Implement __attribute__((require_constant_initialization)) for safe static initialization.

[EricWF]

Summary

This attribute specifies expectations about the initialization of static and
thread local variables. Specifically that the variable has a
constant initializer
according to the rules of [basic.start.static]. Failure to meet this expectation
will result in an error.

Static objects with constant initializers avoid hard-to-find bugs caused by
the indeterminate order of dynamic initialization. They can also be safely
used by other static constructors across translation units.

This attribute acts as a compile time assertion that the requirements
for constant initialization have been met. Since these requirements change
between dialects and have subtle pitfalls it's important to fail fast instead
of silently falling back on dynamic initialization.

c++
  // -std=c++14
  #define SAFE_STATIC __attribute__((require_constant_initialization)) static
  struct T {
    constexpr T(int) {}
    ~T();
  };
  SAFE_STATIC T x = {42}; // OK.
  SAFE_STATIC T y = 42; // error: variable does not have a constant initializer
  // copy initialization is not a constant expression on a non-literal type.

This attribute can only be applied to objects with static or thread-local storage
duration.

[EricWF]

Open questions:

• What should __has_constant_initializer do for non-static inputs? Currently it returns false.
• Do I need to do more to handle value dependent inputs?
• Should expression traits SFINAE?

[EricWF]

Check the initializers of TLS_Dynamic variables since they may actually be non-dynamic.

[EricWF]

Re-flow comments because I suck at English.

[jroelofs]

lib/AST/Expr.cpp

2656 ↗

(On Diff #67635)

no need for this if.

Also, I think the for should be written:

for (auto *Arg : CE->arguments())
  if (Arg->isConstantInitializer(Ctx, false, Culprit))
    return false;

lib/Sema/SemaExprCXX.cpp

4775 ↗

(On Diff #67768)

no else after return.

Also, what do you want this to do for ParmVarDecls that happen to have an initializer? i.e:

void foo(int i = 45) {}

[jroelofs]

One more thing: need to add docs to clang/docs/LanguageExtensions.rst.

[EricWF]

include/clang/Basic/DiagnosticSemaKinds.td

6807

Help improving this wording would be appreciated.

lib/Sema/SemaExprCXX.cpp

4775 ↗

(On Diff #67768)

I believe that case should return false. i isn't static or thread local so it doesn't have a "constant initializer" according to [basic.start.static].

[EricWF]

lib/Sema/SemaExprCXX.cpp

4775 ↗

(On Diff #67768)

Perhaps using __has_constant_initializer should emit a diagnostic when used on non-static, non-thread-local objects?

[jroelofs]

include/clang/Basic/DiagnosticSemaKinds.td

6807

"expression must be a named variable", maybe?

A "counterexample" to the original wording is __has_constant_initializer(x+1).

lib/Sema/SemaExprCXX.cpp

4775 ↗

(On Diff #67768)

Maybe a warning... And you might want it to behave differently when it comes from a macro expansion. I'm not sure what the norm is for that sort of thing though.

I think the more important thing at this point is to precisely document what you want the behavior to be in the docs. Then any difference from that spec is "just a compiler bug", rather than potentially being a breaking change in behavior for someone who used your API in a way that you didn't expect.

[EricWF]

• Apply @jroelof's suggestions
• Add tests for static class members

[EricWF]

• Add documentation for __has_constant_initializer and expression traits in general.
• Make expression traits detectable using __has_extension.

[EricWF]

lib/Sema/SemaExprCXX.cpp

4775 ↗

(On Diff #67790)

I've added docs to LanguageExtensions.rst specifying the semantics I intend for the trait.

[jroelofs]

I don't think I have any more comments, but I'll let one of the other reviewers give the final go/no-go.

docs/LanguageExtensions.rst

1047 ↗

(On Diff #67790)

s/a object/an object/

(english sucks)

[rsmith]

Have you considered modelling this as an attribute on the declaration of the variable instead of as a separate check? If so, why do you prefer this approach? (If I were to suggest this for standardization, an attribute is the approach I'd probably take.)

lib/AST/Expr.cpp

2653–2662 ↗

(On Diff #67790)

This doesn't look right: just because we're calling a constexpr constructor with constant arguments doesn't imply that the initializer is constant.

[EricWF]

In D23385#513443, @rsmith wrote:

Have you considered modelling this as an attribute on the declaration of the variable instead of as a separate check? If so, why do you prefer this approach? (If I were to suggest this for standardization, an attribute is the approach I'd probably take.)

An attribute would be a much better approach! I only went this root because I figured out how to do it. If you could give me a starting point I'll change it over to an attribute.

[EricWF]

Switch to an attribute based implementation as suggested by @rsmith.

[EricWF]

• Remove test from previous implementation.

[EricWF]

lib/AST/Expr.cpp

2653–2662 ↗

(On Diff #67790)

I changed this to use VD->checkInitICE() when evaluating a constexpr constructor or if VD->isInitKnownICE(). Otherwise it falls back on isConstantInitializer()

[aaron.ballman]

include/clang/Basic/Attr.td

1384

This should not use the GCC spelling because GCC doesn't support the attribute. Do you expect this attribute to do anything useful in C? If not, this should just be a CXX11 spelling in the clang namespace.

1385

You might want to make a custom SubsetSubject for this. Check out NormalVar, SharedVar, and the likes in Attr.td. Then you can get rid of the custom handling in SemaDeclAttr.cpp.

include/clang/Basic/AttrDocs.td

835

Should be no need to specify the heading manually since there's only one spelling for the attribute.

847

s/acts an a/acts as a

include/clang/Basic/DiagnosticSemaKinds.td

6842

I would reword this to: "'require_constant_initialization' attribute only applies to variables with static or thread-local storage duration"

test/SemaCXX/attr-require-constant-initialization.cpp

2

This file should also get tests that ensure we properly diagnose the attribute when it doesn't apply to a declaration (such as a local variable, as well as nonsense like a function), test that it does not accept arguments, etc.

5–7

Does this comment actually apply?

[EricWF]

Address @aaron.ballman's review comments.

include/clang/Basic/Attr.td

1384

Are CXX11 attributes usable in C++03? If not perhaps we should provide both?

test/SemaCXX/attr-require-constant-initialization.cpp

5–7

No.

[majnemer]

lib/Sema/SemaDecl.cpp

10388–10390

You could use a lambda to abstract away the "check if it's cached, if not query" logic.

10489

Any reason not to use the already existing err_init_element_not_constant?

[rsmith]

Attributes are specified in include/clang/Basic/Attr.td with a (hopefully) fairly self-explanatory declarative syntax. You'll then need to add code to lib/Sema/SemaDeclAttr.cpp to create a corresponding attribute object and attach it to the declaration.

Two implementation approaches seem feasible: either check that the VarDecl has constant initialization at the point when the attribute is attached in SemaDeclAttr.cpp, or attach the attribute without checking and instead perform the check from Sema::CheckCompleteVariableDeclaration, around where we currently call isConstantInitializer to produce a warning on non-constant initialization -- the effect of the attribute would then be to promote that warning to an error.

[rsmith]

Sorry about the redundant previous comment, the thread got forked by the change of subject and I missed the updated patch.

lib/Sema/SemaDecl.cpp

10488–10489

I think this check is incorrect: we perform constant initialization (to zero) for globals with no initializer.

10493

Instead of diagnosing the condition separately (and getting both a warning and an error for the same situation), it would seem preferable to change this to produce either diag::warn_global_constructor or your new error depending on whether the attribute is present. This would also remove the duplicate error messages if the attribute is specified on an object that is also marked constexpr.

[EricWF]

Attempt to address Richards concerns about duplicate diagnostics and add tests for those cases.

Unfortunately the tests are failing, because there is a duplicate -Wglobal-constructors diagnostic, but I can't find where it's being emitted.

lib/Sema/SemaDecl.cpp

10488–10489

Agreed. Technically not "constant initialization" but every bit as safe.

10489

Any reason not to use the already existing err_init_element_not_constant?

I hadn't considered it, but the error text seems misleading, since it may select a constructor that's not a valid constant expression even when every element in the initializer is.

10493

Already I think I've dealt with the duplicate diagnostics.

10528

I can't figure out where the diagnostic is this comment is coming from. Hopefully I'm just missing something simple.

[EricWF]

lib/Sema/SemaDecl.cpp

10528

Nevermind, I kept reading "global destructor" as "global constructor" and was looking for the wrong thing.

[EricWF]

Get all tests passing regarding duplicate warnings between __attribute__((requires_constant_initialization)) and -Wglobal-constructors. The warning will not emit a duplicate warning about global constructors, but it will still warn if the variable has a global destructor, which make sense to me.

I believe this is ready to go and I have addressed all concerns.

[EricWF]

Fix missing semicolon.

[rsmith]

include/clang/Basic/Attr.td

1384

Providing both seems fine, but regardless this should be a GNU spelling not a GCC spelling, because GCC doesn't support the attribute.

include/clang/Basic/AttrDocs.td

836–840

This reads a bit awkwardly, since you don't actually say what the attribute does until the second sentence. Maybe fold the first two sentences together:

"This attribute specifies that the variable to which it is attached is intended to have a constant initializer according to the rules of [basic.start.static]. The variable is required to have static or thread storage duration. If the initialization of the variable is not a constant initializer, an error will be produced."

842

Static objects -> Static storage duration variables

844

static constructors -> dynamic initializers?

858

OK even though T has a non-trivial destructor? This makes the variable unsafe to use during program shutdown in the general case.

include/clang/Basic/DiagnosticSemaKinds.td

2575

thread-local -> thread, per standard terminology

6842

It may be useful for this diagnostic to say why we consider this to be an error (that is, mention that there is a require_constant_initialization attribute attached to the variable). The attribute will typically be hidden behind a (perhaps unfamiliar to the reader) macro, so it may not be obvious if we don't point it out.

lib/Sema/SemaDecl.cpp

10519–10520

Falling back to checkConstInit here will suppress the warning on some cases that are not technically constant initializers (but that Clang can emit as constants regardless). Is that what you want? If so, you should update the documentation to say that instead of saying that we only check for a constant initializer.

test/SemaCXX/attr-require-constant-initialization.cpp

8–16

Just use _Static_assert.

97–101

Did you mean for this to still be here?

[EricWF]

include/clang/Basic/AttrDocs.td

844

Changed "by other static constructors" -> "during dynamic initialization"

858

Right, but I want this attribute to be able to work with (A) the union trick for "trivial" destructors and (B) variables not used during shutdown.
I was planning on following this up with an additional feature to aid in the shutdown case as well, but I think there is value in separating the features.

Currently -Wglobal-destructors will still warn on that declaration, so at least the unsafe shutdown is not silently missed.

Does this behavior make sense to you?

include/clang/Basic/DiagnosticSemaKinds.td

6842

"variable does not have a constant initializer as required by 'require_constant_initializer' attribute"?

Or do we want the diagnostic to point to the attribute token in a "required from here"-like note?

lib/Sema/SemaDecl.cpp

10519–10520

Falling back to checkConstInit here will suppress the warning on some cases that are not technically constant initializers (but that Clang can emit as constants regardless). Is that what you want?

Not really. I would prefer this strictly conform to the standard so it can be used to portably detect possible dynamic initializers on other toolchains.

What would the correct fallback here be?

test/SemaCXX/attr-require-constant-initialization.cpp

97–101

No.

[EricWF]

Address most of @rsmiths review comments.

[rsmith]

include/clang/Basic/AttrDocs.td

858

Sure, if that's a conscious design decision for the attribute.

include/clang/Basic/DiagnosticSemaKinds.td

6842

A separate note pointed at the attribute would make it clearer how the attribute got involved (especially via the macro expansion backtrace).

lib/Sema/SemaDecl.cpp

10519–10520

In C++11 onwards, checkInitIsICE is the right thing to use in all cases. In C++98, checkInitIsICE is appropriate for globals of integral type; we do not have an implementation of strict constant expression checking for other types. Perhaps just documenting that (and maybe adding a FIXME here) is the best you can do for now, assuming you're not interested in implementing the C++98 rules.

[EricWF]

lib/Sema/SemaDecl.cpp

10519–10520

SGTM. I think I'll fall back to isConstantInitializer() in C++03. Do you have an example of what checkConstantInitializer() gets wrong in C++03?

[rsmith]

lib/Sema/SemaDecl.cpp

10519–10520

struct A {
  ~A();
  int n;
} a;
int *p = &a.n; // constant initializer, but not a C++98 address constant expression

[EricWF]

Do strict 'constant initializer' checking in C++11, but fall back to isConstantInitializer() in C++03. Add documentation about non-strict C++03 checking.

This has weird results for example:

struct PODType { int x; int y; };
__attribute__((require_constant_initialization)) PODType pod; // error in C++11, OK in C++03.

[aaron.ballman]

include/clang/Basic/AttrDocs.td

836

I don't think I ever heard whether this attribute was usable in C or not. I suspect it's not particularly needed in C. If that's true, we should state that in the documentation, and consider making the attribute a C++-only attribute?

test/SemaCXX/attr-require-constant-initialization.cpp

1

Can you run this file through clang-format?

7–9

This doesn't appear to be needed by the test.

11

Hah, I've not seen 0+ before in a verify comment, that's a neat trick!

[EricWF]

include/clang/Basic/AttrDocs.td

836

I think it would be somewhat useful in C. In particular if you have globals initialized from values you don't own. Example:

#include <y.h>
ATTR int x = y; // Will diagnose if  becomes 'y' is a non-constant expression.

However the current implementation only handles C++ and I'm satisfied with that. I'll mark the attribute as C++ only and document that change.

[EricWF]

Address all comments except making the attribute C++ only.

[EricWF]

Make the attribute C++ only.

[EricWF]

utils/TableGen/ClangAttrEmitter.cpp

2794 ↗

(On Diff #69775)

This is needed so that the COnly and CPlusPlus entries in Attr.td don't create the same function name.

[rsmith]

include/clang/Basic/AttrDocs.td

836

For the record, in C the program is ill-formed if the initializer for a global is non-constant, so it doesn't seem like this attribute would ever be useful.

[EricWF]

include/clang/Basic/AttrDocs.td

836

Ah I didn't know that!

[EricWF]

Are there any remaining issues with this patch?

[aaron.ballman]

LGTM!

[EricWF]

Updating against recent ToT.

include/clang/Basic/Attr.td

 def ReqdWorkGroupSize : InheritableAttr {
   let Spellings = [GNU<"reqd_work_group_size">];
   let Args = [UnsignedArgument<"XDim">, UnsignedArgument<"YDim">,
               UnsignedArgument<"ZDim">];
   let Subjects = SubjectList<[Function], ErrorDiag>;
   let Documentation = [Undocumented];
 }
 
+def RequireConstantInit : InheritableAttr {
+  let Spellings = [GNU<"require_constant_initialization">,
+                   CXX11<"clang", "require_constant_initialization">];
+  let Subjects = SubjectList<[GlobalVar], ErrorDiag,
+                              "ExpectedStaticOrTLSVar">;
+  let Documentation = [RequireConstantInitDocs];
+}
+
 def WorkGroupSizeHint :  InheritableAttr {
   let Spellings = [GNU<"work_group_size_hint">];
   let Args = [UnsignedArgument<"XDim">, 
               UnsignedArgument<"YDim">,
               UnsignedArgument<"ZDim">];
   let Subjects = SubjectList<[Function], ErrorDiag>;
   let Documentation = [Undocumented];
 }

include/clang/Basic/AttrDocs.td

.. code-block:: objc
 
   @interface B : A
   - (id)method __attribute__((availability(macos,introduced=10.3))); // okay: method moved into base class later
   - (id)method __attribute__((availability(macos,introduced=10.5))); // error: this method was available via the base class in 10.4
   @end
   }];
 }
 
+
+def RequireConstantInitDocs : Documentation {
+  let Category = DocCatVariable;
+  let Content = [{
+This attribute specifies that the variable to which it is attached is intended
+to have a `constant initializer <http://en.cppreference.com/w/cpp/language/constant_initialization>`_
+according to the rules of [basic.start.static]. The variable is required to
+have static or thread storage duration. If the initialization of the variable
+is not a constant initializer, an error will be produced.
+
+Note that in C++03 strict constant expression checking is not done. Instead
+the attribute reports if Clang can emit the the variable as a constant, even
+if it's not technically a 'constant initializer'. This behavior is non-portable.
+
+Static storage duration variables with constant initializers avoid hard-to-find
+bugs caused by the indeterminate order of dynamic initialization. They can also
+be safely used during dynamic initialization across translation units.
+
+This attribute acts as a compile time assertion that the requirements
+for constant initialization have been met. Since these requirements change
+between dialects and have subtle pitfalls it's important to fail fast instead
+of silently falling back on dynamic initialization.
+
+.. code-block:: c++
+  // -std=c++14
+  #define SAFE_STATIC __attribute__((require_constant_initialization)) static
+  struct T {
+    constexpr T(int) {}
+    ~T(); // non-trivial
+  };
+  SAFE_STATIC T x = {42}; // Initialization OK. Doesn't check destructor.
+  SAFE_STATIC T y = 42; // error: variable does not have a constant initializer
+  // copy initialization is not a constant expression on a non-literal type.
+  }];
+}
+
 def WarnMaybeUnusedDocs : Documentation {
   let Category = DocCatVariable;
   let Heading = "maybe_unused, unused, gnu::unused";
   let Content = [{
 When passing the ``-Wunused`` flag to Clang, entities that are unused by the
 program may be diagnosed. The ``[[maybe_unused]]`` (or
 ``__attribute__((unused))``) attribute can be used to silence such diagnostics
 when the entity cannot be removed. For instance, a local variable may exist

 generated when a function or its return type is marked with ``[[nodiscard]]``
 (or ``__attribute__((warn_unused_result))``) and the function call appears as a
 potentially-evaluated discarded-value expression that is not explicitly cast to
 `void`.
 
 .. code-block: c++
   struct [[nodiscard]] error_info { /*...*/ };
   error_info enable_missile_safety_mode();
-  
   void launch_missiles();
   void test_missiles() {
     enable_missile_safety_mode(); // diagnoses
     launch_missiles();
   }
   error_info &foo();
   void f() { foo(); } // Does not diagnose, error_info is a reference.  
   }];

include/clang/Basic/DiagnosticSemaKinds.td

   "functions, methods, and parameters|classes|enums|variables|methods|"
   "fields and global variables|structs|parameters and typedefs|variables and typedefs|"
   "thread-local variables|variables and fields|variables, data members and tag types|"
   "types and namespaces|Objective-C interfaces|methods and properties|"
   "struct or union|struct, union or class|types|"
   "Objective-C instance methods|init methods of interface or class extension declarations|"
   "variables, functions and classes|"
   "functions, variables, classes, and Objective-C interfaces|"
-  "Objective-C protocols|"
+  "Objective-C protocols|variables with static or thread storage duration|"
   "functions and global variables|structs, unions, and typedefs|structs and typedefs|"
   "interface or protocol declarations|kernel functions|non-K&R-style functions|"
   "variables, enums, fields and typedefs|functions, methods, enums, and classes|"
   "structs, classes, variables, functions, and inline namespaces|"
   "variables, functions, methods, types, enumerations, enumerators, labels, and non-static data members}1">,
   InGroup<IgnoredAttributes>;
 def err_attribute_wrong_decl_type : Error<warn_attribute_wrong_decl_type.Text>;
 def warn_type_attribute_wrong_type : Warning<

 def err_typecheck_choose_expr_requires_constant : Error<
   "'__builtin_choose_expr' requires a constant expression">;
 def warn_unused_expr : Warning<"expression result unused">,
   InGroup<UnusedValue>;
 def warn_unused_voidptr : Warning<
   "expression result unused; should this cast be to 'void'?">,
   InGroup<UnusedValue>;
 def warn_unused_property_expr : Warning<
  "property access result unused - getters should not be used for side effects">,
   InGroup<UnusedGetterReturnValue>;
 def warn_unused_container_subscript_expr : Warning<
  "container access result unused - container access should not be used for side effects">,
   InGroup<UnusedValue>;
 def warn_unused_call : Warning<
   "ignoring return value of function declared with %0 attribute">,
   InGroup<UnusedValue>;
 def warn_side_effects_unevaluated_context : Warning<

 def warn_unused_comparison : Warning<
   "%select{%select{|in}1equality|relational}0 comparison result unused">,
   InGroup<UnusedComparison>;
 def note_inequality_comparison_to_or_assign : Note<
   "use '|=' to turn this inequality comparison into an or-assignment">;
 
 def err_incomplete_type_used_in_type_trait_expr : Error<
   "incomplete type %0 used in type trait expression">;
-  
+def err_require_constant_init_failed : Error<
+  "variable does not have a constant initializer">;
+def note_declared_required_constant_init_here : Note<
+  "required by 'require_constant_initializer' attribute here">;
+
 def err_dimension_expr_not_constant_integer : Error<
   "dimension expression does not evaluate to a constant unsigned int">;
 
 def err_typecheck_cond_incompatible_operands_null : Error<
   "non-pointer operand type %0 incompatible with %select{NULL|nullptr}1">;
 def ext_empty_struct_union : Extension<
   "empty %select{struct|union}0 is a GNU extension">, InGroup<GNUEmptyStruct>;
 def ext_no_named_members_in_struct_union : Extension<

include/clang/Sema/AttributeList.h

enum AttributeDeclKind {
   ExpectedStructOrUnion,
   ExpectedStructOrUnionOrClass,
   ExpectedType,
   ExpectedObjCInstanceMethod,
   ExpectedObjCInterfaceDeclInitMethod,
   ExpectedFunctionVariableOrClass,
   ExpectedFunctionVariableClassOrObjCInterface,
   ExpectedObjectiveCProtocol,
+  ExpectedStaticOrTLSVar,
   ExpectedFunctionGlobalVarMethodOrProperty,
   ExpectedStructOrUnionOrTypedef,
   ExpectedStructOrTypedef,
   ExpectedObjectiveCInterfaceOrProtocol,
   ExpectedKernelFunction,
   ExpectedFunctionWithProtoType,
   ExpectedVariableEnumFieldOrTypedef,
   ExpectedFunctionMethodEnumOrClass,
   ExpectedStructClassVariableFunctionOrInlineNamespace,
   ExpectedForMaybeUnused
 };
 
 }  // end namespace clang
 
 #endif

lib/Sema/SemaDecl.cpp

     VarDecl *prev = var->getPreviousDecl();
     while (prev && prev->isThisDeclarationADefinition())
       prev = prev->getPreviousDecl();
 
     if (!prev)
       Diag(var->getLocation(), diag::warn_missing_variable_declarations) << var;
   }
 
+  // Cache the result of checking for constant initialization.
+  Optional<bool> CacheHasConstInit;
+  const Expr *CacheCulprit;
+  auto checkConstInit = [&]() mutable {
+    if (!CacheHasConstInit)
+      CacheHasConstInit = var->getInit()->isConstantInitializer(
+            Context, var->getType()->isReferenceType(), &CacheCulprit);
+    return *CacheHasConstInit;
+  };
+
   if (var->getTLSKind() == VarDecl::TLS_Static) {
-    const Expr *Culprit;
     if (var->getType().isDestructedType()) {
       // GNU C++98 edits for __thread, [basic.start.term]p3:
       //   The type of an object with thread storage duration shall not
       //   have a non-trivial destructor.
       Diag(var->getLocation(), diag::err_thread_nontrivial_dtor);
       if (getLangOpts().CPlusPlus11)
         Diag(var->getLocation(), diag::note_use_thread_local);
-    } else if (getLangOpts().CPlusPlus && var->hasInit() &&
-               !var->getInit()->isConstantInitializer(
-                   Context, var->getType()->isReferenceType(), &Culprit)) {
-      // GNU C++98 edits for __thread, [basic.start.init]p4:
-      //   An object of thread storage duration shall not require dynamic
-      //   initialization.
-      // FIXME: Need strict checking here.
-      Diag(Culprit->getExprLoc(), diag::err_thread_dynamic_init)
-        << Culprit->getSourceRange();
-      if (getLangOpts().CPlusPlus11)
-        Diag(var->getLocation(), diag::note_use_thread_local);
+    } else if (getLangOpts().CPlusPlus && var->hasInit()) {
+      if (!checkConstInit()) {
+        // GNU C++98 edits for __thread, [basic.start.init]p4:
+        //   An object of thread storage duration shall not require dynamic
+        //   initialization.
+        // FIXME: Need strict checking here.
+        Diag(CacheCulprit->getExprLoc(), diag::err_thread_dynamic_init)
+          << CacheCulprit->getSourceRange();
+        if (getLangOpts().CPlusPlus11)
+          Diag(var->getLocation(), diag::note_use_thread_local);
+      }
     }
   }
 
   // Apply section attributes and pragmas to global variables.
   bool GlobalStorage = var->hasGlobalStorage();
   if (GlobalStorage && var->isThisDeclarationADefinition() &&
       ActiveTemplateInstantiations.empty()) {
     PragmaStack<StringLiteral *> *Stack = nullptr;

       }
     }
   }
 
   Expr *Init = var->getInit();
   bool IsGlobal = GlobalStorage && !var->isStaticLocal();
   QualType baseType = Context.getBaseElementType(type);
 
   if (!var->getDeclContext()->isDependentContext() &&
       Init && !Init->isValueDependent()) {
-    if (IsGlobal && !var->isConstexpr() &&
-        !getDiagnostics().isIgnored(diag::warn_global_constructor,
-                                    var->getLocation())) {
-      // Warn about globals which don't have a constant initializer.  Don't
-      // warn about globals with a non-trivial destructor because we already
-      // warned about them.
-      CXXRecordDecl *RD = baseType->getAsCXXRecordDecl();
-      if (!(RD && !RD->hasTrivialDestructor()) &&
-          !Init->isConstantInitializer(Context, baseType->isReferenceType()))
-        Diag(var->getLocation(), diag::warn_global_constructor)
-          << Init->getSourceRange();
-    }
 
     if (var->isConstexpr()) {
       SmallVector<PartialDiagnosticAt, 8> Notes;
       if (!var->evaluateValue(Notes) || !var->isInitICE()) {
         SourceLocation DiagLoc = var->getLocation();
         // If the note doesn't add any useful information other than a source
         // location, fold it into the primary diagnostic.
         if (Notes.size() == 1 && Notes[0].second.getDiagID() ==
               diag::note_invalid_subexpr_in_const_expr) {
           DiagLoc = Notes[0].first;
           Notes.clear();
         }
         Diag(DiagLoc, diag::err_constexpr_var_requires_const_init)
           << var << Init->getSourceRange();
         for (unsigned I = 0, N = Notes.size(); I != N; ++I)
           Diag(Notes[I].first, Notes[I].second);
       }
     } else if (var->isUsableInConstantExpressions(Context)) {
       // Check whether the initializer of a const variable of integral or
       // enumeration type is an ICE now, since we can't tell whether it was
       // initialized by a constant expression if we check later.
       var->checkInitIsICE();
     }
+
+    // Don't emit further diagnostics about constexpr globals since they
+    // were just diagnosed.
+    if (!var->isConstexpr() && GlobalStorage &&
+            var->hasAttr<RequireConstantInitAttr>()) {
+      // FIXME: Need strict checking in C++03 here.
+      bool DiagErr = getLangOpts().CPlusPlus11
+          ? !var->checkInitIsICE() : !checkConstInit();
+      if (DiagErr) {
+        auto attr = var->getAttr<RequireConstantInitAttr>();
+        Diag(var->getLocation(), diag::err_require_constant_init_failed)
+          << Init->getSourceRange();
+        Diag(attr->getLocation(), diag::note_declared_required_constant_init_here)
+          << attr->getRange();
+      }
+    }
+    else if (!var->isConstexpr() && IsGlobal &&
+             !getDiagnostics().isIgnored(diag::warn_global_constructor,
+                                    var->getLocation())) {
+      // Warn about globals which don't have a constant initializer.  Don't
+      // warn about globals with a non-trivial destructor because we already
+      // warned about them.
+      CXXRecordDecl *RD = baseType->getAsCXXRecordDecl();
+      if (!(RD && !RD->hasTrivialDestructor())) {
+        if (!checkConstInit())
+          Diag(var->getLocation(), diag::warn_global_constructor)
+            << Init->getSourceRange();
+      }
+    }
   }
 
   // Require the destructor.
   if (const RecordType *recordType = baseType->getAs<RecordType>())
     FinalizeVarWithDestructor(var, recordType);
 
   // If this variable must be emitted, add it as an initializer for the current
   // module.

lib/Sema/SemaDeclAttr.cpp

     handleWorkGroupSize<WorkGroupSizeHintAttr>(S, D, Attr);
     break;
   case AttributeList::AT_ReqdWorkGroupSize:
     handleWorkGroupSize<ReqdWorkGroupSizeAttr>(S, D, Attr);
     break;
   case AttributeList::AT_VecTypeHint:
     handleVecTypeHint(S, D, Attr);
     break;
+  case AttributeList::AT_RequireConstantInit:
+    handleSimpleAttribute<RequireConstantInitAttr>(S, D, Attr);
+    break;
   case AttributeList::AT_InitPriority:
     handleInitPriorityAttr(S, D, Attr);
     break;
   case AttributeList::AT_Packed:
     handlePackedAttr(S, D, Attr);
     break;
   case AttributeList::AT_Section:
     handleSectionAttr(S, D, Attr);

test/SemaCXX/attr-require-constant-initialization.cpp

+// RUN: %clang_cc1 -fsyntax-only -verify -fcxx-exceptions -DTEST_ONE -std=c++03 %s
+// RUN: %clang_cc1 -fsyntax-only -verify -fcxx-exceptions -DTEST_ONE -std=c++11 %s
+// RUN: %clang_cc1 -fsyntax-only -verify -fcxx-exceptions -DTEST_ONE -std=c++14 %s
+// RUN: %clang_cc1 -fsyntax-only -verify -fcxx-exceptions -DTEST_TWO \
+// RUN: -Wglobal-constructors -std=c++14 %s
+
+#if !__has_feature(cxx_static_assert)
+#define static_assert(b_, m_) _Static_assert(b_, m_)
+#endif
+
+#define ATTR __attribute__((require_constant_initialization)) // expected-note 0+ {{expanded from macro}}
+
+// Test diagnostics when attribute is applied to non-static declarations.
+void test_func_local(ATTR int param) { // expected-error {{only applies to variables with static or thread}}
+    ATTR int x = 42; // expected-error {{only applies to variables with static or thread}}
+    ATTR extern int y;
+}
+struct ATTR class_mem { // expected-error {{only applies to variables with static or thread}}
+  ATTR int x; // expected-error {{only applies to variables with static or thread}}
+};
+
+int ReturnInt();
+
+struct PODType {
+    int value;
+    int value2;
+};
+#if __cplusplus >= 201103L
+struct LitType {
+    constexpr LitType() : value(0) {}
+    constexpr LitType(int x) : value(x) {}
+    LitType(void*) : value(-1) {}
+    int value;
+};
+#endif
+
+struct NonLit {
+#if __cplusplus >= 201402L
+    constexpr NonLit() : value(0) {}
+    constexpr NonLit(int x ) : value(x) {}
+#else
+    NonLit() : value(0) {}
+    NonLit(int x) : value(x) {}
+#endif
+    NonLit(void*) : value(-1) {}
+    ~NonLit() {}
+    int value;
+};
+
+struct StoresNonLit {
+#if __cplusplus >= 201402L
+    constexpr StoresNonLit() : obj() {}
+    constexpr StoresNonLit(int x) : obj(x) {}
+#else
+    StoresNonLit() : obj() {}
+    StoresNonLit(int x) : obj(x) {}
+#endif
+    StoresNonLit(void* p) : obj(p) {}
+    NonLit obj;
+};
+
+const bool NonLitHasConstInit =
+#if __cplusplus >= 201402L
+    true;
+#else
+    false;
+#endif
+
+#if defined(TEST_ONE) // Test semantics of attribute
+
+// [basic.start.static]p2.1
+// if each full-expression (including implicit conversions) that appears in
+// the initializer of a reference with static or thread storage duration is
+// a constant expression (5.20) and the reference is bound to a glvalue
+// designating an object with static storage duration, to a temporary object
+// (see 12.2) or subobject thereof, or to a function;
+
+// Test binding to a static glvalue
+const int glvalue_int = 42;
+const int glvalue_int2 = ReturnInt();
+ATTR const int& glvalue_ref ATTR = glvalue_int;
+ATTR const int& glvalue_ref2 ATTR = glvalue_int2;
+ATTR __thread const int& glvalue_ref_tl = glvalue_int;
+
+void test_basic_start_static_2_1() {
+    const int non_global = 42;
+    ATTR static const int& local_init = non_global; // expected-error {{variable does not have a constant initializer}}
+    // expected-note@-1 {{required by 'require_constant_initializer' attribute here}}
+    ATTR static const int& global_init = glvalue_int;
+    ATTR static const int& temp_init = 42;
+}
+
+ATTR const int& temp_ref = 42;
+ATTR const int& temp_ref2 = ReturnInt(); // expected-error {{variable does not have a constant initializer}}
+// expected-note@-1 {{required by 'require_constant_initializer' attribute here}}
+ATTR const NonLit& nl_temp_ref = 42; // expected-error {{variable does not have a constant initializer}}
+// expected-note@-1 {{required by 'require_constant_initializer' attribute here}}
+
+#if __cplusplus >= 201103L
+ATTR const LitType& lit_temp_ref = 42;
+ATTR const int& subobj_ref = LitType{}.value;
+#endif
+
+ATTR const int& nl_subobj_ref = NonLit().value;  // expected-error {{variable does not have a constant initializer}}
+// expected-note@-1 {{required by 'require_constant_initializer' attribute here}}
+
+struct TT1 {
+  ATTR static const int& no_init;
+  ATTR static const int& glvalue_init;
+  ATTR static const int& temp_init;
+  ATTR static const int& subobj_init;
+#if __cplusplus >= 201103L
+  ATTR static thread_local const int& tl_glvalue_init;
+  ATTR static thread_local const int& tl_temp_init; // expected-note {{required by 'require_constant_initializer' attribute here}}
+#endif
+};
+const int& TT1::glvalue_init = glvalue_int;
+const int& TT1::temp_init = 42;
+const int& TT1::subobj_init = PODType().value;
+#if __cplusplus >= 201103L
+thread_local const int& TT1::tl_glvalue_init = glvalue_int;
+thread_local const int& TT1::tl_temp_init = 42; // expected-error {{variable does not have a constant initializer}}
+#endif
+
+// [basic.start.static]p2.2
+// if an object with static or thread storage duration is initialized by a
+// constructor call, and if the initialization full-expression is a constant
+// initializer for the object;
+
+void test_basic_start_static_2_2()
+{
+#if __cplusplus < 201103L
+    ATTR static PODType pod;
+#else
+    ATTR static PODType pod; // expected-error {{variable does not have a constant initializer}}
+    // expected-note@-1 {{required by 'require_constant_initializer' attribute here}}
+#endif
+    ATTR static PODType pot2 = {ReturnInt()}; // expected-error {{variable does not have a constant initializer}}
+    // expected-note@-1 {{required by 'require_constant_initializer' attribute here}}
+
+#if __cplusplus >= 201103L
+    constexpr LitType l;
+    ATTR static LitType static_lit = l;
+    ATTR static LitType static_lit2 = (void*)0; // expected-error {{variable does not have a constant initializer}}
+    // expected-note@-1 {{required by 'require_constant_initializer' attribute here}}
+    ATTR static LitType static_lit3 = ReturnInt(); // expected-error {{variable does not have a constant initializer}}
+    // expected-note@-1 {{required by 'require_constant_initializer' attribute here}}
+    ATTR thread_local LitType tls = 42;
+#endif
+}
+
+struct TT2 {
+  ATTR static PODType pod_noinit;
+#if __cplusplus >= 201103L
+    // expected-note@-2 {{required by 'require_constant_initializer' attribute here}}
+#endif
+  ATTR static PODType pod_copy_init; // expected-note {{required by 'require_constant_initializer' attribute here}}
+#if __cplusplus >= 201402L
+  ATTR static constexpr LitType lit = {};
+  ATTR static const NonLit non_lit;
+  ATTR static const NonLit non_lit_list_init;
+  ATTR static const NonLit non_lit_copy_init; // expected-note {{required by 'require_constant_initializer' attribute here}}
+#endif
+
+};
+PODType TT2::pod_noinit;
+#if __cplusplus >= 201103L
+ // expected-error@-2 {{variable does not have a constant initializer}}
+#endif
+PODType TT2::pod_copy_init(TT2::pod_noinit); // expected-error {{variable does not have a constant initializer}}
+#if __cplusplus >= 201402L
+const NonLit TT2::non_lit(42);
+const NonLit TT2::non_lit_list_init = {42};
+const NonLit TT2::non_lit_copy_init = 42; // expected-error {{variable does not have a constant initializer}}
+#endif
+
+#if __cplusplus >= 201103L
+ATTR LitType lit_ctor;
+ATTR LitType lit_ctor2{};
+ATTR LitType lit_ctor3 = {};
+ATTR __thread LitType lit_ctor_tl = {};
+
+#if __cplusplus >= 201402L
+ATTR NonLit nl_ctor;
+ATTR NonLit nl_ctor2{};
+ATTR NonLit nl_ctor3 = {};
+ATTR thread_local NonLit nl_ctor_tl = {};
+ATTR StoresNonLit snl;
+#else
+ATTR NonLit nl_ctor; // expected-error {{variable does not have a constant initializer}}
+// expected-note@-1 {{required by 'require_constant_initializer' attribute here}}
+ATTR NonLit nl_ctor2{}; // expected-error {{variable does not have a constant initializer}}
+// expected-note@-1 {{required by 'require_constant_initializer' attribute here}}
+ATTR NonLit nl_ctor3 = {}; // expected-error {{variable does not have a constant initializer}}
+// expected-note@-1 {{required by 'require_constant_initializer' attribute here}}
+ATTR thread_local NonLit nl_ctor_tl = {}; // expected-error {{variable does not have a constant initializer}}
+// expected-note@-1 {{required by 'require_constant_initializer' attribute here}}
+ATTR StoresNonLit snl; // expected-error {{variable does not have a constant initializer}}
+// expected-note@-1 {{required by 'require_constant_initializer' attribute here}}
+#endif
+
+// Non-literal types cannot appear in the initializer of a non-literal type.
+ATTR int nl_in_init = NonLit{42}.value; // expected-error {{variable does not have a constant initializer}}
+// expected-note@-1 {{required by 'require_constant_initializer' attribute here}}
+ATTR int lit_in_init = LitType{42}.value;
+#endif
+
+// [basic.start.static]p2.3
+// if an object with static or thread storage duration is not initialized by a
+// constructor call and if either the object is value-initialized or every
+// full-expression that appears in its initializer is a constant expression.
+void test_basic_start_static_2_3()
+{
+    ATTR static int static_local = 42;
+    ATTR static int static_local2; // zero-initialization takes place
+#if __cplusplus >= 201103L
+    ATTR thread_local int tl_local = 42;
+#endif
+}
+
+ATTR int no_init; // zero initialization takes place
+ATTR int arg_init = 42;
+ATTR PODType pod_init = {};
+ATTR PODType pod_missing_init = {42 /* should have second arg */};
+ATTR PODType pod_full_init = {1, 2};
+ATTR PODType pod_non_constexpr_init = {1, ReturnInt()}; // expected-error {{variable does not have a constant initializer}}
+// expected-note@-1 {{required by 'require_constant_initializer' attribute here}}
+
+#if __cplusplus >= 201103L
+ATTR int val_init{};
+ATTR int brace_init = {};
+#endif
+
+ATTR __thread int tl_init = 0;
+typedef const char* StrType;
+
+#if __cplusplus >= 201103L
+
+// Test that the validity of the selected constructor is checked, not just the
+// initializer
+struct NotC { constexpr NotC(void*) {} NotC(int) {} };
+template <class T>
+struct TestCtor {
+  constexpr TestCtor(int x) : value(x) {}
+  T value;
+};
+ATTR TestCtor<NotC> t(42); // expected-error {{variable does not have a constant initializer}}
+// expected-note@-1 {{required by 'require_constant_initializer' attribute here}}
+#endif
+
+// Test various array types
+ATTR const char* foo[] = { "abc", "def" };
+ATTR PODType bar[] = {{}, {123, 456}};
+
+#elif defined(TEST_TWO) // Test for duplicate warnings
+struct NotC {
+  constexpr NotC(void*) {}
+  NotC(int) {} // expected-note 2 {{declared here}}
+};
+template <class T>
+struct TestCtor {
+  constexpr TestCtor(int x) : value(x) {} // expected-note 2 {{non-constexpr constructor}}
+  T value;
+};
+
+ATTR LitType non_const_lit(nullptr); // expected-error {{variable does not have a constant initializer}}
+// expected-note@-1 {{required by 'require_constant_initializer' attribute here}}
+ATTR NonLit non_const(nullptr); // expected-error {{variable does not have a constant initializer}}
+// expected-warning@-1 {{declaration requires a global destructor}}
+// expected-note@-2 {{required by 'require_constant_initializer' attribute here}}
+LitType const_init_lit(nullptr); // expected-warning {{declaration requires a global constructor}}
+NonLit const_init{42}; // expected-warning {{declaration requires a global destructor}}
+constexpr TestCtor<NotC> inval_constexpr(42); // expected-error {{must be initialized by a constant expression}}
+// expected-note@-1 {{in call to 'TestCtor(42)'}}
+ATTR constexpr TestCtor<NotC> inval_constexpr2(42); // expected-error {{must be initialized by a constant expression}}
+// expected-note@-1 {{in call to 'TestCtor(42)'}}
+
+#else
+#error No test case specified
+#endif // defined(TEST_N)