Unhandled `System.NullReferenceException` in `Microsoft.CodeAnalysis.Compilation.Emit`

[amanasifkhalid]

Version Used: 4.13.0

Repro:

using Microsoft.CodeAnalysis;
using Microsoft.CodeAnalysis.CSharp;
using Microsoft.CodeAnalysis.Emit;
using System;

internal sealed class Program
{
    static readonly string CORE_ROOT = Environment.GetEnvironmentVariable("CORE_ROOT") ?? throw new InvalidOperationException("Environment variable 'CORE_ROOT' is not set.");
    static readonly string TEST_DLL = "test.dll";

    static readonly CSharpCompilationOptions ReleaseOptions =
        new CSharpCompilationOptions(OutputKind.ConsoleApplication, concurrentBuild: false, optimizationLevel: OptimizationLevel.Release).WithAllowUnsafe(true);

    static readonly MetadataReference[] References =
    {
        MetadataReference.CreateFromFile(Path.Combine(CORE_ROOT, "System.Private.CoreLib.dll")),
        MetadataReference.CreateFromFile(Path.Combine(CORE_ROOT, "System.Runtime.dll")),
    };

    EmitResult CompileProgram(string csProgram)
    {
        SyntaxTree tree = CSharpSyntaxTree.ParseText(csProgram);
        SyntaxTree[] trees = { tree };
        CSharpCompilation compilation = CSharpCompilation.Create(null, new[] { tree }, References, ReleaseOptions);
        using var ms = new FileStream(TEST_DLL, FileMode.Create, FileAccess.ReadWrite, FileShare.Read);
        return compilation.Emit(ms);
    }

    public static void Main(string[] args)
    {
        Program p = new Program();
        string program =
"""
using System;

class Program
{
    static int g_3 = -6;
    static ref int g_2 = ref g_3;

    static int func_1()
    {
        int l_5 = unchecked((int)0xDE0B4074);
        g_2 = ref g_2;
        return l_5;
    }

    static void Main(string[] args)
    {
        func_1();
    }
}
""";
        p.CompileProgram(program);
    }
}

Expected Behavior:
Program string fails compilation.

Actual Behavior:
Unhandled NRE. Stack trace:

Unhandled exception. System.NullReferenceException: Object reference not set to an instance of an object.
   at Microsoft.CodeAnalysis.CSharp.Binder.CheckValueKind(SyntaxNode node, BoundExpression expr, BindValueKind valueKind, Boolean checkingReceiver, BindingDiagnosticBag diagnostics)
   at Microsoft.CodeAnalysis.CSharp.Binder.CheckIsValidReceiverForVariable(SyntaxNode node, BoundExpression receiver, BindValueKind kind, BindingDiagnosticBag diagnostics)
   at Microsoft.CodeAnalysis.CSharp.Binder.CheckFieldValueKind(SyntaxNode node, BoundFieldAccess fieldAccess, BindValueKind valueKind, Boolean checkingReceiver, BindingDiagnosticBag diagnostics)
   at Microsoft.CodeAnalysis.CSharp.Binder.CheckValueKind(SyntaxNode node, BoundExpression expr, BindValueKind valueKind, Boolean checkingReceiver, BindingDiagnosticBag diagnostics)
   at Microsoft.CodeAnalysis.CSharp.Binder.CheckValue(BoundExpression expr, BindValueKind valueKind, BindingDiagnosticBag diagnostics)
   at Microsoft.CodeAnalysis.CSharp.Binder.BindValue(ExpressionSyntax node, BindingDiagnosticBag diagnostics, BindValueKind valueKind)
   at Microsoft.CodeAnalysis.CSharp.Binder.BindAssignment(AssignmentExpressionSyntax node, BindingDiagnosticBag diagnostics)
   at Microsoft.CodeAnalysis.CSharp.Binder.<BindExpressionInternal>g__bindExpressionInternal|343_0(ExpressionSyntax node, BindingDiagnosticBag diagnostics, Boolean invoked, Boolean indexed)
   at Microsoft.CodeAnalysis.CSharp.Binder.BindExpressionInternal(ExpressionSyntax node, BindingDiagnosticBag diagnostics, Boolean invoked, Boolean indexed)
   at Microsoft.CodeAnalysis.CSharp.Binder.BindExpression(ExpressionSyntax node, BindingDiagnosticBag diagnostics, Boolean invoked, Boolean indexed)
   at Microsoft.CodeAnalysis.CSharp.Binder.BindValue(ExpressionSyntax node, BindingDiagnosticBag diagnostics, BindValueKind valueKind)
   at Microsoft.CodeAnalysis.CSharp.Binder.BindRValueWithoutTargetType(ExpressionSyntax node, BindingDiagnosticBag diagnostics, Boolean reportNoTargetType)
   at Microsoft.CodeAnalysis.CSharp.Binder.BindExpressionStatement(CSharpSyntaxNode node, ExpressionSyntax syntax, Boolean allowsAnyExpression, BindingDiagnosticBag diagnostics)
   at Microsoft.CodeAnalysis.CSharp.Binder.BindExpressionStatement(ExpressionStatementSyntax node, BindingDiagnosticBag diagnostics)
   at Microsoft.CodeAnalysis.CSharp.Binder.BindStatement(StatementSyntax node, BindingDiagnosticBag diagnostics)
   at Microsoft.CodeAnalysis.CSharp.Binder.BindBlockParts(BlockSyntax node, BindingDiagnosticBag diagnostics)
   at Microsoft.CodeAnalysis.CSharp.Binder.BindBlock(BlockSyntax node, BindingDiagnosticBag diagnostics)
   at Microsoft.CodeAnalysis.CSharp.Binder.BindStatement(StatementSyntax node, BindingDiagnosticBag diagnostics)
   at Microsoft.CodeAnalysis.CSharp.Binder.BindMethodBody(CSharpSyntaxNode declaration, BlockSyntax blockBody, ArrowExpressionClauseSyntax expressionBody, BindingDiagnosticBag diagnostics)
   at Microsoft.CodeAnalysis.CSharp.Binder.BindMethodBody(CSharpSyntaxNode syntax, BindingDiagnosticBag diagnostics)
   at Microsoft.CodeAnalysis.CSharp.MethodCompiler.<>c.<BindMethodBody>b__42_1(Binder bodyBinder, CSharpSyntaxNode syntaxNode, Object _, BindingDiagnosticBag diagnostics)
   at Microsoft.CodeAnalysis.CSharp.Binder.BindWithLambdaBindingCountDiagnostics[TSyntax,TArg,TResult](TSyntax syntax, TArg arg, BindingDiagnosticBag diagnostics, Func`5 bind)
   at Microsoft.CodeAnalysis.CSharp.MethodCompiler.BindMethodBody(MethodSymbol method, TypeCompilationState compilationState, BindingDiagnosticBag diagnostics, Boolean includeInitializersInBody, BoundNode initializersBody, Boolean reportNullableDiagnostics, ImportChain& importChain, Boolean& originalBodyNested, Boolean& prependedDefaultValueTypeConstructorInitializer, InitialState& forSemanticModel)
   at Microsoft.CodeAnalysis.CSharp.MethodCompiler.CompileMethod(MethodSymbol methodSymbol, Int32 methodOrdinal, ProcessedFieldInitializers& processedInitializers, SynthesizedSubmissionFields previousSubmissionFields, TypeCompilationState compilationState)
   at Microsoft.CodeAnalysis.CSharp.MethodCompiler.CompileNamedType(NamedTypeSymbol containingType)
   at Microsoft.CodeAnalysis.CSharp.MethodCompiler.VisitNamedType(NamedTypeSymbol symbol, TypeCompilationState arg)
   at Microsoft.CodeAnalysis.CSharp.Symbols.NamedTypeSymbol.Accept[TArgument,TResult](CSharpSymbolVisitor`2 visitor, TArgument argument)
   at Microsoft.CodeAnalysis.CSharp.MethodCompiler.CompileNamespace(NamespaceSymbol symbol)
   at Microsoft.CodeAnalysis.CSharp.MethodCompiler.CompileMethodBodies(CSharpCompilation compilation, PEModuleBuilder moduleBeingBuiltOpt, Boolean emittingPdb, Boolean hasDeclarationErrors, Boolean emitMethodBodies, BindingDiagnosticBag diagnostics, Predicate`1 filterOpt, CancellationToken cancellationToken)
   at Microsoft.CodeAnalysis.CSharp.CSharpCompilation.CompileMethods(CommonPEModuleBuilder moduleBuilder, Boolean emittingPdb, DiagnosticBag diagnostics, Predicate`1 filterOpt, CancellationToken cancellationToken)
   at Microsoft.CodeAnalysis.Compilation.Emit(Stream peStream, Stream metadataPEStream, Stream pdbStream, Stream xmlDocumentationStream, Stream win32Resources, IEnumerable`1 manifestResources, EmitOptions options, IMethodSymbol debugEntryPoint, Stream sourceLinkStream, IEnumerable`1 embeddedTexts, RebuildData rebuildData, CompilationTestData testData, CancellationToken cancellationToken)
   at Microsoft.CodeAnalysis.Compilation.Emit(Stream peStream, Stream pdbStream, Stream xmlDocumentationStream, Stream win32Resources, IEnumerable`1 manifestResources, EmitOptions options, IMethodSymbol debugEntryPoint, Stream sourceLinkStream, IEnumerable`1 embeddedTexts, Stream metadataPEStream, RebuildData rebuildData, CancellationToken cancellationToken)
   at Microsoft.CodeAnalysis.Compilation.Emit(Stream peStream, Stream pdbStream, Stream xmlDocumentationStream, Stream win32Resources, IEnumerable`1 manifestResources, EmitOptions options, IMethodSymbol debugEntryPoint, Stream sourceLinkStream, IEnumerable`1 embeddedTexts, Stream metadataPEStream, CancellationToken cancellationToken)
   at Program.CompileProgram(String csProgram) in /home/aman/test/Program.cs:line 26
   at Program.Main(String[] args) in /home/aman/test/Program.cs:line 54

[bernd5]

Static ref fields are currently not support (but it should not cause a NRE):

Instead you can write a ref returing property - (supports no ref reassignment):

class Program
{
    static int g_3 = -6;
    static ref int g_2 => ref g_3;

    static int func_1()
    {
        int l_5 = unchecked((int)0xDE0B4074);
        return l_5;
    }

    static void Main(string[] args)
    {
        func_1();
    }
}

[amanasifkhalid]

Thanks for taking a look so quickly! This snippet was actually generated by a fuzzer intended to test the JIT; it ended up finding a bug in Roslyn instead.