Add -require-explicit-sendable to warn about non-Sendable public types

Introduce a compiler flag that warnings about any public types defined in
a module that are neither explicitly `Sendable` nor explicitly
non-`Sendable` (the latter of which has no spelling currently), which
is intended to help with auditing a module for Sendable conformances.

Author: DougGregor

include/swift/AST/DiagnosticsSema.def

@@ -1949,6 +1949,15 @@ NOTE(non_sendable_nominal,none,
 NOTE(add_nominal_sendable_conformance,none,
      "consider making %0 %1 conform to the 'Sendable' protocol",
      (DescriptiveDeclKind, DeclName))
+WARNING(public_decl_needs_sendable,none,
+        "public %0 %1 does not specify whether it is 'Sendable' or not",
+        (DescriptiveDeclKind, DeclName))
+NOTE(explicit_unchecked_sendable,none,
+     "add '@unchecked Sendable' conformance to %0 %1 if this type manually implements concurrency safety",
+     (DescriptiveDeclKind, DeclName))
+NOTE(explicit_disable_sendable,none,
+     "make %0 %1 explicitly non-Sendable to suppress this warning",
+     (DescriptiveDeclKind, DeclName))
 
 NOTE(required_by_opaque_return,none,
     "required by opaque return type of %0 %1", (DescriptiveDeclKind, DeclName))

include/swift/Basic/LangOptions.h

@@ -176,6 +176,9 @@ namespace swift {
     // Availability macros definitions to be expanded at parsing.
     SmallVector<std::string, 4> AvailabilityMacros;
 
+    /// Require public declarations to declare that they are Sendable (or not).
+    bool RequireExplicitSendable = false;
+
     /// If false, '#file' evaluates to the full path rather than a
     /// human-readable string.
     bool EnableConcisePoundFile = false;

include/swift/Option/Options.td

@@ -413,6 +413,10 @@ def require_explicit_availability_target : Separate<["-"], "require-explicit-ava
   HelpText<"Suggest fix-its adding @available(<target>, *) to public declarations without availability">,
   MetaVarName<"<target>">;
 
+def require_explicit_sendable : Flag<["-"], "require-explicit-sendable">,
+  Flags<[FrontendOption, NoInteractiveOption]>,
+  HelpText<"Require explicit Sendable annotations on public declarations">;
+
 def define_availability : Separate<["-"], "define-availability">,
   Flags<[FrontendOption, NoInteractiveOption]>,
   HelpText<"Define an availability macro in the format 'macroName : iOS 13.0, macOS 10.15'">,

lib/Driver/ToolChains.cpp

@@ -233,6 +233,7 @@ void ToolChain::addCommonFrontendArgs(const OutputInfo &OI,
   inputArgs.AddLastArg(arguments, options::OPT_enable_library_evolution);
   inputArgs.AddLastArg(arguments, options::OPT_require_explicit_availability);
   inputArgs.AddLastArg(arguments, options::OPT_require_explicit_availability_target);
+  inputArgs.AddLastArg(arguments, options::OPT_require_explicit_sendable);
   inputArgs.AddLastArg(arguments, options::OPT_enable_testing);
   inputArgs.AddLastArg(arguments, options::OPT_enable_private_imports);
   inputArgs.AddLastArg(arguments, options::OPT_g_Group);

lib/Frontend/CompilerInvocation.cpp

@@ -573,6 +573,7 @@ static bool ParseLangArgs(LangOptions &Opts, ArgList &Args,
     }
   }
 
+  Opts.RequireExplicitSendable |= Args.hasArg(OPT_require_explicit_sendable);
   for (const Arg *A : Args.filtered(OPT_define_availability)) {
     Opts.AvailabilityMacros.push_back(A->getValue());
   }

lib/Sema/TypeCheckConcurrency.cpp

@@ -553,11 +553,32 @@ bool swift::isSendableType(ModuleDecl *module, Type type) {
       });
 }
 
+/// Add Fix-It text for the given nominal type to adopt Sendable.
+static void addSendableFixIt(
+    const NominalTypeDecl *nominal, InFlightDiagnostic &diag, bool unchecked) {
+  if (nominal->getInherited().empty()) {
+    SourceLoc fixItLoc = nominal->getBraces().Start;
+    if (unchecked)
+      diag.fixItInsert(fixItLoc, ": @unchecked Sendable");
+    else
+      diag.fixItInsert(fixItLoc, ": Sendable");
+  } else {
+    ASTContext &ctx = nominal->getASTContext();
+    SourceLoc fixItLoc = nominal->getInherited().back().getSourceRange().End;
+    fixItLoc = Lexer::getLocForEndOfToken(ctx.SourceMgr, fixItLoc);
+    if (unchecked)
+      diag.fixItInsert(fixItLoc, ", @unchecked Sendable");
+    else
+      diag.fixItInsert(fixItLoc, ", Sendable");
+  }
+}
+
 /// Produce a diagnostic for a single instance of a non-Sendable type where
 /// a Sendable type is required.
 static bool diagnoseSingleNonSendableType(
     Type type, ModuleDecl *module, SourceLoc loc,
-    llvm::function_ref<bool(Type, DiagnosticBehavior)> diagnose) {
+    llvm::function_ref<
+      std::pair<DiagnosticBehavior, bool>(Type, DiagnosticBehavior)> diagnose) {
 
   auto behavior = DiagnosticBehavior::Unspecified;
 
@@ -594,23 +615,20 @@ static bool diagnoseSingleNonSendableType(
     behavior = DiagnosticBehavior::Warning;
   }
 
-  bool wasError = diagnose(type, behavior);
+  DiagnosticBehavior actualBehavior;
+  bool wasError;
+  std::tie(actualBehavior, wasError) = diagnose(type, behavior);
 
-  if (type->is<FunctionType>()) {
+  if (actualBehavior == DiagnosticBehavior::Ignore) {
+    // Don't emit any other diagnostics.
+  } else if (type->is<FunctionType>()) {
     ctx.Diags.diagnose(loc, diag::nonsendable_function_type);
   } else if (nominal && nominal->getParentModule() == module &&
              (isa<StructDecl>(nominal) || isa<EnumDecl>(nominal))) {
     auto note = nominal->diagnose(
         diag::add_nominal_sendable_conformance,
         nominal->getDescriptiveKind(), nominal->getName());
-    if (nominal->getInherited().empty()) {
-      SourceLoc fixItLoc = nominal->getBraces().Start;
-      note.fixItInsert(fixItLoc, ": Sendable ");
-    } else {
-      SourceLoc fixItLoc = nominal->getInherited().back().getSourceRange().End;
-      fixItLoc = Lexer::getLocForEndOfToken(ctx.SourceMgr, fixItLoc);
-      note.fixItInsert(fixItLoc, ", Sendable");
-    }
+    addSendableFixIt(nominal, note, /*unchecked=*/false);
   } else if (nominal) {
     nominal->diagnose(
         diag::non_sendable_nominal, nominal->getDescriptiveKind(),
@@ -622,7 +640,8 @@ static bool diagnoseSingleNonSendableType(
 
 bool swift::diagnoseNonSendableTypes(
     Type type, ModuleDecl *module, SourceLoc loc,
-    llvm::function_ref<bool(Type, DiagnosticBehavior)> diagnose) {
+    llvm::function_ref<
+      std::pair<DiagnosticBehavior, bool>(Type, DiagnosticBehavior)> diagnose) {
   // If the Sendable protocol is missing, do nothing.
   auto proto = module->getASTContext().getProtocol(KnownProtocolKind::Sendable);
   if (!proto)
@@ -710,6 +729,81 @@ void swift::diagnoseMissingSendableConformance(
       type, module, loc, diag::non_sendable_type);
 }
 
+static bool checkSendableInstanceStorage(
+    NominalTypeDecl *nominal, DeclContext *dc, SendableCheck check);
+
+void swift::diagnoseMissingExplicitSendable(NominalTypeDecl *nominal) {
+  // Only diagnose when explicitly requested.
+  ASTContext &ctx = nominal->getASTContext();
+  if (!ctx.LangOpts.RequireExplicitSendable)
+    return;
+
+  if (nominal->getLoc().isInvalid())
+    return;
+
+  // Protocols aren't checked.
+  if (isa<ProtocolDecl>(nominal))
+    return;
+
+  // Actors are always Sendable.
+  if (auto classDecl = dyn_cast<ClassDecl>(nominal))
+    if (classDecl->isActor())
+      return;
+
+  // Only public/open types have this check.
+  if (!nominal->getFormalAccessScope(
+        /*useDC=*/nullptr,
+        /*treatUsableFromInlineAsPublic=*/true).isPublic())
+    return;
+
+  // FIXME: Check for explicit "do not conform to Sendable" marker.
+
+  // Look for any conformance to `Sendable`.
+  auto proto = ctx.getProtocol(KnownProtocolKind::Sendable);
+  if (!proto)
+    return;
+
+  SmallVector<ProtocolConformance *, 2> conformances;
+  if (nominal->lookupConformance(proto, conformances))
+    return;
+
+  // Diagnose it.
+  nominal->diagnose(
+      diag::public_decl_needs_sendable, nominal->getDescriptiveKind(),
+      nominal->getName());
+
+  // Note to add a Sendable conformance, possibly an unchecked one.
+  {
+    bool isUnchecked = false;
+
+    // Non-final classes can only have @unchecked.
+    if (auto classDecl = dyn_cast<ClassDecl>(nominal)) {
+      if (!classDecl->isFinal())
+        isUnchecked = true;
+    }
+
+    // NOTE: We might need to introduce a conditional conformance here.
+    if (!isUnchecked &&
+        checkSendableInstanceStorage(
+            nominal, nominal, SendableCheck::Implicit)) {
+      isUnchecked = true;
+    }
+
+    auto note = nominal->diagnose(
+        isUnchecked ? diag::explicit_unchecked_sendable
+                    : diag::add_nominal_sendable_conformance,
+        nominal->getDescriptiveKind(), nominal->getName());
+    addSendableFixIt(nominal, note, isUnchecked);
+  }
+
+  // Note to disable the warning.
+  nominal->diagnose(
+      diag::explicit_disable_sendable, nominal->getDescriptiveKind(),
+      nominal->getName())
+    .fixItInsert(nominal->getAttributeInsertionLoc(/*forModifier=*/false),
+                 "@_nonSendable ");
+}
+
 /// Determine whether this is the main actor type.
 /// FIXME: the diagnostics engine has a copy of this.
 static bool isMainActor(Type type) {
@@ -3413,13 +3507,16 @@ static bool checkSendableInstanceStorage(
               [&](Type type, DiagnosticBehavior suggestedBehavior) {
                 auto action = limitSendableInstanceBehavior(
                     langOpts, check, suggestedBehavior);
+                if (check == SendableCheck::Implicit)
+                  return action;
+
                 property->diagnose(diag::non_concurrent_type_member,
                                    false, property->getName(),
                                    nominal->getDescriptiveKind(),
                                    nominal->getName(),
                                    propertyType)
                     .limitBehavior(action.first);
-                return action.second;
+                return action;
               });
 
       if (diagnosedProperty) {
@@ -3450,13 +3547,16 @@ static bool checkSendableInstanceStorage(
               [&](Type type, DiagnosticBehavior suggestedBehavior) {
                 auto action = limitSendableInstanceBehavior(
                     langOpts, check, suggestedBehavior);
+                if (check == SendableCheck::Implicit)
+                  return action;
+
                 element->diagnose(diag::non_concurrent_type_member,
                                   true, element->getName(),
                                   nominal->getDescriptiveKind(),
                                   nominal->getName(),
                                   type)
                     .limitBehavior(action.first);
-                return action.second;
+                return action;
               });
 
         if (diagnosedElement) {

lib/Sema/TypeCheckConcurrency.h

@@ -245,6 +245,10 @@ bool diagnoseNonSendableTypesInReference(
 void diagnoseMissingSendableConformance(
     SourceLoc loc, Type type, ModuleDecl *module);
 
+/// If the given nominal type is public and does not explicitly
+/// state whether it conforms to Sendable, provide a diagnostic.
+void diagnoseMissingExplicitSendable(NominalTypeDecl *nominal);
+
 /// Diagnose any non-Sendable types that occur within the given type, using
 /// the given diagnostic.
 ///
@@ -255,7 +259,8 @@ void diagnoseMissingSendableConformance(
 /// \returns \c true if any diagnostics were produced, \c false otherwise.
 bool diagnoseNonSendableTypes(
     Type type, ModuleDecl *module, SourceLoc loc,
-    llvm::function_ref<bool(Type, DiagnosticBehavior)> diagnose);
+    llvm::function_ref<
+      std::pair<DiagnosticBehavior, bool>(Type, DiagnosticBehavior)> diagnose);
 
 namespace detail {
   template<typename T>
@@ -276,7 +281,8 @@ bool diagnoseNonSendableTypes(
       type, module, loc, [&](Type specificType, DiagnosticBehavior behavior) {
     ctx.Diags.diagnose(loc, diag, type, diagArgs...)
       .limitBehavior(behavior);
-    return behavior == DiagnosticBehavior::Unspecified;
+    return std::pair<DiagnosticBehavior, bool>(
+        behavior, behavior == DiagnosticBehavior::Unspecified);
   });
 }
 

lib/Sema/TypeCheckDeclPrimary.cpp

@@ -2207,7 +2207,7 @@ class DeclChecker : public DeclVisitor<DeclChecker> {
       visit(member);
 
     checkInheritanceClause(ED);
-
+    diagnoseMissingExplicitSendable(ED);
     checkAccessControl(ED);
 
     TypeChecker::checkPatternBindingCaptures(ED);
@@ -2257,6 +2257,7 @@ class DeclChecker : public DeclVisitor<DeclChecker> {
     TypeChecker::checkPatternBindingCaptures(SD);
 
     checkInheritanceClause(SD);
+    diagnoseMissingExplicitSendable(SD);
 
     checkAccessControl(SD);
 
@@ -2508,6 +2509,7 @@ class DeclChecker : public DeclVisitor<DeclChecker> {
     }
 
     checkInheritanceClause(CD);
+    diagnoseMissingExplicitSendable(CD);
 
     checkAccessControl(CD);
 

test/Concurrency/concurrent_value_inference.swift

@@ -10,7 +10,7 @@ struct S1 {
   var c: C2
 }
 
-enum E1 { // expected-note{{consider making enum 'E1' conform to the 'Sendable' protocol}}{{9-9=: Sendable }}
+enum E1 { // expected-note {{consider making enum 'E1' conform to the 'Sendable' protocol}}{{9-9=: Sendable}}
   case base
   indirect case nested(E1)
 }