Index: lib/Target/ARM/ARMBaseInstrInfo.cpp
===================================================================
--- lib/Target/ARM/ARMBaseInstrInfo.cpp
+++ lib/Target/ARM/ARMBaseInstrInfo.cpp
@@ -2333,6 +2333,8 @@
   for (int CurRegEnc = FirstRegEnc - 1; CurRegEnc >= 0 && RegsNeeded;
        --CurRegEnc) {
     unsigned CurReg = RegClass->getRegister(CurRegEnc);
+    if (IsT1PushPop && CurReg > ARM::R7)
+      continue;
     if (!IsPop) {
       // Pushing any register is completely harmless, mark the register involved
       // as undef since we don't care about its value and must not restore it
Index: test/CodeGen/ARM/fold-stack-adjust.ll
===================================================================
--- test/CodeGen/ARM/fold-stack-adjust.ll
+++ test/CodeGen/ARM/fold-stack-adjust.ll
@@ -1,10 +1,10 @@
 ; Disable shrink-wrapping on the first test otherwise we wouldn't
 ; exerce the path for PR18136.
-; RUN: llc -mtriple=thumbv7-apple-none-macho < %s -enable-shrink-wrap=false | FileCheck %s
-; RUN: llc -mtriple=thumbv6m-apple-none-macho -frame-pointer=all < %s | FileCheck %s --check-prefix=CHECK-T1
-; RUN: llc -mtriple=thumbv7-apple-darwin-ios -frame-pointer=all < %s | FileCheck %s --check-prefix=CHECK-IOS
-; RUN: llc -mtriple=thumbv7--linux-gnueabi -frame-pointer=all < %s | FileCheck %s --check-prefix=CHECK-LINUX
-
+; RUN: llc -mtriple=thumbv7-apple-none-macho < %s -enable-shrink-wrap=false -verify-machineinstrs | FileCheck %s --check-prefixes=CHECK-FNSTART,CHECK
+; RUN: llc -mtriple=thumbv6m-apple-none-macho -frame-pointer=all < %s -verify-machineinstrs | FileCheck %s --check-prefixes=CHECK-FNSTART,CHECK-T1
+; RUN: llc -mtriple=thumbv6m-apple-none-macho < %s -verify-machineinstrs | FileCheck %s --check-prefixes=CHECK-FNSTART,CHECK-T1-NOFP
+; RUN: llc -mtriple=thumbv7-apple-darwin-ios -frame-pointer=all < %s -verify-machineinstrs | FileCheck %s --check-prefixes=CHECK-FNSTART,CHECK-IOS
+; RUN: llc -mtriple=thumbv7--linux-gnueabi -frame-pointer=all < %s -verify-machineinstrs | FileCheck %s --check-prefixes=CHECK-FNSTART,CHECK-LINUX
 
 declare void @bar(i8*)
 
@@ -13,14 +13,13 @@
 @var = global %bigVec zeroinitializer
 
 define void @check_simple() minsize {
-; CHECK-LABEL: check_simple:
+; CHECK-FNSTART-LABEL: check_simple:
 ; CHECK: push {r3, r4, r5, r6, r7, lr}
 ; CHECK-NOT: sub sp, sp,
 ; ...
 ; CHECK-NOT: add sp, sp,
 ; CHECK: pop {r0, r1, r2, r3, r7, pc}
 
-; CHECK-T1-LABEL: check_simple:
 ; CHECK-T1: push {r3, r4, r5, r6, r7, lr}
 ; CHECK-T1: add r7, sp, #16
 ; CHECK-T1-NOT: sub sp, sp,
@@ -30,7 +29,6 @@
 
   ; iOS always has a frame pointer and messing with the push affects
   ; how it's set in the prologue. Make sure we get that right.
-; CHECK-IOS-LABEL: check_simple:
 ; CHECK-IOS: push {r3, r4, r5, r6, r7, lr}
 ; CHECK-NOT: sub sp,
 ; CHECK-IOS: add r7, sp, #16
@@ -45,7 +43,7 @@
 }
 
 define void @check_simple_too_big() minsize {
-; CHECK-LABEL: check_simple_too_big:
+; CHECK-FNSTART-LABEL: check_simple_too_big:
 ; CHECK: push {r7, lr}
 ; CHECK: sub sp,
 ; ...
@@ -57,7 +55,7 @@
 }
 
 define void @check_vfp_fold() minsize {
-; CHECK-LABEL: check_vfp_fold:
+; CHECK-FNSTART-LABEL: check_vfp_fold:
 ; CHECK: push {r[[GLOBREG:[0-9]+]], lr}
 ; CHECK: vpush {d6, d7, d8, d9}
 ; CHECK-NOT: sub sp,
@@ -68,7 +66,6 @@
 
   ; iOS uses aligned NEON stores here, which is convenient since we
   ; want to make sure that works too.
-; CHECK-IOS-LABEL: check_vfp_fold:
 ; CHECK-IOS: push {r4, r7, lr}
 ; CHECK-IOS: sub.w r4, sp, #16
 ; CHECK-IOS: bfc r4, #0, #4
@@ -92,23 +89,20 @@
 ; This function should use just enough space that the "add sp, sp, ..." could be
 ; folded in except that doing so would clobber the value being returned.
 define i64 @check_no_return_clobber() minsize {
-; CHECK-LABEL: check_no_return_clobber:
+; CHECK-FNSTART-LABEL: check_no_return_clobber:
 ; CHECK: push {r1, r2, r3, r4, r5, r6, r7, lr}
 ; CHECK-NOT: sub sp,
 ; ...
 ; CHECK: add sp, #24
 ; CHECK: pop {r7, pc}
 
-  ; Just to keep iOS FileCheck within previous function:
-; CHECK-IOS-LABEL: check_no_return_clobber:
-
   %var = alloca i8, i32 20
   call void @bar(i8* %var)
   ret i64 0
 }
 
 define arm_aapcs_vfpcc double @check_vfp_no_return_clobber() minsize {
-; CHECK-LABEL: check_vfp_no_return_clobber:
+; CHECK-FNSTART-LABEL: check_vfp_no_return_clobber:
 ; CHECK: push {r[[GLOBREG:[0-9]+]], lr}
 ; CHECK: vpush {d0, d1, d2, d3, d4, d5, d6, d7, d8, d9}
 ; CHECK-NOT: sub sp,
@@ -131,7 +125,7 @@
 ; PR18136: there was a bug determining where the first eligible pop in a
 ; basic-block was when the entire block was epilogue code.
 define void @test_fold_point(i1 %tst) minsize {
-; CHECK-LABEL: test_fold_point:
+; CHECK-FNSTART-LABEL: test_fold_point:
 
   ; Important to check for beginning of basic block, because if it gets
   ; if-converted the test is probably no longer checking what it should.
@@ -142,7 +136,6 @@
   ; With a guaranteed frame-pointer, we want to make sure that its offset in the
   ; push block is correct, even if a few registers have been tacked onto a later
   ; vpush (PR18160).
-; CHECK-IOS-LABEL: test_fold_point:
 ; CHECK-IOS: push {r4, r7, lr}
 ; CHECK-IOS-NEXT: add r7, sp, #4
 ; CHECK-IOS-NEXT: vpush {d7, d8}
@@ -165,7 +158,7 @@
 }
 
 define void @test_varsize(...) minsize {
-; CHECK-T1-LABEL: test_varsize:
+; CHECK-FNSTART-LABEL: test_varsize:
 ; CHECK-T1: sub	sp, #16
 ; CHECK-T1: push	{r5, r6, r7, lr}
 ; ...
@@ -174,7 +167,6 @@
 ; CHECK-T1: add	sp, #16
 ; CHECK-T1: bx	[[POP_REG]]
 
-; CHECK-LABEL: test_varsize:
 ; CHECK: sub	sp, #16
 ; CHECK: push	{r5, r6, r7, lr}
 ; ...
@@ -198,7 +190,7 @@
 
 define fastcc float @check_vfp_no_return_clobber2(i16* %r, i16* %chars, i32 %length, i1 zeroext %flag) minsize {
 entry:
-; CHECK-LINUX-LABEL: check_vfp_no_return_clobber2
+; CHECK-FNSTART-LABEL: check_vfp_no_return_clobber2
 ; CHECK-LINUX: vpush	{d0, d1, d2, d3, d4, d5, d6, d7, d8}
 ; CHECK-NOT: sub sp,
 ; ...
@@ -220,7 +212,7 @@
 
 declare void @use_arr(i32*)
 define void @test_fold_reuse() minsize {
-; CHECK-LABEL: test_fold_reuse:
+; CHECK-FNSTART-LABEL: test_fold_reuse:
 ; CHECK: push.w {r4, r7, r8, lr}
 ; CHECK: sub sp, #24
 ; [...]
@@ -232,4 +224,16 @@
   ret void
 }
 
+; It doesn't matter what registers this pushes and pops; just make sure
+; it doesn't try to push/pop an illegal register on Thumb1.
+define void @test_long_fn() minsize nounwind optsize {
+; CHECK-FNSTART-LABEL: test_long_fn:
+; CHECK-T1-NOFP: push {r7, lr}
+; CHECK-T1-NOFP: pop {r3, pc}
+entry:
+  %z = alloca i32, align 4
+  call void asm sideeffect ".space 3000", "r"(i32* nonnull %z)
+  ret void
+}
+
 declare void @llvm.va_start(i8*) nounwind