Implement #pragma clang restrict_expansion

[beanz]

Summary

This patch adds #pragma clang restrict_expansion to enable flagging
macros as unsafe for header use. This is to allow macros that may have
ABI implications to be avoided in headers that have ABI stability
promises.

Using macros in headers (particularly public headers) can cause a
variety of issues relating to ABI and modules. This new pragma logs
warnings when using annotated macros outside the main source file.

This warning is added under a new diagnostics group -Wpedantic-macros

[beanz]

Fixing an inadvertant change.

[beanz]

Re-adding a newline that was inadvertently remvoed.

[beanz]

+@lattner,

Chris provided some post-commit feedback on the macro deprecation patch, I'll address his feedback here since I'm touching the same code.

Chris' feedback is:

/clang/lib/Lex/Preprocessor.cpp:1417 Random drive-by, but in non-LTO builds of clang, this is adding an unnecessary call/return on the expansion path for all non-deprecated macros (the common case). I'd recommend something like:

// Inline in header:
void emitMacroExpansionWarnings(const Token &Identifier) {
if (Identifier.getIdentifierInfo()->isDeprecatedMacro())

emitMacroExpansionWarningsImpl(Identifier);

}

and then put emitMacroExpansionWarningsImpl in the .cpp file.

Thanks!

[beanz]

Updates based on post-commit feedback from @lattner on D106732.

This should inline the determination for emitting warnings, but keep the actual
warning emission in a call.

[aaron.ballman]

clang/docs/LanguageExtensions.rst

3913

I think it should be made more clear as to whether this "unsafe to use in headers" means "unsafe to use in the header declaring the attribute as unsafe" vs "unsafe to use in any header included by the one marked as unsafe.", etc.

There's also the rather interesting example of:

// foo.h
#define FROBBLE 1
#pragma clang header_unsafe(FROBBLE, "why would you ever frobble things?")

// bar.h
#if 1
#elifdef FROBBLE
#endif

// source.c
#include "foo.h"
#include "bar.h"

Do we diagnose use of FROBBLE in bar.h despite it not directly including foo.h? Do we diagnose even though it's in a branch that's not possible to take? Does/should the answer change if we swap the order of includes? What if we change #if 1 into something that's actually variable like FOO > 8?

clang/include/clang/Basic/DiagnosticGroups.td

1310

Speaking of making things pedantic... :-D

clang/include/clang/Basic/IdentifierTable.h

127–130

192–193

clang/include/clang/Lex/Preprocessor.h

804

2421

Is this going to cause a copy for Msg without a call to move()?

clang/lib/Lex/Preprocessor.cpp

1416–1435

I think it'd make sense to have a "macro marked <whatever> here" note in both of these pragmas (the deprecated one can be handled separately as a later thing), WDYT?

clang/test/Lexer/Inputs/unsafe-macro-2.h

24–27

Why do we not expect warnings for these cases? I would have expected that undefining a macro is just as unsafe for ABI reasons as defining a macro is.

[beanz]

@aaron.ballman, thanks for the feedback!

Some comments, but I'll work on updated patches and try to get them up tonight or tomorrow morning.

clang/docs/LanguageExtensions.rst

3913

My intent was that once marked unsafe, it would warn for _all_ uses in files that aren't the main source file.

In your example, the warning wouldn't fire because the preprocessor doesn't expand skipped block conditionals, but it would if the block wasn't skipped.

It also is order-based, so the warning only fires on uses after the pragma. My thought was that could be a way to allow the header defining the macro to use it in some limited set of expansions. i.e:

// foo.h

//We only frobble on arm...
#if __is_target_arch(arm)
#define FROBBLE 1
#endif

#if FROBBLE
...
#endif
#pragma clang header_unsafe(FROBBLE, "Nobody else gets to Frobble in headers but me!")

Then in any user code, including foo.h causes FROBBLE to warn in all subsequent included sources.

The concrete use case for this is actually macOS Catalyst. Apple provides TargetConditionals.h which defines TARGET_OS_* macros for each target operating system.

The problem is, with Catalyst, you might be building a codebase that is going to run on macOS, but needs to be API & ABI compatible with iOS. So we want the ability to warn on those macros being used in headers, and instead encourage people to use API availability markup.

clang/lib/Lex/Preprocessor.cpp

1416–1435

+1

Will work on that.

clang/test/Lexer/Inputs/unsafe-macro-2.h

24–27

I kinda waffled on this myself. My thought was to treat this similarly to how we handle the macro redefinition warning. If you undef, you're kind of claiming the macro as your own and all bets are off...

That said, my next clang extension closes that loop hole too:
https://github.com/llvm-beanz/llvm-project/commit/f0a5216e18f5ee0883039095169bd380295b1de0

[beanz]

Addressing feedback by @aaron.ballman.

If the pattern I used for the note diagnostic is good here, I'll apply it to the deprecated extension too.

[beanz]

Updating documentation to be more clear about the behavior.

[aaron.ballman]

clang/test/Lexer/Inputs/unsafe-macro-2.h

24–27

So header_unsafe is "diagnose if someone expands this macro from outside the main source file" and final is "diagnose if someone defines or undefines this macro anywhere", correct? Would it make sense to have a shorthand to combine these effects for a "fully reserved" macro identifier (#pragma clang reserve_macro(IDENT[, msg]) as a strawman)?

[aaron.ballman]

clang/include/clang/Basic/DiagnosticLexKinds.td

535

[beanz]

clang/test/Lexer/Inputs/unsafe-macro-2.h

24–27

My thought process for implementing them separately was that final would be useful independent of header_unsafe. I could, for example, see applying final to macros like MIN and MAX, where they can be safely used anywhere, but you really don’t want multiple definitions floating around.

[aaron.ballman]

clang/test/Lexer/Inputs/unsafe-macro-2.h

24–27

FWIW, I agree that having separation is useful -- I think these serve orthogonal (but related) purposes: macros which can only be used by "user code", and macros which cannot be redefined or undefined. I was thinking that would be an additional pragma instead of a replacement for the two proposed.

I should probably tell you my use cases so we're both on the same page. One of the most frustrating problems with trying to write a highly portable library is the fact that I have to worry about users defining macros that may conflict with my identifiers (like function names, structure names, template names, etc), but I have no way to reserve those identifiers. I'm hopeful we can find a way that I can "protect" those identifiers in a library with an extension that basically says "you can't use these identifiers for macro purposes without breaking me". I think that's a combination of header_unsafe and final -- I don't want other libraries to start using macros with the names of my library's functions if my header has been included somewhere, and I don't want user code defining macros that may conflict with my library.

[beanz]

clang/test/Lexer/Inputs/unsafe-macro-2.h

24–27

Ah! That makes perfect sense. I think I misunderstood your comment. Totally agree, having a shorthand that groups both together would be super useful. I suspect we'll have some uses where we will want both final and header_unsafe too!

[aaron.ballman]

clang/docs/LanguageExtensions.rst

3916

May want to put something in here along the lines of: Redefining the macro or undefining the macro will not be diagnosed, nor will expansion of the macro within the main source file.

clang/include/clang/Basic/DiagnosticLexKinds.td

531

Should this get its own warning flag within the pedantic macros group? (Otherwise, it's awkward to try to silence this diagnostic while retaining some of the other ones like deprecated pragma.)

clang/test/Lexer/Inputs/unsafe-macro-2.h

24–27

Excellent! FWIW, I don't think the combined pragma has any impact on the behavior of this one.

[beanz]

Updated docs, added header-unsafe-macro diag group, and added test case to verify that the -Wpedantic-macros warnings don't trip on eachother.

[aaron.ballman]

The technical bits all LGTM, thank you for the functionality! There was a comment on IRC that header_unsafe might be confusing to users as it may suggest that the *header* is unsafe rather than the use of the macro. I don't know if we resolved the naming question on IRC or whether that's something you'd like to bikeshed on more before we land this? I'll mark as approved once we're comfortable with the name.

Btw, I think you should add something to the release notes to alert folks to all of the awesome new preprocessor functionality.

[beanz]

[e-mail]

@aaron.ballman thank you for all the feedback and support!

I'm not really sure where to go on the naming. I'm not attached to header_unsafe, and totally understand the confusion. I don't really love the reserved* wording either as it doesn't really convey meaning.

For my other patch I like final because it means something similar to what the final keyword means in C++ and other languages (i.e. don't change this again).

For this I also thought about variations on restrict to signify restrictions on the macro's expansion contexts.

The goal is to warn on expansions that are outside the main source file, so maybe something like restrict_header_expansion?

Very open to feedback here on making clear naming. After all naming is one of the hardest problems in computer science :)

[aaron.ballman]

In D107095#2940638, @beanz wrote:

[e-mail]

@aaron.ballman thank you for all the feedback and support!

I'm not really sure where to go on the naming. I'm not attached to header_unsafe, and totally understand the confusion. I don't really love the reserved* wording either as it doesn't really convey meaning.

We can spitball some ideas, and interested people can chime in with their opinions. I don't want to hold up the functionality for overly long on bikeshedding the name, so if at some point it starts to feel like we should pick one and go with it, we can do that. Sound reasonable?

For my other patch I like final because it means something similar to what the final keyword means in C++ and other languages (i.e. don't change this again).

For this I also thought about variations on restrict to signify restrictions on the macro's expansion contexts.

The goal is to warn on expansions that are outside the main source file, so maybe something like restrict_header_expansion?

Very open to feedback here on making clear naming. After all naming is one of the hardest problems in computer science :)

I think restrict_header_expansion is an improvement, but rather wordy. Maybe restrict_expansion instead? Paging @rsmith, who is often very good at naming questions.

[beanz]

Renaming to restrict_expansion

[beanz]

Fixing documentation line wrapping.

[beanz]

Cleaning up documentation wording to make more sense with the rename

[beanz]

Missed updating the flag name.

[aaron.ballman]

LGTM!

clang/docs/LanguageExtensions.rst

.. code-block:: c
    void min(int a, int b) {
      return MIN(a, b); // warning: MIN is deprecated: use std::min instead
    }
 
 ``#pragma clang deprecated`` should be preferred for this purpose over
 ``#pragma GCC warning`` because the warning can be controlled with
 ``-Wdeprecated``.
 
+Restricted Expansion Macros
+===========================
+
+Clang supports the pragma ``#pragma clang restrict_expansion``, which can be
+used restrict macro expansion in headers. This can be valuable when providing
+headers with ABI stability requirements. Any expansion of the annotated macro
+processed by the preprocessor after the ``#pragma`` annotation will log a
+warning. Redefining the macro or undefining the macro will not be diagnosed, nor
+will expansion of the macro within the main source file. For example:
+
+.. code-block:: c
+
+   #define TARGET_ARM 1
+   #pragma clang restrict_expansion(TARGET_ARM, "<reason>")
+
+   /// Foo.h
+   struct Foo {
+   #if TARGET_ARM // warning: TARGET_ARM is marked unsafe in headers: <reason>
+     uint32_t X;
+   #else
+     uint64_t X;
+   #endif
+   };
+
+   /// main.c
+   #include "foo.h"
+   #if TARGET_ARM // No warning in main source file
+   X_TYPE uint32_t
+   #else
+   X_TYPE uint64_t
+   #endif
+
+This warning is controlled by ``-Wpedantic-macros``.
+
 Extended Integer Types
 ======================
 
 Clang supports a set of extended integer types under the syntax ``_ExtInt(N)``
 where ``N`` is an integer that specifies the number of bits that are used to represent
 the type, including the sign bit. The keyword ``_ExtInt`` is a type specifier, thus
 it can be used in any place a type can, including as a non-type-template-parameter,
 as the type of a bitfield, and as the underlying type of an enumeration.

clang/include/clang/Basic/DiagnosticGroups.td

 // GCC name for -Wunsequenced
 def : DiagGroup<"sequence-point", [Unsequenced]>;
 
 // Preprocessor warnings.
 def AmbiguousMacro : DiagGroup<"ambiguous-macro">;
 def KeywordAsMacro : DiagGroup<"keyword-macro">;
 def ReservedIdAsMacro : DiagGroup<"reserved-macro-identifier">;
 def ReservedIdAsMacroAlias : DiagGroup<"reserved-id-macro", [ReservedIdAsMacro]>;
+def RestrictExpansionMacro : DiagGroup<"header-unsafe-macro">;
 
 // Just silence warnings about -Wstrict-aliasing for now.
 def : DiagGroup<"strict-aliasing=0">;
 def : DiagGroup<"strict-aliasing=1">;
 def : DiagGroup<"strict-aliasing=2">;
 def : DiagGroup<"strict-aliasing">;
 
 // Just silence warnings about -Wstrict-overflow for now.

 }];
 }
 
 def WebAssemblyExceptionSpec : DiagGroup<"wasm-exception-spec">;
 
 def RTTI : DiagGroup<"rtti">;
 
 def OpenCLCoreFeaturesDiagGroup : DiagGroup<"pedantic-core-features">;
+
+// Warnings and extensions to make preprocessor macro usage pedantic.
+def PedanticMacros : DiagGroup<"pedantic-macros",
+                    [DeprecatedPragma,
+                     MacroRedefined,
+                     BuiltinMacroRedefined,
+                     RestrictExpansionMacro]>;

clang/include/clang/Basic/DiagnosticLexKinds.td

def warn_pragma_warning_expected_number :
   ExtWarn<"#pragma warning expected a warning number">,
   InGroup<UnknownPragmas>;
 
 // - #pragma deprecated(...)
 def warn_pragma_deprecated_macro_use :
   ExtWarn<"macro %0 has been marked as deprecated%select{|: %2}1">,
   InGroup<DeprecatedPragma>;
 
+// - #pragma clang restrict_expansion(...)
+def warn_pragma_restrict_expansion_macro_use :
+  ExtWarn<"macro %0 has been marked as unsafe for use in headers"
+          "%select{|: %2}1">,
+  InGroup<RestrictExpansionMacro>;
+
+// - Note for macro annotations.
+def note_pp_macro_annotation :
+  Note<"macro marked '%select{deprecated|restrict_expansion}0' here">;
+
 // - #pragma execution_character_set(...)
 def warn_pragma_exec_charset_expected :
   ExtWarn<"#pragma execution_character_set expected '%0'">,
   InGroup<UnknownPragmas>;
 def warn_pragma_exec_charset_spec_invalid :
   ExtWarn<"#pragma execution_character_set expected 'push' or 'pop'">,
   InGroup<UnknownPragmas>;
 def warn_pragma_exec_charset_push_invalid :

clang/include/clang/Basic/IdentifierTable.h

class alignas(IdentifierInfoAlignment) IdentifierInfo {
   unsigned OutOfDate : 1;
 
   // True if this is the 'import' contextual keyword.
   unsigned IsModulesImport : 1;
 
   // True if this is a mangled OpenMP variant name.
   unsigned IsMangledOpenMPVariantName : 1;
 
-  // True if this is a deprecated macro
+  // True if this is a deprecated macro.
   unsigned IsDeprecatedMacro : 1;
 
-  // 24 bits left in a 64-bit word.
+  // True if this macro is unsafe in headers.
+  unsigned IsRestrictExpansion : 1;
+
+  // 23 bits left in a 64-bit word.
 
   // Managed by the language front-end.
   void *FETokenInfo = nullptr;
 
   llvm::StringMapEntry<IdentifierInfo *> *Entry = nullptr;
 
   IdentifierInfo()
       : TokenID(tok::identifier), ObjCOrBuiltinID(0), HasMacro(false),
         HadMacro(false), IsExtension(false), IsFutureCompatKeyword(false),
         IsPoisoned(false), IsCPPOperatorKeyword(false),
         NeedsHandleIdentifier(false), IsFromAST(false), ChangedAfterLoad(false),
         FEChangedAfterLoad(false), RevertedTokenID(false), OutOfDate(false),
         IsModulesImport(false), IsMangledOpenMPVariantName(false),
-        IsDeprecatedMacro(false) {}
+        IsDeprecatedMacro(false), IsRestrictExpansion(false) {}
 
 public:
   IdentifierInfo(const IdentifierInfo &) = delete;
   IdentifierInfo &operator=(const IdentifierInfo &) = delete;
   IdentifierInfo(IdentifierInfo &&) = delete;
   IdentifierInfo &operator=(IdentifierInfo &&) = delete;
 
   /// Return true if this is the identifier for the specified string.
public:
   void setHasMacroDefinition(bool Val) {
     if (HasMacro == Val) return;
 
     HasMacro = Val;
     if (Val) {
       NeedsHandleIdentifier = true;
       HadMacro = true;
     } else {
+      // Because calling the setters of these calls recomputes, just set them
+      // manually to avoid recomputing a bunch of times.
+      IsDeprecatedMacro = false;
+      IsRestrictExpansion = false;
       RecomputeNeedsHandleIdentifier();
-      setIsDeprecatedMacro(false);
     }
   }
   /// Returns true if this identifier was \#defined to some value at any
   /// moment. In this case there should be an entry for the identifier in the
   /// macro history table in Preprocessor.
   bool hadMacroDefinition() const {
     return HadMacro;
   }
 
   bool isDeprecatedMacro() const { return IsDeprecatedMacro; }
 
   void setIsDeprecatedMacro(bool Val) {
     if (IsDeprecatedMacro == Val)
       return;
     IsDeprecatedMacro = Val;
     if (Val)
       NeedsHandleIdentifier = true;
     else
       RecomputeNeedsHandleIdentifier();
   }
 
+  bool isRestrictExpansion() const { return IsRestrictExpansion; }
+
+  void setIsRestrictExpansion(bool Val) {
+    if (IsRestrictExpansion == Val)
+      return;
+    IsRestrictExpansion = Val;
+    if (Val)
+      NeedsHandleIdentifier = true;
+    else
+      RecomputeNeedsHandleIdentifier();
+  }
+
   /// If this is a source-language token (e.g. 'for'), this API
   /// can be used to cause the lexer to map identifiers to source-language
   /// tokens.
   tok::TokenKind getTokenID() const { return (tok::TokenKind)TokenID; }
 
   /// True if revertTokenIDToIdentifier() was called.
   bool hasRevertedTokenIDToIdentifier() const { return RevertedTokenID; }
 

clang/include/clang/Lex/Preprocessor.h

 /// Defines the clang::Preprocessor interface.
 //
 //===----------------------------------------------------------------------===//
 
 #ifndef LLVM_CLANG_LEX_PREPROCESSOR_H
 #define LLVM_CLANG_LEX_PREPROCESSOR_H
 
 #include "clang/Basic/Diagnostic.h"
+#include "clang/Basic/DiagnosticIDs.h"
 #include "clang/Basic/IdentifierTable.h"
 #include "clang/Basic/LLVM.h"
 #include "clang/Basic/LangOptions.h"
 #include "clang/Basic/Module.h"
 #include "clang/Basic/SourceLocation.h"
 #include "clang/Basic/SourceManager.h"
 #include "clang/Basic/TokenKinds.h"
 #include "clang/Lex/Lexer.h"
private:
   /// We store just their SourceLocations instead of
   /// something like MacroInfo*. The benefit of this is that when we are
   /// deserializing from PCH, we don't need to deserialize identifier & macros
   /// just so that we can report that they are unused, we just warn using
   /// the SourceLocations of this set (that will be filled by the ASTReader).
   using WarnUnusedMacroLocsTy = llvm::SmallDenseSet<SourceLocation, 32>;
   WarnUnusedMacroLocsTy WarnUnusedMacroLocs;
 
-  /// Deprecation messages for macros provided in #pragma clang deprecated
+  /// This is a pair of an optional message and source location used for pragmas
+  /// that annotate macros like pragma clang restrict_expansion and pragma clang
+  /// deprecated. This pair stores the optional message and the location of the
+  /// annotation pragma for use producing diagnostics and notes.
+  using MsgLocationPair = std::pair<std::string, SourceLocation>;
+
+  /// Deprecation messages for macros provided in #pragma clang deprecated.
   llvm::DenseMap<const IdentifierInfo *, std::string> MacroDeprecationMsgs;
 
+  /// Usage warning for macros marked by #pragma clang restrict_expansion.
+  llvm::DenseMap<const IdentifierInfo *, MsgLocationPair>
+      RestrictExpansionMacroMsgs;
+
   /// A "freelist" of MacroArg objects that can be
   /// reused for quick allocation.
   MacroArgs *MacroArgCache = nullptr;
 
   /// For each IdentifierInfo used in a \#pragma push_macro directive,
   /// we keep a MacroInfo stack used to restore the previous macro value.
   llvm::DenseMap<IdentifierInfo *, std::vector<MacroInfo *>>
       PragmaPushMacroInfo;
public:
 
   llvm::Optional<std::string> getMacroDeprecationMsg(const IdentifierInfo *II) {
     auto MsgEntry = MacroDeprecationMsgs.find(II);
     if (MsgEntry == MacroDeprecationMsgs.end())
       return llvm::None;
     return MsgEntry->second;
   }
 
-  void emitMacroExpansionWarnings(const Token &Identifier);
+  void addRestrictExpansionMsg(const IdentifierInfo *II, std::string Msg,
+                               SourceLocation AnnotationLoc) {
+    RestrictExpansionMacroMsgs.insert(
+        std::make_pair(II, std::make_pair(std::move(Msg), AnnotationLoc)));
+  }
+
+  MsgLocationPair getRestrictExpansionMsg(const IdentifierInfo *II) {
+    return RestrictExpansionMacroMsgs.find(II)->second;
+  }
+
+  void emitMacroExpansionWarnings(const Token &Identifier) {
+    if (Identifier.getIdentifierInfo()->isDeprecatedMacro())
+      emitMacroDeprecationWarning(Identifier);
+
+    if (Identifier.getIdentifierInfo()->isRestrictExpansion() &&
+        !SourceMgr.isInMainFile(Identifier.getLocation()))
+      emitMacroUnsafeHeaderWarning(Identifier);
+  }
 
 private:
+  void emitMacroDeprecationWarning(const Token &Identifier);
+  void emitMacroUnsafeHeaderWarning(const Token &Identifier);
+
   Optional<unsigned>
   getSkippedRangeForExcludedConditionalBlock(SourceLocation HashLoc);
 
   /// Contains the currently active skipped range mappings for skipping excluded
   /// conditional directives.
   ExcludedPreprocessorDirectiveSkipMapping
       *ExcludedConditionalDirectiveSkipMappings;
 };

clang/lib/Lex/Pragma.cpp

void HandlePragma(Preprocessor &PP, PragmaIntroducer Introducer,
                     Token &NameTok) override {
     // #pragma region: endregion matches can be verified
     // __pragma(region): no sense, but ignored by msvc
     // _Pragma is not valid for MSVC, but there isn't any point
     // to handle a _Pragma differently.
   }
 };
 
-/// "\#pragma clang deprecated(...)"
-///
-/// The syntax is
-/// \code
-///   #pragma clang deprecate(MACRO_NAME [, Message])
-/// \endcode
-struct PragmaDeprecatedHandler : public PragmaHandler {
-  PragmaDeprecatedHandler() : PragmaHandler("deprecated") {}
-
-  void HandlePragma(Preprocessor &PP, PragmaIntroducer Introducer,
-                    Token &Tok) override {
-    std::string Macro, MessageString;
+/// This handles parsing pragmas that take a macro name and optional message
+static IdentifierInfo *HandleMacroAnnotationPragma(Preprocessor &PP, Token &Tok,
+                                                   const char *Pragma,
+                                                   std::string &MessageString) {
+  std::string Macro;
 
-    PP.Lex(Tok);
-    if (Tok.isNot(tok::l_paren)) {
-      PP.Diag(Tok, diag::err_expected) << "(";
-      return;
-    }
+    return nullptr;
 
-    PP.LexUnexpandedToken(Tok);
-    if (!Tok.is(tok::identifier)) {
-      PP.Diag(Tok, diag::err_expected) << tok::identifier;
-      return;
-    }
-    IdentifierInfo *II = Tok.getIdentifierInfo();
+    return nullptr;
 
-    if (!II->hasMacroDefinition()) {
-      PP.Diag(Tok, diag::err_pp_visibility_non_macro) << II->getName();
-      return;
-    }
+    return nullptr;
 
-    PP.Lex(Tok);
-    if (Tok.is(tok::comma)) {
-      PP.Lex(Tok);
-      if (!PP.FinishLexStringLiteral(Tok, MessageString,
-                                     "#pragma clang deprecated",
-                                     /*AllowMacroExpansion=*/true))
-        return;
-    }
+    if (!PP.FinishLexStringLiteral(Tok, MessageString, Pragma,
+      return nullptr;
 
-    if (Tok.isNot(tok::r_paren)) {
-      PP.Diag(Tok, diag::err_expected) << ")";
-      return;
-    }
+    return nullptr;
+  }
+  return II;
 
+/// "\#pragma clang deprecated(...)"
+///
+/// The syntax is
+/// \code
+///   #pragma clang deprecate(MACRO_NAME [, Message])
+/// \endcode
+struct PragmaDeprecatedHandler : public PragmaHandler {
+  PragmaDeprecatedHandler() : PragmaHandler("deprecated") {}
+
+  void HandlePragma(Preprocessor &PP, PragmaIntroducer Introducer,
+                    Token &Tok) override {
+    std::string MessageString;
+
+    if (IdentifierInfo *II = HandleMacroAnnotationPragma(
+            PP, Tok, "#pragma clang deprecated", MessageString)) {
       II->setIsDeprecatedMacro(true);
       if (!MessageString.empty())
         PP.addMacroDeprecationMsg(II, std::move(MessageString));
     }
+  }
+};
+
+/// "\#pragma clang restrict_expansion(...)"
+///
+/// The syntax is
+/// \code
+///   #pragma clang restrict_expansion(MACRO_NAME [, Message])
+/// \endcode
+struct PragmaRestrictExpansionHandler : public PragmaHandler {
+  PragmaRestrictExpansionHandler() : PragmaHandler("restrict_expansion") {}
+
+  void HandlePragma(Preprocessor &PP, PragmaIntroducer Introducer,
+                    Token &Tok) override {
+    std::string MessageString;
+
+    if (IdentifierInfo *II = HandleMacroAnnotationPragma(
+            PP, Tok, "#pragma clang restrict_expansion", MessageString)) {
+      II->setIsRestrictExpansion(true);
+      PP.addRestrictExpansionMsg(II, std::move(MessageString),
+                                 Tok.getLocation());
+    }
+  }
 };
 
 } // namespace
 
 /// RegisterBuiltinPragmas - Install the standard preprocessor pragmas:
 /// \#pragma GCC poison/system_header/dependency and \#pragma once.
 void Preprocessor::RegisterBuiltinPragmas() {
   AddPragmaHandler(new PragmaOnceHandler());
void Preprocessor::RegisterBuiltinPragmas() {
   AddPragmaHandler("clang", new PragmaPoisonHandler());
   AddPragmaHandler("clang", new PragmaSystemHeaderHandler());
   AddPragmaHandler("clang", new PragmaDebugHandler());
   AddPragmaHandler("clang", new PragmaDependencyHandler());
   AddPragmaHandler("clang", new PragmaDiagnosticHandler("clang"));
   AddPragmaHandler("clang", new PragmaARCCFCodeAuditedHandler());
   AddPragmaHandler("clang", new PragmaAssumeNonNullHandler());
   AddPragmaHandler("clang", new PragmaDeprecatedHandler());
+  AddPragmaHandler("clang", new PragmaRestrictExpansionHandler());
 
   // #pragma clang module ...
   auto *ModuleHandler = new PragmaNamespace("module");
   AddPragmaHandler("clang", ModuleHandler);
   ModuleHandler->AddPragma(new PragmaModuleImportHandler());
   ModuleHandler->AddPragma(new PragmaModuleBeginHandler());
   ModuleHandler->AddPragma(new PragmaModuleEndHandler());
   ModuleHandler->AddPragma(new PragmaModuleBuildHandler());

clang/lib/Lex/Preprocessor.cpp

if ((*H)->HandleComment(*this, Comment))
       AnyPendingTokens = true;
   }
   if (!AnyPendingTokens || getCommentRetentionState())
     return false;
   Lex(result);
   return true;
 }
 
-void Preprocessor::emitMacroExpansionWarnings(const Token &Identifier) {
-  if (Identifier.getIdentifierInfo()->isDeprecatedMacro()) {
-    auto DepMsg = getMacroDeprecationMsg(Identifier.getIdentifierInfo());
-    if (!DepMsg)
-      Diag(Identifier, diag::warn_pragma_deprecated_macro_use)
-          << Identifier.getIdentifierInfo() << 0;
-    else
-      Diag(Identifier, diag::warn_pragma_deprecated_macro_use)
-          << Identifier.getIdentifierInfo() << 1 << *DepMsg;
-  }
+void Preprocessor::emitMacroDeprecationWarning(const Token &Identifier) {
+
+void Preprocessor::emitMacroUnsafeHeaderWarning(const Token &Identifier) {
+  auto DepMsg = getRestrictExpansionMsg(Identifier.getIdentifierInfo());
+  if (DepMsg.first.empty())
+    Diag(Identifier, diag::warn_pragma_restrict_expansion_macro_use)
+        << Identifier.getIdentifierInfo() << 0;
+  else
+    Diag(Identifier, diag::warn_pragma_restrict_expansion_macro_use)
+        << Identifier.getIdentifierInfo() << 1 << DepMsg.first;
+  Diag(DepMsg.second, diag::note_pp_macro_annotation) << 1;
 }
 
 ModuleLoader::~ModuleLoader() = default;
 
 CommentHandler::~CommentHandler() = default;
 
 EmptylineHandler::~EmptylineHandler() = default;
 
 CodeCompletionHandler::~CodeCompletionHandler() = default;
 
 void Preprocessor::createPreprocessingRecord() {
   if (Record)
     return;
 
   Record = new PreprocessingRecord(getSourceManager());
   addPPCallbacks(std::unique_ptr<PPCallbacks>(Record));
 }

clang/test/Lexer/Inputs/pedantic-macro-interplay.h

+#define UNSAFE_MACRO 1
+#pragma clang restrict_expansion(UNSAFE_MACRO, "Don't use this!")
+// not-expected-warning@+1{{macro 'UNSAFE_MACRO' has been marked as unsafe for use in headers: Don't use this!}}
+#pragma clang deprecated(UNSAFE_MACRO, "Don't use this!")
+
+#define UNSAFE_MACRO_2 1
+#pragma clang deprecated(UNSAFE_MACRO_2, "Don't use this!")
+// not-expected-warning@+1{{macro 'UNSAFE_MACRO_2' has been marked as deprecated: Don't use this!}}
+#pragma clang restrict_expansion(UNSAFE_MACRO_2, "Don't use this!")

clang/test/Lexer/Inputs/unsafe-macro-2.h

+// expected-warning@+1{{macro 'UNSAFE_MACRO' has been marked as unsafe for use in headers: Don't use this!}}
+#if UNSAFE_MACRO
+#endif
+
+// expected-warning@+1{{macro 'UNSAFE_MACRO' has been marked as unsafe for use in headers: Don't use this!}}
+#if defined(UNSAFE_MACRO)
+#endif
+
+// expected-warning@+1{{macro 'UNSAFE_MACRO' has been marked as unsafe for use in headers: Don't use this!}}
+#ifdef UNSAFE_MACRO
+#endif
+
+// expected-warning@+1{{macro 'UNSAFE_MACRO' has been marked as unsafe for use in headers: Don't use this!}}
+#ifndef UNSAFE_MACRO
+#endif
+
+// expected-warning@+1{{macro 'UNSAFE_MACRO' has been marked as unsafe for use in headers: Don't use this!}}
+const int x = UNSAFE_MACRO;
+
+// expected-warning@+1{{macro 'UNSAFE_MACRO_2' has been marked as unsafe for use in headers}}
+const int y = UNSAFE_MACRO_2;
+
+// not-expected-warning@+1{{macro 'UNSAFE_MACRO_2' has been marked as unsafe for use in headers}}
+#undef UNSAFE_MACRO_2
+// not-expected-warning@+1{{macro 'UNSAFE_MACRO_2' has been marked as unsafe for use in headers}}
+#define UNSAFE_MACRO_2 2
+
+// not-expected-warning@+1{{macro 'UNSAFE_MACRO_2' has been marked as unsafe for use in headers}}
+const int z = UNSAFE_MACRO_2;
+
+
+// Test that we diagnose on #elif.
+#if 0
+#elif UNSAFE_MACRO
+// expected-warning@-1{{macro 'UNSAFE_MACRO' has been marked as unsafe for use in headers: Don't use this!}}
+#endif
+
+
+// Test that we diagnose on #elifdef.
+#ifdef baz
+#elifdef UNSAFE_MACRO
+// expected-warning@-1{{macro 'UNSAFE_MACRO' has been marked as unsafe for use in headers: Don't use this!}}
+#endif
+
+// Test that we diagnose on #elifndef.
+#ifdef baz
+#elifndef UNSAFE_MACRO
+#endif
+// expected-warning@-2{{macro 'UNSAFE_MACRO' has been marked as unsafe for use in headers: Don't use this!}}
+
+// FIXME: These cases are currently not handled because clang doesn't expand
+// conditions on skipped #elif* blocks. See the FIXME notes in
+// Preprocessor::SkipExcludedConditionalBlock.
+
+#define frobble
+
+#ifdef frobble
+// not-expected-warning@+1{{macro 'UNSAFE_MACRO' has been marked as unsafe for use in headers: Don't use this!}}
+#elifndef UNSAFE_MACRO
+#endif
+
+#ifdef frobble
+// not-expected-warning@+1{{macro 'UNSAFE_MACRO' has been marked as unsafe for use in headers: Don't use this!}}
+#elifdef UNSAFE_MACRO
+#endif
+
+#if 1
+// not-expected-warning@+1{{macro 'UNSAFE_MACRO' has been marked as unsafe for use in headers: Don't use this!}}
+#elif UNSAFE_MACRO
+#endif

clang/test/Lexer/Inputs/unsafe-macro.h

+// expected-error@+1{{expected (}}
+#pragma clang restrict_expansion
+
+// expected-error@+1{{expected identifier}}
+#pragma clang restrict_expansion(4
+
+// expected-error@+1{{no macro named foo}}
+#pragma clang restrict_expansion(foo)
+
+
+#define UNSAFE_MACRO 1
+// expected-note@+8{{macro marked 'restrict_expansion' here}}
+// expected-note@+7{{macro marked 'restrict_expansion' here}}
+// expected-note@+6{{macro marked 'restrict_expansion' here}}
+// expected-note@+5{{macro marked 'restrict_expansion' here}}
+// expected-note@+4{{macro marked 'restrict_expansion' here}}
+// expected-note@+3{{macro marked 'restrict_expansion' here}}
+// expected-note@+2{{macro marked 'restrict_expansion' here}}
+// expected-note@+1{{macro marked 'restrict_expansion' here}} 
+#pragma clang restrict_expansion(UNSAFE_MACRO, "Don't use this!")
+
+#define UNSAFE_MACRO_2 2
+// expected-note@+1{{macro marked 'restrict_expansion' here}}
+#pragma clang restrict_expansion(UNSAFE_MACRO_2)
+
+// expected-error@+1{{expected )}}
+#pragma clang deprecated(UNSAFE_MACRO

clang/test/Lexer/pedantic-macro-interplay.c

+// RUN: %clang_cc1 -Wpedantic-macros %s -fsyntax-only -verify
+
+// This test verifies that the -Wpedantic-macros warnings don't fire in the
+// annotation pragmas themselves. This ensures you can annotate macros with
+// more than one of the pragmas without spewing warnings all over the code.
+
+#include "Inputs/pedantic-macro-interplay.h"
+
+#define UNSAFE_MACRO_2 1
+#pragma clang deprecated(UNSAFE_MACRO_2, "Don't use this!")
+// not-expected-warning@+1{{macro 'UNSAFE_MACRO_2' has been marked as deprecated: Don't use this!}}
+#pragma clang restrict_expansion(UNSAFE_MACRO_2, "Don't use this!")
+
+// expected-no-diagnostics

clang/test/Lexer/unsafe-macro.c

+// RUN: %clang_cc1 -Wheader-unsafe-macro %s -fsyntax-only -verify
+#include "Inputs/unsafe-macro.h"
+#include "Inputs/unsafe-macro-2.h"
+
+// not-expected-warning@+1{{macro 'UNSAFE_MACRO' has been marked as unsafe for use in headers: Don't use this!}}
+#if UNSAFE_MACRO
+#endif