Index: lib/Target/X86/X86ISelLowering.cpp
===================================================================
--- lib/Target/X86/X86ISelLowering.cpp
+++ lib/Target/X86/X86ISelLowering.cpp
@@ -28083,10 +28083,14 @@
   MachineInstrBuilder MIB =
       BuildMI(fallMBB, DL, TII->get(PtrLoadOpc), PrevSSPReg);
   for (unsigned i = 0; i < X86::AddrNumOperands; ++i) {
+    const MachineOperand &MO = MI.getOperand(i);
     if (i == X86::AddrDisp)
-      MIB.addDisp(MI.getOperand(i), SPPOffset);
+      MIB.addDisp(MO, SPPOffset);
+    else if (MO.isReg()) // Don't add the whole operand, we don't want to
+                         // preserve kill flags.
+      MIB.addReg(MO.getReg());
     else
-      MIB.add(MI.getOperand(i));
+      MIB.add(MO);
   }
   MIB.setMemRefs(MMOBegin, MMOEnd);
 
@@ -28204,17 +28208,27 @@
 
   // Reload FP
   MIB = BuildMI(*thisMBB, MI, DL, TII->get(PtrLoadOpc), FP);
-  for (unsigned i = 0; i < X86::AddrNumOperands; ++i)
-    MIB.add(MI.getOperand(i));
+  for (unsigned i = 0; i < X86::AddrNumOperands; ++i) {
+    const MachineOperand &MO = MI.getOperand(i);
+    if (MO.isReg()) // Don't add the whole operand, we don't want to
+                    // preserve kill flags.
+      MIB.addReg(MO.getReg());
+    else
+      MIB.add(MO);
+  }
   MIB.setMemRefs(MMOBegin, MMOEnd);
 
   // Reload IP
   MIB = BuildMI(*thisMBB, MI, DL, TII->get(PtrLoadOpc), Tmp);
   for (unsigned i = 0; i < X86::AddrNumOperands; ++i) {
+    const MachineOperand &MO = MI.getOperand(i);
     if (i == X86::AddrDisp)
-      MIB.addDisp(MI.getOperand(i), LabelOffset);
+      MIB.addDisp(MO, LabelOffset);
+    else if (MO.isReg()) // Don't add the whole operand, we don't want to
+                         // preserve kill flags.
+      MIB.addReg(MO.getReg());
     else
-      MIB.add(MI.getOperand(i));
+      MIB.add(MO);
   }
   MIB.setMemRefs(MMOBegin, MMOEnd);
 
@@ -28224,7 +28238,8 @@
     if (i == X86::AddrDisp)
       MIB.addDisp(MI.getOperand(i), SPOffset);
     else
-      MIB.add(MI.getOperand(i));
+      MIB.add(MI.getOperand(i)); // We can preserve the kill flags here, it's
+                                 // the last instruction of the expansion.
   }
   MIB.setMemRefs(MMOBegin, MMOEnd);
 
Index: test/CodeGen/X86/sjlj-shadow-stack-liveness.mir
===================================================================
--- /dev/null
+++ test/CodeGen/X86/sjlj-shadow-stack-liveness.mir
@@ -0,0 +1,35 @@
+# RUN: llc -mtriple=x86_64-- -run-pass=expand-isel-pseudos -verify-machineinstrs -o - %s | FileCheck %s
+# Check that we're not copying the kill flags with the operands from the pseudo
+# instruction.
+--- |
+  define void @bar() { ret void }
+
+  !llvm.module.flags = !{!0}
+
+  !0 = !{i32 4, !"cf-protection-return", i32 1}
+...
+---
+name:            bar
+# CHECK-LABEL: name: bar
+alignment:       4
+tracksRegLiveness: true
+body:             |
+  bb.0:
+    %0:gr64 = IMPLICIT_DEF
+    ; CHECK: %0:gr64 = IMPLICIT_DEF
+    EH_SjLj_LongJmp64 killed %0, 1, $noreg, 0, $noreg
+    ; CHECK: bb.3:
+    ; CHECK: MOV64rm %0
+    ; CHECK-NOT: MOV64rm killed %0
+    ; CHECK: bb.7:
+    ; CHECK-NEXT: MOV64rm %0
+    ; CHECK-NOT: MOV64rm killed %0
+    ; CHECK-NEXT: MOV64rm %0
+    ; CHECK-NOT: MOV64rm killed %0
+    ; CHECK-NEXT: MOV64rm killed %0
+
+  ; FIXME: Dummy PHI to set the property NoPHIs to false. PR38439.
+  bb.2:
+    %1:gr64 = PHI undef %1, %bb.2, undef %1, %bb.2
+    JMP_1 %bb.2
+...