Implement #pragma clang restrict_expansion

[beanz]

Summary

This patch adds #pragma clang restrict_expansion to enable flagging
macros as unsafe for header use. This is to allow macros that may have
ABI implications to be avoided in headers that have ABI stability
promises.

Using macros in headers (particularly public headers) can cause a
variety of issues relating to ABI and modules. This new pragma logs
warnings when using annotated macros outside the main source file.

This warning is added under a new diagnostics group -Wpedantic-macros

[beanz]

Fixing an inadvertant change.

[beanz]

Re-adding a newline that was inadvertently remvoed.

[beanz]

+@lattner,

Chris provided some post-commit feedback on the macro deprecation patch, I'll address his feedback here since I'm touching the same code.

Chris' feedback is:

/clang/lib/Lex/Preprocessor.cpp:1417 Random drive-by, but in non-LTO builds of clang, this is adding an unnecessary call/return on the expansion path for all non-deprecated macros (the common case). I'd recommend something like:

// Inline in header:
void emitMacroExpansionWarnings(const Token &Identifier) {
if (Identifier.getIdentifierInfo()->isDeprecatedMacro())

emitMacroExpansionWarningsImpl(Identifier);

}

and then put emitMacroExpansionWarningsImpl in the .cpp file.

Thanks!

[beanz]

Updates based on post-commit feedback from @lattner on D106732.

This should inline the determination for emitting warnings, but keep the actual
warning emission in a call.

[aaron.ballman]

clang/docs/LanguageExtensions.rst

3913

I think it should be made more clear as to whether this "unsafe to use in headers" means "unsafe to use in the header declaring the attribute as unsafe" vs "unsafe to use in any header included by the one marked as unsafe.", etc.

There's also the rather interesting example of:

// foo.h
#define FROBBLE 1
#pragma clang header_unsafe(FROBBLE, "why would you ever frobble things?")

// bar.h
#if 1
#elifdef FROBBLE
#endif

// source.c
#include "foo.h"
#include "bar.h"

Do we diagnose use of FROBBLE in bar.h despite it not directly including foo.h? Do we diagnose even though it's in a branch that's not possible to take? Does/should the answer change if we swap the order of includes? What if we change #if 1 into something that's actually variable like FOO > 8?

clang/include/clang/Basic/DiagnosticGroups.td

1309

Speaking of making things pedantic... :-D

clang/include/clang/Basic/IdentifierTable.h

127–130

192–193

clang/include/clang/Lex/Preprocessor.h

804

2420

Is this going to cause a copy for Msg without a call to move()?

clang/lib/Lex/Preprocessor.cpp

1416–1435

I think it'd make sense to have a "macro marked <whatever> here" note in both of these pragmas (the deprecated one can be handled separately as a later thing), WDYT?

clang/test/Lexer/Inputs/unsafe-macro-2.h

24–27

Why do we not expect warnings for these cases? I would have expected that undefining a macro is just as unsafe for ABI reasons as defining a macro is.

[beanz]

@aaron.ballman, thanks for the feedback!

Some comments, but I'll work on updated patches and try to get them up tonight or tomorrow morning.

clang/docs/LanguageExtensions.rst

3913

My intent was that once marked unsafe, it would warn for _all_ uses in files that aren't the main source file.

In your example, the warning wouldn't fire because the preprocessor doesn't expand skipped block conditionals, but it would if the block wasn't skipped.

It also is order-based, so the warning only fires on uses after the pragma. My thought was that could be a way to allow the header defining the macro to use it in some limited set of expansions. i.e:

// foo.h

//We only frobble on arm...
#if __is_target_arch(arm)
#define FROBBLE 1
#endif

#if FROBBLE
...
#endif
#pragma clang header_unsafe(FROBBLE, "Nobody else gets to Frobble in headers but me!")

Then in any user code, including foo.h causes FROBBLE to warn in all subsequent included sources.

The concrete use case for this is actually macOS Catalyst. Apple provides TargetConditionals.h which defines TARGET_OS_* macros for each target operating system.

The problem is, with Catalyst, you might be building a codebase that is going to run on macOS, but needs to be API & ABI compatible with iOS. So we want the ability to warn on those macros being used in headers, and instead encourage people to use API availability markup.

clang/lib/Lex/Preprocessor.cpp

1416–1435

+1

Will work on that.

clang/test/Lexer/Inputs/unsafe-macro-2.h

24–27

I kinda waffled on this myself. My thought was to treat this similarly to how we handle the macro redefinition warning. If you undef, you're kind of claiming the macro as your own and all bets are off...

That said, my next clang extension closes that loop hole too:
https://github.com/llvm-beanz/llvm-project/commit/f0a5216e18f5ee0883039095169bd380295b1de0

[beanz]

Addressing feedback by @aaron.ballman.

If the pattern I used for the note diagnostic is good here, I'll apply it to the deprecated extension too.

[beanz]

Updating documentation to be more clear about the behavior.

[aaron.ballman]

clang/test/Lexer/Inputs/unsafe-macro-2.h

24–27

So header_unsafe is "diagnose if someone expands this macro from outside the main source file" and final is "diagnose if someone defines or undefines this macro anywhere", correct? Would it make sense to have a shorthand to combine these effects for a "fully reserved" macro identifier (#pragma clang reserve_macro(IDENT[, msg]) as a strawman)?

[aaron.ballman]

clang/include/clang/Basic/DiagnosticLexKinds.td

535

[beanz]

clang/test/Lexer/Inputs/unsafe-macro-2.h

24–27

My thought process for implementing them separately was that final would be useful independent of header_unsafe. I could, for example, see applying final to macros like MIN and MAX, where they can be safely used anywhere, but you really don’t want multiple definitions floating around.

[aaron.ballman]

clang/test/Lexer/Inputs/unsafe-macro-2.h

24–27

FWIW, I agree that having separation is useful -- I think these serve orthogonal (but related) purposes: macros which can only be used by "user code", and macros which cannot be redefined or undefined. I was thinking that would be an additional pragma instead of a replacement for the two proposed.

I should probably tell you my use cases so we're both on the same page. One of the most frustrating problems with trying to write a highly portable library is the fact that I have to worry about users defining macros that may conflict with my identifiers (like function names, structure names, template names, etc), but I have no way to reserve those identifiers. I'm hopeful we can find a way that I can "protect" those identifiers in a library with an extension that basically says "you can't use these identifiers for macro purposes without breaking me". I think that's a combination of header_unsafe and final -- I don't want other libraries to start using macros with the names of my library's functions if my header has been included somewhere, and I don't want user code defining macros that may conflict with my library.

[beanz]

clang/test/Lexer/Inputs/unsafe-macro-2.h

24–27

Ah! That makes perfect sense. I think I misunderstood your comment. Totally agree, having a shorthand that groups both together would be super useful. I suspect we'll have some uses where we will want both final and header_unsafe too!

[aaron.ballman]

clang/docs/LanguageExtensions.rst

3916

May want to put something in here along the lines of: Redefining the macro or undefining the macro will not be diagnosed, nor will expansion of the macro within the main source file.

clang/include/clang/Basic/DiagnosticLexKinds.td

531

Should this get its own warning flag within the pedantic macros group? (Otherwise, it's awkward to try to silence this diagnostic while retaining some of the other ones like deprecated pragma.)

clang/test/Lexer/Inputs/unsafe-macro-2.h

24–27

Excellent! FWIW, I don't think the combined pragma has any impact on the behavior of this one.

[beanz]

Updated docs, added header-unsafe-macro diag group, and added test case to verify that the -Wpedantic-macros warnings don't trip on eachother.

[aaron.ballman]

The technical bits all LGTM, thank you for the functionality! There was a comment on IRC that header_unsafe might be confusing to users as it may suggest that the *header* is unsafe rather than the use of the macro. I don't know if we resolved the naming question on IRC or whether that's something you'd like to bikeshed on more before we land this? I'll mark as approved once we're comfortable with the name.

Btw, I think you should add something to the release notes to alert folks to all of the awesome new preprocessor functionality.

[beanz]

[e-mail]

@aaron.ballman thank you for all the feedback and support!

I'm not really sure where to go on the naming. I'm not attached to header_unsafe, and totally understand the confusion. I don't really love the reserved* wording either as it doesn't really convey meaning.

For my other patch I like final because it means something similar to what the final keyword means in C++ and other languages (i.e. don't change this again).

For this I also thought about variations on restrict to signify restrictions on the macro's expansion contexts.

The goal is to warn on expansions that are outside the main source file, so maybe something like restrict_header_expansion?

Very open to feedback here on making clear naming. After all naming is one of the hardest problems in computer science :)

[aaron.ballman]

In D107095#2940638, @beanz wrote:

[e-mail]

@aaron.ballman thank you for all the feedback and support!

I'm not really sure where to go on the naming. I'm not attached to header_unsafe, and totally understand the confusion. I don't really love the reserved* wording either as it doesn't really convey meaning.

We can spitball some ideas, and interested people can chime in with their opinions. I don't want to hold up the functionality for overly long on bikeshedding the name, so if at some point it starts to feel like we should pick one and go with it, we can do that. Sound reasonable?

For my other patch I like final because it means something similar to what the final keyword means in C++ and other languages (i.e. don't change this again).

For this I also thought about variations on restrict to signify restrictions on the macro's expansion contexts.

The goal is to warn on expansions that are outside the main source file, so maybe something like restrict_header_expansion?

Very open to feedback here on making clear naming. After all naming is one of the hardest problems in computer science :)

I think restrict_header_expansion is an improvement, but rather wordy. Maybe restrict_expansion instead? Paging @rsmith, who is often very good at naming questions.

[beanz]

Renaming to restrict_expansion

[beanz]

Fixing documentation line wrapping.

[beanz]

Cleaning up documentation wording to make more sense with the rename

[beanz]

Missed updating the flag name.

[aaron.ballman]

LGTM!

clang/docs/LanguageExtensions.rst

.. code-block:: c
    void min(int a, int b) {
      return MIN(a, b); // warning: MIN is deprecated: use std::min instead
    }
 
 ``#pragma clang deprecated`` should be preferred for this purpose over
 ``#pragma GCC warning`` because the warning can be controlled with
 ``-Wdeprecated``.
 
+Header Unsafe Macros
+====================
+
+Clang supports the pragma ``#pragma clang header_unsafe``, which can be used to
+mark macros as unsafe to use in headers. This can be valuable when providing
+headers with ABI stability requirements. For example:
+
+.. code-block:: c
+
+   #define TARGET_ARM 1
+   #pragma clang header_unsafe(TARGET_ARM, "<reason>")
+
+   /// Foo.h
+   struct Foo {
+   #if TARGET_ARM // warning: TARGET_ARM is marked unsafe in headers: <reason>
+     uint32_t X;
+   #else
+     uint64_t X;
+   #endif
+   };
+
+This warning is controlled by ``-Wpedantic-macros``.
+
 Extended Integer Types
 ======================
 
 Clang supports a set of extended integer types under the syntax ``_ExtInt(N)``
 where ``N`` is an integer that specifies the number of bits that are used to represent
 the type, including the sign bit. The keyword ``_ExtInt`` is a type specifier, thus
 it can be used in any place a type can, including as a non-type-template-parameter,
 as the type of a bitfield, and as the underlying type of an enumeration.

clang/include/clang/Basic/DiagnosticGroups.td

 }];
 }
 
 def WebAssemblyExceptionSpec : DiagGroup<"wasm-exception-spec">;
 
 def RTTI : DiagGroup<"rtti">;
 
 def OpenCLCoreFeaturesDiagGroup : DiagGroup<"pedantic-core-features">;
+
+// Warnings and extensions to make preprocessor macro usage pedantic.
+def PedanticMacros : DiagGroup<"pedantic-macros",
+                    [DeprecatedPragma, MacroRedefined, BuiltinMacroRedefined]>;

clang/include/clang/Basic/DiagnosticLexKinds.td

def warn_pragma_warning_expected_number :
   ExtWarn<"#pragma warning expected a warning number">,
   InGroup<UnknownPragmas>;
 
 // - #pragma deprecated(...)
 def warn_pragma_deprecated_macro_use :
   ExtWarn<"macro %0 has been marked as deprecated%select{|: %2}1">,
   InGroup<DeprecatedPragma>;
 
+// - #pragma clang header_unsafe(...)
+def warn_pragma_header_unsafe_macro_use :
+  ExtWarn<"macro %0 has been marked as unsafe for use in headers"
+          "%select{|: %2}1">,
+  InGroup<PedanticMacros>;
+
+// - Note for macro annotations.
+def note_pp_macro_annotation :
+  Note<"macro marked %select{deprecated|header_unsafe}0 here">;
+
 // - #pragma execution_character_set(...)
 def warn_pragma_exec_charset_expected :
   ExtWarn<"#pragma execution_character_set expected '%0'">,
   InGroup<UnknownPragmas>;
 def warn_pragma_exec_charset_spec_invalid :
   ExtWarn<"#pragma execution_character_set expected 'push' or 'pop'">,
   InGroup<UnknownPragmas>;
 def warn_pragma_exec_charset_push_invalid :

clang/include/clang/Basic/IdentifierTable.h

class alignas(IdentifierInfoAlignment) IdentifierInfo {
   unsigned OutOfDate : 1;
 
   // True if this is the 'import' contextual keyword.
   unsigned IsModulesImport : 1;
 
   // True if this is a mangled OpenMP variant name.
   unsigned IsMangledOpenMPVariantName : 1;
 
-  // True if this is a deprecated macro
+  // True if this is a deprecated macro.
   unsigned IsDeprecatedMacro : 1;
 
-  // 24 bits left in a 64-bit word.
+  // True if this macro is unsafe in headers.
+  unsigned IsHeaderUnsafe : 1;
+
+  // 23 bits left in a 64-bit word.
 
   // Managed by the language front-end.
   void *FETokenInfo = nullptr;
 
   llvm::StringMapEntry<IdentifierInfo *> *Entry = nullptr;
 
   IdentifierInfo()
       : TokenID(tok::identifier), ObjCOrBuiltinID(0), HasMacro(false),
         HadMacro(false), IsExtension(false), IsFutureCompatKeyword(false),
         IsPoisoned(false), IsCPPOperatorKeyword(false),
         NeedsHandleIdentifier(false), IsFromAST(false), ChangedAfterLoad(false),
         FEChangedAfterLoad(false), RevertedTokenID(false), OutOfDate(false),
         IsModulesImport(false), IsMangledOpenMPVariantName(false),
-        IsDeprecatedMacro(false) {}
+        IsDeprecatedMacro(false), IsHeaderUnsafe(false) {}
 
 public:
   IdentifierInfo(const IdentifierInfo &) = delete;
   IdentifierInfo &operator=(const IdentifierInfo &) = delete;
   IdentifierInfo(IdentifierInfo &&) = delete;
   IdentifierInfo &operator=(IdentifierInfo &&) = delete;
 
   /// Return true if this is the identifier for the specified string.
public:
   void setHasMacroDefinition(bool Val) {
     if (HasMacro == Val) return;
 
     HasMacro = Val;
     if (Val) {
       NeedsHandleIdentifier = true;
       HadMacro = true;
     } else {
+      // Because calling the setters of these calls recomputes, just set them
+      // manually to avoid recomputing a bunch of times.
+      IsDeprecatedMacro = false;
+      IsHeaderUnsafe = false;
       RecomputeNeedsHandleIdentifier();
-      setIsDeprecatedMacro(false);
     }
   }
   /// Returns true if this identifier was \#defined to some value at any
   /// moment. In this case there should be an entry for the identifier in the
   /// macro history table in Preprocessor.
   bool hadMacroDefinition() const {
     return HadMacro;
   }
 
   bool isDeprecatedMacro() const { return IsDeprecatedMacro; }
 
   void setIsDeprecatedMacro(bool Val) {
     if (IsDeprecatedMacro == Val)
       return;
     IsDeprecatedMacro = Val;
     if (Val)
       NeedsHandleIdentifier = true;
     else
       RecomputeNeedsHandleIdentifier();
   }
 
+  bool isHeaderUnsafe() const { return IsHeaderUnsafe; }
+
+  void setIsHeaderUnsafe(bool Val) {
+    if (IsHeaderUnsafe == Val)
+      return;
+    IsHeaderUnsafe = Val;
+    if (Val)
+      NeedsHandleIdentifier = true;
+    else
+      RecomputeNeedsHandleIdentifier();
+  }
+
   /// If this is a source-language token (e.g. 'for'), this API
   /// can be used to cause the lexer to map identifiers to source-language
   /// tokens.
   tok::TokenKind getTokenID() const { return (tok::TokenKind)TokenID; }
 
   /// True if revertTokenIDToIdentifier() was called.
   bool hasRevertedTokenIDToIdentifier() const { return RevertedTokenID; }
 

clang/include/clang/Lex/Preprocessor.h

 /// Defines the clang::Preprocessor interface.
 //
 //===----------------------------------------------------------------------===//
 
 #ifndef LLVM_CLANG_LEX_PREPROCESSOR_H
 #define LLVM_CLANG_LEX_PREPROCESSOR_H
 
 #include "clang/Basic/Diagnostic.h"
+#include "clang/Basic/DiagnosticIDs.h"
 #include "clang/Basic/IdentifierTable.h"
 #include "clang/Basic/LLVM.h"
 #include "clang/Basic/LangOptions.h"
 #include "clang/Basic/Module.h"
 #include "clang/Basic/SourceLocation.h"
 #include "clang/Basic/SourceManager.h"
 #include "clang/Basic/TokenKinds.h"
 #include "clang/Lex/Lexer.h"
private:
   /// We store just their SourceLocations instead of
   /// something like MacroInfo*. The benefit of this is that when we are
   /// deserializing from PCH, we don't need to deserialize identifier & macros
   /// just so that we can report that they are unused, we just warn using
   /// the SourceLocations of this set (that will be filled by the ASTReader).
   using WarnUnusedMacroLocsTy = llvm::SmallDenseSet<SourceLocation, 32>;
   WarnUnusedMacroLocsTy WarnUnusedMacroLocs;
 
-  /// Deprecation messages for macros provided in #pragma clang deprecated
+  /// This is a pair of an optional message and source location used for pragmas
+  /// that annotate macros like pragma clang header_unsafe and pragma clang
+  /// deprecated. This pair stores the optional message and the location of the
+  /// annotation pragma for use producing diagnostics and notes.
+  using MsgLocationPair = std::pair<std::string, SourceLocation>;
+
+  /// Deprecation messages for macros provided in #pragma clang deprecated.
   llvm::DenseMap<const IdentifierInfo *, std::string> MacroDeprecationMsgs;
 
+  /// Usage warning for macros marked by #pragma clang header_unsafe.
+  llvm::DenseMap<const IdentifierInfo *, MsgLocationPair> HeaderUnsafeMacroMsgs;
+
   /// A "freelist" of MacroArg objects that can be
   /// reused for quick allocation.
   MacroArgs *MacroArgCache = nullptr;
 
   /// For each IdentifierInfo used in a \#pragma push_macro directive,
   /// we keep a MacroInfo stack used to restore the previous macro value.
   llvm::DenseMap<IdentifierInfo *, std::vector<MacroInfo *>>
       PragmaPushMacroInfo;
public:
 
   llvm::Optional<std::string> getMacroDeprecationMsg(const IdentifierInfo *II) {
     auto MsgEntry = MacroDeprecationMsgs.find(II);
     if (MsgEntry == MacroDeprecationMsgs.end())
       return llvm::None;
     return MsgEntry->second;
   }
 
-  void emitMacroExpansionWarnings(const Token &Identifier);
+  void addHeaderUnsafeMsg(const IdentifierInfo *II, std::string Msg,
+                          SourceLocation AnnotationLoc) {
+    HeaderUnsafeMacroMsgs.insert(
+        std::make_pair(II, std::make_pair(std::move(Msg), AnnotationLoc)));
+  }
+
+  MsgLocationPair getHeaderUnsafeMsg(const IdentifierInfo *II) {
+    return HeaderUnsafeMacroMsgs.find(II)->second;
+  }
+
+  void emitMacroExpansionWarnings(const Token &Identifier) {
+    if (Identifier.getIdentifierInfo()->isDeprecatedMacro())
+      emitMacroDeprecationWarning(Identifier);
+
+    if (Identifier.getIdentifierInfo()->isHeaderUnsafe() &&
+        !SourceMgr.isInMainFile(Identifier.getLocation()))
+      emitMacroUnsafeHeaderWarning(Identifier);
+  }
 
 private:
+  void emitMacroDeprecationWarning(const Token &Identifier);
+  void emitMacroUnsafeHeaderWarning(const Token &Identifier);
+
   Optional<unsigned>
   getSkippedRangeForExcludedConditionalBlock(SourceLocation HashLoc);
 
   /// Contains the currently active skipped range mappings for skipping excluded
   /// conditional directives.
   ExcludedPreprocessorDirectiveSkipMapping
       *ExcludedConditionalDirectiveSkipMappings;
 };

clang/lib/Lex/Pragma.cpp

void HandlePragma(Preprocessor &PP, PragmaIntroducer Introducer,
                     Token &NameTok) override {
     // #pragma region: endregion matches can be verified
     // __pragma(region): no sense, but ignored by msvc
     // _Pragma is not valid for MSVC, but there isn't any point
     // to handle a _Pragma differently.
   }
 };
 
-/// "\#pragma clang deprecated(...)"
-///
-/// The syntax is
-/// \code
-///   #pragma clang deprecate(MACRO_NAME [, Message])
-/// \endcode
-struct PragmaDeprecatedHandler : public PragmaHandler {
-  PragmaDeprecatedHandler() : PragmaHandler("deprecated") {}
-
-  void HandlePragma(Preprocessor &PP, PragmaIntroducer Introducer,
-                    Token &Tok) override {
-    std::string Macro, MessageString;
+/// This handles parsing pragmas that take a macro name and optional message
+static IdentifierInfo *HandleMacroAnnotationPragma(Preprocessor &PP, Token &Tok,
+                                                   const char *Pragma,
+                                                   std::string &MessageString) {
+  std::string Macro;
 
-    PP.Lex(Tok);
-    if (Tok.isNot(tok::l_paren)) {
-      PP.Diag(Tok, diag::err_expected) << "(";
-      return;
-    }
+    return nullptr;
 
-    PP.LexUnexpandedToken(Tok);
-    if (!Tok.is(tok::identifier)) {
-      PP.Diag(Tok, diag::err_expected) << tok::identifier;
-      return;
-    }
-    IdentifierInfo *II = Tok.getIdentifierInfo();
+    return nullptr;
 
-    if (!II->hasMacroDefinition()) {
-      PP.Diag(Tok, diag::err_pp_visibility_non_macro) << II->getName();
-      return;
-    }
+    return nullptr;
 
-    PP.Lex(Tok);
-    if (Tok.is(tok::comma)) {
-      PP.Lex(Tok);
-      if (!PP.FinishLexStringLiteral(Tok, MessageString,
-                                     "#pragma clang deprecated",
-                                     /*AllowMacroExpansion=*/true))
-        return;
-    }
+    if (!PP.FinishLexStringLiteral(Tok, MessageString, Pragma,
+      return nullptr;
 
-    if (Tok.isNot(tok::r_paren)) {
-      PP.Diag(Tok, diag::err_expected) << ")";
-      return;
-    }
+    return nullptr;
+  }
+  return II;
 
+/// "\#pragma clang deprecated(...)"
+///
+/// The syntax is
+/// \code
+///   #pragma clang deprecate(MACRO_NAME [, Message])
+/// \endcode
+struct PragmaDeprecatedHandler : public PragmaHandler {
+  PragmaDeprecatedHandler() : PragmaHandler("deprecated") {}
+
+  void HandlePragma(Preprocessor &PP, PragmaIntroducer Introducer,
+                    Token &Tok) override {
+    std::string MessageString;
+
+    if (IdentifierInfo *II = HandleMacroAnnotationPragma(
+            PP, Tok, "#pragma clang deprecated", MessageString)) {
       II->setIsDeprecatedMacro(true);
       if (!MessageString.empty())
         PP.addMacroDeprecationMsg(II, std::move(MessageString));
     }
+  }
+};
+
+/// "\#pragma clang header_unsafe(...)"
+///
+/// The syntax is
+/// \code
+///   #pragma clang header_unsafe(MACRO_NAME [, Message])
+/// \endcode
+struct PragmaHeaderUnsafeHandler : public PragmaHandler {
+  PragmaHeaderUnsafeHandler() : PragmaHandler("header_unsafe") {}
+
+  void HandlePragma(Preprocessor &PP, PragmaIntroducer Introducer,
+                    Token &Tok) override {
+    std::string MessageString;
+
+    if (IdentifierInfo *II = HandleMacroAnnotationPragma(
+            PP, Tok, "#pragma clang header_unsafe", MessageString)) {
+      II->setIsHeaderUnsafe(true);
+      PP.addHeaderUnsafeMsg(II, std::move(MessageString), Tok.getLocation());
+    }
+  }
 };
 
 } // namespace
 
 /// RegisterBuiltinPragmas - Install the standard preprocessor pragmas:
 /// \#pragma GCC poison/system_header/dependency and \#pragma once.
 void Preprocessor::RegisterBuiltinPragmas() {
   AddPragmaHandler(new PragmaOnceHandler());
void Preprocessor::RegisterBuiltinPragmas() {
   AddPragmaHandler("clang", new PragmaPoisonHandler());
   AddPragmaHandler("clang", new PragmaSystemHeaderHandler());
   AddPragmaHandler("clang", new PragmaDebugHandler());
   AddPragmaHandler("clang", new PragmaDependencyHandler());
   AddPragmaHandler("clang", new PragmaDiagnosticHandler("clang"));
   AddPragmaHandler("clang", new PragmaARCCFCodeAuditedHandler());
   AddPragmaHandler("clang", new PragmaAssumeNonNullHandler());
   AddPragmaHandler("clang", new PragmaDeprecatedHandler());
+  AddPragmaHandler("clang", new PragmaHeaderUnsafeHandler());
 
   // #pragma clang module ...
   auto *ModuleHandler = new PragmaNamespace("module");
   AddPragmaHandler("clang", ModuleHandler);
   ModuleHandler->AddPragma(new PragmaModuleImportHandler());
   ModuleHandler->AddPragma(new PragmaModuleBeginHandler());
   ModuleHandler->AddPragma(new PragmaModuleEndHandler());
   ModuleHandler->AddPragma(new PragmaModuleBuildHandler());

clang/lib/Lex/Preprocessor.cpp

if ((*H)->HandleComment(*this, Comment))
       AnyPendingTokens = true;
   }
   if (!AnyPendingTokens || getCommentRetentionState())
     return false;
   Lex(result);
   return true;
 }
 
-void Preprocessor::emitMacroExpansionWarnings(const Token &Identifier) {
-  if (Identifier.getIdentifierInfo()->isDeprecatedMacro()) {
-    auto DepMsg = getMacroDeprecationMsg(Identifier.getIdentifierInfo());
-    if (!DepMsg)
-      Diag(Identifier, diag::warn_pragma_deprecated_macro_use)
-          << Identifier.getIdentifierInfo() << 0;
-    else
-      Diag(Identifier, diag::warn_pragma_deprecated_macro_use)
-          << Identifier.getIdentifierInfo() << 1 << *DepMsg;
-  }
+void Preprocessor::emitMacroDeprecationWarning(const Token &Identifier) {
+
+void Preprocessor::emitMacroUnsafeHeaderWarning(const Token &Identifier) {
+  auto DepMsg = getHeaderUnsafeMsg(Identifier.getIdentifierInfo());
+  if (DepMsg.first.empty())
+    Diag(Identifier, diag::warn_pragma_header_unsafe_macro_use)
+        << Identifier.getIdentifierInfo() << 0;
+  else
+    Diag(Identifier, diag::warn_pragma_header_unsafe_macro_use)
+        << Identifier.getIdentifierInfo() << 1 << DepMsg.first;
+  Diag(DepMsg.second, diag::note_pp_macro_annotation) << 1;
 }
 
 ModuleLoader::~ModuleLoader() = default;
 
 CommentHandler::~CommentHandler() = default;
 
 EmptylineHandler::~EmptylineHandler() = default;
 
 CodeCompletionHandler::~CodeCompletionHandler() = default;
 
 void Preprocessor::createPreprocessingRecord() {
   if (Record)
     return;
 
   Record = new PreprocessingRecord(getSourceManager());
   addPPCallbacks(std::unique_ptr<PPCallbacks>(Record));
 }

clang/test/Lexer/Inputs/unsafe-macro-2.h

+// expected-warning@+1{{macro 'UNSAFE_MACRO' has been marked as unsafe for use in headers: Don't use this!}}
+#if UNSAFE_MACRO
+#endif
+
+// expected-warning@+1{{macro 'UNSAFE_MACRO' has been marked as unsafe for use in headers: Don't use this!}}
+#if defined(UNSAFE_MACRO)
+#endif
+
+// expected-warning@+1{{macro 'UNSAFE_MACRO' has been marked as unsafe for use in headers: Don't use this!}}
+#ifdef UNSAFE_MACRO
+#endif
+
+// expected-warning@+1{{macro 'UNSAFE_MACRO' has been marked as unsafe for use in headers: Don't use this!}}
+#ifndef UNSAFE_MACRO
+#endif
+
+// expected-warning@+1{{macro 'UNSAFE_MACRO' has been marked as unsafe for use in headers: Don't use this!}}
+const int x = UNSAFE_MACRO;
+
+// expected-warning@+1{{macro 'UNSAFE_MACRO_2' has been marked as unsafe for use in headers}}
+const int y = UNSAFE_MACRO_2;
+
+// not-expected-warning@+1{{macro 'UNSAFE_MACRO_2' has been marked as unsafe for use in headers}}
+#undef UNSAFE_MACRO_2
+// not-expected-warning@+1{{macro 'UNSAFE_MACRO_2' has been marked as unsafe for use in headers}}
+#define UNSAFE_MACRO_2 2
+
+// not-expected-warning@+1{{macro 'UNSAFE_MACRO_2' has been marked as unsafe for use in headers}}
+const int z = UNSAFE_MACRO_2;
+
+
+// Test that we diagnose on #elif.
+#if 0
+#elif UNSAFE_MACRO
+// expected-warning@-1{{macro 'UNSAFE_MACRO' has been marked as unsafe for use in headers: Don't use this!}}
+#endif
+
+
+// Test that we diagnose on #elifdef.
+#ifdef baz
+#elifdef UNSAFE_MACRO
+// expected-warning@-1{{macro 'UNSAFE_MACRO' has been marked as unsafe for use in headers: Don't use this!}}
+#endif
+
+// Test that we diagnose on #elifndef.
+#ifdef baz
+#elifndef UNSAFE_MACRO
+#endif
+// expected-warning@-2{{macro 'UNSAFE_MACRO' has been marked as unsafe for use in headers: Don't use this!}}
+
+// FIXME: These cases are currently not handled because clang doesn't expand
+// conditions on skipped #elif* blocks. See the FIXME notes in
+// Preprocessor::SkipExcludedConditionalBlock.
+
+#define frobble
+
+#ifdef frobble
+// not-expected-warning@+1{{macro 'UNSAFE_MACRO' has been marked as unsafe for use in headers: Don't use this!}}
+#elifndef UNSAFE_MACRO
+#endif
+
+#ifdef frobble
+// not-expected-warning@+1{{macro 'UNSAFE_MACRO' has been marked as unsafe for use in headers: Don't use this!}}
+#elifdef UNSAFE_MACRO
+#endif
+
+#if 1
+// not-expected-warning@+1{{macro 'UNSAFE_MACRO' has been marked as unsafe for use in headers: Don't use this!}}
+#elif UNSAFE_MACRO
+#endif

clang/test/Lexer/Inputs/unsafe-macro.h

+// expected-error@+1{{expected (}}
+#pragma clang header_unsafe
+
+// expected-error@+1{{expected identifier}}
+#pragma clang header_unsafe(4
+
+// expected-error@+1{{no macro named foo}}
+#pragma clang header_unsafe(foo)
+
+
+#define UNSAFE_MACRO 1
+// expected-note@+8{{macro marked header_unsafe here}}
+// expected-note@+7{{macro marked header_unsafe here}}
+// expected-note@+6{{macro marked header_unsafe here}}
+// expected-note@+5{{macro marked header_unsafe here}}
+// expected-note@+4{{macro marked header_unsafe here}}
+// expected-note@+3{{macro marked header_unsafe here}}
+// expected-note@+2{{macro marked header_unsafe here}}
+// expected-note@+1{{macro marked header_unsafe here}} 
+#pragma clang header_unsafe(UNSAFE_MACRO, "Don't use this!")
+
+#define UNSAFE_MACRO_2 2
+// expected-note@+1{{macro marked header_unsafe here}}
+#pragma clang header_unsafe(UNSAFE_MACRO_2)
+
+// expected-error@+1{{expected )}}
+#pragma clang deprecated(UNSAFE_MACRO

clang/test/Lexer/unsafe-macro.c

+// RUN: %clang_cc1 -Wpedantic-macros %s -fsyntax-only -verify
+#include "Inputs/unsafe-macro.h"
+#include "Inputs/unsafe-macro-2.h"
+
+// not-expected-warning@+1{{macro 'UNSAFE_MACRO' has been marked as unsafe for use in headers: Don't use this!}}
+#if UNSAFE_MACRO
+#endif