Add more configuration fragment annotations, and a runtime check.

--
MOS_MIGRATED_REVID=99819719
diff --git a/src/main/java/com/google/devtools/build/lib/analysis/RuleContext.java b/src/main/java/com/google/devtools/build/lib/analysis/RuleContext.java
index fad5cd4..92b3dbd 100644
--- a/src/main/java/com/google/devtools/build/lib/analysis/RuleContext.java
+++ b/src/main/java/com/google/devtools/build/lib/analysis/RuleContext.java
@@ -259,12 +259,15 @@
   public <T extends Fragment> T getFragment(Class<T> fragment) {
     // TODO(bazel-team): The fragments can also be accessed directly through BuildConfiguration.
     // Can we lock that down somehow?
-    Preconditions.checkArgument(
-        rule.getRuleClassObject().isLegalConfigurationFragment(fragment),
+    Preconditions.checkArgument(isLegalFragment(fragment),
         "%s does not have access to %s", rule.getRuleClass(), fragment);
     return getConfiguration().getFragment(fragment);
   }
 
+  public <T extends Fragment> boolean isLegalFragment(Class<T> fragment) {
+    return rule.getRuleClassObject().isLegalConfigurationFragment(fragment);
+  }
+
   @Override
   public ArtifactOwner getOwner() {
     return getAnalysisEnvironment().getOwner();
diff --git a/src/main/java/com/google/devtools/build/lib/rules/cpp/CcToolchainRule.java b/src/main/java/com/google/devtools/build/lib/rules/cpp/CcToolchainRule.java
index 3069037..c1674a9 100644
--- a/src/main/java/com/google/devtools/build/lib/rules/cpp/CcToolchainRule.java
+++ b/src/main/java/com/google/devtools/build/lib/rules/cpp/CcToolchainRule.java
@@ -47,6 +47,7 @@
   public RuleClass build(Builder builder, RuleDefinitionEnvironment env) {
     return builder
         .setUndocumented()
+        .requiresConfigurationFragments(CppConfiguration.class)
         .add(attr("output_licenses", LICENSE))
         .add(attr("cpu", STRING).mandatory())
         .add(attr("all_files", LABEL).legacyAllowAnyFileType().cfg(HOST).mandatory())
diff --git a/src/main/java/com/google/devtools/build/lib/rules/java/JavaToolchainRule.java b/src/main/java/com/google/devtools/build/lib/rules/java/JavaToolchainRule.java
index 1f7b90f..00adebe 100644
--- a/src/main/java/com/google/devtools/build/lib/rules/java/JavaToolchainRule.java
+++ b/src/main/java/com/google/devtools/build/lib/rules/java/JavaToolchainRule.java
@@ -31,6 +31,7 @@
   @Override
   public RuleClass build(Builder builder, RuleDefinitionEnvironment env) {
     return builder.setUndocumented()
+        .requiresConfigurationFragments(JavaConfiguration.class)
         /* <!-- #BLAZE_RULE(java_toolchain).ATTRIBUTE(source_version) -->
         The Java source version (e.g., '6' or '7'). It specifies which set of code structures
         are allowed in the Java source code.
diff --git a/src/main/java/com/google/devtools/build/lib/rules/nativedeps/NativeDepsHelper.java b/src/main/java/com/google/devtools/build/lib/rules/nativedeps/NativeDepsHelper.java
index 90a10a6..8c22344 100644
--- a/src/main/java/com/google/devtools/build/lib/rules/nativedeps/NativeDepsHelper.java
+++ b/src/main/java/com/google/devtools/build/lib/rules/nativedeps/NativeDepsHelper.java
@@ -14,6 +14,7 @@
 
 package com.google.devtools.build.lib.rules.nativedeps;
 
+import com.google.common.base.Preconditions;
 import com.google.common.collect.ImmutableList;
 import com.google.devtools.build.lib.Constants;
 import com.google.devtools.build.lib.actions.Artifact;
@@ -130,6 +131,8 @@
   private static NativeDepsRunfiles maybeCreateNativeDepsAction(final RuleContext ruleContext,
       CcLinkParams linkParams, Collection<String> extraLinkOpts, BuildConfiguration configuration,
       CcToolchainProvider toolchain, PathFragment nativeDepsPath, Root bindirIfShared) {
+    Preconditions.checkState(ruleContext.isLegalFragment(CppConfiguration.class),
+        "%s does not have access to CppConfiguration", ruleContext.getRule().getRuleClass());
     if (linkParams.getLibraries().isEmpty()) {
       return NativeDepsRunfiles.EMPTY;
     }