The objc_object_checker instrumentation inserts a call to the checker function before each call to any of the family of objc_msgSend calls. The checker function gets passed the object, and the selector from the msgSend. These arguments are in different places in the original call instruction depending on whether the method used the struct return convention or not. Traditionally, objc_msgSend was used for scalar returns and objc_msgSent_stret for struct return conventions. But on arm64, both scalar and struct return calls use objc_msgSend, so for struct return methods we were passing the checker the wrong object pointer and the expression was crashing in the checker.
However, the llvm::Instruction generated by the JIT knows whether it was used with struct return convention or not, so add a check for that to the code that inserts the checker.