[Macros] Ban freestanding and peer macro expansions that can produce arbitrary

names at global scope.

Freestanding and peer macros applied at top-level scope cannot introduce
arbitrary names. Introducing arbitrary names means that any lookup
into this scope must expand the macro. This is a problem, because
resolving the macro can invoke type checking other declarations, e.g.
anything that the macro arguments depend on. If _anything_ the macro
depends on performs name unqualified name lookup, e.g. type resolution,
we'll get circularity errors. It's better to prevent this by banning
these macros at global scope if any of the macro candidates introduce
arbitrary names.

Author: hborla

include/swift/AST/DiagnosticsSema.def

@@ -7188,6 +7188,10 @@ ERROR(macro_accessor_missing_from_expansion,none,
 ERROR(macro_init_accessor_not_documented,none,
       "expansion of macro %0 produced an unexpected 'init' accessor",
       (DeclName))
+ERROR(global_arbitrary_name,none,
+      "'%0' macros are not allowed to introduce arbitrary names "
+      "at global scope",
+      (StringRef))
 
 ERROR(macro_resolve_circular_reference, none,
       "circular reference resolving %select{freestanding|attached}0 macro %1",

lib/Sema/TypeCheckMacros.cpp

@@ -1470,6 +1470,40 @@ swift::expandConformances(CustomAttr *attr, MacroDecl *macro,
   return macroSourceFile->getBufferID();
 }
 
+/// Emits an error and returns \c true if the maro reference may
+/// introduce arbitrary names at global scope.
+static bool diagnoseArbitraryGlobalNames(DeclContext *dc,
+                                         UnresolvedMacroReference macroRef,
+                                         MacroRole macroRole) {
+  auto &ctx = dc->getASTContext();
+  assert(macroRole == MacroRole::Declaration ||
+         macroRole == MacroRole::Peer);
+
+  if (!dc->isModuleScopeContext())
+    return false;
+
+  bool isInvalid = false;
+  namelookup::forEachPotentialResolvedMacro(
+      dc, macroRef.getMacroName(), macroRole,
+      [&](MacroDecl *decl, const MacroRoleAttr *attr) {
+        if (!isInvalid &&
+            attr->hasNameKind(MacroIntroducedDeclNameKind::Arbitrary)) {
+          ctx.Diags.diagnose(macroRef.getSigilLoc(),
+                             diag::global_arbitrary_name,
+                             getMacroRoleString(macroRole));
+          isInvalid = true;
+
+          // If this is an attached macro, mark the attribute as invalid
+          // to avoid diagnosing an unknown attribute later.
+          if (auto *attr = macroRef.getAttr()) {
+            attr->setInvalid();
+          }
+        }
+      });
+
+  return isInvalid;
+}
+
 ConcreteDeclRef ResolveMacroRequest::evaluate(Evaluator &evaluator,
                                               UnresolvedMacroReference macroRef,
                                               DeclContext *dc) const {
@@ -1492,6 +1526,19 @@ ConcreteDeclRef ResolveMacroRequest::evaluate(Evaluator &evaluator,
       return ConcreteDeclRef();
   }
 
+  // Freestanding and peer macros applied at top-level scope cannot introduce
+  // arbitrary names. Introducing arbitrary names means that any lookup
+  // into this scope must expand the macro. This is a problem, because
+  // resolving the macro can invoke type checking other declarations, e.g.
+  // anything that the macro arguments depend on. If _anything_ the macro
+  // depends on performs name unqualified name lookup, e.g. type resolution,
+  // we'll get circularity errors. It's better to prevent this by banning
+  // these macros at global scope if any of the macro candidates introduce
+  // arbitrary names.
+  if (diagnoseArbitraryGlobalNames(dc, macroRef, MacroRole::Declaration) ||
+      diagnoseArbitraryGlobalNames(dc, macroRef, MacroRole::Peer))
+    return ConcreteDeclRef();
+
   // If we already have a MacroExpansionExpr, use that. Otherwise,
   // create one.
   MacroExpansionExpr *macroExpansion;

test/Macros/macro_expand_peers.swift

@@ -162,6 +162,16 @@ struct S2 {
   #endif
 }
 
+#if TEST_DIAGNOSTICS
+// Peer macros cannot introduce arbitrary names at global scope
+
+//expected-error@+1 {{'peer' macros are not allowed to introduce arbitrary names at global scope}}
+@addCompletionHandlerArbitrarily(x)
+func h(a: Int, for b: String, _ value: Double) async -> String {
+  return b
+}
+#endif
+
 // Stored properties generated by a peer macro
 @attached(accessor)
 @attached(peer, names: prefixed(_))

test/Macros/top_level_freestanding.swift

@@ -72,13 +72,17 @@ struct HasInnerClosure {
   #freestandingWithClosure(1) { x in x }
 }
 
+#if TEST_DIAGNOSTICS
 // Arbitrary names at global scope
 
 #bitwidthNumberedStructs("MyIntGlobal")
+// expected-error@-1 {{'declaration' macros are not allowed to introduce arbitrary names at global scope}}
 
 func testArbitraryAtGlobal() {
   _ = MyIntGlobal16()
+  // expected-error@-1 {{cannot find 'MyIntGlobal16' in scope}}
 }
+#endif
 
 // DIAG_BUFFERS-DAG: @__swiftmacro_9MacroUser33_{{.*}}9stringifyfMf1_{{.*}}warning: 'deprecated()' is deprecated
 // DIAG_BUFFERS-DAG: @__swiftmacro_9MacroUser33_{{.*}}9stringifyfMf2_{{.*}}warning: 'deprecated()' is deprecated