[cxx-interop] Require lifetime annotations in safe mode

In strict safe mode we should consider all C++ APIs with non-escapable
parameters unsafe unless they have their lifetimes annotated. This can
be done using [[clang::lifetimebound]], [[clang::lifetime_capture_by]],
or [[clang::noescape]].

Author: Gabor Horvath

lib/ClangImporter/ImportDecl.cpp

@@ -3980,8 +3980,8 @@ namespace {
       if (decl->getTemplatedKind() == clang::FunctionDecl::TK_FunctionTemplate)
         return;
 
-      if (!result->getASTContext().LangOpts.hasFeature(
-              Feature::LifetimeDependence))
+      auto &ASTContext = result->getASTContext();
+      if (!ASTContext.LangOpts.hasFeature(Feature::LifetimeDependence))
         return;
 
       SmallVector<LifetimeDependenceInfo, 1> lifetimeDependencies;
@@ -4013,9 +4013,11 @@ namespace {
       const auto dependencyVecSize = swiftParams->size() + hasSelf;
       SmallBitVector inheritLifetimeParamIndicesForReturn(dependencyVecSize);
       SmallBitVector scopedLifetimeParamIndicesForReturn(dependencyVecSize);
+      SmallBitVector paramHasAnnotation(dependencyVecSize);
       std::map<unsigned, SmallBitVector> inheritedArgDependences;
       auto processLifetimeBound = [&](unsigned idx, Type ty) {
         warnForEscapableReturnType();
+        paramHasAnnotation[idx] = true;
         if (ty->isEscapable())
           scopedLifetimeParamIndicesForReturn[idx] = true;
         else
@@ -4039,6 +4041,7 @@ namespace {
                   param == clang::LifetimeCaptureByAttr::INVALID)
                 continue;
 
+              paramHasAnnotation[idx] = true;
               if (isa<clang::CXXMethodDecl>(decl) &&
                   param == clang::LifetimeCaptureByAttr::THIS) {
                 auto [it, inserted] = inheritedArgDependences.try_emplace(
@@ -4110,6 +4113,19 @@ namespace {
             LifetimeDependenceInfoRequest{result},
             Impl.SwiftContext.AllocateCopy(lifetimeDependencies));
       }
+      if (ASTContext.LangOpts.hasFeature(Feature::AllowUnsafeAttribute) &&
+          ASTContext.LangOpts.hasFeature(Feature::SafeInterop)) {
+        for (auto [idx, param] : llvm::enumerate(decl->parameters())) {
+          if (swiftParams->get(idx)->getInterfaceType()->isEscapable())
+            continue;
+          if (param->hasAttr<clang::NoEscapeAttr>() || paramHasAnnotation[idx])
+            continue;
+          // We have a nonescapabe parameter that does not have its lifetime
+          // annotated nor is it marked noescape.
+          auto attr = new (ASTContext) UnsafeAttr(/*implicit=*/true);
+          result->getAttrs().add(attr);
+        }
+      }
       Impl.diagnoseTargetDirectly(decl);
     }
 

test/Interop/Cxx/class/safe-interop-mode.swift

@@ -61,6 +61,10 @@ using VecOfInt = std::vector<int>;
 using SafeTuple = std::tuple<int, int, int>;
 using UnsafeTuple = std::tuple<int, int*, int>;
 
+View safeFunc(View v1 [[clang::noescape]], View v2 [[clang::lifetimebound]]);
+// Second non-escapable type is not annotated in any way.
+void unsafeFunc(View v1 [[clang::noescape]], View v2);
+
 //--- test.swift
 
 import Test
@@ -112,3 +116,12 @@ func useCppSpan(x: SpanOfInt) { // expected-note{{reference to unsafe type alias
 // expected-warning@+1{{global function 'useCppSpan2' has an interface that is not memory-safe}}
 func useCppSpan2(x: SpanOfIntAlias) { // expected-note{{reference to unsafe type alias 'SpanOfIntAlias'}}
 }
+
+func useSafeLifetimeAnnotated(v: View) {
+    let _ = safeFunc(v, v)
+}
+
+func useUnsafeLifetimeAnnotated(v: View) {
+    // expected-warning@+1{{expression uses unsafe constructs but is not marked with 'unsafe'}}
+    unsafeFunc(v, v) // expected-note{{reference to unsafe global function 'unsafeFunc'}}
+}