The logic inside getMulExpr to simplify {a,+,b}*{c,+,d} was wrong, which was