[Windows] Replace TrapUnreachable with an int3 insertion pass

[rnk]

Summary

This is an alternative to D66980, which was reverted. Instead of
inserting a pseudo instruction that optionally expands to nothing, add a
pass that inserts int3 when appropriate after basic block layout.

[hans]

lgtm. I only know about this from what rnk told me about the unwinder not wanting the return address to be outside the function, and this seems like a straight-forward solution to that problem.

llvm/lib/Target/X86/X86.h

85

Maybe mention briefly that this is in order not to confuse certain unwinders? Otherwise this describes perfectly the "what" but not the "why".

[rnk]

Thanks!

llvm/lib/Target/X86/CMakeLists.txt

 if (X86_GEN_FOLD_TABLES)
   tablegen(LLVM X86GenFoldTables.inc -gen-x86-fold-tables)
 endif()
 
 add_public_tablegen_target(X86CommonTableGen)
 
 set(sources
   X86AsmPrinter.cpp
+  X86AvoidTrailingCall.cpp
   X86CallFrameOptimization.cpp
   X86CallingConv.cpp
   X86CallLowering.cpp
   X86CmovConversion.cpp
   X86CondBrFolding.cpp
   X86DomainReassignment.cpp
   X86DiscriminateMemOps.cpp
   X86ExpandPseudo.cpp

llvm/lib/Target/X86/X86.h

 FunctionPass *createX86AvoidStoreForwardingBlocks();
 
 /// Return a pass that lowers EFLAGS copy pseudo instructions.
 FunctionPass *createX86FlagsCopyLoweringPass();
 
 /// Return a pass that expands WinAlloca pseudo-instructions.
 FunctionPass *createX86WinAllocaExpander();
 
+/// Return a pass that inserts int3 at the end of the function if it ends with a
+/// CALL instruction. The pass does the same for each funclet as well.
+FunctionPass *createX86AvoidTrailingCallPass();
+
 /// Return a pass that optimizes the code-size of x86 call sequences. This is
 /// done by replacing esp-relative movs with pushes.
 FunctionPass *createX86CallFrameOptimization();
 
 /// Return an IR pass that inserts EH registration stack objects and explicit
 /// EH state updates. This pass must run after EH preparation, which does
 /// Windows-specific but architecture-neutral preparation.
 FunctionPass *createX86WinEHStatePass();

llvm/lib/Target/X86/X86AvoidTrailingCall.cpp

+//===----- X86AvoidTrailingCall.cpp - Insert int3 after trailing calls ----===//
+//
+// Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
+// See https://llvm.org/LICENSE.txt for license information.
+// SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
+//
+//===----------------------------------------------------------------------===//
+//
+// The Windows x64 unwinder has trouble unwinding the stack when a return
+// address points to the end of the function. This pass maintains the invariant
+// that every return address is inside the bounds of its parent function or
+// funclet by inserting int3 if the last instruction would otherwise be a call.
+//
+//===----------------------------------------------------------------------===//
+
+#include "X86.h"
+#include "X86InstrInfo.h"
+#include "X86Subtarget.h"
+#include "llvm/CodeGen/MachineInstrBuilder.h"
+
+#define DEBUG_TYPE "x86-avoid-trailing-call"
+
+using namespace llvm;
+
+namespace {
+
+class X86AvoidTrailingCallPass : public MachineFunctionPass {
+public:
+  X86AvoidTrailingCallPass() : MachineFunctionPass(ID) {}
+
+  bool runOnMachineFunction(MachineFunction &MF) override;
+
+private:
+  StringRef getPassName() const override {
+    return "X86 avoid trailing call pass";
+  }
+  static char ID;
+};
+
+char X86AvoidTrailingCallPass::ID = 0;
+
+} // end anonymous namespace
+
+FunctionPass *llvm::createX86AvoidTrailingCallPass() {
+  return new X86AvoidTrailingCallPass();
+}
+
+// A real instruction is a non-meta, non-pseudo instruction.  Some pseudos
+// expand to nothing, and some expand to code. This logic conservatively assumes
+// they might expand to nothing.
+static bool isRealInstruction(MachineInstr &MI) {
+  return !MI.isPseudo() && !MI.isMetaInstruction();
+}
+
+// Return true if this is a call instruction, but not a tail call.
+static bool isCallInstruction(const MachineInstr &MI) {
+  return MI.isCall() && !MI.isReturn();
+}
+
+bool X86AvoidTrailingCallPass::runOnMachineFunction(MachineFunction &MF) {
+  const X86Subtarget &STI = MF.getSubtarget<X86Subtarget>();
+  const X86InstrInfo &TII = *STI.getInstrInfo();
+  assert(STI.isTargetWin64() && "pass only runs on Win64");
+
+  // FIXME: Perhaps this pass should also replace SEH_Epilogue by inserting nops
+  // before epilogues.
+
+  bool Changed = false;
+  for (MachineBasicBlock &MBB : MF) {
+    // Look for basic blocks that precede funclet entries or are at the end of
+    // the function.
+    MachineBasicBlock *NextMBB = MBB.getNextNode();
+    if (NextMBB && !NextMBB->isEHFuncletEntry())
+      continue;
+
+    // Find the last real instruction in this block, or previous blocks if this
+    // block is empty.
+    MachineBasicBlock::reverse_iterator LastRealInstr;
+    for (MachineBasicBlock &RMBB :
+         make_range(MBB.getReverseIterator(), MF.rend())) {
+      LastRealInstr = llvm::find_if(reverse(RMBB), isRealInstruction);
+      if (LastRealInstr != RMBB.rend())
+        break;
+    }
+
+    // Do nothing if this function or funclet has no instructions.
+    if (LastRealInstr == MF.begin()->rend())
+      continue;
+
+    // If this is a call instruction, insert int3 right after it with the same
+    // DebugLoc. Convert back to a forward iterator and advance the insertion
+    // position once.
+    if (isCallInstruction(*LastRealInstr)) {
+      LLVM_DEBUG({
+        dbgs() << "inserting int3 after trailing call instruction:\n";
+        LastRealInstr->dump();
+        dbgs() << '\n';
+      });
+
+      MachineBasicBlock::iterator MBBI = std::next(LastRealInstr.getReverse());
+      BuildMI(*LastRealInstr->getParent(), MBBI, LastRealInstr->getDebugLoc(),
+              TII.get(X86::INT3));
+      Changed = true;
+    }
+  }
+
+  return Changed;
+}

llvm/lib/Target/X86/X86TargetMachine.cpp

X86TargetMachine::X86TargetMachine(const Target &T, const Triple &TT,
                                    Optional<CodeModel::Model> CM,
                                    CodeGenOpt::Level OL, bool JIT)
     : LLVMTargetMachine(
           T, computeDataLayout(TT), TT, CPU, FS, Options,
           getEffectiveRelocModel(TT, JIT, RM),
           getEffectiveX86CodeModel(CM, JIT, TT.getArch() == Triple::x86_64),
           OL),
       TLOF(createTLOF(getTargetTriple())) {
-  // Windows stack unwinder gets confused when execution flow "falls through"
-  // after a call to 'noreturn' function.
-  // To prevent that, we emit a trap for 'unreachable' IR instructions.
-  // (which on X86, happens to be the 'ud2' instruction)
   // On PS4, the "return address" of a 'noreturn' call must still be within
   // the calling function, and TrapUnreachable is an easy way to get that.
-  // The check here for 64-bit windows is a bit icky, but as we're unlikely
-  // to ever want to mix 32 and 64-bit windows code in a single module
-  // this should be fine.
-  if ((TT.isOSWindows() && TT.getArch() == Triple::x86_64) || TT.isPS4() ||
-      TT.isOSBinFormatMachO()) {
+  if (TT.isPS4() || TT.isOSBinFormatMachO()) {
     this->Options.TrapUnreachable = true;
     this->Options.NoTrapAfterNoreturn = TT.isOSBinFormatMachO();
   }
 
   // Outlining is available for x86-64.
   if (TT.getArch() == Triple::x86_64)
     setMachineOutliner(true);
 
if (getOptLevel() != CodeGenOpt::None) {
     addPass(createX86FixupLEAs());
     addPass(createX86EvexToVexInsts());
   }
   addPass(createX86DiscriminateMemOpsPass());
   addPass(createX86InsertPrefetchPass());
 }
 
 void X86PassConfig::addPreEmitPass2() {
+  const Triple &TT = TM->getTargetTriple();
+  const MCAsmInfo *MAI = TM->getMCAsmInfo();
+
   addPass(createX86RetpolineThunksPass());
+
+  // Insert extra int3 instructions after trailing call instructions to avoid
+  // issues in the unwinder.
+  if (TT.isOSWindows() && TT.getArch() == Triple::x86_64)
+    addPass(createX86AvoidTrailingCallPass());
+
   // Verify basic block incoming and outgoing cfa offset and register values and
   // correct CFA calculation rule where needed by inserting appropriate CFI
   // instructions.
-  const Triple &TT = TM->getTargetTriple();
-  const MCAsmInfo *MAI = TM->getMCAsmInfo();
   if (!TT.isOSDarwin() &&
       (!TT.isOSWindows() ||
        MAI->getExceptionHandlingType() == ExceptionHandling::DwarfCFI))
     addPass(createCFIInstrInserter());
 }
 
 std::unique_ptr<CSEConfigBase> X86PassConfig::getCSEConfig() const {
   return getStandardCSEConfigForOpt(TM->getOptLevel());
 }

llvm/test/CodeGen/WinEH/wineh-noret-cleanup.ll

-; NOTE: Assertions have been autogenerated by utils/update_llc_test_checks.py
 ; RUN: sed -e s/.Cxx:// %s | llc -mtriple=x86_64-pc-windows-msvc | FileCheck %s --check-prefix=CXX
 ; RUN: sed -e s/.Seh:// %s | llc -mtriple=x86_64-pc-windows-msvc | FileCheck %s --check-prefix=SEH
 
 declare i32 @__CxxFrameHandler3(...)
 declare i32 @__C_specific_handler(...)
 declare void @dummy_filter()
 
 declare void @f(i32)

 ; SEH-LABEL: .Llsda_begin0:
 ; SEH-NEXT:    .long   .Ltmp0@IMGREL+1
 ; SEH-NEXT:    .long   .Ltmp1@IMGREL+1
 ; SEH-NEXT:    .long   dummy_filter@IMGREL
 ; SEH-NEXT:    .long   .LBB0_3@IMGREL
 ; SEH-NEXT:    .long   .Ltmp0@IMGREL+1
 ; SEH-NEXT:    .long   .Ltmp1@IMGREL+1
 ; SEH-NEXT:    .long   dummy_filter@IMGREL
-; SEH-NEXT:    .long   .LBB0_2@IMGREL
+; SEH-NEXT:    .long   .LBB0_5@IMGREL
 ; SEH-NEXT:    .long   .Ltmp2@IMGREL+1
 ; SEH-NEXT:    .long   .Ltmp3@IMGREL+1
-; SEH-NEXT:    .long   "?dtor$5@?0?test@4HA"@IMGREL 
+; SEH-NEXT:    .long   "?dtor$2@?0?test@4HA"@IMGREL
 ; SEH-NEXT:    .long   0
 ; SEH-NEXT:    .long   .Ltmp2@IMGREL+1
 ; SEH-NEXT:    .long   .Ltmp3@IMGREL+1
 ; SEH-NEXT:    .long   dummy_filter@IMGREL
-; SEH-NEXT:    .long   .LBB0_2@IMGREL
+; SEH-NEXT:    .long   .LBB0_5@IMGREL
 ; SEH-NEXT:  .Llsda_end0:

llvm/test/CodeGen/X86/br-fold.ll

 ; RUN: llc -mtriple=x86_64-apple-darwin < %s | FileCheck  -check-prefix=X64_DARWIN %s
 ; RUN: llc -mtriple=x86_64-pc-linux < %s | FileCheck  -check-prefix=X64_LINUX %s
 ; RUN: llc -mtriple=x86_64-pc-windows < %s | FileCheck  -check-prefix=X64_WINDOWS %s
 ; RUN: llc -mtriple=x86_64-pc-windows-gnu < %s | FileCheck  -check-prefix=X64_WINDOWS_GNU %s
 ; RUN: llc -mtriple=x86_64-scei-ps4 < %s | FileCheck -check-prefix=PS4 %s
 
 ; X64_DARWIN: orq
-; X64-DARWIN-NEXT: ud2
+; X64_DARWIN-NEXT: ud2
 
 ; X64_LINUX: orq %rax, %rcx
 ; X64_LINUX-NEXT: jne
 ; X64_LINUX-NEXT: %bb8.i329
 
 ; X64_WINDOWS: orq %rax, %rcx
-; X64_WINDOWS-NEXT: ud2
+; X64_WINDOWS-NEXT: jne
 
 ; X64_WINDOWS_GNU: movq .refptr._ZN11xercesc_2_513SchemaSymbols21fgURI_SCHEMAFORSCHEMAE(%rip), %rax
 ; X64_WINDOWS_GNU: orq .refptr._ZN11xercesc_2_56XMLUni16fgNotationStringE(%rip), %rax
-; X64_WINDOWS_GNU-NEXT: ud2
+; X64_WINDOWS_GNU-NEXT: jne
 
 ; PS4: orq %rax, %rcx
 ; PS4-NEXT: ud2
 
 @_ZN11xercesc_2_513SchemaSymbols21fgURI_SCHEMAFORSCHEMAE = external constant [33 x i16], align 32 ; <[33 x i16]*> [#uses=1]
 @_ZN11xercesc_2_56XMLUni16fgNotationStringE = external constant [9 x i16], align 16 ; <[9 x i16]*> [#uses=1]
 
 define fastcc void @foo() {

llvm/test/CodeGen/X86/catchpad-lifetime.ll

 ; RUN: llc < %s | FileCheck %s
 
 target datalayout = "e-m:x-p:32:32-i64:64-f80:32-n8:16:32-a:0:32-S32"
 target triple = "x86_64-pc-windows-msvc"
 
 declare void @throw()
 
 declare i32 @__CxxFrameHandler3(...)
 
+declare void @llvm.trap()
+
 define void @test1() personality i32 (...)* @__CxxFrameHandler3 {
 entry:
   %alloca2 = alloca i8*, align 4
   %alloca1 = alloca i8*, align 4
   store volatile i8* null, i8** %alloca1
   invoke void @throw()
           to label %unreachable unwind label %catch.dispatch
 
 ; CHECK-LABEL: test1:
 ; CHECK: movq  $0, -8(%rbp)
 ; CHECK: callq throw
 
 catch.dispatch:                                   ; preds = %entry
   %cs = catchswitch within none [label %catch.pad] unwind to caller
 
 catch.pad:                                        ; preds = %catch.dispatch
   %cp = catchpad within %cs [i8* null, i32 0, i8** %alloca1]
   store volatile i8* null, i8** %alloca1
   %bc1 = bitcast i8** %alloca1 to i8*
   call void @llvm.lifetime.end.p0i8(i64 4, i8* nonnull %bc1)
   %bc2 = bitcast i8** %alloca2 to i8*
   call void @llvm.lifetime.start.p0i8(i64 4, i8* %bc2)
   store volatile i8* null, i8** %alloca1
+  call void @llvm.trap()
   unreachable
 
 ; CHECK-LABEL: "?catch$2@?0?test1@4HA"
 ; CHECK: movq  $0, -8(%rbp)
 ; CHECK: movq  $0, -8(%rbp)
 ; CHECK: ud2
 
 unreachable:                                      ; preds = %entry

 catch.pad:                                        ; preds = %catch.dispatch
   %cp = catchpad within %cs [i8* null, i32 0, i8** null]
   store volatile i8* null, i8** %alloca1
   %bc1 = bitcast i8** %alloca1 to i8*
   call void @llvm.lifetime.end.p0i8(i64 4, i8* nonnull %bc1)
   %bc2 = bitcast i8** %alloca2 to i8*
   call void @llvm.lifetime.start.p0i8(i64 4, i8* %bc2)
   store volatile i8* null, i8** %alloca1
+  call void @llvm.trap()
   unreachable
 
 ; CHECK-LABEL: "?catch$2@?0?test2@4HA"
 ; CHECK: movq  $0, -16(%rbp)
 ; CHECK: movq  $0, -16(%rbp)
 ; CHECK: ud2
 
 unreachable:                                      ; preds = %entry

llvm/test/CodeGen/X86/catchpad-regmask.ll

 ; CHECK: callq   _CxxThrowException
 ;   Third array access must remat the address of array
 ; CHECK: movslq  {{.*}}, %[[idx:[^ ]*]]
 ; CHECK: leaq    array(%rip), %[[base:[^ ]*]]
 ; CHECK: movl    $333, (%[[base]],%[[idx]],4)
 ; CHECK: popq %rbp
 ; CHECK: retq
 
-; CHECK: "?catch$2@?0?global_array@4HA":
+; CHECK: "?catch${{[0-9]+}}@?0?global_array@4HA":
 ; CHECK: pushq   %rbp
 ; CHECK: movslq  {{.*}}, %[[idx:[^ ]*]]
 ; CHECK: leaq    array(%rip), %[[base:[^ ]*]]
 ; CHECK: movl    $222, (%[[base]],%[[idx]],4)
 ; CHECK: popq    %rbp
 ; CHECK: retq                            # CATCHRET
 
 declare void @_CxxThrowException(i8*, %eh.ThrowInfo*)

 ; Might throw an exception and return to below...
 ; CHECK: callq   _CxxThrowException
 ;   Third access must reload the address of imported
 ; CHECK: movq    __imp_imported(%rip), %[[base:[^ ]*]]
 ; CHECK: movl    $333, (%[[base]])
 ; CHECK: popq %rbp
 ; CHECK: retq
 
-; CHECK: "?catch$2@?0?access_imported@4HA":
+; CHECK: "?catch${{[0-9]+}}@?0?access_imported@4HA":
 ; CHECK: pushq   %rbp
 ; CHECK: movq    __imp_imported(%rip), %[[base:[^ ]*]]
 ; CHECK: movl    $222, (%[[base]])
 ; CHECK: popq    %rbp
 ; CHECK: retq                            # CATCHRET
 
 
 attributes #0 = { uwtable "disable-tail-calls"="false" "less-precise-fpmad"="false" "no-frame-pointer-elim"="false" "no-infs-fp-math"="false" "no-nans-fp-math"="false" "stack-protector-buffer-size"="8" "target-cpu"="x86-64" "target-features"="+fxsr,+mmx,+sse,+sse2" "unsafe-fp-math"="false" "use-soft-float"="false" }

llvm/test/CodeGen/X86/catchret-regmask.ll

 ; RUN: llc < %s | FileCheck %s
 
 target datalayout = "e-m:w-i64:64-f80:128-n8:16:32:64-S128"
 target triple = "x86_64-pc-windows-msvc"
 
 declare i32 @__CxxFrameHandler3(...)
 declare void @throw() noreturn uwtable
 declare i8* @getval()
+declare void @llvm.trap()
 
 define i8* @reload_out_of_pad(i8* %arg) #0 personality i32 (...)* @__CxxFrameHandler3 {
 assertPassed:
   invoke void @throw()
           to label %unreachable unwind label %catch.dispatch
 
 catch:
   %cp = catchpad within %cs [i8* null, i32 0, i8* null]
   catchret from %cp to label %return
 
   ; This block *must* appear after the catchret to test the bug.
   ; FIXME: Make this an MIR test so we can control MBB layout.
 unreachable:
+  call void @llvm.trap()
   unreachable
 
 catch.dispatch:
   %cs = catchswitch within none [label %catch] unwind to caller
 
 return:
   ret i8* %arg
 }
 
 ; CHECK-LABEL: reload_out_of_pad: # @reload_out_of_pad
 ; CHECK: movq %rcx, -[[arg_slot:[0-9]+]](%rbp) # 8-byte Spill
 ; CHECK: callq throw
 ; CHECK: ud2
 ; CHECK: movq -[[arg_slot]](%rbp), %rax # 8-byte Reload
 ; CHECK: retq
 
-; CHECK: "?catch$3@?0?reload_out_of_pad@4HA":
+; CHECK: "?catch${{[0-9]+}}@?0?reload_out_of_pad@4HA":
 ; CHECK-NOT: Reload
 ; CHECK: retq
 
 define i8* @spill_in_pad() #0 personality i32 (...)* @__CxxFrameHandler3 {
 assertPassed:
   invoke void @throw()
           to label %unreachable unwind label %catch.dispatch
 
 catch:
   %cp = catchpad within %cs [i8* null, i32 0, i8* null]
   %val = call i8* @getval() [ "funclet"(token %cp) ]
   catchret from %cp to label %return
 
 unreachable:
+  call void @llvm.trap()
   unreachable
 
 catch.dispatch:
   %cs = catchswitch within none [label %catch] unwind to caller
 
 return:
   ret i8* %val
 }
 
 ; CHECK-LABEL: spill_in_pad: # @spill_in_pad
 ; CHECK: callq throw
 ; CHECK: ud2
 ; CHECK: movq -[[val_slot:[0-9]+]](%rbp), %rax # 8-byte Reload
 ; CHECK: retq
 
-; CHECK: "?catch$3@?0?spill_in_pad@4HA":
+; CHECK: "?catch${{[0-9]+}}@?0?spill_in_pad@4HA":
 ; CHECK: callq getval
 ; CHECK: movq %rax, -[[val_slot]](%rbp) # 8-byte Spill
 ; CHECK: retq
 
 attributes #0 = { uwtable }

llvm/test/CodeGen/X86/empty-function.ll

 ; the kernel refuses to load.
 
 define void @f() {
 entry:
   unreachable
 
 ; CHECK-LABEL: f:
 ; WIN32: nop
-; WIN64: ud2
+; WIN64: nop
 ; LINUX-NOT: nop
 ; LINUX-NOT: ud2
 
 }

llvm/test/CodeGen/X86/funclet-layout.ll

 ; RUN: llc -mtriple=x86_64-windows-msvc < %s | FileCheck %s
 
 target datalayout = "e-m:w-i64:64-f80:128-n8:16:32:64-S128"
 target triple = "x86_64-pc-windows-msvc"
 
 %eh.ThrowInfo = type { i32, i32, i32, i32 }
 %rtti.TypeDescriptor2 = type { i8**, i8*, [3 x i8] }
 
 @"\01??_7type_info@@6B@" = external constant i8*
 @"\01??_R0H@8" = internal global %rtti.TypeDescriptor2 { i8** @"\01??_7type_info@@6B@", i8* null, [3 x i8] c".H\00" }
 
+declare void @llvm.trap()
+
 define void @test1(i1 %B) personality i32 (...)* @__CxxFrameHandler3 {
 entry:
   invoke void @g()
           to label %unreachable unwind label %catch.dispatch
 
 catch.dispatch:
   %cs1 = catchswitch within none [label %catch] unwind to caller
 
 catch:
   %cp = catchpad within %cs1 [i8* null, i32 64, i8* null]
   br label %catch.loop
 
 catch.loop:
   br i1 %B, label %catchret, label %catch.loop
 
 catchret:
   catchret from %cp to label %try.cont
 
 try.cont:
   ret void
 
 unreachable:
+  call void @llvm.trap()
   unreachable
 }
 
 ; CHECK-LABEL: test1:
 
 ; The entry funclet contains %entry and %try.cont
 ; CHECK: # %entry
 ; CHECK: # %try.cont

 
 try.cont:                                         ; preds = %catch.3
   catchret from %0 to label %try.cont.5
 
 try.cont.5:                                       ; preds = %try.cont
   ret i32 0
 
 unreachable:                                      ; preds = %catch, %entry
+  call void @llvm.trap()
   unreachable
 }
 
 ; CHECK-LABEL: test2:
 
 ; The parent function contains %entry and %try.cont.5
 ; CHECK: .seh_proc
 ; CHECK: # %entry
catch:                                            ; preds = %catch.dispatch.1
   %1 = catchpad within %cs2 [i8* null, i32 64, i8* null]
   tail call void @exit(i32 0) #2 [ "funclet"(token %1) ]
   unreachable
 
 try.cont:                                         ; preds = %entry
   br i1 %V, label %exit_one, label %exit_two
 
 exit_one:
-  tail call void @exit(i32 0)
+  tail call void @g()
+  call void @llvm.trap()
   unreachable
 
 exit_two:
-  tail call void @exit(i32 0)
+  tail call void @g()
+  call void @llvm.trap()
   unreachable
 }
 
 ; CHECK-LABEL: test3:
 
 ; The entry funclet contains %entry and %try.cont
 ; CHECK: # %entry
 ; CHECK: # %try.cont
-; CHECK: callq exit
+; CHECK: callq g
 ; CHECK-NOT: # exit_one
 ; CHECK-NOT: # exit_two
 ; CHECK: ud2
 
 ; The catch(...) funclet contains %catch.2
 ; CHECK: # %catch.2{{$}}
 ; CHECK: callq exit
-; CHECK: ud2
+; CHECK-NEXT: int3
 
 ; The catch(int) funclet contains %catch
 ; CHECK: # %catch{{$}}
 ; CHECK: callq exit
-; CHECK: ud2
+; CHECK-NEXT: int3
 
 declare void @exit(i32) noreturn nounwind
 declare void @_CxxThrowException(i8*, %eh.ThrowInfo*)
 declare i32 @__CxxFrameHandler3(...)

llvm/test/CodeGen/X86/noreturn-call-win64.ll

+; RUN: llc < %s -mtriple=x86_64-windows-msvc | FileCheck %s
+
+; Function Attrs: noinline nounwind optnone uwtable
+define dso_local i32 @foo() {
+entry:
+  %call = call i32 @cond()
+  %tobool = icmp ne i32 %call, 0
+  br i1 %tobool, label %if.then, label %if.end
+
+if.then:                                          ; preds = %entry
+  call void @abort1()
+  unreachable
+
+if.end:                                           ; preds = %entry
+  %call1 = call i32 @cond()
+  %tobool2 = icmp ne i32 %call1, 0
+  br i1 %tobool2, label %if.then3, label %if.end4
+
+if.then3:                                         ; preds = %if.end
+  call void @abort2()
+  unreachable
+
+if.end4:                                          ; preds = %if.end
+  %call5 = call i32 @cond()
+  %tobool6 = icmp ne i32 %call5, 0
+  br i1 %tobool6, label %if.then7, label %if.end8
+
+if.then7:                                         ; preds = %if.end4
+  call void @abort3()
+  unreachable
+
+if.end8:                                          ; preds = %if.end4
+  ret i32 0
+}
+
+; CHECK-LABEL: foo:
+; CHECK: callq cond
+; CHECK: callq cond
+; CHECK: callq cond
+;   We don't need int3's between these calls to abort, since they won't confuse
+;   the unwinder.
+; CHECK: callq abort1
+; CHECK-NEXT:   # %if.then3
+; CHECK: callq abort2
+; CHECK-NEXT:   # %if.then7
+; CHECK: callq abort3
+; CHECK-NEXT: int3
+
+declare dso_local i32 @cond()
+
+declare dso_local void @abort1() noreturn
+declare dso_local void @abort2() noreturn
+declare dso_local void @abort3() noreturn

llvm/test/CodeGen/X86/pr24374.ll

 ; CHECK:       callq g
 ; CHECK:               .seh_handlerdata
 ; CHECK:               .seh_endproc
 
 define void @g() {
   unreachable
 }
 ; CHECK-LABEL: g:
-; CHECK: ud2
+; CHECK: nop
 
 attributes #0 = { nounwind }

llvm/test/CodeGen/X86/trap.ll

 ; RUN: llc < %s -mtriple=i686-apple-darwin8 -mcpu=yonah | FileCheck %s -check-prefix=DARWIN
 ; RUN: llc < %s -mtriple=i686-unknown-linux -mcpu=yonah | FileCheck %s -check-prefix=LINUX
 ; RUN: llc < %s -mtriple=x86_64-scei-ps4 | FileCheck %s -check-prefix=PS4
+; RUN: llc < %s -mtriple=x86_64-windows-msvc | FileCheck %s -check-prefix=WIN64
 
 ; DARWIN-LABEL: test0:
 ; DARWIN: ud2
 ; LINUX-LABEL: test0:
 ; LINUX: ud2
+; FIXME: PS4 probably doesn't want two ud2s.
 ; PS4-LABEL: test0:
 ; PS4: ud2
+; PS4: ud2
+; WIN64-LABEL: test0:
+; WIN64: ud2
+; WIN64-NOT: ud2
 define i32 @test0() noreturn nounwind  {
 entry:
   tail call void @llvm.trap( )
   unreachable
 }
 
 ; DARWIN-LABEL: test1:
 ; DARWIN: int3
 ; LINUX-LABEL: test1:
 ; LINUX: int3
 ; PS4-LABEL: test1:
 ; PS4: int     $65
+; WIN64-LABEL: test1:
+; WIN64: int3
+; WIN64-NOT: ud2
 define i32 @test1() noreturn nounwind  {
 entry:
   tail call void @llvm.debugtrap( )
   unreachable
 }
 
 declare void @llvm.trap() nounwind 
 declare void @llvm.debugtrap() nounwind 
 

llvm/test/CodeGen/X86/unreachable-trap.ll

-; RUN: llc -o - %s -mtriple=x86_64-windows-msvc | FileCheck %s --check-prefixes=CHECK,TRAP_AFTER_NORETURN
+; RUN: llc -o - %s -mtriple=x86_64-linux-gnu | FileCheck %s --check-prefixes=CHECK,NORMAL
+; RUN: llc -o - %s -mtriple=x86_64-windows-msvc | FileCheck %s --check-prefixes=CHECK,NORMAL
+; RUN: llc -o - %s -mtriple=x86_64-scei-ps4 | FileCheck %s --check-prefixes=CHECK,TRAP_AFTER_NORETURN
 ; RUN: llc -o - %s -mtriple=x86_64-apple-darwin | FileCheck %s --check-prefixes=CHECK,NO_TRAP_AFTER_NORETURN
 
 ; CHECK-LABEL: call_exit:
 ; CHECK: callq {{_?}}exit
 ; TRAP_AFTER_NORETURN: ud2
 ; NO_TRAP_AFTER_NORETURN-NOT: ud2
+; NORMAL-NOT: ud2
 define i32 @call_exit() noreturn nounwind {
   tail call void @exit(i32 0)
   unreachable
 }
 
 ; CHECK-LABEL: trap:
 ; CHECK: ud2
 ; TRAP_AFTER_NORETURN: ud2
 ; NO_TRAP_AFTER_NORETURN-NOT: ud2
+; NORMAL-NOT: ud2
 define i32 @trap() noreturn nounwind {
   tail call void @llvm.trap()
   unreachable
 }
 
 ; CHECK-LABEL: unreachable:
-; CHECK: ud2
+; TRAP_AFTER_NORETURN: ud2
+; NO_TRAP_AFTER_NORETURN: ud2
+; NORMAL-NOT: ud2
+; NORMAL: # -- End function
 define i32 @unreachable() noreturn nounwind {
   unreachable
 }
 
 declare void @llvm.trap() nounwind noreturn
 declare void @exit(i32 %rc) nounwind noreturn

llvm/test/CodeGen/X86/win64-eh-empty-block.ll

+; RUN: llc -mtriple=x86_64-windows-gnu %s -o - | FileCheck %s
+
+; Based on this C++ code:
+; struct as {
+;     as() { at = static_cast<int *>(operator new(sizeof(int))); }
+;     ~as() { operator delete(at); }
+;     int *at;
+; };
+; void am(int) {
+;     static as au;
+;     as av;
+;     throw 0;
+; }
+
+; optnone was added to ensure that branch folding and block layout are not
+; disturbed. The key thing about this test is that it ends in an empty
+; unreachable block, which forces us to scan back across blocks.
+
+; CHECK: _Z2ami:
+; CHECK: callq   __cxa_throw
+; CHECK: # %eh.resume
+; CHECK: callq _Unwind_Resume
+; CHECK-NEXT: int3
+; CHECK-NEXT: # %unreachable
+; CHECK-NEXT: .Lfunc_end0:
+
+%struct.as = type { i32* }
+
+@_ZZ2amiE2au = internal unnamed_addr global %struct.as zeroinitializer, align 8
+@_ZGVZ2amiE2au = internal global i64 0, align 8
+@_ZTIi = external constant i8*
+
+define dso_local void @_Z2ami(i32 %0) noinline optnone personality i8* bitcast (i32 (...)* @__gxx_personality_seh0 to i8*) {
+entry:
+  %1 = load atomic i8, i8* bitcast (i64* @_ZGVZ2amiE2au to i8*) acquire, align 8
+  %guard.uninitialized = icmp eq i8 %1, 0
+  br i1 %guard.uninitialized, label %init.check, label %init.end
+
+init.check:                                       ; preds = %entry
+  %2 = tail call i32 @__cxa_guard_acquire(i64* nonnull @_ZGVZ2amiE2au)
+  %tobool = icmp eq i32 %2, 0
+  br i1 %tobool, label %init.end, label %init
+
+init:                                             ; preds = %init.check
+  %call.i3 = invoke i8* @_Znwy(i64 4)
+          to label %invoke.cont unwind label %lpad
+
+invoke.cont:                                      ; preds = %init
+  store i8* %call.i3, i8** bitcast (%struct.as* @_ZZ2amiE2au to i8**), align 8
+  %3 = tail call i32 @atexit(void ()* nonnull @__dtor__ZZ2amiE2au)
+  tail call void @__cxa_guard_release(i64* nonnull @_ZGVZ2amiE2au)
+  br label %init.end
+
+init.end:                                         ; preds = %init.check, %invoke.cont, %entry
+  %call.i = tail call i8* @_Znwy(i64 4)
+  %exception = tail call i8* @__cxa_allocate_exception(i64 4)
+  %4 = bitcast i8* %exception to i32*
+  store i32 0, i32* %4, align 16
+  invoke void @__cxa_throw(i8* %exception, i8* bitcast (i8** @_ZTIi to i8*), i8* null)
+          to label %unreachable unwind label %lpad1
+
+lpad:                                             ; preds = %init
+  %5 = landingpad { i8*, i32 }
+          cleanup
+  %6 = extractvalue { i8*, i32 } %5, 0
+  %7 = extractvalue { i8*, i32 } %5, 1
+  tail call void @__cxa_guard_abort(i64* nonnull @_ZGVZ2amiE2au)
+  br label %eh.resume
+
+lpad1:                                            ; preds = %init.end
+  %8 = landingpad { i8*, i32 }
+          cleanup
+  %9 = extractvalue { i8*, i32 } %8, 0
+  %10 = extractvalue { i8*, i32 } %8, 1
+  tail call void @_ZdlPv(i8* %call.i)
+  br label %eh.resume
+
+eh.resume:                                        ; preds = %lpad1, %lpad
+  %exn.slot.0 = phi i8* [ %9, %lpad1 ], [ %6, %lpad ]
+  %ehselector.slot.0 = phi i32 [ %10, %lpad1 ], [ %7, %lpad ]
+  %lpad.val = insertvalue { i8*, i32 } undef, i8* %exn.slot.0, 0
+  %lpad.val2 = insertvalue { i8*, i32 } %lpad.val, i32 %ehselector.slot.0, 1
+  resume { i8*, i32 } %lpad.val2
+
+unreachable:                                      ; preds = %init.end
+  unreachable
+}
+
+declare dso_local i32 @__cxa_guard_acquire(i64*)
+
+declare dso_local i32 @__gxx_personality_seh0(...)
+
+declare dso_local void @__dtor__ZZ2amiE2au()
+
+declare dso_local i32 @atexit(void ()*)
+
+declare dso_local void @__cxa_guard_abort(i64*)
+
+declare dso_local void @__cxa_guard_release(i64*)
+
+declare dso_local i8* @__cxa_allocate_exception(i64)
+
+declare dso_local void @__cxa_throw(i8*, i8*, i8*)
+
+declare dso_local noalias i8* @_Znwy(i64)
+
+declare dso_local void @_ZdlPv(i8*)

llvm/test/CodeGen/X86/win64_call_epi.ll

catch:
     resume { i8*, i32 } %1
 }
 ; WIN64-LABEL: foo1:
 ; WIN64: .seh_proc foo1
 ; WIN64: callq bar
 ; WIN64: nop
 ; WIN64: addq ${{[0-9]+}}, %rsp
 ; WIN64: retq
-; Check for 'ud2' after noreturn call
+; Check for 'int3' after noreturn call.
 ; WIN64: callq _Unwind_Resume
-; WIN64-NEXT: ud2
-; WIN64: .seh_endproc
+; WIN64-NEXT: int3
 
 
 ; Check it still works when blocks are reordered.
 @something = global i32 0
 define void @foo2(i1 zeroext %cond ) {
     br i1 %cond, label %a, label %b, !prof !0
 a:
     call void @bar()

llvm/test/CodeGen/X86/win64_eh.ll

 
 endtryfinally:
   %tmp10 = load i32, i32* %step
   ret i32 %tmp10
 }
 ; WIN64-LABEL: foo4:
 ; WIN64: .seh_proc foo4
 ; WIN64: .seh_handler _d_eh_personality, @unwind, @except
-; NORM:  subq $56, %rsp
-; ATOM:  leaq -56(%rsp), %rsp
-; WIN64: .seh_stackalloc 56
+; NORM:  subq $40, %rsp
+; ATOM:  leaq -40(%rsp), %rsp
+; WIN64: .seh_stackalloc 40
 ; WIN64: .seh_endprologue
-; WIN64: addq $56, %rsp
+; WIN64: addq $40, %rsp
 ; WIN64: ret
 ; WIN64: .seh_handlerdata
 ; WIN64: .seh_endproc
 
 
 ; Check stack re-alignment and xmm spilling
 define void @foo5() uwtable {
 entry:

llvm/test/CodeGen/X86/wineh-coreclr.ll

 ; CHECK-NEXT: [[test2_after_f1:.+]]:
 ; CHECK: .seh_proc [[test2_catch1:[^ ]+]]
 ; CHECK: .seh_proc [[test2_catch2:[^ ]+]]
 ; CHECK: .seh_proc [[test2_fault:[^ ]+]]
 ; CHECK: .seh_endprologue
 ; CHECK: [[test2_before_f2:.+]]:
 ; CHECK-NEXT: movl $2, %ecx
 ; CHECK-NEXT: callq f
+; CHECK-NEXT: int3
 ; CHECK-NEXT: [[test2_after_f2:.+]]:
 ; CHECK: [[test2_end:.*func_end.*]]:
 
 
 ; Now check for EH table in xdata (following standard xdata)
 ; CHECK-LABEL: .section .xdata
 ; standard xdata comes here
 ; CHECK:      .long 3{{$}}

 unreachable:
   unreachable
 ; CHECK: .seh_proc [[test3_fault3:[^ ]+]]
 ; CHECK: # %fault3
 ; CHECK: .seh_endprologue
 ; CHECK: [[test3_before_f4:.+]]:
 ; CHECK-NEXT: movl $4, %ecx
 ; CHECK-NEXT: callq f
+; CHECK-NEXT: int3
 ; CHECK-NEXT: [[test3_after_f4:.+]]:
 ; CHECK: .seh_proc [[test3_fault2:[^ ]+]]
 ; CHECK: # %fault2
 ; CHECK: .seh_endprologue
 ; CHECK: [[test3_before_f3:.+]]:
 ; CHECK-NEXT: movl $3, %ecx
 ; CHECK-NEXT: callq f
+; CHECK-NEXT: int3
 ; CHECK-NEXT: [[test3_after_f3:.+]]:
 ; CHECK: .seh_proc [[test3_fault1:[^ ]+]]
 ; CHECK: # %fault1
 ; CHECK: .seh_endprologue
 ; CHECK: [[test3_before_f2:.+]]:
 ; CHECK-NEXT: movl $2, %ecx
 ; CHECK-NEXT: callq f
+; CHECK-NEXT: int3
 ; CHECK-NEXT: [[test3_after_f2:.+]]:
 ; CHECK: [[test3_end:.*func_end.*]]:
 }
 
 ; Now check for EH table in xdata (following standard xdata)
 ; CHECK-LABEL: .section .xdata
 ; standard xdata comes here
 ; CHECK:      .long 7{{$}}

llvm/test/DebugInfo/COFF/local-variable-gap.ll

 ; ASM:         xorl    %eax, %eax
 ; ASM:         addq    $32, %rsp
 ; ASM:         popq    %rsi
 ; ASM:         retq
 ; ASM: .LBB0_5:                                # %if.then4
 ; ASM: [[p_b2:\.Ltmp[0-9]+]]:
 ; ASM:         #DEBUG_VALUE: p <- $esi
 ; ASM:         callq   call_noreturn
-; ASM:         ud2
+; ASM:         int3
 ; ASM: .Lfunc_end0:
 
 ; ASM:         .short  {{.*}}         # Record length
 ; ASM:         .short  4414                    # Record kind: S_LOCAL
 ; ASM:         .long   116                     # TypeIndex
 ; ASM:         .short  0                       # Flags
 ; ASM:         .asciz  "p"
 ; ASM:         .cv_def_range    [[p_b1]] [[p_e1]] [[p_b2]] .Lfunc_end0, reg, 23