Visibility attributes on extern global variables are dropped from generated bindings

Input C/C++ Header

#if defined(PHASE8_PROTECTED)
#define TEST_VISIBILITY __attribute__((visibility("protected")))
#else
#define TEST_VISIBILITY __attribute__((visibility("hidden")))
#endif

extern int phase8_visibility_global TEST_VISIBILITY;

Bindgen Invocation

$ bindgen input.h \
    --output bindings.rs \
    --no-layout-tests \
    --no-doc-comments \
    --no-rustfmt-bindings \
    --rust-target 1.75 \
    -- -x c -std=gnu11

I ran the protected case again with -DPHASE8_PROTECTED=1.

Actual Results

Bindgen emits the same Rust declaration for both inputs:

extern "C" {
    pub static mut phase8_visibility_global: ::std::os::raw::c_int;
}

The C and Rust objects have different ELF visibility on the undefined symbol:

input       C object               Rust object
hidden      GLOBAL HIDDEN UND      GLOBAL DEFAULT UND
protected   GLOBAL PROTECTED UND   GLOBAL DEFAULT UND

The LLVM declarations show the same difference:

@phase8_visibility_global = external hidden global i32
@phase8_visibility_global = external protected global i32

; Rust, for either input
@phase8_visibility_global = external global i32

This changes link behavior. A C caller carrying the hidden or protected
undefined reference cannot satisfy it from a default-visible definition in a
shared library. A Rust caller using the generated binding can. In my test, the
C link failed while the Rust program linked and printed value=31337.

As a control, I compiled a local definition that includes the same header.
Both callers then linked and printed the same value, and the provider object
retained the requested visibility.

Expected Results

Bindgen should not turn a non-default ELF reference into a default reference.

Rust has no general source attribute for ELF visibility on an extern static,
so omitting the variable with a diagnostic would be a reasonable conservative
result. A target-specific way to preserve the visibility would also work.
Emitting an ordinary extern static is not equivalent to either C declaration.

Environment

bindgen current main: 9d26c6eddeff9192ddedb563192abe3128fc5aae
bindgen release:      0.72.1
clang:                15.0.7
rustc:                1.75.0
target:               x86_64-unknown-linux-gnu
object inspection:    GNU readelf

I repeated hidden and protected at O0 and O2 with both bindgen versions. The C
objects retained HIDDEN or PROTECTED in every run; the objects produced from
the generated Rust binding used DEFAULT in every run.

Additional notes

Functions and variables currently take different paths here. Function parsing
checks cursor.visibility() and filters non-default declarations. The
top-level variable path does not keep the Clang visibility, so code generation
has no way to distinguish these inputs.

Start with the top-level variable path in bindgen's code generation and compare it with the function parsing path that checks cursor.visibility(). Reproduce the hidden and protected cases from the reported bindgen invocation, then verify that generated bindings no longer emit an ordinary default-visible extern static when the C declaration has non-default visibility.