Sema: Embedded functions are fragile unless marked otherwise

xymus · xymus · commit 1b086e1bfc7d · 2025-10-14T14:14:54.000-07:00
Consider functions in embedded mode to be fragile unless marked with
`@_neverEmitIntoClient`. Basically treating them as if they were
`@_alwaysEmitIntoClient` by default. A fragile function cannot reference
restricted imports such as `@_implementationOnly`, `internal import`,
etc.

We consider them as fragile only for type-checking, at the SIL level
they remain treated as normal functions like before. This allows the
later optimization to work as expected. We may want to likely align both
ends of the compiler once this is properly supported in sema.

This is enabled only in embedded. Fragile functions in library-evolution
are marked with attributes and are already checked. We do not need this
is non-embedded non-library-evolution as CMO handles inlining and
already takes into consideration `@_implementationOnly` imports.

Note: We'll need a similar check for memory layouts exposed to clients.
We can still see compiler crashes and miscompiles in this scenario. This
will apply to both embedded and non-library-evolution modes. That will
likely need to extend the `@_neverEmitIntoClient` attribute and may
require a staged deployment.

rdar://161365361
diff --git a/include/swift/AST/DeclContext.h b/include/swift/AST/DeclContext.h
@@ -202,7 +202,7 @@ struct ConformanceDiagnostic {
   ProtocolDecl *ExistingExplicitProtocol;
 };
 
-/// Used in diagnostic %selects.
+/// Used in diagnostic %selects via FRAGILE_FUNC_KIND.
 struct FragileFunctionKind {
   enum Kind : unsigned {
     Transparent,
@@ -211,6 +211,7 @@ struct FragileFunctionKind {
     DefaultArgument,
     PropertyInitializer,
     BackDeploy,
+    EmbeddedAlwaysEmitIntoClient,
     None
   };
 
diff --git a/include/swift/AST/DiagnosticsSema.def b/include/swift/AST/DiagnosticsSema.def
@@ -7312,7 +7312,8 @@ ERROR(usable_from_inline_attr_in_protocol,none,
   "an '@_alwaysEmitIntoClient' function|" \
   "a default argument value|" \
   "a property initializer in a '@frozen' type|" \
-  "a '@backDeployed' function'}"
+  "a '@backDeployed' function|" \
+  "an embedded function not marked '@_neverEmitIntoClient'}"
 
 ERROR(local_type_in_inlinable_function,
       none, "type %0 cannot be nested inside " FRAGILE_FUNC_KIND "1",
diff --git a/lib/AST/DeclContext.cpp b/lib/AST/DeclContext.cpp
@@ -488,6 +488,11 @@ ResilienceExpansion DeclContext::getResilienceExpansion() const {
   case FragileFunctionKind::PropertyInitializer:
   case FragileFunctionKind::BackDeploy:
     return ResilienceExpansion::Minimal;
+
+  /// Embedded functions are treated as fragile for diagnostics only.
+  /// For code gen they are treated as normal and optimized later.
+  case FragileFunctionKind::EmbeddedAlwaysEmitIntoClient:
+
   case FragileFunctionKind::None:
     return ResilienceExpansion::Maximal;
   }
@@ -551,14 +556,32 @@ swift::FragileFunctionKindRequest::evaluate(Evaluator &evaluator,
       if (AFD->getDeclContext()->isLocalContext())
         continue;
 
+      // Delay checking the implicit conditions after explicit declarations.
+      auto checkEmbeddedAlwaysEmitIntoClient = [&](const ValueDecl *VD) {
+        if (!VD->getASTContext().LangOpts.hasFeature(Feature::Embedded))
+          return FragileFunctionKind::None;
+
+        bool funcIsNEIC = VD->isNeverEmittedIntoClient();
+        bool storageIsNEIC = false;
+        if (auto accessor = dyn_cast<AccessorDecl>(VD))
+          storageIsNEIC = accessor->getStorage()->isNeverEmittedIntoClient();
+
+        // Accessors are implicitly EmbeddedAlwaysEmitIntoClient if neither the
+        // accessor or starage is marked @_neverEmitIntoClient.
+        if (!funcIsNEIC && !storageIsNEIC)
+            return FragileFunctionKind::EmbeddedAlwaysEmitIntoClient;
+        return FragileFunctionKind::None;
+      };
+
       auto funcAccess =
         AFD->getFormalAccessScope(/*useDC=*/nullptr,
                                   /*treatUsableFromInlineAsPublic=*/true);
 
       // If the function is not externally visible, we will not be serializing
       // its body.
       if (!funcAccess.isPublic()) {
-        return {FragileFunctionKind::None};
+        // For non-public decls, only check embedded mode correctness.
+        return {checkEmbeddedAlwaysEmitIntoClient(AFD)};
       }
 
       // If the function is public, @_transparent implies @inlinable.
@@ -592,6 +615,10 @@ swift::FragileFunctionKindRequest::evaluate(Evaluator &evaluator,
           return {FragileFunctionKind::BackDeploy};
         }
       }
+
+      auto implicitKind = checkEmbeddedAlwaysEmitIntoClient(AFD);
+      if (implicitKind != FragileFunctionKind::None)
+        return {implicitKind};
     }
   }
 
diff --git a/lib/AST/TypeCheckRequests.cpp b/lib/AST/TypeCheckRequests.cpp
@@ -687,6 +687,9 @@ void swift::simple_display(llvm::raw_ostream &out,
   case FragileFunctionKind::BackDeploy:
     out << "backDeploy";
     return;
+  case FragileFunctionKind::EmbeddedAlwaysEmitIntoClient:
+    out << "embeddedAlwaysEmitIntoClient";
+    return;
   case FragileFunctionKind::None:
     out << "none";
     return;
diff --git a/lib/Sema/ResilienceDiagnostics.cpp b/lib/Sema/ResilienceDiagnostics.cpp
@@ -97,6 +97,14 @@ bool TypeChecker::diagnoseInlinableDeclRefAccess(SourceLoc loc,
     return false;
   }
 
+  // Embedded functions can reference non-public decls as they are visible
+  // to clients. Still report references to decls imported non-publicly
+  // to enforce access-level on imports.
+  ImportAccessLevel problematicImport = D->getImportAccessFrom(DC);
+  if (fragileKind.kind == FragileFunctionKind::EmbeddedAlwaysEmitIntoClient &&
+      !problematicImport)
+    return false;
+
   DowngradeToWarning downgradeToWarning = DowngradeToWarning::No;
 
   // Swift 4.2 did not perform any checks for type aliases.
@@ -127,7 +135,6 @@ bool TypeChecker::diagnoseInlinableDeclRefAccess(SourceLoc loc,
 
   Context.Diags.diagnose(D, diag::resilience_decl_declared_here, D);
 
-  ImportAccessLevel problematicImport = D->getImportAccessFrom(DC);
   if (problematicImport.has_value() &&
       problematicImport->accessLevel < D->getFormalAccess()) {
     Context.Diags.diagnose(problematicImport->importLoc,
diff --git a/test/Sema/access-level-import-embedded.swift b/test/Sema/access-level-import-embedded.swift
@@ -0,0 +1,181 @@
+/// Test @_implementationOnly internal import exportability diagnostics in embedded mode.
+
+// RUN: %empty-directory(%t)
+// RUN: %target-swift-frontend -emit-module -o %t/indirects.swiftmodule \
+// RUN:   %S/Inputs/implementation-only-imports/indirects.swift \
+// RUN:   -swift-version 5 -target arm64-apple-macosx15.0 \
+// RUN:   -enable-experimental-feature Embedded
+// RUN: %target-swift-frontend -emit-module -o %t/directs.swiftmodule -I %t \
+// RUN:   %S/Inputs/implementation-only-imports/directs.swift \
+// RUN:   -swift-version 5 -target arm64-apple-macosx15.0 \
+// RUN:   -enable-experimental-feature Embedded
+
+// RUN: %target-swift-frontend -typecheck -verify %s -I %t \
+// RUN:   -swift-version 5 -target arm64-apple-macosx15.0 \
+// RUN:   -enable-experimental-feature Embedded
+
+// REQUIRES: swift_feature_Embedded
+
+@_implementationOnly internal import directs
+// expected-warning @-1 {{using '@_implementationOnly' without enabling library evolution for 'main' may lead to instability during execution}}
+// expected-note @-2 19 {{struct 'StructFromDirect' imported as 'internal' from 'directs' here}}
+// expected-note @-3 12 {{initializer 'init()' imported as 'internal' from 'directs' here}}
+import indirects
+
+internal func localInternalFunc() {} // expected-note {{global function 'localInternalFunc()' is not '@usableFromInline' or public}}
+
+@inlinable
+public func explicitlyInlinable(arg: StructFromDirect = StructFromDirect()) {
+// expected-error @-1 {{initializer 'init()' is internal and cannot be referenced from a default argument value}}
+// expected-error @-2 {{struct 'StructFromDirect' is internal and cannot be referenced from a default argument value}}
+// expected-error @-3 {{struct 'StructFromDirect' is internal and cannot be referenced from an '@inlinable' function}}
+// expected-error @-4 {{function cannot be declared public because its parameter uses an internal type}}
+// expected-note @-5 {{struct 'StructFromDirect' is imported by this file as 'internal' from 'directs'}}
+  _ = StructFromDirect() // expected-error {{initializer 'init()' is internal and cannot be referenced from an '@inlinable' function}}
+  // expected-error@-1 {{struct 'StructFromDirect' is internal and cannot be referenced from an '@inlinable' function}}
+
+  if (true) {
+    _ = StructFromDirect() // expected-error {{initializer 'init()' is internal and cannot be referenced from an '@inlinable' function}}
+    // expected-error@-1 {{struct 'StructFromDirect' is internal and cannot be referenced from an '@inlinable' function}}
+  }
+
+  func nested() {
+    _ = StructFromDirect() // expected-error {{initializer 'init()' is internal and cannot be referenced from an '@inlinable' function}}
+    // expected-error@-1 {{struct 'StructFromDirect' is internal and cannot be referenced from an '@inlinable' function}}
+  }
+  nested()
+
+  localInternalFunc() // expected-error {{global function 'localInternalFunc()' is internal and cannot be referenced from an '@inlinable' function}}
+
+  explicitlyInlinable()
+  implicitlyInlinablePublic()
+  implicitlyInlinablePrivate() // expected-error {{global function 'implicitlyInlinablePrivate(arg:)' is private and cannot be referenced from an '@inlinable' function}}
+  explicitNonInliable()
+}
+
+public func implicitlyInlinablePublic(arg: StructFromDirect = StructFromDirect()) {
+// expected-error @-1 {{initializer 'init()' is internal and cannot be referenced from a default argument value}}
+// expected-error @-2 {{struct 'StructFromDirect' is internal and cannot be referenced from a default argument value}}
+// expected-error @-3 {{struct 'StructFromDirect' is internal and cannot be referenced from an embedded function not marked '@_neverEmitIntoClient'}}
+// expected-error @-4 {{function cannot be declared public because its parameter uses an internal type}}
+// expected-note @-5 {{struct 'StructFromDirect' is imported by this file as 'internal' from 'directs'}}
+  _ = StructFromDirect() // expected-error {{initializer 'init()' is internal and cannot be referenced from an embedded function not marked '@_neverEmitIntoClient'}}
+  // expected-error@-1 {{struct 'StructFromDirect' is internal and cannot be referenced from an embedded function not marked '@_neverEmitIntoClient'}}
+
+  if (true) {
+    _ = StructFromDirect() // expected-error {{initializer 'init()' is internal and cannot be referenced from an embedded function not marked '@_neverEmitIntoClient'}}
+    // expected-error@-1 {{struct 'StructFromDirect' is internal and cannot be referenced from an embedded function not marked '@_neverEmitIntoClient'}}
+  }
+
+  func nested() {
+    _ = StructFromDirect() // expected-error {{initializer 'init()' is internal and cannot be referenced from an embedded function not marked '@_neverEmitIntoClient'}}
+    // expected-error@-1 {{struct 'StructFromDirect' is internal and cannot be referenced from an embedded function not marked '@_neverEmitIntoClient'}}
+  }
+  nested()
+
+  localInternalFunc()
+
+  explicitlyInlinable()
+  implicitlyInlinablePublic()
+  implicitlyInlinablePrivate()
+  explicitNonInliable()
+}
+
+private func implicitlyInlinablePrivate(arg: StructFromDirect = StructFromDirect()) {
+// expected-error @-1 {{struct 'StructFromDirect' is internal and cannot be referenced from an embedded function not marked '@_neverEmitIntoClient'}}
+// expected-note @-2 {{global function 'implicitlyInlinablePrivate(arg:)' is not '@usableFromInline' or public}}
+  _ = StructFromDirect() // expected-error {{initializer 'init()' is internal and cannot be referenced from an embedded function not marked '@_neverEmitIntoClient'}}
+  // expected-error@-1 {{struct 'StructFromDirect' is internal and cannot be referenced from an embedded function not marked '@_neverEmitIntoClient'}}
+
+  if (true) {
+    _ = StructFromDirect() // expected-error {{initializer 'init()' is internal and cannot be referenced from an embedded function not marked '@_neverEmitIntoClient'}}
+    // expected-error@-1 {{struct 'StructFromDirect' is internal and cannot be referenced from an embedded function not marked '@_neverEmitIntoClient'}}
+  }
+
+  func nested() {
+    _ = StructFromDirect() // expected-error {{initializer 'init()' is internal and cannot be referenced from an embedded function not marked '@_neverEmitIntoClient'}}
+    // expected-error@-1 {{struct 'StructFromDirect' is internal and cannot be referenced from an embedded function not marked '@_neverEmitIntoClient'}}
+  }
+  nested()
+
+  localInternalFunc()
+
+  explicitlyInlinable()
+  implicitlyInlinablePublic()
+  implicitlyInlinablePrivate()
+  explicitNonInliable()
+}
+
+@_neverEmitIntoClient
+public func explicitNonInliable(arg: StructFromDirect = StructFromDirect()) {
+// expected-error @-1 {{initializer 'init()' is internal and cannot be referenced from a default argument value}}
+// expected-error @-2 {{struct 'StructFromDirect' is internal and cannot be referenced from a default argument value}}
+// expected-error @-3 {{cannot use struct 'StructFromDirect' here; 'directs' has been imported as implementation-only}}
+// expected-error @-4 {{function cannot be declared public because its parameter uses an internal type}}
+// expected-note @-5 {{struct 'StructFromDirect' is imported by this file as 'internal' from 'directs'}}
+  _ = StructFromDirect()
+
+  if (true) {
+    _ = StructFromDirect()
+  }
+
+  @_neverEmitIntoClient
+  func nested() {
+    _ = StructFromDirect()
+  }
+  nested()
+
+  localInternalFunc()
+
+  explicitlyInlinable()
+  implicitlyInlinablePublic()
+  implicitlyInlinablePrivate()
+  explicitNonInliable()
+}
+
+@_neverEmitIntoClient
+internal func explicitNonInliableInternal(arg: StructFromDirect = StructFromDirect()) {
+  _ = StructFromDirect()
+
+  if (true) {
+    _ = StructFromDirect()
+  }
+
+  @_neverEmitIntoClient
+  func nested() {
+    _ = StructFromDirect()
+  }
+  nested()
+
+  localInternalFunc()
+
+  explicitlyInlinable()
+  implicitlyInlinablePublic()
+  implicitlyInlinablePrivate()
+  explicitNonInliable()
+}
+
+public func legalAccessToIndirect(arg: StructFromIndirect = StructFromIndirect()) {
+  _ = StructFromIndirect()
+
+  if (true) {
+    _ = StructFromIndirect()
+  }
+
+  func nested() {
+    _ = StructFromIndirect()
+  }
+  nested()
+}
+
+public struct ExposedLayoutPublic {
+  public var publicField: StructFromDirect // expected-error {{property cannot be declared public because its type uses an internal type}}
+  // expected-error @-1 {{cannot use struct 'StructFromDirect' here; 'directs' has been imported as implementation-only}}
+  // expected-note @-2 {{struct 'StructFromDirect' is imported by this file as 'internal' from 'directs'}}
+
+  private var privateField: StructFromDirect
+}
+
+private struct ExposedLayoutPrivate {
+  private var privateField: StructFromDirect
+}
diff --git a/test/Sema/implementation-only-import-embedded.swift b/test/Sema/implementation-only-import-embedded.swift
diff --git a/test/embedded/implementation-only-import-build.swift b/test/embedded/implementation-only-import-build.swift
diff --git a/test/embedded/linkage/implementation_only_hiding.swift b/test/embedded/linkage/implementation_only_hiding.swift
