Index: llvm/trunk/lib/Target/AArch64/AArch64FrameLowering.cpp
===================================================================
--- llvm/trunk/lib/Target/AArch64/AArch64FrameLowering.cpp
+++ llvm/trunk/lib/Target/AArch64/AArch64FrameLowering.cpp
@@ -1023,6 +1023,8 @@
   int FPOffset = MFI.getObjectOffset(FI) + FixedObject + 16;
   int Offset = MFI.getObjectOffset(FI) + MFI.getStackSize();
   bool isFixed = MFI.isFixedObjectIndex(FI);
+  bool isCSR = !isFixed && MFI.getObjectOffset(FI) >=
+                               -((int)AFI->getCalleeSavedStackSize());
 
   // Use frame pointer to reference fixed objects. Use it for locals if
   // there are VLAs or a dynamically realigned SP (and thus the SP isn't
@@ -1036,6 +1038,12 @@
     // Argument access should always use the FP.
     if (isFixed) {
       UseFP = hasFP(MF);
+    } else if (isCSR && RegInfo->needsStackRealignment(MF)) {
+      // References to the CSR area must use FP if we're re-aligning the stack
+      // since the dynamically-sized alignment padding is between the SP/BP and
+      // the CSR area.
+      assert(hasFP(MF) && "Re-aligned stack must have frame pointer");
+      UseFP = true;
     } else if (hasFP(MF) && !RegInfo->needsStackRealignment(MF)) {
       // If the FPOffset is negative, we have to keep in mind that the
       // available offset range for negative offsets is smaller than for
@@ -1069,9 +1077,9 @@
     }
   }
 
-  assert((isFixed || !RegInfo->needsStackRealignment(MF) || !UseFP) &&
+  assert(((isFixed || isCSR) || !RegInfo->needsStackRealignment(MF) || !UseFP) &&
          "In the presence of dynamic stack pointer realignment, "
-         "non-argument objects cannot be accessed through the frame pointer");
+         "non-argument/CSR objects cannot be accessed through the frame pointer");
 
   if (UseFP) {
     FrameReg = RegInfo->getFrameRegister(MF);
Index: llvm/trunk/test/CodeGen/AArch64/spill-stack-realignment.mir
===================================================================
--- llvm/trunk/test/CodeGen/AArch64/spill-stack-realignment.mir
+++ llvm/trunk/test/CodeGen/AArch64/spill-stack-realignment.mir
@@ -0,0 +1,35 @@
+# RUN: llc -mtriple=aarch64-none-linux-gnu -run-pass=prologepilog %s -o - | FileCheck %s
+
+# Ensure references to scavenged stack slots in the CSR area use the
+# FP as a base when the stack pointer must be aligned to something
+# larger than required by the target. This is necessary because the
+# alignment padding area is between the CSR area and the SP, so the SP
+# cannot be used to reference the CSR area.
+name:            test
+tracksRegLiveness: true
+frameInfo:
+  maxAlignment:    64
+# CHECK:      stack:
+# CHECK:        id: 0, name: '', type: default, offset: -64, size: 4, alignment: 64
+# CHECK-NEXT:     stack-id: 0
+# CHECK-NEXT:     local-offset: -64
+# CHECK:        id: 1, name: '', type: default, offset: -20, size: 4, alignment: 4
+# CHECK-NEXT:     stack-id: 0
+# CHECK-NEXT:     local-offset: -68
+stack:
+  - { id: 0, size: 4, alignment: 64, local-offset: -64 }
+  - { id: 1, size: 4, alignment: 4, local-offset: -68 }
+
+# CHECK: body:
+# CHECK:   $sp = ANDXri killed ${{x[0-9]+}}, 7865
+# CHECK:   STRSui $s0, $sp, 0
+# CHECK:   STURSi $s0, $fp, -4
+body:             |
+  bb.0.entry:
+    liveins: $s0
+
+    STRSui $s0, %stack.0, 0
+    STRSui $s0, %stack.1, 0
+    ; Force preserve a CSR to create a hole in the CSR stack region.
+    $x28 = IMPLICIT_DEF
+    RET_ReallyLR