@Test
	public void testArmThumbFunc() throws Exception {
		AssemblyBuffer asm = createBuffer(ID_ARMv8LE, 0x00400000);

		Language language = asm.getAssembler().getLanguage();
		Register regCtx = language.getContextBaseRegister();
		Register regT = language.getRegister("T");
		RegisterValue rvDefault = new RegisterValue(regCtx,
			asm.getAssembler().getContextAt(asm.getNext()).toBigInteger(regCtx.getNumBytes()));
		RegisterValue rvArm = rvDefault.assign(regT, BigInteger.ZERO);
		RegisterValue rvThumb = rvDefault.assign(regT, BigInteger.ONE);

		AssemblyPatternBlock ctxThumb = AssemblyPatternBlock.fromRegisterValue(rvThumb);

		asm.assemble("mov r1, #456");
		Address addrBlx = asm.getNext();
		asm.assemble("blx 0x0");
		Address addrRet = asm.getNext(); // The address where we expect to return
		asm.assemble("bx lr"); // Follows CALL, so principally, must be here, but not decoded
		Address addrThumb = asm.getNext();
		asm.assemble("add r0, r1", ctxThumb);
		asm.assemble("bx lr", ctxThumb);

		asm.assemble(addrBlx, "blx 0x%s".formatted(addrThumb));

		Translation tr = translateBuffer(asm, asm.getEntry(), Map.of());

		assertEquals(Map.ofEntries(
			tr.entryPrototype(asm.getEntry(), rvArm, 0),
			tr.entryPrototype(addrThumb, rvThumb, 1)),
			tr.passageCls.getBlockEntries());

		/**
		 * The blx will be a direct branch, so that will get executed in the bytecode. However, the
		 * bx lr (from THUMB) will be an indirect jump, causing a passage exit, so we should expect
		 * the return value to be the address immediately after the blx. Of course, that's not all
		 * that convincing.... So, we'll assert that r0 was set, too.
		 */
		assertEquals(addrRet.getOffset(), tr.runClean());
		assertEquals(456, tr.getLongRegVal("r0"));
	}
The size swap is not necessary, but test anyway.
Ghidra/Test/IntegrationTest/src/test.slow/java/ghidra/pcode/emu/jit/gen/JitCodeGeneratorTest.java