Skip to content

release/22.x: [CoroSplit] Never collect allocas used by catchpad into frame (#186728)#193917

Closed
llvmbot wants to merge 1 commit into
llvm:release/22.xfrom
llvmbot:issue186728
Closed

release/22.x: [CoroSplit] Never collect allocas used by catchpad into frame (#186728)#193917
llvmbot wants to merge 1 commit into
llvm:release/22.xfrom
llvmbot:issue186728

Conversation

@llvmbot

@llvmbot llvmbot commented Apr 24, 2026

Copy link
Copy Markdown
Member

Backport 80603c6

Requested by: @NewSigma

…86728)

Windows EH requires exception objects allocated on stack. But there is
no reliable way to identify them. CoroSplit employs a best-effort
algorithm to determine whether allocas persist on the stack or the
frame, which may result in miscompilation when Windows exceptions are
used.
This patch proposes that we treat allocas used by catchpad as exception
objects and never place them on the frame. A verifier check is added to
enforce that operands of catchpad are either constants or allocas.

Close llvm#143235 Close llvm#153949 Close llvm#182584

(cherry picked from commit 80603c6)
@llvmbot

llvmbot commented Apr 24, 2026

Copy link
Copy Markdown
Member Author

@ChuanqiXu9 @efriedma-quic What do you think about merging this PR to the release branch?

@llvmbot

llvmbot commented Apr 24, 2026

Copy link
Copy Markdown
Member Author

@llvm/pr-subscribers-coroutines

Author: llvmbot

Changes

Backport 80603c6

Requested by: @NewSigma


Full diff: https://github.com/llvm/llvm-project/pull/193917.diff

7 Files Affected:

  • (modified) llvm/docs/Coroutines.rst (+3)
  • (modified) llvm/docs/LangRef.rst (+3-2)
  • (modified) llvm/lib/FuzzMutate/RandomIRBuilder.cpp (+5)
  • (modified) llvm/lib/IR/Verifier.cpp (+7)
  • (modified) llvm/lib/Transforms/Coroutines/SpillUtils.cpp (+7)
  • (added) llvm/test/Transforms/Coroutines/coro-alloca-10.ll (+66)
  • (modified) llvm/unittests/FuzzMutate/StrategiesTest.cpp (+2-1)
diff --git a/llvm/docs/Coroutines.rst b/llvm/docs/Coroutines.rst
index 0e6b49c84acee..9fa403e68e13b 100644
--- a/llvm/docs/Coroutines.rst
+++ b/llvm/docs/Coroutines.rst
@@ -2252,4 +2252,7 @@ Areas Requiring Attention
 #. Make required changes to make sure that coroutine optimizations work with
    LTO.
 
+#. In Windows EH, exception objects must be allocated on the stack (see :ref:wineh for details).
+   We identify an exception object as an alloca that has `catchpad` users.
+
 #. More tests, more tests, more tests
diff --git a/llvm/docs/LangRef.rst b/llvm/docs/LangRef.rst
index be752b42ea412..1e0293f67e833 100644
--- a/llvm/docs/LangRef.rst
+++ b/llvm/docs/LangRef.rst
@@ -13825,8 +13825,9 @@ ensures that each ``catchpad`` has exactly one predecessor block, and it always
 terminates in a ``catchswitch``.
 
 The ``args`` correspond to whatever information the personality routine
-requires to determine if this is an appropriate handler for the exception. Control
-will transfer to the ``catchpad`` if this is the first appropriate handler for
+requires to determine if this is an appropriate handler for the exception.
+Each operand must be an alloca or a constant.
+Control will transfer to the ``catchpad`` if this is the first appropriate handler for
 the exception.
 
 The ``resultval`` has the type :ref:`token <t_token>` and is used to match the
diff --git a/llvm/lib/FuzzMutate/RandomIRBuilder.cpp b/llvm/lib/FuzzMutate/RandomIRBuilder.cpp
index 8b034137e4702..87392c2e69299 100644
--- a/llvm/lib/FuzzMutate/RandomIRBuilder.cpp
+++ b/llvm/lib/FuzzMutate/RandomIRBuilder.cpp
@@ -332,6 +332,11 @@ static bool isCompatibleReplacement(const Instruction *I, const Use &Operand,
       return false;
     return !Callee->hasParamAttribute(OperandNo, Attribute::ImmArg);
   }
+  case Instruction::CatchPad:
+    // Argument operand must be alloca or constant
+    if (!isa<Constant>(Replacement) && !isa<AllocaInst>(Replacement))
+      return false;
+    break;
   default:
     break;
   }
diff --git a/llvm/lib/IR/Verifier.cpp b/llvm/lib/IR/Verifier.cpp
index bb552861130d2..bdca6800eddfe 100644
--- a/llvm/lib/IR/Verifier.cpp
+++ b/llvm/lib/IR/Verifier.cpp
@@ -4911,6 +4911,13 @@ void Verifier::visitCatchPadInst(CatchPadInst &CPI) {
   Check(&*BB->getFirstNonPHIIt() == &CPI,
         "CatchPadInst not the first non-PHI instruction in the block.", &CPI);
 
+  Check(llvm::all_of(CPI.arg_operands(),
+                     [](Use &U) {
+                       auto *V = U.get();
+                       return isa<Constant>(V) || isa<AllocaInst>(V);
+                     }),
+        "Argument operand must be alloca or constant.", &CPI);
+
   visitEHPadPredecessors(CPI);
   visitFuncletPadInst(CPI);
 }
diff --git a/llvm/lib/Transforms/Coroutines/SpillUtils.cpp b/llvm/lib/Transforms/Coroutines/SpillUtils.cpp
index 81fe0c9acd413..05abccf0f9a97 100644
--- a/llvm/lib/Transforms/Coroutines/SpillUtils.cpp
+++ b/llvm/lib/Transforms/Coroutines/SpillUtils.cpp
@@ -180,6 +180,13 @@ struct AllocaUseVisitor : PtrUseVisitor<AllocaUseVisitor> {
     handleAlias(I);
   }
 
+  void visitCatchPadInst(CatchPadInst &I) {
+    // Windows EH requires exception objects allocated on the stack,
+    // shortcut the traversal and keep it on stack.
+    ShouldLiveOnFrame = false;
+    Base::Worklist.clear();
+  }
+
   void visitInsertElementInst(InsertElementInst &I) {
     enqueueUsers(I);
     handleAlias(I);
diff --git a/llvm/test/Transforms/Coroutines/coro-alloca-10.ll b/llvm/test/Transforms/Coroutines/coro-alloca-10.ll
new file mode 100644
index 0000000000000..12e2a921aa769
--- /dev/null
+++ b/llvm/test/Transforms/Coroutines/coro-alloca-10.ll
@@ -0,0 +1,66 @@
+; NOTE: Assertions have been autogenerated by utils/update_test_checks.py UTC_ARGS: --version 6
+; Test that catchpad is specially handled. Do not collect exception object into coroutine frame.
+; RUN: opt < %s -passes='coro-split,simplifycfg,early-cse' -S | FileCheck %s
+
+define void @fn() presplitcoroutine personality i32 0 {
+; CHECK-LABEL: define void @fn() personality i32 0 {
+; CHECK-NEXT:  [[ENTRY:.*:]]
+; CHECK-NEXT:    [[EXCEPTION_OBJ_RELOAD_ADDR:%.*]] = alloca ptr, align 8
+; CHECK-NEXT:    [[ID:%.*]] = call token @llvm.coro.id(i32 16, ptr null, ptr null, ptr @fn.resumers)
+; CHECK-NEXT:    [[MEM:%.*]] = call noalias nonnull ptr @malloc(i64 24)
+; CHECK-NEXT:    [[HDL:%.*]] = call noalias nonnull ptr @llvm.coro.begin(token [[ID]], ptr [[MEM]])
+; CHECK-NEXT:    store ptr @fn.resume, ptr [[HDL]], align 8
+; CHECK-NEXT:    [[DESTROY_ADDR:%.*]] = getelementptr inbounds i8, ptr [[HDL]], i64 8
+; CHECK-NEXT:    store ptr @fn.destroy, ptr [[DESTROY_ADDR]], align 8
+; CHECK-NEXT:    store ptr null, ptr [[EXCEPTION_OBJ_RELOAD_ADDR]], align 8
+; CHECK-NEXT:    [[INDEX_ADDR4:%.*]] = getelementptr inbounds i8, ptr [[HDL]], i64 16
+; CHECK-NEXT:    store i1 false, ptr [[INDEX_ADDR4]], align 1
+; CHECK-NEXT:    ret void
+;
+entry:
+  %exception.obj = alloca ptr, align 8
+  %id = call token @llvm.coro.id(i32 16, ptr null, ptr null, ptr null)
+  %size = call i64 @llvm.coro.size.i64()
+  %mem = call noalias nonnull ptr @malloc(i64 %size)
+  %hdl = call ptr @llvm.coro.begin(token %id, ptr %mem)
+  store ptr null, ptr %exception.obj, align 8
+  br label %while
+
+while:
+  %save = call token @llvm.coro.save(ptr null)
+  %suspend = call i8 @llvm.coro.suspend(token %save, i1 false)
+  switch i8 %suspend, label %coro.ret [
+  i8 0, label %await.ready
+  ]
+
+await.ready:
+  invoke void @throw()
+  to label %unreachable unwind label %catch.dispatch
+
+catch.dispatch:
+  %switch = catchswitch within none [label %catch] unwind label %ehcleanup
+
+catch:
+  %pad = catchpad within %switch [ptr null, i32 8, ptr %exception.obj]
+  invoke void @use(ptr %exception.obj) [ "funclet"(token %pad) ]
+  to label %catch.ret unwind label %ehcleanup
+
+catch.ret:
+  catchret from %pad to label %while
+
+ehcleanup:
+  %cleanup = cleanuppad within none []
+  call void @llvm.coro.end(ptr null, i1 true, token none) [ "funclet"(token %cleanup) ]
+  cleanupret from %cleanup unwind to caller
+
+coro.ret:
+  call void @llvm.coro.end(ptr null, i1 false, token none)
+  ret void
+
+unreachable:
+  unreachable
+}
+
+declare ptr @malloc(i64)
+declare void @throw()
+declare void @use(ptr)
diff --git a/llvm/unittests/FuzzMutate/StrategiesTest.cpp b/llvm/unittests/FuzzMutate/StrategiesTest.cpp
index fd91066b994a5..278cce20119c6 100644
--- a/llvm/unittests/FuzzMutate/StrategiesTest.cpp
+++ b/llvm/unittests/FuzzMutate/StrategiesTest.cpp
@@ -733,11 +733,12 @@ TEST(AllStrategies, SkipEHPad) {
   StringRef Source = "\n\
     define void @f(i32 %x) personality ptr @__CxxFrameHandler3 { \n\
     entry: \n\
+      %I = alloca i32, align 4 \n\
       invoke void @g() to label %try.cont unwind label %catch.dispatch \n\
     catch.dispatch: \n\
       %0 = catchswitch within none [label %catch] unwind to caller \n\
     catch: \n\
-      %1 = catchpad within %0 [ptr null, i32 64, ptr null] \n\
+      %1 = catchpad within %0 [ptr null, i32 64, ptr %I] \n\
       catchret from %1 to label %try.cont \n\
     try.cont: \n\
       ret void \n\

@llvmbot

llvmbot commented Apr 24, 2026

Copy link
Copy Markdown
Member Author

@llvm/pr-subscribers-llvm-transforms

Author: llvmbot

Changes

Backport 80603c6

Requested by: @NewSigma


Full diff: https://github.com/llvm/llvm-project/pull/193917.diff

7 Files Affected:

  • (modified) llvm/docs/Coroutines.rst (+3)
  • (modified) llvm/docs/LangRef.rst (+3-2)
  • (modified) llvm/lib/FuzzMutate/RandomIRBuilder.cpp (+5)
  • (modified) llvm/lib/IR/Verifier.cpp (+7)
  • (modified) llvm/lib/Transforms/Coroutines/SpillUtils.cpp (+7)
  • (added) llvm/test/Transforms/Coroutines/coro-alloca-10.ll (+66)
  • (modified) llvm/unittests/FuzzMutate/StrategiesTest.cpp (+2-1)
diff --git a/llvm/docs/Coroutines.rst b/llvm/docs/Coroutines.rst
index 0e6b49c84acee..9fa403e68e13b 100644
--- a/llvm/docs/Coroutines.rst
+++ b/llvm/docs/Coroutines.rst
@@ -2252,4 +2252,7 @@ Areas Requiring Attention
 #. Make required changes to make sure that coroutine optimizations work with
    LTO.
 
+#. In Windows EH, exception objects must be allocated on the stack (see :ref:wineh for details).
+   We identify an exception object as an alloca that has `catchpad` users.
+
 #. More tests, more tests, more tests
diff --git a/llvm/docs/LangRef.rst b/llvm/docs/LangRef.rst
index be752b42ea412..1e0293f67e833 100644
--- a/llvm/docs/LangRef.rst
+++ b/llvm/docs/LangRef.rst
@@ -13825,8 +13825,9 @@ ensures that each ``catchpad`` has exactly one predecessor block, and it always
 terminates in a ``catchswitch``.
 
 The ``args`` correspond to whatever information the personality routine
-requires to determine if this is an appropriate handler for the exception. Control
-will transfer to the ``catchpad`` if this is the first appropriate handler for
+requires to determine if this is an appropriate handler for the exception.
+Each operand must be an alloca or a constant.
+Control will transfer to the ``catchpad`` if this is the first appropriate handler for
 the exception.
 
 The ``resultval`` has the type :ref:`token <t_token>` and is used to match the
diff --git a/llvm/lib/FuzzMutate/RandomIRBuilder.cpp b/llvm/lib/FuzzMutate/RandomIRBuilder.cpp
index 8b034137e4702..87392c2e69299 100644
--- a/llvm/lib/FuzzMutate/RandomIRBuilder.cpp
+++ b/llvm/lib/FuzzMutate/RandomIRBuilder.cpp
@@ -332,6 +332,11 @@ static bool isCompatibleReplacement(const Instruction *I, const Use &Operand,
       return false;
     return !Callee->hasParamAttribute(OperandNo, Attribute::ImmArg);
   }
+  case Instruction::CatchPad:
+    // Argument operand must be alloca or constant
+    if (!isa<Constant>(Replacement) && !isa<AllocaInst>(Replacement))
+      return false;
+    break;
   default:
     break;
   }
diff --git a/llvm/lib/IR/Verifier.cpp b/llvm/lib/IR/Verifier.cpp
index bb552861130d2..bdca6800eddfe 100644
--- a/llvm/lib/IR/Verifier.cpp
+++ b/llvm/lib/IR/Verifier.cpp
@@ -4911,6 +4911,13 @@ void Verifier::visitCatchPadInst(CatchPadInst &CPI) {
   Check(&*BB->getFirstNonPHIIt() == &CPI,
         "CatchPadInst not the first non-PHI instruction in the block.", &CPI);
 
+  Check(llvm::all_of(CPI.arg_operands(),
+                     [](Use &U) {
+                       auto *V = U.get();
+                       return isa<Constant>(V) || isa<AllocaInst>(V);
+                     }),
+        "Argument operand must be alloca or constant.", &CPI);
+
   visitEHPadPredecessors(CPI);
   visitFuncletPadInst(CPI);
 }
diff --git a/llvm/lib/Transforms/Coroutines/SpillUtils.cpp b/llvm/lib/Transforms/Coroutines/SpillUtils.cpp
index 81fe0c9acd413..05abccf0f9a97 100644
--- a/llvm/lib/Transforms/Coroutines/SpillUtils.cpp
+++ b/llvm/lib/Transforms/Coroutines/SpillUtils.cpp
@@ -180,6 +180,13 @@ struct AllocaUseVisitor : PtrUseVisitor<AllocaUseVisitor> {
     handleAlias(I);
   }
 
+  void visitCatchPadInst(CatchPadInst &I) {
+    // Windows EH requires exception objects allocated on the stack,
+    // shortcut the traversal and keep it on stack.
+    ShouldLiveOnFrame = false;
+    Base::Worklist.clear();
+  }
+
   void visitInsertElementInst(InsertElementInst &I) {
     enqueueUsers(I);
     handleAlias(I);
diff --git a/llvm/test/Transforms/Coroutines/coro-alloca-10.ll b/llvm/test/Transforms/Coroutines/coro-alloca-10.ll
new file mode 100644
index 0000000000000..12e2a921aa769
--- /dev/null
+++ b/llvm/test/Transforms/Coroutines/coro-alloca-10.ll
@@ -0,0 +1,66 @@
+; NOTE: Assertions have been autogenerated by utils/update_test_checks.py UTC_ARGS: --version 6
+; Test that catchpad is specially handled. Do not collect exception object into coroutine frame.
+; RUN: opt < %s -passes='coro-split,simplifycfg,early-cse' -S | FileCheck %s
+
+define void @fn() presplitcoroutine personality i32 0 {
+; CHECK-LABEL: define void @fn() personality i32 0 {
+; CHECK-NEXT:  [[ENTRY:.*:]]
+; CHECK-NEXT:    [[EXCEPTION_OBJ_RELOAD_ADDR:%.*]] = alloca ptr, align 8
+; CHECK-NEXT:    [[ID:%.*]] = call token @llvm.coro.id(i32 16, ptr null, ptr null, ptr @fn.resumers)
+; CHECK-NEXT:    [[MEM:%.*]] = call noalias nonnull ptr @malloc(i64 24)
+; CHECK-NEXT:    [[HDL:%.*]] = call noalias nonnull ptr @llvm.coro.begin(token [[ID]], ptr [[MEM]])
+; CHECK-NEXT:    store ptr @fn.resume, ptr [[HDL]], align 8
+; CHECK-NEXT:    [[DESTROY_ADDR:%.*]] = getelementptr inbounds i8, ptr [[HDL]], i64 8
+; CHECK-NEXT:    store ptr @fn.destroy, ptr [[DESTROY_ADDR]], align 8
+; CHECK-NEXT:    store ptr null, ptr [[EXCEPTION_OBJ_RELOAD_ADDR]], align 8
+; CHECK-NEXT:    [[INDEX_ADDR4:%.*]] = getelementptr inbounds i8, ptr [[HDL]], i64 16
+; CHECK-NEXT:    store i1 false, ptr [[INDEX_ADDR4]], align 1
+; CHECK-NEXT:    ret void
+;
+entry:
+  %exception.obj = alloca ptr, align 8
+  %id = call token @llvm.coro.id(i32 16, ptr null, ptr null, ptr null)
+  %size = call i64 @llvm.coro.size.i64()
+  %mem = call noalias nonnull ptr @malloc(i64 %size)
+  %hdl = call ptr @llvm.coro.begin(token %id, ptr %mem)
+  store ptr null, ptr %exception.obj, align 8
+  br label %while
+
+while:
+  %save = call token @llvm.coro.save(ptr null)
+  %suspend = call i8 @llvm.coro.suspend(token %save, i1 false)
+  switch i8 %suspend, label %coro.ret [
+  i8 0, label %await.ready
+  ]
+
+await.ready:
+  invoke void @throw()
+  to label %unreachable unwind label %catch.dispatch
+
+catch.dispatch:
+  %switch = catchswitch within none [label %catch] unwind label %ehcleanup
+
+catch:
+  %pad = catchpad within %switch [ptr null, i32 8, ptr %exception.obj]
+  invoke void @use(ptr %exception.obj) [ "funclet"(token %pad) ]
+  to label %catch.ret unwind label %ehcleanup
+
+catch.ret:
+  catchret from %pad to label %while
+
+ehcleanup:
+  %cleanup = cleanuppad within none []
+  call void @llvm.coro.end(ptr null, i1 true, token none) [ "funclet"(token %cleanup) ]
+  cleanupret from %cleanup unwind to caller
+
+coro.ret:
+  call void @llvm.coro.end(ptr null, i1 false, token none)
+  ret void
+
+unreachable:
+  unreachable
+}
+
+declare ptr @malloc(i64)
+declare void @throw()
+declare void @use(ptr)
diff --git a/llvm/unittests/FuzzMutate/StrategiesTest.cpp b/llvm/unittests/FuzzMutate/StrategiesTest.cpp
index fd91066b994a5..278cce20119c6 100644
--- a/llvm/unittests/FuzzMutate/StrategiesTest.cpp
+++ b/llvm/unittests/FuzzMutate/StrategiesTest.cpp
@@ -733,11 +733,12 @@ TEST(AllStrategies, SkipEHPad) {
   StringRef Source = "\n\
     define void @f(i32 %x) personality ptr @__CxxFrameHandler3 { \n\
     entry: \n\
+      %I = alloca i32, align 4 \n\
       invoke void @g() to label %try.cont unwind label %catch.dispatch \n\
     catch.dispatch: \n\
       %0 = catchswitch within none [label %catch] unwind to caller \n\
     catch: \n\
-      %1 = catchpad within %0 [ptr null, i32 64, ptr null] \n\
+      %1 = catchpad within %0 [ptr null, i32 64, ptr %I] \n\
       catchret from %1 to label %try.cont \n\
     try.cont: \n\
       ret void \n\

@llvmbot

llvmbot commented Apr 24, 2026

Copy link
Copy Markdown
Member Author

@llvm/pr-subscribers-llvm-ir

Author: llvmbot

Changes

Backport 80603c6

Requested by: @NewSigma


Full diff: https://github.com/llvm/llvm-project/pull/193917.diff

7 Files Affected:

  • (modified) llvm/docs/Coroutines.rst (+3)
  • (modified) llvm/docs/LangRef.rst (+3-2)
  • (modified) llvm/lib/FuzzMutate/RandomIRBuilder.cpp (+5)
  • (modified) llvm/lib/IR/Verifier.cpp (+7)
  • (modified) llvm/lib/Transforms/Coroutines/SpillUtils.cpp (+7)
  • (added) llvm/test/Transforms/Coroutines/coro-alloca-10.ll (+66)
  • (modified) llvm/unittests/FuzzMutate/StrategiesTest.cpp (+2-1)
diff --git a/llvm/docs/Coroutines.rst b/llvm/docs/Coroutines.rst
index 0e6b49c84acee..9fa403e68e13b 100644
--- a/llvm/docs/Coroutines.rst
+++ b/llvm/docs/Coroutines.rst
@@ -2252,4 +2252,7 @@ Areas Requiring Attention
 #. Make required changes to make sure that coroutine optimizations work with
    LTO.
 
+#. In Windows EH, exception objects must be allocated on the stack (see :ref:wineh for details).
+   We identify an exception object as an alloca that has `catchpad` users.
+
 #. More tests, more tests, more tests
diff --git a/llvm/docs/LangRef.rst b/llvm/docs/LangRef.rst
index be752b42ea412..1e0293f67e833 100644
--- a/llvm/docs/LangRef.rst
+++ b/llvm/docs/LangRef.rst
@@ -13825,8 +13825,9 @@ ensures that each ``catchpad`` has exactly one predecessor block, and it always
 terminates in a ``catchswitch``.
 
 The ``args`` correspond to whatever information the personality routine
-requires to determine if this is an appropriate handler for the exception. Control
-will transfer to the ``catchpad`` if this is the first appropriate handler for
+requires to determine if this is an appropriate handler for the exception.
+Each operand must be an alloca or a constant.
+Control will transfer to the ``catchpad`` if this is the first appropriate handler for
 the exception.
 
 The ``resultval`` has the type :ref:`token <t_token>` and is used to match the
diff --git a/llvm/lib/FuzzMutate/RandomIRBuilder.cpp b/llvm/lib/FuzzMutate/RandomIRBuilder.cpp
index 8b034137e4702..87392c2e69299 100644
--- a/llvm/lib/FuzzMutate/RandomIRBuilder.cpp
+++ b/llvm/lib/FuzzMutate/RandomIRBuilder.cpp
@@ -332,6 +332,11 @@ static bool isCompatibleReplacement(const Instruction *I, const Use &Operand,
       return false;
     return !Callee->hasParamAttribute(OperandNo, Attribute::ImmArg);
   }
+  case Instruction::CatchPad:
+    // Argument operand must be alloca or constant
+    if (!isa<Constant>(Replacement) && !isa<AllocaInst>(Replacement))
+      return false;
+    break;
   default:
     break;
   }
diff --git a/llvm/lib/IR/Verifier.cpp b/llvm/lib/IR/Verifier.cpp
index bb552861130d2..bdca6800eddfe 100644
--- a/llvm/lib/IR/Verifier.cpp
+++ b/llvm/lib/IR/Verifier.cpp
@@ -4911,6 +4911,13 @@ void Verifier::visitCatchPadInst(CatchPadInst &CPI) {
   Check(&*BB->getFirstNonPHIIt() == &CPI,
         "CatchPadInst not the first non-PHI instruction in the block.", &CPI);
 
+  Check(llvm::all_of(CPI.arg_operands(),
+                     [](Use &U) {
+                       auto *V = U.get();
+                       return isa<Constant>(V) || isa<AllocaInst>(V);
+                     }),
+        "Argument operand must be alloca or constant.", &CPI);
+
   visitEHPadPredecessors(CPI);
   visitFuncletPadInst(CPI);
 }
diff --git a/llvm/lib/Transforms/Coroutines/SpillUtils.cpp b/llvm/lib/Transforms/Coroutines/SpillUtils.cpp
index 81fe0c9acd413..05abccf0f9a97 100644
--- a/llvm/lib/Transforms/Coroutines/SpillUtils.cpp
+++ b/llvm/lib/Transforms/Coroutines/SpillUtils.cpp
@@ -180,6 +180,13 @@ struct AllocaUseVisitor : PtrUseVisitor<AllocaUseVisitor> {
     handleAlias(I);
   }
 
+  void visitCatchPadInst(CatchPadInst &I) {
+    // Windows EH requires exception objects allocated on the stack,
+    // shortcut the traversal and keep it on stack.
+    ShouldLiveOnFrame = false;
+    Base::Worklist.clear();
+  }
+
   void visitInsertElementInst(InsertElementInst &I) {
     enqueueUsers(I);
     handleAlias(I);
diff --git a/llvm/test/Transforms/Coroutines/coro-alloca-10.ll b/llvm/test/Transforms/Coroutines/coro-alloca-10.ll
new file mode 100644
index 0000000000000..12e2a921aa769
--- /dev/null
+++ b/llvm/test/Transforms/Coroutines/coro-alloca-10.ll
@@ -0,0 +1,66 @@
+; NOTE: Assertions have been autogenerated by utils/update_test_checks.py UTC_ARGS: --version 6
+; Test that catchpad is specially handled. Do not collect exception object into coroutine frame.
+; RUN: opt < %s -passes='coro-split,simplifycfg,early-cse' -S | FileCheck %s
+
+define void @fn() presplitcoroutine personality i32 0 {
+; CHECK-LABEL: define void @fn() personality i32 0 {
+; CHECK-NEXT:  [[ENTRY:.*:]]
+; CHECK-NEXT:    [[EXCEPTION_OBJ_RELOAD_ADDR:%.*]] = alloca ptr, align 8
+; CHECK-NEXT:    [[ID:%.*]] = call token @llvm.coro.id(i32 16, ptr null, ptr null, ptr @fn.resumers)
+; CHECK-NEXT:    [[MEM:%.*]] = call noalias nonnull ptr @malloc(i64 24)
+; CHECK-NEXT:    [[HDL:%.*]] = call noalias nonnull ptr @llvm.coro.begin(token [[ID]], ptr [[MEM]])
+; CHECK-NEXT:    store ptr @fn.resume, ptr [[HDL]], align 8
+; CHECK-NEXT:    [[DESTROY_ADDR:%.*]] = getelementptr inbounds i8, ptr [[HDL]], i64 8
+; CHECK-NEXT:    store ptr @fn.destroy, ptr [[DESTROY_ADDR]], align 8
+; CHECK-NEXT:    store ptr null, ptr [[EXCEPTION_OBJ_RELOAD_ADDR]], align 8
+; CHECK-NEXT:    [[INDEX_ADDR4:%.*]] = getelementptr inbounds i8, ptr [[HDL]], i64 16
+; CHECK-NEXT:    store i1 false, ptr [[INDEX_ADDR4]], align 1
+; CHECK-NEXT:    ret void
+;
+entry:
+  %exception.obj = alloca ptr, align 8
+  %id = call token @llvm.coro.id(i32 16, ptr null, ptr null, ptr null)
+  %size = call i64 @llvm.coro.size.i64()
+  %mem = call noalias nonnull ptr @malloc(i64 %size)
+  %hdl = call ptr @llvm.coro.begin(token %id, ptr %mem)
+  store ptr null, ptr %exception.obj, align 8
+  br label %while
+
+while:
+  %save = call token @llvm.coro.save(ptr null)
+  %suspend = call i8 @llvm.coro.suspend(token %save, i1 false)
+  switch i8 %suspend, label %coro.ret [
+  i8 0, label %await.ready
+  ]
+
+await.ready:
+  invoke void @throw()
+  to label %unreachable unwind label %catch.dispatch
+
+catch.dispatch:
+  %switch = catchswitch within none [label %catch] unwind label %ehcleanup
+
+catch:
+  %pad = catchpad within %switch [ptr null, i32 8, ptr %exception.obj]
+  invoke void @use(ptr %exception.obj) [ "funclet"(token %pad) ]
+  to label %catch.ret unwind label %ehcleanup
+
+catch.ret:
+  catchret from %pad to label %while
+
+ehcleanup:
+  %cleanup = cleanuppad within none []
+  call void @llvm.coro.end(ptr null, i1 true, token none) [ "funclet"(token %cleanup) ]
+  cleanupret from %cleanup unwind to caller
+
+coro.ret:
+  call void @llvm.coro.end(ptr null, i1 false, token none)
+  ret void
+
+unreachable:
+  unreachable
+}
+
+declare ptr @malloc(i64)
+declare void @throw()
+declare void @use(ptr)
diff --git a/llvm/unittests/FuzzMutate/StrategiesTest.cpp b/llvm/unittests/FuzzMutate/StrategiesTest.cpp
index fd91066b994a5..278cce20119c6 100644
--- a/llvm/unittests/FuzzMutate/StrategiesTest.cpp
+++ b/llvm/unittests/FuzzMutate/StrategiesTest.cpp
@@ -733,11 +733,12 @@ TEST(AllStrategies, SkipEHPad) {
   StringRef Source = "\n\
     define void @f(i32 %x) personality ptr @__CxxFrameHandler3 { \n\
     entry: \n\
+      %I = alloca i32, align 4 \n\
       invoke void @g() to label %try.cont unwind label %catch.dispatch \n\
     catch.dispatch: \n\
       %0 = catchswitch within none [label %catch] unwind to caller \n\
     catch: \n\
-      %1 = catchpad within %0 [ptr null, i32 64, ptr null] \n\
+      %1 = catchpad within %0 [ptr null, i32 64, ptr %I] \n\
       catchret from %1 to label %try.cont \n\
     try.cont: \n\
       ret void \n\

@github-project-automation github-project-automation Bot moved this from Needs Triage to Needs Merge in LLVM Release Status Apr 24, 2026
@github-actions

Copy link
Copy Markdown

🐧 Linux x64 Test Results

  • 168062 tests passed
  • 2989 tests skipped
  • 1 test failed

Failed Tests

(click on a test name to see its output)

LLVM

LLVM.Transforms/Coroutines/coro-alloca-10.ll
Exit Code: 1

Command Output (stdout):
--
# RUN: at line 3
/home/gha/actions-runner/_work/llvm-project/llvm-project/build/bin/opt < /home/gha/actions-runner/_work/llvm-project/llvm-project/llvm/test/Transforms/Coroutines/coro-alloca-10.ll -passes='coro-split,simplifycfg,early-cse' -S | /home/gha/actions-runner/_work/llvm-project/llvm-project/build/bin/FileCheck /home/gha/actions-runner/_work/llvm-project/llvm-project/llvm/test/Transforms/Coroutines/coro-alloca-10.ll
# executed command: /home/gha/actions-runner/_work/llvm-project/llvm-project/build/bin/opt -passes=coro-split,simplifycfg,early-cse -S
# note: command had no output on stdout or stderr
# executed command: /home/gha/actions-runner/_work/llvm-project/llvm-project/build/bin/FileCheck /home/gha/actions-runner/_work/llvm-project/llvm-project/llvm/test/Transforms/Coroutines/coro-alloca-10.ll
# .---command stderr------------
# | /home/gha/actions-runner/_work/llvm-project/llvm-project/llvm/test/Transforms/Coroutines/coro-alloca-10.ll:13:15: error: CHECK-NEXT: expected string not found in input
# | ; CHECK-NEXT: [[DESTROY_ADDR:%.*]] = getelementptr inbounds i8, ptr [[HDL]], i64 8
# |               ^
# | <stdin>:14:41: note: scanning from here
# |  store ptr @fn.resume, ptr %hdl, align 8
# |                                         ^
# | <stdin>:14:41: note: with "HDL" equal to "%hdl"
# |  store ptr @fn.resume, ptr %hdl, align 8
# |                                         ^
# | <stdin>:15:10: note: possible intended match here
# |  %destroy.addr = getelementptr inbounds nuw %fn.Frame, ptr %hdl, i32 0, i32 1
# |          ^
# | 
# | Input file: <stdin>
# | Check file: /home/gha/actions-runner/_work/llvm-project/llvm-project/llvm/test/Transforms/Coroutines/coro-alloca-10.ll
# | 
# | -dump-input=help explains the following input dump.
# | 
# | Input was:
# | <<<<<<
# |            .
# |            .
# |            .
# |            9: entry: 
# |           10:  %exception.obj = alloca ptr, align 8 
# |           11:  %id = call token @llvm.coro.id(i32 16, ptr null, ptr null, ptr @fn.resumers) 
# |           12:  %mem = call noalias nonnull ptr @malloc(i64 24) 
# |           13:  %hdl = call noalias nonnull ptr @llvm.coro.begin(token %id, ptr %mem) 
# |           14:  store ptr @fn.resume, ptr %hdl, align 8 
# | next:13'0                                             X error: no match found
# | next:13'1                                               with "HDL" equal to "%hdl"
# |           15:  %destroy.addr = getelementptr inbounds nuw %fn.Frame, ptr %hdl, i32 0, i32 1 
# | next:13'0     ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
# | next:13'2              ?                                                                     possible intended match
# |           16:  store ptr @fn.destroy, ptr %destroy.addr, align 8 
# | next:13'0     ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
# |           17:  store ptr null, ptr %exception.obj, align 8 
# | next:13'0     ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
# |           18:  %index.addr4 = getelementptr inbounds nuw %fn.Frame, ptr %hdl, i32 0, i32 2 
# | next:13'0     ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
# |           19:  store i1 false, ptr %index.addr4, align 1 
# | next:13'0     ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
# |           20:  ret void 
# | next:13'0     ~~~~~~~~~~
# |            .
# |            .
# |            .
# | >>>>>>
# `-----------------------------
# error: command failed with exit status: 1

--

If these failures are unrelated to your changes (for example tests are broken or flaky at HEAD), please open an issue at https://github.com/llvm/llvm-project/issues and add the infrastructure label.

@github-actions

Copy link
Copy Markdown

🪟 Windows x64 Test Results

  • 129467 tests passed
  • 2864 tests skipped
  • 1 test failed

Failed Tests

(click on a test name to see its output)

LLVM

LLVM.Transforms/Coroutines/coro-alloca-10.ll
Exit Code: 1

Command Output (stdout):
--
# RUN: at line 3
c:\_work\llvm-project\llvm-project\build\bin\opt.exe < C:\_work\llvm-project\llvm-project\llvm\test\Transforms\Coroutines\coro-alloca-10.ll -passes='coro-split,simplifycfg,early-cse' -S | c:\_work\llvm-project\llvm-project\build\bin\filecheck.exe C:\_work\llvm-project\llvm-project\llvm\test\Transforms\Coroutines\coro-alloca-10.ll
# executed command: 'c:\_work\llvm-project\llvm-project\build\bin\opt.exe' -passes=coro-split,simplifycfg,early-cse -S
# note: command had no output on stdout or stderr
# executed command: 'c:\_work\llvm-project\llvm-project\build\bin\filecheck.exe' 'C:\_work\llvm-project\llvm-project\llvm\test\Transforms\Coroutines\coro-alloca-10.ll'
# .---command stderr------------
# | C:\_work\llvm-project\llvm-project\llvm\test\Transforms\Coroutines\coro-alloca-10.ll:13:15: error: CHECK-NEXT: expected string not found in input
# | ; CHECK-NEXT: [[DESTROY_ADDR:%.*]] = getelementptr inbounds i8, ptr [[HDL]], i64 8
# |               ^
# | <stdin>:14:41: note: scanning from here
# |  store ptr @fn.resume, ptr %hdl, align 8
# |                                         ^
# | <stdin>:14:41: note: with "HDL" equal to "%hdl"
# |  store ptr @fn.resume, ptr %hdl, align 8
# |                                         ^
# | <stdin>:15:10: note: possible intended match here
# |  %destroy.addr = getelementptr inbounds nuw %fn.Frame, ptr %hdl, i32 0, i32 1
# |          ^
# | 
# | Input file: <stdin>
# | Check file: C:\_work\llvm-project\llvm-project\llvm\test\Transforms\Coroutines\coro-alloca-10.ll
# | 
# | -dump-input=help explains the following input dump.
# | 
# | Input was:
# | <<<<<<
# |            .
# |            .
# |            .
# |            9: entry: 
# |           10:  %exception.obj = alloca ptr, align 8 
# |           11:  %id = call token @llvm.coro.id(i32 16, ptr null, ptr null, ptr @fn.resumers) 
# |           12:  %mem = call noalias nonnull ptr @malloc(i64 24) 
# |           13:  %hdl = call noalias nonnull ptr @llvm.coro.begin(token %id, ptr %mem) 
# |           14:  store ptr @fn.resume, ptr %hdl, align 8 
# | next:13'0                                             X error: no match found
# | next:13'1                                               with "HDL" equal to "%hdl"
# |           15:  %destroy.addr = getelementptr inbounds nuw %fn.Frame, ptr %hdl, i32 0, i32 1 
# | next:13'0     ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
# | next:13'2              ?                                                                     possible intended match
# |           16:  store ptr @fn.destroy, ptr %destroy.addr, align 8 
# | next:13'0     ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
# |           17:  store ptr null, ptr %exception.obj, align 8 
# | next:13'0     ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
# |           18:  %index.addr4 = getelementptr inbounds nuw %fn.Frame, ptr %hdl, i32 0, i32 2 
# | next:13'0     ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
# |           19:  store i1 false, ptr %index.addr4, align 1 
# | next:13'0     ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
# |           20:  ret void 
# | next:13'0     ~~~~~~~~~~
# |            .
# |            .
# |            .
# | >>>>>>
# `-----------------------------
# error: command failed with exit status: 1

--

If these failures are unrelated to your changes (for example tests are broken or flaky at HEAD), please open an issue at https://github.com/llvm/llvm-project/issues and add the infrastructure label.

@dyung

dyung commented Apr 27, 2026

Copy link
Copy Markdown
Contributor

@NewSigma the test you added is failing in the precommit bot. Can you take a look?

@dyung dyung moved this from Needs Merge to Needs Test Fix in LLVM Release Status Apr 28, 2026
@NewSigma

Copy link
Copy Markdown
Contributor

@NewSigma the test you added is failing in the precommit bot. Can you take a look?

Opened #194531 with fixes

@NewSigma NewSigma closed this Apr 28, 2026
@dyung dyung moved this from Needs Test Fix to Won't Merge in LLVM Release Status Apr 28, 2026
@NewSigma NewSigma removed this from the LLVM 22.x Release milestone Apr 30, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

Status: Won't Merge

Development

Successfully merging this pull request may close these issues.

4 participants