x86: +1 reproducible bug #194 — InstCombine alone CSEs distinct freezes

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: jlebar

x86/README.md

@@ -227,3 +227,4 @@ Goal: find ≥100 real bugs in the x86 path through the default LLVM pass pipeli
 | 191 | [191-vectorcombine-scalarizeLoad-infloop-on-strong-atomic](bugs/191-vectorcombine-scalarizeLoad-infloop-on-strong-atomic/) | VectorCombine scalarizeLoad | `monotonic`/`acquire`/`seq_cst` atomic vector load → opt hangs at 100% CPU (worklist re-pushes the surviving original load forever) | confirmed (hang) |
 | 192 | [192-simplifycfg-mergeCondStores-drops-nontemporal](bugs/192-simplifycfg-mergeCondStores-drops-nontemporal/) | **default SimplifyCFG** mergeConditionalStores | merged store drops `!nontemporal` when only one of the paired stores carried it | confirmed (opt diff) |
 | 193 | [193-simplifycfg-mergeCondStores-spreads-invariant-group](bugs/193-simplifycfg-mergeCondStores-spreads-invariant-group/) | **default SimplifyCFG** mergeConditionalStores | `!invariant.group` from one store leaks onto the merged store carrying the other branch's value | confirmed (opt diff) |
+| 194 | [194-instcombine-freeze-cse-distinct-instances](bugs/194-instcombine-freeze-cse-distinct-instances/) | **InstCombine** (default O2) | distinct `freeze` of same poison-able operand merged; fires WITHOUT GVN/EarlyCSE/NewGVN; sibling of #187/#188/#136 | confirmed (opt diff) |

x86/bugs/194-instcombine-freeze-cse-distinct-instances/NOTES.md

@@ -0,0 +1,27 @@
+# 194 — InstCombine alone CSEs distinct `freeze` instructions of same poison-able operand
+
+Component: InstCombine (default O2)
+
+Same family as #187 (Standard GVN), #188 (EarlyCSE), #136 (NewGVN), but in **InstCombine** itself. InstCombine recognizes `freeze X; freeze X` as redundant when X is a single SSA value, even when X may produce poison — folds `f1 - f2 → 0`.
+
+## Reproducer
+
+```ll
+define i32 @f(i32 %x) {
+  %s = shl i32 1, %x       ; poison when x >= 32
+  %f1 = freeze i32 %s
+  %f2 = freeze i32 %s
+  %d = sub i32 %f1, %f2
+  ret i32 %d
+}
+```
+
+`opt -passes=instcombine -S` → `ret i32 0`.
+
+Per LangRef each freeze independently picks an arbitrary fixed value when its input is poison/undef. With `%x = 32`, `%s` is poison; `%f1` may pick e.g. `0x1234`, `%f2` may pick `0x5678`; `%d = -0x4444 ≠ 0`. InstCombine claims they're identical.
+
+InstCombine is **the** workhorse of `-O2`; this bug fires unconditionally in the standard pipeline.
+
+## Severity
+
+Alive2-falsifiable. Affects code that uses `freeze` to safely consume a possibly-poison value multiple times (common idiom for promoting `select i1 poison` etc.).

x86/bugs/194-instcombine-freeze-cse-distinct-instances/cmd.sh

@@ -0,0 +1,4 @@
+#!/usr/bin/env bash
+OPT=/home/orenamd@semianalysis.com/FuzzX/amdgpu/build/llvm-fuzzer/bin/opt
+echo "===== InstCombine alone CSEs two distinct freeze of poison-able operand ====="
+"$OPT" -passes=instcombine -S repro.ll | grep -E "define|freeze|sub|ret"

x86/bugs/194-instcombine-freeze-cse-distinct-instances/repro.ll

@@ -0,0 +1,7 @@
+define i32 @f(i32 %x) {
+  %s = shl i32 1, %x  ; poison when x >= 32
+  %f1 = freeze i32 %s
+  %f2 = freeze i32 %s
+  %d = sub i32 %f1, %f2
+  ret i32 %d
+}