[WebAssembly] Initial support for reference type funcref in clang

[pmatos]

Summary

This is the funcref counterpart to 104bad5a. We introduce a new attribute
that marks a function pointer as a funcref. It also implements builtin
__builtin_wasm_ref_null_func(), that returns a null funcref value.

[pmatos]

Rebase on top of main. Add missing code in Sema* to ensure the new funcref builtin is checked for.
Thanks to @asb for helping fix this.

[pmatos]

Update the patch as there were some missing calls from SemaChecking.
Thanks to @asb for spotting it.

[pmatos]

It would be great to get this landed. Can someone pls take a look at it? It's quite independent from the remainder of the work and self-contained.

maybe @tlively ping?

[tlively]

Oops, sorry about that. Will take a look.

[tlively]

It would be good to add tests for more error conditions like in the externref patch and also additional errors like trying to apply __funcref to types that aren't function pointers.

clang/include/clang/Basic/Attr.td

4053

It would be good to document this!

clang/lib/Sema/SemaChecking.cpp

4522

Are the extra parentheses meaningful here?

6549–6552

How do these parts correspond to the original source code?

[aaron.ballman]

Same question here about an RFC for adding this new type to the type system and a design document for how the type behaves as in https://reviews.llvm.org/D122215.

clang/include/clang/Basic/Attr.td

4053

It's a requirement that this be documented. Also, this should probably have a Subjects line that expects a function of some sort? (It doesn't impact the semantics of anything, but it self-documents the expectations for people reading Attr.td.)

clang/include/clang/Basic/DiagnosticSemaKinds.td

7332

1. What is __clang_webassembly_funcref? Did you mean __funcref?
2. There's no test coverage for this diagnostic.

clang/include/clang/Basic/TokenKinds.def

666

Why is this a keyword in all language modes?

clang/include/clang/Parse/Parser.h

2843

clang/include/clang/Sema/Sema.h

13103–13104

Formatting is off here.

13169

I think there's a verb missing from this function identifier -- also, I don't think we need to continue the terrible trend of prepending Sema onto the function name which lives in the Sema object.

clang/lib/AST/ASTContext.cpp

954

Where did this value come from?

clang/lib/Parse/ParseDecl.cpp

845–846

851–854

5780

Why that specific ordering as opposed to AR_VendorAttributesParsed?

clang/lib/Sema/SemaChecking.cpp

6554–6558

Why would we need to do this?? And what do we do when there is no FunctionDecl to get back to (because it's a call expression through a function pointer, for example)?

6561

Why are you guaranteed this function returns void?

clang/lib/Sema/SemaType.cpp

7256

7269

This seems like it's not used.

7289–7290

What happens when the user's function already has an explicitly specified address space?

[pmatos]

clang/lib/AST/ASTContext.cpp

954

Unsure what you mean here. This is the address space number we also use on the LLVM side.

[aaron.ballman]

clang/lib/AST/ASTContext.cpp

954

Unsure what you mean here. This is the address space number we also use on the LLVM side.

That's exactly what I was looking for -- I wanted to make sure this agreed with the LLVM side of things and any public documentation about address spaces for WASM.

[pmatos]

Rebase

[pmatos]

clang/lib/AST/ASTContext.cpp

954

Unsure what you mean here. This is the address space number we also use on the LLVM side.

That's exactly what I was looking for -- I wanted to make sure this agreed with the LLVM side of things and any public documentation about address spaces for WASM.

Sure! Marking as done.

[pmatos]

clang/include/clang/Basic/DiagnosticSemaKinds.td

7332

1. What is __clang_webassembly_funcref? Did you mean __funcref?
2. There's no test coverage for this diagnostic.

Yes, I meant __funcref. Thanks, will add test coverage for the diagnostic.

clang/include/clang/Basic/TokenKinds.def

666

I might have misread the docs but this keyword should be available for both C and C++. Maybe I want KEYC99 | KEYCXX ?

clang/include/clang/Sema/Sema.h

13103–13104

Don't understand why. It's the same as CheckRISCVBuiltinFunctionCall ?

[pmatos]

Addressed some of the concerns from the comments but not ready for review yet.

[pmatos]

Address most of the comments.

[pmatos]

Updated this revision on top of D122215.

[pmatos]

Ready for review.

RFC: https://discourse.llvm.org/t/rfc-webassembly-reference-types-in-clang/66939

[pmatos]

Rebase on top of main.

[pmatos]

@aaron.ballman Hi Aaron, since you requested an RFC for this. I wonder if you have any comments for this or the other related patches: D122215, D139010

[aaron.ballman]

In D128440#4042753, @pmatos wrote:

@aaron.ballman Hi Aaron, since you requested an RFC for this. I wonder if you have any comments for this or the other related patches: D122215, D139010

I appreciate your patience with the extreme delay on getting you feedback after I asked you to post the RFC; I wanted to give the RFC a chance to bake and then ran into the holiday season as a result. Sorry for that!

Adding @erichkeane as new attributes code owner as well, in case he's got additional thoughts.

clang/include/clang/Basic/TokenKinds.def

666

I was thinking this keyword would only work for a web assembly target, so we'd likely want to add KEYWEBASM or something to the list like we have for KEYALTIVEC. But now I'm second-guessing that instinct and am wondering what behavior we want here.

1. Parse the keyword in all language modes and for all targets, give an ignored attribute warning if the target isn't web assembly
2. Parse the keyword in all language modes and for all targets, give a parse time diagnostic (error?) if the target isn't web assembly
3. Only expose the keyword if the target is web assembly, otherwise it parses as an identifier and you get the usual parse errors

My original thinking was that we wanted #3, but on reflection both #1 and #2 seem reasonable to me. Do you have a preference? I think I prefer either 2 or 3 over 1 because this involves the type system (errors are usually a better approach in that case).

clang/lib/AST/TypePrinter.cpp

1651–1652

I'm not certain that the assert adds much here given that the predicate tests exactly the same thing, perhaps remove it (and drop the curly braces)?

clang/lib/Basic/Targets/WebAssembly.h

44–45

I'm not super familiar with the address space maps, but this sets of my spidey senses. All of the other address space maps end with:

ptr64, hlsl_groupshared, wasm_funcref

but this one is ending with:

ptr64, wasm_externref, wasm_funcref

which makes me think something's amiss here. Thoughts?

clang/lib/Parse/ParseDecl.cpp

846

I think we should assert this condition; we already know what the token is before we call this function anyway.

5780–5783

I don't think we need to care about attribute requirements because this is a keyword attribute (this feature is used to prohibit attributes in certain grammars and I don't think that applies here).

clang/lib/Sema/SemaChecking.cpp

6554–6560

These comments no longer seem to match the code -- nothing creates a FunctionDecl here.

6561

I'm still wondering why this code is needed and what it's trying to do. It worries me that we're changing the type of the call expression like this.

clang/lib/Sema/SemaDecl.cpp

14373

clang/lib/Sema/SemaType.cpp

7266

We're missing Sema test coverage for all the various diagnostics you've added; can you add that coverage?

7269

Still wondering about this

7289–7290

Still wondering about this as well.

[erichkeane]

clang/include/clang/Basic/Attr.td

4054

Note that it seems this is likely not going to work correctly on template type aliases! You probably want to make sure that is acceptable to you.

clang/include/clang/Basic/AttrDocs.td

6855 ↗

(On Diff #487700)

This says 'function pointer declaration', but you have it's subject as Typedef?

clang/include/clang/Basic/TokenKinds.def

666

I don't think #1 is acceptable for the keyword, we shouldn't ignore keywords like we do attributes. Doing an ignored warning in SemaDeclAttr.td for the ATTRIBUTE is fine, but keyword form needs to be an error.

My preference is #2, an error if we encounter it during parsing and we're not in WebAsm target.

clang/lib/Basic/Targets/DirectX.h

45

Also apply to the rest of the targets. Also, why is there only 1 added here? I thought we had 2 address spaces for Wasm?

clang/lib/Basic/Targets/WebAssembly.h

44–45

That DEFINITELY looks suspicious to me as well, I noted above too, but either we need to specify we're re-using the hlsl_groupshared for wasm_externref address space (at which point, i wonder: why not re-use a different address space?), or correct this.

clang/lib/Parse/ParseDecl.cpp

849

clang/lib/Sema/SemaChecking.cpp

6546

Does this diagnose? Should we be emitting an error here?

6558

All those comments don't really seem relevant here, and are not really correct. The only thing SemaChecking should do is either modify its arguments (though you don't have any), or set its return type.

6561

This appears to be a 'custom type checking' builtin, where the code in Sema has to check the arguments (rather than the automatic behavior working), and set its return type to the 'correct' one. It appears that this accepts no arguments, then changes the result of the builtin.

So this doesn't seem particularly odd, other than the strange comments above.

clang/lib/Sema/SemaType.cpp

7255

This name seems misleading... should you be desugaring 'Type' to store it in 'Desugared'?

Also, I see that this value is never used, so why do the copy init? ALSO, why is it called Desugared, when it never seems to get a Desugared type?

[aaron.ballman]

clang/lib/Sema/SemaChecking.cpp

6561

Oh yeah that's right, that is how the custom checking code works, thank you for the reminder!

[pmatos]

@aaron.ballman Added support for externref mangling in Microsoft. This follows the pattern implemented by OpenCL types.

[pmatos]

In D128440#4047535, @pmatos wrote:

@aaron.ballman Added support for externref mangling in Microsoft. This follows the pattern implemented by OpenCL types.

Wrong revision - sorry.

[erichkeane]

clang/lib/AST/MicrosoftMangle.cpp

2481 ↗

(On Diff #488645)

I'm not sure what the PA is supposed to mean? I see some uses of mangleArtificialTagType don't do anything with it, so I fear it is something OCL specific.

[pmatos]

Undo last patch. Submitted change to incorrect revision.

[pmatos]

clang/include/clang/Basic/Attr.td

4054

Documentation says about Subject:

// The things to which an attribute can appertain
SubjectList Subjects;

Given this can be attached to function pointer types, is the subject then just Type ?

clang/include/clang/Basic/AttrDocs.td

6855 ↗

(On Diff #487700)

That's a mistake due to how things worked in an earlier revision. Thanks for spotting.

clang/include/clang/Basic/TokenKinds.def

666

Thanks for the comments, I have now updated this with an implementation of option 2 and added a diagnostic test.

clang/lib/Basic/Targets/DirectX.h

45

Externref is a type in clang, doesn't need its own address space in clang, only when it's lowered to a opaque type in llvm it gets its own address space.

[erichkeane]

clang/include/clang/Basic/Attr.td

4054

IIRC, the list of subjects are the Decls and Stmt types that are possibly allowed. I don't thnk it would be just 'Type' there.

As you have it, it is only allowed on TypedefNameDecl.

See the SubsetSubject's at the top of this file for some examples on how you could constrain a special matcher to only work on function pointer decls.

clang/lib/Basic/Targets/DirectX.h

45

Please fix the comment in my suggestion.

Also, your explanation doesn't make it clear to me why you added TWO entries to this list for other targets, but only 1 here.

[pmatos]

Address a few comments, add new test for funcref keyword diagnostic.

[pmatos]

Add new Attr Subject Function Pointer for __funcref attribute.

[pmatos]

clang/include/clang/Basic/Attr.td

4054

Good point @erichkeane . What do you think of FunctionPointer implementation here?

[erichkeane]

clang/include/clang/Basic/Attr.td

4054

That seems acceptable to me.

[pmatos]

Rebase on main.

[aaron.ballman]

Some more comments, but there are unaddressed comments from earlier reviews as well.

clang/include/clang/Basic/Attr.td

4054

That makes sense to me as well, but FWIW, type attributes don't currently have much of any tablegen automation (unlike decl and stmt attributes), so the subject list isn't strictly necessary here. But it's still appreciated because 1) it's documentation, and 2) we want to tablegen more and this helps us with that goal.

clang/include/clang/Basic/DiagnosticSemaKinds.td

11686

clang/lib/AST/DeclBase.cpp

1060–1063 ↗

(On Diff #493251)

clang/lib/Parse/ParseDecl.cpp

856–857

Be sure to run clang-format over the patch to fix this sort of thing.

[pmatos]

clang/lib/Basic/Targets/DirectX.h

45

I have now fixed that. We just need one address space.

clang/lib/Basic/Targets/WebAssembly.h

44–45

Fixed this now. We only need the address space for funcref. The address space for externref is now necessary as it's its own type.

[pmatos]

clang/include/clang/Basic/Attr.td

4054

@erichkeane Yes, you're right. Something like

using IntIntFuncref = int(*)(int) __funcref;

doesn't work. Why is this not accepted? Is it due to the Subjects listed?

[pmatos]

Address some of the pending comments.

[pmatos]

clang/lib/Sema/SemaChecking.cpp

6549–6552

If I understand your question correctly, this is just the semantic checks for each of the builtins.

6554–6560

Right - fixed.

6558

Right, these comments can be removed. I fixed these.

6561

I think this question is not relevant anymore given the current code, right? The wasm ref null builtin will always return the null funcref.

clang/lib/Sema/SemaType.cpp

7255

Bad naming due to earlier code. I have simplified this code now.

[pmatos]

Addressed a few comments.

[pmatos]

clang/lib/Sema/SemaChecking.cpp

6546

I think it makes sense. Will add a test as well for the diagnostic.

6554–6558

I have added a test to check this situation.

[pmatos]

Further refinement of the patch with more diagnostics tested.

[pmatos]

Remove unnecessary code.

[pmatos]

clang/lib/Sema/SemaType.cpp

7269

That's correct - removed.

[pmatos]

@aaron.ballman I have finished addressing all the concerns on this patch. Do you have any further comments?

clang/lib/Sema/SemaType.cpp

7289–7290

We'll just be overriding the address space in this case. Although, I am not sure something like this can happen in Wasm given there's only one linear memory.

[pmatos]

Rebased on current HEAD.

[aaron.ballman]

Generally LGTM with a few comments sprinkled around.

clang/include/clang/Basic/Attr.td

4054

Not due to the subjects -- keyword attributes require manual parsing and type attributes require manual processing (we don't tablegen as much as I'd like for type attributes). But that code should be accepted (you should add a test case for it as well).

clang/include/clang/Basic/AttrDocs.td

6930 ↗

(On Diff #497632)

DocCatType, right?

6933 ↗

(On Diff #497632)

"Function pointer declaration" reads a bit odd to me, I think you mean "function pointer type", right?

e.g.,
void (*)() __funcref is fine, as is void (*fp)() __funcref -- the attribute appertains to the type, not to the declaration?

clang/lib/Sema/SemaType.cpp

7247

Just to avoid confusing editors that can't tell Type is a variable and not clang::Type the type.

clang/test/Sema/wasm-refs.c

50 ↗

(On Diff #497632)

Should we also test two-level application of the qualifier, as in?

using uh_oh = funcref_t __funcref;

[pmatos]

Thanks @aaron.ballman . I think I have now address all outstanding comments.

clang/include/clang/Basic/Attr.td

4054

Seems to be fine now. Test added.

clang/include/clang/Basic/AttrDocs.td

6930 ↗

(On Diff #497632)

Yes.

clang/test/Sema/wasm-refs.c

50 ↗

(On Diff #497632)

Double qualification shouldn't be an issue - adding this to SemaCXX/wasm-funcref.cpp.

[pmatos]

Patch with all outstanding comments addressed.

[pmatos]

Add forgotten comment to test.

[pmatos]

@erichkeane @aaron.ballman any further comments on this?

[erichkeane]

First, we've been dealing with the 16.0 release process/regressions, which unfortunately got us pretty far behind on reviews. Sorry about that!

I have only 1 concern here, otherwise, this LGTM. I'll leave it to Aaron to make the final 'value judgement' of if we want to keep this, so I'll leave it to him to Approve.

clang/lib/AST/DeclBase.cpp

1056 ↗

(On Diff #501081)

probably want to canonicalize here (and above). Else typedefs-to-typedefs/etc might getcha.

[aaron.ballman]

LGTM aside from some small nits that you can fix when landing. Thank you for your patience on this review!

clang/lib/AST/DeclBase.cpp

1056 ↗

(On Diff #501081)

Yeah, I'd do that below on the return, as in: return Ty.getCanonicalType()->isFunctionPointerType();

clang/test/SemaCXX/wasm-funcref.cpp

14 ↗

(On Diff #501081)

Please add a newline to the end of the file.

[pmatos]

Thanks all for the comments, fixed and will soon land after running a check-all.

[MyDeveloperDay]

clang/lib/Format/FormatToken.h

576

Is there a unit test in clang format for this change?

clang/include/clang/AST/Type.h

public:
   /// Sizeless types contain data with no specified size, alignment,
   /// or layout.
   bool isSizelessType() const;
   bool isSizelessBuiltinType() const;
 
   /// Check if this is a WebAssembly Reference Type.
   bool isWebAssemblyReferenceType() const;
   bool isWebAssemblyExternrefType() const;
+
   /// Determines if this is a sizeless type supported by the
   /// 'arm_sve_vector_bits' type attribute, which can be applied to a single
   /// SVE vector or predicate, excluding tuple types such as svint32x4_t.
   bool isVLSTBuiltinType() const;
 
   /// Returns the representative type for the element of an SVE builtin type.
   /// This is used to represent fixed-length SVE vectors created with the
   /// 'arm_sve_vector_bits' type attribute as VectorType.
public:
   /// and vector attributes are not simple type qualifiers.
   ///
   /// Type qualifiers are often, but not always, reflected in the canonical
   /// type.
   bool isQualifier() const;
 
   bool isMSTypeSpec() const;
 
+  bool isWebAssemblyFuncrefSpec() const;
+
   bool isCallingConv() const;
 
   llvm::Optional<NullabilityKind> getImmediateNullability() const;
 
   /// Retrieve the attribute kind corresponding to the given
   /// nullability kind.
   static Kind getNullabilityAttrKind(NullabilityKind kind) {
     switch (kind) {

clang/include/clang/Basic/AddressSpaces.h

enum class LangAS : unsigned {
 
   // Pointer size and extension address spaces.
   ptr32_sptr,
   ptr32_uptr,
   ptr64,
 
   wasm_var,
   wasm_externref,
+  wasm_funcref,
+
   // This denotes the count of language-specific address spaces and also
   // the offset added to the target-specific address spaces, which are usually
   // specified by address space attributes __attribute__(address_space(n))).
   FirstTargetAddressSpace
 };
 
 /// The type of a lookup table which maps from language-specific address spaces
 /// to target-specific ones.

clang/include/clang/Basic/Attr.td

def FunctionReturnThunks : InheritableAttr,
   let Spellings = [GCC<"function_return">];
   let Args = [EnumArgument<"ThunkType", "Kind",
     ["keep", "thunk-extern"],
     ["Keep", "Extern"]
   >];
   let Subjects = SubjectList<[Function]>;
   let Documentation = [FunctionReturnThunksDocs];
 }
+
+def WebAssemblyFuncref : TypeAttr, TargetSpecificAttr<TargetWebAssembly> {
+  let Spellings = [Keyword<"__funcref">];
+  let Documentation = [Undocumented];
+}

clang/include/clang/Basic/BuiltinsWebAssembly.def

 
 TARGET_BUILTIN(__builtin_wasm_dot_i8x16_i7x16_s_i16x8, "V8sV16ScV16Sc", "nc", "relaxed-simd")
 TARGET_BUILTIN(__builtin_wasm_dot_i8x16_i7x16_add_s_i32x4, "V4iV16ScV16ScV4i", "nc", "relaxed-simd")
 
 // Reference Types builtins
 // Some builtins are polymorphic - see 't' as part of the third argument,
 // in which case the argument spec (second argument) is unused.
 TARGET_BUILTIN(__builtin_wasm_ref_null_extern, "e", "nc", "reference-types")
+// A funcref represented as a function pointer with the funcref attribute
+// attached to the type, therefore SemaChecking will check for the right
+// return type.
+TARGET_BUILTIN(__builtin_wasm_ref_null_func, "i", "nct", "reference-types")
 #undef BUILTIN
 #undef TARGET_BUILTIN

clang/include/clang/Basic/DiagnosticSemaKinds.td

def warn_objc_unsafe_perform_selector : Warning<
   "%select{struct|union|vector}1 type">,
   InGroup<DiagGroup<"objc-unsafe-perform-selector">>;
 def note_objc_unsafe_perform_selector_method_declared_here :  Note<
   "method %0 that returns %1 declared here">;
 def err_attribute_arm_builtin_alias : Error<
   "'__clang_arm_builtin_alias' attribute can only be applied to an ARM builtin">;
 def err_attribute_arm_mve_polymorphism : Error<
   "'__clang_arm_mve_strict_polymorphism' attribute can only be applied to an MVE/NEON vector type">;
+def err_attribute_webassembly_funcref : Error<
+  "'__clang_webassembly_funcref' attribute can only be applied to function pointer types">;
 
 def warn_setter_getter_impl_required : Warning<
   "property %0 requires method %1 to be defined - "
   "use @synthesize, @dynamic or provide a method implementation "
   "in this class implementation">,
   InGroup<ObjCPropertyImpl>;
 def warn_setter_getter_impl_required_in_category : Warning<
   "property %0 requires method %1 to be defined - "

 // Layout randomization diagnostics.
 def err_non_designated_init_used : Error<
   "a randomized struct can only be initialized with a designated initializer">;
 def err_cast_from_randomized_struct : Error<
   "casting from randomized structure pointer type %0 to %1">;
 
 // WebAssembly reference type and table diagnostics
 def err_wasm_reference_pointer : Error<
   "pointers to WebAssembly reference types are illegal">;
 def err_wasm_reference_reference : Error<
   "references to WebAssembly reference types are illegal">;
 def err_wasm_capture_reference : Error<
   "cannot capture WebAssembly reference">;
 def err_wasm_addrof_reference : Error<
   "cannot take address of WebAssembly reference">;
 } // end of sema component.

clang/include/clang/Basic/TokenKinds.def

 ALIAS("__volatile__" , volatile   , KEYALL)
 
 // Type nullability.
 KEYWORD(_Nonnull                 , KEYALL)
 KEYWORD(_Nullable                , KEYALL)
 KEYWORD(_Nullable_result         , KEYALL)
 KEYWORD(_Null_unspecified        , KEYALL)
 
+// WebAssembly Type Extension
+KEYWORD(__funcref                     , KEYALL)
+
 // Microsoft extensions which should be disabled in strict conformance mode
 KEYWORD(__ptr64                       , KEYMS)
 KEYWORD(__ptr32                       , KEYMS)
 KEYWORD(__sptr                        , KEYMS)
 KEYWORD(__uptr                        , KEYMS)
 KEYWORD(__w64                         , KEYMS)
 KEYWORD(__uuidof                      , KEYMS | KEYBORLAND)
 KEYWORD(__try                         , KEYMS | KEYBORLAND)

clang/include/clang/Parse/Parser.h

bool MaybeParseMicrosoftDeclSpecs(ParsedAttributes &Attrs) {
     }
     return false;
   }
   void ParseMicrosoftDeclSpecs(ParsedAttributes &Attrs);
   bool ParseMicrosoftDeclSpecArgs(IdentifierInfo *AttrName,
                                   SourceLocation AttrNameLoc,
                                   ParsedAttributes &Attrs);
   void ParseMicrosoftTypeAttributes(ParsedAttributes &attrs);
+  void ParseWebAssemblyFuncrefTypeAttribute(ParsedAttributes &attrs);
   void DiagnoseAndSkipExtendedMicrosoftTypeAttributes();
   SourceLocation SkipExtendedMicrosoftTypeAttributes();
   void ParseMicrosoftInheritanceClassAttributes(ParsedAttributes &attrs);
   void ParseBorlandTypeAttributes(ParsedAttributes &attrs);
   void ParseOpenCLKernelAttributes(ParsedAttributes &attrs);
   void ParseOpenCLQualifiers(ParsedAttributes &Attrs);
   void ParseNullabilityTypeSpecifiers(ParsedAttributes &attrs);
   void ParseCUDAFunctionAttributes(ParsedAttributes &attrs);

clang/include/clang/Sema/Sema.h

private:
   bool CheckX86BuiltinFunctionCall(const TargetInfo &TI, unsigned BuiltinID,
                                    CallExpr *TheCall);
   bool CheckPPCBuiltinFunctionCall(const TargetInfo &TI, unsigned BuiltinID,
                                    CallExpr *TheCall);
   bool CheckAMDGCNBuiltinFunctionCall(unsigned BuiltinID, CallExpr *TheCall);
   bool CheckRISCVLMUL(CallExpr *TheCall, unsigned ArgNum);
   bool CheckRISCVBuiltinFunctionCall(const TargetInfo &TI, unsigned BuiltinID,
                                      CallExpr *TheCall);
+  bool CheckWebAssemblyBuiltinFunctionCall(const TargetInfo &TI, unsigned BuiltinID,
+                                     CallExpr *TheCall);
 
   bool SemaBuiltinVAStart(unsigned BuiltinID, CallExpr *TheCall);
   bool SemaBuiltinVAStartARMMicrosoft(CallExpr *Call);
   bool SemaBuiltinUnorderedCompare(CallExpr *TheCall);
   bool SemaBuiltinFPClassification(CallExpr *TheCall, unsigned NumArgs);
   bool SemaBuiltinComplex(CallExpr *TheCall);
   bool SemaBuiltinVSX(CallExpr *TheCall);
   bool SemaBuiltinOSLogFormat(CallExpr *TheCall);
private:
   // Matrix builtin handling.
   ExprResult SemaBuiltinMatrixTranspose(CallExpr *TheCall,
                                         ExprResult CallResult);
   ExprResult SemaBuiltinMatrixColumnMajorLoad(CallExpr *TheCall,
                                               ExprResult CallResult);
   ExprResult SemaBuiltinMatrixColumnMajorStore(CallExpr *TheCall,
                                                ExprResult CallResult);
 
+  // WebAssembly builtin handling
+  bool SemaBuiltinWasmRefNullFunc(CallExpr *TheCall);
+
 public:
   enum FormatStringType {
     FST_Scanf,
     FST_Printf,
     FST_NSString,
     FST_Strftime,
     FST_Strfmon,
     FST_Kprintf,

clang/lib/AST/ASTContext.cpp

static const unsigned FakeAddrSpaceMap[] = {
         6,  // sycl_global_host
         3,  // sycl_local
         0,  // sycl_private
         10, // ptr32_sptr
         11, // ptr32_uptr
         12, // ptr64
         1,  // wasm_var
         10, // wasm_externref,
+        20, // wasm_funcref
     };
     return &FakeAddrSpaceMap;
   } else {
     return &T.getAddressSpaceMap();
   }
 }
 
 static bool isAddrSpaceMapManglingEnabled(const TargetInfo &TI,

clang/lib/AST/Type.cpp

bool AttributedType::isMSTypeSpec() const {
   case attr::Ptr64:
   case attr::SPtr:
   case attr::UPtr:
     return true;
   }
   llvm_unreachable("invalid attr kind");
 }
 
+bool AttributedType::isWebAssemblyFuncrefSpec() const {
+  return getAttrKind() == attr::WebAssemblyFuncref;
+}
+
 bool AttributedType::isCallingConv() const {
   // FIXME: Generate this with TableGen.
   switch (getAttrKind()) {
   default: return false;
   case attr::Pcs:
   case attr::CDecl:
   case attr::FastCall:
   case attr::StdCall:

clang/lib/AST/TypePrinter.cpp

if (T->isMSTypeSpec()) {
     case attr::Ptr32: OS << " __ptr32"; break;
     case attr::Ptr64: OS << " __ptr64"; break;
     case attr::SPtr: OS << " __sptr"; break;
     case attr::UPtr: OS << " __uptr"; break;
     }
     spaceBeforePlaceHolder(OS);
   }
 
+  if (T->isWebAssemblyFuncrefSpec()) {
+    assert(T->getAttrKind() == attr::WebAssemblyFuncref);
+    OS << "__funcref";
+  }
+
   // Print nullability type specifiers.
   if (T->getImmediateNullability()) {
     if (T->getAttrKind() == attr::TypeNonNull)
       OS << " _Nonnull";
     else if (T->getAttrKind() == attr::TypeNullable)
       OS << " _Nullable";
     else if (T->getAttrKind() == attr::TypeNullUnspecified)
       OS << " _Null_unspecified";
void TypePrinter::printAttributedAfter(const AttributedType *T,
   // If this is a calling convention attribute, don't print the implicit CC from
   // the modified type.
   SaveAndRestore<bool> MaybeSuppressCC(InsideCCAttribute, T->isCallingConv());
 
   printAfter(T->getModifiedType(), OS);
 
   // Some attributes are printed as qualifiers before the type, so we have
   // nothing left to do.
-  if (T->getAttrKind() == attr::ObjCKindOf ||
-      T->isMSTypeSpec() || T->getImmediateNullability())
+  if (T->getAttrKind() == attr::ObjCKindOf || T->isMSTypeSpec() ||
+      T->getImmediateNullability() || T->isWebAssemblyFuncrefSpec())
     return;
 
   // Don't print the inert __unsafe_unretained attribute at all.
   if (T->getAttrKind() == attr::ObjCInertUnsafeUnretained)
     return;
 
   // Don't print ns_returns_retained unless it had an effect.
   if (T->getAttrKind() == attr::NSReturnsRetained &&
#include "clang/Basic/AttrList.inc"
   case attr::ObjCOwnership:
   case attr::Ptr32:
   case attr::Ptr64:
   case attr::SPtr:
   case attr::UPtr:
   case attr::AddressSpace:
   case attr::CmseNSCall:
   case attr::AnnotateType:
+  case attr::WebAssemblyFuncref:
     llvm_unreachable("This attribute should have been handled already");
 
   case attr::NSReturnsRetained:
     OS << "ns_returns_retained";
     break;
 
   // FIXME: When Sema learns to form this AttributedType, avoid printing the
   // attribute again in printFunctionProtoAfter.
std::string Qualifiers::getAddrSpaceAsString(LangAS AS) {
   case LangAS::cuda_shared:
     return "__shared__";
   case LangAS::ptr32_sptr:
     return "__sptr __ptr32";
   case LangAS::ptr32_uptr:
     return "__uptr __ptr32";
   case LangAS::ptr64:
     return "__ptr64";
+  case LangAS::wasm_funcref:
+    return "__funcref";
   default:
     return std::to_string(toTargetAddressSpace(AS));
   }
 }
 
 // Appends qualifiers to the given string, separated by spaces.  Will
 // prefix a space if the string is non-empty.  Will not append a final
 // space.

clang/lib/Basic/Targets/DirectX.h

static const unsigned DirectXAddrSpaceMap[] = {
     0, // sycl_global_device
     0, // sycl_global_host
     0, // sycl_local
     0, // sycl_private
     0, // ptr32_sptr
     0, // ptr32_uptr
     0, // ptr64
     1, // wasm_var
     10,// wasm_externref
+    20,// wasm_funcref
 };
 
 class LLVM_LIBRARY_VISIBILITY DirectXTargetInfo : public TargetInfo {
 public:
   DirectXTargetInfo(const llvm::Triple &Triple, const TargetOptions &)
       : TargetInfo(Triple) {
     TLSSupported = false;
     VLASupported = false;

clang/lib/Basic/Targets/NVPTX.h

static const unsigned NVPTXAddrSpaceMap[] = {
     1, // sycl_global_host
     3, // sycl_local
     0, // sycl_private
     0, // ptr32_sptr
     0, // ptr32_uptr
     0, // ptr64
     1, // wasm_var
     10,// wasm_externref
+    20,// wasm_funcref
 };
 
 /// The DWARF address class. Taken from
 /// https://docs.nvidia.com/cuda/archive/10.0/ptx-writers-guide-to-interoperability/index.html#cuda-specific-dwarf
 static const int NVPTXDWARFAddrSpaceMap[] = {
     -1, // Default, opencl_private or opencl_generic - not defined
     5,  // opencl_global
     -1,

clang/lib/Basic/Targets/SPIR.h

static const unsigned SPIRDefIsPrivMap[] = {
     0, // sycl_global_host
     0, // sycl_local
     0, // sycl_private
     0, // ptr32_sptr
     0, // ptr32_uptr
     0, // ptr64
     1, // wasm_var
     10,// wasm_externref
+    20,// wasm_funcref
 };
 
 // Used by both the SPIR and SPIR-V targets.
 static const unsigned SPIRDefIsGenMap[] = {
     4, // Default
     // OpenCL address space values for this map are dummy and they can't be used
     0, // opencl_global
     0, // opencl_local
static const unsigned SPIRDefIsGenMap[] = {
     6, // sycl_global_host
     3, // sycl_local
     0, // sycl_private
     0, // ptr32_sptr
     0, // ptr32_uptr
     0, // ptr64
     1, // wasm_var
     10,// wasm_externref
+    20,// wasm_funcref
 };
 
 // Base class for SPIR and SPIR-V target info.
 class LLVM_LIBRARY_VISIBILITY BaseSPIRTargetInfo : public TargetInfo {
 protected:
   BaseSPIRTargetInfo(const llvm::Triple &Triple, const TargetOptions &)
       : TargetInfo(Triple) {
     assert((Triple.isSPIR() || Triple.isSPIRV()) &&

clang/lib/Basic/Targets/TCE.h

static const unsigned TCEOpenCLAddrSpaceMap[] = {
     0, // sycl_global_host
     0, // sycl_local
     0, // sycl_private
     0, // ptr32_sptr
     0, // ptr32_uptr
     0, // ptr64
     1, // wasm_var
     10,// wasm_externref
+    20,// wasm_funcref
 };
 
 class LLVM_LIBRARY_VISIBILITY TCETargetInfo : public TargetInfo {
 public:
   TCETargetInfo(const llvm::Triple &Triple, const TargetOptions &)
       : TargetInfo(Triple) {
     TLSSupported = false;
     IntWidth = 32;

clang/lib/Basic/Targets/WebAssembly.h

 #include "clang/Basic/TargetInfo.h"
 #include "clang/Basic/TargetOptions.h"
 #include "llvm/ADT/Triple.h"
 #include "llvm/Support/Compiler.h"
 
 namespace clang {
 namespace targets {
 
+static const unsigned WebAssemblyAddrSpaceMap[] = {
+    0,  // Default
+    0,  // opencl_global
+    0,  // opencl_local
+    0,  // opencl_constant
+    0,  // opencl_private
+    0,  // opencl_generic
+    0,  // opencl_global_device
+    0,  // opencl_global_host
+    0,  // cuda_device
+    0,  // cuda_constant
+    0,  // cuda_shared
+    0,  // sycl_global
+    0,  // sycl_global_device
+    0,  // sycl_global_host
+    0,  // sycl_local
+    0,  // sycl_private
+    0,  // ptr32_sptr
+    0,  // ptr32_uptr
+    0,  // ptr64
+    1,  // wasm_var
+    10, // wasm_externref,
+    20, // wasm_funcref
+};
+
 class LLVM_LIBRARY_VISIBILITY WebAssemblyTargetInfo : public TargetInfo {
   static const Builtin::Info BuiltinInfo[];
 
   enum SIMDEnum {
     NoSIMD,
     SIMD128,
     RelaxedSIMD,
   } SIMDLevel = NoSIMD;
class LLVM_LIBRARY_VISIBILITY WebAssemblyTargetInfo : public TargetInfo {
   bool HasReferenceTypes = false;
   bool HasExtendedConst = false;
 
   std::string ABI;
 
 public:
   explicit WebAssemblyTargetInfo(const llvm::Triple &T, const TargetOptions &)
       : TargetInfo(T) {
+    AddrSpaceMap = &WebAssemblyAddrSpaceMap;
     NoAsmVariants = true;
     SuitableAlign = 128;
     LargeArrayMinWidth = 128;
     LargeArrayAlign = 128;
     SimdDefaultAlign = 128;
     SigAtomicType = SignedLong;
     LongDoubleWidth = LongDoubleAlign = 128;
     LongDoubleFormat = &llvm::APFloat::IEEEquad();

clang/lib/Basic/Targets/X86.h

static const unsigned X86AddrSpaceMap[] = {
     0,   // sycl_global_host
     0,   // sycl_local
     0,   // sycl_private
     270, // ptr32_sptr
     271, // ptr32_uptr
     272, // ptr64
     1,   // wasm_var
     10,  // wasm_externref,
+    20,  // wasm_funcref
 };
 
 // X86 target abstract base class; x86-32 and x86-64 are very close, so
 // most of the implementation can be shared.
 class LLVM_LIBRARY_VISIBILITY X86TargetInfo : public TargetInfo {
 
   enum X86SSEEnum {
     NoSSE,

clang/lib/CodeGen/CGBuiltin.cpp

case WebAssembly::BI__builtin_wasm_nearest_f64x2: {
     Value *Value = EmitScalarExpr(E->getArg(0));
     Function *Callee = CGM.getIntrinsic(IntNo, ConvertType(E->getType()));
     return Builder.CreateCall(Callee, Value);
   }
   case WebAssembly::BI__builtin_wasm_ref_null_extern: {
     Function *Callee = CGM.getIntrinsic(Intrinsic::wasm_ref_null_extern);
     return Builder.CreateCall(Callee);
   }
+  case WebAssembly::BI__builtin_wasm_ref_null_func: {
+    Function *Callee = CGM.getIntrinsic(Intrinsic::wasm_ref_null_func);
+    return Builder.CreateCall(Callee);
+  }
   case WebAssembly::BI__builtin_wasm_swizzle_i8x16: {
     Value *Src = EmitScalarExpr(E->getArg(0));
     Value *Indices = EmitScalarExpr(E->getArg(1));
     Function *Callee = CGM.getIntrinsic(Intrinsic::wasm_swizzle);
     return Builder.CreateCall(Callee, {Src, Indices});
   }
   case WebAssembly::BI__builtin_wasm_add_sat_s_i8x16:
   case WebAssembly::BI__builtin_wasm_add_sat_u_i8x16:

clang/lib/CodeGen/TargetInfo.h

public:
   /// Return the device-side type for the CUDA device builtin texture type.
   virtual llvm::Type *getCUDADeviceBuiltinTextureDeviceType() const {
     // By default, no change from the original one.
     return nullptr;
   }
 
   /// Return the WebAssembly externref reference type.
   virtual llvm::Type *getWasmExternrefReferenceType() const { return nullptr; }
+  /// Return the WebAssembly funcref reference type.
+  virtual llvm::Type *getWasmFuncrefReferenceType() const { return nullptr; }
+
   /// Emit the device-side copy of the builtin surface type.
   virtual bool emitCUDADeviceBuiltinSurfaceDeviceCopy(CodeGenFunction &CGF,
                                                       LValue Dst,
                                                       LValue Src) const {
     // DO NOTHING by default.
     return false;
   }
   /// Emit the device-side copy of the builtin texture type.

clang/lib/CodeGen/TargetInfo.cpp

if (auto *FD = dyn_cast_or_null<FunctionDecl>(D)) {
         Fn->addFnAttr("no-prototype");
     }
   }
 
   /// Return the WebAssembly externref reference type.
   virtual llvm::Type *getWasmExternrefReferenceType() const override {
     return llvm::Type::getWasm_ExternrefTy(getABIInfo().getVMContext());
   }
+  /// Return the WebAssembly funcref reference type.
+  virtual llvm::Type *getWasmFuncrefReferenceType() const override {
+    return llvm::Type::getWasm_FuncrefTy(getABIInfo().getVMContext());
+  }
 };
 
 /// Classify argument of given type \p Ty.
 ABIArgInfo WebAssemblyABIInfo::classifyArgumentType(QualType Ty) const {
   Ty = useFirstFieldIfTransparentUnion(Ty);
 
   if (isAggregateTypeForABI(Ty)) {
     // Records with non-trivial destructors/copy-constructors should not be

clang/lib/Format/FormatToken.h

bool isAccessSpecifier(bool ColonRequired = true) const {
     return isOneOf(tok::kw_public, tok::kw_protected, tok::kw_private) &&
            (!ColonRequired || (Next && Next->is(tok::colon)));
   }
 
   bool canBePointerOrReferenceQualifier() const {
     return isOneOf(tok::kw_const, tok::kw_restrict, tok::kw_volatile,
                    tok::kw___attribute, tok::kw__Nonnull, tok::kw__Nullable,
                    tok::kw__Null_unspecified, tok::kw___ptr32, tok::kw___ptr64,
-                   TT_AttributeMacro);
+                   tok::kw___funcref, TT_AttributeMacro);
   }
 
   /// Determine whether the token is a simple-type-specifier.
   LLVM_NODISCARD bool isSimpleTypeSpecifier() const;
 
   LLVM_NODISCARD bool isTypeOrIdentifier() const;
 
   bool isObjCAccessSpecifier() const {

clang/lib/Parse/ParseDecl.cpp

case tok::kw___uptr: {
       break;
     }
     default:
       return;
     }
   }
 }
 
+void Parser::ParseWebAssemblyFuncrefTypeAttribute(ParsedAttributes &attrs) {
+  if (Tok.getKind() == tok::kw___funcref) {
+    IdentifierInfo *AttrName = Tok.getIdentifierInfo();
+    SourceLocation AttrNameLoc = ConsumeToken();
+    attrs.addNew(AttrName, AttrNameLoc, nullptr, AttrNameLoc, nullptr, 0,
+                 ParsedAttr::AS_Keyword);
+  } else {
+    return;
+  }
+}
+
 void Parser::DiagnoseAndSkipExtendedMicrosoftTypeAttributes() {
   SourceLocation StartLoc = Tok.getLocation();
   SourceLocation EndLoc = SkipExtendedMicrosoftTypeAttributes();
 
   if (EndLoc.isValid()) {
     SourceRange Range(StartLoc, EndLoc);
     Diag(StartLoc, diag::warn_microsoft_qualifiers_ignored) << Range;
   }
 }
 
while (true) {
     case tok::kw___stdcall:
     case tok::kw___fastcall:
     case tok::kw___thiscall:
     case tok::kw___regcall:
     case tok::kw___vectorcall:
       ParseMicrosoftTypeAttributes(DS.getAttributes());
       continue;
 
+    case tok::kw___funcref:
+      ParseWebAssemblyFuncrefTypeAttribute(DS.getAttributes());
+      continue;
+
     // Borland single token adornments.
     case tok::kw___pascal:
       ParseBorlandTypeAttributes(DS.getAttributes());
       continue;
 
     // OpenCL single token adornments.
     case tok::kw___kernel:
       ParseOpenCLKernelAttributes(DS.getAttributes());
#include "clang/Basic/OpenCLImageTypes.def"
   case tok::kw___private:
   case tok::kw___local:
   case tok::kw___global:
   case tok::kw___constant:
   case tok::kw___generic:
   case tok::kw___read_only:
   case tok::kw___read_write:
   case tok::kw___write_only:
+
+  case tok::kw___funcref:
     return true;
 
   case tok::kw_private:
     return getLangOpts().OpenCL;
 
   // C11 _Atomic
   case tok::kw__Atomic:
     return true;
bool Parser::isDeclarationSpecifier(bool DisambiguatingWithExpression) {
   case tok::kw___constant:
   case tok::kw___generic:
   case tok::kw___read_only:
   case tok::kw___read_write:
   case tok::kw___write_only:
 #define GENERIC_IMAGE_TYPE(ImgType, Id) case tok::kw_##ImgType##_t:
 #include "clang/Basic/OpenCLImageTypes.def"
 
+  case tok::kw___funcref:
     return true;
 
   case tok::kw_private:
     return getLangOpts().OpenCL;
   }
 }
 
 bool Parser::isConstructorDeclarator(bool IsUnqualified, bool DeductionGuide) {
while (true) {
     case tok::kw___thiscall:
     case tok::kw___regcall:
     case tok::kw___vectorcall:
       if (AttrReqs & AR_DeclspecAttributesParsed) {
         ParseMicrosoftTypeAttributes(DS.getAttributes());
         continue;
       }
       goto DoneWithTypeQuals;
+
+    case tok::kw___funcref:
+      if (AttrReqs & AR_DeclspecAttributesParsed) {
+        ParseWebAssemblyFuncrefTypeAttribute(DS.getAttributes());
+        continue;
+      }
+      goto DoneWithTypeQuals;
+
     case tok::kw___pascal:
       if (AttrReqs & AR_VendorAttributesParsed) {
         ParseBorlandTypeAttributes(DS.getAttributes());
         continue;
       }
       goto DoneWithTypeQuals;
 
     // Nullability type specifiers.

clang/lib/Parse/ParseTentative.cpp

Parser::isCXXDeclarationSpecifier(Parser::TPResult BracedCastResult,
   case tok::kw___unaligned:
   case tok::kw__Nonnull:
   case tok::kw__Nullable:
   case tok::kw__Nullable_result:
   case tok::kw__Null_unspecified:
   case tok::kw___kindof:
     return TPResult::True;
 
+    // WebAssemblyFuncref
+  case tok::kw___funcref:
+    return TPResult::True;
+
     // Borland
   case tok::kw___pascal:
     return TPResult::True;
 
     // AltiVec
   case tok::kw___vector:
     return TPResult::True;
 

clang/lib/Sema/SemaChecking.cpp

bool Sema::CheckSystemZBuiltinFunctionCall(unsigned BuiltinID,
   case SystemZ::BI__builtin_s390_vclfnls:
   case SystemZ::BI__builtin_s390_vcfn:
   case SystemZ::BI__builtin_s390_vcnf: i = 1; l = 0; u = 15; break;
   case SystemZ::BI__builtin_s390_vcrnfs: i = 2; l = 0; u = 15; break;
   }
   return SemaBuiltinConstantArgRange(TheCall, i, l, u);
 }
 
+bool Sema::CheckWebAssemblyBuiltinFunctionCall(const TargetInfo &TI,
+                                               unsigned BuiltinID,
+                                               CallExpr *TheCall) {
+  switch (BuiltinID) {
+  case WebAssembly::BI__builtin_wasm_ref_null_func:
+    return (SemaBuiltinWasmRefNullFunc(TheCall));
+  }
+
+  return false;
+}
+
 /// SemaBuiltinCpuSupports - Handle __builtin_cpu_supports(char *).
 /// This checks that the target supports __builtin_cpu_supports and
 /// that the string argument is constant and valid.
 static bool SemaBuiltinCpuSupports(Sema &S, const TargetInfo &TI,
                                    CallExpr *TheCall) {
   Expr *Arg = TheCall->getArg(0);
 
   // Check if the argument is a string literal.
static bool checkBuiltinArgument(Sema &S, CallExpr *E, unsigned ArgIndex) {
   Arg = S.PerformCopyInitialization(Entity, SourceLocation(), Arg);
   if (Arg.isInvalid())
     return true;
 
   E->setArg(ArgIndex, Arg.get());
   return false;
 }
 
+bool Sema::SemaBuiltinWasmRefNullFunc(CallExpr *TheCall) {
+  if (TheCall->getNumArgs() != 0)
+    return true;
+
+  // The call we get looks like
+  // CallExpr
+  // `- ImplicitCastExpr
+  //   `- DeclRefExpr
+  //
+  // Therefore we need to change the types of the DeclRefExpr (stored in FDecl)
+  // and regenerate a straight up CallExpr on the modified FDecl.
+  // returning
+  // CallExpr
+  // `- FunctionDecl
+
+  // Prepare FDecl type
+  QualType Pointee = Context.getFunctionType(Context.VoidTy, {}, {});
+  QualType Type = Context.getPointerType(Pointee);
+  Pointee = Context.getAddrSpaceQualType(Pointee, LangAS::wasm_funcref);
+  Type = Context.getAttributedType(attr::WebAssemblyFuncref, Type,
+                                   Context.getPointerType(Pointee));
+  TheCall->setType(Type);
+
+  return false;
+}
+
 /// We have a call to a function like __sync_fetch_and_add, which is an
 /// overloaded function based on the pointer type of its first argument.
 /// The main BuildCallExpr routines have already promoted the types of
 /// arguments because all of these calls are prototyped as void(...).
 ///
 /// This function goes through and does final semantic checking for these
 /// builtins, as well as generating any warnings.
 ExprResult

clang/lib/Sema/SemaDecl.cpp

ParmVarDecl *Sema::CheckParameter(DeclContext *DC, SourceLocation StartLoc,
   // ISO/IEC TR 18037 S6.7.3: "The type of an object with automatic storage
   // duration shall not be qualified by an address-space qualifier."
   // Since all parameters have automatic store duration, they can not have
   // an address space.
   if (T.getAddressSpace() != LangAS::Default &&
       // OpenCL allows function arguments declared to be an array of a type
       // to be qualified with an address space.
       !(getLangOpts().OpenCL &&
-        (T->isArrayType() || T.getAddressSpace() == LangAS::opencl_private))) {
+        (T->isArrayType() || T.getAddressSpace() == LangAS::opencl_private)) &&
+      // WebAssembly allows reference types as parameters. Funcref in particular
+      // lives in a different address space
+      !(T->isFunctionPointerType() &&
+        T.getAddressSpace() == LangAS::wasm_funcref)) {
     Diag(NameLoc, diag::err_arg_with_address_space);
     New->setInvalidDecl();
   }
 
   // PPC MMA non-pointer types are not allowed as function argument types.
   if (Context.getTargetInfo().getTriple().isPPC64() &&
       CheckPPCMMAType(New->getOriginalType(), New->getLocation())) {
     New->setInvalidDecl();

clang/lib/Sema/SemaType.cpp

static bool handleMSPointerTypeQualifierAttr(TypeProcessingState &State,
   QualType Pointee = Type->getPointeeType();
   if (ASIdx != LangAS::Default)
     Pointee = S.Context.getAddrSpaceQualType(
         S.Context.removeAddrSpaceQualType(Pointee), ASIdx);
   Type = State.getAttributedType(A, Type, S.Context.getPointerType(Pointee));
   return false;
 }
 
+static bool HandleWebAssemblyFuncrefAttr(TypeProcessingState &State,
+                                         QualType &Type, ParsedAttr &PAttr) {
+  assert(PAttr.getKind() == ParsedAttr::AT_WebAssemblyFuncref);
+
+  Sema &S = State.getSema();
+  Attr *A = createSimpleAttr<WebAssemblyFuncrefAttr>(S.Context, PAttr);
+
+  std::bitset<attr::LastAttr> Attrs;
+  attr::Kind NewAttrKind = A->getKind();
+  QualType Desugared = Type;
+  const AttributedType *AT = dyn_cast<AttributedType>(Type);
+  while (AT) {
+    Attrs[AT->getAttrKind()] = true;
+    Desugared = AT->getModifiedType();
+    AT = dyn_cast<AttributedType>(Desugared);
+  }
+
+  // You cannot specify duplicate type attributes, so if the attribute has
+  // already been applied, flag it.
+  if (Attrs[NewAttrKind]) {
+    S.Diag(PAttr.getLoc(), diag::warn_duplicate_attribute_exact) << PAttr;
+    return true;
+  }
+  Attrs[NewAttrKind] = true;
+
+  // Pointer type qualifiers can only operate on pointer types, but not
+  // pointer-to-member types.
+  //
+  // FIXME: Should we really be disallowing this attribute if there is any
+  // type sugar between it and the pointer (other than attributes)? Eg, this
+  // disallows the attribute on a parenthesized pointer.
+  // And if so, should we really allow *any* type attribute?
+  if (!isa<PointerType>(Desugared)) {
+    if (Type->isMemberPointerType())
+      S.Diag(PAttr.getLoc(), diag::err_attribute_no_member_pointers) << PAttr;
+    else
+      S.Diag(PAttr.getLoc(), diag::err_attribute_pointers_only) << PAttr << 0;
+    return true;
+  }
+
+  // Add address space to type based on its attributes.
+  LangAS ASIdx = LangAS::wasm_funcref;
+  QualType Pointee = Type->getPointeeType();
+  Pointee = S.Context.getAddrSpaceQualType(
+      S.Context.removeAddrSpaceQualType(Pointee), ASIdx);
+  Type = State.getAttributedType(A, Type, S.Context.getPointerType(Pointee));
+  return false;
+}
+
 /// Map a nullability attribute kind to a nullability kind.
 static NullabilityKind mapNullabilityAttrKind(ParsedAttr::Kind kind) {
   switch (kind) {
   case ParsedAttr::AT_TypeNonNull:
     return NullabilityKind::NonNull;
 
   case ParsedAttr::AT_TypeNullable:
     return NullabilityKind::Nullable;
case ParsedAttr::AT_NoDeref: {
       break;
     }
 
     case ParsedAttr::AT_MatrixType:
       HandleMatrixTypeAttr(type, attr, state.getSema());
       attr.setUsedAsTypeAttr();
       break;
 
+    case ParsedAttr::AT_WebAssemblyFuncref: {
+      if (!HandleWebAssemblyFuncrefAttr(state, type, attr))
+        attr.setUsedAsTypeAttr();
+      break;
+    }
+
     MS_TYPE_ATTRS_CASELIST:
       if (!handleMSPointerTypeQualifierAttr(state, attr, type))
         attr.setUsedAsTypeAttr();
       break;
 
 
     NULLABILITY_TYPE_ATTRS_CASELIST:
       // Either add nullability here or try to distribute it.  We

clang/test/CodeGen/WebAssembly/wasm-funcref.c

+// NOTE: Assertions have been autogenerated by utils/update_cc_test_checks.py
+// RUN: %clang_cc1 -triple wasm32 -target-feature +reference-types -o - -emit-llvm %s | FileCheck %s
+
+typedef void (*__funcref funcref_t)();
+typedef int (*__funcref fn_funcref_t)(int);
+typedef int (*fn_t)(int);
+
+// Null funcref builtin call
+// CHECK-LABEL: @get_null(
+// CHECK-NEXT:  entry:
+// CHECK-NEXT:    [[TMP0:%.*]] = call ptr addrspace(20) @llvm.wasm.ref.null.func()
+// CHECK-NEXT:    ret ptr addrspace(20) [[TMP0]]
+//
+funcref_t get_null() {
+  return __builtin_wasm_ref_null_func();
+}
+
+// Call to null funcref builtin but requires cast since
+// default return value for builtin is a funcref with function type () -> ().
+// CHECK-LABEL: @get_null_ii(
+// CHECK-NEXT:  entry:
+// CHECK-NEXT:    [[TMP0:%.*]] = call ptr addrspace(20) @llvm.wasm.ref.null.func()
+// CHECK-NEXT:    ret ptr addrspace(20) [[TMP0]]
+//
+fn_funcref_t get_null_ii() {
+  return (fn_funcref_t) __builtin_wasm_ref_null_func();
+}
+
+// Identity function for funcref.
+// CHECK-LABEL: @identity(
+// CHECK-NEXT:  entry:
+// CHECK-NEXT:    [[FN_ADDR:%.*]] = alloca ptr addrspace(20), align 4
+// CHECK-NEXT:    store ptr addrspace(20) [[FN:%.*]], ptr [[FN_ADDR]], align 4
+// CHECK-NEXT:    [[TMP0:%.*]] = load ptr addrspace(20), ptr [[FN_ADDR]], align 4
+// CHECK-NEXT:    ret ptr addrspace(20) [[TMP0]]
+//
+funcref_t identity(funcref_t fn) {
+  return fn;
+}
+
+void helper(funcref_t);
+
+// Pass funcref ref as an argument to a helper function.
+// CHECK-LABEL: @handle(
+// CHECK-NEXT:  entry:
+// CHECK-NEXT:    [[FN_ADDR:%.*]] = alloca ptr addrspace(20), align 4
+// CHECK-NEXT:    store ptr addrspace(20) [[FN:%.*]], ptr [[FN_ADDR]], align 4
+// CHECK-NEXT:    [[TMP0:%.*]] = load ptr addrspace(20), ptr [[FN_ADDR]], align 4
+// CHECK-NEXT:    call void @helper(ptr addrspace(20) noundef [[TMP0]])
+// CHECK-NEXT:    ret i32 0
+//
+int handle(funcref_t fn) {
+  helper(fn);
+  return 0;
+}
+
+// Return funcref from function pointer.
+// CHECK-LABEL: @get_ref(
+// CHECK-NEXT:  entry:
+// CHECK-NEXT:    [[FNPTR_ADDR:%.*]] = alloca ptr, align 4
+// CHECK-NEXT:    store ptr [[FNPTR:%.*]], ptr [[FNPTR_ADDR]], align 4
+// CHECK-NEXT:    [[TMP0:%.*]] = load ptr, ptr [[FNPTR_ADDR]], align 4
+// CHECK-NEXT:    [[TMP1:%.*]] = addrspacecast ptr [[TMP0]] to ptr addrspace(20)
+// CHECK-NEXT:    ret ptr addrspace(20) [[TMP1]]
+//
+fn_funcref_t get_ref(fn_t fnptr) {
+  return (fn_funcref_t) fnptr;
+}
+
+// Call funcref
+// CHECK-LABEL: @call_fn(
+// CHECK-NEXT:  entry:
+// CHECK-NEXT:    [[REF_ADDR:%.*]] = alloca ptr addrspace(20), align 4
+// CHECK-NEXT:    [[X_ADDR:%.*]] = alloca i32, align 4
+// CHECK-NEXT:    store ptr addrspace(20) [[REF:%.*]], ptr [[REF_ADDR]], align 4
+// CHECK-NEXT:    store i32 [[X:%.*]], ptr [[X_ADDR]], align 4
+// CHECK-NEXT:    [[TMP0:%.*]] = load ptr addrspace(20), ptr [[REF_ADDR]], align 4
+// CHECK-NEXT:    [[TMP1:%.*]] = load i32, ptr [[X_ADDR]], align 4
+// CHECK-NEXT:    [[CALL:%.*]] = call addrspace(20) i32 [[TMP0]](i32 noundef [[TMP1]])
+// CHECK-NEXT:    ret i32 [[CALL]]
+//
+int call_fn(fn_funcref_t ref, int x) {
+  return ref(x);
+}

clang/test/SemaTemplate/address_space-dependent.cpp

 
 template <int I>
 void neg() {
   __attribute__((address_space(I))) int *bounds; // expected-error {{address space is negative}}
 }
 
 template <long int I>
 void tooBig() {
-  __attribute__((address_space(I))) int *bounds; // expected-error {{address space is larger than the maximum supported (8388586)}}
+  __attribute__((address_space(I))) int *bounds; // expected-error {{address space is larger than the maximum supported (8388585)}}
 }
 
 template <long int I>
 void correct() {
   __attribute__((address_space(I))) int *bounds;
 }
 
 template <int I, int J>

 
 int main() {
   int __attribute__((address_space(1))) * p1;
   int p = GetAddressSpaceValue(p1);
 
   car<1, 2, 3>(); // expected-note {{in instantiation of function template specialization 'car<1, 2, 3>' requested here}}
   HasASTemplateFields<1> HASTF;
   neg<-1>(); // expected-note {{in instantiation of function template specialization 'neg<-1>' requested here}}
-  correct<0x7FFFEA>();
+  correct<0x7FFFE9>();
   tooBig<8388650>(); // expected-note {{in instantiation of function template specialization 'tooBig<8388650L>' requested here}}
 
   __attribute__((address_space(1))) char *x;
   __attribute__((address_space(2))) char *y;
   cmp<1, 2>(x, y); // expected-note {{in instantiation of function template specialization 'cmp<1, 2>' requested here}}
 
   fooFunction<1> ff;
   ff.get_0(); // expected-note {{in instantiation of member function 'fooFunction<1>::get_0' requested here}}
   ff.qf();
   ff.test3(); // expected-note {{in instantiation of member function 'fooFunction<1>::test3' requested here}}
 
   static_assert(partial_spec_deduce_as<int __attribute__((address_space(3))) *>::value == 3, "address space value has been incorrectly deduced");
 
   return 0;
 }