JIT: Incorrect displacement for VPMULUDQ with embedded broadcast #135844

Description

Avx512F.Multiply can read the wrong address when a 64-bit broadcast is folded into its memory operand, producing incorrect results.

Reproduction Steps

Create a .NET 10 console app with this Program.cs:

using System;
using System.Runtime.CompilerServices;
using System.Runtime.InteropServices;
using System.Runtime.Intrinsics;
using System.Runtime.Intrinsics.X86;

[StructLayout(LayoutKind.Explicit)]
struct State
{
    [FieldOffset(8)] public ulong Coefficient;
    [FieldOffset(16)] public ulong Other;
}

class Program
{
    [MethodImpl(MethodImplOptions.NoInlining)]
    static Vector512<ulong> Multiply(ref State state, Vector512<uint> input)
        => Avx512F.Multiply(input, Vector512.Create(state.Coefficient).AsUInt32());

    static void Main()
    {
        var state = new State { Coefficient = 3, Other = 29 };
        Console.WriteLine(Multiply(ref state, Vector512.Create(2u)));
    }
}

Run with AVX-512F available:

DOTNET_TieredCompilation=0 dotnet run -c Release

Expected behavior

Each element is 2 * 3 = 6:

<6, 6, 6, 6, 6, 6, 6, 6>

Actual behavior

Each element is 2 * 29 = 58, using the field at offset 16 instead of offset 8:

<58, 58, 58, 58, 58, 58, 58, 58>

Regression?

No response

Known Workarounds

No response

Configuration

• .NET 10.0.12, 10.0.13, and 12.0.0-alpha.1.26514.112.
• Arch Linux x64

Other information

The instruction bytes are 62 F1 FD 58 F4 46 02, which decode as:

vpmuludq zmm0, zmm0, QWORD BCST [rsi+0x10]

The JIT uses Input_32Bit to compress displacement 8 to 2, but this instruction uses m64bcst, so execution accesses 2 * 8 = 16. See the instruction metadata and displacement calculation.