<table border="1" cellspacing="0" cellpadding="8">
    <tr>
        <th>Issue</th>
        <td>
            <a href=https://github.com/llvm/llvm-project/issues/137968>137968</a>
        </td>
    </tr>

    <tr>
        <th>Summary</th>
        <td>
            [RISCV] `clang` generates incorrect code and uses wrong register during array indexing when using any optimization level other than `-O0`
        </td>
    </tr>

    <tr>
      <th>Labels</th>
      <td>
            clang
      </td>
    </tr>

    <tr>
      <th>Assignees</th>
      <td>
      </td>
    </tr>

    <tr>
      <th>Reporter</th>
      <td>
          thebigclub
      </td>
    </tr>
</table>

<pre>
    Found a case where `clang` misbehaves. The wrong register is being used to generate the memory address that's read. This causes the generated program to crash because an incorrect location (`0xffffffff`) is accessed:

```bash
$ cat << EOF > test.c
#include <stddef.h>

size_t fn(const char *str) {
        size_t ret = 4, sp = 4;

        char c0 = str[0 - sp], c3 = str[3 - sp];
        if (c0 == 0) return ret + 0 - sp;
        if (c3 == 0) return ret + 3 - sp;

        return 0;
}
EOF
$ clang -O3 -c test.c
$ llvm-objdump -d test.o

test.o: file format elf32-littleriscv

Disassembly of section .text:

00000000 <fn>:
       0: ffc54503      lbu     a0, -0x4(a0)
 4: c101                beqz    a0, 0x4 <fn+0x4>
       6: fff04503      lbu     a0, -0x1(zero)
       a: 00a03533      snez    a0, a0
       e: 157d  addi    a0, a0, -0x1
      10: 890d          andi    a0, a0, 0x3
      12: 8082          ret
$ clang -v
clang version 21.0.0git (https://github.com/llvm/llvm-project.git 4aca20c8b6dcf86696db03d860e635112601a7f9)
Target: riscv32-unknown-unknown-elf
```

Notice that the second load uses the `zero` register (`x0`). This register always returns the value zero when read. It should be using the `a0` register instead.

If you change the expression `3 - sp` to `-1`, the correct code is generated:

```bash

test.o: file format elf32-littleriscv

Disassembly of section .text:

00000000 <fn>:
 0: ffc54583            lbu     a1, -0x4(a0)
       4: c181          beqz    a1, 0x4 <fn+0x4>
       6: fff54503      lbu     a0, -0x1(a0)
       a: 00a03533      snez    a0, a0
       e: 157d          addi    a0, a0, -0x1
      10: 890d  andi    a0, a0, 0x3
      12: 8082          ret
      14: 4501  li      a0, 0x0
      16: 8082          ret
```
</pre>
<img width="1" height="1" alt="" src="http://email.email.llvm.org/o/eJy8Vl2P4rgS_TXmpQQqOx8kDzz0F9K83JbuHd3XlWNXEs-GmLWdbuhfv7ITaHpmtjWrldZCIsHnVJmqOkeW3ptuJNqx4p4Vjys5hd66XeipMZ0apmbVWH3e7e00apCgpCd47ckRsBLVIMeOlQgH4xvq5Qv5DXztCV6dHTtw1BkfyIHx0JAZO5g8aQgWOhrJyUAQeoIDHaw7g9TakfcQehmY2HpwJHUMZzwoOXnyCX2hajg62zl5iPGUk76HhhIO5AhmVNY5UgEGq2QwdgQmKlYintplsRKZqOPZpFLkPWmW3TFMnxLnTyN9H99FDkoGYNkDyx7g6XkPLHuCQD5sVNrPzKiGSVOE-KA1tZueZU9zOG_e6LcA7chEpezoA6heOmDizgcXz8C29wlZL0hHMdcj5Ew8gD8uz9n9cjqsE19h2ogxinuENfgjKx4jRWU3O9l1ZwlQmzYWY6ZHXKqDozC5cU4t7mGJ9x0l-4ySfaBE1gLA5bftI8O7p-f9paJxemD9nMFa3dYyh2F4Oaxt801PhyOs9bxp57DLc2xV3ZqBoLXuIAPQ0GZiPZgQBnLGq5cZ_mi89J4OzXAG24InlYZhE-gUrv3GZcXutWPsW9qBeSHL7qBtVZEXmKVfGNZDMzGsJcZyr_GUM1HFlzrS8khQHDlcFsO6oT_ergw85UsucR_JaVIWbDmna_GTdJyJ6o2cXRLOS0YiosSsyK5EP9J7WonvaIpoXmx1REmtzS3qkuWC5qkGVY369i_J8QcWnrJ3kkgkrMQtyVH42P_YqPnxhZyPzRF8gxvsTByrqg_h6GM_xJ6JfWdCPzUbZQ9M7OOYLF_ro7PfSIVNZOVSSYGqakqt2qos61I3mOmqRCqzgnNRIpfbtp6r91W6juIsQBqbTKyn8ffRvo7XbxraW1OYZ-Y_NhhFya2SL3lSdtQwWKnhalasxNSmEt_NcPahE87-sxjcdVcOr_LsF2nNQV7kMBHEONF5x8UXvwTwvZ0GDQ3B5KO7LhklfshnRh8iYz72lxbOdooGNHaz_dLpGH03WWSJi4hLjLbKSlzzdM6HBL14qrKaonFevfivnfPfFeyNVKvvtcN_JtV5LYKtfipY_quC_cwf-I9JP8r116R6K75fl-w_k-qCSDXKC-Tp35kbK3s_KS8_UfxlMlZ6l-k6q-WKdnyblyhEwberfqfzQslaNq2sipL4tmoIeVZrapHzotIrsxMoCswz5DkveL4RWBZVmZNUGjmXiuVIB2mGTbSEjXXdyng_0Y5n27qsVoNsaPDppiPEfHcRIl563C55SDN1nuU4GB_8e4hgwpCuR__98r-H_7Pi8cPN5yIBf3PlSPKQ4-ID392F9OSiVqVz8gxm1HSKr0nYs4rleAZ7DOZg3uaLy0AvNIANPbloN0mm6-dUyskNu79nkEzsU008E_ulLC878WcAAAD__zz62Ao">