Add RequiresUnsafe trimming analyzer capabilities

eng/liveILLink.targets

@@ -10,7 +10,8 @@
         '$(IsAotCompatible)' == 'true' Or '$(EnableAotAnalyzer)' == 'true' Or
         '$(PublishTrimmed)' == 'true' Or
         '$(IsTrimmable)' == 'true' Or '$(EnableTrimAnalyzer)' == 'true' Or
-        '$(EnableSingleFileAnalyzer)' == 'true')">true</_RequiresLiveILLink>
+        '$(EnableSingleFileAnalyzer)' == 'true' Or
+        '$(EnableUnsafeAnalyzer)' == 'true')">true</_RequiresLiveILLink>
   </PropertyGroup>
 
   <PropertyGroup Condition="'$(_RequiresLiveILLink)' == 'true'">
@@ -46,6 +47,13 @@
                       Private="false"
                       OutputItemType="Analyzer"
                       SetConfiguration="Configuration=$(ToolsConfiguration)" />
+
+    <!-- Add the code fix provider for IDE fix suggestions -->
+    <ProjectReference Include="$(_ILLinkTasksSourceDir)..\ILLink.CodeFix\ILLink.CodeFixProvider.csproj"
+                      ReferenceOutputAssembly="false"
+                      Private="false"
+                      OutputItemType="Analyzer"
+                      SetConfiguration="Configuration=$(ToolsConfiguration)" />
   </ItemGroup>
 
 </Project>

src/coreclr/System.Private.CoreLib/CompatibilitySuppressions.xml

@@ -29,4 +29,4 @@
     <DiagnosticId>CP0008</DiagnosticId>
     <Target>T:System.Collections.BitArray</Target>
   </Suppression>
-</Suppressions>
+</Suppressions>

src/coreclr/System.Private.CoreLib/System.Private.CoreLib.csproj

@@ -79,6 +79,7 @@
     <Optimize Condition="'$(Optimize)' == '' and '$(Configuration)' == 'Debug'">false</Optimize>
     <Optimize Condition="'$(Optimize)' == '' and '$(Configuration)' == 'Checked'">true</Optimize>
     <DefineConstants>_LOGGING;DEBUG;$(DefineConstants)</DefineConstants>
+    <EnableUnsafeAnalyzer>true</EnableUnsafeAnalyzer>
   </PropertyGroup>
   <PropertyGroup Condition="'$(Configuration)' == 'Release'">
     <Optimize Condition="'$(Optimize)' == ''">true</Optimize>

src/libraries/System.Private.CoreLib/src/System.Private.CoreLib.Shared.projitems

@@ -284,6 +284,7 @@
     <Compile Include="$(MSBuildThisFileDirectory)System\Diagnostics\CodeAnalysis\UnscopedRefAttribute.cs" />
     <Compile Include="$(MSBuildThisFileDirectory)System\Diagnostics\CodeAnalysis\RequiresAssemblyFilesAttribute.cs" />
     <Compile Include="$(MSBuildThisFileDirectory)System\Diagnostics\CodeAnalysis\RequiresDynamicCodeAttribute.cs" />
+    <Compile Include="$(MSBuildThisFileDirectory)System\Diagnostics\CodeAnalysis\RequiresUnsafeAttribute.cs" />
     <Compile Include="$(MSBuildThisFileDirectory)System\Diagnostics\CodeAnalysis\RequiresUnreferencedCodeAttribute.cs" />
     <Compile Include="$(MSBuildThisFileDirectory)System\Diagnostics\CodeAnalysis\SetsRequiredMembersAttribute.cs" />
     <Compile Include="$(MSBuildThisFileDirectory)System\Diagnostics\CodeAnalysis\StringSyntaxAttribute.cs" />

src/libraries/System.Private.CoreLib/src/System/Diagnostics/CodeAnalysis/RequiresUnsafeAttribute.cs

@@ -0,0 +1,19 @@
+// Licensed to the .NET Foundation under one or more agreements.
+// The .NET Foundation licenses this file to you under the MIT license.
+
+namespace System.Diagnostics.CodeAnalysis
+{
+    /// <summary>
+    /// Indicates that the specified method requires unsafe code that may not be available
+    /// in all execution environments.
+    /// </summary>
+    /// <remarks>
+    /// This allows tools to understand which methods are unsafe to call when targeting
+    /// environments that do not support unsafe code.
+    /// </remarks>
+    [AttributeUsage(AttributeTargets.Method | AttributeTargets.Constructor, Inherited = false)]
+    [Conditional("DEBUG")]
+    internal sealed class RequiresUnsafeAttribute : Attribute
+    {
+    }
+}

src/tools/illink/src/ILLink.CodeFix/Resources.resx

@@ -126,6 +126,9 @@
   <data name="RequiresDynamicCodeCodeFixTitle" xml:space="preserve">
     <value>Add RequiresDynamicCode attribute to parent method</value>
   </data>
+  <data name="RequiresUnsafeCodeFixTitle" xml:space="preserve">
+    <value>Add RequiresUnsafe attribute to parent method</value>
+  </data>
   <data name="UconditionalSuppressMessageCodeFixTitle" xml:space="preserve">
     <value>Add UnconditionalSuppressMessage attribute to parent method</value>
   </data>

src/tools/illink/src/ILLink.RoslynAnalyzer/DynamicallyAccessedMembersAnalyzer.cs

@@ -25,11 +25,17 @@ public sealed class DynamicallyAccessedMembersAnalyzer : DiagnosticAnalyzer
         public const string FullyQualifiedDynamicallyAccessedMembersAttribute = "System.Diagnostics.CodeAnalysis." + DynamicallyAccessedMembersAttribute;
         public const string FullyQualifiedFeatureGuardAttribute = "System.Diagnostics.CodeAnalysis.FeatureGuardAttribute";
         public static Lazy<ImmutableArray<RequiresAnalyzerBase>> RequiresAnalyzers { get; } = new Lazy<ImmutableArray<RequiresAnalyzerBase>>(GetRequiresAnalyzers);
-        private static ImmutableArray<RequiresAnalyzerBase> GetRequiresAnalyzers() =>
-            ImmutableArray.Create<RequiresAnalyzerBase>(
-                new RequiresAssemblyFilesAnalyzer(),
-                new RequiresUnreferencedCodeAnalyzer(),
-                new RequiresDynamicCodeAnalyzer());
+        private static ImmutableArray<RequiresAnalyzerBase> GetRequiresAnalyzers()
+        {
+            var builder = ImmutableArray.CreateBuilder<RequiresAnalyzerBase>();
+            builder.Add(new RequiresAssemblyFilesAnalyzer());
+            builder.Add(new RequiresUnreferencedCodeAnalyzer());
+            builder.Add(new RequiresDynamicCodeAnalyzer());
+#if DEBUG
+            builder.Add(new RequiresUnsafeAnalyzer());
+#endif
+            return builder.ToImmutable();
+        }
 
         public static ImmutableArray<DiagnosticDescriptor> GetSupportedDiagnostics()
         {

src/tools/illink/src/ILLink.RoslynAnalyzer/MSBuildPropertyOptionNames.cs

@@ -9,6 +9,9 @@ public static class MSBuildPropertyOptionNames
         public const string IncludeAllContentForSelfExtract = nameof(IncludeAllContentForSelfExtract);
         public const string EnableTrimAnalyzer = nameof(EnableTrimAnalyzer);
         public const string EnableAotAnalyzer = nameof(EnableAotAnalyzer);
+#if DEBUG
+        public const string EnableUnsafeAnalyzer = nameof(EnableUnsafeAnalyzer);
+#endif
         public const string VerifyReferenceAotCompatibility = nameof(VerifyReferenceAotCompatibility);
         public const string VerifyReferenceTrimCompatibility = nameof(VerifyReferenceTrimCompatibility);
     }

src/tools/illink/src/ILLink.RoslynAnalyzer/RequiresAnalyzerBase.cs

@@ -131,7 +131,7 @@ internal void CheckAndCreateRequiresDiagnostic(
             in DiagnosticContext diagnosticContext)
         {
             // Do not emit any diagnostic if caller is annotated with the attribute too.
-            if (containingSymbol.IsInRequiresScope(RequiresAttributeName, out _))
+            if (IsInRequiresScope(containingSymbol, in diagnosticContext))
                 return;
 
             if (CreateSpecialIncompatibleMembersDiagnostic(incompatibleMembers, member, diagnosticContext))
@@ -150,6 +150,11 @@ internal void CheckAndCreateRequiresDiagnostic(
             CreateRequiresDiagnostic(member, requiresAttribute, diagnosticContext);
         }
 
+        protected virtual bool IsInRequiresScope(ISymbol containingSymbol, in DiagnosticContext context)
+        {
+            return containingSymbol.IsInRequiresScope(RequiresAttributeName, out _);
+        }
+
         private void AnalyzeImplicitBaseCtor(SymbolAnalysisContext context)
         {
             var typeSymbol = (INamedTypeSymbol)context.Symbol;

src/tools/illink/src/ILLink.RoslynAnalyzer/RequiresUnsafeAnalyzer.cs

@@ -0,0 +1,107 @@
+// Copyright (c) .NET Foundation and contributors. All rights reserved.
+// Licensed under the MIT license. See LICENSE file in the project root for full license information.
+
+#if DEBUG
+using System;
+using System.Collections.Immutable;
+using ILLink.Shared;
+using ILLink.Shared.TrimAnalysis;
+using Microsoft.CodeAnalysis;
+using Microsoft.CodeAnalysis.CSharp;
+using Microsoft.CodeAnalysis.CSharp.Syntax;
+using Microsoft.CodeAnalysis.Diagnostics;
+
+namespace ILLink.RoslynAnalyzer
+{
+    [DiagnosticAnalyzer(LanguageNames.CSharp)]
+    public sealed class RequiresUnsafeAnalyzer : RequiresAnalyzerBase
+    {
+        private const string RequiresUnsafeAttribute = nameof(RequiresUnsafeAttribute);
+        public const string FullyQualifiedRequiresUnsafeAttribute = "System.Diagnostics.CodeAnalysis." + RequiresUnsafeAttribute;
+
+        private static readonly DiagnosticDescriptor s_requiresUnsafeOnStaticCtor = DiagnosticDescriptors.GetDiagnosticDescriptor(DiagnosticId.RequiresUnsafeOnStaticConstructor);
+        private static readonly DiagnosticDescriptor s_requiresUnsafeOnEntryPoint = DiagnosticDescriptors.GetDiagnosticDescriptor(DiagnosticId.RequiresUnsafeOnEntryPoint);
+        private static readonly DiagnosticDescriptor s_requiresUnsafeRule = DiagnosticDescriptors.GetDiagnosticDescriptor(DiagnosticId.RequiresUnsafe);
+        private static readonly DiagnosticDescriptor s_requiresUnsafeAttributeMismatch = DiagnosticDescriptors.GetDiagnosticDescriptor(DiagnosticId.RequiresUnsafeAttributeMismatch);
+
+        public override ImmutableArray<DiagnosticDescriptor> SupportedDiagnostics =>
+            ImmutableArray.Create(s_requiresUnsafeRule, s_requiresUnsafeAttributeMismatch, s_requiresUnsafeOnStaticCtor, s_requiresUnsafeOnEntryPoint);
+
+        private protected override string RequiresAttributeName => RequiresUnsafeAttribute;
+
+        internal override string RequiresAttributeFullyQualifiedName => FullyQualifiedRequiresUnsafeAttribute;
+
+        private protected override DiagnosticTargets AnalyzerDiagnosticTargets => DiagnosticTargets.MethodOrConstructor;
+
+        private protected override DiagnosticDescriptor RequiresDiagnosticRule => s_requiresUnsafeRule;
+
+        private protected override DiagnosticId RequiresDiagnosticId => DiagnosticId.RequiresUnsafe;
+
+        private protected override DiagnosticDescriptor RequiresAttributeMismatch => s_requiresUnsafeAttributeMismatch;
+
+        private protected override DiagnosticDescriptor RequiresOnStaticCtor => s_requiresUnsafeOnStaticCtor;
+
+        private protected override DiagnosticDescriptor RequiresOnEntryPoint => s_requiresUnsafeOnEntryPoint;
+
+        internal override bool IsAnalyzerEnabled(AnalyzerOptions options) =>
+            options.IsMSBuildPropertyValueTrue(MSBuildPropertyOptionNames.EnableUnsafeAnalyzer);
+
+        private protected override bool IsRequiresCheck(IPropertySymbol propertySymbol, Compilation compilation)
+        {
+            // No feature check property for RequiresUnsafe
+            return false;
+        }
+
+        protected override bool IsInRequiresScope(ISymbol containingSymbol, in DiagnosticContext context)
+        {
+            if (base.IsInRequiresScope(containingSymbol, context))
+                return true;
+
+            if (!context.Location.IsInSource)
+                return false;
+
+            // Check to see if we're in an unsafe block or unsafe member
+            var syntaxTree = context.Location.SourceTree!;
+            var root = syntaxTree.GetRoot();
+            var node = root.FindNode(context.Location.SourceSpan);
+            while (node != null && node != root)
+            {
+                if (node.IsKind(SyntaxKind.UnsafeStatement))
+                    return true;
+
+                // Check for unsafe modifier on the containing member or type
+                if (node is MethodDeclarationSyntax method && method.Modifiers.Any(SyntaxKind.UnsafeKeyword))
+                    return true;
+                if (node is LocalFunctionStatementSyntax localFunc && localFunc.Modifiers.Any(SyntaxKind.UnsafeKeyword))
+                    return true;
+                if (node is PropertyDeclarationSyntax prop && prop.Modifiers.Any(SyntaxKind.UnsafeKeyword))
+                    return true;
+                if (node is IndexerDeclarationSyntax indexer && indexer.Modifiers.Any(SyntaxKind.UnsafeKeyword))
+                    return true;
+                if (node is OperatorDeclarationSyntax op && op.Modifiers.Any(SyntaxKind.UnsafeKeyword))
+                    return true;
+                if (node is ConversionOperatorDeclarationSyntax conv && conv.Modifiers.Any(SyntaxKind.UnsafeKeyword))
+                    return true;
+                if (node is ConstructorDeclarationSyntax ctor && ctor.Modifiers.Any(SyntaxKind.UnsafeKeyword))
+                    return true;
+                if (node is TypeDeclarationSyntax type && type.Modifiers.Any(SyntaxKind.UnsafeKeyword))
+                    return true;
+
+                // Break out of lambdas/anonymous methods - they create a new scope
+                if (node.IsKind(SyntaxKind.AnonymousMethodExpression)
+                    || node.IsKind(SyntaxKind.SimpleLambdaExpression)
+                    || node.IsKind(SyntaxKind.ParenthesizedLambdaExpression))
+                    break;
+
+                node = node.Parent;
+            }
+
+            return false;
+        }
+
+        protected override bool VerifyAttributeArguments(AttributeData attribute) => true;
+
+        protected override string GetMessageFromAttribute(AttributeData? requiresAttribute) => "";
+    }
+}
+#endif

src/tools/illink/src/ILLink.RoslynAnalyzer/build/Microsoft.NET.ILLink.Analyzers.props

@@ -3,6 +3,7 @@
     <CompilerVisibleProperty Include="EnableAotAnalyzer" />
     <CompilerVisibleProperty Include="EnableSingleFileAnalyzer" />
     <CompilerVisibleProperty Include="EnableTrimAnalyzer" />
+    <CompilerVisibleProperty Include="EnableUnsafeAnalyzer" />
     <CompilerVisibleProperty Include="IncludeAllContentForSelfExtract" />
     <CompilerVisibleProperty Include="VerifyReferenceTrimCompatibility" />
     <CompilerVisibleProperty Include="VerifyReferenceAotCompatibility" />

src/tools/illink/src/ILLink.Shared/DiagnosticId.cs

@@ -212,11 +212,21 @@ public enum DiagnosticId
         RequiresDynamicCodeOnStaticConstructor = 3056,
         RequiresDynamicCodeOnEntryPoint = 3057,
         ReferenceNotMarkedIsAotCompatible = 3058,
+
         _EndAotAnalysisWarningsSentinel,
 
         // Feature guard diagnostic ids.
         ReturnValueDoesNotMatchFeatureGuards = 4000,
-        InvalidFeatureGuard = 4001
+        InvalidFeatureGuard = 4001,
+
+#if DEBUG
+        // RequiresUnsafe diagnostics are in the 5000 range, separate from other diagnostics.
+        RequiresUnsafe = 5000,
+        RequiresUnsafeAttributeMismatch = 5001,
+        RequiresUnsafeOnStaticConstructor = 5002,
+        RequiresUnsafeOnEntryPoint = 5003,
+        _EndRequiresUnsafeWarningsSentinel,
+#endif
     }
 
     public static class DiagnosticIdExtensions
@@ -240,7 +250,10 @@ public static string GetDiagnosticSubcategory(this DiagnosticId diagnosticId) =>
                 2107 => MessageSubCategory.TrimAnalysis,
                 >= 2109 and < (int)DiagnosticId._EndTrimAnalysisWarningsSentinel => MessageSubCategory.TrimAnalysis,
                 >= 3050 and <= 3052 => MessageSubCategory.AotAnalysis,
-                >= 3054 and < (int)DiagnosticId._EndAotAnalysisWarningsSentinel => MessageSubCategory.AotAnalysis,
+                >= 3054 and <= 3058 => MessageSubCategory.AotAnalysis,
+#if DEBUG
+                >= 5000 and < (int)DiagnosticId._EndRequiresUnsafeWarningsSentinel => MessageSubCategory.None,
+#endif
                 _ => MessageSubCategory.None,
             };
 

src/tools/illink/src/ILLink.Shared/SharedStrings.resx

@@ -1183,13 +1183,13 @@
     <value>'RequiresDynamicCodeAttribute' cannot be placed directly on static constructor '{0}'.</value>
   </data>
   <data name="RequiresDynamicCodeOnStaticConstructorTitle" xml:space="preserve">
-    <value>The use of 'RequiresDynamicCodeAttribute' on static constructors is disallowed since is a method not callable by the user, is only called by the runtime. Placing the attribute directly on the static constructor will have no effect, instead use 'RequiresUnreferencedCodeAttribute' on the type which will handle warning and silencing from the static constructor.</value>
+    <value>'RequiresDynamicCodeAttribute' cannot be used on static constructors because they are not directly callable. Consider placing the attribute on the type instead.</value>
   </data>
   <data name="RequiresAssemblyFilesOnStaticConstructorMessage" xml:space="preserve">
     <value>'RequiresAssemblyFilesAttribute' cannot be placed directly on static constructor '{0}'.</value>
   </data>
   <data name="RequiresAssemblyFilesOnStaticConstructorTitle" xml:space="preserve">
-    <value>The use of 'RequiresAssemblyFilesAttribute' on static constructors is disallowed since is a method not callable by the user, is only called by the runtime. Placing the attribute directly on the static constructor will have no effect, instead use 'RequiresUnreferencedCodeAttribute' on the type which will handle warning and silencing from the static constructor.</value>
+    <value>'RequiresAssemblyFilesAttribute' cannot be used on static constructors because they are not directly callable. Consider placing the attribute on the type instead.</value>
   </data>
   <data name="RequiresUnreferencedCodeOnEntryPointMessage" xml:space="preserve">
     <value>'RequiresUnreferencedCodeAttribute' cannot be placed directly on application entry point '{0}'.</value>
@@ -1263,4 +1263,28 @@
   <data name="DataflowAnalysisDidNotConvergeMessage" xml:space="preserve">
     <value>Trim dataflow analysis of member '{0}' took too long to complete. Trim safety cannot be guaranteed.</value>
   </data>
+  <data name="RequiresUnsafeTitle" xml:space="preserve">
+    <value>Calling methods annotated with 'RequiresUnsafeAttribute' may break functionality in environments that do not support unsafe code.</value>
+  </data>
+  <data name="RequiresUnsafeMessage" xml:space="preserve">
+    <value>Using member '{0}' which has 'RequiresUnsafeAttribute' requires an unsafe context, such as an unsafe block or a method marked with 'RequiresUnsafeAttribute'.{1}{2}</value>
+  </data>
+  <data name="RequiresUnsafeAttributeMismatchTitle" xml:space="preserve">
+    <value>'RequiresUnsafeAttribute' annotations must match across all interface implementations or overrides.</value>
+  </data>
+  <data name="RequiresUnsafeAttributeMismatchMessage" xml:space="preserve">
+    <value>{0}. 'RequiresUnsafeAttribute' annotations must match across all interface implementations or overrides.</value>
+  </data>
+  <data name="RequiresUnsafeOnStaticConstructorMessage" xml:space="preserve">
+    <value>'RequiresUnsafeAttribute' cannot be placed directly on static constructor '{0}'.</value>
+  </data>
+  <data name="RequiresUnsafeOnStaticConstructorTitle" xml:space="preserve">
+    <value>'RequiresUnsafeAttribute' cannot be used on static constructors because they are not directly callable. Consider placing the attribute on the type instead.</value>
+  </data>
+  <data name="RequiresUnsafeOnEntryPointMessage" xml:space="preserve">
+    <value>'RequiresUnsafeAttribute' cannot be placed directly on application entry point '{0}'.</value>
+  </data>
+  <data name="RequiresUnsafeOnEntryPointTitle" xml:space="preserve">
+    <value>The use of 'RequiresUnsafeAttribute' on entry points is disallowed since the method will be called from outside the visible app.</value>
+  </data>
 </root>

src/tools/illink/test/ILLink.RoslynAnalyzer.Tests/RequiresUnreferencedCodeAnalyzerTests.cs

@@ -17,8 +17,6 @@ namespace ILLink.RoslynAnalyzer.Tests
 {
     public class RequiresUnreferencedCodeAnalyzerTests
     {
-        static readonly DiagnosticDescriptor dynamicInvocationDiagnosticDescriptor = DiagnosticDescriptors.GetDiagnosticDescriptor(DiagnosticId.RequiresUnreferencedCode, new DiagnosticString("DynamicTypeInvocation"));
-
         static Task VerifyRequiresUnreferencedCodeAnalyzer(string source, params DiagnosticResult[] expected) =>
             VerifyRequiresUnreferencedCodeAnalyzer(source, null, expected);