<table border="1" cellspacing="0" cellpadding="8">
    <tr>
        <th>Issue</th>
        <td>
            <a href=https://github.com/llvm/llvm-project/issues/65090>65090</a>
        </td>
    </tr>

    <tr>
        <th>Summary</th>
        <td>
            Incorrect branch targets in RISC-V executables built with LTO
        </td>
    </tr>

    <tr>
      <th>Labels</th>
      <td>
            backend:RISC-V,
            llvm:codegen,
            LTO
      </td>
    </tr>

    <tr>
      <th>Assignees</th>
      <td>
      </td>
    </tr>

    <tr>
      <th>Reporter</th>
      <td>
          ilovepi
      </td>
    </tr>
</table>

<pre>
    We're seeing several cases where branch targets are invalid, for example in the middle of another instruction, when building Fuchsia's zircon kernel with `flto=full`. This only seems to occur under `-flto-full`, and both non-LTO and ThinLTO do not seem to have this issue.

Most branches appear to be correct, or at least have valid targets, but in some cases the target isn't the location of a valid instruction. This sounds like it could be related to linker relaxation, but https://discourse.llvm.org/t/riscv-status-of-lto-for-risc-v/58518 isn't clear on the current status of LTO for RISC-V, so it may be related.

I'm working on getting something smaller than our kernel image as a reproducer, but in the meantime I'm providing a snippet from a relevant case. The target for the `bne` instruction is in the middle of another instruction sequence
```
  1b2ac8:       1d051363                bne     a0,a6,1b2c8e <VmCowPages::AddNewPageLocked(unsigned long, vm_page*, VmCowPages::CanOverwriteContent, VmPageOrMarker*, bool, bool)+0x1ea>
...
  1b2c80:       0d000593                li      a1,208
 1b2c84:        000ac097                auipc   ra,0xac
  1b2c88:       8a8080e7        jalr    -1880(ra) # 25e52c <assert_fail>
fbl::Canary<1447904080u>::Assert() const:
./../../zircon/system/ulib/fbl/include/fbl/canary.h:64
 1b2c8c:        030aa783                lw      a5,48(s5)
  1b2c90:       ffea5517        auipc   a0,0xffea5
```


https://fxbug.dev/129493 has additional context.

CC: @topperc @MaskRay @asb 

</pre>
<img width="1px" height="1px" alt="" src="http://email.email.llvm.org/o/eJyMVU1v4zwO_jXKhUggy3FiH3LIpBtggM52MVvMHge0TMeayFJWktN0f_2CSppJB-_hLQpbZvjw4yFFYozm4Ig2ovoiqqcZTmnwYWOsP9PJzFrfvW_-Q0KtA0EkMu4Akc4U0ILGSBHeBgoEbUCnB0gYDpQiYCAw7ozWdELtoPcB6ILjybIY0kAwmq6zBL4HdD4NFMC4mMKkk_GOMW8DOWgnYzv2uZ_0EA0KtY7wPxO0d3Ck4MjCm0kDiJXsbfKifOona8VKLuB1MBG8s-8c9hghefBaTwEm11FgxJwh8xuAXaLroPVpAOfd_Pn1JQteB-P43HlwPmVjbGvAM0FiHybGiRZCPgm5vT6_-ZhujFAEPJ0IA2NaAu1DIJ3Ymw-ACSxhTFdrma4PClmjnRLTFf1IN7KZuasCmOiEWqcssl4j85bpvNl5oPNGRvST6yJYcyQwCbSfbMcxBbKYqOMIrXFHCllywY9KcBhDSqcoyq1Qe6H2nYnaTyHSwtrzuPDhINQ-CbUPJurzPCZMU5z7fp4J9mHO8vlZqH1VV0V9j11bZsZfO0JPIZBLcEVzKkw7t873r__ezX9wKNFz5CO-P8T9ifqvQq1HePPhyF3jHRwopdy0fqQ05NOI1lKANKADP4WPRjIjHggwAkKgU_DdpCk8lCF3LaFLZiS4-jkFfza5PxGiM6cTJeiDH7MJS2d0KReOC3AvHGfEtsRKto7ESj6WCrih_sYNgUj_nchpuiW_krf__AlQtAp1zQWTTdHJqihXJdz_hGzYtWyQ-x5XQu2KVumaQJS7H-POv_0LD5TrXW63XfdPyoJnr4_UCVVPLg-NDqx3B6boPP484YGE2vLXnxZ26F7OFN6CSbTzLpFLVzXWeQnfMByZ6Yxtvbe_341QX-SlIBTlP66pLRaLhxx1La85yk5KWTWfc7SGUyyE2ilZ31AZtLyBpEQtm_UnEE7mpIVsAgq1kxfUn9zdKK2xlrWkNQN-oQ1CNvOirqVQNeMaEKoEVVGlNFOKMVJIP3s09p5I39o7OxjeRbkrlst1I5eylhNrXcnPSKFqNqq9iykHkJkQar-4P65DUah9fI-JRqH2kzWtUHv2o_bGaTt1dP_W2eliEOV2tXykRt-oKSXiuv6DzzfmpxJqt6yFqmPFBXpgp7kVo-8Jq6pYP9KZO01e8k9_2bOPz8_Tpr-002HREc-PQjXLpoSBr2nXGb4KvIm4qS7p0yTY7US5BbGUyZ9OFDQfv2E8fsd3PmJs4ao46zZl15QNzmhTrJqyXBZlVcyGzYqo12Vf170upGrVqlw165aW6-WKuhWuZ2ajpCplrRoly6oqFh1ShX3V1Exd0dRiKWlEY-9jcpaXxWZVyUbOLLZkY168SrWoj-Q6UW4_pp0SaieUYqgot9p3dCB3Fz-_vvC5epqFDavM2-kQxVJaE1P87S-ZZGnz1d32zp972rjbcAW6kJ4StpZi3rrpulifX19mU7CbzxU5mDRM7UJ77rMc4PU1PwX_K6-3fU40CrXPuf4_AAD__wsNnWk">