Handle nested landing pads in outlined catch handlers for Windows C++ EH

[andrew.w.kaylor]

Summary

This patch implements the code to fill in nested landing pads that were stubbed out during initial catch handler outlining.

The nested landing pad may introduce new exception variables that need to be recovered in the handler in which the landing pad is nested in order for the value to be passed to eh.actions. If the variable isn't otherwise referenced in the handler, I think we will want to drop the recovered value during code gen.

A catch handler that is called from the nested landing pad may need to return to an address in the outlined handler. I've added code to detect this case and remap the return instruction. This will not work correctly if the cloning code optimizes away the target block or if the target block is shared between multiple catch handlers. I think both of these are possible, but I don't have test cases to show it yet.

[rnk]

lib/CodeGen/WinEHPrepare.cpp

110

Can you add a comment about which is the key and which is the value? This goes from cloned LP to original LP if I read the code right. Maybe ClonedLPToOriginalLP would be a better name.

445

I *think* LPadPair.second = NewLPad will update the container. The subscript operation is making me nervous because it looks like mutation during iteration, even though we already know that the key exists in the container. DenseMap doesn't have this bug, but just the other day we were looking at an old implementation of TR1 hash_map which had a bug where it would potentially resize on this exact operation.

509

In general, you shouldn't need to reach for getInstList(). This can be written:

assert(&OutlinedBB->back() == OutlinedLPad);

530

You could probably just cast the result of the clone() call and save a local variable.

534–536

I have an idea for how we can completely eliminate the need for this. What if we changed the catch object argument from an AllocaInst to the i32 value that would be used with llvm.framerecover? That way the i32 would mean the same thing in the parent function and the child functions.

547

break?

557

Both the AllocaInst and Function cases of are pretty heavy. What do you think of pulling them out into helper functions? prepareExceptionHandlers is pretty long.

558–563

We have a parseEHActions function implementation in a pending patch. It goes from llvm.eh.actions call back into a list of ActionHandlers. It may ultimately be cleaner to use that, but I don't want to block your patch on ours. Let's throw a FIXME in here to come around and do that.

564

You can exit early if it's not i8*.

572–573

You can continue if it's not ReturnInst

580

Ditto, continue

895–900

These "End" comments seem excessive, for this short of a loop.

1139–1141

I wouldn't say "We shouldn't encounter landing pads in the actual cleanup code." This is currently only true because the outlining process unconditionally turns invokes in cleanups into calls. In general, destructors with real invokes can be inlined, and we will need to handle that one day. For now, I would rephrase this comment along the lines of "Cleanup outlining currently demotes all invokes to calls, so all landingpads are trivially unreachable."

[andrew.w.kaylor]

lib/CodeGen/WinEHPrepare.cpp

110

I'm not sure ClonedLPToOriginalLP is especially helpful, as it doesn't indicate why the landing pads in question were mapped.

I do agree that something needs to be done to make this more clear and that a comment doesn't seem quite sufficient.

How about NestedLPToOriginalLP?

Incidentally, I did the mapping in this way because I think that it is possible for the same landing pad to be nested within multiple handlers.

445

Alright, I'll give that a try.

534–536

Yeah, that should work and would clean up a lot of mess here. It's not as readable, but hopefully no one will be reading these things much anyway.

547

Yes, if we have to keep this code.

557

Sounds reasonable.

558–563

OK

895–900

I just really hate seeing that many consecutive end brackets. They'll go away after I clean up the loops as you suggest above.

1139–1141

You mentioned this before, and I think I said then that I don't believe the MS runtime will allow an exception to be thrown in a cleanup handler. Do you disagree?

[andrew.w.kaylor]

Implemented suggested changes from earlier review.

[rnk]

This seems pretty close to done. Sorry for the delay, I was staring at .xdata tables all day long. =P

lib/CodeGen/WinEHPrepare.cpp

111–130

Thanks, these comments help. :)

665–666

parseEHActions is in tree in FunctionLoweringInfo, but if we share this code, we should probably move it over to this pass and declare it in WinEHFuncInfo.h.

Do you want to do this now or later? I'm OK either way.

670–691

Going forward, I would really like to change llvm.eh.actions to take an i32 frameescape index for the catch object instead. Doing this actually makes things easier for WinEHNumbering, which is where we build the try block map entries.

If we make this change first, you can remove this entire alloca case, because the index is the same in the parent function as in the outlined handler. Do you think it's worth defering this again, or would you rather try to get this in first and come back later?

[andrew.w.kaylor]

lib/CodeGen/WinEHPrepare.cpp

665–666

It probably doesn't make sense to check in code that's going to be removed almost immediately. I'm in the process of merging this patch with the latest trunk revision now. I'll go ahead and make this change while I'm at it.

670–691

If the changes to frameescape can be made quickly, I think it's best to have that in first.

[andrew.w.kaylor]

Rebased to merge with latest WinEH changes.
Moved parseEHActions into WinEHPrepare and updated it to save the exception object frameescape index.
Updated the code that was previously parsing eh.actions calls in a different way.

[majnemer]

lib/CodeGen/WinEHPrepare.cpp

699

Can you please clarify this FIXME?

[andrew.w.kaylor]

lib/CodeGen/WinEHPrepare.cpp

699

Oops. That was there from a previous revision. It should have been deleted.

[majnemer]

include/llvm/CodeGen/WinEHFuncInfo.h

77

There is no getExceptionVarIndex and code which loads from ExceptionObjectIndex. Is this code from a prior revision or do you have future intentions for it?

[andrew.w.kaylor]

include/llvm/CodeGen/WinEHFuncInfo.h

77

I expected that the code generating the .xdata tables would use that, but I didn't want to add the function until it was going to be called.

[andrew.w.kaylor]

Adding updates to cppeh-prepared-catch.ll, which I missed previously.
Removing stale FIXME comment.

[rnk]

lgtm

lib/CodeGen/WinEHPrepare.cpp

705

Early continue if !Handler?

include/llvm/CodeGen/WinEHFuncInfo.h

 #include "llvm/ADT/TinyPtrVector.h"
 #include "llvm/ADT/DenseMap.h"
 
 namespace llvm {
 class BasicBlock;
 class Constant;
 class Function;
 class GlobalValue;
+class IntrinsicInst;
 class LandingPadInst;
 class MCSymbol;
 class Value;
 
 enum ActionType { Catch, Cleanup };
 
 class ActionHandler {
 public:
private:
   // Can be either a BlockAddress or a Function depending on the EH personality.
   Constant *HandlerBlockOrFunc;
 };
 
 class CatchHandler : public ActionHandler {
 public:
   CatchHandler(BasicBlock *BB, Constant *Selector, BasicBlock *NextBB)
       : ActionHandler(BB, ActionType::Catch), Selector(Selector),
-        NextBB(NextBB), ExceptionObjectVar(nullptr) {}
+      NextBB(NextBB), ExceptionObjectVar(nullptr),
+      ExceptionObjectIndex(-1) {}
 
   // Method for support type inquiry through isa, cast, and dyn_cast:
   static inline bool classof(const ActionHandler *H) {
     return H->getType() == ActionType::Catch;
   }
 
   Constant *getSelector() const { return Selector; }
   BasicBlock *getNextBB() const { return NextBB; }
 
   const Value *getExceptionVar() { return ExceptionObjectVar; }
   TinyPtrVector<BasicBlock *> &getReturnTargets() { return ReturnTargets; }
 
   void setExceptionVar(const Value *Val) { ExceptionObjectVar = Val; }
+  void setExceptionVarIndex(int Index) { ExceptionObjectIndex = Index;  }
   void setReturnTargets(TinyPtrVector<BasicBlock *> &Targets) {
     ReturnTargets = Targets;
   }
 
 private:
   Constant *Selector;
   BasicBlock *NextBB;
+  // While catch handlers are being outlined the ExceptionObjectVar field will
+  // be populated with the instruction in the parent frame that corresponds
+  // to the exception object (or nullptr if the catch does not use an
+  // exception object) and the ExceptionObjectIndex field will be -1.
+  // When the parseEHActions function is called to populate a vector of
+  // instances of this class, the ExceptionObjectVar field will be nullptr
+  // and the ExceptionObjectIndex will be the index of the exception object in
+  // the parent function's frameescape block.
   const Value *ExceptionObjectVar;
+  int ExceptionObjectIndex;
   TinyPtrVector<BasicBlock *> ReturnTargets;
 };
 
 class CleanupHandler : public ActionHandler {
 public:
   CleanupHandler(BasicBlock *BB) : ActionHandler(BB, ActionType::Cleanup) {}
 
   // Method for support type inquiry through isa, cast, and dyn_cast:
   static inline bool classof(const ActionHandler *H) {
     return H->getType() == ActionType::Cleanup;
   }
 };
 
+void parseEHActions(const IntrinsicInst *II,
+  SmallVectorImpl<ActionHandler *> &Actions);
+
+
 // The following structs respresent the .xdata for functions using C++
 // exceptions on Windows.
 
 struct WinEHUnwindMapEntry {
   int ToState;
   Function *Cleanup;
 };
 

lib/CodeGen/SelectionDAG/FunctionLoweringInfo.cpp

struct WinEHNumbering {
 
   SmallVector<ActionHandler *, 4> HandlerStack;
   SmallPtrSet<const Function *, 4> VisitedHandlers;
 
   int currentEHNumber() const {
     return HandlerStack.empty() ? -1 : HandlerStack.back()->getEHState();
   }
 
-  void parseEHActions(const IntrinsicInst *II,
-                      SmallVectorImpl<ActionHandler *> &Actions);
   void createUnwindMapEntry(int ToState, ActionHandler *AH);
   void createTryBlockMapEntry(int TryLow, int TryHigh,
                               ArrayRef<CatchHandler *> Handlers);
   void processCallSite(ArrayRef<ActionHandler *> Actions, ImmutableCallSite CS);
   void calculateStateNumbers(const Function &F);
 };
 }
 
void FunctionLoweringInfo::set(const Function &fn, MachineFunction &mf,
   if (fn.getFnAttribute("wineh-parent").getValueAsString() == fn.getName()) {
     WinEHNumbering Num(MMI.getWinEHFuncInfo(&fn));
     Num.calculateStateNumbers(fn);
     // Pop everything on the handler stack.
     Num.processCallSite(None, ImmutableCallSite());
   }
 }
 
-void WinEHNumbering::parseEHActions(const IntrinsicInst *II,
-                                    SmallVectorImpl<ActionHandler *> &Actions) {
-  for (unsigned I = 0, E = II->getNumArgOperands(); I != E;) {
-    uint64_t ActionKind =
-        cast<ConstantInt>(II->getArgOperand(I))->getZExtValue();
-    if (ActionKind == /*catch=*/1) {
-      auto *Selector = cast<Constant>(II->getArgOperand(I + 1));
-      Value *CatchObject = II->getArgOperand(I + 2);
-      Constant *Handler = cast<Constant>(II->getArgOperand(I + 3));
-      I += 4;
-      auto *CH = new CatchHandler(/*BB=*/nullptr, Selector, /*NextBB=*/nullptr);
-      CH->setExceptionVar(CatchObject);
-      CH->setHandlerBlockOrFunc(Handler);
-      Actions.push_back(CH);
-    } else {
-      assert(ActionKind == 0 && "expected a cleanup or a catch action!");
-      Constant *Handler = cast<Constant>(II->getArgOperand(I + 1));
-      I += 2;
-      auto *CH = new CleanupHandler(/*BB=*/nullptr);
-      CH->setHandlerBlockOrFunc(Handler);
-      Actions.push_back(CH);
-    }
-  }
-  std::reverse(Actions.begin(), Actions.end());
-}
-
 void WinEHNumbering::createUnwindMapEntry(int ToState, ActionHandler *AH) {
   WinEHUnwindMapEntry UME;
   UME.ToState = ToState;
   if (auto *CH = dyn_cast_or_null<CleanupHandler>(AH))
     UME.Cleanup = cast<Function>(CH->getHandlerBlockOrFunc());
   else
     UME.Cleanup = nullptr;
   FuncInfo.UnwindMap.push_back(UME);

lib/CodeGen/WinEHPrepare.cpp

public:
   const char *getPassName() const override {
     return "Windows exception handling preparation";
   }
 
 private:
   bool prepareExceptionHandlers(Function &F,
                                 SmallVectorImpl<LandingPadInst *> &LPads);
   void promoteLandingPadValues(LandingPadInst *LPad);
+  void completeNestedLandingPad(Function *ParentFn,
+                                LandingPadInst *OutlinedLPad,
+                                const LandingPadInst *OriginalLPad,
+                                FrameVarInfoMap &VarInfo);
   bool outlineHandler(ActionHandler *Action, Function *SrcFn,
                       LandingPadInst *LPad, BasicBlock *StartBB,
                       FrameVarInfoMap &VarInfo);
 
   void mapLandingPadBlocks(LandingPadInst *LPad, LandingPadActions &Actions);
   CatchHandler *findCatchHandler(BasicBlock *BB, BasicBlock *&NextBB,
                                  VisitedBlockSet &VisitedBlocks);
   CleanupHandler *findCleanupHandler(BasicBlock *StartBB, BasicBlock *EndBB);
 
   void processSEHCatchHandler(CatchHandler *Handler, BasicBlock *StartBB);
 
   // All fields are reset by runOnFunction.
   DominatorTree *DT;
   EHPersonality Personality;
   CatchHandlerMapTy CatchHandlerMap;
   CleanupHandlerMapTy CleanupHandlerMap;
   DenseMap<const LandingPadInst *, LandingPadMap> LPadMaps;
+
+  // This maps landing pad instructions found in outlined handlers to
+  // the landing pad instruction in the parent function from which they
+  // were cloned.  The cloned/nested landing pad is used as the key
+  // because the landing pad may be cloned into multiple handlers.
+  // This map will be used to add the llvm.eh.actions call to the nested
+  // landing pads after all handlers have been outlined.
+  DenseMap<LandingPadInst *, const LandingPadInst *> NestedLPtoOriginalLP;
+
+  // This maps blocks in the parent function which are destinations of
+  // catch handlers to cloned blocks in (other) outlined handlers. This
+  // handles the case where a nested landing pads has a catch handler that
+  // returns to a handler function rather than the parent function.
+  // The original block is used as the key here because there should only
+  // ever be one handler function from which the cloned block is not pruned.
+  // The original block will be pruned from the parent function after all
+  // handlers have been outlined.  This map will be used to adjust the
+  // return instructions of handlers which return to the block that was
+  // outlined into a handler.  This is done after all handlers have been
+  // outlined but before the outlined code is pruned from the parent function.
+  DenseMap<const BasicBlock *, BasicBlock *> LPadTargetBlocks;
 };
 
 class WinEHFrameVariableMaterializer : public ValueMaterializer {
 public:
   WinEHFrameVariableMaterializer(Function *OutlinedFn,
                                  FrameVarInfoMap &FrameVarInfo);
   ~WinEHFrameVariableMaterializer() {}
 
private:
   // We will normally only see one of each of these instructions, but
   // if more than one occurs for some reason we can handle that.
   TinyPtrVector<const ExtractValueInst *> ExtractedEHPtrs;
   TinyPtrVector<const ExtractValueInst *> ExtractedSelectors;
 };
 
 class WinEHCloningDirectorBase : public CloningDirector {
 public:
-  WinEHCloningDirectorBase(Function *HandlerFn,
-                           FrameVarInfoMap &VarInfo,
+  WinEHCloningDirectorBase(Function *HandlerFn, FrameVarInfoMap &VarInfo,
                            LandingPadMap &LPadMap)
       : Materializer(HandlerFn, VarInfo),
         SelectorIDType(Type::getInt32Ty(HandlerFn->getContext())),
         Int8PtrType(Type::getInt8PtrTy(HandlerFn->getContext())),
         LPadMap(LPadMap) {}
 
   CloningAction handleInstruction(ValueToValueMapTy &VMap,
                                   const Instruction *Inst,
virtual CloningAction handleTypeIdFor(ValueToValueMapTy &VMap,
                                         const Instruction *Inst,
                                         BasicBlock *NewBB) = 0;
   virtual CloningAction handleInvoke(ValueToValueMapTy &VMap,
                                      const InvokeInst *Invoke,
                                      BasicBlock *NewBB) = 0;
   virtual CloningAction handleResume(ValueToValueMapTy &VMap,
                                      const ResumeInst *Resume,
                                      BasicBlock *NewBB) = 0;
+  virtual CloningAction handleLandingPad(ValueToValueMapTy &VMap,
+                                         const LandingPadInst *LPad,
+                                         BasicBlock *NewBB) = 0;
 
   ValueMaterializer *getValueMaterializer() override { return &Materializer; }
 
 protected:
   WinEHFrameVariableMaterializer Materializer;
   Type *SelectorIDType;
   Type *Int8PtrType;
   LandingPadMap &LPadMap;
 };
 
 class WinEHCatchDirector : public WinEHCloningDirectorBase {
 public:
-  WinEHCatchDirector(Function *CatchFn, Value *Selector,
-                     FrameVarInfoMap &VarInfo, LandingPadMap &LPadMap)
+  WinEHCatchDirector(
+      Function *CatchFn, Value *Selector, FrameVarInfoMap &VarInfo,
+      LandingPadMap &LPadMap,
+      DenseMap<LandingPadInst *, const LandingPadInst *> &NestedLPads)
       : WinEHCloningDirectorBase(CatchFn, VarInfo, LPadMap),
         CurrentSelector(Selector->stripPointerCasts()),
-        ExceptionObjectVar(nullptr) {}
+        ExceptionObjectVar(nullptr), NestedLPtoOriginalLP(NestedLPads) {}
 
   CloningAction handleBeginCatch(ValueToValueMapTy &VMap,
                                  const Instruction *Inst,
                                  BasicBlock *NewBB) override;
   CloningAction handleEndCatch(ValueToValueMapTy &VMap, const Instruction *Inst,
                                BasicBlock *NewBB) override;
   CloningAction handleTypeIdFor(ValueToValueMapTy &VMap,
                                 const Instruction *Inst,
                                 BasicBlock *NewBB) override;
   CloningAction handleInvoke(ValueToValueMapTy &VMap, const InvokeInst *Invoke,
                              BasicBlock *NewBB) override;
   CloningAction handleResume(ValueToValueMapTy &VMap, const ResumeInst *Resume,
                              BasicBlock *NewBB) override;
+  CloningAction handleLandingPad(ValueToValueMapTy &VMap,
+                                 const LandingPadInst *LPad,
+                                 BasicBlock *NewBB) override;
 
   Value *getExceptionVar() { return ExceptionObjectVar; }
   TinyPtrVector<BasicBlock *> &getReturnTargets() { return ReturnTargets; }
 
 private:
   Value *CurrentSelector;
 
   Value *ExceptionObjectVar;
   TinyPtrVector<BasicBlock *> ReturnTargets;
+
+  // This will be a reference to the field of the same name in the WinEHPrepare
+  // object which instantiates this WinEHCatchDirector object.
+  DenseMap<LandingPadInst *, const LandingPadInst *> &NestedLPtoOriginalLP;
 };
 
 class WinEHCleanupDirector : public WinEHCloningDirectorBase {
 public:
-  WinEHCleanupDirector(Function *CleanupFn,
-                       FrameVarInfoMap &VarInfo, LandingPadMap &LPadMap)
+  WinEHCleanupDirector(Function *CleanupFn, FrameVarInfoMap &VarInfo,
+                       LandingPadMap &LPadMap)
       : WinEHCloningDirectorBase(CleanupFn, VarInfo, LPadMap) {}
 
   CloningAction handleBeginCatch(ValueToValueMapTy &VMap,
                                  const Instruction *Inst,
                                  BasicBlock *NewBB) override;
   CloningAction handleEndCatch(ValueToValueMapTy &VMap, const Instruction *Inst,
                                BasicBlock *NewBB) override;
   CloningAction handleTypeIdFor(ValueToValueMapTy &VMap,
                                 const Instruction *Inst,
                                 BasicBlock *NewBB) override;
   CloningAction handleInvoke(ValueToValueMapTy &VMap, const InvokeInst *Invoke,
                              BasicBlock *NewBB) override;
   CloningAction handleResume(ValueToValueMapTy &VMap, const ResumeInst *Resume,
                              BasicBlock *NewBB) override;
+  CloningAction handleLandingPad(ValueToValueMapTy &VMap,
+                                 const LandingPadInst *LPad,
+                                 BasicBlock *NewBB) override;
 };
 
 class LandingPadActions {
 public:
   LandingPadActions() : HasCleanupHandlers(false) {}
 
   void insertCatchHandler(CatchHandler *Action) { Actions.push_back(Action); }
   void insertCleanupHandler(CleanupHandler *Action) {
INITIALIZE_TM_PASS(WinEHPrepare, "winehprepare", "Prepare Windows exceptions",
                    false, false)
 
 FunctionPass *llvm::createWinEHPass(const TargetMachine *TM) {
   return new WinEHPrepare(TM);
 }
 
 // FIXME: Remove this once the backend can handle the prepared IR.
 static cl::opt<bool>
     SEHPrepare("sehprepare", cl::Hidden,
                cl::desc("Prepare functions with SEH personalities"));
 
 bool WinEHPrepare::runOnFunction(Function &Fn) {
   SmallVector<LandingPadInst *, 4> LPads;
   SmallVector<ResumeInst *, 4> Resumes;
   for (BasicBlock &BB : Fn) {
     if (auto *LP = BB.getLandingPadInst())
       LPads.push_back(LP);
     if (auto *Resume = dyn_cast<ResumeInst>(BB.getTerminator()))
if (isAsynchronousEHPersonality(Personality) && !SEHPrepare) {
     return true;
   }
 
   // If there were any landing pads, prepareExceptionHandlers will make changes.
   prepareExceptionHandlers(Fn, LPads);
   return true;
 }
 
-bool WinEHPrepare::doFinalization(Module &M) {
-  return false;
-}
+bool WinEHPrepare::doFinalization(Module &M) { return false; }
 
 void WinEHPrepare::getAnalysisUsage(AnalysisUsage &AU) const {
   AU.addRequired<DominatorTreeWrapperPass>();
 }
 
 bool WinEHPrepare::prepareExceptionHandlers(
     Function &F, SmallVectorImpl<LandingPadInst *> &LPads) {
   // These containers are used to re-map frame variables that are used in
for (LandingPadInst *LPad : LPads) {
     auto *NewLPad = cast<LandingPadInst>(LPad->clone());
     NewLPadBB->getInstList().push_back(NewLPad);
     while (!pred_empty(LPadBB)) {
       auto *pred = *pred_begin(LPadBB);
       InvokeInst *Invoke = cast<InvokeInst>(pred->getTerminator());
       Invoke->setUnwindDest(NewLPadBB);
     }
 
+    // Replace the mapping of any nested landing pad that previously mapped
+    // to this landing pad with a referenced to the cloned version.
+    for (auto &LPadPair : NestedLPtoOriginalLP) {
+      const LandingPadInst *OriginalLPad = LPadPair.second;
+      if (OriginalLPad == LPad) {
+        LPadPair.second = NewLPad;
+      }
+    }
+
     // Replace uses of the old lpad in phis with this block and delete the old
     // block.
     LPadBB->replaceSuccessorsPhiUsesWith(NewLPadBB);
     LPadBB->getTerminator()->eraseFromParent();
     new UnreachableInst(LPadBB->getContext(), LPadBB);
 
     // Add a call to describe the actions for this landing pad.
     std::vector<Value *> ActionArgs;
for (ActionHandler *Action : Actions) {
       }
     }
   } // End for each landingpad
 
   // If nothing got outlined, there is no more processing to be done.
   if (!HandlersOutlined)
     return false;
 
+  // Replace any nested landing pad stubs with the correct action handler.
+  // This must be done before we remove unreachable blocks because it
+  // cleans up references to outlined blocks that will be deleted.
+  for (auto &LPadPair : NestedLPtoOriginalLP)
+    completeNestedLandingPad(&F, LPadPair.first, LPadPair.second, FrameVarInfo);
+
   F.addFnAttr("wineh-parent", F.getName());
 
   // Delete any blocks that were only used by handlers that were outlined above.
   removeUnreachableBlocks(F);
 
   BasicBlock *Entry = &F.getEntryBlock();
   IRBuilder<> Builder(F.getParent()->getContext());
   Builder.SetInsertPoint(Entry->getFirstInsertionPt());
 
   Function *FrameEscapeFn =
       Intrinsic::getDeclaration(M, Intrinsic::frameescape);
   Function *RecoverFrameFn =
       Intrinsic::getDeclaration(M, Intrinsic::framerecover);
 
   // Finally, replace all of the temporary allocas for frame variables used in
   // the outlined handlers with calls to llvm.framerecover.
   BasicBlock::iterator II = Entry->getFirstInsertionPt();
   Instruction *AllocaInsertPt = II;
   SmallVector<Value *, 8> AllocasToEscape;
   for (auto &VarInfoEntry : FrameVarInfo) {
     Value *ParentVal = VarInfoEntry.first;
     TinyPtrVector<AllocaInst *> &Allocas = VarInfoEntry.second;
 
     // If the mapped value isn't already an alloca, we need to spill it if it
     // is a computed value or copy it if it is an argument.
     AllocaInst *ParentAlloca = dyn_cast<AllocaInst>(ParentVal);
     if (!ParentAlloca) {
       if (auto *Arg = dyn_cast<Argument>(ParentVal)) {
         // Lower this argument to a copy and then demote that to the stack.
         // We can't just use the argument location because the handler needs
         // it to be in the frame allocation block.
         // Use 'select i8 true, %arg, undef' to simulate a 'no-op' instruction.
         Value *TrueValue = ConstantInt::getTrue(Context);
         Value *UndefValue = UndefValue::get(Arg->getType());
         Instruction *SI =
             SelectInst::Create(TrueValue, Arg, UndefValue,
                                Arg->getName() + ".tmp", AllocaInsertPt);
         Arg->replaceAllUsesWith(SI);
         // Reset the select operand, because it was clobbered by the RAUW above.
         SI->setOperand(1, Arg);
         ParentAlloca = DemoteRegToStack(*SI, true, SI);
       } else if (auto *PN = dyn_cast<PHINode>(ParentVal)) {
         ParentAlloca = DemotePHIToStack(PN, AllocaInsertPt);
       } else {
         Instruction *ParentInst = cast<Instruction>(ParentVal);
         // FIXME: This is a work-around to temporarily handle the case where an
         //        instruction that is only used in handlers is not sunk.
         //        Without uses, DemoteRegToStack would just eliminate the value.
         //        This will fail if ParentInst is an invoke.
         if (ParentInst->getNumUses() == 0) {
           BasicBlock::iterator InsertPt = ParentInst;
           ++InsertPt;
           ParentAlloca =
               new AllocaInst(ParentInst->getType(), nullptr,
                              ParentInst->getName() + ".reg2mem", InsertPt);
           new StoreInst(ParentInst, ParentAlloca, InsertPt);
         } else {
           ParentAlloca = DemoteRegToStack(*ParentInst, true, ParentInst);
         }
       }
     }
 
     // If the parent alloca is used by exactly one handler and is not a catch
     // parameter, erase the parent and leave the copy in the outlined handler.
     // Catch parameters are indicated by a single null pointer in Allocas.
     if (ParentAlloca->getNumUses() == 0 && Allocas.size() == 1 &&
         Allocas[0] != getCatchObjectSentinel()) {
       ParentAlloca->eraseFromParent();
       // FIXME: Put a null entry in the llvm.frameescape call because we've
       // already created llvm.eh.actions calls with indices into it.
       AllocasToEscape.push_back(Constant::getNullValue(Int8PtrType));
       continue;
     }
 
     // Add this alloca to the list of things to escape.
     AllocasToEscape.push_back(ParentAlloca);
 
     // Next replace all outlined allocas that are mapped to it.
     for (AllocaInst *TempAlloca : Allocas) {
       if (TempAlloca == getCatchObjectSentinel())
         continue; // Skip catch parameter sentinels.
       Function *HandlerFn = TempAlloca->getParent()->getParent();
       // FIXME: Sink this GEP into the blocks where it is used.
       Builder.SetInsertPoint(TempAlloca);
       Builder.SetCurrentDebugLocation(TempAlloca->getDebugLoc());
       Value *RecoverArgs[] = {
           Builder.CreateBitCast(&F, Int8PtrType, ""),
void WinEHPrepare::promoteLandingPadValues(LandingPadInst *LPad) {
   assert(DT);
 
   if (!EHAllocas.empty()) {
     PromoteMemToReg(EHAllocas, *DT);
     EHAllocas.clear();
   }
 }
 
+void WinEHPrepare::completeNestedLandingPad(Function *ParentFn,
+                                            LandingPadInst *OutlinedLPad,
+                                            const LandingPadInst *OriginalLPad,
+                                            FrameVarInfoMap &FrameVarInfo) {
+  // Get the nested block and erase the unreachable instruction that was
+  // temporarily inserted as its terminator.
+  LLVMContext &Context = ParentFn->getContext();
+  BasicBlock *OutlinedBB = OutlinedLPad->getParent();
+  assert(isa<UnreachableInst>(OutlinedBB->getTerminator()));
+  OutlinedBB->getTerminator()->eraseFromParent();
+  // That should leave OutlinedLPad as the last instruction in its block.
+  assert(&OutlinedBB->back() == OutlinedLPad);
+
+  // The original landing pad will have already had its action intrinsic
+  // built by the outlining loop.  We need to clone that into the outlined
+  // location.  It may also be necessary to add references to the exception
+  // variables to the outlined handler in which this landing pad is nested
+  // and remap return instructions in the nested handlers that should return
+  // to an address in the outlined handler.
+  Function *OutlinedHandlerFn = OutlinedBB->getParent();
+  const BasicBlock *OriginalBB = OriginalLPad->getParent();
+  BasicBlock::const_iterator II = OriginalLPad;
+  ++II;
+  // The instruction after the landing pad should now be a call to eh.actions.
+  const Instruction *Recover = II;
+  assert(match(Recover, m_Intrinsic<Intrinsic::eh_actions>()));
+  IntrinsicInst *EHActions = cast<IntrinsicInst>(Recover->clone());
+
+  // Remap the exception variables into the outlined function.
+  WinEHFrameVariableMaterializer Materializer(OutlinedHandlerFn, FrameVarInfo);
+  SmallVector<BlockAddress *, 4> ActionTargets;
+  unsigned NumArgs = EHActions->getNumArgOperands();
+  SmallVector<ActionHandler *, 4> ActionList;
+  parseEHActions(EHActions, ActionList);
+  // FIXME: Replace this with a call to parseEHActions when it's ready.
+  for (auto *Action : ActionList) {
+    auto *Catch = dyn_cast<CatchHandler>(Action);
+    if (!Catch)
+      continue;
+    // The dyn_cast to function here selects C++ catch handlers and skips
+    // SEH catch handlers.
+    if (auto *Handler = dyn_cast<Function>(Catch->getHandlerBlockOrFunc())) {
+      // Visit all the return instructions, looking for places that return
+      // to a location within OutlinedHandlerFn.
+      for (BasicBlock &NestedHandlerBB : *Handler) {
+        auto *Ret = dyn_cast<ReturnInst>(NestedHandlerBB.getTerminator());
+        if (!Ret)
+          continue;
+
+        // Handler functions must always return a block address.
+        BlockAddress *BA = cast<BlockAddress>(Ret->getReturnValue());
+        // The original target will have been in the main parent function,
+        // but if it is the address of a block that has been outlined, it
+        // should be a block that was outlined into OutlinedHandlerFn.
+        assert(BA->getFunction() == ParentFn);
+
+        // Ignore targets that aren't part of OutlinedHandlerFn.
+        if (!LPadTargetBlocks.count(BA->getBasicBlock()))
+          continue;
+
+        // If the return value is the address ofF a block that we
+        // previously outlined into the parent handler function, replace
+        // the return instruction and add the mapped target to the list
+        // of possible return addresses.
+        BasicBlock *MappedBB = LPadTargetBlocks[BA->getBasicBlock()];
+        assert(MappedBB->getParent() == OutlinedHandlerFn);
+        BlockAddress *NewBA = BlockAddress::get(OutlinedHandlerFn, MappedBB);
+        Ret->eraseFromParent();
+        ReturnInst::Create(Context, NewBA, &NestedHandlerBB);
+        ActionTargets.push_back(NewBA);
+      }
+    }
+  }
+  OutlinedBB->getInstList().push_back(EHActions);
+
+  // Insert an indirect branch into the outlined landing pad BB.
+  IndirectBrInst *IBr = IndirectBrInst::Create(EHActions, 0, OutlinedBB);
+  // Add the previously collected action targets.
+  for (auto *Target : ActionTargets)
+    IBr->addDestination(Target->getBasicBlock());
+}
+
 // This function examines a block to determine whether the block ends with a
 // conditional branch to a catch handler based on a selector comparison.
 // This function is used both by the WinEHPrepare::findSelectorComparison() and
 // WinEHCleanupDirector::handleTypeIdFor().
 static bool isSelectorDispatch(BasicBlock *BB, BasicBlock *&CatchHandler,
                                Constant *&Selector, BasicBlock *&NextBB) {
   ICmpInst::Predicate Pred;
   BasicBlock *TBB, *FBB;
bool WinEHPrepare::outlineHandler(ActionHandler *Action, Function *SrcFn,
 
   ValueToValueMapTy VMap;
 
   LandingPadMap &LPadMap = LPadMaps[LPad];
   if (!LPadMap.isInitialized())
     LPadMap.mapLandingPad(LPad);
   if (auto *CatchAction = dyn_cast<CatchHandler>(Action)) {
     Constant *Sel = CatchAction->getSelector();
-    Director.reset(new WinEHCatchDirector(Handler, Sel, VarInfo, LPadMap));
+    Director.reset(new WinEHCatchDirector(Handler, Sel, VarInfo, LPadMap,
+                                          NestedLPtoOriginalLP));
     LPadMap.remapEHValues(VMap, UndefValue::get(Int8PtrType),
                           ConstantInt::get(Type::getInt32Ty(Context), 1));
   } else {
     Director.reset(new WinEHCleanupDirector(Handler, VarInfo, LPadMap));
     LPadMap.remapEHValues(VMap, UndefValue::get(Int8PtrType),
                           UndefValue::get(Type::getInt32Ty(Context)));
   }
 
bool WinEHPrepare::outlineHandler(ActionHandler *Action, Function *SrcFn,
   Entry->getInstList().splice(Entry->end(), FirstClonedBB->getInstList());
   FirstClonedBB->eraseFromParent();
 
   if (auto *CatchAction = dyn_cast<CatchHandler>(Action)) {
     WinEHCatchDirector *CatchDirector =
         reinterpret_cast<WinEHCatchDirector *>(Director.get());
     CatchAction->setExceptionVar(CatchDirector->getExceptionVar());
     CatchAction->setReturnTargets(CatchDirector->getReturnTargets());
+
+    // Look for blocks that are not part of the landing pad that we just
+    // outlined but terminate with a call to llvm.eh.endcatch and a
+    // branch to a block that is in the handler we just outlined.
+    // These blocks will be part of a nested landing pad that intends to
+    // return to an address in this handler.  This case is best handled
+    // after both landing pads have been outlined, so for now we'll just
+    // save the association of the blocks in LPadTargetBlocks.  The
+    // return instructions which are created from these branches will be
+    // replaced after all landing pads have been outlined.
+    for (auto &MapEntry : VMap) {
+      // VMap maps all values and blocks that were just cloned, but dead
+      // blocks which were pruned will map to nullptr.
+      if (!isa<BasicBlock>(MapEntry.first) || MapEntry.second == nullptr)
+        continue;
+      const BasicBlock *MappedBB = cast<BasicBlock>(MapEntry.first);
+      for (auto *Pred : predecessors(const_cast<BasicBlock *>(MappedBB))) {
+        auto *Branch = dyn_cast<BranchInst>(Pred->getTerminator());
+        if (!Branch || !Branch->isUnconditional() || Pred->size() <= 1)
+          continue;
+        BasicBlock::iterator II = const_cast<BranchInst *>(Branch);
+        --II;
+        if (match(cast<Value>(II), m_Intrinsic<Intrinsic::eh_endcatch>())) {
+          // This would indicate that a nested landing pad wants to return
+          // to a block that is outlined into two different handlers.
+          assert(!LPadTargetBlocks.count(MappedBB));
+          LPadTargetBlocks[MappedBB] = cast<BasicBlock>(MapEntry.second);
+        }
+      }
     }
+  } // End if (CatchAction)
 
   Action->setHandlerBlockOrFunc(Handler);
 
   return true;
 }
 
 /// This BB must end in a selector dispatch. All we need to do is pass the
 /// handler block to llvm.eh.actions and list it as a possible indirectbr
CloningDirector::CloningAction WinEHCloningDirectorBase::handleInstruction(
   if (LPadMap.isLandingPadSpecificInst(Inst))
     return CloningDirector::SkipInstruction;
 
   // Nested landing pads will be cloned as stubs, with just the
   // landingpad instruction and an unreachable instruction. When
   // all landingpads have been outlined, we'll replace this with the
   // llvm.eh.actions call and indirect branch created when the
   // landing pad was outlined.
-  if (auto *NestedLPad = dyn_cast<LandingPadInst>(Inst)) {
-    Instruction *NewInst = NestedLPad->clone();
-    if (NestedLPad->hasName())
-      NewInst->setName(NestedLPad->getName());
-    // FIXME: Store this mapping somewhere else also.
-    VMap[NestedLPad] = NewInst;
-    BasicBlock::InstListType &InstList = NewBB->getInstList();
-    InstList.push_back(NewInst);
-    InstList.push_back(new UnreachableInst(NewBB->getContext()));
-    return CloningDirector::StopCloningBB;
+  if (auto *LPad = dyn_cast<LandingPadInst>(Inst)) {
+    return handleLandingPad(VMap, LPad, NewBB);
   }
 
   if (auto *Invoke = dyn_cast<InvokeInst>(Inst))
     return handleInvoke(VMap, Invoke, NewBB);
 
   if (auto *Resume = dyn_cast<ResumeInst>(Inst))
     return handleResume(VMap, Resume, NewBB);
 
   if (match(Inst, m_Intrinsic<Intrinsic::eh_begincatch>()))
     return handleBeginCatch(VMap, Inst, NewBB);
   if (match(Inst, m_Intrinsic<Intrinsic::eh_endcatch>()))
     return handleEndCatch(VMap, Inst, NewBB);
   if (match(Inst, m_Intrinsic<Intrinsic::eh_typeid_for>()))
     return handleTypeIdFor(VMap, Inst, NewBB);
 
   // Continue with the default cloning behavior.
   return CloningDirector::CloneInstruction;
 }
 
+CloningDirector::CloningAction WinEHCatchDirector::handleLandingPad(
+    ValueToValueMapTy &VMap, const LandingPadInst *LPad, BasicBlock *NewBB) {
+  Instruction *NewInst = LPad->clone();
+  if (LPad->hasName())
+    NewInst->setName(LPad->getName());
+  // Save this correlation for later processing.
+  NestedLPtoOriginalLP[cast<LandingPadInst>(NewInst)] = LPad;
+  VMap[LPad] = NewInst;
+  BasicBlock::InstListType &InstList = NewBB->getInstList();
+  InstList.push_back(NewInst);
+  InstList.push_back(new UnreachableInst(NewBB->getContext()));
+  return CloningDirector::StopCloningBB;
+}
+
 CloningDirector::CloningAction WinEHCatchDirector::handleBeginCatch(
     ValueToValueMapTy &VMap, const Instruction *Inst, BasicBlock *NewBB) {
   // The argument to the call is some form of the first element of the
   // landingpad aggregate value, but that doesn't matter.  It isn't used
   // here.
   // The second argument is an outparameter where the exception object will be
   // stored. Typically the exception object is a scalar, but it can be an
   // aggregate when catching by value.
WinEHCatchDirector::handleResume(ValueToValueMapTy &VMap,
                                  const ResumeInst *Resume, BasicBlock *NewBB) {
   // Resume instructions shouldn't be reachable from catch handlers.
   // We still need to handle it, but it will be pruned.
   BasicBlock::InstListType &InstList = NewBB->getInstList();
   InstList.push_back(new UnreachableInst(NewBB->getContext()));
   return CloningDirector::StopCloningBB;
 }
 
+CloningDirector::CloningAction WinEHCleanupDirector::handleLandingPad(
+    ValueToValueMapTy &VMap, const LandingPadInst *LPad, BasicBlock *NewBB) {
+  // The MS runtime will terminate the process if an exception occurs in a
+  // cleanup handler, so we shouldn't encounter landing pads in the actual
+  // cleanup code, but they may appear in catch blocks.  Depending on where
+  // we started cloning we may see one, but it will get dropped during dead
+  // block pruning.
+  Instruction *NewInst = new UnreachableInst(NewBB->getContext());
+  VMap[LPad] = NewInst;
+  BasicBlock::InstListType &InstList = NewBB->getInstList();
+  InstList.push_back(NewInst);
+  return CloningDirector::StopCloningBB;
+}
+
 CloningDirector::CloningAction WinEHCleanupDirector::handleBeginCatch(
     ValueToValueMapTy &VMap, const Instruction *Inst, BasicBlock *NewBB) {
   // Catch blocks within cleanup handlers will always be unreachable.
   // We'll insert an unreachable instruction now, but it will be pruned
   // before the cloning process is complete.
   BasicBlock::InstListType &InstList = NewBB->getInstList();
   InstList.push_back(new UnreachableInst(NewBB->getContext()));
   return CloningDirector::StopCloningBB;
CloningDirector::CloningAction WinEHCleanupDirector::handleResume(
   // Tell the caller to stop processing the current basic block so that
   // the branch instruction will be skipped.
   return CloningDirector::StopCloningBB;
 }
 
 WinEHFrameVariableMaterializer::WinEHFrameVariableMaterializer(
     Function *OutlinedFn, FrameVarInfoMap &FrameVarInfo)
     : FrameVarInfo(FrameVarInfo), Builder(OutlinedFn->getContext()) {
-  Builder.SetInsertPoint(&OutlinedFn->getEntryBlock());
+  BasicBlock *EntryBB = &OutlinedFn->getEntryBlock();
+  Builder.SetInsertPoint(EntryBB, EntryBB->getFirstInsertionPt());
 }
 
 Value *WinEHFrameVariableMaterializer::materializeValueFor(Value *V) {
   // If we're asked to materialize a value that is an instruction, we
   // temporarily create an alloca in the outlined function and add this
   // to the FrameVarInfo map.  When all the outlining is complete, we'll
   // collect these into a structure, spilling non-alloca values in the
   // parent frame as necessary, and replace these temporary allocas with
for (BasicBlock *Succ : successors(BB)) {
     CatchHandler *Action = findCatchHandler(Succ, NextBB, VisitedBlocks);
     if (Action)
       return Action;
   }
   return nullptr;
 }
 
 // These are helper functions to combine repeated code from findCleanupHandler.
-static CleanupHandler *createCleanupHandler(CleanupHandlerMapTy &CleanupHandlerMap,
-                                            BasicBlock *BB) {
+static CleanupHandler *
+createCleanupHandler(CleanupHandlerMapTy &CleanupHandlerMap, BasicBlock *BB) {
   CleanupHandler *Action = new CleanupHandler(BB);
   CleanupHandlerMap[BB] = Action;
   return Action;
 }
 
 // This function searches starting with the input block for the next block that
 // contains code that is not part of a catch handler and would not be eliminated
 // during handler outlining.
for (BasicBlock::iterator II = BB->getFirstNonPHIOrDbg(),
       if (LPadMap && LPadMap->isLandingPadSpecificInst(Inst))
         continue;
       // Unconditional branches fall through to this loop.
       if (Inst == Branch)
         continue;
       // If this is a catch block, there is no cleanup code to be found.
       if (match(Inst, m_Intrinsic<Intrinsic::eh_begincatch>()))
         return nullptr;
+      // If this a nested landing pad, it may contain an endcatch call.
+      if (match(Inst, m_Intrinsic<Intrinsic::eh_endcatch>()))
+        return nullptr;
       // Anything else makes this interesting cleanup code.
       return createCleanupHandler(CleanupHandlerMap, BB);
     }
 
     // Only unconditional branches in empty blocks should get this far.
     assert(Branch && Branch->isUnconditional());
     if (BB == EndBB)
       return nullptr;
     BB = Branch->getSuccessor(0);
   }
   return nullptr;
 }
+
+// This is a public function, declared in WinEHFuncInfo.h and is also
+// referenced by WinEHNumbering in FunctionLoweringInfo.cpp.
+void llvm::parseEHActions(const IntrinsicInst *II,
+  SmallVectorImpl<ActionHandler *> &Actions) {
+  for (unsigned I = 0, E = II->getNumArgOperands(); I != E;) {
+    uint64_t ActionKind =
+      cast<ConstantInt>(II->getArgOperand(I))->getZExtValue();
+    if (ActionKind == /*catch=*/1) {
+      auto *Selector = cast<Constant>(II->getArgOperand(I + 1));
+      ConstantInt *EHObjIndex = cast<ConstantInt>(II->getArgOperand(I + 2));
+      int64_t EHObjIndexVal = EHObjIndex->getSExtValue();
+      Constant *Handler = cast<Constant>(II->getArgOperand(I + 3));
+      I += 4;
+      auto *CH = new CatchHandler(/*BB=*/nullptr, Selector, /*NextBB=*/nullptr);
+      CH->setHandlerBlockOrFunc(Handler);
+      CH->setExceptionVarIndex(EHObjIndexVal);
+      Actions.push_back(CH);
+    }
+    else {
+      assert(ActionKind == 0 && "expected a cleanup or a catch action!");
+      Constant *Handler = cast<Constant>(II->getArgOperand(I + 1));
+      I += 2;
+      auto *CH = new CleanupHandler(/*BB=*/nullptr);
+      CH->setHandlerBlockOrFunc(Handler);
+      Actions.push_back(CH);
+    }
+  }
+  std::reverse(Actions.begin(), Actions.end());
+}
+

test/CodeGen/WinEH/cppeh-catch-unwind.ll

 ;
 ; CHECK: invoke.cont6:                                     ; preds = %entry
 ; CHECK:   ret i8* blockaddress(@"\01?test@@YAXXZ", %try.cont)
 ;
 ; CHECK: [[LPAD5_LABEL]]:{{[ ]+}}; preds = %entry
 ; CHECK:   [[LPAD5_VAL:\%.+]] = landingpad { i8*, i32 } personality i8* bitcast (i32 (...)* @__CxxFrameHandler3 to i8*)
 ; CHECK:           cleanup
 ; CHECK:           catch i8* bitcast (%rtti.TypeDescriptor2* @"\01??_R0H@8" to i8*)
-; CHECK:   unreachable
 ; CHECK: }
 
 declare %class.SomeClass* @"\01??0SomeClass@@QEAA@XZ"(%class.SomeClass* returned) #1
 
 declare i32 @__CxxFrameHandler3(...)
 
 declare void @"\01?may_throw@@YAXXZ"() #1
 

test/CodeGen/WinEH/cppeh-nested-1.ll

 ; RUN: opt -mtriple=x86_64-pc-windows-msvc -winehprepare -S -o - < %s | FileCheck %s
-; XFAIL: *
 
 ; This test is based on the following code:
 ;
 ;void test()
 ;{
 ;  try {
 ;    try {
 ;       may_throw();

 
 invoke.cont:                                      ; preds = %entry
   br label %try.cont
 
 ; CHECK: [[LPAD_LABEL]]:
 ; CHECK:   landingpad { i8*, i32 } personality i8* bitcast (i32 (...)* @__CxxFrameHandler3 to i8*)
 ; CHECK:           catch i8* bitcast (%rtti.TypeDescriptor2* @"\01??_R0H@8" to i8*)
 ; CHECK:           catch i8* bitcast (%rtti.TypeDescriptor2* @"\01??_R0M@8" to i8*)
-; CHECK:   [[RECOVER:\%.+]] = call i8* (...)* @llvm.eh.actions(i32 0, i8* bitcast (%rtti.TypeDescriptor2* @"\01??_R0H@8" to i8*), i32* %i, i8* (i8*, i8*)* @"\01?test@@YAXXZ.catch" to i8*), i32 1, i8* bitcast (%rtti.TypeDescriptor2* @"\01??_R0M@8" to i8*), float* %f, i8* bitcast (i8* (i8*, i8*)* @"\01?test@@YAXXZ.catch1")
+; CHECK:   [[RECOVER:\%.+]] = call i8* (...)* @llvm.eh.actions(i32 1, i8* bitcast (%rtti.TypeDescriptor2* @"\01??_R0H@8" to i8*), i32 0, i8* (i8*, i8*)* @"\01?test@@YAXXZ.catch", i32 1, i8* bitcast (%rtti.TypeDescriptor2* @"\01??_R0M@8" to i8*), i32 1, i8* (i8*, i8*)* @"\01?test@@YAXXZ.catch1")
 ; CHECK:   indirectbr i8* [[RECOVER]], [label %try.cont, label %try.cont10]
 
 lpad:                                             ; preds = %entry
   %0 = landingpad { i8*, i32 } personality i8* bitcast (i32 (...)* @__CxxFrameHandler3 to i8*)
           catch i8* bitcast (%rtti.TypeDescriptor2* @"\01??_R0H@8" to i8*)
           catch i8* bitcast (%rtti.TypeDescriptor2* @"\01??_R0M@8" to i8*)
   %1 = extractvalue { i8*, i32 } %0, 0
   store i8* %1, i8** %exn.slot
eh.resume:                                        ; %catch.dispatch3
   resume { i8*, i32 } %lpad.val13
 ; CHECK: }
 }
 
 ; CHECK: define internal i8* @"\01?test@@YAXXZ.catch"(i8*, i8*)
 ; CHECK: entry:
 ; CHECK:   [[RECOVER_I:\%.+]] = call i8* @llvm.framerecover(i8* bitcast (void ()* @"\01?test@@YAXXZ" to i8*), i8* %1, i32 0)
 ; CHECK:   [[I_PTR:\%.+]] = bitcast i8* [[RECOVER_I]] to i32*
-; ------------================= FAIL here =================------------
-; CHECK:   [[RECOVER_F:\%.+]] = call i8* @llvm.framerecover(i8* bitcast (void ()* @"\01?test@@YAXXZ" to i8*), i8* %1, i32 1)
-; CHECK:   [[F_PTR:\%.+]] = bitcast i8* [[RECOVER_F]] to float*
 ; CHECK:   [[TMP1:\%.+]] = load i32, i32* [[I_PTR]], align 4
 ; CHECK:   invoke void @"\01?handle_int@@YAXH@Z"(i32 [[TMP1]])
 ; CHECK:           to label %invoke.cont2 unwind label %[[LPAD1_LABEL:lpad[0-9]*]]
 ;
 ; CHECK: invoke.cont2:
 ; CHECK:   ret i8* blockaddress(@"\01?test@@YAXXZ", %try.cont)
 ;
 ; CHECK: [[LPAD1_LABEL]]:{{[ ]+}}; preds = %entry
 ; CHECK:   [[LPAD1_VAL:\%.+]] = landingpad { i8*, i32 } personality i8* bitcast (i32 (...)* @__CxxFrameHandler3 to i8*)
 ; CHECK:           catch i8* bitcast (%rtti.TypeDescriptor2* @"\01??_R0M@8" to i8*)
-; ------------================= FAIL here =================------------
-; CHECK:   [[RECOVER1:\%.+]] = call i8* (...)* @llvm.eh.actions({ i8*, i32 } [[LPAD1_VAL]], i32 1, i8* bitcast (%rtti.TypeDescriptor2* @"\01??_R0M@8" to i8*), float* [[F_PTR]], i8* (i8*, i8*)* @"\01?test@@YAXXZ.catch1")
+; CHECK:   [[RECOVER1:\%.+]] = call i8* (...)* @llvm.eh.actions(i32 1, i8* bitcast (%rtti.TypeDescriptor2* @"\01??_R0M@8" to i8*), i32 1, i8* (i8*, i8*)* @"\01?test@@YAXXZ.catch1")
 ; CHECK:   indirectbr i8* [[RECOVER1]], []
 ;
 ; CHECK: }
 
 ; CHECK: define internal i8* @"\01?test@@YAXXZ.catch1"(i8*, i8*)
 ; CHECK: entry:
 ; CHECK:   [[RECOVER_F1:\%.+]] = call i8* @llvm.framerecover(i8* bitcast (void ()* @"\01?test@@YAXXZ" to i8*), i8* %1, i32 1)
 ; CHECK:   [[F_PTR1:\%.+]] = bitcast i8* [[RECOVER_F1]] to float*

test/CodeGen/WinEH/cppeh-nested-3.ll

 ; RUN: opt -mtriple=x86_64-pc-windows-msvc -winehprepare -S -o - < %s | FileCheck %s
-; XFAIL: *
 
 ; This test is based on the following code:
 ;
 ;void test()
 ;{
 ;  try {
 ;    try {
 ;       may_throw();

 
 @"\01??_7type_info@@6B@" = external constant i8*
 @"\01??_R0M@8" = linkonce_odr global %rtti.TypeDescriptor2 { i8** @"\01??_7type_info@@6B@", i8* null, [3 x i8] c".M\00" }, comdat
 @"\01??_R0H@8" = linkonce_odr global %rtti.TypeDescriptor2 { i8** @"\01??_7type_info@@6B@", i8* null, [3 x i8] c".H\00" }, comdat
 
 ; CHECK: define void @"\01?test@@YAXXZ"()
 ; CHECK: entry:
 ; CHECK:   %i = alloca i32, align 4
-; ------------================= FAIL here =================------------
 ; CHECK:   %j = alloca i32, align 4
 ; CHECK:   %f = alloca float, align 4
-; ------------================= FAIL here =================------------
-; CHECK:   call void (...)* @llvm.frameescape(i32* %i, float* %f, int32* %j)
+; CHECK:   call void (...)* @llvm.frameescape(i32* %i, float* %f, i32* %j)
 ; CHECK:   invoke void @"\01?may_throw@@YAXXZ"()
 ; CHECK:           to label %invoke.cont unwind label %[[LPAD_LABEL:lpad[0-9]*]]
 
 ; Function Attrs: uwtable
 define void @"\01?test@@YAXXZ"() #0 {
 entry:
   %exn.slot = alloca i8*
   %ehselector.slot = alloca i32
   %i = alloca i32, align 4
   %j = alloca i32, align 4
   %f = alloca float, align 4
   invoke void @"\01?may_throw@@YAXXZ"()
           to label %invoke.cont unwind label %lpad
 
 invoke.cont:                                      ; preds = %entry
   br label %try.cont10
 
 ; CHECK: [[LPAD_LABEL]]:
 ; CHECK:   landingpad { i8*, i32 } personality i8* bitcast (i32 (...)* @__CxxFrameHandler3 to i8*)
 ; CHECK:           catch i8* bitcast (%rtti.TypeDescriptor2* @"\01??_R0H@8" to i8*)
 ; CHECK:           catch i8* bitcast (%rtti.TypeDescriptor2* @"\01??_R0M@8" to i8*)
-; CHECK:   [[RECOVER:\%.+]] = call i8* (...)* @llvm.eh.actions(i32 0, i8* bitcast (%rtti.TypeDescriptor2* @"\01??_R0H@8" to i8*), i32* %i, i8* (i8*, i8*)* @"\01?test@@YAXXZ.catch" to i8*), i32 1, i8* bitcast (%rtti.TypeDescriptor2* @"\01??_R0M@8" to i8*), float* %f, i8* bitcast (i8* (i8*, i8*)* @"\01?test@@YAXXZ.catch1")
+; CHECK:   [[RECOVER:\%.+]] = call i8* (...)* @llvm.eh.actions(i32 1, i8* bitcast (%rtti.TypeDescriptor2* @"\01??_R0H@8" to i8*), i32 0, i8* (i8*, i8*)* @"\01?test@@YAXXZ.catch", i32 1, i8* bitcast (%rtti.TypeDescriptor2* @"\01??_R0M@8" to i8*), i32 1, i8* (i8*, i8*)* @"\01?test@@YAXXZ.catch1")
 ; CHECK:   indirectbr i8* [[RECOVER]], [label %try.cont10, label %try.cont19]
 
 lpad:                                             ; preds = %entry
   %0 = landingpad { i8*, i32 } personality i8* bitcast (i32 (...)* @__CxxFrameHandler3 to i8*)
           catch i8* bitcast (%rtti.TypeDescriptor2* @"\01??_R0H@8" to i8*)
           catch i8* bitcast (%rtti.TypeDescriptor2* @"\01??_R0M@8" to i8*)
   %1 = extractvalue { i8*, i32 } %0, 0
   store i8* %1, i8** %exn.slot
eh.resume:                                        ; preds = %lpad16, %catch.dispatch11
   resume { i8*, i32 } %lpad.val22
 ; CHECK: }
 }
 
 ; CHECK: define internal i8* @"\01?test@@YAXXZ.catch"(i8*, i8*)
 ; CHECK: entry:
 ; CHECK:   [[RECOVER_I:\%.+]] = call i8* @llvm.framerecover(i8* bitcast (void ()* @"\01?test@@YAXXZ" to i8*), i8* %1, i32 0)
 ; CHECK:   [[I_PTR:\%.+]] = bitcast i8* [[RECOVER_I]] to i32*
-; ------------================= FAIL here =================------------
-; CHECK:   [[RECOVER_F:\%.+]] = call i8* @llvm.framerecover(i8* bitcast (void ()* @"\01?test@@YAXXZ" to i8*), i8* %1, i32 1)
-; CHECK:   [[F_PTR:\%.+]] = bitcast i8* [[RECOVER_F]] to float*
-; ------------================= FAIL here =================------------
-; CHECK:   [[RECOVER_J:\%.+]] = call i8* @llvm.framerecover(i8* bitcast (void ()* @"\01?test@@YAXXZ" to i8*), i8* %1, i32 2)
-; CHECK:   [[J_PTR:\%.+]] = bitcast i8* [[RECOVER_I]] to i32*
 ; CHECK:   invoke void @"\01?may_throw@@YAXXZ"()
 ; CHECK:           to label %invoke.cont2 unwind label %[[LPAD1_LABEL:lpad[0-9]*]]
 ;
-; CHECK: invoke.cont2:                                     ; preds = %entry
+; CHECK: invoke.cont2:                                     ; preds = %[[LPAD1_LABEL]], %entry
 ; CHECK:   [[TMP1:\%.+]] = load i32, i32* [[I_PTR]], align 4
 ; CHECK:   invoke void @"\01?handle_int@@YAXH@Z"(i32 [[TMP1]])
 ; CHECK:           to label %invoke.cont9 unwind label %[[LPAD8_LABEL:lpad[0-9]*]]
 ;
 ; CHECK: [[LPAD1_LABEL]]:{{[ ]+}}; preds = %entry
 ; CHECK:   [[LPAD1_VAL:\%.+]] = landingpad { i8*, i32 } personality i8* bitcast (i32 (...)* @__CxxFrameHandler3 to i8*)
 ; CHECK:           catch i8* bitcast (%rtti.TypeDescriptor2* @"\01??_R0H@8" to i8*)
 ; CHECK:           catch i8* bitcast (%rtti.TypeDescriptor2* @"\01??_R0M@8" to i8*)
-; ------------================= FAIL here =================------------
-; CHECK:   [[RECOVER1:\%.+]] = call i8* (...)* @llvm.eh.actions({ i8*, i32 } [[LPAD1_VAL]], i32 0, i8* bitcast (%rtti.TypeDescriptor2* @"\01??_R0H@8" to i8*), i32* [[J_PTR]], i8* (i8*, i8*)* @"\01?test@@YAXXZ.catch2" to i8*), i32 1, i8* bitcast (%rtti.TypeDescriptor2* @"\01??_R0M@8" to i8*), float* [[F_PTR1]], i8* bitcast (i8* (i8*, i8*)* @"\01?test@@YAXXZ.catch1")
-; CHECK:   indirectbr i8* [[RECOVER1]], []
+; CHECK:   [[RECOVER1:\%.+]] = call i8* (...)* @llvm.eh.actions(i32 1, i8* bitcast (%rtti.TypeDescriptor2* @"\01??_R0H@8" to i8*), i32 2, i8* (i8*, i8*)* @"\01?test@@YAXXZ.catch2", i32 1, i8* bitcast (%rtti.TypeDescriptor2* @"\01??_R0M@8" to i8*), i32 1, i8* (i8*, i8*)* @"\01?test@@YAXXZ.catch1")
+; CHECK:   indirectbr i8* [[RECOVER1]], [label %invoke.cont2]
 ;
 ; CHECK: invoke.cont9:
 ; CHECK:   ret i8* blockaddress(@"\01?test@@YAXXZ", %try.cont10)
 ;
 ; CHECK: [[LPAD8_LABEL]]:{{[ ]+}}; preds = %invoke.cont2
 ; CHECK:   [[LPAD8_VAL:\%.+]] = landingpad { i8*, i32 } personality i8* bitcast (i32 (...)* @__CxxFrameHandler3 to i8*)
 ; CHECK:           catch i8* bitcast (%rtti.TypeDescriptor2* @"\01??_R0M@8" to i8*)
-; ------------================= FAIL here =================------------
-; CHECK:   [[RECOVER2:\%.+]] = call i8* (...)* @llvm.eh.actions({ i8*, i32 } [[LPAD8_VAL]], i32 1, i8* bitcast (%rtti.TypeDescriptor2* @"\01??_R0M@8" to i8*), float* [[F_PTR1]], i8* (i8*, i8*)* @"\01?test@@YAXXZ.catch1")
+; CHECK:   [[RECOVER2:\%.+]] = call i8* (...)* @llvm.eh.actions(i32 1, i8* bitcast (%rtti.TypeDescriptor2* @"\01??_R0M@8" to i8*), i32 1, i8* (i8*, i8*)* @"\01?test@@YAXXZ.catch1")
 ; CHECK:   indirectbr i8* [[RECOVER2]], []
 ;
 ; CHECK: }
 
 ; CHECK: define internal i8* @"\01?test@@YAXXZ.catch1"(i8*, i8*)
 ; CHECK: entry:
-; CHECK:   [[RECOVER_F1:\%.+]] = call i8* @llvm.framerecover(i8* bitcast (void ()* @"\01?test@@YAXXZ" to i8*), i8* %1, i32 1)
-; CHECK:   [[F_PTR1:\%.+]] = bitcast i8* [[RECOVER_F1]] to float*
-; CHECK:   [[TMP2:\%.+]] = load float, float* [[F_PTR1]], align 4
+; CHECK:   [[RECOVER_F:\%.+]] = call i8* @llvm.framerecover(i8* bitcast (void ()* @"\01?test@@YAXXZ" to i8*), i8* %1, i32 1)
+; CHECK:   [[F_PTR:\%.+]] = bitcast i8* [[RECOVER_F]] to float*
+; CHECK:   [[TMP2:\%.+]] = load float, float* [[F_PTR]], align 4
 ; CHECK:   call void @"\01?handle_float@@YAXM@Z"(float [[TMP2]])
 ; CHECK:   ret i8* blockaddress(@"\01?test@@YAXXZ", %try.cont19)
 ; CHECK: }
 
 ; CHECK: define internal i8* @"\01?test@@YAXXZ.catch2"(i8*, i8*)
 ; CHECK: entry:
-; ------------================= FAIL here =================------------
-; SHOULD-CHECK:   [[J_PTR1:\%.+]] = call i8* @llvm.framerecover(i8* bitcast (void ()* @"\01?test@@YAXXZ" to i8*), i8* %1, i32 2)
+; CHECK:   [[RECOVER_J:\%.+]] = call i8* @llvm.framerecover(i8* bitcast (void ()* @"\01?test@@YAXXZ" to i8*), i8* %1, i32 2)
+; CHECK:   [[J_PTR:\%.+]] = bitcast i8* [[RECOVER_J]] to i32*
 ; CHECK:   [[RECOVER_I1:\%.+]] = call i8* @llvm.framerecover(i8* bitcast (void ()* @"\01?test@@YAXXZ" to i8*), i8* %1, i32 0)
 ; CHECK:   [[I_PTR1:\%.+]] = bitcast i8* [[RECOVER_I1]] to i32*
-; CHECK:   [[TMP3:\%.+]] = load i32, i32* [[J_PTR1]], align 4
+; CHECK:   [[TMP3:\%.+]] = load i32, i32* [[J_PTR]], align 4
 ; CHECK:   store i32 [[TMP3]], i32* [[I_PTR1]]
-; ------------================= FAIL here =================------------
 ; CHECK:   ret i8* blockaddress(@"\01?test@@YAXXZ.catch", %invoke.cont2)
 ; CHECK: }
 
 
 declare void @"\01?may_throw@@YAXXZ"() #1
 
 declare i32 @__CxxFrameHandler3(...)