Add a version of the pass_object_size attribute that works with builtin_dynamic_object_size

[erik.pilkington]

Summary

This attribute, named pass_dynamic_object_size has the same semantics as pass_object_size, except that it calls __builtin_dynamic_object_size at the caller instead of __builtin_object_size. You can read more about __builtin_dynamic_object_size here: https://clang.llvm.org/docs/LanguageExtensions.html#evaluating-object-size-dynamically, it was introduced in D56760.

rdar://48208787

Thanks for taking a look!
Erik

[aaron.ballman]

clang/include/clang/Basic/Attr.td

1570

Why use a separate attribute as opposed to a separate spelling and an accessor on PassObjectSizeAttr to ask whether it's dynamic or not? The two attributes seem to have identical semantics aside from which builtin is called, so I think it makes sense to use the same semantic attribute type.

clang/lib/Sema/SemaDeclAttr.cpp

1108

Please do not add a parameter here -- we keep all of the handleFooAttr() function signatures the same because some day we'd like to refactor the switch to be more tablegenerated as well.

1140

Elide braces here and below.

[erik.pilkington]

Address review comments.

clang/include/clang/Basic/Attr.td

1570

Oh, I didn't even know that was possible. I guess thats why Spellings is an array :). That simplifies the implementation too, now we can ditch getPassObjectSizeInfo.

[aaron.ballman]

LGTM!

clang/include/clang/AST/Attr.h

 }
 
 inline const PartialDiagnostic &operator<<(const PartialDiagnostic &PD,
                                            const Attr *At) {
   PD.AddTaggedVal(reinterpret_cast<intptr_t>(At),
                   DiagnosticsEngine::ak_attr);
   return PD;
 }
+
+/// Quick wrapper around either a pass_object_size or pass_dynamic_object_size
+/// attribute. These have a very similar interface, but are still distinct
+/// attributes.
+struct PassObjectSizeInfo {
+  Attr *TheAttr;
+  int Type;
+  bool IsDynamic;
+};
+
+inline Optional<PassObjectSizeInfo>
+getPassObjectSizeInfo(const ParmVarDecl *PVD) {
+  if (auto *POS = PVD->getAttr<PassObjectSizeAttr>())
+    return PassObjectSizeInfo{POS, POS->getType(), false};
+  else if (auto *PDOS = PVD->getAttr<PassDynamicObjectSizeAttr>())
+    return PassObjectSizeInfo{PDOS, PDOS->getType(), true};
+  return None;
+}
 }  // end namespace clang
 
 #endif

clang/include/clang/Basic/Attr.td

 // __builtin_object_size with Type=N evaluated on the parameter at the callsite.
 def PassObjectSize : InheritableParamAttr {
   let Spellings = [Clang<"pass_object_size">];
   let Args = [IntArgument<"Type">];
   let Subjects = SubjectList<[ParmVar]>;
   let Documentation = [PassObjectSizeDocs];
 }
 
+def PassDynamicObjectSize : InheritableParamAttr {
+  let Spellings = [Clang<"pass_dynamic_object_size">];
+  let Args = [IntArgument<"Type">];
+  let Subjects = SubjectList<[ParmVar]>;
+  let Documentation = [PassObjectSizeDocs];
+}
+
 def FortifyStdLib : InheritableAttr {
   let Spellings = [Clang<"fortify_stdlib">];
   let Args = [IntArgument<"Type">, IntArgument<"Flag">];
   let Subjects = SubjectList<[Function]>;
   let Documentation = [FortifyStdLibDocs];
 }
 
 // Nullability type attributes.

clang/include/clang/Basic/AttrDocs.td

 
 * It is an error to take the address of a function with ``pass_object_size`` on
   any of its parameters. If you wish to do this, you can create an overload
   without ``pass_object_size`` on any parameters.
 
 * It is an error to apply the ``pass_object_size`` attribute to parameters that
   are not pointers. Additionally, any parameter that ``pass_object_size`` is
   applied to must be marked ``const`` at its function's definition.
+
+Clang also supports the ``pass_dynamic_object_size`` attribute, which behaves
+identically to ``pass_object_size``, but evaluates a call to
+``__builtin_dynamic_object_size`` at the callee instead of
+``__builtin_object_size``. ``__builtin_dynamic_object_size`` provides some extra
+runtime checks when the object size can't be determined at compile-time. You can
+read more about ``__builtin_dynamic_object_size`` `here
+<https://clang.llvm.org/docs/LanguageExtensions.html#evaluating-object-size-dynamically>`_.
+
   }];
 }
 
 def OverloadableDocs : Documentation {
   let Category = DocCatFunction;
   let Content = [{
 Clang provides support for C++ function overloading in C.  Function overloading
 in C is introduced using the ``overloadable`` attribute.  For example, one

clang/lib/AST/ItaniumMangle.cpp

       mangleExtParameterInfo(Proto->getExtParameterInfo(I));
     }
 
     // Mangle the type.
     QualType ParamTy = Proto->getParamType(I);
     mangleType(Context.getASTContext().getSignatureParameterType(ParamTy));
 
     if (FD) {
-      if (auto *Attr = FD->getParamDecl(I)->getAttr<PassObjectSizeAttr>()) {
-        // Attr can only take 1 character, so we can hardcode the length below.
-        assert(Attr->getType() <= 9 && Attr->getType() >= 0);
-        Out << "U17pass_object_size" << Attr->getType();
+      // FIXME: It would be nice to move this before the type, so it conforms to
+      // the production:
+      //   <type> ::= U <source-name> <type>  # vendor extended type qualifier
+      const ParmVarDecl *PVD = FD->getParamDecl(I);
+      if (auto *POS = PVD->getAttr<PassObjectSizeAttr>()) {
+        assert(POS->getType() <= 9 && POS->getType() >= 0);
+        Out << "U17pass_object_size" << POS->getType();
+      } else if (auto *PDOS = PVD->getAttr<PassDynamicObjectSizeAttr>()) {
+        assert(PDOS->getType() <= 9 && PDOS->getType() >= 0);
+        Out << "U25pass_dynamic_object_size" << PDOS->getType();
       }
     }
   }
 
   FunctionTypeDepth.pop(saved);
 
   // <builtin-type>      ::= z  # ellipsis
   if (Proto->isVariadic())

clang/lib/AST/MicrosoftMangle.cpp

   unsigned StructorType;
 
   typedef llvm::SmallVector<std::string, 10> BackRefVec;
   BackRefVec NameBackReferences;
 
   typedef llvm::DenseMap<const void *, unsigned> ArgBackRefMap;
   ArgBackRefMap TypeBackReferences;
 
-  typedef std::set<int> PassObjectSizeArgsSet;
+  typedef std::set<std::pair<int, bool>> PassObjectSizeArgsSet;
   PassObjectSizeArgsSet PassObjectSizeArgs;
 
   ASTContext &getASTContext() const { return Context.getASTContext(); }
 
   // FIXME: If we add support for __ptr32/64 qualifiers, then we should push
   // this check into mangleQualifiers().
   const bool PointersAre64Bit;
 

 
   void mangleUnscopedTemplateName(const TemplateDecl *ND);
   void
   mangleTemplateInstantiationName(const TemplateDecl *TD,
                                   const TemplateArgumentList &TemplateArgs);
   void mangleObjCMethodName(const ObjCMethodDecl *MD);
 
   void mangleArgumentType(QualType T, SourceRange Range);
-  void manglePassObjectSizeArg(const PassObjectSizeAttr *POSA);
+  void manglePassObjectSizeArg(PassObjectSizeInfo Info);
 
   bool isArtificialTagType(QualType T) const;
 
   // Declare manglers for every type class.
 #define ABSTRACT_TYPE(CLASS, PARENT)
 #define NON_CANONICAL_TYPE(CLASS, PARENT)
 #define TYPE(CLASS, PARENT) void mangleType(const CLASS##Type *T, \
                                             Qualifiers Quals, \

       size_t Size = TypeBackReferences.size();
       TypeBackReferences[TypePtr] = Size;
     }
   } else {
     Out << Found->second;
   }
 }
 
-void MicrosoftCXXNameMangler::manglePassObjectSizeArg(
-    const PassObjectSizeAttr *POSA) {
-  int Type = POSA->getType();
-
-  auto Iter = PassObjectSizeArgs.insert(Type).first;
+void MicrosoftCXXNameMangler::manglePassObjectSizeArg(PassObjectSizeInfo Info) {
+  auto Iter = PassObjectSizeArgs.insert({Info.Type, Info.IsDynamic}).first;
   auto *TypePtr = (const void *)&*Iter;
   ArgBackRefMap::iterator Found = TypeBackReferences.find(TypePtr);
 
   if (Found == TypeBackReferences.end()) {
-    mangleArtificialTagType(TTK_Enum, "__pass_object_size" + llvm::utostr(Type),
-                           {"__clang"});
+    std::string Name =
+        Info.IsDynamic ? "__pass_dynamic_object_size" : "__pass_object_size";
+    mangleArtificialTagType(TTK_Enum, Name + llvm::utostr(Info.Type),
+                            {"__clang"});
 
     if (TypeBackReferences.size() < 10) {
       size_t Size = TypeBackReferences.size();
       TypeBackReferences[TypePtr] = Size;
     }
   } else {
     Out << Found->second;
   }

       // Mangle each pass_object_size parameter as if it's a parameter of enum
       // type passed directly after the parameter with the pass_object_size
       // attribute. The aforementioned enum's name is __pass_object_size, and we
       // pretend it resides in a top-level namespace called __clang.
       //
       // FIXME: Is there a defined extension notation for the MS ABI, or is it
       // necessary to just cross our fingers and hope this type+namespace
       // combination doesn't conflict with anything?
-      if (D)
-        if (const auto *P = D->getParamDecl(I)->getAttr<PassObjectSizeAttr>())
-          manglePassObjectSizeArg(P);
+      if (D) {
+        const ParmVarDecl *PVD = D->getParamDecl(I);
+        if (Optional<PassObjectSizeInfo> Info = getPassObjectSizeInfo(PVD))
+          manglePassObjectSizeArg(*Info);
+      }
     }
     // <builtin-type>      ::= Z  # ellipsis
     if (Proto->isVariadic())
       Out << 'Z';
     else
       Out << '@';
   }
 

clang/lib/CodeGen/CGBuiltin.cpp

 /// we'll call @llvm.objectsize on EmittedE, rather than emitting E.
 llvm::Value *
 CodeGenFunction::emitBuiltinObjectSize(const Expr *E, unsigned Type,
                                        llvm::IntegerType *ResType,
                                        llvm::Value *EmittedE, bool IsDynamic) {
   // We need to reference an argument if the pointer is a parameter with the
   // pass_object_size attribute.
   if (auto *D = dyn_cast<DeclRefExpr>(E->IgnoreParenImpCasts())) {
-    auto *Param = dyn_cast<ParmVarDecl>(D->getDecl());
-    auto *PS = D->getDecl()->getAttr<PassObjectSizeAttr>();
-    if (Param != nullptr && PS != nullptr &&
-        areBOSTypesCompatible(PS->getType(), Type)) {
-      auto Iter = SizeArguments.find(Param);
-      assert(Iter != SizeArguments.end());
-
-      const ImplicitParamDecl *D = Iter->second;
-      auto DIter = LocalDeclMap.find(D);
-      assert(DIter != LocalDeclMap.end());
-
-      return EmitLoadOfScalar(DIter->second, /*volatile=*/false,
-                              getContext().getSizeType(), E->getBeginLoc());
+    if (auto *Param = dyn_cast<ParmVarDecl>(D->getDecl())) {
+      Optional<PassObjectSizeInfo> Info = getPassObjectSizeInfo(Param);
+      if (Info && areBOSTypesCompatible(Info->Type, Type)) {
+        auto Iter = SizeArguments.find(Param);
+        assert(Iter != SizeArguments.end());
+
+        const ImplicitParamDecl *D = Iter->second;
+        auto DIter = LocalDeclMap.find(D);
+        assert(DIter != LocalDeclMap.end());
+
+        return EmitLoadOfScalar(DIter->second, /*volatile=*/false,
+                                getContext().getSizeType(), E->getBeginLoc());
+      }
     }
   }
 
   // LLVM can't handle Type=3 appropriately, and __builtin_object_size shouldn't
   // evaluate E for side-effects. In either case, we shouldn't lower to
   // @llvm.objectsize.
   if (Type == 3 || (!EmittedE && E->HasSideEffects(getContext())))
     return getDefaultBuiltinObjectSizeResult(Type, ResType);

clang/lib/CodeGen/CGCall.cpp

       CGM.getTarget().getCXXABI().areArgsDestroyedLeftToRightInCallee()
           ? Order == EvaluationOrder::ForceLeftToRight
           : Order != EvaluationOrder::ForceRightToLeft;
 
   auto MaybeEmitImplicitObjectSize = [&](unsigned I, const Expr *Arg,
                                          RValue EmittedArg) {
     if (!AC.hasFunctionDecl() || I >= AC.getNumParams())
       return;
-    auto *PS = AC.getParamDecl(I)->getAttr<PassObjectSizeAttr>();
-    if (PS == nullptr)
+
+    Optional<PassObjectSizeInfo> Info =
+        getPassObjectSizeInfo(AC.getParamDecl(I));
+    if (!Info)
       return;
 
     const auto &Context = getContext();
     auto SizeTy = Context.getSizeType();
     auto T = Builder.getIntNTy(Context.getTypeSize(SizeTy));
     assert(EmittedArg.getScalarVal() && "We emitted nothing for the arg?");
-    llvm::Value *V = evaluateOrEmitBuiltinObjectSize(Arg, PS->getType(), T,
+    llvm::Value *V = evaluateOrEmitBuiltinObjectSize(Arg, Info->Type, T,
                                                      EmittedArg.getScalarVal(),
-                                                     /*IsDynamic=*/false);
+                                                     Info->IsDynamic);
     Args.add(RValue::get(V), SizeTy);
     // If we're emitting args in reverse, be sure to do so with
     // pass_object_size, as well.
     if (!LeftToRight)
       std::swap(Args.back(), *(&Args.back() - 1));
   };
 
   // Insert a stack save if we're going to need any inalloca args.

clang/lib/CodeGen/CGClass.cpp

 
     for (const auto *Param : OuterCtor->parameters()) {
       assert(getContext().hasSameUnqualifiedType(
           OuterCtor->getParamDecl(Param->getFunctionScopeIndex())->getType(),
           Param->getType()));
       EmitDelegateCallArg(Args, Param, E->getLocation());
 
       // Forward __attribute__(pass_object_size).
-      if (Param->hasAttr<PassObjectSizeAttr>()) {
+      if (getPassObjectSizeInfo(Param) != None) {
         auto *POSParam = SizeArguments[Param];
         assert(POSParam && "missing pass_object_size value for forwarding");
         EmitDelegateCallArg(Args, POSParam, E->getLocation());
       }
     }
   }
 
   EmitCXXConstructorCall(D, Ctor_Base, ForVirtualBase, /*Delegating*/false,

clang/lib/CodeGen/CGExpr.cpp

   auto *ArrayDeclRef = dyn_cast<DeclRefExpr>(E->IgnoreParenImpCasts());
   if (!ArrayDeclRef)
     return nullptr;
 
   auto *ParamDecl = dyn_cast<ParmVarDecl>(ArrayDeclRef->getDecl());
   if (!ParamDecl)
     return nullptr;
 
-  auto *POSAttr = ParamDecl->getAttr<PassObjectSizeAttr>();
-  if (!POSAttr)
+  Optional<PassObjectSizeInfo> Info = getPassObjectSizeInfo(ParamDecl);
+  if (!Info)
     return nullptr;
 
   // Don't load the size if it's a lower bound.
-  int POSType = POSAttr->getType();
-  if (POSType != 0 && POSType != 1)
+  if (Info->Type != 0 && Info->Type != 1)
     return nullptr;
 
   // Find the implicit size parameter.
   auto PassedSizeIt = SizeArguments.find(ParamDecl);
   if (PassedSizeIt == SizeArguments.end())
     return nullptr;
 
   const ImplicitParamDecl *PassedSizeDecl = PassedSizeIt->second;

clang/lib/CodeGen/CodeGenFunction.cpp

   if (const CXXConstructorDecl *CD = dyn_cast<CXXConstructorDecl>(FD))
     if (auto Inherited = CD->getInheritedConstructor())
       PassedParams =
           getTypes().inheritingCtorHasParams(Inherited, GD.getCtorType());
 
   if (PassedParams) {
     for (auto *Param : FD->parameters()) {
       Args.push_back(Param);
-      if (!Param->hasAttr<PassObjectSizeAttr>())
+      if (getPassObjectSizeInfo(Param) == None)
         continue;
 
       auto *Implicit = ImplicitParamDecl::Create(
           getContext(), Param->getDeclContext(), Param->getLocation(),
           /*Id=*/nullptr, getContext().getSizeType(), ImplicitParamDecl::Other);
       SizeArguments[Param] = Implicit;
       Args.push_back(Implicit);
     }

clang/lib/Sema/SemaChecking.cpp

         }
       }
     }
 
     // Parameters with the pass_object_size attribute only need to be marked
     // constant at function definitions. Because we lack information about
     // whether we're on a declaration or definition when we're instantiating the
     // attribute, we need to check for constness here.
-    if (const auto *Attr = Param->getAttr<PassObjectSizeAttr>())
+    if (Optional<PassObjectSizeInfo> Info = getPassObjectSizeInfo(Param))
       if (!Param->getType().isConstQualified())
         Diag(Param->getLocation(), diag::err_attribute_pointers_only)
-            << Attr->getSpelling() << 1;
+            << Info->TheAttr->getSpelling() << 1;
 
     // Check for parameter names shadowing fields from the class.
     if (LangOpts.CPlusPlus && !Param->isInvalidDecl()) {
       // The owning context for the parameter should be the function, but we
       // want to see if this function's declaration context is a record.
       DeclContext *DC = Param->getDeclContext();
       if (DC && DC->isFunctionOrMethod()) {
         if (auto *RD = dyn_cast<CXXRecordDecl>(DC->getParent()))

clang/lib/Sema/SemaDecl.cpp

   return false;
 }
 
 static bool hasIdenticalPassObjectSizeAttrs(const FunctionDecl *A,
                                             const FunctionDecl *B) {
   assert(A->getNumParams() == B->getNumParams());
 
   auto AttrEq = [](const ParmVarDecl *A, const ParmVarDecl *B) {
-    const auto *AttrA = A->getAttr<PassObjectSizeAttr>();
-    const auto *AttrB = B->getAttr<PassObjectSizeAttr>();
-    if (AttrA == AttrB)
-      return true;
-    return AttrA && AttrB && AttrA->getType() == AttrB->getType();
+    Optional<PassObjectSizeInfo> InfoA = getPassObjectSizeInfo(A);
+    Optional<PassObjectSizeInfo> InfoB = getPassObjectSizeInfo(B);
+    if (!InfoA || !InfoB)
+      return !InfoA && !InfoB;
+    return std::tie(InfoA->Type, InfoA->IsDynamic) ==
+           std::tie(InfoB->Type, InfoB->IsDynamic);
   };
 
   return std::equal(A->param_begin(), A->param_end(), B->param_begin(), AttrEq);
 }
 
 /// If necessary, adjust the semantic declaration context for a qualified
 /// declaration to name the correct inline namespace within the qualifier.
 static void adjustDeclContextForDeclaratorDecl(DeclaratorDecl *NewD,

clang/lib/Sema/SemaDeclAttr.cpp

   bool ArgDependent = false;
   if (const auto *FD = dyn_cast<FunctionDecl>(D))
     ArgDependent = ArgumentDependenceChecker(FD).referencesArgs(Cond);
   D->addAttr(::new (S.Context) DiagnoseIfAttr(
       AL.getRange(), S.Context, Cond, Msg, DiagType, ArgDependent,
       cast<NamedDecl>(D), AL.getAttributeSpellingListIndex()));
 }
 
-static void handlePassObjectSizeAttr(Sema &S, Decl *D, const ParsedAttr &AL) {
-  if (D->hasAttr<PassObjectSizeAttr>()) {
-    S.Diag(D->getBeginLoc(), diag::err_attribute_only_once_per_parameter) << AL;
+static void handlePassObjectSizeAttr(Sema &S, Decl *D, const ParsedAttr &AL,
+                                     bool IsDynamic) {
+  assert(isa<ParmVarDecl>(D) && "Should be checked already!");
+  auto *PVD = cast<ParmVarDecl>(D);
+  if (getPassObjectSizeInfo(PVD) != None) {
+    S.Diag(PVD->getBeginLoc(), diag::err_attribute_only_once_per_parameter)
+        << AL;
     return;
   }
 
   Expr *E = AL.getArgAsExpr(0);
   uint32_t Type;
   if (!checkUInt32Argument(S, AL, E, Type, /*Idx=*/1))
     return;
 
   // pass_object_size's argument is passed in as the second argument of
   // __builtin_object_size. So, it has the same constraints as that second
   // argument; namely, it must be in the range [0, 3].
   if (Type > 3) {
     S.Diag(E->getBeginLoc(), diag::err_attribute_argument_out_of_range)
         << AL << 0 << 3 << E->getSourceRange();
     return;
   }
 
   // pass_object_size is only supported on constant pointer parameters; as a
   // kindness to users, we allow the parameter to be non-const for declarations.
   // At this point, we have no clue if `D` belongs to a function declaration or
   // definition, so we defer the constness check until later.
-  if (!cast<ParmVarDecl>(D)->getType()->isPointerType()) {
+  if (!PVD->getType()->isPointerType()) {
     S.Diag(D->getBeginLoc(), diag::err_attribute_pointers_only) << AL << 1;
     return;
   }
 
-  D->addAttr(::new (S.Context) PassObjectSizeAttr(
-      AL.getRange(), S.Context, (int)Type, AL.getAttributeSpellingListIndex()));
+  if (IsDynamic) {
+    D->addAttr(::new (S.Context) PassDynamicObjectSizeAttr(
+        AL.getRange(), S.Context, (int)Type,
+        AL.getAttributeSpellingListIndex()));
+  } else {
+    D->addAttr(::new (S.Context)
+                   PassObjectSizeAttr(AL.getRange(), S.Context, (int)Type,
+                                      AL.getAttributeSpellingListIndex()));
+  }
 }
 
 static void handleConsumableAttr(Sema &S, Decl *D, const ParsedAttr &AL) {
   ConsumableAttr::ConsumedState DefaultState;
 
   if (AL.isArgIdent(0)) {
     IdentifierLoc *IL = AL.getArgAsIdent(0);
     if (!ConsumableAttr::ConvertStrToConsumedState(IL->Ident->getName(),

     break;
   case ParsedAttr::AT_Common:
     handleCommonAttr(S, D, AL);
     break;
   case ParsedAttr::AT_CUDAConstant:
     handleConstantAttr(S, D, AL);
     break;
   case ParsedAttr::AT_PassObjectSize:
-    handlePassObjectSizeAttr(S, D, AL);
+    handlePassObjectSizeAttr(S, D, AL, false);
+    break;
+  case ParsedAttr::AT_PassDynamicObjectSize:
+    handlePassObjectSizeAttr(S, D, AL, true);
     break;
   case ParsedAttr::AT_Constructor:
     handleConstructorAttr(S, D, AL);
     break;
   case ParsedAttr::AT_CXX11NoReturn:
     handleSimpleAttribute<CXX11NoReturnAttr>(S, D, AL);
     break;
   case ParsedAttr::AT_Deprecated:

clang/lib/Sema/SemaLambda.cpp

 /// C++11 [expr.prim.lambda]p6.
 static void addFunctionPointerConversion(Sema &S,
                                          SourceRange IntroducerRange,
                                          CXXRecordDecl *Class,
                                          CXXMethodDecl *CallOperator) {
   // This conversion is explicitly disabled if the lambda's function has
   // pass_object_size attributes on any of its parameters.
   auto HasPassObjectSizeAttr = [](const ParmVarDecl *P) {
-    return P->hasAttr<PassObjectSizeAttr>();
+    return getPassObjectSizeInfo(P) != None;
   };
   if (llvm::any_of(CallOperator->parameters(), HasPassObjectSizeAttr))
     return;
 
   // Add the conversion to function pointer.
   QualType InvokerFunctionTy = S.getLambdaConversionFunctionResultType(
       CallOperator->getType()->castAs<FunctionProtoType>());
   QualType PtrToFunctionTy = S.Context.getPointerType(InvokerFunctionTy);

clang/lib/Sema/SemaOverload.cpp

 #include <algorithm>
 #include <cstdlib>
 
 using namespace clang;
 using namespace sema;
 
 static bool functionHasPassObjectSizeParams(const FunctionDecl *FD) {
   return llvm::any_of(FD->parameters(), [](const ParmVarDecl *P) {
-    return P->hasAttr<PassObjectSizeAttr>();
+    return getPassObjectSizeInfo(P) != None;
   });
 }
 
 /// A convenience routine for creating a decayed reference to a function.
 static ExprResult
 CreateFunctionRefExpr(Sema &S, FunctionDecl *Fn, NamedDecl *FoundDecl,
                       const Expr *Base, bool HadMultipleCandidates,
                       SourceLocation Loc = SourceLocation(),

                diag::note_addrof_ovl_candidate_disabled_by_enable_if_attr);
       else
         S.Diag(Loc, diag::err_addrof_function_disabled_by_enable_if_attr) << FD;
     }
     return false;
   }
 
   auto I = llvm::find_if(FD->parameters(), [](const ParmVarDecl *P) {
-    return P->hasAttr<PassObjectSizeAttr>();
+    return getPassObjectSizeInfo(P) != None;
   });
   if (I == FD->param_end())
     return true;
 
   if (Complain) {
     // Add one to ParamNo because it's user-facing
     unsigned ParamNo = std::distance(FD->param_begin(), I) + 1;
     if (InOverloadResolution)

clang/lib/Sema/SemaType.cpp

           }
 
           if (auto attr = Param->getAttr<ParameterABIAttr>()) {
             ExtParameterInfos[i] =
               ExtParameterInfos[i].withABI(attr->getABI());
             HasAnyInterestingExtParameterInfos = true;
           }
 
-          if (Param->hasAttr<PassObjectSizeAttr>()) {
+          if (getPassObjectSizeInfo(Param) != None) {
             ExtParameterInfos[i] = ExtParameterInfos[i].withHasPassObjectSize();
             HasAnyInterestingExtParameterInfos = true;
           }
 
           if (Param->hasAttr<NoEscapeAttr>()) {
             ExtParameterInfos[i] = ExtParameterInfos[i].withIsNoEscape(true);
             HasAnyInterestingExtParameterInfos = true;
           }

clang/test/CodeGen/pass-object-size.c

 // RUN: %clang_cc1 -triple x86_64-apple-darwin -emit-llvm -O0 %s -o - 2>&1 | FileCheck %s
 
 typedef unsigned long size_t;
 
 struct Foo {
   int t[10];
 };
 
 #define PS(N) __attribute__((pass_object_size(N)))
+#define PDS(N) __attribute__((pass_dynamic_object_size(N)))
 
 int gi = 0;
 
 // CHECK-LABEL: define i32 @ObjectSize0(i8* %{{.*}}, i64)
 int ObjectSize0(void *const p PS(0)) {
   // CHECK-NOT: @llvm.objectsize
   return __builtin_object_size(p, 0);
 }
 
+// CHECK-LABEL: define i32 @DynamicObjectSize0(i8* %{{.*}}, i64)
+int DynamicObjectSize0(void *const p PDS(0)) {
+  // CHECK-NOT: @llvm.objectsize
+  return __builtin_dynamic_object_size(p, 0);
+}
+
 // CHECK-LABEL: define i32 @ObjectSize1(i8* %{{.*}}, i64)
 int ObjectSize1(void *const p PS(1)) {
   // CHECK-NOT: @llvm.objectsize
   return __builtin_object_size(p, 1);
 }
 
+// CHECK-LABEL: define i32 @DynamicObjectSize1(i8* %{{.*}}, i64)
+int DynamicObjectSize1(void *const p PDS(1)) {
+  // CHECK-NOT: @llvm.objectsize
+  return __builtin_dynamic_object_size(p, 1);
+}
+
 // CHECK-LABEL: define i32 @ObjectSize2(i8* %{{.*}}, i64)
 int ObjectSize2(void *const p PS(2)) {
   // CHECK-NOT: @llvm.objectsize
   return __builtin_object_size(p, 2);
 }
 
+// CHECK-LABEL: define i32 @DynamicObjectSize2(i8* %{{.*}}, i64)
+int DynamicObjectSize2(void *const p PDS(2)) {
+  // CHECK-NOT: @llvm.objectsize
+  return __builtin_object_size(p, 2);
+}
+
 // CHECK-LABEL: define i32 @ObjectSize3(i8* %{{.*}}, i64)
 int ObjectSize3(void *const p PS(3)) {
   // CHECK-NOT: @llvm.objectsize
   return __builtin_object_size(p, 3);
 }
 
+// CHECK-LABEL: define i32 @DynamicObjectSize3(i8* %{{.*}}, i64)
+int DynamicObjectSize3(void *const p PDS(3)) {
+  // CHECK-NOT: @llvm.objectsize
+  return __builtin_object_size(p, 3);
+}
+
+void *malloc(unsigned long) __attribute__((alloc_size(1)));
+
 // CHECK-LABEL: define void @test1
-void test1() {
+void test1(unsigned long sz) {
   struct Foo t[10];
 
   // CHECK: call i32 @ObjectSize0(i8* %{{.*}}, i64 360)
   gi = ObjectSize0(&t[1]);
   // CHECK: call i32 @ObjectSize1(i8* %{{.*}}, i64 360)
   gi = ObjectSize1(&t[1]);
   // CHECK: call i32 @ObjectSize2(i8* %{{.*}}, i64 360)
   gi = ObjectSize2(&t[1]);
   // CHECK: call i32 @ObjectSize3(i8* %{{.*}}, i64 360)
   gi = ObjectSize3(&t[1]);
 
   // CHECK: call i32 @ObjectSize0(i8* %{{.*}}, i64 356)
   gi = ObjectSize0(&t[1].t[1]);
   // CHECK: call i32 @ObjectSize1(i8* %{{.*}}, i64 36)
   gi = ObjectSize1(&t[1].t[1]);
   // CHECK: call i32 @ObjectSize2(i8* %{{.*}}, i64 356)
   gi = ObjectSize2(&t[1].t[1]);
   // CHECK: call i32 @ObjectSize3(i8* %{{.*}}, i64 36)
   gi = ObjectSize3(&t[1].t[1]);
+
+  char *ptr = (char *)malloc(sz);
+
+  // CHECK: [[REG:%.*]] = call i64 @llvm.objectsize.i64.p0i8({{.*}}, i1 false, i1 true, i1 true)
+  // CHECK: call i32 @DynamicObjectSize0(i8* %{{.*}}, i64 [[REG]])
+  gi = DynamicObjectSize0(ptr);
+
+  // CHECK: [[WITH_OFFSET:%.*]] = getelementptr
+  // CHECK: [[REG:%.*]] = call i64 @llvm.objectsize.i64.p0i8(i8* [[WITH_OFFSET]], i1 false, i1 true, i1 true)
+  // CHECK: call i32 @DynamicObjectSize0(i8* {{.*}}, i64 [[REG]])
+  gi = DynamicObjectSize0(ptr+10);
+
+  // CHECK: [[REG:%.*]] = call i64 @llvm.objectsize.i64.p0i8({{.*}}, i1 true, i1 true, i1 true)
+  // CHECK: call i32 @DynamicObjectSize2(i8* {{.*}}, i64 [[REG]])
+  gi = DynamicObjectSize2(ptr);
 }
 
 // CHECK-LABEL: define void @test2
 void test2(struct Foo *t) {
   // CHECK: [[VAR:%[0-9]+]] = call i64 @llvm.objectsize
   // CHECK: call i32 @ObjectSize1(i8* %{{.*}}, i64 [[VAR]])
   gi = ObjectSize1(&t->t[1]);
   // CHECK: call i32 @ObjectSize3(i8* %{{.*}}, i64 36)
   gi = ObjectSize3(&t->t[1]);
 }
 
 // CHECK-LABEL: define i32 @_Z27NoViableOverloadObjectSize0Pv
 int NoViableOverloadObjectSize0(void *const p) __attribute__((overloadable)) {
   // CHECK: @llvm.objectsize
   return __builtin_object_size(p, 0);
 }
 
+// CHECK-LABEL: define i32 @_Z34NoViableOverloadDynamicObjectSize0Pv
+int NoViableOverloadDynamicObjectSize0(void *const p)
+  __attribute__((overloadable)) {
+  // CHECK: @llvm.objectsize
+  return __builtin_object_size(p, 0);
+}
+
 // CHECK-LABEL: define i32 @_Z27NoViableOverloadObjectSize1Pv
 int NoViableOverloadObjectSize1(void *const p) __attribute__((overloadable)) {
   // CHECK: @llvm.objectsize
   return __builtin_object_size(p, 1);
 }
 
 // CHECK-LABEL: define i32 @_Z27NoViableOverloadObjectSize2Pv
 int NoViableOverloadObjectSize2(void *const p) __attribute__((overloadable)) {

 
 // CHECK-LABEL: define i32 @_Z27NoViableOverloadObjectSize0Pv
 // CHECK-NOT: @llvm.objectsize
 int NoViableOverloadObjectSize0(void *const p PS(0))
     __attribute__((overloadable)) {
   return __builtin_object_size(p, 0);
 }
 
+int NoViableOverloadDynamicObjectSize0(void *const p PDS(0))
+  __attribute__((overloadable)) {
+  return __builtin_dynamic_object_size(p, 0);
+}
+
 int NoViableOverloadObjectSize1(void *const p PS(1))
     __attribute__((overloadable)) {
   return __builtin_object_size(p, 1);
 }
 
 int NoViableOverloadObjectSize2(void *const p PS(2))
     __attribute__((overloadable)) {
   return __builtin_object_size(p, 2);
void test3() {
   // CHECK: call i32 @_Z27NoViableOverloadObjectSize0PvU17pass_object_size0(i8* %{{.*}}, i64 356)
   gi = NoViableOverloadObjectSize0(&t[1].t[1]);
   // CHECK: call i32 @_Z27NoViableOverloadObjectSize1PvU17pass_object_size1(i8* %{{.*}}, i64 36)
   gi = NoViableOverloadObjectSize1(&t[1].t[1]);
   // CHECK: call i32 @_Z27NoViableOverloadObjectSize2PvU17pass_object_size2(i8* %{{.*}}, i64 356)
   gi = NoViableOverloadObjectSize2(&t[1].t[1]);
   // CHECK: call i32 @_Z27NoViableOverloadObjectSize3PvU17pass_object_size3(i8* %{{.*}}, i64 36)
   gi = NoViableOverloadObjectSize3(&t[1].t[1]);
+
+  // CHECK: call i32 @_Z34NoViableOverloadDynamicObjectSize0PvU25pass_dynamic_object_size0(i8* %{{.*}}, i64 360)
+  gi = NoViableOverloadDynamicObjectSize0(&t[1]);
 }
 
 // CHECK-LABEL: define void @test4
 void test4(struct Foo *t) {
   // CHECK: call i32 @_Z27NoViableOverloadObjectSize0PvU17pass_object_size0(i8* %{{.*}}, i64 %{{.*}})
   gi = NoViableOverloadObjectSize0(&t[1]);
   // CHECK: call i32 @_Z27NoViableOverloadObjectSize1PvU17pass_object_size1(i8* %{{.*}}, i64 %{{.*}})
   gi = NoViableOverloadObjectSize1(&t[1]);
void test4(struct Foo *t) {
   gi = NoViableOverloadObjectSize3(&t[1].t[1]);
 }
 
 void test5() {
   struct Foo t[10];
 
   int (*f)(void *) = &NoViableOverloadObjectSize0;
   gi = f(&t[1]);
+
+  int (*g)(void *) = &NoViableOverloadDynamicObjectSize0;
+  gi = g(&t[1]);
 }
 
 // CHECK-LABEL: define i32 @IndirectObjectSize0
 int IndirectObjectSize0(void *const p PS(0)) {
   // CHECK: call i32 @ObjectSize0(i8* %{{.*}}, i64 %{{.*}})
   // CHECK-NOT: @llvm.objectsize
   return ObjectSize0(p);
 }

 
 // CHECK-LABEL: define i32 @IndirectObjectSize3
 int IndirectObjectSize3(void *const p PS(3)) {
   // CHECK: call i32 @ObjectSize3(i8* %{{.*}}, i64 %{{.*}})
   // CHECK-NOT: @llvm.objectsize
   return ObjectSize3(p);
 }
 
+int IndirectDynamicObjectSize0(void *const p PDS(0)) {
+  // CHECK: call i32 @ObjectSize0(i8* %{{.*}}, i64 %{{.*}})
+  // CHECK-NOT: @llvm.objectsize
+  return ObjectSize0(p);
+}
+
 int Overload0(void *, size_t, void *, size_t);
 int OverloadNoSize(void *, void *);
 
 int OverloadedObjectSize(void *const p PS(0),
                          void *const c PS(0))
     __attribute__((overloadable)) __asm__("Overload0");
 
 int OverloadedObjectSize(void *const p, void *const c)
void test17(char *C) {
   // Check for 65535 to see if we're emitting this pointer twice.
   // CHECK: 65535
   // CHECK-NOT: 65535
   // CHECK: @llvm.objectsize.i64.p0i8(i8* [[PTR:%[^,]+]],
   // CHECK-NOT: 65535
   // CHECK: call i32 @ObjectSize0(i8* [[PTR]]
   ObjectSize0(C + ({ int a = 65535; a; }));
 }
+
+// CHECK-LABEL: define void @test18
+void test18(char *const p PDS(0)) {
+  // CHECK-NOT: llvm.objectsize
+  gi = __builtin_dynamic_object_size(p, 0);
+  gi = __builtin_object_size(p, 0);
+}

clang/test/CodeGenCXX/mangle-ms.cpp

 // CHECK-DAG: define dso_local i32 @"?foo@PassObjectSize@@YAHQAHW4__pass_object_size0@__clang@@@Z"
 int foo(int *const i __attribute__((pass_object_size(0)))) { return 0; }
 // CHECK-DAG: define dso_local i32 @"?bar@PassObjectSize@@YAHQAHW4__pass_object_size1@__clang@@@Z"
 int bar(int *const i __attribute__((pass_object_size(1)))) { return 0; }
 // CHECK-DAG: define dso_local i32 @"?qux@PassObjectSize@@YAHQAHW4__pass_object_size1@__clang@@0W4__pass_object_size0@3@@Z"
 int qux(int *const i __attribute__((pass_object_size(1))), int *const j __attribute__((pass_object_size(0)))) { return 0; }
 // CHECK-DAG: define dso_local i32 @"?zot@PassObjectSize@@YAHQAHW4__pass_object_size1@__clang@@01@Z"
 int zot(int *const i __attribute__((pass_object_size(1))), int *const j __attribute__((pass_object_size(1)))) { return 0; }
+// CHECK-DAG: define dso_local i32 @"?silly_word@PassObjectSize@@YAHQAHW4__pass_dynamic_object_size1@__clang@@@Z"
+int silly_word(int *const i __attribute__((pass_dynamic_object_size(1)))) { return 0; }
 }
 
 namespace Atomic {
 // CHECK-DAG: define dso_local void @"?f@Atomic@@YAXU?$_Atomic@H@__clang@@@Z"(
 void f(_Atomic(int)) {}
 }
 namespace Complex {
 // CHECK-DAG: define dso_local void @"?f@Complex@@YAXU?$_Complex@H@__clang@@@Z"(

clang/test/Misc/pragma-attribute-supported-attributes-list.test

 // CHECK-NEXT: ObjCRuntimeName (SubjectMatchRule_objc_interface, SubjectMatchRule_objc_protocol)
 // CHECK-NEXT: ObjCRuntimeVisible (SubjectMatchRule_objc_interface)
 // CHECK-NEXT: ObjCSubclassingRestricted (SubjectMatchRule_objc_interface)
 // CHECK-NEXT: OpenCLIntelReqdSubGroupSize (SubjectMatchRule_function)
 // CHECK-NEXT: OpenCLNoSVM (SubjectMatchRule_variable)
 // CHECK-NEXT: OptimizeNone (SubjectMatchRule_function, SubjectMatchRule_objc_method)
 // CHECK-NEXT: Overloadable (SubjectMatchRule_function)
 // CHECK-NEXT: ParamTypestate (SubjectMatchRule_variable_is_parameter)
+// CHECK-NEXT: PassDynamicObjectSize (SubjectMatchRule_variable_is_parameter)
 // CHECK-NEXT: PassObjectSize (SubjectMatchRule_variable_is_parameter)
 // CHECK-NEXT: RenderScriptKernel (SubjectMatchRule_function)
 // CHECK-NEXT: ReqdWorkGroupSize (SubjectMatchRule_function)
 // CHECK-NEXT: RequireConstantInit (SubjectMatchRule_variable_is_global)
 // CHECK-NEXT: Restrict (SubjectMatchRule_function)
 // CHECK-NEXT: ReturnTypestate (SubjectMatchRule_function, SubjectMatchRule_variable_is_parameter)
 // CHECK-NEXT: ReturnsNonNull (SubjectMatchRule_objc_method, SubjectMatchRule_function)
 // CHECK-NEXT: ReturnsTwice (SubjectMatchRule_function)

clang/test/Sema/pass-object-size.c

 void e(void *p __attribute__((pass_object_size(1ULL<<32)))); //expected-error{{integer constant expression evaluates to value 4294967296 that cannot be represented in a 32-bit unsigned integer type}}
 
 void f(char p __attribute__((pass_object_size(0)))); //expected-error{{'pass_object_size' attribute only applies to constant pointer arguments}}
 void g(const char p __attribute__((pass_object_size(0)))); //expected-error{{'pass_object_size' attribute only applies to constant pointer arguments}}
 void h(char *p __attribute__((pass_object_size(0)))) {} //expected-error{{pass_object_size attribute only applies to constant pointer arguments}}
 void i(char *p __attribute__((pass_object_size(0)))); // OK -- const is only necessary on definitions, not decls.
 void j(char *p __attribute__((pass_object_size(0), pass_object_size(1)))); //expected-error{{'pass_object_size' attribute can only be applied once per parameter}}
 
+void k(char *p __attribute__((pass_dynamic_object_size))); // expected-error {{'pass_dynamic_object_size' attribute takes one argument}}
+void l(int p __attribute__((pass_dynamic_object_size(0)))); // expected-error {{'pass_dynamic_object_size' attribute only applies to constant pointer arguments}}
+
 #define PS(N) __attribute__((pass_object_size(N)))
 #define overloaded __attribute__((overloadable))
 void Overloaded(void *p PS(0)) overloaded; //expected-note{{previous declaration is here}}
 void Overloaded(void *p PS(1)) overloaded; //expected-error{{conflicting pass_object_size attributes on parameters}}
 void Overloaded2(void *p PS(1), void *p2 PS(0)) overloaded; //expected-note{{previous declaration is here}}
 void Overloaded2(void *p PS(0), void *p2 PS(1)) overloaded; //expected-error{{conflicting pass_object_size attributes on parameters}}
 
 void Overloaded3(void *p PS(0), void *p2) overloaded; //expected-note{{previous declaration is here}}
 void Overloaded3(void *p, void *p2 PS(0)) overloaded; //expected-error{{conflicting pass_object_size attributes on parameters}}
 
 void TakeFn(void (*)(void *));
 void TakeFnOvl(void (*)(void *)) overloaded;
 void TakeFnOvl(void (*)(int *)) overloaded;
 
 void NotOverloaded(void *p PS(0));
-void IsOverloaded(void *p PS(0)) overloaded;
-void IsOverloaded(char *p) overloaded; // char* inestead of void* is intentional
+void IsOverloaded(void *p PS(0)) overloaded; // expected-note 2 {{candidate address cannot be taken because parameter 1 has pass_object_size attribute}}
+
+// char* inestead of void* is intentional
+void IsOverloaded(char *p) overloaded; // expected-note{{passing argument to parameter 'p' here}} expected-note 2 {{type mismatch}}
+
 void FunctionPtrs() {
   void (*p)(void *) = NotOverloaded; //expected-error{{cannot take address of function 'NotOverloaded' because parameter 1 has pass_object_size attribute}}
   void (*p2)(void *) = &NotOverloaded; //expected-error{{cannot take address of function 'NotOverloaded' because parameter 1 has pass_object_size attribute}}
 
-  void (*p3)(void *) = IsOverloaded; //expected-warning{{incompatible pointer types initializing 'void (*)(void *)' with an expression of type '<overloaded function type>'}} expected-note@-6{{candidate address cannot be taken because parameter 1 has pass_object_size attribute}} expected-note@-5{{type mismatch}}
-  void (*p4)(void *) = &IsOverloaded; //expected-warning{{incompatible pointer types initializing 'void (*)(void *)' with an expression of type '<overloaded function type>'}} expected-note@-7{{candidate address cannot be taken because parameter 1 has pass_object_size attribute}} expected-note@-6{{type mismatch}}
+  void (*p3)(void *) = IsOverloaded; //expected-warning{{incompatible pointer types initializing 'void (*)(void *)' with an expression of type '<overloaded function type>'}}
+  void (*p4)(void *) = &IsOverloaded; //expected-warning{{incompatible pointer types initializing 'void (*)(void *)' with an expression of type '<overloaded function type>'}}
 
   void (*p5)(char *) = IsOverloaded;
   void (*p6)(char *) = &IsOverloaded;
 
   TakeFn(NotOverloaded); //expected-error{{cannot take address of function 'NotOverloaded' because parameter 1 has pass_object_size attribute}}
   TakeFn(&NotOverloaded); //expected-error{{cannot take address of function 'NotOverloaded' because parameter 1 has pass_object_size attribute}}
 
   TakeFnOvl(NotOverloaded); //expected-error{{cannot take address of function 'NotOverloaded' because parameter 1 has pass_object_size attribute}}
   TakeFnOvl(&NotOverloaded); //expected-error{{cannot take address of function 'NotOverloaded' because parameter 1 has pass_object_size attribute}}
 
   int P;
   (&NotOverloaded)(&P); //expected-error{{cannot take address of function 'NotOverloaded' because parameter 1 has pass_object_size attribute}}
-  (&IsOverloaded)(&P); //expected-warning{{incompatible pointer types passing 'int *' to parameter of type 'char *'}} expected-note@36{{passing argument to parameter 'p' here}}
+  (&IsOverloaded)(&P); //expected-warning{{incompatible pointer types passing 'int *' to parameter of type 'char *'}}
 }
+
+void mismatch(void *p __attribute__((pass_object_size(0)))); // expected-note {{previous declaration is here}}
+void mismatch(void *p __attribute__((pass_dynamic_object_size(0)))); // expected-error {{conflicting pass_object_size attributes on parameters}}
+
+void mismatch2(void *p __attribute__((pass_dynamic_object_size(0)))); // expected-note {{previous declaration is here}}
+void mismatch2(void *p __attribute__((pass_dynamic_object_size(1)))); // expected-error {{conflicting pass_object_size attributes on parameters}}