Trimmer doesn't warn on reflection access to RUC override method

[vitek-karas]

Found by @MichalStrehovsky

interface IBase
{
    [RequriesUnreferencedCode("")]
    void DoSomethingDangerous();
}
class Implementation : IBase
{
    [RequiresUnreferencedCode("")]
    public void DoSomethingDangerous() { Console.WriteLine("!!!DANGER!!!"); }
}
void CallMethodOnInstance<[DynamicallyAccessedMembers(DynamicallyAccessedMemberTypes.PublicMethods)] T>(T instance)
{
    typeof(T).GetMethod("DoSomethingDangerous").Invoke(instance, Array.Empty<object>());
}
static void Main()
{
    CallMethodOnInstance(new Implementation);
}

The above will not produce any warning when trimmed, but when executed it will print out !!!DANGER!!!.
The bug is that ILLink will not warn if a method is an override and is in RUC scope and is marked due to annotation (so broader marking like PublicMethods).
This was done assuming that the same broad marking will also mark the base method which will warn. But that's not always true. Reflection doesn't return base interface methods when usual GetMethod is called. ILLink doesn't enumerate the base interface methods in this case either.

Tagging subscribers to this area: @agocke, @sbomer, @vitek-karas
See info in area-owners.md if you want to be subscribed.

Issue Details

---

Found by @MichalStrehovsky

interface IBase
{
    [RequriesUnreferencedCode("")]
    void DoSomethingDangerous();
}
class Implementation : IBase
{
    [RequiresUnreferencedCode("")]
    public void DoSomethingDangerous() { Console.WriteLine("!!!DANGER!!!"); }
}
void CallMethodOnInstance<[DynamicallyAccessedMembers(DynamicallyAccessedMemberTypes.PublicMethods)] T>(T instance)
{
    typeof(T).GetMethod("DoSomethingDangerous").Invoke(instance, Array.Empty<object>());
}
static void Main()
{
    CallMethodOnInstance(new Implementation);
}

The above will not produce any warning when trimmed, but when executed it will print out !!!DANGER!!!.
The bug is that ILLink will not warn if a method is an override and is in RUC scope and is marked due to annotation (so broader marking like PublicMethods).
This was done assuming that the same broad marking will also mark the base method which will warn. But that's not always true. Reflection doesn't return base interface methods when usual GetMethod is called. ILLink doesn't enumerate the base interface methods in this case either.

Author:	vitek-karas
Assignees:	-
Labels:	area-Tools-ILLink
Milestone:	8.0.0

[vitek-karas]

There's an interesting discrepancy in behavior:

TestDirectReflectionAccess(new Derived());

// IL2026 - Base.DoSomethingDangerous
TestAnnotatedReflectionAccess(new Derived());

void TestDirectReflectionAccess(object instance)
{
    // IL2026 - Base.DoSomethingDangerous
    // IL2026 - Derived.DoSomethingDangerous
    typeof(Derived).GetMethod("DoSomethingDangerous")!.Invoke(instance, Array.Empty<object>());
}

void TestAnnotatedReflectionAccess<[DynamicallyAccessedMembers(DynamicallyAccessedMemberTypes.PublicMethods)] T>(T instance)
{
    typeof(T).GetMethod("DoSomethingDangerous")!.Invoke(instance, Array.Empty<object>());
}

class Base
{
    [RequiresUnreferencedCode("Base")]
    public virtual void DoSomethingDangerous() { }
}

class Derived : Base
{
    [RequiresUnreferencedCode("Derived")]
    public override void DoSomethingDangerous() { }
}

If the reflection access is "direct", so the analysis can figure out the exact type and the method name, it will actually warn about both the derived and base methods. But if the access is indirect through annotation, then it only warns about the base method (the same logic as described in the original issue description kicks in an override methods do not warn).

[MichalStrehovsky]

Would it be very bad if we just warn about all occurrences? Was the deduplication added based on negative feedback or are we just being proactive?

[vitek-karas]

I'm still trying to figure out all the cases here, but in general I agree. My current working theory:

• Warn on all occurrences - per the internal algorithm (whatever the algorithm finds, warn on it)
• Don't warn when algorithm finds compiler generated code - this includes local functions and lambdas and obviously all of state machines, but will also trigger for things like delegate cache types for example.

There's another interesting thing I found:
In the above Base/Derived sample calling typeof(Derived).GetMethods() will return only Derived.DoSomethingDangerous, it will not return Base.DoSomethingDangerous. Similarly typeof(Derived).GetMethod() returns Derived.DoSomethingDangerous and does not fail since it doesn't "find" the base method. ILLink will see both methods in both cases.
Fixing this would require us to perform virtual override resolution - similar to what ILLink does today but used the other way round (avoid warning on base instead of on override).

I'm not sure we should try to do that - it's complex, linker will get it wrong (due to its buggy override resolution algo) and the value is questionable.

[vitek-karas]

Another interesting discrepancy. Analyzer doesn't implement any of the above mentioned logic in ILLink and so it will actually generate 2 warnings in the DAM case (for base and derived).

[vitek-karas]

Also related #86032

[vitek-karas]

This has been fixed in #86816.

The only piece remaining is to remove access-to-compiler-generated-code warnings from ILLink - so IL2118, IL2119 and IL2120. That work is tracked by #85042.