Visibility attributes on extern global variables are dropped from generated bindings

[lwz23]

Input C/C++ Header

#if defined(PHASE8_PROTECTED)
#define TEST_VISIBILITY __attribute__((visibility("protected")))
#else
#define TEST_VISIBILITY __attribute__((visibility("hidden")))
#endif

extern int phase8_visibility_global TEST_VISIBILITY;

Bindgen Invocation

$ bindgen input.h \
    --output bindings.rs \
    --no-layout-tests \
    --no-doc-comments \
    --no-rustfmt-bindings \
    --rust-target 1.75 \
    -- -x c -std=gnu11

I ran the protected case again with -DPHASE8_PROTECTED=1.

Actual Results

Bindgen emits the same Rust declaration for both inputs:

extern "C" {
    pub static mut phase8_visibility_global: ::std::os::raw::c_int;
}

The C and Rust objects have different ELF visibility on the undefined symbol:

input       C object               Rust object
hidden      GLOBAL HIDDEN UND      GLOBAL DEFAULT UND
protected   GLOBAL PROTECTED UND   GLOBAL DEFAULT UND

The LLVM declarations show the same difference:

@phase8_visibility_global = external hidden global i32
@phase8_visibility_global = external protected global i32

; Rust, for either input
@phase8_visibility_global = external global i32

This changes link behavior. A C caller carrying the hidden or protected
undefined reference cannot satisfy it from a default-visible definition in a
shared library. A Rust caller using the generated binding can. In my test, the
C link failed while the Rust program linked and printed value=31337.

As a control, I compiled a local definition that includes the same header.
Both callers then linked and printed the same value, and the provider object
retained the requested visibility.

Expected Results

Bindgen should not turn a non-default ELF reference into a default reference.

Rust has no general source attribute for ELF visibility on an extern static,
so omitting the variable with a diagnostic would be a reasonable conservative
result. A target-specific way to preserve the visibility would also work.
Emitting an ordinary extern static is not equivalent to either C declaration.

Environment

bindgen current main: 9d26c6eddeff9192ddedb563192abe3128fc5aae
bindgen release:      0.72.1
clang:                15.0.7
rustc:                1.75.0
target:               x86_64-unknown-linux-gnu
object inspection:    GNU readelf

I repeated hidden and protected at O0 and O2 with both bindgen versions. The C
objects retained HIDDEN or PROTECTED in every run; the objects produced from
the generated Rust binding used DEFAULT in every run.

Additional notes

Functions and variables currently take different paths here. Function parsing
checks cursor.visibility() and filters non-default declarations. The
top-level variable path does not keep the Clang visibility, so code generation
has no way to distinguish these inputs.