jump(pop) with dataflow resolved address does not update stack

[CouleeApps]

When binja is configured to lift return instructions as jump(pop), dataflow can resolve the address of the pop but does modify the stack. Lifting returns as esp = esp + 4 ; jmp *(esp - 4) resolves correctly.

Current behavior:

Expected behavior:
After the first ret, the stack is popped and the second ret resolves to the next address pushed onto the stack, resolving an indirect jump, and continuing the chain.

Binary: asmtest.zip Arch hook for x86:

from binaryninja import *

class X86RetHook(ArchitectureHook):

    def __init__(self, base_arch):
        super(X86RetHook, self).__init__(base_arch)

    def get_instruction_info(self, data, addr):
        info = super(X86RetHook, self).get_instruction_info(data, addr)
        branches = info.branches
        # So dataflow doesn't stop at a return
        for b in branches:
            if b.type == BranchType.FunctionReturn:
                b.type = BranchType.UnresolvedBranch
        info.branches = branches
        return info

    def get_instruction_low_level_il(self, data, addr, il: LowLevelILFunction):
        is_ret = data[0] == 0xc3  # ret
        if is_ret:
            # Produces buggy behavior shown above
            il.append(il.jump(il.pop(il.arch.address_size)))

            # Produces correct dataflow
            # aas = il.arch.address_size
            # reg = "esp" if aas == 4 else "rsp"
            # il.append(il.set_reg(aas, reg,
            #                      il.add(aas,
            #                             il.reg(aas, reg),
            #                             il.const(aas, aas))))
            # il.append(il.jump(il.load(aas,
            #                           il.sub(aas,
            #                                  il.reg(aas, reg),
            #                                  il.const(aas, aas)))))
            return 1
        else:
            return super(X86RetHook, self).get_instruction_low_level_il(data, addr, il)

X86RetHook(Architecture['x86']).register()

[CouleeApps]

And for reference, here is what the alternative lifting for ret produces:

[joshwatson]

It would be cool if this were fixed, I've asked about it a few times now. Current workaround is to lift it as

temp0 = pop
jump(temp0)

[yrp604]

Branches have very similar behavior: https://github.com/Vector35/binaryninja-api/issues/1908