Handle alloc_size attribute on function pointers

[arichardson]

Summary

I have been trying to statically find and analyze all calls to heap
allocation functions to determine how many of them use sizes known at
compile time vs only at runtime. While doing so I saw that quite a few
projects use replaceable function pointers for heap allocation and noticed
that clang was not able to annotate functions pointers with alloc_size.
I have changed the Sema checks to allow alloc_size on all function pointers
and typedefs for function pointers now and added checks that these
attributes are propagated to the LLVM IR correctly.

With this patch we can also compute __builtin_object_size() for calls to
allocation function pointers with the alloc_size attribute.

[arichardson]

Remove RUN: line added for debugging

[aaron.ballman]

include/clang/Basic/Attr.td

1072 ↗

(On Diff #176368)

Does GCC support writing alloc_size on function pointers?

lib/Sema/SemaDecl.cpp

6269 ↗

(On Diff #176368)

const TypedefNameDecl * ?

6270 ↗

(On Diff #176368)

const auto *

6723 ↗

(On Diff #176368)

const auto * and can elide the braces.

This should probably be generalized at some point into something declarative in Attr.td, though the type checking may be hard to do that for (I'm not certain). It doesn't need to be done as part of this patch, though.

test/Sema/alloc-size.c

46 ↗

(On Diff #176368)

What should happen in these situations?

typedef void * (__attribute__((alloc_size(1))) * my_malloc_fn_pointer_type)(int);
typedef void * (* my_other_malloc_fn_pointer_type)(int);

void *fn(int i);
__attribute__((alloc_size(1))) void *fn2(int i);

int main() {
  my_malloc_fn_pointer_type f = fn; // ???
  my_other_malloc_fn_pointer_type f2 = fn2; // ???
}

Should this code do something special?

typedef void * (__attribute__((alloc_size(1))) * my_malloc_fn_pointer_type)(int);
typedef void * (* my_other_malloc_fn_pointer_type)(int);

void overloaded(my_malloc_fn_pointer_type fn);
void overloaded(my_other_malloc_fn_pointer_type fn);

void *fn(int i);
__attribute__((alloc_size(1))) void *fn2(int i);

int main() {
  overloaded(fn);
  overloaded(fn2);
}

[arichardson]

include/clang/Basic/Attr.td

1072 ↗

(On Diff #176368)

Yes it does and it seems to be used by some projects. I first discovered this while compiling libxml2: https://github.com/GNOME/libxml2/blob/35e83488505d501864826125cfe6a7950d6cba78/include/libxml/xmlmemory.h#L66

test/Sema/alloc-size.c

46 ↗

(On Diff #176368)

If I define two overloaded functions that only differ on the attribute GCC gives me the following error:

<source>:14:6: error: redefinition of 'overloaded'

   14 | void overloaded(my_other_malloc_fn_pointer_type fn) {

      |      ^~~~~~~~~~

<source>:11:6: note: previous definition of 'overloaded' was here

   11 | void overloaded(my_malloc_fn_pointer_type fn) {

      |      ^~~~~~~~~~

Assigning function pointers with and without the attribute seems to work just fine:
https://godbolt.org/z/-i5zUK

[arichardson]

• address review comments
• add test that we can assign between function pointers with and without alloc_size attribute.

[aaron.ballman]

include/clang/Basic/Attr.td

1072 ↗

(On Diff #176368)

Parsed and ignored is different than supported. For instance, I can't seem to get GCC to produce different behavior here: https://godbolt.org/z/MI5k_m

Am I missing something?

test/Sema/alloc-size.c

48–49 ↗

(On Diff #176413)

Spurious newlines can be removed.

46 ↗

(On Diff #176368)

Great, that's what I was hoping to hear. Can you add a C++ tests for both of those? The C test is a good start, but C++ is more finicky about type identity.

[arichardson]

Thanks for the review! I'll write a C++ test tomorrow.

include/clang/Basic/Attr.td

1072 ↗

(On Diff #176368)

Ah yes, it does seem like it is ignored. I assumed it would work for GCC since it handles, e.g. the format attribute on function pointers.

However, I would like it if we could support it on function pointers even if GCC just ignores is.

[aaron.ballman]

include/clang/Basic/Attr.td

1072 ↗

(On Diff #176368)

However, I would like it if we could support it on function pointers even if GCC just ignores is.

We can, but the question is: under what spelling(s)? I think we can support this under __attribute__((alloc_size(N))) without issue. If GCC is looking to implement this same behavior, then I think we can also support it under [[gnu::alloc_size(N)]].

If GCC doesn't have plans to add this functionality any time soon, we'd be stepping on their implementation namespace by implementing this functionality under the gnu vendor namespace and users would then be confused as to whose bug it is. In that case, I'd recommend we add [[clang::alloc_size(N)]] that behaves identically to [[gnu::alloc_size(N)]]' except that it can be applied to function pointer types, and not change the behavior of [[gnu::alloc_size(N)]]. This can be implemented as a single semantic attribute by looking at the semantic spelling of the attribute and issuing a compatibility warning if you see [[gnu::alloc_size(N)]] being applied to a function pointer type, and can even recommend a fix-it to switch to [[clang::alloc_size(N)]] in that case. (See uses of getSemanticSpelling()` elsewhere in the project for examples of how to test which spelling a given sematic attribute was spelled with.)

[arichardson]

include/clang/Basic/Attr.td

1072 ↗

(On Diff #176368)

It seems like GCC will also implement this behaviour so using [[gnu::alloc_size()]] (https://gcc.gnu.org/bugzilla/show_bug.cgi?id=88372#c1) should be fine.

[aaron.ballman]

I think all that's missing are some C++ tests and some nits.

include/clang/Basic/Attr.td

1072 ↗

(On Diff #176368)

Fantastic, thank you for coordinating this! I think using the GCC spelling is the right way to go then.

[arichardson]

Add a C++ test for alloc_size

[aaron.ballman]

LGTM aside from two small style nits with the new test file.

test/SemaCXX/alloc-size.cpp

6 ↗

(On Diff #177027)

Can you run this new test file through clang-format?

21 ↗

(On Diff #177027)

Add a full stop at the end of the sentence.

[arichardson]

clang-format
fix a failing test

[arichardson]

fix typo

[arichardson]

test/Misc/pragma-attribute-supported-attributes-list.test

15 ↗

(On Diff #177517)

This seems to also affect __attribute((format)) and others so I'm not sure whether removing AllocSize from this list is a blocker for this patch.

[aaron.ballman]

test/Misc/pragma-attribute-supported-attributes-list.test

15 ↗

(On Diff #177517)

I believe you may need to add an AttrSubjectMatcherSubRule in Attr.td to expose the attribute for #pragma clang attribute support. Can you see if you can support it instead of shrinking this list? Otherwise, I worry that this change will break code that was using the pragma to apply the attribute to declarations.

[arichardson]

test/Misc/pragma-attribute-supported-attributes-list.test

15 ↗

(On Diff #177517)

The problem here already has a fixme in attr.td:

// FIXME: There's a matcher ambiguity with objc methods and blocks since
// functionType excludes them but functionProtoType includes them.
// AttrSubjectMatcherSubRule<"functionProtoType", [HasFunctionProto]>

It seems like this was already added as part of the initial pragma clang attribute commit in https://reviews.llvm.org/D30009

I had a look at the AttrEmitter.cpp in tablegen but couldn't find a straightforward solution.
I'll add @arphaman to the review.

[arichardson]

I don't see an easy way of fixing the pragma clang attribute support for this.
Would it be okay to commit this change anyway?
Since alloc_size is only used for very few functions I'd be very surprised if there's any existing code that relies on using #pragma clang atrribute with alloc_size.

By the way GCC now also supports the attribute on function pointers: https://gcc.gnu.org/viewcvs/gcc?view=revision&revision=267158

[aaron.ballman]

In D55212#1347994, @arichardson wrote:

I don't see an easy way of fixing the pragma clang attribute support for this.
Would it be okay to commit this change anyway?

It causes a regression in behavior, so I'm not certain we should move forward with it just yet (unless there's a pressing reason?).

Since alloc_size is only used for very few functions I'd be very surprised if there's any existing code that relies on using #pragma clang atrribute with alloc_size.

This feature has already been available in a public release and there's no way to know how much code it will break (if any). It does seem rather unlikely, but I've been surprised by how people use this feature in the past.

By the way GCC now also supports the attribute on function pointers: https://gcc.gnu.org/viewcvs/gcc?view=revision&revision=267158

Yeah, my concern isn't with the new functionality so much as it breaking old functionality.

I'm also adding Erik and Duncan to the review because they may have some more insights into whether alloc_size is being used with #pragma clang attribute in the wild. My feeling is: if we can't spot any uses of that feature being used to apply alloc_size with a reasonable amount of looking for it, then we can go ahead with this patch even if it removes support for alloc_size from the pragma. If we get push back from the community, we can fix or revert at that time. However, given that this is plausibly a breaking change, I'd rather not commit to trunk until after we branch to give folks more time to react. WDYT?

test/Misc/pragma-attribute-supported-attributes-list.test

15 ↗

(On Diff #177517)

Ah, good to know that this was already a known issue. Hopefully @arphaman has some ideas on how to support this so we don't remove a supported attribute from the list.

[arichardson]

I completely forgot about this patch. @aaron.ballman are you still happy for me to commit this?

[aaron.ballman]

In D55212#2640260, @arichardson wrote:

I completely forgot about this patch. @aaron.ballman are you still happy for me to commit this?

I think where we left off is that this causes a slight regression in behavior because it shrinks the list of attributes that can use #pragma clang attribute. From earlier:

I'm also adding Erik and Duncan to the review because they may have some more insights into whether alloc_size is being used with #pragma clang attribute in the wild. My feeling is: if we can't spot any uses of that feature being used to apply alloc_size with a reasonable amount of looking for it, then we can go ahead with this patch even if it removes support for alloc_size from the pragma. If we get push back from the community, we can fix or revert at that time. However, given that this is plausibly a breaking change, I'd rather not commit to trunk until after we branch to give folks more time to react. WDYT?

I think folks will have a chance to react if we apply it to trunk now, but I am wondering if anyone's had a chance to investigate usage in the wild. @erik.pilkington or @dexonsmith, do either of you have a gut feeling?

[erik.pilkington]

In D55212#2641301, @aaron.ballman wrote:

I think folks will have a chance to react if we apply it to trunk now, but I am wondering if anyone's had a chance to investigate usage in the wild. @erik.pilkington or @dexonsmith, do either of you have a gut feeling?

I don't see any uses of #pca with alloc_size in our internal codebase. IMO I'd be really quite surprised if anyone actually used these two features together.

[aaron.ballman]

In D55212#2641402, @erik.pilkington wrote:

In D55212#2641301, @aaron.ballman wrote:

I think folks will have a chance to react if we apply it to trunk now, but I am wondering if anyone's had a chance to investigate usage in the wild. @erik.pilkington or @dexonsmith, do either of you have a gut feeling?

I don't see any uses of #pca with alloc_size in our internal codebase. IMO I'd be really quite surprised if anyone actually used these two features together.

Thank you for the feedback! Then I think this continues to LGTM -- if there is breakage in the wild, we can hopefully react to it.

clang/include/clang/Basic/Attr.td

def EmptyBases : InheritableAttr, TargetSpecificAttr<TargetMicrosoftCXXABI> {
   let Spellings = [Declspec<"empty_bases">];
   let Subjects = SubjectList<[CXXRecord]>;
   let Documentation = [EmptyBasesDocs];
   let SimpleHandler = 1;
 }
 
 def AllocSize : InheritableAttr {
   let Spellings = [GCC<"alloc_size">];
-  let Subjects = SubjectList<[Function]>;
+  let Subjects = SubjectList<[HasFunctionProto]>;
   let Args = [ParamIdxArgument<"ElemSizeParam">,
               ParamIdxArgument<"NumElemsParam", /*opt*/ 1>];
   let TemplateDependent = 1;
   let Documentation = [AllocSizeDocs];
 }
 
 def EnableIf : InheritableAttr {
   // Does not have a [[]] spelling because this attribute requires the ability

clang/lib/AST/ExprConstant.cpp

namespace {
   static QualType getStorageType(const ASTContext &Ctx, const Expr *E) {
     if (E->isRValue())
       return E->getType();
     return Ctx.getLValueReferenceType(E->getType());
   }
 
   /// Given a CallExpr, try to get the alloc_size attribute. May return null.
   static const AllocSizeAttr *getAllocSizeAttr(const CallExpr *CE) {
-    const FunctionDecl *Callee = CE->getDirectCallee();
-    return Callee ? Callee->getAttr<AllocSizeAttr>() : nullptr;
+    if (const FunctionDecl *DirectCallee = CE->getDirectCallee())
+      return DirectCallee->getAttr<AllocSizeAttr>();
+    if (const Decl *IndirectCallee = CE->getCalleeDecl())
+      return IndirectCallee->getAttr<AllocSizeAttr>();
+    return nullptr;
   }
 
   /// Attempts to unwrap a CallExpr (with an alloc_size attribute) from an Expr.
   /// This will look through a single cast.
   ///
   /// Returns null if we couldn't unwrap a function with alloc_size.
   static const CallExpr *tryUnwrapAllocSizeCall(const Expr *E) {
     if (!E->getType()->isPointerType())

clang/lib/Sema/SemaDecl.cpp

if (DC->isTranslationUnit() &&
       D.setInvalidType();
     }
     if (D.isInvalidType())
       return false;
   }
   return true;
 }
 
+template <typename AttrTy>
+static void copyAttrFromTypedefToDecl(Sema &S, Decl *D, const TypedefType *TT) {
+  const TypedefNameDecl *TND = TT->getDecl();
+  if (const auto *Attribute = TND->getAttr<AttrTy>()) {
+    AttrTy *Clone = Attribute->clone(S.Context);
+    Clone->setInherited(true);
+    D->addAttr(Clone);
+  }
+}
+
 NamedDecl *Sema::ActOnVariableDeclarator(
     Scope *S, Declarator &D, DeclContext *DC, TypeSourceInfo *TInfo,
     LookupResult &Previous, MultiTemplateParamsArg TemplateParamLists,
     bool &AddToScope, ArrayRef<BindingDecl *> Bindings) {
   QualType R = TInfo->getType();
   DeclarationName Name = GetNameForDeclarator(D).getName();
 
   IdentifierInfo *II = Name.getAsIdentifierInfo();
if (getLangOpts().OpenCL) {
     deduceOpenCLAddressSpace(NewVD);
 
     diagnoseOpenCLTypes(S, *this, D, DC, NewVD->getType());
   }
 
   // Handle attributes prior to checking for duplicates in MergeVarDecl
   ProcessDeclAttributes(S, NewVD, D);
 
+  // FIXME: This is probably the wrong location to be doing this and we should
+  // probably be doing this for more attributes (especially for function
+  // pointer attributes such as format, warn_unused_result, etc.). Ideally
+  // the code to copy attributes would be generated by TableGen.
+  if (R->isFunctionPointerType())
+    if (const auto *TT = R->getAs<TypedefType>())
+      copyAttrFromTypedefToDecl<AllocSizeAttr>(*this, NewVD, TT);
+
   if (getLangOpts().CUDA || getLangOpts().OpenMPIsDevice ||
       getLangOpts().SYCLIsDevice) {
     if (EmitTLSUnsupportedError &&
         ((getLangOpts().CUDA && DeclAttrsMatchCUDAMode(getLangOpts(), NewVD)) ||
          (getLangOpts().OpenMPIsDevice &&
           OMPDeclareTargetDeclAttr::isDeclareTargetDeclaration(NewVD))))
       Diag(D.getDeclSpec().getThreadStorageClassSpecLoc(),
            diag::err_thread_unsupported);

clang/lib/Sema/SemaDeclAttr.cpp

 }
 
 /// Checks to be sure that the given parameter number is in bounds, and
 /// is an integral type. Will emit appropriate diagnostics if this returns
 /// false.
 ///
 /// AttrArgNo is used to actually retrieve the argument, so it's base-0.
 template <typename AttrInfo>
-static bool checkParamIsIntegerType(Sema &S, const FunctionDecl *FD,
-                                    const AttrInfo &AI, unsigned AttrArgNo) {
+static bool checkParamIsIntegerType(Sema &S, const Decl *D, const AttrInfo &AI,
+                                    unsigned AttrArgNo) {
   assert(AI.isArgExpr(AttrArgNo) && "Expected expression argument");
   Expr *AttrArg = AI.getArgAsExpr(AttrArgNo);
   ParamIdx Idx;
-  if (!checkFunctionOrMethodParameterIndex(S, FD, AI, AttrArgNo + 1, AttrArg,
+  if (!checkFunctionOrMethodParameterIndex(S, D, AI, AttrArgNo + 1, AttrArg,
                                            Idx))
     return false;
 
-  const ParmVarDecl *Param = FD->getParamDecl(Idx.getASTIndex());
-  if (!Param->getType()->isIntegerType() && !Param->getType()->isCharType()) {
+  QualType ParamTy = getFunctionOrMethodParamType(D, Idx.getASTIndex());
+  if (!ParamTy->isIntegerType() && !ParamTy->isCharType()) {
     SourceLocation SrcLoc = AttrArg->getBeginLoc();
     S.Diag(SrcLoc, diag::err_attribute_integers_only)
-        << AI << Param->getSourceRange();
+        << AI << getFunctionOrMethodParamRange(D, Idx.getASTIndex());
     return false;
   }
   return true;
 }
 
 static void handleAllocSizeAttr(Sema &S, Decl *D, const ParsedAttr &AL) {
   if (!AL.checkAtLeastNumArgs(S, 1) || !AL.checkAtMostNumArgs(S, 2))
     return;
 
-  const auto *FD = cast<FunctionDecl>(D);
-  if (!FD->getReturnType()->isPointerType()) {
+  assert(isFunctionOrMethod(D) && hasFunctionProto(D));
+
+  QualType RetTy = getFunctionOrMethodResultType(D);
+  if (!RetTy->isPointerType()) {
     S.Diag(AL.getLoc(), diag::warn_attribute_return_pointers_only) << AL;
     return;
   }
 
   const Expr *SizeExpr = AL.getArgAsExpr(0);
   int SizeArgNoVal;
   // Parameter indices are 1-indexed, hence Index=1
   if (!checkPositiveIntArgument(S, AL, SizeExpr, SizeArgNoVal, /*Idx=*/1))
     return;
-  if (!checkParamIsIntegerType(S, FD, AL, /*AttrArgNo=*/0))
+  if (!checkParamIsIntegerType(S, D, AL, /*AttrArgNo=*/0))
     return;
   ParamIdx SizeArgNo(SizeArgNoVal, D);
 
   ParamIdx NumberArgNo;
   if (AL.getNumArgs() == 2) {
     const Expr *NumberExpr = AL.getArgAsExpr(1);
     int Val;
     // Parameter indices are 1-based, hence Index=2
     if (!checkPositiveIntArgument(S, AL, NumberExpr, Val, /*Idx=*/2))
       return;
-    if (!checkParamIsIntegerType(S, FD, AL, /*AttrArgNo=*/1))
+    if (!checkParamIsIntegerType(S, D, AL, /*AttrArgNo=*/1))
       return;
     NumberArgNo = ParamIdx(Val, D);
   }
 
   D->addAttr(::new (S.Context)
                  AllocSizeAttr(S.Context, AL, SizeArgNo, NumberArgNo));
 }
 

clang/test/CodeGen/alloc-size-fnptr.c

+// Check that the alloc_size attribute is propagated to the call instruction
+// for both direct and indirect calls
+// RUN: %clang_cc1 -triple x86_64-apple-darwin -emit-llvm %s -o - 2>&1 | FileCheck %s
+
+#define NULL ((void *)0)
+
+int gi;
+
+typedef unsigned long size_t;
+
+extern void *my_malloc(int) __attribute__((alloc_size(1)));
+extern void *my_calloc(int, int) __attribute__((alloc_size(1, 2)));
+
+// CHECK-LABEL: @call_direct
+void call_direct(void) {
+  my_malloc(50);
+  // CHECK: call i8* @my_malloc(i32 50) [[DIRECT_MALLOC_ATTR:#[0-9]+]]
+  my_calloc(1, 16);
+  // CHECK: call i8* @my_calloc(i32 1, i32 16) [[DIRECT_CALLOC_ATTR:#[0-9]+]]
+}
+
+extern void *(*malloc_function_pointer)(void *, int)__attribute__((alloc_size(2)));
+extern void *(*calloc_function_pointer)(void *, int, int)__attribute__((alloc_size(2, 3)));
+
+// CHECK-LABEL: @call_function_pointer
+void call_function_pointer(void) {
+  malloc_function_pointer(NULL, 100);
+  // CHECK: [[MALLOC_FN_PTR:%.+]] = load i8* (i8*, i32)*, i8* (i8*, i32)** @malloc_function_pointer, align 8
+  // CHECK: call i8* [[MALLOC_FN_PTR]](i8* null, i32 100) [[INDIRECT_MALLOC_ATTR:#[0-9]+]]
+  calloc_function_pointer(NULL, 2, 4);
+  // CHECK: [[CALLOC_FN_PTR:%.+]] = load i8* (i8*, i32, i32)*, i8* (i8*, i32, i32)** @calloc_function_pointer, align 8
+  // CHECK: call i8* [[CALLOC_FN_PTR]](i8* null, i32 2, i32 4) [[INDIRECT_CALLOC_ATTR:#[0-9]+]]
+}
+
+typedef void *(__attribute__((alloc_size(3))) * my_malloc_fn_pointer_type)(void *, void *, int);
+typedef void *(__attribute__((alloc_size(3, 4))) * my_calloc_fn_pointer_type)(void *, void *, int, int);
+extern my_malloc_fn_pointer_type malloc_function_pointer_with_typedef;
+extern my_calloc_fn_pointer_type calloc_function_pointer_with_typedef;
+
+// CHECK-LABEL: @call_function_pointer_typedef
+void call_function_pointer_typedef(void) {
+  malloc_function_pointer_with_typedef(NULL, NULL, 200);
+  // CHECK: [[INDIRECT_TYPEDEF_MALLOC_FN_PTR:%.+]] = load i8* (i8*, i8*, i32)*, i8* (i8*, i8*, i32)** @malloc_function_pointer_with_typedef, align 8
+  // CHECK: call i8* [[INDIRECT_TYPEDEF_MALLOC_FN_PTR]](i8* null, i8* null, i32 200) [[INDIRECT_TYPEDEF_MALLOC_ATTR:#[0-9]+]]
+  calloc_function_pointer_with_typedef(NULL, NULL, 8, 4);
+  // CHECK: [[INDIRECT_TYPEDEF_CALLOC_FN_PTR:%.+]] = load i8* (i8*, i8*, i32, i32)*, i8* (i8*, i8*, i32, i32)** @calloc_function_pointer_with_typedef, align 8
+  // CHECK: call i8* [[INDIRECT_TYPEDEF_CALLOC_FN_PTR]](i8* null, i8* null, i32 8, i32 4) [[INDIRECT_TYPEDEF_CALLOC_ATTR:#[0-9]+]]
+}
+
+// CHECK: attributes [[DIRECT_MALLOC_ATTR]] = { allocsize(0) }
+// CHECK: attributes [[DIRECT_CALLOC_ATTR]] = { allocsize(0,1) }
+// CHECK: attributes [[INDIRECT_MALLOC_ATTR]] = { allocsize(1) }
+// CHECK: attributes [[INDIRECT_CALLOC_ATTR]] = { allocsize(1,2) }
+// CHECK: attributes [[INDIRECT_TYPEDEF_MALLOC_ATTR]] = { allocsize(2) }
+// CHECK: attributes [[INDIRECT_TYPEDEF_CALLOC_ATTR]] = { allocsize(2,3) }

clang/test/CodeGen/alloc-size.c

 void *alloc_uchar(unsigned char) __attribute__((alloc_size(1)));
 
 // CHECK-LABEL: @test13
 void test13() {
   // If 128 were incorrectly seen as negative, the result would become -1.
   // CHECK: store i32 128,
   gi = OBJECT_SIZE_BUILTIN(alloc_uchar(128), 0);
 }
+
+void *(*malloc_function_pointer)(int)__attribute__((alloc_size(1)));
+void *(*calloc_function_pointer)(int, int)__attribute__((alloc_size(1, 2)));
+
+// CHECK-LABEL: @test_fn_pointer
+void test_fn_pointer() {
+  void *const vp = malloc_function_pointer(100);
+  // CHECK: store i32 100
+  gi = __builtin_object_size(vp, 0);
+  // CHECK: store i32 100
+  gi = __builtin_object_size(vp, 1);
+  // CHECK: store i32 100
+  gi = __builtin_object_size(vp, 2);
+  // CHECK: store i32 100
+  gi = __builtin_object_size(vp, 3);
+
+  void *const arr = calloc_function_pointer(100, 5);
+  // CHECK: store i32 500
+  gi = __builtin_object_size(arr, 0);
+  // CHECK: store i32 500
+  gi = __builtin_object_size(arr, 1);
+  // CHECK: store i32 500
+  gi = __builtin_object_size(arr, 2);
+  // CHECK: store i32 500
+  gi = __builtin_object_size(arr, 3);
+
+  // CHECK: store i32 100
+  gi = __builtin_object_size(malloc_function_pointer(100), 0);
+  // CHECK: store i32 100
+  gi = __builtin_object_size(malloc_function_pointer(100), 1);
+  // CHECK: store i32 100
+  gi = __builtin_object_size(malloc_function_pointer(100), 2);
+  // CHECK: store i32 100
+  gi = __builtin_object_size(malloc_function_pointer(100), 3);
+
+  // CHECK: store i32 500
+  gi = __builtin_object_size(calloc_function_pointer(100, 5), 0);
+  // CHECK: store i32 500
+  gi = __builtin_object_size(calloc_function_pointer(100, 5), 1);
+  // CHECK: store i32 500
+  gi = __builtin_object_size(calloc_function_pointer(100, 5), 2);
+  // CHECK: store i32 500
+  gi = __builtin_object_size(calloc_function_pointer(100, 5), 3);
+
+  void *const zeroPtr = malloc_function_pointer(0);
+  // CHECK: store i32 0
+  gi = __builtin_object_size(zeroPtr, 0);
+  // CHECK: store i32 0
+  gi = __builtin_object_size(malloc_function_pointer(0), 0);
+
+  void *const zeroArr1 = calloc_function_pointer(0, 1);
+  void *const zeroArr2 = calloc_function_pointer(1, 0);
+  // CHECK: store i32 0
+  gi = __builtin_object_size(zeroArr1, 0);
+  // CHECK: store i32 0
+  gi = __builtin_object_size(zeroArr2, 0);
+  // CHECK: store i32 0
+  gi = __builtin_object_size(calloc_function_pointer(1, 0), 0);
+  // CHECK: store i32 0
+  gi = __builtin_object_size(calloc_function_pointer(0, 1), 0);
+}
+
+typedef void *(__attribute__((warn_unused_result, alloc_size(1))) * my_malloc_function_pointer_type)(int);
+typedef void *(__attribute__((alloc_size(1, 2))) * my_calloc_function_pointer_type)(int, int);
+extern my_malloc_function_pointer_type malloc_function_pointer_with_typedef;
+extern my_calloc_function_pointer_type calloc_function_pointer_with_typedef;
+
+// CHECK-LABEL: @test_fn_pointer_typedef
+void test_fn_pointer_typedef() {
+  malloc_function_pointer_with_typedef(100);
+  void *const vp = malloc_function_pointer_with_typedef(100);
+  // CHECK: store i32 100
+  gi = __builtin_object_size(vp, 0);
+  // CHECK: store i32 100
+  gi = __builtin_object_size(vp, 1);
+  // CHECK: store i32 100
+  gi = __builtin_object_size(vp, 2);
+  // CHECK: store i32 100
+  gi = __builtin_object_size(vp, 3);
+
+  void *const arr = calloc_function_pointer_with_typedef(100, 5);
+  // CHECK: store i32 500
+  gi = __builtin_object_size(arr, 0);
+  // CHECK: store i32 500
+  gi = __builtin_object_size(arr, 1);
+  // CHECK: store i32 500
+  gi = __builtin_object_size(arr, 2);
+  // CHECK: store i32 500
+  gi = __builtin_object_size(arr, 3);
+
+  // CHECK: store i32 100
+  gi = __builtin_object_size(malloc_function_pointer_with_typedef(100), 0);
+  // CHECK: store i32 100
+  gi = __builtin_object_size(malloc_function_pointer_with_typedef(100), 1);
+  // CHECK: store i32 100
+  gi = __builtin_object_size(malloc_function_pointer_with_typedef(100), 2);
+  // CHECK: store i32 100
+  gi = __builtin_object_size(malloc_function_pointer_with_typedef(100), 3);
+
+  // CHECK: store i32 500
+  gi = __builtin_object_size(calloc_function_pointer_with_typedef(100, 5), 0);
+  // CHECK: store i32 500
+  gi = __builtin_object_size(calloc_function_pointer_with_typedef(100, 5), 1);
+  // CHECK: store i32 500
+  gi = __builtin_object_size(calloc_function_pointer_with_typedef(100, 5), 2);
+  // CHECK: store i32 500
+  gi = __builtin_object_size(calloc_function_pointer_with_typedef(100, 5), 3);
+
+  void *const zeroPtr = malloc_function_pointer_with_typedef(0);
+  // CHECK: store i32 0
+  gi = __builtin_object_size(zeroPtr, 0);
+  // CHECK: store i32 0
+  gi = __builtin_object_size(malloc_function_pointer_with_typedef(0), 0);
+
+  void *const zeroArr1 = calloc_function_pointer_with_typedef(0, 1);
+  void *const zeroArr2 = calloc_function_pointer_with_typedef(1, 0);
+  // CHECK: store i32 0
+  gi = __builtin_object_size(zeroArr1, 0);
+  // CHECK: store i32 0
+  gi = __builtin_object_size(zeroArr2, 0);
+  // CHECK: store i32 0
+  gi = __builtin_object_size(calloc_function_pointer_with_typedef(1, 0), 0);
+  // CHECK: store i32 0
+  gi = __builtin_object_size(calloc_function_pointer_with_typedef(0, 1), 0);
+}

clang/test/Misc/pragma-attribute-supported-attributes-list.test

 // RUN: clang-tblgen -gen-clang-test-pragma-attribute-supported-attributes -I%src_include_dir %src_include_dir/clang/Basic/Attr.td -o - | FileCheck %s
 
 // The number of supported attributes should never go down!
 
 // CHECK: #pragma clang attribute supports the following attributes:
 // CHECK-NEXT: AMDGPUFlatWorkGroupSize (SubjectMatchRule_function)
 // CHECK-NEXT: AMDGPUNumSGPR (SubjectMatchRule_function)
 // CHECK-NEXT: AMDGPUNumVGPR (SubjectMatchRule_function)
 // CHECK-NEXT: AMDGPUWavesPerEU (SubjectMatchRule_function)
 // CHECK-NEXT: AVRSignal (SubjectMatchRule_function)
 // CHECK-NEXT: AbiTag (SubjectMatchRule_record_not_is_union, SubjectMatchRule_variable, SubjectMatchRule_function, SubjectMatchRule_namespace)
 // CHECK-NEXT: AcquireHandle (SubjectMatchRule_function, SubjectMatchRule_type_alias, SubjectMatchRule_variable_is_parameter)
 // CHECK-NEXT: Alias (SubjectMatchRule_function, SubjectMatchRule_variable_is_global)
 // CHECK-NEXT: AlignValue (SubjectMatchRule_variable, SubjectMatchRule_type_alias)
-// CHECK-NEXT: AllocSize (SubjectMatchRule_function)
 // CHECK-NEXT: AlwaysDestroy (SubjectMatchRule_variable)
 // CHECK-NEXT: AlwaysInline (SubjectMatchRule_function)
 // CHECK-NEXT: Annotate ()
 // CHECK-NEXT: AnyX86NoCfCheck (SubjectMatchRule_hasType_functionType)
 // CHECK-NEXT: ArcWeakrefUnavailable (SubjectMatchRule_objc_interface)
 // CHECK-NEXT: ArmBuiltinAlias (SubjectMatchRule_function)
 // CHECK-NEXT: AssumeAligned (SubjectMatchRule_objc_method, SubjectMatchRule_function)
 // CHECK-NEXT: Assumption (SubjectMatchRule_function, SubjectMatchRule_objc_method)

clang/test/Sema/alloc-size.c

 // RUN: %clang_cc1 %s -verify
 
 void *fail1(int a) __attribute__((alloc_size)); //expected-error{{'alloc_size' attribute takes at least 1 argument}}
 void *fail2(int a) __attribute__((alloc_size())); //expected-error{{'alloc_size' attribute takes at least 1 argument}}
 
 void *fail3(int a) __attribute__((alloc_size(0))); //expected-error{{'alloc_size' attribute parameter 1 is out of bounds}}
 void *fail4(int a) __attribute__((alloc_size(2))); //expected-error{{'alloc_size' attribute parameter 1 is out of bounds}}
 
 void *fail5(int a, int b) __attribute__((alloc_size(0, 1))); //expected-error{{'alloc_size' attribute parameter 1 is out of bounds}}
 void *fail6(int a, int b) __attribute__((alloc_size(3, 1))); //expected-error{{'alloc_size' attribute parameter 1 is out of bounds}}
 
 void *fail7(int a, int b) __attribute__((alloc_size(1, 0))); //expected-error{{'alloc_size' attribute parameter 2 is out of bounds}}
 void *fail8(int a, int b) __attribute__((alloc_size(1, 3))); //expected-error{{'alloc_size' attribute parameter 2 is out of bounds}}
 
 int fail9(int a) __attribute__((alloc_size(1))); //expected-warning{{'alloc_size' attribute only applies to return values that are pointers}}
 
-int fail10 __attribute__((alloc_size(1))); //expected-warning{{'alloc_size' attribute only applies to functions}}
+int fail10 __attribute__((alloc_size(1))); //expected-warning{{'alloc_size' attribute only applies to non-K&R-style functions}}
 
 void *fail11(void *a) __attribute__((alloc_size(1))); //expected-error{{'alloc_size' attribute argument may only refer to a function parameter of integer type}}
 
 void *fail12(int a) __attribute__((alloc_size("abc"))); //expected-error{{'alloc_size' attribute requires parameter 1 to be an integer constant}}
 void *fail12(int a) __attribute__((alloc_size(1, "abc"))); //expected-error{{'alloc_size' attribute requires parameter 2 to be an integer constant}}
 void *fail13(int a) __attribute__((alloc_size(1U<<31))); //expected-error{{integer constant expression evaluates to value 2147483648 that cannot be represented in a 32-bit signed integer type}}
 
-int (*PR31453)(int) __attribute__((alloc_size(1))); //expected-warning{{'alloc_size' attribute only applies to functions}}
+void *(*PR31453)(int)__attribute__((alloc_size(1)));
+
+void *KR() __attribute__((alloc_size(1))); //expected-warning{{'alloc_size' attribute only applies to non-K&R-style functions}}
+
+// Applying alloc_size to function pointers should work:
+void *(__attribute__((alloc_size(1))) * func_ptr1)(int);
+void *(__attribute__((alloc_size(1, 2))) func_ptr2)(int, int);
+
+// TODO: according to GCC documentation the following should actually be the type
+// “pointer to pointer to alloc_size attributed function returning void*” and should
+// therefore be supported
+void *(__attribute__((alloc_size(1))) **ptr_to_func_ptr)(int); // expected-warning{{'alloc_size' attribute only applies to non-K&R-style functions}}
+// The following definitions apply the attribute to the pointer to the function pointer which should not be possible
+void *(*__attribute__((alloc_size(1))) * ptr_to_func_ptr2)(int); // expected-warning{{'alloc_size' attribute only applies to non-K&R-style functions}}
+void *(**__attribute__((alloc_size(1))) ptr_to_func_ptr2)(int);  // expected-warning{{'alloc_size' attribute only applies to non-K&R-style functions}}
+
+// It should also work for typedefs:
+typedef void *(__attribute__((alloc_size(1))) allocator_function_typdef)(int);
+typedef void *(__attribute__((alloc_size(1, 2))) * allocator_function_typdef2)(int, int);
+void *(__attribute__((alloc_size(1, 2))) * allocator_function_typdef3)(int, int);
+// This typedef applies the alloc_size to the pointer to the function pointer and should not be allowed
+void *(**__attribute__((alloc_size(1, 2))) * allocator_function_typdef4)(int, int); // expected-warning{{'alloc_size' attribute only applies to non-K&R-style functions}}
+
+// We should not be warning when assigning function pointers with and without the alloc size attribute
+// since it doesn't change the type of the function
+typedef void *(__attribute__((alloc_size(1))) * my_malloc_fn_pointer_type)(int);
+typedef void *(*my_other_malloc_fn_pointer_type)(int);
+void *fn(int i);
+__attribute__((alloc_size(1))) void *fn2(int i);
+
+int main() {
+  my_malloc_fn_pointer_type f = fn;
+  my_other_malloc_fn_pointer_type f2 = fn;
+  my_malloc_fn_pointer_type f3 = fn2;
+  my_other_malloc_fn_pointer_type f4 = fn2;
+}