[WebAssembly] Initial support for reference type funcref in clang

[pmatos]

Summary

This is the funcref counterpart to 104bad5a. We introduce a new attribute
that marks a function pointer as a funcref. It also implements builtin
__builtin_wasm_ref_null_func(), that returns a null funcref value.

[pmatos]

Rebase on top of main. Add missing code in Sema* to ensure the new funcref builtin is checked for.
Thanks to @asb for helping fix this.

[pmatos]

Update the patch as there were some missing calls from SemaChecking.
Thanks to @asb for spotting it.

[pmatos]

It would be great to get this landed. Can someone pls take a look at it? It's quite independent from the remainder of the work and self-contained.

maybe @tlively ping?

[tlively]

Oops, sorry about that. Will take a look.

[tlively]

It would be good to add tests for more error conditions like in the externref patch and also additional errors like trying to apply __funcref to types that aren't function pointers.

clang/include/clang/Basic/Attr.td

4099

It would be good to document this!

clang/lib/Sema/SemaChecking.cpp

4532

Are the extra parentheses meaningful here?

6561–6564

How do these parts correspond to the original source code?

[aaron.ballman]

Same question here about an RFC for adding this new type to the type system and a design document for how the type behaves as in https://reviews.llvm.org/D122215.

clang/include/clang/Basic/Attr.td

4099

It's a requirement that this be documented. Also, this should probably have a Subjects line that expects a function of some sort? (It doesn't impact the semantics of anything, but it self-documents the expectations for people reading Attr.td.)

clang/include/clang/Basic/DiagnosticSemaKinds.td

7342

1. What is __clang_webassembly_funcref? Did you mean __funcref?
2. There's no test coverage for this diagnostic.

clang/include/clang/Basic/TokenKinds.def

668

Why is this a keyword in all language modes?

clang/include/clang/Parse/Parser.h

2844

clang/include/clang/Sema/Sema.h

13137–13138

Formatting is off here.

13203

I think there's a verb missing from this function identifier -- also, I don't think we need to continue the terrible trend of prepending Sema onto the function name which lives in the Sema object.

clang/lib/AST/ASTContext.cpp

957

Where did this value come from?

clang/lib/Parse/ParseDecl.cpp

845–846

851–854

5790

Why that specific ordering as opposed to AR_VendorAttributesParsed?

clang/lib/Sema/SemaChecking.cpp

6566–6570

Why would we need to do this?? And what do we do when there is no FunctionDecl to get back to (because it's a call expression through a function pointer, for example)?

6573

Why are you guaranteed this function returns void?

clang/lib/Sema/SemaType.cpp

7274

7287

This seems like it's not used.

7307–7308

What happens when the user's function already has an explicitly specified address space?

[pmatos]

clang/lib/AST/ASTContext.cpp

957

Unsure what you mean here. This is the address space number we also use on the LLVM side.

[aaron.ballman]

clang/lib/AST/ASTContext.cpp

957

Unsure what you mean here. This is the address space number we also use on the LLVM side.

That's exactly what I was looking for -- I wanted to make sure this agreed with the LLVM side of things and any public documentation about address spaces for WASM.

[pmatos]

Rebase

[pmatos]

clang/lib/AST/ASTContext.cpp

957

Unsure what you mean here. This is the address space number we also use on the LLVM side.

That's exactly what I was looking for -- I wanted to make sure this agreed with the LLVM side of things and any public documentation about address spaces for WASM.

Sure! Marking as done.

[pmatos]

clang/include/clang/Basic/DiagnosticSemaKinds.td

7342

1. What is __clang_webassembly_funcref? Did you mean __funcref?
2. There's no test coverage for this diagnostic.

Yes, I meant __funcref. Thanks, will add test coverage for the diagnostic.

clang/include/clang/Basic/TokenKinds.def

668

I might have misread the docs but this keyword should be available for both C and C++. Maybe I want KEYC99 | KEYCXX ?

clang/include/clang/Sema/Sema.h

13137–13138

Don't understand why. It's the same as CheckRISCVBuiltinFunctionCall ?

[pmatos]

Addressed some of the concerns from the comments but not ready for review yet.

[pmatos]

Address most of the comments.

[pmatos]

Updated this revision on top of D122215.

[pmatos]

Ready for review.

RFC: https://discourse.llvm.org/t/rfc-webassembly-reference-types-in-clang/66939

[pmatos]

Rebase on top of main.

[pmatos]

@aaron.ballman Hi Aaron, since you requested an RFC for this. I wonder if you have any comments for this or the other related patches: D122215, D139010

[aaron.ballman]

In D128440#4042753, @pmatos wrote:

@aaron.ballman Hi Aaron, since you requested an RFC for this. I wonder if you have any comments for this or the other related patches: D122215, D139010

I appreciate your patience with the extreme delay on getting you feedback after I asked you to post the RFC; I wanted to give the RFC a chance to bake and then ran into the holiday season as a result. Sorry for that!

Adding @erichkeane as new attributes code owner as well, in case he's got additional thoughts.

clang/include/clang/Basic/TokenKinds.def

668

I was thinking this keyword would only work for a web assembly target, so we'd likely want to add KEYWEBASM or something to the list like we have for KEYALTIVEC. But now I'm second-guessing that instinct and am wondering what behavior we want here.

1. Parse the keyword in all language modes and for all targets, give an ignored attribute warning if the target isn't web assembly
2. Parse the keyword in all language modes and for all targets, give a parse time diagnostic (error?) if the target isn't web assembly
3. Only expose the keyword if the target is web assembly, otherwise it parses as an identifier and you get the usual parse errors

My original thinking was that we wanted #3, but on reflection both #1 and #2 seem reasonable to me. Do you have a preference? I think I prefer either 2 or 3 over 1 because this involves the type system (errors are usually a better approach in that case).

clang/lib/AST/TypePrinter.cpp

1643–1644

I'm not certain that the assert adds much here given that the predicate tests exactly the same thing, perhaps remove it (and drop the curly braces)?

clang/lib/Basic/Targets/WebAssembly.h

44–45

I'm not super familiar with the address space maps, but this sets of my spidey senses. All of the other address space maps end with:

ptr64, hlsl_groupshared, wasm_funcref

but this one is ending with:

ptr64, wasm_externref, wasm_funcref

which makes me think something's amiss here. Thoughts?

clang/lib/Parse/ParseDecl.cpp

846

I think we should assert this condition; we already know what the token is before we call this function anyway.

5790–5793

I don't think we need to care about attribute requirements because this is a keyword attribute (this feature is used to prohibit attributes in certain grammars and I don't think that applies here).

clang/lib/Sema/SemaChecking.cpp

6575–6581

These comments no longer seem to match the code -- nothing creates a FunctionDecl here.

6582

I'm still wondering why this code is needed and what it's trying to do. It worries me that we're changing the type of the call expression like this.

clang/lib/Sema/SemaDecl.cpp

14523

clang/lib/Sema/SemaType.cpp

7284

We're missing Sema test coverage for all the various diagnostics you've added; can you add that coverage?

7287

Still wondering about this

7307–7308

Still wondering about this as well.

[erichkeane]

clang/include/clang/Basic/Attr.td

4100

Note that it seems this is likely not going to work correctly on template type aliases! You probably want to make sure that is acceptable to you.

clang/include/clang/Basic/AttrDocs.td

6855 ↗

(On Diff #487700)

This says 'function pointer declaration', but you have it's subject as Typedef?

clang/include/clang/Basic/TokenKinds.def

668

I don't think #1 is acceptable for the keyword, we shouldn't ignore keywords like we do attributes. Doing an ignored warning in SemaDeclAttr.td for the ATTRIBUTE is fine, but keyword form needs to be an error.

My preference is #2, an error if we encounter it during parsing and we're not in WebAsm target.

clang/lib/Basic/Targets/DirectX.h

45

Also apply to the rest of the targets. Also, why is there only 1 added here? I thought we had 2 address spaces for Wasm?

clang/lib/Basic/Targets/WebAssembly.h

44–45

That DEFINITELY looks suspicious to me as well, I noted above too, but either we need to specify we're re-using the hlsl_groupshared for wasm_externref address space (at which point, i wonder: why not re-use a different address space?), or correct this.

clang/lib/Parse/ParseDecl.cpp

849

clang/lib/Sema/SemaChecking.cpp

6567

Does this diagnose? Should we be emitting an error here?

6579

All those comments don't really seem relevant here, and are not really correct. The only thing SemaChecking should do is either modify its arguments (though you don't have any), or set its return type.

6582

This appears to be a 'custom type checking' builtin, where the code in Sema has to check the arguments (rather than the automatic behavior working), and set its return type to the 'correct' one. It appears that this accepts no arguments, then changes the result of the builtin.

So this doesn't seem particularly odd, other than the strange comments above.

clang/lib/Sema/SemaType.cpp

7273

This name seems misleading... should you be desugaring 'Type' to store it in 'Desugared'?

Also, I see that this value is never used, so why do the copy init? ALSO, why is it called Desugared, when it never seems to get a Desugared type?

[aaron.ballman]

clang/lib/Sema/SemaChecking.cpp

6582

Oh yeah that's right, that is how the custom checking code works, thank you for the reminder!

[pmatos]

@aaron.ballman Added support for externref mangling in Microsoft. This follows the pattern implemented by OpenCL types.

[pmatos]

In D128440#4047535, @pmatos wrote:

@aaron.ballman Added support for externref mangling in Microsoft. This follows the pattern implemented by OpenCL types.

Wrong revision - sorry.

[erichkeane]

clang/lib/AST/MicrosoftMangle.cpp

2481 ↗

(On Diff #488645)

I'm not sure what the PA is supposed to mean? I see some uses of mangleArtificialTagType don't do anything with it, so I fear it is something OCL specific.

[pmatos]

Undo last patch. Submitted change to incorrect revision.

[pmatos]

clang/include/clang/Basic/Attr.td

4100

Documentation says about Subject:

// The things to which an attribute can appertain
SubjectList Subjects;

Given this can be attached to function pointer types, is the subject then just Type ?

clang/include/clang/Basic/AttrDocs.td

6855 ↗

(On Diff #487700)

That's a mistake due to how things worked in an earlier revision. Thanks for spotting.

clang/include/clang/Basic/TokenKinds.def

668

Thanks for the comments, I have now updated this with an implementation of option 2 and added a diagnostic test.

clang/lib/Basic/Targets/DirectX.h

45

Externref is a type in clang, doesn't need its own address space in clang, only when it's lowered to a opaque type in llvm it gets its own address space.

[erichkeane]

clang/include/clang/Basic/Attr.td

4100

IIRC, the list of subjects are the Decls and Stmt types that are possibly allowed. I don't thnk it would be just 'Type' there.

As you have it, it is only allowed on TypedefNameDecl.

See the SubsetSubject's at the top of this file for some examples on how you could constrain a special matcher to only work on function pointer decls.

clang/lib/Basic/Targets/DirectX.h

45

Please fix the comment in my suggestion.

Also, your explanation doesn't make it clear to me why you added TWO entries to this list for other targets, but only 1 here.

[pmatos]

Address a few comments, add new test for funcref keyword diagnostic.

[pmatos]

Add new Attr Subject Function Pointer for __funcref attribute.

[pmatos]

clang/include/clang/Basic/Attr.td

4100

Good point @erichkeane . What do you think of FunctionPointer implementation here?

[erichkeane]

clang/include/clang/Basic/Attr.td

4100

That seems acceptable to me.

[pmatos]

Rebase on main.

[aaron.ballman]

Some more comments, but there are unaddressed comments from earlier reviews as well.

clang/include/clang/Basic/Attr.td

4100

That makes sense to me as well, but FWIW, type attributes don't currently have much of any tablegen automation (unlike decl and stmt attributes), so the subject list isn't strictly necessary here. But it's still appreciated because 1) it's documentation, and 2) we want to tablegen more and this helps us with that goal.

clang/include/clang/Basic/DiagnosticSemaKinds.td

11681

clang/lib/AST/DeclBase.cpp

1060–1063 ↗

(On Diff #493251)

clang/lib/Parse/ParseDecl.cpp

856–857

Be sure to run clang-format over the patch to fix this sort of thing.

[pmatos]

clang/lib/Basic/Targets/DirectX.h

45

I have now fixed that. We just need one address space.

clang/lib/Basic/Targets/WebAssembly.h

44–45

Fixed this now. We only need the address space for funcref. The address space for externref is now necessary as it's its own type.

[pmatos]

clang/include/clang/Basic/Attr.td

4100

@erichkeane Yes, you're right. Something like

using IntIntFuncref = int(*)(int) __funcref;

doesn't work. Why is this not accepted? Is it due to the Subjects listed?

[pmatos]

Address some of the pending comments.

[pmatos]

clang/lib/Sema/SemaChecking.cpp

6561–6564

If I understand your question correctly, this is just the semantic checks for each of the builtins.

6573

I think this question is not relevant anymore given the current code, right? The wasm ref null builtin will always return the null funcref.

6575–6581

Right - fixed.

6579

Right, these comments can be removed. I fixed these.

clang/lib/Sema/SemaType.cpp

7273

Bad naming due to earlier code. I have simplified this code now.

[pmatos]

Addressed a few comments.

[pmatos]

clang/lib/Sema/SemaChecking.cpp

6566–6570

I have added a test to check this situation.

6567

I think it makes sense. Will add a test as well for the diagnostic.

[pmatos]

Further refinement of the patch with more diagnostics tested.

[pmatos]

Remove unnecessary code.

[pmatos]

clang/lib/Sema/SemaType.cpp

7287

That's correct - removed.

[pmatos]

@aaron.ballman I have finished addressing all the concerns on this patch. Do you have any further comments?

clang/lib/Sema/SemaType.cpp

7307–7308

We'll just be overriding the address space in this case. Although, I am not sure something like this can happen in Wasm given there's only one linear memory.

[pmatos]

Rebased on current HEAD.

[aaron.ballman]

Generally LGTM with a few comments sprinkled around.

clang/include/clang/Basic/Attr.td

4100

Not due to the subjects -- keyword attributes require manual parsing and type attributes require manual processing (we don't tablegen as much as I'd like for type attributes). But that code should be accepted (you should add a test case for it as well).

clang/include/clang/Basic/AttrDocs.td

6930 ↗

(On Diff #497632)

DocCatType, right?

6933 ↗

(On Diff #497632)

"Function pointer declaration" reads a bit odd to me, I think you mean "function pointer type", right?

e.g.,
void (*)() __funcref is fine, as is void (*fp)() __funcref -- the attribute appertains to the type, not to the declaration?

clang/lib/Sema/SemaType.cpp

7265

Just to avoid confusing editors that can't tell Type is a variable and not clang::Type the type.

clang/test/Sema/wasm-refs.c

50 ↗

(On Diff #497632)

Should we also test two-level application of the qualifier, as in?

using uh_oh = funcref_t __funcref;

[pmatos]

Thanks @aaron.ballman . I think I have now address all outstanding comments.

clang/include/clang/Basic/Attr.td

4100

Seems to be fine now. Test added.

clang/include/clang/Basic/AttrDocs.td

6930 ↗

(On Diff #497632)

Yes.

clang/test/Sema/wasm-refs.c

50 ↗

(On Diff #497632)

Double qualification shouldn't be an issue - adding this to SemaCXX/wasm-funcref.cpp.

[pmatos]

Patch with all outstanding comments addressed.

[pmatos]

Add forgotten comment to test.

[pmatos]

@erichkeane @aaron.ballman any further comments on this?

[erichkeane]

First, we've been dealing with the 16.0 release process/regressions, which unfortunately got us pretty far behind on reviews. Sorry about that!

I have only 1 concern here, otherwise, this LGTM. I'll leave it to Aaron to make the final 'value judgement' of if we want to keep this, so I'll leave it to him to Approve.

clang/lib/AST/DeclBase.cpp

1056 ↗

(On Diff #501081)

probably want to canonicalize here (and above). Else typedefs-to-typedefs/etc might getcha.

[aaron.ballman]

LGTM aside from some small nits that you can fix when landing. Thank you for your patience on this review!

clang/lib/AST/DeclBase.cpp

1056 ↗

(On Diff #501081)

Yeah, I'd do that below on the return, as in: return Ty.getCanonicalType()->isFunctionPointerType();

clang/test/SemaCXX/wasm-funcref.cpp

14 ↗

(On Diff #501081)

Please add a newline to the end of the file.

[pmatos]

Thanks all for the comments, fixed and will soon land after running a check-all.

[MyDeveloperDay]

clang/lib/Format/FormatToken.h

599

Is there a unit test in clang format for this change?

clang/include/clang/AST/Type.h

public:
   /// and vector attributes are not simple type qualifiers.
   ///
   /// Type qualifiers are often, but not always, reflected in the canonical
   /// type.
   bool isQualifier() const;
 
   bool isMSTypeSpec() const;
 
+  bool isWebAssemblyFuncrefSpec() const;
+
   bool isCallingConv() const;
 
   llvm::Optional<NullabilityKind> getImmediateNullability() const;
 
   /// Retrieve the attribute kind corresponding to the given
   /// nullability kind.
   static Kind getNullabilityAttrKind(NullabilityKind kind) {
     switch (kind) {

clang/include/clang/Basic/AddressSpaces.h

enum class LangAS : unsigned {
   sycl_private,
 
   // Pointer size and extension address spaces.
   ptr32_sptr,
   ptr32_uptr,
   ptr64,
 
   wasm_externref,
+  wasm_funcref,
+
   // This denotes the count of language-specific address spaces and also
   // the offset added to the target-specific address spaces, which are usually
   // specified by address space attributes __attribute__(address_space(n))).
   FirstTargetAddressSpace
 };
 
 /// The type of a lookup table which maps from language-specific address spaces
 /// to target-specific ones.

clang/include/clang/Basic/Attr.td

def FunctionReturnThunks : InheritableAttr,
   let Spellings = [GCC<"function_return">];
   let Args = [EnumArgument<"ThunkType", "Kind",
     ["keep", "thunk-extern"],
     ["Keep", "Extern"]
   >];
   let Subjects = SubjectList<[Function]>;
   let Documentation = [FunctionReturnThunksDocs];
 }
+
+def WebAssemblyFuncref : TypeAttr, TargetSpecificAttr<TargetWebAssembly> {
+  let Spellings = [Keyword<"__funcref">];
+  let Documentation = [Undocumented];
+}

clang/include/clang/Basic/BuiltinsWebAssembly.def

 
 TARGET_BUILTIN(__builtin_wasm_relaxed_q15mulr_s_i16x8, "V8sV8sV8s", "nc", "relaxed-simd")
 
 TARGET_BUILTIN(__builtin_wasm_dot_i8x16_i7x16_s_i16x8, "V8sV16ScV16Sc", "nc", "relaxed-simd")
 TARGET_BUILTIN(__builtin_wasm_dot_i8x16_i7x16_add_s_i32x4, "V4iV16ScV16ScV4i", "nc", "relaxed-simd")
 TARGET_BUILTIN(__builtin_wasm_relaxed_dot_bf16x8_add_f32_f32x4, "V4fV8UsV8UsV4f", "nc", "relaxed-simd")
 
 // Reference Types builtins
+// Some builtins are custom type-checked - see 't' as part of the third argument,
+// in which case the argument spec (second argument) is unused.
 
-TARGET_BUILTIN(__builtin_wasm_ref_null_extern, "i", "nct", "reference-types")
+TARGET_BUILTIN(__builtin_wasm_ref_null_extern, "e", "nct", "reference-types")
+
+// A funcref represented as a function pointer with the funcref attribute
+// attached to the type, therefore SemaChecking will check for the right
+// return type.
+TARGET_BUILTIN(__builtin_wasm_ref_null_func, "i", "nct", "reference-types")
 
 #undef BUILTIN
 #undef TARGET_BUILTIN

clang/include/clang/Basic/DiagnosticSemaKinds.td

def warn_objc_unsafe_perform_selector : Warning<
   "%select{struct|union|vector}1 type">,
   InGroup<DiagGroup<"objc-unsafe-perform-selector">>;
 def note_objc_unsafe_perform_selector_method_declared_here :  Note<
   "method %0 that returns %1 declared here">;
 def err_attribute_arm_builtin_alias : Error<
   "'__clang_arm_builtin_alias' attribute can only be applied to an ARM builtin">;
 def err_attribute_arm_mve_polymorphism : Error<
   "'__clang_arm_mve_strict_polymorphism' attribute can only be applied to an MVE/NEON vector type">;
+def err_attribute_webassembly_funcref : Error<
+  "'__clang_webassembly_funcref' attribute can only be applied to function pointer types">;
 
 def warn_setter_getter_impl_required : Warning<
   "property %0 requires method %1 to be defined - "
   "use @synthesize, @dynamic or provide a method implementation "
   "in this class implementation">,
   InGroup<ObjCPropertyImpl>;
 def warn_setter_getter_impl_required_in_category : Warning<
   "property %0 requires method %1 to be defined - "

 def err_cast_from_randomized_struct : Error<
   "casting from randomized structure pointer type %0 to %1">;
 
 // WebAssembly reference type and table diagnostics
 def err_wasm_reference_pr : Error<
   "%select{pointers|references}0 to WebAssembly reference types are illegal">;
 def err_wasm_ca_reference : Error<
   "cannot %select{capture|take address of}0 WebAssembly reference">;
 } // end of sema component.

clang/include/clang/Basic/TokenKinds.def

 ALIAS("__volatile__" , volatile   , KEYALL)
 
 // Type nullability.
 KEYWORD(_Nonnull                 , KEYALL)
 KEYWORD(_Nullable                , KEYALL)
 KEYWORD(_Nullable_result         , KEYALL)
 KEYWORD(_Null_unspecified        , KEYALL)
 
+// WebAssembly Type Extension
+KEYWORD(__funcref                     , KEYALL)
+
 // Microsoft extensions which should be disabled in strict conformance mode
 KEYWORD(__ptr64                       , KEYMS)
 KEYWORD(__ptr32                       , KEYMS)
 KEYWORD(__sptr                        , KEYMS)
 KEYWORD(__uptr                        , KEYMS)
 KEYWORD(__w64                         , KEYMS)
 KEYWORD(__uuidof                      , KEYMS | KEYBORLAND)
 KEYWORD(__try                         , KEYMS | KEYBORLAND)

clang/include/clang/Parse/Parser.h

bool MaybeParseMicrosoftDeclSpecs(ParsedAttributes &Attrs) {
     }
     return false;
   }
   void ParseMicrosoftDeclSpecs(ParsedAttributes &Attrs);
   bool ParseMicrosoftDeclSpecArgs(IdentifierInfo *AttrName,
                                   SourceLocation AttrNameLoc,
                                   ParsedAttributes &Attrs);
   void ParseMicrosoftTypeAttributes(ParsedAttributes &attrs);
+  void ParseWebAssemblyFuncrefTypeAttribute(ParsedAttributes &attrs);
   void DiagnoseAndSkipExtendedMicrosoftTypeAttributes();
   SourceLocation SkipExtendedMicrosoftTypeAttributes();
   void ParseMicrosoftInheritanceClassAttributes(ParsedAttributes &attrs);
   void ParseBorlandTypeAttributes(ParsedAttributes &attrs);
   void ParseOpenCLKernelAttributes(ParsedAttributes &attrs);
   void ParseOpenCLQualifiers(ParsedAttributes &Attrs);
   void ParseNullabilityTypeSpecifiers(ParsedAttributes &attrs);
   void ParseCUDAFunctionAttributes(ParsedAttributes &attrs);

clang/include/clang/Sema/Sema.h

private:
   bool CheckX86BuiltinFunctionCall(const TargetInfo &TI, unsigned BuiltinID,
                                    CallExpr *TheCall);
   bool CheckPPCBuiltinFunctionCall(const TargetInfo &TI, unsigned BuiltinID,
                                    CallExpr *TheCall);
   bool CheckAMDGCNBuiltinFunctionCall(unsigned BuiltinID, CallExpr *TheCall);
   bool CheckRISCVLMUL(CallExpr *TheCall, unsigned ArgNum);
   bool CheckRISCVBuiltinFunctionCall(const TargetInfo &TI, unsigned BuiltinID,
                                      CallExpr *TheCall);
   bool CheckWebAssemblyBuiltinFunctionCall(const TargetInfo &TI, unsigned BuiltinID,
                                            CallExpr *TheCall);
 
   bool SemaBuiltinVAStart(unsigned BuiltinID, CallExpr *TheCall);
   bool SemaBuiltinVAStartARMMicrosoft(CallExpr *Call);
   bool SemaBuiltinUnorderedCompare(CallExpr *TheCall);
   bool SemaBuiltinFPClassification(CallExpr *TheCall, unsigned NumArgs);
   bool SemaBuiltinComplex(CallExpr *TheCall);
   bool SemaBuiltinVSX(CallExpr *TheCall);
   bool SemaBuiltinOSLogFormat(CallExpr *TheCall);
private:
   // Matrix builtin handling.
   ExprResult SemaBuiltinMatrixTranspose(CallExpr *TheCall,
                                         ExprResult CallResult);
   ExprResult SemaBuiltinMatrixColumnMajorLoad(CallExpr *TheCall,
                                               ExprResult CallResult);
   ExprResult SemaBuiltinMatrixColumnMajorStore(CallExpr *TheCall,
                                                ExprResult CallResult);
 
-  // WebAssembly builtin handling
+  // WebAssembly builtin handling.
   bool SemaBuiltinWasmRefNullExtern(CallExpr *TheCall);
 
+  // WebAssembly builtin handling.
+  bool SemaBuiltinWasmRefNullFunc(CallExpr *TheCall);
+
 public:
   enum FormatStringType {
     FST_Scanf,
     FST_Printf,
     FST_NSString,
     FST_Strftime,
     FST_Strfmon,
     FST_Kprintf,

clang/lib/AST/ASTContext.cpp

static const unsigned FakeAddrSpaceMap[] = {
         6,  // sycl_global_host
         3,  // sycl_local
         0,  // sycl_private
         10, // ptr32_sptr
         11, // ptr32_uptr
         12, // ptr64
         // Wasm address space values for this map are dummy
         10, // wasm_externref,
+        20, // wasm_funcref
     };
     return &FakeAddrSpaceMap;
   } else {
     return &T.getAddressSpaceMap();
   }
 }
 
 static bool isAddrSpaceMapManglingEnabled(const TargetInfo &TI,

clang/lib/AST/Type.cpp

bool AttributedType::isMSTypeSpec() const {
   case attr::Ptr64:
   case attr::SPtr:
   case attr::UPtr:
     return true;
   }
   llvm_unreachable("invalid attr kind");
 }
 
+bool AttributedType::isWebAssemblyFuncrefSpec() const {
+  return getAttrKind() == attr::WebAssemblyFuncref;
+}
+
 bool AttributedType::isCallingConv() const {
   // FIXME: Generate this with TableGen.
   switch (getAttrKind()) {
   default: return false;
   case attr::Pcs:
   case attr::CDecl:
   case attr::FastCall:
   case attr::StdCall:

clang/lib/AST/TypePrinter.cpp

if (T->isMSTypeSpec()) {
     case attr::Ptr32: OS << " __ptr32"; break;
     case attr::Ptr64: OS << " __ptr64"; break;
     case attr::SPtr: OS << " __sptr"; break;
     case attr::UPtr: OS << " __uptr"; break;
     }
     spaceBeforePlaceHolder(OS);
   }
 
+  if (T->isWebAssemblyFuncrefSpec()) {
+    assert(T->getAttrKind() == attr::WebAssemblyFuncref);
+    OS << "__funcref";
+  }
+
   // Print nullability type specifiers.
   if (T->getImmediateNullability()) {
     if (T->getAttrKind() == attr::TypeNonNull)
       OS << " _Nonnull";
     else if (T->getAttrKind() == attr::TypeNullable)
       OS << " _Nullable";
     else if (T->getAttrKind() == attr::TypeNullUnspecified)
       OS << " _Null_unspecified";
void TypePrinter::printAttributedAfter(const AttributedType *T,
   // If this is a calling convention attribute, don't print the implicit CC from
   // the modified type.
   SaveAndRestore<bool> MaybeSuppressCC(InsideCCAttribute, T->isCallingConv());
 
   printAfter(T->getModifiedType(), OS);
 
   // Some attributes are printed as qualifiers before the type, so we have
   // nothing left to do.
-  if (T->getAttrKind() == attr::ObjCKindOf ||
-      T->isMSTypeSpec() || T->getImmediateNullability())
+  if (T->getAttrKind() == attr::ObjCKindOf || T->isMSTypeSpec() ||
+      T->getImmediateNullability() || T->isWebAssemblyFuncrefSpec())
     return;
 
   // Don't print the inert __unsafe_unretained attribute at all.
   if (T->getAttrKind() == attr::ObjCInertUnsafeUnretained)
     return;
 
   // Don't print ns_returns_retained unless it had an effect.
   if (T->getAttrKind() == attr::NSReturnsRetained &&
#include "clang/Basic/AttrList.inc"
   case attr::ObjCOwnership:
   case attr::Ptr32:
   case attr::Ptr64:
   case attr::SPtr:
   case attr::UPtr:
   case attr::AddressSpace:
   case attr::CmseNSCall:
   case attr::AnnotateType:
+  case attr::WebAssemblyFuncref:
     llvm_unreachable("This attribute should have been handled already");
 
   case attr::NSReturnsRetained:
     OS << "ns_returns_retained";
     break;
 
   // FIXME: When Sema learns to form this AttributedType, avoid printing the
   // attribute again in printFunctionProtoAfter.
std::string Qualifiers::getAddrSpaceAsString(LangAS AS) {
   case LangAS::cuda_shared:
     return "__shared__";
   case LangAS::ptr32_sptr:
     return "__sptr __ptr32";
   case LangAS::ptr32_uptr:
     return "__uptr __ptr32";
   case LangAS::ptr64:
     return "__ptr64";
+  case LangAS::wasm_funcref:
+    return "__funcref";
   default:
     return std::to_string(toTargetAddressSpace(AS));
   }
 }
 
 // Appends qualifiers to the given string, separated by spaces.  Will
 // prefix a space if the string is non-empty.  Will not append a final
 // space.

clang/lib/Basic/Targets/DirectX.h

static const unsigned DirectXAddrSpaceMap[] = {
     0, // sycl_global_device
     0, // sycl_global_host
     0, // sycl_local
     0, // sycl_private
     0, // ptr32_sptr
     0, // ptr32_uptr
     0, // ptr64
     // Wasm address space values for this map are dummy
     10,// wasm_externref
+    20,// wasm_funcref
 };
 
 class LLVM_LIBRARY_VISIBILITY DirectXTargetInfo : public TargetInfo {
 public:
   DirectXTargetInfo(const llvm::Triple &Triple, const TargetOptions &)
       : TargetInfo(Triple) {
     TLSSupported = false;
     VLASupported = false;

clang/lib/Basic/Targets/NVPTX.h

static const unsigned NVPTXAddrSpaceMap[] = {
     1, // sycl_global_host
     3, // sycl_local
     0, // sycl_private
     0, // ptr32_sptr
     0, // ptr32_uptr
     0, // ptr64
     // Wasm address space values for this map are dummy
     10,// wasm_externref
+    20,// wasm_funcref
 };
 
 /// The DWARF address class. Taken from
 /// https://docs.nvidia.com/cuda/archive/10.0/ptx-writers-guide-to-interoperability/index.html#cuda-specific-dwarf
 static const int NVPTXDWARFAddrSpaceMap[] = {
     -1, // Default, opencl_private or opencl_generic - not defined
     5,  // opencl_global
     -1,

clang/lib/Basic/Targets/SPIR.h

static const unsigned SPIRDefIsPrivMap[] = {
     0, // sycl_global_host
     0, // sycl_local
     0, // sycl_private
     0, // ptr32_sptr
     0, // ptr32_uptr
     0, // ptr64
     // Wasm address space values for this map are dummy
     10,// wasm_externref
+    20,// wasm_funcref
 };
 
 // Used by both the SPIR and SPIR-V targets.
 static const unsigned SPIRDefIsGenMap[] = {
     4, // Default
     // OpenCL address space values for this map are dummy and they can't be used
     0, // opencl_global
     0, // opencl_local
static const unsigned SPIRDefIsGenMap[] = {
     6, // sycl_global_host
     3, // sycl_local
     0, // sycl_private
     0, // ptr32_sptr
     0, // ptr32_uptr
     0, // ptr64
     // Wasm address space values for this map are dummy
     10,// wasm_externref
+    20,// wasm_funcref
 };
 
 // Base class for SPIR and SPIR-V target info.
 class LLVM_LIBRARY_VISIBILITY BaseSPIRTargetInfo : public TargetInfo {
 protected:
   BaseSPIRTargetInfo(const llvm::Triple &Triple, const TargetOptions &)
       : TargetInfo(Triple) {
     assert((Triple.isSPIR() || Triple.isSPIRV()) &&

clang/lib/Basic/Targets/TCE.h

static const unsigned TCEOpenCLAddrSpaceMap[] = {
     0, // sycl_global_host
     0, // sycl_local
     0, // sycl_private
     0, // ptr32_sptr
     0, // ptr32_uptr
     0, // ptr64
     // Wasm address space values for this map are dummy
     10,// wasm_externref
+    20,// wasm_funcref
 };
 
 class LLVM_LIBRARY_VISIBILITY TCETargetInfo : public TargetInfo {
 public:
   TCETargetInfo(const llvm::Triple &Triple, const TargetOptions &)
       : TargetInfo(Triple) {
     TLSSupported = false;
     IntWidth = 32;

clang/lib/Basic/Targets/WebAssembly.h

 #include "clang/Basic/TargetInfo.h"
 #include "clang/Basic/TargetOptions.h"
 #include "llvm/ADT/Triple.h"
 #include "llvm/Support/Compiler.h"
 
 namespace clang {
 namespace targets {
 
+static const unsigned WebAssemblyAddrSpaceMap[] = {
+    0,  // Default
+    0,  // opencl_global
+    0,  // opencl_local
+    0,  // opencl_constant
+    0,  // opencl_private
+    0,  // opencl_generic
+    0,  // opencl_global_device
+    0,  // opencl_global_host
+    0,  // cuda_device
+    0,  // cuda_constant
+    0,  // cuda_shared
+    0,  // sycl_global
+    0,  // sycl_global_device
+    0,  // sycl_global_host
+    0,  // sycl_local
+    0,  // sycl_private
+    0,  // ptr32_sptr
+    0,  // ptr32_uptr
+    0,  // ptr64
+    10, // wasm_externref,
+    20, // wasm_funcref
+};
+
 class LLVM_LIBRARY_VISIBILITY WebAssemblyTargetInfo : public TargetInfo {
   static const Builtin::Info BuiltinInfo[];
 
   enum SIMDEnum {
     NoSIMD,
     SIMD128,
     RelaxedSIMD,
   } SIMDLevel = NoSIMD;
class LLVM_LIBRARY_VISIBILITY WebAssemblyTargetInfo : public TargetInfo {
   bool HasReferenceTypes = false;
   bool HasExtendedConst = false;
 
   std::string ABI;
 
 public:
   explicit WebAssemblyTargetInfo(const llvm::Triple &T, const TargetOptions &)
       : TargetInfo(T) {
+    AddrSpaceMap = &WebAssemblyAddrSpaceMap;
     NoAsmVariants = true;
     SuitableAlign = 128;
     LargeArrayMinWidth = 128;
     LargeArrayAlign = 128;
     SimdDefaultAlign = 128;
     SigAtomicType = SignedLong;
     LongDoubleWidth = LongDoubleAlign = 128;
     LongDoubleFormat = &llvm::APFloat::IEEEquad();

clang/lib/Basic/Targets/X86.h

static const unsigned X86AddrSpaceMap[] = {
     0,   // sycl_global_host
     0,   // sycl_local
     0,   // sycl_private
     270, // ptr32_sptr
     271, // ptr32_uptr
     272, // ptr64
     // Wasm address space values for this map are dummy
     10,  // wasm_externref,
+    20,  // wasm_funcref
 };
 
 // X86 target abstract base class; x86-32 and x86-64 are very close, so
 // most of the implementation can be shared.
 class LLVM_LIBRARY_VISIBILITY X86TargetInfo : public TargetInfo {
 
   enum X86SSEEnum {
     NoSSE,

clang/lib/CodeGen/CGBuiltin.cpp

case WebAssembly::BI__builtin_wasm_nearest_f64x2: {
     Value *Value = EmitScalarExpr(E->getArg(0));
     Function *Callee = CGM.getIntrinsic(IntNo, ConvertType(E->getType()));
     return Builder.CreateCall(Callee, Value);
   }
   case WebAssembly::BI__builtin_wasm_ref_null_extern: {
     Function *Callee = CGM.getIntrinsic(Intrinsic::wasm_ref_null_extern);
     return Builder.CreateCall(Callee);
   }
+  case WebAssembly::BI__builtin_wasm_ref_null_func: {
+    Function *Callee = CGM.getIntrinsic(Intrinsic::wasm_ref_null_func);
+    return Builder.CreateCall(Callee);
+  }
   case WebAssembly::BI__builtin_wasm_swizzle_i8x16: {
     Value *Src = EmitScalarExpr(E->getArg(0));
     Value *Indices = EmitScalarExpr(E->getArg(1));
     Function *Callee = CGM.getIntrinsic(Intrinsic::wasm_swizzle);
     return Builder.CreateCall(Callee, {Src, Indices});
   }
   case WebAssembly::BI__builtin_wasm_add_sat_s_i8x16:
   case WebAssembly::BI__builtin_wasm_add_sat_u_i8x16:

clang/lib/CodeGen/TargetInfo.h

public:
   /// Return the device-side type for the CUDA device builtin texture type.
   virtual llvm::Type *getCUDADeviceBuiltinTextureDeviceType() const {
     // By default, no change from the original one.
     return nullptr;
   }
 
   /// Return the WebAssembly externref reference type.
   virtual llvm::Type *getWasmExternrefReferenceType() const { return nullptr; }
-  
+  /// Return the WebAssembly funcref reference type.
+  virtual llvm::Type *getWasmFuncrefReferenceType() const { return nullptr; }
   /// Emit the device-side copy of the builtin surface type.
   virtual bool emitCUDADeviceBuiltinSurfaceDeviceCopy(CodeGenFunction &CGF,
                                                       LValue Dst,
                                                       LValue Src) const {
     // DO NOTHING by default.
     return false;
   }
   /// Emit the device-side copy of the builtin texture type.

clang/lib/CodeGen/TargetInfo.cpp

if (auto *FD = dyn_cast_or_null<FunctionDecl>(D)) {
         Fn->addFnAttr("no-prototype");
     }
   }
 
   /// Return the WebAssembly externref reference type.
   virtual llvm::Type *getWasmExternrefReferenceType() const override {
     return llvm::Type::getWasm_ExternrefTy(getABIInfo().getVMContext());
   }
+  /// Return the WebAssembly funcref reference type.
+  virtual llvm::Type *getWasmFuncrefReferenceType() const override {
+    return llvm::Type::getWasm_FuncrefTy(getABIInfo().getVMContext());
+  }
 };
 
 /// Classify argument of given type \p Ty.
 ABIArgInfo WebAssemblyABIInfo::classifyArgumentType(QualType Ty) const {
   Ty = useFirstFieldIfTransparentUnion(Ty);
 
   if (isAggregateTypeForABI(Ty)) {
     // Records with non-trivial destructors/copy-constructors should not be

clang/lib/Format/FormatToken.h

bool isAccessSpecifier(bool ColonRequired = true) const {
     const auto NextNonComment = getNextNonComment();
     return NextNonComment && NextNonComment->is(tok::colon);
   }
 
   bool canBePointerOrReferenceQualifier() const {
     return isOneOf(tok::kw_const, tok::kw_restrict, tok::kw_volatile,
                    tok::kw___attribute, tok::kw__Nonnull, tok::kw__Nullable,
                    tok::kw__Null_unspecified, tok::kw___ptr32, tok::kw___ptr64,
-                   TT_AttributeMacro);
+                   tok::kw___funcref, TT_AttributeMacro);
   }
 
   /// Determine whether the token is a simple-type-specifier.
   [[nodiscard]] bool isSimpleTypeSpecifier() const;
 
   [[nodiscard]] bool isTypeOrIdentifier() const;
 
   bool isObjCAccessSpecifier() const {

clang/lib/Parse/ParseDecl.cpp

case tok::kw___uptr: {
       break;
     }
     default:
       return;
     }
   }
 }
 
+void Parser::ParseWebAssemblyFuncrefTypeAttribute(ParsedAttributes &attrs) {
+  if (Tok.getKind() == tok::kw___funcref) {
+    IdentifierInfo *AttrName = Tok.getIdentifierInfo();
+    SourceLocation AttrNameLoc = ConsumeToken();
+    attrs.addNew(AttrName, AttrNameLoc, nullptr, AttrNameLoc, nullptr, 0,
+                 ParsedAttr::AS_Keyword);
+  } else {
+    return;
+  }
+}
+
 void Parser::DiagnoseAndSkipExtendedMicrosoftTypeAttributes() {
   SourceLocation StartLoc = Tok.getLocation();
   SourceLocation EndLoc = SkipExtendedMicrosoftTypeAttributes();
 
   if (EndLoc.isValid()) {
     SourceRange Range(StartLoc, EndLoc);
     Diag(StartLoc, diag::warn_microsoft_qualifiers_ignored) << Range;
   }
 }
 
while (true) {
     case tok::kw___stdcall:
     case tok::kw___fastcall:
     case tok::kw___thiscall:
     case tok::kw___regcall:
     case tok::kw___vectorcall:
       ParseMicrosoftTypeAttributes(DS.getAttributes());
       continue;
 
+    case tok::kw___funcref:
+      ParseWebAssemblyFuncrefTypeAttribute(DS.getAttributes());
+      continue;
+
     // Borland single token adornments.
     case tok::kw___pascal:
       ParseBorlandTypeAttributes(DS.getAttributes());
       continue;
 
     // OpenCL single token adornments.
     case tok::kw___kernel:
       ParseOpenCLKernelAttributes(DS.getAttributes());
#include "clang/Basic/OpenCLImageTypes.def"
   case tok::kw___private:
   case tok::kw___local:
   case tok::kw___global:
   case tok::kw___constant:
   case tok::kw___generic:
   case tok::kw___read_only:
   case tok::kw___read_write:
   case tok::kw___write_only:
+
+  case tok::kw___funcref:
     return true;
 
   case tok::kw_private:
     return getLangOpts().OpenCL;
 
   // C11 _Atomic
   case tok::kw__Atomic:
     return true;
bool Parser::isDeclarationSpecifier(bool DisambiguatingWithExpression) {
   case tok::kw___constant:
   case tok::kw___generic:
   case tok::kw___read_only:
   case tok::kw___read_write:
   case tok::kw___write_only:
 #define GENERIC_IMAGE_TYPE(ImgType, Id) case tok::kw_##ImgType##_t:
 #include "clang/Basic/OpenCLImageTypes.def"
 
+  case tok::kw___funcref:
     return true;
 
   case tok::kw_private:
     return getLangOpts().OpenCL;
   }
 }
 
 bool Parser::isConstructorDeclarator(bool IsUnqualified, bool DeductionGuide) {
while (true) {
     case tok::kw___thiscall:
     case tok::kw___regcall:
     case tok::kw___vectorcall:
       if (AttrReqs & AR_DeclspecAttributesParsed) {
         ParseMicrosoftTypeAttributes(DS.getAttributes());
         continue;
       }
       goto DoneWithTypeQuals;
+
+    case tok::kw___funcref:
+      if (AttrReqs & AR_DeclspecAttributesParsed) {
+        ParseWebAssemblyFuncrefTypeAttribute(DS.getAttributes());
+        continue;
+      }
+      goto DoneWithTypeQuals;
+
     case tok::kw___pascal:
       if (AttrReqs & AR_VendorAttributesParsed) {
         ParseBorlandTypeAttributes(DS.getAttributes());
         continue;
       }
       goto DoneWithTypeQuals;
 
     // Nullability type specifiers.

clang/lib/Parse/ParseTentative.cpp

Parser::isCXXDeclarationSpecifier(Parser::TPResult BracedCastResult,
   case tok::kw___unaligned:
   case tok::kw__Nonnull:
   case tok::kw__Nullable:
   case tok::kw__Nullable_result:
   case tok::kw__Null_unspecified:
   case tok::kw___kindof:
     return TPResult::True;
 
+    // WebAssemblyFuncref
+  case tok::kw___funcref:
+    return TPResult::True;
+
     // Borland
   case tok::kw___pascal:
     return TPResult::True;
 
     // AltiVec
   case tok::kw___vector:
     return TPResult::True;
 

clang/lib/Sema/SemaChecking.cpp

bool Sema::CheckSystemZBuiltinFunctionCall(unsigned BuiltinID,
   return SemaBuiltinConstantArgRange(TheCall, i, l, u);
 }
 
 bool Sema::CheckWebAssemblyBuiltinFunctionCall(const TargetInfo &TI,
                                                unsigned BuiltinID,
                                                CallExpr *TheCall) {
   switch(BuiltinID) {
     case WebAssembly::BI__builtin_wasm_ref_null_extern:
       return SemaBuiltinWasmRefNullExtern(TheCall);
+    case WebAssembly::BI__builtin_wasm_ref_null_func:
+      return SemaBuiltinWasmRefNullFunc(TheCall);
   }
 
   return false;
 }
 
 /// SemaBuiltinCpuSupports - Handle __builtin_cpu_supports(char *).
 /// This checks that the target supports __builtin_cpu_supports and
 /// that the string argument is constant and valid.
static bool checkBuiltinArgument(Sema &S, CallExpr *E, unsigned ArgIndex) {
   E->setArg(ArgIndex, Arg.get());
   return false;
 }
 
 bool Sema::SemaBuiltinWasmRefNullExtern(CallExpr *TheCall) {
   if (TheCall->getNumArgs() != 0)
     return true;
 
   TheCall->setType(Context.getExternrefType());
 
   return false;
 }
 
+bool Sema::SemaBuiltinWasmRefNullFunc(CallExpr *TheCall) {
+  if (TheCall->getNumArgs() != 0)
+    return true;
+
+  // The call we get looks like
+  // CallExpr
+  // `- ImplicitCastExpr
+  //   `- DeclRefExpr
+  //
+  // Therefore we need to change the types of the DeclRefExpr (stored in FDecl)
+  // and regenerate a straight up CallExpr on the modified FDecl.
+  // returning
+  // CallExpr
+  // `- FunctionDecl
+
+  // Prepare FDecl type
+  QualType Pointee = Context.getFunctionType(Context.VoidTy, {}, {});
+  QualType Type = Context.getPointerType(Pointee);
+  Pointee = Context.getAddrSpaceQualType(Pointee, LangAS::wasm_funcref);
+  Type = Context.getAttributedType(attr::WebAssemblyFuncref, Type,
+                                   Context.getPointerType(Pointee));
+  TheCall->setType(Type);
+
+  return false;
+}
+
 /// We have a call to a function like __sync_fetch_and_add, which is an
 /// overloaded function based on the pointer type of its first argument.
 /// The main BuildCallExpr routines have already promoted the types of
 /// arguments because all of these calls are prototyped as void(...).
 ///
 /// This function goes through and does final semantic checking for these
 /// builtins, as well as generating any warnings.
 ExprResult

clang/lib/Sema/SemaDecl.cpp

ParmVarDecl *Sema::CheckParameter(DeclContext *DC, SourceLocation StartLoc,
   // ISO/IEC TR 18037 S6.7.3: "The type of an object with automatic storage
   // duration shall not be qualified by an address-space qualifier."
   // Since all parameters have automatic store duration, they can not have
   // an address space.
   if (T.getAddressSpace() != LangAS::Default &&
       // OpenCL allows function arguments declared to be an array of a type
       // to be qualified with an address space.
       !(getLangOpts().OpenCL &&
-        (T->isArrayType() || T.getAddressSpace() == LangAS::opencl_private))) {
+        (T->isArrayType() || T.getAddressSpace() == LangAS::opencl_private)) &&
+      // WebAssembly allows reference types as parameters. Funcref in particular
+      // lives in a different address space
+      !(T->isFunctionPointerType() &&
+        T.getAddressSpace() == LangAS::wasm_funcref)) {
     Diag(NameLoc, diag::err_arg_with_address_space);
     New->setInvalidDecl();
   }
 
   // PPC MMA non-pointer types are not allowed as function argument types.
   if (Context.getTargetInfo().getTriple().isPPC64() &&
       CheckPPCMMAType(New->getOriginalType(), New->getLocation())) {
     New->setInvalidDecl();

clang/lib/Sema/SemaType.cpp

static bool handleMSPointerTypeQualifierAttr(TypeProcessingState &State,
   QualType Pointee = Type->getPointeeType();
   if (ASIdx != LangAS::Default)
     Pointee = S.Context.getAddrSpaceQualType(
         S.Context.removeAddrSpaceQualType(Pointee), ASIdx);
   Type = State.getAttributedType(A, Type, S.Context.getPointerType(Pointee));
   return false;
 }
 
+static bool HandleWebAssemblyFuncrefAttr(TypeProcessingState &State,
+                                         QualType &Type, ParsedAttr &PAttr) {
+  assert(PAttr.getKind() == ParsedAttr::AT_WebAssemblyFuncref);
+
+  Sema &S = State.getSema();
+  Attr *A = createSimpleAttr<WebAssemblyFuncrefAttr>(S.Context, PAttr);
+
+  std::bitset<attr::LastAttr> Attrs;
+  attr::Kind NewAttrKind = A->getKind();
+  QualType Desugared = Type;
+  const AttributedType *AT = dyn_cast<AttributedType>(Type);
+  while (AT) {
+    Attrs[AT->getAttrKind()] = true;
+    Desugared = AT->getModifiedType();
+    AT = dyn_cast<AttributedType>(Desugared);
+  }
+
+  // You cannot specify duplicate type attributes, so if the attribute has
+  // already been applied, flag it.
+  if (Attrs[NewAttrKind]) {
+    S.Diag(PAttr.getLoc(), diag::warn_duplicate_attribute_exact) << PAttr;
+    return true;
+  }
+  Attrs[NewAttrKind] = true;
+
+  // Pointer type qualifiers can only operate on pointer types, but not
+  // pointer-to-member types.
+  //
+  // FIXME: Should we really be disallowing this attribute if there is any
+  // type sugar between it and the pointer (other than attributes)? Eg, this
+  // disallows the attribute on a parenthesized pointer.
+  // And if so, should we really allow *any* type attribute?
+  if (!isa<PointerType>(Desugared)) {
+    if (Type->isMemberPointerType())
+      S.Diag(PAttr.getLoc(), diag::err_attribute_no_member_pointers) << PAttr;
+    else
+      S.Diag(PAttr.getLoc(), diag::err_attribute_pointers_only) << PAttr << 0;
+    return true;
+  }
+
+  // Add address space to type based on its attributes.
+  LangAS ASIdx = LangAS::wasm_funcref;
+  QualType Pointee = Type->getPointeeType();
+  Pointee = S.Context.getAddrSpaceQualType(
+      S.Context.removeAddrSpaceQualType(Pointee), ASIdx);
+  Type = State.getAttributedType(A, Type, S.Context.getPointerType(Pointee));
+  return false;
+}
+
 /// Map a nullability attribute kind to a nullability kind.
 static NullabilityKind mapNullabilityAttrKind(ParsedAttr::Kind kind) {
   switch (kind) {
   case ParsedAttr::AT_TypeNonNull:
     return NullabilityKind::NonNull;
 
   case ParsedAttr::AT_TypeNullable:
     return NullabilityKind::Nullable;
case ParsedAttr::AT_NoDeref: {
       break;
     }
 
     case ParsedAttr::AT_MatrixType:
       HandleMatrixTypeAttr(type, attr, state.getSema());
       attr.setUsedAsTypeAttr();
       break;
 
+    case ParsedAttr::AT_WebAssemblyFuncref: {
+      if (!HandleWebAssemblyFuncrefAttr(state, type, attr))
+        attr.setUsedAsTypeAttr();
+      break;
+    }
+
     MS_TYPE_ATTRS_CASELIST:
       if (!handleMSPointerTypeQualifierAttr(state, attr, type))
         attr.setUsedAsTypeAttr();
       break;
 
 
     NULLABILITY_TYPE_ATTRS_CASELIST:
       // Either add nullability here or try to distribute it.  We

clang/test/CodeGen/WebAssembly/wasm-funcref.c

+// NOTE: Assertions have been autogenerated by utils/update_cc_test_checks.py
+// RUN: %clang_cc1 -triple wasm32 -target-feature +reference-types -o - -emit-llvm %s | FileCheck %s
+
+typedef void (*__funcref funcref_t)();
+typedef int (*__funcref fn_funcref_t)(int);
+typedef int (*fn_t)(int);
+
+// Null funcref builtin call
+// CHECK-LABEL: @get_null(
+// CHECK-NEXT:  entry:
+// CHECK-NEXT:    [[TMP0:%.*]] = call ptr addrspace(20) @llvm.wasm.ref.null.func()
+// CHECK-NEXT:    ret ptr addrspace(20) [[TMP0]]
+//
+funcref_t get_null() {
+  return __builtin_wasm_ref_null_func();
+}
+
+// Call to null funcref builtin but requires cast since
+// default return value for builtin is a funcref with function type () -> ().
+// CHECK-LABEL: @get_null_ii(
+// CHECK-NEXT:  entry:
+// CHECK-NEXT:    [[TMP0:%.*]] = call ptr addrspace(20) @llvm.wasm.ref.null.func()
+// CHECK-NEXT:    ret ptr addrspace(20) [[TMP0]]
+//
+fn_funcref_t get_null_ii() {
+  return (fn_funcref_t) __builtin_wasm_ref_null_func();
+}
+
+// Identity function for funcref.
+// CHECK-LABEL: @identity(
+// CHECK-NEXT:  entry:
+// CHECK-NEXT:    [[FN_ADDR:%.*]] = alloca ptr addrspace(20), align 4
+// CHECK-NEXT:    store ptr addrspace(20) [[FN:%.*]], ptr [[FN_ADDR]], align 4
+// CHECK-NEXT:    [[TMP0:%.*]] = load ptr addrspace(20), ptr [[FN_ADDR]], align 4
+// CHECK-NEXT:    ret ptr addrspace(20) [[TMP0]]
+//
+funcref_t identity(funcref_t fn) {
+  return fn;
+}
+
+void helper(funcref_t);
+
+// Pass funcref ref as an argument to a helper function.
+// CHECK-LABEL: @handle(
+// CHECK-NEXT:  entry:
+// CHECK-NEXT:    [[FN_ADDR:%.*]] = alloca ptr addrspace(20), align 4
+// CHECK-NEXT:    store ptr addrspace(20) [[FN:%.*]], ptr [[FN_ADDR]], align 4
+// CHECK-NEXT:    [[TMP0:%.*]] = load ptr addrspace(20), ptr [[FN_ADDR]], align 4
+// CHECK-NEXT:    call void @helper(ptr addrspace(20) noundef [[TMP0]])
+// CHECK-NEXT:    ret i32 0
+//
+int handle(funcref_t fn) {
+  helper(fn);
+  return 0;
+}
+
+// Return funcref from function pointer.
+// CHECK-LABEL: @get_ref(
+// CHECK-NEXT:  entry:
+// CHECK-NEXT:    [[FNPTR_ADDR:%.*]] = alloca ptr, align 4
+// CHECK-NEXT:    store ptr [[FNPTR:%.*]], ptr [[FNPTR_ADDR]], align 4
+// CHECK-NEXT:    [[TMP0:%.*]] = load ptr, ptr [[FNPTR_ADDR]], align 4
+// CHECK-NEXT:    [[TMP1:%.*]] = addrspacecast ptr [[TMP0]] to ptr addrspace(20)
+// CHECK-NEXT:    ret ptr addrspace(20) [[TMP1]]
+//
+fn_funcref_t get_ref(fn_t fnptr) {
+  return (fn_funcref_t) fnptr;
+}
+
+// Call funcref
+// CHECK-LABEL: @call_fn(
+// CHECK-NEXT:  entry:
+// CHECK-NEXT:    [[REF_ADDR:%.*]] = alloca ptr addrspace(20), align 4
+// CHECK-NEXT:    [[X_ADDR:%.*]] = alloca i32, align 4
+// CHECK-NEXT:    store ptr addrspace(20) [[REF:%.*]], ptr [[REF_ADDR]], align 4
+// CHECK-NEXT:    store i32 [[X:%.*]], ptr [[X_ADDR]], align 4
+// CHECK-NEXT:    [[TMP0:%.*]] = load ptr addrspace(20), ptr [[REF_ADDR]], align 4
+// CHECK-NEXT:    [[TMP1:%.*]] = load i32, ptr [[X_ADDR]], align 4
+// CHECK-NEXT:    [[CALL:%.*]] = call addrspace(20) i32 [[TMP0]](i32 noundef [[TMP1]])
+// CHECK-NEXT:    ret i32 [[CALL]]
+//
+int call_fn(fn_funcref_t ref, int x) {
+  return ref(x);
+}

clang/test/SemaTemplate/address_space-dependent.cpp

 
 template <int I>
 void neg() {
   __attribute__((address_space(I))) int *bounds; // expected-error {{address space is negative}}
 }
 
 template <long int I>
 void tooBig() {
-  __attribute__((address_space(I))) int *bounds; // expected-error {{address space is larger than the maximum supported (8388586)}}
+  __attribute__((address_space(I))) int *bounds; // expected-error {{address space is larger than the maximum supported (8388585)}}
 }
 
 template <long int I>
 void correct() {
   __attribute__((address_space(I))) int *bounds;
 }
 
 template <int I, int J>

 
 int main() {
   int __attribute__((address_space(1))) * p1;
   int p = GetAddressSpaceValue(p1);
 
   car<1, 2, 3>(); // expected-note {{in instantiation of function template specialization 'car<1, 2, 3>' requested here}}
   HasASTemplateFields<1> HASTF;
   neg<-1>(); // expected-note {{in instantiation of function template specialization 'neg<-1>' requested here}}
-  correct<0x7FFFEA>();
+  correct<0x7FFFE9>();
   tooBig<8388650>(); // expected-note {{in instantiation of function template specialization 'tooBig<8388650L>' requested here}}
 
   __attribute__((address_space(1))) char *x;
   __attribute__((address_space(2))) char *y;
   cmp<1, 2>(x, y); // expected-note {{in instantiation of function template specialization 'cmp<1, 2>' requested here}}
 
   fooFunction<1> ff;
   ff.get_0(); // expected-note {{in instantiation of member function 'fooFunction<1>::get_0' requested here}}
   ff.qf();
   ff.test3(); // expected-note {{in instantiation of member function 'fooFunction<1>::test3' requested here}}
 
   static_assert(partial_spec_deduce_as<int __attribute__((address_space(3))) *>::value == 3, "address space value has been incorrectly deduced");
 
   return 0;
 }