[llvm-ml] Improve indirect call parsing

[ayzhao]

Summary

In MASM, if a QWORD symbol is passed to a jmp or call instruction in
64-bit mode or a DWORD or WORD symbol is passed in 32-bit mode, then
MSVC's assembler recognizes that as an indirect call. Additionally, if
the operand is qualified as a ptr, then that should also be an indirect
call.

Furthermore, in 64-bit mode, such operands are implicitly rip-relative
(in fact, MSVC's assembler ml64.exe does not allow explicitly specifying
rip as a base register.)

To keep this patch managable, this patch does not include:

• error messages for wrong operand types (e.g. passing a QWORD in 32-bit mode)
• resolving indirect calls if the symbol is declared after it's first use (llvm-ml currently only runs a single pass).
• imlementing the extern keyword (required to resolve https://crbug.com/762167.)

This patch is likely missing a bunch of edge cases, so please do point
them out in the review.

[ayzhao]

Remove extra spaces and leftover debugging lines

[MaskRay]

llvm/lib/Target/X86/AsmParser/X86AsmParser.cpp

1109–1110

Fix the function naming to use lowerCase while updating the signature.

llvm/test/tools/llvm-ml/unconditional_branch_x64.asm

11 ↗

(On Diff #425011)

t0 alone may not be unique in the output.

61 ↗

(On Diff #425011)

Consider -NEXT: if appropriate.

[epastor]

llvm/lib/Target/X86/AsmParser/X86AsmParser.cpp

2642

Why do we need to set the DefaultBaseReg unconditionally for the unconditional branches? Aren't they only implicitly RIP-relative if referencing a named symbol (i.e., one with known type, which is what the SM.getElementSize() below is testing)?

(Also, I'm a little surprised if the conditional branches have different handling, though anything's possible.)

2655

Rather than lookUpData, can't we just use the type info that's already available in SM? (getType if you want the name, and others if you want other information.) There's even a chance this might account for the QWORD PTR "cast" already.

2658

Can't we check the type size, rather than the name? If it's actually special-cased on these types alone, then maybe we should consider marking the type info with a special flag rather than handling the mnemonic here.

[hans]

llvm/test/tools/llvm-ml/unconditional_branch_x64.asm

5 ↗

(On Diff #425011)

probably a silly question, but what's the 28 for?

70 ↗

(On Diff #425011)

These are great test cases!

Can we also have some tests where instead of jmp or call, "fn", "[fn]" etc. are moved into a register?
And should there be some tests with conditional jumps too?
It seems from this patch that they might be different, but in either case it seems good to cover that with tests.

llvm/test/tools/llvm-ml/unconditional_branch_x86.asm

1 ↗

(On Diff #425011)

Since they're mostly the same, maybe instead of having separate test files for 32- and 64-bit, maybe it would be simpler to combine them into one. file with two "RUN" lines.
You could use a macro to define e.g. "WORD" to "qword" or "dword", and use "CHECK32" and "CHECK64" for when the expectations are different.

[ayzhao]

code review feedback

llvm/lib/Target/X86/AsmParser/X86AsmParser.cpp

2642

Why do we need to set the DefaultBaseReg unconditionally for the unconditional branches? Aren't they only implicitly RIP-relative if referencing a named symbol (i.e., one with known type, which is what the SM.getElementSize() below is testing)?

Done.

The difficulty here is that in direct jumps, the operand is a relative displacement, not a memory address. My original thought was that direct jumps are inherently rip relative (e.g. jmp 0xAB means jump to the address [rip + 0xAB], not jump to 0xAB], and direct jumps and indirect jumps (e.g. jump to the address [rip + 0xAB] vs jump to the address stored at memory location [rip + 0xAB] would be differentiated by BaseReg ad MaybeDirectBranchDest. In hindsight though, this would've meant that we have to set DefaultBaseReg = X86::RIP for all branching instructions in 64-bit mode, which feels pretty excessive.

To complicate things, there are also far jumps, which apparently do jump to absolute addresses. This patch ignores those.

(Also, I'm a little surprised if the conditional branches have different handling, though anything's possible.)

All branching instructions that I've encountered only accept offsets as parameters[0][1], so I _think_ only call and jmp can do an indirect branch. OTOH, I could be completely missing something.

[0]: https://www.felixcloutier.com/x86/jcc
[1]: https://www.felixcloutier.com/x86/loop:loopcc

2658

I played around with MSVC ml and it turns out that it is entirely dependent on the type size rather than the name, so, for example, an 8 byte sized struct would still work. I added a test case for this scenario.

llvm/test/tools/llvm-ml/unconditional_branch_x64.asm

5 ↗

(On Diff #425011)

Dummy value

70 ↗

(On Diff #425011)

Can we also have some tests where instead of jmp or call, "fn", "[fn]" etc. are moved into a register?

Already covered in rip-relative-addressing.asm

And should there be some tests with conditional jumps too?

Done (though conditional jumps only accept labels)

llvm/test/tools/llvm-ml/unconditional_branch_x86.asm

1 ↗

(On Diff #425011)

Done.

At this time, type aliases are defined with the TYPEDEF keyword, which is not yet implemented, so I ended up splitting it into multiple blocks.

[epastor]

Looks good to me, but probably make sure Hans agrees first.

llvm/test/tools/llvm-ml/indirect_branch.asm

189

nit: let's add the end-of-file newline.

[hans]

The logic seems pretty tricky to me, but I defer to Eric for that.
And I'm slowly coming to terms that brackets doesn't seem to mean anything to masm, it's really just about the operand types.

I'm basically happy, but maybe we can make the test file clearer by defining some macro with the /D option?

llvm/lib/Target/X86/AsmParser/X86AsmParser.cpp

4718

This change looks like a no-op?

llvm/lib/Target/X86/AsmParser/X86Operand.h

76

A comment would be good.

llvm/test/tools/llvm-ml/indirect_branch.asm

186

Do we give a decent error for "je fn_ref"?

llvm/test/tools/llvm-ml/unconditional_branch_x86.asm

1 ↗

(On Diff #425011)

Sorry, I was thinking of "macro" as in those that can be defined on the command-line, e.g. "ml /DWORD=dword". I didn't check if llvm-ml supports the /D flag, but in case it does that might be easier?

[ayzhao]

more code review comments

[ayzhao]

llvm/test/tools/llvm-ml/indirect_branch.asm

186

llvm-ml seems to accept je fn_ref by treating fn_ref as a label. My guess is that llvm-ml (and perhaps other assembler dialects) are more tolerant of what can be treated as a label.

This is definitely an inconsistency, but fixing it feels like it's out of the scope of this patch.

[hans]

lgtm

[MaskRay]

llvm/test/tools/llvm-ml/indirect_branch.asm

8

Two-column indentation is much more common.

[ayzhao]

indirect_branch_asm spacing

[ayzhao]

one more indent

llvm/lib/Target/X86/AsmParser/X86AsmParser.cpp

private:
   std::unique_ptr<X86Operand> DefaultMemDIOperand(SMLoc Loc);
   bool IsSIReg(unsigned Reg);
   unsigned GetSIDIForRegClass(unsigned RegClassID, unsigned Reg, bool IsSIReg);
   void
   AddDefaultSrcDestOperands(OperandVector &Operands,
                             std::unique_ptr<llvm::MCParsedAsmOperand> &&Src,
                             std::unique_ptr<llvm::MCParsedAsmOperand> &&Dst);
   bool VerifyAndAdjustOperands(OperandVector &OrigOperands,
                                OperandVector &FinalOperands);
-  bool ParseOperand(OperandVector &Operands);
-  bool ParseATTOperand(OperandVector &Operands);
-  bool ParseIntelOperand(OperandVector &Operands);
+  bool parseOperand(OperandVector &Operands, StringRef Name);
+  bool parseATTOperand(OperandVector &Operands);
+  bool parseIntelOperand(OperandVector &Operands, StringRef Name);
   bool ParseIntelOffsetOperator(const MCExpr *&Val, StringRef &ID,
                                 InlineAsmIdentifierInfo &Info, SMLoc &End);
   bool ParseIntelDotOperator(IntelExprStateMachine &SM, SMLoc &End);
   unsigned IdentifyIntelInlineAsmOperator(StringRef Name);
   unsigned ParseIntelInlineAsmOperator(unsigned OpKind);
   unsigned IdentifyMasmOperator(StringRef Name);
   bool ParseMasmOperator(unsigned OpKind, int64_t &Val);
   bool ParseRoundingModeOp(SMLoc Start, OperandVector &Operands);
bool X86AsmParser::VerifyAndAdjustOperands(OperandVector &OrigOperands,
   }
   // OrigOperands.append(FinalOperands.begin(), FinalOperands.end());
   for (unsigned int i = 0; i < FinalOperands.size(); ++i)
     OrigOperands.push_back(std::move(FinalOperands[i]));
 
   return false;
 }
 
-bool X86AsmParser::ParseOperand(OperandVector &Operands) {
+bool X86AsmParser::parseOperand(OperandVector &Operands, StringRef Name) {
   if (isParsingIntelSyntax())
-    return ParseIntelOperand(Operands);
+    return parseIntelOperand(Operands, Name);
 
-  return ParseATTOperand(Operands);
+  return parseATTOperand(Operands);
 }
 
 bool X86AsmParser::CreateMemForMSInlineAsm(
     unsigned SegReg, const MCExpr *Disp, unsigned BaseReg, unsigned IndexReg,
     unsigned Scale, SMLoc Start, SMLoc End, unsigned Size, StringRef Identifier,
     const InlineAsmIdentifierInfo &Info, OperandVector &Operands) {
   // If we found a decl other than a VarDecl, then assume it is a FuncDecl or
   // some other label reference.
if (Size) {
     const AsmToken &Tok = Lex(); // Eat operand size (e.g., byte, word).
     if (!(Tok.getString().equals("PTR") || Tok.getString().equals("ptr")))
       return Error(Tok.getLoc(), "Expected 'PTR' or 'ptr' token!");
     Lex(); // Eat ptr.
   }
   return false;
 }
 
-bool X86AsmParser::ParseIntelOperand(OperandVector &Operands) {
+bool X86AsmParser::parseIntelOperand(OperandVector &Operands, StringRef Name) {
   MCAsmParser &Parser = getParser();
   const AsmToken &Tok = Parser.getTok();
   SMLoc Start, End;
 
   // Parse optional Size directive.
   unsigned Size;
   if (ParseIntelMemoryOperandSize(Size))
     return true;
if ((BaseReg || IndexReg) &&
     return Error(Start, ErrMsg);
   if (isParsingMSInlineAsm())
     return CreateMemForMSInlineAsm(RegNo, Disp, BaseReg, IndexReg, Scale, Start,
                                    End, Size, SM.getSymName(),
                                    SM.getIdentifierInfo(), Operands);
 
   // When parsing x64 MS-style assembly, all non-absolute references to a named
   // variable default to RIP-relative.
-  if (Parser.isParsingMasm() && is64BitMode() && SM.getElementSize() > 0) {
-    Operands.push_back(X86Operand::CreateMem(getPointerWidth(), RegNo, Disp,
-                                             BaseReg, IndexReg, Scale, Start,
-                                             End, Size,
-                                             /*DefaultBaseReg=*/X86::RIP));
-    return false;
+  unsigned DefaultBaseReg = X86::NoRegister;
+  bool MaybeDirectBranchDest = true;
+
+  if (Parser.isParsingMasm()) {
+    bool IsUnconditionalBranch =
+        Name.equals_insensitive("jmp") || Name.equals_insensitive("call");
+    if (is64BitMode() && SM.getElementSize() > 0) {
+      DefaultBaseReg = X86::RIP;
+    }
+    if (IsUnconditionalBranch) {
+      if (PtrInOperand) {
+        MaybeDirectBranchDest = false;
+        if (is64BitMode())
+          DefaultBaseReg = X86::RIP;
+      } else if (!BaseReg && !IndexReg && Disp &&
+                 Disp->getKind() == MCExpr::SymbolRef) {
+        if (is64BitMode()) {
+          if (SM.getSize() == 8) {
+            MaybeDirectBranchDest = false;
+            DefaultBaseReg = X86::RIP;
+          }
+        } else {
+          if (SM.getSize() == 4 || SM.getSize() == 2)
+            MaybeDirectBranchDest = false;
+        }
+      }
+    }
   }
 
-  if ((BaseReg || IndexReg || RegNo))
-    Operands.push_back(X86Operand::CreateMem(getPointerWidth(), RegNo, Disp,
-                                             BaseReg, IndexReg, Scale, Start,
-                                             End, Size));
+  if ((BaseReg || IndexReg || RegNo || DefaultBaseReg != X86::NoRegister))
+    Operands.push_back(X86Operand::CreateMem(
+        getPointerWidth(), RegNo, Disp, BaseReg, IndexReg, Scale, Start, End,
+        Size, DefaultBaseReg, /*SymName=*/StringRef(), /*OpDecl=*/nullptr,
+        /*FrontendSize=*/0, /*UseUpRegs=*/false, MaybeDirectBranchDest));
   else
-    Operands.push_back(
-        X86Operand::CreateMem(getPointerWidth(), Disp, Start, End, Size));
+    Operands.push_back(X86Operand::CreateMem(
+        getPointerWidth(), Disp, Start, End, Size, /*SymName=*/StringRef(),
+        /*OpDecl=*/nullptr, /*FrontendSize=*/0, /*UseUpRegs=*/false,
+        MaybeDirectBranchDest));
   return false;
 }
 
-bool X86AsmParser::ParseATTOperand(OperandVector &Operands) {
+bool X86AsmParser::parseATTOperand(OperandVector &Operands) {
   MCAsmParser &Parser = getParser();
   switch (getLexer().getKind()) {
   case AsmToken::Dollar: {
     // $42 or $ID -> immediate.
     SMLoc Start = Parser.getTok().getLoc(), End;
     Parser.Lex();
     const MCExpr *Val;
     // This is an immediate, so we should not parse a register. Do a precheck
bool X86AsmParser::ParseInstruction(ParseInstructionInfo &Info, StringRef Name,
   // the next one.
   if (getLexer().isNot(AsmToken::EndOfStatement) && !IsPrefix) {
     // Parse '*' modifier.
     if (getLexer().is(AsmToken::Star))
       Operands.push_back(X86Operand::CreateToken("*", consumeToken()));
 
     // Read the operands.
     while (true) {
-      if (ParseOperand(Operands))
+      if (parseOperand(Operands, Name))
         return true;
       if (HandleAVX512Operand(Operands))
         return true;
 
       // check for comma and eat it
       if (getLexer().is(AsmToken::Comma))
         Parser.Lex();
       else
if (UnsizedMemOp && UnsizedMemOp->isMemUnsized()) {
     // Restore the size of the unsized memory operand if we modified it.
     UnsizedMemOp->Mem.Size = 0;
   }
 
   // If we haven't matched anything yet, this is not a basic integer or FPU
   // operation.  There shouldn't be any ambiguity in our mnemonic table, so try
   // matching with the unsized operand.
   if (Match.empty()) {
-    Match.push_back(MatchInstruction(
-        Operands, Inst, ErrorInfo, MissingFeatures, MatchingInlineAsm,
-        isParsingIntelSyntax()));
+    unsigned MI = MatchInstruction(Operands, Inst, ErrorInfo, MissingFeatures,
+                                   MatchingInlineAsm, isParsingIntelSyntax());
+    Match.push_back(MI);
     // If this returned as a missing feature failure, remember that.
     if (Match.back() == Match_MissingFeature)
       ErrorInfoMissingFeatures = MissingFeatures;
   }
 
   // Restore the size of the unsized memory operand if we modified it.
   if (UnsizedMemOp)
     UnsizedMemOp->Mem.Size = 0;

llvm/lib/Target/X86/AsmParser/X86Operand.h

struct MemOp {
     unsigned IndexReg;
     unsigned Scale;
     unsigned Size;
     unsigned ModeSize;
 
     /// If the memory operand is unsized and there are multiple instruction
     /// matches, prefer the one with this size.
     unsigned FrontendSize;
+
+    bool MaybeDirectBranchDest;
   };
 
   union {
     struct TokOp Tok;
     struct RegOp Reg;
     struct ImmOp Imm;
     struct MemOp Mem;
     struct PrefOp Pref;
struct X86Operand final : public MCParsedAsmOperand {
   unsigned getMemModeSize() const {
     assert(Kind == Memory && "Invalid access!");
     return Mem.ModeSize;
   }
   unsigned getMemFrontendSize() const {
     assert(Kind == Memory && "Invalid access!");
     return Mem.FrontendSize;
   }
+  bool isMaybeDirectBranchDest() const {
+    assert(Kind == Memory && "Invalid access!");
+    return Mem.MaybeDirectBranchDest;
+  }
 
   bool isToken() const override {return Kind == Token; }
 
   bool isImm() const override { return Kind == Immediate; }
 
   bool isImmSExti16i8() const {
     if (!isImm())
       return false;
bool isMem512_RC256X() const {
     return isMem512() && isMemIndexReg(X86::YMM0, X86::YMM31);
   }
   bool isMem512_RC512() const {
     return isMem512() && isMemIndexReg(X86::ZMM0, X86::ZMM31);
   }
 
   bool isAbsMem() const {
     return Kind == Memory && !getMemSegReg() && !getMemBaseReg() &&
-      !getMemIndexReg() && getMemScale() == 1;
+           !getMemIndexReg() && getMemScale() == 1 && isMaybeDirectBranchDest();
   }
+
   bool isAVX512RC() const{
       return isImm();
   }
 
   bool isAbsMem16() const {
     return isAbsMem() && Mem.ModeSize == 16;
   }
 
static std::unique_ptr<X86Operand> CreateImm(const MCExpr *Val,
     return Res;
   }
 
   /// Create an absolute memory operand.
   static std::unique_ptr<X86Operand>
   CreateMem(unsigned ModeSize, const MCExpr *Disp, SMLoc StartLoc, SMLoc EndLoc,
             unsigned Size = 0, StringRef SymName = StringRef(),
             void *OpDecl = nullptr, unsigned FrontendSize = 0,
-            bool UseUpRegs = false) {
+            bool UseUpRegs = false, bool MaybeDirectBranchDest = true) {
     auto Res = std::make_unique<X86Operand>(Memory, StartLoc, EndLoc);
     Res->Mem.SegReg   = 0;
     Res->Mem.Disp     = Disp;
     Res->Mem.BaseReg  = 0;
     Res->Mem.DefaultBaseReg = 0;
     Res->Mem.IndexReg = 0;
     Res->Mem.Scale    = 1;
     Res->Mem.Size     = Size;
     Res->Mem.ModeSize = ModeSize;
     Res->Mem.FrontendSize = FrontendSize;
+    Res->Mem.MaybeDirectBranchDest = MaybeDirectBranchDest;
     Res->UseUpRegs = UseUpRegs;
     Res->SymName      = SymName;
     Res->OpDecl       = OpDecl;
     Res->AddressOf    = false;
     return Res;
   }
 
   /// Create a generalized memory operand.
   static std::unique_ptr<X86Operand>
   CreateMem(unsigned ModeSize, unsigned SegReg, const MCExpr *Disp,
             unsigned BaseReg, unsigned IndexReg, unsigned Scale, SMLoc StartLoc,
             SMLoc EndLoc, unsigned Size = 0,
             unsigned DefaultBaseReg = X86::NoRegister,
             StringRef SymName = StringRef(), void *OpDecl = nullptr,
-            unsigned FrontendSize = 0, bool UseUpRegs = false) {
+            unsigned FrontendSize = 0, bool UseUpRegs = false,
+            bool MaybeDirectBranchDest = true) {
     // We should never just have a displacement, that should be parsed as an
     // absolute memory operand.
     assert((SegReg || BaseReg || IndexReg || DefaultBaseReg) &&
            "Invalid memory operand!");
 
     // The scale should always be one of {1,2,4,8}.
     assert(((Scale == 1 || Scale == 2 || Scale == 4 || Scale == 8)) &&
            "Invalid scale!");
     auto Res = std::make_unique<X86Operand>(Memory, StartLoc, EndLoc);
     Res->Mem.SegReg   = SegReg;
     Res->Mem.Disp     = Disp;
     Res->Mem.BaseReg  = BaseReg;
     Res->Mem.DefaultBaseReg = DefaultBaseReg;
     Res->Mem.IndexReg = IndexReg;
     Res->Mem.Scale    = Scale;
     Res->Mem.Size     = Size;
     Res->Mem.ModeSize = ModeSize;
     Res->Mem.FrontendSize = FrontendSize;
+    Res->Mem.MaybeDirectBranchDest = MaybeDirectBranchDest;
     Res->UseUpRegs = UseUpRegs;
     Res->SymName      = SymName;
     Res->OpDecl       = OpDecl;
     Res->AddressOf    = false;
     return Res;
   }
 };
 
 } // end namespace llvm
 
 #endif // LLVM_LIB_TARGET_X86_ASMPARSER_X86OPERAND_H

llvm/test/tools/llvm-ml/indirect_branch.asm

+; RUN: llvm-ml -m64 -filetype=s %s /Fo - | FileCheck %s --check-prefixes=CHECK-64,CHECK
+; RUN: llvm-ml -m32 -filetype=s %s /Fo - | FileCheck %s --check-prefixes=CHECK-32,CHECK
+
+.data
+
+ifdef rax
+    fn_ref qword 1
+else
+    fn_ref dword 1
+endif
+
+fn_ref_word word 2
+fn PROC
+
+BranchTargetStruc struc
+    member0 dword ?
+    ifdef rax
+        member1 dword ?
+    endif
+BranchTargetStruc ends
+
+
+ifdef rax
+    fn_ref_struc BranchTargetStruc {3, 3}
+else
+    fn_ref_struc BranchTargetStruc {3}
+endif
+
+.code
+
+t0:
+call fn_ref
+jmp fn_ref
+; CHECK-LABEL: t0:
+; CHECK-64: call qword ptr [rip + fn_ref]
+; CHECK-64: jmp qword ptr [rip + fn_ref]
+; CHECK-32: call dword ptr [fn_ref]
+; CHECK-32: jmp dword ptr [fn_ref]
+
+t1:
+call [fn_ref]
+jmp [fn_ref]
+; CHECK-LABEL: t1:
+; CHECK-64: call qword ptr [rip + fn_ref]
+; CHECK-64: jmp qword ptr [rip + fn_ref]
+; CHECK-32: call dword ptr [fn_ref]
+; CHECK-32: jmp dword ptr [fn_ref]
+
+ifdef rax
+    t2:
+    call qword ptr [fn_ref]
+    jmp qword ptr [fn_ref]
+    ; CHECK-64-LABEL: t2:
+    ; CHECK-64: call qword ptr [rip + fn_ref]
+    ; CHECK-64: jmp qword ptr [rip + fn_ref]
+else
+    t2:
+    call dword ptr [fn_ref]
+    jmp dword ptr [fn_ref]
+    ; CHECK-32-LABEL: t2:
+    ; CHECK-32: call dword ptr [fn_ref]
+    ; CHECK-32: jmp dword ptr [fn_ref]
+
+    t3:
+    call fn_ref_word
+    jmp fn_ref_word
+    ; CHECK-32-LABEL: t3:
+    ; CHECK-32: call word ptr [fn_ref_word]
+    ; CHECK-32-NEXT: jmp word ptr [fn_ref_word]
+
+    t4:
+    call [fn_ref_word]
+    jmp [fn_ref_word]
+    ; CHECK-32-LABEL: t4:
+    ; CHECK-32: call word ptr [fn_ref_word]
+    ; CHECK-32-NEXT: jmp word ptr [fn_ref_word]
+
+    t5:
+    call word ptr [fn_ref_word]
+    jmp word ptr [fn_ref_word]
+    ; CHECK-32-LABEL: t5:
+    ; CHECK-32: call word ptr [fn_ref_word]
+    ; CHECK-32-NEXT: jmp word ptr [fn_ref_word]
+endif
+
+t6:
+call t6
+jmp t6
+; CHECK-LABEL: t6:
+; CHECK: call t6
+; CHECK-NEXT: jmp t6
+
+t7:
+call [t7]
+jmp [t7]
+; CHECK-LABEL: t7:
+; CHECK: call t7
+; CHECK-NEXT: jmp t7
+
+ifdef rax
+    t8:
+    call qword ptr [t8]
+    jmp qword ptr [t8]
+    ; CHECK-64-LABEL: t8:
+    ; CHECK-64: call qword ptr [rip + t8]
+    ; CHECK-64-NEXT: jmp qword ptr [rip + t8]
+else
+    t8:
+    call dword ptr [t8]
+    jmp dword ptr [t8]
+    ; CHECK-32-LABEL: t8:
+    ; CHECK-32: call dword ptr [t8]
+    ; CHECK-32-NEXT: jmp dword ptr [t8]
+endif
+
+t9:
+call fn
+jmp fn
+; CHECK-LABEL: t9:
+; CHECK: call fn
+; CHECK-NEXT: jmp fn
+
+t10:
+call [fn]
+jmp [fn]
+; CHECK-LABEL: t10:
+; CHECK: call fn
+; CHECK-NEXT: jmp fn
+
+ifdef rax
+    t11:
+    call qword ptr [fn]
+    jmp qword ptr [fn]
+    ; CHECK-64-LABEL: t11:
+    ; CHECK-64: call qword ptr [rip + fn]
+    ; CHECK-64-NEXT: jmp qword ptr [rip + fn]
+else
+    t11:
+    call dword ptr [fn]
+    jmp dword ptr [fn]
+    ; CHECK-32-LABEL: t11:
+    ; CHECK-32: call dword ptr [fn]
+    ; CHECK-32-NEXT: jmp dword ptr [fn]
+endif
+
+t12:
+call fn_ref_struc
+jmp fn_ref_struc
+; CHECK-LABEL: t12:
+; CHECK-64: call qword ptr [rip + fn_ref_struc]
+; CHECK-64: jmp qword ptr [rip + fn_ref_struc]
+; CHECK-32: call dword ptr [fn_ref_struc]
+; CHECK-32: jmp dword ptr [fn_ref_struc]
+
+t13:
+call [fn_ref_struc]
+jmp [fn_ref_struc]
+; CHECK-LABEL: t13:
+; CHECK-64: call qword ptr [rip + fn_ref_struc]
+; CHECK-64: jmp qword ptr [rip + fn_ref_struc]
+; CHECK-32: call dword ptr [fn_ref_struc]
+; CHECK-32: jmp dword ptr [fn_ref_struc]
+
+ifdef rax
+    t14:
+    call qword ptr [fn_ref_struc]
+    jmp qword ptr [fn_ref_struc]
+    ; CHECK-64-LABEL: t14:
+    ; CHECK-64: call qword ptr [rip + fn_ref_struc]
+    ; CHECK-64: jmp qword ptr [rip + fn_ref_struc]
+else
+    t14:
+    call dword ptr [fn_ref_struc]
+    jmp dword ptr [fn_ref_struc]
+    ; CHECK-32-LABEL: t14:
+    ; CHECK-32: call dword ptr [fn_ref_struc]
+    ; CHECK-32: jmp dword ptr [fn_ref_struc]
+endif
+
+t15:
+je t15
+; CHECK-LABEL: t15:
+; CHECK: je t15
+
+t16:
+je [t16];
+; CHECK-LABEL: t16:
+; CHECK: je t16
 No newline at end of file