[ARM SEH 7] [ARM] Adjust the frame pointer when it's needed for SEH unwinding

[mstorsjo]

Summary

For functions that require restoring SP from FP (e.g. that need to
align the stack, or that have variable sized allocations), the prologue
and epilogue previously used to look like this:

push {r4-r5, r11, lr}
add r11, sp, #8
...
sub r4, r11, #8
mov sp, r4
pop {r4-r5, r11, pc}

This is problematic, because this unwinding operation (restoring sp
from r11 + offset) can't be expressed with the SEH unwind opcodes
(probably because this unwind procedure doesn't map exactly to
individual instructions; note the detour via r4 in the epilogue too).

To make unwinding work, the GPR push is split into two; the first one
pushing all other registers, and the second one pushing r11+lr, so that
r11 can be set pointing at this spot on the stack:

push {r4-r5}
push {r11, lr}
mov r11, sp
...
mov sp, r11
pop {r11, lr}
pop {r4-r5}
bx lr

For the same setup, MSVC generates code that uses two registers;
r11 still pointing at the {r11,lr} pair, but a separate register
used for restoring the stack at the end:

push {r4-r5, r7, r11, lr}
add r11, sp, #12
mov r7, sp
...
mov sp, r7
pop {r4-r5, r7, r11, pc}

[efriedma]

Can we just rearrange the order we save registers on the stack? I mean, generating an extra push instruction just to satisfy the unwinder is sort of silly, but it seems like the least bad alternative. (And we only need to do it in cases involving dynamic allocation.)

push {r4-r5}
push {r11, lr}
mov r11, sp

[mstorsjo]

In D125649#3514665, @efriedma wrote:

Can we just rearrange the order we save registers on the stack? I mean, generating an extra push instruction just to satisfy the unwinder is sort of silly, but it seems like the least bad alternative. (And we only need to do it in cases involving dynamic allocation.)

push {r4-r5}
push {r11, lr}
mov r11, sp

Oh, thanks, that sounds like a good idea. I'll see how that turns out!

[mstorsjo]

Split the pushed registers into two, as suggested.

[efriedma]

Please add a testcase with VFP register spills. (Do we push them before FP? Does getMaxFPOffset need to account for that?)

[mstorsjo]

In D125649#3516571, @efriedma wrote:

Please add a testcase with VFP register spills. (Do we push them before FP? Does getMaxFPOffset need to account for that?)

Oh, crap. Indeed, those are pushed after FP right now, so they wouldn't be restored properly if we need to restore SP from FP. Fixing that will require a bit more messing around...

[mstorsjo]

Updated on top of the rest; store {r11,lr} below d8-d15 too, included that in the testcase.

[mstorsjo]

Updated after rebasing and updating earlier patches, no functional change since last update.

[efriedma]

llvm/test/CodeGen/ARM/Windows/wineh-framepointer.ll

26

We probably shouldn't include this seh_stackalloc_w in the prologue; not sure if the unwinder actually cares, but at best it has no effect.

[mstorsjo]

llvm/test/CodeGen/ARM/Windows/wineh-framepointer.ll

26

Yeah, I thought about that, but I was wary of making the emitPrologue code more complex than necessary, since we do need to cover this bit for the cases where we don't restore from a stack pointer. But I guess I could add a condition to end the SEH range of the prologue earlier, at least for the STI.splitFramePointerPush(MF) cases.

[mstorsjo]

llvm/test/CodeGen/ARM/Windows/wineh-framepointer.ll

26

Ok, it turned out to not be that bad after all.

[mstorsjo]

End the prologue after setting up the frame pointer for these cases.

[mstorsjo]

Fixed a bug in the previous revision, which broke a bunch of tests.

[efriedma]

LGTM

[mstorsjo]

Rebased after updating the preceding patch.

llvm/lib/Target/ARM/ARMBaseRegisterInfo.h

switch (Reg) {
     case R8: case R9: case R10: case R11: case R12:
       // iOS has this second area.
       return SplitFramePushPop;
     default:
       return false;
   }
 }
 
+static inline bool isSplitFPArea1Register(unsigned Reg,
+                                          bool SplitFramePushPop) {
+  using namespace ARM;
+
+  switch (Reg) {
+    case R0:  case R1:  case R2:  case R3:
+    case R4:  case R5:  case R6:  case R7:
+    case R8:  case R9:  case R10: case R12:
+    case SP:  case PC:
+      return true;
+    default:
+      return false;
+  }
+}
+
+static inline bool isSplitFPArea2Register(unsigned Reg,
+                                          bool SplitFramePushPop) {
+  using namespace ARM;
+
+  switch (Reg) {
+    case R11: case LR:
+      return true;
+    default:
+      return false;
+  }
+}
+
 static inline bool isARMArea3Register(unsigned Reg, bool SplitFramePushPop) {
   using namespace ARM;
 
   switch (Reg) {
     case D15: case D14: case D13: case D12:
     case D11: case D10: case D9:  case D8:
     case D7:  case D6:  case D5:  case D4:
     case D3:  case D2:  case D1:  case D0:

llvm/lib/Target/ARM/ARMBaseRegisterInfo.cpp

const MCPhysReg *RegList =
           ? CSR_iOS_SaveList
           : (UseSplitPush ? CSR_AAPCS_SplitPush_SaveList : CSR_AAPCS_SaveList);
 
   const Function &F = MF->getFunction();
   if (F.getCallingConv() == CallingConv::GHC) {
     // GHC set of callee saved regs is empty as all those regs are
     // used for passing STG regs around
     return CSR_NoRegs_SaveList;
+  } else if (STI.splitFramePointerPush(*MF)) {
+    return CSR_Win_SplitFP_SaveList;
   } else if (F.getCallingConv() == CallingConv::CFGuard_Check) {
     return CSR_Win_AAPCS_CFGuard_Check_SaveList;
   } else if (F.getCallingConv() == CallingConv::SwiftTail) {
     return STI.isTargetDarwin()
                ? CSR_iOS_SwiftTail_SaveList
                : (UseSplitPush ? CSR_AAPCS_SplitPush_SwiftTail_SaveList
                                : CSR_AAPCS_SwiftTail_SaveList);
   } else if (F.hasFnAttribute("interrupt")) {

llvm/lib/Target/ARM/ARMCallingConv.td

 // The order of callee-saved registers needs to match the order we actually push
 // them in FrameLowering, because this order is what's used by
 // PrologEpilogInserter to allocate frame index slots. So when R7 is the frame
 // pointer, we use this AAPCS alternative.
 def CSR_AAPCS_SplitPush : CalleeSavedRegs<(add LR, R7, R6, R5, R4,
                                                R11, R10, R9, R8,
                                                (sequence "D%u", 15, 8))>;
 
+def CSR_Win_SplitFP : CalleeSavedRegs<(add R10, R9, R8, R7, R6, R5, R4,
+                                               (sequence "D%u", 15, 8),
+                                               LR, R11)>;
+
 // R8 is used to pass swifterror, remove it from CSR.
 def CSR_AAPCS_SplitPush_SwiftError : CalleeSavedRegs<(sub CSR_AAPCS_SplitPush,
                                                       R8)>;
 
 // R10 is used to pass swifterror, remove it from CSR.
 def CSR_AAPCS_SplitPush_SwiftTail : CalleeSavedRegs<(sub CSR_AAPCS_SplitPush,
                                                      R10)>;
 

llvm/lib/Target/ARM/ARMFrameLowering.cpp

static MachineBasicBlock::iterator insertSEH(MachineBasicBlock::iterator MBBI,
   Flags |= MachineInstr::NoMerge;
 
   switch (Opc) {
   default:
     report_fatal_error("No SEH Opcode for instruction " + TII.getName(Opc));
     break;
   case ARM::t2ADDri:   // add.w r11, sp, #xx
   case ARM::t2ADDri12: // add.w r11, sp, #xx
-  case ARM::t2SUBri:   // sub.w r4, r11, #xx
   case ARM::t2MOVTi16: // movt  r4, #xx
   case ARM::t2MOVi16:  // movw  r4, #xx
   case ARM::tBL:       // bl __chkstk
     // These are harmless if used for just setting up a frame pointer,
     // but that frame pointer can't be relied upon for unwinding, unless
     // set up with SEH_SaveSP.
     MIB = BuildMI(MF, DL, TII.get(ARM::SEH_Nop))
               .addImm(/*Wide=*/1)

 }
 
 /// We need the offset of the frame pointer relative to other MachineFrameInfo
 /// offsets which are encoded relative to SP at function begin.
 /// See also emitPrologue() for how the FP is set up.
 /// Unfortunately we cannot determine this value in determineCalleeSaves() yet
 /// as assignCalleeSavedSpillSlots() hasn't run at this point. Instead we use
 /// this to produce a conservative estimate that we check in an assert() later.
-static int getMaxFPOffset(const ARMSubtarget &STI, const ARMFunctionInfo &AFI) {
+static int getMaxFPOffset(const ARMSubtarget &STI, const ARMFunctionInfo &AFI,
+                          const MachineFunction &MF) {
   // For Thumb1, push.w isn't available, so the first push will always push
   // r7 and lr onto the stack first.
   if (AFI.isThumb1OnlyFunction())
     return -AFI.getArgRegsSaveSize() - (2 * 4);
   // This is a conservative estimation: Assume the frame pointer being r7 and
   // pc("r15") up to r8 getting spilled before (= 8 registers).
-  int FPCXTSaveSize = (STI.hasV8_1MMainlineOps() && AFI.isCmseNSEntryFunction()) ? 4 : 0;
-  return - FPCXTSaveSize - AFI.getArgRegsSaveSize() - (8 * 4);
+  int MaxRegBytes = 8 * 4;
+  if (STI.splitFramePointerPush(MF)) {
+    // Here, r11 can be stored below all of r4-r15 (3 registers more than
+    // above), plus d8-d15.
+    MaxRegBytes = 11 * 4 + 8 * 8;
+  }
+  int FPCXTSaveSize =
+      (STI.hasV8_1MMainlineOps() && AFI.isCmseNSEntryFunction()) ? 4 : 0;
+  return -FPCXTSaveSize - AFI.getArgRegsSaveSize() - MaxRegBytes;
 }
 
 void ARMFrameLowering::emitPrologue(MachineFunction &MF,
                                     MachineBasicBlock &MBB) const {
   MachineBasicBlock::iterator MBBI = MBB.begin();
   MachineFrameInfo  &MFI = MF.getFrameInfo();
   ARMFunctionInfo *AFI = MF.getInfo<ARMFunctionInfo>();
   MachineModuleInfo &MMI = MF.getMMI();
if (NeedsWinCFI && MBBI != MBB.begin()) {
       BuildMI(MBB, MBBI, dl, TII.get(ARM::SEH_PrologEnd))
           .setMIFlag(MachineInstr::FrameSetup);
       MF.setHasWinCFI(true);
     }
     return;
   }
 
   // Determine spill area sizes.
+  if (STI.splitFramePointerPush(MF)) {
+    for (const CalleeSavedInfo &I : CSI) {
+      Register Reg = I.getReg();
+      int FI = I.getFrameIdx();
+      switch (Reg) {
+      case ARM::R11:
+      case ARM::LR:
+        if (Reg == FramePtr)
+          FramePtrSpillFI = FI;
+        GPRCS2Size += 4;
+        break;
+      case ARM::R0:
+      case ARM::R1:
+      case ARM::R2:
+      case ARM::R3:
+      case ARM::R4:
+      case ARM::R5:
+      case ARM::R6:
+      case ARM::R7:
+      case ARM::R8:
+      case ARM::R9:
+      case ARM::R10:
+      case ARM::R12:
+        GPRCS1Size += 4;
+        break;
+      case ARM::FPCXTNS:
+        FPCXTSaveSize = 4;
+        break;
+      default:
+        // This is a DPR. Exclude the aligned DPRCS2 spills.
+        if (Reg == ARM::D8)
+          D8SpillFI = FI;
+        if (Reg < ARM::D8 || Reg >= ARM::D8 + AFI->getNumAlignedDPRCS2Regs())
+          DPRCSSize += 8;
+      }
+    }
+  } else {
     for (const CalleeSavedInfo &I : CSI) {
       Register Reg = I.getReg();
       int FI = I.getFrameIdx();
       switch (Reg) {
       case ARM::R8:
       case ARM::R9:
       case ARM::R10:
       case ARM::R11:
       case ARM::R12:
         if (STI.splitFramePushPop(MF)) {
           GPRCS2Size += 4;
           break;
         }
         LLVM_FALLTHROUGH;
       case ARM::R0:
       case ARM::R1:
       case ARM::R2:
       case ARM::R3:
       case ARM::R4:
       case ARM::R5:
       case ARM::R6:
       case ARM::R7:
       case ARM::LR:
         if (Reg == FramePtr)
           FramePtrSpillFI = FI;
         GPRCS1Size += 4;
         break;
       case ARM::FPCXTNS:
         FPCXTSaveSize = 4;
         break;
       default:
         // This is a DPR. Exclude the aligned DPRCS2 spills.
         if (Reg == ARM::D8)
           D8SpillFI = FI;
         if (Reg < ARM::D8 || Reg >= ARM::D8 + AFI->getNumAlignedDPRCS2Regs())
           DPRCSSize += 8;
       }
     }
+  }
 
   MachineBasicBlock::iterator LastPush = MBB.end(), GPRCS1Push, GPRCS2Push;
 
   // Move past the PAC computation.
   if (AFI->shouldSignReturnAddress())
     LastPush = MBBI++;
 
   // Move past FPCXT area.
if (GPRCS1Size > 0) {
     DefCFAOffsetCandidates.addInst(LastPush, GPRCS1Size, true);
   }
 
   // Determine starting offsets of spill areas.
   unsigned FPCXTOffset = NumBytes - ArgRegsSaveSize - FPCXTSaveSize;
   unsigned GPRCS1Offset = FPCXTOffset - GPRCS1Size;
   unsigned GPRCS2Offset = GPRCS1Offset - GPRCS2Size;
   Align DPRAlign = DPRCSSize ? std::min(Align(8), Alignment) : Align(4);
-  unsigned DPRGapSize =
-      (GPRCS1Size + GPRCS2Size + FPCXTSaveSize + ArgRegsSaveSize) %
-      DPRAlign.value();
-
-  unsigned DPRCSOffset = GPRCS2Offset - DPRGapSize - DPRCSSize;
+  unsigned DPRGapSize = GPRCS1Size + FPCXTSaveSize + ArgRegsSaveSize;
+  if (!STI.splitFramePointerPush(MF)) {
+    DPRGapSize += GPRCS2Size;
+  }
+  DPRGapSize %= DPRAlign.value();
+
+  unsigned DPRCSOffset;
+  if (STI.splitFramePointerPush(MF)) {
+    DPRCSOffset = GPRCS1Offset - DPRGapSize - DPRCSSize;
+    GPRCS2Offset = DPRCSOffset - GPRCS2Size;
+  } else {
+    DPRCSOffset = GPRCS2Offset - DPRGapSize - DPRCSSize;
+  }
   int FramePtrOffsetInPush = 0;
   if (HasFP) {
     int FPOffset = MFI.getObjectOffset(FramePtrSpillFI);
-    assert(getMaxFPOffset(STI, *AFI) <= FPOffset &&
+    assert(getMaxFPOffset(STI, *AFI, MF) <= FPOffset &&
            "Max FP estimation is wrong");
     FramePtrOffsetInPush = FPOffset + ArgRegsSaveSize + FPCXTSaveSize;
     AFI->setFramePtrSpillOffset(MFI.getObjectOffset(FramePtrSpillFI) +
                                 NumBytes);
   }
   AFI->setGPRCalleeSavedArea1Offset(GPRCS1Offset);
   AFI->setGPRCalleeSavedArea2Offset(GPRCS2Offset);
   AFI->setDPRCalleeSavedAreaOffset(DPRCSOffset);
 
   // Move past area 2.
-  if (GPRCS2Size > 0) {
+  if (GPRCS2Size > 0 && !STI.splitFramePointerPush(MF)) {
     GPRCS2Push = LastPush = MBBI++;
     DefCFAOffsetCandidates.addInst(LastPush, GPRCS2Size);
   }
 
   // Prolog/epilog inserter assumes we correctly align DPRs on the stack, so our
   // .cfi_offset operations will reflect that.
   if (DPRGapSize) {
     assert(DPRGapSize == 4 && "unexpected alignment requirements for DPRs");
if (AFI->getNumAlignedDPRCS2Regs() > 0) {
     // The code inserted by emitAlignedDPRCS2Spills realigns the stack, and
     // leaves the stack pointer pointing to the DPRCS2 area.
     //
     // Adjust NumBytes to represent the stack slots below the DPRCS2 area.
     NumBytes += MFI.getObjectOffset(D8SpillFI);
   } else
     NumBytes = DPRCSOffset;
 
+  if (GPRCS2Size > 0 && STI.splitFramePointerPush(MF)) {
+    GPRCS2Push = LastPush = MBBI++;
+    DefCFAOffsetCandidates.addInst(LastPush, GPRCS2Size);
+  }
+
+  bool NeedsWinCFIStackAlloc = NeedsWinCFI;
+  if (STI.splitFramePointerPush(MF) && HasFP)
+    NeedsWinCFIStackAlloc = false;
+
   if (STI.isTargetWindows() && WindowsRequiresStackProbe(MF, NumBytes)) {
     uint32_t NumWords = NumBytes >> 2;
 
     if (NumWords < 65536) {
       BuildMI(MBB, MBBI, dl, TII.get(ARM::t2MOVi16), ARM::R4)
           .addImm(NumWords)
           .setMIFlags(MachineInstr::FrameSetup)
           .add(predOps(ARMCC::AL));
if (STI.isTargetWindows() && WindowsRequiresStackProbe(MF, NumBytes)) {
 
     MachineInstrBuilder Instr, SEH;
     Instr = BuildMI(MBB, MBBI, dl, TII.get(ARM::t2SUBrr), ARM::SP)
                 .addReg(ARM::SP, RegState::Kill)
                 .addReg(ARM::R4, RegState::Kill)
                 .setMIFlags(MachineInstr::FrameSetup)
                 .add(predOps(ARMCC::AL))
                 .add(condCodeOp());
-    if (NeedsWinCFI) {
+    if (NeedsWinCFIStackAlloc) {
       SEH = BuildMI(MF, dl, TII.get(ARM::SEH_StackAlloc))
                 .addImm(NumBytes)
                 .addImm(/*Wide=*/1)
                 .setMIFlags(MachineInstr::FrameSetup);
       MBB.insertAfter(Instr, SEH);
     }
     NumBytes = 0;
   }
void ARMFrameLowering::emitPrologue(MachineFunction &MF,
   }
 
   // Set FP to point to the stack slot that contains the previous FP.
   // For iOS, FP is R7, which has now been stored in spill area 1.
   // Otherwise, if this is not iOS, all the callee-saved registers go
   // into spill area 1, including the FP in R11.  In either case, it
   // is in area one and the adjustment needs to take place just after
   // that push.
+  MachineBasicBlock::iterator AfterPush;
   if (HasFP) {
-    MachineBasicBlock::iterator AfterPush = std::next(GPRCS1Push);
+    AfterPush = std::next(GPRCS1Push);
     unsigned PushSize = sizeOfSPAdjustment(*GPRCS1Push);
-    emitRegPlusImmediate(!AFI->isThumbFunction(), MBB, AfterPush,
-                         dl, TII, FramePtr, ARM::SP,
-                         PushSize + FramePtrOffsetInPush,
+    int FPOffset = PushSize + FramePtrOffsetInPush;
+    if (STI.splitFramePointerPush(MF)) {
+      AfterPush = std::next(GPRCS2Push);
+      emitRegPlusImmediate(!AFI->isThumbFunction(), MBB, AfterPush, dl, TII,
+                           FramePtr, ARM::SP, 0, MachineInstr::FrameSetup);
+    } else {
+      emitRegPlusImmediate(!AFI->isThumbFunction(), MBB, AfterPush, dl, TII,
+                           FramePtr, ARM::SP, FPOffset,
                            MachineInstr::FrameSetup);
+    }
     if (!NeedsWinCFI) {
       if (FramePtrOffsetInPush + PushSize != 0) {
         unsigned CFIIndex = MF.addFrameInst(MCCFIInstruction::cfiDefCfa(
             nullptr, MRI->getDwarfRegNum(FramePtr, true),
             FPCXTSaveSize + ArgRegsSaveSize - FramePtrOffsetInPush));
         BuildMI(MBB, AfterPush, dl, TII.get(TargetOpcode::CFI_INSTRUCTION))
             .addCFIIndex(CFIIndex)
             .setMIFlags(MachineInstr::FrameSetup);
       } else {
         unsigned CFIIndex =
             MF.addFrameInst(MCCFIInstruction::createDefCfaRegister(
                 nullptr, MRI->getDwarfRegNum(FramePtr, true)));
         BuildMI(MBB, AfterPush, dl, TII.get(TargetOpcode::CFI_INSTRUCTION))
             .addCFIIndex(CFIIndex)
             .setMIFlags(MachineInstr::FrameSetup);
       }
     }
   }
 
   // Emit a SEH opcode indicating the prologue end. The rest of the prologue
   // instructions below don't need to be replayed to unwind the stack.
   if (NeedsWinCFI && MBBI != MBB.begin()) {
-    insertSEHRange(MBB, {}, MBBI, TII, MachineInstr::FrameSetup);
-    BuildMI(MBB, MBBI, dl, TII.get(ARM::SEH_PrologEnd))
+    MachineBasicBlock::iterator End = MBBI;
+    if (HasFP && STI.splitFramePointerPush(MF))
+      End = AfterPush;
+    insertSEHRange(MBB, {}, End, TII, MachineInstr::FrameSetup);
+    BuildMI(MBB, End, dl, TII.get(ARM::SEH_PrologEnd))
         .setMIFlag(MachineInstr::FrameSetup);
     MF.setHasWinCFI(true);
   }
 
   // Now that the prologue's actual instructions are finalised, we can insert
   // the necessary DWARF cf instructions to describe the situation. Start by
   // recording where each register ended up:
   if (GPRCS1Size > 0 && !NeedsWinCFI) {
for (; i != 0; --i) {
       Register Reg = Info.getReg();
       if (!(Func)(Reg, STI.splitFramePushPop(MF))) continue;
 
       // The aligned reloads from area DPRCS2 are not inserted here.
       if (Reg >= ARM::D8 && Reg < ARM::D8 + NumAlignedDPRCS2Regs)
         continue;
       if (Reg == ARM::LR && !isTailCall && !isVarArg && !isInterrupt &&
           !isCmseEntry && !isTrap && AFI->getArgumentStackToRestore() == 0 &&
-          STI.hasV5TOps() && MBB.succ_empty() && !hasPAC) {
+          STI.hasV5TOps() && MBB.succ_empty() && !hasPAC &&
+          !STI.splitFramePointerPush(MF)) {
         Reg = ARM::PC;
         // Fold the return instruction into the LDM.
         DeleteRet = true;
         LdmOpc = AFI->isThumbFunction() ? ARM::t2LDMIA_RET : ARM::LDMIA_RET;
         // We 'restore' LR into PC so it is not live out of the return block:
         // Clear Restored bit.
         Info.setRestored(false);
       }
if (llvm::any_of(CSI, [](const CalleeSavedInfo &C) {
         return C.getReg() == ARM::FPCXTNS;
       })) {
     BuildMI(MBB, MI, DebugLoc(), STI.getInstrInfo()->get(ARM::VSTR_FPCXTNS_pre),
             ARM::SP)
         .addReg(ARM::SP)
         .addImm(-4)
         .add(predOps(ARMCC::AL));
   }
-  emitPushInst(MBB, MI, CSI, PushOpc, PushOneOpc, false, &isARMArea1Register, 0,
-               MachineInstr::FrameSetup);
-  emitPushInst(MBB, MI, CSI, PushOpc, PushOneOpc, false, &isARMArea2Register, 0,
-               MachineInstr::FrameSetup);
+  if (STI.splitFramePointerPush(MF)) {
+    emitPushInst(MBB, MI, CSI, PushOpc, PushOneOpc, false,
+                 &isSplitFPArea1Register, 0, MachineInstr::FrameSetup);
+    emitPushInst(MBB, MI, CSI, FltOpc, 0, true, &isARMArea3Register,
+                 NumAlignedDPRCS2Regs, MachineInstr::FrameSetup);
+    emitPushInst(MBB, MI, CSI, PushOpc, PushOneOpc, false,
+                 &isSplitFPArea2Register, 0, MachineInstr::FrameSetup);
+  } else {
+    emitPushInst(MBB, MI, CSI, PushOpc, PushOneOpc, false, &isARMArea1Register,
+                 0, MachineInstr::FrameSetup);
+    emitPushInst(MBB, MI, CSI, PushOpc, PushOneOpc, false, &isARMArea2Register,
+                 0, MachineInstr::FrameSetup);
     emitPushInst(MBB, MI, CSI, FltOpc, 0, true, &isARMArea3Register,
                  NumAlignedDPRCS2Regs, MachineInstr::FrameSetup);
+  }
 
   // The code above does not insert spill code for the aligned DPRCS2 registers.
   // The stack realignment code will be inserted between the push instructions
   // and these spills.
   if (NumAlignedDPRCS2Regs)
     emitAlignedDPRCS2Spills(MBB, MI, NumAlignedDPRCS2Regs, CSI, TRI);
 
   return true;
bool ARMFrameLowering::restoreCalleeSavedRegisters(
   unsigned NumAlignedDPRCS2Regs = AFI->getNumAlignedDPRCS2Regs();
 
   // The emitPopInst calls below do not insert reloads for the aligned DPRCS2
   // registers. Do that here instead.
   if (NumAlignedDPRCS2Regs)
     emitAlignedDPRCS2Restores(MBB, MI, NumAlignedDPRCS2Regs, CSI, TRI);
 
   unsigned PopOpc = AFI->isThumbFunction() ? ARM::t2LDMIA_UPD : ARM::LDMIA_UPD;
-  unsigned LdrOpc = AFI->isThumbFunction() ? ARM::t2LDR_POST :ARM::LDR_POST_IMM;
+  unsigned LdrOpc =
+      AFI->isThumbFunction() ? ARM::t2LDR_POST : ARM::LDR_POST_IMM;
   unsigned FltOpc = ARM::VLDMDIA_UPD;
+  if (STI.splitFramePointerPush(MF)) {
+    emitPopInst(MBB, MI, CSI, PopOpc, LdrOpc, isVarArg, false,
+                &isSplitFPArea2Register, 0);
+    emitPopInst(MBB, MI, CSI, FltOpc, 0, isVarArg, true, &isARMArea3Register,
+                NumAlignedDPRCS2Regs);
+    emitPopInst(MBB, MI, CSI, PopOpc, LdrOpc, isVarArg, false,
+                &isSplitFPArea1Register, 0);
+  } else {
     emitPopInst(MBB, MI, CSI, FltOpc, 0, isVarArg, true, &isARMArea3Register,
                 NumAlignedDPRCS2Regs);
     emitPopInst(MBB, MI, CSI, PopOpc, LdrOpc, isVarArg, false,
                 &isARMArea2Register, 0);
     emitPopInst(MBB, MI, CSI, PopOpc, LdrOpc, isVarArg, false,
                 &isARMArea1Register, 0);
+  }
 
   return true;
 }
 
 // FIXME: Make generic?
 static unsigned EstimateFunctionSizeInBytes(const MachineFunction &MF,
                                             const ARMBaseInstrInfo &TII) {
   unsigned FnSize = 0;
void ARMFrameLowering::determineCalleeSaves(MachineFunction &MF,
   bool HasBPOrFixedSP = RegInfo->hasBasePointer(MF) || !HasMovingSP;
 
   // If we have a frame pointer, we assume arguments will be accessed
   // relative to the frame pointer. Check whether fp-relative accesses to
   // arguments require scavenging.
   //
   // We could do slightly better on Thumb1; in some cases, an sp-relative
   // offset would be legal even though an fp-relative offset is not.
-  int MaxFPOffset = getMaxFPOffset(STI, *AFI);
+  int MaxFPOffset = getMaxFPOffset(STI, *AFI, MF);
   bool HasLargeArgumentList =
       HasFP && (MaxFixedOffset - MaxFPOffset) > (int)EstimatedRSFixedSizeLimit;
 
   bool BigFrameOffsets = HasLargeStack || !HasBPOrFixedSP ||
                          HasLargeArgumentList || HasNonSPFrameIndex;
   LLVM_DEBUG(dbgs() << "EstimatedLimit: " << EstimatedRSStackSizeLimit
                     << "; EstimatedStack: " << EstimatedStackSize
                     << "; EstimatedFPStack: " << MaxFixedOffset - MaxFPOffset

llvm/lib/Target/ARM/ARMSubtarget.h

#include "ARMGenSubtargetInfo.inc"
   bool splitFramePushPop(const MachineFunction &MF) const {
     if (MF.getInfo<ARMFunctionInfo>()->shouldSignReturnAddress())
       return true;
     return (getFramePointerReg() == ARM::R7 &&
             MF.getTarget().Options.DisableFramePointerElim(MF)) ||
            isThumb1Only();
   }
 
+  bool splitFramePointerPush(const MachineFunction &MF) const;
+
   bool useStride4VFPs() const;
 
   bool useMovt() const;
 
   bool supportsTailCall() const { return SupportsTailCall; }
 
   bool allowsUnalignedMem() const { return !StrictAlign; }
 

llvm/lib/Target/ARM/ARMSubtarget.cpp

 #include "MCTargetDesc/ARMMCTargetDesc.h"
 #include "Thumb1FrameLowering.h"
 #include "Thumb1InstrInfo.h"
 #include "Thumb2InstrInfo.h"
 #include "llvm/ADT/StringRef.h"
 #include "llvm/ADT/Triple.h"
 #include "llvm/ADT/Twine.h"
 #include "llvm/CodeGen/GlobalISel/InstructionSelect.h"
+#include "llvm/CodeGen/MachineFrameInfo.h"
 #include "llvm/CodeGen/MachineFunction.h"
 #include "llvm/IR/Function.h"
 #include "llvm/IR/GlobalValue.h"
 #include "llvm/MC/MCAsmInfo.h"
 #include "llvm/MC/MCTargetOptions.h"
 #include "llvm/Support/CodeGen.h"
 #include "llvm/Support/CommandLine.h"
 #include "llvm/Support/ARMTargetParser.h"
bool ARMSubtarget::ignoreCSRForAllocationOrder(const MachineFunction &MF,
   // To minimize code size in Thumb2, we prefer the usage of low regs (lower
   // cost per use) so we can  use narrow encoding. By default, caller-saved
   // registers (e.g. lr, r12) are always  allocated first, regardless of
   // their cost per use. When optForMinSize, we prefer the low regs even if
   // they are CSR because usually push/pop can be folded into existing ones.
   return isThumb2() && MF.getFunction().hasMinSize() &&
          ARM::GPRRegClass.contains(PhysReg);
 }
+
+bool ARMSubtarget::splitFramePointerPush(const MachineFunction &MF) const {
+  const Function &F = MF.getFunction();
+  if (!MF.getTarget().getMCAsmInfo()->usesWindowsCFI() ||
+      !F.needsUnwindTableEntry())
+    return false;
+  const MachineFrameInfo &MFI = MF.getFrameInfo();
+  return MFI.hasVarSizedObjects() || getRegisterInfo()->hasStackRealignment(MF);
+}

llvm/test/CodeGen/ARM/Windows/wineh-framepointer.ll

+;; Check that this produces the expected assembly output
+; RUN: llc -mtriple=thumbv7-windows -o - %s -verify-machineinstrs | FileCheck %s
+;; Also try to write an object file, which verifies that the SEH opcodes
+;; match the actual prologue/epilogue length.
+; RUN: llc -mtriple=thumbv7-windows -filetype=obj -o %t.obj %s -verify-machineinstrs
+
+; CHECK-LABEL: alloc_local:
+; CHECK-NEXT: .seh_proc alloc_local
+; CHECK-NEXT: @ %bb.0:                                @ %entry
+; CHECK-NEXT:         push.w  {r4, r5, r6, r7, r8, r9, r10}
+; CHECK-NEXT:         .seh_save_regs_w        {r4-r10}
+; CHECK-NEXT:         sub     sp, #4
+; CHECK-NEXT:         .seh_stackalloc 4
+; CHECK-NEXT:         vpush   {d8, d9, d10, d11, d12, d13, d14, d15}
+; CHECK-NEXT:         .seh_save_fregs         {d8-d15}
+; CHECK-NEXT:         push.w  {r11, lr}
+; CHECK-NEXT:         .seh_save_regs_w        {r11, lr}
+; CHECK-NEXT:         mov     r11, sp
+; CHECK-NEXT:         .seh_save_sp    r11
+; CHECK-NEXT:         .seh_endprologue
+; CHECK-NEXT:         movw    r4, #1256
+; CHECK-NEXT:         bl      __chkstk
+; CHECK-NEXT:         sub.w   sp, sp, r4
+; CHECK-NEXT:         mov     r4, sp
+; CHECK-NEXT:         bfc     r4, #0, #4
+; CHECK-NEXT:         mov     sp, r4
+
+; CHECK:              ldr.w   [[TMP:r[0-9]]], [r11, #104]
+; CHECK:              mov     r0, [[TMP]]
+
+; CHECK:              .seh_startepilogue
+; CHECK-NEXT:         mov     sp, r11
+; CHECK-NEXT:         .seh_save_sp    r11
+; CHECK-NEXT:         pop.w   {r11, lr}
+; CHECK-NEXT:         .seh_save_regs_w        {r11, lr}
+; CHECK-NEXT:         vpop    {d8, d9, d10, d11, d12, d13, d14, d15}
+; CHECK-NEXT:         .seh_save_fregs         {d8-d15}
+; CHECK-NEXT:         add     sp, #4
+; CHECK-NEXT:         .seh_stackalloc 4
+; CHECK-NEXT:         pop.w   {r4, r5, r6, r7, r8, r9, r10}
+; CHECK-NEXT:         .seh_save_regs_w        {r4-r10}
+; CHECK-NEXT:         bx      lr
+; CHECK-NEXT:         .seh_nop
+; CHECK-NEXT:         .seh_endepilogue
+; CHECK-NEXT:         .seh_endproc
+
+define arm_aapcs_vfpcc void @alloc_local(i32 noundef %a, i32 noundef %b, i32 noundef %c, i32 noundef %d, i32 noundef %e) uwtable {
+entry:
+  %buf2 = alloca [5000 x i8], align 16
+  %vla = alloca i8, i32 %a, align 1
+  call void @llvm.lifetime.start.p0(i64 5000, ptr nonnull %buf2) #3
+  call arm_aapcs_vfpcc void @other(i32 noundef %e, ptr noundef nonnull %vla, ptr noundef nonnull %buf2)
+  call void asm sideeffect "", "~{r4},~{r5},~{r6},~{r7},~{r8},~{r9},~{r10},~{r11},~{r12}"()
+  call void asm sideeffect "", "~{d8},~{d9},~{d10},~{d11},~{d12},~{d13},~{d14},~{d15}"()
+  call void @llvm.lifetime.end.p0(i64 5000, ptr nonnull %buf2) #3
+  ret void
+}
+
+declare void @llvm.lifetime.start.p0(i64 immarg, ptr nocapture)
+declare void @llvm.lifetime.end.p0(i64 immarg, ptr nocapture)
+
+declare arm_aapcs_vfpcc void @other(i32 noundef, ptr noundef, ptr noundef)