[Windows SEH]: HARDWARE EXCEPTION HANDLING (MSVC -EHa) - Part 2

[tentzen]

Summary

This patch is the Part-2 (BE LLVM) implementation of HW Exception handling.
Part-1 (FE Clang) was committed in 797ad701522988e212495285dade8efac41a24d4.

This new feature adds the support of Hardware Exception for Microsoft Windows
SEH (Structured Exception Handling).

Compiler options:
For clang-cl.exe, the option is -EHa, the same as MSVC.
For clang.exe, the extra option is -fasync-exceptions,
plus -triple x86_64-windows -fexceptions and -fcxx-exceptions as usual.

NOTE:: Without the -EHa or -fasync-exceptions, this patch is a NO-DIFF change.

The rules for C code:
For C-code, one way (MSVC approach) to achieve SEH -EHa semantic is to follow three rules:

• First, no exception can move in or out of _try region., i.e., no "potential faulty instruction can be moved across _try boundary.
• Second, the order of exceptions for instructions 'directly' under a _try must be preserved (not applied to those in callees).
• Finally, global states (local/global/heap variables) that can be read outside of _try region must be updated in memory (not just in register) before the subsequent exception occurs.

The impact to C++ code:

Although SEH is a feature for C code, -EHa does have a profound effect on C++
side. When a C++ function (in the same compilation unit with option -EHa ) is
called by a SEH C function, a hardware exception occurs in C++ code can also
be handled properly by an upstream SEH _try-handler or a C++ catch(...).
As such, when that happens in the middle of an object's life scope, the dtor
must be invoked the same way as C++ Synchronous Exception during unwinding process.

Design:

A natural way to achieve the rules above in LLVM today is to allow an EH edge
added on memory/computation instruction (previous iload/istore idea) so that
exception path is modeled in Flow graph preciously. However, tracking every
single memory instruction and potential faulty instruction can create many
Invokes, complicate flow graph and possibly result in negative performance
impact for downstream optimization and code generation. Making all
optimizations be aware of the new semantic is also substantial.

This design does not intend to model exception path at instruction level.
Instead, the proposed design tracks and reports EH state at BLOCK-level to
reduce the complexity of flow graph and minimize the performance-impact on CPP
code under -EHa option.

One key element of this design is the ability to compute State number at
block-level. Our algorithm is based on the following rationales:

A _try scope is always a SEME (Single Entry Multiple Exits) region as jumping
into a _try is not allowed. The single entry must start with a seh_try_begin()
invoke with a correct State number that is the initial state of the SEME.
Through control-flow, state number is propagated into all blocks. Side exits
marked by seh_try_end() will unwind to parent state based on existing SEHUnwindMap[].
Note side exits can ONLY jump into parent scopes (lower state number).
Thus, when a block succeeds various states from its predecessors, the lowest
State triumphs others.  If some exits flow to unreachable, propagation on those
paths terminate, not affecting remaining blocks.
For CPP code, object lifetime region is usually a SEME as SEH _try.
However there is one rare exception: jumping into a lifetime that has Dtor but
has no Ctor is warned, but allowed:

Warning: jump bypasses variable with a non-trivial destructor

In that case, the region is actually a MEME (multiple entry multiple exits).
Our solution is to inject a eha_scope_begin() invoke in the side entry block to
ensure a correct State.

Implementation:
Part-1: Clang implementation (already in):
Please see commit 797ad701522988e212495285dade8efac41a24d4).

Part-2 : LLVM implementation described below.

For both C++ & C-code, the state of each block is computed at the same place in
BE (WinEHPreparing pass) where all other EH tables/maps are calculated.
In addition to _scope_begin & _scope_end, the computation of block state also
rely on the existing State tracking code (UnwindMap and InvokeStateMap).

For both C++ & C-code, the state of each block with potential trap instruction
is marked and reported in DAG Instruction Selection pass, the same place where
the state for -EHsc (synchronous exceptions) is done.
If the first instruction in a reported block scope can trap, a Nop is injected
before this instruction. This nop is needed to accommodate LLVM Windows EH
implementation, in which the address in IPToState table is offset by +1.
(note the purpose of that is to ensure the return address of a call is in the
same scope as the call address.

The handler for catch(...) for -EHa must handle HW exception. So it is
'adjective' flag is reset (it cannot be IsStdDotDot (0x40) that only catches
C++ exceptions).
Suppress push/popTerminate() scope (from noexcept/noTHrow) so that HW
exceptions can be passed through.

Original llvm-dev [RFC] discussions can be found in these two threads below:
https://lists.llvm.org/pipermail/llvm-dev/2020-March/140541.html
https://lists.llvm.org/pipermail/llvm-dev/2020-April/141338.html

[gAlfonso-bit]

llvm/lib/Analysis/EHPersonalities.cpp

82–83 ↗

(On Diff #347591)

I would check for EHA first before checking if the personality is Asynchronous

[tentzen]

llvm/lib/Analysis/EHPersonalities.cpp

82–83 ↗

(On Diff #347591)

OK, make sense. will do.
thank you for the feedback!

[majnemer]

llvm/lib/CodeGen/AsmPrinter/AsmPrinter.cpp

1305

nit: bcause -> because

[tentzen]

Thank David.
Does anyone have any more feedbacks?
We would like to land this patch in shortly.
thanks,

[lebedev.ri]

Looks like these patches (yes, the previous one too) are failing to capture the audience;
at least from the phabricator, it doesn't look like there has been an/any substantial review. :/

[tentzen]

The previous did get lots of substantial and quality reviews (especially those from rjmccall).
Roman, you asked about LLVM design & implementation when reviewing part-1. Here you go; Do you have any feedback?
thanks,

[JosephTremoulet]

llvm/include/llvm/CodeGen/SelectionDAGISel.h

332

In the previous checkin, you went through and replaced the term EHa with asyncEH or similar in all identifiers and comments, didn't you? If so, I think it would be good to do the same with this one.

llvm/include/llvm/CodeGen/WinEHFuncInfo.h

128–132

Here you've got the signature and the name both indicating that this works at a block scope, and a comment indicating that it is for EHa. I wonder if it wouldn't be better to have the signature indicate block scope and use the name to indicate EHa, something like calculateCXXStateForAsyncEH.

llvm/include/llvm/IR/BasicBlock.h

198

To me, the word "faulty" implies that a fault definitely exists. I think that getFirstMayFaultInst, though perhaps more awkward, would be more clear.

llvm/lib/CodeGen/AsmPrinter/AsmPrinter.cpp

1305

what if the divisior is not a constant but evaluates to 0 at run-time? I assume that's handled differently, but without context I wouldn't know where, so maybe mentioning in the comment would be good.

llvm/lib/CodeGen/BranchFolding.cpp

1207

do the tests (either the new ones you're adding or existing ones) exercise the case where we need this?

llvm/lib/CodeGen/SelectionDAG/SelectionDAGBuilder.cpp

2887–2888

How do we know that this is a CleanupPad and not a Catchswitch?

llvm/lib/CodeGen/SelectionDAG/SelectionDAGISel.cpp

1325–1327

How do we know this doesn't wind back out of the block we care about? Is it worth adding an assertion?

llvm/lib/CodeGen/WinEHPrepare.cpp

253–256

I'm surprised this doesn't cause a problem for super-deep CFGs (pathological cases); consider using a worklist.

267–269

I think you're saying here that it's legal for a side exit to target a successor with any ancestor state. But also you're assigning each such successor the exact parent state of its least predecessor ("least" by comparing state numbers). How do you know that it shouldn't be the grandparent (or any other ancestor) of the least predecessor?

269

nit: should be "trumps others" or "triumphs over others"

272

Oh, I didn't notice this when I wrote the comment above. I agree with clang-tidy on this one (for both of these functions).

llvm/lib/IR/BasicBlock.cpp

212

I didn't notice when commenting on this name earlier that this method is on the IR BasicBlock class. I don't know if there's a better term to use for this than "fault". Regardless, I think it would be good to make the comment on the declaration very explicit that this checks for loads/stores (which may dereference a null pointer) and calls/invokes (which may propagate exceptions), since I don't think we have a well-defined IR concept for this particular property of those instructions. (FWIW, The last time I went looking, the closest I could find was the logic in SimplifyCFG that decides how much code it can remove before an unconditional branch to unreachable, which was open-coded.)

216

Did you mean CallBase here? This will skip InvokeInsts (and CallBrInsts).

[tentzen]

Thank Joseph's in-depth code review and many great suggestions. will work on it and reply back later..

[tentzen]

Update per Joseph Tremoulet's feedback.

[tentzen]

Joseph,
I greatly appreciate your thorough review and insightful feedbacks.
new revision is provided. also review it again.
thank you!

llvm/include/llvm/CodeGen/SelectionDAGISel.h

332

good point. done.

llvm/include/llvm/CodeGen/WinEHFuncInfo.h

128–132

yes makes sense. thanks.

llvm/lib/CodeGen/AsmPrinter/AsmPrinter.cpp

1305

as stated in last line comment, in that case the DIV will not be the first instruction in the EH region. we can skip Nop..

llvm/lib/CodeGen/BranchFolding.cpp

1207

Yes, the **Dtor one. it's how we found this bug. thanks.

llvm/lib/CodeGen/SelectionDAG/SelectionDAGBuilder.cpp

2887–2888

fixed. thanks.

llvm/lib/CodeGen/SelectionDAG/SelectionDAGISel.cpp

1325–1327

good point. fixed in the new patch.

llvm/lib/CodeGen/WinEHPrepare.cpp

253–256

done. recursion is replaced by a worklist loop..

267–269

the new state only assigned to successor when it's smaller than successor's current state. See the first line in the while loop.
if ( ... && EHInfo.BlockToStateMap[BB] <= State) ..

272

done. recursion is replaced by a worklist loop..

llvm/lib/IR/BasicBlock.cpp

212

renamed it with getFirstMayFaultInst(). also added more comments in header. thanks!

216

good catch! done.

[JosephTremoulet]

llvm/lib/CodeGen/SelectionDAG/SelectionDAGBuilder.cpp

2887–2888

Nit: variable name still indicates cleanup. I'd suggest EHPadMBB.

llvm/lib/CodeGen/WinEHPrepare.cpp

267–269

Yes I see that you're taking the state of the least connected predecessor. What I'm not following is how you know that the least connected predecessor is a sibling, rather than say a neice -- what if the sibling ends in unreached, for example? Something like:

B1: (state = 0
{ // new scope
B2: (state = 1)
  { // new scope
  B2: (state = 2)
     { // new scope
     B3: (state = 3)
        if (_) {
        B4:
            goto B7;
        }
        B5: (state = 3)
        __assume(0);
     } // exit scope
     B6: (state TBD)
  } // exit scope
 B7: (state TBD)
} // exit scope
B8: (state TBD)

And maybe optimization turned __assume(0) into unreachable and got rid of B6 entirely. So then B4 is the only predecessor of B7. Doesn't that mean we'll assign state 2 to B7? But B7 should have state 1. How do we know this doesn't happen?

[tentzen]

Hi Joseph, all good points. see replies below.
thank you!

llvm/lib/CodeGen/SelectionDAG/SelectionDAGBuilder.cpp

2887–2888

good catch. will fix it. thanks.

llvm/lib/CodeGen/WinEHPrepare.cpp

267–269

Very good point. In this case, B7 actually is a side-entry that is led by a block of seh_scope_begin() intrinsic (see CpodeGen/CGStmt.cpp change in Part-1 patch). As such, the state will be reset via EHInfo.InvokeStateMap[] when real code blocks are proceeded.

[dpaoliello]

llvm/lib/CodeGen/AsmPrinter/AsmPrinter.cpp

1686

Is this still required? LLVM is no longer adding 1 to the addresses in its SEH tables (although it does for its IP2State table).

[tentzen]

llvm/lib/CodeGen/AsmPrinter/AsmPrinter.cpp

1686

Yes, this is required. -EHa is applied to C++ code too. Without this Nop, exception occurs on the instruction immediately following an EH_LABEL won't be caught due to current "+1+offset" mechanism.

[gmh5225]

This comment was removed by gmh5225.

[gmh5225]

Code below will cause a crash.

 void
 parse()
{
    throw std::exception("throw--------");
    return;
}

 int
 main()
{
    try
    {
        parse();
    }
    catch (const std::exception &e)
    {
        printf("except=%s\n", e.what());
        // Crash when return in catch scope
        return -1;
    }

    system("pause");
    printf("end\n");
    return 0;
}

Seems that function 'EmitSehCppScopeEnd' in PopCleanupBlock can not find the insert point.
CGF.Builder.GetInsertBlock() or CGF.getInvokeDest() equals nullptr.

[tentzen]

In D102817#3350514, @gmh5225 wrote:

Code below will cause a crash.

 void
 parse()
{
    throw std::exception("throw--------");
    return;
}

 int
 main()
{
    try
    {
        parse();
    }
    catch (const std::exception &e)
    {
        printf("except=%s\n", e.what());
        // Crash when return in catch scope
        return -1;
    }

    system("pause");
    printf("end\n");
    return 0;
}

Seems that function 'EmitSehCppScopeEnd' in PopCleanupBlock can not find the insert point.
CGF.Builder.GetInsertBlock() or CGF.getInvokeDest() equals nullptr.

Sorry for late reply (thank Aaron Smith for bringing this up to my attention).
Looks like there is a corner bug in Part-1 Clang FE patch (https://reviews.llvm.org/D80344), not directly related to this LLVM part. I will look into it and work on a separate patch shortly.
thank you for trying this feature in advance.

[efriedma]

llvm/lib/CodeGen/AsmPrinter/AsmPrinter.cpp

1681

If the issue here that the "end" label for a region can accidentally include the following instruction after the region? Would it make sense to explicitly insert a nop earlier, in that case?

llvm/lib/CodeGen/SelectionDAG/SelectionDAGBuilder.cpp

3000

I assume this is trying to trick optimizations into avoiding optimizations on the cleanup block if the __try involves multiple basic blocks.

Have you considered trying to fix the control flow graph? I mean, I understand the difficulty of expressing the control flow at the IR level, given we don't have IR versions of "load" and "store" with an unwind edge, but those concerns don't really apply in the same way in a MachineFunction. You can mark the cleanup block as a successor of any block that can throw an exception, without explicitly marking up the control flow on each individual instruction. (This is how exceptions normally work.)

llvm/lib/CodeGen/SelectionDAG/SelectionDAGISel.cpp

1304

getBasicBlock() can return null, in general. Maybe since this is running during isel, that isn't an issue, though. Maybe worth adding a comment.

1322

If a load is folded into the terminator, it can fault... but I guess that's unlikely to come up in practice. The most likely scenario probably involves indirectbr. Most other indirect jumps probably aren't terminators. I guess a jump table could theoretically fault, but if you cared you could probably just disable those.

[tentzen]

llvm/lib/CodeGen/AsmPrinter/AsmPrinter.cpp

1681

I don't see the value of emitting it earlier. I think the closer to emission is safer. Or there is always a risk of being changed or reordered by other phases. Besides, there are a couple of similar cases of emitting Nop in that file (like functionPrfix). I think inserting the nop where the EH_Label is emitted is safest and most straight-forward.

llvm/lib/CodeGen/SelectionDAG/SelectionDAGBuilder.cpp

3000

The Cleanup block is turned into a dtor funclet at the end. And the beginning address of that funclet will be recorded in EH table in .xdata section. So it's really address-taken by definition. If you verify this by checking Linker relocation records or the EH table in .asm file. IMO this flag should be set regardless of the SEH feature.

llvm/lib/CodeGen/SelectionDAG/SelectionDAGISel.cpp

1304

ok, will add a comment. thanks.

1322

Right, it's unlikely in practice. I don't think it's concern here.
thank you for pointing out.

[efriedma]

llvm/lib/CodeGen/AsmPrinter/AsmPrinter.cpp

1681

Could you at least clarify the comment to clarify what aspect of the SEH region is problematic? We currently use EH_LABEL for both the beginning and end of a region, and it isn't clear which one this is meant to apply to.

llvm/lib/CodeGen/SelectionDAG/SelectionDAGBuilder.cpp

3000

That's not what "address-taken" is supposed to mean.

It's supposed to be equivalent to BasicBlock::hasAddressTaken, which means that the block is the target of a blockaddress expression (used for indirectbr). Primarily, this restricts certain optimizations because in general, we can't split a critical edge from an indirectbr.

hasAddressTaken() is not a general "will the address of the block eventually be emitted somewhere in the assembly". That can happen for a variety of unrelated reasons, including exception handling, debug info, jump tables, and branch lowering.

[JosephTremoulet]

llvm/lib/CodeGen/WinEHPrepare.cpp

267–269

I apologize for the ridiculous delay in responding, until just now I was under the mistaken impression that you hadn't replied.

I'm still confused by the logic here. Your comment states "Side exits can ONLY jump into parent scopes (lower state number)". My example had a jump to a grandparent, and you pointed out that its destination would be marked as a side entry. Are those the only two cases, would it be equally correct to say "Side exits can ONLY jump to either the immediate parent scope or a side-entry of another ancestor" ? Or is there a way to go straight to grandparent that doesn't get a side entry?

I think an equivalent question is: at the continue on line 300, could you assert EHInfo.BlockToStateMap[BB] == State || (block is side entry) ?

[tentzen]

llvm/lib/CodeGen/AsmPrinter/AsmPrinter.cpp

1681

It's for both.
EH_LABEL marks the end of the previous region and the beginning of the following region. The Nop is added to prevent a potential-faulty-instruction from being included in the previous region and to ensure this potential faulty instruction still in the present region.
Yes, I will add more comments.

llvm/lib/CodeGen/SelectionDAG/SelectionDAGBuilder.cpp

3000

I'm not sure about your interpretation. the comment of this flag from the header is:

/// Returns true if there are any uses of this basic block other than
/// direct branches, switches, etc. to it.
bool hasAddressTaken() const {
  return getBasicBlockBits().BlockAddressRefCount != 0;
}

it does include "switch" which I think refers to jump-table.
Besides, the dtor-funclet in EH table is invoked via indirectbr/indirect-call. Does not that also meet your interpretation?

llvm/lib/CodeGen/WinEHPrepare.cpp

267–269

Sorry for the confusion. the comment "jump into parent scopes" here does not imply it's the immediate parent. it can be grandparents, etc as in your example. Will fix the comment.
Those two are actually refer to the same scenario. Jumping into a protected parant/grandparent's scope induces a warning, and under that situation the target label is marked as side-entry (JumpDiagnostics.cpp change in Part-1 patch).

[efriedma]

llvm/lib/CodeGen/BranchFolding.cpp

1207

We intentionally do not check for hasAddressTaken() here. Even if something refers to the address, it's not legal to branch to the block, so it can't contain any useful instructions. AsmPrinter::emitFunctionBody has some code to print a fake label if there's a reference to an erased block.

llvm/lib/CodeGen/SelectionDAG/SelectionDAGBuilder.cpp

3000

"other than direct branches, switches, etc." means MachineBasicBlock terminators, exception pads, and jump tables. Anything which is *not* one of those, we mark up, because target-independent code can't analyze it. But in almost all cases, the above list covers basically everything except indirectbr until you get very late in the compile process.

If we do end up performing some transform that materializes the address of a block outside of the above cases, it could make sense to mark a block address-taken. (Some target-specific code does this. Not sure if that code is really doing it correctly, but none of those calls are relevant to this patch.) But we should not be preemptively marking basic block address-taken: we should wait until such a transform is actually performed.

For a dtor-funclet, we don't actually "take the address" of the funclet until the AsmPrinter, when we compute the exception tables. We could add an address-taken marking at that point... but nothing would check it that late in the pipeline.

[JosephTremoulet]

Thanks for the explanations and your patience. This patch LGTM, modulo resolution of @efriedma's concerns (so I'll leave it to him to mark accepted).

llvm/lib/CodeGen/WinEHPrepare.cpp

267–269

Jumping into a protected [ancestor scope other than the immediate parent scope] ... [can't occur unless] the target label is marked as side-entry

That is the key point I was missing. Yes, I think it would be great to include that in the comment and/or as an assertion.

a protected parant/grandparent's

What happens if an unprotected block is only reachable from side-exits of protected regions? Do we end up protecting it, and is that okay? This too would be good to include in comment.

[tentzen]

llvm/lib/CodeGen/BranchFolding.cpp

1207

Hmm, really? there are at least three places where hasAddressTaken() is used to guard optimizations in the same pass (BranchFolding.cpp). why is OptimizeBranches() special?

llvm/lib/CodeGen/SelectionDAG/SelectionDAGBuilder.cpp

3000

This is exactly the case that a target-independent code (like BranchFolding.cpp) must be aware of it.
The dtor-funclet cleanup block is genuinely address-taken the moment it's created.
Yes, it's not emitted until AsmPrinter. but it does not mean the block is not address-taken until AsmPrinter.

[efriedma]

llvm/lib/CodeGen/BranchFolding.cpp

1207

The other places in the pass are checking hasAddressTaken() to try to figure out if they can rewrite the predecessors. Here, we can trivially rewrite all the predecessors: there aren't any.

llvm/lib/CodeGen/SelectionDAG/SelectionDAGBuilder.cpp

3000

There's not really any point to arguing what the person who originally wrote the comment meant. Sorry, I shouldn't have tried to take the discussion in that direction.

But I still think this is confusing: there's multiple different use-cases smashed together into one boolean.

How about this: we split up isBlockAddressTarget(), isAsyncSEHTarget(), and maybe isMachineLabelUsed() for the target-specific stuff that messes with MachineBasicBlock labels in weird ways. And then as a transitional measure hasAddressTaken() checks all of them, maybe? Really, I expect most of the relevant places that would check hasAddressTaken(), or something like that.

Then we can go through later and refine various places to check exactly what they need. I suspect most places don't actually need all three.

[tentzen]

llvm/lib/CodeGen/SelectionDAG/SelectionDAGBuilder.cpp

3000

I feel doing that is over-engineering and I don't see much value out of it.

note that in addition to BasicBlock.h, it's also commented in MachineBasicBlock.h :

/// Test whether this block is **potentially the target of an indirect branch.**
bool hasAddressTaken() const { return AddressTaken; }

Also, some present usages are far from what you described.
See the usages in RetpolineThunkInserter where CaptureSpec and CallTarget blocks are not even address-taken.

The usage of hasAddressTaken() in this revision is much more appropriate and legitimate.

[efriedma]

llvm/lib/CodeGen/SelectionDAG/SelectionDAGBuilder.cpp

3000

Looked a bit more. It turns out there's an actual bug here: mixing up the different markings could confuse the AsmPrinter if we mix together the different bits. Posted D124697.

With that, the "MBBLabelUsed" is probably close enough to what you need, if we need something. I guess we don't really need to distinguish between the SEH uses and other target-specific uses.

I'm still not sure where, exactly, the MBB is being stored that necessitates this. If I look at an MIR dump, the only place the EHPad shows up is as a successor of the block that can throw an exception. And as far as I can tell, none of the side-tables in WinEHFuncInfo contain any references to MBBs.

[tentzen]

llvm/lib/CodeGen/SelectionDAG/SelectionDAGBuilder.cpp

3000

The EH table is named $stateUnwindMap$, the 'state' and 'action' map table. It is stored in $cppxdata$ that is the primary EH table passed to _CxxFrameHandler3/4 by __ehhandler$**. Check the new test case windows-seh-EHa-cpp-Dtors01.ll.
LLVM code that emits it is in WinException.cpp:

// UnwindMapEntry {
//   int32_t ToState;
//   void  (*Action)();
// };
if (UnwindMapXData) {
  OS.emitLabel(UnwindMapXData);
  for (const CxxUnwindMapEntry &UME : FuncInfo.CxxUnwindMap) {
    MCSymbol *CleanupSym =
        getMCSymbolForMBB(Asm, UME.Cleanup.dyn_cast<MachineBasicBlock *>());
    AddComment("ToState");
    OS.emitInt32(UME.ToState);

    AddComment("Action");
    OS.emitValue(create32bitRef(CleanupSym), 4);
  }

note getMCSymbolForMBB() that refers to the ehcleanup block we were talking about here.

[efriedma]

llvm/lib/CodeGen/BranchFolding.cpp

1207

I guess given that we have references to an MBB stored in FuncInfo, we can't really delete the block. So I guess this is right, sort of. But it would still be undefined behavior to jump to it, so I'm not sure this really solves whatever problem you ran into.

llvm/lib/CodeGen/SelectionDAG/SelectionDAGBuilder.cpp

3000

I was more concerned about the other end of it... but looking into it, I guess FunctionLoweringInfo::set() is actually where we end up computing the mapping. So we need to ensure that the FuncInfo tables stay consistent through the entirety of codegen. Which seems like an extreme restriction, but I guess it's unlikely to matter that much in practice.

[tentzen]

llvm/lib/CodeGen/BranchFolding.cpp

1207

it's MBB.pred_empty(), so there is no edge jumping to it.
Without this change, an EH Cleanuppad block could be removed and EH runtime would not be able to dtor a live object during unwinding.

llvm/lib/CodeGen/SelectionDAG/SelectionDAGBuilder.cpp

3000

the FuncInfo and its related tables is the existent framework that handles EH.
Yes, I'm sure it is reliable and consistent with IR or C++ EH today would not be working at all.
This patch is adding SEH support that is built on top of existent EH framework.

[efriedma]

llvm/lib/CodeGen/BranchFolding.cpp

1207

That's a contradiction: you're saying there's no edge jumping to it, but somehow the "EH runtime" is executing the code in the block.

In particular, even if you preserve the block, anything involving dominance relationships, like register allocation, is likely to destroy unreachable code. Maybe you can sort of get away with it in trivial cases.

[tentzen]

llvm/lib/CodeGen/BranchFolding.cpp

1207

I meant no edge jumps into it through IR's control flow graph during compilation. EH runtime invokes it via an indirect branch during execution time.

It's the whole point of 'address-taken' attribute; it tells optimizations/transformations that although this block is unreached via IR control flow, its address is taken and runtime (or some other code) can invoke this block via an indirect branch.

Register-allocation, or and all other optimizations (like this BranchFolding) should check whether or not it's address-taken before optimizing it away.
If more cases are revealed, we should fix them. 'Retpoline' and other code are also relying on this flag to guard an unreachable block.

[efriedma]

llvm/lib/CodeGen/BranchFolding.cpp

1207

I think you're misunderstanding what I mean by "control flow graph".

Every MachineBasicBlock has a "successor" list, and a "predecessor" list. These can be accessed by MachineBasicBlock::successors() and MachineBasicBlock::predecessors(). MachineBasicBlock::pred_empty() queries the predecessor list. This isn't directly tied to any instructions in the block itself; they're just std::vector<MachineBasicBlock*>. But they reflect the possible directions for control flow. For example, suppose you have an indirectbr. This gets lowered to an indirect jump instruction; none of the destinations are directly encoded into the basic block. However, the block has a successor list; the jump must jump to one of those successors, or the behavior is undefined. And the destination has a predecessor list; the block with the indirectbr must be in that list.

This is a bit different from LLVM IR, where every control flow edge is explicitly attached to a terminator instruction.

This successor list is essential to the way MachineFunction IR works. Before register allocation, the IR is in SSA form; computing where an SSA value is live requires an accurate control flow graph.

If the EH runtime is jumping to a MachineBasicBlock with no predecessors, that means there's a missing call to MachineBasicBlock::addSuccessor() somewhere.

[tentzen]

llvm/lib/CodeGen/BranchFolding.cpp

1207

For Switch jump table, yes, pred. & succ. lists are well maintained because they are real control-flow.

We are talking about EH unwinding flow here. EH runtime cannot be in the list. it's why we rely on address-taken flag to convey this scenario to optimizations.

[efriedma]

llvm/lib/CodeGen/BranchFolding.cpp

1207

We model EH unwinding flow similarly to any other control flow. Take the following example:

echo "struct A {~A(); }; void f(); void g() { A a; f(); }" | clang++ --target=x86_64-pc-windows-msvc -x c++ - -o - -S -mllvm -stop-before=greedy

This dumps the MIR as it appears during register allocation. If you look at the output, it contains:

bb.0.entry:
  successors: %bb.1(0x40000000), %bb.2(0x40000000)

bb.1 is the normal continuation, bb.2 is the cleanuppad. bb.2 isn't directly reachable; the only way to jump to the block is through the exception unwinder. But we still model the edge.

[tentzen]

llvm/lib/CodeGen/BranchFolding.cpp

1207

Yes, we all know that. that is the whole point of this design.
For Asynch Exception, this design only tracks EH state at scope (or block) level, not at instruction level. As such, after seh-scope-intrinsic is lowered, the design relies on address-taken flag to guard ehcleanup pads.
Please review the design on the top.

[efriedma]

llvm/lib/CodeGen/BranchFolding.cpp

1207

The reason we agreed not to track the control flow per-instruction at the LLVM IR level is the difficulty of adding the control flow edges: it would require a completely different form of control flow modelling to attach an exception edge to an LLVM IR load instruction. So we use an approximation: controlflow uses the edge encoded on the nearest llvm.seh.try.begin().

We don't need to use the same tradeoff here, though. Control flow doesn't work the same way on MachineBasicBlocks as it does on LLVM IR. We should decide the best way to model the control flow based on the constructs available, independent of what we decided for LLVM IR.

As far as I can tell, there isn't any reason you can't just mark the appropriate edges explicitly.

Alternatively, you could lower llvm.seh.try.begin to a pseudo-instruction, and mark the edge from that instruction to the exception-handling block, the same way we do it on LLVM IR. The control flow in that case wouldn't be precisely correct, but it would be close enough that you can make it work. I don't see any reason to prefer that approach, though.

Depending purely on the address-taken flag to preserve a block with no predecessors isn't ever going to work well; it's incompatible with how the backend reasons about control flow and liveness.

[tentzen]

llvm/lib/CodeGen/BranchFolding.cpp

1207

Good to know there is no disagreement about tracking at seh-scope level, not at instruction level.
Good to know you also don't think there is any reason to continue modeling EH flow at scope-level after LLVM IR Lowering.

I agree that address-taken mechanism is not perfect. but it's an existent mechanism in LLVM framework. As said earlier, it's used in many places today. IMO, it's robust and well-understood mechanism employed in several compiler code based (LLVM is 4th one I experienced). In compiler & code-gen space, when we see address-taken, we all know what the implication is.

This revision is about SEH. Any concern or opinion about an existent framework should be resolved in a separate patch.

[efriedma]

I don't think the current patch makes sense, and I'm not sure how else to explain my concerns. Maybe a different perspective would be helpful; please start a thread on Discourse.

[tentzen]

Hey Eli, I agree that address-taken is not perfect, but I’m not sure I have any better ideas right now. Maybe @rnk and @JosephTremoulet have thoughts?’

[belliash]

In D102817#3457704, @tentzen wrote:

In D102817#3350514, @gmh5225 wrote:

Code below will cause a crash.

 void
 parse()
{
    throw std::exception("throw--------");
    return;
}

 int
 main()
{
    try
    {
        parse();
    }
    catch (const std::exception &e)
    {
        printf("except=%s\n", e.what());
        // Crash when return in catch scope
        return -1;
    }

    system("pause");
    printf("end\n");
    return 0;
}

Seems that function 'EmitSehCppScopeEnd' in PopCleanupBlock can not find the insert point.
CGF.Builder.GetInsertBlock() or CGF.getInvokeDest() equals nullptr.

Sorry for late reply (thank Aaron Smith for bringing this up to my attention).
Looks like there is a corner bug in Part-1 Clang FE patch (https://reviews.llvm.org/D80344), not directly related to this LLVM part. I will look into it and work on a separate patch shortly.
thank you for trying this feature in advance.

What is the current status of this fix?

[tentzen]

What is the current status of this fix?

I'm waiting for Eli's https://reviews.llvm.org/D124697/new/ to land in first so I can submit a revision that uses new AddressTaken flag as requested.
After this patch is landed and SEH HW feature is really completed, I'll work on that bug.
Thank you for being patient.

[jyu2]

Hi @tentzen,
Any updates on this patch? Would like to see it moving forward.
We have customer trying to use clang on window which depend on asynchronous exception.
Thanks!
Jennifer

[tentzen]

Per Eli Friedman's feedback, replace MBB->hasAddressTaken() with new MBB->isMachineBlockAddressTaken()

[jyu2]

Hi,
Any update? I did run time test for a simple test, it works for me.

Thanks.
Jennifer

[pengfei]

Reverse ping @tentzen. Is there any block issues for it moving on? I don't see serious from a quick review, just some nits.

llvm/lib/CodeGen/AsmPrinter/AsmPrinter.cpp

1677

duplicated.

1685

Check for call instructions?

llvm/lib/CodeGen/AsmPrinter/WinException.cpp

766

Check it in test case?

llvm/lib/CodeGen/SelectionDAG/SelectionDAGBuilder.cpp

2999–3000

The comment format seems uncommon, reformat it?

llvm/lib/CodeGen/SelectionDAG/SelectionDAGISel.cpp

1302

It's more preferred to use .. E = MF->end(); MBBI != E; ..

1306

Any reason this has to be done in SelectionDAGISel. If we do it after ISel, we can check mayRaiseFPException for FP instructions too.

1315–1316

Is there any chance a terminator will raise exception?
If we don't emit begin/end labels, why adding them to EHInfo by line 1297?

1322–1324

You can use getFirstTerminator.

llvm/lib/CodeGen/WinEHPrepare.cpp

232

Didn't see its free. Would there be memory leak?

254–256

There are many function calls, would be better to simplify to

if (Fn && Fn->isIntrinsic()) {
  Intrinsic::ID IID = Fn->getIntrinsicID();
  if (IID == ...)

270

ditto.

llvm/lib/IR/BasicBlock.cpp

212

We'd better use machine instruction infos.

llvm/test/CodeGen/X86/windows-seh-EHa-CppCatchDotDotDot.ll

291

This is useless and misleading. Ditto for other tests.

[tentzen]

In D102817#3910700, @pengfei wrote:

Reverse ping @tentzen. Is there any block issues for it moving on? I don't see serious from a quick review, just some nits.

All issues had been addressed. Just need an approval.

[efriedma]

LGTM with @pengfei 's comments addressed.

[tentzen]

llvm/lib/CodeGen/AsmPrinter/AsmPrinter.cpp

1677

good eyes. thanks.

1685

SEH HW exception will be caught in callee. No need to inject a nop before the call

llvm/lib/CodeGen/AsmPrinter/WinException.cpp

766

yes, without this change, tests will fail

llvm/lib/CodeGen/SelectionDAG/SelectionDAGISel.cpp

1302

ok.

1306

It's convenient and a natural place to do this table. It's already at the end of DAGISel.
If we are still missing some features, I prefer a follow-up patch. This patch has been tested and proved robust.

1315–1316

No. terminator won't raise exception.
Good catch, will move them to the top of that block to avoid unused IPToState entry.

1322–1324

I think I did it once. the reason getFirstTerminator() not used is that there could be real instructions between 1st and 2nd terminator. it's being a while, don't remember exactly. I think it's better not changing it now. this is minor anyways.

llvm/lib/CodeGen/WinEHPrepare.cpp

254–256

it does not really matter as duplicated Fn->getIntrinsicID() will be CSEed away

270

ditto.

llvm/lib/IR/BasicBlock.cpp

212

this is the style copied from neighborhood code. do you see any problem or potential bug?

llvm/test/CodeGen/X86/windows-seh-EHa-CppCatchDotDotDot.ll

291

this is testing SEH related table and flag is put properly.
which part is misleading?

[tentzen]

update per review feedbacks

[pengfei]

llvm/lib/CodeGen/WinEHPrepare.cpp

270

Still not see where it been freed. Should we push the object instead?

llvm/lib/IR/BasicBlock.cpp

212

I'm concerned about the FP exceptions as explained above. Especially FP instructions are more target specific, e.g., given an integet to FP conversion, CVTDQ2PD doesn't raise any FP exception but CVTDQ2PS does.
But I'm fine to improve it in a follow up.

llvm/test/CodeGen/X86/windows-seh-EHa-CppCatchDotDotDot.ll

291

I mean the !2 = !{!"clang version 11.0.0 ...

[tentzen]

llvm/lib/CodeGen/WinEHPrepare.cpp

270

Oh, my overlooked. done.

llvm/lib/IR/BasicBlock.cpp

212

ok, thanks.

llvm/test/CodeGen/X86/windows-seh-EHa-CppCatchDotDotDot.ll

291

I see. done.

[tentzen]

update per Pengfei's review feedbacks.

[pengfei]

Thanks @tentzen ! This patch LGTM. Please wait a few days for other reviewers.

[pengfei]

One question: Is the comment still true with this patch? https://github.com/llvm/llvm-project/blob/main/llvm/lib/Target/X86/X86AsmPrinter.cpp#L807C55-L808

[tentzen]

In D102817#3921362, @pengfei wrote:

One question: Is the comment still true with this patch? https://github.com/llvm/llvm-project/blob/main/llvm/lib/Target/X86/X86AsmPrinter.cpp#L807C55-L808

Yes, it's true. this patch is targeting X86_64 only, not including X86 yet.
X86 EH mechanism is different, it's dynamic State tracking, not static PC-table based as X64, AArch64, etc.

[pengfei]

In D102817#3922951, @tentzen wrote:

In D102817#3921362, @pengfei wrote:

One question: Is the comment still true with this patch? https://github.com/llvm/llvm-project/blob/main/llvm/lib/Target/X86/X86AsmPrinter.cpp#L807C55-L808

Yes, it's true. this patch is targeting X86_64 only, not including X86 yet.
X86 EH mechanism is different, it's dynamic State tracking, not static PC-table based as X64, AArch64, etc.

Got it, thank you!

[pengfei]

Ping @tentzen @efriedma. LLVM 16.0 will be branched this month. Should we consider to land this patch to the release?

[lebedev.ri]

Was this change not committed? Why is this review still open?

[efriedma]

Not merged yet.

[lebedev.ri]

In D102817#4050181, @efriedma wrote:

Not merged yet.

It was in 1a949c871ab4a6b6d792849d3e8c0fa6958d27f5, but then reverted in db6a979ae82410e42430e47afa488936ba8e3025.

[victork1996]

Hi @tentzen :)
I compiled clang's main branch after applying these changes, and I think I found a bug.
I tried to compile the following code with the "-fasync-exceptions" flag and the compiler crashed :(
can you take a look?

void foo()
{
    try
    {}
    catch (...)
    {
        // The 'return' statement causes a crash, it compiles just fine without the 'return'.
        return;
    }
}

thanks :)

[nickdesaulniers]

llvm/lib/CodeGen/BranchFolding.cpp

1207

If the EH runtime is jumping to a MachineBasicBlock with no predecessors, that means there's a missing call to MachineBasicBlock::addSuccessor() somewhere.

I agree with @efriedma here. Even for indirectbr, we still correctly model successor and predecessor lists. Having those be imprecise or omit edges (whether direct or indirect) is asking for trouble.

[bowang]

Any updates on when this change can land? Really look forward to LLVM's support for SEH. My project got stuck with MVSC due to this missing capability.

[pengfei]

FYI, I just got in touch with @tentzen. He is not working with this now, but he said the revert is just a mistake.
I suggest we reland it as is if no strong objections from other reviewers.
We have customers that looking forward to it as well. I'd like to work with community for the followups.

[pengfei]

In D102817#4079631, @victork1996 wrote:

Hi @tentzen :)
I compiled clang's main branch after applying these changes, and I think I found a bug.
I tried to compile the following code with the "-fasync-exceptions" flag and the compiler crashed :(
can you take a look?

void foo()
{
    try
    {}
    catch (...)
    {
        // The 'return' statement causes a crash, it compiles just fine without the 'return'.
        return;
    }
}

thanks :)

I can fix the crash by D147165, but I don't have confidence whether the codegen is expected or not. Please take a look, thanks!

[hexhexd]

Hello,

I'm trying to move our code base from using ancient LLVM 11 to main branch LLVM. I experienced clang crashes with below messages while using an assert enabled LLVM build. The problem goes away if I remove /EHa from our cmake.

A single unwind edge may only enter one EH pad
  invoke void @llvm.seh.scope.end()
          to label %"??1?$_Compressed_pair@V?$allocator@D@std@@V?$_String_val@U?$_Simple_types@D@std@@@2@$00@std@@[e-mail]6.i" unwind label %ehcleanup.i5.i, !dbg !4121
in function ??1CrashdumpCollecter@debugging@skyfall@@QEAA@XZ
fatal error: error in backend: Broken function found, compilation aborted!

The crash happened in

#6 0x00007ff76757bf80 `anonymous namespace'::VerifierLegacyPass::runOnFunction C:\dev\llvm-project\llvm\lib\IR\Verifier.cpp:6532:0

[pengfei]

In D102817#4279048, @hexhexd wrote:

Hello,

I'm trying to move our code base from using ancient LLVM 11 to main branch LLVM. I experienced clang crashes with below messages while using an assert enabled LLVM build. The problem goes away if I remove /EHa from our cmake.

A single unwind edge may only enter one EH pad
  invoke void @llvm.seh.scope.end()
          to label %"??1?$_Compressed_pair@V?$allocator@D@std@@V?$_String_val@U?$_Simple_types@D@std@@@2@$00@std@@[e-mail]6.i" unwind label %ehcleanup.i5.i, !dbg !4121
in function ??1CrashdumpCollecter@debugging@skyfall@@QEAA@XZ
fatal error: error in backend: Broken function found, compilation aborted!

The crash happened in

#6 0x00007ff76757bf80 `anonymous namespace'::VerifierLegacyPass::runOnFunction C:\dev\llvm-project\llvm\lib\IR\Verifier.cpp:6532:0

I observed same failure in our internal testing. I'm looking into it. In the meanwhile, I think you can remove /EHa as a workaround. The option was a dumb without this patch.

llvm/include/llvm/CodeGen/SelectionDAGISel.h

private:
 
   void pushStackMapLiveVariable(SmallVectorImpl<SDValue> &Ops, SDValue Operand,
                                 SDLoc DL);
   void Select_STACKMAP(SDNode *N);
   void Select_PATCHPOINT(SDNode *N);
 
 private:
   void DoInstructionSelection();
   SDNode *MorphNode(SDNode *Node, unsigned TargetOpc, SDVTList VTList,
                     ArrayRef<SDValue> Ops, unsigned EmitNodeInfo);
 
   /// Prepares the landing pad to take incoming values or do other EH
   /// personality specific tasks. Returns true if the block should be
   /// instruction selected, false if no code should be emitted for it.
   bool PrepareEHLandingPad();
 
+  // Mark and Report IPToState for each Block under AsynchEH
+  void reportIPToStateForBlocks(MachineFunction *Fn);
+
   /// Perform instruction selection on all basic blocks in the function.
   void SelectAllBasicBlocks(const Function &Fn);
 
   /// Perform instruction selection on a single basic block, for
   /// instructions between \p Begin and \p End.  \p HadTailCall will be set
   /// to true if a call in the block was translated as a tail call.
   void SelectBasicBlock(BasicBlock::const_iterator Begin,
                         BasicBlock::const_iterator End,

llvm/include/llvm/CodeGen/WinEHFuncInfo.h

struct ClrEHUnwindMapEntry {
   ClrHandlerType HandlerType;
 };
 
 struct WinEHFuncInfo {
   DenseMap<const Instruction *, int> EHPadStateMap;
   DenseMap<const FuncletPadInst *, int> FuncletBaseStateMap;
   DenseMap<const InvokeInst *, int> InvokeStateMap;
   DenseMap<MCSymbol *, std::pair<int, MCSymbol *>> LabelToStateMap;
+  DenseMap<const BasicBlock *, int> BlockToStateMap; // for AsynchEH
   SmallVector<CxxUnwindMapEntry, 4> CxxUnwindMap;
   SmallVector<WinEHTryBlockMapEntry, 4> TryBlockMap;
   SmallVector<SEHUnwindMapEntry, 4> SEHUnwindMap;
   SmallVector<ClrEHUnwindMapEntry, 4> ClrEHUnwindMap;
   int UnwindHelpFrameIdx = std::numeric_limits<int>::max();
   int PSPSymFrameIdx = std::numeric_limits<int>::max();
 
   int getLastStateNumber() const { return CxxUnwindMap.size() - 1; }
 
   void addIPToStateRange(const InvokeInst *II, MCSymbol *InvokeBegin,
                          MCSymbol *InvokeEnd);
 
+  void addIPToStateRange(int State, MCSymbol *InvokeBegin, MCSymbol *InvokeEnd);
+
   int EHRegNodeFrameIndex = std::numeric_limits<int>::max();
   int EHRegNodeEndOffset = std::numeric_limits<int>::max();
   int EHGuardFrameIndex = std::numeric_limits<int>::max();
   int SEHSetFrameOffset = std::numeric_limits<int>::max();
 
   WinEHFuncInfo();
 };
 
 /// Analyze the IR in ParentFn and it's handlers to build WinEHFuncInfo, which
 /// describes the state numbers and tables used by __CxxFrameHandler3. This
 /// analysis assumes that WinEHPrepare has already been run.
 void calculateWinCXXEHStateNumbers(const Function *ParentFn,
                                    WinEHFuncInfo &FuncInfo);
 
 void calculateSEHStateNumbers(const Function *ParentFn,
                               WinEHFuncInfo &FuncInfo);
 
 void calculateClrEHStateNumbers(const Function *Fn, WinEHFuncInfo &FuncInfo);
 
+// For AsynchEH (VC++ option -EHa)
+void calculateCXXStateForAsynchEH(const BasicBlock *BB, int State,
+                                  WinEHFuncInfo &FuncInfo);
+void calculateSEHStateForAsynchEH(const BasicBlock *BB, int State,
+                                  WinEHFuncInfo &FuncInfo);
+
 } // end namespace llvm
 
 #endif // LLVM_CODEGEN_WINEHFUNCINFO_H

llvm/include/llvm/IR/BasicBlock.h

public:
   getFirstNonPHIOrDbgOrLifetime(bool SkipPseudoOp = true) const;
   Instruction *getFirstNonPHIOrDbgOrLifetime(bool SkipPseudoOp = true) {
     return const_cast<Instruction *>(
         static_cast<const BasicBlock *>(this)->getFirstNonPHIOrDbgOrLifetime(
             SkipPseudoOp));
   }
 
   /// Returns an iterator to the first instruction in this block that is
   /// suitable for inserting a non-PHI instruction.
   ///
   /// In particular, it skips all PHIs and LandingPad instructions.
   const_iterator getFirstInsertionPt() const;
   iterator getFirstInsertionPt() {
     return static_cast<const BasicBlock *>(this)
                                           ->getFirstInsertionPt().getNonConst();
   }
 
   /// Returns an iterator to the first instruction in this block that is
   /// not a PHINode, a debug intrinsic, a static alloca or any pseudo operation.
   const_iterator getFirstNonPHIOrDbgOrAlloca() const;
   iterator getFirstNonPHIOrDbgOrAlloca() {
     return static_cast<const BasicBlock *>(this)
         ->getFirstNonPHIOrDbgOrAlloca()
         .getNonConst();
   }
 
+  /// Returns the first potential AsynchEH faulty instruction
+  /// currently it checks for loads/stores (which may dereference a null
+  /// pointer) and calls/invokes (which may propagate exceptions)
+  const Instruction* getFirstMayFaultInst() const;
+  Instruction* getFirstMayFaultInst() {
+      return const_cast<Instruction*>(
+          static_cast<const BasicBlock*>(this)->getFirstMayFaultInst());
+  }
+
   /// Return a const iterator range over the instructions in the block, skipping
   /// any debug instructions. Skip any pseudo operations as well if \c
   /// SkipPseudoOp is true.
   iterator_range<filter_iterator<BasicBlock::const_iterator,
                                  std::function<bool(const Instruction &)>>>
   instructionsWithoutDebug(bool SkipPseudoOp = true) const;
 
   /// Return an iterator range over the instructions in the block, skipping any

llvm/lib/CodeGen/AsmPrinter/AsmPrinter.cpp

void AsmPrinter::emitCFIInstruction(const MachineInstr &MI) {
   ExceptionHandling ExceptionHandlingType = MAI->getExceptionHandlingType();
   if (!needsCFIForDebug() &&
       ExceptionHandlingType != ExceptionHandling::DwarfCFI &&
       ExceptionHandlingType != ExceptionHandling::ARM)
     return;
 
   if (getFunctionCFISectionType(*MF) == CFISection::None)
     return;
 
   // If there is no "real" instruction following this CFI instruction, skip
   // emitting it; it would be beyond the end of the function's FDE range.
   auto *MBB = MI.getParent();
   auto I = std::next(MI.getIterator());
   while (I != MBB->end() && I->isTransient())
     ++I;
   if (I == MBB->instr_end() &&
       MBB->getReverseIterator() == MBB->getParent()->rbegin())
if (!MLI) {
       OwnedMLI->getBase().analyze(MDT->getBase());
       MLI = OwnedMLI.get();
     }
   }
 
   // Print out code for the function.
   bool HasAnyRealCode = false;
   int NumInstsInFunction = 0;
+  bool IsEHa = MMI->getModule()->getModuleFlag("eh-asynch");
 
   bool CanDoExtraAnalysis = ORE->allowExtraAnalysis(DEBUG_TYPE);
   for (auto &MBB : *MF) {
     // Print a label for the basic block.
     emitBasicBlockStart(MBB);
     DenseMap<StringRef, unsigned> MnemonicCounts;
     for (auto &MI : MBB) {
       // Print the assembly for the instruction.
for (auto &MI : MBB) {
       switch (MI.getOpcode()) {
       case TargetOpcode::CFI_INSTRUCTION:
         emitCFIInstruction(MI);
         break;
       case TargetOpcode::LOCAL_ESCAPE:
         emitFrameAlloc(MI);
         break;
       case TargetOpcode::ANNOTATION_LABEL:
-      case TargetOpcode::EH_LABEL:
       case TargetOpcode::GC_LABEL:
         OutStreamer->emitLabel(MI.getOperand(0).getMCSymbol());
         break;
+      case TargetOpcode::EH_LABEL:
+        OutStreamer->emitLabel(MI.getOperand(0).getMCSymbol());
+        // For AsynchEH, insert a Nop if followed by a trap inst
+        //   Or the exception won't be caught.
+        //   (see MCConstantExpr::create(1,..) in WinException.cpp)
+        //  Ignore SDiv/UDiv because a DIV with Const-0 divisor
+        //    must have being turned into an UndefValue.
+        //  Div with variable opnds won't be the first instruction in
+        //  an EH region as it must be led by at least a Load
+        {
+          auto MI2 = std::next(MI.getIterator());
+          if (IsEHa && MI2 != MBB.end() &&
+              (MI2->mayLoadOrStore() || MI2->mayRaiseFPException()))
+            emitNops(1);
+        }
+        break;
       case TargetOpcode::INLINEASM:
       case TargetOpcode::INLINEASM_BR:
         emitInlineAsm(&MI);
         break;
       case TargetOpcode::DBG_VALUE:
       case TargetOpcode::DBG_VALUE_LIST:
         if (isVerbose()) {
           if (!emitDebugValueComment(&MI, *this))

llvm/lib/CodeGen/AsmPrinter/WinException.cpp

if (Asm->MAI->usesWindowsCFI() &&
     AddComment("UnwindHelp");
     OS.emitInt32(UnwindHelpOffset);
   }
 
   AddComment("ESTypeList");
   OS.emitInt32(0);
 
   AddComment("EHFlags");
+  if (MMI->getModule()->getModuleFlag("eh-asynch")) {
+    OS.emitInt32(0);
+  } else {
     OS.emitInt32(1);
+  }
 
   // UnwindMapEntry {
   //   int32_t ToState;
   //   void  (*Action)();
   // };
   if (UnwindMapXData) {
     OS.emitLabel(UnwindMapXData);
     for (const CxxUnwindMapEntry &UME : FuncInfo.CxxUnwindMap) {

llvm/lib/CodeGen/BranchFolding.cpp

bool BranchFolder::OptimizeBranches(MachineFunction &MF) {
 
   // Make sure blocks are numbered in order
   MF.RenumberBlocks();
   // Renumbering blocks alters EH scope membership, recalculate it.
   EHScopeMembership = getEHScopeMembership(MF);
 
   for (MachineBasicBlock &MBB :
        llvm::make_early_inc_range(llvm::drop_begin(MF))) {
     MadeChange |= OptimizeBlock(&MBB);
 
     // If it is dead, remove it.
-    if (MBB.pred_empty()) {
+    if (MBB.pred_empty() && !MBB.isMachineBlockAddressTaken()) {
       RemoveDeadBlock(&MBB);
       MadeChange = true;
       ++NumDeadBlocks;
     }
   }
 
   return MadeChange;
 }

llvm/lib/CodeGen/SelectionDAG/SelectionDAGBuilder.cpp

void SelectionDAGBuilder::visitBitTestHeader(BitTestBlock &B,
   SDValue CopyTo = DAG.getCopyToReg(getControlRoot(), dl, B.Reg, Sub);
 
   MachineBasicBlock* MBB = B.Cases[0].ThisBB;
 
   if (!B.FallthroughUnreachable)
     addSuccessorWithProb(SwitchBB, B.Default, B.DefaultProb);
   addSuccessorWithProb(SwitchBB, MBB, B.Prob);
   SwitchBB->normalizeSuccProbs();
 
   SDValue Root = CopyTo;
   if (!B.FallthroughUnreachable) {
     // Conditional branch to the default block.
     SDValue RangeCmp = DAG.getSetCC(dl,
         TLI.getSetCCResultType(DAG.getDataLayout(), *DAG.getContext(),
                                RangeSub.getValueType()),
         RangeSub, DAG.getConstant(B.Range, dl, RangeSub.getValueType()),
         ISD::SETUGT);
 

 
 void SelectionDAGBuilder::visitInvoke(const InvokeInst &I) {
   MachineBasicBlock *InvokeMBB = FuncInfo.MBB;
 
   // Retrieve successors. Look through artificial IR level blocks like
   // catchswitch for successors.
   MachineBasicBlock *Return = FuncInfo.MBBMap[I.getSuccessor(0)];
   const BasicBlock *EHPadBB = I.getSuccessor(1);
+  MachineBasicBlock *EHPadMBB = FuncInfo.MBBMap[EHPadBB];
 
   // Deopt bundles are lowered in LowerCallSiteWithDeoptBundle, and we don't
   // have to do anything here to lower funclet bundles.
   assert(!I.hasOperandBundlesOtherThan(
              {LLVMContext::OB_deopt, LLVMContext::OB_gc_transition,
               LLVMContext::OB_gc_live, LLVMContext::OB_funclet,
               LLVMContext::OB_cfguardtarget,
               LLVMContext::OB_clang_arc_attachedcall}) &&
          "Cannot lower invokes with arbitrary operand bundles yet!");
 
   const Value *Callee(I.getCalledOperand());
   const Function *Fn = dyn_cast<Function>(Callee);
   if (isa<InlineAsm>(Callee))
     visitInlineAsm(I, EHPadBB);
   else if (Fn && Fn->isIntrinsic()) {
     switch (Fn->getIntrinsicID()) {
     default:
       llvm_unreachable("Cannot invoke this intrinsic");
     case Intrinsic::donothing:
       // Ignore invokes to @llvm.donothing: jump directly to the next BB.
     case Intrinsic::seh_try_begin:
     case Intrinsic::seh_scope_begin:
     case Intrinsic::seh_try_end:
     case Intrinsic::seh_scope_end:
+      if (EHPadMBB)
+          // a block referenced by EH table
+          // so dtor-funclet not removed by opts
+          EHPadMBB->setMachineBlockAddressTaken();
       break;
     case Intrinsic::experimental_patchpoint_void:
     case Intrinsic::experimental_patchpoint_i64:
       visitPatchpoint(I, EHPadBB);
       break;
     case Intrinsic::experimental_gc_statepoint:
       LowerStatepoint(cast<GCStatepointInst>(I), EHPadBB);
       break;

llvm/lib/CodeGen/SelectionDAG/SelectionDAGISel.cpp

 #include "llvm/CodeGen/StackMaps.h"
 #include "llvm/CodeGen/StackProtector.h"
 #include "llvm/CodeGen/SwiftErrorValueTracking.h"
 #include "llvm/CodeGen/TargetInstrInfo.h"
 #include "llvm/CodeGen/TargetLowering.h"
 #include "llvm/CodeGen/TargetRegisterInfo.h"
 #include "llvm/CodeGen/TargetSubtargetInfo.h"
 #include "llvm/CodeGen/ValueTypes.h"
+#include "llvm/CodeGen/WinEHFuncInfo.h"
 #include "llvm/IR/BasicBlock.h"
 #include "llvm/IR/Constants.h"
 #include "llvm/IR/DataLayout.h"
 #include "llvm/IR/DebugInfo.h"
 #include "llvm/IR/DebugInfoMetadata.h"
 #include "llvm/IR/DebugLoc.h"
 #include "llvm/IR/DiagnosticInfo.h"
 #include "llvm/IR/EHPersonalities.h"
if (Pers == EHPersonality::Wasm_CXX) {
     // Mark exception selector register as live in.
     if (unsigned Reg = TLI->getExceptionSelectorRegister(PersonalityFn))
       FuncInfo->ExceptionSelectorVirtReg = MBB->addLiveIn(Reg, PtrRC);
   }
 
   return true;
 }
 
+// Mark and Report IPToState for each Block under IsEHa
+void SelectionDAGISel::reportIPToStateForBlocks(MachineFunction *MF) {
+  MachineModuleInfo &MMI = MF->getMMI();
+  llvm::WinEHFuncInfo *EHInfo = MF->getWinEHFuncInfo();
+  if (!EHInfo)
+    return;
+  for (auto MBBI = MF->begin(), E = MF->end(); MBBI != E; ++MBBI) {
+    MachineBasicBlock *MBB = &*MBBI;
+    const BasicBlock *BB = MBB->getBasicBlock();
+    int State = EHInfo->BlockToStateMap[BB];
+    if (BB->getFirstMayFaultInst()) {
+      // Report IP range only for blocks with Faulty inst
+      auto MBBb = MBB->getFirstNonPHI();
+      MachineInstr *MIb = &*MBBb;
+      if (MIb->isTerminator())
+        continue;
+
+      // Insert EH Labels
+      MCSymbol *BeginLabel = MMI.getContext().createTempSymbol();
+      MCSymbol *EndLabel = MMI.getContext().createTempSymbol();
+      EHInfo->addIPToStateRange(State, BeginLabel, EndLabel);
+      BuildMI(*MBB, MBBb, SDB->getCurDebugLoc(),
+              TII->get(TargetOpcode::EH_LABEL))
+          .addSym(BeginLabel);
+      auto MBBe = MBB->instr_end();
+      MachineInstr *MIe = &*(--MBBe);
+      // insert before (possible multiple) terminators
+      while (MIe->isTerminator())
+        MIe = &*(--MBBe);
+      ++MBBe;
+      BuildMI(*MBB, MBBe, SDB->getCurDebugLoc(),
+              TII->get(TargetOpcode::EH_LABEL))
+          .addSym(EndLabel);
+    }
+  }
+}
+
 /// isFoldedOrDeadInstruction - Return true if the specified instruction is
 /// side-effect free and is either dead or folded into a generated instruction.
 /// Return false if it needs to be emitted.
 static bool isFoldedOrDeadInstruction(const Instruction *I,
                                       const FunctionLoweringInfo &FuncInfo) {
   return !I->mayWriteToMemory() && // Side-effecting instructions aren't folded.
          !I->isTerminator() &&     // Terminators aren't folded.
          !isa<DbgInfoIntrinsic>(I) && // Debug instructions aren't folded.
for (const BasicBlock *LLVMBB : RPOT) {
 
     if (FastIS)
       FastIS->finishBasicBlock();
     FinishBasicBlock();
     FuncInfo->PHINodesToUpdate.clear();
     ElidedArgCopyInstrs.clear();
   }
 
+  // AsynchEH: Report Block State under -AsynchEH
+  if (Fn.getParent()->getModuleFlag("eh-asynch"))
+    reportIPToStateForBlocks(MF);
+
   SP.copyToMachineFrameInfo(MF->getFrameInfo());
 
   SwiftError->propagateVRegs();
 
   delete FastIS;
   SDB->clearDanglingDebugInfo();
   SDB->SPDescriptor.resetPerFunctionState();
 }

llvm/lib/CodeGen/WinEHPrepare.cpp

for (BasicBlock &BB : *F) {
     } else {
       Instruction *PadInst = InvokeUnwindDest->getFirstNonPHI();
       assert(FuncInfo.EHPadStateMap.count(PadInst) && "EH Pad has no state!");
       FuncInfo.InvokeStateMap[II] = FuncInfo.EHPadStateMap[PadInst];
     }
   }
 }
 
+// See comments below for calculateSEHStateForAsynchEH().
+// State - incoming State of normal paths
+struct WorkItem {
+  const BasicBlock *Block;
+  int State;
+  WorkItem(const BasicBlock *BB, int St) {
+    Block = BB;
+    State = St;
+  }
+};
+void llvm::calculateCXXStateForAsynchEH(const BasicBlock *BB, int State,
+                                        WinEHFuncInfo &EHInfo) {
+  SmallVector<struct WorkItem *, 8> WorkList;
+  struct WorkItem *WI = new WorkItem(BB, State);
+  WorkList.push_back(WI);
+
+  while (!WorkList.empty()) {
+    WI = WorkList.pop_back_val();
+    const BasicBlock *BB = WI->Block;
+    int State = WI->State;
+    delete WI;
+    if (EHInfo.BlockToStateMap.count(BB) && EHInfo.BlockToStateMap[BB] <= State)
+      continue; // skip blocks already visited by lower State
+
+    const llvm::Instruction *I = BB->getFirstNonPHI();
+    const llvm::Instruction *TI = BB->getTerminator();
+    if (I->isEHPad())
+      State = EHInfo.EHPadStateMap[I];
+    EHInfo.BlockToStateMap[BB] = State; // Record state, also flag visiting
+
+    if ((isa<CleanupReturnInst>(TI) || isa<CatchReturnInst>(TI)) && State > 0) {
+      // Retrive the new State
+      State = EHInfo.CxxUnwindMap[State].ToState; // Retrive next State
+    } else if (isa<InvokeInst>(TI)) {
+      auto *Call = dyn_cast<CallBase>(TI);
+      const Function *Fn = Call->getCalledFunction();
+      if (Fn && Fn->isIntrinsic() &&
+          (Fn->getIntrinsicID() == Intrinsic::seh_scope_begin ||
+           Fn->getIntrinsicID() == Intrinsic::seh_try_begin))
+        // Retrive the new State from seh_scope_begin
+        State = EHInfo.InvokeStateMap[cast<InvokeInst>(TI)];
+      else if (Fn && Fn->isIntrinsic() &&
+               (Fn->getIntrinsicID() == Intrinsic::seh_scope_end ||
+                Fn->getIntrinsicID() == Intrinsic::seh_try_end)) {
+        // In case of conditional ctor, let's retrieve State from Invoke
+        State = EHInfo.InvokeStateMap[cast<InvokeInst>(TI)];
+        // end of current state, retrive new state from UnwindMap
+        State = EHInfo.CxxUnwindMap[State].ToState;
+      }
+    }
+    // Continue push successors into worklist
+    for (auto *SuccBB : successors(BB)) {
+      WI = new WorkItem(SuccBB, State);
+      WorkList.push_back(WI);
+    }
+  }
+}
+
+// The central theory of this routine is based on the following:
+//   A _try scope is always a SEME (Single Entry Multiple Exits) region
+//     as jumping into a _try is not allowed
+//   The single entry must start with a seh_try_begin() invoke with a
+//     correct State number that is the initial state of the SEME.
+//   Through control-flow, state number is propagated into all blocks.
+//   Side exits marked by seh_try_end() will unwind to parent state via
+//     existing SEHUnwindMap[].
+//   Side exits can ONLY jump into parent scopes (lower state number).
+//   Thus, when a block succeeds various states from its predecessors,
+//     the lowest State trumphs others.
+//   If some exits flow to unreachable, propagation on those paths terminate,
+//     not affecting remaining blocks.
+void llvm::calculateSEHStateForAsynchEH(const BasicBlock *BB, int State,
+                                        WinEHFuncInfo &EHInfo) {
+  SmallVector<struct WorkItem *, 8> WorkList;
+  struct WorkItem *WI = new WorkItem(BB, State);
+  WorkList.push_back(WI);
+
+  while (!WorkList.empty()) {
+    WI = WorkList.pop_back_val();
+    const BasicBlock *BB = WI->Block;
+    int State = WI->State;
+    delete WI;
+    if (EHInfo.BlockToStateMap.count(BB) && EHInfo.BlockToStateMap[BB] <= State)
+      continue; // skip blocks already visited by lower State
+
+    const llvm::Instruction *I = BB->getFirstNonPHI();
+    const llvm::Instruction *TI = BB->getTerminator();
+    if (I->isEHPad())
+      State = EHInfo.EHPadStateMap[I];
+    EHInfo.BlockToStateMap[BB] = State; // Record state
+
+    if (isa<CatchPadInst>(I) && isa<CatchReturnInst>(TI)) {
+      const Constant *FilterOrNull = cast<Constant>(
+          cast<CatchPadInst>(I)->getArgOperand(0)->stripPointerCasts());
+      const Function *Filter = dyn_cast<Function>(FilterOrNull);
+      if (!Filter || !Filter->getName().startswith("__IsLocalUnwind"))
+        State = EHInfo.SEHUnwindMap[State].ToState; // Retrive next State
+    } else if ((isa<CleanupReturnInst>(TI) || isa<CatchReturnInst>(TI)) &&
+               State > 0) {
+      // Retrive the new State.
+      State = EHInfo.SEHUnwindMap[State].ToState; // Retrive next State
+    } else if (isa<InvokeInst>(TI)) {
+      auto *Call = dyn_cast<CallBase>(TI);
+      const Function *Fn = Call->getCalledFunction();
+      if (Fn && Fn->isIntrinsic() &&
+          Fn->getIntrinsicID() == Intrinsic::seh_try_begin)
+        // Retrive the new State from seh_try_begin
+        State = EHInfo.InvokeStateMap[cast<InvokeInst>(TI)];
+      else if (Fn && Fn->isIntrinsic() &&
+               Fn->getIntrinsicID() == Intrinsic::seh_try_end)
+        // end of current state, retrive new state from UnwindMap
+        State = EHInfo.SEHUnwindMap[State].ToState;
+    }
+    // Continue push successors into worklist
+    for (auto *SuccBB : successors(BB)) {
+      WI = new WorkItem(SuccBB, State);
+      WorkList.push_back(WI);
+    }
+  }
+}
+
 // Given BB which ends in an unwind edge, return the EHPad that this BB belongs
 // to. If the unwind edge came from an invoke, return null.
 static const BasicBlock *getEHPadFromPredecessor(const BasicBlock *BB,
                                                  Value *ParentPad) {
   const Instruction *TI = BB->getTerminator();
   if (isa<InvokeInst>(TI))
     return nullptr;
   if (auto *CatchSwitch = dyn_cast<CatchSwitchInst>(TI)) {
if (auto *CatchSwitch = dyn_cast<CatchSwitchInst>(FirstNonPHI)) {
     const Module *Mod = BB->getParent()->getParent();
     bool IsPreOrder = Triple(Mod->getTargetTriple()).isArch64Bit();
     if (IsPreOrder)
       addTryBlockMapEntry(FuncInfo, TryLow, TryHigh, CatchLow, Handlers);
     unsigned TBMEIdx = FuncInfo.TryBlockMap.size() - 1;
 
     for (const auto *CatchPad : Handlers) {
       FuncInfo.FuncletBaseStateMap[CatchPad] = CatchLow;
+      FuncInfo.EHPadStateMap[CatchPad] = CatchLow;
       for (const User *U : CatchPad->users()) {
         const auto *UserI = cast<Instruction>(U);
         if (auto *InnerCatchSwitch = dyn_cast<CatchSwitchInst>(UserI)) {
           BasicBlock *UnwindDest = InnerCatchSwitch->getUnwindDest();
           if (!UnwindDest || UnwindDest == CatchSwitch->getUnwindDest())
             calculateCXXStateNumbers(FuncInfo, UserI, CatchLow);
         }
         if (auto *InnerCleanupPad = dyn_cast<CleanupPadInst>(UserI)) {
const Constant *FilterOrNull =
         cast<Constant>(CatchPad->getArgOperand(0)->stripPointerCasts());
     const Function *Filter = dyn_cast<Function>(FilterOrNull);
     assert((Filter || FilterOrNull->isNullValue()) &&
            "unexpected filter value");
     int TryState = addSEHExcept(FuncInfo, ParentState, Filter, CatchPadBB);
 
     // Everything in the __try block uses TryState as its parent state.
     FuncInfo.EHPadStateMap[CatchSwitch] = TryState;
+    FuncInfo.EHPadStateMap[CatchPad] = TryState;
     LLVM_DEBUG(dbgs() << "Assigning state #" << TryState << " to BB "
                       << CatchPadBB->getName() << '\n');
     for (const BasicBlock *PredBlock : predecessors(BB))
       if ((PredBlock = getEHPadFromPredecessor(PredBlock,
                                                CatchSwitch->getParentPad())))
         calculateSEHStateNumbers(FuncInfo, PredBlock->getFirstNonPHI(),
                                  TryState);
 
if (!BB.isEHPad())
       continue;
     const Instruction *FirstNonPHI = BB.getFirstNonPHI();
     if (!isTopLevelPadForMSVC(FirstNonPHI))
       continue;
     ::calculateSEHStateNumbers(FuncInfo, FirstNonPHI, -1);
   }
 
   calculateStateNumbersForInvokes(Fn, FuncInfo);
+
+  bool IsEHa = Fn->getParent()->getModuleFlag("eh-asynch");
+  if (IsEHa) {
+    const BasicBlock *EntryBB = &(Fn->getEntryBlock());
+    calculateSEHStateForAsynchEH(EntryBB, -1, FuncInfo);
+  }
 }
 
 void llvm::calculateWinCXXEHStateNumbers(const Function *Fn,
                                          WinEHFuncInfo &FuncInfo) {
   // Return if it's already been done.
   if (!FuncInfo.EHPadStateMap.empty())
     return;
 
   for (const BasicBlock &BB : *Fn) {
     if (!BB.isEHPad())
       continue;
     const Instruction *FirstNonPHI = BB.getFirstNonPHI();
     if (!isTopLevelPadForMSVC(FirstNonPHI))
       continue;
     calculateCXXStateNumbers(FuncInfo, FirstNonPHI, -1);
   }
 
   calculateStateNumbersForInvokes(Fn, FuncInfo);
+
+  bool IsEHa = Fn->getParent()->getModuleFlag("eh-asynch");
+  if (IsEHa) {
+    const BasicBlock *EntryBB = &(Fn->getEntryBlock());
+    calculateCXXStateForAsynchEH(EntryBB, -1, FuncInfo);
+  }
 }
 
 static int addClrEHHandler(WinEHFuncInfo &FuncInfo, int HandlerParentState,
                            int TryParentState, ClrHandlerType HandlerType,
                            uint32_t TypeToken, const BasicBlock *Handler) {
   ClrEHUnwindMapEntry Entry;
   Entry.HandlerParentState = HandlerParentState;
   Entry.TryParentState = TryParentState;

 void WinEHFuncInfo::addIPToStateRange(const InvokeInst *II,
                                       MCSymbol *InvokeBegin,
                                       MCSymbol *InvokeEnd) {
   assert(InvokeStateMap.count(II) &&
          "should get invoke with precomputed state");
   LabelToStateMap[InvokeBegin] = std::make_pair(InvokeStateMap[II], InvokeEnd);
 }
 
+void WinEHFuncInfo::addIPToStateRange(int State, MCSymbol* InvokeBegin,
+    MCSymbol* InvokeEnd) {
+    LabelToStateMap[InvokeBegin] = std::make_pair(State, InvokeEnd);
+}
+
 WinEHFuncInfo::WinEHFuncInfo() = default;

llvm/lib/IR/BasicBlock.cpp

const CallInst *BasicBlock::getPostdominatingDeoptimizeCall() const {
   while (auto *Succ = BB->getUniqueSuccessor()) {
     if (!Visited.insert(Succ).second)
       return nullptr;
     BB = Succ;
   }
   return BB->getTerminatingDeoptimizeCall();
 }
 
+const Instruction *BasicBlock::getFirstMayFaultInst() const {
+  if (InstList.empty())
+    return nullptr;
+  for (const Instruction &I : *this)
+    if (isa<LoadInst>(I) || isa<StoreInst>(I) || isa<CallBase>(I))
+      return &I;
+  return nullptr;
+}
+
 const Instruction* BasicBlock::getFirstNonPHI() const {
   for (const Instruction &I : *this)
     if (!isa<PHINode>(I))
       return &I;
   return nullptr;
 }
 
 const Instruction *BasicBlock::getFirstNonPHIOrDbg(bool SkipPseudoOp) const {

llvm/lib/IR/EHPersonalities.cpp

 //===- EHPersonalities.cpp - Compute EH-related information ---------------===//
 //
 // Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
 // See https://llvm.org/LICENSE.txt for license information.
 // SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
 //
 //===----------------------------------------------------------------------===//
 
 #include "llvm/IR/EHPersonalities.h"
 #include "llvm/ADT/StringSwitch.h"
 #include "llvm/IR/CFG.h"
 #include "llvm/IR/Constants.h"
 #include "llvm/IR/Function.h"
 #include "llvm/IR/Instructions.h"
+#include "llvm/IR/Module.h"
 #include "llvm/Support/Debug.h"
 #include "llvm/Support/raw_ostream.h"
 #include "llvm/TargetParser/Triple.h"
 using namespace llvm;
 
 /// See if the given exception handling personality function is one that we
 /// understand.  If so, return a description of it; otherwise return Unknown.
 EHPersonality llvm::classifyEHPersonality(const Value *Pers) {
else
     return EHPersonality::GNU_C;
 }
 
 bool llvm::canSimplifyInvokeNoUnwind(const Function *F) {
   EHPersonality Personality = classifyEHPersonality(F->getPersonalityFn());
   // We can't simplify any invokes to nounwind functions if the personality
   // function wants to catch asynch exceptions.  The nounwind attribute only
   // implies that the function does not throw synchronous exceptions.
-  return !isAsynchronousEHPersonality(Personality);
+
+  // Cannot simplify CXX Personality under AsynchEH
+  const llvm::Module *M = (const llvm::Module *)F->getParent();
+  bool EHa = M->getModuleFlag("eh-asynch");
+  return !EHa && !isAsynchronousEHPersonality(Personality);
 }
 
 DenseMap<BasicBlock *, ColorVector> llvm::colorEHFunclets(Function &F) {
   SmallVector<std::pair<BasicBlock *, BasicBlock *>, 16> Worklist;
   BasicBlock *EntryBlock = &F.getEntryBlock();
   DenseMap<BasicBlock *, ColorVector> BlockColors;
 
   // Build up the color map, which maps each block to its set of 'colors'.

llvm/test/CodeGen/X86/windows-seh-EHa-CppCatchDotDotDot.ll

+; RUN: llc -verify-machineinstrs < %s | FileCheck %s
+
+; CHECK-LABEL: "$cppxdata$?crash@@YAXH@Z":
+; CHECK:  .long ("$stateUnwindMap$?crash@@YAXH@Z")
+; CHECK:        .long   ("$tryMap$?crash@@YAXH@Z")@IMGREL # TryBlockMap
+; CHECK-NEXT:   .long   6                       # IPMapEntries
+; CHECK-NEXT: .long ("$ip2state$?crash@@YAXH@Z")
+
+; CHECK-LABEL: "$stateUnwindMap$?crash@@YAXH@Z":
+; CHECK-NEXT:        .long   -1                
+; CHECK-NEXT:        .long   0                 
+; CHECK-NEXT:        .long   0                 
+; CHECK-NEXT:        .long   "?dtor$
+; CHECK-NEXT:        .long   -1                
+; CHECK-NEXT:        .long   0                 
+
+; CHECK-LABEL: "$tryMap$?crash@@YAXH@Z":
+; CHECK-NEXT:        .long   0             
+; CHECK-NEXT:        .long   1             
+; CHECK-NEXT:        .long   2             
+; CHECK-NEXT:        .long   1             
+; CHECK-NEXT:        .long   ("$handlerMap$
+
+; CHECK:       "$handlerMap$0$?crash@@YAXH@Z"
+; CHECK-NEXT:        .long   0             
+; CHECK-NEXT:        .long   0             
+; CHECK-NEXT:        .long   0             
+; CHECK-NEXT:        .long   "?catch$ 
+
+; CHECK-LABEL: "$ip2state$?crash@@YAXH@Z":
+; CHECK-NEXT: .long .Lfunc_begin0@IMGREL
+; CHECK-NEXT: .long -1                  
+; CHECK-NEXT: .long .Ltmp     
+; CHECK-NEXT: .long 0                   
+; CHECK-NEXT: .long .Ltmp     
+; CHECK-NEXT: .long 1                   
+; CHECK-NEXT: .long .Ltmp
+; CHECK-NEXT: .long 0                  
+; CHECK-NEXT: .long .Ltmp
+; CHECK-NEXT: .long -1                                  
+; CHECK-NEXT: .long "?catch$
+; CHECK-NEXT: .long 2                  
+
+; ModuleID = 'windows-seh-EHa-CppCatchDotDotDot.cpp'
+source_filename = "windows-seh-EHa-CppCatchDotDotDot.cpp"
+target datalayout = "e-m:w-p270:32:32-p271:32:32-p272:64:64-i64:64-f80:128-n8:16:32:64-S128"
+target triple = "x86_64-unknown-windows-msvc"
+
+%rtti.TypeDescriptor2 = type { i8**, i8*, [3 x i8] }
+%eh.CatchableType = type { i32, i32, i32, i32, i32, i32, i32 }
+%eh.CatchableTypeArray.1 = type { i32, [1 x i32] }
+%eh.ThrowInfo = type { i32, i32, i32, i32 }
+%struct.A = type { i8 }
+
+$"??_C@_0BJ@EIKFKKLB@?5in?5catch?$CI?4?4?4?$CJ?5funclet?5?6?$AA@" = comdat any
+
+$"??_R0H@8" = comdat any
+
+$"_CT??_R0H@84" = comdat any
+
+$_CTA1H = comdat any
+
+$_TI1H = comdat any
+
+$"??_C@_0CN@MKCAOFNA@?5Test?5CPP?5unwind?3?5in?5except?5hand@" = comdat any
+
+$"??_C@_0N@LJHFFAKD@?5in?5A?5ctor?5?6?$AA@" = comdat any
+
+$"??_C@_0N@HMNCGOCN@?5in?5A?5dtor?5?6?$AA@" = comdat any
+
+@"?pt1@@3PEAHEA" = dso_local global i32* null, align 8
+@"?pt2@@3PEAHEA" = dso_local global i32* null, align 8
+@"?pt3@@3PEAHEA" = dso_local global i32* null, align 8
+@"?g@@3HA" = dso_local global i32 0, align 4
+@"??_C@_0BJ@EIKFKKLB@?5in?5catch?$CI?4?4?4?$CJ?5funclet?5?6?$AA@" = linkonce_odr dso_local unnamed_addr constant [25 x i8] c" in catch(...) funclet \0A\00", comdat, align 1
+@"??_7type_info@@6B@" = external constant i8*
+@"??_R0H@8" = linkonce_odr global %rtti.TypeDescriptor2 { i8** @"??_7type_info@@6B@", i8* null, [3 x i8] c".H\00" }, comdat
+@__ImageBase = external dso_local constant i8
+@"_CT??_R0H@84" = linkonce_odr unnamed_addr constant %eh.CatchableType { i32 1, i32 trunc (i64 sub nuw nsw (i64 ptrtoint (%rtti.TypeDescriptor2* @"??_R0H@8" to i64), i64 ptrtoint (i8* @__ImageBase to i64)) to i32), i32 0, i32 -1, i32 0, i32 4, i32 0 }, section ".xdata", comdat
+@_CTA1H = linkonce_odr unnamed_addr constant %eh.CatchableTypeArray.1 { i32 1, [1 x i32] [i32 trunc (i64 sub nuw nsw (i64 ptrtoint (%eh.CatchableType* @"_CT??_R0H@84" to i64), i64 ptrtoint (i8* @__ImageBase to i64)) to i32)] }, section ".xdata", comdat
+@_TI1H = linkonce_odr unnamed_addr constant %eh.ThrowInfo { i32 0, i32 0, i32 0, i32 trunc (i64 sub nuw nsw (i64 ptrtoint (%eh.CatchableTypeArray.1* @_CTA1H to i64), i64 ptrtoint (i8* @__ImageBase to i64)) to i32) }, section ".xdata", comdat
+@"??_C@_0CN@MKCAOFNA@?5Test?5CPP?5unwind?3?5in?5except?5hand@" = linkonce_odr dso_local unnamed_addr constant [45 x i8] c" Test CPP unwind: in except handler i = %d \0A\00", comdat, align 1
+@"??_C@_0N@LJHFFAKD@?5in?5A?5ctor?5?6?$AA@" = linkonce_odr dso_local unnamed_addr constant [13 x i8] c" in A ctor \0A\00", comdat, align 1
+@"??_C@_0N@HMNCGOCN@?5in?5A?5dtor?5?6?$AA@" = linkonce_odr dso_local unnamed_addr constant [13 x i8] c" in A dtor \0A\00", comdat, align 1
+
+; Function Attrs: noinline nounwind optnone
+define dso_local void @"?foo@@YAXXZ"() #0 {
+entry:
+  store volatile i32 0, i32* inttoptr (i64 17 to i32*), align 4
+  ret void
+}
+
+; Function Attrs: noinline optnone
+define dso_local void @"?crash@@YAXH@Z"(i32 %i) #1 personality i8* bitcast (i32 (...)* @__CxxFrameHandler3 to i8*) {
+entry:
+  %i.addr = alloca i32, align 4
+  %ObjA = alloca %struct.A, align 1
+  %tmp = alloca i32, align 4
+  store i32 %i, i32* %i.addr, align 4
+  %0 = load i32, i32* %i.addr, align 4
+  store i32 %0, i32* @"?g@@3HA", align 4
+  invoke void @llvm.seh.try.begin()
+          to label %invoke.cont unwind label %catch.dispatch
+
+invoke.cont:                                      ; preds = %entry
+  %call = invoke %struct.A* @"??0A@?1??crash@@YAXH@Z@QEAA@XZ"(%struct.A* %ObjA)
+          to label %invoke.cont1 unwind label %catch.dispatch
+
+invoke.cont1:                                     ; preds = %invoke.cont
+  invoke void @llvm.seh.scope.begin()
+          to label %invoke.cont2 unwind label %ehcleanup
+
+invoke.cont2:                                     ; preds = %invoke.cont1
+  %1 = load i32, i32* %i.addr, align 4
+  %cmp = icmp eq i32 %1, 1
+  br i1 %cmp, label %if.then, label %if.end
+
+if.then:                                          ; preds = %invoke.cont2
+  store volatile i32 0, i32* inttoptr (i64 17 to i32*), align 4
+  br label %if.end
+
+if.end:                                           ; preds = %if.then, %invoke.cont2
+  invoke void @llvm.seh.scope.end()
+          to label %invoke.cont3 unwind label %ehcleanup
+
+invoke.cont3:                                     ; preds = %if.end
+  call void @"??1A@?1??crash@@YAXH@Z@QEAA@XZ"(%struct.A* %ObjA) #6
+  br label %try.cont
+
+ehcleanup:                                        ; preds = %if.end, %invoke.cont1
+  %2 = cleanuppad within none []
+  call void @"??1A@?1??crash@@YAXH@Z@QEAA@XZ"(%struct.A* %ObjA) #6 [ "funclet"(token %2) ]
+  cleanupret from %2 unwind label %catch.dispatch
+
+catch.dispatch:                                   ; preds = %ehcleanup, %invoke.cont, %entry
+  %3 = catchswitch within none [label %catch] unwind to caller
+
+catch:                                            ; preds = %catch.dispatch
+  %4 = catchpad within %3 [i8* null, i32 0, i8* null]
+  call void (...) @"?printf@@YAXZZ"(i8* getelementptr inbounds ([25 x i8], [25 x i8]* @"??_C@_0BJ@EIKFKKLB@?5in?5catch?$CI?4?4?4?$CJ?5funclet?5?6?$AA@", i64 0, i64 0)) [ "funclet"(token %4) ]
+  %5 = load i32, i32* %i.addr, align 4
+  %cmp4 = icmp eq i32 %5, 1
+  br i1 %cmp4, label %if.then5, label %if.end6
+
+if.then5:                                         ; preds = %catch
+  %6 = load i32, i32* %i.addr, align 4
+  store i32 %6, i32* %tmp, align 4
+  %7 = bitcast i32* %tmp to i8*
+  call void @_CxxThrowException(i8* %7, %eh.ThrowInfo* @_TI1H) #7 [ "funclet"(token %4) ]
+  unreachable
+
+if.end6:                                          ; preds = %catch
+  catchret from %4 to label %catchret.dest
+
+catchret.dest:                                    ; preds = %if.end6
+  br label %try.cont
+
+try.cont:                                         ; preds = %catchret.dest, %invoke.cont3
+  ret void
+}
+
+; Function Attrs: nounwind willreturn
+declare dso_local void @llvm.seh.try.begin() #2
+
+declare dso_local i32 @__CxxFrameHandler3(...)
+
+; Function Attrs: noinline optnone
+define internal %struct.A* @"??0A@?1??crash@@YAXH@Z@QEAA@XZ"(%struct.A* returned %this) unnamed_addr #1 align 2 {
+entry:
+  %retval = alloca %struct.A*, align 8
+  %this.addr = alloca %struct.A*, align 8
+  store %struct.A* %this, %struct.A** %this.addr, align 8
+  %this1 = load %struct.A*, %struct.A** %this.addr, align 8
+  store %struct.A* %this1, %struct.A** %retval, align 8
+  call void (...) @"?printf@@YAXZZ"(i8* getelementptr inbounds ([13 x i8], [13 x i8]* @"??_C@_0N@LJHFFAKD@?5in?5A?5ctor?5?6?$AA@", i64 0, i64 0))
+  %0 = load i32, i32* @"?g@@3HA", align 4
+  %cmp = icmp eq i32 %0, 0
+  br i1 %cmp, label %if.then, label %if.end
+
+if.then:                                          ; preds = %entry
+  store volatile i32 0, i32* inttoptr (i64 17 to i32*), align 4
+  br label %if.end
+
+if.end:                                           ; preds = %if.then, %entry
+  %1 = load %struct.A*, %struct.A** %retval, align 8
+  ret %struct.A* %1
+}
+
+; Function Attrs: nounwind readnone
+declare dso_local void @llvm.seh.scope.begin() #3
+
+; Function Attrs: nounwind readnone
+declare dso_local void @llvm.seh.scope.end() #3
+
+; Function Attrs: noinline nounwind optnone
+define internal void @"??1A@?1??crash@@YAXH@Z@QEAA@XZ"(%struct.A* %this) unnamed_addr #0 align 2 {
+entry:
+  %this.addr = alloca %struct.A*, align 8
+  store %struct.A* %this, %struct.A** %this.addr, align 8
+  %this1 = load %struct.A*, %struct.A** %this.addr, align 8
+  call void (...) @"?printf@@YAXZZ"(i8* getelementptr inbounds ([13 x i8], [13 x i8]* @"??_C@_0N@HMNCGOCN@?5in?5A?5dtor?5?6?$AA@", i64 0, i64 0))
+  ret void
+}
+
+declare dso_local void @"?printf@@YAXZZ"(...) #4
+
+declare dso_local void @_CxxThrowException(i8*, %eh.ThrowInfo*)
+
+; Function Attrs: noinline norecurse optnone
+define dso_local i32 @main() #5 personality i8* bitcast (i32 (...)* @__C_specific_handler to i8*) {
+entry:
+  %retval = alloca i32, align 4
+  %i = alloca i32, align 4
+  %__exception_code = alloca i32, align 4
+  store i32 0, i32* %retval, align 4
+  store i32 0, i32* %i, align 4
+  br label %for.cond
+
+for.cond:                                         ; preds = %for.inc, %entry
+  %0 = load i32, i32* %i, align 4
+  %cmp = icmp slt i32 %0, 2
+  br i1 %cmp, label %for.body, label %for.end
+
+for.body:                                         ; preds = %for.cond
+  invoke void @llvm.seh.try.begin()
+          to label %invoke.cont unwind label %catch.dispatch
+
+invoke.cont:                                      ; preds = %for.body
+  %1 = load volatile i32, i32* %i, align 4
+  invoke void @"?crash@@YAXH@Z"(i32 %1) #8
+          to label %invoke.cont1 unwind label %catch.dispatch
+
+invoke.cont1:                                     ; preds = %invoke.cont
+  invoke void @llvm.seh.try.end()
+          to label %invoke.cont2 unwind label %catch.dispatch
+
+catch.dispatch:                                   ; preds = %invoke.cont1, %invoke.cont, %for.body
+  %2 = catchswitch within none [label %__except] unwind to caller
+
+__except:                                         ; preds = %catch.dispatch
+  %3 = catchpad within %2 [i8* null]
+  catchret from %3 to label %__except3
+
+__except3:                                        ; preds = %__except
+  %4 = call i32 @llvm.eh.exceptioncode(token %3)
+  store i32 %4, i32* %__exception_code, align 4
+  %5 = load i32, i32* %i, align 4
+  call void (...) @"?printf@@YAXZZ"(i8* getelementptr inbounds ([45 x i8], [45 x i8]* @"??_C@_0CN@MKCAOFNA@?5Test?5CPP?5unwind?3?5in?5except?5hand@", i64 0, i64 0), i32 %5)
+  br label %__try.cont
+
+__try.cont:                                       ; preds = %__except3, %invoke.cont2
+  br label %for.inc
+
+for.inc:                                          ; preds = %__try.cont
+  %6 = load i32, i32* %i, align 4
+  %inc = add nsw i32 %6, 1
+  store i32 %inc, i32* %i, align 4
+  br label %for.cond
+
+invoke.cont2:                                     ; preds = %invoke.cont1
+  br label %__try.cont
+
+for.end:                                          ; preds = %for.cond
+  ret i32 0
+}
+
+declare dso_local i32 @__C_specific_handler(...)
+
+; Function Attrs: nounwind willreturn
+declare dso_local void @llvm.seh.try.end() #2
+
+; Function Attrs: nounwind readnone
+declare i32 @llvm.eh.exceptioncode(token) #3
+
+attributes #0 = { noinline nounwind optnone "correctly-rounded-divide-sqrt-fp-math"="false" "disable-tail-calls"="false" "frame-pointer"="none" "less-precise-fpmad"="false" "min-legal-vector-width"="0" "no-infs-fp-math"="false" "no-jump-tables"="false" "no-nans-fp-math"="false" "no-signed-zeros-fp-math"="false" "no-trapping-math"="false" "stack-protector-buffer-size"="8" "target-features"="+cx8,+mmx,+sse,+sse2,+x87" "unsafe-fp-math"="false" "use-soft-float"="false" }
+attributes #1 = { noinline optnone "correctly-rounded-divide-sqrt-fp-math"="false" "disable-tail-calls"="false" "frame-pointer"="none" "less-precise-fpmad"="false" "min-legal-vector-width"="0" "no-infs-fp-math"="false" "no-jump-tables"="false" "no-nans-fp-math"="false" "no-signed-zeros-fp-math"="false" "no-trapping-math"="false" "stack-protector-buffer-size"="8" "target-features"="+cx8,+mmx,+sse,+sse2,+x87" "unsafe-fp-math"="false" "use-soft-float"="false" }
+attributes #2 = { nounwind willreturn }
+attributes #3 = { nounwind readnone }
+attributes #4 = { "correctly-rounded-divide-sqrt-fp-math"="false" "disable-tail-calls"="false" "frame-pointer"="none" "less-precise-fpmad"="false" "no-infs-fp-math"="false" "no-nans-fp-math"="false" "no-signed-zeros-fp-math"="false" "no-trapping-math"="false" "stack-protector-buffer-size"="8" "target-features"="+cx8,+mmx,+sse,+sse2,+x87" "unsafe-fp-math"="false" "use-soft-float"="false" }
+attributes #5 = { noinline norecurse optnone "correctly-rounded-divide-sqrt-fp-math"="false" "disable-tail-calls"="false" "frame-pointer"="none" "less-precise-fpmad"="false" "min-legal-vector-width"="0" "no-infs-fp-math"="false" "no-jump-tables"="false" "no-nans-fp-math"="false" "no-signed-zeros-fp-math"="false" "no-trapping-math"="false" "stack-protector-buffer-size"="8" "target-features"="+cx8,+mmx,+sse,+sse2,+x87" "unsafe-fp-math"="false" "use-soft-float"="false" }
+attributes #6 = { nounwind }
+attributes #7 = { noreturn }
+attributes #8 = { noinline }
+
+!llvm.module.flags = !{!0, !1}
+
+!0 = !{i32 1, !"wchar_size", i32 2}
+!1 = !{i32 2, !"eh-asynch", i32 1}
+
+

llvm/test/CodeGen/X86/windows-seh-EHa-CppCondiTemps.ll

+; RUN: llc -verify-machineinstrs < %s | FileCheck %s
+
+; CHECK-LABEL: $ip2state$main:
+; CHECK-NEXT: .long .Lfunc_begin4@IMGREL
+; CHECK-NEXT: .long -1                              # ToState
+; CHECK-NEXT: .long .Ltmp
+; CHECK-NEXT: .long 0                               # ToState
+; CHECK-NEXT: .long .Ltmp
+; CHECK-NEXT: .long 4                               # ToState
+; CHECK-NEXT:   .long .Ltmp
+; CHECK:      .long 5                               # ToState
+; CHECK-NEXT: .long .Ltmp
+; CHECK-NEXT: .long 4                               # ToState
+; CHECK-NEXT: .long .Ltmp
+; CHECK-NEXT: .long 0                               # ToState
+; CHECK-NEXT: .long .Ltmp
+; CHECK-NEXT: .long 2                               # ToState
+; CHECK-NEXT: .long .Ltmp
+; CHECK-NEXT: .long 3                               # ToState
+; CHECK-NEXT: .long .Ltmp
+; CHECK-NEXT: .long 0                               # ToState
+; CHECK-NEXT: .long .Ltmp
+; CHECK-NEXT: .long 1                               # ToState
+; CHECK-NEXT: .long .Ltmp
+; CHECK-NEXT: .long 0                               # ToState
+; CHECK-NEXT: .long .Ltmp
+; CHECK-NEXT: .long -1                              # ToState
+
+; ModuleID = 'windows-seh-EHa-CppCondiTemps.cpp'
+source_filename = "windows-seh-EHa-CppCondiTemps.cpp"
+target datalayout = "e-m:w-p270:32:32-p271:32:32-p272:64:64-i64:64-f80:128-n8:16:32:64-S128"
+target triple = "x86_64-unknown-windows-msvc"
+
+%class.B1 = type { i32 }
+%class.B2 = type { %class.B1 }
+%class.B3 = type { %class.B2 }
+
+$"??1B1@@QEAA@XZ" = comdat any
+
+$"??1B2@@QEAA@XZ" = comdat any
+
+$"??0B2@@QEAA@XZ" = comdat any
+
+$"??0B3@@QEAA@XZ" = comdat any
+
+$"??1B3@@QEAA@XZ" = comdat any
+
+$"??0B1@@QEAA@XZ" = comdat any
+
+$"??_C@_0N@FMGAAAAM@in?5B1?5Dtor?5?6?$AA@" = comdat any
+
+$"??_C@_0N@GFONDMMJ@in?5B2?5Dtor?5?6?$AA@" = comdat any
+
+$"??_C@_0N@HCJGCIIK@in?5B3?5Dtor?5?6?$AA@" = comdat any
+
+@"?xxxx@@3HA" = dso_local global i32 0, align 4
+@"?ptr@@3PEAHEA" = dso_local global i32* null, align 8
+@"??_C@_0N@FMGAAAAM@in?5B1?5Dtor?5?6?$AA@" = linkonce_odr dso_local unnamed_addr constant [13 x i8] c"in B1 Dtor \0A\00", comdat, align 1
+@"??_C@_0N@GFONDMMJ@in?5B2?5Dtor?5?6?$AA@" = linkonce_odr dso_local unnamed_addr constant [13 x i8] c"in B2 Dtor \0A\00", comdat, align 1
+@"??_C@_0N@HCJGCIIK@in?5B3?5Dtor?5?6?$AA@" = linkonce_odr dso_local unnamed_addr constant [13 x i8] c"in B3 Dtor \0A\00", comdat, align 1
+
+; Function Attrs: noinline nounwind optnone mustprogress
+define dso_local i32 @"?foo@@YAHH@Z"(i32 %a) #0 {
+entry:
+  %a.addr = alloca i32, align 4
+  store i32 %a, i32* %a.addr, align 4
+  %0 = load i32, i32* @"?xxxx@@3HA", align 4
+  %1 = load i32, i32* %a.addr, align 4
+  %add = add nsw i32 %0, %1
+  ret i32 %add
+}
+
+; Function Attrs: noinline optnone mustprogress
+define dso_local i32 @"?bar@@YAHHVB1@@VB2@@@Z"(i32 %j, i32 %b1Bar.coerce, i32 %b2Bar.coerce) #1 personality i8* bitcast (i32 (...)* @__CxxFrameHandler3 to i8*) {
+entry:
+  %b1Bar = alloca %class.B1, align 4
+  %b2Bar = alloca %class.B2, align 4
+  %j.addr = alloca i32, align 4
+  %ww = alloca i32, align 4
+  %coerce.dive = getelementptr inbounds %class.B1, %class.B1* %b1Bar, i32 0, i32 0
+  store i32 %b1Bar.coerce, i32* %coerce.dive, align 4
+  %coerce.dive1 = getelementptr inbounds %class.B2, %class.B2* %b2Bar, i32 0, i32 0
+  %coerce.dive2 = getelementptr inbounds %class.B1, %class.B1* %coerce.dive1, i32 0, i32 0
+  store i32 %b2Bar.coerce, i32* %coerce.dive2, align 4
+  invoke void @llvm.seh.scope.begin()
+          to label %invoke.cont unwind label %ehcleanup7
+
+invoke.cont:                                      ; preds = %entry
+  invoke void @llvm.seh.scope.begin()
+          to label %invoke.cont3 unwind label %ehcleanup
+
+invoke.cont3:                                     ; preds = %invoke.cont
+  store i32 %j, i32* %j.addr, align 4
+  %0 = load i32, i32* %j.addr, align 4
+  %cmp = icmp sgt i32 %0, 0
+  br i1 %cmp, label %if.then, label %if.else
+
+if.then:                                          ; preds = %invoke.cont3
+  %data = getelementptr inbounds %class.B1, %class.B1* %b1Bar, i32 0, i32 0
+  %1 = load i32, i32* %data, align 4
+  store i32 %1, i32* %ww, align 4
+  br label %if.end
+
+if.else:                                          ; preds = %invoke.cont3
+  %2 = bitcast %class.B2* %b2Bar to %class.B1*
+  %data4 = getelementptr inbounds %class.B1, %class.B1* %2, i32 0, i32 0
+  %3 = load i32, i32* %data4, align 4
+  store i32 %3, i32* %ww, align 4
+  br label %if.end
+
+if.end:                                           ; preds = %if.else, %if.then
+  %4 = load i32, i32* %ww, align 4
+  %5 = load i32*, i32** @"?ptr@@3PEAHEA", align 8
+  %6 = load i32, i32* %5, align 4
+  %add = add nsw i32 %4, %6
+  invoke void @llvm.seh.scope.end()
+          to label %invoke.cont5 unwind label %ehcleanup
+
+invoke.cont5:                                     ; preds = %if.end
+  call void @"??1B1@@QEAA@XZ"(%class.B1* nonnull align 4 dereferenceable(4) %b1Bar) #8
+  invoke void @llvm.seh.scope.end()
+          to label %invoke.cont6 unwind label %ehcleanup7
+
+ehcleanup:                                        ; preds = %if.end, %invoke.cont
+  %7 = cleanuppad within none []
+  call void @"??1B1@@QEAA@XZ"(%class.B1* nonnull align 4 dereferenceable(4) %b1Bar) #8 [ "funclet"(token %7) ]
+  cleanupret from %7 unwind label %ehcleanup7
+
+invoke.cont6:                                     ; preds = %invoke.cont5
+  call void @"??1B2@@QEAA@XZ"(%class.B2* nonnull align 4 dereferenceable(4) %b2Bar) #8
+  ret i32 %add
+
+ehcleanup7:                                       ; preds = %invoke.cont5, %ehcleanup, %entry
+  %8 = cleanuppad within none []
+  call void @"??1B2@@QEAA@XZ"(%class.B2* nonnull align 4 dereferenceable(4) %b2Bar) #8 [ "funclet"(token %8) ]
+  cleanupret from %8 unwind to caller
+}
+
+; Function Attrs: nounwind readnone
+declare dso_local void @llvm.seh.scope.begin() #2
+
+declare dso_local i32 @__CxxFrameHandler3(...)
+
+; Function Attrs: nounwind readnone
+declare dso_local void @llvm.seh.scope.end() #2
+
+; Function Attrs: noinline nounwind optnone
+define linkonce_odr dso_local void @"??1B1@@QEAA@XZ"(%class.B1* nonnull align 4 dereferenceable(4) %this) unnamed_addr #3 comdat align 2 {
+entry:
+  %this.addr = alloca %class.B1*, align 8
+  store %class.B1* %this, %class.B1** %this.addr, align 8
+  %this1 = load %class.B1*, %class.B1** %this.addr, align 8
+  call void (...) @"?printf@@YAXZZ"(i8* getelementptr inbounds ([13 x i8], [13 x i8]* @"??_C@_0N@FMGAAAAM@in?5B1?5Dtor?5?6?$AA@", i64 0, i64 0))
+  ret void
+}
+
+; Function Attrs: noinline nounwind optnone
+define linkonce_odr dso_local void @"??1B2@@QEAA@XZ"(%class.B2* nonnull align 4 dereferenceable(4) %this) unnamed_addr #3 comdat align 2 personality i8* bitcast (i32 (...)* @__CxxFrameHandler3 to i8*) {
+entry:
+  %this.addr = alloca %class.B2*, align 8
+  store %class.B2* %this, %class.B2** %this.addr, align 8
+  %this1 = load %class.B2*, %class.B2** %this.addr, align 8
+  invoke void @llvm.seh.scope.begin()
+          to label %invoke.cont unwind label %ehcleanup
+
+invoke.cont:                                      ; preds = %entry
+  invoke void (...) @"?printf@@YAXZZ"(i8* getelementptr inbounds ([13 x i8], [13 x i8]* @"??_C@_0N@GFONDMMJ@in?5B2?5Dtor?5?6?$AA@", i64 0, i64 0))
+          to label %invoke.cont2 unwind label %ehcleanup
+
+invoke.cont2:                                     ; preds = %invoke.cont
+  invoke void @llvm.seh.scope.end()
+          to label %invoke.cont3 unwind label %ehcleanup
+
+invoke.cont3:                                     ; preds = %invoke.cont2
+  %0 = bitcast %class.B2* %this1 to %class.B1*
+  call void @"??1B1@@QEAA@XZ"(%class.B1* nonnull align 4 dereferenceable(4) %0) #8
+  ret void
+
+ehcleanup:                                        ; preds = %invoke.cont2, %invoke.cont, %entry
+  %1 = cleanuppad within none []
+  %2 = bitcast %class.B2* %this1 to %class.B1*
+  call void @"??1B1@@QEAA@XZ"(%class.B1* nonnull align 4 dereferenceable(4) %2) #8 [ "funclet"(token %1) ]
+  cleanupret from %1 unwind to caller
+}
+
+; Function Attrs: noinline optnone mustprogress
+define dso_local void @"?goo@@YA?AVB1@@H@Z"(%class.B1* noalias sret(%class.B1) align 4 %agg.result, i32 %w) #1 personality i8* bitcast (i32 (...)* @__CxxFrameHandler3 to i8*) {
+entry:
+  %result.ptr = alloca i8*, align 8
+  %w.addr = alloca i32, align 4
+  %b2ingoo = alloca %class.B2, align 4
+  %0 = bitcast %class.B1* %agg.result to i8*
+  store i8* %0, i8** %result.ptr, align 8
+  store i32 %w, i32* %w.addr, align 4
+  %call = call %class.B2* @"??0B2@@QEAA@XZ"(%class.B2* nonnull align 4 dereferenceable(4) %b2ingoo)
+  invoke void @llvm.seh.scope.begin()
+          to label %invoke.cont unwind label %ehcleanup
+
+invoke.cont:                                      ; preds = %entry
+  %1 = load i32, i32* %w.addr, align 4
+  %2 = bitcast %class.B2* %b2ingoo to %class.B1*
+  %data = getelementptr inbounds %class.B1, %class.B1* %2, i32 0, i32 0
+  %3 = load i32, i32* %data, align 4
+  %add = add nsw i32 %3, %1
+  store i32 %add, i32* %data, align 4
+  %4 = bitcast %class.B2* %b2ingoo to %class.B1*
+  %5 = bitcast %class.B1* %agg.result to i8*
+  %6 = bitcast %class.B1* %4 to i8*
+  call void @llvm.memcpy.p0i8.p0i8.i64(i8* align 4 %5, i8* align 4 %6, i64 4, i1 false)
+  invoke void @llvm.seh.scope.end()
+          to label %invoke.cont1 unwind label %ehcleanup
+
+invoke.cont1:                                     ; preds = %invoke.cont
+  call void @"??1B2@@QEAA@XZ"(%class.B2* nonnull align 4 dereferenceable(4) %b2ingoo) #8
+  ret void
+
+ehcleanup:                                        ; preds = %invoke.cont, %entry
+  %7 = cleanuppad within none []
+  call void @"??1B2@@QEAA@XZ"(%class.B2* nonnull align 4 dereferenceable(4) %b2ingoo) #8 [ "funclet"(token %7) ]
+  cleanupret from %7 unwind to caller
+}
+
+; Function Attrs: noinline optnone
+define linkonce_odr dso_local %class.B2* @"??0B2@@QEAA@XZ"(%class.B2* nonnull returned align 4 dereferenceable(4) %this) unnamed_addr #4 comdat align 2 personality i8* bitcast (i32 (...)* @__CxxFrameHandler3 to i8*) {
+entry:
+  %this.addr = alloca %class.B2*, align 8
+  store %class.B2* %this, %class.B2** %this.addr, align 8
+  %this1 = load %class.B2*, %class.B2** %this.addr, align 8
+  %0 = bitcast %class.B2* %this1 to %class.B1*
+  %call = call %class.B1* @"??0B1@@QEAA@XZ"(%class.B1* nonnull align 4 dereferenceable(4) %0)
+  invoke void @llvm.seh.scope.begin()
+          to label %invoke.cont unwind label %ehcleanup
+
+invoke.cont:                                      ; preds = %entry
+  %1 = bitcast %class.B2* %this1 to %class.B1*
+  %data = getelementptr inbounds %class.B1, %class.B1* %1, i32 0, i32 0
+  %2 = load i32, i32* %data, align 4
+  %add = add nsw i32 %2, 222
+  %call2 = call i32 @"?foo@@YAHH@Z"(i32 %add)
+  invoke void @llvm.seh.scope.end()
+          to label %invoke.cont3 unwind label %ehcleanup
+
+invoke.cont3:                                     ; preds = %invoke.cont
+  ret %class.B2* %this1
+
+ehcleanup:                                        ; preds = %invoke.cont, %entry
+  %3 = cleanuppad within none []
+  %4 = bitcast %class.B2* %this1 to %class.B1*
+  call void @"??1B1@@QEAA@XZ"(%class.B1* nonnull align 4 dereferenceable(4) %4) #8 [ "funclet"(token %3) ]
+  cleanupret from %3 unwind to caller
+}
+
+; Function Attrs: argmemonly nofree nosync nounwind willreturn
+declare void @llvm.memcpy.p0i8.p0i8.i64(i8* noalias nocapture writeonly, i8* noalias nocapture readonly, i64, i1 immarg) #5
+
+; Function Attrs: noinline norecurse optnone mustprogress
+define dso_local i32 @main() #6 personality i8* bitcast (i32 (...)* @__CxxFrameHandler3 to i8*) {
+entry:
+  %retval = alloca i32, align 4
+  %b3inmain = alloca %class.B3, align 4
+  %m = alloca i32, align 4
+  %ref.tmp = alloca %class.B2, align 4
+  %cleanup.cond = alloca i1, align 1
+  %ref.tmp5 = alloca %class.B3, align 4
+  %cleanup.cond9 = alloca i1, align 1
+  %i = alloca i32, align 4
+  %agg.tmp = alloca %class.B2, align 4
+  %agg.tmp28 = alloca %class.B1, align 4
+  %b1fromgoo = alloca %class.B1, align 4
+  store i32 0, i32* %retval, align 4
+  %call = call %class.B3* @"??0B3@@QEAA@XZ"(%class.B3* nonnull align 4 dereferenceable(4) %b3inmain)
+  invoke void @llvm.seh.scope.begin()
+          to label %invoke.cont unwind label %ehcleanup50
+
+invoke.cont:                                      ; preds = %entry
+  %0 = load i32, i32* @"?xxxx@@3HA", align 4
+  %cmp = icmp sgt i32 %0, 1
+  store i1 false, i1* %cleanup.cond, align 1
+  store i1 false, i1* %cleanup.cond9, align 1
+  br i1 %cmp, label %cond.true, label %cond.false
+
+cond.true:                                        ; preds = %invoke.cont
+  %call2 = invoke %class.B2* @"??0B2@@QEAA@XZ"(%class.B2* nonnull align 4 dereferenceable(4) %ref.tmp)
+          to label %invoke.cont1 unwind label %ehcleanup50
+
+invoke.cont1:                                     ; preds = %cond.true
+  invoke void @llvm.seh.scope.begin()
+          to label %invoke.cont3 unwind label %ehcleanup21
+
+invoke.cont3:                                     ; preds = %invoke.cont1
+  store i1 true, i1* %cleanup.cond, align 1
+  %1 = bitcast %class.B2* %ref.tmp to %class.B1*
+  %data = getelementptr inbounds %class.B1, %class.B1* %1, i32 0, i32 0
+  %2 = load i32, i32* %data, align 4
+  %call4 = call i32 @"?foo@@YAHH@Z"(i32 99)
+  %add = add nsw i32 %2, %call4
+  br label %cond.end
+
+cond.false:                                       ; preds = %invoke.cont
+  %call7 = invoke %class.B3* @"??0B3@@QEAA@XZ"(%class.B3* nonnull align 4 dereferenceable(4) %ref.tmp5)
+          to label %invoke.cont6 unwind label %ehcleanup21
+
+invoke.cont6:                                     ; preds = %cond.false
+  invoke void @llvm.seh.scope.begin()
+          to label %invoke.cont8 unwind label %ehcleanup
+
+invoke.cont8:                                     ; preds = %invoke.cont6
+  store i1 true, i1* %cleanup.cond9, align 1
+  %3 = bitcast %class.B3* %ref.tmp5 to %class.B1*
+  %data10 = getelementptr inbounds %class.B1, %class.B1* %3, i32 0, i32 0
+  %4 = load i32, i32* %data10, align 4
+  %call11 = call i32 @"?foo@@YAHH@Z"(i32 88)
+  %add12 = add nsw i32 %4, %call11
+  br label %cond.end
+
+cond.end:                                         ; preds = %invoke.cont8, %invoke.cont3
+  %cond = phi i32 [ %add, %invoke.cont3 ], [ %add12, %invoke.cont8 ]
+  invoke void @llvm.seh.scope.end()
+          to label %invoke.cont13 unwind label %ehcleanup
+
+invoke.cont13:                                    ; preds = %cond.end
+  %cleanup.is_active = load i1, i1* %cleanup.cond9, align 1
+  br i1 %cleanup.is_active, label %cleanup.action, label %cleanup.done
+
+cleanup.action:                                   ; preds = %invoke.cont13
+  call void @"??1B3@@QEAA@XZ"(%class.B3* nonnull align 4 dereferenceable(4) %ref.tmp5) #8
+  br label %cleanup.done
+
+cleanup.done:                                     ; preds = %cleanup.action, %invoke.cont13
+  invoke void @llvm.seh.scope.end()
+          to label %invoke.cont17 unwind label %ehcleanup21
+
+invoke.cont17:                                    ; preds = %cleanup.done
+  %cleanup.is_active18 = load i1, i1* %cleanup.cond, align 1
+  br i1 %cleanup.is_active18, label %cleanup.action19, label %cleanup.done20
+
+cleanup.action19:                                 ; preds = %invoke.cont17
+  call void @"??1B2@@QEAA@XZ"(%class.B2* nonnull align 4 dereferenceable(4) %ref.tmp) #8
+  br label %cleanup.done20
+
+cleanup.done20:                                   ; preds = %cleanup.action19, %invoke.cont17
+  store i32 %cond, i32* %m, align 4
+  %call26 = invoke %class.B2* @"??0B2@@QEAA@XZ"(%class.B2* nonnull align 4 dereferenceable(4) %agg.tmp)
+          to label %invoke.cont25 unwind label %ehcleanup50
+
+invoke.cont25:                                    ; preds = %cleanup.done20
+  invoke void @llvm.seh.scope.begin()
+          to label %invoke.cont27 unwind label %ehcleanup38
+
+invoke.cont27:                                    ; preds = %invoke.cont25
+  %call30 = invoke %class.B1* @"??0B1@@QEAA@XZ"(%class.B1* nonnull align 4 dereferenceable(4) %agg.tmp28)
+          to label %invoke.cont29 unwind label %ehcleanup38
+
+invoke.cont29:                                    ; preds = %invoke.cont27
+  invoke void @llvm.seh.scope.begin()
+          to label %invoke.cont31 unwind label %ehcleanup36
+
+invoke.cont31:                                    ; preds = %invoke.cont29
+  %call32 = call i32 @"?foo@@YAHH@Z"(i32 0)
+  %coerce.dive = getelementptr inbounds %class.B1, %class.B1* %agg.tmp28, i32 0, i32 0
+  %5 = load i32, i32* %coerce.dive, align 4
+  %coerce.dive33 = getelementptr inbounds %class.B2, %class.B2* %agg.tmp, i32 0, i32 0
+  %coerce.dive34 = getelementptr inbounds %class.B1, %class.B1* %coerce.dive33, i32 0, i32 0
+  %6 = load i32, i32* %coerce.dive34, align 4
+  invoke void @llvm.seh.scope.end()
+          to label %invoke.cont35 unwind label %ehcleanup36
+
+invoke.cont35:                                    ; preds = %invoke.cont31
+  invoke void @llvm.seh.scope.end()
+          to label %invoke.cont37 unwind label %ehcleanup38
+
+invoke.cont37:                                    ; preds = %invoke.cont35
+  %call40 = invoke i32 @"?bar@@YAHHVB1@@VB2@@@Z"(i32 %call32, i32 %5, i32 %6)
+          to label %invoke.cont39 unwind label %ehcleanup50
+
+invoke.cont39:                                    ; preds = %invoke.cont37
+  store i32 %call40, i32* %i, align 4
+  %7 = load i32, i32* %i, align 4
+  invoke void @"?goo@@YA?AVB1@@H@Z"(%class.B1* sret(%class.B1) align 4 %b1fromgoo, i32 %7)
+          to label %invoke.cont41 unwind label %ehcleanup50
+
+invoke.cont41:                                    ; preds = %invoke.cont39
+  invoke void @llvm.seh.scope.begin()
+          to label %invoke.cont42 unwind label %ehcleanup48
+
+invoke.cont42:                                    ; preds = %invoke.cont41
+  %8 = load i32, i32* %m, align 4
+  %data43 = getelementptr inbounds %class.B1, %class.B1* %b1fromgoo, i32 0, i32 0
+  %9 = load i32, i32* %data43, align 4
+  %add44 = add nsw i32 %8, %9
+  %10 = bitcast %class.B3* %b3inmain to %class.B1*
+  %data45 = getelementptr inbounds %class.B1, %class.B1* %10, i32 0, i32 0
+  %11 = load i32, i32* %data45, align 4
+  %add46 = add nsw i32 %add44, %11
+  store i32 %add46, i32* %retval, align 4
+  invoke void @llvm.seh.scope.end()
+          to label %invoke.cont47 unwind label %ehcleanup48
+
+ehcleanup:                                        ; preds = %cond.end, %invoke.cont6
+  %12 = cleanuppad within none []
+  %cleanup.is_active14 = load i1, i1* %cleanup.cond9, align 1
+  br i1 %cleanup.is_active14, label %cleanup.action15, label %cleanup.done16
+
+cleanup.action15:                                 ; preds = %ehcleanup
+  call void @"??1B3@@QEAA@XZ"(%class.B3* nonnull align 4 dereferenceable(4) %ref.tmp5) #8 [ "funclet"(token %12) ]
+  br label %cleanup.done16
+
+cleanup.done16:                                   ; preds = %cleanup.action15, %ehcleanup
+  cleanupret from %12 unwind label %ehcleanup21
+
+ehcleanup21:                                      ; preds = %cleanup.done, %cleanup.done16, %cond.false, %invoke.cont1
+  %13 = cleanuppad within none []
+  %cleanup.is_active22 = load i1, i1* %cleanup.cond, align 1
+  br i1 %cleanup.is_active22, label %cleanup.action23, label %cleanup.done24
+
+cleanup.action23:                                 ; preds = %ehcleanup21
+  call void @"??1B2@@QEAA@XZ"(%class.B2* nonnull align 4 dereferenceable(4) %ref.tmp) #8 [ "funclet"(token %13) ]
+  br label %cleanup.done24
+
+cleanup.done24:                                   ; preds = %cleanup.action23, %ehcleanup21
+  cleanupret from %13 unwind label %ehcleanup50
+
+ehcleanup36:                                      ; preds = %invoke.cont31, %invoke.cont29
+  %14 = cleanuppad within none []
+  call void @"??1B1@@QEAA@XZ"(%class.B1* nonnull align 4 dereferenceable(4) %agg.tmp28) #8 [ "funclet"(token %14) ]
+  cleanupret from %14 unwind label %ehcleanup38
+
+ehcleanup38:                                      ; preds = %invoke.cont35, %ehcleanup36, %invoke.cont27, %invoke.cont25
+  %15 = cleanuppad within none []
+  call void @"??1B2@@QEAA@XZ"(%class.B2* nonnull align 4 dereferenceable(4) %agg.tmp) #8 [ "funclet"(token %15) ]
+  cleanupret from %15 unwind label %ehcleanup50
+
+invoke.cont47:                                    ; preds = %invoke.cont42
+  call void @"??1B1@@QEAA@XZ"(%class.B1* nonnull align 4 dereferenceable(4) %b1fromgoo) #8
+  invoke void @llvm.seh.scope.end()
+          to label %invoke.cont49 unwind label %ehcleanup50
+
+ehcleanup48:                                      ; preds = %invoke.cont42, %invoke.cont41
+  %16 = cleanuppad within none []
+  call void @"??1B1@@QEAA@XZ"(%class.B1* nonnull align 4 dereferenceable(4) %b1fromgoo) #8 [ "funclet"(token %16) ]
+  cleanupret from %16 unwind label %ehcleanup50
+
+invoke.cont49:                                    ; preds = %invoke.cont47
+  call void @"??1B3@@QEAA@XZ"(%class.B3* nonnull align 4 dereferenceable(4) %b3inmain) #8
+  %17 = load i32, i32* %retval, align 4
+  ret i32 %17
+
+ehcleanup50:                                      ; preds = %invoke.cont47, %ehcleanup48, %invoke.cont39, %invoke.cont37, %ehcleanup38, %cleanup.done20, %cleanup.done24, %cond.true, %entry
+  %18 = cleanuppad within none []
+  call void @"??1B3@@QEAA@XZ"(%class.B3* nonnull align 4 dereferenceable(4) %b3inmain) #8 [ "funclet"(token %18) ]
+  cleanupret from %18 unwind to caller
+}
+
+; Function Attrs: noinline optnone
+define linkonce_odr dso_local %class.B3* @"??0B3@@QEAA@XZ"(%class.B3* nonnull returned align 4 dereferenceable(4) %this) unnamed_addr #4 comdat align 2 personality i8* bitcast (i32 (...)* @__CxxFrameHandler3 to i8*) {
+entry:
+  %this.addr = alloca %class.B3*, align 8
+  store %class.B3* %this, %class.B3** %this.addr, align 8
+  %this1 = load %class.B3*, %class.B3** %this.addr, align 8
+  %0 = bitcast %class.B3* %this1 to %class.B2*
+  %call = call %class.B2* @"??0B2@@QEAA@XZ"(%class.B2* nonnull align 4 dereferenceable(4) %0)
+  invoke void @llvm.seh.scope.begin()
+          to label %invoke.cont unwind label %ehcleanup
+
+invoke.cont:                                      ; preds = %entry
+  %1 = bitcast %class.B3* %this1 to %class.B1*
+  %data = getelementptr inbounds %class.B1, %class.B1* %1, i32 0, i32 0
+  %2 = load i32, i32* %data, align 4
+  %add = add nsw i32 %2, 333
+  %call2 = call i32 @"?foo@@YAHH@Z"(i32 %add)
+  invoke void @llvm.seh.scope.end()
+          to label %invoke.cont3 unwind label %ehcleanup
+
+invoke.cont3:                                     ; preds = %invoke.cont
+  ret %class.B3* %this1
+
+ehcleanup:                                        ; preds = %invoke.cont, %entry
+  %3 = cleanuppad within none []
+  %4 = bitcast %class.B3* %this1 to %class.B2*
+  call void @"??1B2@@QEAA@XZ"(%class.B2* nonnull align 4 dereferenceable(4) %4) #8 [ "funclet"(token %3) ]
+  cleanupret from %3 unwind to caller
+}
+
+; Function Attrs: noinline nounwind optnone
+define linkonce_odr dso_local void @"??1B3@@QEAA@XZ"(%class.B3* nonnull align 4 dereferenceable(4) %this) unnamed_addr #3 comdat align 2 personality i8* bitcast (i32 (...)* @__CxxFrameHandler3 to i8*) {
+entry:
+  %this.addr = alloca %class.B3*, align 8
+  store %class.B3* %this, %class.B3** %this.addr, align 8
+  %this1 = load %class.B3*, %class.B3** %this.addr, align 8
+  invoke void @llvm.seh.scope.begin()
+          to label %invoke.cont unwind label %ehcleanup
+
+invoke.cont:                                      ; preds = %entry
+  invoke void (...) @"?printf@@YAXZZ"(i8* getelementptr inbounds ([13 x i8], [13 x i8]* @"??_C@_0N@HCJGCIIK@in?5B3?5Dtor?5?6?$AA@", i64 0, i64 0))
+          to label %invoke.cont2 unwind label %ehcleanup
+
+invoke.cont2:                                     ; preds = %invoke.cont
+  invoke void @llvm.seh.scope.end()
+          to label %invoke.cont3 unwind label %ehcleanup
+
+invoke.cont3:                                     ; preds = %invoke.cont2
+  %0 = bitcast %class.B3* %this1 to %class.B2*
+  call void @"??1B2@@QEAA@XZ"(%class.B2* nonnull align 4 dereferenceable(4) %0) #8
+  ret void
+
+ehcleanup:                                        ; preds = %invoke.cont2, %invoke.cont, %entry
+  %1 = cleanuppad within none []
+  %2 = bitcast %class.B3* %this1 to %class.B2*
+  call void @"??1B2@@QEAA@XZ"(%class.B2* nonnull align 4 dereferenceable(4) %2) #8 [ "funclet"(token %1) ]
+  cleanupret from %1 unwind to caller
+}
+
+; Function Attrs: noinline nounwind optnone
+define linkonce_odr dso_local %class.B1* @"??0B1@@QEAA@XZ"(%class.B1* nonnull returned align 4 dereferenceable(4) %this) unnamed_addr #3 comdat align 2 {
+entry:
+  %this.addr = alloca %class.B1*, align 8
+  store %class.B1* %this, %class.B1** %this.addr, align 8
+  %this1 = load %class.B1*, %class.B1** %this.addr, align 8
+  %data = getelementptr inbounds %class.B1, %class.B1* %this1, i32 0, i32 0
+  store i32 90, i32* %data, align 4
+  %data2 = getelementptr inbounds %class.B1, %class.B1* %this1, i32 0, i32 0
+  %0 = load i32, i32* %data2, align 4
+  %add = add nsw i32 %0, 111
+  %call = call i32 @"?foo@@YAHH@Z"(i32 %add)
+  ret %class.B1* %this1
+}
+
+declare dso_local void @"?printf@@YAXZZ"(...) #7
+
+attributes #0 = { noinline nounwind optnone mustprogress "frame-pointer"="none" "min-legal-vector-width"="0" "no-trapping-math"="true" "stack-protector-buffer-size"="8" "target-features"="+cx8,+mmx,+sse,+sse2,+x87" }
+attributes #1 = { noinline optnone mustprogress "frame-pointer"="none" "min-legal-vector-width"="0" "no-trapping-math"="true" "stack-protector-buffer-size"="8" "target-features"="+cx8,+mmx,+sse,+sse2,+x87" }
+attributes #2 = { nounwind readnone }
+attributes #3 = { noinline nounwind optnone "frame-pointer"="none" "min-legal-vector-width"="0" "no-trapping-math"="true" "stack-protector-buffer-size"="8" "target-features"="+cx8,+mmx,+sse,+sse2,+x87" }
+attributes #4 = { noinline optnone "frame-pointer"="none" "min-legal-vector-width"="0" "no-trapping-math"="true" "stack-protector-buffer-size"="8" "target-features"="+cx8,+mmx,+sse,+sse2,+x87" }
+attributes #5 = { argmemonly nofree nosync nounwind willreturn }
+attributes #6 = { noinline norecurse optnone mustprogress "frame-pointer"="none" "min-legal-vector-width"="0" "no-trapping-math"="true" "stack-protector-buffer-size"="8" "target-features"="+cx8,+mmx,+sse,+sse2,+x87" }
+attributes #7 = { "frame-pointer"="none" "no-trapping-math"="true" "stack-protector-buffer-size"="8" "target-features"="+cx8,+mmx,+sse,+sse2,+x87" }
+attributes #8 = { nounwind }
+
+!llvm.module.flags = !{!0, !1}
+
+!0 = !{i32 1, !"wchar_size", i32 2}
+!1 = !{i32 2, !"eh-asynch", i32 1}

llvm/test/CodeGen/X86/windows-seh-EHa-CppDtors01.ll

+; RUN: llc -verify-machineinstrs < %s | FileCheck %s
+
+; CHECK-LABEL: "$cppxdata$?crash@@YAXH@Z":
+; CHECK:  .long ("$stateUnwindMap$?crash@@YAXH@Z")
+; CHECK:  .long ("$ip2state$?crash@@YAXH@Z")
+
+; CHECK-LABEL: "$stateUnwindMap$?crash@@YAXH@Z":
+; CHECK:  .long -1 
+; CHECK:  .long "?dtor$
+; CHECK:  .long 0 
+; CHECK:  .long "?dtor$
+; CHECK:  .long 1
+; CHECK:  .long "?dtor$
+
+; CHECK-LABEL: "$ip2state$?crash@@YAXH@Z":
+; CHECK-NEXT: .long .Lfunc_begin0@IMGREL
+; CHECK-NEXT: .long -1                  
+; CHECK-NEXT: .long .Ltmp     
+; CHECK-NEXT: .long 0                   
+; CHECK-NEXT: .long .Ltmp     
+; CHECK-NEXT: .long 1                   
+; CHECK-NEXT: .long .Ltmp
+; CHECK-NEXT: .long 2                   
+; CHECK-NEXT: .long .Ltmp
+; CHECK-NEXT: .long 1                   
+; CHECK-NEXT: .long .Ltmp
+; CHECK-NEXT: .long 0                   
+; CHECK-NEXT: .long .Ltmp
+; CHECK-NEXT: .long -1                  
+
+; ModuleID = 'windows-seh-EHa-CppDtors01.cpp'
+source_filename = "windows-seh-EHa-CppDtors01.cpp"
+target datalayout = "e-m:w-p270:32:32-p271:32:32-p272:64:64-i64:64-f80:128-n8:16:32:64-S128"
+target triple = "x86_64-unknown-windows-msvc"
+
+%struct.A = type { i8 }
+%struct.B = type { i8 }
+%struct.C = type { i8 }
+
+$"??_C@_0CM@KAOHJHDK@?5Test?5CPP?5unwind?3?5in?5catch?5handl@" = comdat any
+
+$"??_C@_0N@FCCEEGKL@?5in?5C?5dtor?5?6?$AA@" = comdat any
+
+$"??_C@_0N@EFFPFCOI@?5in?5B?5dtor?5?6?$AA@" = comdat any
+
+$"??_C@_0N@HMNCGOCN@?5in?5A?5dtor?5?6?$AA@" = comdat any
+
+@"?g@@3HA" = dso_local global i32 0, align 4
+@"??_C@_0CM@KAOHJHDK@?5Test?5CPP?5unwind?3?5in?5catch?5handl@" = linkonce_odr dso_local unnamed_addr constant [44 x i8] c" Test CPP unwind: in catch handler i = %d \0A\00", comdat, align 1
+@"??_C@_0N@FCCEEGKL@?5in?5C?5dtor?5?6?$AA@" = linkonce_odr dso_local unnamed_addr constant [13 x i8] c" in C dtor \0A\00", comdat, align 1
+@"??_C@_0N@EFFPFCOI@?5in?5B?5dtor?5?6?$AA@" = linkonce_odr dso_local unnamed_addr constant [13 x i8] c" in B dtor \0A\00", comdat, align 1
+@"??_C@_0N@HMNCGOCN@?5in?5A?5dtor?5?6?$AA@" = linkonce_odr dso_local unnamed_addr constant [13 x i8] c" in A dtor \0A\00", comdat, align 1
+
+; Function Attrs: noinline optnone
+define dso_local void @"?crash@@YAXH@Z"(i32 %i) #0 personality i8* bitcast (i32 (...)* @__CxxFrameHandler3 to i8*) {
+entry:
+  %i.addr = alloca i32, align 4
+  %ObjA = alloca %struct.A, align 1
+  %ObjB = alloca %struct.B, align 1
+  %ObjC = alloca %struct.C, align 1
+  store i32 %i, i32* %i.addr, align 4
+  invoke void @llvm.seh.scope.begin()
+          to label %invoke.cont unwind label %ehcleanup13
+
+invoke.cont:                                      ; preds = %entry
+  %0 = load i32, i32* %i.addr, align 4
+  %cmp = icmp eq i32 %0, 0
+  br i1 %cmp, label %if.then, label %if.end
+
+if.then:                                          ; preds = %invoke.cont
+  store volatile i32 0, i32* inttoptr (i64 17 to i32*), align 4
+  br label %if.end
+
+if.end:                                           ; preds = %if.then, %invoke.cont
+  invoke void @llvm.seh.scope.begin()
+          to label %invoke.cont1 unwind label %ehcleanup11
+
+invoke.cont1:                                     ; preds = %if.end
+  %1 = load i32, i32* %i.addr, align 4
+  %cmp2 = icmp eq i32 %1, 1
+  br i1 %cmp2, label %if.then3, label %if.end4
+
+if.then3:                                         ; preds = %invoke.cont1
+  store volatile i32 0, i32* inttoptr (i64 17 to i32*), align 4
+  br label %if.end4
+
+if.end4:                                          ; preds = %if.then3, %invoke.cont1
+  invoke void @llvm.seh.scope.begin()
+          to label %invoke.cont5 unwind label %ehcleanup
+
+invoke.cont5:                                     ; preds = %if.end4
+  %2 = load i32, i32* %i.addr, align 4
+  %cmp6 = icmp eq i32 %2, 2
+  br i1 %cmp6, label %if.then7, label %if.end8
+
+if.then7:                                         ; preds = %invoke.cont5
+  store volatile i32 0, i32* inttoptr (i64 17 to i32*), align 4
+  br label %if.end8
+
+if.end8:                                          ; preds = %if.then7, %invoke.cont5
+  invoke void @llvm.seh.scope.end()
+          to label %invoke.cont9 unwind label %ehcleanup
+
+invoke.cont9:                                     ; preds = %if.end8
+  call void @"??1C@?1??crash@@YAXH@Z@QEAA@XZ"(%struct.C* %ObjC) #6
+  invoke void @llvm.seh.scope.end()
+          to label %invoke.cont10 unwind label %ehcleanup11
+
+invoke.cont10:                                    ; preds = %invoke.cont9
+  call void @"??1B@?1??crash@@YAXH@Z@QEAA@XZ"(%struct.B* %ObjB) #6
+  invoke void @llvm.seh.scope.end()
+          to label %invoke.cont12 unwind label %ehcleanup13
+
+invoke.cont12:                                    ; preds = %invoke.cont10
+  call void @"??1A@?1??crash@@YAXH@Z@QEAA@XZ"(%struct.A* %ObjA) #6
+  ret void
+
+ehcleanup:                                        ; preds = %if.end8, %if.end4
+  %3 = cleanuppad within none []
+  call void @"??1C@?1??crash@@YAXH@Z@QEAA@XZ"(%struct.C* %ObjC) #6 [ "funclet"(token %3) ]
+  cleanupret from %3 unwind label %ehcleanup11
+
+ehcleanup11:                                      ; preds = %invoke.cont9, %ehcleanup, %if.end
+  %4 = cleanuppad within none []
+  call void @"??1B@?1??crash@@YAXH@Z@QEAA@XZ"(%struct.B* %ObjB) #6 [ "funclet"(token %4) ]
+  cleanupret from %4 unwind label %ehcleanup13
+
+ehcleanup13:                                      ; preds = %invoke.cont10, %ehcleanup11, %entry
+  %5 = cleanuppad within none []
+  call void @"??1A@?1??crash@@YAXH@Z@QEAA@XZ"(%struct.A* %ObjA) #6 [ "funclet"(token %5) ]
+  cleanupret from %5 unwind to caller
+}
+
+; Function Attrs: nounwind readnone
+declare dso_local void @llvm.seh.scope.begin() #1
+
+declare dso_local i32 @__CxxFrameHandler3(...)
+
+; Function Attrs: nounwind readnone
+declare dso_local void @llvm.seh.scope.end() #1
+
+; Function Attrs: noinline nounwind optnone
+define internal void @"??1C@?1??crash@@YAXH@Z@QEAA@XZ"(%struct.C* %this) unnamed_addr #2 align 2 {
+entry:
+  %this.addr = alloca %struct.C*, align 8
+  store %struct.C* %this, %struct.C** %this.addr, align 8
+  %this1 = load %struct.C*, %struct.C** %this.addr, align 8
+  call void (...) @"?printf@@YAXZZ"(i8* getelementptr inbounds ([13 x i8], [13 x i8]* @"??_C@_0N@FCCEEGKL@?5in?5C?5dtor?5?6?$AA@", i64 0, i64 0))
+  ret void
+}
+
+; Function Attrs: noinline nounwind optnone
+define internal void @"??1B@?1??crash@@YAXH@Z@QEAA@XZ"(%struct.B* %this) unnamed_addr #2 align 2 {
+entry:
+  %this.addr = alloca %struct.B*, align 8
+  store %struct.B* %this, %struct.B** %this.addr, align 8
+  %this1 = load %struct.B*, %struct.B** %this.addr, align 8
+  call void (...) @"?printf@@YAXZZ"(i8* getelementptr inbounds ([13 x i8], [13 x i8]* @"??_C@_0N@EFFPFCOI@?5in?5B?5dtor?5?6?$AA@", i64 0, i64 0))
+  ret void
+}
+
+; Function Attrs: noinline nounwind optnone
+define internal void @"??1A@?1??crash@@YAXH@Z@QEAA@XZ"(%struct.A* %this) unnamed_addr #2 align 2 {
+entry:
+  %this.addr = alloca %struct.A*, align 8
+  store %struct.A* %this, %struct.A** %this.addr, align 8
+  %this1 = load %struct.A*, %struct.A** %this.addr, align 8
+  call void (...) @"?printf@@YAXZZ"(i8* getelementptr inbounds ([13 x i8], [13 x i8]* @"??_C@_0N@HMNCGOCN@?5in?5A?5dtor?5?6?$AA@", i64 0, i64 0))
+  ret void
+}
+
+; Function Attrs: noinline norecurse optnone
+define dso_local i32 @main() #3 personality i8* bitcast (i32 (...)* @__C_specific_handler to i8*) {
+entry:
+  %retval = alloca i32, align 4
+  %i = alloca i32, align 4
+  %__exception_code = alloca i32, align 4
+  store i32 0, i32* %retval, align 4
+  store i32 0, i32* %i, align 4
+  br label %for.cond
+
+for.cond:                                         ; preds = %for.inc, %entry
+  %0 = load i32, i32* %i, align 4
+  %cmp = icmp slt i32 %0, 3
+  br i1 %cmp, label %for.body, label %for.end
+
+for.body:                                         ; preds = %for.cond
+  invoke void @llvm.seh.try.begin()
+          to label %invoke.cont unwind label %catch.dispatch
+
+invoke.cont:                                      ; preds = %for.body
+  %1 = load volatile i32, i32* %i, align 4
+  invoke void @"?crash@@YAXH@Z"(i32 %1) #7
+          to label %invoke.cont1 unwind label %catch.dispatch
+
+invoke.cont1:                                     ; preds = %invoke.cont
+  invoke void @llvm.seh.try.end()
+          to label %invoke.cont2 unwind label %catch.dispatch
+
+catch.dispatch:                                   ; preds = %invoke.cont1, %invoke.cont, %for.body
+  %2 = catchswitch within none [label %__except] unwind to caller
+
+__except:                                         ; preds = %catch.dispatch
+  %3 = catchpad within %2 [i8* null]
+  catchret from %3 to label %__except3
+
+__except3:                                        ; preds = %__except
+  %4 = call i32 @llvm.eh.exceptioncode(token %3)
+  store i32 %4, i32* %__exception_code, align 4
+  %5 = load i32, i32* %i, align 4
+  call void (...) @"?printf@@YAXZZ"(i8* getelementptr inbounds ([44 x i8], [44 x i8]* @"??_C@_0CM@KAOHJHDK@?5Test?5CPP?5unwind?3?5in?5catch?5handl@", i64 0, i64 0), i32 %5)
+  br label %__try.cont
+
+__try.cont:                                       ; preds = %__except3, %invoke.cont2
+  br label %for.inc
+
+for.inc:                                          ; preds = %__try.cont
+  %6 = load i32, i32* %i, align 4
+  %inc = add nsw i32 %6, 1
+  store i32 %inc, i32* %i, align 4
+  br label %for.cond
+
+invoke.cont2:                                     ; preds = %invoke.cont1
+  br label %__try.cont
+
+for.end:                                          ; preds = %for.cond
+  ret i32 0
+}
+
+; Function Attrs: nounwind willreturn
+declare dso_local void @llvm.seh.try.begin() #4
+
+declare dso_local i32 @__C_specific_handler(...)
+
+; Function Attrs: nounwind willreturn
+declare dso_local void @llvm.seh.try.end() #4
+
+; Function Attrs: nounwind readnone
+declare i32 @llvm.eh.exceptioncode(token) #1
+
+declare dso_local void @"?printf@@YAXZZ"(...) #5
+
+attributes #0 = { noinline optnone "correctly-rounded-divide-sqrt-fp-math"="false" "disable-tail-calls"="false" "frame-pointer"="none" "less-precise-fpmad"="false" "min-legal-vector-width"="0" "no-infs-fp-math"="false" "no-jump-tables"="false" "no-nans-fp-math"="false" "no-signed-zeros-fp-math"="false" "no-trapping-math"="false" "stack-protector-buffer-size"="8" "target-features"="+cx8,+mmx,+sse,+sse2,+x87" "unsafe-fp-math"="false" "use-soft-float"="false" }
+attributes #1 = { nounwind readnone }
+attributes #2 = { noinline nounwind optnone "correctly-rounded-divide-sqrt-fp-math"="false" "disable-tail-calls"="false" "frame-pointer"="none" "less-precise-fpmad"="false" "min-legal-vector-width"="0" "no-infs-fp-math"="false" "no-jump-tables"="false" "no-nans-fp-math"="false" "no-signed-zeros-fp-math"="false" "no-trapping-math"="false" "stack-protector-buffer-size"="8" "target-features"="+cx8,+mmx,+sse,+sse2,+x87" "unsafe-fp-math"="false" "use-soft-float"="false" }
+attributes #3 = { noinline norecurse optnone "correctly-rounded-divide-sqrt-fp-math"="false" "disable-tail-calls"="false" "frame-pointer"="none" "less-precise-fpmad"="false" "min-legal-vector-width"="0" "no-infs-fp-math"="false" "no-jump-tables"="false" "no-nans-fp-math"="false" "no-signed-zeros-fp-math"="false" "no-trapping-math"="false" "stack-protector-buffer-size"="8" "target-features"="+cx8,+mmx,+sse,+sse2,+x87" "unsafe-fp-math"="false" "use-soft-float"="false" }
+attributes #4 = { nounwind willreturn }
+attributes #5 = { "correctly-rounded-divide-sqrt-fp-math"="false" "disable-tail-calls"="false" "frame-pointer"="none" "less-precise-fpmad"="false" "no-infs-fp-math"="false" "no-nans-fp-math"="false" "no-signed-zeros-fp-math"="false" "no-trapping-math"="false" "stack-protector-buffer-size"="8" "target-features"="+cx8,+mmx,+sse,+sse2,+x87" "unsafe-fp-math"="false" "use-soft-float"="false" }
+attributes #6 = { nounwind }
+attributes #7 = { noinline }
+
+!llvm.module.flags = !{!0, !1}
+
+!0 = !{i32 1, !"wchar_size", i32 2}
+!1 = !{i32 2, !"eh-asynch", i32 1}

llvm/test/CodeGen/X86/windows-seh-EHa-TryInFinally.ll

+; RUN: llc -verify-machineinstrs < %s | FileCheck %s
+
+; CHECK-LABEL: "?fin$0@0@main@@"
+; CHECK:      .seh_handlerdata
+; CHECK:      .set ".L?fin$0@0@main@@$parent_frame_offset", 48
+; CHECK-NEXT:        .long   (.Llsda_end1-.Llsda_begin1)/16 
+; CHECK-NEXT: .Llsda_begin1:
+; CHECK-NEXT:        .long   .Ltmp
+; CHECK-NEXT:        .long   .Ltmp
+; CHECK-NEXT:        .long   "?dtor$
+; CHECK-NEXT:        .long   0
+; CHECK-NEXT: .Llsda_end1:
+
+; ModuleID = 'windows-seh-EHa-TryInFinally.cpp'
+source_filename = "windows-seh-EHa-TryInFinally.cpp"
+target datalayout = "e-m:w-p270:32:32-p271:32:32-p272:64:64-i64:64-f80:128-n8:16:32:64-S128"
+target triple = "x86_64-unknown-windows-msvc"
+
+$"??_C@_0CI@MDFPIOJJ@?5?9?9?9?5Test?5_Try?5in?5_finally?5?9?9?9?5i@" = comdat any
+
+$"??_C@_0BN@HHKJHLBE@?5?5In?5Inner?5_finally?5i?5?$DN?5?$CFd?5?6?$AA@" = comdat any
+
+$"??_C@_0BN@HAIIIOKI@?5?5In?5outer?5_finally?5i?5?$DN?5?$CFd?5?6?$AA@" = comdat any
+
+$"??_C@_0BJ@OJMMAGCD@?5?5In?5outer?5_try?5i?5?$DN?5?$CFd?5?6?$AA@" = comdat any
+
+$"??_C@_0CG@ENDJHCGA@?5?9?9?9?5In?5outer?5except?5handler?5i?5?$DN@" = comdat any
+
+@"??_C@_0CI@MDFPIOJJ@?5?9?9?9?5Test?5_Try?5in?5_finally?5?9?9?9?5i@" = linkonce_odr dso_local unnamed_addr constant [40 x i8] c" --- Test _Try in _finally --- i = %d \0A\00", comdat, align 1
+@"??_C@_0BN@HHKJHLBE@?5?5In?5Inner?5_finally?5i?5?$DN?5?$CFd?5?6?$AA@" = linkonce_odr dso_local unnamed_addr constant [29 x i8] c"  In Inner _finally i = %d \0A\00", comdat, align 1
+@"??_C@_0BN@HAIIIOKI@?5?5In?5outer?5_finally?5i?5?$DN?5?$CFd?5?6?$AA@" = linkonce_odr dso_local unnamed_addr constant [29 x i8] c"  In outer _finally i = %d \0A\00", comdat, align 1
+@"??_C@_0BJ@OJMMAGCD@?5?5In?5outer?5_try?5i?5?$DN?5?$CFd?5?6?$AA@" = linkonce_odr dso_local unnamed_addr constant [25 x i8] c"  In outer _try i = %d \0A\00", comdat, align 1
+@"??_C@_0CG@ENDJHCGA@?5?9?9?9?5In?5outer?5except?5handler?5i?5?$DN@" = linkonce_odr dso_local unnamed_addr constant [38 x i8] c" --- In outer except handler i = %d \0A\00", comdat, align 1
+
+; Function Attrs: noinline norecurse optnone
+define dso_local i32 @main() #0 personality i8* bitcast (i32 (...)* @__C_specific_handler to i8*) {
+entry:
+  %retval = alloca i32, align 4
+  %i = alloca i32, align 4
+  %__exception_code = alloca i32, align 4
+  call void (...) @llvm.localescape(i32* %i)
+  store i32 0, i32* %retval, align 4
+  store i32 0, i32* %i, align 4
+  br label %for.cond
+
+for.cond:                                         ; preds = %for.inc, %entry
+  %0 = load i32, i32* %i, align 4
+  %cmp = icmp slt i32 %0, 3
+  br i1 %cmp, label %for.body, label %for.end
+
+for.body:                                         ; preds = %for.cond
+  %1 = load i32, i32* %i, align 4
+  call void (...) @"?printf@@YAXZZ"(i8* getelementptr inbounds ([40 x i8], [40 x i8]* @"??_C@_0CI@MDFPIOJJ@?5?9?9?9?5Test?5_Try?5in?5_finally?5?9?9?9?5i@", i64 0, i64 0), i32 %1)
+  invoke void @llvm.seh.try.begin()
+          to label %invoke.cont unwind label %catch.dispatch
+
+invoke.cont:                                      ; preds = %for.body
+  invoke void @llvm.seh.try.begin()
+          to label %invoke.cont1 unwind label %ehcleanup
+
+invoke.cont1:                                     ; preds = %invoke.cont
+  %2 = load volatile i32, i32* %i, align 4
+  invoke void (...) @"?printf@@YAXZZ"(i8* getelementptr inbounds ([25 x i8], [25 x i8]* @"??_C@_0BJ@OJMMAGCD@?5?5In?5outer?5_try?5i?5?$DN?5?$CFd?5?6?$AA@", i64 0, i64 0), i32 %2) #6
+          to label %invoke.cont2 unwind label %ehcleanup
+
+invoke.cont2:                                     ; preds = %invoke.cont1
+  %3 = load volatile i32, i32* %i, align 4
+  %cmp3 = icmp eq i32 %3, 0
+  br i1 %cmp3, label %if.then, label %if.end
+
+if.then:                                          ; preds = %invoke.cont2
+  store volatile i32 0, i32* inttoptr (i64 17 to i32*), align 4
+  br label %if.end
+
+if.end:                                           ; preds = %if.then, %invoke.cont2
+  invoke void @llvm.seh.try.end()
+          to label %invoke.cont4 unwind label %ehcleanup
+
+invoke.cont4:                                     ; preds = %if.end
+  %4 = call i8* @llvm.localaddress()
+  invoke void @"?fin$0@0@main@@"(i8 0, i8* %4) #6
+          to label %invoke.cont5 unwind label %catch.dispatch
+
+invoke.cont5:                                     ; preds = %invoke.cont4
+  invoke void @llvm.seh.try.end()
+          to label %invoke.cont7 unwind label %catch.dispatch
+
+catch.dispatch:                                   ; preds = %invoke.cont5, %invoke.cont6, %ehcleanup, %invoke.cont4, %for.body
+  %5 = catchswitch within none [label %__except] unwind to caller
+
+__except:                                         ; preds = %catch.dispatch
+  %6 = catchpad within %5 [i8* null]
+  catchret from %6 to label %__except8
+
+__except8:                                        ; preds = %__except
+  %7 = call i32 @llvm.eh.exceptioncode(token %6)
+  store i32 %7, i32* %__exception_code, align 4
+  %8 = load i32, i32* %i, align 4
+  call void (...) @"?printf@@YAXZZ"(i8* getelementptr inbounds ([38 x i8], [38 x i8]* @"??_C@_0CG@ENDJHCGA@?5?9?9?9?5In?5outer?5except?5handler?5i?5?$DN@", i64 0, i64 0), i32 %8)
+  br label %__try.cont
+
+__try.cont:                                       ; preds = %__except8, %invoke.cont7
+  br label %for.inc
+
+for.inc:                                          ; preds = %__try.cont
+  %9 = load i32, i32* %i, align 4
+  %inc = add nsw i32 %9, 1
+  store i32 %inc, i32* %i, align 4
+  br label %for.cond
+
+invoke.cont7:                                     ; preds = %invoke.cont5
+  br label %__try.cont
+
+ehcleanup:                                        ; preds = %if.end, %invoke.cont1, %invoke.cont
+  %10 = cleanuppad within none []
+  %11 = call i8* @llvm.localaddress()
+  invoke void @"?fin$0@0@main@@"(i8 1, i8* %11) #6 [ "funclet"(token %10) ]
+          to label %invoke.cont6 unwind label %catch.dispatch
+
+invoke.cont6:                                     ; preds = %ehcleanup
+  cleanupret from %10 unwind label %catch.dispatch
+
+for.end:                                          ; preds = %for.cond
+  ret i32 0
+}
+
+declare dso_local void @"?printf@@YAXZZ"(...) #1
+
+; Function Attrs: nounwind willreturn
+declare dso_local void @llvm.seh.try.begin() #2
+
+declare dso_local i32 @__C_specific_handler(...)
+
+; Function Attrs: noinline
+define internal void @"?fin$0@0@main@@"(i8 %abnormal_termination, i8* %frame_pointer) #3 personality i8* bitcast (i32 (...)* @__C_specific_handler to i8*) {
+entry:
+  %frame_pointer.addr = alloca i8*, align 8
+  %abnormal_termination.addr = alloca i8, align 1
+  %0 = call i8* @llvm.localrecover(i8* bitcast (i32 ()* @main to i8*), i8* %frame_pointer, i32 0)
+  %i = bitcast i8* %0 to i32*
+  store i8* %frame_pointer, i8** %frame_pointer.addr, align 8
+  store i8 %abnormal_termination, i8* %abnormal_termination.addr, align 1
+  invoke void @llvm.seh.try.begin()
+          to label %invoke.cont unwind label %ehcleanup
+
+invoke.cont:                                      ; preds = %entry
+  %1 = load volatile i32, i32* %i, align 4
+  invoke void (...) @"?printf@@YAXZZ"(i8* getelementptr inbounds ([29 x i8], [29 x i8]* @"??_C@_0BN@HAIIIOKI@?5?5In?5outer?5_finally?5i?5?$DN?5?$CFd?5?6?$AA@", i64 0, i64 0), i32 %1) #6
+          to label %invoke.cont1 unwind label %ehcleanup
+
+invoke.cont1:                                     ; preds = %invoke.cont
+  %2 = load volatile i32, i32* %i, align 4
+  %cmp = icmp eq i32 %2, 1
+  br i1 %cmp, label %if.then, label %if.end
+
+if.then:                                          ; preds = %invoke.cont1
+  store volatile i32 0, i32* inttoptr (i64 17 to i32*), align 4
+  br label %if.end
+
+if.end:                                           ; preds = %if.then, %invoke.cont1
+  invoke void @llvm.seh.try.end()
+          to label %invoke.cont2 unwind label %ehcleanup
+
+invoke.cont2:                                     ; preds = %if.end
+  call void @"?fin$1@0@main@@"(i8 0, i8* %frame_pointer)
+  ret void
+
+ehcleanup:                                        ; preds = %if.end, %invoke.cont, %entry
+  %3 = cleanuppad within none []
+  call void @"?fin$1@0@main@@"(i8 1, i8* %frame_pointer) [ "funclet"(token %3) ]
+  cleanupret from %3 unwind to caller
+}
+
+; Function Attrs: nounwind readnone
+declare i8* @llvm.localrecover(i8*, i8*, i32 immarg) #4
+
+; Function Attrs: noinline
+define internal void @"?fin$1@0@main@@"(i8 %abnormal_termination, i8* %frame_pointer) #3 {
+entry:
+  %frame_pointer.addr = alloca i8*, align 8
+  %abnormal_termination.addr = alloca i8, align 1
+  %0 = call i8* @llvm.localrecover(i8* bitcast (i32 ()* @main to i8*), i8* %frame_pointer, i32 0)
+  %i = bitcast i8* %0 to i32*
+  store i8* %frame_pointer, i8** %frame_pointer.addr, align 8
+  store i8 %abnormal_termination, i8* %abnormal_termination.addr, align 1
+  %1 = load i32, i32* %i, align 4
+  call void (...) @"?printf@@YAXZZ"(i8* getelementptr inbounds ([29 x i8], [29 x i8]* @"??_C@_0BN@HHKJHLBE@?5?5In?5Inner?5_finally?5i?5?$DN?5?$CFd?5?6?$AA@", i64 0, i64 0), i32 %1)
+  %2 = load i32, i32* %i, align 4
+  %cmp = icmp eq i32 %2, 2
+  br i1 %cmp, label %if.then, label %if.end
+
+if.then:                                          ; preds = %entry
+  store volatile i32 0, i32* inttoptr (i64 17 to i32*), align 4
+  br label %if.end
+
+if.end:                                           ; preds = %if.then, %entry
+  ret void
+}
+
+; Function Attrs: nounwind willreturn
+declare dso_local void @llvm.seh.try.end() #2
+
+; Function Attrs: nounwind readnone
+declare i8* @llvm.localaddress() #4
+
+; Function Attrs: nounwind readnone
+declare i32 @llvm.eh.exceptioncode(token) #4
+
+; Function Attrs: nounwind
+declare void @llvm.localescape(...) #5
+
+attributes #0 = { noinline norecurse optnone "correctly-rounded-divide-sqrt-fp-math"="false" "disable-tail-calls"="false" "frame-pointer"="none" "less-precise-fpmad"="false" "min-legal-vector-width"="0" "no-infs-fp-math"="false" "no-jump-tables"="false" "no-nans-fp-math"="false" "no-signed-zeros-fp-math"="false" "no-trapping-math"="false" "stack-protector-buffer-size"="8" "target-features"="+cx8,+mmx,+sse,+sse2,+x87" "unsafe-fp-math"="false" "use-soft-float"="false" }
+attributes #1 = { "correctly-rounded-divide-sqrt-fp-math"="false" "disable-tail-calls"="false" "frame-pointer"="none" "less-precise-fpmad"="false" "no-infs-fp-math"="false" "no-nans-fp-math"="false" "no-signed-zeros-fp-math"="false" "no-trapping-math"="false" "stack-protector-buffer-size"="8" "target-features"="+cx8,+mmx,+sse,+sse2,+x87" "unsafe-fp-math"="false" "use-soft-float"="false" }
+attributes #2 = { nounwind willreturn }
+attributes #3 = { noinline "correctly-rounded-divide-sqrt-fp-math"="false" "disable-tail-calls"="false" "frame-pointer"="none" "less-precise-fpmad"="false" "min-legal-vector-width"="0" "no-infs-fp-math"="false" "no-nans-fp-math"="false" "no-signed-zeros-fp-math"="false" "no-trapping-math"="false" "stack-protector-buffer-size"="8" "target-features"="+cx8,+mmx,+sse,+sse2,+x87" "unsafe-fp-math"="false" "use-soft-float"="false" }
+attributes #4 = { nounwind readnone }
+attributes #5 = { nounwind }
+attributes #6 = { noinline }
+
+!llvm.module.flags = !{!0, !1}
+
+!0 = !{i32 1, !"wchar_size", i32 2}
+!1 = !{i32 2, !"eh-asynch", i32 1}
+