<table border="1" cellspacing="0" cellpadding="8">
    <tr>
        <th>Issue</th>
        <td>
            <a href=https://github.com/llvm/llvm-project/issues/58321>58321</a>
        </td>
    </tr>

    <tr>
        <th>Summary</th>
        <td>
            miscompile of a frozen poison by AArch64 backend
        </td>
    </tr>

    <tr>
      <th>Labels</th>
      <td>
            new issue
      </td>
    </tr>

    <tr>
      <th>Assignees</th>
      <td>
      </td>
    </tr>

    <tr>
      <th>Reporter</th>
      <td>
          regehr
      </td>
    </tr>
</table>

<pre>
    here's a slightly modified version of a function found in the LLVM test suite:
```llvm
define i32 @f(i32 %0) {
  %2 = ashr i32 %0, 32
  %3 = freeze i32 %2
  %4 = ashr i32 %3, 3
  %5 = mul i32 %3, %4
  ret i32 %5
}
```

it's a bit of a pain to demonstrate how it gets miscompiled, so please bear with me. %2 is poison so then %3 is an arbitrary i32, %4 is an arbitrary i32 that has 3 signbits and then %5 is `(%3 * (%3 >>a 3))`. this function can return any i32 that satisfies this equation. 

on the AArch64 side, this is the generated code:
```
f:
        asr     w8, w8, #3
        mul     w0, w8, w8
        ret
```
notice that it multiplies the shifted value by itself, instead of multiplying the shifted value by the unshifted value, which is what the original code does. this leads to returning impossible values such as 0x4676cf69 that are not solutions to the equation above. 

a correct backend can return a constant satisfying the equation (such as 0) or it could generate code similar to this that faithfully performs the math:
```
f:
        asr     w9, w8, #3
        mul     w0, w8, w9
        ret
```

cc @nunoplopes @ryan-berger @nbushehri @Hatsunespica
</pre>
<img width="1px" height="1px" alt="" src="http://email.email.llvm.org/o/eJyVVEuTnDYQ_jXMpctTIAZmOHAYZ-Pywb7mLlADSoRE1GLX41-fFprXJluVpIoSkvr99afunLq0E3rMxJFAAhk9TsFcYHZKDxoVvKIn7Sy4gcXDavsQT4NbrQJtIUwI37799h0CUgBadcCsPGf5S5afszpPnzGvc7pSOGiLoEsB2SEfMnHatqLKM9FAdvyc1CBe8X35ApImDw-lX6AUTzrlpjN4xJ9403qWH_7ho9x8PKlUm8q8mnca0fam5DHcZNW1suPL30q8HrdVhyuanQ4Jt0VGqBwonJ2l4GVAmNwbsHzEQDBr6t28aIMqBicHi0FJCB1KD286TDDjPoGiCRaniZvAagy_TTjwtbQgPcf00l9iwrc6PpKxpQwwSYISSI-WRVFJ3T1W0SoWJk4JZ3GG-778lT_JMIomfnW-ZzvWv_Oj53gM2-o5rH0KSDJoYl5R0sc_Vxn1ubQn_Fyi1fns-6k-cHoKYymbhaZNNqLFiKKC3qkPGJeOw0OQN5I8r2-n6CqtmSjLu5gJEMX5Q8zrTcilfBjAuqB7TKVxL9lH0ItJ5SHQpIeY4qs0K7eSYQiEZoi-NbMApYrsuBpdtB0_toqXq313vaU36X6KeLzF6FHJeT1qK82GCSiHdG0Lc0lR5F9qSYyk58UR6c5g8kj8dtkd8yH_caiPdT_UTapLegSuk9lm1tirzVEMd2seyM694vsWSs7Be-wDdLL_A5lXz4xgIdcv7Y0P99rvLplp93ziZHA-4tu71ah771OZpGdt-JFsSW3s4JwHyU9mWA0PsgX94PycOjLLMP0fsjT_nSzNv5IlrX0fJ59drVuMWxh3PvmLtJ869CP6TditNOHkdTx8lYFWi7ToXu6wLeq6qpqiypudakvVlI3cBR0Mto8Zcp3V3v3kp3ydFcyj23u6dmS3etNOISwUCxdf-BsZtbXbsxs-bEM7_T4t3v3OzeSjJmKy8KY6laLYTW01FLWqi2Mtm2NRqYM4KFUeSyyKqpZ9n--M7NBQm1WfMyEs8tCLLnifVS873YpciCIvRFEXJ9Hs62N5qHuVC9mcKhwUI4Cz1GYf89g7P-58u6XUrSOx0GgK9BBKisMMcQvH_uUaJudbjyPjudsit1vmfwEzDiI7">