[WebAssembly] Initial support for reference type funcref in clang

[pmatos]

Summary

This is the funcref counterpart to 104bad5a. We introduce a new attribute
that marks a function pointer as a funcref. It also implements builtin
__builtin_wasm_ref_null_func(), that returns a null funcref value.

[pmatos]

Rebase on top of main. Add missing code in Sema* to ensure the new funcref builtin is checked for.
Thanks to @asb for helping fix this.

[pmatos]

Update the patch as there were some missing calls from SemaChecking.
Thanks to @asb for spotting it.

[pmatos]

It would be great to get this landed. Can someone pls take a look at it? It's quite independent from the remainder of the work and self-contained.

maybe @tlively ping?

[tlively]

Oops, sorry about that. Will take a look.

[tlively]

It would be good to add tests for more error conditions like in the externref patch and also additional errors like trying to apply __funcref to types that aren't function pointers.

clang/include/clang/Basic/Attr.td

4128

It would be good to document this!

clang/lib/Sema/SemaChecking.cpp

4658

Are the extra parentheses meaningful here?

6690–6693

How do these parts correspond to the original source code?

[aaron.ballman]

Same question here about an RFC for adding this new type to the type system and a design document for how the type behaves as in https://reviews.llvm.org/D122215.

clang/include/clang/Basic/Attr.td

4128

It's a requirement that this be documented. Also, this should probably have a Subjects line that expects a function of some sort? (It doesn't impact the semantics of anything, but it self-documents the expectations for people reading Attr.td.)

clang/include/clang/Basic/DiagnosticSemaKinds.td

7381

1. What is __clang_webassembly_funcref? Did you mean __funcref?
2. There's no test coverage for this diagnostic.

clang/include/clang/Basic/TokenKinds.def

682

Why is this a keyword in all language modes?

clang/include/clang/Parse/Parser.h

2928

clang/include/clang/Sema/Sema.h

13469–13470

Formatting is off here.

13538

I think there's a verb missing from this function identifier -- also, I don't think we need to continue the terrible trend of prepending Sema onto the function name which lives in the Sema object.

clang/lib/AST/ASTContext.cpp

933

Where did this value come from?

clang/lib/Parse/ParseDecl.cpp

843–844

849–852

5917

Why that specific ordering as opposed to AR_VendorAttributesParsed?

clang/lib/Sema/SemaChecking.cpp

6695–6699

Why would we need to do this?? And what do we do when there is no FunctionDecl to get back to (because it's a call expression through a function pointer, for example)?

6702

Why are you guaranteed this function returns void?

clang/lib/Sema/SemaType.cpp

7341

7354

This seems like it's not used.

7374–7375

What happens when the user's function already has an explicitly specified address space?

[pmatos]

clang/lib/AST/ASTContext.cpp

933

Unsure what you mean here. This is the address space number we also use on the LLVM side.

[aaron.ballman]

clang/lib/AST/ASTContext.cpp

933

Unsure what you mean here. This is the address space number we also use on the LLVM side.

That's exactly what I was looking for -- I wanted to make sure this agreed with the LLVM side of things and any public documentation about address spaces for WASM.

[pmatos]

Rebase

[pmatos]

clang/lib/AST/ASTContext.cpp

933

Unsure what you mean here. This is the address space number we also use on the LLVM side.

That's exactly what I was looking for -- I wanted to make sure this agreed with the LLVM side of things and any public documentation about address spaces for WASM.

Sure! Marking as done.

[pmatos]

clang/include/clang/Basic/DiagnosticSemaKinds.td

7381

1. What is __clang_webassembly_funcref? Did you mean __funcref?
2. There's no test coverage for this diagnostic.

Yes, I meant __funcref. Thanks, will add test coverage for the diagnostic.

clang/include/clang/Basic/TokenKinds.def

682

I might have misread the docs but this keyword should be available for both C and C++. Maybe I want KEYC99 | KEYCXX ?

clang/include/clang/Sema/Sema.h

13469–13470

Don't understand why. It's the same as CheckRISCVBuiltinFunctionCall ?

[pmatos]

Addressed some of the concerns from the comments but not ready for review yet.

[pmatos]

Address most of the comments.

[pmatos]

Updated this revision on top of D122215.

[pmatos]

Ready for review.

RFC: https://discourse.llvm.org/t/rfc-webassembly-reference-types-in-clang/66939

[pmatos]

Rebase on top of main.

[pmatos]

@aaron.ballman Hi Aaron, since you requested an RFC for this. I wonder if you have any comments for this or the other related patches: D122215, D139010

[aaron.ballman]

In D128440#4042753, @pmatos wrote:

@aaron.ballman Hi Aaron, since you requested an RFC for this. I wonder if you have any comments for this or the other related patches: D122215, D139010

I appreciate your patience with the extreme delay on getting you feedback after I asked you to post the RFC; I wanted to give the RFC a chance to bake and then ran into the holiday season as a result. Sorry for that!

Adding @erichkeane as new attributes code owner as well, in case he's got additional thoughts.

clang/include/clang/Basic/TokenKinds.def

682

I was thinking this keyword would only work for a web assembly target, so we'd likely want to add KEYWEBASM or something to the list like we have for KEYALTIVEC. But now I'm second-guessing that instinct and am wondering what behavior we want here.

1. Parse the keyword in all language modes and for all targets, give an ignored attribute warning if the target isn't web assembly
2. Parse the keyword in all language modes and for all targets, give a parse time diagnostic (error?) if the target isn't web assembly
3. Only expose the keyword if the target is web assembly, otherwise it parses as an identifier and you get the usual parse errors

My original thinking was that we wanted #3, but on reflection both #1 and #2 seem reasonable to me. Do you have a preference? I think I prefer either 2 or 3 over 1 because this involves the type system (errors are usually a better approach in that case).

clang/lib/AST/TypePrinter.cpp

1652–1653

I'm not certain that the assert adds much here given that the predicate tests exactly the same thing, perhaps remove it (and drop the curly braces)?

clang/lib/Basic/Targets/WebAssembly.h

44–45

I'm not super familiar with the address space maps, but this sets of my spidey senses. All of the other address space maps end with:

ptr64, hlsl_groupshared, wasm_funcref

but this one is ending with:

ptr64, wasm_externref, wasm_funcref

which makes me think something's amiss here. Thoughts?

clang/lib/Parse/ParseDecl.cpp

844

I think we should assert this condition; we already know what the token is before we call this function anyway.

5917–5920

I don't think we need to care about attribute requirements because this is a keyword attribute (this feature is used to prohibit attributes in certain grammars and I don't think that applies here).

clang/lib/Sema/SemaChecking.cpp

6704–6710

These comments no longer seem to match the code -- nothing creates a FunctionDecl here.

6711

I'm still wondering why this code is needed and what it's trying to do. It worries me that we're changing the type of the call expression like this.

clang/lib/Sema/SemaDecl.cpp

14816

clang/lib/Sema/SemaType.cpp

7351

We're missing Sema test coverage for all the various diagnostics you've added; can you add that coverage?

7354

Still wondering about this

7374–7375

Still wondering about this as well.

[erichkeane]

clang/include/clang/Basic/Attr.td

4129

Note that it seems this is likely not going to work correctly on template type aliases! You probably want to make sure that is acceptable to you.

clang/include/clang/Basic/AttrDocs.td

6855

This says 'function pointer declaration', but you have it's subject as Typedef?

clang/include/clang/Basic/TokenKinds.def

682

I don't think #1 is acceptable for the keyword, we shouldn't ignore keywords like we do attributes. Doing an ignored warning in SemaDeclAttr.td for the ATTRIBUTE is fine, but keyword form needs to be an error.

My preference is #2, an error if we encounter it during parsing and we're not in WebAsm target.

clang/lib/Basic/Targets/DirectX.h

45

Also apply to the rest of the targets. Also, why is there only 1 added here? I thought we had 2 address spaces for Wasm?

clang/lib/Basic/Targets/WebAssembly.h

44–45

That DEFINITELY looks suspicious to me as well, I noted above too, but either we need to specify we're re-using the hlsl_groupshared for wasm_externref address space (at which point, i wonder: why not re-use a different address space?), or correct this.

clang/lib/Parse/ParseDecl.cpp

847

clang/lib/Sema/SemaChecking.cpp

6696

Does this diagnose? Should we be emitting an error here?

6708

All those comments don't really seem relevant here, and are not really correct. The only thing SemaChecking should do is either modify its arguments (though you don't have any), or set its return type.

6711

This appears to be a 'custom type checking' builtin, where the code in Sema has to check the arguments (rather than the automatic behavior working), and set its return type to the 'correct' one. It appears that this accepts no arguments, then changes the result of the builtin.

So this doesn't seem particularly odd, other than the strange comments above.

clang/lib/Sema/SemaType.cpp

7340

This name seems misleading... should you be desugaring 'Type' to store it in 'Desugared'?

Also, I see that this value is never used, so why do the copy init? ALSO, why is it called Desugared, when it never seems to get a Desugared type?

[aaron.ballman]

clang/lib/Sema/SemaChecking.cpp

6711

Oh yeah that's right, that is how the custom checking code works, thank you for the reminder!

[pmatos]

@aaron.ballman Added support for externref mangling in Microsoft. This follows the pattern implemented by OpenCL types.

[pmatos]

In D128440#4047535, @pmatos wrote:

@aaron.ballman Added support for externref mangling in Microsoft. This follows the pattern implemented by OpenCL types.

Wrong revision - sorry.

[erichkeane]

clang/lib/AST/MicrosoftMangle.cpp

2481 ↗

(On Diff #488645)

I'm not sure what the PA is supposed to mean? I see some uses of mangleArtificialTagType don't do anything with it, so I fear it is something OCL specific.

[pmatos]

Undo last patch. Submitted change to incorrect revision.

[pmatos]

clang/include/clang/Basic/Attr.td

4129

Documentation says about Subject:

// The things to which an attribute can appertain
SubjectList Subjects;

Given this can be attached to function pointer types, is the subject then just Type ?

clang/include/clang/Basic/AttrDocs.td

6855

That's a mistake due to how things worked in an earlier revision. Thanks for spotting.

clang/include/clang/Basic/TokenKinds.def

682

Thanks for the comments, I have now updated this with an implementation of option 2 and added a diagnostic test.

clang/lib/Basic/Targets/DirectX.h

45

Externref is a type in clang, doesn't need its own address space in clang, only when it's lowered to a opaque type in llvm it gets its own address space.

[erichkeane]

clang/include/clang/Basic/Attr.td

4129

IIRC, the list of subjects are the Decls and Stmt types that are possibly allowed. I don't thnk it would be just 'Type' there.

As you have it, it is only allowed on TypedefNameDecl.

See the SubsetSubject's at the top of this file for some examples on how you could constrain a special matcher to only work on function pointer decls.

clang/lib/Basic/Targets/DirectX.h

45

Please fix the comment in my suggestion.

Also, your explanation doesn't make it clear to me why you added TWO entries to this list for other targets, but only 1 here.

[pmatos]

Address a few comments, add new test for funcref keyword diagnostic.

[pmatos]

Add new Attr Subject Function Pointer for __funcref attribute.

[pmatos]

clang/include/clang/Basic/Attr.td

4129

Good point @erichkeane . What do you think of FunctionPointer implementation here?

[erichkeane]

clang/include/clang/Basic/Attr.td

4129

That seems acceptable to me.

[pmatos]

Rebase on main.

[aaron.ballman]

Some more comments, but there are unaddressed comments from earlier reviews as well.

clang/include/clang/Basic/Attr.td

4129

That makes sense to me as well, but FWIW, type attributes don't currently have much of any tablegen automation (unlike decl and stmt attributes), so the subject list isn't strictly necessary here. But it's still appreciated because 1) it's documentation, and 2) we want to tablegen more and this helps us with that goal.

clang/include/clang/Basic/DiagnosticSemaKinds.td

11784

clang/lib/AST/DeclBase.cpp

1060–1063 ↗

(On Diff #493251)

clang/lib/Parse/ParseDecl.cpp

854–855

Be sure to run clang-format over the patch to fix this sort of thing.

[pmatos]

clang/lib/Basic/Targets/DirectX.h

45

I have now fixed that. We just need one address space.

clang/lib/Basic/Targets/WebAssembly.h

44–45

Fixed this now. We only need the address space for funcref. The address space for externref is now necessary as it's its own type.

[pmatos]

clang/include/clang/Basic/Attr.td

4129

@erichkeane Yes, you're right. Something like

using IntIntFuncref = int(*)(int) __funcref;

doesn't work. Why is this not accepted? Is it due to the Subjects listed?

[pmatos]

Address some of the pending comments.

[pmatos]

clang/lib/Sema/SemaChecking.cpp

6690–6693

If I understand your question correctly, this is just the semantic checks for each of the builtins.

6702

I think this question is not relevant anymore given the current code, right? The wasm ref null builtin will always return the null funcref.

6704–6710

Right - fixed.

6708

Right, these comments can be removed. I fixed these.

clang/lib/Sema/SemaType.cpp

7340

Bad naming due to earlier code. I have simplified this code now.

[pmatos]

Addressed a few comments.

[pmatos]

clang/lib/Sema/SemaChecking.cpp

6695–6699

I have added a test to check this situation.

6696

I think it makes sense. Will add a test as well for the diagnostic.

[pmatos]

Further refinement of the patch with more diagnostics tested.

[pmatos]

Remove unnecessary code.

[pmatos]

clang/lib/Sema/SemaType.cpp

7354

That's correct - removed.

[pmatos]

@aaron.ballman I have finished addressing all the concerns on this patch. Do you have any further comments?

clang/lib/Sema/SemaType.cpp

7374–7375

We'll just be overriding the address space in this case. Although, I am not sure something like this can happen in Wasm given there's only one linear memory.

[pmatos]

Rebased on current HEAD.

[aaron.ballman]

Generally LGTM with a few comments sprinkled around.

clang/include/clang/Basic/Attr.td

4129

Not due to the subjects -- keyword attributes require manual parsing and type attributes require manual processing (we don't tablegen as much as I'd like for type attributes). But that code should be accepted (you should add a test case for it as well).

clang/include/clang/Basic/AttrDocs.td

6852

DocCatType, right?

6855

"Function pointer declaration" reads a bit odd to me, I think you mean "function pointer type", right?

e.g.,
void (*)() __funcref is fine, as is void (*fp)() __funcref -- the attribute appertains to the type, not to the declaration?

clang/lib/Sema/SemaType.cpp

7332

Just to avoid confusing editors that can't tell Type is a variable and not clang::Type the type.

clang/test/Sema/wasm-refs.c

50 ↗

(On Diff #497632)

Should we also test two-level application of the qualifier, as in?

using uh_oh = funcref_t __funcref;

[pmatos]

Thanks @aaron.ballman . I think I have now address all outstanding comments.

clang/include/clang/Basic/Attr.td

4129

Seems to be fine now. Test added.

clang/include/clang/Basic/AttrDocs.td

6852

Yes.

clang/test/Sema/wasm-refs.c

50 ↗

(On Diff #497632)

Double qualification shouldn't be an issue - adding this to SemaCXX/wasm-funcref.cpp.

[pmatos]

Patch with all outstanding comments addressed.

[pmatos]

Add forgotten comment to test.

[pmatos]

@erichkeane @aaron.ballman any further comments on this?

[erichkeane]

First, we've been dealing with the 16.0 release process/regressions, which unfortunately got us pretty far behind on reviews. Sorry about that!

I have only 1 concern here, otherwise, this LGTM. I'll leave it to Aaron to make the final 'value judgement' of if we want to keep this, so I'll leave it to him to Approve.

clang/lib/AST/DeclBase.cpp

1056 ↗

(On Diff #501081)

probably want to canonicalize here (and above). Else typedefs-to-typedefs/etc might getcha.

[aaron.ballman]

LGTM aside from some small nits that you can fix when landing. Thank you for your patience on this review!

clang/lib/AST/DeclBase.cpp

1056 ↗

(On Diff #501081)

Yeah, I'd do that below on the return, as in: return Ty.getCanonicalType()->isFunctionPointerType();

clang/test/SemaCXX/wasm-funcref.cpp

14 ↗

(On Diff #501081)

Please add a newline to the end of the file.

[pmatos]

Thanks all for the comments, fixed and will soon land after running a check-all.

[MyDeveloperDay]

clang/lib/Format/FormatToken.h

603

Is there a unit test in clang format for this change?

clang/include/clang/AST/Type.h

public:
   /// and vector attributes are not simple type qualifiers.
   ///
   /// Type qualifiers are often, but not always, reflected in the canonical
   /// type.
   bool isQualifier() const;
 
   bool isMSTypeSpec() const;
 
+  bool isWebAssemblyFuncrefSpec() const;
+
   bool isCallingConv() const;
 
   llvm::Optional<NullabilityKind> getImmediateNullability() const;
 
   /// Retrieve the attribute kind corresponding to the given
   /// nullability kind.
   static Kind getNullabilityAttrKind(NullabilityKind kind) {
     switch (kind) {

clang/include/clang/Basic/AddressSpaces.h

enum class LangAS : unsigned {
   // Pointer size and extension address spaces.
   ptr32_sptr,
   ptr32_uptr,
   ptr64,
 
   // HLSL specific address spaces.
   hlsl_groupshared,
 
+  // Wasm specific address spaces.
+  wasm_funcref,
+
   // This denotes the count of language-specific address spaces and also
   // the offset added to the target-specific address spaces, which are usually
   // specified by address space attributes __attribute__(address_space(n))).
   FirstTargetAddressSpace
 };
 
 /// The type of a lookup table which maps from language-specific address spaces
 /// to target-specific ones.

clang/include/clang/Basic/Attr.td

def FunctionReturnThunks : InheritableAttr,
   let Spellings = [GCC<"function_return">];
   let Args = [EnumArgument<"ThunkType", "Kind",
     ["keep", "thunk-extern"],
     ["Keep", "Extern"]
   >];
   let Subjects = SubjectList<[Function]>;
   let Documentation = [FunctionReturnThunksDocs];
 }
+
+def WebAssemblyFuncref : TypeAttr, TargetSpecificAttr<TargetWebAssembly> {
+  let Spellings = [Keyword<"__funcref">];
+  let Documentation = [WebAssemblyExportNameDocs];
+  let Subjects = SubjectList<[Type], ErrorDiag>;
+}
+
 def ReadOnlyPlacement : InheritableAttr {
   let Spellings = [Clang<"enforce_read_only_placement">];
   let Subjects = SubjectList<[Record]>;
   let Documentation = [ReadOnlyPlacementDocs];
 }

clang/include/clang/Basic/AttrDocs.td

def ReadOnlyPlacementDocs : Documentation {
   2. Type ``T`` defines/inherits a mutable field.
   3. Type ``T`` defines/inherits non-constexpr constructor(s) for initialization.
   4. A field of type ``T`` is defined by type ``Q``, which does not bear the
      ``enforce_read_only_placement`` attribute.
   5. A type ``Q`` inherits from type ``T`` and it does not have the
      ``enforce_read_only_placement`` attribute.
   }];
 }
+
+def WebAssemblyFuncrefDocs : Documentation {
+  let Category = DocCatFunction;
+  let Content = [{
+Clang supports the ``__funcref`` attribute for the WebAssembly target. 
+This attribute may be attached to a function pointer declaration, where it modifies 
+its underlying representation to be a WebAssembly ``funcref``.
+  }];
+}

clang/include/clang/Basic/BuiltinsWebAssembly.def

 
 TARGET_BUILTIN(__builtin_wasm_relaxed_q15mulr_s_i16x8, "V8sV8sV8s", "nc", "relaxed-simd")
 
 TARGET_BUILTIN(__builtin_wasm_relaxed_dot_i8x16_i7x16_s_i16x8, "V8sV16ScV16Sc", "nc", "relaxed-simd")
 TARGET_BUILTIN(__builtin_wasm_relaxed_dot_i8x16_i7x16_add_s_i32x4, "V4iV16ScV16ScV4i", "nc", "relaxed-simd")
 TARGET_BUILTIN(__builtin_wasm_relaxed_dot_bf16x8_add_f32_f32x4, "V4fV8UsV8UsV4f", "nc", "relaxed-simd")
 
 // Reference Types builtins
+// Some builtins are custom type-checked - see 't' as part of the third argument,
+// in which case the argument spec (second argument) is unused.
 
 TARGET_BUILTIN(__builtin_wasm_ref_null_extern, "i", "nct", "reference-types")
 
+// A funcref represented as a function pointer with the funcref attribute
+// attached to the type, therefore SemaChecking will check for the right
+// return type.
+TARGET_BUILTIN(__builtin_wasm_ref_null_func, "i", "nct", "reference-types")
+
 #undef BUILTIN
 #undef TARGET_BUILTIN

clang/include/clang/Basic/DiagnosticSemaKinds.td

def warn_objc_unsafe_perform_selector : Warning<
   "%select{struct|union|vector}1 type">,
   InGroup<DiagGroup<"objc-unsafe-perform-selector">>;
 def note_objc_unsafe_perform_selector_method_declared_here :  Note<
   "method %0 that returns %1 declared here">;
 def err_attribute_arm_builtin_alias : Error<
   "'__clang_arm_builtin_alias' attribute can only be applied to an ARM builtin">;
 def err_attribute_arm_mve_polymorphism : Error<
   "'__clang_arm_mve_strict_polymorphism' attribute can only be applied to an MVE/NEON vector type">;
+def err_attribute_webassembly_funcref : Error<
+  "'__funcref' attribute can only be applied to a function pointer type">;
 
 def warn_setter_getter_impl_required : Warning<
   "property %0 requires method %1 to be defined - "
   "use @synthesize, @dynamic or provide a method implementation "
   "in this class implementation">,
   InGroup<ObjCPropertyImpl>;
 def warn_setter_getter_impl_required_in_category : Warning<
   "property %0 requires method %1 to be defined - "

 def err_loongarch_builtin_requires_la32 : Error<
   "this builtin requires target: loongarch32">;
 
 // WebAssembly reference type and table diagnostics.
 def err_wasm_reference_pr : Error<
   "%select{pointer|reference}0 to WebAssembly reference type is not allowed">;
 def err_wasm_ca_reference : Error<
   "cannot %select{capture|take address of}0 WebAssembly reference">;
+def err_wasm_funcref_not_wasm : Error<
+  "invalid use of __funcref keyword outside the WebAssembly triple">;
 } // end of sema component.

clang/include/clang/Basic/TokenKinds.def

 ALIAS("__volatile__" , volatile   , KEYALL)
 
 // Type nullability.
 KEYWORD(_Nonnull                 , KEYALL)
 KEYWORD(_Nullable                , KEYALL)
 KEYWORD(_Nullable_result         , KEYALL)
 KEYWORD(_Null_unspecified        , KEYALL)
 
+// WebAssembly Type Extension
+KEYWORD(__funcref                     , KEYALL)
+
 // Microsoft extensions which should be disabled in strict conformance mode
 KEYWORD(__ptr64                       , KEYMS)
 KEYWORD(__ptr32                       , KEYMS)
 KEYWORD(__sptr                        , KEYMS)
 KEYWORD(__uptr                        , KEYMS)
 KEYWORD(__w64                         , KEYMS)
 KEYWORD(__uuidof                      , KEYMS | KEYBORLAND)
 KEYWORD(__try                         , KEYMS | KEYBORLAND)

clang/include/clang/Parse/Parser.h

bool MaybeParseMicrosoftDeclSpecs(ParsedAttributes &Attrs) {
     }
     return false;
   }
   void ParseMicrosoftDeclSpecs(ParsedAttributes &Attrs);
   bool ParseMicrosoftDeclSpecArgs(IdentifierInfo *AttrName,
                                   SourceLocation AttrNameLoc,
                                   ParsedAttributes &Attrs);
   void ParseMicrosoftTypeAttributes(ParsedAttributes &attrs);
+  void ParseWebAssemblyFuncrefTypeAttribute(ParsedAttributes &Attrs);
   void DiagnoseAndSkipExtendedMicrosoftTypeAttributes();
   SourceLocation SkipExtendedMicrosoftTypeAttributes();
   void ParseMicrosoftInheritanceClassAttributes(ParsedAttributes &attrs);
   void ParseBorlandTypeAttributes(ParsedAttributes &attrs);
   void ParseOpenCLKernelAttributes(ParsedAttributes &attrs);
   void ParseOpenCLQualifiers(ParsedAttributes &Attrs);
   void ParseNullabilityTypeSpecifiers(ParsedAttributes &attrs);
   void ParseCUDAFunctionAttributes(ParsedAttributes &attrs);

clang/include/clang/Sema/Sema.h

private:
   bool CheckX86BuiltinFunctionCall(const TargetInfo &TI, unsigned BuiltinID,
                                    CallExpr *TheCall);
   bool CheckPPCBuiltinFunctionCall(const TargetInfo &TI, unsigned BuiltinID,
                                    CallExpr *TheCall);
   bool CheckAMDGCNBuiltinFunctionCall(unsigned BuiltinID, CallExpr *TheCall);
   bool CheckRISCVLMUL(CallExpr *TheCall, unsigned ArgNum);
   bool CheckRISCVBuiltinFunctionCall(const TargetInfo &TI, unsigned BuiltinID,
                                      CallExpr *TheCall);
   bool CheckLoongArchBuiltinFunctionCall(const TargetInfo &TI,
                                          unsigned BuiltinID, CallExpr *TheCall);
   bool CheckWebAssemblyBuiltinFunctionCall(const TargetInfo &TI,
                                            unsigned BuiltinID,
                                            CallExpr *TheCall);
 
   bool SemaBuiltinVAStart(unsigned BuiltinID, CallExpr *TheCall);
   bool SemaBuiltinVAStartARMMicrosoft(CallExpr *Call);
   bool SemaBuiltinUnorderedCompare(CallExpr *TheCall);
   bool SemaBuiltinFPClassification(CallExpr *TheCall, unsigned NumArgs);
private:
   ExprResult SemaBuiltinMatrixTranspose(CallExpr *TheCall,
                                         ExprResult CallResult);
   ExprResult SemaBuiltinMatrixColumnMajorLoad(CallExpr *TheCall,
                                               ExprResult CallResult);
   ExprResult SemaBuiltinMatrixColumnMajorStore(CallExpr *TheCall,
                                                ExprResult CallResult);
 
   // WebAssembly builtin handling.
   bool BuiltinWasmRefNullExtern(CallExpr *TheCall);
+  bool BuiltinWasmRefNullFunc(CallExpr *TheCall);
 
 public:
   enum FormatStringType {
     FST_Scanf,
     FST_Printf,
     FST_NSString,
     FST_Strftime,
     FST_Strfmon,

clang/lib/AST/ASTContext.cpp

 }
 
 ParentMapContext &ASTContext::getParentMapContext() {
   if (!ParentMapCtx)
     ParentMapCtx.reset(new ParentMapContext(*this));
   return *ParentMapCtx.get();
 }
 
 static bool isAddrSpaceMapManglingEnabled(const TargetInfo &TI,
                                           const LangOptions &LangOpts) {
   switch (LangOpts.getAddressSpaceMapMangling()) {
   case LangOptions::ASMM_Target:
     return TI.useAddressSpaceMapMangling();
   case LangOptions::ASMM_On:
     return true;
   case LangOptions::ASMM_Off:
     return false;

 /// opaque reference to a host value.
 QualType ASTContext::getWebAssemblyExternrefType() const {
   if (Target->getTriple().isWasm() && Target->hasFeature("reference-types")) {
 #define WASM_REF_TYPE(Name, MangledName, Id, SingletonId, AS)                  \
   if (BuiltinType::Id == BuiltinType::WasmExternRef)                           \
     return SingletonId;
 #include "clang/Basic/WebAssemblyReferenceTypes.def"
   }
-  assert(false && "shouldn't try to generate type externref outside WebAssembly target");
+  llvm_unreachable("couldn't find the externref type?");
 }
 
 /// getScalableVectorType - Return the unique reference to a scalable vector
 /// type of the specified element type and size. VectorType must be a built-in
 /// type.
 QualType ASTContext::getScalableVectorType(QualType EltTy,
                                            unsigned NumElts) const {
   if (Target->hasAArch64SVETypes()) {

clang/lib/AST/Type.cpp

bool AttributedType::isMSTypeSpec() const {
   case attr::Ptr64:
   case attr::SPtr:
   case attr::UPtr:
     return true;
   }
   llvm_unreachable("invalid attr kind");
 }
 
+bool AttributedType::isWebAssemblyFuncrefSpec() const {
+  return getAttrKind() == attr::WebAssemblyFuncref;
+}
+
 bool AttributedType::isCallingConv() const {
   // FIXME: Generate this with TableGen.
   switch (getAttrKind()) {
   default: return false;
   case attr::Pcs:
   case attr::CDecl:
   case attr::FastCall:
   case attr::StdCall:

clang/lib/AST/TypePrinter.cpp

if (T->isMSTypeSpec()) {
     case attr::Ptr32: OS << " __ptr32"; break;
     case attr::Ptr64: OS << " __ptr64"; break;
     case attr::SPtr: OS << " __sptr"; break;
     case attr::UPtr: OS << " __uptr"; break;
     }
     spaceBeforePlaceHolder(OS);
   }
 
+  if (T->isWebAssemblyFuncrefSpec())
+    OS << "__funcref";
+
   // Print nullability type specifiers.
   if (T->getImmediateNullability()) {
     if (T->getAttrKind() == attr::TypeNonNull)
       OS << " _Nonnull";
     else if (T->getAttrKind() == attr::TypeNullable)
       OS << " _Nullable";
     else if (T->getAttrKind() == attr::TypeNullUnspecified)
       OS << " _Null_unspecified";
void TypePrinter::printAttributedAfter(const AttributedType *T,
   // If this is a calling convention attribute, don't print the implicit CC from
   // the modified type.
   SaveAndRestore MaybeSuppressCC(InsideCCAttribute, T->isCallingConv());
 
   printAfter(T->getModifiedType(), OS);
 
   // Some attributes are printed as qualifiers before the type, so we have
   // nothing left to do.
-  if (T->getAttrKind() == attr::ObjCKindOf ||
-      T->isMSTypeSpec() || T->getImmediateNullability())
+  if (T->getAttrKind() == attr::ObjCKindOf || T->isMSTypeSpec() ||
+      T->getImmediateNullability() || T->isWebAssemblyFuncrefSpec())
     return;
 
   // Don't print the inert __unsafe_unretained attribute at all.
   if (T->getAttrKind() == attr::ObjCInertUnsafeUnretained)
     return;
 
   // Don't print ns_returns_retained unless it had an effect.
   if (T->getAttrKind() == attr::NSReturnsRetained &&
#include "clang/Basic/AttrList.inc"
   case attr::ObjCOwnership:
   case attr::Ptr32:
   case attr::Ptr64:
   case attr::SPtr:
   case attr::UPtr:
   case attr::AddressSpace:
   case attr::CmseNSCall:
   case attr::AnnotateType:
+  case attr::WebAssemblyFuncref:
     llvm_unreachable("This attribute should have been handled already");
 
   case attr::NSReturnsRetained:
     OS << "ns_returns_retained";
     break;
 
   // FIXME: When Sema learns to form this AttributedType, avoid printing the
   // attribute again in printFunctionProtoAfter.
std::string Qualifiers::getAddrSpaceAsString(LangAS AS) {
   case LangAS::cuda_shared:
     return "__shared__";
   case LangAS::ptr32_sptr:
     return "__sptr __ptr32";
   case LangAS::ptr32_uptr:
     return "__uptr __ptr32";
   case LangAS::ptr64:
     return "__ptr64";
+  case LangAS::wasm_funcref:
+    return "__funcref";
   case LangAS::hlsl_groupshared:
     return "groupshared";
   default:
     return std::to_string(toTargetAddressSpace(AS));
   }
 }
 
 // Appends qualifiers to the given string, separated by spaces.  Will

clang/lib/Basic/TargetInfo.cpp

static const LangASMap FakeAddrSpaceMap = {
     5,  // sycl_global_device
     6,  // sycl_global_host
     3,  // sycl_local
     0,  // sycl_private
     10, // ptr32_sptr
     11, // ptr32_uptr
     12, // ptr64
     13, // hlsl_groupshared
+    20, // wasm_funcref
 };
 
 // TargetInfo Constructor.
 TargetInfo::TargetInfo(const llvm::Triple &T) : Triple(T) {
   // Set defaults.  Defaults are set for a 32-bit RISC platform, like PPC or
   // SPARC.  These should be overridden by concrete targets as needed.
   BigEndian = !T.isLittleEndian();
   TLSSupported = true;

clang/lib/Basic/Targets/DirectX.h

static const unsigned DirectXAddrSpaceMap[] = {
     0, // sycl_global_device
     0, // sycl_global_host
     0, // sycl_local
     0, // sycl_private
     0, // ptr32_sptr
     0, // ptr32_uptr
     0, // ptr64
     3, // hlsl_groupshared
+    // Wasm address space values for this target are dummy values,
+    // as it is only enabled for Wasm targets.
+    20, // wasm_funcref
 };
 
 class LLVM_LIBRARY_VISIBILITY DirectXTargetInfo : public TargetInfo {
 public:
   DirectXTargetInfo(const llvm::Triple &Triple, const TargetOptions &)
       : TargetInfo(Triple) {
     TLSSupported = false;
     VLASupported = false;

clang/lib/Basic/Targets/NVPTX.h

static const unsigned NVPTXAddrSpaceMap[] = {
     1, // sycl_global_device
     1, // sycl_global_host
     3, // sycl_local
     0, // sycl_private
     0, // ptr32_sptr
     0, // ptr32_uptr
     0, // ptr64
     0, // hlsl_groupshared
+    // Wasm address space values for this target are dummy values,
+    // as it is only enabled for Wasm targets.
+    20, // wasm_funcref
 };
 
 /// The DWARF address class. Taken from
 /// https://docs.nvidia.com/cuda/archive/10.0/ptx-writers-guide-to-interoperability/index.html#cuda-specific-dwarf
 static const int NVPTXDWARFAddrSpaceMap[] = {
     -1, // Default, opencl_private or opencl_generic - not defined
     5,  // opencl_global
     -1,

clang/lib/Basic/Targets/SPIR.h

static const unsigned SPIRDefIsPrivMap[] = {
     0, // sycl_global_device
     0, // sycl_global_host
     0, // sycl_local
     0, // sycl_private
     0, // ptr32_sptr
     0, // ptr32_uptr
     0, // ptr64
     0, // hlsl_groupshared
+    // Wasm address space values for this target are dummy values,
+    // as it is only enabled for Wasm targets.
+    20, // wasm_funcref
 };
 
 // Used by both the SPIR and SPIR-V targets.
 static const unsigned SPIRDefIsGenMap[] = {
     4, // Default
     // OpenCL address space values for this map are dummy and they can't be used
     0, // opencl_global
     0, // opencl_local
static const unsigned SPIRDefIsGenMap[] = {
     5, // sycl_global_device
     6, // sycl_global_host
     3, // sycl_local
     0, // sycl_private
     0, // ptr32_sptr
     0, // ptr32_uptr
     0, // ptr64
     0, // hlsl_groupshared
+    // Wasm address space values for this target are dummy values,
+    // as it is only enabled for Wasm targets.
+    20, // wasm_funcref
 };
 
 // Base class for SPIR and SPIR-V target info.
 class LLVM_LIBRARY_VISIBILITY BaseSPIRTargetInfo : public TargetInfo {
 protected:
   BaseSPIRTargetInfo(const llvm::Triple &Triple, const TargetOptions &)
       : TargetInfo(Triple) {
     assert((Triple.isSPIR() || Triple.isSPIRV()) &&

clang/lib/Basic/Targets/TCE.h

static const unsigned TCEOpenCLAddrSpaceMap[] = {
     0, // sycl_global_device
     0, // sycl_global_host
     0, // sycl_local
     0, // sycl_private
     0, // ptr32_sptr
     0, // ptr32_uptr
     0, // ptr64
     0, // hlsl_groupshared
+    // Wasm address space values for this target are dummy values,
+    // as it is only enabled for Wasm targets.
+    20, // wasm_funcref
 };
 
 class LLVM_LIBRARY_VISIBILITY TCETargetInfo : public TargetInfo {
 public:
   TCETargetInfo(const llvm::Triple &Triple, const TargetOptions &)
       : TargetInfo(Triple) {
     TLSSupported = false;
     IntWidth = 32;

clang/lib/Basic/Targets/WebAssembly.h

 #include "clang/Basic/TargetInfo.h"
 #include "clang/Basic/TargetOptions.h"
 #include "llvm/ADT/Triple.h"
 #include "llvm/Support/Compiler.h"
 
 namespace clang {
 namespace targets {
 
+static const unsigned WebAssemblyAddrSpaceMap[] = {
+    0, // Default
+    0, // opencl_global
+    0, // opencl_local
+    0, // opencl_constant
+    0, // opencl_private
+    0, // opencl_generic
+    0, // opencl_global_device
+    0, // opencl_global_host
+    0, // cuda_device
+    0, // cuda_constant
+    0, // cuda_shared
+    0, // sycl_global
+    0, // sycl_global_device
+    0, // sycl_global_host
+    0, // sycl_local
+    0, // sycl_private
+    0, // ptr32_sptr
+    0, // ptr32_uptr
+    0, // ptr64
+    0, // hlsl_groupshared
+    20, // wasm_funcref
+};
+
 class LLVM_LIBRARY_VISIBILITY WebAssemblyTargetInfo : public TargetInfo {
 
   enum SIMDEnum {
     NoSIMD,
     SIMD128,
     RelaxedSIMD,
   } SIMDLevel = NoSIMD;
 
   bool HasNontrappingFPToInt = false;
   bool HasSignExt = false;
   bool HasExceptionHandling = false;
   bool HasBulkMemory = false;
   bool HasAtomics = false;
   bool HasMutableGlobals = false;
   bool HasMultivalue = false;
   bool HasTailCall = false;
   bool HasReferenceTypes = false;
   bool HasExtendedConst = false;
 
   std::string ABI;
 
 public:
   explicit WebAssemblyTargetInfo(const llvm::Triple &T, const TargetOptions &)
       : TargetInfo(T) {
+    AddrSpaceMap = &WebAssemblyAddrSpaceMap;
     NoAsmVariants = true;
     SuitableAlign = 128;
     LargeArrayMinWidth = 128;
     LargeArrayAlign = 128;
     SimdDefaultAlign = 128;
     SigAtomicType = SignedLong;
     LongDoubleWidth = LongDoubleAlign = 128;
     LongDoubleFormat = &llvm::APFloat::IEEEquad();

clang/lib/Basic/Targets/X86.h

static const unsigned X86AddrSpaceMap[] = {
     0,   // sycl_global_device
     0,   // sycl_global_host
     0,   // sycl_local
     0,   // sycl_private
     270, // ptr32_sptr
     271, // ptr32_uptr
     272, // ptr64
     0,   // hlsl_groupshared
+    // Wasm address space values for this target are dummy values,
+    // as it is only enabled for Wasm targets.
+    20, // wasm_funcref
 };
 
 // X86 target abstract base class; x86-32 and x86-64 are very close, so
 // most of the implementation can be shared.
 class LLVM_LIBRARY_VISIBILITY X86TargetInfo : public TargetInfo {
 
   enum X86SSEEnum {
     NoSSE,

clang/lib/CodeGen/CGBuiltin.cpp

case WebAssembly::BI__builtin_wasm_nearest_f64x2: {
     Value *Value = EmitScalarExpr(E->getArg(0));
     Function *Callee = CGM.getIntrinsic(IntNo, ConvertType(E->getType()));
     return Builder.CreateCall(Callee, Value);
   }
   case WebAssembly::BI__builtin_wasm_ref_null_extern: {
     Function *Callee = CGM.getIntrinsic(Intrinsic::wasm_ref_null_extern);
     return Builder.CreateCall(Callee);
   }
+  case WebAssembly::BI__builtin_wasm_ref_null_func: {
+    Function *Callee = CGM.getIntrinsic(Intrinsic::wasm_ref_null_func);
+    return Builder.CreateCall(Callee);
+  }
   case WebAssembly::BI__builtin_wasm_swizzle_i8x16: {
     Value *Src = EmitScalarExpr(E->getArg(0));
     Value *Indices = EmitScalarExpr(E->getArg(1));
     Function *Callee = CGM.getIntrinsic(Intrinsic::wasm_swizzle);
     return Builder.CreateCall(Callee, {Src, Indices});
   }
   case WebAssembly::BI__builtin_wasm_add_sat_s_i8x16:
   case WebAssembly::BI__builtin_wasm_add_sat_u_i8x16:

clang/lib/CodeGen/TargetInfo.h

public:
   virtual llvm::Type *getCUDADeviceBuiltinTextureDeviceType() const {
     // By default, no change from the original one.
     return nullptr;
   }
 
   /// Return the WebAssembly externref reference type.
   virtual llvm::Type *getWasmExternrefReferenceType() const { return nullptr; }
 
+  /// Return the WebAssembly funcref reference type.
+  virtual llvm::Type *getWasmFuncrefReferenceType() const { return nullptr; }
+
   /// Emit the device-side copy of the builtin surface type.
   virtual bool emitCUDADeviceBuiltinSurfaceDeviceCopy(CodeGenFunction &CGF,
                                                       LValue Dst,
                                                       LValue Src) const {
     // DO NOTHING by default.
     return false;
   }
   /// Emit the device-side copy of the builtin texture type.

clang/lib/CodeGen/TargetInfo.cpp

if (auto *FD = dyn_cast_or_null<FunctionDecl>(D)) {
         Fn->addFnAttr("no-prototype");
     }
   }
 
   /// Return the WebAssembly externref reference type.
   virtual llvm::Type *getWasmExternrefReferenceType() const override {
     return llvm::Type::getWasm_ExternrefTy(getABIInfo().getVMContext());
   }
+  /// Return the WebAssembly funcref reference type.
+  virtual llvm::Type *getWasmFuncrefReferenceType() const override {
+    return llvm::Type::getWasm_FuncrefTy(getABIInfo().getVMContext());
+  }
 };
 
 /// Classify argument of given type \p Ty.
 ABIArgInfo WebAssemblyABIInfo::classifyArgumentType(QualType Ty) const {
   Ty = useFirstFieldIfTransparentUnion(Ty);
 
   if (isAggregateTypeForABI(Ty)) {
     // Records with non-trivial destructors/copy-constructors should not be

clang/lib/Format/FormatToken.h

bool isAccessSpecifier(bool ColonRequired = true) const {
     const auto NextNonComment = getNextNonComment();
     return NextNonComment && NextNonComment->is(tok::colon);
   }
 
   bool canBePointerOrReferenceQualifier() const {
     return isOneOf(tok::kw_const, tok::kw_restrict, tok::kw_volatile,
                    tok::kw___attribute, tok::kw__Nonnull, tok::kw__Nullable,
                    tok::kw__Null_unspecified, tok::kw___ptr32, tok::kw___ptr64,
-                   TT_AttributeMacro);
+                   tok::kw___funcref, TT_AttributeMacro);
   }
 
   /// Determine whether the token is a simple-type-specifier.
   [[nodiscard]] bool isSimpleTypeSpecifier() const;
 
   [[nodiscard]] bool isTypeOrIdentifier() const;
 
   bool isObjCAccessSpecifier() const {

clang/lib/Parse/ParseDecl.cpp

case tok::kw___uptr: {
       break;
     }
     default:
       return;
     }
   }
 }
 
+void Parser::ParseWebAssemblyFuncrefTypeAttribute(ParsedAttributes &attrs) {
+  assert(Tok.is(tok::kw___funcref));
+  SourceLocation StartLoc = Tok.getLocation();
+  if (!getTargetInfo().getTriple().isWasm()) {
+    ConsumeToken();
+    Diag(StartLoc, diag::err_wasm_funcref_not_wasm);
+    return;
+  }
+    
+  IdentifierInfo *AttrName = Tok.getIdentifierInfo();
+  SourceLocation AttrNameLoc = ConsumeToken();
+  attrs.addNew(AttrName, AttrNameLoc, /*ScopeName=*/nullptr, /*ScopeLoc=*/SourceLocation{}, /*Args=*/nullptr, /*numArgs=*/0,
+               ParsedAttr::AS_Keyword);
+}
+
 void Parser::DiagnoseAndSkipExtendedMicrosoftTypeAttributes() {
   SourceLocation StartLoc = Tok.getLocation();
   SourceLocation EndLoc = SkipExtendedMicrosoftTypeAttributes();
 
   if (EndLoc.isValid()) {
     SourceRange Range(StartLoc, EndLoc);
     Diag(StartLoc, diag::warn_microsoft_qualifiers_ignored) << Range;
   }
while (true) {
     case tok::kw___stdcall:
     case tok::kw___fastcall:
     case tok::kw___thiscall:
     case tok::kw___regcall:
     case tok::kw___vectorcall:
       ParseMicrosoftTypeAttributes(DS.getAttributes());
       continue;
 
+    case tok::kw___funcref:
+      ParseWebAssemblyFuncrefTypeAttribute(DS.getAttributes());
+      continue;
+
     // Borland single token adornments.
     case tok::kw___pascal:
       ParseBorlandTypeAttributes(DS.getAttributes());
       continue;
 
     // OpenCL single token adornments.
     case tok::kw___kernel:
       ParseOpenCLKernelAttributes(DS.getAttributes());
#include "clang/Basic/OpenCLImageTypes.def"
   case tok::kw___private:
   case tok::kw___local:
   case tok::kw___global:
   case tok::kw___constant:
   case tok::kw___generic:
   case tok::kw___read_only:
   case tok::kw___read_write:
   case tok::kw___write_only:
-
+  case tok::kw___funcref:
   case tok::kw_groupshared:
     return true;
 
   case tok::kw_private:
     return getLangOpts().OpenCL;
 
   // C11 _Atomic
   case tok::kw__Atomic:
bool Parser::isDeclarationSpecifier(
   case tok::kw___constant:
   case tok::kw___generic:
   case tok::kw___read_only:
   case tok::kw___read_write:
   case tok::kw___write_only:
 #define GENERIC_IMAGE_TYPE(ImgType, Id) case tok::kw_##ImgType##_t:
 #include "clang/Basic/OpenCLImageTypes.def"
 
+  case tok::kw___funcref:
   case tok::kw_groupshared:
     return true;
 
   case tok::kw_private:
     return getLangOpts().OpenCL;
   }
 }
 
while (true) {
     case tok::kw___thiscall:
     case tok::kw___regcall:
     case tok::kw___vectorcall:
       if (AttrReqs & AR_DeclspecAttributesParsed) {
         ParseMicrosoftTypeAttributes(DS.getAttributes());
         continue;
       }
       goto DoneWithTypeQuals;
+
+    case tok::kw___funcref:
+      if (AttrReqs & AR_DeclspecAttributesParsed) {
+        ParseWebAssemblyFuncrefTypeAttribute(DS.getAttributes());
+        continue;
+      }
+      goto DoneWithTypeQuals;
+
     case tok::kw___pascal:
       if (AttrReqs & AR_VendorAttributesParsed) {
         ParseBorlandTypeAttributes(DS.getAttributes());
         continue;
       }
       goto DoneWithTypeQuals;
 
     // Nullability type specifiers.

clang/lib/Parse/ParseTentative.cpp

Parser::isCXXDeclarationSpecifier(ImplicitTypenameContext AllowImplicitTypename,
   case tok::kw___unaligned:
   case tok::kw__Nonnull:
   case tok::kw__Nullable:
   case tok::kw__Nullable_result:
   case tok::kw__Null_unspecified:
   case tok::kw___kindof:
     return TPResult::True;
 
+    // WebAssemblyFuncref
+  case tok::kw___funcref:
+    return TPResult::True;
+
     // Borland
   case tok::kw___pascal:
     return TPResult::True;
 
     // AltiVec
   case tok::kw___vector:
     return TPResult::True;
 

clang/lib/Sema/SemaChecking.cpp

bool Sema::CheckSystemZBuiltinFunctionCall(unsigned BuiltinID,
   return SemaBuiltinConstantArgRange(TheCall, i, l, u);
 }
 
 bool Sema::CheckWebAssemblyBuiltinFunctionCall(const TargetInfo &TI,
                                                unsigned BuiltinID,
                                                CallExpr *TheCall) {
   switch (BuiltinID) {
   case WebAssembly::BI__builtin_wasm_ref_null_extern:
     return BuiltinWasmRefNullExtern(TheCall);
+  case WebAssembly::BI__builtin_wasm_ref_null_func:
+    return BuiltinWasmRefNullFunc(TheCall);
   }
 
   return false;
 }
 
 /// SemaBuiltinCpuSupports - Handle __builtin_cpu_supports(char *).
 /// This checks that the target supports __builtin_cpu_supports and
 /// that the string argument is constant and valid.
static bool checkBuiltinArgument(Sema &S, CallExpr *E, unsigned ArgIndex) {
   E->setArg(ArgIndex, Arg.get());
   return false;
 }
 
 bool Sema::BuiltinWasmRefNullExtern(CallExpr *TheCall) {
   if (TheCall->getNumArgs() != 0)
     return true;
 
   TheCall->setType(Context.getWebAssemblyExternrefType());
 
   return false;
 }
 
+bool Sema::BuiltinWasmRefNullFunc(CallExpr *TheCall) {
+  if (TheCall->getNumArgs() != 0)
+    return true;
+
+  // The call we get looks like
+  // CallExpr
+  // `- ImplicitCastExpr
+  //   `- DeclRefExpr
+  //
+  // Therefore we need to change the types of the DeclRefExpr (stored in FDecl)
+  // and regenerate a straight up CallExpr on the modified FDecl.
+  // returning
+  // CallExpr
+  // `- FunctionDecl
+
+  // Prepare FDecl type
+  QualType Pointee = Context.getFunctionType(Context.VoidTy, {}, {});
+  QualType Type = Context.getPointerType(Pointee);
+  Pointee = Context.getAddrSpaceQualType(Pointee, LangAS::wasm_funcref);
+  Type = Context.getAttributedType(attr::WebAssemblyFuncref, Type,
+                                   Context.getPointerType(Pointee));
+  TheCall->setType(Type);
+
+  return false;
+}
+
 /// We have a call to a function like __sync_fetch_and_add, which is an
 /// overloaded function based on the pointer type of its first argument.
 /// The main BuildCallExpr routines have already promoted the types of
 /// arguments because all of these calls are prototyped as void(...).
 ///
 /// This function goes through and does final semantic checking for these
 /// builtins, as well as generating any warnings.
 ExprResult

clang/lib/Sema/SemaDecl.cpp

ParmVarDecl *Sema::CheckParameter(DeclContext *DC, SourceLocation StartLoc,
   // ISO/IEC TR 18037 S6.7.3: "The type of an object with automatic storage
   // duration shall not be qualified by an address-space qualifier."
   // Since all parameters have automatic store duration, they can not have
   // an address space.
   if (T.getAddressSpace() != LangAS::Default &&
       // OpenCL allows function arguments declared to be an array of a type
       // to be qualified with an address space.
       !(getLangOpts().OpenCL &&
-        (T->isArrayType() || T.getAddressSpace() == LangAS::opencl_private))) {
+        (T->isArrayType() || T.getAddressSpace() == LangAS::opencl_private)) &&
+      // WebAssembly allows reference types as parameters. Funcref in particular
+      // lives in a different address space
+      !(T->isFunctionPointerType() &&
+        T.getAddressSpace() == LangAS::wasm_funcref)) {
     Diag(NameLoc, diag::err_arg_with_address_space);
     New->setInvalidDecl();
   }
 
   // PPC MMA non-pointer types are not allowed as function argument types.
   if (Context.getTargetInfo().getTriple().isPPC64() &&
       CheckPPCMMAType(New->getOriginalType(), New->getLocation())) {
     New->setInvalidDecl();

clang/lib/Sema/SemaType.cpp

static bool handleMSPointerTypeQualifierAttr(TypeProcessingState &State,
   QualType Pointee = Type->getPointeeType();
   if (ASIdx != LangAS::Default)
     Pointee = S.Context.getAddrSpaceQualType(
         S.Context.removeAddrSpaceQualType(Pointee), ASIdx);
   Type = State.getAttributedType(A, Type, S.Context.getPointerType(Pointee));
   return false;
 }
 
+static bool HandleWebAssemblyFuncrefAttr(TypeProcessingState &State,
+                                         QualType &Type, ParsedAttr &PAttr) {
+  assert(PAttr.getKind() == ParsedAttr::AT_WebAssemblyFuncref);
+
+  Sema &S = State.getSema();
+  Attr *A = createSimpleAttr<WebAssemblyFuncrefAttr>(S.Context, PAttr);
+
+  std::bitset<attr::LastAttr> Attrs;
+  attr::Kind NewAttrKind = A->getKind();
+  QualType Desugared = Type;
+  const auto *AT = dyn_cast<AttributedType>(Type);
+  while (AT) {
+    Attrs[AT->getAttrKind()] = true;
+    Desugared = AT->getModifiedType();
+    AT = dyn_cast<AttributedType>(Desugared);
+  }
+
+  // You cannot specify duplicate type attributes, so if the attribute has
+  // already been applied, flag it.
+  if (Attrs[NewAttrKind]) {
+    S.Diag(PAttr.getLoc(), diag::warn_duplicate_attribute_exact) << PAttr;
+    return true;
+  }
+  Attrs[NewAttrKind] = true;
+
+  // Pointer type qualifiers can only operate on pointer types, but not
+  // pointer-to-member types.
+  //
+  // FIXME: Should we really be disallowing this attribute if there is any
+  // type sugar between it and the pointer (other than attributes)? Eg, this
+  // disallows the attribute on a parenthesized pointer.
+  // And if so, should we really allow *any* type attribute?
+  if (!isa<PointerType>(Desugared)) {
+    if (Type->isMemberPointerType())
+      S.Diag(PAttr.getLoc(), diag::err_attribute_no_member_pointers) << PAttr;
+    else
+      S.Diag(PAttr.getLoc(), diag::err_attribute_pointers_only) << PAttr << 0;
+    return true;
+  }
+
+  // Add address space to type based on its attributes.
+  LangAS ASIdx = LangAS::wasm_funcref;
+  QualType Pointee = Type->getPointeeType();
+  Pointee = S.Context.getAddrSpaceQualType(
+      S.Context.removeAddrSpaceQualType(Pointee), ASIdx);
+  Type = State.getAttributedType(A, Type, S.Context.getPointerType(Pointee));
+  return false;
+}
+
 /// Map a nullability attribute kind to a nullability kind.
 static NullabilityKind mapNullabilityAttrKind(ParsedAttr::Kind kind) {
   switch (kind) {
   case ParsedAttr::AT_TypeNonNull:
     return NullabilityKind::NonNull;
 
   case ParsedAttr::AT_TypeNullable:
     return NullabilityKind::Nullable;
case ParsedAttr::AT_NoDeref: {
       break;
     }
 
     case ParsedAttr::AT_MatrixType:
       HandleMatrixTypeAttr(type, attr, state.getSema());
       attr.setUsedAsTypeAttr();
       break;
 
+    case ParsedAttr::AT_WebAssemblyFuncref: {
+      if (!HandleWebAssemblyFuncrefAttr(state, type, attr))
+        attr.setUsedAsTypeAttr();
+      break;
+    }
+
     MS_TYPE_ATTRS_CASELIST:
       if (!handleMSPointerTypeQualifierAttr(state, attr, type))
         attr.setUsedAsTypeAttr();
       break;
 
 
     NULLABILITY_TYPE_ATTRS_CASELIST:
       // Either add nullability here or try to distribute it.  We

clang/test/CodeGen/WebAssembly/wasm-funcref.c

+// NOTE: Assertions have been autogenerated by utils/update_cc_test_checks.py
+// RUN: %clang_cc1 -triple wasm32 -target-feature +reference-types -o - -emit-llvm %s | FileCheck %s
+
+typedef void (*__funcref funcref_t)();
+typedef int (*__funcref fn_funcref_t)(int);
+typedef int (*fn_t)(int);
+
+// Null funcref builtin call
+// CHECK-LABEL: @get_null(
+// CHECK-NEXT:  entry:
+// CHECK-NEXT:    [[TMP0:%.*]] = call ptr addrspace(20) @llvm.wasm.ref.null.func()
+// CHECK-NEXT:    ret ptr addrspace(20) [[TMP0]]
+//
+funcref_t get_null() {
+  return __builtin_wasm_ref_null_func();
+}
+
+// Call to null funcref builtin but requires cast since
+// default return value for builtin is a funcref with function type () -> ().
+// CHECK-LABEL: @get_null_ii(
+// CHECK-NEXT:  entry:
+// CHECK-NEXT:    [[TMP0:%.*]] = call ptr addrspace(20) @llvm.wasm.ref.null.func()
+// CHECK-NEXT:    ret ptr addrspace(20) [[TMP0]]
+//
+fn_funcref_t get_null_ii() {
+  return (fn_funcref_t) __builtin_wasm_ref_null_func();
+}
+
+// Identity function for funcref.
+// CHECK-LABEL: @identity(
+// CHECK-NEXT:  entry:
+// CHECK-NEXT:    [[FN_ADDR:%.*]] = alloca ptr addrspace(20), align 4
+// CHECK-NEXT:    store ptr addrspace(20) [[FN:%.*]], ptr [[FN_ADDR]], align 4
+// CHECK-NEXT:    [[TMP0:%.*]] = load ptr addrspace(20), ptr [[FN_ADDR]], align 4
+// CHECK-NEXT:    ret ptr addrspace(20) [[TMP0]]
+//
+funcref_t identity(funcref_t fn) {
+  return fn;
+}
+
+void helper(funcref_t);
+
+// Pass funcref ref as an argument to a helper function.
+// CHECK-LABEL: @handle(
+// CHECK-NEXT:  entry:
+// CHECK-NEXT:    [[FN_ADDR:%.*]] = alloca ptr addrspace(20), align 4
+// CHECK-NEXT:    store ptr addrspace(20) [[FN:%.*]], ptr [[FN_ADDR]], align 4
+// CHECK-NEXT:    [[TMP0:%.*]] = load ptr addrspace(20), ptr [[FN_ADDR]], align 4
+// CHECK-NEXT:    call void @helper(ptr addrspace(20) noundef [[TMP0]])
+// CHECK-NEXT:    ret i32 0
+//
+int handle(funcref_t fn) {
+  helper(fn);
+  return 0;
+}
+
+// Return funcref from function pointer.
+// CHECK-LABEL: @get_ref(
+// CHECK-NEXT:  entry:
+// CHECK-NEXT:    [[FNPTR_ADDR:%.*]] = alloca ptr, align 4
+// CHECK-NEXT:    store ptr [[FNPTR:%.*]], ptr [[FNPTR_ADDR]], align 4
+// CHECK-NEXT:    [[TMP0:%.*]] = load ptr, ptr [[FNPTR_ADDR]], align 4
+// CHECK-NEXT:    [[TMP1:%.*]] = addrspacecast ptr [[TMP0]] to ptr addrspace(20)
+// CHECK-NEXT:    ret ptr addrspace(20) [[TMP1]]
+//
+fn_funcref_t get_ref(fn_t fnptr) {
+  return (fn_funcref_t) fnptr;
+}
+
+// Call funcref
+// CHECK-LABEL: @call_fn(
+// CHECK-NEXT:  entry:
+// CHECK-NEXT:    [[REF_ADDR:%.*]] = alloca ptr addrspace(20), align 4
+// CHECK-NEXT:    [[X_ADDR:%.*]] = alloca i32, align 4
+// CHECK-NEXT:    store ptr addrspace(20) [[REF:%.*]], ptr [[REF_ADDR]], align 4
+// CHECK-NEXT:    store i32 [[X:%.*]], ptr [[X_ADDR]], align 4
+// CHECK-NEXT:    [[TMP0:%.*]] = load ptr addrspace(20), ptr [[REF_ADDR]], align 4
+// CHECK-NEXT:    [[TMP1:%.*]] = load i32, ptr [[X_ADDR]], align 4
+// CHECK-NEXT:    [[CALL:%.*]] = call addrspace(20) i32 [[TMP0]](i32 noundef [[TMP1]])
+// CHECK-NEXT:    ret i32 [[CALL]]
+//
+int call_fn(fn_funcref_t ref, int x) {
+  return ref(x);
+}

clang/test/Parser/wasm-funcref.c

+// RUN: %clang_cc1 -triple powerpc-linux-gnu -fsyntax-only -verify %s
+
+// Test that we trigger an error at parse time if using keyword funcref
+// while not using a wasm triple.
+typedef void (*__funcref funcref_t)();     // expected-error {{invalid use of __funcref keyword outside the WebAssembly triple}}
+typedef int (*__funcref fn_funcref_t)(int);// expected-error {{invalid use of __funcref keyword outside the WebAssembly triple}}
+typedef int (*fn_t)(int);
+
+static fn_funcref_t nullFuncref = 0;

clang/test/SemaTemplate/address_space-dependent.cpp

 
 template <int I>
 void neg() {
   __attribute__((address_space(I))) int *bounds; // expected-error {{address space is negative}}
 }
 
 template <long int I>
 void tooBig() {
-  __attribute__((address_space(I))) int *bounds; // expected-error {{address space is larger than the maximum supported (8388587)}}
+  __attribute__((address_space(I))) int *bounds; // expected-error {{address space is larger than the maximum supported (8388586)}}
 }
 
 template <long int I>
 void correct() {
   __attribute__((address_space(I))) int *bounds;
 }
 
 template <int I, int J>

 
 int main() {
   int __attribute__((address_space(1))) * p1;
   int p = GetAddressSpaceValue(p1);
 
   car<1, 2, 3>(); // expected-note {{in instantiation of function template specialization 'car<1, 2, 3>' requested here}}
   HasASTemplateFields<1> HASTF;
   neg<-1>(); // expected-note {{in instantiation of function template specialization 'neg<-1>' requested here}}
-  correct<0x7FFFEA>();
+  correct<0x7FFFE9>();
   tooBig<8388650>(); // expected-note {{in instantiation of function template specialization 'tooBig<8388650L>' requested here}}
 
   __attribute__((address_space(1))) char *x;
   __attribute__((address_space(2))) char *y;
   cmp<1, 2>(x, y); // expected-note {{in instantiation of function template specialization 'cmp<1, 2>' requested here}}
 
   fooFunction<1> ff;
   ff.get_0(); // expected-note {{in instantiation of member function 'fooFunction<1>::get_0' requested here}}
   ff.qf();
   ff.test3(); // expected-note {{in instantiation of member function 'fooFunction<1>::test3' requested here}}
 
   static_assert(partial_spec_deduce_as<int __attribute__((address_space(3))) *>::value == 3, "address space value has been incorrectly deduced");
 
   return 0;
 }