[all-commits] [llvm/llvm-project] d1e84b: Thread Safety Analysis: Support attributes on func...

[Marco Elver via All-commits]

  Branch: refs/heads/main
  Home:   https://github.com/llvm/llvm-project
  Commit: d1e84bb9ad3b6a844cd902cf70e2764cb8126979
      https://github.com/llvm/llvm-project/commit/d1e84bb9ad3b6a844cd902cf70e2764cb8126979
  Author: Marco Elver <elver at google.com>
  Date:   2026-05-04 (Mon, 04 May 2026)

  Changed paths:
    M clang/docs/ReleaseNotes.rst
    M clang/docs/ThreadSafetyAnalysis.rst
    M clang/include/clang/Basic/Attr.td
    M clang/include/clang/Basic/DiagnosticSemaKinds.td
    M clang/include/clang/Sema/Sema.h
    M clang/lib/Analysis/ThreadSafetyCommon.cpp
    M clang/lib/Parse/ParseDecl.cpp
    M clang/lib/Sema/SemaDeclAttr.cpp
    M clang/lib/Sema/SemaTemplateInstantiate.cpp
    M clang/lib/Sema/SemaTemplateInstantiateDecl.cpp
    M clang/test/Sema/attr-capabilities.c
    M clang/test/Sema/warn-thread-safety-analysis.c
    M clang/test/SemaCXX/warn-thread-safety-analysis.cpp
    M clang/test/SemaCXX/warn-thread-safety-parsing.cpp
    M clang/utils/TableGen/ClangAttrEmitter.cpp

  Log Message:
  -----------
  Thread Safety Analysis: Support attributes on function pointers (#191187)

Allow acquire_capability, release_capability, requires_capability,
try_acquire_capability, assert_capability, and locks_excluded attributes
(incl. their shared variants) on function pointer variables and struct
fields. Calls through annotated function pointers are checked the same
way as direct function calls.

The attributes are placed on variable/field declarations, not on the
function pointer type itself. This is a deliberate trade-off: making
these "attributes" part of the type system would require diagnosing
mismatched assignments, which would be a significant type-system
extension with limited practical benefit, which would likely require
promoting the TSA vocabulary to full type-qualifiers. Instead, the
analysis trusts the annotations on the variable at the call site, and
sticks with the attribute-based semantics. This matches the existing
philosophy where the analysis tries to avoid false positives where
possible and attribute mismatches on direct functions are likewise not
hard errors or warnings (yet).

The primary motivation is to avoid false positives in large C codebases,
such as the Linux kernel [1], which tend to use structs containing
function pointers to emulate subtype polymorphism and dynamic dispatch.

[1] https://lore.kernel.org/all/20260409064221.GA8378@lst.de/



To unsubscribe from these emails, change your notification settings at https://github.com/llvm/llvm-project/settings/notifications