Check ref safety of arg mixing in interpolated strings

Author: jjonescz

src/Compilers/CSharp/Portable/Binder/Binder.ValueChecks.cs

@@ -1940,6 +1940,12 @@ internal SafeContext GetInterpolatedStringHandlerConversionEscapeScope(
                 escapeScope = escapeScope.Intersect(argEscape);
             }
 
+            if (!scopeOfTheContainingExpression.IsConvertibleTo(escapeScope) &&
+                !CheckInterpolatedStringHandlerInvocationArgMixing(expression, escapeFrom: scopeOfTheContainingExpression, escapeTo: escapeScope, BindingDiagnosticBag.Discarded))
+            {
+                escapeScope = scopeOfTheContainingExpression;
+            }
+
             arguments.Free();
             return escapeScope;
         }
@@ -4474,6 +4480,11 @@ internal SafeContext GetValEscape(BoundExpression expr, SafeContext scopeOfTheCo
                     return scopeOfTheContainingExpression;
 
                 case BoundKind.InterpolatedStringHandlerPlaceholder:
+                    if (_placeholderScopes?.TryGetValue((BoundInterpolatedStringHandlerPlaceholder)expr, out var scope) == true)
+                    {
+                        return scope;
+                    }
+
                     // The handler placeholder cannot escape out of the current expression, as it's a compiler-synthesized
                     // location.
                     return scopeOfTheContainingExpression;
@@ -4767,6 +4778,7 @@ internal bool CheckValEscape(SyntaxNode node, BoundExpression expr, SafeContext
                 case BoundKind.DeconstructValuePlaceholder:
                 case BoundKind.AwaitableValuePlaceholder:
                 case BoundKind.InterpolatedStringArgumentPlaceholder:
+                case BoundKind.InterpolatedStringHandlerPlaceholder:
                     if (!GetPlaceholderScope((BoundValuePlaceholderBase)expr).IsConvertibleTo(escapeTo))
                     {
                         Error(diagnostics, inUnsafeRegion ? ErrorCode.WRN_EscapeVariable : ErrorCode.ERR_EscapeVariable, node, expr.Syntax);
@@ -5610,6 +5622,11 @@ private bool CheckInterpolatedStringHandlerConversionEscape(BoundExpression expr
                 }
             }
 
+            if (result)
+            {
+                result = CheckInterpolatedStringHandlerInvocationArgMixing(expression, escapeFrom, escapeTo, diagnostics);
+            }
+
             arguments.Free();
             return result;
         }
@@ -5661,5 +5678,54 @@ void getParts(BoundInterpolatedString interpolatedString)
                 }
             }
         }
+
+        private bool CheckInterpolatedStringHandlerInvocationArgMixing(BoundExpression expression, SafeContext escapeFrom, SafeContext escapeTo, BindingDiagnosticBag diagnostics)
+        {
+            bool result = true;
+
+            while (true)
+            {
+                switch (expression)
+                {
+                    case BoundBinaryOperator binary:
+                        result &= CheckInterpolatedStringHandlerInvocationArgMixing(binary.Right, escapeFrom, escapeTo, diagnostics);
+                        expression = binary.Left;
+                        break;
+
+                    case BoundInterpolatedString interpolatedString:
+                        result &= CheckInterpolatedStringHandlerInvocationArgMixingParts(interpolatedString, escapeFrom, escapeTo, diagnostics);
+                        return result;
+
+                    default:
+                        throw ExceptionUtilities.UnexpectedValue(expression.Kind);
+                }
+            }
+        }
+
+        private bool CheckInterpolatedStringHandlerInvocationArgMixingParts(BoundInterpolatedString interpolatedString, SafeContext escapeFrom, SafeContext escapeTo, BindingDiagnosticBag diagnostics)
+        {
+            bool result = true;
+
+            foreach (var part in interpolatedString.Parts)
+            {
+                if (part is BoundCall { Method.Name: BoundInterpolatedString.AppendFormattedMethod } call)
+                {
+                    using var _ = new PlaceholderRegion(this, [((BoundInterpolatedStringHandlerPlaceholder)call.ReceiverOpt, escapeTo)]);
+                    result &= CheckInvocationArgMixing(
+                        call.Syntax,
+                        MethodInfo.Create(call.Method),
+                        receiverOpt: call.ReceiverOpt,
+                        receiverIsSubjectToCloning: call.InitialBindingReceiverIsSubjectToCloning,
+                        parameters: call.Method.Parameters,
+                        argsOpt: call.Arguments,
+                        argRefKindsOpt: call.ArgumentRefKindsOpt,
+                        argsToParamsOpt: call.ArgsToParamsOpt,
+                        scopeOfTheContainingExpression: escapeFrom,
+                        diagnostics);
+                }
+            }
+
+            return result;
+        }
     }
 }

src/Compilers/CSharp/Test/Semantic/Semantics/RefEscapingTests.cs

@@ -10227,6 +10227,123 @@ public void Utf8Addition()
             CreateCompilation(code, targetFramework: TargetFramework.Net70).VerifyDiagnostics();
         }
 
+        [Fact, WorkItem("https://github.com/dotnet/roslyn/issues/63306")]
+        public void InterpolatedString_UnscopedRef_Return()
+        {
+            var source = """
+                using System.Diagnostics.CodeAnalysis;
+                using System.Runtime.CompilerServices;
+
+                class C
+                {
+                    R M()
+                    {
+                        var local = 1;
+                        return $"{local}";
+                    }
+                }
+
+                [InterpolatedStringHandlerAttribute]
+                ref struct R
+                {
+                    public R(int literalLength, int formattedCount) { }
+
+                    public void AppendFormatted([UnscopedRef] in int x) { }
+                }
+                """;
+            CreateCompilation([source, UnscopedRefAttributeDefinition, InterpolatedStringHandlerAttribute]).VerifyDiagnostics(
+                // (9,18): error CS8350: This combination of arguments to 'R.AppendFormatted(in int)' is disallowed because it may expose variables referenced by parameter 'x' outside of their declaration scope
+                //         return $"{local}";
+                Diagnostic(ErrorCode.ERR_CallArgMixing, "{local}").WithArguments("R.AppendFormatted(in int)", "x").WithLocation(9, 18),
+                // (9,19): error CS8168: Cannot return local 'local' by reference because it is not a ref local
+                //         return $"{local}";
+                Diagnostic(ErrorCode.ERR_RefReturnLocal, "local").WithArguments("local").WithLocation(9, 19));
+        }
+
+        [Fact, WorkItem("https://github.com/dotnet/roslyn/issues/63306")]
+        public void InterpolatedString_UnscopedRef_Assignment()
+        {
+            var source = """
+                using System.Diagnostics.CodeAnalysis;
+                using System.Runtime.CompilerServices;
+
+                class C
+                {
+                    R M()
+                    {
+                        var local = 1;
+                        R r = $"{local}";
+                        return r;
+                    }
+                }
+
+                [InterpolatedStringHandlerAttribute]
+                ref struct R
+                {
+                    public R(int literalLength, int formattedCount) { }
+
+                    public void AppendFormatted([UnscopedRef] in int x) { }
+                }
+                """;
+            CreateCompilation([source, UnscopedRefAttributeDefinition, InterpolatedStringHandlerAttribute]).VerifyDiagnostics(
+                // (10,16): error CS8352: Cannot use variable 'r' in this context because it may expose referenced variables outside of their declaration scope
+                //         return r;
+                Diagnostic(ErrorCode.ERR_EscapeVariable, "r").WithArguments("r").WithLocation(10, 16));
+        }
+
+        [Fact, WorkItem("https://github.com/dotnet/roslyn/issues/63306")]
+        public void InterpolatedString_ScopedRef_Return()
+        {
+            var source = """
+                using System.Runtime.CompilerServices;
+
+                class C
+                {
+                    R M()
+                    {
+                        var local = 1;
+                        return $"{local}";
+                    }
+                }
+
+                [InterpolatedStringHandlerAttribute]
+                ref struct R
+                {
+                    public R(int literalLength, int formattedCount) { }
+
+                    public void AppendFormatted(in int x) { }
+                }
+                """;
+            CreateCompilation([source, InterpolatedStringHandlerAttribute]).VerifyDiagnostics();
+        }
+
+        [Fact, WorkItem("https://github.com/dotnet/roslyn/issues/63306")]
+        public void InterpolatedString_ScopedRef_Assignment()
+        {
+            var source = """
+                using System.Runtime.CompilerServices;
+
+                class C
+                {
+                    R M()
+                    {
+                        var local = 1;
+                        R r = $"{local}";
+                        return r;
+                    }
+                }
+
+                [InterpolatedStringHandlerAttribute]
+                ref struct R
+                {
+                    public R(int literalLength, int formattedCount) { }
+
+                    public void AppendFormatted(in int x) { }
+                }
+                """;
+            CreateCompilation([source, InterpolatedStringHandlerAttribute]).VerifyDiagnostics();
+        }
+
         [Fact, WorkItem("https://github.com/dotnet/roslyn/issues/75592")]
         public void SelfAssignment_ReturnOnly()
         {