2 files changed, 18 insertions, 15 deletions
diff --git a/src/main/java/com/google/devtools/build/lib/flags/InvocationPolicyEnforcer.java b/src/main/java/com/google/devtools/build/lib/flags/InvocationPolicyEnforcer.java
index 5a6e324bcb..886b5d5d2e 100644
--- a/src/main/java/com/google/devtools/build/lib/flags/InvocationPolicyEnforcer.java
+++ b/src/main/java/com/google/devtools/build/lib/flags/InvocationPolicyEnforcer.java
@@ -36,7 +36,9 @@ import com.google.devtools.common.options.OptionsParser.OptionValueDescription;
 import com.google.devtools.common.options.OptionsParsingException;
 import java.util.ArrayList;
 import java.util.Arrays;
+import java.util.HashMap;
 import java.util.List;
+import java.util.Map;
 import java.util.Set;
 import java.util.logging.Level;
 import java.util.logging.Logger;
@@ -209,7 +211,14 @@ public final class InvocationPolicyEnforcer {
       expandedPolicies.addAll(policies);
     }
 
-    return expandedPolicies;
+    // Only keep that last policy for each flag.
+    Map<String, FlagPolicy> effectivePolicy = new HashMap<>();
+    for (FlagPolicy expandedPolicy : expandedPolicies) {
+      String flagName = expandedPolicy.getFlagName();
+      effectivePolicy.put(flagName, expandedPolicy);
+    }
+
+    return new ArrayList<>(effectivePolicy.values());
   }
 
   /**
diff --git a/src/main/protobuf/invocation_policy.proto b/src/main/protobuf/invocation_policy.proto
index 218b00e0ed..f14db3e6ca 100644
--- a/src/main/protobuf/invocation_policy.proto
+++ b/src/main/protobuf/invocation_policy.proto
@@ -20,18 +20,10 @@ option java_package = "com.google.devtools.build.lib.runtime.proto";
 // The --invocation_policy flag takes a base64-encoded binary-serialized or text
 // formatted InvocationPolicy message.
 message InvocationPolicy {
-  // Policies will be applied in order. Later policies will override
-  // previous policies if they conflict, which is important for flags
-  // that interact with each other. For example, if there is a flag "--foo"
-  // which is an expansion flag that expands into "--bar=x --baz=y", and the
-  // policy list first has a SetValue policy for "set --bar to z", and then has
-  // a SetDefault policy to set "--foo" to its default value, both --bar and
-  // --baz will get reset to their default values, overriding the SetValue
-  // operation. The UseDefault should come before the SetValue.
-  //
-  // Note that currently, if user value is lost, either cleared by UseDefault
-  // or by being written over by a SetValue, a later white-listing of the user's
-  // inputted value will not restore it.
+  // Order matters.
+  // After expanding policies on expansion flags or flags with implicit
+  // requirements, only the final policy on a specific flag will be enforced
+  // onto the user's command line.
   repeated FlagPolicy flag_policies = 1;
 }
 
@@ -127,8 +119,10 @@ message UseDefault {
   // so that when the value is requested and no flag is found, the flag parser
   // returns the default. This is mostly relevant for expansion flags: it will
   // erase user values in *all* flags that the expansion flag expands to. Only
-  // use this on expansion flags if this is acceptable behavior. Otherwise, make
-  // an appropriate policy for the expanded flags that you care about.
+  // use this on expansion flags if this is acceptable behavior. Since the last
+  // policy wins, later policies on this same flag will still remove the
+  // expanded UseDefault, so there is a way around, but it's really best not to
+  // use this on expansion flags at all.
 }
 
 message DisallowValues {