Suppress strict safety diagnostics in @unsafe declarations

When a declaration is `@unsafe`, don't emit strict safety diagnostics
for uses of unsafe entities, constructs, or types within it. This
allows one to account for all unsafe behavior in a module using strict
memory safety by marking the appropriate declarations `@unsafe`.

Enhance the strict-safety diagnostics to suggest the addition of
`@unsafe` where it is needed to suppress them, with a Fix-It. Ensure
that all such diagnostics can be suppressed via `@unsafe` so it's
possible to get to the above state.

Also includes a drive-by bug fix where we weren't diagnosing unsafe
methods overriding safe ones in some cases.

Fixes rdar://139467327.

Author: DougGregor

include/swift/AST/AvailabilityContext.h

@@ -86,6 +86,10 @@ class AvailabilityContext {
   /// Returns true if this context is `@_unavailableInEmbedded`.
   bool isUnavailableInEmbedded() const;
 
+  /// Returns true if this context allows the use of unsafe constructs inside
+  /// it.
+  bool allowsUnsafe() const;
+
   /// Constrain with another `AvailabilityContext`.
   void constrainWithContext(const AvailabilityContext &other, ASTContext &ctx);
 

include/swift/AST/AvailabilityContextStorage.h

@@ -43,6 +43,10 @@ struct AvailabilityContext::PlatformInfo {
   /// platform.
   unsigned IsDeprecated : 1;
 
+  /// Whether or not the context allows unsafe code within it, e.g., via the
+  /// `@unsafe` attribute.
+  unsigned AllowsUnsafe: 1;
+
   /// Sets each field to the value of the corresponding field in `other` if the
   /// other is more restrictive. Returns true if any field changed as a result
   /// of adding this constraint.
@@ -63,6 +67,7 @@ struct AvailabilityContext::PlatformInfo {
     ID.AddBoolean(IsUnavailableInEmbedded);
     ID.AddInteger(static_cast<uint8_t>(UnavailablePlatform));
     ID.AddBoolean(IsDeprecated);
+    ID.AddBoolean(AllowsUnsafe);
   }
 };
 

include/swift/AST/Decl.h

@@ -1191,6 +1191,10 @@ class alignas(1 << DeclAlignInBits) Decl : public ASTAllocated<Decl>, public Swi
   /// used in a "safe" dialect.
   bool isUnsafe() const;
 
+  /// Whether this declaration explicitly states that it is allowed to contain
+  /// unsafe code.
+  bool allowsUnsafe() const;
+
 private:
   bool isUnsafeComputed() const {
     return Bits.Decl.IsUnsafeComputed;
@@ -1908,6 +1912,7 @@ class ExtensionDecl final : public GenericContext, public Decl,
   friend class Decl;
 public:
   using Decl::getASTContext;
+  using Decl::allowsUnsafe;
 
   /// Create a new extension declaration.
   static ExtensionDecl *create(ASTContext &ctx, SourceLoc extensionLoc,
@@ -3380,6 +3385,7 @@ class GenericTypeDecl : public GenericContext, public TypeDecl {
   using DeclContext::operator new;
   using DeclContext::operator delete;
   using TypeDecl::getDeclaredInterfaceType;
+  using Decl::allowsUnsafe;
 
   static bool classof(const DeclContext *C) {
     if (auto D = C->getAsDecl())

include/swift/AST/DeclAttr.def

@@ -504,7 +504,7 @@ SIMPLE_DECL_ATTR(sensitive, Sensitive,
   159)
 
 SIMPLE_DECL_ATTR(unsafe, Unsafe,
-  OnAbstractFunction | OnSubscript | OnVar | OnMacro | OnNominalType |
+  OnAbstractFunction | OnSubscript | OnVar | OnMacro | OnNominalType | OnExtension |
   UserInaccessible |
   ABIStableToAdd | ABIStableToRemove | APIBreakingToAdd | APIStableToRemove,
   160)

include/swift/AST/DeclContext.h

@@ -713,6 +713,10 @@ class alignas(1 << DeclContextAlignInBits) DeclContext
   /// target. Used for conformance lookup disambiguation.
   bool isAlwaysAvailableConformanceContext() const;
 
+  /// Determines whether this context is explicitly allowed to use unsafe
+  /// constructs.
+  bool allowsUnsafe() const;
+
   /// \returns true if traversal was aborted, false otherwise.
   bool walkContext(ASTWalker &Walker);
 

include/swift/AST/DiagnosticsSema.def

@@ -8091,6 +8091,15 @@ GROUPED_WARNING(reference_to_unsafe_typed_decl,Unsafe,none,
       (bool, const ValueDecl *, Type))
 NOTE(unsafe_decl_here,none,
      "unsafe %kindbase0 declared here", (const ValueDecl *))
+NOTE(make_enclosing_context_unsafe,none,
+     "mark the enclosing %kindbase0 '@unsafe' to allow it to use unsafe constructs",
+     (const Decl *))
+NOTE(make_subclass_unsafe,none,
+     "mark the class %0 '@unsafe' to allow unsafe overrides of safe superclass methods",
+     (DeclName))
+NOTE(make_conforming_context_unsafe,none,
+     "mark the enclosing %0 with '@unsafe' to allow unsafe conformance to protocol %1",
+     (DescriptiveDeclKind, DeclName))
 
 //===----------------------------------------------------------------------===//
 // MARK: Value Generics

lib/AST/AvailabilityContext.cpp

@@ -46,6 +46,7 @@ bool AvailabilityContext::PlatformInfo::constrainWith(
         CONSTRAIN_BOOL(IsUnavailableInEmbedded, other.IsUnavailableInEmbedded);
   }
   isConstrained |= CONSTRAIN_BOOL(IsDeprecated, other.IsDeprecated);
+  isConstrained |= CONSTRAIN_BOOL(AllowsUnsafe, other.AllowsUnsafe);
 
   return isConstrained;
 }
@@ -63,6 +64,7 @@ bool AvailabilityContext::PlatformInfo::constrainWith(const Decl *decl) {
   }
 
   isConstrained |= CONSTRAIN_BOOL(IsDeprecated, decl->isDeprecated());
+  isConstrained |= CONSTRAIN_BOOL(AllowsUnsafe, decl->allowsUnsafe());
 
   return isConstrained;
 }
@@ -128,7 +130,8 @@ AvailabilityContext::forPlatformRange(const AvailabilityRange &range,
   PlatformInfo platformInfo{range, PlatformKind::none,
                             /*IsUnavailable*/ false,
                             /*IsUnavailableInEmbedded*/ false,
-                            /*IsDeprecated*/ false};
+                            /*IsDeprecated*/ false,
+                            /*AllowsUnsafe*/ false};
   return AvailabilityContext(Storage::get(platformInfo, ctx));
 }
 
@@ -151,7 +154,8 @@ AvailabilityContext::get(const AvailabilityRange &platformAvailability,
                                 ? *unavailablePlatform
                                 : PlatformKind::none,
                             unavailablePlatform.has_value(),
-                            /*IsUnavailableInEmbedded*/ false, deprecated};
+                            /*IsUnavailableInEmbedded*/ false, deprecated,
+                            /*AllowsUnsafe*/ false};
   return AvailabilityContext(Storage::get(platformInfo, ctx));
 }
 
@@ -170,6 +174,10 @@ bool AvailabilityContext::isUnavailableInEmbedded() const {
   return Info->Platform.IsUnavailableInEmbedded;
 }
 
+bool AvailabilityContext::allowsUnsafe() const {
+  return Info->Platform.AllowsUnsafe;
+}
+
 bool AvailabilityContext::isDeprecated() const {
   return Info->Platform.IsDeprecated;
 }

lib/AST/Decl.cpp

@@ -1079,6 +1079,10 @@ bool Decl::isUnsafe() const {
       false);
 }
 
+bool Decl::allowsUnsafe() const {
+  return isUnsafe();
+}
+
 Type AbstractFunctionDecl::getThrownInterfaceType() const {
   if (!getThrownTypeRepr())
     return ThrownType.getType();

lib/AST/DeclContext.cpp

@@ -1549,3 +1549,10 @@ bool DeclContext::isAlwaysAvailableConformanceContext() const {
 
   return deploymentTarget.isContainedIn(conformanceAvailability);
 }
+
+bool DeclContext::allowsUnsafe() const {
+  if (auto decl = getAsDecl())
+    return decl->allowsUnsafe();
+
+  return false;
+}

lib/Sema/AssociatedTypeInference.cpp

@@ -366,9 +366,11 @@ static void recordTypeWitness(NormalProtocolConformance *conformance,
     diagnoseUnsafeType(ctx,
                        loc,
                        type,
+                       conformance->getDeclContext(),
                        [&](Type specificType) {
       ctx.Diags.diagnose(
           loc, diag::type_witness_unsafe, specificType, assocType->getName());
+      suggestUnsafeMarkerOnConformance(conformance);
       assocType->diagnose(diag::decl_declared_here, assocType);
     });
   }