Merge requiresunsafe-corelib2 into feature/requires-unsafe

src/coreclr/System.Private.CoreLib/System.Private.CoreLib.csproj

@@ -22,6 +22,7 @@
     <FeaturePortableThreadPool Condition="'$(TargetsBrowser)' != 'true'">true</FeaturePortableThreadPool>
     <FeaturePortableTimer Condition="'$(TargetsBrowser)' != 'true'">true</FeaturePortableTimer>
     <FeatureSingleThread Condition="'$(TargetsBrowser)' == 'true'">true</FeatureSingleThread>
+    <EnableUnsafeAnalyzer>true</EnableUnsafeAnalyzer>
   </PropertyGroup>
 
   <ItemGroup>

src/coreclr/System.Private.CoreLib/src/System/Array.CoreCLR.cs

@@ -401,7 +401,11 @@ internal IEnumerator<T> GetEnumerator<T>()
         {
             // ! Warning: "this" is an array, not an SZArrayHelper. See comments above
             // ! or you may introduce a security hole!
-            T[] @this = Unsafe.As<T[]>(this);
+            T[] @this;
+            unsafe
+            {
+                @this = Unsafe.As<T[]>(this);
+            }
             int length = @this.Length;
             return length == 0 ? SZGenericArrayEnumerator<T>.Empty : new SZGenericArrayEnumerator<T>(@this, length);
         }
@@ -411,23 +415,35 @@ private void CopyTo<T>(T[] array, int index)
             // ! Warning: "this" is an array, not an SZArrayHelper. See comments above
             // ! or you may introduce a security hole!
 
-            T[] @this = Unsafe.As<T[]>(this);
+            T[] @this;
+            unsafe
+            {
+                @this = Unsafe.As<T[]>(this);
+            }
             Array.Copy(@this, 0, array, index, @this.Length);
         }
 
         internal int get_Count<T>()
         {
             // ! Warning: "this" is an array, not an SZArrayHelper. See comments above
             // ! or you may introduce a security hole!
-            T[] @this = Unsafe.As<T[]>(this);
+            T[] @this;
+            unsafe
+            {
+                @this = Unsafe.As<T[]>(this);
+            }
             return @this.Length;
         }
 
         internal T get_Item<T>(int index)
         {
             // ! Warning: "this" is an array, not an SZArrayHelper. See comments above
             // ! or you may introduce a security hole!
-            T[] @this = Unsafe.As<T[]>(this);
+            T[] @this;
+            unsafe
+            {
+                @this = Unsafe.As<T[]>(this);
+            }
             if ((uint)index >= (uint)@this.Length)
             {
                 ThrowHelper.ThrowArgumentOutOfRange_IndexMustBeLessException();
@@ -440,7 +456,11 @@ internal void set_Item<T>(int index, T value)
         {
             // ! Warning: "this" is an array, not an SZArrayHelper. See comments above
             // ! or you may introduce a security hole!
-            T[] @this = Unsafe.As<T[]>(this);
+            T[] @this;
+            unsafe
+            {
+                @this = Unsafe.As<T[]>(this);
+            }
             if ((uint)index >= (uint)@this.Length)
             {
                 ThrowHelper.ThrowArgumentOutOfRange_IndexMustBeLessException();
@@ -459,7 +479,11 @@ private bool Contains<T>(T value)
         {
             // ! Warning: "this" is an array, not an SZArrayHelper. See comments above
             // ! or you may introduce a security hole!
-            T[] @this = Unsafe.As<T[]>(this);
+            T[] @this;
+            unsafe
+            {
+                @this = Unsafe.As<T[]>(this);
+            }
             return Array.IndexOf(@this, value, 0, @this.Length) >= 0;
         }
 
@@ -480,7 +504,11 @@ private int IndexOf<T>(T value)
         {
             // ! Warning: "this" is an array, not an SZArrayHelper. See comments above
             // ! or you may introduce a security hole!
-            T[] @this = Unsafe.As<T[]>(this);
+            T[] @this;
+            unsafe
+            {
+                @this = Unsafe.As<T[]>(this);
+            }
             return Array.IndexOf(@this, value, 0, @this.Length);
         }
 

src/coreclr/System.Private.CoreLib/src/System/Delegate.CoreCLR.cs

@@ -435,7 +435,11 @@ private bool BindToMethodInfo(object? target, IRuntimeMethodInfo method, Runtime
         private static MulticastDelegate InternalAlloc(RuntimeType type)
         {
             Debug.Assert(type.IsAssignableTo(typeof(MulticastDelegate)));
-            return Unsafe.As<MulticastDelegate>(RuntimeTypeHandle.InternalAlloc(type));
+            // FIXME: review unsafe to confirm correct annotation
+            unsafe
+            {
+                return Unsafe.As<MulticastDelegate>(RuntimeTypeHandle.InternalAlloc(type));
+            }
         }
 
         [MethodImpl(MethodImplOptions.AggressiveInlining)]

src/coreclr/System.Private.CoreLib/src/System/MulticastDelegate.CoreCLR.cs

@@ -55,7 +55,12 @@ public sealed override bool Equals([NotNullWhen(true)] object? obj)
             // the types are the same, obj should also be a
             // MulticastDelegate
             Debug.Assert(obj is MulticastDelegate, "Shouldn't have failed here since we already checked the types are the same!");
-            MulticastDelegate d = Unsafe.As<MulticastDelegate>(obj);
+            MulticastDelegate d;
+            // FIXME: review unsafe to confirm correct annotation
+            unsafe
+            {
+                d = Unsafe.As<MulticastDelegate>(obj);
+            }
 
             if (_invocationCount != 0)
             {
@@ -168,7 +173,11 @@ private static bool TrySetSlot(object?[] a, int index, object o)
         private unsafe MulticastDelegate NewMulticastDelegate(object[] invocationList, int invocationCount, bool thisIsMultiCastAlready)
         {
             // First, allocate a new multicast delegate just like this one, i.e. same type as the this object
-            MulticastDelegate result = Unsafe.As<MulticastDelegate>(RuntimeTypeHandle.InternalAllocNoChecks(RuntimeHelpers.GetMethodTable(this)));
+            MulticastDelegate result;
+            unsafe
+            {
+                result = Unsafe.As<MulticastDelegate>(RuntimeTypeHandle.InternalAllocNoChecks(RuntimeHelpers.GetMethodTable(this)));
+            }
 
             // Performance optimization - if this already points to a true multicast delegate,
             // copy _methodPtr and _methodPtrAux fields rather than calling into the EE to get them

src/coreclr/System.Private.CoreLib/src/System/RuntimeType.CoreCLR.cs

@@ -2448,7 +2448,10 @@ private RuntimeTypeCache? CacheIfExists
                 {
                     object? cache = GCHandle.InternalGet(m_cache);
                     Debug.Assert(cache == null || cache is RuntimeTypeCache);
-                    return Unsafe.As<RuntimeTypeCache>(cache);
+                    unsafe
+                    {
+                        return Unsafe.As<RuntimeTypeCache>(cache);
+                    }
                 }
                 return null;
             }
@@ -2465,7 +2468,10 @@ private RuntimeTypeCache Cache
                     if (cache != null)
                     {
                         Debug.Assert(cache is RuntimeTypeCache);
-                        return Unsafe.As<RuntimeTypeCache>(cache);
+                        unsafe
+                        {
+                            return Unsafe.As<RuntimeTypeCache>(cache);
+                        }
                     }
                 }
                 return InitializeCache();

src/libraries/Directory.Build.props

@@ -50,6 +50,7 @@
     <Nullable Condition="'$(Nullable)' == '' and '$(IsTestProject)' == 'true'">annotations</Nullable>
     <!-- AOT compatibility is enabled by default for src/ref projects. -->
     <IsAotCompatible Condition="'$(IsAotCompatible)' == '' and ('$(IsSourceProject)' == 'true' or '$(IsReferenceAssemblyProject)' == 'true')">true</IsAotCompatible>
+    <EnableUnsafeAnalyzer>true</EnableUnsafeAnalyzer>
   </PropertyGroup>
 
   <!-- Set up common paths -->

src/libraries/System.Private.CoreLib/src/System.Private.CoreLib.Shared.projitems

@@ -286,6 +286,7 @@
     <Compile Include="$(MSBuildThisFileDirectory)System\Diagnostics\CodeAnalysis\RequiresAssemblyFilesAttribute.cs" />
     <Compile Include="$(MSBuildThisFileDirectory)System\Diagnostics\CodeAnalysis\RequiresDynamicCodeAttribute.cs" />
     <Compile Include="$(MSBuildThisFileDirectory)System\Diagnostics\CodeAnalysis\RequiresUnreferencedCodeAttribute.cs" />
+    <Compile Include="$(MSBuildThisFileDirectory)System\Diagnostics\CodeAnalysis\RequiresUnsafeAttribute.cs" />
     <Compile Include="$(MSBuildThisFileDirectory)System\Diagnostics\CodeAnalysis\SetsRequiredMembersAttribute.cs" />
     <Compile Include="$(MSBuildThisFileDirectory)System\Diagnostics\CodeAnalysis\StringSyntaxAttribute.cs" />
     <Compile Include="$(MSBuildThisFileDirectory)System\Diagnostics\CodeAnalysis\SuppressMessageAttribute.cs" />

src/libraries/System.Private.CoreLib/src/System/Buffers/SharedArrayPool.cs

@@ -60,7 +60,10 @@ public override T[] Rent(int minimumLength)
             SharedArrayPoolThreadLocalArray[]? tlsBuckets = t_tlsBuckets;
             if (tlsBuckets is not null && (uint)bucketIndex < (uint)tlsBuckets.Length)
             {
-                buffer = Unsafe.As<T[]>(tlsBuckets[bucketIndex].Array);
+                unsafe
+                {
+                    buffer = Unsafe.As<T[]>(tlsBuckets[bucketIndex].Array);
+                }
                 if (buffer is not null)
                 {
                     tlsBuckets[bucketIndex].Array = null;
@@ -79,7 +82,10 @@ public override T[] Rent(int minimumLength)
                 SharedArrayPoolPartitions? b = perCoreBuckets[bucketIndex];
                 if (b is not null)
                 {
-                    buffer = Unsafe.As<T[]>(b.TryPop());
+                    unsafe
+                    {
+                        buffer = Unsafe.As<T[]>(b.TryPop());
+                    }
                     if (buffer is not null)
                     {
                         if (log.IsEnabled())

src/libraries/System.Private.CoreLib/src/System/Collections/Concurrent/ConcurrentDictionary.cs

@@ -2321,7 +2321,11 @@ private static IAlternateEqualityComparer<TAlternateKey, TKey> GetAlternateCompa
              where TAlternateKey : notnull, allows ref struct
         {
             Debug.Assert(IsCompatibleKey<TAlternateKey>(tables));
-            return Unsafe.As<IAlternateEqualityComparer<TAlternateKey, TKey>>(tables._comparer!);
+            // FIXME: review unsafe to confirm correct annotation
+            unsafe
+            {
+                return Unsafe.As<IAlternateEqualityComparer<TAlternateKey, TKey>>(tables._comparer!);
+            }
         }
 
         /// <summary>

src/libraries/System.Private.CoreLib/src/System/Collections/Generic/Dictionary.cs

@@ -737,7 +737,10 @@ internal static bool IsCompatibleKey(Dictionary<TKey, TValue> dictionary)
             internal static IAlternateEqualityComparer<TAlternateKey, TKey> GetAlternateComparer(Dictionary<TKey, TValue> dictionary)
             {
                 Debug.Assert(IsCompatibleKey(dictionary));
-                return Unsafe.As<IAlternateEqualityComparer<TAlternateKey, TKey>>(dictionary._comparer)!;
+                unsafe
+                {
+                    return Unsafe.As<IAlternateEqualityComparer<TAlternateKey, TKey>>(dictionary._comparer)!;
+                }
             }
 
             /// <summary>Gets the value associated with the specified alternate key.</summary>

src/libraries/System.Private.CoreLib/src/System/Collections/Generic/HashSet.cs

@@ -444,7 +444,11 @@ internal static bool IsCompatibleItem(HashSet<T> set)
             internal static IAlternateEqualityComparer<TAlternate, T> GetAlternateComparer(HashSet<T> set)
             {
                 Debug.Assert(IsCompatibleItem(set));
-                return Unsafe.As<IAlternateEqualityComparer<TAlternate, T>>(set._comparer)!;
+                // FIXME: review unsafe to confirm correct annotation
+                unsafe
+                {
+                    return Unsafe.As<IAlternateEqualityComparer<TAlternate, T>>(set._comparer)!;
+                }
             }
 
             /// <summary>Adds the specified element to a set.</summary>

src/libraries/System.Private.CoreLib/src/System/ComAwareWeakReference.cs

@@ -112,7 +112,11 @@ private void SetTarget(object? target, ComInfo? comInfo)
                 if (_comInfo != null)
                 {
                     // Check if the target is still null
-                    target = Unsafe.As<T>(GCHandle.InternalGet(_weakHandle));
+                    // FIXME: review unsafe to confirm correct annotation
+                    unsafe
+                    {
+                        target = Unsafe.As<T>(GCHandle.InternalGet(_weakHandle));
+                    }
                     if (target == null)
                     {
                         // Resolve and reset. Perform runtime cast to catch bugs
@@ -146,22 +150,40 @@ private static ComAwareWeakReference EnsureComAwareReference(ref nint taggedHand
                 GC.SuppressFinalize(newRef);
             }
 
-            return Unsafe.As<ComAwareWeakReference>(GCHandle.InternalGet(taggedHandle & ~HandleTagBits)!);
+            // FIXME: review unsafe to confirm correct annotation
+            unsafe
+            {
+                return Unsafe.As<ComAwareWeakReference>(GCHandle.InternalGet(taggedHandle & ~HandleTagBits)!);
+            }
         }
 
         [MethodImpl(MethodImplOptions.AggressiveInlining)]
         internal static ComAwareWeakReference GetFromTaggedReference(nint taggedHandle)
         {
             Debug.Assert((taggedHandle & ComAwareBit) != 0);
-            return Unsafe.As<ComAwareWeakReference>(GCHandle.InternalGet(taggedHandle & ~HandleTagBits)!);
+            // FIXME: review unsafe to confirm correct annotation
+            unsafe
+            {
+                return Unsafe.As<ComAwareWeakReference>(GCHandle.InternalGet(taggedHandle & ~HandleTagBits)!);
+            }
         }
 
         [MethodImpl(MethodImplOptions.NoInlining)]
         internal static void SetTarget(ref nint taggedHandle, object? target, ComInfo? comInfo)
         {
-            ComAwareWeakReference comAwareRef = comInfo != null ?
-                EnsureComAwareReference(ref taggedHandle) :
-                Unsafe.As<ComAwareWeakReference>(GCHandle.InternalGet(taggedHandle & ~HandleTagBits)!);
+            ComAwareWeakReference comAwareRef;
+            if (comInfo != null)
+            {
+                comAwareRef = EnsureComAwareReference(ref taggedHandle);
+            }
+            else
+            {
+                // FIXME: review unsafe to confirm correct annotation
+                unsafe
+                {
+                    comAwareRef = Unsafe.As<ComAwareWeakReference>(GCHandle.InternalGet(taggedHandle & ~HandleTagBits)!);
+                }
+            }
 
             comAwareRef.SetTarget(target, comInfo);
         }

src/libraries/System.Private.CoreLib/src/System/Delegate.cs

@@ -78,7 +78,17 @@ public abstract partial class Delegate : ICloneable, ISerializable
         /// Gets a value that indicates whether the <see cref="Delegate"/> has a single invocation target.
         /// </summary>
         /// <value>true if the <see cref="Delegate"/> has a single invocation target.</value>
-        public bool HasSingleTarget => Unsafe.As<MulticastDelegate>(this).HasSingleTarget;
+        public bool HasSingleTarget
+        {
+            get
+            {
+                // FIXME: review unsafe to confirm correct annotation
+                unsafe
+                {
+                    return Unsafe.As<MulticastDelegate>(this).HasSingleTarget;
+                }
+            }
+        }
 #endif
 
         /// <summary>
@@ -94,7 +104,13 @@ public abstract partial class Delegate : ICloneable, ISerializable
         /// The method returns an empty enumerator for null delegate.
         /// </remarks>
         public static System.Delegate.InvocationListEnumerator<TDelegate> EnumerateInvocationList<TDelegate>(TDelegate? d) where TDelegate : System.Delegate
-            => new InvocationListEnumerator<TDelegate>(Unsafe.As<MulticastDelegate>(d));
+        {
+            // FIXME: review unsafe to confirm correct annotation
+            unsafe
+            {
+                return new InvocationListEnumerator<TDelegate>(Unsafe.As<MulticastDelegate>(d));
+            }
+        }
 
         /// <summary>
         /// Provides an enumerator for the invocation list of a delegate.
@@ -128,9 +144,15 @@ public TDelegate Current
             public bool MoveNext()
             {
                 int index = _index + 1;
-                if ((_current = Unsafe.As<TDelegate>(_delegate?.TryGetAt(index))) == null)
+                unsafe
                 {
-                    return false;
+                    unsafe
+                    {
+                        if ((_current = Unsafe.As<TDelegate>(_delegate?.TryGetAt(index))) == null)
+                        {
+                            return false;
+                        }
+                    }
                 }
                 _index = index;
                 return true;

src/libraries/System.Private.CoreLib/src/System/Diagnostics/CodeAnalysis/RequiresUnsafeAttribute.cs

@@ -0,0 +1,18 @@
+// Licensed to the .NET Foundation under one or more agreements.
+// The .NET Foundation licenses this file to you under the MIT license.
+
+namespace System.Diagnostics.CodeAnalysis
+{
+    /// <summary>
+    /// Indicates that the specified method requires dynamic access to code that is not referenced
+    /// statically, for example through <see cref="Reflection"/>.
+    /// </summary>
+    /// <remarks>
+    /// This allows tools to understand which methods are unsafe to call when removing unreferenced
+    /// code from an application.
+    /// </remarks>
+    [AttributeUsage(AttributeTargets.Method | AttributeTargets.Constructor, Inherited = false)]
+    internal sealed class RequiresUnsafeAttribute : Attribute
+    {
+    }
+}

src/libraries/System.Private.CoreLib/src/System/IO/BinaryReader.cs

@@ -357,7 +357,11 @@ private int InternalReadChars(Span<char> buffer)
                 if (_isMemoryStream)
                 {
                     Debug.Assert(_stream is MemoryStream);
-                    MemoryStream mStream = Unsafe.As<MemoryStream>(_stream);
+                    MemoryStream mStream;
+                    unsafe
+                    {
+                        mStream = Unsafe.As<MemoryStream>(_stream);
+                    }
 
                     int position = mStream.InternalGetPosition();
                     numBytes = mStream.InternalEmulateRead(numBytes);
@@ -477,7 +481,12 @@ private ReadOnlySpan<byte> InternalRead(Span<byte> buffer)
             {
                 // read directly from MemoryStream buffer
                 Debug.Assert(_stream is MemoryStream);
-                return Unsafe.As<MemoryStream>(_stream).InternalReadSpan(buffer.Length);
+                MemoryStream mStream;
+                unsafe
+                {
+                    mStream = Unsafe.As<MemoryStream>(_stream);
+                }
+                return mStream.InternalReadSpan(buffer.Length);
             }
             else
             {