MFC r280273;
Permit multiple arguments for the nonnull attribute.

This is very useful for non-trivial functions and doesn't
affect existing uses.