Don't allow mangling substitutions to refer to unrelated entities from different <encoding>s.

[rsmith]

Summary

Per the ABI rules, substitutable components are symbolic constructs, not
the associated mangling character strings, so references to function
parameters or template parameters of distinct <encoding>s should not be
considered substitutable even if they're at the same depth / index.

See https://github.com/itanium-cxx-abi/cxx-abi/issues/106.

This change can be turned off by setting -fclang-abi-compat to 10 or
earlier.

[rsmith]

Hm, I think this is not quite right. For example, given:

template<typename T, typename U> struct X {};
template<typename T> auto f(T a, decltype(a)) {
  struct A {};
  struct B {};
  return X<A, B>();
}
void g(decltype(f(0, 0))) {}

... I think we won't use a substitution from the first parameter of f<int> in the second <local-name> back to the first parameter of f<int> in the first <local-name>.

clang/include/clang/Basic/LangOptions.h

enum class ClangABI {
     Ver7,
 
     /// Attempt to be ABI-compatible with code generated by Clang 9.0.x
     /// (SVN r351319). This causes vectors of __int128 to be passed in memory
     /// instead of passing in multiple scalar registers on x86_64 on Linux and
     /// NetBSD.
     Ver9,
 
+    /// Attempt to be ABI-compatible with code generated by Clang 10.0.x.
+    /// This allows mangling substitutions to be used if they refer to function
+    /// or template parameters at the same depth and index, even if they refer
+    /// to parameters of unrelated functions.
+    Ver10,
+
     /// Conform to the underlying platform's C and C++ ABIs as closely
     /// as we can.
     Latest
   };
 
   enum class CoreFoundationABI {
     /// No interoperability ABI has been specified
     Unspecified,

clang/lib/AST/ItaniumMangle.cpp

void writeSortedUniqueAbiTags(raw_ostream &Out, const AbiTagList &AbiTags) {
         Out << Tag;
       }
     }
   };
 
   AbiTagState *AbiTags = nullptr;
   AbiTagState AbiTagsRoot;
 
-  llvm::DenseMap<uintptr_t, unsigned> Substitutions;
+  struct Substitution {
+    unsigned SeqID;
+    unsigned EncodingScope;
+  };
+  llvm::DenseMap<uintptr_t, Substitution> Substitutions;
   llvm::DenseMap<StringRef, unsigned> ModuleSubstitutions;
 
   ASTContext &getASTContext() const { return Context.getASTContext(); }
 
 public:
   CXXNameMangler(ItaniumMangleContextImpl &C, raw_ostream &Out_,
                  const NamedDecl *D = nullptr, bool NullOut_ = false)
     : Context(C), Out(Out_), NullOut(NullOut_),  Structor(getStructor(D)),
CXXNameMangler(ItaniumMangleContextImpl &C, raw_ostream &Out_,
                  const CXXDestructorDecl *D, CXXDtorType Type)
     : Context(C), Out(Out_), Structor(getStructor(D)), StructorType(Type),
       SeqID(0), AbiTagsRoot(AbiTags) { }
 
   CXXNameMangler(CXXNameMangler &Outer, raw_ostream &Out_)
       : Context(Outer.Context), Out(Out_), NullOut(false),
         Structor(Outer.Structor), StructorType(Outer.StructorType),
         SeqID(Outer.SeqID), FunctionTypeDepth(Outer.FunctionTypeDepth),
-        AbiTagsRoot(AbiTags), Substitutions(Outer.Substitutions) {}
+        AbiTagsRoot(AbiTags), Substitutions(Outer.Substitutions),
+        ModuleSubstitutions(Outer.ModuleSubstitutions),
+        InnermostScope(Outer.InnermostScope),
+        EncodingScopes(Outer.EncodingScopes) {}
 
   CXXNameMangler(CXXNameMangler &Outer, llvm::raw_null_ostream &Out_)
       : Context(Outer.Context), Out(Out_), NullOut(true),
         Structor(Outer.Structor), StructorType(Outer.StructorType),
         SeqID(Outer.SeqID), FunctionTypeDepth(Outer.FunctionTypeDepth),
-        AbiTagsRoot(AbiTags), Substitutions(Outer.Substitutions) {}
+        AbiTagsRoot(AbiTags), Substitutions(Outer.Substitutions),
+        ModuleSubstitutions(Outer.ModuleSubstitutions),
+        InnermostScope(Outer.InnermostScope),
+        EncodingScopes(Outer.EncodingScopes) {}
 
   raw_ostream &getStream() { return Out; }
 
   void disableDerivedAbiTags() { DisableDerivedAbiTags = true; }
   static bool shouldHaveAbiTags(ItaniumMangleContextImpl &C, const VarDecl *VD);
 
   void mangle(GlobalDecl GD);
   void mangleCallOffset(int64_t NonVirtual, int64_t Virtual);
   void mangleNumber(const llvm::APSInt &I);
   void mangleNumber(int64_t Number);
   void mangleFloat(const llvm::APFloat &F);
   void mangleFunctionEncoding(GlobalDecl GD);
   void mangleSeqID(unsigned SeqID);
   void mangleName(GlobalDecl GD);
   void mangleType(QualType T);
   void mangleNameOrStandardSubstitution(const NamedDecl *ND);
   void mangleLambdaSig(const CXXRecordDecl *Lambda);
 
 private:
+  /// An interesting region within the mangling process.
+  struct ManglingScope {
+    CXXNameMangler &M;
+    ManglingScope *Parent;
+    enum Kind { Substitution, Encoding } K;
+
+    ManglingScope(CXXNameMangler &M, Kind K)
+        : M(M), Parent(M.InnermostScope), K(K) {
+      M.InnermostScope = this;
+    }
+    ManglingScope(const ManglingScope&) = delete;
+    void operator=(const ManglingScope&) = delete;
+    ~ManglingScope() {
+      M.InnermostScope = Parent;
+    }
+
+    template<typename T> T *getAs() {
+      return K == T::StaticKind ? static_cast<T*>(this) : nullptr;
+    }
+  };
+  ManglingScope *InnermostScope = nullptr;
+
+  /// Indicates a mangling region that might be converted into a substitution.
+  /// This object tracks properties of the substituted component that aren't
+  /// captured in its pointer value.
+  struct SubstitutionScope : ManglingScope {
+    static constexpr Kind StaticKind = Substitution;
+
+    // The innermost encoding scope that this substitution references.
+    unsigned InnermostEncodingScope = 0;
+
+    SubstitutionScope(CXXNameMangler &M) : ManglingScope(M, StaticKind) {}
+  };
+
+  /// The number of local encoding scopes mangled so far, used to assign unique
+  /// IDs to scopes. The ID of a scope is always less than that of any inner
+  /// scopes.
+  unsigned EncodingScopes = 0;
+
+  /// Indicates a mangling region corresponding to a nested <encoding>.
+  struct EncodingScope : ManglingScope {
+    static constexpr Kind StaticKind = Encoding;
+
+    unsigned ScopeID;
+
+    EncodingScope(CXXNameMangler &M)
+        : ManglingScope(M, StaticKind), ScopeID(++M.EncodingScopes) {}
+  };
+
+  bool inEncodingScope(unsigned I) const {
+    for (ManglingScope *S = InnermostScope; S; S = S->Parent) {
+      if (EncodingScope *ES = S->getAs<EncodingScope>()) {
+        if (ES->ScopeID == I) return true;
+        if (ES->ScopeID < I) return false;
+      }
+    }
+    return false;
+  }
+
+  /// Note that we made reference to part of the enclosing <encoding>. In
+  /// particular, this means that any substitutions within that <encoding>
+  /// cannot be used from outside it.
+  void noteReferenceToEncoding() {
+    unsigned InnermostEncodingScope = 0;
+    for (ManglingScope *S = InnermostScope; S; S = S->Parent) {
+      if (EncodingScope *ES = S->getAs<EncodingScope>()) {
+        InnermostEncodingScope = ES->ScopeID;
+        break;
+      }
+    }
+    for (ManglingScope *S = InnermostScope; S; S = S->Parent) {
+      if (S->getAs<EncodingScope>())
+        break;
+      if (SubstitutionScope *SS = S->getAs<SubstitutionScope>())
+        SS->InnermostEncodingScope =
+            std::max(SS->InnermostEncodingScope, InnermostEncodingScope);
+    }
+  }
 
   bool mangleSubstitution(const NamedDecl *ND);
   bool mangleSubstitution(QualType T);
   bool mangleSubstitution(TemplateName Template);
   bool mangleSubstitution(uintptr_t Ptr);
 
   void mangleExistingSubstitution(TemplateName name);
 
   bool mangleStandardSubstitution(const NamedDecl *ND);
 
-  void addSubstitution(const NamedDecl *ND) {
+  void addSubstitution(const SubstitutionScope &S, const NamedDecl *ND) {
     ND = cast<NamedDecl>(ND->getCanonicalDecl());
 
-    addSubstitution(reinterpret_cast<uintptr_t>(ND));
+    addSubstitution(S, reinterpret_cast<uintptr_t>(ND));
   }
-  void addSubstitution(QualType T);
-  void addSubstitution(TemplateName Template);
-  void addSubstitution(uintptr_t Ptr);
+  void addSubstitution(const SubstitutionScope &S, QualType T);
+  void addSubstitution(const SubstitutionScope &S, TemplateName Template);
+  void addSubstitution(const SubstitutionScope &S, uintptr_t Ptr);
   // Destructive copy substitutions from other mangler.
-  void extendSubstitutions(CXXNameMangler* Other);
+  void extendSubstitutions(CXXNameMangler *Other);
 
   void mangleUnresolvedPrefix(NestedNameSpecifier *qualifier,
                               bool recursive = false);
   void mangleUnresolvedName(NestedNameSpecifier *qualifier,
                             DeclarationName name,
                             const TemplateArgumentLoc *TemplateArgs,
                             unsigned NumTemplateArgs,
                             unsigned KnownArity = UnknownArity);
else if (const FieldDecl *FD = dyn_cast<FieldDecl>(GD.getDecl()))
     mangleName(FD);
   else if (const MSGuidDecl *GuidD = dyn_cast<MSGuidDecl>(GD.getDecl()))
     mangleName(GuidD);
   else
     llvm_unreachable("unexpected kind of global decl");
 }
 
 void CXXNameMangler::mangleFunctionEncoding(GlobalDecl GD) {
+  // Track that we're in this encoding scope.
+  EncodingScope Scope(*this);
+
   const FunctionDecl *FD = cast<FunctionDecl>(GD.getDecl());
   // <encoding> ::= <function name> <bare-function-type>
 
   // Don't mangle in the type if this isn't a decl we should typically mangle.
   if (!Context.shouldMangleDeclName(FD)) {
     mangleName(GD);
     return;
   }

 
 void CXXNameMangler::mangleUnscopedTemplateName(
     GlobalDecl GD, const AbiTagList *AdditionalAbiTags) {
   const TemplateDecl *ND = cast<TemplateDecl>(GD.getDecl());
   //     <unscoped-template-name> ::= <unscoped-name>
   //                              ::= <substitution>
   if (mangleSubstitution(ND))
     return;
+  SubstitutionScope Subst(*this);
 
   // <template-template-param> ::= <template-param>
   if (const auto *TTP = dyn_cast<TemplateTemplateParmDecl>(ND)) {
     assert(!AdditionalAbiTags &&
            "template template param cannot have abi tags");
     mangleTemplateParameter(TTP->getDepth(), TTP->getIndex());
   } else if (isa<BuiltinTemplateDecl>(ND) || isa<ConceptDecl>(ND)) {
     mangleUnscopedName(GD, AdditionalAbiTags);
   } else {
     mangleUnscopedName(GD.getWithDecl(ND->getTemplatedDecl()), AdditionalAbiTags);
   }
 
-  addSubstitution(ND);
+  addSubstitution(Subst, ND);
 }
 
 void CXXNameMangler::mangleUnscopedTemplateName(
     TemplateName Template, const AbiTagList *AdditionalAbiTags) {
   //     <unscoped-template-name> ::= <unscoped-name>
   //                              ::= <substitution>
   if (TemplateDecl *TD = Template.getAsTemplateDecl())
     return mangleUnscopedTemplateName(TD, AdditionalAbiTags);
 
   if (mangleSubstitution(Template))
     return;
+  SubstitutionScope Subst(*this);
 
   assert(!AdditionalAbiTags &&
          "dependent template name cannot have abi tags");
 
   DependentTemplateName *Dependent = Template.getAsDependentTemplateName();
   assert(Dependent && "Not a dependent template name?");
   if (const IdentifierInfo *Id = Dependent->getIdentifier())
     mangleSourceName(Id);
   else
     mangleOperatorName(Dependent->getOperator(), UnknownArity);
 
-  addSubstitution(Template);
+  addSubstitution(Subst, Template);
 }
 
 void CXXNameMangler::mangleFloat(const llvm::APFloat &f) {
   // ABI:
   //   Floating-point literals are encoded using a fixed-length
   //   lowercase hexadecimal string corresponding to the internal
   //   representation (IEEE on Itanium), high-order bytes first,
   //   without leading zeroes. For example: "Lf bf800000 E" is -1.0f
void CXXNameMangler::mangleCallOffset(int64_t NonVirtual, int64_t Virtual) {
   Out << '_';
   mangleNumber(Virtual);
   Out << '_';
 }
 
 void CXXNameMangler::manglePrefix(QualType type) {
   if (const auto *TST = type->getAs<TemplateSpecializationType>()) {
     if (!mangleSubstitution(QualType(TST, 0))) {
+      SubstitutionScope Subst(*this);
       mangleTemplatePrefix(TST->getTemplateName());
 
       // FIXME: GCC does not appear to mangle the template arguments when
       // the template in question is a dependent template name. Should we
       // emulate that badness?
       mangleTemplateArgs(TST->getArgs(), TST->getNumArgs());
-      addSubstitution(QualType(TST, 0));
+      addSubstitution(Subst, QualType(TST, 0));
     }
   } else if (const auto *DTST =
                  type->getAs<DependentTemplateSpecializationType>()) {
     if (!mangleSubstitution(QualType(DTST, 0))) {
+      SubstitutionScope Subst(*this);
       TemplateName Template = getASTContext().getDependentTemplateName(
           DTST->getQualifier(), DTST->getIdentifier());
       mangleTemplatePrefix(Template);
 
       // FIXME: GCC does not appear to mangle the template arguments when
       // the template in question is a dependent template name. Should we
       // emulate that badness?
       mangleTemplateArgs(DTST->getArgs(), DTST->getNumArgs());
-      addSubstitution(QualType(DTST, 0));
+      addSubstitution(Subst, QualType(DTST, 0));
     }
   } else {
     // We use the QualType mangle type variant here because it handles
     // substitutions.
     mangleType(type);
   }
 }
 
void CXXNameMangler::manglePrefix(const DeclContext *DC, bool NoFunction) {
   if (NoFunction && isLocalContainerContext(DC))
     return;
 
   assert(!isLocalContainerContext(DC));
 
   const NamedDecl *ND = cast<NamedDecl>(DC);
   if (mangleSubstitution(ND))
     return;
+  SubstitutionScope Subst(*this);
 
   // Check if we have a template.
   const TemplateArgumentList *TemplateArgs = nullptr;
   if (GlobalDecl TD = isTemplate(ND, TemplateArgs)) {
     mangleTemplatePrefix(TD);
     mangleTemplateArgs(*TemplateArgs);
   } else {
     manglePrefix(getEffectiveDeclContext(ND), NoFunction);
     mangleUnqualifiedName(ND, nullptr);
   }
 
-  addSubstitution(ND);
+  addSubstitution(Subst, ND);
 }
 
 void CXXNameMangler::mangleTemplatePrefix(TemplateName Template) {
   // <template-prefix> ::= <prefix> <template unqualified-name>
   //                   ::= <template-param>
   //                   ::= <substitution>
   if (TemplateDecl *TD = Template.getAsTemplateDecl())
     return mangleTemplatePrefix(TD);
void CXXNameMangler::mangleTemplatePrefix(GlobalDecl GD,
   // <template-prefix> ::= <prefix> <template unqualified-name>
   //                   ::= <template-param>
   //                   ::= <substitution>
   // <template-template-param> ::= <template-param>
   //                               <substitution>
 
   if (mangleSubstitution(ND))
     return;
+  SubstitutionScope Subst(*this);
 
   // <template-template-param> ::= <template-param>
   if (const auto *TTP = dyn_cast<TemplateTemplateParmDecl>(ND)) {
     mangleTemplateParameter(TTP->getDepth(), TTP->getIndex());
   } else {
     manglePrefix(getEffectiveDeclContext(ND), NoFunction);
     if (isa<BuiltinTemplateDecl>(ND) || isa<ConceptDecl>(ND))
       mangleUnqualifiedName(GD, nullptr);
     else
       mangleUnqualifiedName(GD.getWithDecl(ND->getTemplatedDecl()), nullptr);
   }
 
-  addSubstitution(ND);
+  addSubstitution(Subst, ND);
 }
 
 /// Mangles a template name under the production <type>.  Required for
 /// template template arguments.
 ///   <type> ::= <class-enum-type>
 ///          ::= <template-param>
 ///          ::= <substitution>
 void CXXNameMangler::mangleType(TemplateName TN) {
   if (mangleSubstitution(TN))
     return;
+  SubstitutionScope Subst(*this);
 
   TemplateDecl *TD = nullptr;
 
   switch (TN.getKind()) {
   case TemplateName::QualifiedTemplate:
     TD = TN.getAsQualifiedTemplateName()->getTemplateDecl();
     goto HaveDecl;
 
case TemplateName::SubstTemplateTemplateParmPack: {
     // template <template <class> class T...> class A {
     //   template <template <class> class U...> void foo(B<T,U> x...);
     // };
     Out << "_SUBSTPACK_";
     break;
   }
   }
 
-  addSubstitution(TN);
+  addSubstitution(Subst, TN);
 }
 
 bool CXXNameMangler::mangleUnresolvedTypeOrSimpleId(QualType Ty,
                                                     StringRef Prefix) {
   // Only certain other types are valid as prefixes;  enumerate them.
   switch (Ty->getTypeClass()) {
   case Type::Builtin:
   case Type::Complex:
void CXXNameMangler::mangleType(QualType T) {
   SplitQualType split = T.split();
   Qualifiers quals = split.Quals;
   const Type *ty = split.Ty;
 
   bool isSubstitutable =
     isTypeSubstitutable(quals, ty, Context.getASTContext());
   if (isSubstitutable && mangleSubstitution(T))
     return;
+  SubstitutionScope Subst(*this);
 
   // If we're mangling a qualified array type, push the qualifiers to
   // the element type.
   if (quals && isa<ArrayType>(T)) {
     ty = Context.getASTContext().getAsArrayType(T);
     quals = Qualifiers();
 
     // Note that we don't update T: we want to add the
case Type::CLASS: \
       mangleType(static_cast<const CLASS##Type*>(ty)); \
       break;
 #include "clang/AST/TypeNodes.inc"
     }
   }
 
   // Add the substitution.
   if (isSubstitutable)
-    addSubstitution(T);
+    addSubstitution(Subst, T);
 }
 
 void CXXNameMangler::mangleNameOrStandardSubstitution(const NamedDecl *ND) {
   if (!mangleStandardSubstitution(ND))
     mangleName(ND);
 }
 
 void CXXNameMangler::mangleType(const BuiltinType *T) {

 }
 
 void CXXNameMangler::mangleType(const TemplateSpecializationType *T) {
   if (TemplateDecl *TD = T->getTemplateName().getAsTemplateDecl()) {
     mangleTemplateName(TD, T->getArgs(), T->getNumArgs());
   } else {
     if (mangleSubstitution(QualType(T, 0)))
       return;
+    SubstitutionScope Subst(*this);
 
     mangleTemplatePrefix(T->getTemplateName());
 
     // FIXME: GCC does not appear to mangle the template arguments when
     // the template in question is a dependent template name. Should we
     // emulate that badness?
     mangleTemplateArgs(T->getArgs(), T->getNumArgs());
-    addSubstitution(QualType(T, 0));
+    addSubstitution(Subst, QualType(T, 0));
   }
 }
 
 void CXXNameMangler::mangleType(const DependentNameType *T) {
   // Proposal by cxx-abi-dev, 2014-03-26
   // <class-enum-type> ::= <name>    # non-dependent or dependent type name or
   //                                 # dependent elaborated type specifier using
   //                                 # 'typename'
if (const DependentAddressSpaceType *DAST =
     mangleQualifiers(parm->getType().getQualifiers());
   }
 
   // Parameter index.
   if (parmIndex != 0) {
     Out << (parmIndex - 1);
   }
   Out << '_';
+
+  // A reference to a function parameter is a reference to a property of the
+  // <encoding>.
+  noteReferenceToEncoding();
 }
 
 void CXXNameMangler::mangleCXXCtorType(CXXCtorType T,
                                        const CXXRecordDecl *InheritedFrom) {
   // <ctor-dtor-name> ::= C1  # complete object constructor
   //                  ::= C2  # base object constructor
   //                  ::= CI1 <type> # complete inheriting constructor
   //                  ::= CI2 <type> # base inheriting constructor
void CXXNameMangler::mangleTemplateParameter(unsigned Depth, unsigned Index) {
   // The latter two manglings are from a proposal here:
   // https://github.com/itanium-cxx-abi/cxx-abi/issues/31#issuecomment-528122117
   Out << 'T';
   if (Depth != 0)
     Out << 'L' << (Depth - 1) << '_';
   if (Index != 0)
     Out << (Index - 1);
   Out << '_';
+
+  // Make a note that this is a reference to a parameter of the innermost
+  // <encoding>; substitutions referring to it can only be used within that
+  // same <encoding>.
+  // See https://github.com/itanium-cxx-abi/cxx-abi/issues/106
+  noteReferenceToEncoding();
 }
 
 void CXXNameMangler::mangleSeqID(unsigned SeqID) {
   if (SeqID == 1)
     Out << '0';
   else if (SeqID > 1) {
     SeqID--;
 
if (TemplateDecl *TD = Template.getAsTemplateDecl())
     return mangleSubstitution(TD);
 
   Template = Context.getASTContext().getCanonicalTemplateName(Template);
   return mangleSubstitution(
                       reinterpret_cast<uintptr_t>(Template.getAsVoidPointer()));
 }
 
 bool CXXNameMangler::mangleSubstitution(uintptr_t Ptr) {
-  llvm::DenseMap<uintptr_t, unsigned>::iterator I = Substitutions.find(Ptr);
+  auto I = Substitutions.find(Ptr);
   if (I == Substitutions.end())
     return false;
 
-  unsigned SeqID = I->second;
+  // Check this substitution is usable from this scope.
+  if (unsigned Scope = I->second.EncodingScope) {
+    // In Clang 10 and before, we permitted substitutions to refer to unrelated
+    // parameters from distinct <encoding>s that happened to have the same
+    // depth and index.
+    if (Context.getASTContext().getLangOpts().getClangABICompat() >
+            LangOptions::ClangABI::Ver10 &&
+        !inEncodingScope(Scope))
+      return false;
+  }
+
+  unsigned SeqID = I->second.SeqID;
   Out << 'S';
   mangleSeqID(SeqID);
 
   return true;
 }
 
 static bool isCharType(QualType T) {
   if (T.isNull())
if (const ClassTemplateSpecializationDecl *SD =
     if (isStreamCharSpecialization(SD, "basic_iostream")) {
       Out << "Sd";
       return true;
     }
   }
   return false;
 }
 
-void CXXNameMangler::addSubstitution(QualType T) {
+void CXXNameMangler::addSubstitution(const SubstitutionScope &S, QualType T) {
   if (!hasMangledSubstitutionQualifiers(T)) {
     if (const RecordType *RT = T->getAs<RecordType>()) {
-      addSubstitution(RT->getDecl());
+      addSubstitution(S, RT->getDecl());
       return;
     }
   }
 
   uintptr_t TypePtr = reinterpret_cast<uintptr_t>(T.getAsOpaquePtr());
-  addSubstitution(TypePtr);
+  addSubstitution(S, TypePtr);
 }
 
-void CXXNameMangler::addSubstitution(TemplateName Template) {
+void CXXNameMangler::addSubstitution(const SubstitutionScope &S,
+                                     TemplateName Template) {
   if (TemplateDecl *TD = Template.getAsTemplateDecl())
-    return addSubstitution(TD);
+    return addSubstitution(S, TD);
 
   Template = Context.getASTContext().getCanonicalTemplateName(Template);
-  addSubstitution(reinterpret_cast<uintptr_t>(Template.getAsVoidPointer()));
+  addSubstitution(S, reinterpret_cast<uintptr_t>(Template.getAsVoidPointer()));
 }
 
-void CXXNameMangler::addSubstitution(uintptr_t Ptr) {
-  assert(!Substitutions.count(Ptr) && "Substitution already exists!");
-  Substitutions[Ptr] = SeqID++;
+void CXXNameMangler::addSubstitution(const SubstitutionScope &S,
+                                     uintptr_t Ptr) {
+  assert((!Substitutions.count(Ptr) ||
+          !inEncodingScope(Substitutions[Ptr].EncodingScope)) &&
+         "Substitution already exists!");
+  Substitutions[Ptr] = {SeqID++, S.InnermostEncodingScope};
 }
 
-void CXXNameMangler::extendSubstitutions(CXXNameMangler* Other) {
+void CXXNameMangler::extendSubstitutions(CXXNameMangler *Other) {
   assert(Other->SeqID >= SeqID && "Must be superset of substitutions!");
   if (Other->SeqID > SeqID) {
     Substitutions.swap(Other->Substitutions);
     SeqID = Other->SeqID;
   }
+  assert(Other->EncodingScopes >= EncodingScopes &&
+         "Must be superset of encoding scopes!");
+  EncodingScopes = Other->EncodingScopes;
 }
 
 CXXNameMangler::AbiTagList
 CXXNameMangler::makeFunctionReturnTypeTags(const FunctionDecl *FD) {
   // When derived abi tags are disabled there is no need to make any list.
   if (DisableDerivedAbiTags)
     return AbiTagList();
 

clang/lib/Frontend/CompilerInvocation.cpp

if (!VerParts.first.startswith("0") &&
       else if (Major <= 4)
         Opts.setClangABICompat(LangOptions::ClangABI::Ver4);
       else if (Major <= 6)
         Opts.setClangABICompat(LangOptions::ClangABI::Ver6);
       else if (Major <= 7)
         Opts.setClangABICompat(LangOptions::ClangABI::Ver7);
       else if (Major <= 9)
         Opts.setClangABICompat(LangOptions::ClangABI::Ver9);
+      else if (Major <= 10)
+        Opts.setClangABICompat(LangOptions::ClangABI::Ver10);
     } else if (Ver != "latest") {
       Diags.Report(diag::err_drv_invalid_value)
           << A->getAsString(Args) << A->getValue();
     }
   }
 
   Opts.CompleteMemberPointers = Args.hasArg(OPT_fcomplete_member_pointers);
   Opts.BuildingPCHWithObjectFile = Args.hasArg(OPT_building_pch_with_obj);

clang/test/CodeGenCXX/mangle-abi-tag.cpp

 // f19_test(N19::C<N19::A, &N19::foo[abi:B]>, N19::F, N19::D)
 // CHECK-DAG: define {{(dso_local )?}}void @_Z8f19_testN3N191CINS_1AEXadL_ZNS_3fooB1BES1_NS_1DEEEEENS_1FES2_(
 
 namespace pr30440 {
 
 template<class F> void g(F);
 template<class ...A> auto h(A ...a)->decltype (g (0, g < a > (a) ...)) {
 }
-// CHECK-DAG: define {{.*}} @_ZN7pr304401hIJEEEDTcl1gLi0Espcl1gIL_ZZNS_1hEDpT_E1aEEfp_EEES2_(
+// FIXME: This mangling is wrong. We should never refer to a function parameter by <local-name>.
+// Should be:               @_ZN7pr304401hIJEEEDTcl1gLi0Espcl1gIXfp_EEfp_EEEDpT_
+// CHECK-DAG: define {{.*}} @_ZN7pr304401hIJEEEDTcl1gLi0Espcl1gIL_ZZNS_1hEDpT_E1aEEfp_EEEDpT_(
 
 void pr30440_test () {
   h();
 }
 
 }

clang/test/CodeGenCXX/mangle-local-substitutions.cpp

+// RUN: %clang_cc1 -std=c++20 %s -emit-llvm -o - -triple x86_64-linux-gnu | FileCheck %s --check-prefix=CHECK-NEW
+// RUN: %clang_cc1 -std=c++20 %s -emit-llvm -o - -triple x86_64-linux-gnu -fclang-abi-compat=10 | FileCheck %s --check-prefix=CHECK-OLD
+
+namespace multiple_encodings {
+  template<typename T> auto f(T a, decltype(a)) { struct A {}; return A(); }
+  template<typename T> auto g(T b, decltype(b)) { struct B {}; return B(); }
+  using A = decltype(f(0, 0));
+  using B = decltype(g(0.0, 0.0));
+  template<typename ...T> struct X {};
+  // Note that we do not use backreferences for the repeated T_ and DtfL1p_E
+  // here; they are symbolically different because they refer to parameters of
+  // different function template specializiations.
+  // CHECK-NEW: define {{.*}}@_ZN18multiple_encodings1hENS_1XIJZNS_1fIiEEDaT_DtfL1p_EE1AZNS_1gIdEEDaT_DtfL1p_EE1BEEE(
+  // CHECK-OLD: define {{.*}}@_ZN18multiple_encodings1hENS_1XIJZNS_1fIiEEDaT_DtfL1p_EE1AZNS_1gIdEEDaS2_S3_E1BEEE(
+  void h(X<A, B>) {}
+}
+
+namespace multiple_lambdas {
+  template<typename T> struct X { X(T f) { f(0); } template<typename ...U> void operator()(U...); };
+  template<typename T> void f(T&&) { X{[](auto &&, auto...){}}(); }
+  // Note that we use OT_ for both lambdas here, rather than using a
+  // substitution for the second OT_. These are references to distinct template
+  // parameters, so are not substitutable.
+  // CHECK-NEW: call {{.*}}_ZN16multiple_lambdas1XIZNS_1fIiEEvOT_EUlOT_DpT0_E_EclIJEEEvDpT_(
+  // CHECK-OLD: call {{.*}}_ZN16multiple_lambdas1XIZNS_1fIiEEvOT_EUlS3_DpT0_E_EclIJEEEvDpT_(
+  void g() { f(0); }
+}