diff --git a/llvm/lib/Target/AArch64/AArch64SpeculationHardening.cpp b/llvm/lib/Target/AArch64/AArch64SpeculationHardening.cpp
index 85b32f9df0e1f..753f694613085 100644
--- a/llvm/lib/Target/AArch64/AArch64SpeculationHardening.cpp
+++ b/llvm/lib/Target/AArch64/AArch64SpeculationHardening.cpp
@@ -286,18 +286,20 @@ bool AArch64SpeculationHardening::instrumentControlFlow(
   bool TmpRegisterNotAvailableEverywhere = false;
 
   RegScavenger RS;
-  RS.enterBasicBlock(MBB);
+  RS.enterBasicBlockEnd(MBB);
 
-  for (MachineBasicBlock::iterator I = MBB.begin(); I != MBB.end(); I++) {
-    MachineInstr &MI = *I;
+  for (MachineBasicBlock::iterator I = MBB.end(); I != MBB.begin(); ) {
+    MachineInstr &MI = *--I;
     if (!MI.isReturn() && !MI.isCall())
       continue;
 
     // The RegScavenger represents registers available *after* the MI
     // instruction pointed to by RS.getCurrentPosition().
     // We need to have a register that is available *before* the MI is executed.
-    if (I != MBB.begin())
-      RS.forward(std::prev(I));
+    if (I == MBB.begin())
+      RS.enterBasicBlock(MBB);
+    else
+      RS.backward(std::prev(I));
     // FIXME: The below just finds *a* unused register. Maybe code could be
     // optimized more if this looks for the register that isn't used for the
     // longest time around this place, to enable more scheduling freedom. Not