[C++2a] Parsing and semantic analysis for contracts (P0542R5)

[hamzasood]

Summary

This patch implements Parsing, Semantic analysis, and AST representation for contract attributes as described in P0542R5.

Missing from the implementation:

1. CodeGen and library support are on hold until the relevant ABI decisions are made.
2. The supporting AST stuff (serialisation etc.) isn't included yet; this patch is large enough as it is.
3. Specifying a build level requires a compiler option, which probably requires further discussion.

The rest of it is mostly complete, however there're a few things that I couldn't work out:

1. Are contracts allowed on constructors/destructors, or any special member function for that matter? If so, then is MyClass() [[expects: something()]] = default a trivial constructor? I can't seem to find anything relevant in the standard but that seems quite contradictory.
2. Are contracts allowed on explicit instantiations? The latest proposal (r5) explicitly forbids it, but that sentence is missing from the current working draft (N4762). Does that mean that it should follow the usual redeclaration rules?

This is dependent on the following patches:

• D50021: [Support] Add casting iterator adapters
• D50763: [Parser] Refactor and fix bugs in late-parsing
• D50764: [AST] Make NullStmt final and give it factory functions

[steveire]

lib/Parse/ParseStmt.cpp

272

Any reason to create the intermediate variable here, instead of leaving the ConsumeToken() call where it was?

include/clang/AST/AttrContract.h

+//===--- AttrContract.h - Classes for representing contracts ----*- C++ -*-===//
+//
+//                     The LLVM Compiler Infrastructure
+//
+// This file is distributed under the University of Illinois Open Source
+// License. See LICENSE.TXT for details.
+//
+//===----------------------------------------------------------------------===//
+//
+//  This file defines the ContractAttr interface and subclasses.
+//  Note that these are entirely independent of the Attr interface; their only
+//  real resemblance is in the name.
+//
+//===----------------------------------------------------------------------===//
+
+#ifndef LLVM_CLANG_AST_ATTRCONTRACT_H
+#define LLVM_CLANG_AST_ATTRCONTRACT_H
+
+#include "clang/Basic/Contract.h"
+#include "clang/Basic/SourceLocation.h"
+
+namespace clang {
+  class Expr;
+  class VarDecl;
+  struct PrintingPolicy;
+
+/// Common base class for all contract attributes.
+class ContractAttr {
+  /// Predicate that is intended to hold on evaluation of the contract.
+  Expr *Predicate;
+
+  /// Range that covers the entire attribute, including the square brackets.
+  SourceRange Range;
+
+  /// Location of the contract kind token.
+  SourceLocation KindLoc;
+
+  /// Location of the (optional) contract level token.
+  /// This will be invalid if a level wasn't specified.
+  SourceLocation LevelLoc;
+
+  /// Location of the colon that denotes the start of the predicate.
+  SourceLocation ColonLoc;
+
+  ContractKind Kind;
+  ContractLevel Level;
+
+protected:
+  ContractAttr(SourceRange Range, ContractKind Kind, SourceLocation KindLoc,
+               ContractLevel Level, SourceLocation LevelLoc,
+               SourceLocation ColonLoc, Expr *Predicate)
+      : Predicate(Predicate), Range(Range), KindLoc(KindLoc),
+        LevelLoc(LevelLoc), ColonLoc(ColonLoc), Kind(Kind), Level(Level) {}
+
+public:
+  ContractKind getKind() const { return Kind; }
+  ContractLevel getLevel() const { return Level; }
+
+  Expr *getPredicate() const { return Predicate; }
+  void setPredicate(Expr *NewPredicate) { Predicate = NewPredicate; }
+
+  SourceRange getRange() const { return Range; }
+  SourceLocation getBeginLoc() const { return Range.getBegin(); }
+  SourceLocation getEndLoc() const { return Range.getEnd(); }
+  SourceLocation getKindLoc() const { return KindLoc; }
+  SourceLocation getLevelLoc() const { return LevelLoc; }
+  SourceLocation getColonLoc() const { return ColonLoc; }
+
+  /// Pretty print the contract into its source language syntax.
+  void printPretty(raw_ostream &OS, const PrintingPolicy &Policy) const;
+};
+
+class ExpectsContract final : public ContractAttr {
+public:
+  ExpectsContract(SourceRange Range, SourceLocation KindLoc,
+                  ContractLevel Level, SourceLocation LevelLoc,
+                  SourceLocation ColonLoc, Expr *Predicate)
+      : ContractAttr(Range, ContractKind::Expects, KindLoc, Level, LevelLoc,
+                     ColonLoc, Predicate) {}
+
+  static bool classof(const ContractAttr *C) {
+    return classofKind(C->getKind());
+  }
+  static bool classofKind(ContractKind K) { return K == ContractKind::Expects; }
+};
+
+class EnsuresContract final : public ContractAttr {
+  /// Declaration of the variable that represents the function result.
+  /// This will be null if the optional identifier wasn't specified.
+  VarDecl *ResultVar;
+
+public:
+  EnsuresContract(SourceRange Range, SourceLocation KindLoc,
+                  ContractLevel Level, SourceLocation LevelLoc,
+                  VarDecl *ResultVar, SourceLocation ColonLoc, Expr *Predicate)
+      : ContractAttr(Range, ContractKind::Ensures, KindLoc, Level, LevelLoc,
+                     ColonLoc, Predicate),
+        ResultVar(ResultVar) {}
+
+  VarDecl *getResultVar() const { return ResultVar; }
+  void setResultVar(VarDecl *NewResultVar) { ResultVar = NewResultVar; }
+
+  static bool classof(const ContractAttr *C) {
+    return classofKind(C->getKind());
+  }
+  static bool classofKind(ContractKind K) { return K == ContractKind::Ensures; }
+};
+
+class AssertContract final : public ContractAttr {
+public:
+  AssertContract(SourceRange Range, SourceLocation KindLoc,
+                 ContractLevel Level, SourceLocation LevelLoc,
+                 SourceLocation ColonLoc, Expr *Predicate)
+      : ContractAttr(Range, ContractKind::Assert, KindLoc, Level, LevelLoc,
+                     ColonLoc, Predicate) {}
+
+  static bool classof(const ContractAttr *C) {
+    return classofKind(C->getKind());
+  }
+  static bool classofKind(ContractKind K) { return K == ContractKind::Assert; }
+};
+
+} // end namespace clang
+
+#endif // LLVM_CLANG_AST_ATTRCONTRACT_H

include/clang/AST/Decl.h

 #include <utility>
 
 namespace clang {
 
 class ASTContext;
 struct ASTTemplateArgumentListInfo;
 class Attr;
 class CompoundStmt;
+class ContractAttr;
 class DependentFunctionTemplateSpecializationInfo;
+class EnsuresContract;
 class EnumDecl;
+class ExpectsContract;
 class Expr;
 class FunctionTemplateDecl;
 class FunctionTemplateSpecializationInfo;
 class LabelStmt;
 class MemberSpecializationInfo;
 class Module;
 class NamespaceDecl;
 class ParmVarDecl;
class NonParmVarDeclBitfields {
 
     /// Whether this variable is (C++0x) constexpr.
     unsigned IsConstexpr : 1;
 
     /// Whether this variable is the implicit variable for a lambda
     /// init-capture.
     unsigned IsInitCapture : 1;
 
+    /// Whether this variable represents the result of a function call for use
+    /// in a postcondition contract.
+    unsigned IsContractFunctionResult : 1;
+
     /// Whether this local extern variable's previous declaration was
     /// declared in the same block scope. This controls whether we should merge
     /// the type of this declaration with its previous declaration.
     unsigned PreviousDeclInSameBlockScope : 1;
 
     /// Defines kind of the ImplicitParamDecl: 'this', 'self', 'vtt', '_cmd' or
     /// something else.
     unsigned ImplicitParamKind : 3;
public:
   bool isInitCapture() const {
     return isa<ParmVarDecl>(this) ? false : NonParmVarDeclBits.IsInitCapture;
   }
   void setInitCapture(bool IC) {
     assert(!isa<ParmVarDecl>(this));
     NonParmVarDeclBits.IsInitCapture = IC;
   }
 
+  /// Whether this variable represents the result of a function call for use in
+  /// a postcondition contract.
+  bool isContractFunctionResult() const {
+    return isa<ParmVarDecl>(this)
+               ? false
+               : NonParmVarDeclBits.IsContractFunctionResult;
+  }
+  void setContractFunctionResult(bool IsRes) {
+    assert(!isa<ParmVarDecl>(this));
+    NonParmVarDeclBits.IsContractFunctionResult = IsRes;
+  }
+
   /// Whether this local extern variable declaration's previous declaration
   /// was declared in the same block scope. Only correct in C++.
   bool isPreviousDeclInSameBlockScope() const {
     return isa<ParmVarDecl>(this)
                ? false
                : NonParmVarDeclBits.PreviousDeclInSameBlockScope;
   }
   void setPreviousDeclInSameBlockScope(bool Same) {

 private:
   /// A new[]'d array of pointers to VarDecls for the formal
   /// parameters of this function.  This is null if a prototype or if there are
   /// no formals.
   ParmVarDecl **ParamInfo = nullptr;
 
   LazyDeclStmtPtr Body;
 
+  ContractAttr **Contracts = nullptr;
+  unsigned NumContracts = 0;
+
   unsigned ODRHash;
 
   /// End part of this FunctionDecl's source range.
   ///
   /// We could compute the full range in getSourceRange(). However, when we're
   /// dealing with a function definition deserialized from a PCH/AST file,
   /// we can only compute the full range once the function body has been
   /// de-serialized, so it's far better to have the (sometimes-redundant)
void setFunctionTemplateSpecialization(ASTContext &C,
                                          SourceLocation PointOfInstantiation);
 
   /// Specify that this record is an instantiation of the
   /// member function FD.
   void setInstantiationOfMemberFunction(ASTContext &C, FunctionDecl *FD,
                                         TemplateSpecializationKind TSK);
 
   void setParams(ASTContext &C, ArrayRef<ParmVarDecl *> NewParamInfo);
+  void setContracts(ASTContext &C, ArrayRef<ContractAttr *> NewContracts);
 
   // This is unfortunately needed because ASTDeclWriter::VisitFunctionDecl
   // need to access this bit but we want to avoid making ASTDeclWriter
   // a friend of FunctionDeclBitfields just for this.
   bool isDeletedBit() const { return FunctionDeclBits.IsDeleted; }
 
   /// Whether an ODRHash has been stored.
   bool hasODRHash() const { return FunctionDeclBits.HasODRHash; }
void setParams(ArrayRef<ParmVarDecl *> NewParamInfo) {
     setParams(getASTContext(), NewParamInfo);
   }
 
   /// Returns the minimum number of arguments needed to call this function. This
   /// may be fewer than the number of function parameters, if some of the
   /// parameters have default arguments (in C++).
   unsigned getMinRequiredArguments() const;
 
+  /// Get the contract attributes attached to this function.
+  /// @{
+  ArrayRef<ContractAttr *> contracts() const {
+    return {Contracts, NumContracts};
+  }
+  MutableArrayRef<ContractAttr *> contracts() {
+    return {Contracts, NumContracts};
+  }
+  /// @}
+
+  bool hasInheritedContracts() const {
+    return FunctionDeclBits.HasInheritedContracts;
+  }
+  void setInheritedContracts(bool Inherited = true) {
+    FunctionDeclBits.HasInheritedContracts = Inherited;
+  }
+
+  /// Set the list of contracts attributes attached to this function.
+  /// This should be called at most once per FunctionDecl.
+  ///
+  /// \pre contracts() == None;
+  /// \pre none_of(NewContracts, isa<AssertContract>);
+  /// \post contracts() == NewContracts;
+  void setContracts(ArrayRef<ContractAttr *> NewContracts) {
+    setContracts(getASTContext(), NewContracts);
+  }
+
   QualType getReturnType() const {
     assert(getType()->getAs<FunctionType>() && "Expected a FunctionType!");
     return getType()->getAs<FunctionType>()->getReturnType();
   }
 
   /// Attempt to compute an informative source range covering the
   /// function return type. This may omit qualifiers and other information with
   /// limited representation in the AST.

include/clang/AST/DeclBase.h

class FunctionDeclBitfields {
 
     /// [C++17] Only used by CXXDeductionGuideDecl. Indicates that
     /// the Deduction Guide is the implicitly generated 'copy
     /// deduction candidate' (is used during overload resolution).
     uint64_t IsCopyDeductionCandidate : 1;
 
     /// Store the ODRHash after first calculation.
     uint64_t HasODRHash : 1;
+
+    /// Indicates if the function's contract conditions were inherited from a
+    /// previous declaration as opposed to explicitly written in the source.
+    uint64_t HasInheritedContracts : 1;
   };
 
   /// Number of non-inherited bits in FunctionDeclBitfields.
-  enum { NumFunctionDeclBits = 25 };
+  enum { NumFunctionDeclBits = 26 };
 
   /// Stores the bits used by CXXConstructorDecl. If modified
   /// NumCXXConstructorDeclBits and the accessor
   /// methods in CXXConstructorDecl should be updated appropriately.
   class CXXConstructorDeclBitfields {
     friend class CXXConstructorDecl;
     /// For the bits in DeclContextBitfields.
     uint64_t : NumDeclContextBits;
     /// For the bits in FunctionDeclBitfields.
     uint64_t : NumFunctionDeclBits;
 
-    /// 25 bits to fit in the remaining availible space.
+    /// 24 bits to fit in the remaining availible space.
     /// Note that this makes CXXConstructorDeclBitfields take
     /// exactly 64 bits and thus the width of NumCtorInitializers
     /// will need to be shrunk if some bit is added to NumDeclContextBitfields,
     /// NumFunctionDeclBitfields or CXXConstructorDeclBitfields.
-    uint64_t NumCtorInitializers : 25;
+    uint64_t NumCtorInitializers : 24;
     uint64_t IsInheritingConstructor : 1;
   };
 
   /// Number of non-inherited bits in CXXConstructorDeclBitfields.
   enum { NumCXXConstructorDeclBits = 26 };
 
   /// Stores the bits used by ObjCMethodDecl.
   /// If modified NumObjCMethodDeclBits and the accessor

include/clang/AST/Stmt.h

 namespace llvm {
 
 class FoldingSetNodeID;
 
 } // namespace llvm
 
 namespace clang {
 
+class AssertContract;
 class ASTContext;
 class Attr;
 class CapturedDecl;
 class Decl;
 class Expr;
 class LabelDecl;
 class ODRHash;
 class PrinterHelper;
public:
 
   reverse_decl_iterator decl_rend() {
     return reverse_decl_iterator(decl_begin());
   }
 };
 
 /// NullStmt - This is the null statement ";": C99 6.8.3p3.
 ///
-class NullStmt final : public Stmt {
+class NullStmt final
+    : public Stmt,
+      private llvm::TrailingObjects<NullStmt, AssertContract *> {
+
   SourceLocation SemiLoc;
 
   /// True if the null statement was preceded by an empty macro, e.g:
   /// @code
   ///   #define CALL(x)
   ///   CALL(0);
   /// @endcode
-  bool HasLeadingEmptyMacro;
+  unsigned HasLeadingEmptyMacro : 1;
+
+  /// Number of assertion contracts attached to this statement.
+  unsigned NumAssertions : 31;
 
-  NullStmt(SourceLocation L, bool hasLeadingEmptyMacro)
-      : Stmt(NullStmtClass), SemiLoc(L),
-        HasLeadingEmptyMacro(hasLeadingEmptyMacro) {}
+  NullStmt(SourceLocation L, bool hasLeadingEmptyMacro,
+           ArrayRef<AssertContract *> Assertions);
 
-  explicit NullStmt(EmptyShell Empty)
-      : Stmt(NullStmtClass, Empty), HasLeadingEmptyMacro(false) {}
+  NullStmt(EmptyShell Empty, unsigned NumAssertions);
 
 public:
   friend class ASTStmtReader;
   friend class ASTStmtWriter;
+  friend TrailingObjects;
 
   static NullStmt *Create(const ASTContext &C, SourceLocation L,
-                          bool hasLeadingEmptyMacro = false) {
-    return new (C) NullStmt(L, hasLeadingEmptyMacro);
-  }
+                          bool hasLeadingEmptyMacro = false,
+                          ArrayRef<AssertContract *> Assertions = None);
 
   /// Build an empty null statement.
-  static NullStmt *CreateEmpty(const ASTContext &C) {
-    return new (C) NullStmt(EmptyShell{});
+  static NullStmt *CreateEmpty(const ASTContext &C, unsigned NumAssertions = 0);
+
+  using assertion_iterator = AssertContract *const *;
+  using assertion_range = llvm::iterator_range<assertion_iterator>;
+
+  assertion_iterator assertions_begin() const {
+    return getTrailingObjects<AssertContract *>();
+  }
+  assertion_iterator assertions_end() const {
+    return assertions_begin() + NumAssertions;
+  }
+  assertion_range assertions() const {
+    return {assertions_begin(), assertions_end()};
   }
 
   SourceLocation getSemiLoc() const { return SemiLoc; }
   void setSemiLoc(SourceLocation L) { SemiLoc = L; }
 
   bool hasLeadingEmptyMacro() const { return HasLeadingEmptyMacro; }
 
   LLVM_ATTRIBUTE_DEPRECATED(SourceLocation getLocStart() const LLVM_READONLY,
                             "Use getBeginLoc instead") {
     return getBeginLoc();
   }
-  SourceLocation getBeginLoc() const LLVM_READONLY { return SemiLoc; }
+  SourceLocation getBeginLoc() const LLVM_READONLY;
   LLVM_ATTRIBUTE_DEPRECATED(SourceLocation getLocEnd() const LLVM_READONLY,
                             "Use getEndLoc instead") {
     return getEndLoc();
   }
   SourceLocation getEndLoc() const LLVM_READONLY { return SemiLoc; }
 
   static bool classof(const Stmt *T) {
     return T->getStmtClass() == NullStmtClass;

include/clang/Basic/Contract.h

+//===--- Contract.h - Types for C++ Contracts  ------------------*- C++ -*-===//
+//
+//                     The LLVM Compiler Infrastructure
+//
+// This file is distributed under the University of Illinois Open Source
+// License. See LICENSE.TXT for details.
+//
+//===----------------------------------------------------------------------===//
+
+#ifndef LLVM_CLANG_BASIC_CONTRACT_H
+#define LLVM_CLANG_BASIC_CONTRACT_H
+
+#include <cstdint>
+
+namespace clang {
+
+enum class ContractKind : std::uint8_t {
+  Expects, ///< Precondition
+  Ensures, ///< Postcondition
+  Assert,  ///< Assertion
+};
+
+enum class ContractLevel : std::uint8_t {
+  /// The cost of run-time checking is assumed to be small (or at least not
+  /// expensive) compared to the cost of executing the function.
+  Default,
+
+  /// The cost of run-time checking is assumed to be large (or at least
+  /// significant) compared to the cost of executing the function.
+  Audit,
+
+  /// Formal comments that are not evaluated at run-time.
+  Axiom,
+};
+
+} // end namespace clang
+
+#endif // LLVM_CLANG_BASIC_CONTRACT_H

include/clang/Basic/DiagnosticASTKinds.td

 def note_constexpr_memcpy_overlap : Note<
   "'%select{memcpy|wmemcpy}0' between overlapping memory regions">;
 def note_constexpr_memcpy_unsupported : Note<
   "'%select{%select{memcpy|wmemcpy}1|%select{memmove|wmemmove}1}0' "
   "not supported: %select{"
   "size to copy (%4) is not a multiple of size of element type %3 (%5)|"
   "source is not a contiguous array of at least %4 elements of type %3|"
   "destination is not a contiguous array of at least %4 elements of type %3}2">;
+def note_constexpr_contract_failed : Note<
+  "%select{precondition|postcondition|assertion}0 %select{failed|is unsatisfiable}1">;
 
 def warn_integer_constant_overflow : Warning<
   "overflow in expression; result is %0 with type %1">,
   InGroup<DiagGroup<"integer-overflow">>;
 
 // This is a temporary diagnostic, and shall be removed once our
 // implementation is complete, and like the preceding constexpr notes belongs
 // in Sema.

include/clang/Basic/DiagnosticParseKinds.td

 def err_expected_lbrace_in_compound_literal : Error<
   "expected '{' in compound literal">;
 def err_expected_while : Error<"expected 'while' in do/while loop">;
 
 def err_expected_semi_after_stmt : Error<"expected ';' after %0 statement">;
 def err_expected_semi_after_expr : Error<"expected ';' after expression">;
 def err_extraneous_token_before_semi : Error<"extraneous '%0' before ';'">;
 
+def err_expected_semi_after_assert_contract : Error<
+  "expected ';' after assertion">;
 def err_expected_semi_after_method_proto : Error<
   "expected ';' after method prototype">;
 def err_expected_semi_after_namespace_name : Error<
   "expected ';' after namespace name">;
 def err_unexpected_namespace_attributes_alias : Error<
   "attributes cannot be specified on namespace alias">;
 def err_unexpected_nested_namespace_attribute : Error<
   "attributes cannot be specified on a nested namespace definition">;
def err_ms_property_duplicate_accessor : Error<
   "property declaration specifies '%0' accessor twice">;
 def err_ms_property_expected_accessor_name : Error<
   "expected name of accessor method">;
 def err_ms_property_expected_comma_or_rparen : Error<
   "expected ',' or ')' at end of property accessor list">;
 def err_ms_property_initializer : Error<
   "property declaration cannot have an in-class initializer">;
 
+// Contract Attributes
+def warn_cxx17_compat_contract_attributes: Warning<
+  "contract attributes are incompatible with C++ standards before C++2a">,
+  InGroup<CXXPre2aCompat>, DefaultIgnore;
+def ext_contract_attributes: ExtWarn<
+  "contract attributes are a C++2a extension">, InGroup<CXX2a>;
+def err_contract_attribute_needs_separate_list : Error<
+  "contract attributes must be the only member of their attribute list">;
+def err_contract_attribute_misplaced : Error<
+  "'%select{expects|ensures|assert}0' attribute is only allowed on "
+  "%select{a function type|a function type|an empty statement}0">;
+def err_unknown_contract_level : Error<
+  "unknown contract level %0">;
+def err_unknown_contract_level_suggest : Error<
+  "unknown contract level %0; did you mean %1?">;
+
 /// C++ Templates
 def err_expected_template : Error<"expected template">;
 def err_unknown_template_name : Error<
   "unknown template name %0">;
 def err_expected_comma_greater : Error<
   "expected ',' or '>' in template-parameter-list">;
 def err_class_on_template_template_param : Error<
   "template template parameter requires 'class' after the parameter list">;

include/clang/Basic/DiagnosticSemaKinds.td

def err_spaceship_argument_narrowing : Error<
   "%select{cannot be narrowed from type %1 to %2|"
   "evaluates to %1, which cannot be narrowed to type %2}0">;
 def err_std_compare_type_not_supported : Error<
   "standard library implementation of %0 is not supported; "
    "%select{member '%2' does not have expected form|"
    "member '%2' is missing|"
    "the type is not trivially copyable|"
    "the type does not have the expected form}1">;
+
+// Contract Attributes
+def err_friend_decl_with_contracts_redeclared : Error<
+  "friend declaration specifying contract conditions must be the only declaration">;
+def err_friend_decl_with_contracts_must_be_def : Error<
+  "friend declaration specifying contract conditions must be a definition">;
+def err_contract_attribute_nonfunc : Error<
+  "contract conditions can only be specified on a function declaration">;
+def err_contract_result_void : Error<
+  "cannot use a result identifier on a function that doesn't return a value">;
+def err_incompatible_contracts_on_redecl : Error<
+  "redeclaration of %0 with different contract conditions; either specify the "
+  "same contracts or omit them entirely">;
+def select_contract_type : TextSubstitution<
+  "%select{a regular|an auditing|an axiomatic}1 %select{pre|post}0condition">;
+def note_redecl_contract_type : Note<
+  "the %ordinal0 contract is %sub{select_contract_type}1,2">;
+def note_orig_contract_type : Note<
+  "whereas on the original declaration it's %sub{select_contract_type}0,1">;
+def note_redecl_contract_pred : Note<
+  "the predicate of the %ordinal0 contract">;
+def note_orig_contract_pred : Note<
+  "is different from the original declaration here">;
+def note_missing_contracts : Note<
+  "%select{original |re}0declaration has %plural{1:this|:these %1}1 "
+  "additional contract%s1">;
+
 } // end of sema component.

include/clang/Parse/Parser.h

 //
 //===----------------------------------------------------------------------===//
 
 #ifndef LLVM_CLANG_PARSE_PARSER_H
 #define LLVM_CLANG_PARSE_PARSER_H
 
 #include "clang/AST/Availability.h"
 #include "clang/Basic/BitmaskEnum.h"
+#include "clang/Basic/Contract.h"
 #include "clang/Basic/OpenMPKinds.h"
 #include "clang/Basic/OperatorPrecedence.h"
 #include "clang/Basic/Specifiers.h"
 #include "clang/Lex/CodeCompletionHandler.h"
 #include "clang/Lex/Preprocessor.h"
 #include "clang/Sema/DeclSpec.h"
 #include "clang/Sema/LoopHint.h"
 #include "clang/Sema/Sema.h"
class Parser : public CodeCompletionHandler {
   IdentifierInfo *Ident_language, *Ident_defined_in,
       *Ident_generated_declaration;
 
   /// C++0x contextual keywords.
   mutable IdentifierInfo *Ident_final;
   mutable IdentifierInfo *Ident_GNU_final;
   mutable IdentifierInfo *Ident_override;
 
+  // Contract kind identifiers.
+  mutable IdentifierInfo *Ident_expects;
+  mutable IdentifierInfo *Ident_ensures;
+  mutable IdentifierInfo *Ident_assert;
+
+  // Contract level identifiers.
+  // "default" is a regular keyword, so that isn't needed here.
+  mutable IdentifierInfo *Ident_audit;
+  mutable IdentifierInfo *Ident_axiom;
+
   // C++ type trait keywords that can be reverted to identifiers and still be
   // used as type traits.
   llvm::SmallDenseMap<IdentifierInfo *, tok::TokenKind> RevertibleTypeTraits;
 
   std::unique_ptr<PragmaHandler> AlignHandler;
   std::unique_ptr<PragmaHandler> GCCVisibilityHandler;
   std::unique_ptr<PragmaHandler> OptionsHandler;
   std::unique_ptr<PragmaHandler> PackHandler;
public:
   bool SkipUntil(ArrayRef<tok::TokenKind> Toks,
                  SkipUntilFlags Flags = static_cast<SkipUntilFlags>(0));
 
   /// SkipMalformedDecl - Read tokens until we get to some likely good stopping
   /// point for skipping past a simple-declaration.
   void SkipMalformedDecl();
 
 private:
+  class ContractsParseState;
+
   //===--------------------------------------------------------------------===//
   // Lexing and parsing of C++ inline methods.
 
   struct ParsingClass;
 
   /// [class.mem]p1: "... the class is regarded as complete within
   /// - function bodies
   /// - default arguments
struct LateParsedMethodDeclaration : public LateParsedDeclaration {
     /// have a default argument, but all of the parameters of the
     /// method will be stored so that they can be reintroduced into
     /// scope at the appropriate times.
     SmallVector<LateParsedDefaultArgument, 8> DefaultArgs;
 
     /// The set of tokens that make up an exception-specification that
     /// has not yet been parsed.
     std::unique_ptr<CachedTokens> ExceptionSpecTokens;
+
+    /// The sequence of tokens that make up the contract attributes that have
+    /// not yet been parsed.
+    std::unique_ptr<CachedTokens> ContractTokens;
   };
 
   /// LateParsedMemberInitializer - An initializer for a non-static class data
   /// member whose parsing must to be delayed until the class is completely
   /// defined (C++11 [class.mem]p2).
   struct LateParsedMemberInitializer : public LateParsedDeclaration {
     LateParsedMemberInitializer(Parser *P, Decl *FD)
       : Self(P), Field(FD) { }
private:
   };
   StmtResult
   ParseStatementOrDeclaration(StmtVector &Stmts, AllowedConstructsKind Allowed,
                               SourceLocation *TrailingElseLoc = nullptr);
   StmtResult ParseStatementOrDeclarationAfterAttributes(
                                          StmtVector &Stmts,
                                          AllowedConstructsKind Allowed,
                                          SourceLocation *TrailingElseLoc,
-                                         ParsedAttributesWithRange &Attrs);
+                                         ParsedAttributesWithRange &Attrs,
+                                         ContractsParseState *Contracts =
+                                                                 nullptr);
   StmtResult ParseExprStatement();
   StmtResult ParseLabeledStatement(ParsedAttributesWithRange &attrs);
   StmtResult ParseCaseStatement(bool MissingCase = false,
                                 ExprResult Expr = ExprResult());
   StmtResult ParseDefaultStatement();
   StmtResult ParseCompoundStatement(bool isStmtExpr = false);
   StmtResult ParseCompoundStatement(bool isStmtExpr,
                                     unsigned ScopeFlags);
private:
   IdentifierLoc *ParseIdentifierLoc();
 
   unsigned
   ParseClangAttributeArgs(IdentifierInfo *AttrName, SourceLocation AttrNameLoc,
                           ParsedAttributes &Attrs, SourceLocation *EndLoc,
                           IdentifierInfo *ScopeName, SourceLocation ScopeLoc,
                           ParsedAttr::Syntax Syntax);
 
-  void MaybeParseCXX11Attributes(Declarator &D) {
+  void MaybeParseCXX11Attributes(Declarator &D,
+                                 ContractsParseState *Contracts = nullptr) {
     if (standardAttributesAllowed() && isCXX11AttributeSpecifier()) {
       ParsedAttributesWithRange attrs(AttrFactory);
       SourceLocation endLoc;
-      ParseCXX11Attributes(attrs, &endLoc);
+      ParseCXX11Attributes(attrs, &endLoc, Contracts);
       D.takeAttributes(attrs, endLoc);
     }
   }
   void MaybeParseCXX11Attributes(ParsedAttributes &attrs,
-                                 SourceLocation *endLoc = nullptr) {
+                                 SourceLocation *endLoc = nullptr,
+                                 ContractsParseState *Contracts = nullptr) {
     if (standardAttributesAllowed() && isCXX11AttributeSpecifier()) {
       ParsedAttributesWithRange attrsWithRange(AttrFactory);
-      ParseCXX11Attributes(attrsWithRange, endLoc);
+      ParseCXX11Attributes(attrsWithRange, endLoc, Contracts);
       attrs.takeAllFrom(attrsWithRange);
     }
   }
   void MaybeParseCXX11Attributes(ParsedAttributesWithRange &attrs,
                                  SourceLocation *endLoc = nullptr,
-                                 bool OuterMightBeMessageSend = false) {
+                                 bool OuterMightBeMessageSend = false,
+                                 ContractsParseState *Contracts = nullptr) {
     if (standardAttributesAllowed() &&
         isCXX11AttributeSpecifier(false, OuterMightBeMessageSend))
-      ParseCXX11Attributes(attrs, endLoc);
+      ParseCXX11Attributes(attrs, endLoc, Contracts);
   }
 
   void ParseCXX11AttributeSpecifier(ParsedAttributes &attrs,
-                                    SourceLocation *EndLoc = nullptr);
+                                    SourceLocation *EndLoc = nullptr,
+                                    ContractsParseState *Contracts = nullptr);
   void ParseCXX11Attributes(ParsedAttributesWithRange &attrs,
-                            SourceLocation *EndLoc = nullptr);
+                            SourceLocation *EndLoc = nullptr,
+                            ContractsParseState *Contracts = nullptr);
+
   /// Parses a C++11 (or C2x)-style attribute argument list. Returns true
   /// if this results in adding an attribute to the ParsedAttributes list.
   bool ParseCXX11AttributeArgs(IdentifierInfo *AttrName,
                                SourceLocation AttrNameLoc,
                                ParsedAttributes &Attrs, SourceLocation *EndLoc,
                                IdentifierInfo *ScopeName,
                                SourceLocation ScopeLoc);
 
   IdentifierInfo *TryParseCXX11AttributeIdentifier(SourceLocation &Loc);
 
+  class ContractsParseState {
+    union {
+      /// List of successfully parsed contracts.
+      SmallVector<ContractResult, 4> Parsed;
+
+      /// Tokens that make up the contract attributes.
+      CachedTokens CachedToks;
+    };
+
+    /// Return type of the function that the contract applies to, if known.
+    QualType ResultType;
+
+    /// Whether the contracts we're parsing apply to a function or a statement.
+    bool IsParsingFunctionDecl;
+
+    /// Whether parsing of the contracts should be delayed.
+    /// This corresponds to the active member of the union.
+    bool Delayed;
+
+  public:
+    // Tags that can be used to select a constructor.
+    struct ParsingFunctionDecl {};
+    struct ParsingStmt {};
+
+    ContractsParseState(ParsingFunctionDecl, bool Delayed = false,
+                        QualType ResultType = QualType())
+        : ResultType(ResultType), IsParsingFunctionDecl(true),
+          Delayed(Delayed) {
+      // Construct the appropriate union member.
+      if (Delayed)
+        new (&CachedToks) decltype(CachedToks)();
+      else
+        new (&Parsed) decltype(Parsed)();
+    }
+
+    ContractsParseState(ParsingStmt)
+        : Parsed(), IsParsingFunctionDecl(false), Delayed(false) {}
+
+    ~ContractsParseState() {
+      // Destruct the appropriate union member.
+      if (Delayed)
+        CachedToks.~SmallVector();
+      else
+        Parsed.~SmallVector();
+    }
+
+    bool allowsKind(ContractKind Kind) const {
+      switch (Kind) {
+      case ContractKind::Expects: return IsParsingFunctionDecl;
+      case ContractKind::Ensures: return IsParsingFunctionDecl;
+      case ContractKind::Assert:  return !IsParsingFunctionDecl;
+      }
+    }
+
+    QualType getResultType() const { return ResultType; }
+    bool delayParsing() const { return Delayed; }
+
+    decltype(Parsed) &getParsedList() & {
+      assert(!delayParsing() && "Wrong list!");
+      return Parsed;
+    }
+    decltype(CachedToks) &getCachedTokens() & {
+      assert(delayParsing() && "Wrong list!");
+      return CachedToks;
+    }
+  };
+  Optional<ContractKind> isContractKind(const Token &Tok) const;
+  Optional<ContractLevel> isContractLevel(const Token &Tok) const;
+  bool UserProbablyMeantContractLevel(ContractKind Kind);
+  void ParseContractAttributeSpecifier(ContractsParseState *Contracts);
+  bool MaybeDiagnoseAssertWithoutSemi(ContractsParseState *Contracts);
+
   void MaybeParseMicrosoftAttributes(ParsedAttributes &attrs,
                                      SourceLocation *endLoc = nullptr) {
     if (getLangOpts().MicrosoftExt && Tok.is(tok::l_square))
       ParseMicrosoftAttributes(attrs, endLoc);
   }
   void ParseMicrosoftUuidAttributeArgs(ParsedAttributes &Attrs);
   void ParseMicrosoftAttributes(ParsedAttributes &attrs,
                                 SourceLocation *endLoc = nullptr);

include/clang/Sema/DeclSpec.h

struct FunctionTypeInfo {
     /// declarator.
     unsigned NumParams;
 
     /// NumExceptionsOrDecls - This is the number of types in the
     /// dynamic-exception-decl, if the function has one. In C, this is the
     /// number of declarations in the function prototype.
     unsigned NumExceptionsOrDecls;
 
+    /// Number of parsed contract attributes attached to this declarator.
+    /// If this is zero, then we \e might be storing cached tokens for delayed
+    /// parsing; the cache pointer may be null if there're no contracts at all.
+    unsigned NumParsedContracts;
+
     /// The location of the ref-qualifier, if any.
     ///
     /// If this is an invalid location, there is no ref-qualifier.
     unsigned RefQualifierLoc;
 
     /// The location of the const-qualifier, if any.
     ///
     /// If this is an invalid location, there is no const-qualifier.
union {
       CachedTokens *ExceptionSpecTokens;
 
       /// Pointer to a new[]'d array of declarations that need to be available
       /// for lookup inside the function body, if one exists. Does not exist in
       /// C++.
       NamedDecl **DeclsInPrototype;
     };
 
+    union {
+      /// Pointer to a new[]'d array of contracts.
+      ContractAttr **ParsedContracts;
+
+      /// Pointer to a new'd cache of contract tokens for late parsing.
+      CachedTokens *ContractTokens;
+    };
+
     /// If HasTrailingReturnType is true, this is the trailing return
     /// type specified.
     UnionParsedType TrailingReturnType;
 
     /// Reset the parameter list to having zero parameters.
     ///
     /// This is used in various places for error recovery.
     void freeParams() {
void destroy() {
       case EST_Unparsed:
         delete ExceptionSpecTokens;
         break;
       case EST_None:
         if (NumExceptionsOrDecls != 0)
           delete[] DeclsInPrototype;
         break;
       }
+      if (NumParsedContracts)
+        delete[] ParsedContracts;
+      else if (ContractTokens)
+        delete ContractTokens;
     }
 
     /// isKNRPrototype - Return true if this is a K&R style identifier list,
     /// like "void foo(a,b,c)".  In a function definition, this will be followed
     /// by the parameter type definitions.
     bool isKNRPrototype() const { return !hasPrototype && NumParams != 0; }
 
     SourceLocation getLParenLoc() const {
static DeclaratorChunk getFunction(bool HasProto,
                                      unsigned NumExceptions,
                                      Expr *NoexceptExpr,
                                      CachedTokens *ExceptionSpecTokens,
                                      ArrayRef<NamedDecl *> DeclsInPrototype,
                                      SourceLocation LocalRangeBegin,
                                      SourceLocation LocalRangeEnd,
                                      Declarator &TheDeclarator,
                                      TypeResult TrailingReturnType =
-                                                    TypeResult());
+                                                    TypeResult(),
+                                     ArrayRef<ContractResult> ParsedContracts =
+                                                                  None,
+                                     CachedTokens *ContractTokens = nullptr);
 
   /// Return a DeclaratorChunk for a block.
   static DeclaratorChunk getBlockPointer(unsigned TypeQuals,
                                          SourceLocation Loc) {
     DeclaratorChunk I;
     I.Kind          = BlockPointer;
     I.Loc           = Loc;
     I.Cls.TypeQuals = TypeQuals;

include/clang/Sema/DelayedDiagnostic.h

static DelayedDiagnostic makeAvailability(AvailabilityResult AR,
                                             const NamedDecl *ReferringDecl,
                                             const NamedDecl *OffendingDecl,
                                             const ObjCInterfaceDecl *UnknownObjCClass,
                                             const ObjCPropertyDecl  *ObjCProperty,
                                             StringRef Msg,
                                             bool ObjCPropertyAccess);
 
   static DelayedDiagnostic makeAccess(SourceLocation Loc,
-                                      const AccessedEntity &Entity) {
+                                      const AccessedEntity &Entity,
+                                      bool FromContractCondition) {
     DelayedDiagnostic DD;
     DD.Kind = Access;
     DD.Triggered = false;
     DD.Loc = Loc;
-    new (&DD.getAccessData()) AccessedEntity(Entity);
+    new (DD.AccessControlData.AccessData) AccessedEntity(Entity);
+    DD.AccessControlData.FromContractCondition = FromContractCondition;
     return DD;
   }
 
   static DelayedDiagnostic makeForbiddenType(SourceLocation loc,
                                              unsigned diagnostic,
                                              QualType type,
                                              unsigned argument) {
     DelayedDiagnostic DD;
     DD.Kind = ForbiddenType;
     DD.Triggered = false;
     DD.Loc = loc;
     DD.ForbiddenTypeData.Diagnostic = diagnostic;
     DD.ForbiddenTypeData.OperandType = type.getAsOpaquePtr();
     DD.ForbiddenTypeData.Argument = argument;
     return DD;
   }
 
   AccessedEntity &getAccessData() {
-    assert(Kind == Access && "Not an access diagnostic.");
-    return *reinterpret_cast<AccessedEntity*>(AccessData);
+    return const_cast<AccessedEntity &>(
+               const_cast<const DelayedDiagnostic *>(this)->getAccessData());
   }
   const AccessedEntity &getAccessData() const {
     assert(Kind == Access && "Not an access diagnostic.");
-    return *reinterpret_cast<const AccessedEntity*>(AccessData);
+    return *reinterpret_cast<const AccessedEntity *>(
+                AccessControlData.AccessData);
+  }
+
+  /// Whether the entity is being accessed from the predicate of a contract
+  /// condition.
+  bool isFromContractCondition() const {
+    assert(Kind == Access && "Not an access diagnostic.");
+    return AccessControlData.FromContractCondition;
   }
 
   const NamedDecl *getAvailabilityReferringDecl() const {
     assert(Kind == Availability && "Not an availability diagnostic.");
     return AvailabilityData.ReferringDecl;
   }
 
   const NamedDecl *getAvailabilityOffendingDecl() const {
const ObjCPropertyDecl *getObjCProperty() const {
     return AvailabilityData.ObjCProperty;
   }
 
   bool getObjCPropertyAccess() const {
     return AvailabilityData.ObjCPropertyAccess;
   }
 
 private:
+  struct ACD {
+    alignas(AccessedEntity) char AccessData[sizeof(AccessedEntity)];
+    bool FromContractCondition;
+  };
+
   struct AD {
     const NamedDecl *ReferringDecl;
     const NamedDecl *OffendingDecl;
     const ObjCInterfaceDecl *UnknownObjCClass;
     const ObjCPropertyDecl  *ObjCProperty;
     const char *Message;
     size_t MessageLen;
     SourceLocation *SelectorLocs;
     size_t NumSelectorLocs;
     AvailabilityResult AR;
     bool ObjCPropertyAccess;
   };
 
   struct FTD {
     unsigned Diagnostic;
     unsigned Argument;
     void *OperandType;
   };
 
   union {
+    struct ACD AccessControlData;
     struct AD AvailabilityData;
     struct FTD ForbiddenTypeData;
-
-    /// Access control.
-    char AccessData[sizeof(AccessedEntity)];
   };
 };
 
 /// A collection of diagnostics which were delayed.
 class DelayedDiagnosticPool {
   const DelayedDiagnosticPool *Parent;
   SmallVector<DelayedDiagnostic, 4> Diagnostics;
 

include/clang/Sema/Ownership.h

 #include <cstdint>
 
 //===----------------------------------------------------------------------===//
 // OpaquePtr
 //===----------------------------------------------------------------------===//
 
 namespace clang {
 
+class ContractAttr;
 class CXXBaseSpecifier;
 class CXXCtorInitializer;
 class Decl;
 class Expr;
 class ParsedTemplateArgument;
 class QualType;
 class Stmt;
 class TemplateName;
template<> struct IsResultPtrLowBitFree<Stmt*> {
     static const bool value = true;
   };
   template<> struct IsResultPtrLowBitFree<CXXBaseSpecifier*> {
     static const bool value = true;
   };
   template<> struct IsResultPtrLowBitFree<CXXCtorInitializer*> {
     static const bool value = true;
   };
+  template<> struct IsResultPtrLowBitFree<ContractAttr*> {
+    static const bool value = true;
+  };
 
   using ExprResult = ActionResult<Expr *>;
   using StmtResult = ActionResult<Stmt *>;
   using TypeResult = ActionResult<ParsedType>;
   using BaseResult = ActionResult<CXXBaseSpecifier *>;
   using MemInitResult = ActionResult<CXXCtorInitializer *>;
+  using ContractResult = ActionResult<ContractAttr *>;
 
   using DeclResult = ActionResult<Decl *>;
   using ParsedTemplateTy = OpaquePtr<TemplateName>;
   using UnionParsedTemplateTy = UnionOpaquePtr<TemplateName>;
 
   using MultiExprArg = MutableArrayRef<Expr *>;
   using MultiStmtArg = MutableArrayRef<Stmt *>;
   using ASTTemplateArgsPtr = MutableArrayRef<ParsedTemplateArgument>;

include/clang/Sema/Scope.h

enum ScopeFlags {
     /// We are currently in the filter expression of an SEH except block.
     SEHFilterScope = 0x200000,
 
     /// This is a compound statement scope.
     CompoundStmtScope = 0x400000,
 
     /// We are between inheritance colon and the real class/struct definition scope.
     ClassInheritanceScope = 0x800000,
+
+    /// We are between the opening and closing bracket of a contract attribute.
+    ContractAttributeScope = 0x1000000,
   };
 
 private:
   /// The parent scope for this scope.  This is null for the translation-unit
   /// scope.
   Scope *AnyParent;
 
   /// Flags - This contains a set of ScopeFlags, which indicates how the scope
public:
   /// Determine whether this scope is a SEH '__except' block.
   bool isSEHExceptScope() const { return getFlags() & Scope::SEHExceptScope; }
 
   /// Determine whether this scope is a compound statement scope.
   bool isCompoundStmtScope() const {
     return getFlags() & Scope::CompoundStmtScope;
   }
 
+  /// Determine whether this scope is a contract attribute scope.
+  bool isContractAttributeScope() const {
+    return getFlags() & Scope::ContractAttributeScope;
+  }
+
   /// Returns if rhs has a higher scope depth than this.
   ///
   /// The caller is responsible for calling this only if one of the two scopes
   /// is an ancestor of the other.
   bool Contains(const Scope& rhs) const { return Depth < rhs.Depth; }
 
   /// containedInPrototypeScope - Return true if this or a parent scope
   /// is a FunctionPrototypeScope.

include/clang/Sema/Sema.h

 #include "clang/AST/ExternalASTSource.h"
 #include "clang/AST/LocInfoType.h"
 #include "clang/AST/MangleNumberingContext.h"
 #include "clang/AST/NSAPI.h"
 #include "clang/AST/PrettyPrinter.h"
 #include "clang/AST/StmtCXX.h"
 #include "clang/AST/TypeLoc.h"
 #include "clang/AST/TypeOrdering.h"
+#include "clang/Basic/Contract.h"
 #include "clang/Basic/ExpressionTraits.h"
 #include "clang/Basic/Module.h"
 #include "clang/Basic/OpenMPKinds.h"
 #include "clang/Basic/PragmaKinds.h"
 #include "clang/Basic/Specifiers.h"
 #include "clang/Basic/TemplateKinds.h"
 #include "clang/Basic/TypeTraits.h"
 #include "clang/Sema/AnalysisBasedWarnings.h"

 namespace clang {
   class ADLResult;
   class ASTConsumer;
   class ASTContext;
   class ASTMutationListener;
   class ASTReader;
   class ASTWriter;
   class ArrayType;
+  class AssertContract;
   class ParsedAttr;
   class BindingDecl;
   class BlockDecl;
   class CapturedDecl;
+  class ContractAttr;
   class CXXBasePath;
   class CXXBasePaths;
   class CXXBindTemporaryExpr;
   typedef SmallVector<CXXBaseSpecifier*, 4> CXXCastPath;
   class CXXConstructorDecl;
   class CXXConversionDecl;
   class CXXDeleteExpr;
   class CXXDestructorDecl;
namespace clang {
   class LangOptions;
   class LocalInstantiationScope;
   class LookupResult;
   class MacroInfo;
   typedef ArrayRef<std::pair<IdentifierInfo *, SourceLocation>> ModuleIdPath;
   class ModuleLoader;
   class MultiLevelTemplateArgumentList;
   class NamedDecl;
+  class NullStmt;
   class ObjCCategoryDecl;
   class ObjCCategoryImplDecl;
   class ObjCCompatibleAliasDecl;
   class ObjCContainerDecl;
   class ObjCImplDecl;
   class ObjCImplementationDecl;
   class ObjCInterfaceDecl;
   class ObjCIvarDecl;
public:
   /// \param DC - The DeclContext containing the lambda expression or
   /// block literal.
   /// \param[out] ManglingContextDecl - Returns the ManglingContextDecl
   /// associated with the context, if relevant.
   MangleNumberingContext *getCurrentMangleNumberContext(
     const DeclContext *DC,
     Decl *&ManglingContextDecl);
 
+  /// Whether we're currently analysing the predicate of a contract condition
+  /// (i.e. a precondition or postcondition). We need to keep track of this
+  /// because they have additional access restrictions that we need to enforce.
+  ///
+  /// \warning
+  ///   Don't modify this directly; use \c EnterContractPredicateRAII to ensure
+  ///   that the state is tracked correctly.
+  bool InContractConditionPredicate = false;
+
+  /// Note that we're analysing a contract predicate.
+  class EnterContractPredicateRAII {
+    Sema &S;
+    bool Entered;
+
+    /// Previous value of \c Sema::InContractConditionPredicate.
+    bool OldInContractConditionPredicate;
+
+  public:
+    EnterContractPredicateRAII(Sema &S, ContractKind K);
+    void Exit();
+    ~EnterContractPredicateRAII() { Exit(); }
+  };
 
   /// SpecialMemberOverloadResult - The overloading result for a special member
   /// function.
   ///
   /// This is basically a wrapper around PointerIntPair. The lowest bits of the
   /// integer are used to determine whether overload resolution succeeded.
   class SpecialMemberOverloadResult {
   public:

   /// that best represents the call.
   bool CheckCallReturnType(QualType ReturnType, SourceLocation Loc,
                            CallExpr *CE, FunctionDecl *FD);
 
   /// Helpers for dealing with blocks and functions.
   bool CheckParmsForFunctionDef(ArrayRef<ParmVarDecl *> Parameters,
                                 bool CheckParameterNames);
   void CheckCXXDefaultArguments(FunctionDecl *FD);
-  void CheckExtraCXXDefaultArguments(Declarator &D);
+  void CheckCXXNonDeclFunctionRestrictions(Declarator &D);
   Scope *getNonFieldDeclScope(Scope *S);
 
   /// \name Name lookup
   ///
   /// These routines provide name lookup that is used during semantic
   /// analysis to resolve the various kinds of names (identifiers,
   /// overloaded operator names, constructor names, etc.) into zero or
   /// more declarations within a particular scope. The major entry
ExprResult FE =
                           /*DiscardedValue*/ true);
     return FullExprArg(FE.get());
   }
 
   StmtResult ActOnExprStmt(ExprResult Arg);
   StmtResult ActOnExprStmtError();
 
   StmtResult ActOnNullStmt(SourceLocation SemiLoc,
-                           bool HasLeadingEmptyMacro = false);
+                           bool HasLeadingEmptyMacro = false,
+                           ArrayRef<ContractResult> Assertions = None);
+
+  StmtResult BuildNullStmt(SourceLocation SemiLoc, bool HasLeadingEmptyMacro,
+                           ArrayRef<AssertContract *> Assertions);
 
   void ActOnStartOfCompoundStmt(bool IsStmtExpr);
   void ActOnFinishOfCompoundStmt();
   StmtResult ActOnCompoundStmt(SourceLocation L, SourceLocation R,
                                ArrayRef<Stmt *> Elts, bool isStmtExpr);
 
   /// A RAII object to enter scope of a compound statement.
   class CompoundScopeRAII {
DeduceAutoType(TypeSourceInfo *AutoType, Expr *&Initializer, QualType &Result,
                  Optional<unsigned> DependentDeductionDepth = None);
   DeduceAutoResult
   DeduceAutoType(TypeLoc AutoTypeLoc, Expr *&Initializer, QualType &Result,
                  Optional<unsigned> DependentDeductionDepth = None);
   void DiagnoseAutoDeductionFailure(VarDecl *VDecl, Expr *Init);
   bool DeduceReturnType(FunctionDecl *FD, SourceLocation Loc,
                         bool Diagnose = true);
 
+  void AdjustDeducedFunctionResultType(FunctionDecl *FD, QualType ResultType);
+
   /// Declare implicit deduction guides for a class template if we've
   /// not already done so.
   void DeclareImplicitDeductionGuides(TemplateDecl *Template,
                                       SourceLocation Loc);
 
   QualType DeduceTemplateSpecializationFromInitializer(
       TypeSourceInfo *TInfo, const InitializedEntity &Entity,
       const InitializationKind &Kind, MultiExprArg Init);

   bool SubstParmTypes(SourceLocation Loc, ArrayRef<ParmVarDecl *> Params,
                       const FunctionProtoType::ExtParameterInfo *ExtParamInfos,
                       const MultiLevelTemplateArgumentList &TemplateArgs,
                       SmallVectorImpl<QualType> &ParamTypes,
                       SmallVectorImpl<ParmVarDecl *> *OutParams,
                       ExtParameterInfoBuilder &ParamInfos);
   ExprResult SubstExpr(Expr *E,
                        const MultiLevelTemplateArgumentList &TemplateArgs);
+  bool SubstContracts(FunctionDecl *New, const FunctionDecl *Tmpl,
+                      const MultiLevelTemplateArgumentList &TemplateArgs);
 
   /// Substitute the given template arguments into a list of
   /// expressions, expanding pack expansions if required.
   ///
   /// \param Exprs The list of expressions to substitute into.
   ///
   /// \param IsCall Whether this is some form of call, in which case
   /// default arguments will be dropped.

   StmtResult BuildCoroutineBodyStmt(CoroutineBodyStmt::CtorArgs);
   bool buildCoroutineParameterMoves(SourceLocation Loc);
   VarDecl *buildCoroutinePromise(SourceLocation Loc);
   void CheckCompletedCoroutineBody(FunctionDecl *FD, Stmt *&Body);
   ClassTemplateDecl *lookupCoroutineTraits(SourceLocation KwLoc,
                                            SourceLocation FuncLoc);
 
   //===--------------------------------------------------------------------===//
+  // C++ Contract Attributes
+  //
+
+  TypoCorrection CorrectTypoInContractLevel(IdentifierInfo *GivenIdent,
+                                            SourceLocation GivenLoc);
+
+  DeclResult ActOnContractResultIdentifier(IdentifierInfo *Id,
+                                           SourceLocation IdLoc,
+                                           QualType ResultType = QualType());
+
+  ContractResult ActOnContractAttribute(SourceRange Range,
+                                        ContractKind Kind,
+                                        SourceLocation KindLoc,
+                                        ContractLevel Level,
+                                        SourceLocation LevelLoc,
+                                        DeclResult ResultVar,
+                                        SourceLocation ColonLoc,
+                                        ConditionResult Predicate);
+
+  ContractResult BuildContractAttribute(SourceRange Range,
+                                        ContractKind Kind,
+                                        SourceLocation KindLoc,
+                                        ContractLevel Level,
+                                        SourceLocation LevelLoc,
+                                        VarDecl *ResultVar,
+                                        SourceLocation ColonLoc,
+                                        Expr *Predicate);
+
+  void ActOnDelayedContractAttributes(ArrayRef<ContractResult> Contracts,
+                                      FunctionDecl *Method);
+
+  bool ValidateContractResultVariable(const VarDecl *VD);
+
+  void AttachContractsToFunctionDecl(ArrayRef<ContractAttr *> Contracts,
+                                     FunctionDecl *FD);
+
+  bool UpdateFunctionContractsWithNewResultType(FunctionDecl *FD);
+
+  bool MergeContractsOnFunctionRedecl(FunctionDecl *New, FunctionDecl *Old);
+
+  //===--------------------------------------------------------------------===//
   // OpenCL extensions.
   //
 private:
   std::string CurrOpenCLExtension;
   /// Extensions required by an OpenCL type.
   llvm::DenseMap<const Type*, std::set<std::string>> OpenCLTypeExtMap;
   /// Extensions required by an OpenCL declaration.
   llvm::DenseMap<const Decl*, std::set<std::string>> OpenCLDeclExtMap;

lib/AST/AttrContract.cpp

+//===--- AttrContract.cpp - Classes for representing contracts --*- C++ -*-===//
+//
+//                     The LLVM Compiler Infrastructure
+//
+// This file is distributed under the University of Illinois Open Source
+// License. See LICENSE.TXT for details.
+//
+//===----------------------------------------------------------------------===//
+
+#include "clang/AST/AttrContract.h"
+#include "clang/AST/Decl.h"
+#include "clang/AST/Expr.h"
+#include "llvm/ADT/StringRef.h"
+#include "llvm/Support/raw_ostream.h"
+
+using namespace clang;
+
+static StringRef toString(ContractKind K) {
+  switch (K) {
+  case ContractKind::Expects: return "expects";
+  case ContractKind::Ensures: return "ensures";
+  case ContractKind::Assert:  return "assert";
+  }
+}
+
+static StringRef toString(ContractLevel L) {
+  switch (L) {
+  case ContractLevel::Default: return "default";
+  case ContractLevel::Audit:   return "audit";
+  case ContractLevel::Axiom:   return "axiom";
+  }
+}
+
+void ContractAttr::printPretty(raw_ostream &OS,
+                               const PrintingPolicy &Policy) const {
+  OS << "[[";
+
+  OS << toString(getKind());
+
+  if (getLevelLoc().isValid()) {
+    OS << ' ' << toString(getLevel());
+  } else {
+    assert(getLevel() == ContractLevel::Default &&
+           "Non-default contract level should have a source location");
+  }
+
+  if (auto *Ensures = dyn_cast<EnsuresContract>(this)) {
+    if (Ensures->getResultVar())
+      OS << ' ' << Ensures->getResultVar()->getName();
+  }
+
+  OS << ": ";
+  getPredicate()->printPretty(OS, nullptr, Policy);
+
+  OS << "]]";
+}

lib/AST/CMakeLists.txt

 set(LLVM_LINK_COMPONENTS
   BinaryFormat
   Support
   )
 
 add_clang_library(clangAST
   APValue.cpp
   ASTConsumer.cpp
   ASTContext.cpp
   ASTDiagnostic.cpp
   ASTDumper.cpp
   ASTImporter.cpp
   ASTStructuralEquivalence.cpp
   ASTTypeTraits.cpp
+  AttrContract.cpp
   AttrImpl.cpp
   CXXInheritance.cpp
   Comment.cpp
   CommentBriefParser.cpp
   CommentCommandTraits.cpp
   CommentLexer.cpp
   CommentParser.cpp
   CommentSema.cpp

lib/AST/Decl.cpp

 //
 //===----------------------------------------------------------------------===//
 
 #include "clang/AST/Decl.h"
 #include "Linkage.h"
 #include "clang/AST/ASTContext.h"
 #include "clang/AST/ASTLambda.h"
 #include "clang/AST/ASTMutationListener.h"
+#include "clang/AST/AttrContract.h"
 #include "clang/AST/CanonicalType.h"
 #include "clang/AST/DeclBase.h"
 #include "clang/AST/DeclCXX.h"
 #include "clang/AST/DeclObjC.h"
 #include "clang/AST/DeclOpenMP.h"
 #include "clang/AST/DeclTemplate.h"
 #include "clang/AST/DeclarationName.h"
 #include "clang/AST/Expr.h"
void FunctionDecl::setParams(ASTContext &C,
 
   // Zero params -> null pointer.
   if (!NewParamInfo.empty()) {
     ParamInfo = new (C) ParmVarDecl*[NewParamInfo.size()];
     std::copy(NewParamInfo.begin(), NewParamInfo.end(), ParamInfo);
   }
 }
 
+void FunctionDecl::setContracts(ASTContext &C,
+                                ArrayRef<ContractAttr *> NewContracts) {
+  assert(!Contracts && "Already have contracts!");
+  assert(llvm::none_of(NewContracts, isa<AssertContract, ContractAttr *>) &&
+         "Cannot apply assertion contracts to a function");
+
+  if (!NewContracts.empty()) {
+    Contracts = new (C) ContractAttr*[NewContracts.size()];
+    NumContracts = NewContracts.size();
+    llvm::copy(NewContracts, Contracts);
+  }
+}
+
 /// getMinRequiredArguments - Returns the minimum number of arguments
 /// needed to call this function. This may be fewer than the number of
 /// function parameters, if some of the parameters have default
 /// arguments (in C++) or are parameter packs (C++11).
 unsigned FunctionDecl::getMinRequiredArguments() const {
   if (!getASTContext().getLangOpts().CPlusPlus)
     return getNumParams();
 

lib/AST/DeclPrinter.cpp

 //===--- DeclPrinter.cpp - Printing implementation for Decl ASTs ----------===//
 //
 //                     The LLVM Compiler Infrastructure
 //
 // This file is distributed under the University of Illinois Open Source
 // License. See LICENSE.TXT for details.
 //
 //===----------------------------------------------------------------------===//
 //
 // This file implements the Decl::print method, which pretty prints the
 // AST back out to C/Objective-C/C++/Objective-C++ code.
 //
 //===----------------------------------------------------------------------===//
 #include "clang/AST/ASTContext.h"
 #include "clang/AST/Attr.h"
+#include "clang/AST/AttrContract.h"
 #include "clang/AST/Decl.h"
 #include "clang/AST/DeclCXX.h"
 #include "clang/AST/DeclObjC.h"
 #include "clang/AST/DeclVisitor.h"
 #include "clang/AST/Expr.h"
 #include "clang/AST/ExprCXX.h"
 #include "clang/AST/PrettyPrinter.h"
 #include "clang/Basic/Module.h"
if (const FunctionType *AFT = Ty->getAs<FunctionType>()) {
     }
     Out << Proto;
   } else {
     Ty.print(Out, Policy, Proto);
   }
 
   prettyPrintAttributes(D);
 
+  const bool PrintContracts = !D->hasInheritedContracts() &&
+                              !D->contracts().empty();
+  if (PrintContracts) {
+    Indentation += Policy.Indentation;
+    for (const ContractAttr *Contract : D->contracts()) {
+      Out << '\n';
+      Indent();
+      Contract->printPretty(Out, Policy);
+    }
+    Indentation -= Policy.Indentation;
+  }
+
   if (D->isPure())
     Out << " = 0";
   else if (D->isDeletedAsWritten())
     Out << " = delete";
   else if (D->isExplicitlyDefaulted())
     Out << " = default";
   else if (D->doesThisDeclarationHaveABody()) {
     if (!Policy.TerseOutput) {
       if (!D->hasPrototype() && D->getNumParams()) {
         // This is a K&R function definition, so we need to print the
         // parameters.
         Out << '\n';
         DeclPrinter ParamPrinter(Out, SubPolicy, Context, Indentation);
         Indentation += Policy.Indentation;
         for (unsigned i = 0, e = D->getNumParams(); i != e; ++i) {
           Indent();
           ParamPrinter.VisitParmVarDecl(D->getParamDecl(i));
           Out << ";\n";
         }
         Indentation -= Policy.Indentation;
+      } else if (PrintContracts) {
+        // Newline between the last contract and the opening brace.
+        Out << '\n';
       } else
         Out << ' ';
 
       if (D->getBody())
         D->getBody()->printPretty(Out, nullptr, SubPolicy, Indentation);
     } else {
       if (!Policy.TerseOutput && isa<CXXConstructorDecl>(*D))
         Out << " {}";

lib/AST/ExprConstant.cpp

 // expression is not necessarily non-constant).
 //
 //===----------------------------------------------------------------------===//
 
 #include "clang/AST/APValue.h"
 #include "clang/AST/ASTContext.h"
 #include "clang/AST/ASTDiagnostic.h"
 #include "clang/AST/ASTLambda.h"
+#include "clang/AST/AttrContract.h"
 #include "clang/AST/CharUnits.h"
 #include "clang/AST/Expr.h"
 #include "clang/AST/RecordLayout.h"
 #include "clang/AST/StmtVisitor.h"
 #include "clang/AST/TypeLoc.h"
 #include "clang/Basic/Builtins.h"
 #include "clang/Basic/TargetInfo.h"
+#include "llvm/Support/CastingIterators.h"
 #include "llvm/Support/raw_ostream.h"
 #include <cstring>
 #include <functional>
 
 #define DEBUG_TYPE "exprconstant"
 
 using namespace clang;
 using llvm::APSInt;
struct CallStackFrame {
 
     /// This - The binding for the this pointer in this call, if any.
     const LValue *This;
 
     /// Arguments - Parameter bindings for this function call, indexed by
     /// parameters' function scope indices.
     APValue *Arguments;
 
+    /// Result of this function call.
+    /// This should be set after a successful return.
+    APValue *ResultValue = nullptr;
+
     // Note that we intentionally use std::map here so that references to
     // values are stable.
     typedef std::pair<const void *, unsigned> MapKeyTy;
     typedef std::map<MapKeyTy, APValue> MapTy;
     /// Temporaries - Temporary lvalues materialized within this stack frame.
     MapTy Temporaries;
 
     /// CallLoc - The location of the call expression for this call.
if (const ParmVarDecl *PVD = dyn_cast<ParmVarDecl>(VD)) {
     if (!Frame || !Frame->Arguments) {
       Info.FFDiag(E, diag::note_invalid_subexpr_in_const_expr);
       return false;
     }
     Result = &Frame->Arguments[PVD->getFunctionScopeIndex()];
     return true;
   }
 
+  // If this is result identifier introduced by a postcondition contract, get
+  // the result value of the current function call.
+  if (VD->isContractFunctionResult()) {
+    assert(Frame && Frame->ResultValue &&
+           "Trying to evaluate a postcondition variable but the current frame "
+           "doesn't have a result. Either we're trying to check the result of "
+           "a void function or the postcondtions are being executed before the "
+           "function has returned");
+    Result = Frame->ResultValue;
+    return true;
+  }
+
   // If this is a local variable, dig out its value.
   if (Frame) {
     Result = LVal ? Frame->getTemporary(VD, LVal->getLValueVersion())
                   : Frame->getCurrentTemporary(VD);
     if (!Result) {
       // Assume variables referenced within a lambda's call operator that were
       // not declared within the call operator are captures and during checking
       // of a potential constant expression, assume they are unknown constant

 static bool EvaluateCond(EvalInfo &Info, const VarDecl *CondDecl,
                          const Expr *Cond, bool &Result) {
   FullExpressionRAII Scope(Info);
   if (CondDecl && !EvaluateDecl(Info, CondDecl))
     return false;
   return EvaluateAsBooleanCondition(Cond, Result, Info);
 }
 
+/// Evaluate a contract attribute.
+/// \return true if the evaluation succeeded and the predicate returned true.
+static bool EvaluateContract(EvalInfo &Info, const ContractAttr *C) {
+  // TODO: Skip contracts that aren't checked in the current build level.
+
+  // Evaluate the predicate.
+  bool PredResult;
+  if (!EvaluateCond(Info, nullptr, C->getPredicate(), PredResult))
+    return false;
+
+  // C++2a [expr.const]p2:
+  //   An expression e is a core constant expression unless [...]:
+  //     [...]
+  //     - a checked contract whose predicate evaluates to false;
+  //     [...]
+  if (!PredResult) {
+    Info.CCEDiag(C->getPredicate(), diag::note_constexpr_contract_failed)
+      << static_cast<int>(C->getKind())
+      << Info.checkingPotentialConstantExpression();
+  }
+
+  return PredResult;
+}
+
 namespace {
 /// A location where the result (returned value) of evaluating a
 /// statement should be stored.
 struct StmtResult {
   /// The APValue that should be filled in with the returned value.
   APValue &Value;
   /// The location containing the result, if any (used to support RVO).
   const LValue *Slot;
if (const Expr *E = dyn_cast<Expr>(S)) {
       if (!EvaluateIgnoredValue(Info, E))
         return ESR_Failed;
       return ESR_Succeeded;
     }
 
     Info.FFDiag(S->getBeginLoc());
     return ESR_Failed;
 
-  case Stmt::NullStmtClass:
-    return ESR_Succeeded;
+  case Stmt::NullStmtClass: {
+    const bool Ok = llvm::all_of(cast<NullStmt>(S)->assertions(),
+                                 [&Info](const AssertContract *C) {
+      return EvaluateContract(Info, C);
+    });
+    return Ok ? ESR_Succeeded : ESR_Failed;
+  }
 
   case Stmt::DeclStmtClass: {
     const DeclStmt *DS = cast<DeclStmt>(S);
     for (const auto *DclIt : DS->decls()) {
       // Each declaration initialization is its own full-expression.
       // FIXME: This isn't quite right; if we're performing aggregate
       // initialization, each braced subexpression is its own full-expression.
       FullExpressionRAII Scope(Info);
if (!Evaluate(ArgValues[I - Args.begin()], Info, *I)) {
       if (!Info.noteFailure())
         return false;
       Success = false;
     }
   }
   return Success;
 }
 
+static bool EvaluatePreconditions(ArrayRef<const ContractAttr *> Contracts,
+                                  EvalInfo &Info) {
+  return llvm::all_of(llvm::make_dyn_cast_range<ExpectsContract>(Contracts),
+                      [&Info](const ExpectsContract *C) {
+    return EvaluateContract(Info, C);
+  });
+}
+
+static bool EvaluatePostconditions(ArrayRef<const ContractAttr *> Contracts,
+                                   EvalInfo &Info) {
+  return llvm::all_of(llvm::make_dyn_cast_range<EnsuresContract>(Contracts),
+                      [&Info](const EnsuresContract *C) {
+    return EvaluateContract(Info, C);
+  });
+}
+
 /// Evaluate a function call.
 static bool HandleFunctionCall(SourceLocation CallLoc,
                                const FunctionDecl *Callee, const LValue *This,
                                ArrayRef<const Expr*> Args, const Stmt *Body,
                                EvalInfo &Info, APValue &Result,
                                const LValue *ResultSlot) {
   ArgVector ArgValues(Args.size());
   if (!EvaluateArgs(Args, ArgValues, Info))
     return false;
 
   if (!Info.CheckCallLimit(CallLoc))
     return false;
 
   CallStackFrame Frame(Info, CallLoc, Callee, This, ArgValues.data());
 
+  if (!EvaluatePreconditions(Callee->contracts(), Info))
+    return false;
+
   // For a trivial copy or move assignment, perform an APValue copy. This is
   // essential for unions, where the operations performed by the assignment
   // operator cannot be represented as statements.
   //
   // Skip this for non-union classes with no fields; in that case, the defaulted
   // copy/move does not actually read the object.
   const CXXMethodDecl *MD = dyn_cast<CXXMethodDecl>(Callee);
   if (MD && MD->isDefaulted() &&
if (MD && MD->isDefaulted() &&
     // case. But since we don't need the captures to constexpr check, we can
     // just ignore them.
     if (!Info.checkingPotentialConstantExpression())
       MD->getParent()->getCaptureFields(Frame.LambdaCaptureFields,
                                         Frame.LambdaThisCaptureField);
   }
 
   StmtResult Ret = {Result, ResultSlot};
-  EvalStmtResult ESR = EvaluateStmt(Ret, Info, Body);
-  if (ESR == ESR_Succeeded) {
-    if (Callee->getReturnType()->isVoidType())
-      return true;
+  switch (EvaluateStmt(Ret, Info, Body)) {
+  case ESR_Returned:
+    Frame.ResultValue = &Result;
+    return EvaluatePostconditions(Callee->contracts(), Info);
+
+  case ESR_Succeeded:
+    if (!Callee->getReturnType()->isVoidType()) {
       Info.FFDiag(Callee->getEndLoc(), diag::note_constexpr_no_return);
+      return false;
+    }
+    return EvaluatePostconditions(Callee->contracts(), Info);
+
+  default:
+    return false;
   }
-  return ESR == ESR_Returned;
 }
 
 /// Evaluate a constructor call.
 static bool HandleConstructorCall(const Expr *E, const LValue &This,
                                   APValue *ArgValues,
                                   const CXXConstructorDecl *Definition,
                                   EvalInfo &Info, APValue &Result) {
   SourceLocation CallLoc = E->getExprLoc();
   if (!Info.CheckCallLimit(CallLoc))
     return false;
 
   const CXXRecordDecl *RD = Definition->getParent();
   if (RD->getNumVBases()) {
     Info.FFDiag(CallLoc, diag::note_constexpr_virtual_base) << RD;
     return false;
   }
 
   EvalInfo::EvaluatingConstructorRAII EvalObj(
       Info, {This.getLValueBase(),
              {This.getLValueCallIndex(), This.getLValueVersion()}});
   CallStackFrame Frame(Info, CallLoc, Definition, &This, ArgValues);
 
+  if (!EvaluatePreconditions(Definition->contracts(), Info))
+    return false;
+
   // FIXME: Creating an APValue just to hold a nonexistent return value is
   // wasteful.
   APValue RetVal;
   StmtResult Ret = {RetVal, nullptr};
 
   // If it's a delegating constructor, delegate.
   if (Definition->isDelegatingConstructor()) {
     CXXConstructorDecl::init_const_iterator I = Definition->init_begin();
if (!EvaluateInPlace(*Value, Info, Subobject, Init) ||
       // initializers even if some of them fail.
       if (!Info.noteFailure())
         return false;
       Success = false;
     }
   }
 
   return Success &&
-         EvaluateStmt(Ret, Info, Definition->getBody()) != ESR_Failed;
+         EvaluateStmt(Ret, Info, Definition->getBody()) != ESR_Failed &&
+         EvaluatePostconditions(Definition->contracts(), Info);
 }
 
 static bool HandleConstructorCall(const Expr *E, const LValue &This,
                                   ArrayRef<const Expr*> Args,
                                   const CXXConstructorDecl *Definition,
                                   EvalInfo &Info, APValue &Result) {
   ArgVector ArgValues(Args.size());
   if (!EvaluateArgs(Args, ArgValues, Info))

lib/AST/Stmt.cpp

 //===- Stmt.cpp - Statement AST Node Implementation -----------------------===//
 //
 //                     The LLVM Compiler Infrastructure
 //
 // This file is distributed under the University of Illinois Open Source
 // License. See LICENSE.TXT for details.
 //
 //===----------------------------------------------------------------------===//
 //
 // This file implements the Stmt class and statement subclasses.
 //
 //===----------------------------------------------------------------------===//
 
 #include "clang/AST/Stmt.h"
 #include "clang/AST/ASTContext.h"
 #include "clang/AST/ASTDiagnostic.h"
+#include "clang/AST/AttrContract.h"
 #include "clang/AST/Decl.h"
 #include "clang/AST/DeclGroup.h"
 #include "clang/AST/Expr.h"
 #include "clang/AST/ExprCXX.h"
 #include "clang/AST/ExprObjC.h"
 #include "clang/AST/ExprOpenMP.h"
 #include "clang/AST/StmtCXX.h"
 #include "clang/AST/StmtObjC.h"

 AttributedStmt *AttributedStmt::CreateEmpty(const ASTContext &C,
                                             unsigned NumAttrs) {
   assert(NumAttrs > 0 && "NumAttrs should be greater than zero");
   void *Mem = C.Allocate(totalSizeToAlloc<const Attr *>(NumAttrs),
                          alignof(AttributedStmt));
   return new (Mem) AttributedStmt(EmptyShell(), NumAttrs);
 }
 
+NullStmt *NullStmt::Create(const ASTContext &C, SourceLocation L,
+                           bool hasLeadingEmptyMacro,
+                           ArrayRef<AssertContract *> Assertions) {
+  void *Mem = C.Allocate(totalSizeToAlloc<AssertContract *>(Assertions.size()),
+                         alignof(NullStmt));
+  return new (Mem) NullStmt(L, hasLeadingEmptyMacro, Assertions);
+}
+
+NullStmt *NullStmt::CreateEmpty(const ASTContext &C, unsigned NumAssertions) {
+  void *Mem = C.Allocate(totalSizeToAlloc<AssertContract *>(NumAssertions),
+                         alignof(NullStmt));
+  return new (Mem) NullStmt(EmptyShell{}, NumAssertions);
+}
+
+NullStmt::NullStmt(SourceLocation L, bool hasLeadingEmptyMacro,
+                   ArrayRef<AssertContract *> Assertions)
+    : Stmt(NullStmtClass), SemiLoc(L),
+      HasLeadingEmptyMacro(hasLeadingEmptyMacro),
+      NumAssertions(Assertions.size()) {
+  assert(this->NumAssertions == Assertions.size() && "Contract overflow!");
+  llvm::copy(Assertions, getTrailingObjects<AssertContract *>());
+}
+
+NullStmt::NullStmt(EmptyShell Empty, unsigned NumAssertions)
+    : Stmt(NullStmtClass, Empty), HasLeadingEmptyMacro(false),
+      NumAssertions(NumAssertions) {
+  assert(this->NumAssertions == NumAssertions && "Contract overflow!");
+  std::fill_n(getTrailingObjects<AssertContract *>(), NumAssertions, nullptr);
+}
+
+SourceLocation NullStmt::getBeginLoc() const {
+  // Use the start location of the first assertion contract if we have any.
+  if (assertions_begin() != assertions_end())
+    return (*assertions_begin())->getBeginLoc();
+
+  return SemiLoc;
+}
+
 std::string AsmStmt::generateAsmString(const ASTContext &C) const {
   if (const auto *gccAsmStmt = dyn_cast<GCCAsmStmt>(this))
     return gccAsmStmt->generateAsmString(C);
   if (const auto *msAsmStmt = dyn_cast<MSAsmStmt>(this))
     return msAsmStmt->generateAsmString(C);
   llvm_unreachable("unknown asm statement kind!");
 }
 

lib/AST/StmtPrinter.cpp

 //===- StmtPrinter.cpp - Printing implementation for Stmt ASTs ------------===//
 //
 //                     The LLVM Compiler Infrastructure
 //
 // This file is distributed under the University of Illinois Open Source
 // License. See LICENSE.TXT for details.
 //
 //===----------------------------------------------------------------------===//
 //
 // This file implements the Stmt::dumpPretty/Stmt::printPretty methods, which
 // pretty print the AST back out to C code.
 //
 //===----------------------------------------------------------------------===//
 
 #include "clang/AST/ASTContext.h"
 #include "clang/AST/Attr.h"
+#include "clang/AST/AttrContract.h"
 #include "clang/AST/Decl.h"
 #include "clang/AST/DeclBase.h"
 #include "clang/AST/DeclCXX.h"
 #include "clang/AST/DeclObjC.h"
 #include "clang/AST/DeclOpenMP.h"
 #include "clang/AST/DeclTemplate.h"
 #include "clang/AST/Expr.h"
 #include "clang/AST/ExprCXX.h"

 }
 
 void StmtPrinter::PrintRawDeclStmt(const DeclStmt *S) {
   SmallVector<Decl *, 2> Decls(S->decls());
   Decl::printGroup(Decls.data(), Decls.size(), OS, Policy, IndentLevel);
 }
 
 void StmtPrinter::VisitNullStmt(NullStmt *Node) {
-  Indent() << ";\n";
+  Indent();
+  if (Node->assertions_begin() != Node->assertions_end()) {
+    auto It = Node->assertions_begin();
+    const auto End = Node->assertions_end();
+    (*It++)->printPretty(OS, Policy);
+    while (It != End) {
+      OS << ' ';
+      (*It++)->printPretty(OS, Policy);
+    }
+  }
+  OS << ";\n";
 }
 
 void StmtPrinter::VisitDeclStmt(DeclStmt *Node) {
   Indent();
   PrintRawDeclStmt(Node);
   OS << ";\n";
 }
 

lib/AST/StmtProfile.cpp

void VisitDecl(const Decl *D) override {
 
         if (const TemplateTemplateParmDecl *TTP =
                 dyn_cast<TemplateTemplateParmDecl>(D)) {
           ID.AddInteger(TTP->getDepth());
           ID.AddInteger(TTP->getIndex());
           ID.AddBoolean(TTP->isParameterPack());
           return;
         }
+
+        if (isa<VarDecl>(D) && cast<VarDecl>(D)->isContractFunctionResult())
+          return;
       }
 
       ID.AddPointer(D ? D->getCanonicalDecl() : nullptr);
     }
 
     void VisitType(QualType T) override {
       if (Canonical && !T.isNull())
         T = Context.getCanonicalType(T);

lib/CodeGen/CGStmt.cpp

EmitOMPTargetTeamsDistributeSimdDirective(
         cast<OMPTargetTeamsDistributeSimdDirective>(*S));
     break;
   }
 }
 
 bool CodeGenFunction::EmitSimpleStmt(const Stmt *S) {
   switch (S->getStmtClass()) {
   default: return false;
-  case Stmt::NullStmtClass: break;
+  case Stmt::NullStmtClass:     EmitNullStmt(cast<NullStmt>(*S));         break;
   case Stmt::CompoundStmtClass: EmitCompoundStmt(cast<CompoundStmt>(*S)); break;
   case Stmt::DeclStmtClass:     EmitDeclStmt(cast<DeclStmt>(*S));         break;
   case Stmt::LabelStmtClass:    EmitLabelStmt(cast<LabelStmt>(*S));       break;
   case Stmt::AttributedStmtClass:
                             EmitAttributedStmt(cast<AttributedStmt>(*S)); break;
   case Stmt::GotoStmtClass:     EmitGotoStmt(cast<GotoStmt>(*S));         break;
   case Stmt::BreakStmtClass:    EmitBreakStmt(cast<BreakStmt>(*S));       break;
   case Stmt::ContinueStmtClass: EmitContinueStmt(cast<ContinueStmt>(*S)); break;
void CodeGenFunction::LexicalScope::rescopeLabels() {
 
   // Reparent the labels if the new scope also has cleanups.
   if (innermostScope != EHScopeStack::stable_end() && ParentScope) {
     ParentScope->Labels.append(Labels.begin(), Labels.end());
   }
 }
 
 
+void CodeGenFunction::EmitNullStmt(const NullStmt &S) {
+  if (S.assertions_begin() == S.assertions_end())
+    return;
+
+  ErrorUnsupported(&S, "assertion contract");
+}
+
 void CodeGenFunction::EmitLabelStmt(const LabelStmt &S) {
   EmitLabel(S.getDecl());
   EmitStmt(S.getSubStmt());
 }
 
 void CodeGenFunction::EmitAttributedStmt(const AttributedStmt &S) {
   EmitStmt(S.getSubStmt(), S.getAttrs());
 }

lib/CodeGen/CodeGenFunction.h

Address EmitCompoundStmtWithoutScope(const CompoundStmt &S,
                                        bool GetLast = false,
                                        AggValueSlot AVS =
                                                 AggValueSlot::ignored());
 
   /// EmitLabel - Emit the block for the given label. It is legal to call this
   /// function even if there is no current insertion point.
   void EmitLabel(const LabelDecl *D); // helper for EmitLabelStmt.
 
+  void EmitNullStmt(const NullStmt &S);
   void EmitLabelStmt(const LabelStmt &S);
   void EmitAttributedStmt(const AttributedStmt &S);
   void EmitGotoStmt(const GotoStmt &S);
   void EmitIndirectGotoStmt(const IndirectGotoStmt &S);
   void EmitIfStmt(const IfStmt &S);
 
   void EmitWhileStmt(const WhileStmt &S,
                      ArrayRef<const Attr *> Attrs = None);

lib/CodeGen/CodeGenFunction.cpp

void CodeGenFunction::GenerateCode(GlobalDecl GD, llvm::Function *Fn,
   // Initialize helper which will detect jumps which can cause invalid lifetime
   // markers.
   if (Body && ShouldEmitLifetimeMarkers)
     Bypasses.Init(Body);
 
   // Emit the standard function prologue.
   StartFunction(GD, ResTy, Fn, FnInfo, Args, Loc, BodyRange.getBegin());
 
+  if (!FD->contracts().empty())
+    CGM.ErrorUnsupported(FD, "function with contract conditions");
+
   // Generate the body of the function.
   PGO.assignRegionCounters(GD, CurFn);
   if (isa<CXXDestructorDecl>(FD))
     EmitDestructorBody(Args);
   else if (isa<CXXConstructorDecl>(FD))
     EmitConstructorBody(Args);
   else if (getLangOpts().CUDA &&
            !getLangOpts().CUDAIsDevice &&

lib/Parse/ParseCXXInlineMethods.cpp

if (std::unique_ptr<CachedTokens> Toks = std::move(LM.ExceptionSpecTokens)) {
     Actions.actOnDelayedExceptionSpecification(LM.Method, EST,
                                                SpecificationRange,
                                                DynamicExceptions,
                                                DynamicExceptionRanges,
                                                NoexceptExpr.isUsable()?
                                                  NoexceptExpr.get() : nullptr);
   }
 
+  // Parse a delayed sequence of contract-attribute-specifier, if there is one.
+  if (std::unique_ptr<CachedTokens> Toks = std::move(LM.ContractTokens)) {
+    ParenBraceBracketBalancer BalancerRAIIObj(*this);
+    UseCachedTokensRAII CachedTokStream(*this, *Toks, LM.Method);
+    Sema::ContextRAII FuncCtx(Actions, Func, false);
+
+    ContractsParseState Contracts(ContractsParseState::ParsingFunctionDecl{},
+                                  /* Delayed */false, Func->getReturnType());
+
+    // Parse as an attribute-specifier-seq.
+    // We still need a factory even though we should only have contracts.
+    AttributeFactory DummyFactory;
+    ParsedAttributesWithRange Attrs(DummyFactory);
+    ParseCXX11Attributes(Attrs, nullptr, &Contracts);
+    assert(Attrs.empty() && "Expecting only contracts at this point");
+
+    Actions.ActOnDelayedContractAttributes(Contracts.getParsedList(), Func);
+  }
+
   ThisScope.Exit();
   PrototypeScope.Exit();
 
   // Finish the delayed C++ method declaration.
   Actions.ActOnFinishDelayedCXXMethodDeclaration(getCurScope(), LM.Method);
 }
 
 /// ParseLexedMethodDefs - We finished parsing the member specification of a top

lib/Parse/ParseDecl.cpp

void Parser::ParseFunctionDeclarator(Declarator &D,
   SourceLocation RestrictQualifierLoc;
   ExceptionSpecificationType ESpecType = EST_None;
   SourceRange ESpecRange;
   SmallVector<ParsedType, 2> DynamicExceptions;
   SmallVector<SourceRange, 2> DynamicExceptionRanges;
   ExprResult NoexceptExpr;
   CachedTokens *ExceptionSpecTokens = nullptr;
   ParsedAttributesWithRange FnAttrs(AttrFactory);
+  ContractsParseState Contracts(
+      ContractsParseState::ParsingFunctionDecl{},
+      /* Delayed */D.getContext() == DeclaratorContext::MemberContext);
   TypeResult TrailingReturnType;
 
   /* LocalEndLoc is the end location for the local FunctionTypeLoc.
      EndLoc is the end location for the function declarator.
      They differ for trailing return types. */
   SourceLocation StartLoc, LocalEndLoc, EndLoc;
   SourceLocation LParenLoc, RParenLoc;
   LParenLoc = Tracker.getOpenLocation();
if (getLangOpts().CPlusPlus) {
                                                  DynamicExceptionRanges,
                                                  NoexceptExpr,
                                                  ExceptionSpecTokens);
       if (ESpecType != EST_None)
         EndLoc = ESpecRange.getEnd();
 
       // Parse attribute-specifier-seq[opt]. Per DR 979 and DR 1297, this goes
       // after the exception-specification.
-      MaybeParseCXX11Attributes(FnAttrs);
+      MaybeParseCXX11Attributes(FnAttrs, nullptr, false, &Contracts);
 
       // Parse trailing-return-type[opt].
       LocalEndLoc = EndLoc;
       if (getLangOpts().CPlusPlus11 && Tok.is(tok::arrow)) {
         Diag(Tok, diag::warn_cxx98_compat_trailing_return_type);
         if (D.getDeclSpec().getTypeSpecType() == TST_auto)
           StartLoc = D.getDeclSpec().getTypeSpecTypeLoc();
         LocalEndLoc = Tok.getLocation();
D.AddTypeInfo(DeclaratorChunk::getFunction(
                     DS.getTypeQualifiers(), RefQualifierIsLValueRef,
                     RefQualifierLoc, ConstQualifierLoc, VolatileQualifierLoc,
                     RestrictQualifierLoc,
                     /*MutableLoc=*/SourceLocation(), ESpecType, ESpecRange,
                     DynamicExceptions.data(), DynamicExceptionRanges.data(),
                     DynamicExceptions.size(),
                     NoexceptExpr.isUsable() ? NoexceptExpr.get() : nullptr,
                     ExceptionSpecTokens, DeclsInPrototype, StartLoc,
-                    LocalEndLoc, D, TrailingReturnType),
+                    LocalEndLoc, D, TrailingReturnType,
+                    Contracts.delayParsing()
+                        ? ArrayRef<ContractResult>()
+                        : Contracts.getParsedList(),
+                    Contracts.delayParsing()
+                        ? &Contracts.getCachedTokens()
+                        : nullptr),
                 std::move(FnAttrs), EndLoc);
 }
 
 /// ParseRefQualifier - Parses a member function ref-qualifier. Returns
 /// true if a ref-qualifier is found.
 bool Parser::ParseRefQualifier(bool &RefQualifierIsLValueRef,
                                SourceLocation &RefQualifierLoc) {
   if (Tok.isOneOf(tok::amp, tok::ampamp)) {

lib/Parse/ParseDeclCXX.cpp

void Parser::HandleMemberFunctionDeclDelays(Declarator &DeclaratorInfo,
 
   const bool LateParseDefaultArgs =
       llvm::any_of(ParamInfoRange, [](const DeclaratorChunk::ParamInfo &PI)
         { return cast<ParmVarDecl>(PI.Param)->hasUnparsedDefaultArg(); });
 
   const bool LateParseExceptionSpec =
       FTI.getExceptionSpecType() == EST_Unparsed;
 
+  const bool LateParseContracts =
+      FTI.NumParsedContracts == 0 && FTI.ContractTokens;
+
   // If we didn't delay parsing for any parts of this function, then we're done.
-  if (!LateParseDefaultArgs && !LateParseExceptionSpec)
+  if (!LateParseDefaultArgs && !LateParseExceptionSpec && !LateParseContracts)
     return;
 
   // Push this method onto the stack of late-parsed method declarations.
   auto LateMethod = new LateParsedMethodDeclaration(this, ThisDecl);
   getCurrentClass().LateParsedDeclarations.push_back(LateMethod);
   LateMethod->TemplateScope = getCurScope()->isTemplateParamScope();
 
   // Stash the '= initializer-clause' tokens for each parameter. We need to do
   // this for every parameter, even those without a default initializer, so that
   // the late-parsed method has a reference to the parameter declarations.
   LateMethod->DefaultArgs.reserve(FTI.NumParams);
   llvm::transform(ParamInfoRange, std::back_inserter(LateMethod->DefaultArgs),
                   [](DeclaratorChunk::ParamInfo &PI) {
     return LateParsedDefaultArgument(
                 PI.Param, std::move(PI.DefaultArgTokens));
   });
 
   if (LateParseExceptionSpec) {
     // Stash the exception-specification tokens.
     LateMethod->ExceptionSpecTokens.reset(FTI.ExceptionSpecTokens);
     FTI.ExceptionSpecTokens = nullptr;
   }
+
+  if (LateParseContracts) {
+    // Stash the contract-attribute-specifier tokens.
+    LateMethod->ContractTokens.reset(FTI.ContractTokens);
+    FTI.ContractTokens = nullptr;
+  }
 }
 
 /// isCXX11VirtSpecifier - Determine whether the given token is a C++11
 /// virt-specifier.
 ///
 ///       virt-specifier:
 ///         override
 ///         final
bool Parser::ParseCXX11AttributeArgs(IdentifierInfo *AttrName,
   }
   return true;
 }
 
 /// ParseCXX11AttributeSpecifier - Parse a C++11 or C2x attribute-specifier.
 ///
 /// [C++11] attribute-specifier:
 ///         '[' '[' attribute-list ']' ']'
+/// [C++2a] contract-attribute-specifier
 ///         alignment-specifier
 ///
 /// [C++11] attribute-list:
 ///         attribute[opt]
 ///         attribute-list ',' attribute[opt]
 ///         attribute '...'
 ///         attribute-list ',' attribute '...'
 ///
 /// [C++11] attribute:
 ///         attribute-token attribute-argument-clause[opt]
 ///
 /// [C++11] attribute-token:
 ///         identifier
 ///         attribute-scoped-token
 ///
 /// [C++11] attribute-scoped-token:
 ///         attribute-namespace '::' identifier
 ///
 /// [C++11] attribute-namespace:
 ///         identifier
 void Parser::ParseCXX11AttributeSpecifier(ParsedAttributes &attrs,
-                                          SourceLocation *endLoc) {
+                                          SourceLocation *endLoc,
+                                          ContractsParseState *Contracts) {
   if (Tok.is(tok::kw_alignas)) {
     Diag(Tok.getLocation(), diag::warn_cxx98_compat_alignas);
     ParseAlignmentSpecifier(attrs, endLoc);
     return;
   }
 
   assert(Tok.is(tok::l_square) && NextToken().is(tok::l_square) &&
          "Not a double square bracket attribute list");
 
+  // Handle C++ contract attributes separately.
+  if (getLangOpts().CPlusPlus &&
+      isContractKind(GetLookAheadToken(2/* brackets */)) &&
+      GetLookAheadToken(3).isNot(tok::coloncolon))
+    return ParseContractAttributeSpecifier(Contracts);
+
   Diag(Tok.getLocation(), diag::warn_cxx98_compat_attribute);
 
   ConsumeBracket();
   ConsumeBracket();
 
   SourceLocation CommonScopeLoc;
   IdentifierInfo *CommonScopeName = nullptr;
   if (Tok.is(tok::kw_using)) {
void Parser::ParseCXX11AttributeSpecifier(ParsedAttributes &attrs,
   while (Tok.isNot(tok::r_square)) {
     // attribute not present
     if (TryConsumeToken(tok::comma))
       continue;
 
     SourceLocation ScopeLoc, AttrLoc;
     IdentifierInfo *ScopeName = nullptr, *AttrName = nullptr;
 
+    if (getLangOpts().CPlusPlus && !CommonScopeName &&
+        NextToken().isNot(tok::coloncolon) && isContractKind(Tok)) {
+      // Contract attributes can't appear in a regular attribute-list; it's
+      // always one contract per attribute-specifier.
+      Diag(Tok.getLocation(), diag::err_contract_attribute_needs_separate_list);
+      SkipUntil(tok::r_square, StopBeforeMatch);
+      break;
+    }
+
     AttrName = TryParseCXX11AttributeIdentifier(AttrLoc);
     if (!AttrName)
       // Break out to the "expected ']'" diagnostic.
       break;
 
     // scoped attribute
     if (TryConsumeToken(tok::coloncolon)) {
       ScopeName = AttrName;
if (ExpectAndConsume(tok::r_square))
     SkipUntil(tok::r_square);
 }
 
 /// ParseCXX11Attributes - Parse a C++11 or C2x attribute-specifier-seq.
 ///
 /// attribute-specifier-seq:
 ///       attribute-specifier-seq[opt] attribute-specifier
 void Parser::ParseCXX11Attributes(ParsedAttributesWithRange &attrs,
-                                  SourceLocation *endLoc) {
+                                  SourceLocation *endLoc,
+                                  ContractsParseState *Contracts) {
   assert(standardAttributesAllowed());
 
   SourceLocation StartLoc = Tok.getLocation(), Loc;
   if (!endLoc)
     endLoc = &Loc;
 
   do {
-    ParseCXX11AttributeSpecifier(attrs, endLoc);
+    ParseCXX11AttributeSpecifier(attrs, endLoc, Contracts);
   } while (isCXX11AttributeSpecifier());
 
   attrs.Range = SourceRange(StartLoc, *endLoc);
 }
 
 void Parser::DiagnoseAndSkipCXX11Attributes() {
   // Start and end location of an attribute or an attribute list.
   SourceLocation StartLoc = Tok.getLocation();
if (Tok.is(tok::l_square)) {
         T.skipToEnd();
       EndLoc = T.getCloseLocation();
     }
   } while (isCXX11AttributeSpecifier());
 
   return EndLoc;
 }
 
+/// Try to interpret the given token as a contract attribute kind.
+Optional<ContractKind> Parser::isContractKind(const Token &Tok) const {
+  if (Tok.is(tok::identifier)) {
+    const IdentifierInfo *Ident = Tok.getIdentifierInfo();
+
+    if (!Ident_expects) {
+      Ident_expects = PP.getIdentifierInfo("expects");
+      Ident_ensures = PP.getIdentifierInfo("ensures");
+      Ident_assert  = PP.getIdentifierInfo("assert");
+    }
+
+    if (Ident == Ident_expects)
+      return ContractKind::Expects;
+    if (Ident == Ident_ensures)
+      return ContractKind::Ensures;
+    if (Ident == Ident_assert)
+      return ContractKind::Assert;
+  }
+  return None;
+}
+
+/// Try to interpret the given token as a C++2a contract-level.
+///
+/// contract-level:
+///   'default'
+///   'audit'
+///   'axiom'
+Optional<ContractLevel> Parser::isContractLevel(const Token &Tok) const {
+  switch (Tok.getKind()) {
+  case tok::kw_default:
+    return ContractLevel::Default;
+
+  case tok::identifier: {
+    const IdentifierInfo *Ident = Tok.getIdentifierInfo();
+
+    if (!Ident_audit) {
+      Ident_audit = PP.getIdentifierInfo("audit");
+      Ident_axiom = PP.getIdentifierInfo("axiom");
+    }
+
+    if (Ident == Ident_audit)
+      return ContractLevel::Audit;
+    if (Ident == Ident_axiom)
+      return ContractLevel::Axiom;
+
+    LLVM_FALLTHROUGH;
+  }
+
+  default:
+    return None;
+  }
+}
+
+/// After failing to parse a contract-level, determine whether the current token
+/// was likely intended as a contract level.
+bool Parser::UserProbablyMeantContractLevel(ContractKind Kind) {
+  // Gauge the structure of the attribute by peeking at the subsequent tokens.
+  switch (Kind) {
+  case ContractKind::Expects:
+  case ContractKind::Assert:
+    return Tok.getIdentifierInfo() && NextToken().is(tok::colon);
+
+  case ContractKind::Ensures:
+    return Tok.getIdentifierInfo() && NextToken().getIdentifierInfo() &&
+           GetLookAheadToken(2).is(tok::colon);
+  }
+}
+
+/// Parse a C++2a contract-attribute-specifier.
+///
+/// contract-attribute-specifier:
+///   '[' '[' 'expects' contract-level[opt] ':' conditional-expression ']' ']'
+///   '[' '[' 'ensures' contract-level[opt] identifier[opt] ':' conditional-expression ']' ']'
+///   '[' '[' 'assert' contract-level[opt] ':' conditional-expression ']' ']'
+void Parser::ParseContractAttributeSpecifier(ContractsParseState *Contracts) {
+  assert(Tok.is(tok::l_square) && NextToken().is(tok::l_square) &&
+         isContractKind(GetLookAheadToken(2/* brackets */)) &&
+         "Not a contract-attribute-specifier");
+
+  if (Contracts && Contracts->delayParsing()) {
+    // Cache the tokens that make up this contract; we'll parse it later.
+    // The first bracket is pushed manually because the consume function
+    // automatically skips over balanced delimiters.
+    CachedTokens &Cache = Contracts->getCachedTokens();
+    Cache.push_back(Tok);
+    ConsumeBracket();
+    ConsumeAndStoreUntil(tok::r_square, Cache);
+    return;
+  }
+
+  BalancedDelimiterTracker Outer(*this, tok::l_square);
+  BalancedDelimiterTracker Inner(*this, tok::l_square);
+
+  Outer.consumeOpen();
+  Inner.consumeOpen();
+
+  ParseScope ContractScope(this, getCurScope()->getFlags() |
+                                 Scope::ContractAttributeScope);
+
+  ContractKind Kind = *isContractKind(Tok);
+  SourceLocation KindLoc = ConsumeToken();
+
+  Diag(KindLoc, getLangOpts().CPlusPlus2a
+                    ? diag::warn_cxx17_compat_contract_attributes
+                    : diag::ext_contract_attributes);
+
+  const bool Allowed = Contracts && Contracts->allowsKind(Kind);
+  if (!Allowed) {
+    Diag(KindLoc, diag::err_contract_attribute_misplaced)
+      << static_cast<int>(Kind);
+  }
+
+  ContractLevel Level;
+  SourceLocation LevelLoc;
+  if (auto LevelOpt = isContractLevel(Tok)) {
+    // Greedily take the level, even if it could be a return identifier.
+    //
+    // C++2a [dcl.attr.contract.syn]p1:
+    //   An ambiguity between a contract-level and an identifier is resolved in
+    //   favor of contract-level.
+    Level = *LevelOpt;
+    LevelLoc = ConsumeToken();
+  } else {
+    // C++2a [dcl.attr.contract.check]p1:
+    //   If the contract-level of a contract-attribute-specifier is absent, it
+    //   is assumed to be default.
+    Level = ContractLevel::Default;
+
+    // The contract-level is optional, so we could just continue as normal at
+    // this point. However we can provide nicer diagnostics in cases where the
+    // intention is clear.
+    if (UserProbablyMeantContractLevel(Kind)) {
+      // Prefer to present a correction if possible.
+      if (const TypoCorrection Correction =
+              Actions.CorrectTypoInContractLevel(Tok.getIdentifierInfo(),
+                                                 Tok.getLocation())) {
+        Diag(Tok.getLocation(), diag::err_unknown_contract_level_suggest)
+          << Tok.getIdentifierInfo()
+          << Correction.getCorrectionAsIdentifierInfo();
+      } else {
+        Diag(Tok.getLocation(), diag::err_unknown_contract_level)
+          << Tok.getIdentifierInfo();
+      }
+
+      // Consume the erroneous token for recovery purposes.
+      ConsumeToken();
+    }
+  }
+
+  DeclResult ResultVar;
+  if (Kind == ContractKind::Ensures && Tok.is(tok::identifier)) {
+    IdentifierInfo *II = Tok.getIdentifierInfo();
+    SourceLocation Loc = ConsumeToken();
+
+    ResultVar = Actions.ActOnContractResultIdentifier(
+                    II, Loc,
+                    Contracts ? Contracts->getResultType() : QualType());
+  }
+
+  SourceLocation ColonLoc = Tok.getLocation();
+  ExpectAndConsume(tok::colon);
+
+  Sema::ConditionResult Predicate;
+  {
+    Sema::EnterContractPredicateRAII _(Actions, Kind);
+
+    ExprResult CondExpr = ParseExpression();
+    if (CondExpr.isInvalid()) {
+      Inner.skipToEnd();
+      Outer.skipToEnd();
+      return;
+    }
+
+    // C++2a [dcl.attr.contract.syn]p5:
+    //   The conditional-expression in a contract is contextually converted to
+    //   bool; the converted expression is called the predicate of the contract.
+    Predicate = Actions.ActOnCondition(getCurScope(), KindLoc, CondExpr.get(),
+                                       Sema::ConditionKind::Boolean);
+  }
+
+  ContractScope.Exit();
+
+  Inner.consumeClose();
+  Outer.consumeClose();
+
+  if (Allowed && !Predicate.isInvalid() && Predicate.get().second) {
+    Contracts->getParsedList().push_back(
+        Actions.ActOnContractAttribute(
+            Outer.getRange(), Kind, KindLoc, Level, LevelLoc, ResultVar,
+            ColonLoc, Predicate));
+  }
+}
+
 /// Parse uuid() attribute when it appears in a [] Microsoft attribute.
 void Parser::ParseMicrosoftUuidAttributeArgs(ParsedAttributes &Attrs) {
   assert(Tok.is(tok::identifier) && "Not a Microsoft attribute list");
   IdentifierInfo *UuidIdent = Tok.getIdentifierInfo();
   assert(UuidIdent->getName() == "uuid" && "Not a Microsoft attribute list");
 
   SourceLocation UuidLoc = Tok.getLocation();
   ConsumeToken();

lib/Parse/ParseStmt.cpp

 StmtResult
 Parser::ParseStatementOrDeclaration(StmtVector &Stmts,
                                     AllowedConstructsKind Allowed,
                                     SourceLocation *TrailingElseLoc) {
 
   ParenBraceBracketBalancer BalancerRAIIObj(*this);
 
   ParsedAttributesWithRange Attrs(AttrFactory);
-  MaybeParseCXX11Attributes(Attrs, nullptr, /*MightBeObjCMessageSend*/ true);
+  ContractsParseState Contracts(ContractsParseState::ParsingStmt{});
+  MaybeParseCXX11Attributes(Attrs, nullptr, /*MightBeObjCMessageSend*/ true,
+                            &Contracts);
+
   if (!MaybeParseOpenCLUnrollHintAttribute(Attrs))
     return StmtError();
 
   StmtResult Res = ParseStatementOrDeclarationAfterAttributes(
-      Stmts, Allowed, TrailingElseLoc, Attrs);
+      Stmts, Allowed, TrailingElseLoc, Attrs, &Contracts);
 
   assert((Attrs.empty() || Res.isInvalid() || Res.isUsable()) &&
          "attributes on empty statement");
 
   if (Attrs.empty() || Res.isInvalid())
     return Res;
 
   return Actions.ProcessStmtAttributes(Res.get(), Attrs, Attrs.Range);
bool ValidateCandidate(const TypoCorrection &candidate) override {
     return CorrectionCandidateCallback::ValidateCandidate(candidate);
   }
 
 private:
   Token NextToken;
 };
 }
 
+/// Look for (assertion) contracts that aren't attached to a null statement.
+/// It's very unlikely that the user legitimately thought that an assertion can
+/// be attached to an arbitrary statement (e.g. a for loop), so we'll diagnose
+/// it as a missing semicolon.
+/// \returns true if we diagnose a missing semicolon.
+bool Parser::MaybeDiagnoseAssertWithoutSemi(ContractsParseState *Contracts) {
+  assert(!Contracts || Contracts->allowsKind(ContractKind::Assert) &&
+         "Checking the wrong kind of contract");
+
+  // If there're no contracts or the token is a semicolon (i.e. the next
+  // statement is a null statement), then we don't need to do anything.
+  if (!Contracts || Contracts->getParsedList().empty() || Tok.is(tok::semi))
+    return false;
+
+  // Recover gracefully if there's an extra closing bracket before a semicolon.
+  if (Tok.is(tok::r_square) && NextToken().is(tok::semi)) {
+    Diag(Tok, diag::err_extraneous_token_before_semi)
+      << "]" << FixItHint::CreateRemoval(Tok.getLocation());
+    ConsumeBracket();
+    return false;
+  }
+
+  // Otherwise, just emit the expected ';' diagnostic.
+  // FIXME: Maybe use the end location of the last contract?
+  const SourceLocation End = getEndOfPreviousToken();
+  Diag(End, diag::err_expected_semi_after_assert_contract)
+    << FixItHint::CreateInsertion(End, ";");
+  return true;
+}
+
 StmtResult
 Parser::ParseStatementOrDeclarationAfterAttributes(StmtVector &Stmts,
           AllowedConstructsKind Allowed, SourceLocation *TrailingElseLoc,
-          ParsedAttributesWithRange &Attrs) {
+          ParsedAttributesWithRange &Attrs, ContractsParseState *Contracts) {
   const char *SemiError = nullptr;
   StmtResult Res;
 
+  const bool IsAssertWithoutSemi = MaybeDiagnoseAssertWithoutSemi(Contracts);
+
   // Cases in this switch statement should fall through if the parser expects
   // the token to end in a semicolon (in which case SemiError should be set),
   // or they directly 'return;' if not.
 Retry:
   tok::TokenKind Kind  = Tok.getKind();
   SourceLocation AtLoc;
   switch (Kind) {
   case tok::at: // May be a @try or @throw statement
if ((getLangOpts().CPlusPlus || getLangOpts().MicrosoftExt ||
         isDeclarationStatement()) {
       SourceLocation DeclStart = Tok.getLocation(), DeclEnd;
       DeclGroupPtrTy Decl = ParseDeclaration(DeclaratorContext::BlockContext,
                                              DeclEnd, Attrs);
       return Actions.ActOnDeclStmt(Decl, DeclStart, DeclEnd);
     }
 
     if (Tok.is(tok::r_brace)) {
+      if (!IsAssertWithoutSemi)
         Diag(Tok, diag::err_expected_statement);
       return StmtError();
     }
 
     return ParseExprStatement();
   }
 
   case tok::kw_case:                // C99 6.8.1: labeled-statement
     return ParseCaseStatement();
   case tok::kw_default:             // C99 6.8.1: labeled-statement
     return ParseDefaultStatement();
 
   case tok::l_brace:                // C99 6.8.2: compound-statement
     return ParseCompoundStatement();
   case tok::semi: {                 // C99 6.8.3p3: expression[opt] ';'
     bool HasLeadingEmptyMacro = Tok.hasLeadingEmptyMacro();
-    return Actions.ActOnNullStmt(ConsumeToken(), HasLeadingEmptyMacro);
+    SourceLocation SemiLoc = ConsumeToken();
+    return Actions.ActOnNullStmt(SemiLoc, HasLeadingEmptyMacro,
+                                 Contracts
+                                     ? Contracts->getParsedList()
+                                     : ArrayRef<ContractResult>());
   }
 
   case tok::kw_if:                  // C99 6.8.4.1: if-statement
     return ParseIfStatement(TrailingElseLoc);
   case tok::kw_switch:              // C99 6.8.4.2: switch-statement
     return ParseSwitchStatement(TrailingElseLoc);
 
   case tok::kw_while:               // C99 6.8.5.1: while-statement

lib/Parse/Parser.cpp

void Parser::Initialize() {
   }
 
   Ident_instancetype = nullptr;
   Ident_final = nullptr;
   Ident_sealed = nullptr;
   Ident_override = nullptr;
   Ident_GNU_final = nullptr;
 
+  Ident_expects = nullptr;
+  Ident_ensures = nullptr;
+  Ident_assert = nullptr;
+  Ident_audit = nullptr;
+  Ident_axiom = nullptr;
+
   Ident_super = &PP.getIdentifierTable().get("super");
 
   Ident_vector = nullptr;
   Ident_bool = nullptr;
   Ident_pixel = nullptr;
   if (getLangOpts().AltiVec || getLangOpts().ZVector) {
     Ident_vector = &PP.getIdentifierTable().get("vector");
     Ident_bool = &PP.getIdentifierTable().get("bool");

lib/Sema/CMakeLists.txt

add_clang_library(clangSema
   Sema.cpp
   SemaAccess.cpp
   SemaAttr.cpp
   SemaCXXScopeSpec.cpp
   SemaCast.cpp
   SemaChecking.cpp
   SemaCodeComplete.cpp
   SemaConsumer.cpp
+  SemaContract.cpp
   SemaCoroutine.cpp
   SemaCUDA.cpp
   SemaDecl.cpp
   SemaDeclAttr.cpp
   SemaDeclCXX.cpp
   SemaDeclObjC.cpp
   SemaExceptionSpec.cpp
   SemaExpr.cpp

lib/Sema/DeclSpec.cpp

 //===--- DeclSpec.cpp - Declaration Specifier Semantic Analysis -----------===//
 //
 //                     The LLVM Compiler Infrastructure
 //
 // This file is distributed under the University of Illinois Open Source
 // License. See LICENSE.TXT for details.
 //
 //===----------------------------------------------------------------------===//
 //
 //  This file implements semantic analysis for declaration specifiers.
 //
 //===----------------------------------------------------------------------===//
 
 #include "clang/Sema/DeclSpec.h"
 #include "clang/AST/ASTContext.h"
+#include "clang/AST/AttrContract.h"
 #include "clang/AST/DeclCXX.h"
 #include "clang/AST/Expr.h"
 #include "clang/AST/LocInfoType.h"
 #include "clang/AST/TypeLoc.h"
 #include "clang/Basic/LangOptions.h"
 #include "clang/Basic/TargetInfo.h"
 #include "clang/Sema/ParsedTemplate.h"
 #include "clang/Sema/Sema.h"
DeclaratorChunk DeclaratorChunk::getFunction(bool hasProto,
                                              unsigned NumExceptions,
                                              Expr *NoexceptExpr,
                                              CachedTokens *ExceptionSpecTokens,
                                              ArrayRef<NamedDecl*>
                                                  DeclsInPrototype,
                                              SourceLocation LocalRangeBegin,
                                              SourceLocation LocalRangeEnd,
                                              Declarator &TheDeclarator,
-                                             TypeResult TrailingReturnType) {
+                                             TypeResult TrailingReturnType,
+                                             ArrayRef<ContractResult> Contracts,
+                                             CachedTokens *ContractTokens) {
   assert(!(TypeQuals & DeclSpec::TQ_atomic) &&
          "function cannot have _Atomic qualifier");
 
   DeclaratorChunk I;
   I.Kind                        = Function;
   I.Loc                         = LocalRangeBegin;
   I.EndLoc                      = LocalRangeEnd;
   I.Fun.hasPrototype            = hasProto;
DeclaratorChunk DeclaratorChunk::getFunction(bool hasProto,
   I.Fun.ConstQualifierLoc       = ConstQualifierLoc.getRawEncoding();
   I.Fun.VolatileQualifierLoc    = VolatileQualifierLoc.getRawEncoding();
   I.Fun.RestrictQualifierLoc    = RestrictQualifierLoc.getRawEncoding();
   I.Fun.MutableLoc              = MutableLoc.getRawEncoding();
   I.Fun.ExceptionSpecType       = ESpecType;
   I.Fun.ExceptionSpecLocBeg     = ESpecRange.getBegin().getRawEncoding();
   I.Fun.ExceptionSpecLocEnd     = ESpecRange.getEnd().getRawEncoding();
   I.Fun.NumExceptionsOrDecls    = 0;
+  I.Fun.NumParsedContracts      = 0;
   I.Fun.Exceptions              = nullptr;
   I.Fun.NoexceptExpr            = nullptr;
+  I.Fun.ContractTokens          = nullptr;
   I.Fun.HasTrailingReturnType   = TrailingReturnType.isUsable() ||
                                   TrailingReturnType.isInvalid();
   I.Fun.TrailingReturnType      = TrailingReturnType.get();
 
   assert(I.Fun.TypeQuals == TypeQuals && "bitfield overflow");
   assert(I.Fun.ExceptionSpecType == ESpecType && "bitfield overflow");
 
   // new[] a parameter array if needed.
case EST_NoexceptTrue:
     I.Fun.NoexceptExpr = NoexceptExpr;
     break;
 
   case EST_Unparsed:
     I.Fun.ExceptionSpecTokens = ExceptionSpecTokens;
     break;
   }
 
+  if (!Contracts.empty()) {
+    assert(!ContractTokens && "Can't mix parsed contracts with delayed parsing");
+    I.Fun.NumParsedContracts = Contracts.size();
+    I.Fun.ParsedContracts = new ContractAttr *[Contracts.size()];
+    llvm::transform(Contracts, I.Fun.ParsedContracts,
+                    std::mem_fn(&ContractResult::get));
+  } else if (ContractTokens && !ContractTokens->empty()) {
+    I.Fun.ContractTokens = new CachedTokens(*ContractTokens);
+  }
+
   if (!DeclsInPrototype.empty()) {
     assert(ESpecType == EST_None && NumExceptions == 0 &&
            "cannot have exception specifiers and decls in prototype");
     I.Fun.NumExceptionsOrDecls = DeclsInPrototype.size();
     // Copy the array of decls into stable heap storage.
     I.Fun.DeclsInPrototype = new NamedDecl *[DeclsInPrototype.size()];
     for (size_t J = 0; J < DeclsInPrototype.size(); ++J)
       I.Fun.DeclsInPrototype[J] = DeclsInPrototype[J];

lib/Sema/Scope.cpp

std::pair<unsigned, const char *> FlagInfo[] = {
       {OpenMPDirectiveScope, "OpenMPDirectiveScope"},
       {OpenMPLoopDirectiveScope, "OpenMPLoopDirectiveScope"},
       {OpenMPSimdDirectiveScope, "OpenMPSimdDirectiveScope"},
       {EnumScope, "EnumScope"},
       {SEHTryScope, "SEHTryScope"},
       {SEHExceptScope, "SEHExceptScope"},
       {SEHFilterScope, "SEHFilterScope"},
       {CompoundStmtScope, "CompoundStmtScope"},
-      {ClassInheritanceScope, "ClassInheritanceScope"}};
+      {ClassInheritanceScope, "ClassInheritanceScope"},
+      {ContractAttributeScope, "ContractAttributeScope"}};
 
   for (auto Info : FlagInfo) {
     if (Flags & Info.first) {
       OS << Info.second;
       Flags &= ~Info.first;
       if (Flags)
         OS << " | ";
     }

lib/Sema/SemaAccess.cpp

static CXXRecordDecl *FindDeclaringClass(NamedDecl *D) {
   CXXRecordDecl *DeclaringClass = cast<CXXRecordDecl>(DC);
   while (DeclaringClass->isAnonymousStructOrUnion())
     DeclaringClass = cast<CXXRecordDecl>(DeclaringClass->getDeclContext());
   return DeclaringClass;
 }
 
 namespace {
 struct EffectiveContext {
-  EffectiveContext() : Inner(nullptr), Dependent(false) {}
+  EffectiveContext() : Inner(nullptr), Dependent(false),
+                       InContractCondition(false) {}
 
-  explicit EffectiveContext(DeclContext *DC)
+  EffectiveContext(DeclContext *DC, bool InContractCondition)
     : Inner(DC),
-      Dependent(DC->isDependentContext()) {
+      Dependent(DC->isDependentContext()),
+      InContractCondition(InContractCondition) {
 
     // C++11 [class.access.nest]p1:
     //   A nested class is a member and as such has the same access
     //   rights as any other member.
     // C++11 [class.access]p2:
     //   A member of a class can also access all the names to which
     //   the class has access.  A local class of a member function
     //   may access the same names that the member function itself
while (true) {
         break;
       } else {
         DC = DC->getParent();
       }
     }
   }
 
   bool isDependent() const { return Dependent; }
+  bool isInContractCondition() const { return InContractCondition; }
 
   bool includesClass(const CXXRecordDecl *R) const {
     R = R->getCanonicalDecl();
     return std::find(Records.begin(), Records.end(), R)
              != Records.end();
   }
 
   /// Retrieves the innermost "useful" context.  Can be null if we're
   /// doing access-control without privileges.
   DeclContext *getInnerContext() const {
     return Inner;
   }
 
   typedef SmallVectorImpl<CXXRecordDecl*>::const_iterator record_iterator;
 
   DeclContext *Inner;
   SmallVector<FunctionDecl*, 4> Functions;
   SmallVector<CXXRecordDecl*, 4> Records;
   bool Dependent;
+  bool InContractCondition;
 };
 
 /// Like sema::AccessedEntity, but kindly lets us scribble all over
 /// it.
 struct AccessTarget : public AccessedEntity {
   AccessTarget(const AccessedEntity &Entity)
     : AccessedEntity(Entity) {
     initialize();
static AccessResult MatchesFriend(Sema &S,
   return MatchesFriend(S, EC, cast<FunctionDecl>(Friend));
 }
 
 static AccessResult GetFriendKind(Sema &S,
                                   const EffectiveContext &EC,
                                   const CXXRecordDecl *Class) {
   AccessResult OnFailure = AR_inaccessible;
 
+  // C++2a [dcl.attr.contract.cond]p4:
+  //   [...]
+  //   Additional access restrictions apply to names appearing in a contract
+  //   condition of a member function of class C:
+  //     - Friendship is not considered.
+  //     [...]
+  //   For names appearing in a contract condition of a non-member function,
+  //   friendship is not considered.
+  if (EC.isInContractCondition())
+    return AR_inaccessible;
+
   // Okay, check friends.
   for (auto *Friend : Class->friends()) {
     switch (MatchesFriend(S, EC, Friend)) {
     case AR_accessible:
       return AR_accessible;
 
     case AR_inaccessible:
       continue;
static AccessResult HasAccess(Sema &S,
                               AccessSpecifier Access,
                               const AccessTarget &Target) {
   assert(NamingClass->getCanonicalDecl() == NamingClass &&
          "declaration should be canonicalized before being passed here");
 
   if (Access == AS_public) return AR_accessible;
   assert(Access == AS_private || Access == AS_protected);
 
+  if (EC.isInContractCondition() && isa<FunctionDecl>(EC.getInnerContext())) {
+    // C++2a [dcl.attr.contract.cond]p4:
+    //   The predicate of a contract condition has the same semantic
+    //   restrictions as if it appeared as the first expression-statement in
+    //   the body of the function it applies to. Additional access restrictions
+    //   apply to names appearing in a contract condition of a member function
+    //   of class C:
+    //     - Friendship is not considered.
+    //     - For a contract condition of a public member function, no member of
+    //       C or of an enclosing class of C is accessible unless it is a public
+    //       member of C, or a member of a base class accessible as a public
+    //       member of C.
+    //     - For a contract condition of a protected member function, no member
+    //       of C or of an enclosing class of C is accessible unless it is a
+    //       public or protected member of C, or a member of a base class
+    //       accessible as a public or protected member of C.
+    //   For names appearing in a contract condition of a non-member function,
+    //   friendship is not considered.
+    auto *Func = cast<FunctionDecl>(EC.getInnerContext())->getCanonicalDecl();
+    if (Func->isCXXClassMember()) {
+      // The above wording lets us take a very interesting shortcut. Consider a
+      // protected member function in a class C. It's explicitly stated that its
+      // contract conditions can't access private members or bases of C, but a
+      // consequence of ignoring friendship is that it can't access private
+      // members or bases of *any* class (even those entirely unrelated to C).
+      // This lets us instantly deny access to targets with stronger access
+      // restrictions without checking anything about the involved classes.
+      // In cases where the access levels match, we fall back to the regular
+      // logic (with one extra restriction in GetFriendKind).
+      if (Func->getAccess() < Access)
+        return AR_inaccessible;
+    } else {
+      // Without friendship, there's no way for a non-member function to access
+      // private or protected targets in any class.
+      return AR_inaccessible;
+    }
+  }
+
   AccessResult OnFailure = AR_inaccessible;
 
   for (EffectiveContext::record_iterator
          I = EC.Records.begin(), E = EC.Records.end(); I != E; ++I) {
     // All the declarations in EC have been canonicalized, so pointer
     // equality from this point on will work fine.
     const CXXRecordDecl *ECRecord = *I;
 
static Sema::AccessResult CheckAccess(Sema &S, SourceLocation Loc,
   // For example, we might be parsing a declaration with a scope
   // specifier, like this:
   //   A::private_type A::foo() { ... }
   //
   // Or we might be parsing something that will turn out to be a friend:
   //   void foo(A::private_type);
   //   void B::foo(A::private_type);
   if (S.DelayedDiagnostics.shouldDelayDiagnostics()) {
-    S.DelayedDiagnostics.add(DelayedDiagnostic::makeAccess(Loc, Entity));
+    S.DelayedDiagnostics.add(
+        DelayedDiagnostic::makeAccess(Loc, Entity,
+                                      S.InContractConditionPredicate));
     return Sema::AR_delayed;
   }
 
-  EffectiveContext EC(S.CurContext);
+  EffectiveContext EC(S.CurContext, S.InContractConditionPredicate);
   switch (CheckEffectiveAccess(S, EC, Loc, Entity)) {
   case AR_accessible: return Sema::AR_accessible;
   case AR_inaccessible: return Sema::AR_inaccessible;
   case AR_dependent: return Sema::AR_dependent;
   }
   llvm_unreachable("invalid access result");
 }
 
 void Sema::HandleDelayedAccessCheck(DelayedDiagnostic &DD, Decl *D) {
   // Access control for names used in the declarations of functions
   // and function templates should normally be evaluated in the context
   // of the declaration, just in case it's a friend of something.
   // However, this does not apply to local extern declarations.
 
   DeclContext *DC = D->getDeclContext();
   if (D->isLocalExternDecl()) {
     DC = D->getLexicalDeclContext();
   } else if (FunctionDecl *FN = dyn_cast<FunctionDecl>(D)) {
     DC = FN;
   } else if (TemplateDecl *TD = dyn_cast<TemplateDecl>(D)) {
     DC = cast<DeclContext>(TD->getTemplatedDecl());
   }
 
-  EffectiveContext EC(DC);
+  EffectiveContext EC(DC, DD.isFromContractCondition());
 
   AccessTarget Target(DD.getAccessData());
 
   if (CheckEffectiveAccess(*this, EC, DD.Loc, Target) == ::AR_inaccessible)
     DD.Triggered = true;
 }
 
 void Sema::HandleDependentAccessCheck(const DependentDiagnostic &DD,
AccessTarget entity(Context, AccessTarget::Member,
                       DeclAccessPair::make(target, access),
                       /*no instance context*/ QualType());
   entity.setDiag(diag::err_access_friend_function)
       << (method->getQualifier() ? method->getQualifierLoc().getSourceRange()
                                  : method->getNameInfo().getSourceRange());
 
   // We need to bypass delayed-diagnostics because we might be called
   // while the ParsingDeclarator is active.
-  EffectiveContext EC(CurContext);
+  EffectiveContext EC(CurContext, InContractConditionPredicate);
   switch (CheckEffectiveAccess(*this, EC, target->getLocation(), entity)) {
   case ::AR_accessible: return Sema::AR_accessible;
   case ::AR_inaccessible: return Sema::AR_inaccessible;
   case ::AR_dependent: return Sema::AR_dependent;
   }
   llvm_unreachable("invalid access result");
 }
 
if (Target->getAccess() == AS_public)
       return true;
     QualType qType = Class->getTypeForDecl()->getCanonicalTypeInternal();
     // The unprivileged access is AS_none as we don't know how the member was
     // accessed, which is described by the access in DeclAccessPair.
     // `IsAccessible` will examine the actual access of Target (i.e.
     // Decl->getAccess()) when calculating the access.
     AccessTarget Entity(Context, AccessedEntity::Member, Class,
                         DeclAccessPair::make(Target, AS_none), qType);
-    EffectiveContext EC(CurContext);
+    EffectiveContext EC(CurContext, InContractConditionPredicate);
     return ::IsAccessible(*this, EC, Entity) != ::AR_inaccessible;
   }
 
   if (ObjCIvarDecl *Ivar = dyn_cast<ObjCIvarDecl>(Target)) {
     // @public and @package ivars are always accessible.
     if (Ivar->getCanonicalAccessControl() == ObjCIvarDecl::Public ||
         Ivar->getCanonicalAccessControl() == ObjCIvarDecl::Package)
       return true;

lib/Sema/SemaCast.cpp

Sema::ActOnCXXNamedCast(SourceLocation OpLoc, tok::TokenKind Kind,
   assert(!D.isInvalidType());
 
   TypeSourceInfo *TInfo = GetTypeForDeclaratorCast(D, E->getType());
   if (D.isInvalidType())
     return ExprError();
 
   if (getLangOpts().CPlusPlus) {
     // Check that there are no default arguments (C++ only).
-    CheckExtraCXXDefaultArguments(D);
+    CheckCXXNonDeclFunctionRestrictions(D);
   }
 
   return BuildCXXNamedCast(OpLoc, Kind, TInfo, E,
                            SourceRange(LAngleBracketLoc, RAngleBracketLoc),
                            SourceRange(LParenLoc, RParenLoc));
 }
 
 ExprResult

lib/Sema/SemaContract.cpp

+//===--- SemaContract.cpp - Semantic Analysis for Contracts ---------------===//
+//
+//                     The LLVM Compiler Infrastructure
+//
+// This file is distributed under the University of Illinois Open Source
+// License. See LICENSE.TXT for details.
+//
+//===----------------------------------------------------------------------===//
+
+#include "clang/AST/AttrContract.h"
+#include "clang/AST/Decl.h"
+#include "clang/Basic/Contract.h"
+#include "clang/Sema/SemaInternal.h"
+#include "clang/Sema/TypoCorrection.h"
+#include "llvm/ADT/STLExtras.h"
+#include "llvm/Support/CastingIterators.h"
+#include "TreeTransform.h"
+#include <cassert>
+
+using namespace clang;
+
+TypoCorrection Sema::CorrectTypoInContractLevel(IdentifierInfo *GivenIdent,
+                                                SourceLocation GivenLoc) {
+  assert(GivenIdent && "Nothing to correct!");
+  DeclarationNameInfo Given(GivenIdent, GivenLoc);
+
+  auto Callback = llvm::make_unique<CorrectionCandidateCallback>(GivenIdent);
+  Callback->WantCXXNamedCasts = false;
+  Callback->WantExpressionKeywords = false;
+  Callback->WantFunctionLikeCasts = false;
+  Callback->WantObjCSuper = false;
+  Callback->WantRemainingKeywords = true;
+  Callback->WantTypeSpecifiers = false;
+
+  TypoCorrectionConsumer Corrector(*this, Given, LookupOrdinaryName,
+                                   /* Scope */nullptr, /* ScopeSpec */nullptr,
+                                   std::move(Callback),
+                                   /* MemberContext */nullptr,
+                                   /* EnteringContext */false);
+  Corrector.addKeywordResult("default");
+  Corrector.addKeywordResult("audit");
+  Corrector.addKeywordResult("axiom");
+
+  return Corrector.empty()
+             ? FailedCorrection(GivenIdent, GivenLoc, false)
+             : Corrector.getNextCorrection();
+}
+
+/// Invoked when we've parsed an identifier that represents the function result
+/// object in a postcondition contract.
+/// \param ResultType Type of the result variable, if known. If this is
+///                   supplied, the analysis will require one fewer step.
+DeclResult Sema::ActOnContractResultIdentifier(IdentifierInfo *Id,
+                                               SourceLocation IdLoc,
+                                               QualType ResultTy) {
+  assert(getCurScope()->isContractAttributeScope());
+
+  if (ResultTy.isNull() || ResultTy->isUndeducedType()) {
+    // We don't know what the result type is yet. In the meantime, we'll use a
+    // placeholder dependent type to allow for initial parsing of the predicate.
+    ResultTy = Context.DependentTy;
+  }
+
+  // Temporarily add the variable to the translation unit until we have an
+  // associated function declaration.
+  auto *VD = VarDecl::Create(Context, Context.getTranslationUnitDecl(), IdLoc,
+                             IdLoc, Id, ResultTy, /* TInfo */nullptr, SC_None);
+  VD->setContractFunctionResult(true);
+  if (ValidateContractResultVariable(VD))
+    VD->setInvalidDecl();
+
+  // Add the variable to scope so it can be used in the predicate.
+  PushOnScopeChains(VD, getCurScope(), /* AddToContext */false);
+
+  return VD;
+}
+
+Sema::EnterContractPredicateRAII::EnterContractPredicateRAII(Sema &S,
+                                                             ContractKind K)
+    : S(S), Entered(true),
+      OldInContractConditionPredicate(S.InContractConditionPredicate) {
+  // C++2a [dcl.attr.contract.syn]p5:
+  //   [...]
+  //   Note: The predicate of a contract is potentially evaluated.
+  S.PushExpressionEvaluationContext(
+      ExpressionEvaluationContext::PotentiallyEvaluated);
+
+  // Note whether this is a contract condition.
+  switch (K) {
+  case ContractKind::Expects:
+  case ContractKind::Ensures:
+    S.InContractConditionPredicate = true;
+    break;
+
+  default:
+    S.InContractConditionPredicate = false;
+  }
+}
+
+void Sema::EnterContractPredicateRAII::Exit() {
+  if (!Entered)
+    return;
+
+  S.InContractConditionPredicate = OldInContractConditionPredicate;
+  S.PopExpressionEvaluationContext();
+  Entered = false;
+}
+
+/// Invoked when we've parsed a complete contract attribute.
+/// \param ResultVar If this is a postcondition, this should be the result
+///                  object returned from \c ActOnContractResultIdentifier.
+ContractResult Sema::ActOnContractAttribute(SourceRange Range,
+                                            ContractKind Kind,
+                                            SourceLocation KindLoc,
+                                            ContractLevel Level,
+                                            SourceLocation LevelLoc,
+                                            DeclResult ResultVar,
+                                            SourceLocation ColonLoc,
+                                            ConditionResult Predicate) {
+  assert(!Predicate.get().first &&
+         "Contract predicate shouldn't declare a variable");
+
+  return BuildContractAttribute(Range, Kind, KindLoc, Level, LevelLoc,
+                                cast_or_null<VarDecl>(ResultVar.get()),
+                                ColonLoc, Predicate.get().second);
+}
+
+/// Build an AST node for a contract attribute.
+ContractResult Sema::BuildContractAttribute(SourceRange Range,
+                                            ContractKind Kind,
+                                            SourceLocation KindLoc,
+                                            ContractLevel Level,
+                                            SourceLocation LevelLoc,
+                                            VarDecl *ResultVar,
+                                            SourceLocation ColonLoc,
+                                            Expr *Predicate) {
+  assert(Predicate && "Contract must have a predicate");
+
+  switch (Kind) {
+  case ContractKind::Expects:
+    return new (Context) ExpectsContract(Range, KindLoc, Level, LevelLoc,
+                                         ColonLoc, Predicate);
+  case ContractKind::Ensures:
+    return new (Context) EnsuresContract(Range, KindLoc, Level, LevelLoc,
+                                         ResultVar, ColonLoc, Predicate);
+  case ContractKind::Assert:
+    return new (Context) AssertContract(Range, KindLoc, Level, LevelLoc,
+                                        ColonLoc, Predicate);
+  }
+}
+
+/// Invoked after parsing contracts that were initially delayed (e.g. because
+/// they're lexically contained in a class).
+void Sema::ActOnDelayedContractAttributes(ArrayRef<ContractResult> Results,
+                                          FunctionDecl *Method) {
+  if (Results.empty())
+    return;
+
+  // We only really need to add the contracts to the method declaration, but the
+  // contracts are coming from the parser so we need to unwrap them first.
+  SmallVector<ContractAttr *, 16> Contracts;
+  Contracts.reserve(Results.size());
+  llvm::transform(Results, std::back_inserter(Contracts),
+                  std::mem_fn(&ContractResult::get));
+  AttachContractsToFunctionDecl(Contracts, Method);
+}
+
+/// Check if the given variable is suitable for use in a postcondition contract.
+/// \returns true if an error was found and diagnosed.
+bool Sema::ValidateContractResultVariable(const VarDecl *VD) {
+  assert(VD->isContractFunctionResult());
+
+  // Silently fail if the variable is already invalid.
+  if (VD->isInvalidDecl())
+    return true;
+
+  // Check for a valid result type.
+  if (VD->getType()->isVoidType()) {
+    Diag(VD->getBeginLoc(), diag::err_contract_result_void);
+    return true;
+  }
+
+  return false;
+}
+
+/// Finish processing the contracts and install them on the given function decl.
+void Sema::AttachContractsToFunctionDecl(ArrayRef<ContractAttr *> Contracts,
+                                         FunctionDecl *FD) {
+  assert(!Contracts.empty());
+  for (auto *C : llvm::make_dyn_cast_range<EnsuresContract>(Contracts)) {
+    // Set the context of the result variable declarations.
+    // See 'ActOnContractResultIdentifier' for when this was set originally.
+    if (C->getResultVar())
+      C->getResultVar()->setDeclContext(FD);
+  }
+  FD->setContracts(Contracts);
+}
+
+namespace {
+
+/// Transformation that updates the result type for postconditions in-place.
+/// \see Sema::UpdateFunctionContractsWithNewResultType.
+class ResultTypeUpdater final : private TreeTransform<ResultTypeUpdater> {
+public:
+  friend TreeTransform;
+  using TreeTransform::TreeTransform;
+
+  bool Update(ArrayRef<ContractAttr *> Contracts, QualType NewType) {
+    bool Err = false;
+    for (auto *Post : llvm::make_dyn_cast_range<EnsuresContract>(Contracts)) {
+      // Postconditions that don't declare a result variable can't depend on the
+      // return type in any way, so we can skip them entirely.
+      CurrentResultVar = Post->getResultVar();
+      if (!CurrentResultVar)
+        continue;
+
+      // Update the result variable with the new type.
+      CurrentResultVar->setType(NewType);
+      if (getSema().ValidateContractResultVariable(CurrentResultVar))
+        CurrentResultVar->setInvalidDecl();
+
+      // Transform the predicate.
+      ExprResult Result = TransformContractPredicate(Post);
+
+      // Update the contract with the new predicate.
+      if (!Result.isInvalid())
+        Post->setPredicate(Result.get());
+      else
+        Err = true;
+    }
+    return Err;
+  }
+
+  ExprResult TransformDeclRefExpr(DeclRefExpr *E) {
+    // We always want to rebuild expressions that reference the result variable
+    // because we've just updated its type.
+    if (E->getDecl() == CurrentResultVar) {
+      assert(!E->hasExplicitTemplateArgs());
+      return RebuildDeclRefExpr(E->getQualifierLoc(), CurrentResultVar,
+                                E->getNameInfo(), /* TemplateArgs */nullptr);
+    }
+
+    return TreeTransform::TransformDeclRefExpr(E);
+  }
+
+private:
+  VarDecl *CurrentResultVar;
+};
+
+} // end unnamed namespace
+
+/// Re-analyse postconditions that reference the function result object.
+/// This should be used if the return type wasn't known at the time of parsing.
+/// \returns true if an error occurred while updating.
+bool Sema::UpdateFunctionContractsWithNewResultType(FunctionDecl *FD) {
+  const QualType RetTy = FD->getReturnType();
+  if(RetTy->isUndeducedType())
+    return false;
+
+  ContextRAII FuncCtx(*this, FD);
+  return ResultTypeUpdater(*this).Update(FD->contracts(), RetTy);
+}
+
+namespace {
+
+/// Transformation that copies contracts from the original declaration over to a
+/// redeclaration that was written without any contracts requirements.
+/// \see Sema::MergeContractsOnFunctionRedecl.
+class RedeclCopier : private TreeTransform<RedeclCopier> {
+public:
+  using TreeTransform::TreeTransform;
+  friend TreeTransform;
+
+  void Copy(FunctionDecl *New, FunctionDecl *Old) {
+    assert(New->contracts().empty() && "Trying to overwrite contracts");
+    assert(!Old->isInvalidDecl() &&
+           "Trying to copy contracts from an invalid decl");
+
+    // Transform old template parameter references to the new ones.
+    assert(Old->getTemplatedKind() == New->getTemplatedKind());
+    if (Old->getTemplatedKind() != FunctionDecl::TK_NonTemplate) {
+      TemplateParameterList *OldTParams =
+          Old->getDescribedFunctionTemplate()->getTemplateParameters();
+      TemplateParameterList *NewTParams =
+          New->getDescribedFunctionTemplate()->getTemplateParameters();
+
+      assert(OldTParams->size() == NewTParams->size());
+      for (auto T : llvm::zip_first(*OldTParams, *NewTParams))
+        transformedLocalDecl(std::get<0>(T), std::get<1>(T));
+    }
+
+    // Transform old parameter references to the new ones.
+    assert(Old->param_size() == New->param_size());
+    for (auto P : llvm::zip_first(Old->parameters(), New->parameters()))
+      transformedLocalDecl(std::get<0>(P), std::get<1>(P));
+
+    SmallVector<ContractAttr *, 4> NewContracts;
+    NewContracts.reserve(Old->contracts().size());
+    for (ContractAttr *C : Old->contracts()) {
+      // If this is a postcondition that declares a result variable, transform
+      // it to a new variable that lives in the context of the new function.
+      if (VarDecl *ResultVar = isa<EnsuresContract>(C)
+                                   ? cast<EnsuresContract>(C)->getResultVar()
+                                   : nullptr) {
+        auto *NewResultVar = VarDecl::Create(getSema().Context, New,
+                                             SourceLocation(), SourceLocation(),
+                                             ResultVar->getIdentifier(),
+                                             ResultVar->getType(),
+                                             ResultVar->getTypeSourceInfo(),
+                                             ResultVar->getStorageClass());
+        NewResultVar->setContractFunctionResult(true);
+
+        transformedLocalDecl(ResultVar, NewResultVar);
+      }
+
+      ContractResult Result = TransformContractAttr(C);
+      assert(Result.isUsable() && "Rebuilding shouldn't fail");
+      NewContracts.push_back(Result.get());
+    }
+    New->setContracts(NewContracts);
+    New->setInheritedContracts();
+  }
+
+  QualType TransformTemplateTypeParmType(TypeLocBuilder &TLB,
+                                         TemplateTypeParmTypeLoc TL) {
+    auto Found = TransformedLocalDecls.find(TL.getDecl());
+    if (Found != TransformedLocalDecls.end()) {
+      auto *TDecl = cast<TemplateTypeParmDecl>(Found->second);
+
+      auto TLoc = TLB.push<TemplateTypeParmTypeLoc>({
+                      TDecl->getTypeForDecl(),
+                      TL.getType().getQualifiers().getAsOpaqueValue()});
+      TLoc.setNameLoc(TDecl->getLocation());
+
+      return TLoc.getType();
+    }
+
+    return TreeTransform::TransformTemplateTypeParmType(TLB, TL);
+  }
+};
+
+} // end unnamed namespace
+
+/// Validate and merge the contracts on a function redeclaration.
+/// \returns true if an error occurred.
+bool Sema::MergeContractsOnFunctionRedecl(FunctionDecl *New,
+                                          FunctionDecl *OldNotFirst) {
+  // C++2a [dcl.attr.contract.cond]p1:
+  //   The first declaration of a function shall specify all contract conditions
+  //   (if any) of the function. Subsequent declarations shall either specify no
+  //   contract conditions or the same list of contract conditions; [...]
+
+  // Always compare against the first declaration so the diagnostics highlight
+  // the most relevant locations. If there're any intermediate declarations, we
+  // assume that their contracts have already been checked and merged.
+  FunctionDecl *Old = OldNotFirst->getFirstDecl();
+
+  // Omitting contracts on a redeclaration is never erroneous.
+  if (New->contracts().empty()) {
+    if (!Old->contracts().empty()) {
+      // Copy over the old contracts.
+      ContextRAII FuncCtx(*this, New);
+      RedeclCopier(*this).Copy(New, Old);
+    }
+    return false;
+  }
+
+  bool Invalid = false;
+
+  // Helper to ensure that we emit the error at most once; subsequent
+  // communication is handled through notes.
+  auto EmitErr = [&] {
+    if (Invalid)
+      return;
+    Diag(New->getLocation(), diag::err_incompatible_contracts_on_redecl)
+      << New;
+    Invalid = true;
+  };
+
+  const std::size_t NewCount = New->contracts().size();
+  const std::size_t OldCount = Old->contracts().size();
+
+  // C++2a [dcl.attr.contract.cond]p2:
+  //   Two lists of contract conditions are the same if they consist of the same
+  //   contract conditions in the same order. [...]
+  for (std::size_t i = 0, End = std::min(NewCount, OldCount); i < End; ++i) {
+    const ContractAttr *NewContract = New->contracts()[i];
+    const ContractAttr *OldContract = Old->contracts()[i];
+    const auto Ordinal = static_cast<unsigned>(i + 1);
+
+    // C++2a [dcl.attr.contract.cond]p2:
+    //   [...] Two contract conditions are the same if their contract levels are
+    //   the same and their predicates are the same. [...]
+    if (NewContract->getKind() != OldContract->getKind() ||
+        NewContract->getLevel() != OldContract->getLevel()) {
+      EmitErr();
+      Diag(NewContract->getKindLoc(), diag::note_redecl_contract_type)
+        << Ordinal
+        << static_cast<int>(NewContract->getKind())
+        << static_cast<int>(NewContract->getLevel());
+      Diag(OldContract->getKindLoc(), diag::note_orig_contract_type)
+        << static_cast<int>(OldContract->getKind())
+        << static_cast<int>(OldContract->getLevel());
+
+      // Don't bother checking the predicate if the type doesn't match.
+      continue;
+    }
+
+    // C++2a [dcl.attr.contract.cond]p2:
+    //   [...] Two predicates contained in contract-attribute-specifiers are the
+    //   same if they would satisfy the one-definition rule were they to appear
+    //   in function definitions, except for renaming of parameters, return
+    //   value identifiers (if any), and template parameters.
+    llvm::FoldingSetNodeID OldFSN, NewFSN;
+    OldContract->getPredicate()->Profile(OldFSN, Context, true);
+    NewContract->getPredicate()->Profile(NewFSN, Context, true);
+    if (OldFSN != NewFSN) {
+      EmitErr();
+      Diag(NewContract->getPredicate()->getBeginLoc(),
+           diag::note_redecl_contract_pred) << Ordinal;
+      Diag(OldContract->getPredicate()->getBeginLoc(),
+           diag::note_orig_contract_pred);
+    }
+  }
+
+  // Check for a size mismatch.
+  if (NewCount != OldCount) {
+    const bool NewHasMore = NewCount > OldCount;
+
+    // Get an iterator pair over the range of excess contracts.
+    ArrayRef<ContractAttr *>::iterator It, End;
+    if (NewHasMore) {
+      It = New->contracts().begin();
+      End = New->contracts().end();
+      std::advance(It, OldCount);
+    } else {
+      It = Old->contracts().begin();
+      End = Old->contracts().end();
+      std::advance(It, NewCount);
+    }
+
+    // Highlight the missing contracts.
+    EmitErr();
+    auto Builder = Diag((*It)->getBeginLoc(), diag::note_missing_contracts)
+                     << NewHasMore
+                     << static_cast<int>(std::distance(It, End));
+    for (; It != End; ++It)
+      Builder << (*It)->getRange();
+  }
+
+  return Invalid;
+}

lib/Sema/SemaDecl.cpp

 //  This file implements semantic analysis for declarations.
 //
 //===----------------------------------------------------------------------===//
 
 #include "TypeLocBuilder.h"
 #include "clang/AST/ASTConsumer.h"
 #include "clang/AST/ASTContext.h"
 #include "clang/AST/ASTLambda.h"
+#include "clang/AST/AttrContract.h"
 #include "clang/AST/CXXInheritance.h"
 #include "clang/AST/CharUnits.h"
 #include "clang/AST/CommentDiagnostic.h"
 #include "clang/AST/DeclCXX.h"
 #include "clang/AST/DeclObjC.h"
 #include "clang/AST/DeclTemplate.h"
 #include "clang/AST/EvaluatedExprVisitor.h"
 #include "clang/AST/ExprCXX.h"

 #include "clang/Sema/Lookup.h"
 #include "clang/Sema/ParsedTemplate.h"
 #include "clang/Sema/Scope.h"
 #include "clang/Sema/ScopeInfo.h"
 #include "clang/Sema/SemaInternal.h"
 #include "clang/Sema/Template.h"
 #include "llvm/ADT/SmallString.h"
 #include "llvm/ADT/Triple.h"
+#include "llvm/Support/CastingIterators.h"
 #include <algorithm>
 #include <cstring>
 #include <functional>
 
 using namespace clang;
 using namespace sema;
 
 Sema::DeclGroupPtrTy Sema::ConvertDeclToDeclGroup(Decl *Ptr, Decl *OwnedType) {
static bool ShouldDiagnoseUnusedDecl(const NamedDecl *D) {
 
   if (Referenced || D->hasAttr<UnusedAttr>() ||
       D->hasAttr<ObjCPreciseLifetimeAttr>())
     return false;
 
   if (isa<LabelDecl>(D))
     return true;
 
+  if (isa<VarDecl>(D) && cast<VarDecl>(D)->isContractFunctionResult())
+    return true;
+
   // Except for labels, we only care about unused decls that are local to
   // functions.
   bool WithinFunction = D->getDeclContext()->isFunctionOrMethod();
   if (const auto *R = dyn_cast<CXXRecordDecl>(D->getDeclContext()))
     // For dependent types, the diagnostic is deferred.
     WithinFunction =
         WithinFunction || (R->isLocalClass() && !R->isDependentType());
   if (!WithinFunction)
NamedDecl *Sema::HandleDeclarator(Scope *S, Declarator &D,
   if (Previous.isSingleTagDecl() &&
       D.getDeclSpec().getStorageClassSpec() != DeclSpec::SCS_typedef &&
       (TemplateParamLists.size() == 0 || R->isFunctionType()))
     Previous.clear();
 
   // Check that there are no default arguments other than in the parameters
   // of a function declaration (C++ only).
   if (getLangOpts().CPlusPlus)
-    CheckExtraCXXDefaultArguments(D);
+    CheckCXXNonDeclFunctionRestrictions(D);
 
   NamedDecl *New;
 
   bool AddToScope = true;
   if (D.getDeclSpec().getStorageClassSpec() == DeclSpec::SCS_typedef) {
     if (TemplateParamLists.size()) {
       Diag(D.getIdentifierLoc(), diag::err_template_typedef);
       return nullptr;
if (I != ExtnameUndeclaredIdentifiers.end()) {
         NewFD->addAttr(I->second);
         ExtnameUndeclaredIdentifiers.erase(I);
       } else
         Diag(NewFD->getLocation(), diag::warn_redefine_extname_not_applied)
             << /*Variable*/0 << NewFD;
     }
   }
 
-  // Copy the parameter declarations from the declarator D to the function
-  // declaration NewFD, if they are available.  First scavenge them into Params.
   SmallVector<ParmVarDecl*, 16> Params;
+  ArrayRef<ContractAttr*> Contracts;
+
+  // Copy the parameter declarations and contract attributes from the declarator
+  // D to the function declaration NewFD, if they are available. First scavenge
+  // them into local storage.
   unsigned FTIIdx;
   if (D.isFunctionDeclarator(FTIIdx)) {
     DeclaratorChunk::FunctionTypeInfo &FTI = D.getTypeObject(FTIIdx).Fun;
 
     // Check for C99 6.7.5.3p10 - foo(void) is a non-varargs
     // function that takes no arguments, not a function that takes a
     // single void argument.
     // We let through "const void" here because Sema::GetTypeForDeclarator
     // already checks for that case.
     if (FTIHasNonVoidParameters(FTI) && FTI.Params[0].Param) {
       for (unsigned i = 0, e = FTI.NumParams; i != e; ++i) {
         ParmVarDecl *Param = cast<ParmVarDecl>(FTI.Params[i].Param);
         assert(Param->getDeclContext() != NewFD && "Was set before ?");
         Param->setDeclContext(NewFD);
         Params.push_back(Param);
 
         if (Param->isInvalidDecl())
           NewFD->setInvalidDecl();
       }
     }
 
+    // Get the contracts from the declarator.
+    if (FTI.NumParsedContracts > 0) {
+      Contracts = llvm::makeArrayRef(FTI.ParsedContracts,
+                                     FTI.NumParsedContracts);
+    }
+
     if (!getLangOpts().CPlusPlus) {
       // In C, find all the tag declarations from the prototype and move them
       // into the function DeclContext. Remove them from the surrounding tag
       // injection context of the function, which is typically but not always
       // the TU.
       DeclContext *PrototypeTagContext =
           getTagInjectionContext(NewFD->getLexicalDeclContext());
       for (NamedDecl *NonParmDecl : FTI.getDeclsInPrototype()) {
Sema::ActOnFunctionDeclarator(Scope *S, Declarator &D, DeclContext *DC,
   } else {
     assert(R->isFunctionNoProtoType() && NewFD->getNumParams() == 0 &&
            "Should not need args for typedef of non-prototype fn");
   }
 
   // Finally, we know we have the right number of parameters, install them.
   NewFD->setParams(Params);
 
+  // Install the contracts.
+  if (!Contracts.empty()) {
+    AttachContractsToFunctionDecl(Contracts, NewFD);
+
+    // The result type wasn't known when parsing the declarator.
+    if (UpdateFunctionContractsWithNewResultType(NewFD))
+      NewFD->setInvalidDecl();
+  }
+
   if (D.getDeclSpec().isNoreturnSpecified())
     NewFD->addAttr(
         ::new(Context) C11NoReturnAttr(D.getDeclSpec().getNoreturnSpecLoc(),
                                        Context, 0));
 
   // Functions returning a variably modified type violate C99 6.7.5.2p2
   // because all functions have linkage.
   if (!NewFD->isInvalidDecl() &&
Decl *Sema::ActOnParamDeclarator(Scope *S, Declarator &D) {
   DiagnoseFunctionSpecifiers(DS);
 
   TypeSourceInfo *TInfo = GetTypeForDeclarator(D, S);
   QualType parmDeclType = TInfo->getType();
 
   if (getLangOpts().CPlusPlus) {
     // Check that there are no default arguments inside the type of this
     // parameter.
-    CheckExtraCXXDefaultArguments(D);
+    CheckCXXNonDeclFunctionRestrictions(D);
 
     // Parameter declarators cannot be qualified (C++ [dcl.meaning]p1).
     if (D.getCXXScopeSpec().isSet()) {
       Diag(D.getIdentifierLoc(), diag::err_qualified_param_declarator)
         << D.getCXXScopeSpec().getRange();
       D.getCXXScopeSpec().clear();
     }
   }
if (getLangOpts().CPlusPlus14) {
         // the deduced result type is 'void'.
         if (!FD->getReturnType()->getAs<AutoType>()) {
           Diag(dcl->getLocation(), diag::err_auto_fn_no_return_but_not_auto)
               << FD->getReturnType();
           FD->setInvalidDecl();
         } else {
           // Substitute 'void' for the 'auto' in the type.
           TypeLoc ResultType = getReturnTypeLoc(FD);
-          Context.adjustDeducedFunctionResultType(
+          AdjustDeducedFunctionResultType(
               FD, SubstAutoType(ResultType.getType(), Context.VoidTy));
         }
       }
     } else if (getLangOpts().CPlusPlus11 && isLambdaCallOperator(FD)) {
       // In C++11, we don't use 'auto' deduction rules for lambda call
       // operators because we don't support return type deduction.
       auto *LSI = getCurLambda();
       if (LSI->HasImplicitReturnType) {
FieldDecl *Sema::HandleField(Scope *S, RecordDecl *Record,
 
   IdentifierInfo *II = D.getIdentifier();
   SourceLocation Loc = DeclStart;
   if (II) Loc = D.getIdentifierLoc();
 
   TypeSourceInfo *TInfo = GetTypeForDeclarator(D, S);
   QualType T = TInfo->getType();
   if (getLangOpts().CPlusPlus) {
-    CheckExtraCXXDefaultArguments(D);
+    CheckCXXNonDeclFunctionRestrictions(D);
 
     if (DiagnoseUnexpandedParameterPack(D.getIdentifierLoc(), TInfo,
                                         UPPC_DataMemberType)) {
       D.setInvalidType();
       T = Context.IntTy;
       TInfo = Context.getTrivialTypeSourceInfo(T, Loc);
     }
   }

lib/Sema/SemaDeclCXX.cpp

 //  This file implements semantic analysis for C++ declarations.
 //
 //===----------------------------------------------------------------------===//
 
 #include "clang/AST/ASTConsumer.h"
 #include "clang/AST/ASTContext.h"
 #include "clang/AST/ASTLambda.h"
 #include "clang/AST/ASTMutationListener.h"
+#include "clang/AST/AttrContract.h"
 #include "clang/AST/CXXInheritance.h"
 #include "clang/AST/CharUnits.h"
 #include "clang/AST/ComparisonCategories.h"
 #include "clang/AST/EvaluatedExprVisitor.h"
 #include "clang/AST/ExprCXX.h"
 #include "clang/AST/RecordLayout.h"
 #include "clang/AST/RecursiveASTVisitor.h"
 #include "clang/AST/StmtVisitor.h"
void Sema::ActOnParamDefaultArgumentError(Decl *param,
   Param->setInvalidDecl();
   UnparsedDefaultArgLocs.erase(Param);
   Param->setDefaultArg(new(Context)
                        OpaqueValueExpr(EqualLoc,
                                        Param->getType().getNonReferenceType(),
                                        VK_RValue));
 }
 
-/// CheckExtraCXXDefaultArguments - Check for any extra default
-/// arguments in the declarator, which is not a function declaration
-/// or definition and therefore is not permitted to have default
-/// arguments. This routine should be invoked for every declarator
-/// that is not a function declaration or definition.
-void Sema::CheckExtraCXXDefaultArguments(Declarator &D) {
-  // C++ [dcl.fct.default]p3
+/// Check the function types in a declarator for things that're only allowed on
+/// a function declaration or definition (e.g. default arguments). This routine
+/// should be invoked for every declarator that is not a function declaration or
+/// definition.
+void Sema::CheckCXXNonDeclFunctionRestrictions(Declarator &D) {
+  bool MightBeFunction = D.isFunctionDeclarationContext();
+  for (const DeclaratorChunk &Chunk : D.type_objects()) {
+    switch (Chunk.Kind) {
+    case DeclaratorChunk::Function:
+      if (MightBeFunction) {
+        // This is a function declaration; keep looking in case its return type
+        // or parameter types are function types.
+        MightBeFunction = false;
+        continue;
+      }
+
+      // C++ [dcl.fct.default]p3:
       //   A default argument expression shall be specified only in the
       //   parameter-declaration-clause of a function declaration or in a
       //   template-parameter (14.1). It shall not be specified for a
       //   parameter pack. If it is specified in a
       //   parameter-declaration-clause, it shall not occur within a
       //   declarator or abstract-declarator of a parameter-declaration.
-  bool MightBeFunction = D.isFunctionDeclarationContext();
-  for (unsigned i = 0, e = D.getNumTypeObjects(); i != e; ++i) {
-    DeclaratorChunk &chunk = D.getTypeObject(i);
-    if (chunk.Kind == DeclaratorChunk::Function) {
-      if (MightBeFunction) {
-        // This is a function declaration. It can have default arguments, but
-        // keep looking in case its return type is a function type with default
-        // arguments.
-        MightBeFunction = false;
-        continue;
-      }
-      for (unsigned argIdx = 0, e = chunk.Fun.NumParams; argIdx != e;
-           ++argIdx) {
-        ParmVarDecl *Param = cast<ParmVarDecl>(chunk.Fun.Params[argIdx].Param);
+      for (DeclaratorChunk::ParamInfo &ParamInfo :
+               llvm::make_range(Chunk.Fun.Params,
+                                Chunk.Fun.Params + Chunk.Fun.NumParams)) {
+        auto *Param = cast<ParmVarDecl>(ParamInfo.Param);
         if (Param->hasUnparsedDefaultArg()) {
           std::unique_ptr<CachedTokens> Toks =
-              std::move(chunk.Fun.Params[argIdx].DefaultArgTokens);
+              std::move(ParamInfo.DefaultArgTokens);
           SourceRange SR;
           if (Toks->size() > 1)
             SR = SourceRange((*Toks)[1].getLocation(),
                              Toks->back().getLocation());
           else
             SR = UnparsedDefaultArgLocs[Param];
           Diag(Param->getLocation(), diag::err_param_default_argument_nonfunc)
             << SR;
         } else if (Param->getDefaultArg()) {
           Diag(Param->getLocation(), diag::err_param_default_argument_nonfunc)
             << Param->getDefaultArg()->getSourceRange();
           Param->setDefaultArg(nullptr);
         }
       }
-    } else if (chunk.Kind != DeclaratorChunk::Paren) {
+
+      // C++2a [dcl.attr.contract.cond]p3:
+      //   A function pointer cannot include contract conditions.
+      if (Chunk.Fun.NumParsedContracts > 0) {
+        Diag(Chunk.Fun.ParsedContracts[0]->getBeginLoc(),
+             diag::err_contract_attribute_nonfunc);
+      } else if (Chunk.Fun.ContractTokens) {
+        Diag(Chunk.Fun.ContractTokens->front().getLocation(),
+             diag::err_contract_attribute_nonfunc);
+      }
+
+      break;
+
+    case DeclaratorChunk::Paren:
+      break;
+
+    default:
       MightBeFunction = false;
     }
   }
 }
 
 static bool functionDeclHasDefaultArgument(const FunctionDecl *FD) {
   for (unsigned NumParams = FD->getNumParams(); NumParams > 0; --NumParams) {
     const ParmVarDecl *PVD = FD->getParamDecl(NumParams-1);
bool Sema::MergeCXXFunctionDecl(FunctionDecl *New, FunctionDecl *Old,
   auto *NewGuide = dyn_cast<CXXDeductionGuideDecl>(New);
   if (NewGuide && NewGuide->isExplicitSpecified() !=
                       cast<CXXDeductionGuideDecl>(Old)->isExplicitSpecified()) {
     Diag(New->getLocation(), diag::err_deduction_guide_explicit_mismatch)
       << NewGuide->isExplicitSpecified();
     Diag(Old->getLocation(), diag::note_previous_declaration);
   }
 
-  // C++11 [dcl.fct.default]p4: If a friend declaration specifies a default
-  // argument expression, that declaration shall be a definition and shall be
-  // the only declaration of the function or function template in the
-  // translation unit.
-  if (Old->getFriendObjectKind() == Decl::FOK_Undeclared &&
-      functionDeclHasDefaultArgument(Old)) {
+  if (Old->getFriendObjectKind() == Decl::FOK_Undeclared) {
+    // C++11 [dcl.fct.default]p4:
+    //   If a friend declaration specifies a default argument expression, that
+    //   declaration shall be a definition and shall be the only declaration of
+    //   the function or function template in the translation unit.
+    if (functionDeclHasDefaultArgument(Old)) {
       Diag(New->getLocation(), diag::err_friend_decl_with_def_arg_redeclared);
       Diag(Old->getLocation(), diag::note_previous_declaration);
       Invalid = true;
     }
 
+    // C++2a [dcl.attr.contract.cond]p1:
+    //   If a friend declaration is the first declaration of the function in a
+    //   translation unit and has a contract condition, the declaration shall be
+    //   a definition and shall be the only declaration of the function in the
+    //   translation unit.
+    if (!Old->contracts().empty()) {
+      Diag(New->getLocation(), diag::err_friend_decl_with_contracts_redeclared);
+      Diag(Old->getLocation(), diag::note_previous_declaration);
+      Invalid = true;
+    }
+  }
+
+  // Merge contracts if we haven't encountered an error yet.
+  Invalid = Invalid || MergeContractsOnFunctionRedecl(New, Old);
+
   return Invalid;
 }
 
 NamedDecl *
 Sema::ActOnDecompositionDeclarator(Scope *S, Declarator &D,
                                    MultiTemplateParamsArg TemplateParamLists) {
   assert(D.isDecompositionDeclarator());
   const DecompositionDeclarator &Decomp = D.getDecompositionDeclarator();
if (functionDeclHasDefaultArgument(FD)) {
       if (D.isRedeclaration()) {
         Diag(FD->getLocation(), diag::err_friend_decl_with_def_arg_redeclared);
         Diag(Previous.getRepresentativeDecl()->getLocation(),
              diag::note_previous_declaration);
       } else if (!D.isFunctionDefinition())
         Diag(FD->getLocation(), diag::err_friend_decl_with_def_arg_must_be_def);
     }
 
+    // C++2a [dcl.attr.contract.cond]p1:
+    //   If a friend declaration is the first declaration of the function in a
+    //   translation unit and has a contract condition, the declaration shall be
+    //   a definition and shall be the only declaration of the function in the
+    //   translation unit.
+    //
+    // Late-parsing hasn't happened yet, so we also need to check the declarator
+    // for any unparsed tokens.
+    {
+      unsigned Idx;
+      if (!FD->contracts().empty() ||
+          (D.isFunctionDeclarator(Idx) &&
+           D.getTypeObject(Idx).Fun.ContractTokens)) {
+        if (D.isRedeclaration()) {
+          Diag(FD->getLocation(),
+               diag::err_friend_decl_with_contracts_redeclared);
+          Diag(Previous.getRepresentativeDecl()->getLocation(),
+               diag::note_previous_declaration);
+        } else if (!D.isFunctionDefinition())
+          Diag(FD->getLocation(),
+               diag::err_friend_decl_with_contracts_must_be_def);
+      }
+    }
+
     // Mark templated-scope function declarations as unsupported.
     if (FD->getNumTemplateParameterLists() && SS.isValid()) {
       Diag(FD->getLocation(), diag::warn_template_qualified_friend_unsupported)
         << SS.getScopeRep() << SS.getRange()
         << cast<CXXRecordDecl>(CurContext);
       FrD->setUnsupportedFriend(true);
     }
   }
if (!II) {
     Diag(DeclStart, diag::err_anonymous_property);
     return nullptr;
   }
   SourceLocation Loc = D.getIdentifierLoc();
 
   TypeSourceInfo *TInfo = GetTypeForDeclarator(D, S);
   QualType T = TInfo->getType();
   if (getLangOpts().CPlusPlus) {
-    CheckExtraCXXDefaultArguments(D);
+    CheckCXXNonDeclFunctionRestrictions(D);
 
     if (DiagnoseUnexpandedParameterPack(D.getIdentifierLoc(), TInfo,
                                         UPPC_DataMemberType)) {
       D.setInvalidType();
       T = Context.IntTy;
       TInfo = Context.getTrivialTypeSourceInfo(T, Loc);
     }
   }

lib/Sema/SemaDeclObjC.cpp

if (DeclSpec::TSCS TSCS = D.getDeclSpec().getThreadStorageClassSpec())
      << DeclSpec::getSpecifierName(TSCS);
   D.getMutableDeclSpec().ClearStorageClassSpecs();
 
   DiagnoseFunctionSpecifiers(D.getDeclSpec());
 
   // Check that there are no default arguments inside the type of this
   // exception object (C++ only).
   if (getLangOpts().CPlusPlus)
-    CheckExtraCXXDefaultArguments(D);
+    CheckCXXNonDeclFunctionRestrictions(D);
 
   TypeSourceInfo *TInfo = GetTypeForDeclarator(D, S);
   QualType ExceptionType = TInfo->getType();
 
   VarDecl *New = BuildObjCExceptionDecl(TInfo, ExceptionType,
                                         D.getSourceRange().getBegin(),
                                         D.getIdentifierLoc(),
                                         D.getIdentifier(),

lib/Sema/SemaExpr.cpp

assert(!D.isInvalidType() && (CastExpr != nullptr) &&
          "ActOnCastExpr(): missing type or expr");
 
   TypeSourceInfo *castTInfo = GetTypeForDeclaratorCast(D, CastExpr->getType());
   if (D.isInvalidType())
     return ExprError();
 
   if (getLangOpts().CPlusPlus) {
     // Check that there are no default arguments (C++ only).
-    CheckExtraCXXDefaultArguments(D);
+    CheckCXXNonDeclFunctionRestrictions(D);
   } else {
     // Make sure any TypoExprs have been dealt with.
     ExprResult Res = CorrectDelayedTyposInExpr(CastExpr);
     if (!Res.isUsable())
       return ExprError();
     CastExpr = Res.get();
   }
 

lib/Sema/SemaStmt.cpp

 //  This file implements semantic analysis for statements.
 //
 //===----------------------------------------------------------------------===//
 
 #include "clang/Sema/SemaInternal.h"
 #include "clang/AST/ASTContext.h"
 #include "clang/AST/ASTDiagnostic.h"
 #include "clang/AST/ASTLambda.h"
+#include "clang/AST/AttrContract.h"
 #include "clang/AST/CharUnits.h"
 #include "clang/AST/CXXInheritance.h"
 #include "clang/AST/DeclObjC.h"
 #include "clang/AST/EvaluatedExprVisitor.h"
 #include "clang/AST/ExprCXX.h"
 #include "clang/AST/ExprObjC.h"
 #include "clang/AST/RecursiveASTVisitor.h"
 #include "clang/AST/StmtCXX.h"

 
 
 StmtResult Sema::ActOnExprStmtError() {
   DiscardCleanupsInEvaluationContext();
   return StmtError();
 }
 
 StmtResult Sema::ActOnNullStmt(SourceLocation SemiLoc,
-                               bool HasLeadingEmptyMacro) {
-  return NullStmt::Create(Context, SemiLoc, HasLeadingEmptyMacro);
+                               bool HasLeadingEmptyMacro,
+                               ArrayRef<ContractResult> Contracts) {
+  // Transform the contracts array from the parser's representation to an actual
+  // array of assertions.
+  SmallVector<AssertContract *, 4> Assertions;
+  Assertions.reserve(Contracts.size());
+  llvm::transform(Contracts, std::back_inserter(Assertions),
+                  [](ContractResult C) {
+    // Force cast; we shouldn't have any other contract kind here.
+    return cast<AssertContract>(C.get());
+  });
+
+  return BuildNullStmt(SemiLoc, HasLeadingEmptyMacro, Assertions);
+}
+
+StmtResult Sema::BuildNullStmt(SourceLocation SemiLoc, bool HasLeadingEmptyMacro,
+                               ArrayRef<AssertContract *> Assertions) {
+  return NullStmt::Create(Context, SemiLoc, HasLeadingEmptyMacro, Assertions);
 }
 
 StmtResult Sema::ActOnDeclStmt(DeclGroupPtrTy dg, SourceLocation StartLoc,
                                SourceLocation EndLoc) {
   DeclGroupRef DG = dg.get();
 
   // If we have an invalid decl, just return an error.
   if (DG.isNull()) return StmtError();
if (!FD->isDependentContext() && OldDeducedType != NewDeducedType) {
         Diag(ReturnLoc, diag::err_auto_fn_different_deductions)
           << (AT->isDecltypeAuto() ? 1 : 0)
           << NewAT->getDeducedType() << DeducedT;
       }
       return true;
     }
   } else if (!FD->isInvalidDecl()) {
     // Update all declarations of the function to have the deduced return type.
-    Context.adjustDeducedFunctionResultType(FD, Deduced);
+    AdjustDeducedFunctionResultType(FD, Deduced);
   }
 
   return false;
 }
 
 StmtResult
 Sema::ActOnReturnStmt(SourceLocation ReturnLoc, Expr *RetValExp,
                       Scope *CurScope) {

lib/Sema/SemaTemplateDeduction.cpp

if (isLambdaConversionOperator(FD)) {
     QualType RetType = getLambdaConversionFunctionResultType(
         CallOp->getType()->castAs<FunctionProtoType>());
     if (FD->getReturnType()->getAs<PointerType>())
       RetType = Context.getPointerType(RetType);
     else {
       assert(FD->getReturnType()->getAs<BlockPointerType>());
       RetType = Context.getBlockPointerType(RetType);
     }
-    Context.adjustDeducedFunctionResultType(FD, RetType);
+    AdjustDeducedFunctionResultType(FD, RetType);
     return false;
   }
 
   if (FD->getTemplateInstantiationPattern())
     InstantiateFunctionDefinition(Loc, FD);
 
   bool StillUndeduced = FD->getReturnType()->isUndeducedType();
   if (StillUndeduced && Diagnose && !FD->isInvalidDecl()) {
     Diag(Loc, diag::err_auto_fn_used_before_defined) << FD;
     Diag(FD->getLocation(), diag::note_callee_decl) << FD;
   }
 
   return StillUndeduced;
 }
 
+void Sema::AdjustDeducedFunctionResultType(FunctionDecl *FD,
+                                           QualType ResultType) {
+  // Get ASTContext to change the function type.
+  Context.adjustDeducedFunctionResultType(FD, ResultType);
+
+  auto It = FD->getFirstDecl()->redecls_begin();
+  const auto End = FD->getFirstDecl()->redecls_end();
+
+  // We're only dealing with contracts past this point.
+  if ((*It)->contracts().empty())
+    return;
+
+  // Start by updating the first declaration as that's the most relevant
+  // location for diagnostics; subsequent redeclarations might not even have any
+  // contracts written in the source.
+  if (UpdateFunctionContractsWithNewResultType(*It)) {
+    // If that didn't work, give up and mark everything as invalid.
+    for (; It != End; ++It)
+      (*It)->setInvalidDecl();
+    return;
+  }
+
+  // Update the remaining declarations.
+  ++It;
+  for (; It != End; ++It) {
+    if ((*It)->isInvalidDecl())
+      continue;
+
+    // The contracts should be exactly the same as the first declaration.
+    // If these fail then it means that there's a problem with the contract
+    // comparison/validation handler.
+    bool Ok = UpdateFunctionContractsWithNewResultType(*It);
+    assert(Ok && "Updating redeclarations shouldn't fail");
+  }
+}
+
 /// If this is a non-static member function,
 static void
 AddImplicitObjectParameterType(ASTContext &Context,
                                CXXMethodDecl *Method,
                                SmallVectorImpl<QualType> &ArgTypes) {
   // C++11 [temp.func.order]p3:
   //   [...] The new parameter is of type "reference to cv A," where cv are
   //   the cv-qualifiers of the function template (if any) and A is

lib/Sema/SemaTemplateInstantiate.cpp

Sema::SubstBaseSpecifiers(CXXRecordDecl *Instantiation,
   }
 
   if (!Invalid && AttachBaseSpecifiers(Instantiation, InstantiatedBases))
     Invalid = true;
 
   return Invalid;
 }
 
+bool Sema::SubstContracts(FunctionDecl *New, const FunctionDecl *Tmpl,
+                          const MultiLevelTemplateArgumentList &TemplateArgs) {
+  bool Invalid = false;
+
+  const SourceLocation Loc = Tmpl->getTypeSourceInfo()->getTypeLoc().getEndLoc();
+  TemplateInstantiator Instantiator(*this, TemplateArgs, Loc,
+                                    /* Entity */DeclarationName());
+
+  SmallVector<ContractAttr *, 4> Contracts;
+  Contracts.reserve(Tmpl->contracts().size());
+  for (ContractAttr *C : Tmpl->contracts()) {
+    ContractResult Result = Instantiator.TransformContractAttr(C);
+    if (Result.isUsable())
+      Contracts.push_back(Result.get());
+    else
+      Invalid = true;
+  }
+  New->setContracts(Contracts);
+
+  return Invalid;
+}
+
 // Defined via #include from SemaTemplateInstantiateDecl.cpp
 namespace clang {
   namespace sema {
     Attr *instantiateTemplateAttribute(const Attr *At, ASTContext &C, Sema &S,
                             const MultiLevelTemplateArgumentList &TemplateArgs);
     Attr *instantiateTemplateAttributeForDecl(
         const Attr *At, ASTContext &C, Sema &S,
         const MultiLevelTemplateArgumentList &TemplateArgs);

lib/Sema/SemaTemplateInstantiateDecl.cpp

if (SemaRef.getLangOpts().CPlusPlus11 &&
       New->setType(SemaRef.Context.getFunctionType(
           NewProto->getReturnType(), NewProto->getParamTypes(), EPI));
     } else {
       Sema::ContextRAII SwitchContext(SemaRef, New);
       SemaRef.SubstExceptionSpec(New, Proto, TemplateArgs);
     }
   }
 
+  if (!Tmpl->contracts().empty()) {
+    Sema::ContextRAII SwitchContext(SemaRef, New);
+    SemaRef.SubstContracts(New, Tmpl, TemplateArgs);
+  }
+
   // Get the definition. Leaves the variable unchanged if undefined.
   const FunctionDecl *Definition = Tmpl;
   Tmpl->isDefined(Definition);
 
   SemaRef.InstantiateAttrs(TemplateArgs, Definition, New,
                            LateAttrs, StartingScope);
 
   return false;
 }
 
 /// Initializes common fields of an instantiated method
 /// declaration (New) from the corresponding fields of its template
 /// (Tmpl).
 ///
 /// \returns true if there was an error
 bool
 TemplateDeclInstantiator::InitMethodInstantiation(CXXMethodDecl *New,
                                                   CXXMethodDecl *Tmpl) {
+  // We need to set the access first because contract condition instantiation,
+  // which is part of InitFunctionInstantiation, depends on it.
+  // FIXME: Is there a better way to structure this?
+  New->setAccess(Tmpl->getAccess());
+
   if (InitFunctionInstantiation(New, Tmpl))
     return true;
 
-  New->setAccess(Tmpl->getAccess());
   if (Tmpl->isVirtualAsWritten())
     New->setVirtualAsWritten(true);
 
   // FIXME: New needs a pointer to Tmpl
   return false;
 }
 
 /// Instantiate (or find existing instantiation of) a function template with a

lib/Sema/SemaType.cpp

TypeResult Sema::ActOnTypeName(Scope *S, Declarator &D) {
   // we are actually going to build a declaration from this eventually.
   if (D.getContext() != DeclaratorContext::ObjCParameterContext &&
       D.getContext() != DeclaratorContext::AliasDeclContext &&
       D.getContext() != DeclaratorContext::AliasTemplateContext)
     checkUnusedDeclAttributes(D);
 
   if (getLangOpts().CPlusPlus) {
     // Check that there are no default arguments (C++ only).
-    CheckExtraCXXDefaultArguments(D);
+    CheckCXXNonDeclFunctionRestrictions(D);
   }
 
   return CreateParsedType(T, TInfo);
 }
 
 ParsedType Sema::ActOnObjCInstanceType(SourceLocation Loc) {
   QualType T = Context.getObjCInstanceType();
   TypeSourceInfo *TInfo = Context.getTrivialTypeSourceInfo(T, Loc);

lib/Sema/TreeTransform.h

 //
 //===----------------------------------------------------------------------===//
 
 #ifndef LLVM_CLANG_LIB_SEMA_TREETRANSFORM_H
 #define LLVM_CLANG_LIB_SEMA_TREETRANSFORM_H
 
 #include "CoroutineStmtBuilder.h"
 #include "TypeLocBuilder.h"
+#include "clang/AST/AttrContract.h"
 #include "clang/AST/Decl.h"
 #include "clang/AST/DeclObjC.h"
 #include "clang/AST/DeclTemplate.h"
 #include "clang/AST/Expr.h"
 #include "clang/AST/ExprCXX.h"
 #include "clang/AST/ExprObjC.h"
 #include "clang/AST/ExprOpenMP.h"
 #include "clang/AST/Stmt.h"
ExprResult TransformDependentScopeDeclRefExpr(DependentScopeDeclRefExpr *E,
                                                 TypeSourceInfo **RecoveryTSI);
 
   ExprResult TransformParenDependentScopeDeclRefExpr(
       ParenExpr *PE, DependentScopeDeclRefExpr *DRE, bool IsAddressOfOperand,
       TypeSourceInfo **RecoveryTSI);
 
   StmtResult TransformOMPExecutableDirective(OMPExecutableDirective *S);
 
+  /// Transform the given contract attribute.
+  ///
+  /// By default, this routine transforms a contract by delegating to the
+  /// appropriate TransformXXXContract function to build a new contract.
+  /// Subclasses may override this function to transform contracts using some
+  /// other mechanism.
+  ///
+  /// \returns the transformed contract.
+  ContractResult TransformContractAttr(ContractAttr *C);
+
 // FIXME: We use LLVM_ATTRIBUTE_NOINLINE because inlining causes a ridiculous
 // amount of stack usage with clang.
 #define STMT(Node, Parent)                        \
   LLVM_ATTRIBUTE_NOINLINE \
   StmtResult Transform##Node(Node *S);
 #define EXPR(Node, Parent)                        \
   LLVM_ATTRIBUTE_NOINLINE \
   ExprResult Transform##Node(Node *E);
 #define ABSTRACT_STMT(Stmt)
 #include "clang/AST/StmtNodes.inc"
 
 #define OPENMP_CLAUSE(Name, Class)                        \
   LLVM_ATTRIBUTE_NOINLINE \
   OMPClause *Transform ## Class(Class *S);
 #include "clang/Basic/OpenMPKinds.def"
 
+  /// Transform the specified contract attribute.
+  ///
+  /// By default, this transforms the predicate and result variable (if
+  /// applicable) and rebuilds the contract.
+  /// @{
+  ContractResult TransformExpectsContract(ExpectsContract *C);
+  ContractResult TransformEnsuresContract(EnsuresContract *C);
+  ContractResult TransformAssertContract(AssertContract *C);
+  /// @}
+
+  /// Transform the predicate of the specified contract attribute.
+  ExprResult TransformContractPredicate(ContractAttr *C);
+
   /// Build a new qualified type given its unqualified type and type
   /// qualifiers.
   ///
   /// By default, this routine adds type qualifiers only to types that can
   /// have qualifiers, and silently suppresses those qualifiers that are not
   /// permitted. Subclasses may override this routine to provide different
   /// behavior.
   QualType RebuildQualifiedType(QualType T, SourceLocation Loc,
#include "clang/Basic/OpenMPKinds.def"
   /// be resolved to a specific template, then builds the appropriate kind of
   /// template name. Subclasses may override this routine to provide different
   /// behavior.
   TemplateName RebuildTemplateName(TemplateTemplateParmDecl *Param,
                                    const TemplateArgument &ArgPack) {
     return getSema().Context.getSubstTemplateTemplateParmPack(Param, ArgPack);
   }
 
+  /// Build a new null statement.
+  ///
+  /// By default, performs semantic analysis to build the new statement.
+  /// Subclasses may override this routine to provide different behavior.
+  StmtResult RebuildNullStmt(SourceLocation SemiLoc, bool HasLeadingEmptyMacro,
+                             ArrayRef<AssertContract *> Assertions) {
+    return getSema().BuildNullStmt(SemiLoc, HasLeadingEmptyMacro, Assertions);
+  }
+
   /// Build a new compound statement.
   ///
   /// By default, performs semantic analysis to build the new statement.
   /// Subclasses may override this routine to provide different behavior.
   StmtResult RebuildCompoundStmt(SourceLocation LBraceLoc,
                                        MultiStmtArg Statements,
                                        SourceLocation RBraceLoc,
                                        bool IsStmtExpr) {
ExprResult RebuildAtomicExpr(SourceLocation BuiltinLoc,
                                SourceLocation RParenLoc) {
     // Just create the expression; there is not any interesting semantic
     // analysis here because we can't actually build an AtomicExpr until
     // we are sure it is semantically sound.
     return new (SemaRef.Context) AtomicExpr(BuiltinLoc, SubExprs, RetTy, Op,
                                             RParenLoc);
   }
 
+  /// Build a new contract attribute.
+  ///
+  /// By default, performs semantic analysis to build the new contract.
+  /// Subclasses may override this routine to provide different behavior.
+  ContractResult RebuildContractAttr(SourceRange Range,
+                                     ContractKind Kind,
+                                     SourceLocation KindLoc,
+                                     ContractLevel Level,
+                                     SourceLocation LevelLoc,
+                                     VarDecl *ResultVar,
+                                     SourceLocation ColonLoc,
+                                     Expr *Predicate) {
+    return getSema().BuildContractAttribute(
+               Range, Kind, KindLoc, Level, LevelLoc, ResultVar,
+               ColonLoc, Predicate);
+  }
+
 private:
   TypeLoc TransformTypeInObjectScope(TypeLoc TL,
                                      QualType ObjectType,
                                      NamedDecl *FirstQualifierInScope,
                                      CXXScopeSpec &SS);
 
   TypeSourceInfo *TransformTypeInObjectScope(TypeSourceInfo *TSInfo,
                                              QualType ObjectType,

 }
 
 //===----------------------------------------------------------------------===//
 // Statement transformation
 //===----------------------------------------------------------------------===//
 template<typename Derived>
 StmtResult
 TreeTransform<Derived>::TransformNullStmt(NullStmt *S) {
+  bool AssertionInvalid = false;
+  bool AssertionChanged = false;
+
+  SmallVector<AssertContract *, 4> Assertions;
+  Assertions.reserve(llvm::size(S->assertions()));
+  for (AssertContract *C : S->assertions()) {
+    ContractResult Result = getDerived().TransformContractAttr(C);
+
+    if (Result.isInvalid()) {
+      AssertionInvalid = true;
+      continue;
+    }
+
+    AssertionChanged = AssertionChanged || Result.get() != C;
+    Assertions.push_back(cast<AssertContract>(Result.get()));
+  }
+
+  if (AssertionInvalid)
+    return StmtError();
+
+  if (!getDerived().AlwaysRebuild() && !AssertionChanged)
     return S;
+
+  return getDerived().RebuildNullStmt(S->getSemiLoc(),
+                                      S->hasLeadingEmptyMacro(),
+                                      Assertions);
 }
 
 template<typename Derived>
 StmtResult
 TreeTransform<Derived>::TransformCompoundStmt(CompoundStmt *S) {
   return getDerived().TransformCompoundStmt(S, false);
 }
 
if (!getDerived().AlwaysRebuild() &&
       !ArgumentChanged)
     return E;
 
   return getDerived().RebuildAtomicExpr(E->getBuiltinLoc(), SubExprs,
                                         RetTy, E->getOp(), E->getRParenLoc());
 }
 
 //===----------------------------------------------------------------------===//
+// Contract transformation
+//===----------------------------------------------------------------------===//
+
+template<typename Derived>
+ContractResult TreeTransform<Derived>::TransformContractAttr(ContractAttr *C) {
+  if (!C)
+    return C;
+
+  if (auto *Expects = dyn_cast<ExpectsContract>(C))
+    return TransformExpectsContract(Expects);
+  if (auto *Ensures = dyn_cast<EnsuresContract>(C))
+    return TransformEnsuresContract(Ensures);
+  if (auto *Assert = dyn_cast<AssertContract>(C))
+    return TransformAssertContract(Assert);
+
+  llvm_unreachable("Unexpected contract kind");
+}
+
+template<typename Derived>
+ContractResult
+TreeTransform<Derived>::TransformExpectsContract(ExpectsContract *C) {
+  // Transform the predicate.
+  ExprResult Pred = getDerived().TransformContractPredicate(C);
+  if (Pred.isInvalid())
+    return ContractResult(/* Invalid */true);
+
+  if (!getDerived().AlwaysRebuild() && Pred.get() == C->getPredicate())
+    return C;
+
+  return getDerived().RebuildContractAttr(
+             C->getRange(), ContractKind::Expects, C->getKindLoc(),
+             C->getLevel(), C->getLevelLoc(), /* ResultVar */nullptr,
+             C->getColonLoc(), Pred.get());
+}
+
+template<typename Derived>
+ContractResult
+TreeTransform<Derived>::TransformEnsuresContract(EnsuresContract *C) {
+  // Transform the result variable.
+  VarDecl *ResultVar = C->getResultVar();
+  if (ResultVar) {
+    ResultVar = cast_or_null<VarDecl>(
+                    getDerived().TransformDecl(ResultVar->getLocation(),
+                                               ResultVar));
+    if (!ResultVar)
+      return ContractResult(/* Invalid */true);
+
+    ResultVar->setContractFunctionResult(true);
+    if (getSema().ValidateContractResultVariable(ResultVar))
+      ResultVar->setInvalidDecl();
+  }
+
+  // Transform the predicate.
+  ExprResult Pred = getDerived().TransformContractPredicate(C);
+  if (Pred.isInvalid())
+    return ContractResult(/* Invalid */true);
+
+  if (!getDerived().AlwaysRebuild() &&
+      ResultVar == C->getResultVar() &&
+      Pred.get() == C->getPredicate())
+    return C;
+
+  return getDerived().RebuildContractAttr(
+             C->getRange(), ContractKind::Ensures, C->getKindLoc(),
+             C->getLevel(), C->getLevelLoc(), ResultVar,
+             C->getColonLoc(), Pred.get());
+}
+
+template<typename Derived>
+ContractResult
+TreeTransform<Derived>::TransformAssertContract(AssertContract *C) {
+  // Transform the predicate.
+  ExprResult Pred = getDerived().TransformContractPredicate(C);
+  if (Pred.isInvalid())
+    return ContractResult(/* Invalid */true);
+
+  if (!getDerived().AlwaysRebuild() && Pred.get() == C->getPredicate())
+    return C;
+
+  return getDerived().RebuildContractAttr(
+             C->getRange(), ContractKind::Assert, C->getKindLoc(),
+             C->getLevel(), C->getLevelLoc(), /* ResultVar */nullptr,
+             C->getColonLoc(), Pred.get());
+}
+
+template<typename Derived>
+ExprResult
+TreeTransform<Derived>::TransformContractPredicate(ContractAttr *C) {
+  Sema::EnterContractPredicateRAII _(getSema(), C->getKind());
+
+  Sema::ConditionResult Result =
+      getDerived().TransformCondition(C->getKindLoc(), /* Var */nullptr,
+                                      C->getPredicate(),
+                                      Sema::ConditionKind::Boolean);
+
+  return (Result.isInvalid() ? ExprError() : Result.get().second);
+}
+
+//===----------------------------------------------------------------------===//
 // Type reconstruction
 //===----------------------------------------------------------------------===//
 
 template<typename Derived>
 QualType TreeTransform<Derived>::RebuildPointerType(QualType PointeeType,
                                                     SourceLocation Star) {
   return SemaRef.BuildPointerType(PointeeType, Star,
                                   getDerived().getBaseEntity());

test/CXX/dcl.dcl/dcl.attr/dcl.attr.contract/dcl.attr.contract.cond/p1.cpp

+// RUN: %clang_cc1 -fsyntax-only -std=c++2a -verify %s
+
+namespace no_contracts_on_redecl {
+  int f(int x, int y)
+    [[expects: x != 0]]
+    [[expects: y != 0]]
+    [[ensures r: r != x && r != y]];
+
+  // Redeclarations should be writable without any contract conditions.
+  int f(int x, int y);
+  int f(int x, int y) { return 0; }
+}
+
+namespace overloading_is_ok {
+  int f(int x, int y);
+
+  // This is an overload, not the same function. So there shouldn't be any
+  // comparisons made between its contracts and the above function.
+  int f(float x, int y)
+    [[expects: x != 0.003f]];
+}
+
+namespace no_contracts_on_first_decl {
+  // Singular.
+  int f(int x, int y);
+  int f(int x, int y)    // expected-error {{redeclaration of 'f' with different contract conditions}}
+    [[expects: x != 0]]; // expected-note {{redeclaration has this additional contract}}
+
+  // Plural.
+  int g(int x, int y);
+  int g(int x, int y)   // expected-error {{redeclaration of 'g' with different contract conditions}}
+    [[expects: x != 0]] // expected-note {{redeclaration has these 2 additional contracts}}
+    [[expects: y != 0]];
+}
+
+namespace different_type {
+  int f(int x, int y)
+    [[expects: true]] // expected-note {{whereas on the original declaration it's a regular precondition}}
+    [[ensures: false]]
+    [[ensures audit: false]]; // expected-note {{whereas on the original declaration it's an auditing postcondition}}
+
+  int f(int x, int y) // expected-error {{redeclaration of 'f' with different contract conditions}}
+    [[ensures: true]] // expected-note {{the 1st contract is a regular postcondition}}
+    [[ensures default: false]]
+    [[ensures axiom: false]]; // expected-note {{the 3rd contract is an axiomatic postcondition}}
+}
+
+namespace different_predicate {
+  int f(int x, int y)
+    [[ensures r: r == x + y]]; // expected-note {{is different from the original declaration here}}
+
+  int f(int x, int y) // expected-error {{redeclaration of 'f' with different contract conditions}}
+    [[ensures r: r == 50]]; // expected-note {{the predicate of the 1st contract}}
+}
+
+namespace mixed {
+  template<typename T>
+  T f(T x, T y)
+    [[expects: true]]
+    [[expects audit: x == y]] // expected-note {{whereas on the original declaration it's an auditing precondition}}
+    [[expects axiom: x == y * y]]; // expected-note {{is different from the original declaration here}}
+
+  template<typename T>
+  T f(T x, T y) // expected-error {{redeclaration of 'f' with different contract conditions}}
+    [[expects default: true]]
+    [[ensures axiom: y == x]] // expected-note {{the 2nd contract is an axiomatic postcondition}}
+    [[expects axiom: x == y + y]]  // expected-note {{the predicate of the 3rd contract}}
+    [[ensures audit: false]]; // expected-note {{redeclaration has this additional contract}}
+}
+
+namespace friends_with_contracts {
+  class MyClass {
+    friend void f(int x) // expected-note {{previous declaration is here}}
+      [[expects: x == 10]] {}
+
+    template<typename T>
+    friend void g(T x) // expected-note {{previous declaration is here}}
+      [[expects: sizeof(x) == 500]] {}
+
+    friend void h() // expected-error {{friend declaration specifying contract conditions must be a definition}}
+      [[expects: true]];
+  };
+
+  void f(int x); // expected-error {{friend declaration specifying contract conditions must be the only declaration}}
+  template<typename T> void g(T x); // expected-error {{friend declaration specifying contract conditions must be the only declaration}}
+}

test/CXX/dcl.dcl/dcl.attr/dcl.attr.contract/dcl.attr.contract.cond/p2.cpp

+// RUN: %clang_cc1 -fsyntax-only -std=c++2a -verify %s
+// expected-no-diagnostics
+
+int f(int x, int y)
+  [[expects: x != 0]]
+  [[expects: y != 0]]
+  [[ensures r: r != x && r != y]];
+
+int f(int a, int b)
+  [[expects: a != 0]]
+  [[expects: b != 0]]
+  [[ensures res: res != a && res != b]];
+
+template<typename T1, typename T2>
+int g(T1 x, T2 y)
+  [[expects: x != 0]]
+  [[expects: y != 0]]
+  [[ensures r: r != x && r != y]];
+
+template<typename First, typename Second>
+int g(First a, Second b)
+  [[expects: a != 0]]
+  [[expects: b != 0]]
+  [[ensures res: res != a && res != b]];

test/CXX/dcl.dcl/dcl.attr/dcl.attr.contract/dcl.attr.contract.cond/p3.cpp

+// RUN: %clang_cc1 -fsyntax-only -std=c++2a -verify %s
+
+typedef int (*MyType1)() [[ensures r: r != 0]]; // expected-error {{contract conditions can only be specified on a function declaration}}
+
+using MyType2 = void(*)() [[expects: true]]; // expected-error {{contract conditions can only be specified on a function declaration}}
+
+float (*f)(int x) [[ensures r: r == (float)x]]; // expected-error {{contract conditions can only be specified on a function declaration}}
+
+bool (*g())(int) [[expects: true]]; // expected-error {{contract conditions can only be specified on a function declaration}}
+
+bool (*h() [[expects: true]])(int);
+
+class MyClass {
+  // Make sure that this isn't eaten by late-parsing.
+  void (*member)() [[expects: true]]; // expected-error {{contract conditions can only be specified on a function declaration}}
+};

test/CXX/dcl.dcl/dcl.attr/dcl.attr.contract/dcl.attr.contract.cond/p4.cpp

+// RUN: %clang_cc1 -fsyntax-only -std=c++2a -verify %s
+
+class Standalone {
+public:
+  void fromPub()
+    [[expects: pubMem]]
+    [[expects: protMem]] // expected-error {{'protMem' is a protected member}}
+    [[expects: privMem]]; // expected-error {{'privMem' is a private member}}
+
+protected:
+  void fromProt()
+    [[expects: pubMem]]
+    [[expects: protMem]]
+    [[expects: privMem]]; // expected-error {{'privMem' is a private member}}
+
+private:
+  void fromPriv()
+    [[expects: pubMem]]
+    [[expects: protMem]]
+    [[expects: privMem]];
+
+  public: bool pubMem;
+  protected: bool protMem; // expected-note {{declared protected here}}
+  private: bool privMem; // expected-note 2{{declared private here}}
+};
+
+namespace friendly {
+  class C {
+    friend class Friendly;
+    friend void f(const C &x)
+      [[expects: x.pubPred()]]
+      [[expects: x.protPred()]] // expected-error {{'protPred' is a protected member}}
+      [[expects: x.privPred()]] // expected-error {{'privPred' is a private member}}
+    {}
+
+    public: bool pubPred() const;
+    protected: bool protPred() const; // expected-note 2{{declared protected here}}
+    private: bool privPred() const; // expected-note 2{{declared private here}}
+  };
+
+  class Friendly {
+    void f(C &x)
+      [[ensures: x.pubPred()]]
+      [[ensures: x.protPred()]] // expected-error {{'protPred' is a protected member}}
+      [[ensures: x.privPred()]]; // expected-error {{'privPred' is a private member}}
+  };
+}
+
+namespace inaccessible_base {
+  class Base {
+  public:
+    bool pred() const; // expected-note {{member is declared here}}
+  };
+
+  class Derived : private Base { // expected-note {{constrained by private inheritance here}} \
+                                 // expected-note {{declared private here}}
+  public:
+    void doStuff()
+      [[ensures: pred()]]; // expected-error {{'pred' is a private member}} \
+                           // expected-error {{to its private base class}}
+  };
+}
+
+namespace tmpl_instantiation {
+  class C {
+    int i; // expected-note {{implicitly declared private here}}
+
+  public:
+    template<typename T>
+    void f(const T &x)
+      [[expects: x.i > 9000]] // expected-error {{'i' is a private member}}
+    {}
+  };
+
+  template void C::f<C>(const C &); // expected-note {{in instantiation}}
+}
+
+namespace assertions_arent_conditions {
+  // A contract condition is a precondition or a postcondition.
+  // So the additional access restrictions shouldn't apply to assertions.
+
+  class C {
+    bool pred() const;
+
+  public:
+    void f() {
+      [[assert: pred()]];
+    }
+
+    friend class FriendClass;
+
+    friend void friendFunc(const C &x) {
+      [[assert: x.pred()]];
+    }
+  };
+
+  class FriendClass {
+  public:
+    void f(const C &x) {
+      [[assert: x.pred()]];
+    }
+  };
+}

test/CXX/expr/expr.const/p2-2a.cpp

+// RUN: %clang_cc1 -std=c++2a -fsyntax-only -verify %s
+
+// - A checked contract (10.6.11) whose predicate evaluates to false.
+
+constexpr int f(int i)
+  [[expects: i != 0]] // expected-note {{precondition failed}}
+  [[ensures r: r == i]]
+{
+  return i;
+}
+static_assert(f(42) == 42);
+static_assert(f(0) == -1); // expected-error {{not an integral constant expression}} expected-note{{in call}}
+
+namespace never {
+  constexpr void f() // expected-error {{never produces a constant expression}}
+    [[expects: false]] // expected-note {{precondition is unsatisfiable}}
+  {}
+
+  constexpr int g() // expected-error {{never produces a constant expression}}
+    [[ensures r: r == 66]] // expected-note {{postcondition is unsatisfiable}}
+  {
+    return 0;
+  }
+
+  constexpr void h() // expected-error {{never produces a constant expression}}
+  {
+    [[assert: true]];
+    [[assert: 10 == 100]]; // expected-note {{assertion is unsatisfiable}}
+  }
+}
+
+class CheckedConstructor {
+public:
+  constexpr explicit CheckedConstructor() // expected-error {{never produces a constant expression}}
+    [[ensures: false]] // expected-note {{postcondition is unsatisfiable}}
+  {}
+
+  constexpr explicit CheckedConstructor(int i)
+    [[expects: i != 0]] // expected-note {{precondition failed}}
+  {}
+
+  constexpr explicit operator bool() const { return true; }
+};
+static_assert(CheckedConstructor(14));
+static_assert(CheckedConstructor(0)); // expected-error {{not an integral constant expression}} expected-note {{in call}}

test/CodeGenCXX/cxx2a-contracts-unsupported.cpp

+// RUN: %clang_cc1 -std=c++2a -emit-llvm -verify %s
+
+// Test that CodeGen emits an error when attempting to compile contracts.
+// This should be deleted when the contracts implementation is complete.
+
+void f() // expected-error {{cannot compile this}}
+  [[expects: true]]
+{
+  [[assert: true]]; // expected-error {{cannot compile this}}
+}

test/FixIt/fixit-cxx-contract.cpp

+// RUN: %clang_cc1 -std=c++2a -verify %s
+// RUN: not %clang_cc1 -std=c++2a -fdiagnostics-parseable-fixits %s 2>&1 | FileCheck %s
+// RUN: cp %s %t
+// RUN: not %clang_cc1 -std=c++2a -fixit -x c++ %t
+// RUN: %clang_cc1 -std=c++2a -x c++ %t
+
+int colonRecovery(int i)
+  [[expects true]] // expected-error {{expected ':'}}
+                   // CHECK: fix-it:{{.*}}:{[[@LINE-1]]:12-[[@LINE-1]]:12}:":"
+
+  [[expects audit true]] // expected-error {{expected ':'}}
+                         // CHECK: fix-it:{{.*}}:{[[@LINE-1]]:18-[[@LINE-1]]:18}:":"
+
+  [[ensures r r > 100]] // expected-error {{expected ':'}}
+                        // CHECK: fix-it:{{.*}}:{[[@LINE-1]]:14-[[@LINE-1]]:14}:":"
+
+  [[ensures axiom r r > i]]; // expected-error {{expected ':'}}
+                             // CHECK: fix-it:{{.*}}:{[[@LINE-1]]:20-[[@LINE-1]]:20}:":"
+
+void semicolonRecovery()
+{
+  [[assert: false]] // expected-error {{expected ';' after assertion}}
+                    // CHECK: fix-it:{{.*}}:{[[@LINE-1]]:20-[[@LINE-1]]:20}:";"
+
+  for (int i = 0; i < 5; ++i) {
+    [[assert: i < 100]] // expected-error {{expected ';' after assertion}}
+                        // CHECK: fix-it:{{.*}}:{[[@LINE-1]]:24-[[@LINE-1]]:24}:";"
+  }
+
+  [[assert: true]] // expected-error {{expected ';' after assertion}}
+                   // CHECK: fix-it:{{.*}}:{[[@LINE-1]]:19-[[@LINE-1]]:19}:";"
+}

test/Parser/cxx-contract.cpp

+// RUN: %clang_cc1 -std=c++2a -fsyntax-only -Wno-unknown-attributes -verify %s
+
+int addPositive(int a, int b)
+  [[expects: a > 0]]
+  [[expects: b > 0]]
+  [[ensures r: r > a]]
+  [[ensures r: r > b]]
+  [[ensures axiom r: r == a + b]]
+{
+  int result = a;
+  for (int i = 0; i < b; ++i) {
+    ++result;
+    [[assert audit: result > a]];
+  }
+  return result;
+}
+
+void tryAllLevels()
+  [[expects: true]]
+  [[ensures: true]]
+  [[expects default: true]]
+  [[ensures default: true]]
+  [[expects audit: true]]
+  [[ensures audit: true]]
+  [[expects axiom: true]]
+  [[ensures axiom: true]]
+{
+  [[assert: true]];
+  [[assert default: true]];
+  [[assert audit: true]];
+  [[assert axiom: true]];
+}
+
+void invalidLevels()
+  // We should be able to use the surrounding tokens to infer that 'not_a_level'
+  // was inteded as a contract level.
+  [[expects not_a_level: true]] // expected-error {{unknown contract level 'not_a_level'}}
+
+  // But in this case it's probably part of the predicate (with a missing colon).
+  [[expects not_a_level]]; // expected-error {{expected ':'}} \
+                           // expected-error {{undeclared identifier 'not_a_level'}}
+
+void badBrackets()
+{
+  [[assert: true]]]; // expected-error {{extraneous ']' before ';'}}
+  [[assert: true]; // expected-error {{expected ']'}} expected-note {{to match this '['}}
+}
+
+int missingPredicate()
+  [[expects:]] // expected-error {{expected expression}}
+  [[ensures axiom r:]] // expected-error {{expected expression}}
+{
+  [[assert audit:]]; // expected-error {{expected expression}}
+  return 5;
+}
+
+void wrongPlacement()
+  [[assert: true]] // expected-error {{'assert' attribute is only allowed on an empty statement}}
+{
+  [[expects: true]]; // expected-error {{'expects' attribute is only allowed on a function type}}
+  [[ensures: true]]; // expected-error {{'ensures' attribute is only allowed on a function type}}
+}
+
+void sharingList(int i)
+  [[myattr, expects: true]] // expected-error {{contract attributes must be the only}}
+  [[myattr1, myattr, ensures: false]] // expected-error {{contract attributes must be the only}}
+{
+  switch (i) {
+  case 0:
+    [[fallthrough, assert: true]]; // expected-error {{contract attributes must be the only}}
+
+  default:
+    break;
+  }
+}
+
+void multiAssert(int i)
+{
+  // This isn't explicitly mentioned in the standard, however the grammar
+  // implies that it's allowed.
+  [[assert: i != 2]] [[assert: i != 3]] [[assert: i != 4]];
+}
+
+class DelayMemberParsing {
+public:
+  void f(int arg) [[expects: arg != i]];
+  void g(int arg) [[expects: arg != j]]; // expected-error {{use of undeclared identifier 'j'}}
+
+  int i;
+};

test/SemaCXX/typo-correction-contract.cpp

+// RUN: %clang_cc1 -std=c++2a -fsyntax-only -verify %s
+
+int f()
+  [[expects flooat: true]]  // expected-error {{unknown contract level 'flooat'}}
+  [[expects defaul: true]]  // expected-error {{unknown contract level 'defaul'; did you mean 'default'?}}
+  [[ensures audio r: true]] // expected-error {{unknown contract level 'audio'; did you mean 'audit'?}}
+{
+  [[assert axiomm: true]]; // expected-error {{unknown contract level 'axiomm'; did you mean 'axiom'?}}
+  return 0;
+}

test/SemaCXX/warn-unused-result-contract.cpp

+// RUN: %clang_cc1 -std=c++2a -fsyntax-only -Wunused-variable -verify %s
+
+namespace at_ns_scope {
+  int f() [[ensures r: r != 0]];
+  int g() [[ensures r: true]]; // expected-warning {{unused variable 'r'}}
+}
+
+class AtClassScope {
+public:
+  int f() [[ensures r: r != 0]];
+  int g() [[ensures r: true]]; // expected-warning {{unused variable 'r'}}
+};
+
+namespace templated_funcs {
+  template<typename T>
+  T f() [[ensures r: r != 0]];
+
+  template<typename T>
+  T g() [[ensures r: true]]; // expected-warning {{unused variable 'r'}}
+}