[WinEH] Update CoreCLR EH state numbering

[JosephTremoulet]

Summary

Fix the CLR state numbering to generate correct tables, and update the lit
test to verify them.

The CLR numbering assigns one state number to each catchpad and
cleanuppad.

It also computes two tree-like relations over states:

1. Each state has a "HandlerParentState", which is the state of the next outer handler enclosing this state's handler (same as nearest ancestor per the ParentPad linkage on EH pads, but skipping over catchswitches).
2. Each state has a "TryParentState", which: a) for a catchpad that's not the last handler on its catchswitch, is the state of the next catchpad on that catchswitch. b) for all other pads, is the state of the pad whose try region is the next outer try region enclosing this state's try region. The "try regions are not present as such in the IR, but will be inferred based on the placement of invokes and pads which reach each other by exceptional exits.

Catchswitches do not get their own states, but each gets mapped to the
state of its first catchpad.

Table generation requires each state's "unwind dest" state to have a lower
state number than the given state.

Since HandlerParentState can be computed as a function of a pad's
ParentPad, and TryParentState can be computed as a function of its unwind
dest and the TryParentStates of its children, the CLR state numbering
algorithm first computes HandlerParentState in a top-down pass, then
computes TryParentState in a bottom-up pass.

Also reword some comments/names in the CLR EH table generation to make the
distinction between the different kinds of "parent" clear.

[JosephTremoulet]

• Update worklist seeding to include all pads that unwind to caller (or are cleanuppads with no cleanupret)

[JosephTremoulet]

• fix wineh-coreclr test to report proper outer scope for nested fault cleanuppad
• adjust getEHPadFromPredecessor and calls to it for CLR EH so it behaves correctly for nested CLR funclets

[andrew.w.kaylor]

lib/CodeGen/WinEHPrepare.cpp

492

I have to admit that I'm not familiar enough with Core CLR to know what's possible and what isn't, so maybe this isn't an issue, but it strikes me here that a nested cleanup pad that never returns will be treated like a top level cleanup pad. I'm thinking of something like this:

try {
  try {
    f()
  } catch (...) {
    try {
      g()
    } finally {
      throw() // noreturn
    }
  }
} catch (...) {
}

The throw call here would unwind to the outer catch handler, but I think CPI->getCleanupRetUnwindDest() would return null.

496

I'm probably not understanding this correctly. Can you talk me through how a case like the following would be handled?

try {
  try {
  } catch { // inner catch
  }
} catch { // outer catch
  try {
  } catch { // catch catch
  }
}

If I have everything straight, both "outer catch" and "catch catch" will have null unwind destinations. So that would make the parent state of "catch catch" -1, I think. Is that what you want?

[JosephTremoulet]

lib/CodeGen/WinEHPrepare.cpp

492

Yes, good catch, that's a case that wouldn't be handled correctly as written. We've discussed a plan, which I think we now need for cases like this and the irreducible loop, and which I am working on, to add "bundles" to calls and invokes in EH handlers indicating their handler membership (i.e. "color"), analogous to the "within" annotation that D15139 adds to the pads themselves. In that world, the IR for your example would look like:

invoke void @f()
  to label %whatever unwind label %inner_catch_switch
inner_catch_switch:
  %ics = catchswitch within none [label %inner_catch] unwind label %outer_catch_switch
inner_catch:
  %ic = catchpad within %ics [...]
  invoke void @g() ["within" token %ic]
    to label %whatever2 unwind label %finally
finally:
  %f = cleanuppad within %ic []
  invoke void @throw() ["within" token %f]
    to label %unreachable unwind label %outer_catch_switch

I'd expect this code to be updated to look through uses of the cleanuppad (%f) for not just cleanuprets but also "within" bundles on calls/invokes, and find the "unwind label %outer_catch_switch" on the invoke.

As far as staging the changes, I was thinking it makes sense to go ahead and check in this code that gets us from "completely broken" to "correct except in cleanups that have lost their cleanupret", once D15139 lands, since that will be enough to unblock downstreaming changes into LLILC while the bundle change iterates. Though I probably should at least include a FIXME here in this change.

It would of course be possible to hunt for invokes in the cleanup without the bundles making it easy, but since we seem to need the bundles for exotic-but-theoretically-possible cases where the correct color is irresolvably ambiguous, I'd rather not bother with that just to rewrite it to use the token bundles; but I would still like to checkpoint this step.

And, of course, I should be more concrete about "cases where I think we need the bundles". Here's an example (courtesy @majnemer): Suppose we started with:

...
 } finally {
    if (_) {
      left();
      __unreachable;
    } else {
      right();
      __unreachable;
    }
  }
...
left();
try {
  foo();
} catch { // catch 1
  /* stuff */
}
...
right();
try {
  bar();
} catch { // catch 2
  /* stuff */
}

which would become IR like

finally:
  %fin = cleanuppad []
  br i1 %_, label %left_unreachable, label %right_unreachable
left_unreachable:
  call void @left()
  unreachable
right_unreachable:
  call void @right()
  unreachable
...
left_bait:
  call void @left()
  invoke void @foo()
    to label %whatever unwind label %catchswitch_1
...
right_bait:
  call void @right()
  invoke void @bar()
    to label %whatever_else unwind label %catchswitch_2

then, although I'm pretty sure we don't actually have this transformation, it seems reasonable to expect to be able to rewrite that to:

finally:
  %fin = cleanuppad []
  br i1 %_, label %left_bait, label %right_bait
...
left_bait:
  call void @left()
  invoke void @foo()
    to label %whatever unwind label %catchswitch_1
...
right_bait:
  call void @right()
  invoke void @bar()
    to label %whatever_else unwind label %catchswitch_2

Then the "finally" cleanup has no cleanupret, and if you try to figure out where the cleanup's "unwind dest" is by scanning its invokes, you'll find both %catchswitch_1 and %catchswitch_2, and picking either of them would lead you to generate bad code if dynamically the other path is taken. Having the front-end tag the calls/invokes in a cleanup with the token of the cleanup they're in makes it unambiguous when you want to infer a cleanup's "unwind destination" from an invoke -- the inference is valid if and only if the invoke has a matching token.

Of course, this code would still have to deal with the case that there isn't a cleanupret and aren't any invokes either. I've convinced myself that in that case it's correct to treat the cleanup as at the topmost level inside its enclosing funclet.

496

Yes, that's what I want. The relationship I need is:

• If a catchpad is not the first on its catchswitch, then the immediately prior catchpad on its same catchswitch is its parent
• otherwise, if the try region for EH pad A is the innermost try region enclosing the try region for EH pad B, then A is the parent of B

Since the try region for "outer catch" is disjoint with the try region for "catch catch", neither is an ancestor of the other; since no try region encloses the try region for "catch catch", its parent is -1.

[JosephTremoulet]

lib/CodeGen/WinEHPrepare.cpp

496

Oops, got the first rule reversed. It's:

• If a catchpad is not the last on its catchswitch, then the immediately following catchpad on its same catchswitch is its parent
• otherwise, if the try region for EH pad A is the innermost try region enclosing the try region for EH pad B, then A is the parent of B

[JosephTremoulet]

• refactor toplevel test into isToplevelForCLR, give a fuller implementation
• rebase

[JosephTremoulet]

• expand comments in response to @AndyAyers's feedback at https://github.com/Microsoft/llvm/pull/123

[andrew.w.kaylor]

lib/CodeGen/WinEHPrepare.cpp

458

This comment makes me nervous. Besides indicating where exceptions that occur inside the catchpads unwind the unwind clause of a catchswitch also indicates where an exception will go if it is not caught by any of the handlers in the catchswitch. So in order to change this clause from some EH pad to "unwinds to caller" we'd need to know both that none of the catch pads ever throws an exception and that all exceptions that come to this catch switch are caught by one of the catch pads (and even then, it seems like a bad idea). It doesn't seem like any optimization outside of the WinEH-specific handling should be able to confirm this second condition since it depends on the personality function. Is this really happening?

472

Does the phrase "exceptions propogating out of it" include both exceptions that cause the cleanup pad to be executed but reach the cleanupret instruction and exceptions that occur within the cleanup handler? It seems from the code that follows that it does, but it wasn't entirely clear to me.

485

This doesn't seem quite right. Consider the following scenario:

cleanup:
  %cl = cleanuppad within none []
  invoke void @g()
    to label %cleanup.cont unwind label %cleanup.cs
cleanup.cs:
  %cs = catchswitch within %cl [label %cleanup.catch] unwind label %nested.cleanup
cleanup.catch:
  %cp = catchpad within %cs []
  catchret from %cp to label %cleanup.cont
nested.cleanup:
  %nc = cleanuppad within %cl []
  call void @h()
  cleanupret from %nc unwind to caller
cleanup.cont:
  cleanupret from %cl unwind to caller

This case may return either true or false, depending on whether it encounters the nested catchswitch or the outer cleanupret first in the user list.

500

Shouldn't this be "if (!UselessCleanups.count(CPI))"?

[JosephTremoulet]

lib/CodeGen/WinEHPrepare.cpp

458

The only place I'm aware of making this transformation is in SimplifyCFG's SimplifyUnreachable -- if the catchswitch (and invokes etc within the catches) unwinds to a cleanuppad that immediately its unreachable, we'll removeUnwindEdge each of those preds -- so in that case,
a) the inference is coming from the unwind destination, not analysis of the switch clauses, and
b) the same transformation will get applied to the invokes and such in the catches
which may be of some comfort.

Point well taken that preserving the agreement between unwind destinations in catches w.r.t. each other and the catchswitch in general requires careful non-local analysis.

472

Yeah, it needs to mean both, I'll try to make that more clear.

485

Yes, this was supposed to check if the catchswitch dest's parent is also the cleanup and continue to the next use if so. Good catch, thanks, I'll fix and expand the test.

500

Whoops, yes, of course. I'll maybe just remove this loop, though -- when the invokes are tagged with the cleanup, getting to this point means no exceptions escape the cleanup that aren't supposed to reach all the way up to caller, and so we can report it as top-level by the same reasoning that we use for faux-unwinds to caller catchswitches on line 454.

[andrew.w.kaylor]

lib/CodeGen/WinEHPrepare.cpp

458

OK. I got the impression from this comment that this was happening if nothing was unwinding from within the catch switch.

[JosephTremoulet]

• Rebase on top of funclet bundle changes
• Extend to handle missing cases; rework as a top-down pass and then a bottom-up pass instead of using the IsToplevel/getEHPred scheme
• Split ClrEHUnwindMapEntry's Parent field into HandlerParentState and TryParentState; update comments and naming to keep the distinction clear
• Expand lit test to cover several of the corner cases

[majnemer]

lib/CodeGen/WinEHPrepare.cpp

649–650

Is calculateStateNumbersForInvokes correct for your personality? I'm surprised it went through untouched. Specifically, the bit where we use getCleanupRetUnwindDest seems a little sketchy...

[JosephTremoulet]

lib/CodeGen/WinEHPrepare.cpp

649–650

Yes, it works out, although we're not really making use of its logic. This bit is the part that's irrelevant for CLR EH:

BasicBlock *FuncletUnwindDest;
auto *FuncletPad =
    dyn_cast<FuncletPadInst>(FuncletEntryBB->getFirstNonPHI());
assert(FuncletPad || FuncletEntryBB == &Fn->getEntryBlock());
if (!FuncletPad)
  FuncletUnwindDest = nullptr;
else if (auto *CatchPad = dyn_cast<CatchPadInst>(FuncletPad))
  FuncletUnwindDest = CatchPad->getCatchSwitch()->getUnwindDest();
else if (auto *CleanupPad = dyn_cast<CleanupPadInst>(FuncletPad))
  FuncletUnwindDest = getCleanupRetUnwindDest(CleanupPad);
else
  llvm_unreachable("unexpected funclet pad!");

BasicBlock *InvokeUnwindDest = II->getUnwindDest();
int BaseState = -1;
if (FuncletUnwindDest == InvokeUnwindDest) {
  auto BaseStateI = FuncInfo.FuncletBaseStateMap.find(FuncletPad);
  if (BaseStateI != FuncInfo.FuncletBaseStateMap.end())
    BaseState = BaseStateI->second;
}

You're right that FuncletUnwindDest will take on a meaningless value for cleanupret-less cleanups, but since we never populate FuncletBaseStateMap when targeting CLR, we never reach BaseState = BaseStateI->second, regardless of whether FuncletUnwindDest happens to match InvokeUnwindDest.

[JosephTremoulet]

rebase

[majnemer]

LGTM

include/llvm/CodeGen/WinEHFuncInfo.h

struct WinEHTryBlockMapEntry {
   SmallVector<WinEHHandlerType, 1> HandlerArray;
 };
 
 enum class ClrHandlerType { Catch, Finally, Fault, Filter };
 
 struct ClrEHUnwindMapEntry {
   MBBOrBasicBlock Handler;
   uint32_t TypeToken;
-  int Parent;
+  int HandlerParentState; ///< Outer handler enclosing this entry's handler
+  int TryParentState; ///< Outer try region enclosing this entry's try region,
+                      ///< treating later catches on same try as "outer"
   ClrHandlerType HandlerType;
 };
 
 struct WinEHFuncInfo {
   DenseMap<const Instruction *, int> EHPadStateMap;
   DenseMap<const FuncletPadInst *, int> FuncletBaseStateMap;
   DenseMap<const InvokeInst *, int> InvokeStateMap;
   DenseMap<const CatchReturnInst *, const BasicBlock *>

lib/CodeGen/AsmPrinter/WinException.cpp

for (const SEHUnwindMapEntry &UME : FuncInfo.SEHUnwindMap) {
     OS.EmitIntValue(ToState, 4);
     AddComment(UME.IsFinally ? "Null" : "FilterFunction");
     OS.EmitValue(create32bitRef(UME.Filter), 4);
     AddComment(UME.IsFinally ? "FinallyFunclet" : "ExceptionHandler");
     OS.EmitValue(create32bitRef(ExceptOrFinally), 4);
   }
 }
 
-static int getRank(const WinEHFuncInfo &FuncInfo, int State) {
+static int getTryRank(const WinEHFuncInfo &FuncInfo, int State) {
   int Rank = 0;
   while (State != -1) {
     ++Rank;
-    State = FuncInfo.ClrEHUnwindMap[State].Parent;
+    State = FuncInfo.ClrEHUnwindMap[State].TryParentState;
   }
   return Rank;
 }
 
-static int getAncestor(const WinEHFuncInfo &FuncInfo, int Left, int Right) {
-  int LeftRank = getRank(FuncInfo, Left);
-  int RightRank = getRank(FuncInfo, Right);
+static int getTryAncestor(const WinEHFuncInfo &FuncInfo, int Left, int Right) {
+  int LeftRank = getTryRank(FuncInfo, Left);
+  int RightRank = getTryRank(FuncInfo, Right);
 
   while (LeftRank < RightRank) {
-    Right = FuncInfo.ClrEHUnwindMap[Right].Parent;
+    Right = FuncInfo.ClrEHUnwindMap[Right].TryParentState;
     --RightRank;
   }
 
   while (RightRank < LeftRank) {
-    Left = FuncInfo.ClrEHUnwindMap[Left].Parent;
+    Left = FuncInfo.ClrEHUnwindMap[Left].TryParentState;
     --LeftRank;
   }
 
   while (Left != Right) {
-    Left = FuncInfo.ClrEHUnwindMap[Left].Parent;
-    Right = FuncInfo.ClrEHUnwindMap[Right].Parent;
+    Left = FuncInfo.ClrEHUnwindMap[Left].TryParentState;
+    Right = FuncInfo.ClrEHUnwindMap[Right].TryParentState;
   }
 
   return Left;
 }
 
 void WinException::emitCLRExceptionTable(const MachineFunction *MF) {
   // CLR EH "states" are really just IDs that identify handlers/funclets;
   // states, handlers, and funclets all have 1:1 mappings between them, and a
void WinException::emitCLRExceptionTable(const MachineFunction *MF) {
   int NumStates = FuncInfo.ClrEHUnwindMap.size();
   assert(NumStates > 0 && "Don't need exception table!");
   DenseMap<const MachineBasicBlock *, int> HandlerStates;
   for (int State = 0; State < NumStates; ++State) {
     MachineBasicBlock *HandlerBlock =
         FuncInfo.ClrEHUnwindMap[State].Handler.get<MachineBasicBlock *>();
     HandlerStates[HandlerBlock] = State;
     // Use this loop through all handlers to verify our assumption (used in
-    // the MinEnclosingState computation) that ancestors have lower state
-    // numbers than their descendants.
-    assert(FuncInfo.ClrEHUnwindMap[State].Parent < State &&
+    // the MinEnclosingState computation) that enclosing funclets have lower
+    // state numbers than their enclosed funclets.
+    assert(FuncInfo.ClrEHUnwindMap[State].HandlerParentState < State &&
            "ill-formed state numbering");
   }
   // Map the main function to the NullState.
   HandlerStates[&MF->front()] = NullState;
 
   // Write out a sentinel indicating the end of the standard (Windows) xdata
   // and the start of the additional (CLR) info.
   OS.EmitIntValue(0xffffffff, 4);
void WinException::emitCLRExceptionTable(const MachineFunction *MF) {
   // try regions we entered before entering the PendingState try but which
   // we haven't yet exited.
   SmallVector<std::pair<const MCSymbol *, int>, 4> HandlerStack;
   // EndSymbolMap and MinClauseMap are maps described above.
   std::unique_ptr<MCSymbol *[]> EndSymbolMap(new MCSymbol *[NumStates]);
   SmallVector<int, 4> MinClauseMap((size_t)NumStates, NumStates);
 
   // Visit the root function and each funclet.
-
   for (MachineFunction::const_iterator FuncletStart = MF->begin(),
                                        FuncletEnd = MF->begin(),
                                        End = MF->end();
        FuncletStart != End; FuncletStart = FuncletEnd) {
     int FuncletState = HandlerStates[&*FuncletStart];
     // Find the end of the funclet
     MCSymbol *EndSymbol = FuncEndSym;
     while (++FuncletEnd != End) {
for (MachineFunction::const_iterator FuncletStart = MF->begin(),
     // Walk the state changes in this function/funclet and compute its clauses.
     // Funclets always start in the null state.
     const MCSymbol *CurrentStartLabel = nullptr;
     int CurrentState = NullState;
     assert(HandlerStack.empty());
     for (const auto &StateChange :
          InvokeStateChangeIterator::range(FuncInfo, FuncletStart, FuncletEnd)) {
       // Close any try regions we're not still under
-      int AncestorState =
-          getAncestor(FuncInfo, CurrentState, StateChange.NewState);
-      while (CurrentState != AncestorState) {
-        assert(CurrentState != NullState && "Failed to find ancestor!");
+      int StillPendingState =
+          getTryAncestor(FuncInfo, CurrentState, StateChange.NewState);
+      while (CurrentState != StillPendingState) {
+        assert(CurrentState != NullState &&
+               "Failed to find still-pending state!");
         // Close the pending clause
         Clauses.push_back({CurrentStartLabel, StateChange.PreviousEndLabel,
                            CurrentState, FuncletState});
-        // Now the parent handler is current
-        CurrentState = FuncInfo.ClrEHUnwindMap[CurrentState].Parent;
+        // Now the next-outer try region is current
+        CurrentState = FuncInfo.ClrEHUnwindMap[CurrentState].TryParentState;
         // Pop the new start label from the handler stack if we've exited all
-        // descendants of the corresponding handler.
+        // inner try regions of the corresponding try region.
         if (HandlerStack.back().second == CurrentState)
           CurrentStartLabel = HandlerStack.pop_back_val().first;
       }
 
       if (StateChange.NewState != CurrentState) {
         // For each clause we're starting, update the MinClauseMap so we can
         // know which is the topmost funclet containing a clause targeting
         // it.
         for (int EnteredState = StateChange.NewState;
              EnteredState != CurrentState;
-             EnteredState = FuncInfo.ClrEHUnwindMap[EnteredState].Parent) {
+             EnteredState =
+                 FuncInfo.ClrEHUnwindMap[EnteredState].TryParentState) {
           int &MinEnclosingState = MinClauseMap[EnteredState];
           if (FuncletState < MinEnclosingState)
             MinEnclosingState = FuncletState;
         }
         // Save the previous current start/label on the stack and update to
         // the newly-current start/state.
         HandlerStack.emplace_back(CurrentStartLabel, CurrentState);
         CurrentStartLabel = StateChange.NewStartLabel;

lib/CodeGen/WinEHPrepare.cpp

 // provided by MSVC. Functions with other personality functions are left alone
 // and may be prepared by other passes. In particular, all supported MSVC
 // personality functions require cleanup code to be outlined, and the C++
 // personality requires catch handler code to be outlined.
 //
 //===----------------------------------------------------------------------===//
 
 #include "llvm/CodeGen/Passes.h"
+#include "llvm/ADT/DenseMap.h"
 #include "llvm/ADT/MapVector.h"
+#include "llvm/ADT/STLExtras.h"
 #include "llvm/Analysis/CFG.h"
 #include "llvm/Analysis/EHPersonalities.h"
 #include "llvm/CodeGen/WinEHFuncInfo.h"
 #include "llvm/Pass.h"
 #include "llvm/Support/Debug.h"
 #include "llvm/Support/raw_ostream.h"
 #include "llvm/Transforms/Utils/BasicBlockUtils.h"
 #include "llvm/Transforms/Utils/Cloning.h"
for (const BasicBlock &BB : *Fn) {
     if (!isTopLevelPadForMSVC(FirstNonPHI))
       continue;
     calculateCXXStateNumbers(FuncInfo, FirstNonPHI, -1);
   }
 
   calculateStateNumbersForInvokes(Fn, FuncInfo);
 }
 
-static int addClrEHHandler(WinEHFuncInfo &FuncInfo, int ParentState,
-                           ClrHandlerType HandlerType, uint32_t TypeToken,
-                           const BasicBlock *Handler) {
+static int addClrEHHandler(WinEHFuncInfo &FuncInfo, int HandlerParentState,
+                           int TryParentState, ClrHandlerType HandlerType,
+                           uint32_t TypeToken, const BasicBlock *Handler) {
   ClrEHUnwindMapEntry Entry;
-  Entry.Parent = ParentState;
+  Entry.HandlerParentState = HandlerParentState;
+  Entry.TryParentState = TryParentState;
   Entry.Handler = Handler;
   Entry.HandlerType = HandlerType;
   Entry.TypeToken = TypeToken;
   FuncInfo.ClrEHUnwindMap.push_back(Entry);
   return FuncInfo.ClrEHUnwindMap.size() - 1;
 }
 
 void llvm::calculateClrEHStateNumbers(const Function *Fn,
                                       WinEHFuncInfo &FuncInfo) {
   // Return if it's already been done.
   if (!FuncInfo.EHPadStateMap.empty())
     return;
 
-  SmallVector<std::pair<const Instruction *, int>, 8> Worklist;
+  // This numbering assigns one state number to each catchpad and cleanuppad.
+  // It also computes two tree-like relations over states:
+  // 1) Each state has a "HandlerParentState", which is the state of the next
+  //    outer handler enclosing this state's handler (same as nearest ancestor
+  //    per the ParentPad linkage on EH pads, but skipping over catchswitches).
+  // 2) Each state has a "TryParentState", which:
+  //    a) for a catchpad that's not the last handler on its catchswitch, is
+  //       the state of the next catchpad on that catchswitch
+  //    b) for all other pads, is the state of the pad whose try region is the
+  //       next outer try region enclosing this state's try region.  The "try
+  //       regions are not present as such in the IR, but will be inferred
+  //       based on the placement of invokes and pads which reach each other
+  //       by exceptional exits
+  // Catchswitches do not get their own states, but each gets mapped to the
+  // state of its first catchpad.
+
+  // Step one: walk down from outermost to innermost funclets, assigning each
+  // catchpad and cleanuppad a state number.  Add an entry to the
+  // ClrEHUnwindMap for each state, recording its HandlerParentState and
+  // handler attributes.  Record the TryParentState as well for each catchpad
+  // that's not the last on its catchswitch, but initialize all other entries'
+  // TryParentStates to a sentinel -1 value that the next pass will update.
 
-  // Each pad needs to be able to refer to its parent, so scan the function
-  // looking for top-level handlers and seed the worklist with them.
+  // Seed a worklist with pads that have no parent.
+  SmallVector<std::pair<const Instruction *, int>, 8> Worklist;
   for (const BasicBlock &BB : *Fn) {
-    if (!BB.isEHPad())
-      continue;
-    if (BB.isLandingPad())
-      report_fatal_error("CoreCLR EH cannot use landingpads");
     const Instruction *FirstNonPHI = BB.getFirstNonPHI();
-    if (!isTopLevelPadForMSVC(FirstNonPHI))
+    const Value *ParentPad;
+    if (const auto *CPI = dyn_cast<CleanupPadInst>(FirstNonPHI))
+      ParentPad = CPI->getParentPad();
+    else if (const auto *CSI = dyn_cast<CatchSwitchInst>(FirstNonPHI))
+      ParentPad = CSI->getParentPad();
+    else
       continue;
-    // queue this with sentinel parent state -1 to mean unwind to caller.
+    if (isa<ConstantTokenNone>(ParentPad))
       Worklist.emplace_back(FirstNonPHI, -1);
   }
 
+  // Use the worklist to visit all pads, from outer to inner.  Record
+  // HandlerParentState for all pads.  Record TryParentState only for catchpads
+  // that aren't the last on their catchswitch (setting all other entries'
+  // TryParentStates to an initial value of -1).  This loop is also responsible
+  // for setting the EHPadStateMap entry for all catchpads, cleanuppads, and
+  // catchswitches.
   while (!Worklist.empty()) {
     const Instruction *Pad;
-    int ParentState;
-    std::tie(Pad, ParentState) = Worklist.pop_back_val();
+    int HandlerParentState;
+    std::tie(Pad, HandlerParentState) = Worklist.pop_back_val();
 
-    Value *ParentPad;
-    int PredState;
-    if (const CleanupPadInst *Cleanup = dyn_cast<CleanupPadInst>(Pad)) {
-      // A cleanup can have multiple exits; don't re-process after the first.
-      if (FuncInfo.EHPadStateMap.count(Cleanup))
-        continue;
-      // CoreCLR personality uses arity to distinguish faults from finallies.
-      const BasicBlock *PadBlock = Cleanup->getParent();
+    if (const auto *Cleanup = dyn_cast<CleanupPadInst>(Pad)) {
+      // Create the entry for this cleanup with the appropriate handler
+      // properties.  Finaly and fault handlers are distinguished by arity.
       ClrHandlerType HandlerType =
-          (Cleanup->getNumOperands() ? ClrHandlerType::Fault
+          (Cleanup->getNumArgOperands() ? ClrHandlerType::Fault
                                         : ClrHandlerType::Finally);
-      int NewState =
-          addClrEHHandler(FuncInfo, ParentState, HandlerType, 0, PadBlock);
-      FuncInfo.EHPadStateMap[Cleanup] = NewState;
-      // Propagate the new state to all preds of the cleanup
-      ParentPad = Cleanup->getParentPad();
-      PredState = NewState;
-    } else if (const auto *CatchSwitch = dyn_cast<CatchSwitchInst>(Pad)) {
-      SmallVector<const CatchPadInst *, 1> Handlers;
-      for (const BasicBlock *CatchPadBB : CatchSwitch->handlers()) {
-        const auto *Catch = cast<CatchPadInst>(CatchPadBB->getFirstNonPHI());
-        Handlers.push_back(Catch);
-      }
-      FuncInfo.EHPadStateMap[CatchSwitch] = ParentState;
-      int NewState = ParentState;
-      for (auto HandlerI = Handlers.rbegin(), HandlerE = Handlers.rend();
-           HandlerI != HandlerE; ++HandlerI) {
-        const CatchPadInst *Catch = *HandlerI;
-        const BasicBlock *PadBlock = Catch->getParent();
+      int CleanupState = addClrEHHandler(FuncInfo, HandlerParentState, -1,
+                                         HandlerType, 0, Pad->getParent());
+      // Queue any child EH pads on the worklist.
+      for (const User *U : Cleanup->users())
+        if (const auto *I = dyn_cast<Instruction>(U))
+          if (I->isEHPad())
+            Worklist.emplace_back(I, CleanupState);
+      // Remember this pad's state.
+      FuncInfo.EHPadStateMap[Cleanup] = CleanupState;
+    } else {
+      // Walk the handlers of this catchswitch in reverse order since all but
+      // the last need to set the following one as its TryParentState.
+      const auto *CatchSwitch = cast<CatchSwitchInst>(Pad);
+      int CatchState = -1, FollowerState = -1;
+      SmallVector<const BasicBlock *, 4> CatchBlocks(CatchSwitch->handlers());
+      for (auto CBI = CatchBlocks.rbegin(), CBE = CatchBlocks.rend();
+           CBI != CBE; ++CBI, FollowerState = CatchState) {
+        const BasicBlock *CatchBlock = *CBI;
+        // Create the entry for this catch with the appropriate handler
+        // properties.
+        const auto *Catch = cast<CatchPadInst>(CatchBlock->getFirstNonPHI());
         uint32_t TypeToken = static_cast<uint32_t>(
             cast<ConstantInt>(Catch->getArgOperand(0))->getZExtValue());
-        NewState = addClrEHHandler(FuncInfo, NewState, ClrHandlerType::Catch,
-                                   TypeToken, PadBlock);
-        FuncInfo.EHPadStateMap[Catch] = NewState;
-      }
-      for (const auto *CatchPad : Handlers) {
-        for (const User *U : CatchPad->users()) {
-          const auto *UserI = cast<Instruction>(U);
-          if (UserI->isEHPad())
-            Worklist.emplace_back(UserI, ParentState);
-        }
-      }
-      PredState = NewState;
-      ParentPad = CatchSwitch->getParentPad();
+        CatchState =
+            addClrEHHandler(FuncInfo, HandlerParentState, FollowerState,
+                            ClrHandlerType::Catch, TypeToken, CatchBlock);
+        // Queue any child EH pads on the worklist.
+        for (const User *U : Catch->users())
+          if (const auto *I = dyn_cast<Instruction>(U))
+            if (I->isEHPad())
+              Worklist.emplace_back(I, CatchState);
+        // Remember this catch's state.
+        FuncInfo.EHPadStateMap[Catch] = CatchState;
+      }
+      // Associate the catchswitch with the state of its first catch.
+      assert(CatchSwitch->getNumHandlers());
+      FuncInfo.EHPadStateMap[CatchSwitch] = CatchState;
+
+  // Step two: record the TryParentState of each state.  For cleanuppads that
+  // don't have cleanuprets, we may need to infer this from their child pads,
+  // so visit pads in descendant-most to ancestor-most order.
+  for (auto Entry = FuncInfo.ClrEHUnwindMap.rbegin(),
+            End = FuncInfo.ClrEHUnwindMap.rend();
+       Entry != End; ++Entry) {
+    const Instruction *Pad =
+        Entry->Handler.get<const BasicBlock *>()->getFirstNonPHI();
+    // For most pads, the TryParentState is the state associated with the
+    // unwind dest of exceptional exits from it.
+    const BasicBlock *UnwindDest;
+    if (const auto *Catch = dyn_cast<CatchPadInst>(Pad)) {
+      // If a catch is not the last in its catchswitch, its TryParentState is
+      // the state associated with the next catch in the switch, even though
+      // that's not the unwind dest of exceptions escaping the catch.  Those
+      // cases were already assigned a TryParentState in the first pass, so
+      // skip them.
+      if (Entry->TryParentState != -1)
+        continue;
+      // Otherwise, get the unwind dest from the catchswitch.
+      UnwindDest = Catch->getCatchSwitch()->getUnwindDest();
     } else {
-      llvm_unreachable("Unexpected EH pad");
+      const auto *Cleanup = cast<CleanupPadInst>(Pad);
+      UnwindDest = nullptr;
+      for (const User *U : Cleanup->users()) {
+        if (auto *CleanupRet = dyn_cast<CleanupReturnInst>(U)) {
+          // Common and unambiguous case -- cleanupret indicates cleanup's
+          // unwind dest.
+          UnwindDest = CleanupRet->getUnwindDest();
+          break;
+        }
+
+        // Get an unwind dest for the user
+        const BasicBlock *UserUnwindDest = nullptr;
+        if (auto *Invoke = dyn_cast<InvokeInst>(U)) {
+          UserUnwindDest = Invoke->getUnwindDest();
+        } else if (auto *CatchSwitch = dyn_cast<CatchSwitchInst>(U)) {
+          UserUnwindDest = CatchSwitch->getUnwindDest();
+        } else if (auto *ChildCleanup = dyn_cast<CleanupPadInst>(U)) {
+          int UserState = FuncInfo.EHPadStateMap[ChildCleanup];
+          int UserUnwindState =
+              FuncInfo.ClrEHUnwindMap[UserState].TryParentState;
+          if (UserUnwindState != -1)
+            UserUnwindDest = FuncInfo.ClrEHUnwindMap[UserUnwindState]
+                                 .Handler.get<const BasicBlock *>();
+        }
+
+        // Not having an unwind dest for this user might indicate that it
+        // doesn't unwind, so can't be taken as proof that the cleanup itself
+        // may unwind to caller (see e.g. SimplifyUnreachable and
+        // RemoveUnwindEdge).
+        if (!UserUnwindDest)
+          continue;
+
+        // Now we have an unwind dest for the user, but we need to see if it
+        // unwinds all the way out of the cleanup or if it stays within it.
+        const Instruction *UserUnwindPad = UserUnwindDest->getFirstNonPHI();
+        const Value *UserUnwindParent;
+        if (auto *CSI = dyn_cast<CatchSwitchInst>(UserUnwindPad))
+          UserUnwindParent = CSI->getParentPad();
+        else
+          UserUnwindParent =
+              cast<CleanupPadInst>(UserUnwindPad)->getParentPad();
+
+        // The unwind stays within the cleanup iff it targets a child of the
+        // cleanup.
+        if (UserUnwindParent == Cleanup)
+          continue;
+
+        // This unwind exits the cleanup, so its dest is the cleanup's dest.
+        UnwindDest = UserUnwindDest;
+        break;
       }
+    }
+
+    // Record the state of the unwind dest as the TryParentState.
+    int UnwindDestState;
 
-    // Queue all predecessors with the given state
-    for (const BasicBlock *Pred : predecessors(Pad->getParent())) {
-      if ((Pred = getEHPadFromPredecessor(Pred, ParentPad)))
-        Worklist.emplace_back(Pred->getFirstNonPHI(), PredState);
+    // If UnwindDest is null at this point, either the pad in question can
+    // be exited by unwind to caller, or it cannot be exited by unwind.  In
+    // either case, reporting such cases as unwinding to caller is correct.
+    // This can lead to EH tables that "look strange" -- if this pad's is in
+    // a parent funclet which has other children that do unwind to an enclosing
+    // pad, the try region for this pad will be missing the "duplicate" EH
+    // clause entries that you'd expect to see covering the whole parent.  That
+    // should be benign, since the unwind never actually happens.  If it were
+    // an issue, we could add a subsequent pass that pushes unwind dests down
+    // from parents that have them to children that appear to unwind to caller.
+    if (!UnwindDest) {
+      UnwindDestState = -1;
+    } else {
+      UnwindDestState = FuncInfo.EHPadStateMap[UnwindDest->getFirstNonPHI()];
     }
+
+    Entry->TryParentState = UnwindDestState;
   }
 
+  // Step three: transfer information from pads to invokes.
   calculateStateNumbersForInvokes(Fn, FuncInfo);
 }
 
 void WinEHPrepare::colorFunclets(Function &F) {
   BlockColors = colorEHFunclets(F);
 
   // Invert the map from BB to colors to color to BBs.
   for (BasicBlock &BB : F) {
     ColorVector &Colors = BlockColors[&BB];

test/CodeGen/X86/wineh-coreclr.ll

 ;         f(6);
 ;       }
 ;     }
 ;   } finally {
 ;     f(7);
 ;   }
 ;   f(8);
 ; }
-
+;
 ; CHECK-LABEL: test1:     # @test1
-; CHECK-NEXT: [[L_begin:.*func_begin.*]]:
+; CHECK-NEXT: [[test1_begin:.*func_begin.*]]:
 define void @test1() personality i8* bitcast (void ()* @ProcessCLRException to i8*) {
 entry:
 ; CHECK: # %entry
 ; CHECK: leaq [[FPOffset:[0-9]+]](%rsp), %rbp
 ; CHECK: .seh_endprologue
 ; CHECK: movq %rsp, [[PSPSymOffset:[0-9]+]](%rsp)
-; CHECK: [[L_before_f1:.+]]:
+; CHECK: [[test1_before_f1:.+]]:
 ; CHECK-NEXT: movl $1, %ecx
 ; CHECK-NEXT: callq f
-; CHECK-NEXT: [[L_after_f1:.+]]:
+; CHECK-NEXT: [[test1_after_f1:.+]]:
   invoke void @f(i32 1)
-    to label %inner_try unwind label %finally.pad
+    to label %inner_try unwind label %finally
 inner_try:
 ; CHECK: # %inner_try
-; CHECK: [[L_before_f2:.+]]:
+; CHECK: [[test1_before_f2:.+]]:
 ; CHECK-NEXT: movl $2, %ecx
 ; CHECK-NEXT: callq f
-; CHECK-NEXT: [[L_after_f2:.+]]:
+; CHECK-NEXT: [[test1_after_f2:.+]]:
   invoke void @f(i32 2)
-    to label %finally.clone unwind label %catch1.pad
-catch1.pad:
-  %cs1 = catchswitch within none [label %catch1.body, label %catch2.body] unwind label %finally.pad
-catch1.body:
-  %catch1 = catchpad within %cs1 [i32 1]
-; CHECK: .seh_proc [[L_catch1:[^ ]+]]
+    to label %finally.clone unwind label %exn.dispatch
+exn.dispatch:
+  %catchswitch = catchswitch within none [label %catch1, label %catch2] unwind label %finally
+catch1:
+  %catch.pad1 = catchpad within %catchswitch [i32 1]
+; CHECK: .seh_proc [[test1_catch1:[^ ]+]]
 ; CHECK: .seh_stackalloc [[FuncletFrameSize:[0-9]+]]
 ;                        ^ all funclets use the same frame size
 ; CHECK: movq [[PSPSymOffset]](%rcx), %rcx
 ;                              ^ establisher frame pointer passed in rcx
 ; CHECK: movq %rcx, [[PSPSymOffset]](%rsp)
 ; CHECK: leaq [[FPOffset]](%rcx), %rbp
 ; CHECK: .seh_endprologue
 ; CHECK: movq %rdx, %rcx
 ;             ^ exception pointer passed in rdx
 ; CHECK-NEXT: callq g
-  %exn1 = call i8 addrspace(1)* @llvm.eh.exceptionpointer.p1i8(token %catch1)
-  call void @g(i8 addrspace(1)* %exn1) [ "funclet"(token %catch1) ]
-; CHECK: [[L_before_f3:.+]]:
+  %exn1 = call i8 addrspace(1)* @llvm.eh.exceptionpointer.p1i8(token %catch.pad1)
+  call void @g(i8 addrspace(1)* %exn1) [ "funclet"(token %catch.pad1) ]
+; CHECK: [[test1_before_f3:.+]]:
 ; CHECK-NEXT: movl $3, %ecx
 ; CHECK-NEXT: callq f
-; CHECK-NEXT: [[L_after_f3:.+]]:
-  invoke void @f(i32 3) [ "funclet"(token %catch1) ]
-    to label %catch1.ret unwind label %finally.pad
+; CHECK-NEXT: [[test1_after_f3:.+]]:
+  invoke void @f(i32 3) [ "funclet"(token %catch.pad1) ]
+    to label %catch1.ret unwind label %finally
 catch1.ret:
-  catchret from %catch1 to label %finally.clone
-catch2.body:
-  %catch2 = catchpad within %cs1 [i32 2]
-; CHECK: .seh_proc [[L_catch2:[^ ]+]]
+  catchret from %catch.pad1 to label %finally.clone
+catch2:
+  %catch.pad2 = catchpad within %catchswitch [i32 2]
+; CHECK: .seh_proc [[test1_catch2:[^ ]+]]
 ; CHECK: .seh_stackalloc [[FuncletFrameSize:[0-9]+]]
 ;                        ^ all funclets use the same frame size
 ; CHECK: movq [[PSPSymOffset]](%rcx), %rcx
 ;                              ^ establisher frame pointer passed in rcx
 ; CHECK: movq %rcx, [[PSPSymOffset]](%rsp)
 ; CHECK: leaq [[FPOffset]](%rcx), %rbp
 ; CHECK: .seh_endprologue
 ; CHECK: movq %rdx, %rcx
 ;             ^ exception pointer passed in rdx
 ; CHECK-NEXT: callq g
-  %exn2 = call i8 addrspace(1)* @llvm.eh.exceptionpointer.p1i8(token %catch2)
-  call void @g(i8 addrspace(1)* %exn2) [ "funclet"(token %catch2) ]
-; CHECK: [[L_before_f4:.+]]:
+  %exn2 = call i8 addrspace(1)* @llvm.eh.exceptionpointer.p1i8(token %catch.pad2)
+  call void @g(i8 addrspace(1)* %exn2) [ "funclet"(token %catch.pad2) ]
+; CHECK: [[test1_before_f4:.+]]:
 ; CHECK-NEXT: movl $4, %ecx
 ; CHECK-NEXT: callq f
-; CHECK-NEXT: [[L_after_f4:.+]]:
-  invoke void @f(i32 4) [ "funclet"(token %catch2) ]
-    to label %try_in_catch unwind label %finally.pad
+; CHECK-NEXT: [[test1_after_f4:.+]]:
+  invoke void @f(i32 4) [ "funclet"(token %catch.pad2) ]
+    to label %try_in_catch unwind label %finally
 try_in_catch:
 ; CHECK: # %try_in_catch
-; CHECK: [[L_before_f5:.+]]:
+; CHECK: [[test1_before_f5:.+]]:
 ; CHECK-NEXT: movl $5, %ecx
 ; CHECK-NEXT: callq f
-; CHECK-NEXT: [[L_after_f5:.+]]:
-  invoke void @f(i32 5) [ "funclet"(token %catch2) ]
-    to label %catch2.ret unwind label %fault.pad
-fault.pad:
-; CHECK: .seh_proc [[L_fault:[^ ]+]]
-  %fault = cleanuppad within none [i32 undef]
+; CHECK-NEXT: [[test1_after_f5:.+]]:
+  invoke void @f(i32 5) [ "funclet"(token %catch.pad2) ]
+    to label %catch2.ret unwind label %fault
+fault:
+; CHECK: .seh_proc [[test1_fault:[^ ]+]]
+  %fault.pad = cleanuppad within %catch.pad2 [i32 undef]
 ; CHECK: .seh_stackalloc [[FuncletFrameSize:[0-9]+]]
 ;                        ^ all funclets use the same frame size
 ; CHECK: movq [[PSPSymOffset]](%rcx), %rcx
 ;                              ^ establisher frame pointer passed in rcx
 ; CHECK: movq %rcx, [[PSPSymOffset]](%rsp)
 ; CHECK: leaq [[FPOffset]](%rcx), %rbp
 ; CHECK: .seh_endprologue
-; CHECK: [[L_before_f6:.+]]:
+; CHECK: [[test1_before_f6:.+]]:
 ; CHECK-NEXT: movl $6, %ecx
 ; CHECK-NEXT: callq f
-; CHECK-NEXT: [[L_after_f6:.+]]:
-  invoke void @f(i32 6) [ "funclet"(token %fault) ]
-    to label %fault.ret unwind label %finally.pad
+; CHECK-NEXT: [[test1_after_f6:.+]]:
+  invoke void @f(i32 6) [ "funclet"(token %fault.pad) ]
+    to label %fault.ret unwind label %finally
 fault.ret:
-  cleanupret from %fault unwind label %finally.pad
+  cleanupret from %fault.pad unwind label %finally
 catch2.ret:
-  catchret from %catch2 to label %finally.clone
+  catchret from %catch.pad2 to label %finally.clone
 finally.clone:
   call void @f(i32 7)
   br label %tail
-finally.pad:
-; CHECK: .seh_proc [[L_finally:[^ ]+]]
-  %finally = cleanuppad within none []
+finally:
+; CHECK: .seh_proc [[test1_finally:[^ ]+]]
+  %finally.pad = cleanuppad within none []
 ; CHECK: .seh_stackalloc [[FuncletFrameSize:[0-9]+]]
 ;                        ^ all funclets use the same frame size
 ; CHECK: movq [[PSPSymOffset]](%rcx), %rcx
 ;                              ^ establisher frame pointer passed in rcx
 ; CHECK: movq %rcx, [[PSPSymOffset]](%rsp)
 ; CHECK: leaq [[FPOffset]](%rcx), %rbp
 ; CHECK: .seh_endprologue
 ; CHECK-NEXT: movl $7, %ecx
 ; CHECK-NEXT: callq f
-  call void @f(i32 7) [ "funclet"(token %finally) ]
-  cleanupret from %finally unwind to caller
+  call void @f(i32 7) [ "funclet"(token %finally.pad) ]
+  cleanupret from %finally.pad unwind to caller
 tail:
   call void @f(i32 8)
   ret void
-; CHECK: [[L_end:.*func_end.*]]:
+; CHECK: [[test1_end:.*func_end.*]]:
 }
 
-; FIXME: Verify that the new clauses are correct and re-enable these checks.
-
 ; Now check for EH table in xdata (following standard xdata)
-; CHECKX-LABEL: .section .xdata
+; CHECK-LABEL: .section .xdata
 ; standard xdata comes here
-; CHECKX:      .long 4{{$}}
+; CHECK:      .long 4{{$}}
 ;                   ^ number of funclets
-; CHECKX-NEXT: .long [[L_catch1]]-[[L_begin]]
+; CHECK-NEXT: .long [[test1_catch1]]-[[test1_begin]]
 ;                   ^ offset from L_begin to start of 1st funclet
-; CHECKX-NEXT: .long [[L_catch2]]-[[L_begin]]
+; CHECK-NEXT: .long [[test1_catch2]]-[[test1_begin]]
 ;                   ^ offset from L_begin to start of 2nd funclet
-; CHECKX-NEXT: .long [[L_fault]]-[[L_begin]]
+; CHECK-NEXT: .long [[test1_fault]]-[[test1_begin]]
 ;                   ^ offset from L_begin to start of 3rd funclet
-; CHECKX-NEXT: .long [[L_finally]]-[[L_begin]]
+; CHECK-NEXT: .long [[test1_finally]]-[[test1_begin]]
 ;                   ^ offset from L_begin to start of 4th funclet
-; CHECKX-NEXT: .long [[L_end]]-[[L_begin]]
+; CHECK-NEXT: .long [[test1_end]]-[[test1_begin]]
 ;                   ^ offset from L_begin to end of last funclet
-; CHECKX-NEXT: .long 7
+; CHECK-NEXT: .long 7
 ;                   ^ number of EH clauses
 ; Clause 1: call f(2) is guarded by catch1
-; CHECKX-NEXT: .long 0
+; CHECK-NEXT: .long 0
 ;                   ^ flags (0 => catch handler)
-; CHECKX-NEXT: .long ([[L_before_f2]]-[[L_begin]])+1
+; CHECK-NEXT: .long ([[test1_before_f2]]-[[test1_begin]])+1
 ;                   ^ offset of start of clause
-; CHECKX-NEXT: .long ([[L_after_f2]]-[[L_begin]])+1
+; CHECK-NEXT: .long ([[test1_after_f2]]-[[test1_begin]])+1
 ;                   ^ offset of end of clause
-; CHECKX-NEXT: .long [[L_catch1]]-[[L_begin]]
+; CHECK-NEXT: .long [[test1_catch1]]-[[test1_begin]]
 ;                   ^ offset of start of handler
-; CHECKX-NEXT: .long [[L_catch2]]-[[L_begin]]
+; CHECK-NEXT: .long [[test1_catch2]]-[[test1_begin]]
 ;                   ^ offset of end of handler
-; CHECKX-NEXT: .long 1
+; CHECK-NEXT: .long 1
 ;                   ^ type token of catch (from catchpad)
 ; Clause 2: call f(2) is also guarded by catch2
-; CHECKX-NEXT: .long 0
+; CHECK-NEXT: .long 0
 ;                   ^ flags (0 => catch handler)
-; CHECKX-NEXT: .long ([[L_before_f2]]-[[L_begin]])+1
+; CHECK-NEXT: .long ([[test1_before_f2]]-[[test1_begin]])+1
 ;                   ^ offset of start of clause
-; CHECKX-NEXT: .long ([[L_after_f2]]-[[L_begin]])+1
+; CHECK-NEXT: .long ([[test1_after_f2]]-[[test1_begin]])+1
 ;                   ^ offset of end of clause
-; CHECKX-NEXT: .long [[L_catch2]]-[[L_begin]]
+; CHECK-NEXT: .long [[test1_catch2]]-[[test1_begin]]
 ;                   ^ offset of start of handler
-; CHECKX-NEXT: .long [[L_fault]]-[[L_begin]]
+; CHECK-NEXT: .long [[test1_fault]]-[[test1_begin]]
 ;                   ^ offset of end of handler
-; CHECKX-NEXT: .long 2
+; CHECK-NEXT: .long 2
 ;                   ^ type token of catch (from catchpad)
 ; Clause 3: calls f(1) and f(2) are guarded by finally
-; CHECKX-NEXT: .long 2
+; CHECK-NEXT: .long 2
 ;                   ^ flags (2 => finally handler)
-; CHECKX-NEXT: .long ([[L_before_f1]]-[[L_begin]])+1
+; CHECK-NEXT: .long ([[test1_before_f1]]-[[test1_begin]])+1
 ;                   ^ offset of start of clause
-; CHECKX-NEXT: .long ([[L_after_f2]]-[[L_begin]])+1
+; CHECK-NEXT: .long ([[test1_after_f2]]-[[test1_begin]])+1
 ;                   ^ offset of end of clause
-; CHECKX-NEXT: .long [[L_finally]]-[[L_begin]]
+; CHECK-NEXT: .long [[test1_finally]]-[[test1_begin]]
 ;                   ^ offset of start of handler
-; CHECKX-NEXT: .long [[L_end]]-[[L_begin]]
+; CHECK-NEXT: .long [[test1_end]]-[[test1_begin]]
 ;                   ^ offset of end of handler
-; CHECKX-NEXT: .long 0
+; CHECK-NEXT: .long 0
 ;                   ^ type token slot (null for finally)
 ; Clause 4: call f(3) is guarded by finally
 ;           This is a "duplicate" because the protected range (f(3))
 ;           is in funclet catch1 but the finally's immediate parent
 ;           is the main function, not that funclet.
-; CHECKX-NEXT: .long 10
+; CHECK-NEXT: .long 10
 ;                   ^ flags (2 => finally handler | 8 => duplicate)
-; CHECKX-NEXT: .long ([[L_before_f3]]-[[L_begin]])+1
+; CHECK-NEXT: .long ([[test1_before_f3]]-[[test1_begin]])+1
 ;                   ^ offset of start of clause
-; CHECKX-NEXT: .long ([[L_after_f3]]-[[L_begin]])+1
+; CHECK-NEXT: .long ([[test1_after_f3]]-[[test1_begin]])+1
 ;                   ^ offset of end of clause
-; CHECKX-NEXT: .long [[L_finally]]-[[L_begin]]
+; CHECK-NEXT: .long [[test1_finally]]-[[test1_begin]]
 ;                   ^ offset of start of handler
-; CHECKX-NEXT: .long [[L_end]]-[[L_begin]]
+; CHECK-NEXT: .long [[test1_end]]-[[test1_begin]]
 ;                   ^ offset of end of handler
-; CHECKX-NEXT: .long 0
+; CHECK-NEXT: .long 0
 ;                   ^ type token slot (null for finally)
 ; Clause 5: call f(5) is guarded by fault
-; CHECKX-NEXT: .long 4
+; CHECK-NEXT: .long 4
 ;                   ^ flags (4 => fault handler)
-; CHECKX-NEXT: .long ([[L_before_f5]]-[[L_begin]])+1
+; CHECK-NEXT: .long ([[test1_before_f5]]-[[test1_begin]])+1
 ;                   ^ offset of start of clause
-; CHECKX-NEXT: .long ([[L_after_f5]]-[[L_begin]])+1
+; CHECK-NEXT: .long ([[test1_after_f5]]-[[test1_begin]])+1
 ;                   ^ offset of end of clause
-; CHECKX-NEXT: .long [[L_fault]]-[[L_begin]]
+; CHECK-NEXT: .long [[test1_fault]]-[[test1_begin]]
 ;                   ^ offset of start of handler
-; CHECKX-NEXT: .long [[L_finally]]-[[L_begin]]
+; CHECK-NEXT: .long [[test1_finally]]-[[test1_begin]]
 ;                   ^ offset of end of handler
-; CHECKX-NEXT: .long 0
+; CHECK-NEXT: .long 0
 ;                   ^ type token slot (null for fault)
 ; Clause 6: calls f(4) and f(5) are guarded by finally
 ;           This is a "duplicate" because the protected range (f(4)-f(5))
 ;           is in funclet catch2 but the finally's immediate parent
 ;           is the main function, not that funclet.
-; CHECKX-NEXT: .long 10
+; CHECK-NEXT: .long 10
 ;                   ^ flags (2 => finally handler | 8 => duplicate)
-; CHECKX-NEXT: .long ([[L_before_f4]]-[[L_begin]])+1
+; CHECK-NEXT: .long ([[test1_before_f4]]-[[test1_begin]])+1
 ;                   ^ offset of start of clause
-; CHECKX-NEXT: .long ([[L_after_f5]]-[[L_begin]])+1
+; CHECK-NEXT: .long ([[test1_after_f5]]-[[test1_begin]])+1
 ;                   ^ offset of end of clause
-; CHECKX-NEXT: .long [[L_finally]]-[[L_begin]]
+; CHECK-NEXT: .long [[test1_finally]]-[[test1_begin]]
 ;                   ^ offset of start of handler
-; CHECKX-NEXT: .long [[L_end]]-[[L_begin]]
+; CHECK-NEXT: .long [[test1_end]]-[[test1_begin]]
 ;                   ^ offset of end of handler
-; CHECKX-NEXT: .long 0
+; CHECK-NEXT: .long 0
 ;                   ^ type token slot (null for finally)
 ; Clause 7: call f(6) is guarded by finally
 ;           This is a "duplicate" because the protected range (f(3))
 ;           is in funclet catch1 but the finally's immediate parent
 ;           is the main function, not that funclet.
-; CHECKX-NEXT: .long 10
+; CHECK-NEXT: .long 10
 ;                   ^ flags (2 => finally handler | 8 => duplicate)
-; CHECKX-NEXT: .long ([[L_before_f6]]-[[L_begin]])+1
+; CHECK-NEXT: .long ([[test1_before_f6]]-[[test1_begin]])+1
 ;                   ^ offset of start of clause
-; CHECKX-NEXT: .long ([[L_after_f6]]-[[L_begin]])+1
+; CHECK-NEXT: .long ([[test1_after_f6]]-[[test1_begin]])+1
 ;                   ^ offset of end of clause
-; CHECKX-NEXT: .long [[L_finally]]-[[L_begin]]
+; CHECK-NEXT: .long [[test1_finally]]-[[test1_begin]]
 ;                   ^ offset of start of handler
-; CHECKX-NEXT: .long [[L_end]]-[[L_begin]]
+; CHECK-NEXT: .long [[test1_end]]-[[test1_begin]]
 ;                   ^ offset of end of handler
-; CHECKX-NEXT: .long 0
+; CHECK-NEXT: .long 0
 ;                   ^ type token slot (null for finally)
+
+; Test with a cleanup that has no cleanupret, and thus needs its unwind dest
+; inferred from an inner catchswitch
+;
+; corresponds to C# along the lines of:
+; void test2() {
+;   try {
+;     try {
+;       f(1);
+;     } fault {
+;       try {
+;         f(2);
+;       } catch(type1) {
+;       }
+;       __unreachable();
+;     }
+;   } catch(type2) {
+;   }
+; }
+;
+; CHECK-LABEL: test2:     # @test2
+; CHECK-NEXT: [[test2_begin:.*func_begin.*]]:
+define void @test2() personality i8* bitcast (void ()* @ProcessCLRException to i8*) {
+entry:
+; CHECK: .seh_endprologue
+; CHECK: [[test2_before_f1:.+]]:
+; CHECK-NEXT: movl $1, %ecx
+; CHECK-NEXT: callq f
+; CHECK-NEXT: [[test2_after_f1:.+]]:
+  invoke void @f(i32 1)
+    to label %exit unwind label %fault
+fault:
+; CHECK: .seh_proc [[test2_fault:[^ ]+]]
+  %fault.pad = cleanuppad within none [i32 undef]
+; CHECK: .seh_endprologue
+; CHECK: [[test2_before_f2:.+]]:
+; CHECK-NEXT: movl $2, %ecx
+; CHECK-NEXT: callq f
+; CHECK-NEXT: [[test2_after_f2:.+]]:
+  invoke void @f(i32 2) ["funclet"(token %fault.pad)]
+    to label %unreachable unwind label %exn.dispatch.inner
+exn.dispatch.inner:
+  %catchswitch.inner = catchswitch within %fault.pad [label %catch1] unwind label %exn.dispatch.outer
+catch1:
+  %catch.pad1 = catchpad within %catchswitch.inner [i32 1]
+; CHECK: .seh_proc [[test2_catch1:[^ ]+]]
+  catchret from %catch.pad1 to label %unreachable
+exn.dispatch.outer:
+  %catchswitch.outer = catchswitch within none [label %catch2] unwind to caller
+catch2:
+  %catch.pad2 = catchpad within %catchswitch.outer [i32 2]
+; CHECK: .seh_proc [[test2_catch2:[^ ]+]]
+  catchret from %catch.pad2 to label %exit
+exit:
+  ret void
+unreachable:
+  unreachable
+; CHECK: [[test2_end:.*func_end.*]]:
+}
+
+; Now check for EH table in xdata (following standard xdata)
+; CHECK-LABEL: .section .xdata
+; standard xdata comes here
+; CHECK:      .long 3{{$}}
+;                   ^ number of funclets
+; CHECK-NEXT: .long [[test2_fault]]-[[test2_begin]]
+;                   ^ offset from L_begin to start of 1st funclet
+; CHECK-NEXT: .long [[test2_catch1]]-[[test2_begin]]
+;                   ^ offset from L_begin to start of 2nd funclet
+; CHECK-NEXT: .long [[test2_catch2]]-[[test2_begin]]
+;                   ^ offset from L_begin to start of 3rd funclet
+; CHECK-NEXT: .long [[test2_end]]-[[test2_begin]]
+;                   ^ offset from L_begin to end of last funclet
+; CHECK-NEXT: .long 4
+;                   ^ number of EH clauses
+; Clause 1: call f(1) is guarded by fault
+; CHECK-NEXT: .long 4
+;                   ^ flags (4 => fault handler)
+; CHECK-NEXT: .long ([[test2_before_f1]]-[[test2_begin]])+1
+;                   ^ offset of start of clause
+; CHECK-NEXT: .long ([[test2_after_f1]]-[[test2_begin]])+1
+;                   ^ offset of end of clause
+; CHECK-NEXT: .long [[test2_fault]]-[[test2_begin]]
+;                   ^ offset of start of handler
+; CHECK-NEXT: .long [[test2_catch1]]-[[test2_begin]]
+;                   ^ offset of end of handler
+; CHECK-NEXT: .long 0
+;                   ^ type token slot (null for fault)
+; Clause 2: call f(1) is also guarded by catch2
+; CHECK-NEXT: .long 0
+;                   ^ flags (0 => catch handler)
+; CHECK-NEXT: .long ([[test2_before_f1]]-[[test2_begin]])+1
+;                   ^ offset of start of clause
+; CHECK-NEXT: .long ([[test2_after_f1]]-[[test2_begin]])+1
+;                   ^ offset of end of clause
+; CHECK-NEXT: .long [[test2_catch2]]-[[test2_begin]]
+;                   ^ offset of start of handler
+; CHECK-NEXT: .long [[test2_end]]-[[test2_begin]]
+;                   ^ offset of end of handler
+; CHECK-NEXT: .long 2
+;                   ^ type token of catch (from catchpad)
+; Clause 3: calls f(2) is guarded by catch1
+; CHECK-NEXT: .long 0
+;                   ^ flags (0 => catch handler)
+; CHECK-NEXT: .long ([[test2_before_f2]]-[[test2_begin]])+1
+;                   ^ offset of start of clause
+; CHECK-NEXT: .long ([[test2_after_f2]]-[[test2_begin]])+1
+;                   ^ offset of end of clause
+; CHECK-NEXT: .long [[test2_catch1]]-[[test2_begin]]
+;                   ^ offset of start of handler
+; CHECK-NEXT: .long [[test2_catch2]]-[[test2_begin]]
+;                   ^ offset of end of handler
+; CHECK-NEXT: .long 1
+;                   ^ type token of catch (from catchpad)
+; Clause 4: call f(2) is also guarded by catch2
+;           This is a "duplicate" because the protected range (f(2))
+;           is in funclet fault but catch2's immediate parent
+;           is the main function, not that funclet.
+; CHECK-NEXT: .long 8
+;                   ^ flags (0 => catch handler | 8 => duplicate)
+; CHECK-NEXT: .long ([[test2_before_f2]]-[[test2_begin]])+1
+;                   ^ offset of start of clause
+; CHECK-NEXT: .long ([[test2_after_f2]]-[[test2_begin]])+1
+;                   ^ offset of end of clause
+; CHECK-NEXT: .long [[test2_catch2]]-[[test2_begin]]
+;                   ^ offset of start of handler
+; CHECK-NEXT: .long [[test2_end]]-[[test2_begin]]
+;                   ^ offset of end of handler
+; CHECK-NEXT: .long 2
+;                   ^ type token of catch (from catchpad)
+
+; Test with several cleanups that need to infer their unwind dests from each
+; other, the inner one needing to make the inference from an invoke, ignoring
+; not-really-unwinding calls/unwind-to-caller catchswitches, as well as some
+; internal invokes/catchswitches
+;
+; Corresponds to something like:
+; void test3() {
+;   try {
+;     f(1);
+;   } fault { // fault1
+;     try {
+;       try {
+;         f(2);
+;         __unreachable();
+;       } fault { // fault2
+;         try {
+;           f(3);
+;         } fault { // fault3
+;           try {
+;             f(4);
+;           } fault { // fault4
+;             f(5); // no unwind edge (e.g. front-end knew it wouldn't throw but
+;                    didn't bother to specify nounwind)
+;             try {
+;               try {
+;                 f(6);
+;               } catch(type 1) {
+;                 goto __unreachable;
+;               }
+;             } catch (type 2) { // marked "unwinds to caller" because we allow
+;                                // that if the unwind won't be taken (see
+;                                // SimplifyUnreachable & RemoveUnwindEdge)
+;               goto _unreachable;
+;             }
+;             f(7);
+;             __unreachable();
+;           }
+;         }
+;       }
+;     } fault { // fault 5
+;     }
+;   }
+; }
+;
+; CHECK-LABEL: test3:     # @test3
+; CHECK-NEXT: [[test3_begin:.*func_begin.*]]:
+define void @test3() personality i8* bitcast (void ()* @ProcessCLRException to i8*) {
+entry:
+; CHECK: .seh_endprologue
+; CHECK: [[test3_before_f1:.+]]:
+; CHECK-NEXT: movl $1, %ecx
+; CHECK-NEXT: callq f
+; CHECK-NEXT: [[test3_after_f1:.+]]:
+  invoke void @f(i32 1)
+    to label %exit unwind label %fault1
+fault1:
+ ; check lines below since this gets reordered to end-of-func
+  %fault.pad1 = cleanuppad within none [i32 undef]
+  invoke void @f(i32 2) ["funclet"(token %fault.pad1)]
+    to label %unreachable unwind label %fault2
+fault2:
+ ; check lines below since this gets reordered to end-of-func
+  %fault.pad2 = cleanuppad within %fault.pad1 [i32 undef]
+  invoke void @f(i32 3) ["funclet"(token %fault.pad2)]
+    to label %unreachable unwind label %fault3
+fault3:
+ ; check lines below since this gets reordered to end-of-func
+  %fault.pad3 = cleanuppad within %fault.pad2 [i32 undef]
+  invoke void @f(i32 4) ["funclet"(token %fault.pad3)]
+    to label %unreachable unwind label %fault4
+fault4:
+; CHECK: .seh_proc [[test3_fault4:[^ ]+]]
+  %fault.pad4 = cleanuppad within %fault.pad3 [i32 undef]
+; CHECK: .seh_endprologue
+  call void @f(i32 5) ["funclet"(token %fault.pad4)]
+; CHECK: [[test3_before_f6:.+]]:
+; CHECK-NEXT: movl $6, %ecx
+; CHECK-NEXT: callq f
+; CHECK-NEXT: [[test3_after_f6:.+]]:
+  invoke void @f(i32 6) ["funclet"(token %fault.pad4)]
+    to label %fault4.cont unwind label %exn.dispatch1
+fault4.cont:
+; CHECK: # %fault4.cont
+; CHECK: [[test3_before_f7:.+]]:
+; CHECK-NEXT: movl $7, %ecx
+; CHECK-NEXT: callq f
+; CHECK-NEXT: [[test3_after_f7:.+]]:
+  invoke void @f(i32 7) ["funclet"(token %fault.pad4)]
+    to label %unreachable unwind label %fault5
+exn.dispatch1:
+  %catchswitch1 = catchswitch within %fault.pad4 [label %catch1] unwind label %exn.dispatch2
+catch1:
+  %catch.pad1 = catchpad within %catchswitch1 [i32 1]
+; CHECK: .seh_proc [[test3_catch1:[^ ]+]]
+  catchret from %catch.pad1 to label %unreachable
+exn.dispatch2:
+  %catchswitch2 = catchswitch within %fault.pad4 [label %catch2] unwind to caller
+catch2:
+  %catch.pad2 = catchpad within %catchswitch2 [i32 2]
+; CHECK: .seh_proc [[test3_catch2:[^ ]+]]
+  catchret from %catch.pad2 to label %unreachable
+fault5:
+; CHECK: .seh_proc [[test3_fault5:[^ ]+]]
+  %fault.pad5 = cleanuppad within %fault.pad1 [i32 undef]
+; CHECK: .seh_endprologue
+cleanupret from %fault.pad5 unwind to caller
+exit:
+  ret void
+unreachable:
+  unreachable
+; CHECK: .seh_proc [[test3_fault3:[^ ]+]]
+; CHECK: # %fault3
+; CHECK: .seh_endprologue
+; CHECK: [[test3_before_f4:.+]]:
+; CHECK-NEXT: movl $4, %ecx
+; CHECK-NEXT: callq f
+; CHECK-NEXT: [[test3_after_f4:.+]]:
+; CHECK: .seh_proc [[test3_fault2:[^ ]+]]
+; CHECK: # %fault2
+; CHECK: .seh_endprologue
+; CHECK: [[test3_before_f3:.+]]:
+; CHECK-NEXT: movl $3, %ecx
+; CHECK-NEXT: callq f
+; CHECK-NEXT: [[test3_after_f3:.+]]:
+; CHECK: .seh_proc [[test3_fault1:[^ ]+]]
+; CHECK: # %fault1
+; CHECK: .seh_endprologue
+; CHECK: [[test3_before_f2:.+]]:
+; CHECK-NEXT: movl $2, %ecx
+; CHECK-NEXT: callq f
+; CHECK-NEXT: [[test3_after_f2:.+]]:
+; CHECK: [[test3_end:.*func_end.*]]:
+}
+
+; Now check for EH table in xdata (following standard xdata)
+; CHECK-LABEL: .section .xdata
+; standard xdata comes here
+; CHECK:      .long 7{{$}}
+;                   ^ number of funclets
+; CHECK-NEXT: .long [[test3_fault4]]-[[test3_begin]]
+;                   ^ offset from L_begin to start of 1st funclet
+; CHECK-NEXT: .long [[test3_catch1]]-[[test3_begin]]
+;                   ^ offset from L_begin to start of 2nd funclet
+; CHECK-NEXT: .long [[test3_catch2]]-[[test3_begin]]
+;                   ^ offset from L_begin to start of 3rd funclet
+; CHECK-NEXT: .long [[test3_fault5]]-[[test3_begin]]
+;                   ^ offset from L_begin to start of 4th funclet
+; CHECK-NEXT: .long [[test3_fault3]]-[[test3_begin]]
+;                   ^ offset from L_begin to start of 5th funclet
+; CHECK-NEXT: .long [[test3_fault2]]-[[test3_begin]]
+;                   ^ offset from L_begin to start of 6th funclet
+; CHECK-NEXT: .long [[test3_fault1]]-[[test3_begin]]
+;                   ^ offset from L_begin to start of 7th funclet
+; CHECK-NEXT: .long [[test3_end]]-[[test3_begin]]
+;                   ^ offset from L_begin to end of last funclet
+; CHECK-NEXT: .long 10
+;                   ^ number of EH clauses
+; Clause 1: call f(1) is guarded by fault1
+; CHECK-NEXT: .long 4
+;                   ^ flags (4 => fault handler)
+; CHECK-NEXT: .long ([[test3_before_f1]]-[[test3_begin]])+1
+;                   ^ offset of start of clause
+; CHECK-NEXT: .long ([[test3_after_f1]]-[[test3_begin]])+1
+;                   ^ offset of end of clause
+; CHECK-NEXT: .long [[test3_fault1]]-[[test3_begin]]
+;                   ^ offset of start of handler
+; CHECK-NEXT: .long [[test3_end]]-[[test3_begin]]
+;                   ^ offset of end of handler
+; CHECK-NEXT: .long 0
+;                   ^ type token slot (null for fault)
+; Clause 3: call f(6) is guarded by catch1
+; CHECK-NEXT: .long 0
+;                   ^ flags (0 => catch handler)
+; CHECK-NEXT: .long ([[test3_before_f6]]-[[test3_begin]])+1
+;                   ^ offset of start of clause
+; CHECK-NEXT: .long ([[test3_after_f6]]-[[test3_begin]])+1
+;                   ^ offset of end of clause
+; CHECK-NEXT: .long [[test3_catch1]]-[[test3_begin]]
+;                   ^ offset of start of handler
+; CHECK-NEXT: .long [[test3_catch2]]-[[test3_begin]]
+;                   ^ offset of end of handler
+; CHECK-NEXT: .long 1
+;                   ^ type token of catch (from catchpad)
+; Clause 3: call f(6) is also guarded by catch2
+; CHECK-NEXT: .long 0
+;                   ^ flags (0 => catch handler)
+; CHECK-NEXT: .long ([[test3_before_f6]]-[[test3_begin]])+1
+;                   ^ offset of start of clause
+; CHECK-NEXT: .long ([[test3_after_f6]]-[[test3_begin]])+1
+;                   ^ offset of end of clause
+; CHECK-NEXT: .long [[test3_catch2]]-[[test3_begin]]
+;                   ^ offset of start of handler
+; CHECK-NEXT: .long [[test3_fault5]]-[[test3_begin]]
+;                   ^ offset of end of handler
+; CHECK-NEXT: .long 2
+;                   ^ type token of catch (from catchpad)
+; Clause 4: call f(7) is guarded by fault5
+;           This is a "duplicate" because the protected range (f(6)-f(7))
+;           is in funclet fault4 but fault5's immediate parent
+;           is fault1, not that funclet.
+; CHECK-NEXT: .long 12
+;                   ^ flags (4 => fault handler | 8 => duplicate)
+; CHECK-NEXT: .long ([[test3_before_f7]]-[[test3_begin]])+1
+;                   ^ offset of start of clause
+; CHECK-NEXT: .long ([[test3_after_f7]]-[[test3_begin]])+1
+;                   ^ offset of end of clause
+; CHECK-NEXT: .long [[test3_fault5]]-[[test3_begin]]
+;                   ^ offset of start of handler
+; CHECK-NEXT: .long [[test3_fault3]]-[[test3_begin]]
+;                   ^ offset of end of handler
+; CHECK-NEXT: .long 0
+;                   ^ type token slot (null for fault)
+; Clause 5: call f(4) is guarded by fault4
+; CHECK-NEXT: .long 4
+;                   ^ flags (4 => fault handler)
+; CHECK-NEXT: .long ([[test3_before_f4]]-[[test3_begin]])+1
+;                   ^ offset of start of clause
+; CHECK-NEXT: .long ([[test3_after_f4]]-[[test3_begin]])+1
+;                   ^ offset of end of clause
+; CHECK-NEXT: .long [[test3_fault4]]-[[test3_begin]]
+;                   ^ offset of start of handler
+; CHECK-NEXT: .long [[test3_catch1]]-[[test3_begin]]
+;                   ^ offset of end of handler
+; CHECK-NEXT: .long 0
+;                   ^ type token slot (null for fault)
+; Clause 6: call f(4) is also guarded by fault5
+;           This is a "duplicate" because the protected range (f(4))
+;           is in funclet fault3 but fault5's immediate parent
+;           is fault1, not that funclet.
+; CHECK-NEXT: .long 12
+;                   ^ flags (4 => fault handler)
+; CHECK-NEXT: .long ([[test3_before_f4]]-[[test3_begin]])+1
+;                   ^ offset of start of clause
+; CHECK-NEXT: .long ([[test3_after_f4]]-[[test3_begin]])+1
+;                   ^ offset of end of clause
+; CHECK-NEXT: .long [[test3_fault5]]-[[test3_begin]]
+;                   ^ offset of start of handler
+; CHECK-NEXT: .long [[test3_fault3]]-[[test3_begin]]
+;                   ^ offset of end of handler
+; CHECK-NEXT: .long 0
+;                   ^ type token slot (null for fault)
+; Clause 7: call f(3) is guarded by fault3
+; CHECK-NEXT: .long 4
+;                   ^ flags (4 => fault handler)
+; CHECK-NEXT: .long ([[test3_before_f3]]-[[test3_begin]])+1
+;                   ^ offset of start of clause
+; CHECK-NEXT: .long ([[test3_after_f3]]-[[test3_begin]])+1
+;                   ^ offset of end of clause
+; CHECK-NEXT: .long [[test3_fault3]]-[[test3_begin]]
+;                   ^ offset of start of handler
+; CHECK-NEXT: .long [[test3_fault2]]-[[test3_begin]]
+;                   ^ offset of end of handler
+; CHECK-NEXT: .long 0
+;                   ^ type token slot (null for fault)
+; Clause 8: call f(3) is guarded by fault5
+;           This is a "duplicate" because the protected range (f(3))
+;           is in funclet fault2 but fault5's immediate parent
+;           is fault1, not that funclet.
+; CHECK-NEXT: .long 12
+;                   ^ flags (4 => fault handler | 8 => duplicate)
+; CHECK-NEXT: .long ([[test3_before_f3]]-[[test3_begin]])+1
+;                   ^ offset of start of clause
+; CHECK-NEXT: .long ([[test3_after_f3]]-[[test3_begin]])+1
+;                   ^ offset of end of clause
+; CHECK-NEXT: .long [[test3_fault5]]-[[test3_begin]]
+;                   ^ offset of start of handler
+; CHECK-NEXT: .long [[test3_fault3]]-[[test3_begin]]
+;                   ^ offset of end of handler
+; CHECK-NEXT: .long 0
+;                   ^ type token slot (null for fault)
+; Clause 9: call f(2) is guarded by fault2
+; CHECK-NEXT: .long 4
+;                   ^ flags (4 => fault handler)
+; CHECK-NEXT: .long ([[test3_before_f2]]-[[test3_begin]])+1
+;                   ^ offset of start of clause
+; CHECK-NEXT: .long ([[test3_after_f2]]-[[test3_begin]])+1
+;                   ^ offset of end of clause
+; CHECK-NEXT: .long [[test3_fault2]]-[[test3_begin]]
+;                   ^ offset of start of handler
+; CHECK-NEXT: .long [[test3_fault1]]-[[test3_begin]]
+;                   ^ offset of end of handler
+; CHECK-NEXT: .long 0
+;                   ^ type token slot (null for fault)
+; Clause 10: call f(2) is guarded by fault5
+; CHECK-NEXT: .long 4
+;                   ^ flags (4 => fault handler)
+; CHECK-NEXT: .long ([[test3_before_f2]]-[[test3_begin]])+1
+;                   ^ offset of start of clause
+; CHECK-NEXT: .long ([[test3_after_f2]]-[[test3_begin]])+1
+;                   ^ offset of end of clause
+; CHECK-NEXT: .long [[test3_fault5]]-[[test3_begin]]
+;                   ^ offset of start of handler
+; CHECK-NEXT: .long [[test3_fault3]]-[[test3_begin]]
+;                   ^ offset of end of handler
+; CHECK-NEXT: .long 0
+;                   ^ type token slot (null for fault)