diff --git a/src/llvm-project b/src/llvm-project
index ed6566573eb21..9b1bf4cf041c1 160000
--- a/src/llvm-project
+++ b/src/llvm-project
@@ -1 +1 @@
-Subproject commit ed6566573eb21b00a3f87815e14ff766fd56ef42
+Subproject commit 9b1bf4cf041c1c1fe62cf03891ac90431615e780
diff --git a/tests/ui/darwin-ld64.rs b/tests/ui/darwin-ld64.rs
new file mode 100644
index 0000000000000..75acc07a002c4
--- /dev/null
+++ b/tests/ui/darwin-ld64.rs
@@ -0,0 +1,24 @@
+//@ compile-flags: -Copt-level=3 -Ccodegen-units=256 -Clink-arg=-ld_classic
+//@ run-pass
+//@ only-x86_64-apple-darwin
+
+// This is a regression test for https://github.com/rust-lang/rust/issues/140686.
+// Although this is a ld64(ld-classic) bug, we still need to support it
+// due to cross-compilation and support for older Xcode.
+
+fn main() {
+    let dst: Vec<u8> = Vec::new();
+    let len = broken_func(std::hint::black_box(2), dst);
+    assert_eq!(len, 8);
+}
+
+#[inline(never)]
+pub fn broken_func(version: usize, mut dst: Vec<u8>) -> usize {
+    match version {
+        1 => dst.extend_from_slice(b"aaaaaaaa"),
+        2 => dst.extend_from_slice(b"bbbbbbbb"),
+        3 => dst.extend_from_slice(b"bbbbbbbb"),
+        _ => panic!(),
+    }
+    dst.len()
+}