Outline functions for SEH with the MSVC environment

[andrew.w.kaylor]

Summary

This is a preliminary implementation of a pass to outline filter functions and exception handlers to support exception handling when compiling for the MSVC environment (that is, using the MSVC runtime personality functions). Because the MS personality functions are designed to call filter functions and exception handlers outside of the frame context in which the exception handler appears, the functions are extracted from their original location and inserted into an external function with the signature dictated by the personality function.

This patch represents a work in progress. It is not yet intended as a candidate to commit for the following reasons:

• It only outlines SEH filter functions (not finally handlers and not C++ EH handlers) but the rest should be just a matter of different heuristics to find the end points of the region to be outlined.
• It doesn’t remove the code after it has been outlined. That should be fairly simple but I didn’t want to delay discussion while implementing it.
• It depends on IR semantics that are being implemented by other in-flight patches.
• I haven’t implemented tests for it yet. So far I’ve just been manually verifying functionality in the debugger.

I hope that it will be a reasonable basis for discussion and that once the necessary design decisions have been made I will be able to quickly refactor it to become product-ready.

[andrew.w.kaylor]

Sorry about the lack of contexts. I don't have arcanist set up yet and the version of svn I have installed doesn't seem to want to give me extra lines of context. Most of the interesting stuff is in the new file though so hopefully this will be OK.

[rnk]

Cool! I have some ideas for making this more robust.

include/llvm/Transforms/Utils/Cloning.h

144–146

These should probably merge into maybeEndCloning() or something like that, given that you had to thread state from shouldStopAt into createTerminateInst.

lib/CodeGen/MSVCEHPrepare.cpp

164

At the end of the day, EH lowering should not fail if the IR passes verification. I have some ideas for how cut back the fragile pattern matching, but I'm sure there are some edge cases I haven't thought of. For now, it's OK to assert on really uncommon ones.

184–191

This makes sense, but I'd just make it an assert, since we'll want that assert in the final code anyway.

194–221

This code can be made a lot more robust by reusing some of the techniques in the SjLj EH preparation code, which replaces the landingpad aggregate with something else. It optimistically iterates the use chain of the landingpad and replaces extractvalue instrs with the actual pointer and selector values. However, if it there are uses remaining, it synthesizes an aggregate and replaces all uses of the aggregate with that.

For the outliner, we don't want to replace things in place, we want to add to the value map instead. We probably want to produce something like:

Instruction *EHAggregate; // Null if there are no uses of the aggregate other than extracts.
SmallVector<Instruction*, 4> EHPtrExtracts;
SmallVector<Instruction*, 4> EHSelExtracts;

And in each outlined filter, add mappings for all of those instructions.

237

I think this can be handled more robustly by setting up the value map for the selector and these intrinsic calls to return the constant 1 for the active selector and 0 for inactive selectors. The cloner already knows how to prune conditional branches like the ones you're pattern matching away, so we'd get that more or less for free. If the pruning analysis fails, we'd get something that is conservatively correct.

In this model, we'd start the cloning just after the landing pad instruction. Filters would have to be emitted before cleanups. This creates some challenges for clang IR emission, but I think I can handle it.

305

Yeah, this analysis is going to be fun. We can set it aside for later. I think there is some interesting prior art in SjLj preparation that will help.

327

We should be able to insert multiple return instructions to handle this case.

test/CodeGen/X86/seh-outline.ll

2

I think you can run opt -codegenprepare and FileCheck the output. Grep around test/ for -codegenprep to see what the other preparation tests do.

[andrew.w.kaylor]

include/llvm/Transforms/Utils/Cloning.h

144–146

Yeah, that makes sense.

lib/CodeGen/MSVCEHPrepare.cpp

164

At this point the assertions are as much documentation of my assumptions as anything else. Basically, I put assertions in for any condition that would cause this code not to do what I meant for it to do. I think that once this code is sufficiently robust the assertions will either go away or will be things that we genuinely don't believe can happen.

237

I think I understand what you're suggesting here. I'll rework the code and update the review.

327

I was thinking that this is an indication of poorly formed IR, but maybe I'm being overly narrow in my thinking. I was viewing this as code that clang would generate to represent the code between the parens of an __except statement, which should always evaluate to a single value, but I suppose I can see an arbitrary client of llvm calling the llvm.eh.seh.filter intrinsic to terminate any number of branches. Since this code will replace each of them with a return instruction, that should be fine.

The real problem I'm trying to solve here is finding the beginning and end of the filter handler. Following your suggestion of starting at the landing pad with mapped values to reduce the following instructions to the flow for the selector I mean to be handling, what I want to be sure of is that all control paths from the landing pad instruction will lead to a call to the llvm.eh.seh.filter intrinsic (or something that terminates in the case where an exception occurs within the filter function?). But I can probably handle that better by asserting that this code doesn't see a return instruction as input.

[andrew.w.kaylor]

• Re-implemented filter outlining in a more robust manner
• Added support for cleanup outlining
• Added code necessary to invoke the pass from opt for testing
• Updated the test to use opt and check outlined functions

I'm not sure the cleanup handling is correct. MSVC disallows __try in a block that requires unwinding, so I expected that we'd do the same in clang. Does the MSVC SEH personality function even support exception handlers and cleanup in the same block? Also, it isn't clear to me how the cleanup handlers will be connected to the landingpad after they've been outlined.

I'm still not handling references to frame variables within the handlers, but I have an idea how I can do that with the CloningDirector class as I've revised it here.

I'm also still not removing code that has been outlined.

[rnk]

Neat, so these tests pass? Seems like this approach is working! =D

The MSVCEHPrepare.cpp file has a bunch of Allman style braces, which should be fixed.

I feel like this is probably a good chunk of logic to commit, but we're a bit blocked on review. Long term, will need to do analysis to share regions of cleanup code in separate outlined functions rather than duplicating code.

lib/Transforms/Utils/CloneFunction.cpp

327

This comment seems like it got mis-edited. :) Maybe "..., we want to stop everything. The cloning director is reponsible for inserting a terminator here."

383

ditto

[andrew.w.kaylor]

Yeah, the test passes (...now...there was a change missing in the last revision I uploaded). It was kind of a beautiful thing to see it come together. One minute it was producing a garbled mess full of bad references, then after one more change it all simplified to the expected results.

These latest changes include a fix for an unmapped variable problem during outlining. I also fixed the comments that were wrong and ran the new source file through clang-format.

I expect that this will need to wait until the related changes are committed and the intended form of the IR is settled, but I think they are otherwise ready to go.

[rnk]

OK, so the MSVC EH type is landed now and the x64 SEH tables are available. Want to rebase and I'll take another look? I can start adding seh or C++ EH stuff to Clang to support this as well.

[andrew.w.kaylor]

Rebased and updated the form of the expected input IR.

I am proposing replacing uses of the llvm.eh.typeid.for intrinsic with new intrinsics -- llvm.seh.filterid.for if the comparison is intended to lead to a filter sequence (before it is outlined) and llvm.seh.handlerid.for if the comparison is intended to lead to the actual SEH exception handler body. The main thing this accomplishes is that it gives me a way to determine whether or not filter function outlining has already been done. I think it will also help with removing the filter code from the main function body after it has been outlined. As an added benefit, we will no longer be pretending that function pointers are type IDs.

I have not implemented the intrinsics proposed above and so the code is currently looking for them by function name. If you like this suggestion, I'll submit a patch to implement these intrinsics that will go in before this one.

My seh-outline.ll test case asserts at Win64Exception.cpp:224 if you try passing it to llc (because the number of landing pad clauses doesn't match the number of typeids in the landing pad instruction). That failure goes away if I remove the "cleanup" clause from my landing pad instruction in the test case IR. It seemed to me that this indicated that SEH cleanup isn't fully implemented yet at that level.

In general, I'm not feeling terribly comfortable about the way that I'm handling cleanup in this patch. More to the point, I don't have a clear idea of what the end-to-end solution is supposed to look like for cleanup. Maybe we can discuss this more on the LLVMDev list. With regards to this patch, the biggest hole seems to be that I'm creating a cleanup function but not linking the landing pad instruction to it in any way. I don't have a proposed solution for that yet.

[rnk]

In D6556#109469, @andrew.w.kaylor wrote:

Rebased and updated the form of the expected input IR.

I am proposing replacing uses of the llvm.eh.typeid.for intrinsic with new intrinsics -- llvm.seh.filterid.for if the comparison is intended to lead to a filter sequence (before it is outlined) and llvm.seh.handlerid.for if the comparison is intended to lead to the actual SEH exception handler body. The main thing this accomplishes is that it gives me a way to determine whether or not filter function outlining has already been done. I think it will also help with removing the filter code from the main function body after it has been outlined. As an added benefit, we will no longer be pretending that function pointers are type IDs.

David suggested simply renaming this intrinsic to llvm.eh.selector.for(i8*) to generalize it over SEH. Continuing to use typeid is a bit crazy. Do you think it's better to generalize the typeid intrinsic or add a new special purpose intrinsic? We'd have to teach GVN about it.

I have not implemented the intrinsics proposed above and so the code is currently looking for them by function name. If you like this suggestion, I'll submit a patch to implement these intrinsics that will go in before this one.

My seh-outline.ll test case asserts at Win64Exception.cpp:224 if you try passing it to llc (because the number of landing pad clauses doesn't match the number of typeids in the landing pad instruction). That failure goes away if I remove the "cleanup" clause from my landing pad instruction in the test case IR. It seemed to me that this indicated that SEH cleanup isn't fully implemented yet at that level.

In general, I'm not feeling terribly comfortable about the way that I'm handling cleanup in this patch. More to the point, I don't have a clear idea of what the end-to-end solution is supposed to look like for cleanup. Maybe we can discuss this more on the LLVMDev list. With regards to this patch, the biggest hole seems to be that I'm creating a cleanup function but not linking the landing pad instruction to it in any way. I don't have a proposed solution for that yet.

Yeah, I'm still not sure how to represent prepared cleanups in IR. Maybe just @llvm.seh.cleanup(void ()* @mycleanup)?

[andrew.w.kaylor]

David suggested simply renaming this intrinsic to llvm.eh.selector.for(i8*) to generalize it over SEH. Continuing to use typeid is a bit crazy. Do you think it's better to generalize the typeid intrinsic or add a new special purpose intrinsic? We'd have to teach GVN about it.

I like the idea of a generalized selector intrinsics, but I have two problems that I'm not sure it solves.

1. I need a way to determine whether or not the outlining has already been done. I suppose I could use the presence of calls to "llvm.eh.seh.filter" (or whatever else ends up in that place) to do that, but that's a new intrinsic too. There's also still the problem of outlining the clean handlers (and recognizing when that has been done) and native Windows support for C++ EH.

2. I was kind of hoping to use a dead code elimination trick similar to what you suggested for the outlined functions to get rid of the filter code after it has been outlined. I could possibly still do that if the filter dispatch and handler dispatch were calling the same intrinsic. I haven't tried that out yet.

Having said that, both of these problems can probably be solved without having two different intrinsics that essentially mean the same thing just in different places. So let me see if I can work this out with the general selector intrinsic.

I'll also think about the big picture a bit more and try to look ahead to how Windows support for C++ EH will fit into the plan.

Yeah, I'm still not sure how to represent prepared cleanups in IR. Maybe just @llvm.seh.cleanup(void ()* @mycleanup)?

How would that be attached to the landing pad instruction? Specifically, how would we find it when generating the .xdata table?

[andrew.w.kaylor]

Updated the patch to expect a single llvm.eh.selector.for intrinsic.
Removed cleanup outlining because that seems not to be settled yet.
Added support for pruning filter code that has been outlined.
Updated test to verify that outlined code has been removed from its original location.

[andrew.w.kaylor]

These changes are no longer needed for SEH, since we are now outlining filter functions in the front end.

The bulk of these changes were reworked for use in D7363.

include/llvm/CodeGen/Passes.h

/// MachineDominanaceFrontier - This pass is a machine dominators analysis pass.
   /// adapted to code generation.  Required if using dwarf exception handling.
   FunctionPass *createDwarfEHPass(const TargetMachine *TM);
 
   /// createSjLjEHPreparePass - This pass adapts exception handling code to use
   /// the GCC-style builtin setjmp/longjmp (sjlj) to handling EH control flow.
   ///
   FunctionPass *createSjLjEHPreparePass(const TargetMachine *TM);
 
+  /// createMSVCEHPreparePass - This pass adapts exception handling code to use
+  /// the MSVC-style (outlined) exception and unwind handlers.
+  ///
+  FunctionPass *createMSVCEHPreparePass(const TargetMachine *TM);
+
   /// LocalStackSlotAllocation - This pass assigns local frame indices to stack
   /// slots relative to one another and allocates base registers to access them
   /// when it is estimated by the target to be out of range of normal frame
   /// pointer or stack pointer index addressing.
   extern char &LocalStackSlotAllocationID;
 
   /// ExpandISelPseudos - This pass expands pseudo-instructions.
   extern char &ExpandISelPseudosID;

include/llvm/InitializePasses.h

 void initializeCFGSimplifyPassPass(PassRegistry&);
 void initializeCFLAliasAnalysisPass(PassRegistry&);
 void initializeForwardControlFlowIntegrityPass(PassRegistry&);
 void initializeFlattenCFGPassPass(PassRegistry&);
 void initializeStructurizeCFGPass(PassRegistry&);
 void initializeCFGViewerPass(PassRegistry&);
 void initializeConstantHoistingPass(PassRegistry&);
 void initializeCodeGenPreparePass(PassRegistry&);
+void initializeMSVCEHPreparePass(PassRegistry&);
 void initializeConstantMergePass(PassRegistry&);
 void initializeConstantPropagationPass(PassRegistry&);
 void initializeMachineCopyPropagationPass(PassRegistry&);
 void initializeCostModelAnalysisPass(PassRegistry&);
 void initializeCorrelatedValuePropagationPass(PassRegistry&);
 void initializeDAEPass(PassRegistry&);
 void initializeDAHPass(PassRegistry&);
 void initializeDCEPass(PassRegistry&);

include/llvm/Transforms/Utils/Cloning.h

void CloneFunctionInto(Function *NewFunc, const Function *OldFunc,
                        ValueToValueMapTy &VMap,
                        bool ModuleLevelChanges,
                        SmallVectorImpl<ReturnInst*> &Returns,
                        const char *NameSuffix = "",
                        ClonedCodeInfo *CodeInfo = nullptr,
                        ValueMapTypeRemapper *TypeMapper = nullptr,
                        ValueMaterializer *Materializer = nullptr);
 
+/// A helper class used with CloneAndPruneIntoFromInst to change the default
+/// behavior while instructions are being cloned.
+class CloningDirector
+{
+public:
+  /// This enumeration describes the way CloneAndPruneIntoFromInst should
+  /// proceed after the CloningDirector has examined an instruction.
+  enum CloningAction {
+    ///< Continue cloning the instruction (default behavior).
+    CloneInstruction,
+    ///< Skip this instruction but continue cloning the current basic block.
+    SkipInstruction,
+    ///< Skip this instruction and stop cloning the current basic block.
+    StopCloningBB
+  };
+
+  CloningDirector() {}
+  virtual ~CloningDirector() {}
+
+  /// Subclasses must override this function to customize cloning behavior.
+  virtual CloningAction handleInstruction(ValueToValueMapTy &VMap,
+                                          const Instruction *Inst,
+                                          BasicBlock        *NewBB) = 0;
+};
+
+void CloneAndPruneIntoFromInst(Function *NewFunc, const Function *OldFunc,
+                               const Instruction *StartingInst,
+                               ValueToValueMapTy &VMap,
+                               bool ModuleLevelChanges,
+                               SmallVectorImpl<ReturnInst*> &Returns,
+                               const char *NameSuffix = "", 
+                               ClonedCodeInfo *CodeInfo = nullptr,
+                               const DataLayout *DL = nullptr,
+                               CloningDirector *Director = nullptr);
+
+
 /// CloneAndPruneFunctionInto - This works exactly like CloneFunctionInto,
 /// except that it does some simple constant prop and DCE on the fly.  The
 /// effect of this is to copy significantly less code in cases where (for
 /// example) a function call with constant arguments is inlined, and those
 /// constant arguments cause a significant amount of code in the callee to be
 /// dead.  Since this doesn't produce an exactly copy of the input, it can't be
 /// used for things like CloneFunction or CloneModule.
 ///

lib/CodeGen/CMakeLists.txt

add_llvm_library(LLVMCodeGen
   MachinePostDominators.cpp
   MachineRegisterInfo.cpp
   MachineRegionInfo.cpp
   MachineSSAUpdater.cpp
   MachineScheduler.cpp
   MachineSink.cpp
   MachineTraceMetrics.cpp
   MachineVerifier.cpp
+  MSVCEHPrepare.cpp
   OcamlGC.cpp
   OptimizePHIs.cpp
   PHIElimination.cpp
   PHIEliminationUtils.cpp
   Passes.cpp
   PeepholeOptimizer.cpp
   PostRASchedulerList.cpp
   ProcessImplicitDefs.cpp

lib/CodeGen/CodeGen.cpp

 using namespace llvm;
 
 /// initializeCodeGen - Initialize all passes linked into the CodeGen library.
 void llvm::initializeCodeGen(PassRegistry &Registry) {
   initializeAtomicExpandPass(Registry);
   initializeBasicTTIPass(Registry);
   initializeBranchFolderPassPass(Registry);
   initializeCodeGenPreparePass(Registry);
+  initializeMSVCEHPreparePass(Registry);
   initializeDeadMachineInstructionElimPass(Registry);
   initializeEarlyIfConverterPass(Registry);
   initializeExpandPostRAPass(Registry);
   initializeExpandISelPseudosPass(Registry);
   initializeFinalizeMachineBundlesPass(Registry);
   initializeGCMachineCodeAnalysisPass(Registry);
   initializeGCModuleInfoPass(Registry);
   initializeIfConverterPass(Registry);

lib/CodeGen/MSVCEHPrepare.cpp

+//===------ MSVCEHPrepare.cpp - Outline exception handling sequences ------===//
+//
+//                     The LLVM Compiler Infrastructure
+//
+// This file is distributed under the University of Illinois Open Source
+// License. See LICENSE.TXT for details.
+//
+//===----------------------------------------------------------------------===//
+//
+// This transformation is designed for use by code generators which use
+// Windows exception handling targeted at the MSVC environment.
+//
+//===----------------------------------------------------------------------===//
+
+#include "llvm/CodeGen/Passes.h"
+#include "llvm/ADT/DenseSet.h"
+#include "llvm/IR/CFG.h"
+#include "llvm/IR/Function.h"
+#include "llvm/IR/Instructions.h"
+#include "llvm/IR/InstVisitor.h"
+#include "llvm/IR/IntrinsicInst.h"
+#include "llvm/IR/IRBuilder.h"
+#include "llvm/IR/Module.h"
+#include "llvm/IR/ValueMap.h"
+#include "llvm/Pass.h"
+#include "llvm/Support/Debug.h"
+#include "llvm/Support/raw_ostream.h"
+#include "llvm/Transforms/Utils/BasicBlockUtils.h"
+#include "llvm/Transforms/Utils/Cloning.h"
+#include "llvm/Transforms/Utils/Local.h"
+
+using namespace llvm;
+
+#define DEBUG_TYPE "msvcehprepare"
+
+namespace {
+class MSVCEHPrepare : public FunctionPass {
+  const TargetMachine *TM;
+
+public:
+  static char ID; // Pass identification, replacement for typeid
+  explicit MSVCEHPrepare(const TargetMachine *TM = nullptr)
+      : FunctionPass(ID), TM(TM) {
+    initializeMSVCEHPreparePass(*PassRegistry::getPassRegistry());
+  }
+  bool runOnFunction(Function &F) override;
+
+  void getAnalysisUsage(AnalysisUsage &AU) const override {}
+  const char *getPassName() const override {
+    return "MSVC Exception Handling preparation";
+  }
+
+private:
+  bool prepareSEHHandlers(Function &F, BasicBlock *LandingPadBB);
+
+  bool outlineSEHFilterHandler(Function *SrcFn, Function *FilterFn,
+                               LandingPadInst *LPI);
+
+  bool prepareCPPEHHandlers(Function &F, BasicBlock *LandingPadBB);
+};
+
+class SEHFilterDirector : public CloningDirector {
+public:
+  SEHFilterDirector(Function *FilterFn, LandingPadInst *LPI)
+      : CurrentFilterFn(FilterFn), LPI(LPI),
+        FilterIDType(Type::getInt32Ty(FilterFn->getContext())) {}
+  virtual ~SEHFilterDirector() {}
+
+  CloningAction handleInstruction(ValueToValueMapTy &VMap,
+                                  const Instruction *Inst,
+                                  BasicBlock *NewBB) override;
+
+private:
+  Function *CurrentFilterFn;
+  LandingPadInst *LPI;
+  Type *FilterIDType;
+};
+
+class LandingPadVisitor : public InstVisitor<LandingPadVisitor, void> {
+public:
+  LandingPadVisitor(LandingPadInst *LPad);
+
+  // Template method instantiations.
+  void visitCallInst(CallInst &Call);
+  void visitTerminatorInst(TerminatorInst &Terminator);
+
+  // Entry point for subclasses.
+  void beginSearch(BasicBlock *BB);
+
+  // Callbacks for subclasses.
+  virtual void handleCallInst(CallInst &Call) {}
+  virtual void handleTerminatorInst(TerminatorInst &Terminator) {}
+
+protected:
+  bool            TargetFound;
+  LandingPadInst *OriginLPad;
+
+private:
+  DenseSet<const BasicBlock*>  VisitedBlocks;
+};
+
+class SEHFilterVisitor : public LandingPadVisitor {
+public:
+  SEHFilterVisitor(LandingPadInst *LPad) : LandingPadVisitor(LPad) {}
+
+  bool reachesFilterIntrinsicCall(BasicBlock *BB);
+
+  void handleCallInst(CallInst &Call) override;
+};
+
+class MSVCEHPruningVisitor : public LandingPadVisitor {
+public:
+  MSVCEHPruningVisitor(LandingPadInst *LPad) : LandingPadVisitor(LPad), 
+                                               FilterToPrune(nullptr) {}
+
+  bool pruneOutlinedFilterCode(BasicBlock *BB, Function *FilterFn);
+
+  void handleTerminatorInst(TerminatorInst &Terminator) override;
+
+private:
+  bool pruneFilterBranch(TerminatorInst &Terminator);
+
+  Function *FilterToPrune;
+};
+
+} // end anonymous namespace
+
+char MSVCEHPrepare::ID = 0;
+INITIALIZE_TM_PASS(MSVCEHPrepare, "msvcehprepare",
+                   "Outline exception handlers for the MSVC environment", false,
+                   false)
+
+// Public Interface To the MSVCEHPrepare pass.
+FunctionPass *llvm::createMSVCEHPreparePass(const TargetMachine *TM) {
+  return new MSVCEHPrepare(TM);
+}
+
+bool MSVCEHPrepare::runOnFunction(Function &F) {
+  bool MadeChange = false;
+
+  for (Function::iterator BB : F) {
+    if (BB->isLandingPad()) {
+      BasicBlock::iterator II = BB->begin();
+      LandingPadInst *lpad = BB->getLandingPadInst();
+
+      // The code below is not robust enough for actual use,
+      // but it is sufficient for getting things working.
+      Function *PersonalityFn =
+          dyn_cast<Function>(lpad->getPersonalityFn()->stripPointerCasts());
+      if (!PersonalityFn)
+        continue;
+
+      StringRef Personality = PersonalityFn->getName();
+      if (Personality == "__C_specific_handler") {
+        MadeChange |= prepareSEHHandlers(F, BB);
+      } else if (Personality == "__CxxFrameHandler3") {
+        MadeChange |= prepareCPPEHHandlers(F, BB);
+      } else if (Personality == "__gcc_personality_v0" ||
+                 Personality == "__gxx_personality_v0") {
+        // FIXME: ShadowStackGC inserts this personality function without
+        // regard to exception handling type, and eight of the tests in 
+        // CodeGen/Generic use __gxx_personality_v0.
+        continue;
+      } else {
+        // TODO: Add 32-bit handlers and other varieties as needed.
+        llvm_unreachable("unsupported MSVC EH personality function");
+      }
+    } // if (BB->isLandingPad())
+  }   // for (BB : F)
+
+  return MadeChange;
+}
+
+bool MSVCEHPrepare::prepareSEHHandlers(Function &F, BasicBlock *LandingPadBB) {
+  LandingPadInst *LPI = LandingPadBB->getLandingPadInst();
+
+  if (!LPI) {
+    DEBUG(dbgs() << 
+        "Couldn't find the landing pad instruction for a landing pad block!\n");
+    return false;
+  }
+
+  // If there is no filter ID check, that must mean the filter functions
+  // have already been outlined.
+  SEHFilterVisitor  Visitor(LPI);
+  if (!Visitor.reachesFilterIntrinsicCall(LPI->getParent())) {
+    DEBUG(dbgs() << 
+              "No filter intrinsic calls are reachable from the landing pad.\n"
+              "Skipping outlining pass.");
+    return false;
+  }
+
+
+  for (unsigned Idx = 0, NumClauses = LPI->getNumClauses(); Idx < NumClauses;
+       ++Idx) {
+
+    if (LPI->isCatch(Idx)) {
+      Function *FilterFn;
+      FilterFn = dyn_cast<Function>(LPI->getClause(Idx)->stripPointerCasts());
+
+      outlineSEHFilterHandler(&F, FilterFn, LPI);
+    }
+  }
+
+  return true;
+}
+
+bool MSVCEHPrepare::outlineSEHFilterHandler(Function *SrcFn, Function *FilterFn,
+                                            LandingPadInst *LPI) {
+  // Initially the filter function is expected to contain a single
+  // "unreachable" instruction.
+  assert(FilterFn->isDeclaration() || 
+         isa<UnreachableInst>(FilterFn->front().getInstList().front()));
+
+  // Discard the contents of the filter function stub.
+  FilterFn->getBasicBlockList().clear();
+
+  // TODO: Insert a call to llvm.recoverframeallocation
+
+  ValueToValueMapTy VMap;
+
+  // TODO: Map other values referenced in the filter handler.
+
+  SEHFilterDirector Director(FilterFn, LPI);
+
+  SmallVector<ReturnInst *, 8> Returns;
+  ClonedCodeInfo InlinedFunctionInfo;
+
+  BasicBlock::iterator II = LPI;
+
+  CloneAndPruneIntoFromInst(FilterFn, SrcFn, ++II, VMap,
+                            /*ModuleLevelChanges=*/false, Returns, ".seh",
+                            &InlinedFunctionInfo,
+                            SrcFn->getParent()->getDataLayout(), &Director);
+
+  MSVCEHPruningVisitor  Visitor(LPI);
+  Visitor.pruneOutlinedFilterCode(LPI->getParent(), FilterFn);
+
+  return true;
+}
+
+LandingPadVisitor::LandingPadVisitor(LandingPadInst *LPad) 
+  : TargetFound(false), OriginLPad(LPad) {
+  // The VisitedBlocks set is used to prevent the search from visiting blocks
+  // that have already been visited, but it is also used to avoid visiting
+  // blocks that are beyond the scope of the landing pad.  This is accomplished
+  // by finding the invoke instructions which are predecessors of the landing 
+  // pad we are visiting.  The "normal destination" of the invoke instruction
+  // marks the end of the landing pad.  All paths through the landing pad will
+  // reach either a normal destination, a resume instruction, a call to the 
+  // llvm.eh.filer intrinsic or a terminate call.  The normal destination is the
+  // only path that has the potential to take us outside the landing pad scope.
+  BasicBlock *LPadBB = LPad->getParent();
+  for (pred_iterator i = pred_begin(LPadBB), e = pred_end(LPadBB); i != e; ++i) {
+    BasicBlock *PredBB = *i;
+    InvokeInst *Invoke = dyn_cast<InvokeInst>(PredBB->getTerminator());
+    // The landing pad predecessors must be invoke instructions.
+    assert(Invoke);
+    VisitedBlocks.insert(Invoke->getNormalDest());
+  }
+}
+
+void LandingPadVisitor::beginSearch(BasicBlock *BB) {
+  VisitedBlocks.insert(BB);
+  visit(BB);
+}
+
+void LandingPadVisitor::visitCallInst(CallInst &Call) {
+  handleCallInst(Call);
+}
+
+void LandingPadVisitor::visitTerminatorInst(TerminatorInst &Terminator) {
+  // Give the subclasses a chance to examine this instruction.
+  handleTerminatorInst(Terminator);
+
+  // If we have found what we were looking for, stop visiting.
+  if (TargetFound)
+    return;
+
+  // Otherwise, visit successors unless they are in the visited blocks
+  // set or are landing pad blocks.  Landing pad blocks within a landing pad
+  // indicate an error path and do not need to be searched.
+  // The visited block set will contain the normal destination block of the
+  // invoke instruction that led to the landing pad we are searching, so
+  // this check will keep us from going outside the landing pad clauses.
+  for (unsigned i = 0, e = Terminator.getNumSuccessors(); i != e; ++i) {
+    BasicBlock *BB = Terminator.getSuccessor(i);
+    if (BB->isLandingPad() || VisitedBlocks.find(BB) != VisitedBlocks.end())
+      continue;
+    VisitedBlocks.insert(BB);
+    visit(BB);
+  }
+}
+
+void SEHFilterVisitor::handleCallInst(CallInst &Call) {
+  if (Call.getCalledFunction()->getName() == "llvm.eh.seh.filter")
+    TargetFound = true;
+}
+
+bool SEHFilterVisitor::reachesFilterIntrinsicCall(BasicBlock *BB) {
+  beginSearch(BB);
+  return TargetFound;
+}
+
+bool MSVCEHPruningVisitor::pruneOutlinedFilterCode(BasicBlock *BB, 
+                                                   Function *FilterFn) {
+  FilterToPrune = FilterFn;
+  beginSearch(BB);
+  return TargetFound;
+}
+
+bool MSVCEHPruningVisitor::pruneFilterBranch(TerminatorInst &Terminator) {
+  BranchInst *Branch = dyn_cast<BranchInst>(&Terminator);
+  if (!Branch || !Branch->isConditional())
+    return false;
+
+  CmpInst *Compare = dyn_cast<CmpInst>(Branch->getCondition());
+  if (!Compare || !Compare->isEquality())
+    return false;
+
+  // Check to see if either operand is a call to get an eh selector id.
+  // FIXME: Make this an intrinsic check.
+  CallInst *Call = dyn_cast<CallInst>(Compare->getOperand(0));
+  if (!Call || Call->getCalledFunction()->getName() != "llvm.eh.selector.for") {
+    Call = dyn_cast<CallInst>(Compare->getOperand(1));
+    if (!Call || Call->getCalledFunction()->getName() != "llvm.eh.selector.for")
+      return false;
+  }
+
+  if (Call->getArgOperand(0)->stripPointerCasts() != FilterToPrune)
+    return false;
+
+  BasicBlock *FilterBranch = nullptr;
+  if (Compare->getPredicate() == CmpInst::ICMP_EQ)
+    FilterBranch = Branch->getSuccessor(0);
+  else if (Compare->getPredicate() == CmpInst::ICMP_NE)
+    FilterBranch = Branch->getSuccessor(1);
+  else
+    return false; // Unexpected predicate;
+
+  SEHFilterVisitor  Visitor(OriginLPad);
+  if (!Visitor.reachesFilterIntrinsicCall(FilterBranch)) {
+    DEBUG(dbgs() << "Compare doesn't lead to filter intrinsic.\n");
+    return false;
+  }
+
+  if (Compare->getPredicate() == CmpInst::ICMP_EQ)
+    Branch->setCondition(ConstantInt::get(Compare->getType(), 0));
+  else
+    Branch->setCondition(ConstantInt::get(Compare->getType(), 1));
+
+  // Save the branch's basic block before we attempt to fold it.
+  BasicBlock *Pred = Branch->getParent();
+
+  ConstantFoldTerminator(Pred, true);
+
+  // In most cases replacing the branch instruction's condition will leave
+  // the compare and the the selector intrinsic call as unused code.
+  if (Compare->getNumUses() == 0)
+    Compare->eraseFromParent();
+  if (Call->getNumUses() == 0)
+    Call->eraseFromParent();
+
+  // The call to ConstantFoldTerminator should have replaced the conditional
+  // branch instruction with an unconditional branch.
+  Branch = dyn_cast<BranchInst>(Pred->getTerminator());
+  assert(Branch && Branch->isUnconditional());
+
+  // If nothing else leads to the Filter branch, delete it now.
+  if (pred_begin(FilterBranch) == pred_end(FilterBranch))
+    DeleteDeadBlock(FilterBranch);
+
+  // After the constant folding above, the branch instruction should be
+  // unconditional.  If the successor has no other predecessors, fold
+  // the successor block into the branch's block.
+  BasicBlock *Dest = Branch->getSuccessor(0);
+  if (Dest->getSinglePredecessor()) {
+    // We shouldn't be able to get single-entry PHI nodes here, as instsimplify
+    // above should have zapped all of them..
+    assert(!isa<PHINode>(Dest->begin()));
+
+    // We know all single-entry PHI nodes in the inlined function have been
+    // removed, so we just need to splice the blocks.
+    Branch->eraseFromParent();
+    
+    // Make all PHI nodes that referred to Dest now refer to I as their source.
+    Dest->replaceAllUsesWith(Pred);
+
+    // Move all the instructions in the succ to the pred.
+    Pred->getInstList().splice(Pred->end(), Dest->getInstList());
+    
+    // Remove the dest block.
+    Dest->eraseFromParent();
+  }
+
+  return true;
+}
+
+void MSVCEHPruningVisitor::handleTerminatorInst(TerminatorInst &Terminator) {
+  if (pruneFilterBranch(Terminator))
+    TargetFound = true;
+}
+
+CloningDirector::CloningAction SEHFilterDirector::handleInstruction(
+    ValueToValueMapTy &VMap, const Instruction *Inst, BasicBlock *NewBB) {
+  // Intercept instructions which extract values from the landing pad aggregate.
+  const ExtractValueInst *Extract = dyn_cast<ExtractValueInst>(Inst);
+  if (Extract && Extract->getAggregateOperand() == LPI) {
+
+    assert(Extract->getNumIndices() == 1 &&
+           "Unexpected operation: extracting both landing pad values");
+    assert((*(Extract->idx_begin()) == 0 || *(Extract->idx_begin()) == 1) &&
+           "Unexpected operation: extracting an unknown landing pad element");
+
+    // Element 0 corresponds to the first argument of the filter function.
+    // Element 1 corresponds to the filter ID (use 1 to match).
+    if (*(Extract->idx_begin()) == 0)
+      VMap[Inst] = CurrentFilterFn->arg_begin();
+    else
+      VMap[Inst] = ConstantInt::get(FilterIDType, 1);
+
+    // Tell the caller not to clone this instruction.
+    return CloningDirector::SkipInstruction;
+  }
+
+  // TODO: Make this use intrinsics.
+  const CallInst *Call = dyn_cast<CallInst>(Inst);
+  if (Call && Call->getCalledFunction()->getName() == "llvm.eh.selector.for") {
+    Function *FilterFn =
+        dyn_cast<Function>(Call->getArgOperand(0)->stripPointerCasts());
+    if (FilterFn) {
+      // This causes a replacement that will collapse the landing pad CFG based
+      // on the filter function we intend to match.
+      if (FilterFn == CurrentFilterFn)
+        VMap[Inst] = ConstantInt::get(FilterIDType, 1);
+      else
+        VMap[Inst] = ConstantInt::get(FilterIDType, 0);
+      // Tell the caller not to clone this instruction.
+      return CloningDirector::SkipInstruction;
+    }
+  }
+  else if (Call && Call->getCalledFunction()->getName() == "llvm.eh.seh.filter") {
+    // The argument to the call should already have been cloned and mapped,
+    // but the cloning function will want to remap the operands of the 
+    // terminator, so we insert an instruction here that uses the original
+    // return value.
+    Value *FilterResult = Call->getArgOperand(0);
+    ReturnInst::Create(NewBB->getContext(), FilterResult, NewBB);
+    // We've found our endpoint and inserted a terminator.
+    // Tell the caller to stop processing the current basic block.
+    return CloningDirector::StopCloningBB;
+  }
+
+  // Continue with the default cloning behavior.
+  return CloningDirector::CloneInstruction;
+}
+
+bool MSVCEHPrepare::prepareCPPEHHandlers(Function &F,
+                                         BasicBlock *LandingPadBB) {
+  // TODO: Implement C++ exception handler outlining.
+  llvm_unreachable("unsupported MSVC EH personality function");
+  return false;
+}

lib/CodeGen/Passes.cpp

case ExceptionHandling::SjLj:
     // removed from the parent invoke(s). This could happen when a landing
     // pad is shared by multiple invokes and is also a target of a normal
     // edge from elsewhere.
     addPass(createSjLjEHPreparePass(TM));
     // FALLTHROUGH
   case ExceptionHandling::DwarfCFI:
   case ExceptionHandling::ARM:
   case ExceptionHandling::ItaniumWinEH:
-  case ExceptionHandling::MSVC: // FIXME: Needs preparation.
+    addPass(createDwarfEHPass(TM));
+    break;
+  case ExceptionHandling::MSVC:
+    addPass(createMSVCEHPreparePass(TM));
     addPass(createDwarfEHPass(TM));
     break;
   case ExceptionHandling::None:
     addPass(createLowerInvokePass());
 
     // The lower invoke pass may create unreachable code. Remove it.
     addPass(createUnreachableBlockEliminationPass());
     break;

lib/Transforms/Utils/CloneFunction.cpp

namespace {
   struct PruningFunctionCloner {
     Function *NewFunc;
     const Function *OldFunc;
     ValueToValueMapTy &VMap;
     bool ModuleLevelChanges;
     const char *NameSuffix;
     ClonedCodeInfo *CodeInfo;
     const DataLayout *DL;
+    CloningDirector *Director;
+
   public:
     PruningFunctionCloner(Function *newFunc, const Function *oldFunc,
                           ValueToValueMapTy &valueMap,
                           bool moduleLevelChanges,
                           const char *nameSuffix, 
                           ClonedCodeInfo *codeInfo,
-                          const DataLayout *DL)
+                          const DataLayout *DL,
+                          CloningDirector *Director)
     : NewFunc(newFunc), OldFunc(oldFunc),
       VMap(valueMap), ModuleLevelChanges(moduleLevelChanges),
-      NameSuffix(nameSuffix), CodeInfo(codeInfo), DL(DL) {
+      NameSuffix(nameSuffix), CodeInfo(codeInfo), DL(DL),
+      Director(Director) {
     }
 
     /// CloneBlock - The specified block is found to be reachable, clone it and
     /// anything that it can reach.
-    void CloneBlock(const BasicBlock *BB,
+    void CloneBlock(const BasicBlock *BB, 
+                    BasicBlock::const_iterator StartingInst,
                     std::vector<const BasicBlock*> &ToClone);
   };
 }
 
 /// CloneBlock - The specified block is found to be reachable, clone it and
 /// anything that it can reach.
 void PruningFunctionCloner::CloneBlock(const BasicBlock *BB,
+                                       BasicBlock::const_iterator StartingInst,
                                        std::vector<const BasicBlock*> &ToClone){
   WeakVH &BBEntry = VMap[BB];
 
   // Have we already cloned this block?
   if (BBEntry) return;
   
   // Nope, clone it now.
   BasicBlock *NewBB;
void PruningFunctionCloner::CloneBlock(const BasicBlock *BB,
   //
   // Note that we don't need to fix the mapping for unreachable blocks;
   // the default mapping there is safe.
   if (BB->hasAddressTaken()) {
     Constant *OldBBAddr = BlockAddress::get(const_cast<Function*>(OldFunc),
                                             const_cast<BasicBlock*>(BB));
     VMap[OldBBAddr] = BlockAddress::get(NewFunc, NewBB);
   }
-    
-
   bool hasCalls = false, hasDynamicAllocas = false, hasStaticAllocas = false;
-  
   // Loop over all instructions, and copy them over, DCE'ing as we go.  This
   // loop doesn't include the terminator.
-  for (BasicBlock::const_iterator II = BB->begin(), IE = --BB->end();
+  for (BasicBlock::const_iterator II = StartingInst, IE = --BB->end();
        II != IE; ++II) {
+    // If the "Director" remaps the instruction, don't clone it.
+    if (Director) {
+      CloningDirector::CloningAction Action 
+                              = Director->handleInstruction(VMap, II, NewBB);
+      // If the cloning director says stop, we want to stop everything, not
+      // just break out of the loop (which would cause the terminator to be
+      // cloned).  The cloning director is responsible for inserting a proper
+      // terminator into the new basic block in this case.
+      if (Action == CloningDirector::StopCloningBB)
+        return;
+      // If the cloning director says skip, continue to the next instruction.
+      // In this case, the cloning director is responsible for mapping the
+      // skipped instruction to some value that is defined in the new
+      // basic block.
+      if (Action == CloningDirector::SkipInstruction)
+        continue;
+    }
+
     Instruction *NewInst = II->clone();
 
     // Eagerly remap operands to the newly cloned instruction, except for PHI
     // nodes for which we defer processing until we update the CFG.
     if (!isa<PHINode>(NewInst)) {
       RemapInstruction(NewInst, VMap,
                        ModuleLevelChanges ? RF_None : RF_NoModuleLevelChanges);
 
if (const AllocaInst *AI = dyn_cast<AllocaInst>(II)) {
       else
         hasDynamicAllocas = true;
     }
   }
   
   // Finally, clone over the terminator.
   const TerminatorInst *OldTI = BB->getTerminator();
   bool TerminatorDone = false;
+  if (Director) {
+    CloningDirector::CloningAction Action 
+                           = Director->handleInstruction(VMap, OldTI, NewBB);
+    // If the cloning director says stop, we want to stop everything, not
+    // just break out of the loop (which would cause the terminator to be
+    // cloned).  The cloning director is responsible for inserting a proper
+    // terminator into the new basic block in this case.
+    if (Action == CloningDirector::StopCloningBB)
+      return;
+    assert(Action != CloningDirector::SkipInstruction && 
+           "SkipInstruction is not valid for terminators.");
+  }
   if (const BranchInst *BI = dyn_cast<BranchInst>(OldTI)) {
     if (BI->isConditional()) {
       // If the condition was a known constant in the callee...
       ConstantInt *Cond = dyn_cast<ConstantInt>(BI->getCondition());
       // Or is a known constant in the caller...
       if (!Cond) {
         Value *V = VMap[BI->getCondition()];
         Cond = dyn_cast_or_null<ConstantInt>(V);
void PruningFunctionCloner::CloneBlock(const BasicBlock *BB,
   if (CodeInfo) {
     CodeInfo->ContainsCalls          |= hasCalls;
     CodeInfo->ContainsDynamicAllocas |= hasDynamicAllocas;
     CodeInfo->ContainsDynamicAllocas |= hasStaticAllocas && 
       BB != &BB->getParent()->front();
   }
 }
 
-/// CloneAndPruneFunctionInto - This works exactly like CloneFunctionInto,
-/// except that it does some simple constant prop and DCE on the fly.  The
-/// effect of this is to copy significantly less code in cases where (for
-/// example) a function call with constant arguments is inlined, and those
-/// constant arguments cause a significant amount of code in the callee to be
-/// dead.  Since this doesn't produce an exact copy of the input, it can't be
-/// used for things like CloneFunction or CloneModule.
-void llvm::CloneAndPruneFunctionInto(Function *NewFunc, const Function *OldFunc,
+/// CloneAndPruneIntoFromInst - This works like CloneAndPruneFunctionInto, except
+/// that it does not clone the entire function. Instead it starts at an
+/// instruction provided by the caller and copies (and prunes) only the code 
+/// reachable from that instruction.
+void llvm::CloneAndPruneIntoFromInst(Function *NewFunc, const Function *OldFunc,
+                                     const Instruction *StartingInst,
                                      ValueToValueMapTy &VMap,
                                      bool ModuleLevelChanges,
                                      SmallVectorImpl<ReturnInst*> &Returns,
                                      const char *NameSuffix, 
                                      ClonedCodeInfo *CodeInfo,
                                      const DataLayout *DL,
-                                     Instruction *TheCall) {
+                                     CloningDirector *Director) {
   assert(NameSuffix && "NameSuffix cannot be null!");
-  
 #ifndef NDEBUG
-  for (Function::const_arg_iterator II = OldFunc->arg_begin(), 
+  // If the cloning starts at the begining of the function, verify that
+  // the function arguments are mapped.
+  if (!StartingInst)
+    for (Function::const_arg_iterator II = OldFunc->arg_begin(),
          E = OldFunc->arg_end(); II != E; ++II)
       assert(VMap.count(II) && "No mapping from source argument specified!");
 #endif
 
   PruningFunctionCloner PFC(NewFunc, OldFunc, VMap, ModuleLevelChanges,
-                            NameSuffix, CodeInfo, DL);
+                            NameSuffix, CodeInfo, DL, Director);
+  const BasicBlock *StartingBB;
+  if (StartingInst)
+    StartingBB = StartingInst->getParent();
+  else {
+    StartingBB = &OldFunc->getEntryBlock();
+    StartingInst = StartingBB->begin();
+  }
 
   // Clone the entry block, and anything recursively reachable from it.
   std::vector<const BasicBlock*> CloneWorklist;
-  CloneWorklist.push_back(&OldFunc->getEntryBlock());
+  PFC.CloneBlock(StartingBB, StartingInst, CloneWorklist);
   while (!CloneWorklist.empty()) {
     const BasicBlock *BB = CloneWorklist.back();
     CloneWorklist.pop_back();
-    PFC.CloneBlock(BB, CloneWorklist);
+    PFC.CloneBlock(BB, BB->begin(), CloneWorklist);
   }
   
   // Loop over all of the basic blocks in the old function.  If the block was
   // reachable, we have cloned it and the old block is now in the value map:
   // insert it into the new function in the right order.  If not, ignore it.
   //
   // Defer PHI resolution until rest of function is resolved.
   SmallVector<const PHINode*, 16> PHIToResolve;
#endif
   for (unsigned Idx = 0, Size = PHIToResolve.size(); Idx != Size; ++Idx)
     if (PHINode *PN = dyn_cast<PHINode>(VMap[PHIToResolve[Idx]]))
       recursivelySimplifyInstruction(PN, DL);
 
   // Now that the inlined function body has been fully constructed, go through
   // and zap unconditional fall-through branches.  This happen all the time when
   // specializing code: code specialization turns conditional branches into
   // uncond branches, and this code folds them.
-  Function::iterator Begin = cast<BasicBlock>(VMap[&OldFunc->getEntryBlock()]);
+  Function::iterator Begin = cast<BasicBlock>(VMap[StartingBB]);
   Function::iterator I = Begin;
   while (I != NewFunc->end()) {
     // Check if this block has become dead during inlining or other
     // simplifications. Note that the first block will appear dead, as it has
     // not yet been wired up properly.
     if (I != Begin && (pred_begin(I) == pred_end(I) ||
                        I->getSinglePredecessor() == I)) {
       BasicBlock *DeadBB = I++;
while (I != NewFunc->end()) {
     Dest->eraseFromParent();
     
     // Do not increment I, iteratively merge all things this block branches to.
   }
 
   // Make a final pass over the basic blocks from theh old function to gather
   // any return instructions which survived folding. We have to do this here
   // because we can iteratively remove and merge returns above.
-  for (Function::iterator I = cast<BasicBlock>(VMap[&OldFunc->getEntryBlock()]),
+  for (Function::iterator I = cast<BasicBlock>(VMap[StartingBB]),
                           E = NewFunc->end();
        I != E; ++I)
     if (ReturnInst *RI = dyn_cast<ReturnInst>(I->getTerminator()))
       Returns.push_back(RI);
 }
+
+
+/// CloneAndPruneFunctionInto - This works exactly like CloneFunctionInto,
+/// except that it does some simple constant prop and DCE on the fly.  The
+/// effect of this is to copy significantly less code in cases where (for
+/// example) a function call with constant arguments is inlined, and those
+/// constant arguments cause a significant amount of code in the callee to be
+/// dead.  Since this doesn't produce an exact copy of the input, it can't be
+/// used for things like CloneFunction or CloneModule.
+void llvm::CloneAndPruneFunctionInto(Function *NewFunc, const Function *OldFunc,
+                                     ValueToValueMapTy &VMap,
+                                     bool ModuleLevelChanges,
+                                     SmallVectorImpl<ReturnInst*> &Returns,
+                                     const char *NameSuffix, 
+                                     ClonedCodeInfo *CodeInfo,
+                                     const DataLayout *DL,
+                                     Instruction *TheCall) {
+  CloneAndPruneIntoFromInst(NewFunc, OldFunc, OldFunc->front().begin(),
+                            VMap, ModuleLevelChanges, Returns, NameSuffix,
+                            CodeInfo, DL, nullptr);
+}

test/CodeGen/X86/seh-outline.ll

+; RUN: opt -mtriple=x86_64-pc-msvc -msvcehprepare -S -o - < %s | FileCheck %s
+
+define i32 @safe_div_filt0(i8* %ehp, i8* %rbp) {
+  unreachable ; Stub function, filled in by MSVCEHPrepare
+}
+
+; Verify the body of the outlined function.
+; CHECK: define i32 @safe_div_filt0(i8* %ehp, i8* %rbp) {
+; CHECK: lpad.seh:
+; CHECK:   %eh_ptrs_c.0.seh = bitcast i8* %ehp to i32**
+; CHECK:   %eh_rec.0.seh = load i32** %eh_ptrs_c.0.seh
+; CHECK:   %eh_code.0.seh = load i32* %eh_rec.0.seh
+; CHECK:   %cmp.0.seh = icmp eq i32 %eh_code.0.seh, -1073741819
+; CHECK:   %filt0.res.seh = zext i1 %cmp.0.seh to i32
+; CHECK:   ret i32 %filt0.res.seh
+; CHECK: }
+
+define i32 @safe_div_filt1(i8* %ehp, i8* %rbp) {
+  unreachable ; Stub function, filled in by MSVCEHPrepare
+}
+
+; Verify the body of the outlined function.
+; CHECK: define i32 @safe_div_filt1(i8* %ehp, i8* %rbp) {
+; CHECK: lpad.seh:
+; CHECK:   %eh_ptrs_c.1.seh = bitcast i8* %ehp to i32**
+; CHECK:   %eh_rec.1.seh = load i32** %eh_ptrs_c.1.seh
+; CHECK:   %eh_code.1.seh = load i32* %eh_rec.1.seh
+; CHECK:   %cmp.1.seh = icmp eq i32 %eh_code.1.seh, -1073741676
+; CHECK:   %filt1.res.seh = zext i1 %cmp.1.seh to i32
+; CHECK:   ret i32 %filt1.res.seh
+; CHECK: }
+
+@str1=linkonce_odr unnamed_addr constant [3 x i8] c"One", align 1
+@str2=linkonce_odr unnamed_addr constant [3 x i8] c"Two", align 1
+
+define i32 @safe_div(i32* %n, i32* %d) {
+entry:
+  %r = alloca i32, align 4
+  invoke void @try_body(i32* %r, i32* %n, i32* %d)
+          to label %__try.cont unwind label %lpad
+
+lpad:
+  %vals = landingpad { i8*, i32 } personality i8* bitcast (i32 (...)* @__C_specific_handler to i8*)
+          catch i8* bitcast (i32 (i8*, i8*)* @safe_div_filt0 to i8*)
+          catch i8* bitcast (i32 (i8*, i8*)* @safe_div_filt1 to i8*)
+  br label %seh.filter.dispatch
+
+seh.filter.dispatch:
+  %eh_ptrs = extractvalue { i8*, i32 } %vals, 0
+  %sel = extractvalue { i8*, i32 } %vals, 1
+  %filt0_val = call i32 @llvm.eh.selector.for(i8* bitcast (i32 (i8*, i8*)* @safe_div_filt0 to i8*))
+  %is_filt0 = icmp eq i32 %sel, %filt0_val
+  br i1 %is_filt0, label %filter0, label %seh.filter.dispatch1
+
+seh.filter.dispatch1:
+  %filt1_val = call i32 @llvm.eh.selector.for(i8* bitcast (i32 (i8*, i8*)* @safe_div_filt1 to i8*))
+  %is_filt1 = icmp eq i32 %sel, %filt1_val
+  br i1 %is_filt1, label %filter1, label %seh.handler.dispatch
+
+filter0:  ; MSVCEHPrepare traces out this basic block, after folding away preceding dispatch.
+  %eh_ptrs_c.0 = bitcast i8* %eh_ptrs to i32**
+  %eh_rec.0 = load i32** %eh_ptrs_c.0
+  %eh_code.0 = load i32* %eh_rec.0
+  ; EXCEPTION_ACCESS_VIOLATION = 0xC0000005
+  %cmp.0 = icmp eq i32 %eh_code.0, 3221225477
+  %filt0.res = zext i1 %cmp.0 to i32
+  ; FILTER OUTLINING ENDS HERE
+  call void @llvm.eh.seh.filter(i32 %filt0.res)
+  br label %seh.handler.dispatch
+
+filter1:
+  %eh_ptrs_c.1 = bitcast i8* %eh_ptrs to i32**
+  %eh_rec.1 = load i32** %eh_ptrs_c.1
+  %eh_code.1 = load i32* %eh_rec.1
+  ; EXCEPTION_INT_DIVIDE_BY_ZERO = 0xC0000094
+  %cmp.1 = icmp eq i32 %eh_code.1, 3221225620
+  %filt1.res = zext i1 %cmp.1 to i32
+  ; FILTER OUTLINING ENDS HERE
+  call void @llvm.eh.seh.filter(i32 %filt1.res)
+  br label %seh.handler.dispatch
+
+seh.handler.dispatch:
+  %handler0_val = call i32 @llvm.eh.selector.for(i8* bitcast (i32 (i8*, i8*)* @safe_div_filt0 to i8*))
+  %is_handler0 = icmp eq i32 %sel, %handler0_val
+  br i1 %is_handler0, label %handler0, label %seh.handler.dispatch1
+
+seh.handler.dispatch1:
+  %handler1_val = call i32 @llvm.eh.selector.for(i8* bitcast (i32 (i8*, i8*)* @safe_div_filt1 to i8*))
+  %is_handler1 = icmp eq i32 %sel, %handler1_val
+  br i1 %is_handler1, label %handler1, label %seh.resume
+
+handler0:
+  call void @puts(i8* getelementptr inbounds ([3 x i8]* @str1, i32 0, i32 0))
+  store i32 -1, i32* %r, align 4
+  br label %__try.cont
+
+handler1:
+  call void @puts(i8* getelementptr inbounds ([3 x i8]* @str2, i32 0, i32 0))
+  store i32 -2, i32* %r, align 4
+  br label %__try.cont
+
+seh.resume:
+  resume { i8*, i32 } %vals
+
+__try.cont:
+  %safe_ret = load i32* %r, align 4
+  ret i32 %safe_ret
+}
+
+; Verify that the filters have been removed from the body of the original function.
+; CHECK: define i32 @safe_div(i32* %n, i32* %d) {
+; CHECK: entry:
+; CHECK:   %r = alloca i32, align 4
+; CHECK:   invoke void @try_body(i32* %r, i32* %n, i32* %d)
+; CHECK:           to label %__try.cont unwind label %lpad
+;
+; CHECK: lpad:
+; CHECK:   %vals = landingpad { i8*, i32 } personality i8* bitcast (i32 (...)* @__C_specific_handler to i8*)
+; CHECK:           catch i8* bitcast (i32 (i8*, i8*)* @safe_div_filt0 to i8*)
+; CHECK:           catch i8* bitcast (i32 (i8*, i8*)* @safe_div_filt1 to i8*)
+;
+; Leave some flexibility as to how the branching is now implemented,
+; but at some point it should contain the following definition.
+; CHECK:   %sel = extractvalue { i8*, i32 } %vals, 1
+;
+; CHECK-NOT: filter0:
+; CHECK-NOT:   %eh_ptrs_c.0 = bitcast i8* %eh_ptrs to i32**
+; CHECK-NOT:   %eh_rec.0 = load i32** %eh_ptrs_c.0
+; CHECK-NOT:   %eh_code.0 = load i32* %eh_rec.0
+; CHECK-NOT:   %cmp.0 = icmp eq i32 %eh_code.0, 3221225477
+; CHECK-NOT:   %filt0.res = zext i1 %cmp.0 to i32
+; CHECK-NOT:   call void @llvm.eh.seh.filter(i32 %filt0.res)
+; CHECK-NOT:   br label %seh.handler.dispatch
+;
+; CHECK-NOT: filter1:
+; CHECK-NOT:   %eh_ptrs_c.1 = bitcast i8* %eh_ptrs to i32**
+; CHECK-NOT:   %eh_rec.1 = load i32** %eh_ptrs_c.1
+; CHECK-NOT:   %eh_code.1 = load i32* %eh_rec.1
+; CHECK-NOT:   %cmp.1 = icmp eq i32 %eh_code.1, 3221225620
+; CHECK-NOT:   %filt1.res = zext i1 %cmp.1 to i32
+; CHECK-NOT:   call void @llvm.eh.seh.filter(i32 %filt1.res)
+; CHECK-NOT:   br label %seh.handler.dispatch
+;
+; Everything else should be left intact.
+;
+; CHECK:   %handler0_val = call i32 @llvm.eh.selector.for(i8* bitcast (i32 (i8*, i8*)* @safe_div_filt0 to i8*))
+; CHECK:   %is_handler0 = icmp eq i32 %sel, %handler0_val
+; CHECK:   br i1 %is_handler0, label %handler0, label %seh.handler.dispatch1
+;
+; CHECK: seh.handler.dispatch1:
+; CHECK:   %handler1_val = call i32 @llvm.eh.selector.for(i8* bitcast (i32 (i8*, i8*)* @safe_div_filt1 to i8*))
+; CHECK:   %is_handler1 = icmp eq i32 %sel, %handler1_val
+; CHECK:   br i1 %is_handler1, label %handler1, label %seh.resume
+;
+; CHECK: handler0:
+; CHECK:   call void @puts(i8* getelementptr inbounds ([3 x i8]* @str1, i32 0, i32 0))
+; CHECK:   store i32 -1, i32* %r, align 4
+; CHECK:   br label %__try.cont
+;
+; CHECK: handler1:
+; CHECK:   call void @puts(i8* getelementptr inbounds ([3 x i8]* @str2, i32 0, i32 0))
+; CHECK:   store i32 -2, i32* %r, align 4
+; CHECK:   br label %__try.cont
+;
+; CHECK: seh.resume:
+; CHECK:   resume { i8*, i32 } %vals
+;
+; CHECK: __try.cont:                                        ; preds
+; CHECK:   %safe_ret = load i32* %r, align 4
+; CHECK:   ret i32 %safe_ret
+; CHECK: }
+
+declare i32 @__C_specific_handler(...)
+
+declare void @try_body(i32*, i32*, i32*)
+
+declare void @puts(i8*)
+
+declare void @llvm.eh.seh.filter(i32)
+declare i32 @llvm.eh.selector.for(i8*)

tools/opt/opt.cpp

int main(int argc, char **argv) {
   initializeIPA(Registry);
   initializeTransformUtils(Registry);
   initializeInstCombine(Registry);
   initializeInstrumentation(Registry);
   initializeTarget(Registry);
   // For codegen passes, only passes that do IR to IR transformation are
   // supported.
   initializeCodeGenPreparePass(Registry);
+  initializeMSVCEHPreparePass(Registry);
   initializeAtomicExpandPass(Registry);
   initializeRewriteSymbolsPass(Registry);
 
 #ifdef LINK_POLLY_INTO_TOOLS
   polly::initializePollyPasses(Registry);
 #endif
 
   cl::ParseCommandLineOptions(argc, argv,