Model "unsafe" global actor isolation.

With "unsafe" global actor isolation, we only enforce actor isolation
when interacting with other explicitly-isolated code. This allows some
code to be annotated with, e.g., `@MainActor(unsafe)` so that users
who opt into concurrency get proper diagnostics, but existing code
does not change.

Author: DougGregor

include/swift/AST/ActorIsolation.h

@@ -56,6 +56,10 @@ class ActorIsolation {
     /// The declaration is isolated to a global actor. It can refer to other
     /// entities with the same global actor.
     GlobalActor,
+    /// The declaration is isolated to a global actor but with the "unsafe"
+    /// annotation, which means that we only enforce the isolation if we're
+    /// coming from something with specific isolation.
+    GlobalActorUnsafe,
   };
 
 private:
@@ -93,8 +97,9 @@ class ActorIsolation {
     return ActorIsolation(ActorInstance, actor);
   }
 
-  static ActorIsolation forGlobalActor(Type globalActor) {
-    return ActorIsolation(GlobalActor, globalActor);
+  static ActorIsolation forGlobalActor(Type globalActor, bool unsafe) {
+    return ActorIsolation(
+        unsafe ? GlobalActorUnsafe : GlobalActor, globalActor);
   }
 
   Kind getKind() const { return kind; }
@@ -108,8 +113,12 @@ class ActorIsolation {
     return actor;
   }
 
+  bool isGlobalActor() const {
+    return getKind() == GlobalActor || getKind() == GlobalActorUnsafe;
+  }
+
   Type getGlobalActor() const {
-    assert(getKind() == GlobalActor);
+    assert(isGlobalActor());
     return globalActor;
   }
 
@@ -135,6 +144,7 @@ class ActorIsolation {
       return lhs.actor == rhs.actor;
 
     case GlobalActor:
+    case GlobalActorUnsafe:
       return areTypesEqual(lhs.globalActor, rhs.globalActor);
     }
   }

lib/AST/Decl.cpp

@@ -8085,7 +8085,8 @@ ActorIsolation swift::getActorIsolationOfContext(DeclContext *dc) {
       return ActorIsolation::forIndependent(ActorIndependentKind::Safe);
 
     case ClosureActorIsolation::GlobalActor: {
-      return ActorIsolation::forGlobalActor(isolation.getGlobalActor());
+      return ActorIsolation::forGlobalActor(
+          isolation.getGlobalActor(), /*unsafe=*/false);
     }
 
     case ClosureActorIsolation::ActorInstance: {

lib/AST/DiagnosticEngine.cpp

@@ -690,6 +690,7 @@ static void formatDiagnosticArgument(StringRef Modifier,
       break;
 
     case ActorIsolation::GlobalActor:
+    case ActorIsolation::GlobalActorUnsafe:
       Out << "global actor " << FormatOpts.OpeningQuotationMark
         << isolation.getGlobalActor().getString()
         << FormatOpts.ClosingQuotationMark << "-isolated";

lib/AST/TypeCheckRequests.cpp

@@ -1519,6 +1519,7 @@ bool ActorIsolation::requiresSubstitution() const {
     return false;
 
   case GlobalActor:
+  case GlobalActorUnsafe:
     return getGlobalActor()->hasTypeParameter();
   }
   llvm_unreachable("unhandled actor isolation kind!");
@@ -1533,7 +1534,9 @@ ActorIsolation ActorIsolation::subst(SubstitutionMap subs) const {
     return *this;
 
   case GlobalActor:
-    return forGlobalActor(getGlobalActor().subst(subs));
+  case GlobalActorUnsafe:
+    return forGlobalActor(
+        getGlobalActor().subst(subs), kind == GlobalActorUnsafe);
   }
   llvm_unreachable("unhandled actor isolation kind!");
 }
@@ -1558,8 +1561,12 @@ void swift::simple_display(
       break;
 
     case ActorIsolation::GlobalActor:
+    case ActorIsolation::GlobalActorUnsafe:
       out << "actor-isolated to global actor "
           << state.getGlobalActor().getString();
+
+      if (state == ActorIsolation::GlobalActorUnsafe)
+        out << "(unsafe)";
       break;
   }
 }

lib/SILGen/SILGenApply.cpp

@@ -4303,6 +4303,7 @@ Optional<SILValue> SILGenFunction::emitLoadActorExecutorForCallee(
       }
 
       case ActorIsolation::GlobalActor:
+      case ActorIsolation::GlobalActorUnsafe:
         return emitLoadGlobalActorExecutor(actorIso.getGlobalActor());
     }
   }

lib/SILGen/SILGenProlog.cpp

@@ -472,6 +472,7 @@ void SILGenFunction::emitProlog(CaptureInfo captureInfo,
       case ActorIsolation::Unspecified:
       case ActorIsolation::Independent:
       case ActorIsolation::IndependentUnsafe:
+      case ActorIsolation::GlobalActorUnsafe:
         break;
 
       case ActorIsolation::ActorInstance: {

lib/Sema/TypeCheckConcurrency.cpp

@@ -567,6 +567,10 @@ ActorIsolationRestriction ActorIsolationRestriction::forDeclaration(
       // Actor-independent have no restrictions on their access.
       return forUnrestricted();
 
+    case ActorIsolation::GlobalActorUnsafe:
+      // TODO: Capture GlobalActorUnsafe so we can do more checking.
+      return forUnrestricted();
+
     case ActorIsolation::Unspecified:
       return isAccessibleAcrossActors ? forUnrestricted() : forUnsafe();
     }
@@ -1361,8 +1365,10 @@ namespace {
           return isolation;
 
         case ActorIsolation::GlobalActor:
+        case ActorIsolation::GlobalActorUnsafe:
           return ActorIsolation::forGlobalActor(
-              constDC->mapTypeIntoContext(isolation.getGlobalActor()));
+              constDC->mapTypeIntoContext(isolation.getGlobalActor()),
+              isolation == ActorIsolation::GlobalActorUnsafe);
         }
       };
 
@@ -1467,7 +1473,8 @@ namespace {
       // Check whether we are within the same isolation context, in which
       // case there is nothing further to check,
       auto contextIsolation = getInnermostIsolatedContext(declContext);
-      if (contextIsolation == ActorIsolation::forGlobalActor(globalActor)) {
+      if (contextIsolation.isGlobalActor() &&
+          contextIsolation.getGlobalActor()->isEqual(globalActor)) {
         return false;
       }
 
@@ -1490,7 +1497,8 @@ namespace {
         noteIsolatedActorMember(value);
         return true;
 
-      case ActorIsolation::GlobalActor: {
+      case ActorIsolation::GlobalActor:
+      case ActorIsolation::GlobalActorUnsafe: {
         // Check if this decl reference is the callee of the enclosing Apply,
         // making it OK as an implicitly async call.
         if (inspectForImplicitlyAsync())
@@ -1829,6 +1837,7 @@ namespace {
           }
 
           case ActorIsolation::GlobalActor:
+          case ActorIsolation::GlobalActorUnsafe:
             // Check for implicit async.
             if (auto result = checkImplicitlyAsync())
               return *result;
@@ -1880,7 +1889,8 @@ namespace {
       case ActorIsolation::Unspecified:
         return ClosureActorIsolation::forIndependent();
 
-      case ActorIsolation::GlobalActor: {
+      case ActorIsolation::GlobalActor:
+      case ActorIsolation::GlobalActorUnsafe: {
         Type globalActorType = closure->mapTypeIntoContext(
             parentIsolation.getGlobalActor()->mapTypeOutOfContext());
         return ClosureActorIsolation::forGlobalActor(globalActorType);
@@ -2036,14 +2046,8 @@ static Optional<ActorIsolation> getIsolationFromAttributes(
           diag::global_actor_non_unsafe_init, globalActorType);
     }
 
-    // TODO: Model as unsafe from the actor-isolation perspective, which
-    // disables all checking. We probably want to model this as a separate kind
-    // of actor isolation to emit warnings.
-    if (isUnsafe)
-      return ActorIsolation::forIndependent(ActorIndependentKind::Unsafe);
-
     return ActorIsolation::forGlobalActor(
-        globalActorType->mapTypeOutOfContext());
+        globalActorType->mapTypeOutOfContext(), isUnsafe);
   }
 
   llvm_unreachable("Forgot about an attribute?");
@@ -2113,7 +2117,8 @@ static Optional<ActorIsolation> getIsolationFromWitnessedRequirements(
       case ActorIsolation::Unspecified:
         return true;
 
-      case ActorIsolation::GlobalActor: {
+      case ActorIsolation::GlobalActor:
+      case ActorIsolation::GlobalActorUnsafe: {
         // Substitute into the global actor type.
         auto conformance = std::get<0>(isolated);
         auto requirementSubs = SubstitutionMap::getProtocolSubstitutions(
@@ -2124,7 +2129,8 @@ static Optional<ActorIsolation> getIsolationFromWitnessedRequirements(
           return true;
 
         // Update the global actor type, now that we've done this substitution.
-        std::get<1>(isolated) = ActorIsolation::forGlobalActor(globalActor);
+        std::get<1>(isolated) = ActorIsolation::forGlobalActor(
+            globalActor, isolation == ActorIsolation::GlobalActorUnsafe);
         return false;
       }
       }
@@ -2188,10 +2194,13 @@ ActorIsolation ActorIsolationRequest::evaluate(
                               ActorIndependentKind::Safe, /*IsImplicit=*/true));
       break;
 
-    case ActorIsolation::GlobalActor: {
+    case ActorIsolation::GlobalActor:
+    case ActorIsolation::GlobalActorUnsafe: {
       auto typeExpr = TypeExpr::createImplicit(inferred.getGlobalActor(), ctx);
       auto attr = CustomAttr::create(
           ctx, SourceLoc(), typeExpr, /*implicit=*/true);
+      if (inferred == ActorIsolation::GlobalActorUnsafe)
+        attr->setArgIsUnsafe(true);
       value->getAttrs().add(attr);
       break;
     }
@@ -2315,15 +2324,40 @@ void swift::checkOverrideActorIsolation(ValueDecl *value) {
   // If the overridden declaration is @actorIndependent(unsafe) and the
   // overriding declaration has been placed in a global actor, allow it.
   if (overriddenIsolation.getKind() == ActorIsolation::IndependentUnsafe &&
-      isolation.getKind() == ActorIsolation::GlobalActor)
+      isolation.isGlobalActor())
     return;
 
   // If the overridden declaration is from Objective-C with no actor annotation,
   // and the overriding declaration has been placed in a global actor, allow it.
   if (overridden->hasClangNode() && !overriddenIsolation &&
-      isolation.getKind() == ActorIsolation::GlobalActor)
+      isolation.isGlobalActor())
     return;
 
+  // If the overridden declaration uses an unsafe global actor, we can do
+  // anything except be actor-isolated or have a different global actor.
+  if (overriddenIsolation == ActorIsolation::GlobalActorUnsafe) {
+    switch (isolation) {
+    case ActorIsolation::Independent:
+    case ActorIsolation::IndependentUnsafe:
+    case ActorIsolation::Unspecified:
+      return;
+
+    case ActorIsolation::ActorInstance:
+      // Diagnose below.
+      break;
+
+    case ActorIsolation::GlobalActor:
+    case ActorIsolation::GlobalActorUnsafe:
+      // The global actors don't match; diagnose it.
+      if (overriddenIsolation.getGlobalActor()->isEqual(
+              isolation.getGlobalActor()))
+        return;
+
+      // Diagnose below.
+      break;
+    }
+  }
+
   // Isolation mismatch. Diagnose it.
   value->diagnose(
       diag::actor_isolation_override_mismatch, isolation,

lib/Sema/TypeCheckConcurrency.h

@@ -74,22 +74,24 @@ class ActorIsolationRestriction {
     /// There is no restriction on references to the given declaration.
     Unrestricted,
 
-    /// Access to the declaration is unsafe in a concurrent context.
+    /// Access to the declaration is unsafe in any concurrent context.
     Unsafe,
 
     /// References to this entity are allowed from anywhere, but doing so
-    /// may cross an actor boundary if it is not on \c self.
+    /// may cross an actor boundary if it is not from within the same actor's
+    /// isolation domain.
     CrossActorSelf,
 
-    /// References to this member of an actor are only permitted on 'self'.
+    /// References to this member of an actor are only permitted from within
+    /// the actor's isolation domain.
     ActorSelf,
 
     /// References to a declaration that is part of a global actor are only
     /// permitted from other declarations with that same global actor.
     GlobalActor,
 
-    /// Referneces to this entity are allowed from anywhere, but doing so may
-    /// cross an actor bounder if it is not from the same global actor.
+    /// References to this entity are allowed from anywhere, but doing so may
+    /// cross an actor boundary if it is not from the same global actor.
     CrossGlobalActor,
   };
 

lib/Sema/TypeCheckProtocol.cpp

@@ -2785,10 +2785,15 @@ bool ConformanceChecker::checkActorIsolation(
 
   // Check whether the requirement requires some particular actor isolation.
   Type requirementGlobalActor;
+  bool requirementIsUnsafe = false;
   switch (auto requirementIsolation = getActorIsolation(requirement)) {
   case ActorIsolation::ActorInstance:
     llvm_unreachable("There are not actor protocols");
 
+  case ActorIsolation::GlobalActorUnsafe:
+    requirementIsUnsafe = true;
+    LLVM_FALLTHROUGH;
+
   case ActorIsolation::GlobalActor: {
     auto requirementSubs = SubstitutionMap::getProtocolSubstitutions(
         Proto, Adoptee, ProtocolConformanceRef(Conformance));
@@ -2846,9 +2851,11 @@ bool ConformanceChecker::checkActorIsolation(
 
   // If the requirement has a global actor but the witness does not, we have
   // an isolation error.
-  //
-  // FIXME: Within a module, this will be an inference rule.
   if (requirementGlobalActor && !witnessGlobalActor) {
+    // If the requirement's global actor was "unsafe", we allow this.
+    if (requirementIsUnsafe)
+      return false;
+
     if (isCrossActor) {
       return diagnoseNonConcurrentTypesInReference(
         witness, DC, witness->getLoc(), ConcurrentReferenceKind::CrossActor);