[nonnull] Teach Clang to attach the nonnull LLVM attribute to declarations and calls instead of just definitions, and then teach it to *not* attach such attributes even if the source code contains them.

[chandlerc]

Summary

This follows the design direction discussed on cfe-dev here:
http://lists.llvm.org/pipermail/cfe-dev/2017-January/052066.html

The idea is that for C standard library builtins, even if the library
vendor chooses to annotate their routines with attribute((nonnull)),
we will ignore those attributes which pertain to pointer arguments that
have an associated size. This allows the widespread (and seemingly
reasonable) pattern of calling these routines with a null pointer and
a zero size. I have only done this for the library builtins currently
recognized by Clang, but we can now trivially add to this set. This will
be controllable with -fno-builtin if anyone should care to do so.

Note that this does *not* change the AST. As a consequence, warnings,
static analysis, and source code rewriting are not impacted.

This isn't even a regression on any platform as neither Clang nor LLVM
have ever put 'nonnull' onto these arguments for declarations. All this
patch does is enable it on other declarations while preventing us from
ever accidentally enabling it on these libc functions due to a library
vendor.

[ahatanak]

Are users allowed to call these routines with a null pointer and a non-zero size? Or can we assume that if the size is known to be non-zero at compile time, the pointers are not null?

I'm thinking we might miss optimization opportunities if it's not possible to mark the pointer parameters as nonnull.

[chandlerc]

In D30806#697372, @ahatanak wrote:

Are users allowed to call these routines with a null pointer and a non-zero size? Or can we assume that if the size is known to be non-zero at compile time, the pointers are not null?

If the sizes are non-zero, all of these will access memory through the pointer.

But we don't currently have any way of easily expressing this in the IR. We could try something fancy like call-side attributes when the size is known, but it is pretty redundant -- we could just teach the same things that look at the attributes to know that these are reads or writes of a constant size...

I'm thinking we might miss optimization opportunities if it's not possible to mark the pointer parameters as nonnull.

Note that currently, *nothing marks these parameters as nonnull*. So in all the years that folks have used Clang and LLVM with libc headers that have an attribute((nonnull)), no one has found a performance problem with this as the root cause and fixed it.

To me, this indicates that this isn't that important of an optimization *for these libc routines*.

If someone ever comes up with a testcase where this is important thing for performance, I think we can cross the bridge of finding a fancier way to analyze things then.

[majnemer]

lib/AST/ASTContext.cpp

8786

1U to avoid overflow UB?

lib/CodeGen/CGCall.cpp

2082

Ditto.

[chandlerc]

lib/AST/ASTContext.cpp

8786

I'd mildly prefer an assert (or rely on UBSan) that it *doesn't* overflow.

Also note that this is the same pattern we use just a few lines down for the ICE argument bitmask -- we have a pretty baked in assumption that all the builtins here don't have more than 31 arguments.

Anyways, happy to make whatever change you would prefer here. I just copied the code below, I don't have any strong opinion here.

lib/CodeGen/CGCall.cpp

2082

See above, I'll keep these in sync.

However, this exposes a related bug: we shouldn't be even doing this bit test if the function isn't a builtin. I'll add a check for that. That seems cleaner than relying on the bittest itself failing.

[chandlerc]

Update to fix subtle bugs in handling arguments. Thanks to David for the review
comments that caused me to see the issue here.

[chandlerc]

Ping?

[hfinkel]

include/clang/AST/ASTContext.h

1865

Please add some description of the new parameters.

1868

It seems like you had to touch more code than necessary because you decided to add these parameters before IntegerConstantArgs. Why don't you add them afterward instead?

[chandlerc]

include/clang/AST/ASTContext.h

1868

It seemed more natural.... But I'm happy to change the order. I'm not worreid about how much code I have to touch, I'd rather just get the options in the right place. What order would you suggest?

[hfinkel]

include/clang/AST/ASTContext.h

1868

I suggest the other order because it is more common to want the IntegerConstantArgs than the nonnull args (which essentially only one caller wants).

[chandlerc]

Function argument order fixed.

[chandlerc]

Update with fixes suggested in review.

[hfinkel]

LGTM

[xbolva00]

Coming from D50039. This patch was accepted but never merged?

[efriedma]

This was merged in https://reviews.llvm.org/rC298491 .

[spatel]

In D30806#1248575, @efriedma wrote:

This was merged in https://reviews.llvm.org/rC298491 .

But it got reverted soon after due to miscompiles:
https://reviews.llvm.org/rL298695

And the functionality hasn't been reimplemented AFAICT.

include/clang/AST/ASTContext.h

enum GetBuiltinTypeError {
     GE_Missing_setjmp,    ///< Missing a type from <setjmp.h>
     GE_Missing_ucontext   ///< Missing a type from <ucontext.h>
   };
 
   /// \brief Return the type for the specified builtin.
   ///
   /// If \p IntegerConstantArgs is non-null, it is filled in with a bitmask of
   /// arguments to the builtin that are required to be integer constant
   /// expressions.
   QualType GetBuiltinType(unsigned ID, GetBuiltinTypeError &Error,
+                          bool *OverrideNonnullReturn = nullptr,
+                          unsigned *OverrideNonnullArgs = nullptr,
                           unsigned *IntegerConstantArgs = nullptr) const;
 
 private:
   CanQualType getFromTargetType(unsigned Type) const;
   TypeInfo getTypeInfoImpl(const Type *T) const;
 
   //===--------------------------------------------------------------------===//
   //                         Type Predicates.

include/clang/Basic/Builtins.def

 // Types may be prefixed with the following modifiers:
 //  L   -> long (e.g. Li for 'long int')
 //  LL  -> long long
 //  LLL -> __int128_t (e.g. LLLi)
 //  W   -> int64_t
 //  S   -> signed
 //  U   -> unsigned
 //  I   -> Required to constant fold to an integer constant expression.
+//  N   -> Do not assume non-null for optimizations even if attributed nonnull.
+//         This can be used when a relevant standard requires arguments or
+//         returns to be non-null and they are attributed accordingly but in
+//         practice are not used in this way. This typically used when a size
+//         parameter is also provided and when zero it would be reasonable to
+//         give an invalid pointer.
 //
 // Types may be postfixed with the following modifiers:
 // * -> pointer (optionally followed by an address space number, if no address
 //               space is specified than any address space will be accepted)
 // & -> reference (optionally followed by an address space number)
 // C -> const
 // D -> volatile
 

 // C99 stdlib.h
 LIBBUILTIN(abort, "v",            "fr",    "stdlib.h", ALL_LANGUAGES)
 LIBBUILTIN(calloc, "v*zz",        "f",     "stdlib.h", ALL_LANGUAGES)
 LIBBUILTIN(exit, "vi",            "fr",    "stdlib.h", ALL_LANGUAGES)
 LIBBUILTIN(_Exit, "vi",           "fr",    "stdlib.h", ALL_LANGUAGES)
 LIBBUILTIN(malloc, "v*z",         "f",     "stdlib.h", ALL_LANGUAGES)
 LIBBUILTIN(realloc, "v*v*z",      "f",     "stdlib.h", ALL_LANGUAGES)
 // C99 string.h
-LIBBUILTIN(memcpy, "v*v*vC*z",    "f",     "string.h", ALL_LANGUAGES)
-LIBBUILTIN(memcmp, "ivC*vC*z",    "f",     "string.h", ALL_LANGUAGES)
-LIBBUILTIN(memmove, "v*v*vC*z",   "f",     "string.h", ALL_LANGUAGES)
-LIBBUILTIN(strcpy, "c*c*cC*",     "f",     "string.h", ALL_LANGUAGES)
-LIBBUILTIN(strncpy, "c*c*cC*z",   "f",     "string.h", ALL_LANGUAGES)
-LIBBUILTIN(strcmp, "icC*cC*",     "f",     "string.h", ALL_LANGUAGES)
-LIBBUILTIN(strncmp, "icC*cC*z",   "f",     "string.h", ALL_LANGUAGES)
-LIBBUILTIN(strcat, "c*c*cC*",     "f",     "string.h", ALL_LANGUAGES)
-LIBBUILTIN(strncat, "c*c*cC*z",   "f",     "string.h", ALL_LANGUAGES)
-LIBBUILTIN(strxfrm, "zc*cC*z",    "f",     "string.h", ALL_LANGUAGES)
-LIBBUILTIN(memchr, "v*vC*iz",     "f",     "string.h", ALL_LANGUAGES)
-LIBBUILTIN(strchr, "c*cC*i",      "f",     "string.h", ALL_LANGUAGES)
-LIBBUILTIN(strcspn, "zcC*cC*",    "f",     "string.h", ALL_LANGUAGES)
-LIBBUILTIN(strpbrk, "c*cC*cC*",   "f",     "string.h", ALL_LANGUAGES)
-LIBBUILTIN(strrchr, "c*cC*i",     "f",     "string.h", ALL_LANGUAGES)
-LIBBUILTIN(strspn, "zcC*cC*",     "f",     "string.h", ALL_LANGUAGES)
-LIBBUILTIN(strstr, "c*cC*cC*",    "f",     "string.h", ALL_LANGUAGES)
-LIBBUILTIN(strtok, "c*c*cC*",     "f",     "string.h", ALL_LANGUAGES)
-LIBBUILTIN(memset, "v*v*iz",      "f",     "string.h", ALL_LANGUAGES)
-LIBBUILTIN(strerror, "c*i",       "f",     "string.h", ALL_LANGUAGES)
-LIBBUILTIN(strlen, "zcC*",        "f",     "string.h", ALL_LANGUAGES)
+LIBBUILTIN(memcpy, "Nv*Nv*NvC*z",  "f",     "string.h", ALL_LANGUAGES)
+LIBBUILTIN(memcmp, "iNvC*NvC*z",   "f",     "string.h", ALL_LANGUAGES)
+LIBBUILTIN(memmove, "Nv*Nv*NvC*z", "f",     "string.h", ALL_LANGUAGES)
+LIBBUILTIN(strcpy, "c*c*cC*",      "f",     "string.h", ALL_LANGUAGES)
+LIBBUILTIN(strncpy, "Nc*Nc*NcC*z", "f",     "string.h", ALL_LANGUAGES)
+LIBBUILTIN(strcmp, "icC*cC*",      "f",     "string.h", ALL_LANGUAGES)
+LIBBUILTIN(strncmp, "iNcC*NcC*z",  "f",     "string.h", ALL_LANGUAGES)
+LIBBUILTIN(strcat, "c*c*cC*",      "f",     "string.h", ALL_LANGUAGES)
+LIBBUILTIN(strncat, "c*c*NcC*z",   "f",     "string.h", ALL_LANGUAGES)
+LIBBUILTIN(strxfrm, "zc*cC*z",     "f",     "string.h", ALL_LANGUAGES)
+LIBBUILTIN(memchr, "Nv*NvC*iz",    "f",     "string.h", ALL_LANGUAGES)
+LIBBUILTIN(strchr, "c*cC*i",       "f",     "string.h", ALL_LANGUAGES)
+LIBBUILTIN(strcspn, "zcC*cC*",     "f",     "string.h", ALL_LANGUAGES)
+LIBBUILTIN(strpbrk, "c*cC*cC*",    "f",     "string.h", ALL_LANGUAGES)
+LIBBUILTIN(strrchr, "c*cC*i",      "f",     "string.h", ALL_LANGUAGES)
+LIBBUILTIN(strspn, "zcC*cC*",      "f",     "string.h", ALL_LANGUAGES)
+LIBBUILTIN(strstr, "c*cC*cC*",     "f",     "string.h", ALL_LANGUAGES)
+LIBBUILTIN(strtok, "c*c*cC*",      "f",     "string.h", ALL_LANGUAGES)
+LIBBUILTIN(memset, "Nv*Nv*iz",     "f",     "string.h", ALL_LANGUAGES)
+LIBBUILTIN(strerror, "c*i",        "f",     "string.h", ALL_LANGUAGES)
+LIBBUILTIN(strlen, "zcC*",         "f",     "string.h", ALL_LANGUAGES)
 // C99 stdio.h
 LIBBUILTIN(printf, "icC*.",       "fp:0:", "stdio.h", ALL_LANGUAGES)
 LIBBUILTIN(fprintf, "iP*cC*.",    "fp:1:", "stdio.h", ALL_LANGUAGES)
 LIBBUILTIN(snprintf, "ic*zcC*.",  "fp:2:", "stdio.h", ALL_LANGUAGES)
 LIBBUILTIN(sprintf, "ic*cC*.",    "fp:1:", "stdio.h", ALL_LANGUAGES)
 LIBBUILTIN(vprintf, "icC*a",      "fP:0:", "stdio.h", ALL_LANGUAGES)
 LIBBUILTIN(vfprintf, "iP*cC*a",   "fP:1:", "stdio.h", ALL_LANGUAGES)
 LIBBUILTIN(vsnprintf, "ic*zcC*a", "fP:2:", "stdio.h", ALL_LANGUAGES)

 LIBBUILTIN(isspace, "ii", "fnU", "ctype.h", ALL_LANGUAGES)
 LIBBUILTIN(isupper, "ii", "fnU", "ctype.h", ALL_LANGUAGES)
 LIBBUILTIN(isxdigit, "ii", "fnU", "ctype.h", ALL_LANGUAGES)
 LIBBUILTIN(tolower, "ii", "fnU", "ctype.h", ALL_LANGUAGES)
 LIBBUILTIN(toupper, "ii", "fnU", "ctype.h", ALL_LANGUAGES)
 // C99 wchar.h
 // FIXME: This list is incomplete. We should cover at least the functions that
 // take format strings.
-LIBBUILTIN(wcschr,  "w*wC*w",   "f", "wchar.h", ALL_LANGUAGES)
-LIBBUILTIN(wcscmp,  "iwC*wC*",  "f", "wchar.h", ALL_LANGUAGES)
-LIBBUILTIN(wcslen,  "zwC*",     "f", "wchar.h", ALL_LANGUAGES)
-LIBBUILTIN(wcsncmp, "iwC*wC*z", "f", "wchar.h", ALL_LANGUAGES)
-LIBBUILTIN(wmemchr, "w*wC*wz",  "f", "wchar.h", ALL_LANGUAGES)
-LIBBUILTIN(wmemcmp, "iwC*wC*z", "f", "wchar.h", ALL_LANGUAGES)
+LIBBUILTIN(wcschr,  "w*wC*w",     "f", "wchar.h", ALL_LANGUAGES)
+LIBBUILTIN(wcscmp,  "iwC*wC*",    "f", "wchar.h", ALL_LANGUAGES)
+LIBBUILTIN(wcslen,  "zwC*",       "f", "wchar.h", ALL_LANGUAGES)
+LIBBUILTIN(wcsncmp, "iNwC*NwC*z", "f", "wchar.h", ALL_LANGUAGES)
+LIBBUILTIN(wmemchr, "Nw*NwC*wz",  "f", "wchar.h", ALL_LANGUAGES)
+LIBBUILTIN(wmemcmp, "iNwC*NwC*z", "f", "wchar.h", ALL_LANGUAGES)
 
 // C99
 // In some systems setjmp is a macro that expands to _setjmp. We undefine
 // it here to avoid having two identical LIBBUILTIN entries.
 #undef setjmp
 LIBBUILTIN(setjmp, "iJ",          "fj",    "setjmp.h", ALL_LANGUAGES)
 LIBBUILTIN(longjmp, "vJi",        "fr",    "setjmp.h", ALL_LANGUAGES)
 

lib/AST/ASTContext.cpp

 /// AllowTypeModifiers is false then modifier like * are not parsed, just basic
 /// types.  This allows "v2i*" to be parsed as a pointer to a v2i instead of
 /// a vector of "i*".
 ///
 /// RequiresICE is filled in on return to indicate whether the value is required
 /// to be an Integer Constant Expression.
 static QualType DecodeTypeFromStr(const char *&Str, const ASTContext &Context,
                                   ASTContext::GetBuiltinTypeError &Error,
-                                  bool &RequiresICE,
+                                  bool &RequiresICE, bool &OverrideNonnull,
                                   bool AllowTypeModifiers) {
   // Modifiers.
   int HowLong = 0;
   bool Signed = false, Unsigned = false;
   RequiresICE = false;
-  
+  OverrideNonnull = false;
   // Read the prefixed modifiers first.
   bool Done = false;
   while (!Done) {
     switch (*Str++) {
     default: Done = true; --Str; break;
     case 'I':
       RequiresICE = true;
       break;
+    case 'N':
+      OverrideNonnull = true;
+      break;
     case 'S':
       assert(!Unsigned && "Can't use both 'S' and 'U' modifiers!");
       assert(!Signed && "Can't use 'S' modifier multiple times!");
       Signed = true;
       break;
     case 'U':
       assert(!Signed && "Can't use both 'S' and 'U' modifiers!");
       assert(!Unsigned && "Can't use 'U' modifier multiple times!");
else
       Type = Context.getLValueReferenceType(Type);
     break;
   case 'V': {
     char *End;
     unsigned NumElements = strtoul(Str, &End, 10);
     assert(End != Str && "Missing vector size");
     Str = End;
 
-    QualType ElementType = DecodeTypeFromStr(Str, Context, Error, 
-                                             RequiresICE, false);
+    QualType ElementType = DecodeTypeFromStr(Str, Context, Error, RequiresICE,
+                                             OverrideNonnull, false);
     assert(!RequiresICE && "Can't require vector ICE");
     
     // TODO: No way to make AltiVec vectors in builtins yet.
     Type = Context.getVectorType(ElementType, NumElements,
                                  VectorType::GenericVector);
     break;
   }
   case 'E': {
     char *End;
     
     unsigned NumElements = strtoul(Str, &End, 10);
     assert(End != Str && "Missing vector size");
     
     Str = End;
-    
     QualType ElementType = DecodeTypeFromStr(Str, Context, Error, RequiresICE,
-                                             false);
+                                             OverrideNonnull, false);
     Type = Context.getExtVectorType(ElementType, NumElements);
     break;    
   }
   case 'X': {
     QualType ElementType = DecodeTypeFromStr(Str, Context, Error, RequiresICE,
-                                             false);
+                                             OverrideNonnull, false);
     assert(!RequiresICE && "Can't require complex ICE");
     Type = Context.getComplexType(ElementType);
     break;
   }  
   case 'Y' : {
     Type = Context.getPointerDiffType();
     break;
   }
static QualType DecodeTypeFromStr(const char *&Str, const ASTContext &Context,
   
   assert((!RequiresICE || Type->isIntegralOrEnumerationType()) &&
          "Integer constant 'I' type must be an integer"); 
 
   return Type;
 }
 
 /// GetBuiltinType - Return the type for the specified builtin.
-QualType ASTContext::GetBuiltinType(unsigned Id,
-                                    GetBuiltinTypeError &Error,
+QualType ASTContext::GetBuiltinType(unsigned Id, GetBuiltinTypeError &Error,
+                                    bool *OverrideNonnullReturn,
+                                    unsigned *OverrideNonnullArgs,
                                     unsigned *IntegerConstantArgs) const {
   const char *TypeStr = BuiltinInfo.getTypeString(Id);
 
   SmallVector<QualType, 8> ArgTypes;
 
   bool RequiresICE = false;
+  bool OverrideNonnull = false;
   Error = GE_None;
-  QualType ResType = DecodeTypeFromStr(TypeStr, *this, Error,
-                                       RequiresICE, true);
+  QualType ResType = DecodeTypeFromStr(TypeStr, *this, Error, RequiresICE,
+                                       OverrideNonnull, true);
   if (Error != GE_None)
     return QualType();
-  
+  if (OverrideNonnullReturn)
+    *OverrideNonnullReturn = OverrideNonnull;
   assert(!RequiresICE && "Result of intrinsic cannot be required to be an ICE");
-  
   while (TypeStr[0] && TypeStr[0] != '.') {
-    QualType Ty = DecodeTypeFromStr(TypeStr, *this, Error, RequiresICE, true);
+    QualType Ty = DecodeTypeFromStr(TypeStr, *this, Error, RequiresICE,
+                                    OverrideNonnull, true);
     if (Error != GE_None)
       return QualType();
 
+    // If this argument should have any nonnull annotations overriden, fill in
+    // the bitmask.
+    if (OverrideNonnull && OverrideNonnullArgs)
+      *OverrideNonnullArgs |= 1 << ArgTypes.size();
+
     // If this argument is required to be an IntegerConstantExpression and the
     // caller cares, fill in the bitmask we return.
     if (RequiresICE && IntegerConstantArgs)
       *IntegerConstantArgs |= 1 << ArgTypes.size();
     
     // Do array -> pointer decay.  The builtin should use the decayed type.
     if (Ty->isArrayType())
       Ty = getArrayDecayedType(Ty);

lib/CodeGen/CGBuiltin.cpp

 
   if (IntrinsicID != Intrinsic::not_intrinsic) {
     SmallVector<Value*, 16> Args;
 
     // Find out if any arguments are required to be integer constant
     // expressions.
     unsigned ICEArguments = 0;
     ASTContext::GetBuiltinTypeError Error;
-    getContext().GetBuiltinType(BuiltinID, Error, &ICEArguments);
+    getContext().GetBuiltinType(BuiltinID, Error,
+                                /*OverrideNonnullReturn=*/nullptr,
+                                /*OverrideNonnullArgs=*/nullptr, &ICEArguments);
     assert(Error == ASTContext::GE_None && "Should not codegen an error");
 
     Function *F = CGM.getIntrinsic(IntrinsicID);
     llvm::FunctionType *FTy = F->getFunctionType();
 
     for (unsigned i = 0, e = E->getNumArgs(); i != e; ++i) {
       Value *ArgValue;
       // If this is a normal argument, just emit it as a scalar.
if (BuiltinID == ARM::BI__builtin_arm_rsr ||
 
     return EmitSpecialRegisterBuiltin(*this, E, RegisterType, ValueType, IsRead);
   }
 
   // Find out if any arguments are required to be integer constant
   // expressions.
   unsigned ICEArguments = 0;
   ASTContext::GetBuiltinTypeError Error;
-  getContext().GetBuiltinType(BuiltinID, Error, &ICEArguments);
+  getContext().GetBuiltinType(BuiltinID, Error,
+                              /*OverrideNonnullReturn=*/nullptr,
+                              /*OverrideNonnullArgs=*/nullptr, &ICEArguments);
   assert(Error == ASTContext::GE_None && "Should not codegen an error");
 
   auto getAlignmentValue32 = [&](Address addr) -> Value* {
     return Builder.getInt32(addr.getAlignment().getQuantity());
   };
 
   Address PtrOp0 = Address::invalid();
   Address PtrOp1 = Address::invalid();
if (BuiltinID == AArch64::BI__builtin_arm_rsr ||
 
     return EmitSpecialRegisterBuiltin(*this, E, RegisterType, ValueType, IsRead);
   }
 
   // Find out if any arguments are required to be integer constant
   // expressions.
   unsigned ICEArguments = 0;
   ASTContext::GetBuiltinTypeError Error;
-  getContext().GetBuiltinType(BuiltinID, Error, &ICEArguments);
+  getContext().GetBuiltinType(BuiltinID, Error,
+                              /*OverrideNonnullReturn=*/nullptr,
+                              /*OverrideNonnullArgs=*/nullptr, &ICEArguments);
   assert(Error == ASTContext::GE_None && "Should not codegen an error");
 
   llvm::SmallVector<Value*, 4> Ops;
   for (unsigned i = 0, e = E->getNumArgs() - 1; i != e; i++) {
     if ((ICEArguments & (1 << i)) == 0) {
       Ops.push_back(EmitScalarExpr(E->getArg(i)));
     } else {
       // If this is required to be a constant, constant fold it so that we know
if (BuiltinID == X86::BI__builtin_ms_va_copy) {
     return Builder.CreateStore(ArgPtr, DestAddr);
   }
 
   SmallVector<Value*, 4> Ops;
 
   // Find out if any arguments are required to be integer constant expressions.
   unsigned ICEArguments = 0;
   ASTContext::GetBuiltinTypeError Error;
-  getContext().GetBuiltinType(BuiltinID, Error, &ICEArguments);
+  getContext().GetBuiltinType(BuiltinID, Error,
+                              /*OverrideNonnullReturn=*/nullptr,
+                              /*OverrideNonnullArgs=*/nullptr, &ICEArguments);
   assert(Error == ASTContext::GE_None && "Should not codegen an error");
 
   for (unsigned i = 0, e = E->getNumArgs(); i != e; i++) {
     // If this is a normal argument, just emit it as a scalar.
     if ((ICEArguments & (1 << i)) == 0) {
       Ops.push_back(EmitScalarExpr(E->getArg(i)));
       continue;
     }

lib/CodeGen/CGCall.cpp

void CodeGenModule::AddDefaultFnAttrs(llvm::Function &F) {
   ConstructDefaultFnAttrList(F.getName(),
                              F.hasFnAttribute(llvm::Attribute::OptimizeNone),
                              /* AttrOnCallsite = */ false, FuncAttrs);
   llvm::AttributeSet AS = llvm::AttributeSet::get(
       getLLVMContext(), llvm::AttributeSet::FunctionIndex, FuncAttrs);
   F.addAttributes(llvm::AttributeSet::FunctionIndex, AS);
 }
 
+/// Returns the attribute (either parameter attribute, or function
+/// attribute), which declares argument ArgNo to be non-null.
+static const NonNullAttr *getNonNullAttr(const Decl *FD, const ParmVarDecl *PVD,
+                                         QualType ArgType, unsigned ArgNo) {
+  // FIXME: __attribute__((nonnull)) can also be applied to:
+  //   - references to pointers, where the pointee is known to be
+  //     nonnull (apparently a Clang extension)
+  //   - transparent unions containing pointers
+  // In the former case, LLVM IR cannot represent the constraint. In
+  // the latter case, we have no guarantee that the transparent union
+  // is in fact passed as a pointer.
+  if (!ArgType->isAnyPointerType() && !ArgType->isBlockPointerType())
+    return nullptr;
+  // First, check attribute on parameter itself.
+  if (PVD) {
+    if (auto ParmNNAttr = PVD->getAttr<NonNullAttr>())
+      return ParmNNAttr;
+  }
+  // Check function attributes.
+  if (!FD)
+    return nullptr;
+  for (const auto *NNAttr : FD->specific_attrs<NonNullAttr>()) {
+    if (NNAttr->isNonNull(ArgNo))
+      return NNAttr;
+  }
+  return nullptr;
+}
+
 void CodeGenModule::ConstructAttributeList(
     StringRef Name, const CGFunctionInfo &FI, CGCalleeInfo CalleeInfo,
     AttributeListType &PAL, unsigned &CallingConv, bool AttrOnCallSite) {
   llvm::AttrBuilder FuncAttrs;
   llvm::AttrBuilder RetAttrs;
 
   CallingConv = FI.getEffectiveCallingConvention();
   if (FI.isNoReturn())
     FuncAttrs.addAttribute(llvm::Attribute::NoReturn);
 
   // If we have information about the function prototype, we can learn
   // attributes form there.
   AddAttributesFromFunctionProtoType(getContext(), FuncAttrs,
                                      CalleeInfo.getCalleeFunctionProtoType());
 
   const Decl *TargetDecl = CalleeInfo.getCalleeDecl();
+  const FunctionDecl *FD = dyn_cast_or_null<FunctionDecl>(TargetDecl);
+
+  // Check if this is a builtin function that might override some attributes.
+  unsigned BuiltinID = FD ? FD->getBuiltinID() : 0;
+  bool OverrideNonnullReturn = false;
+  unsigned OverrideNonnullArgs = 0;
+  if (BuiltinID) {
+    ASTContext::GetBuiltinTypeError Error;
+    getContext().GetBuiltinType(BuiltinID, Error, &OverrideNonnullReturn,
+                                &OverrideNonnullArgs);
+    assert(Error == ASTContext::GE_None && "Should not codegen an error");
+  }
 
   bool HasOptnone = false;
   // FIXME: handle sseregparm someday...
   if (TargetDecl) {
     if (TargetDecl->hasAttr<ReturnsTwiceAttr>())
       FuncAttrs.addAttribute(llvm::Attribute::ReturnsTwice);
     if (TargetDecl->hasAttr<NoThrowAttr>())
       FuncAttrs.addAttribute(llvm::Attribute::NoUnwind);
     if (TargetDecl->hasAttr<NoReturnAttr>())
       FuncAttrs.addAttribute(llvm::Attribute::NoReturn);
     if (TargetDecl->hasAttr<NoDuplicateAttr>())
       FuncAttrs.addAttribute(llvm::Attribute::NoDuplicate);
     if (TargetDecl->hasAttr<ConvergentAttr>())
       FuncAttrs.addAttribute(llvm::Attribute::Convergent);
 
-    if (const FunctionDecl *Fn = dyn_cast<FunctionDecl>(TargetDecl)) {
+    if (FD) {
       AddAttributesFromFunctionProtoType(
-          getContext(), FuncAttrs, Fn->getType()->getAs<FunctionProtoType>());
+          getContext(), FuncAttrs, FD->getType()->getAs<FunctionProtoType>());
       // Don't use [[noreturn]] or _Noreturn for a call to a virtual function.
       // These attributes are not inherited by overloads.
-      const CXXMethodDecl *MD = dyn_cast<CXXMethodDecl>(Fn);
-      if (Fn->isNoReturn() && !(AttrOnCallSite && MD && MD->isVirtual()))
+      const CXXMethodDecl *MD = dyn_cast<CXXMethodDecl>(FD);
+      if (FD->isNoReturn() && !(AttrOnCallSite && MD && MD->isVirtual()))
         FuncAttrs.addAttribute(llvm::Attribute::NoReturn);
     }
 
     // 'const', 'pure' and 'noalias' attributed functions are also nounwind.
     if (TargetDecl->hasAttr<ConstAttr>()) {
       FuncAttrs.addAttribute(llvm::Attribute::ReadNone);
       FuncAttrs.addAttribute(llvm::Attribute::NoUnwind);
     } else if (TargetDecl->hasAttr<PureAttr>()) {
       FuncAttrs.addAttribute(llvm::Attribute::ReadOnly);
       FuncAttrs.addAttribute(llvm::Attribute::NoUnwind);
     } else if (TargetDecl->hasAttr<NoAliasAttr>()) {
       FuncAttrs.addAttribute(llvm::Attribute::ArgMemOnly);
       FuncAttrs.addAttribute(llvm::Attribute::NoUnwind);
     }
     if (TargetDecl->hasAttr<RestrictAttr>())
       RetAttrs.addAttribute(llvm::Attribute::NoAlias);
-    if (TargetDecl->hasAttr<ReturnsNonNullAttr>())
+    if (TargetDecl->hasAttr<ReturnsNonNullAttr>() && !OverrideNonnullReturn)
       RetAttrs.addAttribute(llvm::Attribute::NonNull);
 
     HasOptnone = TargetDecl->hasAttr<OptimizeNoneAttr>();
     if (auto *AllocSize = TargetDecl->getAttr<AllocSizeAttr>()) {
       Optional<unsigned> NumElemsParam;
       // alloc_size args are base-1, 0 means not present.
       if (unsigned N = AllocSize->getNumElemsParam())
         NumElemsParam = N - 1;
bool DisableTailCalls =
                         TargetDecl->hasAttr<AnyX86InterruptAttr>()));
     FuncAttrs.addAttribute("disable-tail-calls",
                            llvm::toStringRef(DisableTailCalls));
 
     // Add target-cpu and target-features attributes to functions. If
     // we have a decl for the function and it has a target attribute then
     // parse that and add it to the feature set.
     StringRef TargetCPU = getTarget().getTargetOpts().CPU;
-    const FunctionDecl *FD = dyn_cast_or_null<FunctionDecl>(TargetDecl);
     if (FD && FD->hasAttr<TargetAttr>()) {
       llvm::StringMap<bool> FeatureMap;
       getFunctionFeatureMap(FeatureMap, FD);
 
       // Produce the canonical string for this set of features.
       std::vector<std::string> Features;
       for (llvm::StringMap<bool>::const_iterator it = FeatureMap.begin(),
                                                  ie = FeatureMap.end();
for (CGFunctionInfo::const_arg_iterator I = FI.arg_begin(),
 
     case ABIArgInfo::InAlloca:
       // inalloca disables readnone and readonly.
       FuncAttrs.removeAttribute(llvm::Attribute::ReadOnly)
           .removeAttribute(llvm::Attribute::ReadNone);
       continue;
     }
 
+    if (FD && ArgNo < FD->param_size() && ParamType->isPointerType()) {
+      auto *PVD = FD->getParamDecl(ArgNo);
+      if (getNonNullAttr(FD, PVD, ParamType, PVD->getFunctionScopeIndex()) &&
+          (!BuiltinID || (OverrideNonnullArgs & (1 << ArgNo)) == 0))
+        Attrs.addAttribute(llvm::Attribute::NonNull);
+    }
+
     if (const auto *RefTy = ParamType->getAs<ReferenceType>()) {
       QualType PTy = RefTy->getPointeeType();
       if (!PTy->isIncompleteType() && PTy->isConstantSizeType())
         Attrs.addDereferenceableAttr(getContext().getTypeSizeInChars(PTy)
                                        .getQuantity());
       else if (getContext().getTargetAddressSpace(PTy) == 0)
         Attrs.addAttribute(llvm::Attribute::NonNull);
     }
assert((varType->isIntegerTy() || varType->isFloatingPointTy())
          && "unexpected promotion type");
 
   if (isa<llvm::IntegerType>(varType))
     return CGF.Builder.CreateTrunc(value, varType, "arg.unpromote");
 
   return CGF.Builder.CreateFPCast(value, varType, "arg.unpromote");
 }
 
-/// Returns the attribute (either parameter attribute, or function
-/// attribute), which declares argument ArgNo to be non-null.
-static const NonNullAttr *getNonNullAttr(const Decl *FD, const ParmVarDecl *PVD,
-                                         QualType ArgType, unsigned ArgNo) {
-  // FIXME: __attribute__((nonnull)) can also be applied to:
-  //   - references to pointers, where the pointee is known to be
-  //     nonnull (apparently a Clang extension)
-  //   - transparent unions containing pointers
-  // In the former case, LLVM IR cannot represent the constraint. In
-  // the latter case, we have no guarantee that the transparent union
-  // is in fact passed as a pointer.
-  if (!ArgType->isAnyPointerType() && !ArgType->isBlockPointerType())
-    return nullptr;
-  // First, check attribute on parameter itself.
-  if (PVD) {
-    if (auto ParmNNAttr = PVD->getAttr<NonNullAttr>())
-      return ParmNNAttr;
-  }
-  // Check function attributes.
-  if (!FD)
-    return nullptr;
-  for (const auto *NNAttr : FD->specific_attrs<NonNullAttr>()) {
-    if (NNAttr->isNonNull(ArgNo))
-      return NNAttr;
-  }
-  return nullptr;
-}
-
 namespace {
   struct CopyBackSwiftError final : EHScopeStack::Cleanup {
     Address Temp;
     Address Arg;
     CopyBackSwiftError(Address temp, Address arg) : Temp(temp), Arg(arg) {}
     void Emit(CodeGenFunction &CGF, Flags flags) override {
       llvm::Value *errorValue = CGF.Builder.CreateLoad(Temp);
       CGF.Builder.CreateStore(errorValue, Arg);

lib/Sema/SemaChecking.cpp

 ExprResult
 Sema::CheckBuiltinFunctionCall(FunctionDecl *FDecl, unsigned BuiltinID,
                                CallExpr *TheCall) {
   ExprResult TheCallResult(TheCall);
 
   // Find out if any arguments are required to be integer constant expressions.
   unsigned ICEArguments = 0;
   ASTContext::GetBuiltinTypeError Error;
-  Context.GetBuiltinType(BuiltinID, Error, &ICEArguments);
+  Context.GetBuiltinType(BuiltinID, Error, /*OverrideNonnullReturn=*/nullptr,
+                         /*OverrideNonnullArgs=*/nullptr, &ICEArguments);
   if (Error != ASTContext::GE_None)
     ICEArguments = 0;  // Don't diagnose previously diagnosed errors.
   
   // If any arguments are required to be ICE's, check and diagnose.
   for (unsigned ArgNo = 0; ICEArguments != 0; ++ArgNo) {
     // Skip arguments not required to be ICE's.
     if ((ICEArguments & (1 << ArgNo)) == 0) continue;
     

test/CodeGen/nonnull.c

 
 // CHECK: define void @bar7(i32* nonnull %a, i32* nonnull %b)
 void bar7(int *a, int *b) __attribute__((nonnull(1)))
 __attribute__((nonnull(2))) {}
 
 // CHECK: define void @bar8(i32* nonnull %a, i32* nonnull %b)
 void bar8(int *a, int *b) __attribute__((nonnull))
 __attribute__((nonnull(1))) {}
+
+// CHECK: declare void @foo_decl(i32* nonnull)
+void foo_decl(int *__attribute__((nonnull)));
+
+// CHECK: declare void @bar_decl(i32* nonnull)
+void bar_decl(int *) __attribute__((nonnull(1)));
+
+// CHECK: declare void @bar2_decl(i32*, i32* nonnull)
+void bar2_decl(int *, int *) __attribute__((nonnull(2)));
+
+// CHECK: declare nonnull i32* @bar3_decl()
+int *bar3_decl(void) __attribute__((returns_nonnull));
+
+// CHECK: declare i32 @bar4_decl(i32, i32* nonnull)
+int bar4_decl(int, int *) __attribute__((nonnull));
+
+// CHECK: declare i32 @bar5_decl(i32, i32* nonnull)
+int bar5_decl(int, int *) __attribute__((nonnull(1, 2)));
+
+// CHECK: declare i32 @bar6_decl(i64)
+int bar6_decl(TransparentUnion) __attribute__((nonnull(1)));
+
+// CHECK: declare void @bar7_decl(i32* nonnull, i32* nonnull)
+void bar7_decl(int *, int *)
+    __attribute__((nonnull(1))) __attribute__((nonnull(2)));
+
+// CHECK: declare void @bar8_decl(i32* nonnull, i32* nonnull)
+void bar8_decl(int *, int *)
+    __attribute__((nonnull)) __attribute__((nonnull(1)));
+
+// Clang specially disables nonnull attributes on some library builtin
+// functions to work around the fact that the standard and some vendors mark
+// them as nonnull even though they are frequently called in practice with null
+// arguments if a corresponding size argument is zero.
+
+// CHECK: declare i8* @memcpy(i8*, i8*, i64)
+void *memcpy(void *, const void *, unsigned long)
+    __attribute__((nonnull(1, 2))) __attribute__((returns_nonnull));
+
+// CHECK: declare i32 @memcmp(i8*, i8*, i64)
+int memcmp(const void *, const void *, unsigned long) __attribute__((nonnull(1, 2)));
+
+// CHECK: declare i8* @memmove(i8*, i8*, i64)
+void *memmove(void *, const void *, unsigned long)
+    __attribute__((nonnull(1, 2))) __attribute__((returns_nonnull));
+
+// CHECK: declare i8* @strncpy(i8*, i8*, i64)
+char *strncpy(char *, const char *, unsigned long)
+    __attribute__((nonnull(1, 2))) __attribute__((returns_nonnull));
+
+// CHECK: declare i32 @strncmp(i8*, i8*, i64)
+int strncmp(const char *, const char *, unsigned long) __attribute__((nonnull(1, 2)));
+
+// CHECK: declare nonnull i8* @strncat(i8* nonnull, i8*, i64)
+char *strncat(char *, const char *, unsigned long)
+    __attribute__((nonnull(1, 2))) __attribute__((returns_nonnull));
+
+// CHECK: declare i8* @memchr(i8*, i32, i64)
+void *memchr(const void *__attribute__((nonnull)), int, unsigned long)
+    __attribute__((returns_nonnull));
+
+// CHECK: declare i8* @memset(i8*, i32, i64)
+void *memset(void *__attribute__((nonnull)), int, unsigned long)
+    __attribute__((returns_nonnull));
+
+void use_declarations(int *p, void *volatile *sink) {
+  foo_decl(p);
+  bar_decl(p);
+  bar2_decl(p, p);
+  (void)bar3_decl();
+  bar4_decl(42, p);
+  bar5_decl(42, p);
+  bar6_decl(p);
+  bar7_decl(p, p);
+  bar8_decl(p, p);
+  *sink = (void *)&memcpy;
+  *sink = (void *)&memcmp;
+  *sink = (void *)&memmove;
+  *sink = (void *)&strncpy;
+  *sink = (void *)&strncmp;
+  *sink = (void *)&strncat;
+  *sink = (void *)&memchr;
+  *sink = (void *)&memset;
+}