.NET 11 regression: SAFEARRAY VARIANT copy-back coerces replacement values through existing byref elements #134579

// Licensed to the .NET Foundation under one or more agreements.
// The .NET Foundation licenses this file to you under the MIT license.

// When a reverse [In, Out] SAFEARRAY copy-back runs with valid native contents, the old array
// converter used MarshalCommonOleRefVariantForObject and, when the managed value did not fit the
// existing element type, replaced the array slot outright. The replacement
// VariantArrayElementMarshaler calls ObjectMarshaler.ConvertToNative, which reaches
// MarshalOleRefVariantForObject (src/coreclr/vm/olevariant.cpp) and instead coerces the value to the
// existing VARTYPE and writes it through the caller's VT_BYREF pointer.

using System;
using System.Runtime.InteropServices;

internal static unsafe class Program
{
    private const ushort VT_I4 = 3;
    private const ushort VT_BSTR = 8;
    private const ushort VT_VARIANT = 12;
    private const ushort VT_BYREF = 0x4000;

    [UnmanagedFunctionPointer(CallingConvention.Cdecl)]
    private delegate void Modify(
        [In, Out, MarshalAs(UnmanagedType.SafeArray, SafeArraySubType = VarEnum.VT_VARIANT)] object[] values);

    private static int Main()
    {
        Console.WriteLine(RuntimeInformation.FrameworkDescription);
        if (!OperatingSystem.IsWindows())
        {
            Console.WriteLine("Requires Windows built-in COM interop.");
            return 2;
        }

        int native = 4;
        SafeArray* array = SafeArrayCreateVector(VT_VARIANT, 0, 1);
        if (array is null)
        {
            Console.WriteLine("SafeArrayCreateVector failed.");
            return 2;
        }

        // The caller's element already holds a pointer to the native integer.
        Variant* elements = (Variant*)array->Data;
        elements[0].Vt = VT_BYREF | VT_I4;
        elements[0].Data1 = (nint)(&native);

        var callback = new Modify(ReplaceWithString);
        nint entryPoint = Marshal.GetFunctionPointerForDelegate(callback);
        try
        {
            ((delegate* unmanaged[Cdecl]<SafeArray*, void>)entryPoint)(array);

            Console.WriteLine($"Element VARIANT type: 0x{elements[0].Vt:X4} (expected 0x{VT_BSTR:X4} VT_BSTR)");
            Console.WriteLine($"Referenced native integer: {native} (expected 4, unchanged)");

            bool passed = native == 4 && elements[0].Vt == VT_BSTR;
            Console.WriteLine(passed
                ? "PASS"
                : "BUG: the string was coerced into the existing VT_BYREF|VT_I4 element instead of replacing the slot.");
            return passed ? 0 : 1;
        }
        catch (Exception ex)
        {
            Console.WriteLine($"BUG: replacing the element threw instead of replacing the slot: {ex}");
            return 1;
        }
        finally
        {
            GC.KeepAlive(callback);
            if (elements[0].Vt == VT_BSTR)
            {
                Marshal.FreeBSTR(elements[0].Data1);
                elements[0] = default;
            }

            SafeArrayDestroy(array);
        }
    }

    private static void ReplaceWithString(object[] values)
    {
        Console.WriteLine($"Managed method saw: [{string.Join(", ", values)}]");
        values[0] = "7";
    }

    [DllImport("oleaut32.dll")]
    private static extern SafeArray* SafeArrayCreateVector(ushort vt, int lowerBound, uint count);

    [DllImport("oleaut32.dll")]
    private static extern int SafeArrayDestroy(SafeArray* array);

    [StructLayout(LayoutKind.Sequential)]
    private struct Variant
    {
        public ushort Vt;
        public ushort Reserved1;
        public ushort Reserved2;
        public ushort Reserved3;
        public nint Data1;
        public nint Data2;
    }

    [StructLayout(LayoutKind.Sequential)]
    private struct SafeArray
    {
        public ushort Dimensions;
        public ushort Features;
        public uint ElementSize;
        public uint Locks;
        public nint Data;
        public uint Elements;
        public int LowerBound;
    }
}