Unsafe evolution: unsafe expressions by jjonescz · Pull Request #84012 · dotnet/roslyn

jjonescz · 2026-06-04T13:23:26Z

Test plan: #81207
Speclet update: dotnet/csharplang#10196

Microsoft Reviewers: Open in CodeFlow

dotnet-policy-service · 2026-06-04T13:24:13Z

This PR modifies public API files. Please follow the instructions at https://github.com/dotnet/roslyn/blob/main/docs/contributing/API%20Review%20Process.md for ensuring all public APIs are reviewed before merging.

Copilot

Pull request overview

Adds C# parser/binder and public syntax model support for a new primary-function form unsafe(<expr>) (Unsafe Evolution), including updates to syntax generation outputs and extensive parsing/semantic tests.

Changes:

Introduces SyntaxKind.UnsafeExpression / UnsafeExpressionSyntax, parsing (LanguageParser.ParseUnsafeExpression) and binding (BindUnsafeExpression + unsafe-region binder flags).
Updates semantic model/binder mapping utilities to treat unsafe(<expr>) like other parenthesized constructs for binder association and “bindable node” selection.
Adds parsing tests, await-parsing coverage, and CSharp15 Unsafe Evolution semantic tests (diagnostics, constant value, IOperation, flow graph, IL).

Reviewed changes

Copilot reviewed 13 out of 18 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
src/Compilers/CSharp/Test/Syntax/Parsing/ExpressionParsingTests.cs	Adds parse-tree coverage for `unsafe(<expr>)` and common postfix forms.
src/Compilers/CSharp/Test/Syntax/Parsing/AwaitParsingTests.cs	Ensures `await unsafe(...)` parses as `AwaitExpression` over `UnsafeExpression`.
src/Compilers/CSharp/Test/Syntax/Generated/Syntax.Test.xml.Generated.cs	Adds generated factory/rewriter tests for `UnsafeExpressionSyntax`.
src/Compilers/CSharp/Test/CSharp15/UnsafeEvolutionTests.cs	Adds end-to-end tests for diagnostics and semantics of `unsafe(<expr>)` under updated memory safety rules.
src/Compilers/CSharp/Portable/Syntax/SyntaxNodeExtensions.cs	Allows `UnsafeExpression` to have an associated local binder.
src/Compilers/CSharp/Portable/Syntax/SyntaxKindFacts.cs	Maps `UnsafeKeyword` as a “primary function” keyword to `UnsafeExpression`.
src/Compilers/CSharp/Portable/Syntax/SyntaxKind.cs	Introduces `SyntaxKind.UnsafeExpression` (experimental).
src/Compilers/CSharp/Portable/Syntax/Syntax.xml	Defines `UnsafeExpressionSyntax` node in the syntax model generator input.
src/Compilers/CSharp/Portable/PublicAPI.Unshipped.txt	Tracks new public API surface for `UnsafeExpressionSyntax` and visitors/factory methods.
src/Compilers/CSharp/Portable/Parser/LanguageParser.cs	Parses `unsafe(<expr>)` and disambiguates statement vs expression uses.
src/Compilers/CSharp/Portable/Generated/CSharpSyntaxGenerator/CSharpSyntaxGenerator.SourceGenerator/Syntax.xml.Syntax.Generated.cs	Generated red node for `UnsafeExpressionSyntax`.
src/Compilers/CSharp/Portable/Generated/CSharpSyntaxGenerator/CSharpSyntaxGenerator.SourceGenerator/Syntax.xml.Main.Generated.cs	Generated visitors/rewriter + `SyntaxFactory.UnsafeExpression` API.
src/Compilers/CSharp/Portable/Generated/CSharpSyntaxGenerator/CSharpSyntaxGenerator.SourceGenerator/Syntax.xml.Internal.Generated.cs	Generated green node + internal factory support for `UnsafeExpression`.
src/Compilers/CSharp/Portable/Generated/CSharp.Generated.g4	Updates grammar to include `unsafe_expression` in expressions.
src/Compilers/CSharp/Portable/Compilation/MemberSemanticModel.cs	Treats `UnsafeExpressionSyntax` similarly to other parenthesized constructs for binder lookup and binding selection.
src/Compilers/CSharp/Portable/Binder/LocalBinderFactory.cs	Creates an unsafe-region binder for `UnsafeExpressionSyntax`.
src/Compilers/CSharp/Portable/Binder/EarlyWellKnownAttributeBinder.cs	Allows `UnsafeExpression` as a syntactically valid attribute-argument form (rebinding later produces diagnostics as needed).
src/Compilers/CSharp/Portable/Binder/Binder_Expressions.cs	Binds `UnsafeExpressionSyntax` and enforces `/unsafe` + feature availability.

Copilot

Pull request overview

Copilot reviewed 15 out of 20 changed files in this pull request and generated 1 comment.

jjonescz · 2026-06-05T09:21:28Z

@333fred @AlekseyTs for reviews, thanks

AlekseyTs · 2026-06-05T15:31:25Z

Does this PR introduce a breaking change?

jjonescz · 2026-06-08T08:10:56Z

Does this PR introduce a breaking change?

No, I don't think so. unsafe was always a non-contextual keyword, so I don't think any of the new forms of its usage could be valid previously.

AlekseyTs · 2026-06-08T14:10:39Z

        TestSingleParamFunctionalOperator(SyntaxKind.RefTypeKeyword);

Consider adding a call for unsafe keyword too #Closed

Refers to: src/Compilers/CSharp/Test/Syntax/Parsing/ExpressionParsingTests.cs:865 in 765aab7. [](commit_id = 765aab7, deletion_comment = False)

AlekseyTs · 2026-06-08T14:20:39Z

                            {
                                return _syntaxFactory.GlobalStatement(ParseUnsafeStatement(attributes));
                            }
+                            else if (this.PeekToken(1).Kind == SyntaxKind.OpenParenToken)


else if (this.PeekToken(1).Kind == SyntaxKind.OpenParenToken)

Why is this necessary? It looks like we do not have special handling for checked/unchecked #Closed

I guess the following comment below explains that

// All modifiers that might start an expression are processed above.

AlekseyTs · 2026-06-08T15:21:37Z

+            }
+            else
+            {
+                CheckFeatureAvailability(node.UnsafeKeyword, MessageID.IDS_FeatureUnsafeEvolution, diagnostics);


CheckFeatureAvailability(node.UnsafeKeyword, MessageID.IDS_FeatureUnsafeEvolution, diagnostics);

Consider performing this check independently from value of this.Compilation.Options.AllowUnsafe. #Closed

This was done intentionally to match what Binder.BindUnsafeStatement does. But I agree I don't see much advantage in this.

AlekseyTs · 2026-06-08T15:33:05Z

+                return ParseExpressionStatement(attributes);
+            }
+
+            return IsPossibleUnsafeStatement() ? ParseUnsafeStatement(attributes) : null;


IsPossibleUnsafeStatement

It looks like this is the only call site. Consider inlining the helper and requesting PeekToken(1).Kind only once. #Closed

AlekseyTs · 2026-06-08T15:54:32Z

                //  checked and unchecked expressions
                case SyntaxKind.UncheckedExpression:
                case SyntaxKind.CheckedExpression:
+                case SyntaxKind.UnsafeExpression:


case SyntaxKind.UnsafeExpression:

Do we have a test observing significance of this case? #Closed

Adding UnsafeEvolutionTests.UnsafeExpression_AttributeArgument_DefaultParameterValue, thanks.

AlekseyTs · 2026-06-08T16:04:57Z

+        var expectedOperationTree = """
+            IReturnOperation (OperationKind.Return, Type: null) (Syntax: 'return unsafe(*p);')
+              ReturnedValue:
+                IOperation:  (OperationKind.None, Type: System.Int32) (Syntax: '*p')


IOperation: (OperationKind.None, Type: System.Int32) (Syntax: '*p')

Apparently we haven't implemented support for dereference (and likely other pointer specific operations) For IOperation tests, consider using supported forms of expressions. Also, given the feature, should we add support for the pointer related operations?

Also, given the feature, should we add support for the pointer related operations?

The feature only makes pointer types safe, pointer dereference is still unsafe as it always was, i.e., adding IOperation for it doesn't seem particularly motivated by this feature.

The feature only makes pointer types safe, pointer dereference is still unsafe as it always was, i.e., adding IOperation for it doesn't seem particularly motivated by this feature.

Pointers and operations on pointers were "outside" of the language. It is my understanding, that with this feature, they truly become part of the language.

To clarify, I am not suggesting to do the IOperation work in this PR

Pointers and operations on pointers were "outside" of the language. It is my understanding, that with this feature, they truly become part of the language.

That's a good point, filed #84081.

AlekseyTs · 2026-06-08T16:05:36Z

+                Predecessors: [B0]
+                Statements (0)
+                Next (Return) Block[B2]
+                    IOperation:  (OperationKind.None, Type: System.Int32) (Syntax: '*p')


IOperation: (OperationKind.None, Type: System.Int32) (Syntax: '*p')

Similar suggestion to use supported expressions #Closed

AlekseyTs · 2026-06-08T16:13:02Z

+        CreateCompilation(source,
+            options: TestOptions.UnsafeReleaseExe.WithUpdatedMemorySafetyRules())
+            .VerifyDiagnostics(
+            // (2,1): error CS0201: Only assignment, call, increment, decrement, await, and new object expressions can be used as a statement


// (2,1): error CS0201: Only assignment, call, increment, decrement, await, and new object expressions can be used as a statement

Do we report the same error for checked/unchecked? #Closed

AlekseyTs · 2026-06-08T16:15:15Z

+                {
+                    if (LookupPosition.IsBetweenTokens(position, unsafeExpression.OpenParenToken, unsafeExpression.CloseParenToken))
+                    {
+                        binder = rootBinder.GetBinder(current);


binder = rootBinder.GetBinder(current);

Do we have an explicit test covering this code path? #Closed

Adding UnsafeExpression_SemanticModel_EnclosingBinder, thanks.

AlekseyTs · 2026-06-08T16:16:03Z

Done with review pass (commit 7)

AlekseyTs · 2026-06-09T13:59:10Z

Done with review pass (commit 10). It looks like there are legitimate CI failures

Copilot

Pull request overview

Copilot reviewed 15 out of 20 changed files in this pull request and generated no new comments.

AlekseyTs

LGTM (commit 11)

jjonescz · 2026-06-12T07:22:39Z

@333fred for a second review, thanks

333fred · 2026-06-15T20:03:15Z

+    </Field>
+    <Field Name="Expression" Type="ExpressionSyntax">
+      <PropertyComment>
+        <summary>Argument of the primary function.</summary>


This comment doesn't make sense to me?

Yeah, it was copied from the CheckedExpressionSyntax, but it doesn't make sense to me either. I will improve it here.

333fred · 2026-06-15T20:25:01Z

So copilot found a fun edge case:

void M() { unsafe (int, int) Local() => (1, 2); // valid before this PR, broken after. }

Let's also test in a catch filter block, as they can do interesting things sometimes.

Let's also test in a catch filter block, as they can do interesting things sometimes.

We are already testing that in UnsafeEvolutionTests.UnsafeExpression_ExceptionFilter.

333fred · 2026-06-15T21:00:48Z

            => PeekToken(1).Kind == SyntaxKind.OpenParenToken ? ParseUsingStatement(attributes) : ParseLocalDeclarationStatement(attributes);

-        // Checking for brace to disambiguate between unsafe statement and unsafe local function
+        // Checking for brace or parenthesis to disambiguate between unsafe statement, unsafe expression, and unsafe local function


Plural

Suggested change

// Checking for brace or parenthesis to disambiguate between unsafe statement, unsafe expression, and unsafe local function

// Checking for brace or parentheses to disambiguate between unsafe statement, unsafe expression, and unsafe local function

333fred · 2026-06-15T21:07:16Z

+            {
+                int M(int i)
+                /*<bind>*/{
+                    return unsafe(i);


We should have a version of this test with flow inside the unsafe, like a ternary or null-coalscing expression.

jjonescz added 2 commits June 4, 2026 15:21

Unsafe evolution: unsafe expressions

7f308d0

Fix parsing of statements

5b8afb3

jjonescz requested a review from Copilot June 4, 2026 13:23

jjonescz added Area-Compilers Feature - Unsafe Evolution labels Jun 4, 2026

Copilot started reviewing on behalf of jjonescz June 4, 2026 13:23

View session

dotnet-policy-service Bot added the Needs API Review Needs to be reviewed by the API review council label Jun 4, 2026

Copilot AI reviewed Jun 4, 2026

View reviewed changes

Comment thread src/Compilers/CSharp/Portable/Syntax/Syntax.xml Outdated

Comment thread src/Compilers/CSharp/Portable/Binder/Binder_Expressions.cs

jjonescz added 5 commits June 4, 2026 15:37

Fixup APIs

e0d66bf

Avoid cascading errors

cf5f5f9

Test emit transparency

511c471

Update SemanticSearch ReferenceAssemblies

d1f9834

Update pre-existing tests

765aab7

jjonescz marked this pull request as ready for review June 4, 2026 15:19

jjonescz requested a review from a team as a code owner June 4, 2026 15:19

Copilot AI review requested due to automatic review settings June 4, 2026 15:19

jjonescz requested a review from a team as a code owner June 4, 2026 15:19

jjonescz requested review from 333fred and AlekseyTs June 4, 2026 15:20

Copilot started reviewing on behalf of jjonescz June 4, 2026 15:20

View session

Copilot AI reviewed Jun 4, 2026

View reviewed changes

Comment thread src/Compilers/CSharp/Test/CSharp15/UnsafeEvolutionTests.cs

AlekseyTs reviewed Jun 8, 2026

View reviewed changes

jjonescz added 4 commits June 9, 2026 11:36

Separate LangVersion and AllowUnsafe checks

a52f5db

Rename UnsafeKeyword to match other similar nodes

33e6f17

Improve code style and tests

2c5dd0a

Fixup more APIs

4bf3813

Copilot AI review requested due to automatic review settings June 9, 2026 16:20

Copilot started reviewing on behalf of jjonescz June 9, 2026 16:21

View session

jjonescz requested a review from AlekseyTs June 9, 2026 16:22

jjonescz mentioned this pull request Jun 9, 2026

Add IOperation nodes for unsafe constructs #84081

Open

Copilot AI reviewed Jun 9, 2026

View reviewed changes

AlekseyTs approved these changes Jun 10, 2026

View reviewed changes

333fred reviewed Jun 15, 2026

View reviewed changes

jjonescz added 3 commits June 16, 2026 09:30

Improve docs

b5e022e

Fix ambiguity with unsafe tuple local function

46ab1cd

Test more complex flow graph

7244d6c

jjonescz mentioned this pull request Jun 16, 2026

ILLink: codefix for C# unsafe evolution dotnet/runtime#128304

Closed

jjonescz requested a review from 333fred June 16, 2026 09:12

333fred approved these changes Jun 16, 2026

View reviewed changes

jjonescz merged commit 610e1e1 into dotnet:main Jun 16, 2026
28 checks passed

jjonescz deleted the Unsafe-39-UnsafeExpressions branch June 16, 2026 15:53

This was referenced Jun 16, 2026

[release/10.0.4xx] Source code updates from dotnet/roslyn dotnet/dotnet#7259

Merged

[main] Source code updates from dotnet/roslyn dotnet/dotnet#7260

Merged

dotnet-bot mentioned this pull request Jun 24, 2026

[Automated] PRs inserted in VS build main-11923.123 #84256

Closed

richlander mentioned this pull request Jun 30, 2026

Emit minimal C# unsafe expressions in decompiler output richlander/dotnet-inspect#2021

Closed

	// Checking for brace or parenthesis to disambiguate between unsafe statement, unsafe expression, and unsafe local function
	// Checking for brace or parentheses to disambiguate between unsafe statement, unsafe expression, and unsafe local function

Conversation

jjonescz commented Jun 4, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Microsoft Reviewers: Open in CodeFlow

Uh oh!

dotnet-policy-service Bot commented Jun 4, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

jjonescz commented Jun 5, 2026

Uh oh!

AlekseyTs commented Jun 5, 2026

Uh oh!

jjonescz commented Jun 8, 2026

Uh oh!

AlekseyTs commented Jun 8, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

AlekseyTs Jun 8, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

AlekseyTs Jun 8, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

AlekseyTs Jun 8, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

AlekseyTs Jun 8, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

AlekseyTs Jun 8, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

AlekseyTs Jun 8, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

AlekseyTs Jun 8, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

AlekseyTs Jun 8, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

AlekseyTs commented Jun 8, 2026

Uh oh!

jjonescz commented Jun 4, 2026 •

edited

Loading

AlekseyTs commented Jun 8, 2026 •

edited

Loading

AlekseyTs Jun 8, 2026 •

edited

Loading

AlekseyTs Jun 8, 2026 •

edited

Loading

AlekseyTs Jun 8, 2026 •

edited

Loading

AlekseyTs Jun 8, 2026 •

edited

Loading

AlekseyTs Jun 8, 2026 •

edited

Loading

AlekseyTs Jun 8, 2026 •

edited

Loading

AlekseyTs Jun 8, 2026 •

edited

Loading

AlekseyTs Jun 8, 2026 •

edited

Loading

jjonescz Jun 16, 2026 •

edited

Loading