip assert( start <= stop ) in Alias::addRange, or give an inverted range in a release build.

This fix ends the stretch at the branch itself when nothing follows it (Token& after = (curr != end) ? *curr : token;).

• Test: test_trailing_branch_ranges.cpp compiles a program that ends with b and checks that every range --show-reg-alloc prints ends within the program. It fails without this fix.
• Output: byte-identical across a local corpus of 49 programs (quake2-ps2, Tyra, ps2gl, the examples and some repros). Three of them fail to compile on master and with this fix, with the same errors: two have out-of-range immediates, and Tyra's stapip_cull_td_vu1 runs out of VF registers. On master, 10 of the programs print ranges that end past their last line: the nine general* fixtures and ps2gl's billboard renderer. With the fix, none do.
• Sanitizers: the tests and the corpus run clean under ASan and UBSan. Neither can see this out-of-bounds read, because it stays inside a valid object.

[glampert]

Not sure what happened with the MacOS test below, seems to have timed out and I don't think I can rerun it. I am working on a Mac, so the MacOS tests are passing.

The job was not acquired by Runner of type hosted even after multiple attempts
Internal server error. Correlation ID: 07e7c0c2-0980-472e-8c99-88d4430ec455

Cheers!