[LifetimeAnalysis] Add support for lifetime annotations on functions

[xazax.hun]

Summary

This patch corresponds to this RFC: http://lists.llvm.org/pipermail/cfe-dev/2019-December/064067.html

This does not cover everything yet, but I wanted to keep the patch small to be incremental.

[gribozavr2]

I'd also appreciate if you updated the docs for the changes done in this patch.

clang/include/clang/AST/LifetimeAttr.h

23

"/// An abstract memory location..."

It would also really help to show some examples of the sorts of locations it can express (especially the nested field accesses).

25

I feel like the name is too broad, maybe LifetimeContractVariable?

32

I'd suggest to make the above two constructors into named factories as well. It took me a while to realize that converting a RecordDecl* to ContractVariable actually models a "this" pointer.

72

I'd suggest to add all such is* methods in this commit, and group them next to each other in the source code.

144

These names are not descriptive...

147

I'm sorry, but this comment is missing the most important piece of information -- what this function does.

This comment says "matching the AST that describes the contracts", which does give me a feeling of the compiler component, but I have no idea about how exactly it uses the expression that is passed in, and what happens with the map, and why a SourceRange is returned.

clang/include/clang/Basic/Attr.td

2897

I'd suggest to call it something other than "Expr" (to avoid confusion with or shadowing the type name) -- "ContractExpr" maybe?

clang/include/clang/Basic/DiagnosticSemaKinds.td

3342

I think a warning that is a debugging aid is new territory.

clang/lib/AST/LifetimeAttr.cpp

17

I don't think this comment adds much.

19

I'm not sure what you mean by "return values".

ignoreWrapperASTNodes?

56

The lifetime paper says it is called "global" now:

Renamed static to global to reduce confusion with the keyword.

Also, the paper spells these special names in all lowercase letters.

clang/lib/Sema/SemaDeclAttr.cpp

4532

I'm assuming higher quality error messages are going to come later? Right now it is a catch-all message that is shown for unsupported expressions, expressions that don't type check, and expressions that will never be supported.

clang/test/Sema/attr-psets-annotation.cpp

25

If this code imitates an existing library, please ignore.

Declaring PointerTraits::deref to be a function and then invoking it and using decltype on the return value seems unnecessarily complex.

You could declare a type alias within PointerTraits instead.

template<typename T>
struct PointerTraits {
  using DerefType = decltype(*declvar<T>());
};

template<typename T>
struct PointerTraits<T*> {
  using DerefType = T;
}; // Is this specialization needed? Wouldn't the primary template work?

template<typename T>
struct PointerTraits<T&> {
  using DerefType = T;
};

Also, a specialization for rvalue references?

However, I'm not sure if the specialization even for regular references will be used -- the free function deref() strips the reference from T (also strips constness from it!) Due to reference collapse rules, T will never be a reference.

96

I'm not sure what causes this unqualified call to deref to call gsl::deref (in a different namespace). Does not seem like ADL would do it, since the type of out is also not in gsl.

[xazax.hun]

• Address most of the review comments.

[xazax.hun]

clang/include/clang/AST/LifetimeAttr.h

144

I changed them slightly and added some comments. Let me know if they are better or if you have some alternatives.

147

You are completely right. This comment was mainly an implementation related one. Now I have a more user facing comment in the header and moved the implementation related part to the cpp file.

clang/include/clang/Basic/DiagnosticSemaKinds.td

3342

Do you think a cc1 flag would be sufficient or do you have other ideas/preferences?

clang/lib/AST/LifetimeAttr.cpp

56

In this case the implementation was out of date, sorry for that. Now all the names should reflect the paper except for the Return. The function name to express return values did not work out well due to how name lookup works (and overloads). Herb already updated his working draft to reflect this change. I will ask him if he is willing to publish the working draft somewhere.

Also, he argued that Return is capitalized because it has a slightly different meaning compared to null, global, and invalid. In the lifetime annotations, Return will be on the 'left hand side', while the others will be on the 'right hand side'.

clang/lib/Sema/SemaDeclAttr.cpp

4532

Yes, I would love to improve the error message in the future. Note that, the current message is not that bad as it will highlight the unsupported expression. Expressions that does not type check will produce a warning earlier while parsing the argument of the attribute. Those warnings would be identical to warnings from expressions within the functions.

As for invalid lifetime annotations that are valid C++ expressions, ideally we want to make this impossible. (This patch does not push this direction yet.) Basically, we would like to make a DSL where every expression that type-checks using C++ type checking rules is a valid lifetime annotation.

clang/test/Sema/attr-psets-annotation.cpp

25

I agree with you.

If this code imitates an existing library, please ignore.

Yes and no. This imitates an experiment (not a well established library). In that experiment I was looking into generating some runtime checks from static lifetime annotations. It turns out most of the time it is not possible to generate appropriate runtime checks from these annotations except for some corner cases like nullability. So the reason why I had this as a function because it carried out some null checks.

Since null pointers are easy to catch dynamically using other methods I do not have strong feelings about the current API. Do you think it is worth to keep it as a function or do you prefer the simpler way?

However, I'm not sure if the specialization even for regular references will be used...

That is correct, this is a leftover from the implementation which was using a trick to trigger these specializations like:

#define deref(arg) deref<decltype(arg)>(arg)

96

I have a using namespace above to keep tests more concise.

[gribozavr2]

clang/include/clang/AST/LifetimeAttr.h

23

Drop the "this represents", it does not add anything (you can say so about *every* class, "this represents an expression", "this represents a person", "this represents an postal address").

"An abstract memory location that participates in defining a lifetime contract. A lifetime contract constrains lifetime of a LifetimeContractVariable to be at least as big as the lifetime of other LifetimeContractVariables.

The memory locations that we can describe are: return values of a function, this pointer, any function parameter, a "drilldown" expression based on function parameters, null etc."

29

Also a factory, please.

161

WDYT about s/LifetimeSet/ObjectLifetimeSet/ ?

Comment:

"A lifetime of a pointee of a specific pointer-like C++ object. This lifetime is represented as a disjunction of different lifetime possibilities (set elements). Each lifetime possibility is specified by naming another object that the pointee can point at."

Also, three slashes for doc comments.

162

"Lifetime constraints for multiple objects. The key of the map is the pointer-like object, the value is the lifetime of the pointee.

Can be used to describe all lifetime constraints required by a given function, or all lifetimes inferred at a specific program point etc."

163

Generally, DenseMap and DenseSet are faster. Any reason to not use them instead?

166

Cut the fluff.

"Converts an AST of a lifetime contract (that is, the `gtl::lifetime(...) call expression) to a LifetimeContracts object that is used throughout the lifetime analysis.

If the AST does not describe a valid contract, the source range of the erroneous part is returned.

When the function succeeds, the returned SourceRange is invalid."

Having written this out, I'm contemplating whether the return value should be an optional of a source range.

clang/include/clang/Basic/DiagnosticSemaKinds.td

3342

Yes, I think that would be quite standard (similar to dumping the AST, dumping the CFG etc.)

clang/lib/AST/LifetimeAttr.cpp

56

I don't think the left-hand-side/right-hand-side difference helps me as a reader much. However, we would have a huge implementation problem if return was not capitalized (because it would be a keyword, and our expression parser really would not like that). So... whatever works, as long as we are consistent with the spec.

clang/lib/Sema/SemaDeclAttr.cpp

4532

Expressions that does not type check will produce a warning earlier while parsing the argument of the attribute.

I'd love some basic tests to show that.

clang/test/Sema/attr-psets-annotation.cpp

25

Yes, I'd prefer a simpler implementation.

35

Using a C variadic here gives me pause. I can't definitely say it would be a problem, however, C variadics are weird, can only pass certain types correctly, require passing them by value etc. So there might be some issues down the line, for example, with static analysis that warns about passing non-C-compatible types through a variadic, or with noncopyable types failing to typecheck in the call to PSet's constructor.

I think it would be better to do a variadic template that takes everything by const reference.

96

I'd strongly suggest to un-use that namespace to make tests more realistic. Or even add basic tests for both cases, and keep the bulk of the tests close to what you expect users to write. There will be some differences in the AST between the two cases, I believe.

[xazax.hun]

clang/include/clang/AST/LifetimeAttr.h

163

No specific reason other than I am always insecure about the choice. Dense data structures are great for small objects and I do not know where the break even point is and never really did any benchmarks. Is there some guidelines somewhere for what object size should we prefer one over the other?

clang/include/clang/Basic/DiagnosticSemaKinds.td

3342

I started to look into a cc1 flag, but it looks like it needs a bit more plumbing I expected as some does not have access to the CompilerInvocation object or the FrontendOptions. While it is not too hard to pass an additional boolean to Sema I also started to think about the user/developer experience (ok, regular users are not expected to do debugging). The advantage of warnings are that we get a source location for free, so it is really easy to see where the message is originated from. And while it is true that I cannot think of any examples of using warnings for debugging the Clang Static Analyzer is full of checks that are only dumping debug data as warnings.

[xazax.hun]

• Address some review comments.

[aaron.ballman]

Thank you for the work on this!

clang/include/clang/AST/LifetimeAttr.h

25

constrains lifetime -> constrains the lifetime

26

big -> long

30

What is a drilldown expression? That's not a term I'm familiar with.

71

I think it would be easier to read if the pattern was: if (Foo < Bar) return true; as opposed to checking inequality before returning the comparison.

80

This will have non deterministic behavior between program executions -- are you sure that's what we want? Similar below for fields.

154–155

These constructors should probably be explicit?

163

I usually figure that if it's less than two pointers in size, it's sufficiently small, but maybe others have a different opinion. This class is probably a bit large for using dense containers.

I do worry a little bit about the hoops we're jumping through to make the class orderable -- is there a reason to avoid an unordered container instead?

clang/include/clang/Basic/Attr.td

2892

I think the attribute should probably only be supported in C++ for now, and should have let LangOpts = [CPlusPlus]; in the declaration. WDYT?

2931

I agree with the FIXME comment. ;-)

clang/include/clang/Basic/DiagnosticSemaKinds.td

3342

I also prefer a cc1 flag -- using warnings to control debugging behavior is novel and doesn't seem like something we should encourage. I don't think you would need to pass any additional flags to Sema however; I would expect this to show up in a language option so it can be queried through LangOpts. This makes it available to other things, like clang-tidy checks as well.

clang/lib/AST/LifetimeAttr.cpp

24

This need some explanation as it sort of comes out of thin air. What is special about a class named PSet? Does it need to be in the global namespace, or a class named PSet in any namespace is special?

124

Same question about identifier namespaces here as above.

clang/lib/Sema/SemaDeclAttr.cpp

4512

I suspect you want this to handle redeclarations where you may be working with an inherited attribute? If so, you probably should be following the merge pattern used by other attributes.

clang/lib/Sema/SemaType.cpp

7555

This is not an okay thing to do for C++ attributes. They have a specific meaning as to what they appertain to and do not move around to better subjects like GNU-style attributes.

clang/test/Sema/attr-psets-annotation.cpp

2

I think this test should be in SemaCXX instead of Sema.

45

Please spell out the full diagnostic the first time it is used in the test file.

131

This is missing all of the tests which verify the sanity of the attribute (appertains to the correct subject, accepts the correct number/type of arguments, etc).

[xazax.hun]

clang/include/clang/AST/LifetimeAttr.h

71

I think this might not be equivalent.

The code below will always early return if the Tag is not the same.

if (Tag != O.Tag)
  return Tag < O.Tag;

The code below will only early return if the condition is true.

if (Tag < O.Tag)
  return true;

So I think the pattern above is an optimization.

80

Good point. As far as the analysis is concerned the end result should always be the same. I see potential problems in the tests where the contents of some ordered data structures using this ordering is dumped. I do not see any natural (and preformant) way to order RecordDecls. (I can order FieldDecls using their indices.) Are you ok with sorting the string representation before outputting them as strings? This should solve the potential non-deterministic behavior of tests.

163

I am not insisting on using ordered containers but note that since I have no idea how to get a deterministic and efficient hash value of a RecordDecl I would likely just include the address of the canonical decl. So the order of the elements in the container would be non-deterministic both ways. But the algorithm (other than the debug dumps which are fixable) will not depend on the order of the elements.

clang/include/clang/Basic/Attr.td

2892

Makes sense, thanks!

clang/include/clang/Basic/DiagnosticSemaKinds.td

3342

Yeah, plumbing through LangOpts will definitely work. The main reason I was reluctant to do so because I do not see anything in the language options that serves the purpose of debugging and I was wondering it this would really belong there.

clang/lib/AST/LifetimeAttr.cpp

24

I agree, I will make this more strict. Basically, there is a need for a small support library for these contracts to work. That support library is not defined anywhere yet, but it will be expected to live in the gslnamespace.

clang/lib/Sema/SemaDeclAttr.cpp

4512

It is not completely the same. I did not give much testing for redeclarations yet. The main purpuse of this code is to handle the following use case:

void multiple_annotations(int *a, int *b, int *c)
    [[gsl::pre(gsl::lifetime(b, {a}))]]
    [[gsl::pre(gsl::lifetime(c, {a}))]];

So the same declaration might have multiple instances of the annotation (similar to contracts) and we need to merge them.

clang/lib/Sema/SemaType.cpp

7555

Yeah, I know that. But this is problematic in the standard. See the contracts proposal which also kind of violates this rule by adding an exception. Basically, this is the poor man's version of emulating the contracts proposal. In the long term we plan to piggyback on contracts rather than hacking the C++ attributes.

[xazax.hun]

• Rebase.
• Address some review comments.

[aaron.ballman]

clang/include/clang/AST/LifetimeAttr.h

71

Good point about ordering requirements, but this is still extremely hard to read. Can you use std::tie() to simplify the logic somewhat?

80

Would it make sense to order the records by their source location when the pointer values are not equal? Or ordering on the fully-qualified name of the record?

163

I guess I was more speaking to the point that, if this is going to be unordered anyway, why not just use unordered containers and not attempt to impose an ordering in the first place? If the nondeterminism is not user-observable, then I'm not certain it matters.

clang/lib/Sema/SemaType.cpp

7555

The contracts proposal was not adopted and I am opposed to adding this change for any standard attribute. We've done a lot of work to ensure that those attributes attach to the correct thing based on lexical placement and I don't want to start to undo that effort.

[xazax.hun]

clang/lib/Sema/SemaType.cpp

7555

I am not sure how to proceed in this case. As far as I understand this wasn't the main reason why didn't we adopt the contracts proposal.

While I do understand why is it good to make the lexical placement matter, but the current placement hinders non-trivial use-cases. Currently, we either have a type attribute or we cannot mention any of the formal parameters. This is why the contracts cannot work without changing attributes in the standard, and the same reason why this patch will never work without doing this. Or do you have an alternative in mind?

Do you think introducing a frontend flag for this attribute would help? This would make it clear that we are currently using a non-standard feature that needs to be enabled explicitly. Again, this is a temporary solution, that will go away as soon as we have contracts. Since contracts need to solve the same problem, whatever the solution will be, this patch can piggyback on that.

What do you think?

[aaron.ballman]

clang/lib/Sema/SemaType.cpp

7555

I am not sure how to proceed in this case. As far as I understand this wasn't the main reason why didn't we adopt the contracts proposal.

There were a lot of flaws, and this was one of them. I don't think you could point to any one flaw and say "this is why we didn't get contracts" though.

Or do you have an alternative in mind?

I agree that this is an existing deficiency in both the C and C++ standards with the attribute syntax for functions. There simply is no way to make a function declaration attribute that can refer to the parameters currently. The only alternative that comes to mind is to use only a GNU-style spelling rather than trying to use a [[]] spelling.

Do you think introducing a frontend flag for this attribute would help? This would make it clear that we are currently using a non-standard feature that needs to be enabled explicitly. Again, this is a temporary solution, that will go away as soon as we have contracts. Since contracts need to solve the same problem, whatever the solution will be, this patch can piggyback on that.

There's no guarantee that contracts will come back with the same syntax used previously, so I wouldn't want to rely on that to solve the issue until we have a better idea of what contracts will look like coming out of the new study group. My preference is to use the GNU-style spelling and not provide a [[]] spelling. We've done that for other attributes (like enable_if and diagnose_if.

clang/include/clang/AST/Attr.h

 
 #ifndef LLVM_CLANG_AST_ATTR_H
 #define LLVM_CLANG_AST_ATTR_H
 
 #include "clang/AST/ASTContextAllocate.h"  // For Attrs.inc
 #include "clang/AST/AttrIterator.h"
 #include "clang/AST/Decl.h"
 #include "clang/AST/Expr.h"
+#include "clang/AST/LifetimeAttr.h"
 #include "clang/AST/Type.h"
 #include "clang/Basic/AttrKinds.h"
 #include "clang/Basic/AttributeCommonInfo.h"
 #include "clang/Basic/LLVM.h"
 #include "clang/Basic/OpenMPKinds.h"
 #include "clang/Basic/Sanitizers.h"
 #include "clang/Basic/SourceLocation.h"
 #include "llvm/ADT/StringSwitch.h"

clang/include/clang/AST/LifetimeAttr.h

+//===--- LifetimeAttrData.h - Classes for lifetime attributes ---*- C++ -*-===//
+//
+// Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
+// See https://llvm.org/LICENSE.txt for license information.
+// SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
+//
+//===----------------------------------------------------------------------===//
+//
+//  This file defines classes that are used by lifetime attributes.
+//
+//===----------------------------------------------------------------------===//
+
+#ifndef LLVM_CLANG_AST_LIFETIMEATTR_H
+#define LLVM_CLANG_AST_LIFETIMEATTR_H
+
+#include "clang/AST/Decl.h"
+#include "clang/AST/Expr.h"
+#include <set>
+
+namespace clang {
+
+/// This represents an abstract memory location that is used in the lifetime
+/// contract representation. This can represent the return value, this
+/// pointer, parameters, null, invalid memory, dereference locations, and member
+/// selections. Global is used to communicate that something should not be
+/// reasoned about. It is either safe or too complex to capture the semantics.
+class LifetimeContractVariable {
+public:
+  LifetimeContractVariable(const ParmVarDecl *PVD, int Deref = 0)
+      : ParamIdx(PVD->getFunctionScopeIndex()), Tag(Param) {
+    deref(Deref);
+  }
+
+  static LifetimeContractVariable thisVal(const RecordDecl *RD) {
+    return LifetimeContractVariable(RD);
+  }
+  static LifetimeContractVariable returnVal() {
+    return LifetimeContractVariable(Return);
+  }
+  static LifetimeContractVariable globalVal() {
+    return LifetimeContractVariable(Global);
+  }
+  static LifetimeContractVariable nullVal() {
+    return LifetimeContractVariable(Null);
+  }
+  static LifetimeContractVariable invalid() {
+    return LifetimeContractVariable(Invalid);
+  }
+
+  bool operator==(const LifetimeContractVariable &O) const {
+    if (Tag != O.Tag)
+      return false;
+    if (FDs != O.FDs)
+      return false;
+    if (Tag == Param)
+      return ParamIdx == O.ParamIdx;
+    if (Tag == This)
+      return RD == O.RD;
+    return true;
+  }
+
+  bool operator!=(const LifetimeContractVariable &O) const {
+    return !(*this == O);
+  }
+
+  bool operator<(const LifetimeContractVariable &O) const {
+    if (Tag != O.Tag)
+      return Tag < O.Tag;
+    if (FDs.size() != O.FDs.size())
+      return FDs.size() < O.FDs.size();
+    if (Tag == Param)
+      if (ParamIdx != O.ParamIdx)
+        return ParamIdx < O.ParamIdx;
+    if (Tag == This)
+      if (RD != O.RD)
+        return std::less<const RecordDecl *>()(RD, O.RD);
+
+    for (auto I = FDs.begin(), J = O.FDs.begin(); I != FDs.end(); ++I, ++J) {
+      if (*I != *J)
+        return std::less<const FieldDecl *>()(*I, *J);
+    }
+    return false;
+  }
+
+  bool isThisPointer() const { return Tag == This; }
+  bool isReturnVal() const { return Tag == Return; }
+  bool isNull() const { return Tag == Null; }
+  bool isInvalid() const { return Tag == Invalid; }
+  bool isGlobal() const { return Tag == Global; }
+
+  const ParmVarDecl *asParmVarDecl(const FunctionDecl *FD) const {
+    return Tag == Param ? FD->getParamDecl(ParamIdx) : nullptr;
+  }
+
+  // Chain of field accesses starting from VD. Types must match.
+  void addFieldRef(const FieldDecl *FD) { FDs.push_back(FD); }
+
+  LifetimeContractVariable &deref(int Num = 1) {
+    while (Num--)
+      FDs.push_back(nullptr);
+    return *this;
+  }
+
+  std::string dump(const FunctionDecl *FD) const {
+    std::string Result;
+    switch (Tag) {
+    case Null:
+      return "null";
+    case Global:
+      return "global";
+    case Invalid:
+      return "invalid";
+    case This:
+      Result = "this";
+      break;
+    case Return:
+      Result = "(return value)";
+      break;
+    case Param:
+      Result = FD->getParamDecl(ParamIdx)->getName();
+      break;
+    }
+
+    for (unsigned I = 0; I < FDs.size(); ++I) {
+      if (FDs[I]) {
+        if (I > 0 && !FDs[I - 1])
+          Result = "(" + Result + ")";
+        Result += "." + std::string(FDs[I]->getName());
+      } else
+        Result.insert(0, 1, '*');
+    }
+    return Result;
+  }
+
+private:
+  union {
+    const RecordDecl *RD;
+    unsigned ParamIdx;
+  };
+
+  enum TagType {
+    Global,
+    Null,
+    Invalid,
+    This,
+    Return,
+    Param,
+  } Tag;
+
+  LifetimeContractVariable(TagType T) : Tag(T) {}
+  LifetimeContractVariable(const RecordDecl *RD) : RD(RD), Tag(This) {}
+
+  /// Possibly empty list of fields and deref operations on the base.
+  /// The First entry is the field on base, next entry is the field inside
+  /// there, etc. Null pointers represent a deref operation.
+  llvm::SmallVector<const FieldDecl *, 3> FDs;
+};
+
+// We assume that the lifetime of an annotated entity ends when either of the
+// lifetime ends in the set.
+using LifetimeSet = std::set<LifetimeContractVariable>;
+// Maps each annotated entity to a lifetime set.
+using LifetimeContracts = std::map<LifetimeContractVariable, LifetimeSet>;
+
+namespace process_lifetime_contracts {
+/// This function has the sole purpose of converting the AST representation of a
+/// contract into the LifetimeContracts representation which is easier to work with.
+/// It will fill the LifetimeContracts with the lifetimes described by the Expr.
+/// In case there is an unrecognized subexpression, the SourceRange will be valid
+/// and it should be used to diagnose the error to the user.
+SourceRange fillContractFromExpr(const Expr *E, LifetimeContracts &Fill);
+} // namespace process_lifetime_contracts
+} // namespace clang
+
+#endif // LLVM_CLANG_AST_LIFETIMEATTR_H

clang/include/clang/Basic/Attr.td

 
 def Pointer : InheritableAttr {
   let Spellings = [CXX11<"gsl", "Pointer">];
   let Subjects = SubjectList<[Struct]>;
   let Args = [TypeArgument<"DerefType", /*opt=*/1>];
   let Documentation = [LifetimePointerDocs];
 }
 
+def LifetimeContract : InheritableAttr {
+  let Spellings = [CXX11<"gsl", "pre">, CXX11<"gsl", "post">];
+  let Accessors = [Accessor<"isPre", [CXX11<"gsl", "pre">]>,
+                   Accessor<"isPost", [CXX11<"gsl", "post">]>];
+  let Subjects = SubjectList<[Function]>; // TODO: HasFunctionProto?
+  let Args = [ExprArgument<"ContractExpr">];
+  let LateParsed = 1;
+  let TemplateDependent = 1;
+  let ParseArgumentsAsUnevaluated = 1;
+  let AdditionalMembers = [{
+public:
+  LifetimeContracts *PreContracts;
+  LifetimeContracts *PostContracts;
+
+  static std::string dumpSet(const LifetimeSet &Set,
+                             const FunctionDecl *FD) {
+    std::string Buffer;
+    llvm::raw_string_ostream OS(Buffer);
+    OS << "{ ";
+    for (const auto &CV : Set)
+      OS << CV.dump(FD) << " ";
+    OS << "}";
+    return OS.str();
+  }
+
+  std::string dumpContracts(const FunctionDecl *FD) const {
+    std::string Buffer;
+    llvm::raw_string_ostream OS(Buffer);
+    OS << "Pre {";
+    for (const auto &P : *PreContracts)
+      OS << " " << P.first.dump(FD) << " -> " << dumpSet(P.second, FD) << ";";
+    OS << " }";
+    OS << "  Post {";
+    for (const auto &P : *PostContracts)
+      OS << " " << P.first.dump(FD) << " -> " << dumpSet(P.second, FD) << ";";
+    OS << " }";
+    return OS.str();
+  }
+  }];
+  let Documentation = [Undocumented]; // FIXME
+}
+
 // Microsoft-related attributes
 
 def MSNoVTable : InheritableAttr, TargetSpecificAttr<TargetMicrosoftCXXABI> {
   let Spellings = [Declspec<"novtable">];
   let Subjects = SubjectList<[CXXRecord]>;
   let Documentation = [MSNoVTableDocs];
 }
 

clang/include/clang/Basic/DiagnosticGroups.td

def ThreadSafety : DiagGroup<"thread-safety",
                               ThreadSafetyPrecise,
                               ThreadSafetyReference]>;
 def ThreadSafetyVerbose : DiagGroup<"thread-safety-verbose">;
 def ThreadSafetyBeta : DiagGroup<"thread-safety-beta">;
 
 // Uniqueness Analysis warnings
 def Consumed       : DiagGroup<"consumed">;
 
+def LifetimeAnalysis : DiagGroup<"lifetime">;
+def LifetimeDumpContracts : DiagGroup<"lifetime-dump-contracts">;
+
 // Note that putting warnings in -Wall will not disable them by default. If a
 // warning should be active _only_ when -Wall is passed in, mark it as
 // DefaultIgnore in addition to putting it here.
 def All : DiagGroup<"all", [Most, Parentheses, Switch, SwitchBool, MisleadingIndentation]>;
 
 // Warnings that should be in clang-cl /w4.
 def : DiagGroup<"CL4", [All, Extra]>;
 

clang/include/clang/Basic/DiagnosticSemaKinds.td

def warn_loop_state_mismatch : Warning<
   InGroup<Consumed>, DefaultIgnore;
 def warn_param_return_typestate_mismatch : Warning<
   "parameter '%0' not in expected state when the function returns: expected "
   "'%1', observed '%2'">, InGroup<Consumed>, DefaultIgnore;
 def warn_param_typestate_mismatch : Warning<
   "argument not in expected state; expected '%0', observed '%1'">,
   InGroup<Consumed>, DefaultIgnore;
 
+// Lifetime Analysis
+def warn_unsupported_expression : Warning<"this pre/postcondition is not supported">,
+  InGroup<LifetimeAnalysis>, DefaultIgnore;
+def warn_dump_lifetime_contracts : Warning<"%0">, InGroup<LifetimeDumpContracts>, DefaultIgnore;
+
 // no_sanitize attribute
 def warn_unknown_sanitizer_ignored : Warning<
   "unknown sanitizer '%0' ignored">, InGroup<UnknownSanitizers>;
 
 def warn_impcast_vector_scalar : Warning<
   "implicit conversion turns vector to scalar: %0 to %1">,
   InGroup<Conversion>, DefaultIgnore;
 def warn_impcast_complex_scalar : Warning<

clang/lib/AST/CMakeLists.txt

add_clang_library(clangAST
   Interp/PrimType.cpp
   Interp/Program.cpp
   Interp/Record.cpp
   Interp/Source.cpp
   Interp/State.cpp
   ItaniumCXXABI.cpp
   ItaniumMangle.cpp
   JSONNodeDumper.cpp
+  LifetimeAttr.cpp
   Mangle.cpp
   MicrosoftCXXABI.cpp
   MicrosoftMangle.cpp
   NestedNameSpecifier.cpp
   NSAPI.cpp
   ODRHash.cpp
   OpenMPClause.cpp
   OSLog.cpp

clang/lib/AST/LifetimeAttr.cpp

+//===--- SemaType.cpp - Semantic Analysis for Types -----------------------===//
+//
+// Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
+// See https://llvm.org/LICENSE.txt for license information.
+// SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
+//
+//===----------------------------------------------------------------------===//
+
+#include "clang/AST/LifetimeAttr.h"
+#include "clang/AST/Expr.h"
+#include "clang/AST/ExprCXX.h"
+#include "clang/Basic/SourceLocation.h"
+
+namespace clang {
+namespace process_lifetime_contracts {
+static const Expr *ignoreWrapperASTNodes(const Expr *E) {
+  const Expr *Original;
+  do {
+    Original = E;
+    E = E->IgnoreImplicit();
+    if (const auto *CE = dyn_cast<CXXConstructExpr>(E)) {
+      const auto *Ctor = CE->getConstructor();
+      if (Ctor->getParent()->getName() == "PSet")
+        return CE;
+      E = CE->getArg(0);
+    }
+    if (const auto *MCE = dyn_cast<CXXMemberCallExpr>(E)) {
+      if (llvm::isa_and_nonnull<CXXConversionDecl>(MCE->getDirectCallee()))
+        E = MCE->getImplicitObjectArgument();
+    }
+  } while (E != Original);
+  return E;
+}
+
+// This function can either collect the PSets of the symbols based on a lookup
+// table or just the symbols into a pset if the lookup table is nullptr.
+static LifetimeSet collectPSet(const Expr *E, const LifetimeContracts *Lookup,
+                               SourceRange *FailRange) {
+  if (const auto *TE = dyn_cast<CXXThisExpr>(E))
+    return LifetimeSet{LifetimeContractVariable::thisVal(
+        TE->getType()->getPointeeCXXRecordDecl())};
+  if (const auto *DRE = dyn_cast<DeclRefExpr>(E)) {
+    const auto *VD = dyn_cast<VarDecl>(DRE->getDecl());
+    if (!VD) {
+      *FailRange = DRE->getSourceRange();
+      return LifetimeSet{};
+    }
+    StringRef Name = VD->getName();
+    if (Name == "null")
+      return LifetimeSet{LifetimeContractVariable::nullVal()};
+    else if (Name == "global")
+      return LifetimeSet{LifetimeContractVariable::globalVal()};
+    else if (Name == "invalid")
+      return LifetimeSet{LifetimeContractVariable::invalid()};
+    else if (Name == "Return")
+      return LifetimeSet{LifetimeContractVariable::returnVal()};
+    else {
+      const auto *PVD = dyn_cast<ParmVarDecl>(VD);
+      if (!PVD) {
+        *FailRange = DRE->getSourceRange();
+        return LifetimeSet{};
+      }
+      if (Lookup) {
+        auto it = Lookup->find(LifetimeContractVariable(PVD));
+        if (it != Lookup->end())
+          return it->second;
+      }
+      return LifetimeSet{LifetimeContractVariable{PVD}};
+    }
+    *FailRange = DRE->getSourceRange();
+    return LifetimeSet{};
+  }
+  if (const auto *CE = dyn_cast<CallExpr>(E)) {
+    const FunctionDecl *FD = CE->getDirectCallee();
+    if (!FD || !FD->getIdentifier() || FD->getName() != "deref") {
+      *FailRange = CE->getSourceRange();
+      return LifetimeSet{};
+    }
+    LifetimeSet Result =
+        collectPSet(ignoreWrapperASTNodes(CE->getArg(0)), Lookup, FailRange);
+    auto VarsCopy = Result;
+    Result.clear();
+    for (auto Var : VarsCopy)
+      Result.insert(Var.deref());
+    return Result;
+  }
+  auto processArgs = [&](ArrayRef<const Expr *> Args) {
+    LifetimeSet Result;
+    for (const auto *Arg : Args) {
+      LifetimeSet Elem =
+          collectPSet(ignoreWrapperASTNodes(Arg), Lookup, FailRange);
+      if (Elem.empty())
+        return Elem;
+      Result.insert(Elem.begin(), Elem.end());
+    }
+    return Result;
+  };
+  if (const auto *CE = dyn_cast<CXXConstructExpr>(E))
+    return processArgs({CE->getArgs(), CE->getNumArgs()});
+  if (const auto *IE = dyn_cast<InitListExpr>(E))
+    return processArgs(IE->inits());
+  *FailRange = E->getSourceRange();
+  return LifetimeSet{};
+}
+
+// We are only interested in identifier names
+// of function calls and variables. The AST, however, has a lot of other
+// information such as casts, termporary objects and so on. They do not have
+// any semantic meaning for contracts so much of the code is just skipping
+// these unwanted nodes. The rest is collecting the identifiers and their
+// hierarchy.
+// Also, the code might be rewritten a more simple way in the future
+// piggybacking this work: https://reviews.llvm.org/rL365355
+SourceRange fillContractFromExpr(const Expr *E, LifetimeContracts &Fill) {
+  const auto *CE = dyn_cast<CallExpr>(E);
+  if (!CE)
+    return E->getSourceRange();
+  do {
+    if (const auto *ULE = dyn_cast<UnresolvedLookupExpr>(CE->getCallee())) {
+      if (ULE->getName().isIdentifier() &&
+          ULE->getName().getAsIdentifierInfo()->getName() == "lifetime")
+        break;
+    }
+    const FunctionDecl *FD = CE->getDirectCallee();
+    if (!FD || !FD->getIdentifier() || FD->getName() != "lifetime")
+      return E->getSourceRange();
+  } while (false);
+
+  const Expr *LHS = ignoreWrapperASTNodes(CE->getArg(0));
+  if (!LHS)
+    return CE->getArg(0)->getSourceRange();
+  const Expr *RHS = ignoreWrapperASTNodes(CE->getArg(1));
+  if (!RHS)
+    return CE->getArg(1)->getSourceRange();
+
+  SourceRange ErrorRange;
+  LifetimeSet LhsPSet = collectPSet(LHS, nullptr, &ErrorRange);
+  if (LhsPSet.size() != 1)
+    return LHS->getSourceRange();
+  if (ErrorRange.isValid())
+    return ErrorRange;
+
+  LifetimeContractVariable VD = *LhsPSet.begin();
+  LifetimeSet RhsPSet = collectPSet(RHS, &Fill, &ErrorRange);
+  if (ErrorRange.isValid())
+    return ErrorRange;
+  Fill[VD] = RhsPSet;
+  return SourceRange();
+}
+} // namespace process_lifetime_contracts
+} // namespace clang

clang/lib/Sema/SemaDeclAttr.cpp

 #include "clang/AST/DeclCXX.h"
 #include "clang/AST/DeclObjC.h"
 #include "clang/AST/DeclTemplate.h"
 #include "clang/AST/Expr.h"
 #include "clang/AST/ExprCXX.h"
 #include "clang/AST/Mangle.h"
 #include "clang/AST/RecursiveASTVisitor.h"
 #include "clang/Basic/CharInfo.h"
+#include "clang/Basic/SourceLocation.h"
 #include "clang/Basic/SourceManager.h"
 #include "clang/Basic/TargetBuiltins.h"
 #include "clang/Basic/TargetInfo.h"
 #include "clang/Lex/Preprocessor.h"
 #include "clang/Sema/DeclSpec.h"
 #include "clang/Sema/DelayedDiagnostic.h"
 #include "clang/Sema/Initialization.h"
 #include "clang/Sema/Lookup.h"
if (AL.getKind() == ParsedAttr::AT_Owner) {
     }
     for (Decl *Redecl : D->redecls()) {
       Redecl->addAttr(::new (S.Context)
                           PointerAttr(S.Context, AL, DerefTypeLoc));
     }
   }
 }
 
+
+static void handleLifetimeContractAttr(Sema &S, Decl *D, const ParsedAttr &AL) {
+  LifetimeContractAttr *LCAttr;
+  if (auto *Existing = D->getAttr<LifetimeContractAttr>())
+    LCAttr = Existing;
+  else {
+    LCAttr = LifetimeContractAttr::Create(S.Context, AL.getArgAsExpr(0), AL);
+    D->addAttr(LCAttr);
+    LCAttr->PreContracts = new (S.Context) LifetimeContracts{};
+    LCAttr->PostContracts = new (S.Context) LifetimeContracts{};
+  }
+
+  using namespace process_lifetime_contracts;
+
+  SourceRange ErrorRange;
+  if (AL.getAttributeSpellingListIndex())
+    ErrorRange = fillContractFromExpr(AL.getArgAsExpr(0), *LCAttr->PostContracts);
+  else
+    ErrorRange = fillContractFromExpr(AL.getArgAsExpr(0), *LCAttr->PreContracts);
+
+  if (ErrorRange.isValid())
+    S.Diag(ErrorRange.getBegin(), diag::warn_unsupported_expression)
+        << ErrorRange;
+}
+
 bool Sema::CheckCallingConvAttr(const ParsedAttr &Attrs, CallingConv &CC,
                                 const FunctionDecl *FD) {
   if (Attrs.isInvalid())
     return true;
 
   if (Attrs.hasProcessingCache()) {
     CC = (CallingConv) Attrs.getProcessingCache();
     return false;
case ParsedAttr::AT_AArch64VectorPcs:
     break;
   case ParsedAttr::AT_Suppress:
     handleSuppressAttr(S, D, AL);
     break;
   case ParsedAttr::AT_Owner:
   case ParsedAttr::AT_Pointer:
     handleLifetimeCategoryAttr(S, D, AL);
     break;
+  case ParsedAttr::AT_LifetimeContract:
+    handleLifetimeContractAttr(S, D, AL);
+    break;
   case ParsedAttr::AT_OpenCLKernel:
     handleSimpleAttribute<OpenCLKernelAttr>(S, D, AL);
     break;
   case ParsedAttr::AT_OpenCLAccess:
     handleOpenCLAccessAttr(S, D, AL);
     break;
   case ParsedAttr::AT_OpenCLNoSVM:
     handleOpenCLNoSVMAttr(S, D, AL);
void Sema::ProcessDeclAttributeList(Scope *S, Decl *D,
   // but that looks really pointless. We reject it.
   if (D->hasAttr<WeakRefAttr>() && !D->hasAttr<AliasAttr>()) {
     Diag(AttrList.begin()->getLoc(), diag::err_attribute_weakref_without_alias)
         << cast<NamedDecl>(D);
     D->dropAttr<WeakRefAttr>();
     return;
   }
 
+  if (const auto *LCAttr = D->getAttr<LifetimeContractAttr>()) {
+    if (!getDiagnostics().isIgnored(diag::warn_dump_lifetime_contracts,
+                                    D->getBeginLoc())) {
+      if (const auto *FD = dyn_cast<FunctionDecl>(D))
+        Diag(D->getBeginLoc(), diag::warn_dump_lifetime_contracts)
+            << LCAttr->dumpContracts(FD);
+    }
+  }
+
   // FIXME: We should be able to handle this in TableGen as well. It would be
   // good to have a way to specify "these attributes must appear as a group",
   // for these. Additionally, it would be good to have a way to specify "these
   // attribute must never appear as a group" for attributes like cold and hot.
   if (!D->hasAttr<OpenCLKernelAttr>()) {
     // These attributes cannot be applied to a non-kernel function.
     if (const auto *A = D->getAttr<ReqdWorkGroupSizeAttr>()) {
       // FIXME: This emits a different error message than

clang/lib/Sema/SemaInit.cpp

 //
 //===----------------------------------------------------------------------===//
 
 #include "clang/AST/ASTContext.h"
 #include "clang/AST/DeclObjC.h"
 #include "clang/AST/ExprCXX.h"
 #include "clang/AST/ExprObjC.h"
 #include "clang/AST/ExprOpenMP.h"
+#include "clang/AST/LifetimeAttr.h"
 #include "clang/AST/TypeLoc.h"
 #include "clang/Basic/CharInfo.h"
 #include "clang/Basic/TargetInfo.h"
 #include "clang/Sema/Designator.h"
 #include "clang/Sema/Initialization.h"
 #include "clang/Sema/Lookup.h"
 #include "clang/Sema/SemaInternal.h"
 #include "llvm/ADT/APInt.h"
static bool shouldTrackFirstArgument(const FunctionDecl *FD) {
   } else if (FD->getReturnType()->isReferenceType()) {
     return llvm::StringSwitch<bool>(FD->getName())
         .Cases("get", "any_cast", true)
         .Default(false);
   }
   return false;
 }
 
+static bool shouldTrackContract(const LifetimeContractAttr *LCAttr,
+                                const FunctionDecl *FD,
+                                LifetimeContractVariable CV) {
+  if (!LCAttr || !LCAttr->PostContracts)
+    return false;
+  const LifetimeContracts &PM = *LCAttr->PostContracts;
+  auto It = PM.find(LifetimeContractVariable::returnVal());
+  if (It == PM.end())
+    return false;
+  return It->second.count(CV);
+}
+
+static LifetimeContractAttr *getLifetimeAttr(const FunctionDecl *FD) {
+  if (const auto LCAttr = FD->getAttr<LifetimeContractAttr>()) {
+    // The actual information is stored at primary templates for
+    // specializations.
+    if (const auto *FTD = FD->getPrimaryTemplate()) {
+      assert(FTD->getTemplatedDecl()->hasAttr<LifetimeContractAttr>());
+      return FTD->getTemplatedDecl()->getAttr<LifetimeContractAttr>();
+    }
+    return LCAttr;
+  }
+  return nullptr;
+}
+
+namespace {
+struct CallInfo {
+  FunctionDecl *Callee = nullptr;
+  ArrayRef<Expr *> Args;
+  Expr *ObjectArg = nullptr;
+};
+} // namespace
+
+static CallInfo getCallInfo(Expr *Call) {
+  CallInfo Info;
+  if (auto *CE = dyn_cast<CallExpr>(Call)) {
+    Info.Callee = CE->getDirectCallee();
+    Info.Args = llvm::makeArrayRef(CE->getArgs(), CE->getNumArgs());
+  } else {
+    auto *CCE = cast<CXXConstructExpr>(Call);
+    Info.Callee = CCE->getConstructor();
+    Info.Args = llvm::makeArrayRef(CCE->getArgs(), CCE->getNumArgs());
+  }
+  if (isa<CXXOperatorCallExpr>(Call) && Info.Callee->isCXXInstanceMember()) {
+    Info.ObjectArg = Info.Args[0];
+    Info.Args = Info.Args.slice(1);
+  } else if (auto *MCE = dyn_cast<CXXMemberCallExpr>(Call)) {
+    Info.ObjectArg = MCE->getImplicitObjectArgument();
+  }
+  return Info;
+}
+
 static void handleGslAnnotatedTypes(IndirectLocalPath &Path, Expr *Call,
                                     LocalVisitor Visit) {
   auto VisitPointerArg = [&](const Decl *D, Expr *Arg, bool Value) {
     // We are not interested in the temporary base objects of gsl Pointers:
     //   Temp().ptr; // Here ptr might not dangle.
     if (isa<MemberExpr>(Arg->IgnoreImpCasts()))
       return;
     // Once we initialized a value with a reference, it can no longer dangle.
if (Arg->isGLValue())
                                             Visit,
                                             /*EnableLifetimeWarnings=*/true);
     else
       visitLocalsRetainedByInitializer(Path, Arg, Visit, true,
                                        /*EnableLifetimeWarnings=*/true);
     Path.pop_back();
   };
 
-  if (auto *MCE = dyn_cast<CXXMemberCallExpr>(Call)) {
-    const auto *MD = cast_or_null<CXXMethodDecl>(MCE->getDirectCallee());
-    if (MD && shouldTrackImplicitObjectArg(MD))
-      VisitPointerArg(MD, MCE->getImplicitObjectArgument(),
-                      !MD->getReturnType()->isReferenceType());
-    return;
-  } else if (auto *OCE = dyn_cast<CXXOperatorCallExpr>(Call)) {
-    FunctionDecl *Callee = OCE->getDirectCallee();
-    if (Callee && Callee->isCXXInstanceMember() &&
-        shouldTrackImplicitObjectArg(cast<CXXMethodDecl>(Callee)))
-      VisitPointerArg(Callee, OCE->getArg(0),
-                      !Callee->getReturnType()->isReferenceType());
-    return;
-  } else if (auto *CE = dyn_cast<CallExpr>(Call)) {
-    FunctionDecl *Callee = CE->getDirectCallee();
-    if (Callee && shouldTrackFirstArgument(Callee))
-      VisitPointerArg(Callee, CE->getArg(0),
-                      !Callee->getReturnType()->isReferenceType());
+  CallInfo CI = getCallInfo(Call);
+  if (!CI.Callee)
     return;
-  }
+
+  bool ReturnsRef = CI.Callee->getReturnType()->isReferenceType();
 
   if (auto *CCE = dyn_cast<CXXConstructExpr>(Call)) {
-    const auto *Ctor = CCE->getConstructor();
-    const CXXRecordDecl *RD = Ctor->getParent();
-    if (CCE->getNumArgs() > 0 && RD->hasAttr<PointerAttr>())
-      VisitPointerArg(Ctor->getParamDecl(0), CCE->getArgs()[0], true);
+    const CXXRecordDecl *RD = CCE->getConstructor()->getParent();
+    if (CI.Args.size() > 0 && RD->hasAttr<PointerAttr>())
+      VisitPointerArg(CI.Callee->getParamDecl(0), CI.Args[0], true);
+    return;
+  }
+
+  const auto LCAttr = getLifetimeAttr(CI.Callee);
+  for (unsigned I = 0; I < CI.Args.size() && I < CI.Callee->getNumParams(); ++I)
+    if (shouldTrackContract(LCAttr, CI.Callee, CI.Callee->getParamDecl(I)))
+      VisitPointerArg(CI.Callee, CI.Args[I], !ReturnsRef);
+
+  if (auto *MD = dyn_cast<CXXMethodDecl>(CI.Callee)) {
+    if (shouldTrackImplicitObjectArg(MD) ||
+        shouldTrackContract(LCAttr, CI.Callee,
+                            LifetimeContractVariable::thisVal(MD->getParent())))
+      VisitPointerArg(MD, CI.ObjectArg, !ReturnsRef);
+    return;
+  }
+
+  if (auto *CE = dyn_cast<CallExpr>(Call)) {
+    if (shouldTrackFirstArgument(CI.Callee))
+      VisitPointerArg(CI.Callee, CI.Args[0], !ReturnsRef);
+    return;
   }
 }
 
 static bool implicitObjectParamIsLifetimeBound(const FunctionDecl *FD) {
   const TypeSourceInfo *TSI = FD->getTypeSourceInfo();
   if (!TSI)
     return false;
   // Don't declare this variable in the second operand of the for-statement;
   // GCC miscompiles that by ending its lifetime before evaluating the
   // third operand. See gcc.gnu.org/PR86769.
   AttributedTypeLoc ATL;
   for (TypeLoc TL = TSI->getTypeLoc();
        (ATL = TL.getAsAdjusted<AttributedTypeLoc>());
        TL = ATL.getModifiedLoc()) {
     if (ATL.getAttrAs<LifetimeBoundAttr>())
       return true;
   }
   return false;
 }
 
 static void visitLifetimeBoundArguments(IndirectLocalPath &Path, Expr *Call,
                                         LocalVisitor Visit) {
-  const FunctionDecl *Callee;
-  ArrayRef<Expr*> Args;
-
-  if (auto *CE = dyn_cast<CallExpr>(Call)) {
-    Callee = CE->getDirectCallee();
-    Args = llvm::makeArrayRef(CE->getArgs(), CE->getNumArgs());
-  } else {
-    auto *CCE = cast<CXXConstructExpr>(Call);
-    Callee = CCE->getConstructor();
-    Args = llvm::makeArrayRef(CCE->getArgs(), CCE->getNumArgs());
-  }
-  if (!Callee)
+  CallInfo CI = getCallInfo(Call);
+  if (!CI.Callee)
     return;
 
-  Expr *ObjectArg = nullptr;
-  if (isa<CXXOperatorCallExpr>(Call) && Callee->isCXXInstanceMember()) {
-    ObjectArg = Args[0];
-    Args = Args.slice(1);
-  } else if (auto *MCE = dyn_cast<CXXMemberCallExpr>(Call)) {
-    ObjectArg = MCE->getImplicitObjectArgument();
-  }
-
   auto VisitLifetimeBoundArg = [&](const Decl *D, Expr *Arg) {
     Path.push_back({IndirectLocalPathEntry::LifetimeBoundCall, Arg, D});
     if (Arg->isGLValue())
       visitLocalsRetainedByReferenceBinding(Path, Arg, RK_ReferenceBinding,
                                             Visit,
                                             /*EnableLifetimeWarnings=*/false);
     else
       visitLocalsRetainedByInitializer(Path, Arg, Visit, true,
                                        /*EnableLifetimeWarnings=*/false);
     Path.pop_back();
   };
 
-  if (ObjectArg && implicitObjectParamIsLifetimeBound(Callee))
-    VisitLifetimeBoundArg(Callee, ObjectArg);
+  if (CI.ObjectArg && implicitObjectParamIsLifetimeBound(CI.Callee))
+    VisitLifetimeBoundArg(CI.Callee, CI.ObjectArg);
 
-  for (unsigned I = 0,
-                N = std::min<unsigned>(Callee->getNumParams(), Args.size());
+  for (unsigned I = 0, N = std::min<unsigned>(CI.Callee->getNumParams(),
+                                              CI.Args.size());
        I != N; ++I) {
-    if (Callee->getParamDecl(I)->hasAttr<LifetimeBoundAttr>())
-      VisitLifetimeBoundArg(Callee->getParamDecl(I), Args[I]);
+    if (CI.Callee->getParamDecl(I)->hasAttr<LifetimeBoundAttr>())
+      VisitLifetimeBoundArg(CI.Callee->getParamDecl(I), CI.Args[I]);
   }
 }
 
 /// Visit the locals that would be reachable through a reference bound to the
 /// glvalue expression \c Init.
 static void visitLocalsRetainedByReferenceBinding(IndirectLocalPath &Path,
                                                   Expr *Init, ReferenceKind RK,
                                                   LocalVisitor Visit,

clang/lib/Sema/SemaType.cpp

case ParsedAttr::AT_OpenCLAccess:
       HandleOpenCLAccessAttr(type, attr, state.getSema());
       attr.setUsedAsTypeAttr();
       break;
     case ParsedAttr::AT_LifetimeBound:
       if (TAL == TAL_DeclChunk)
         HandleLifetimeBoundAttr(state, type, attr);
       break;
 
+    // Move function type attribute to the declarator.
+    case ParsedAttr::AT_LifetimeContract:
+      moveAttrFromListToList(attr, state.getCurrentAttributes(),
+                             state.getDeclarator().getAttributes());
+      break;
+
     case ParsedAttr::AT_NoDeref: {
       ASTContext &Ctx = state.getSema().Context;
       type = state.getAttributedType(createSimpleAttr<NoDerefAttr>(Ctx, attr),
                                      type, type);
       attr.setUsedAsTypeAttr();
       state.setParsedNoDeref(true);
       break;
     }

clang/test/Sema/attr-psets-annotation.cpp

+// RUN: %clang_cc1 -fsyntax-only -Wlifetime -Wlifetime-dump-contracts -verify %s
+
+namespace gsl {
+struct null_t {
+  template <typename T>
+  operator T() const;
+} null;
+
+struct global_t {
+  template <typename T>
+  operator T() const;
+} global;
+
+struct invalid_t {
+  template <typename T>
+  operator T() const;
+} invalid;
+
+struct return_t {
+  template <typename T>
+  operator T() const;
+} Return;
+
+template <typename T>
+struct PointerTraits {
+  static auto deref(const T &t) -> decltype(*t);
+};
+
+template <typename T>
+struct PointerTraits<T *> {
+  static const T &deref(const T *t);
+};
+
+struct PSet {
+  PSet(...);
+};
+
+template <typename T>
+auto deref(const T &t) -> decltype(PointerTraits<T>::deref(t));
+
+template <typename T>
+bool lifetime(const T &lhs, const PSet &rhs);
+} // namespace gsl
+
+using namespace gsl;
+
+void basic(int *a, int *b) [[gsl::pre(lifetime(b, {a}))]];
+// expected-warning@-1 {{Pre { b -> { a }; }}}
+
+void specials(int *a, int *b, int *c)
+    [[gsl::pre(lifetime(a, {null}))]]
+    [[gsl::pre(lifetime(b, {global}))]]
+    [[gsl::pre(lifetime(c, {invalid}))]];
+// expected-warning@-4 {{Pre { a -> { null }; b -> { global }; c -> { invalid }; }}}
+
+void variadic(int *a, int *b, int *c)
+    [[gsl::pre(lifetime(b, {a, c}))]];
+// expected-warning@-2 {{Pre { b -> { a c }; }}}
+
+void variadic_special(int *a, int *b, int *c)
+    [[gsl::pre(lifetime(b, {a, null}))]];
+// expected-warning@-2 {{Pre { b -> { null a }; }}}
+
+void multiple_annotations(int *a, int *b, int *c)
+    [[gsl::pre(lifetime(b, {a}))]]
+    [[gsl::pre(lifetime(c, {a}))]];
+// expected-warning@-3 {{Pre { b -> { a }; c -> { a }; }}}
+
+void multiple_annotations_chained(int *a, int *b, int *c)
+    [[gsl::pre(lifetime(b, {a}))]]
+    [[gsl::pre(lifetime(c, {b}))]];
+// expected-warning@-3 {{Pre { b -> { a }; c -> { a }; }}}
+
+void deref_ptr(int *a, int *b, int **c)
+    [[gsl::pre(lifetime(deref(c), {a}))]];
+// expected-warning@-2 {{Pre { *c -> { a }; }}}
+
+void deref_ptr_pointee(int *a, int *b, int **c)
+    [[gsl::pre(lifetime(a, {deref(c)}))]];
+// expected-warning@-2 {{Pre { a -> { *c }; }}}
+
+void deref_ref(int *a, int *b, int *&c)
+    [[gsl::pre(lifetime(deref(c), {a}))]];
+// expected-warning@-2 {{Pre { *c -> { a }; }}}
+
+void deref_ref_pointee(int *a, int *b, int *&c)
+    [[gsl::pre(lifetime(a, {deref(c)}))]];
+// expected-warning@-2 {{Pre { a -> { *c }; }}}
+
+struct [[gsl::Owner(void)]] X {
+  void f(X **out)
+      [[gsl::post(lifetime(deref(out), {this}))]];
+  // expected-warning@-2 {{Pre { }  Post { *out -> { this }; }}}
+  X *operator+(const X& other)
+      [[gsl::post(lifetime(Return, {other}))]];
+  // expected-warning@-2 {{Pre { }  Post { (return value) -> { other }; }}}
+};
+
+template <typename It, typename T>
+It find(It begin, It end, const T &val)
+    [[gsl::pre(lifetime(end, {begin}))]]
+    [[gsl::post(lifetime(Return, {begin}))]];
+// expected-warning@-3 {{Pre { end -> { begin }; }  Post { (return value) -> { begin }; }}}
+
+int *find_nontemp(int *begin, int *end, const int &val)
+    [[gsl::pre(lifetime(end, {begin}))]]
+    [[gsl::post(lifetime(Return, {begin}))]];
+// expected-warning@-3 {{Pre { end -> { begin }; }  Post { (return value) -> { begin }; }}}
+
+struct [[gsl::Owner(int)]] MyOwner {
+  int *begin()
+      [[gsl::post(lifetime(Return, {this}))]];
+  // expected-warning@-2 {{Pre { }  Post { (return value) -> { this }; }}}
+  int *end()
+      [[gsl::post(lifetime(Return, {this}))]];
+  // expected-warning@-2 {{Pre { }  Post { (return value) -> { this }; }}}
+};
+
+void testGslWarning() {
+  int *res = find(MyOwner{}.begin(), MyOwner{}.end(), 5);
+  // expected-warning@-1 {{object backing the pointer will be destroyed at the end of the full-expression}}
+  (void)res;
+  int *res2 = find_nontemp(MyOwner{}.begin(), MyOwner{}.end(), 5);
+  // expected-warning@-1 {{object backing the pointer will be destroyed at the end of the full-expression}}
+  (void)res2;
+  X x;
+  // TODO: this should work without X annotated as owner.
+  X *xp = x + X{};
+  // expected-warning@-1 {{object backing the pointer will be destroyed at the end of the full-expression}}
+  (void)xp;
+}