Introduce the callback attribute and emit !callback metadata

[jdoerfert]

Summary

With commit rXXXXX (currently https://reviews.llvm.org/D54498), LLVM
gained the ability to apply existing optimizations on indirections
through callbacks. This is based on an abstraction that hides the
middle man as described in rXXXXX and the llvm::AbstractCallSite class.

This commit enables clang to emit !callback metadata that is
understood by LLVM. It does so in three different cases:
  1) For known broker functions declarations that are directly
     emitted, e.g., __kmpc_fork_call for the OpenMP pragma parallel.
  2) For known broker functions that are identified by their name and
     source location through the builtin mechanism, e.g.,
     pthread_create from the POSIX thread API.
  3) For user annotated functions that carry the "callback(idx, ...)"
     attribute. The attribute has to include the index of the callback
     callee and how the passed arguments can be identified (as many as
     the callback callee has).

For additional information, also consider the commit message and
discussion for the LLVM patch: https://reviews.llvm.org/D54498

NOTE: This is only committed after https://reviews.llvm.org/D54498 and the commit message will be modified accordingly.

[aaron.ballman]

This is missing all of the Sema and SemaCXX tests. Should have tests for member functions, variadic functions, incorrect arguments, incorrect subjects, etc.

include/clang/Basic/Attr.td

1206

No new undocumented attributes, please.

[aaron.ballman]

include/clang/Basic/Attr.td

1205

Should this also apply to Objective-C methods?

Why should the user specify this attribute on the function as opposed to on the parameter? e.g.,

// Why this:
__attribute__((callback (1, 2, 3)))
void* broker0(void* (*callee)(void *), void *payload, int otherPayload) {
  return callee(payload);
}

// Instead of this:
void* broker0(void* (*callee)(void *) __attribute__((callback (2, 3))), void *payload, int otherPayload) {
  return callee(payload);
}

// Or this:
void* broker0(void* (*callee)(void *) __attribute__((callback (payload, otherPayload))), void *payload, int otherPayload) {
  return callee(payload);
}

I ask because these "use an index" attributes are really hard for users to use in practice. They have to account for 0-vs-1 based indexing, implicit this parameters, etc and if we can avoid that, it may be worth the effort.

[jdoerfert]

In D55483#1326029, @aaron.ballman wrote:

This is missing all of the Sema and SemaCXX tests. Should have tests for member functions, variadic functions, incorrect arguments, incorrect subjects, etc.

I will write more tests and update this revision.

include/clang/Basic/Attr.td

1205

Should this also apply to Objective-C methods?

I don't need it to and unless somebody does, I'd say no.

I ask because these "use an index" attributes are really hard for users to use in practice. They have to account for 0-vs-1 based indexing, implicit this parameters, etc and if we can avoid that, it may be worth the effort.

I was thinking that the function notation makes it clear that there is *only one callback per function* allowed right now. I don't expect many manual users of this feature until we improve the middle-end support, so it is unclear to me if this requirement needs to be removed as well.

Other than that, some thoughts:

• I do not feel strongly about this.
• The middle requirement seems not much better n the first, we would still need to deal with index numbers (callbacks without arguments are not really interesting for now).
• The last encoding requires us to define a symbol for "unknown argument" (maybe _ or ?).

1206

Ok, I can write documentation similar to the commit message and the lang-ref documentation for the callback metadata.

[jdoerfert]

Update according to initial feedback

[aaron.ballman]

include/clang/Basic/Attr.td

1205

I was thinking that the function notation makes it clear that there is *only one callback per function* allowed right now.

I don't see how that follows. Users may still try writing:

__attribute__((callback (1, 3, 4)))
__attribute__((callback (2, 3, 4)))
void broker0(void (*cb1)(void *, int), void (*cb2)(void *, int), void *payload, int otherPayload) {
  cb1(payload, otherPayload);
  cb2(payload, otherPayload);
}

and reasonably expect that to work (we should have this as a test case, and probably warn on it).

I'm not strongly opposed to the current way this is exposed to users, just wondering if we can find a better way to surface the feature.

The last encoding requires us to define a symbol for "unknown argument" (maybe _ or ?).

Ah, I wasn't aware that this was part of the feature, but the documentation you wrote helped to clarify for me. Personal preference is for ?, but any symbol will do (so long as we aren't hoping users can count commas, e.g., callback(,,,,frobble,,,foo)).

include/clang/Basic/AttrDocs.td

3711

I'd remove callee here in both places.

3714

and the following indicies are the forwarded arguments.

3716

The index '0' is used to represent a callback callee argument which is not present in the declared parameter list.

3718

attributes -> attribute

3719

, allow to make the connection -> , make the connection

3721

Switch to consistently using a single space after the period (as was done in the previous paragraph).

3723

undefinied -> undefined

3724

else than then actual callback -> anything other than the actual callback.

Thus, inspected -> Inspected,

3725

shall may be mentioned -> are listed

3730–3731

You should mention the circumstances under which we automatically recognize a callback so that users know when they're required to write the annotation vs allowing the compiler to infer it.

[jdoerfert]

Fix and improve documentation

[jdoerfert]

Thanks for the feedback.

Once we decided on the style of the annotation, I will implement that and change the tests/documentation accordingly.

include/clang/Basic/Attr.td

1205

and reasonably expect that to work (we should have this as a test case, and probably warn on it).

We have a test case and we'll spit out an error. (Sema/attr-callback-broken.c line 21 & 22)

I'm not strongly opposed to the current way this is exposed to users, just wondering if we can find a better way to surface the feature.

I can change it to the inlined style if nobody disagrees:

void broker(int foo, void (*callback)(int, int, int, int) __attribute__((callback(foo, ?, bar, ?))), int bar);

As I mentioned, I don't have a strong opinion on this but I just don't want to change it back and forth :)

[arichardson]

include/clang/Basic/Builtins.def

942

qsort_r callback argument order is different on Linux, macOS and FreeBSD so those constants can't be hardcoded:
Linux:
void qsort_r(void *base, size_t nmemb, size_t size, int (*compar)(const void *, const void *, void *), void *arg);
FreeBSD:
void qsort_r(void *base, size_t nmemb, size_t size, void *thunk, int (*compar)(void *, const void *, const void*));
macos:
void qsort_r(void *base, size_t nel, size_t width, void *thunk, int (*compar)(void *, const void *, const void *));

test/CodeGen/callback_qsort_r.c

2

This should use a linux triple otherwise the qsort_r declaration is wrong. Ideally it should also handle macos+FreeBSD with the inverted argument order.

[jdoerfert]

include/clang/Basic/Builtins.def

942

Really good point. I'll remove qsort_r in the next version I guess. If we find another similar function we can extend the encoding to sth like: C:(<3,-1,-1,4>|<5,4,-1,-1>) which represents both possibilities. The Builtin::Context::performsCallback(...) will then need to check which is appropriate based on the type of the actual declaration.

[jdoerfert]

Update encoding, rebase to HEAD

[jdoerfert]

Fix tests

[jdoerfert]

Allow to use names in the callback metadata

[jdoerfert]

include/clang/Basic/Attr.td

1205

You can now use parameter names or indices in the callback attribute. The special identifiers "" (double underscore) and "this" can be used to specify an unknown (-1 in the index notation) and the implicit "this" (0 in the index notation) argument.

test/CodeGen/callback_qsort_r.c

2

I postponed qsort_r until we have another similar function or somebody want to implement the necessary functionality.

[aaron.ballman]

include/clang/Basic/Attr.td

1205

Nice! I like that approach.

include/clang/Basic/AttrDocs.td

3716

I'd use backticks around 0 and this rather than single and double quotes, to make it clear that these are syntax and not prose.

3720–3721

Grammatical issue here -- I think it should probably say "or one that is, but is potentially..."

3724

are -> is

include/clang/Basic/DiagnosticSemaKinds.td

2598

I think this should say 'callback' attribute (here and in the other diagnostics); WDYT?

2599–2600

This is not needed, see err_attribute_argument_out_of_bounds.

2606

I'd reword this to use "may not" instead of "shall not".

2609–2612

These are not needed, see err_attribute_too_many_arguments and err_attribute_too_few_arguments (or err_attribute_wrong_number_arguments).

lib/Sema/SemaDecl.cpp

13587–13588

You can combine these predicates into one if statement.

lib/Sema/SemaDeclAttr.cpp

3474

This doesn't match the documentation -- I assume you switched from ? to __ because __ at least parses as a valid identifier, whereas ? would require extra parsing support? If so, that's fine by me.

3476

This doesn't match the documentation either, but I'm less clear on why the double underscores are used.

3485

Identifiers don't match the usual naming conventions. Prefer ++U as well.

3486

Spurious newline

3495

You can pass in IdLoc->Ident and the diagnostic engine should properly print and quote it for you.

3501

Spurious newline.

3521

Newline

test/CodeGen/callback_annotated.c

19–20

Can you add a test like this:

void* broker2(void *(*callee)(void));

void* test(void) {
  return broker2(test);
}

__attribute__((callback (callee)))
void* broker2(void *(*callee)(void));

Basically, I'm trying to see whether we properly merge the declarations and note that the call to broker2() within test() really does have the callback attribute.

test/Sema/attr-callback-broken.c

6

Please run the tests through clang-format.

[jdoerfert]

Style changes, clang-format, documentation improvements

[jdoerfert]

Updated according to your comments.

lib/Sema/SemaDeclAttr.cpp

3474

Yes, __, and __this where chosen because they work without lexer/parser changes and are in the implementation namespace. I forgot to update the documentation though. Will be fixed.

3476

If you use this, the lexer will generate the special "this" token. That one is checked explicitly to be only used inside of non-static class methods. If you have an idea how to avoid this check or make it consider uses in the attribute as OK, please let me know.

3485

OK.

Prefer ++U as well.

Out of curiosity, why?

3486

That was intentional but OK.

[aaron.ballman]

include/clang/Basic/AttrDocs.td

3718

The '?' here needs to change to be '__' instead.

include/clang/Basic/Builtins.def

96

Wrap to 80-col

lib/Sema/SemaDeclAttr.cpp

3476

Why do you want to avoid that check? It seems like that's a very good check to have -- what circumstances would you expect a user to use this in a something other than a non-static member function?

3485

Because the previous value of U is not needed (you're executing the instruction only for its side effects, not its value).

[jdoerfert]

Small fixes, allow "this" inside "callbacks"

[jdoerfert]

Generalize the treatment of "kw_this" as "kw_ident"

[aaron.ballman]

LGTM aside from some minor nits.

However, please hold off on committing this until *after* the 8.0 branch happens. While I don't expect there to be issues with this patch, it does introduce a pretty novel new way to interact with attributes and I want to ensure that the community has the opportunity to react to any major issues with this approach, and I'm not certain a month or so will be enough time for that. If you need this patch to go in *before* the branch for some reason, please mention it! I'm not strictly opposed to it going in sooner rather than later, but if there's not a pressing need for the functionality, I'd prefer to wait out of an abundance of caution.

include/clang/Basic/AttrDocs.td

3716

__this should be this now.

utils/TableGen/ClangAttrEmitter.cpp

2163

const Record *

2171–2172

The formatting looks off here.

include/clang/AST/ASTContext.h

TemplateName getSubstTemplateTemplateParm(TemplateTemplateParmDecl *param,
                                             TemplateName replacement) const;
   TemplateName getSubstTemplateTemplateParmPack(TemplateTemplateParmDecl *Param,
                                         const TemplateArgument &ArgPack) const;
 
   enum GetBuiltinTypeError {
     /// No error
     GE_None,
 
+    /// Missing a type
+    GE_Missing_type,
+
     /// Missing a type from <stdio.h>
     GE_Missing_stdio,
 
     /// Missing a type from <setjmp.h>
     GE_Missing_setjmp,
 
     /// Missing a type from <ucontext.h>
     GE_Missing_ucontext

include/clang/Basic/Attr.td

class FunctionArgument<string name, bit opt = 0, bit fake = 0> : Argument<name,
                                                                           opt,
                                                                           fake>;
 class NamedArgument<string name, bit opt = 0, bit fake = 0> : Argument<name,
                                                                           opt,
                                                                           fake>;
 class TypeArgument<string name, bit opt = 0> : Argument<name, opt>;
 class UnsignedArgument<string name, bit opt = 0> : Argument<name, opt>;
 class VariadicUnsignedArgument<string name> : Argument<name, 1>;
+class VariadicSignedArgument<string name> : Argument<name, 1>;
 class VariadicExprArgument<string name> : Argument<name, 1>;
 class VariadicStringArgument<string name> : Argument<name, 1>;
 class VariadicIdentifierArgument<string name> : Argument<name, 1>;
 
 // Like VariadicUnsignedArgument except values are ParamIdx.
 class VariadicParamIdxArgument<string name> : Argument<name, 1>;
 
 // Like VariadicParamIdxArgument but for a single function parameter index.

 
 def FormatArg : InheritableAttr {
   let Spellings = [GCC<"format_arg">];
   let Args = [ParamIdxArgument<"FormatIdx">];
   let Subjects = SubjectList<[ObjCMethod, HasFunctionProto]>;
   let Documentation = [Undocumented];
 }
 
+def Callback : InheritableAttr {
+  let Spellings = [Clang<"callback">];
+  let Args = [UnsignedArgument<"CalleeIdx">,
+              VariadicSignedArgument<"PayloadIndices">];
+  let Subjects = SubjectList<[Function]>;
+  let Documentation = [CallbackDocs];
+}
+
 def GNUInline : InheritableAttr {
   let Spellings = [GCC<"gnu_inline">];
   let Subjects = SubjectList<[Function]>;
   let Documentation = [GnuInlineDocs];
 }
 
 def Hot : InheritableAttr {
   let Spellings = [GCC<"hot">];

include/clang/Basic/AttrDocs.td

def NoDestroyDocs : Documentation {
   let Content = [{
 The ``no_destroy`` attribute specifies that a variable with static or thread
 storage duration shouldn't have its exit-time destructor run. Annotating every
 static and thread duration variable with this attribute is equivalent to
 invoking clang with -fno-c++-static-destructors.
   }];
 }
 
+def CallbackDocs : Documentation {
+  let Category = DocCatVariable;
+  let Content = [{
+The ``callback`` attribute specifies that the annotated function may invoke the
+specified callback callee zero or more times. The callback callee, as well as
+the passed arguments, are identified by their parameter position (starting with
+1!) in the annotated function. The first position identifies the callback callee,
+the following indices the forwarded arguments. The callback callee is required
+to be callable with the number, and order, of the specified arguments. To
+represent unknown arguments a zero shall be used.
+
+The ``callback`` attributes, which are directly translated to ``callback``
+metadata <http://llvm.org/docs/LangRef.html#callback-metadata>, allow to make
+the connection between the call to the annotated function and the callback
+callee.  This can enable interprocedural optimizations which were otherwise
+impossible.  If a function parameter is mentioned in the ``callback``
+attribute, through its position, it is undefinied if that parameter is used for
+anything else than then actual callback. Thus, inspected, captured, or modified
+parameters shall may be mentioned in the ``callback`` metadata.
+
+An example for the callback performed by `pthread_create` is shown below.  The
+explicit attribute annotation indicates that the third parameter
+(`start_routine`) is called zero or more times by the `pthread_create` function,
+and that the fourth parameter (`arg`) is passed along. Note that this case is
+actually automatically recognized.
+
+  .. code-block:: c
+
+    __attribute__((callback (3, 4)))
+    int pthread_create(pthread_t *thread, const pthread_attr_t *attr,
+                       void *(*start_routine) (void *), void *arg);
+
+  }];
+}
+
 def GnuInlineDocs : Documentation {
   let Category = DocCatFunction;
   let Content = [{
 The ``gnu_inline`` changes the meaning of ``extern inline`` to use GNU inline
 semantics, meaning:
 
 * If any declaration that is declared ``inline`` is not declared ``extern``,
 then the ``inline`` keyword is just a hint. In particular, an out-of-line

include/clang/Basic/Builtins.h

public:
   /// argument and whether this function as a va_list argument.
   bool isPrintfLike(unsigned ID, unsigned &FormatIdx, bool &HasVAListArg);
 
   /// Determine whether this builtin is like scanf in its
   /// formatting rules and, if so, set the index to the format string
   /// argument and whether this function as a va_list argument.
   bool isScanfLike(unsigned ID, unsigned &FormatIdx, bool &HasVAListArg);
 
+  /// Determine whether this builtin has callback behavior (see
+  /// llvm::AbstractCallSites for details). If so, set the index to the
+  /// callback callee argument and the callback payload arguments. Note that
+  /// we use LLVM indices starting at 0 here!
+  bool performsCallback(unsigned ID, unsigned &CalleeIdx,
+                        llvm::SmallVectorImpl<int> &PayloadIndices) const;
+
   /// Return true if this function has no side effects and doesn't
   /// read memory, except for possibly errno.
   ///
   /// Such functions can be const when the MathErrno lang option is disabled.
   bool isConstWithoutErrno(unsigned ID) const {
     return strchr(getRecord(ID).Attributes, 'e') != nullptr;
   }
 

include/clang/Basic/Builtins.def

 //          string.
 //  S:N: -> similar to the s:N: attribute, but the function is like vscanf
 //          in that it accepts its arguments as a va_list rather than
 //          through an ellipsis
 //  e -> const, but only when -fno-math-errno
 //  j -> returns_twice (like setjmp)
 //  u -> arguments are not evaluated for their side-effects
 //  V:N: -> requires vectors of at least N bits to be legal
+//  C<N,M_0,...,M_k> -> callback behavior: argument N is called with argument M_0, ..., M_k as payload
 //  FIXME: gcc has nonnull
 
 #if defined(BUILTIN) && !defined(LIBBUILTIN)
 #  define LIBBUILTIN(ID, TYPE, ATTRS, HEADER, BUILTIN_LANG) BUILTIN(ID, TYPE, ATTRS)
 #endif
 
 #if defined(BUILTIN) && !defined(LANGBUILTIN)
 #  define LANGBUILTIN(ID, TYPE, ATTRS, BUILTIN_LANG) BUILTIN(ID, TYPE, ATTRS)

 LIBBUILTIN(setjmp, "iJ",          "fj",    "setjmp.h", ALL_LANGUAGES)
 LIBBUILTIN(longjmp, "vJi",        "fr",    "setjmp.h", ALL_LANGUAGES)
 
 // Non-C library functions, active in GNU mode only.
 // Functions with (returns_twice) attribute (marked as "j") are still active in
 // all languages, because losing this attribute would result in miscompilation
 // when these functions are used in non-GNU mode. PR16138.
 LIBBUILTIN(alloca, "v*z",         "f",     "stdlib.h", ALL_GNU_LANGUAGES)
+LIBBUILTIN(qsort_r, "",           "fC<3,-1,-1,4>", "stdlib.h", ALL_GNU_LANGUAGES)
 // POSIX string.h
 LIBBUILTIN(stpcpy, "c*c*cC*",     "f",     "string.h", ALL_GNU_LANGUAGES)
 LIBBUILTIN(stpncpy, "c*c*cC*z",   "f",     "string.h", ALL_GNU_LANGUAGES)
 LIBBUILTIN(strdup, "c*cC*",       "f",     "string.h", ALL_GNU_LANGUAGES)
 LIBBUILTIN(strndup, "c*cC*z",     "f",     "string.h", ALL_GNU_LANGUAGES)
 // POSIX strings.h
 LIBBUILTIN(index, "c*cC*i",       "f",     "strings.h", ALL_GNU_LANGUAGES)
 LIBBUILTIN(rindex, "c*cC*i",      "f",     "strings.h", ALL_GNU_LANGUAGES)
 LIBBUILTIN(bzero, "vv*z",         "f",     "strings.h", ALL_GNU_LANGUAGES)
 // In some systems str[n]casejmp is a macro that expands to _str[n]icmp.
 // We undefine then here to avoid wrong name.
 #undef strcasecmp
 #undef strncasecmp
 LIBBUILTIN(strcasecmp, "icC*cC*", "f",     "strings.h", ALL_GNU_LANGUAGES)
 LIBBUILTIN(strncasecmp, "icC*cC*z", "f",   "strings.h", ALL_GNU_LANGUAGES)
 // POSIX unistd.h
 LIBBUILTIN(_exit, "vi",           "fr",    "unistd.h", ALL_GNU_LANGUAGES)
 LIBBUILTIN(vfork, "p",            "fj",    "unistd.h", ALL_LANGUAGES)
+// POSIX pthread.h
+LIBBUILTIN(pthread_create, "",  "fC<2,3>", "pthread.h", ALL_GNU_LANGUAGES)
+
 // POSIX setjmp.h
 
 LIBBUILTIN(_setjmp, "iJ",         "fj",   "setjmp.h", ALL_LANGUAGES)
 LIBBUILTIN(__sigsetjmp, "iSJi",   "fj",   "setjmp.h", ALL_LANGUAGES)
 LIBBUILTIN(sigsetjmp, "iSJi",     "fj",   "setjmp.h", ALL_LANGUAGES)
 LIBBUILTIN(setjmp_syscall, "iJ",  "fj",   "setjmp.h", ALL_LANGUAGES)
 LIBBUILTIN(savectx, "iJ",         "fj",   "setjmp.h", ALL_LANGUAGES)
 LIBBUILTIN(qsetjmp, "iJ",         "fj",   "setjmp.h", ALL_LANGUAGES)

include/clang/Basic/DiagnosticSemaKinds.td

def err_format_strftime_third_parameter : Error<
   "strftime format attribute requires 3rd parameter to be 0">;
 def err_format_attribute_requires_variadic : Error<
   "format attribute requires variadic function">;
 def err_format_attribute_not : Error<"format argument not %0">;
 def err_format_attribute_result_not : Error<"function does not return %0">;
 def err_format_attribute_implicit_this_format_string : Error<
   "format attribute cannot specify the implicit this argument as the format "
   "string">;
+def err_callback_attribute_no_callee : Error<
+  "no callback callee argument index specified">;
+def err_callback_attribute_multiple : Error<
+  "multiple 'callback' attributes specified">;
+def err_callback_attribute_argument_index_oob : Error<
+  "'callback' argument at position %0 is out-of-bounds">;
+def err_callback_incomplete_function_type : Error<
+  "'callback' function has incomplete function type">;
+def err_callback_callee_no_function_type : Error<
+  "'callback' callee does not have function type">;
+def err_callback_callee_is_variadic : Error<
+  "'callback' callee shall not be variadic">;
+def err_callback_implicit_this_not_available : Error<
+  "'callback' argument at position %0 specifies unawailable implicit 'this'">;
+def err_callback_too_few_arguments : Error<
+  "'callback' attribute specifies too few arguments">;
+def err_callback_too_many_arguments : Error<
+  "'callback' attribute specifies too many arguments">;
 def err_init_method_bad_return_type : Error<
   "init methods must return an object pointer type, not %0">;
 def err_attribute_invalid_size : Error<
   "vector size not an integral multiple of component size">;
 def err_attribute_zero_size : Error<"zero vector size">;
 def err_attribute_size_too_large : Error<"vector size too large">;
 def err_typecheck_vector_not_convertable_implict_truncation : Error<
    "cannot convert between %select{scalar|vector}0 type %1 and vector type"
    " %2 as implicit conversion would cause truncation">;
 def err_typecheck_vector_not_convertable : Error<
   "cannot convert between vector values of different size (%0 and %1)">;
 def err_typecheck_vector_not_convertable_non_scalar : Error<

lib/AST/ASTContext.cpp

static QualType DecodeTypeFromStr(const char *&Str, const ASTContext &Context,
   return Type;
 }
 
 /// GetBuiltinType - Return the type for the specified builtin.
 QualType ASTContext::GetBuiltinType(unsigned Id,
                                     GetBuiltinTypeError &Error,
                                     unsigned *IntegerConstantArgs) const {
   const char *TypeStr = BuiltinInfo.getTypeString(Id);
+  if (TypeStr[0] == '\0') {
+    Error = GE_Missing_type;
+    return {};
+  }
 
   SmallVector<QualType, 8> ArgTypes;
 
   bool RequiresICE = false;
   Error = GE_None;
   QualType ResType = DecodeTypeFromStr(TypeStr, *this, Error,
                                        RequiresICE, true);
   if (Error != GE_None)

lib/Basic/Builtins.cpp

bool Builtin::Context::isPrintfLike(unsigned ID, unsigned &FormatIdx,
   return isLike(ID, FormatIdx, HasVAListArg, "pP");
 }
 
 bool Builtin::Context::isScanfLike(unsigned ID, unsigned &FormatIdx,
                                    bool &HasVAListArg) {
   return isLike(ID, FormatIdx, HasVAListArg, "sS");
 }
 
+bool Builtin::Context::performsCallback(
+    unsigned ID, unsigned &CalleeIdx,
+    SmallVectorImpl<int> &PayloadIndices) const {
+  const char *CalleePos = ::strchr(getRecord(ID).Attributes, 'C');
+  if (!CalleePos)
+    return false;
+
+  ++CalleePos;
+  assert(*CalleePos == '<' &&
+         "Callback callee specifier must be followed by a '<'");
+  ++CalleePos;
+
+  char *EndPos;
+  CalleeIdx = ::strtol(CalleePos, &EndPos, 10);
+
+  while (*EndPos == ',') {
+    const char *PayloadPos = EndPos + 1;
+
+    int PayloadIdx = ::strtol(PayloadPos, &EndPos, 10);
+    PayloadIndices.push_back(PayloadIdx);
+  }
+
+  assert(*EndPos == '>' && "Callback callee specifier must end with a '>'");
+
+  return true;
+}
+
 bool Builtin::Context::canBeRedeclared(unsigned ID) const {
   return ID == Builtin::NotBuiltin ||
          ID == Builtin::BI__va_start ||
          (!hasReferenceArgsOrResult(ID) &&
           !hasCustomTypechecking(ID));
 }

lib/CodeGen/CGOpenMPRuntime.cpp

CGOpenMPRuntime::createRuntimeFunction(unsigned Function) {
   case OMPRTL__kmpc_fork_call: {
     // Build void __kmpc_fork_call(ident_t *loc, kmp_int32 argc, kmpc_micro
     // microtask, ...);
     llvm::Type *TypeParams[] = {getIdentTyPointerTy(), CGM.Int32Ty,
                                 getKmpc_MicroPointerTy()};
     auto *FnTy =
         llvm::FunctionType::get(CGM.VoidTy, TypeParams, /*isVarArg*/ true);
     RTLFn = CGM.CreateRuntimeFunction(FnTy, "__kmpc_fork_call");
+    if (auto *F = dyn_cast<llvm::Function>(RTLFn)) {
+      if (!F->hasMetadata(llvm::LLVMContext::MD_callback)) {
+        llvm::MDBuilder MDB(F->getContext());
+        // Annotate the callback behavior of the __kmpc_fork_call:
+        //  - The callback callee is argument number 2 (microtask).
+        //  - The first two arguments of the callback callee are unknown (-1).
+        //  - All variadic arguments to the __kmpc_fork_call are passed to the
+        //    callback callee.
+        F->addMetadata(llvm::LLVMContext::MD_callback,
+                       *MDB.createCallback(2, {-1, -1}, /* VarArg */ true));
+      }
+    }
     break;
   }
   case OMPRTL__kmpc_global_thread_num: {
     // Build kmp_int32 __kmpc_global_thread_num(ident_t *loc);
     llvm::Type *TypeParams[] = {getIdentTyPointerTy()};
     auto *FnTy =
         llvm::FunctionType::get(CGM.Int32Ty, TypeParams, /*isVarArg*/ false);
     RTLFn = CGM.CreateRuntimeFunction(FnTy, "__kmpc_global_thread_num");
CGOpenMPRuntime::createRuntimeFunction(unsigned Function) {
   case OMPRTL__kmpc_fork_teams: {
     // Build void __kmpc_fork_teams(ident_t *loc, kmp_int32 argc, kmpc_micro
     // microtask, ...);
     llvm::Type *TypeParams[] = {getIdentTyPointerTy(), CGM.Int32Ty,
                                 getKmpc_MicroPointerTy()};
     auto *FnTy =
         llvm::FunctionType::get(CGM.VoidTy, TypeParams, /*isVarArg*/ true);
     RTLFn = CGM.CreateRuntimeFunction(FnTy, "__kmpc_fork_teams");
+    if (auto *F = dyn_cast<llvm::Function>(RTLFn)) {
+      if (!F->hasMetadata(llvm::LLVMContext::MD_callback)) {
+        llvm::MDBuilder MDB(F->getContext());
+        // Annotate the callback behavior of the __kmpc_fork_teams:
+        //  - The callback callee is argument number 2 (microtask).
+        //  - The first two arguments of the callback callee are unknown (-1).
+        //  - All variadic arguments to the __kmpc_fork_teams are passed to the
+        //    callback callee.
+        F->addMetadata(llvm::LLVMContext::MD_callback,
+                       *MDB.createCallback(2, {-1, -1}, /* VarArg */ true));
+      }
+    }
     break;
   }
   case OMPRTL__kmpc_taskloop: {
     // Build void __kmpc_taskloop(ident_t *loc, int gtid, kmp_task_t *task, int
     // if_val, kmp_uint64 *lb, kmp_uint64 *ub, kmp_int64 st, int nogroup, int
     // sched, kmp_uint64 grainsize, void *task_dup);
     llvm::Type *TypeParams[] = {getIdentTyPointerTy(),
                                 CGM.IntTy,

lib/CodeGen/CodeGenModule.cpp

void CodeGenModule::SetFunctionAttributes(GlobalDecl GD, llvm::Function *F,
 
   // Don't emit entries for function declarations in the cross-DSO mode. This
   // is handled with better precision by the receiving DSO.
   if (!CodeGenOpts.SanitizeCfiCrossDso)
     CreateFunctionTypeMetadataForIcall(FD, F);
 
   if (getLangOpts().OpenMP && FD->hasAttr<OMPDeclareSimdDeclAttr>())
     getOpenMPRuntime().emitDeclareSimdFunction(FD, F);
+
+  if (const auto *CB = FD->getAttr<CallbackAttr>()) {
+    // Annotate the callback behavior as metadata:
+    //  - The callback callee (as argument number).
+    //  - The callback payloads (as argument numbers).
+    llvm::MDBuilder MDB(F->getContext());
+    ArrayRef<int> PayloadIndices(CB->payloadIndices_begin(),
+                                 CB->payloadIndices_size());
+    F->addMetadata(llvm::LLVMContext::MD_callback,
+                   *MDB.createCallback(CB->getCalleeIdx(), PayloadIndices,
+                                       /* VarArg */ false));
+  }
 }
 
 void CodeGenModule::addUsedGlobal(llvm::GlobalValue *GV) {
   assert(!GV->isDeclaration() &&
          "Only globals with definition can force usage.");
   LLVMUsed.emplace_back(GV);
 }
 

lib/Sema/SemaDecl.cpp

static void LookupPredefedObjCSuperType(Sema &ThisSema, Scope *S,
   LookupResult Result(ThisSema, &Context.Idents.get("objc_super"),
                       SourceLocation(), Sema::LookupTagName);
   ThisSema.LookupName(Result, S);
   if (Result.getResultKind() == LookupResult::Found)
     if (const TagDecl *TD = Result.getAsSingle<TagDecl>())
       Context.setObjCSuperType(Context.getTagDeclType(TD));
 }
 
-static StringRef getHeaderName(ASTContext::GetBuiltinTypeError Error) {
+static StringRef getHeaderName(Builtin::Context &BuiltinInfo, unsigned ID,
+                               ASTContext::GetBuiltinTypeError Error) {
   switch (Error) {
   case ASTContext::GE_None:
     return "";
+  case ASTContext::GE_Missing_type:
+    return BuiltinInfo.getHeaderName(ID);
   case ASTContext::GE_Missing_stdio:
     return "stdio.h";
   case ASTContext::GE_Missing_setjmp:
     return "setjmp.h";
   case ASTContext::GE_Missing_ucontext:
     return "ucontext.h";
   }
   llvm_unreachable("unhandled error kind");
 }
 
 /// LazilyCreateBuiltin - The specified Builtin-ID was first used at
 /// file scope.  lazily create a decl for it. ForRedeclaration is true
 /// if we're creating this built-in in anticipation of redeclaring the
 /// built-in.
 NamedDecl *Sema::LazilyCreateBuiltin(IdentifierInfo *II, unsigned ID,
                                      Scope *S, bool ForRedeclaration,
                                      SourceLocation Loc) {
   LookupPredefedObjCSuperType(*this, S, II);
 
   ASTContext::GetBuiltinTypeError Error;
   QualType R = Context.GetBuiltinType(ID, Error);
   if (Error) {
     if (ForRedeclaration)
       Diag(Loc, diag::warn_implicit_decl_requires_sysheader)
-          << getHeaderName(Error) << Context.BuiltinInfo.getName(ID);
+          << getHeaderName(Context.BuiltinInfo, ID, Error)
+          << Context.BuiltinInfo.getName(ID);
     return nullptr;
   }
 
   if (!ForRedeclaration &&
       (Context.BuiltinInfo.isPredefinedLibFunction(ID) ||
        Context.BuiltinInfo.isHeaderDependentFunction(ID))) {
     Diag(Loc, diag::ext_implicit_lib_function_decl)
         << Context.BuiltinInfo.getName(ID) << R;
if (unsigned BuiltinID = FD->getBuiltinID()) {
      if (!FD->hasAttr<FormatAttr>())
        FD->addAttr(FormatAttr::CreateImplicit(Context,
                                               &Context.Idents.get("scanf"),
                                               FormatIdx+1,
                                               HasVAListArg ? 0 : FormatIdx+2,
                                               FD->getLocation()));
     }
 
+    // Automatically recognized callbacks are currently limited to a single
+    // payload argument.
+    unsigned CallbackCalleeIdx;
+    SmallVector<int, 4> CallbackPayloadIndices;
+    if (Context.BuiltinInfo.performsCallback(BuiltinID, CallbackCalleeIdx,
+                                             CallbackPayloadIndices)) {
+      if (!FD->hasAttr<CallbackAttr>())
+        FD->addAttr(CallbackAttr::CreateImplicit(
+            Context, CallbackCalleeIdx, CallbackPayloadIndices.data(),
+            CallbackPayloadIndices.size(), FD->getLocation()));
+    }
+
     // Mark const if we don't care about errno and that is the only thing
     // preventing the function from being const. This allows IRgen to use LLVM
     // intrinsics for such functions.
     if (!getLangOpts().MathErrno && !FD->hasAttr<ConstAttr>() &&
         Context.BuiltinInfo.isConstWithoutErrno(BuiltinID))
       FD->addAttr(ConstAttr::CreateImplicit(Context, FD->getLocation()));
 
     // We make "fma" on some platforms const because we know it does not set

lib/Sema/SemaDeclAttr.cpp

static void handleFormatAttr(Sema &S, Decl *D, const ParsedAttr &AL) {
 
   FormatAttr *NewAttr = S.mergeFormatAttr(D, AL.getRange(), II,
                                           Idx, FirstArg,
                                           AL.getAttributeSpellingListIndex());
   if (NewAttr)
     D->addAttr(NewAttr);
 }
 
+/// Handle __attribute__((callback(CalleeIdx, PayloadIdx0, ...))) attributes.
+static void handleCallbackAttr(Sema &S, Decl *D, const ParsedAttr &AL) {
+  // The index that identifies the callback callee is mandatory.
+  assert(AL.getNumArgs() > 0);
+
+  bool HasImplicitThisParam = isInstanceMethod(D);
+  int32_t NumArgs = getFunctionOrMethodNumParams(D);
+
+  // Helper to extract a number and validate its range.
+  auto ExtractArgIdx = [&](int32_t &Idx, unsigned Pos, int32_t Min) -> bool {
+    Expr *IdxExpr = AL.getArgAsExpr(Pos);
+    if (!checkUInt32Argument(S, AL, IdxExpr, (uint32_t &)Idx, Pos + 1, false))
+      return false;
+
+    if (Idx < Min || Idx > NumArgs) {
+      S.Diag(AL.getLoc(), diag::err_callback_attribute_argument_index_oob)
+          << (Pos + 1) << IdxExpr->getSourceRange();
+      return false;
+    }
+
+    return true;
+  };
+
+  // If the callee index is 0 it is invalid (we start counting with 1).
+  int CalleeIdx;
+  if (!ExtractArgIdx(CalleeIdx, 0, 1))
+    return;
+  assert(CalleeIdx > 0 && CalleeIdx <= NumArgs);
+
+  SmallVector<int, 8> PayloadIndices;
+  for (unsigned i = 1, e = AL.getNumArgs(); i < e; i++) {
+    // A payload index can be -1 to indicate an unknown value, 0 to indicate the
+    // implicit "this" argument in C++, or a positive value up to NumArgs.
+    int PayloadIdx;
+    if (!ExtractArgIdx(PayloadIdx, i, -1))
+      return;
+    if (PayloadIdx == 0 && !HasImplicitThisParam) {
+      S.Diag(AL.getLoc(), diag::err_callback_implicit_this_not_available)
+          << (i + 1) << AL.getArgAsExpr(i)->getSourceRange();
+      return;
+    }
+
+    // Adjust for the case we do not have an implicit "this" parameter. In this
+    // case we decrease all positive values by 1 to get LLVM argument indices.
+    PayloadIndices.push_back(std::max(-1, PayloadIdx - !HasImplicitThisParam));
+  }
+
+  const Type *CalleeType =
+      getFunctionOrMethodParamType(D, CalleeIdx - 1).getTypePtr();
+  if (!CalleeType || !CalleeType->isFunctionPointerType()) {
+    S.Diag(AL.getLoc(), diag::err_callback_callee_no_function_type)
+        << AL.getRange();
+    return;
+  }
+
+  const Type *CalleeFnType =
+      CalleeType->getPointeeType()->getUnqualifiedDesugaredType();
+
+  // TODO: Check the type of the callee arguments.
+
+  const auto *CalleeFnProtoType = dyn_cast<FunctionProtoType>(CalleeFnType);
+  if (!CalleeFnProtoType) {
+    S.Diag(AL.getLoc(), diag::err_callback_callee_no_function_type)
+        << AL.getRange();
+    return;
+  }
+
+  if (CalleeFnProtoType->getNumParams() > PayloadIndices.size()) {
+    S.Diag(AL.getLoc(), diag::err_callback_too_few_arguments) << AL.getRange();
+    return;
+  }
+
+  if (CalleeFnProtoType->getNumParams() < PayloadIndices.size()) {
+    S.Diag(AL.getLoc(), diag::err_callback_too_many_arguments) << AL.getRange();
+    return;
+  }
+
+  if (CalleeFnProtoType->isVariadic()) {
+    S.Diag(AL.getLoc(), diag::err_callback_callee_is_variadic) << AL.getRange();
+    return;
+  }
+
+  // Do not allow multiple callback attributes.
+  if (D->hasAttr<CallbackAttr>()) {
+    S.Diag(AL.getLoc(), diag::err_callback_attribute_multiple) << AL.getRange();
+    return;
+  }
+
+  // Adjust for the case we do not have an implicit "this" parameter. In this
+  // case we decrease all positive values by 1 to get LLVM argument indices.
+  CalleeIdx = CalleeIdx - !HasImplicitThisParam;
+
+  D->addAttr(::new (S.Context) CallbackAttr(
+      AL.getRange(), S.Context, CalleeIdx, PayloadIndices.data(),
+      PayloadIndices.size(), AL.getAttributeSpellingListIndex()));
+}
+
 static void handleTransparentUnionAttr(Sema &S, Decl *D, const ParsedAttr &AL) {
   // Try to find the underlying union declaration.
   RecordDecl *RD = nullptr;
   const auto *TD = dyn_cast<TypedefNameDecl>(D);
   if (TD && TD->getUnderlyingType()->isUnionType())
     RD = TD->getUnderlyingType()->getAsUnionType()->getDecl();
   else
     RD = dyn_cast<RecordDecl>(D);
case ParsedAttr::AT_Flatten:
     handleSimpleAttribute<FlattenAttr>(S, D, AL);
     break;
   case ParsedAttr::AT_Format:
     handleFormatAttr(S, D, AL);
     break;
   case ParsedAttr::AT_FormatArg:
     handleFormatArgAttr(S, D, AL);
     break;
+  case ParsedAttr::AT_Callback:
+    handleCallbackAttr(S, D, AL);
+    break;
   case ParsedAttr::AT_CUDAGlobal:
     handleGlobalAttr(S, D, AL);
     break;
   case ParsedAttr::AT_CUDADevice:
     handleSimpleAttributeWithExclusions<CUDADeviceAttr, CUDAGlobalAttr>(S, D,
                                                                         AL);
     break;
   case ParsedAttr::AT_CUDAHost:

test/CodeGen/attr-callback.c

+// RUN: %clang_cc1 -triple i386-unknown-unknown %s -emit-llvm -o - | FileCheck %s
+
+void cb0(void);
+
+// CHECK-DAG: !callback ![[cid0:[0-9]+]] void @no_args
+__attribute__((callback(1)))         void no_args(void (*callback)(void));
+
+// CHECK-DAG: @args_1({{[^#]*#[0-9]+}} !callback ![[cid1:[0-9]+]]
+__attribute__((callback(1, 2, 3)))   void args_1(void (*callback)(int, double), int a, double b) { no_args(cb0); }
+
+// CHECK-DAG: !callback ![[cid2:[0-9]+]] void @args_2
+__attribute__((callback(2, 3, 3)))   void args_2(int a, void (*callback)(double, double), double b);
+
+// CHECK-DAG: @args_3({{[^#]*#[0-9]+}} !callback ![[cid3:[0-9]+]]
+__attribute__((callback(2, -1, -1))) void args_3(int a, void (*callback)(double, double), double b) { args_2(a, callback, b); }
+
+// CHECK-DAG: ![[cid0]] = !{i1 false, i64 0}
+// CHECK-DAG: ![[cid1]] = !{i1 false, i64 0, i64 1, i64 2}
+// CHECK-DAG: ![[cid2]] = !{i1 false, i64 1, i64 2, i64 2}
+// CHECK-DAG: ![[cid3]] = !{i1 false, i64 1, i64 -1, i64 -1}

test/CodeGen/callback_annotated.c

+// RUN: %clang_cc1 -triple i386-unknown-unknown -fopenmp -O1 %s -emit-llvm -o - | FileCheck %s --check-prefix=RUN1
+// RUN: %clang_cc1 -triple i386-unknown-unknown -fopenmp -O1 %s -emit-llvm -o - | FileCheck %s --check-prefix=RUN2
+// RUN: %clang_cc1 -triple i386-unknown-unknown -fopenmp -O1 %s -emit-llvm -o - | opt -ipconstprop -S | FileCheck --check-prefix=IPCP %s
+
+// RUN1-DAG: @broker0({{[^#]*#[0-9]+}} !callback ![[cid0:[0-9]+]]
+__attribute__((callback (1, 2)))
+void* broker0(void* (*callee)(void *), void *payload) {
+  return callee(payload);
+}
+
+// RUN1-DAG: @broker1({{[^#]*#[0-9]+}} !callback ![[cid1:[0-9]+]]
+__attribute__((callback (2, 1)))
+void* broker1(void *payload, void* (*callee)(void *)) {
+  return broker0(callee, payload);
+}
+
+// RUN1-DAG: declare !callback ![[cid2:[0-9]+]] i8* @broker2
+__attribute__((callback (1)))
+void* broker2(void (*callee)(void));
+
+// RUN1-DAG: declare !callback ![[cid3:[0-9]+]] i8* @broker3
+__attribute__((callback (4, 1, 2, 3)))
+void* broker3(int, int, int, int (*callee)(int, int, int), int);
+
+// RUN1-DAG: declare !callback ![[cid4:[0-9]+]] i8* @broker4
+__attribute__((callback (4, -1, 1, -1)))
+void* broker4(int, int, int, int (*callee)(int, int, int), int);
+
+// RUN1-DAG: declare !callback ![[cid5:[0-9]+]] i8* @broker5
+__attribute__((callback (4, 5, 5, 2)))
+void* broker5(int, int, int, int (*callee)(int, int, int), int);
+
+
+static void *VoidPtr2VoidPtr(void *payload) {
+// RUN2: ret i8* %payload
+// IPCP:  ret i8* null
+  return payload;
+}
+
+static int ThreeInt2Int(int a, int b, int c) {
+// RUN2:      define internal i32 @ThreeInt2Int(i32 %a, i32 %b, i32 %c)
+// RUN2-NEXT: entry:
+// RUN2-NEXT:     %mul = mul nsw i32 %b, %a
+// RUN2-NEXT:     %add = add nsw i32 %mul, %c
+// RUN2-NEXT:     ret i32 %add
+
+// IPCP:       define internal i32 @ThreeInt2Int(i32 %a, i32 %b, i32 %c)
+// IPCP-NEXT:  entry:
+// IPCP-NEXT:      %mul = mul nsw i32 4, %a
+// IPCP-NEXT:      %add = add nsw i32 %mul, %c
+// IPCP-NEXT:      ret i32 %add
+
+  return a * b + c;
+}
+
+void foo() {
+  broker0(VoidPtr2VoidPtr, 0l);
+  broker1(0l, VoidPtr2VoidPtr);
+  broker2(foo);
+  broker3(1, 4, 5, ThreeInt2Int, 1);
+  broker4(4, 2, 7, ThreeInt2Int, 0);
+  broker5(8, 0, 3, ThreeInt2Int, 4);
+}
+
+// RUN1-DAG: ![[cid0]] = !{i1 false, i64 0, i64 1}
+// RUN1-DAG: ![[cid1]] = !{i1 false, i64 1, i64 0}
+// RUN1-DAG: ![[cid2]] = !{i1 false, i64 0}
+// RUN1-DAG: ![[cid3]] = !{i1 false, i64 3, i64 0, i64 1, i64 2}
+// RUN1-DAG: ![[cid4]] = !{i1 false, i64 3, i64 -1, i64 0, i64 -1}
+// RUN1-DAG: ![[cid5]] = !{i1 false, i64 3, i64 4, i64 4, i64 1}

test/CodeGen/callback_openmp.c

+// RUN: %clang_cc1 -triple i386-unknown-unknown -fopenmp -O1 %s -emit-llvm -o - | FileCheck %s
+// RUN: %clang_cc1 -triple i386-unknown-unknown -fopenmp -O1 %s -emit-llvm -o - | opt -ipconstprop -S | FileCheck --check-prefix=IPCP %s
+
+// CHECK: declare !callback ![[cid:[0-9]+]] void @__kmpc_fork_call
+// CHECK: declare !callback ![[cid]] void @__kmpc_fork_teams
+// CHECK: ![[cid]] = !{i1 true, i64 2, i64 -1, i64 -1}
+
+void work1(int, int);
+void work2(int, int);
+void work12(int, int);
+
+void foo(int q) {
+  int p = 2;
+
+  #pragma omp parallel firstprivate(q, p)
+  work1(p, q);
+// IPCP: call void @work1(i32 2, i32 %{{[._a-zA-Z0-9]*}})
+
+  #pragma omp parallel for firstprivate(p, q)
+  for (int i = 0; i < q; i++)
+    work2(i, p);
+// IPCP: call void @work2(i32 %{{[._a-zA-Z0-9]*}}, i32 2)
+
+  #pragma omp target teams firstprivate(p)
+  work12(p, p);
+// IPCP: call void @work12(i32 2, i32 2)
+}

test/CodeGen/callback_pthread_create.c

+// RUN: %clang -O1 %s -S -c -emit-llvm -o - | FileCheck %s
+// RUN: %clang -O1 %s -S -c -emit-llvm -o - | opt -ipconstprop -S | FileCheck --check-prefix=IPCP %s
+
+// CHECK: declare !callback ![[cid:[0-9]+]] dso_local i32 @pthread_create
+// CHECK: ![[cid]] = !{i1 false, i64 2, i64 3}
+
+#include <pthread.h>
+
+const int GlobalVar = 0;
+
+static void *callee0(void *payload) {
+// IPCP:      define internal i8* @callee0
+// IPCP-NEXT:   entry:
+// IPCP-NEXT:     ret i8* null
+  return payload;
+}
+
+static void *callee1(void *payload) {
+// IPCP:      define internal i8* @callee1
+// IPCP-NEXT:   entry:
+// IPCP-NEXT:     ret i8* bitcast (i32* @GlobalVar to i8*)
+  return payload;
+}
+
+void foo() {
+  pthread_t MyFirstThread;
+  pthread_create(&MyFirstThread, NULL, callee0, NULL);
+
+  pthread_t MySecondThread;
+  pthread_create(&MySecondThread, NULL, callee1, (void *)&GlobalVar);
+}

test/CodeGen/callback_qsort_r.c

+// RUN: %clang %s -fsyntax-only 2>&1 | FileCheck %s
+// RUN: %clang -D_GNU_SOURCE %s -S -c -emit-llvm -o - -O1 | FileCheck %s --check-prefix=IR
+// RUN: %clang -D_GNU_SOURCE %s -S -c -emit-llvm -o - -O1 | opt -ipconstprop -instcombine -S | FileCheck --check-prefix=IPCP %s
+
+// CHECK: declaration of built-in function 'qsort_r' requires inclusion of the header <stdlib.h>
+
+#include <stdlib.h>
+
+static int callee(const void *v0, const void *v1, void *payload);
+
+void foo(char *A, int N) {
+// IR: declare !callback ![[cid:[0-9]+]] dso_local void @qsort_r
+  qsort_r(A, N, 1, callee, NULL);
+}
+
+static int callee(const void *v0, const void *v1, void *payload) {
+// IR:      define internal i32 @callee
+// IR-NEXT: entry:
+// IR-NEXT:   %cmp = icmp eq i8* %payload, null
+// IR-NEXT:   %cmp1 = icmp ult i8* %v0, %v1
+// IR-NEXT:   %cmp2 = icmp ult i8* %v1, %v0
+// IR-NEXT:   %cond.in = select i1 %cmp, i1 %cmp1, i1 %cmp2
+// IR-NEXT:   %cond = zext i1 %cond.in to i32
+// IR-NEXT:   ret i32 %cond
+
+// IPCP:      define internal i32 @callee
+// IPCP-NEXT: entry:
+// IPCP-NEXT:   %cmp1 = icmp ult i8* %v0, %v1
+// IPCP-NEXT:   %cond = zext i1 %cmp1 to i32
+// IPCP-NEXT:   ret i32 %cond
+  return payload == 0 ? v0 < v1 : v1 < v0;
+}
+
+// IR: ![[cid]] = !{i1 false, i64 3, i64 -1, i64 -1, i64 4}

test/CodeGenCXX/attr-callback.cpp

+// RUN: %clang_cc1 -triple i386-unknown-unknown %s -emit-llvm -o - | FileCheck %s
+
+struct Base {
+
+  void no_args_1(void (*callback)(void));
+  __attribute__((callback(1))) void no_args_2(void (*callback1)(void), void (*callback2)(void));
+
+  // TODO: There should probably be a warning or even an error for different
+  //       callbacks on the same method.
+  __attribute__((callback(1))) virtual void
+  virtual_1(void (*callback)(void));
+
+  __attribute__((callback(1, 0, -1, 0))) virtual void
+  this_unknown_this(void (*callback)(Base *, Base *, Base *));
+};
+
+// CHECK-DAG:      define void @_ZN4Base9no_args_1EPFvvE({{[^!]*!callback}} ![[cid0:[0-9]+]]
+__attribute__((callback(1))) void
+Base::no_args_1(void (*callback)(void)) {
+}
+
+// CHECK-DAG:      define void @_ZN4Base9no_args_2EPFvvES1_({{[^!]*!callback}} ![[cid1:[0-9]+]]
+__attribute__((callback(2))) void Base::no_args_2(void (*callback1)(void), void (*callback2)(void)) {
+}
+
+// CHECK-DAG:      define void @_ZN4Base17this_unknown_thisEPFvPS_S0_S0_E({{[^!]*!callback}} ![[cid2:[0-9]+]]
+void Base::this_unknown_this(void (*callback)(Base *, Base *, Base *)) {
+}
+
+struct Derived_1 : public Base {
+  __attribute__((callback(1))) virtual void
+  virtual_1(void (*callback)(void)) override;
+};
+
+// CHECK-DAG:      define void @_ZN9Derived_19virtual_1EPFvvE({{[^!]*!callback}} ![[cid0]]
+void Derived_1::virtual_1(void (*callback)(void)) {}
+
+struct Derived_2 : public Base {
+  void virtual_1(void (*callback)(void)) override;
+};
+
+// CHECK-DAG: define void @_ZN9Derived_29virtual_1EPFvvE
+// CHECK-NOT: !callback
+void Derived_2::virtual_1(void (*callback)(void)) {}
+
+// CHECK-DAG: ![[cid0]] = !{i1 false, i64 1}
+// CHECK-DAG: ![[cid1]] = !{i1 false, i64 2}
+// CHECK-DAG: ![[cid2]] = !{i1 false, i64 1, i64 0, i64 -1, i64 0}

test/Misc/pragma-attribute-supported-attributes-list.test

 // CHECK-NEXT: CUDAConstant (SubjectMatchRule_variable)
 // CHECK-NEXT: CUDADevice (SubjectMatchRule_function, SubjectMatchRule_variable)
 // CHECK-NEXT: CUDAGlobal (SubjectMatchRule_function)
 // CHECK-NEXT: CUDAHost (SubjectMatchRule_function)
 // CHECK-NEXT: CUDALaunchBounds (SubjectMatchRule_objc_method, SubjectMatchRule_hasType_functionType)
 // CHECK-NEXT: CUDAShared (SubjectMatchRule_variable)
 // CHECK-NEXT: CXX11NoReturn (SubjectMatchRule_function)
 // CHECK-NEXT: CallableWhen (SubjectMatchRule_function_is_member)
+// CHECK-NEXT: Callback (SubjectMatchRule_function)
 // CHECK-NEXT: Capability (SubjectMatchRule_record, SubjectMatchRule_type_alias)
 // CHECK-NEXT: CarriesDependency (SubjectMatchRule_variable_is_parameter, SubjectMatchRule_objc_method, SubjectMatchRule_function)
 // CHECK-NEXT: Cold (SubjectMatchRule_function)
 // CHECK-NEXT: Common (SubjectMatchRule_variable)
 // CHECK-NEXT: Constructor (SubjectMatchRule_function)
 // CHECK-NEXT: Consumable (SubjectMatchRule_record)
 // CHECK-NEXT: ConsumableAutoCast (SubjectMatchRule_record)
 // CHECK-NEXT: ConsumableSetOnRead (SubjectMatchRule_record)

test/OpenMP/parallel_codegen.cpp

 // CHECK-DEBUG-NEXT:  [[VLA_ELEM:%.+]] = load i32, i32* [[VLA_ELEM_REF]]
 // CHECK-DEBUG-NEXT:  invoke void [[FOO:@.+foo.+]](i32 [[VLA_ELEM]])
 // CHECK-DEBUG:       ret void
 // CHECK-DEBUG:       call void @{{.+terminate.*|abort}}(
 // CHECK-DEBUG-NEXT:  unreachable
 // CHECK-DEBUG-NEXT:  }
 
 // CHECK-DAG: define linkonce_odr {{.*}}void [[FOO]]({{i32[ ]?[a-z]*}} %argc)
-// CHECK-DAG: declare {{.*}}void @__kmpc_fork_call(%struct.ident_t*, i32, void (i32*, i32*, ...)*, ...)
+// CHECK-DAG: declare !callback ![[cbid:[0-9]+]] {{.*}}void @__kmpc_fork_call(%struct.ident_t*, i32, void (i32*, i32*, ...)*, ...)
 // CHECK-DEBUG-DAG: define linkonce_odr void [[FOO]](i32 %argc)
-// CHECK-DEBUG-DAG: declare void @__kmpc_fork_call(%struct.ident_t*, i32, void (i32*, i32*, ...)*, ...)
+// CHECK-DEBUG-DAG: declare !callback ![[cbid:[0-9]+]] void @__kmpc_fork_call(%struct.ident_t*, i32, void (i32*, i32*, ...)*, ...)
 // CHECK-DEBUG-DAG:       define internal void [[OMP_OUTLINED]](i32* noalias %.global_tid., i32* noalias %.bound_tid., i64 [[VLA_SIZE:%.+]], i32* {{.+}} [[VLA_ADDR:%[^)]+]])
 // CHECK-DEBUG-DAG:       call void [[OMP_OUTLINED_DEBUG]]
 
 // CHECK:       define linkonce_odr {{[a-z\_\b]*[ ]?i32}} [[TMAIN]](i8** %argc)
 // CHECK:       store i8** %argc, i8*** [[ARGC_ADDR:%.+]],
 // CHECK-NEXT:  call {{.*}}void (%struct.ident_t*, i32, void (i32*, i32*, ...)*, ...) @__kmpc_fork_call(%struct.ident_t* [[DEF_LOC_2]], i32 1, void (i32*, i32*, ...)* bitcast (void (i32*, i32*, i8***)* [[OMP_OUTLINED:@.+]] to void (i32*, i32*, ...)*), i8*** [[ARGC_ADDR]])
 // CHECK-NEXT:  ret i32 0
 // CHECK-NEXT:  }

 
 // CHECK: define linkonce_odr {{.*}}void [[FOO1]](i8** %argc)
 // CHECK-DEBUG-DAG: define linkonce_odr void [[FOO1]](i8** %argc)
 // CHECK-DEBUG-DAG: define internal void [[OMP_OUTLINED]](i32* noalias %.global_tid., i32* noalias %.bound_tid., i8*** dereferenceable({{4|8}}) %argc)
 // CHECK-DEBUG-DAG: call void [[OMP_OUTLINED_DEBUG]]({{[^)]+}}){{[^,]*}}, !dbg
 
 // CHECK: attributes #[[FN_ATTRS]] = {{.+}} nounwind
 // CHECK-DEBUG: attributes #[[FN_ATTRS]] = {{.+}} nounwind
-
+// CHECK: ![[cbid]] = !{i1 true, i64 2, i64 -1, i64 -1}
 #endif

test/Sema/attr-callback-broken.c

+// RUN: %clang_cc1 %s -verify -fsyntax-only
+
+__attribute__((callback())) void no_callee(void (*callback)(void)); // expected-error {{'callback' attribute takes at least 1 argument}}
+
+__attribute__((callback(1, 1)))    void too_many_args_1(void   (*callback)(void)) {}   // expected-error {{'callback' attribute specifies too many arguments}}
+__attribute__((callback(1, -1)))    void too_many_args_2(double (*callback)(void));     // expected-error {{'callback' attribute specifies too many arguments}}
+__attribute__((callback(1, 2, 2))) void too_many_args_3(void   (*callback)(int), int); // expected-error {{'callback' attribute specifies too many arguments}}
+
+__attribute__((callback(1, 2)))  void too_few_args_1(void (*callback)(int, int), int); // expected-error {{'callback' attribute specifies too few arguments}}
+__attribute__((callback(1)))     void too_few_args_2(int  (*callback)(int));           // expected-error {{'callback' attribute specifies too few arguments}}
+__attribute__((callback(1, -1))) void too_few_args_3(void (*callback)(int, int)) {}    // expected-error {{'callback' attribute specifies too few arguments}}
+
+__attribute__((callback(0)))     void oob_args_0(void  (*callback)(void));     // expected-error {{'callback' argument at position 1 is out-of-bounds}}
+__attribute__((callback(-1)))    void oob_args_1(void  (*callback)(void));     // expected-error {{'callback' argument at position 1 is out-of-bounds}}
+__attribute__((callback(2)))     void oob_args_2(int*  (*callback)(void)) {}   // expected-error {{'callback' argument at position 1 is out-of-bounds}}
+__attribute__((callback(1, 3)))  void oob_args_3(short (*callback)(int), int); // expected-error {{'callback' argument at position 2 is out-of-bounds}}
+__attribute__((callback(-2, 2))) void oob_args_4(void* (*callback)(int), int); // expected-error {{'callback' argument at position 1 is out-of-bounds}}
+__attribute__((callback(1, -2))) void oob_args_5(void* (*callback)(int), int); // expected-error {{'callback' argument at position 2 is out-of-bounds}}
+__attribute__((callback(1,  2))) void oob_args_6(void* (*callback)(int), ...); // expected-error {{'callback' argument at position 2 is out-of-bounds}}
+
+__attribute__((callback(1))) __attribute__((callback(1))) void multiple_cb_1(void (*callback)(void));                           // expected-error {{multiple 'callback' attributes specified}}
+__attribute__((callback(1))) __attribute__((callback(2))) void multiple_cb_2(void (*callback1)(void), void (*callback2)(void)); // expected-error {{multiple 'callback' attributes specified}}
+
+#ifndef HAS_THIS
+__attribute__((callback(1, 0))) void no_this_1(void* (*callback)(void)); // expected-error {{'callback' argument at position 2 specifies unawailable implicit 'this'}}
+__attribute__((callback(1, 0))) void no_this_2(void* (*callback)(int));  // expected-error {{'callback' argument at position 2 specifies unawailable implicit 'this'}}
+#endif
+
+// We could allow the following declarations if we at some point need to:
+
+__attribute__((callback(1, -1))) void vararg_cb_1(void (*callback)(int, ...)) {}      // expected-error {{'callback' callee shall not be variadic}}
+__attribute__((callback(1,  1))) void vararg_cb_2(void (*callback)(int, ...), int a); // expected-error {{'callback' callee shall not be variadic}}
+
+__attribute__((callback(1, -1, 1, 2, 3, 4, -1)))   void varargs_1(void (*callback)(int, ...), int a, float b, double c) {}                // expected-error {{'callback' attribute specifies too many arguments}}
+__attribute__((callback(1, -1, 4, 2, 3, 4, -1)))   void varargs_2(void (*callback)(void *, double, int, ...), int a, float b , double c); // expected-error {{'callback' attribute specifies too many arguments}}
+
+__attribute__((callback(1, -1, 1)))          void self_arg_1(void (*callback)(int, ...)) {} // expected-error {{'callback' attribute specifies too many arguments}}
+__attribute__((callback(1, -1, 1, -1, -1, 1))) void self_arg_2(void (*callback)(int, ...));   // expected-error {{'callback' attribute specifies too many arguments}}

test/Sema/attr-callback.c

+// RUN: %clang_cc1 %s -verify -fsyntax-only
+
+// expected-no-diagnostics
+
+__attribute__((callback(1)))         void no_args(void (*callback)(void));
+__attribute__((callback(1, 2, 3)))   void args_1(void (*callback)(int, double), int a, double b);
+__attribute__((callback(2, 3, 3)))   void args_2(int a, void (*callback)(double, double), double b);
+__attribute__((callback(2, -1, -1))) void args_3(int a, void (*callback)(double, double), double b);

test/SemaCXX/attr-callback-broken.cpp

+// RUN: %clang_cc1 %s -verify -fsyntax-only
+
+class C_in_class {
+#define HAS_THIS
+#include "../Sema/attr-callback-broken.c"
+#undef HAS_THIS
+};

test/SemaCXX/attr-callback.cpp

+// RUN: %clang_cc1 %s -verify -fsyntax-only
+
+// expected-no-diagnostics
+
+class C_in_class {
+#include "../Sema/attr-callback.c"
+};
+
+struct Base {
+
+  void no_args_1(void (*callback)(void));
+  __attribute__((callback(1))) void no_args_2(void (*callback)(void));
+  __attribute__((callback(1))) void no_args_3(void (*callback)(void)) {}
+
+  __attribute__((callback(1, 0))) virtual void
+  this_tr(void (*callback)(Base *));
+
+  __attribute__((callback(1, 0, -1, 0))) virtual void
+  this_unknown_this(void (*callback)(Base *, Base *, Base *));
+
+  __attribute__((callback(1))) virtual void
+  virtual_1(void (*callback)(void));
+
+  __attribute__((callback(1))) virtual void
+  virtual_2(void (*callback)(void));
+
+  __attribute__((callback(1))) virtual void
+  virtual_3(void (*callback)(void));
+};
+
+__attribute__((callback(1))) void
+Base::no_args_1(void (*callback)(void)) {
+}
+
+void Base::no_args_2(void (*callback)(void)) {
+}
+
+struct Derived_1 : public Base {
+
+  __attribute__((callback(1, 0))) virtual void
+  this_tr(void (*callback)(Base *)) override;
+
+  __attribute__((callback(1))) virtual void
+  virtual_1(void (*callback)(void)) override {}
+
+  virtual void
+  virtual_3(void (*callback)(void)) override {}
+};
+
+struct Derived_2 : public Base {
+
+  __attribute__((callback(1))) virtual void
+  virtual_1(void (*callback)(void)) override;
+
+  virtual void
+  virtual_2(void (*callback)(void)) override;
+
+  virtual void
+  virtual_3(void (*callback)(void)) override;
+};
+
+void Derived_2::virtual_1(void (*callback)(void)) {}
+
+__attribute__((callback(1))) void
+Derived_2::virtual_2(void (*callback)(void)) {}
+
+void Derived_2::virtual_3(void (*callback)(void)) {}

utils/TableGen/ClangAttrEmitter.cpp

createArgument(const Record &Arg, StringRef Attr,
   else if (ArgName == "StringArgument")
     Ptr = llvm::make_unique<StringArgument>(Arg, Attr);
   else if (ArgName == "TypeArgument")
     Ptr = llvm::make_unique<TypeArgument>(Arg, Attr);
   else if (ArgName == "UnsignedArgument")
     Ptr = llvm::make_unique<SimpleArgument>(Arg, Attr, "unsigned");
   else if (ArgName == "VariadicUnsignedArgument")
     Ptr = llvm::make_unique<VariadicArgument>(Arg, Attr, "unsigned");
+  else if (ArgName == "VariadicSignedArgument")
+    Ptr = llvm::make_unique<VariadicArgument>(Arg, Attr, "int");
   else if (ArgName == "VariadicStringArgument")
     Ptr = llvm::make_unique<VariadicStringArgument>(Arg, Attr);
   else if (ArgName == "VariadicEnumArgument")
     Ptr = llvm::make_unique<VariadicEnumArgument>(Arg, Attr);
   else if (ArgName == "VariadicExprArgument")
     Ptr = llvm::make_unique<VariadicExprArgument>(Arg, Attr);
   else if (ArgName == "VariadicParamIdxArgument")
     Ptr = llvm::make_unique<VariadicParamIdxArgument>(Arg, Attr);
for (const auto *Attr : Attrs) {
     // All these spellings take an identifier argument.
     forEachUniqueSpelling(*Attr, [&](const FlattenedSpelling &S) {
       OS << ".Case(\"" << S.name() << "\", " << "true" << ")\n";
     });
   }
   OS << "#endif // CLANG_ATTR_IDENTIFIER_ARG_LIST\n\n";
 }
 
 namespace clang {
 
 // Emits the class definitions for attributes.
 void EmitClangAttrClass(RecordKeeper &Records, raw_ostream &OS) {
   emitSourceFileHeader("Attribute classes' definitions", OS);
 
   OS << "#ifndef LLVM_CLANG_ATTR_CLASSES_INC\n";
   OS << "#define LLVM_CLANG_ATTR_CLASSES_INC\n\n";
 
   std::vector<Record*> Attrs = Records.getAllDerivedDefinitions("Attr");
 
   for (const auto *Attr : Attrs) {
     const Record &R = *Attr;
 
     // FIXME: Currently, documentation is generated as-needed due to the fact
     // that there is no way to allow a generated project "reach into" the docs
     // directory (for instance, it may be an out-of-tree build). However, we want
     // to ensure that every attribute has a Documentation field, and produce an