<table border="1" cellspacing="0" cellpadding="8">
    <tr>
        <th>Issue</th>
        <td>
            <a href=https://github.com/llvm/llvm-project/issues/60429>60429</a>
        </td>
    </tr>

    <tr>
        <th>Summary</th>
        <td>
            AArch64 backend: miscompile of testcase of a funnel shift of freeze poison
        </td>
    </tr>

    <tr>
      <th>Labels</th>
      <td>
            backend:AArch64,
            llvm:codegen,
            miscompilation
      </td>
    </tr>

    <tr>
      <th>Assignees</th>
      <td>
      </td>
    </tr>

    <tr>
      <th>Reporter</th>
      <td>
          regehr
      </td>
    </tr>
</table>

<pre>
    this function:

```llvm
target datalayout = "e-m:e-i8:8:32-i16:16:32-i64:64-i128:128-n32:64-S128"
target triple = "aarch64-linux-gnu"

define i8 @f(i32 %0) {
  %2 = freeze i32 poison
  %3 = call i32 @llvm.fshr.i32(i32 1, i32 %0, i32 %2)
  %4 = trunc i32 %3 to i8
  ret i8 %4
}

; Function Attrs: nocallback nofree nosync nounwind speculatable willreturn memory(none)
declare i32 @llvm.fshr.i32(i32, i32, i32) #0

attributes #0 = { nocallback nofree nosync nounwind speculatable willreturn memory(none) }
```

has a set of possible output for every input value, due to using the frozen poison. let's choose 1079001153 as the input parameter. in this case, the possible outputs do not include zero, and hopefully this will convince you:

https://alive2.llvm.org/ce/z/nJQcJ9

the AArch64 backend lowers our function to:
```
f:
        mvn     w8, w8
        mov     w9, #2
        lsr     w10, w0, w8
        lsl     w8, w9, w8
        orr     w0, w8, w10
        ret
```
if we assume wlog that `w8 == 0` and pass the same 1079001153 to this code in w0, we get 0 being returned.

sorry for the not-fun explanation, it's the best I can do (and hopefully it's correct)

cc @nunoplopes 
</pre>
<img width="1px" height="1px" alt="" src="http://email.email.llvm.org/o/eJysVd2O6jgMfppwY4HapEBzwQVzRkh77lb7BGnq0uymSZUfOMzTr5wCw4xWe3UkSFvni-P4--yoGM3ZIR7Y9o1t31cqp9GHQ8AzjmHV-f52SKOJMGSnk_GOiSOr3ln1GHfV8rP2Mi2mpMIZE_QqKatuPidg4h0Y57iemDji2rRMHOkv-NrUOyaOZaCvXcPEcdesTc0JUPN27QRfbH-RjfMvm6RgZouPDZQKetw1a2tc_rU-u_yEL2OPg3EIpgXWVAPjrREcGN9WjEtg-7cFBWTixecQED8QCDZ7E717QYiC0MraMs-akoLNEMewMYLfvdeM_4DPbZ7vnHH54qwpzlLITj8QApIH0z5AAVMJnG-b-5H271-IEG9wunMEx5RCZOIIzlOAndL_gPN0GnA-3pwG57O7GtdDnFFnq5LqLMLVWBsw5eBgwsmHG-Ot8w6fwfaorQr4Pye-n_H5kMC4qF4jVSkF0-WEsUwt5O3ffmOs8JmbhzxfAxhVBAURE_gBZh-jIX8-pzknGHwAvGC4gXH0fVE2I52mz0iM5GjcGdKIMAT_ge4ujA1YTIzvI-jR-4hQV3tZVXW9FaBiwS_-ZhXUhAnDBoyDUlpaxbIDgb6FE6H34HwC47TNPcIHBk9Y5XoY_YxDtva2uKGEgPbuYpxGuPn8rVTHlGYSBeMnxk_KmgvyTWHQhzPjJ42Mnz4YP7mff-qf8nUpRXY8luICIghdD9ZfMUTwOTx7AyT_uefXzA8vwcjp4lglry0d5Np-mv2FzJLMjItn6UobA03UpYCu1bdlNtpPb_LbpA9l6WMNjfVTDDJg-s9ozQBXBBVjnhCu1hPhKgHbVdeW9EqSJXShYVZxITiq6Qvvyd_59T2x_4gcgTpXBR2SkhYJY795zXf0IdyKFMmv82k9ZAf4a7bKqdKFqbwWvRGiw5jgD9DKkV4Yb7_K447UPgTU6VnMy6g1VbLLzs_Wzxhh1R9EL4VUKzzUu_22lvVW1qvx0FZDRZ-VaCWveN1yKWRXK8k7MeybbmUOvOKiqkVdt1u5rTe6avZDLcVuj8NWNg1rKpyUsU_ZrUyMGQ-7quFyZVWHNpaLiPO7zJg43oVHvZz_YJyXm0YcKatndE_zZKL202zsPUGcbrNwIPS6y-dI7crEFD_3TiZZPHzTNXXNpyukDpEwJipRelekdYcW4miG0j_uV8TSBVY52MPXOjubNOZuo_3E-KmEvjzWc_B_FzZOJQeR8VNJw78BAAD___ByQ1s">