Sema: Check access, availability, and exportability of availability domains.

Teach Sema to diagnose the access level, exportability, and availability of
availability domains that are referenced by `@available` attributes and
`if #available` statements.

Resolves rdar://159147207.

Author: tshortli

include/swift/AST/DiagnosticsSema.def

@@ -6989,6 +6989,17 @@ WARNING(attr_availability_expected_version_spec, none,
 ERROR(attr_availability_requires_custom_availability, none,
       "%0 requires '-enable-experimental-feature CustomAvailability'",
       (AvailabilityDomain))
+ERROR(attr_availability_domain_access, none,
+      "availability domain '%0' is "
+      "%select{private|fileprivate|internal|package|%error|%error}1 "
+      "and cannot be used in '%2' on "
+      "%select{private|fileprivate|internal|package|public|%error}3 %kind4",
+      (AvailabilityDomain, AccessLevel, DeclAttribute, AccessLevel,
+       const Decl *))
+ERROR(attr_availability_domain_not_usable_from_inline, none,
+      "availability domain '%0' used in '%1' on %kind2 must be "
+      "'@usableFromInline' or public",
+      (AvailabilityDomain, DeclAttribute, const Decl *))
 
 ERROR(availability_decl_unavailable, none,
       "%0 is unavailable%select{ in %2|}1%select{|: %3}3",

lib/Sema/TypeCheckAccess.cpp

@@ -28,6 +28,7 @@
 #include "swift/AST/Import.h"
 #include "swift/AST/ParameterList.h"
 #include "swift/AST/Pattern.h"
+#include "swift/AST/PrettyStackTrace.h"
 #include "swift/AST/TypeCheckRequests.h"
 #include "swift/Basic/Assertions.h"
 #include "clang/AST/DeclCXX.h"
@@ -70,10 +71,22 @@ static void forAllRequirementTypes(
 using CheckTypeAccessCallback =
     void(AccessScope, const TypeRepr *, DowngradeToWarning, ImportAccessLevel);
 
+using CheckDeclAccessCallback = void(AccessScope, SourceLoc, ImportAccessLevel);
+
 class AccessControlCheckerBase {
 protected:
   bool checkUsableFromInline;
 
+  bool shouldSkipChecking(const ValueDecl *decl);
+
+  /// Returns true if access checking ought to be skipped for the given
+  /// `AccessScope`.
+  bool shouldSkipAccessCheckingInContext(AccessScope contextAccessScope,
+                                         const ASTContext &ctx);
+
+  ImportAccessLevel getImportAccessForDecl(const ValueDecl *decl,
+                                           const DeclContext *useDC);
+
   void checkTypeAccessImpl(
       Type type, TypeRepr *typeRepr, AccessScope contextAccessScope,
       const DeclContext *useDC, bool mayBeInferred,
@@ -102,6 +115,12 @@ class AccessControlCheckerBase {
     });
   }
 
+  void checkAvailabilityDomains(const Decl *D);
+
+  void checkDeclAccess(SourceLoc loc, const ValueDecl *decl,
+                       AccessScope contextAccessScope, const DeclContext *useDC,
+                       llvm::function_ref<CheckDeclAccessCallback> diagnose);
+
   AccessControlCheckerBase(bool checkUsableFromInline)
       : checkUsableFromInline(checkUsableFromInline) {}
 
@@ -117,10 +136,50 @@ class AccessControlCheckerBase {
     const ValueDecl *ownerDecl);
 
   void checkGlobalActorAccess(const Decl *D);
+
+  void checkAvailabilityDomains(const Decl *D, AccessScope accessScope,
+                                AccessLevel contextAccess);
 };
 
 } // end anonymous namespace
 
+bool AccessControlCheckerBase::shouldSkipChecking(const ValueDecl *decl) {
+  if (!checkUsableFromInline)
+    return false;
+
+  if (decl->getFormalAccess() != AccessLevel::Internal &&
+      decl->getFormalAccess() != AccessLevel::Package)
+    return true;
+  return !decl->isUsableFromInline();
+}
+
+bool AccessControlCheckerBase::shouldSkipAccessCheckingInContext(
+    AccessScope contextAccessScope, const ASTContext &ctx) {
+  if (ctx.isAccessControlDisabled())
+    return true;
+
+  // Don't spend time checking local declarations; this is always valid by the
+  // time we get to this point.
+  if (contextAccessScope.isInContext() &&
+      contextAccessScope.getDeclContext()->isLocalContext())
+    return true;
+
+  return false;
+}
+
+ImportAccessLevel
+AccessControlCheckerBase::getImportAccessForDecl(const ValueDecl *decl,
+                                                 const DeclContext *useDC) {
+  auto complainImport = decl->getImportAccessFrom(useDC);
+
+  // Don't complain about an import that doesn't restrict the access
+  // level of the decl. This can happen with imported `package` decls.
+  if (complainImport && complainImport->accessLevel >= decl->getFormalAccess())
+    return std::nullopt;
+
+  return complainImport;
+}
+
 /// Searches the given type representation for a `DeclRefTypeRepr` that is
 /// bound to a type declaration with the given access scope. The type
 /// representation is searched in source order. For example, nodes in
@@ -201,12 +260,7 @@ void AccessControlCheckerBase::checkTypeAccessImpl(
     llvm::function_ref<CheckTypeAccessCallback> diagnose) {
 
   auto &Context = useDC->getASTContext();
-  if (Context.isAccessControlDisabled())
-    return;
-  // Don't spend time checking local declarations; this is always valid by the
-  // time we get to this point.
-  if (contextAccessScope.isInContext() &&
-      contextAccessScope.getDeclContext()->isLocalContext())
+  if (shouldSkipAccessCheckingInContext(contextAccessScope, Context))
     return;
 
   // Report where it was imported from.
@@ -229,7 +283,7 @@ void AccessControlCheckerBase::checkTypeAccessImpl(
         return TypeWalker::Action::Continue;
       }));
     }
-  };
+  }
 
   AccessScope problematicAccessScope = AccessScope::getPublic();
 
@@ -307,19 +361,36 @@ void AccessControlCheckerBase::checkTypeAccessImpl(
     const ValueDecl *VD = complainRepr->getBoundDecl();
     assert(VD &&
            "findTypeDeclWithAccessScope should return bound TypeReprs only");
-    complainImport = VD->getImportAccessFrom(useDC);
-
-    // Don't complain about an import that doesn't restrict the access
-    // level of the decl. This can happen with imported `package` decls.
-    if (complainImport.has_value() &&
-        complainImport->accessLevel >= VD->getFormalAccess())
-      complainImport = std::nullopt;
+    complainImport = getImportAccessForDecl(VD, useDC);
   }
 
   diagnose(problematicAccessScope, complainRepr, downgradeToWarning,
            complainImport);
 }
 
+void AccessControlCheckerBase::checkDeclAccess(
+    SourceLoc loc, const ValueDecl *decl, AccessScope contextAccessScope,
+    const DeclContext *useDC,
+    llvm::function_ref<CheckDeclAccessCallback> diagnose) {
+
+  auto &ctx = useDC->getASTContext();
+  if (shouldSkipAccessCheckingInContext(contextAccessScope, ctx))
+    return;
+
+  recordRequiredImportAccessLevelForDecl(
+      decl, useDC, contextAccessScope.accessLevelForDiagnostics(), loc);
+
+  AccessScope declAccessScope =
+      decl->getFormalAccessScope(useDC, checkUsableFromInline);
+  if (contextAccessScope.hasEqualDeclContextWith(declAccessScope) ||
+      contextAccessScope.isChildOf(declAccessScope))
+    return;
+
+  // The reference to the decl violates the rules of access control.
+  ImportAccessLevel complainImport = getImportAccessForDecl(decl, useDC);
+  diagnose(declAccessScope, loc, complainImport);
+}
+
 /// Checks if the access scope of the type described by \p TL is valid for the
 /// type to be the type of \p context. If it isn't, calls \p diagnose with a
 /// TypeRepr representing the offending part of \p TL.
@@ -556,6 +627,50 @@ void AccessControlCheckerBase::checkGlobalActorAccess(const Decl *D) {
       });
 }
 
+void AccessControlCheckerBase::checkAvailabilityDomains(
+    const Decl *D, AccessScope accessScope, AccessLevel contextAccess) {
+  auto &ctx = D->getASTContext();
+  for (auto attr : D->getSemanticAvailableAttrs()) {
+    if (auto *domainDecl = attr.getDomain().getDecl()) {
+      checkDeclAccess(
+          attr.getParsedAttr()->getDomainLoc(), domainDecl, accessScope,
+          D->getDeclContext(),
+          [&](AccessScope domainAccessScope, SourceLoc useLoc,
+              ImportAccessLevel importLimit) {
+            // FIXME: [availability] Improve diagnostics by indicating the decl
+            // that the formal access is implied by. Enum cases, associated
+            // types, protocol requirements, etc. inherit their access level
+            // from their context.
+
+            if (checkUsableFromInline) {
+              ctx.Diags.diagnose(
+                  useLoc, diag::attr_availability_domain_not_usable_from_inline,
+                  attr.getDomain(), attr.getParsedAttr(), D);
+              noteLimitingImport(nullptr, ctx, importLimit, domainDecl);
+              return;
+            }
+
+            ctx.Diags.diagnose(useLoc, diag::attr_availability_domain_access,
+                               attr.getDomain(),
+                               domainAccessScope.accessLevelForDiagnostics(),
+                               attr.getParsedAttr(), contextAccess, D);
+            noteLimitingImport(nullptr, ctx, importLimit, domainDecl);
+          });
+    }
+  }
+}
+
+void AccessControlCheckerBase::checkAvailabilityDomains(const Decl *D) {
+  auto VD = dyn_cast<ValueDecl>(D->getAbstractSyntaxDeclForAttributes());
+  if (!VD || shouldSkipChecking(VD))
+    return;
+
+  AccessScope contextAccessScope =
+      VD->getFormalAccessScope(VD->getDeclContext(), checkUsableFromInline);
+
+  checkAvailabilityDomains(VD, contextAccessScope, VD->getFormalAccess());
+}
+
 namespace {
 class AccessControlChecker : public AccessControlCheckerBase,
                              public DeclVisitor<AccessControlChecker> {
@@ -573,6 +688,7 @@ class AccessControlChecker : public AccessControlCheckerBase,
 
     DeclVisitor<AccessControlChecker>::visit(D);
     checkGlobalActorAccess(D);
+    checkAvailabilityDomains(D);
   }
 
   // Force all kinds to be handled at a lower level.
@@ -1321,13 +1437,6 @@ class UsableFromInlineChecker : public AccessControlCheckerBase,
   UsableFromInlineChecker()
       : AccessControlCheckerBase(/*checkUsableFromInline=*/true) {}
 
-  static bool shouldSkipChecking(const ValueDecl *VD) {
-    if (VD->getFormalAccess() != AccessLevel::Internal &&
-        VD->getFormalAccess() != AccessLevel::Package)
-      return true;
-    return !VD->isUsableFromInline();
-  };
-
   void visit(Decl *D) {
     if (!D->getASTContext().isSwiftVersionAtLeast(4, 2))
       return;
@@ -1341,6 +1450,7 @@ class UsableFromInlineChecker : public AccessControlCheckerBase,
 
     DeclVisitor<UsableFromInlineChecker>::visit(D);
     checkGlobalActorAccess(D);
+    checkAvailabilityDomains(D);
   }
 
   // Force all kinds to be handled at a lower level.
@@ -2139,10 +2249,22 @@ class DeclAvailabilityChecker : public DeclVisitor<DeclAvailabilityChecker> {
     }
   }
 
+  void checkAvailabilityDomains(const Decl *D) {
+    D = D->getAbstractSyntaxDeclForAttributes();
+    for (auto attr : D->getSemanticAvailableAttrs()) {
+      if (auto *domainDecl = attr.getDomain().getDecl()) {
+        diagnoseDeclAvailability(domainDecl,
+                                 attr.getParsedAttr()->getDomainLoc(), nullptr,
+                                 Where, std::nullopt);
+      }
+    }
+  }
+
   void visit(Decl *D) {
     DeclVisitor<DeclAvailabilityChecker>::visit(D);
     checkGlobalActor(D);
     checkAttachedMacros(D);
+    checkAvailabilityDomains(D);
   }
 
   // Force all kinds to be handled at a lower level.
@@ -2372,14 +2494,10 @@ class DeclAvailabilityChecker : public DeclVisitor<DeclAvailabilityChecker> {
   }
 
   void checkConstrainedExtensionRequirements(ExtensionDecl *ED,
-                                             bool hasExportedMembers) {
+                                             ExportabilityReason reason) {
     if (!ED->getTrailingWhereClause())
       return;
 
-    ExportabilityReason reason =
-        hasExportedMembers ? ExportabilityReason::ExtensionWithPublicMembers
-                           : ExportabilityReason::ExtensionWithConditionalConformances;
-
     forAllRequirementTypes(ED, [&](Type type, TypeRepr *typeRepr) {
       checkType(type, typeRepr, ED, reason,
                 DeclAvailabilityFlag::DisableUnsafeChecking);
@@ -2423,7 +2541,23 @@ class DeclAvailabilityChecker : public DeclVisitor<DeclAvailabilityChecker> {
     // the 'where' clause must only name exported types.
     Where = wasWhere.withExported(hasExportedMembers ||
                                   !ED->getInherited().empty());
-    checkConstrainedExtensionRequirements(ED, hasExportedMembers);
+    ExportabilityReason reason =
+        hasExportedMembers
+            ? ExportabilityReason::ExtensionWithPublicMembers
+            : ExportabilityReason::ExtensionWithConditionalConformances;
+    checkConstrainedExtensionRequirements(ED, reason);
+
+    // Diagnose the exportability of the availability domains referenced by the
+    // @available attributes attached to the extension.
+    if (Where.isExported()) {
+      for (auto availableAttr : ED->getSemanticAvailableAttrs()) {
+        if (auto *domainDecl = availableAttr.getDomain().getDecl()) {
+          TypeChecker::diagnoseDeclRefExportability(
+              availableAttr.getParsedAttr()->getDomainLoc(), domainDecl,
+              Where.withReason(reason));
+        }
+      }
+    }
 
     // If we haven't already visited the extended nominal visit it here.
     // This logic is too wide but prevents false reports of an unused public
@@ -2491,7 +2625,7 @@ class DeclAvailabilityChecker : public DeclVisitor<DeclAvailabilityChecker> {
 
 } // end anonymous namespace
 
-static void checkExtensionGenericParamAccess(const ExtensionDecl *ED) {
+static void checkExtensionAccess(const ExtensionDecl *ED) {
   auto *AA = ED->getAttrs().getAttribute<AccessControlAttr>();
   if (!AA)
     return;
@@ -2522,8 +2656,11 @@ static void checkExtensionGenericParamAccess(const ExtensionDecl *ED) {
     break;
   }
 
-  AccessControlChecker().checkGenericParamAccess(
-      ED, ED, desiredAccessScope, userSpecifiedAccess);
+  auto accessChecker = AccessControlChecker();
+  accessChecker.checkGenericParamAccess(ED, ED, desiredAccessScope,
+                                        userSpecifiedAccess);
+  accessChecker.checkAvailabilityDomains(ED, desiredAccessScope,
+                                         userSpecifiedAccess);
 }
 
 DisallowedOriginKind swift::getDisallowedOriginKind(const Decl *decl,
@@ -2659,13 +2796,10 @@ void swift::checkAccessControl(Decl *D) {
     AccessControlChecker(allowInlineable).visit(D);
     UsableFromInlineChecker().visit(D);
   } else if (auto *ED = dyn_cast<ExtensionDecl>(D)) {
-    checkExtensionGenericParamAccess(ED);
+    checkExtensionAccess(ED);
     registerPackageAccessForPackageExtendedType(ED);
   }
 
-  if (isa<AccessorDecl>(D))
-    return;
-
   auto where = ExportContext::forDeclSignature(D);
   if (where.isImplicit())
     return;

lib/Sema/TypeCheckAttr.cpp

@@ -563,6 +563,9 @@ void AttributeChecker::visitSensitiveAttr(SensitiveAttr *attr) {
 }
 
 void AttributeChecker::visitTransparentAttr(TransparentAttr *attr) {
+  if (attr->isImplicit())
+    return;
+
   DeclContext *dc = D->getDeclContext();
   // Protocol declarations cannot be transparent.
   if (isa<ProtocolDecl>(dc))

lib/Sema/TypeCheckDeclPrimary.cpp

@@ -3719,11 +3719,11 @@ class DeclChecker : public DeclVisitor<DeclChecker> {
         TypeChecker::checkProtocolSelfRequirements(FD);
       }
 
-      checkAccessControl(FD);
-
       TypeChecker::checkParameterList(FD->getParameters(), FD);
     }
 
+    checkAccessControl(FD);
+
     TypeChecker::checkDeclAttributes(FD);
     TypeChecker::checkDistributedFunc(FD);