ld.bfd (both in ARM and Thumb code), and ld.gold (in Thumb code) are able to choose between bl and blx depending on the target address.
But in ARM code, ld.gold is only able to transform bl into blx, and not the opposite.

echo "void fn(void) {}" | arm-linux-gnueabihf-gcc -marm -c -o called.o -xc -
echo "\t.arm\ncaller:\n\tblx fn" | arm-linux-gnueabihf-as -o caller.o
arm-linux-ld.gold -o gold.out caller.o called.o
arm-linux-ld.bfd -o bfd.out caller.o called.o

arm-linux-gnueabihf-objdump -d gold.out
...
00008094 <caller>:
    8094:       faffffff        blx     8098 <fn>
...

arm-linux-gnueabihf-objdump -d bfd.out
...
00010074 <caller>:
   10074:       ebffffff        bl      10078 <fn>
...


It makes WebKit crash when compiling in ARM mode and linking with gold, due to https://github.com/WebKit/webkit/blob/master/Source/JavaScriptCore/offlineasm/arm.rb#L570.