[MS ABI] Fix mangling references to declarations.

[bolshakov-a]

Summary

Several issues have been discovered and (hopefully) fixed here:

• Reference NTTPs should be mangled in the same manner as pointer ones.

• Pointer fields of class type NTTPs should be treated in the same

manner as reference ones.

• Pointer-to-member fields of class type NTTPs should be treated

differently compared to pointer-to-member NTTPs. Tests on
pointer-to-member-function NTTP class fields added.

• Correct mangling of pointers to anonymous union members.

• A bug in mangling references to subobjects fixed.

• Mangling array subscripts and base class members in references

to subobjects.

Reference NTTP mangling was done back in 2013
in e8fdc06e0dab2e7b98339425dbe369e27e2092a3, and Microsoft might change
mangling algorithm since then. But class type NTTPs are introduced only
in C++20, and the test was written in b637148ecb62b900872b34eedd78b923bb43c378.
It is strange if the MS ABI had been realy changed, because Microsoft
claims that they maintain ABI stability since VS 2015. I've tested both
on v142 and v143 MSVC toolsets, and they show the same behavior
on the test cases which are changed in this PR. But
pointer-to-member-function NTTP class field mangling has been actually
changed, because it was erroneous in v142, leading to name collisions.

Moreover, pointer-to-member mangling with conversions across class
hierarchy has been enabled.

[bolshakov-a]

Rebased.

[erichkeane]

Added the code owners here. There doesn't seem to be anything questionable here to me, but I want to make sure someone who really knows what is going on takes a look.

[efriedma]

clang/lib/AST/MicrosoftMangle.cpp

722

It's not obvious to me why the inheritance model is relevant here. If you want to check if the class has virtual bases, please do that explicitly. (Note that the inheritance model can be messed with using attributes; see https://learn.microsoft.com/en-us/cpp/cpp/inheritance-keywords.)

1874

It might be more clear here to use APValue::isNullPointer(), instead of checking if getMemberPointerDecl() returns null. At first glance, it's not really obvious why getMemberPointerDecl() would return null. And in theory, it's possible to have a non-null APValue where getMemberPointerDecl() returns null (although in this context, such cases should get rejected earlier).

[rjmccall]

clang/lib/AST/MicrosoftMangle.cpp

722

It would at least be good to test what exactly this is based on.

If RD is the base class of the member pointer type, isn't RD followed by the unqualified name of VD potentially ambiguous when there's any inheritance at all? You don't even need multiple inheritance, just the presence of multiple classes in the hierarchy that declare a field with the same name. I mean, if that's what MSVC does then we need to match it, but we should make certain by testing member pointers at different positions in the hierarchy of the declared base.

(And this is assuming the MSVC model that restricts what subclass member pointers are allowed in superclass member pointer types.)

[bolshakov-a]

Add test cases on unspecified inheritance.

[bolshakov-a]

Mangle pointer-to-members with conversion.

Pointer-to-member-functions with conversions across hierarchy work fine, as I can see.

I don't still understand how to mangle nested unnamed tags in general.

clang/lib/AST/MicrosoftMangle.cpp

722

@efriedma, MS inheritance model overrides real inheritance. I've added a couple of test cases to reflect this. Btw, thanks for the link! I really didn't understand what "unspecified inheritance" is and how it is even possible.

@rjmccall, thank you! I've updated the mangling to a more correct algorithm.

1874

APValue::isNullPointer() works only with LValues, not with MemberPointers:
https://github.com/llvm/llvm-project/blob/llvmorg-17-init/clang/lib/AST/APValue.cpp#L1000

[efriedma]

I don't still understand how to mangle nested unnamed tags in general.

According to some quick experiments, for the non-virtual case, you mangle a member of an unnamed union it the same way as a regular member, except you stick <unnamed-tag>@ into the mangling. Additional levels of nesting append 3's: <unnamed-tag>@3, <unnamed-tag>@33, etc.

---

The mangling with virtual inheritance seems pretty broken. The following produces a name collision on MSVC:

#pragma pointers_to_members(full_generality, virtual_inheritance)
struct Nested { int a; union { int k; int k2;}; };
struct DerivedVirtually : Nested { int a; };
struct D2 { int DerivedVirtually::*p; };
template<D2> void f() {}
template void f<D2{&Nested::k}>();
template void f<D2{&Nested::k2}>();

The following crashes MSVC:

struct A {};
struct Nested { int a; };
struct DerivedVirtually : virtual A, Nested { };
struct D2 { int DerivedVirtually::*p; };
template<D2> void f() {}
template void f<D2{&Nested::a}>();

clang/lib/AST/MicrosoftMangle.cpp

1249

maybe say "anonymous struct/union member pointer", if you don't implement this.

[bolshakov-a]

Additional levels of nesting append 3's: <unnamed-tag>@3, <unnamed-tag>@33, etc.

Yes, but if you have such a code:

struct A {
  union {
    union {
      struct B {};
      using T = B;
    };
  };
};
void f(A::T);

you have ?f@@YAXUB@<unnamed-tag>@2A@@@Z for f, and for such a code:

struct A {
  union {
    union {
      struct B { struct C {}; };
      using T = B::C;
    };
  };
};
void f(A::T);

you'd have ?f@@YAXUC@B@<unnamed-tag>@3A@@@Z. What are 2 and 3 in general? I don't know whether the aforementioned code is acceptable according to the standard, honestly. But if I put a code into the common place, I should figure out the common algorithm.

[bolshakov-a]

clang/lib/AST/MicrosoftMangle.cpp

1249

It is not specific only to member pointers, as the examples in my previous comment show.

[efriedma]

The numbers are backreferences of the sort generated by mangleSourceName(), I think. If you nest deeply enough, MSVC stops using them; for example:

struct A {
union {union { union {union {
struct B {struct C {struct D {struct E {struct F {struct G {
struct H {struct I {struct J {struct K {
};};};};};};};};};};
using T = B::C::D::E::F::G::H::I::J::K;
T x;
using T2 = B::C::D::E::F::G::H::I::J;
T2 y;
};};};};
};
void f(decltype(A::x)) {}
void f2(decltype(A::y)) {}
void *g = (void*)&f;
void *g2 = (void*)&f2;

[bolshakov-a]

Mangling of anonymous unions. @eli.friedman, thank you!

I don't know whether the aforementioned code is acceptable according to the standard, honestly.

It is not acceptable because anonymous unions cannot contain nested types. In fact, they cannot contain even other anonymous unions, according to the C++ standard:
https://timsong-cpp.github.io/cppwp/n4868/class.union.anon#1
But clang and MSVC both accept such code, probably because recursively nested anonymous structs and unions are allowed in C17. Hence, this case is handled for generality, but I'm not sure if this behavior should be nailed down in a test.

[bolshakov-a]

The following produces a name collision on MSVC

Clang reproduces this buggy behavior. Should it produce an explicit error instead? Or, maybe, some temporary correct algorithm should be found? (It is pretty sad if clang cannot provide new language features for Windows programs just because MSVC doesn't provide them...)

[bolshakov-a]

Fix mangling of references to subobjects.

[bolshakov-a]

Mangle array subscripts and base class members in references to subobjects.

[bolshakov-a]

Minor refactoring. Don't hide function parameter with local variable.

[bolshakov-a]

Ping.

[efriedma]

clang/lib/AST/MicrosoftMangle.cpp

1249

Weird indentation

1815–1817

Please just use SmallVector instead of std::stack.

[bolshakov-a]

clang/lib/AST/MicrosoftMangle.cpp

1249

I agree. Don't know why clang-format does so. Should I put clang-format off here?

[efriedma]

clang/lib/AST/MicrosoftMangle.cpp

1249

If clang-format won't cooperate, you can probably make it figure out what you're doing with something like

if (const auto *ID = dyn_cast<IndirectFieldDecl>(ND)) {
  for (unsigned I = 1, IE = ID->getChainingSize(); I < IE; ++I)
    mangleSourceName("<unnamed-tag>");
}

[bolshakov-a]

clang/lib/AST/MicrosoftMangle.cpp

1249

It doesn't help. Moreover, clang-format corrupts formatting in this function even without my changes. You can check it by yourself.

[efriedma]

clang/lib/AST/MicrosoftMangle.cpp

1249

I just tried "clang-format -i" on the file with your patch, and it seems to compute the correct indentation here. This with a source tree and clang-format binary from feb 28 because that's what I had handy... but I don't think anything relevant has changed here?

[bolshakov-a]

clang/lib/AST/MicrosoftMangle.cpp

1249

Running clang-format on the whole file really seems to produce correct formatting... But it is a lot of unrelated changes. Running clang-format only on the mangleNestedName function (--lines=1185:1287 without my changes, --lines=1242:1349 with my changes) produces bad formatting.

1815–1817

std::stack can be parameterized with container type (std::stack<char, SmallVector<char, 2>>). Or it should not be used for some other reason?

[bolshakov-a]

clang/lib/AST/MicrosoftMangle.cpp

1249

I could make a separate PR with formatting this file and fix this PR after landing that one.

[efriedma]

clang/lib/AST/MicrosoftMangle.cpp

1249

If clang-format --lines is broken, just fix the formatting by hand (and file a bug against clang-format).

1815–1817

Using std::stack as a wrapper around SmallVector is sort of pointless; you can just explicitly push_back/pop_back.

[bolshakov-a]

SmallVector instead of std::stack; fixing formatting.

[bolshakov-a]

clang/lib/AST/MicrosoftMangle.cpp

1249

Manual formatting without clang-format off doesn't pass pre-merge checks, of course. But, probably, it is not very important for landing?

I've played for a while with clang-format. clang-format --lines just reproduces indentation from previous block of code (switch in mangleUnqualifiedName in this case). I'm not sure whether it is a bug or a feature.

[efriedma]

LGTM

(Do you have commit access? If not, please specify the name/email you want for the "author" field.)

[bolshakov-a]

No, I don't have commit access. You could use just Bolshakov <[e-mail]>

[bolshakov-a]

Thanks!

clang/lib/AST/MicrosoftMangle.cpp

 #include "clang/AST/GlobalDecl.h"
 #include "clang/AST/Mangle.h"
 #include "clang/AST/VTableBuilder.h"
 #include "clang/Basic/ABI.h"
 #include "clang/Basic/DiagnosticOptions.h"
 #include "clang/Basic/FileManager.h"
 #include "clang/Basic/SourceManager.h"
 #include "clang/Basic/TargetInfo.h"
+#include "llvm/ADT/SmallVector.h"
 #include "llvm/ADT/StringExtras.h"
 #include "llvm/Support/CRC.h"
 #include "llvm/Support/MD5.h"
 #include "llvm/Support/MathExtras.h"
 #include "llvm/Support/StringSaver.h"
 #include "llvm/Support/xxhash.h"
+#include <functional>
 #include <optional>
 
 using namespace clang;
 
 namespace {
 
 // Get GlobalDecl of DeclContext of local entities.
 static GlobalDecl getGlobalDeclAsDeclContext(const DeclContext *DC) {
public:
   raw_ostream &getStream() const { return Out; }
 
   void mangle(GlobalDecl GD, StringRef Prefix = "?");
   void mangleName(GlobalDecl GD);
   void mangleFunctionEncoding(GlobalDecl GD, bool ShouldMangle);
   void mangleVariableEncoding(const VarDecl *VD);
   void mangleMemberDataPointer(const CXXRecordDecl *RD, const ValueDecl *VD,
                                StringRef Prefix = "$");
+  void mangleMemberDataPointerInClassNTTP(const CXXRecordDecl *,
+                                          const ValueDecl *);
   void mangleMemberFunctionPointer(const CXXRecordDecl *RD,
                                    const CXXMethodDecl *MD,
                                    StringRef Prefix = "$");
+  void mangleMemberFunctionPointerInClassNTTP(const CXXRecordDecl *RD,
+                                              const CXXMethodDecl *MD);
   void mangleVirtualMemPtrThunk(const CXXMethodDecl *MD,
                                 const MethodVFTableLocation &ML);
   void mangleNumber(int64_t Number);
   void mangleNumber(llvm::APSInt Number);
   void mangleFloat(llvm::APFloat Number);
   void mangleBits(llvm::APInt Number);
   void mangleTagTypeKind(TagTypeKind TK);
   void mangleArtificialTagType(TagTypeKind TK, StringRef UnqualifiedName,
void MicrosoftCXXNameMangler::mangleMemberDataPointer(const CXXRecordDecl *RD,
   // in template parameter contexts, so the vbptr offset of data member pointers
   // is always zero.
   if (inheritanceModelHasVBPtrOffsetField(IM))
     mangleNumber(0);
   if (inheritanceModelHasVBTableOffsetField(IM))
     mangleNumber(VBTableOffset);
 }
 
+void MicrosoftCXXNameMangler::mangleMemberDataPointerInClassNTTP(
+    const CXXRecordDecl *RD, const ValueDecl *VD) {
+  MSInheritanceModel IM = RD->getMSInheritanceModel();
+  // <nttp-class-member-data-pointer> ::= <member-data-pointer>
+  //                                  ::= N
+  //                                  ::= 8 <postfix> @ <unqualified-name> @
+
+  if (IM != MSInheritanceModel::Single && IM != MSInheritanceModel::Multiple)
+    return mangleMemberDataPointer(RD, VD, "");
+
+  if (!VD) {
+    Out << 'N';
+    return;
+  }
+
+  Out << '8';
+  mangleNestedName(VD);
+  Out << '@';
+  mangleUnqualifiedName(VD);
+  Out << '@';
+}
+
 void
 MicrosoftCXXNameMangler::mangleMemberFunctionPointer(const CXXRecordDecl *RD,
                                                      const CXXMethodDecl *MD,
                                                      StringRef Prefix) {
   // <member-function-pointer> ::= $1? <name>
   //                           ::= $H? <name> <number>
   //                           ::= $I? <name> <number> <number>
   //                           ::= $J? <name> <number> <number> <number>
MicrosoftCXXNameMangler::mangleMemberFunctionPointer(const CXXRecordDecl *RD,
   if (inheritanceModelHasNVOffsetField(/*IsMemberFunction=*/true, IM))
     mangleNumber(static_cast<uint32_t>(NVOffset));
   if (inheritanceModelHasVBPtrOffsetField(IM))
     mangleNumber(VBPtrOffset);
   if (inheritanceModelHasVBTableOffsetField(IM))
     mangleNumber(VBTableOffset);
 }
 
+void MicrosoftCXXNameMangler::mangleMemberFunctionPointerInClassNTTP(
+    const CXXRecordDecl *RD, const CXXMethodDecl *MD) {
+  // <nttp-class-member-function-pointer> ::= <member-function-pointer>
+  //                           ::= N
+  //                           ::= E? <virtual-mem-ptr-thunk>
+  //                           ::= E? <mangled-name> <type-encoding>
+
+  if (!MD) {
+    if (RD->getMSInheritanceModel() != MSInheritanceModel::Single)
+      return mangleMemberFunctionPointer(RD, MD, "");
+
+    Out << 'N';
+    return;
+  }
+
+  Out << "E?";
+  if (MD->isVirtual()) {
+    MicrosoftVTableContext *VTContext =
+        cast<MicrosoftVTableContext>(getASTContext().getVTableContext());
+    MethodVFTableLocation ML =
+        VTContext->getMethodVFTableLocation(GlobalDecl(MD));
+    mangleVirtualMemPtrThunk(MD, ML);
+  } else {
+    mangleName(MD);
+    mangleFunctionEncoding(MD, /*ShouldMangle=*/true);
+  }
+}
+
 void MicrosoftCXXNameMangler::mangleVirtualMemPtrThunk(
     const CXXMethodDecl *MD, const MethodVFTableLocation &ML) {
   // Get the vftable offset.
   CharUnits PointerWidth = getASTContext().toCharUnitsFromBits(
       getASTContext().getTargetInfo().getPointerWidth(LangAS::Default));
   uint64_t OffsetInVFTable = ML.Index * PointerWidth.getQuantity();
 
   Out << "?_9";
case DeclarationName::CXXUsingDirective:
       llvm_unreachable("Can't mangle a using directive name!");
   }
 }
 
 // <postfix> ::= <unqualified-name> [<postfix>]
 //           ::= <substitution> [<postfix>]
 void MicrosoftCXXNameMangler::mangleNestedName(GlobalDecl GD) {
   const NamedDecl *ND = cast<NamedDecl>(GD.getDecl());
+
+  if (const auto *ID = dyn_cast<IndirectFieldDecl>(ND))
+    for (unsigned I = 1, IE = ID->getChainingSize(); I < IE; ++I)
+      mangleSourceName("<unnamed-tag>");
+
   const DeclContext *DC = getEffectiveDeclContext(ND);
   while (!DC->isTranslationUnit()) {
     if (isa<TagDecl>(ND) || isa<VarDecl>(ND)) {
       unsigned Disc;
       if (Context.getNextDiscriminator(ND, Disc)) {
         Out << '?';
         mangleNumber(Disc);
         Out << '?';
void MicrosoftCXXNameMangler::mangleTemplateArg(const TemplateDecl *TD,
   //                  ::= 5 <constant-value> @         # address of subobject
   //                  ::= 6 <constant-value> <unqualified-name> @ # a.b
   //                  ::= 7 <type> [<unqualified-name> <constant-value>] @
   //                      # union, with or without an active member
   //                  # pointer to member, symbolically
   //                  ::= 8 <class> <unqualified-name> @
   //                  ::= A <type> <non-negative integer>  # float
   //                  ::= B <type> <non-negative integer>  # double
-  //                  ::= E <mangled-name>             # reference to D
   //                  # pointer to member, by component value
   //                  ::= F <number> <number>
   //                  ::= G <number> <number> <number>
   //                  ::= H <mangled-name> <number>
   //                  ::= I <mangled-name> <number> <number>
   //                  ::= J <mangled-name> <number> <number> <number>
   //
   // <typed-constant-value> ::= [<type>] <constant-value>
if (isa<FieldDecl>(ND) || isa<IndirectFieldDecl>(ND)) {
         mangleFunctionEncoding(FD, /*ShouldMangle=*/true);
       }
     } else if (TA.getParamTypeForDecl()->isRecordType()) {
       Out << "$";
       auto *TPO = cast<TemplateParamObjectDecl>(ND);
       mangleTemplateArgValue(TPO->getType().getUnqualifiedType(),
                              TPO->getValue());
     } else {
-      mangle(ND, TA.getParamTypeForDecl()->isReferenceType() ? "$E?" : "$1?");
+      mangle(ND, "$1?");
     }
     break;
   }
   case TemplateArgument::Integral: {
     QualType T = TA.getIntegralType();
     mangleIntegerLiteral(TA.getAsIntegral(),
                          cast<NonTypeTemplateParmDecl>(Parm), T);
     break;
if (!V.hasLValuePath() || V.getLValuePath().empty()) {
         // FIXME: This mangles 0 cast to a pointer the same as a null pointer,
         // even in cases where the two are different values.
         Out << "0";
         mangleNumber(V.getLValueOffset().getQuantity());
       } else if (!V.hasLValuePath()) {
         // FIXME: This can only happen as an extension. Invent a mangling.
         break;
       } else if (auto *VD = Base.dyn_cast<const ValueDecl*>()) {
-        Out << (T->isReferenceType() ? "E" : "1");
+        Out << "E";
         mangle(VD);
       } else {
         break;
       }
     } else {
-      unsigned NumAts = 0;
-      if (T->isPointerType()) {
+      if (T->isPointerType())
         Out << "5";
-        ++NumAts;
-      }
 
-      QualType T = Base.getType();
+      SmallVector<char, 2> EntryTypes;
+      SmallVector<std::function<void()>, 2> EntryManglers;
+      QualType ET = Base.getType();
       for (APValue::LValuePathEntry E : V.getLValuePath()) {
-        // We don't know how to mangle array subscripting yet.
-        if (T->isArrayType())
-          goto mangling_unknown;
+        if (auto *AT = ET->getAsArrayTypeUnsafe()) {
+          EntryTypes.push_back('C');
+          EntryManglers.push_back([this, I = E.getAsArrayIndex()] {
+            Out << '0';
+            mangleNumber(I);
+            Out << '@';
+          });
+          ET = AT->getElementType();
+          continue;
+        }
 
         const Decl *D = E.getAsBaseOrMember().getPointer();
-        auto *FD = dyn_cast<FieldDecl>(D);
-        // We don't know how to mangle derived-to-base conversions yet.
-        if (!FD)
-          goto mangling_unknown;
-
-        Out << "6";
-        ++NumAts;
-        T = FD->getType();
+        if (auto *FD = dyn_cast<FieldDecl>(D)) {
+          ET = FD->getType();
+          if (const auto *RD = ET->getAsRecordDecl())
+            if (RD->isAnonymousStructOrUnion())
+              continue;
+        } else {
+          ET = getASTContext().getRecordType(cast<CXXRecordDecl>(D));
+          // Bug in MSVC: fully qualified name of base class should be used for
+          // mangling to prevent collisions e.g. on base classes with same names
+          // in different namespaces.
+        }
+
+        EntryTypes.push_back('6');
+        EntryManglers.push_back([this, D] {
+          mangleUnqualifiedName(cast<NamedDecl>(D));
+          Out << '@';
+        });
       }
 
+      for (auto I = EntryTypes.rbegin(), E = EntryTypes.rend(); I != E; ++I)
+        Out << *I;
+
       auto *VD = Base.dyn_cast<const ValueDecl*>();
       if (!VD)
         break;
       Out << "E";
       mangle(VD);
 
-      for (APValue::LValuePathEntry E : V.getLValuePath()) {
-        const Decl *D = E.getAsBaseOrMember().getPointer();
-        mangleUnqualifiedName(cast<FieldDecl>(D));
-      }
-      for (unsigned I = 0; I != NumAts; ++I)
+      for (const std::function<void()> &Mangler : EntryManglers)
+        Mangler();
+      if (T->isPointerType())
         Out << '@';
     }
 
     return;
   }
 
   case APValue::MemberPointer: {
     if (WithScalarType)
       mangleType(T, SourceRange(), QMM_Escape);
 
-    // FIXME: The below manglings don't include a conversion, so bail if there
-    // would be one. MSVC mangles the (possibly converted) value of the
-    // pointer-to-member object as if it were a struct, leading to collisions
-    // in some cases.
-    if (!V.getMemberPointerPath().empty())
-      break;
-
     const CXXRecordDecl *RD =
         T->castAs<MemberPointerType>()->getMostRecentCXXRecordDecl();
     const ValueDecl *D = V.getMemberPointerDecl();
     if (T->isMemberDataPointerType())
-      mangleMemberDataPointer(RD, D, "");
+      mangleMemberDataPointerInClassNTTP(RD, D);
     else
-      mangleMemberFunctionPointer(RD, cast_or_null<CXXMethodDecl>(D), "");
+      mangleMemberFunctionPointerInClassNTTP(RD,
+                                             cast_or_null<CXXMethodDecl>(D));
     return;
   }
 
   case APValue::Struct: {
     Out << '2';
     mangleType(T, SourceRange(), QMM_Escape);
     const CXXRecordDecl *RD = T->getAsCXXRecordDecl();
     assert(RD && "unexpected type for record value");
case APValue::Vector: {
     return;
   }
 
   case APValue::AddrLabelDiff:
   case APValue::FixedPoint:
     break;
   }
 
-mangling_unknown:
   DiagnosticsEngine &Diags = Context.getDiags();
   unsigned DiagID = Diags.getCustomDiagID(
       DiagnosticsEngine::Error, "cannot mangle this template argument yet");
   Diags.Report(DiagID);
 }
 
 void MicrosoftCXXNameMangler::mangleObjCProtocol(const ObjCProtocolDecl *PD) {
   llvm::SmallString<64> TemplateMangling;

clang/test/CodeGenCXX/mangle-class-nttp.cpp

 // MSABI: define {{.*}} @"??$f@$2UA@@H00$$CBH01@@@YAXXZ"
 template void f<A{1, 2}>();
 
 struct B { const int *p; int k; };
 template<B> void f() {}
 
 int n = 0;
 // CHECK: define weak_odr void @_Z1fIXtl1BadL_Z1nEEEEvv(
-// MSABI: define {{.*}} @"??$f@$2UB@@PEBH1?n@@3HAH0A@@@@YAXXZ"
+// MSABI: define {{.*}} @"??$f@$2UB@@PEBHE?n@@3HAH0A@@@@YAXXZ"
 template void f<B{&n}>();
 // CHECK: define weak_odr void @_Z1fIXtl1BLPKi0ELi1EEEEvv(
 // MSABI: define {{.*}} @"??$f@$2UB@@PEBH0A@H00@@@YAXXZ"
 template void f<B{nullptr, 1}>();
 // CHECK: define weak_odr void @_Z1fIXtl1BEEEvv(
 // MSABI: define {{.*}} @"??$f@$2UB@@PEBH0A@H0A@@@@YAXXZ"
 template void f<B{nullptr}>();
 // These are extensions, but they seem like the obvious manglings.
 // CHECK: define weak_odr void @_Z1fIXtl1BLPKi32EEEEvv(
 // MSABI: define {{.*}} @"??$f@$2UB@@PEBH0CA@H0A@@@@YAXXZ"
 template void f<B{fold((int*)32)}>();
 #ifndef _WIN32
 // FIXME: On MS ABI, we mangle this the same as nullptr, despite considering a
 // null pointer and zero bitcast to a pointer to be distinct pointer values.
 // CHECK: define weak_odr void @_Z1fIXtl1BrcPKiLi0EEEEvv(
 template void f<B{fold(reinterpret_cast<int*>(0))}>();
 #endif
 
 // Pointers to subobjects.
 struct Nested { union { int k; int arr[2]; }; } nested[2];
-struct Derived : A, Nested { int z; } extern derived;
+struct Derived : A, Nested { int z; A a_field; } extern derived;
 // CHECK: define weak_odr void @_Z1fIXtl1BadsoKiL_Z7derivedE16EEEEvv
 // MSABI: define {{.*}} void @"??$f@$2UB@@PEBH56E?derived@@3UDerived@@Az@@@H0A@@@@YAXXZ"
 template void f<B{&derived.z}>();
-// FIXME: We don't know the MS ABI mangling for array subscripting and
-// past-the-end pointers yet.
-#ifndef _WIN32
+// CHECK: define weak_odr void @_Z1fIXtl1BadsoKiL_Z7derivedE20EEEEvv
+// MSABI: define {{.*}} void @"??$f@$2UB@@PEBH566E?derived@@3UDerived@@Aa_field@@a@@@H0A@@@@YAXXZ"
+template void f<B{&derived.a_field.a}>();
 // CHECK: define weak_odr void @_Z1fIXtl1BadsoKiL_Z6nestedE_EEEEvv
+// MSABI: define {{.*}} void @"??$f@$2UB@@PEBH56CE?nested@@3PAUNested@@A0A@@k@@@H0A@@@@YAXXZ"
 template void f<B{&nested[0].k}>();
+// Mangling of pointers to nested array elements and past-the-end pointers
+// is still incorrect in MSVC.
+#ifndef _WIN32
 // CHECK: define weak_odr void @_Z1fIXtl1BadsoKiL_Z6nestedE16_0pEEEEvv
 template void f<B{&nested[1].arr[2]}>();
 // CHECK: define weak_odr void @_Z1fIXtl1BadsoKiL_Z7derivedE8pEEEEvv
 template void f<B{&derived.b + 1}>();
 // CHECK: define weak_odr void @_Z1fIXtl1BcvPKiplcvPcadL_Z7derivedELl16EEEEvv
 template void f<B{fold(&derived.b + 3)}>();
 #endif
 
 // References to subobjects.
 struct BR { const int &r; };
 template<BR> void f() {}
 // CHECK: define weak_odr void @_Z1fIXtl2BRsoKiL_Z7derivedE16EEEEvv
 // MSABI: define {{.*}} void @"??$f@$2UBR@@AEBH6E?derived@@3UDerived@@Az@@@@@YAXXZ"
 template void f<BR{derived.z}>();
-// FIXME: We don't know the MS ABI mangling for array subscripting yet.
-#ifndef _WIN32
 // CHECK: define weak_odr void @_Z1fIXtl2BRsoKiL_Z6nestedE_EEEEvv
+// MSABI: define {{.*}} void @"??$f@$2UBR@@AEBH6CE?nested@@3PAUNested@@A0A@@k@@@@@YAXXZ"
 template void f<BR{nested[0].k}>();
 // CHECK: define weak_odr void @_Z1fIXtl2BRsoKiL_Z6nestedE12_0EEEEvv
+// MSABI: define {{.*}} void @"??$f@$2UBR@@AEBHC6CE?nested@@3PAUNested@@A00@arr@@00@@@@YAXXZ"
 template void f<BR{nested[1].arr[1]}>();
 // CHECK: define weak_odr void @_Z1fIXtl2BRsoKiL_Z7derivedE4EEEEvv
+// MSABI: define {{.*}} void @"??$f@$2UBR@@AEBH66E?derived@@3UDerived@@AA@@b@@@@@YAXXZ"
 template void f<BR{derived.b}>();
+#ifndef _WIN32
 // CHECK: define weak_odr void @_Z1fIXtl2BRdecvPKiplcvPcadL_Z7derivedELl16EEEEvv
 template void f<BR{fold(*(&derived.b + 3))}>();
 #endif
 
 // Qualification conversions.
 struct C { const int *p; };
 template<C> void f() {}
 // CHECK: define weak_odr void @_Z1fIXtl1CadsoKiL_Z7derivedE16EEEEvv
 // MSABI: define {{.*}} void @"??$f@$2UC@@PEBH56E?derived@@3UDerived@@Az@@@@@@YAXXZ"
 template void f<C{&derived.z}>();
-#ifndef _WIN32
 // CHECK: define weak_odr void @_Z1fIXtl1CadsoKiL_Z7derivedE4EEEEvv
+// MSABI: define {{.*}} void @"??$f@$2UC@@PEBH566E?derived@@3UDerived@@AA@@b@@@@@@YAXXZ"
 template void f<C{&derived.b}>();
-#endif
 
 // Pointers to members.
 struct D { const int Derived::*p; int k; };
 template<D> void f() {}
 // CHECK: define weak_odr void @_Z1fIXtl1DLM7DerivedKi0ELi1EEEEvv
-// MSABI: define {{.*}} @"??$f@$2UD@@PERDerived@@H0?0H00@@@YAXXZ"
+// MSABI: define {{.*}} @"??$f@$2UD@@PERDerived@@HNH00@@@YAXXZ"
 template void f<D{nullptr, 1}>();
 // CHECK: define weak_odr void @_Z1fIXtl1DEEEvv
-// MSABI: define {{.*}} @"??$f@$2UD@@PERDerived@@H0?0H0A@@@@YAXXZ"
+// MSABI: define {{.*}} @"??$f@$2UD@@PERDerived@@HNH0A@@@@YAXXZ"
 template void f<D{nullptr}>();
 // CHECK: define weak_odr void @_Z1fIXtl1DadL_ZN7Derived1zEEEEEvv
-// MSABI: define {{.*}} @"??$f@$2UD@@PERDerived@@H0BA@H0A@@@@YAXXZ"
+// MSABI: define {{.*}} @"??$f@$2UD@@PERDerived@@H82@z@@H0A@@@@YAXXZ"
 template void f<D{&Derived::z}>();
-#ifndef _WIN32
 // CHECK: define weak_odr void @_Z1fIXtl1DmcM7DerivedKiadL_ZN1A1aEEEEEEvv
-// MSABI-FIXME: define {{.*}} @"??$f@$2UD@@PERDerived@@H0A@H0A@@@@YAXXZ"
+// MSABI: define {{.*}} @"??$f@$2UD@@PERDerived@@H8A@@a@@H0A@@@@YAXXZ"
 template void f<D{&A::a}>();
 // CHECK: define weak_odr void @_Z1fIXtl1DmcM7DerivedKiadL_ZN1A1bEEEEEEvv
-// MSABI-FIXME: define {{.*}} @"??$f@$2UD@@PERDerived@@H03H0A@@@@YAXXZ"
+// MSABI: define {{.*}} @"??$f@$2UD@@PERDerived@@H8A@@b@@H0A@@@@YAXXZ"
 template void f<D{&A::b}>();
 // FIXME: Is the Ut_1 mangling here correct?
 // CHECK: define weak_odr void @_Z1fIXtl1DmcM7DerivedKiadL_ZN6NestedUt_1kEE8ELi2EEEEvv
-// FIXME: This mangles the same as &A::a (bug in the MS ABI).
-// MSABI-FIXME: define {{.*}} @"??$f@$2UD@@PERDerived@@H0A@H01@@@YAXXZ"
+// MSABI: define {{.*}} @"??$f@$2UD@@PERDerived@@H8<unnamed-tag>@Nested@@k@@H01@@@YAXXZ"
 template void f<D{&Nested::k, 2}>();
 struct MoreDerived : A, Derived { int z; };
 // CHECK: define weak_odr void @_Z1fIXtl1DmcM7DerivedKiadL_ZN11MoreDerived1zEEn8EEEEvv
-// MSABI-FIXME: define {{.*}} @"??$f@$2UD@@PERDerived@@H0BI@H0A@@@@YAXXZ"
+// MSABI: define {{.*}} @"??$f@$2UD@@PERDerived@@H8MoreDerived@@z@@H0A@@@@YAXXZ"
 template void f<D{(int Derived::*)&MoreDerived::z}>();
-#endif
 
-// FIXME: Pointers to member functions.
+struct DerivedVirtually : virtual A, Nested { int z; };
+struct D2 { const int DerivedVirtually::*p; int k; };
+template<D2> void f() {}
+// CHECK: define weak_odr void @_Z1fIXtl2D2LM16DerivedVirtuallyKi0ELi1EEEEvv
+// MSABI: define {{.*}} @"??$f@$2UD2@@PERDerivedVirtually@@HFA@?0H00@@@YAXXZ"
+template void f<D2{nullptr, 1}>();
+// CHECK: define weak_odr void @_Z1fIXtl2D2EEEvv
+// MSABI: define {{.*}} @"??$f@$2UD2@@PERDerivedVirtually@@HFA@?0H0A@@@@YAXXZ"
+template void f<D2{nullptr}>();
+// CHECK: define weak_odr void @_Z1fIXtl2D2adL_ZN16DerivedVirtually1zEEEEEvv
+// MSABI: define {{.*}} @"??$f@$2UD2@@PERDerivedVirtually@@HFBA@A@H0A@@@@YAXXZ"
+template void f<D2{&DerivedVirtually::z}>();
+
+// Forward-decl without MS inheritance keyword means unspecified inheritance
+// which is different from e. g. single inheritance.
+struct UnspecInherStruct;
+struct D3 { const int UnspecInherStruct::*p; };
+template<D3> void f() {}
+struct UnspecInherStruct { int i; };
+// CHECK: define weak_odr void @_Z1fIXtl2D3adL_ZN17UnspecInherStruct1iEEEEEvv
+// MSABI: define {{.*}} @"??$f@$2UD3@@PERUnspecInherStruct@@HGA@A@A@@@@YAXXZ"
+template void f<D3{&UnspecInherStruct::i}>();
+
+// Pointers to member functions.
+// Test struct templates instead of function templates so as to cover
+// the separate code which handles nullptr in their pointer-to-member arguments.
+struct Derived2 : A, Nested { void f(); virtual void g(); };
+struct D4 { void (Derived2::*p)(); };
+template <D4> struct S1 { static void fn() {} };
+// CHECK: define weak_odr void @_ZN2S1IXtl2D4adL_ZN8Derived21fEvEEEE2fnEv
+// MSABI: define {{.*}} @"?fn@?$S1@$2UD4@@P8Derived2@@EAAXXZE?f@2@QEAAXXZ@@@SAXXZ"
+template void S1<D4{&Derived2::f}>::fn();
+// CHECK: define weak_odr void @_ZN2S1IXtl2D4adL_ZN8Derived21gEvEEEE2fnEv
+// MSABI: define {{.*}} @"?fn@?$S1@$2UD4@@P8Derived2@@EAAXXZE??_92@$BA@AA@@@SAXXZ"
+template void S1<D4{&Derived2::g}>::fn();
+// CHECK: define weak_odr void @_ZN2S1IXtl2D4EEE2fnEv
+// MSABI: define {{.*}} @"?fn@?$S1@$2UD4@@P8Derived2@@EAAXXZHA@@@@SAXXZ"
+template void S1<D4{nullptr}>::fn();
+
+struct NoInheritance { void f(); };
+struct D5 { void (NoInheritance::*p)(); };
+template <D5> struct S2 { static void fn() {} };
+// CHECK: define weak_odr void @_ZN2S2IXtl2D5adL_ZN13NoInheritance1fEvEEEE2fnEv
+// MSABI: define {{.*}} @"?fn@?$S2@$2UD5@@P8NoInheritance@@EAAXXZE?f@2@QEAAXXZ@@@SAXXZ"
+template void S2<D5{&NoInheritance::f}>::fn();
+// CHECK: define weak_odr void @_ZN2S2IXtl2D5EEE2fnEv
+// MSABI: define {{.*}} @"?fn@?$S2@$2UD5@@P8NoInheritance@@EAAXXZN@@@SAXXZ"
+template void S2<D5{nullptr}>::fn();
+
+struct NoInheritanceButUnspecified;
+struct D6 { void (NoInheritanceButUnspecified::*p)(); };
+template <D6> struct S3 { static void fn() {} };
+// CHECK: define weak_odr void @_ZN2S3IXtl2D6EEE2fnEv
+// MSABI: define {{.*}} @"?fn@?$S3@$2UD6@@P8NoInheritanceButUnspecified@@EAAXXZJA@A@?0@@@SAXXZ"
+template void S3<D6{nullptr}>::fn();
+
 
 union E {
   int n;
   float f;
   constexpr E() {}
   constexpr E(int n) : n(n) {}
   constexpr E(float f) : f(f) {}
 };

 // CHECK: define weak_odr void @_Z1fIXtl1GLi1ELi2EEEEvv
 // MSABI: define {{.*}} @"??$f@$2UG@@H00H01@@@YAXXZ"
 template void f<G{1, 2}>();
 // CHECK: define weak_odr void @_Z1fIXtl1GLin8ELin32EEEEvv
 // MSABI: define {{.*}} @"??$f@$2UG@@H0?7H0?CA@@@@YAXXZ"
 template void f<G{-8, -32}>();
 
 // Empty and nearly-empty unions.
-// Some of the MSVC manglings here are our invention, because MSVC rejects, but
-// seem likely to be right.
 union H1 {};
 union H2 { int : 1, : 2, : 3; };
 union H3 { int : 1, a, : 2, b, : 3; };
 struct H4 { H2 h2; };
 template<H1> void f() {}
 template<H2> void f() {}
 template<H3> void f() {}
 template<H4> void f() {}

clang/test/CodeGenCXX/mangle-ms-templates.cpp

struct record {
   int first;
   int second;
 };
 template <const record &>
 struct type1 {
 };
 extern const record inst;
 void recref(type1<inst>) {}
-// CHECK: "?recref@@YAXU?$type1@$E?inst@@3Urecord@@B@@@Z"
+// CHECK: "?recref@@YAXU?$type1@$1?inst@@3Urecord@@B@@@Z"
 
 struct _GUID {};
 struct __declspec(uuid("{12345678-1234-1234-1234-1234567890aB}")) uuid;
 
 template <typename T, const _GUID *G = &__uuidof(T)>
 struct UUIDType1 {};
 
 template <typename T, const _GUID &G = __uuidof(T)>
 struct UUIDType2 {};
 
 void fun(UUIDType1<uuid> a) {}
 // CHECK: "?fun@@YAXU?$UUIDType1@Uuuid@@$1?_GUID_12345678_1234_1234_1234_1234567890ab@@3U__s_GUID@@B@@@Z"
 void fun(UUIDType2<uuid> b) {}
-// CHECK: "?fun@@YAXU?$UUIDType2@Uuuid@@$E?_GUID_12345678_1234_1234_1234_1234567890ab@@3U__s_GUID@@B@@@Z"
+// CHECK: "?fun@@YAXU?$UUIDType2@Uuuid@@$1?_GUID_12345678_1234_1234_1234_1234567890ab@@3U__s_GUID@@B@@@Z"
 
 template <typename T> struct TypeWithFriendDefinition {
   friend void FunctionDefinedWithInjectedName(TypeWithFriendDefinition<T>) {}
 };
 // CHECK: call {{.*}} @"?FunctionDefinedWithInjectedName@@YAXU?$TypeWithFriendDefinition@H@@@Z"
 void CallFunctionDefinedWithInjectedName() {
   FunctionDefinedWithInjectedName(TypeWithFriendDefinition<int>());
 }