AArch64: use "LBB-_func" entries in 32-bit jump tables for MachO

[t.p.northover]

Summary

MachO has only 24-bits for relocation addends, which is too small to span a semi-reasonable sized function. This means jump table lowering has to be careful about two things:

• Any pc-relative address should be to a linker-visible symbol so the addend is 0. This was fixed previously by making the actual jump table symbol linker-private.
• The entries, "LBB-x", must be resolved at compile-time.

This implements the second point by making the base the function address itself on MachO targets. However, it only applies to MachO because it is a less efficient system overall (requiring the function address base to be materialized separately).

[t.p.northover]

Actually, I've discovered 32-bit addends are allowed in a constant-pool setting like that so it won't overflow on a reasonable function. Siince this makes CodeGen strictly worse there's no point.

llvm/lib/Target/AArch64/AArch64AsmPrinter.cpp

 
 void AArch64AsmPrinter::emitJumpTableEntry(const MachineJumpTableInfo *MJTI,
                                            const MachineBasicBlock *MBB,
                                            unsigned JTI) {
   const MCExpr *Value = MCSymbolRefExpr::create(MBB->getSymbol(), OutContext);
   auto AFI = MF->getInfo<AArch64FunctionInfo>();
   unsigned Size = AFI->getJumpTableEntrySize(JTI);
 
-  if (Size == 4) {
+  if (Size == 4 && getSubtargetInfo().getTargetTriple().isOSBinFormatMachO()) {
+    // .word LBB - _func
+    const MCExpr *Base =
+        MCSymbolRefExpr::create(getSymbol(&MF->getFunction()), OutContext);
+    Value = MCBinaryExpr::createSub(Value, Base, OutContext);
+  } else if (Size == 4) {
     // .word LBB - LJTI
-    bool UseLinkerPrivateJT =
-        getSubtargetInfo().getTargetTriple().isOSBinFormatMachO();
-    const MCExpr *Base = MCSymbolRefExpr::create(
-        MF->getJTISymbol(JTI, OutContext, UseLinkerPrivateJT), OutContext);
+    const MCExpr *Base =
+        MCSymbolRefExpr::create(MF->getJTISymbol(JTI, OutContext), OutContext);
     Value = MCBinaryExpr::createSub(Value, Base, OutContext);
   } else {
     // .byte (LBB - LBB) >> 2 (or .hword)
     const MCSymbol *BaseSym = AFI->getJumpTableEntryPCRelSymbol(JTI);
     const MCExpr *Base = MCSymbolRefExpr::create(BaseSym, OutContext);
     Value = MCBinaryExpr::createSub(Value, Base, OutContext);
     Value = MCBinaryExpr::createLShr(
         Value, MCConstantExpr::create(2, OutContext), OutContext);
case AArch64::TLSDESC_CALLSEQ: {
     EmitToStreamer(*OutStreamer, Blr);
 
     return;
   }
 
   case AArch64::JumpTableDest32: {
     // We want:
     //     ldrsw xScratch, [xTable, xEntry, lsl #2]
-    //     add xDest, xTable, xScratch
+    //     add xDest, xBase, xScratch
     unsigned DestReg = MI->getOperand(0).getReg(),
              ScratchReg = MI->getOperand(1).getReg(),
-             TableReg = MI->getOperand(2).getReg(),
-             EntryReg = MI->getOperand(3).getReg();
+             BaseReg = MI->getOperand(2).getReg(),
+             TableReg = MI->getOperand(3).getReg(),
+             EntryReg = MI->getOperand(4).getReg();
     EmitToStreamer(*OutStreamer, MCInstBuilder(AArch64::LDRSWroX)
                                      .addReg(ScratchReg)
                                      .addReg(TableReg)
                                      .addReg(EntryReg)
                                      .addImm(0)
                                      .addImm(1));
     EmitToStreamer(*OutStreamer, MCInstBuilder(AArch64::ADDXrs)
                                      .addReg(DestReg)
-                                     .addReg(TableReg)
+                                     .addReg(BaseReg)
                                      .addReg(ScratchReg)
                                      .addImm(0));
     return;
   }
   case AArch64::JumpTableDest16:
   case AArch64::JumpTableDest8:
     LowerJumpTableDestSmall(*OutStreamer, *MI);
     return;

llvm/lib/Target/AArch64/AArch64CompressJumpTables.cpp

void AArch64CompressJumpTables::scanFunction() {
   }
 }
 
 bool AArch64CompressJumpTables::compressJumpTable(MachineInstr &MI,
                                                   int Offset) {
   if (MI.getOpcode() != AArch64::JumpTableDest32)
     return false;
 
-  int JTIdx = MI.getOperand(4).getIndex();
+  int JTIdx = MI.getOperand(5).getIndex();
   auto &JTInfo = *MF->getJumpTableInfo();
   const MachineJumpTableEntry &JT = JTInfo.getJumpTables()[JTIdx];
 
   // The jump-table might have been optimized away.
   if (JT.MBBs.empty())
     return false;
 
   int MaxOffset = std::numeric_limits<int>::min(),
if (!isInt<21>(MinOffset - Offset)) {
     return false;
   }
 
   int Span = MaxOffset - MinOffset;
   auto AFI = MF->getInfo<AArch64FunctionInfo>();
   if (isUInt<8>(Span / 4)) {
     AFI->setJumpTableEntryInfo(JTIdx, 1, MinBlock->getSymbol());
     MI.setDesc(TII->get(AArch64::JumpTableDest8));
+    MI.RemoveOperand(2);
     ++NumJT8;
     return true;
   } else if (isUInt<16>(Span / 4)) {
     AFI->setJumpTableEntryInfo(JTIdx, 2, MinBlock->getSymbol());
     MI.setDesc(TII->get(AArch64::JumpTableDest16));
+    MI.RemoveOperand(2);
     ++NumJT16;
     return true;
   }
 
   ++NumJT32;
   return false;
 }
 

llvm/lib/Target/AArch64/AArch64ExpandHardenedPseudos.cpp

if (MI.getOpcode() == AArch64::BR_JumpTable) {
 
     // Emit:
     //     adrp xTable, Ltable@PAGE
     //     add xTable, Ltable@PAGEOFF
     //     mov xEntry, #<size of table> ; depending on table size, with MOVKs
     //     cmp xEntry, #<size of table> ; if table size fits in 12-bit immediate
     //     csel xEntry, xEntry, xzr, ls
     //     ldrsw xScratch, [xTable, xEntry, lsl #2] ; kill xEntry, xScratch = xEntry
+    //     adrp xBase, _func@PAGE
+    //     add xBase, xBase, _func@PAGEOFF
     //     add xDest, xTable, xScratch ; kill xTable, xDest = xTable
     //     br xDest
 
     MachineOperand JTOp = MI.getOperand(0);
 
     unsigned JTI = JTOp.getIndex();
     const uint64_t NumTableEntries = JTs[JTI].MBBs.size();
 
BuildMI(MBB, MBBI, DL, TII->get(AArch64::ADDXri), AArch64::X17)
       .add(JTLoOp)
       .addImm(0);
 
     BuildMI(MBB, MBBI, DL, TII->get(AArch64::LDRSWroX), AArch64::X16)
       .addReg(AArch64::X17)
       .addReg(AArch64::X16)
       .addImm(0)
       .addImm(1);
+
+    if (STI.isTargetMachO()) {
+      // Table contains "LBB - _func" because it has to be resolved at
+      // compile-time in case function overflows available 24-bit addend.
+      Function *F = &MF.getFunction();
+      BuildMI(MBB, MBBI, DL, TII->get(AArch64::ADRP), AArch64::X17)
+          .addGlobalAddress(F, 0, AArch64II::MO_PAGE);
+      BuildMI(MBB, MBBI, DL, TII->get(AArch64::ADDXri), AArch64::X17)
+          .addUse(AArch64::X17)
+          .addGlobalAddress(F, 0, AArch64II::MO_PAGEOFF | AArch64II::MO_NC)
+          .addImm(0);
+    }
+
     BuildMI(MBB, MBBI, DL, TII->get(AArch64::ADDXrs), AArch64::X16)
       .addReg(AArch64::X17)
       .addReg(AArch64::X16)
       .addImm(0);
 
     BuildMI(MBB, MBBI, DL, TII->get(AArch64::BR))
       .addReg(AArch64::X16);
 

llvm/lib/Target/AArch64/AArch64ISelLowering.cpp

SDValue AArch64TargetLowering::LowerBR_JT(SDValue Op,
   // is necessary here. Just get the address of the jump table.
   SDLoc DL(Op);
   SDValue JT = Op.getOperand(1);
   SDValue Entry = Op.getOperand(2);
   int JTI = cast<JumpTableSDNode>(JT.getNode())->getIndex();
 
   // With aarch64-hardened-codegen, we only expand the full jump table dispatch
   // sequence later, to guarantee the integrity of the intermediate values.
-  if (DAG.getMachineFunction().getFunction()
-        .hasFnAttribute("jump-table-hardening") ||
+  Function &F = DAG.getMachineFunction().getFunction();
+  if (F.hasFnAttribute("jump-table-hardening") ||
       Subtarget->getTargetTriple().getArchName() == "arm64e") {
     assert(Subtarget->isTargetMachO() &&
            "hardened jump-table not yet supported on non-macho");
     SDValue Chain = DAG.getCopyToReg(DAG.getEntryNode(), DL, AArch64::X16,
                                      Entry, SDValue());
     SDNode *B = DAG.getMachineNode(AArch64::BR_JumpTable, DL, MVT::Other,
                                    DAG.getTargetJumpTable(JTI, MVT::i32),
                                    Chain.getValue(0), Chain.getValue(1));
     return SDValue(B, 0);
   }
 
-  SDNode *Dest =
-      DAG.getMachineNode(AArch64::JumpTableDest32, DL, MVT::i64, MVT::i64, JT,
-                         Entry, DAG.getTargetJumpTable(JTI, MVT::i32));
+  // It's more efficient to use the jump-table itself as the base for any
+  // offsets stored, MachO relocations are limited to 24-bit addends so there we
+  // unfortunately need to resolve all differences at compile-time in case the
+  // function is large.
+  SDValue Base =
+      Subtarget->isTargetMachO() ? DAG.getGlobalAddress(&F, DL, MVT::i64) : JT;
+
+  SDNode *Dest = DAG.getMachineNode(
+      AArch64::JumpTableDest32, DL, MVT::i64, MVT::i64,
+      {Base, JT, Entry, DAG.getTargetJumpTable(JTI, MVT::i32)});
   return DAG.getNode(ISD::BRIND, DL, MVT::Other, Op.getOperand(0),
                      SDValue(Dest, 0));
 }
 
 SDValue AArch64TargetLowering::LowerBRIND(SDValue Op,
                                           SelectionDAG &DAG) const {
   // On arm64e, BRIND is only used for indirectbr.  Jump table branches are
   // independently lowered to BRAA.

llvm/lib/Target/AArch64/AArch64InstrInfo.cpp

case AArch64::AUTPAC:
     break;
   case AArch64::LOADgotPAC:
   case AArch64::MOVaddrPAC:
     // 12 fixed + 16 variable, for pointer offset, and discriminator
     // We could potentially model the variable size overhead more accurately.
     NumBytes = 28;
     break;
   case AArch64::BR_JumpTable:
-    // 28 fixed + 16 variable, for table size materialization
+    // 28 fixed + 24 variable, for table size materialization
     // We could potentially model the variable size overhead more accurately.
-    NumBytes = 44;
+    NumBytes = 52;
     break;
   case AArch64::JumpTableDest32:
   case AArch64::JumpTableDest16:
   case AArch64::JumpTableDest8:
     NumBytes = 12;
     break;
   case AArch64::SPACE:
     NumBytes = MI.getOperand(1).getImm();

llvm/lib/Target/AArch64/AArch64InstrInfo.td

 def : Pat<(AArch64LOADgot tconstpool:$addr),
           (LOADgot tconstpool:$addr)>;
 
 // 32-bit jump table destination is actually only 2 instructions since we can
 // use the table itself as a PC-relative base. But optimization occurs after
 // branch relaxation so be pessimistic.
 let Size = 12, Constraints = "@earlyclobber $dst,@earlyclobber $scratch" in {
 def JumpTableDest32 : Pseudo<(outs GPR64:$dst, GPR64sp:$scratch),
-                             (ins GPR64:$table, GPR64:$entry, i32imm:$jti), []>,
+                             (ins GPR64:$base, GPR64:$table, GPR64:$entry, i32imm:$jti), []>,
                       Sched<[]>;
 def JumpTableDest16 : Pseudo<(outs GPR64:$dst, GPR64sp:$scratch),
                              (ins GPR64:$table, GPR64:$entry, i32imm:$jti), []>,
                       Sched<[]>;
 def JumpTableDest8 : Pseudo<(outs GPR64:$dst, GPR64sp:$scratch),
                             (ins GPR64:$table, GPR64:$entry, i32imm:$jti), []>,
                      Sched<[]>;
 }

llvm/lib/Target/AArch64/GISel/AArch64InstructionSelector.cpp

if (MF.getFunction().hasFnAttribute("jump-table-hardening") ||
     MIB.buildInstr(AArch64::BR_JumpTable)
         .addJumpTableIndex(I.getOperand(1).getIndex());
     I.eraseFromParent();
     return true;
   }
 
   Register TargetReg = MRI.createVirtualRegister(&AArch64::GPR64RegClass);
   Register ScratchReg = MRI.createVirtualRegister(&AArch64::GPR64spRegClass);
-  auto JumpTableInst = MIB.buildInstr(AArch64::JumpTableDest32,
-                                      {TargetReg, ScratchReg}, {JTAddr, Index})
-                           .addJumpTableIndex(JTI);
+  Register Base;
+  if (STI.isTargetMachO()) {
+    Function *F = &MF.getFunction();
+    Base = MRI.createVirtualRegister(&AArch64::GPR64RegClass);
+    MIB.buildInstr(AArch64::MOVaddr)
+        .addDef(Base)
+        .addGlobalAddress(F, 0, AArch64II::MO_PAGE)
+        .addGlobalAddress(F, 0, AArch64II::MO_PAGEOFF | AArch64II::MO_NC);
+  } else
+    Base = JTAddr;
+  auto JumpTableInst =
+      MIB.buildInstr(AArch64::JumpTableDest32, {TargetReg, ScratchReg},
+                     {Base, JTAddr, Index})
   // Build the indirect branch.
   MIB.buildInstr(AArch64::BR, {}, {TargetReg});
   I.eraseFromParent();
   return constrainSelectedInstRegOperands(*JumpTableInst, TII, TRI, RBI);
 }
 
 bool AArch64InstructionSelector::selectJumpTable(
     MachineInstr &I, MachineRegisterInfo &MRI) const {

llvm/test/CodeGen/AArch64/GlobalISel/arm64e-jump-table-hardening.ll

 ; RUN: llc -verify-machineinstrs -o - %s -mtriple=arm64-apple-ios -global-isel -global-isel-abort=1 -aarch64-enable-atomic-cfg-tidy=0 | FileCheck %s
 
 ; x16 and x17 are hard-coded into the pseudo-instruction because they have
 ; better security guarantees.
 
 ; CHECK-LABEL: test_jumptable:
 ; CHECK: ubfx  x16, x0, #0, #32
 ; CHECK: cmp   x16, #5
 ; CHECK: csel  x16, x16, xzr, ls
 ; CHECK: adrp  x17, lJTI0_0@PAGE
 ; CHECK: add   x17, x17, lJTI0_0@PAGEOFF
 ; CHECK: ldrsw x16, [x17, x16, lsl #2]
+; CHECK: adrp  x17, _test_jumptable@PAGE
+; CHECK: add   x17, x17, _test_jumptable@PAGEOFF
 ; CHECK: add   x16, x17, x16
 ; CHECK: br    x16
 
 define i32 @test_jumptable(i32 %in) "jump-table-hardening" {
 
   switch i32 %in, label %def [
     i32 0, label %lbl1
     i32 1, label %lbl2
lbl4:
   ret i32 8
 
 lbl5:
   ret i32 10
 
 }
 
 ; CHECK: lJTI0_0:
-; CHECK-NEXT: .long LBB{{[0-9_]+}}-lJTI0_0
-; CHECK-NEXT: .long LBB{{[0-9_]+}}-lJTI0_0
-; CHECK-NEXT: .long LBB{{[0-9_]+}}-lJTI0_0
-; CHECK-NEXT: .long LBB{{[0-9_]+}}-lJTI0_0
-; CHECK-NEXT: .long LBB{{[0-9_]+}}-lJTI0_0
-; CHECK-NEXT: .long LBB{{[0-9_]+}}-lJTI0_0
+; CHECK-NEXT: .long LBB{{[0-9_]+}}-_test_jumptable
+; CHECK-NEXT: .long LBB{{[0-9_]+}}-_test_jumptable
+; CHECK-NEXT: .long LBB{{[0-9_]+}}-_test_jumptable
+; CHECK-NEXT: .long LBB{{[0-9_]+}}-_test_jumptable
+; CHECK-NEXT: .long LBB{{[0-9_]+}}-_test_jumptable
+; CHECK-NEXT: .long LBB{{[0-9_]+}}-_test_jumptable

llvm/test/CodeGen/AArch64/GlobalISel/select-jump-table-brjt-constrain.mir

body:             |
   ; CHECK:   [[DEF:%[0-9]+]]:gpr64common = IMPLICIT_DEF
   ; CHECK:   [[LDRBBui:%[0-9]+]]:gpr32 = LDRBBui [[DEF]], 0 :: (load 1)
   ; CHECK:   [[SUBREG_TO_REG:%[0-9]+]]:gpr64common = SUBREG_TO_REG 0, [[LDRBBui]], %subreg.sub_32
   ; CHECK:   $xzr = SUBSXri [[SUBREG_TO_REG]], 8, 0, implicit-def $nzcv
   ; CHECK:   Bcc 8, %bb.3, implicit $nzcv
   ; CHECK: bb.1:
   ; CHECK:   successors: %bb.2(0x40000000), %bb.3(0x40000000)
   ; CHECK:   [[MOVaddrJT:%[0-9]+]]:gpr64 = MOVaddrJT target-flags(aarch64-page) %jump-table.0, target-flags(aarch64-pageoff, aarch64-nc) %jump-table.0
-  ; CHECK:   early-clobber %6:gpr64, early-clobber %7:gpr64sp = JumpTableDest32 [[MOVaddrJT]], [[SUBREG_TO_REG]], %jump-table.0
+  ; CHECK:   early-clobber %6:gpr64, early-clobber %7:gpr64sp = JumpTableDest32 [[MOVaddrJT]], [[MOVaddrJT]], [[SUBREG_TO_REG]], %jump-table.0
   ; CHECK:   BR %6
   ; CHECK: bb.2:
   ; CHECK:   successors: %bb.3(0x80000000)
   ; CHECK:   B %bb.3
   ; CHECK: bb.3:
   ; CHECK:   RET_ReallyLR
   bb.1:
     %1:gpr(p0) = G_IMPLICIT_DEF

llvm/test/CodeGen/AArch64/GlobalISel/select-jump-table-brjt.mir

body:             |
   ; CHECK:   [[SUBSWri:%[0-9]+]]:gpr32 = SUBSWri [[COPY]], 4, 0, implicit-def $nzcv
   ; CHECK:   [[SUBREG_TO_REG:%[0-9]+]]:gpr64common = SUBREG_TO_REG 0, [[SUBSWri]], %subreg.sub_32
   ; CHECK:   $xzr = SUBSXri [[SUBREG_TO_REG]], 71, 0, implicit-def $nzcv
   ; CHECK:   Bcc 8, %bb.4, implicit $nzcv
   ; CHECK: bb.1.entry:
   ; CHECK:   successors: %bb.3(0x2aaaaaab), %bb.4(0x2aaaaaab), %bb.2(0x2aaaaaab)
   ; CHECK:   [[COPY2:%[0-9]+]]:gpr32 = COPY $wzr
   ; CHECK:   [[MOVaddrJT:%[0-9]+]]:gpr64 = MOVaddrJT target-flags(aarch64-page) %jump-table.0, target-flags(aarch64-pageoff, aarch64-nc) %jump-table.0
-  ; CHECK:   early-clobber %18:gpr64, early-clobber %19:gpr64sp = JumpTableDest32 [[MOVaddrJT]], [[SUBREG_TO_REG]], %jump-table.0
+  ; CHECK:   early-clobber %18:gpr64, early-clobber %19:gpr64sp = JumpTableDest32 [[MOVaddrJT]], [[MOVaddrJT]], [[SUBREG_TO_REG]], %jump-table.0
   ; CHECK:   BR %18
   ; CHECK: bb.2.sw.bb:
   ; CHECK:   successors: %bb.4(0x80000000)
   ; CHECK:   [[ADDWri:%[0-9]+]]:gpr32sp = nsw ADDWri [[COPY]], 42, 0
   ; CHECK:   B %bb.4
   ; CHECK: bb.3.sw.bb1:
   ; CHECK:   successors: %bb.4(0x80000000)
   ; CHECK:   [[MOVi32imm:%[0-9]+]]:gpr32 = MOVi32imm 3

llvm/test/CodeGen/AArch64/arm64e-jump-table-hardening.ll

 ; RUN: llc -verify-machineinstrs -o - %s -mtriple=arm64-apple-ios -aarch64-enable-atomic-cfg-tidy=0 | FileCheck %s
 ; RUN: llc -verify-machineinstrs -o - %s -mtriple=arm64-apple-ios -code-model=large -aarch64-enable-atomic-cfg-tidy=0 | FileCheck %s
 
 ; CHECK-LABEL: test_jumptable:
 ; CHECK: mov   w[[INDEX:[0-9]+]], w0
 ; CHECK: cmp   x[[INDEX]], #5
 ; CHECK: csel  [[INDEX2:x[0-9]+]], x[[INDEX]], xzr, ls
 ; CHECK: adrp  [[JTPAGE:x[0-9]+]], lJTI0_0@PAGE
 ; CHECK: add   x[[JT:[0-9]+]], [[JTPAGE]], lJTI0_0@PAGEOFF
 ; CHECK: ldrsw [[OFFSET:x[0-9]+]], [x[[JT]], [[INDEX2]], lsl #2]
-; CHECK: add   [[DEST:x[0-9]+]], x[[JT]], [[OFFSET]]
+; CHECK: adrp  [[BASE:x[0-9]+]], _test_jumptable@PAGE
+; CHECK: add   [[BASE]], [[BASE]], _test_jumptable@PAGEOFF
+; CHECK: add   [[DEST:x[0-9]+]], [[BASE]], [[OFFSET]]
 ; CHECK: br    [[DEST]]
 
 define i32 @test_jumptable(i32 %in) "jump-table-hardening" {
 
   switch i32 %in, label %def [
     i32 0, label %lbl1
     i32 1, label %lbl2
     i32 2, label %lbl3
lbl4:
   ret i32 8
 
 lbl5:
   ret i32 10
 
 }
 
 ; CHECK: lJTI0_0:
-; CHECK-NEXT: .long LBB{{[0-9_]+}}-lJTI0_0
-; CHECK-NEXT: .long LBB{{[0-9_]+}}-lJTI0_0
-; CHECK-NEXT: .long LBB{{[0-9_]+}}-lJTI0_0
-; CHECK-NEXT: .long LBB{{[0-9_]+}}-lJTI0_0
-; CHECK-NEXT: .long LBB{{[0-9_]+}}-lJTI0_0
-; CHECK-NEXT: .long LBB{{[0-9_]+}}-lJTI0_0
+; CHECK-NEXT: .long LBB{{[0-9_]+}}-_test_jumptable
+; CHECK-NEXT: .long LBB{{[0-9_]+}}-_test_jumptable
+; CHECK-NEXT: .long LBB{{[0-9_]+}}-_test_jumptable
+; CHECK-NEXT: .long LBB{{[0-9_]+}}-_test_jumptable
+; CHECK-NEXT: .long LBB{{[0-9_]+}}-_test_jumptable
+; CHECK-NEXT: .long LBB{{[0-9_]+}}-_test_jumptable

llvm/test/CodeGen/AArch64/jti-correct-datatype.mir

body:             |
   
   bb.1:
     successors: %bb.2(0x20000000), %bb.3(0x20000000), %bb.4(0x20000000), %bb.5(0x20000000)
     liveins: $w0, $x1, $x2, $x3, $x4
   
     $x8 = ADRP target-flags(aarch64-page) %jump-table.0
     renamable $w9 = ORRWrs $wzr, killed renamable $w0, 0, implicit-def $x9
     renamable $x8 = ADDXri killed $x8, target-flags(aarch64-pageoff, aarch64-nc) %jump-table.0, 0
-    early-clobber renamable $x10, dead early-clobber renamable $x11 = JumpTableDest32 killed renamable $x8, killed renamable $x9, %jump-table.0
+    early-clobber renamable $x10, dead early-clobber renamable $x11 = JumpTableDest32 killed renamable $x8, killed renamable $x8, killed renamable $x9, %jump-table.0
     BR killed renamable $x10
   
   bb.2 (align 65536):
     successors: %bb.3(0x50000000), %bb.6(0x30000000)
     liveins: $x1, $x2, $x3, $x4
   
     renamable $x8 = ADRP target-flags(aarch64-page) @reps
     renamable $w9 = LDRWui renamable $x8, target-flags(aarch64-pageoff, aarch64-nc) @reps :: (volatile dereferenceable load 4 from @reps, !tbaa !2)

llvm/test/CodeGen/AArch64/jump-table-compress.mir

body:             |
   bb.0 (%ir-block.0):
     liveins: $x8
 
   bb.1 (%ir-block.0):
     ; CHECK-LABEL: body:
     ; CHECK-LABEL: bb.1
     ; CHECK: JumpTableDest8
     liveins: $x8
-    early-clobber $x10, dead early-clobber $x11 = JumpTableDest32 undef killed $x9, undef killed $x8, %jump-table.0
+    early-clobber $x10, dead early-clobber $x11 = JumpTableDest32 undef killed $x10, undef killed $x9, undef killed $x8, %jump-table.0
     BR killed $x10
 
   bb.2:
     ; Last destination is 4 * 255 = 1020 bytes after first. Byte is OK.
     dead $xzr = SPACE 1020, undef $xzr
 
   bb.3:
     ; CHECK-LABEL: bb.3
     ; CHECK: JumpTableDest16
-    early-clobber $x10, dead early-clobber $x11 = JumpTableDest32 undef killed $x9, undef killed $x8, %jump-table.1
+    early-clobber $x10, dead early-clobber $x11 = JumpTableDest32 undef killed $x10, undef killed $x9, undef killed $x8, %jump-table.1
     BR killed $x10
 
   bb.4:
     ; Last destination is 4 * 256 = 1024 bytes after first. Half needed.
     dead $xzr = SPACE 1024, undef $xzr
 
   bb.5:
     ; CHECK-LABEL: bb.5
     ; CHECK: JumpTableDest8
-    early-clobber $x10, dead early-clobber $x11 = JumpTableDest32 undef killed $x9, undef killed $x8, %jump-table.2
+    early-clobber $x10, dead early-clobber $x11 = JumpTableDest32 undef killed $x10, undef killed $x9, undef killed $x8, %jump-table.2
     BR killed $x10
 
   bb.6:
     ; First destination is (2^20 - 4) after reference. Just reachable by ADR so can use compressed table.
     dead $xzr = SPACE 1048556, undef $xzr
 
   bb.7:
     ; CHECK-LABEL: bb.7
     ; CHECK: JumpTableDest32
-    early-clobber $x10, dead early-clobber $x11 = JumpTableDest32 undef killed $x9, undef killed $x8, %jump-table.3
+    early-clobber $x10, dead early-clobber $x11 = JumpTableDest32 undef killed $x10, undef killed $x9, undef killed $x8, %jump-table.3
     BR killed $x10
 
   bb.8:
     ; First destination is 2^20 after reference. Compressed table cannot reach it.
     dead $xzr = SPACE 1048560, undef $xzr
 
   bb.9:
     ; First destination is 2^20 before reference. Just within reach of ADR.
     dead $xzr = SPACE 1048576, undef $xzr
 
   bb.10:
     ; CHECK-LABEL: bb.10
     ; CHECK: JumpTableDest8
-    early-clobber $x10, dead early-clobber $x11 = JumpTableDest32 undef killed $x9, undef killed $x8, %jump-table.4
+    early-clobber $x10, dead early-clobber $x11 = JumpTableDest32 undef killed $x10, undef killed $x9, undef killed $x8, %jump-table.4
     BR killed $x10
 
   bb.11:
     ; First destination is 2^20 before reference. Just within reach of ADR.
     dead $xzr = SPACE 1048580, undef $xzr
 
   bb.12:
     ; CHECK-LABEL: bb.12
     ; CHECK: JumpTableDest32
-    early-clobber $x10, dead early-clobber $x11 = JumpTableDest32 undef killed $x9, undef killed $x8, %jump-table.5
+    early-clobber $x10, dead early-clobber $x11 = JumpTableDest32 undef killed $x10, undef killed $x9, undef killed $x8, %jump-table.5
     BR killed $x10
 ...

llvm/test/CodeGen/AArch64/jump-table.ll

define i32 @test_jumptable32(i32 %in) {
 
   switch i32 %in, label %def [
     i32 0, label %lbl1
     i32 1, label %lbl2
     i32 2, label %lbl3
     i32 4, label %lbl4
   ]
 ; CHECK-IOS-LABEL: test_jumptable32:
-; CHECK-IOS:     adrp [[JTPAGE:x[0-9]+]], [[LJTI:lJTI[0-9]+_[0-9]+]]@PAGE
-; CHECK-IOS:     add x[[JT:[0-9]+]], [[JTPAGE]], [[LJTI]]@PAGEOFF
+; CHECK-IOS-DAG:     adrp [[JTPAGE:x[0-9]+]], [[LJTI:lJTI[0-9]+_[0-9]+]]@PAGE
+; CHECK-IOS-DAG:     add x[[JT:[0-9]+]], [[JTPAGE]], [[LJTI]]@PAGEOFF
+; CHECK-IOS-DAG:     adrp [[BASEPAGE:x[0-9]+]], _test_jumptable32@PAGE
+; CHECK-IOS-DAG:     add [[BASE:x[0-9]+]], [[BASEPAGE]], _test_jumptable32@PAGEOFF
 ; CHECK-IOS:     ldrsw [[OFFSET:x[0-9]+]], [x[[JT]], {{x[0-9]+}}, lsl #2]
-; CHECK-IOS:     add [[DEST:x[0-9]+]], x[[JT]], [[OFFSET]]
+; CHECK-IOS:     add [[DEST:x[0-9]+]], [[BASE]], [[OFFSET]]
 ; CHECK-IOS:     br [[DEST]]
 
 ; CHECK: .rodata
 ; CHECK: .LJTI2_0:
 ; CHECK-NEXT: .word .LBB{{.*}}-.LJTI2_0
 
 ; CHECK-IOS-NOT .section __TEXT,__const
 ; CHECK-IOS: [[LJTI]]:
-; CHECK-IOS: .long {{LBB[0-9]+_[0-9]+}}-[[LJTI]]
+; CHECK-IOS: .long {{LBB[0-9]+_[0-9]+}}-_test_jumptable32
 
 def:
   ret i32 0
 
 lbl1:
   ret i32 1
 
 lbl2: