<table border="1" cellspacing="0" cellpadding="8">
    <tr>
        <th>Issue</th>
        <td>
            <a href=https://github.com/llvm/llvm-project/issues/91481>91481</a>
        </td>
    </tr>

    <tr>
        <th>Summary</th>
        <td>
            miscompile due to interaction between returned and range attributes
        </td>
    </tr>

    <tr>
      <th>Labels</th>
      <td>
            miscompilation
      </td>
    </tr>

    <tr>
      <th>Assignees</th>
      <td>
      </td>
    </tr>

    <tr>
      <th>Reporter</th>
      <td>
          regehr
      </td>
    </tr>
</table>

<pre>
    this function:
```llvm
define i32 @f(i32 %0) {
  %2 = shl i32 %0, 1
 %3 = sub nuw i32 %2, %0
  ret i32 %3
}
```
is being optimized to:
```lllvm
define range(i32 0, -1) i32 @f(i32 returned %0) local_unnamed_addr #0 {
  ret i32 %0
}

attributes #0 = { mustprogress nofree norecurse nosync nounwind willreturn memory(none) }
```
but when we pass -1 to the optimized code this is out-of-bounds for the range, creating poison, violating the rules for `returned`

cc @nunoplopes 
</pre>
<img width="1px" height="1px" alt="" src="http://email.email.llvm.org/o/eJxsU91uqzwQfBpzs0pkGwjJBRfnNMprVMZewJ-MF_mnUb-nPzKkTRVVQsYss9bMeFbFaCeP2LP2L2uvlcppptAHnHAO1UDms0-zjTBmr5Mlz-o_jF8Z_8NOfH-c-1j2ksHRegRbS2ANH5k8b1vZciYvwLq_OwxKSQKrrxBnB0_MG4gHgsm23gF5AJ_vXyBZQBv4cVLA9PWvfvDqri8E908bYUDrJ6A12cX-jwYS_abmVU5QfsKHlo3kQRQ5LyoDphw8mm-5jrRy79l7taB5V8YEYLLmP234QZ6_kt9WlVKwQ04YH731tfTDkmNaA00BYwRPY0AETwF1DrHs4qfX4Cn7u_UG7ta5nR4suFD4ZPLsyeN-Kb-7NeQE9xk93BFWFSMcBCSCNOMP_zQZhC0dNgLldKDxMFD2JsJIYQM_zHsDHVClYv9KNpIvpQ9Lbq9tyOxw72Mn_uXmN5991bpY7rOn1dGKESrT1-ZSX1SFvehEK7pL2_Fq7rHhdYucD4qrk-h4q4UQGofLqVPjSdSV7SWXDW_5WTTNSfBjfVGcnxqjzrLjWo6s4bgo644lEEcKU2VjzNhfRHMWlVMDurgNjZSLjZqW1RY1RZosgxT60ngY8hRZw52NKT6PSjY57L_7EEzG4q_1CYPaBg0GTHdE_0yW8mb3E565qHJw_ZzSGkuU5Y3J22TTnIejpoXJ25bm_XVYA_2HOjF525REJm-bmH8BAAD__0QFNr8">