Crash in DataFlowAnalysis

[bkoelman]

Version Used:
Microsoft.CodeAnalysis v2.8.2

Steps to Reproduce:
Consider the next program, which runs data flow analysis on lambda expression x => true:

using System.Linq;
using Microsoft.CodeAnalysis;
using Microsoft.CodeAnalysis.CSharp;
using Microsoft.CodeAnalysis.CSharp.Syntax;

namespace RoslynDataFlowCrash
{
    class Program
    {
        static void Main()
        {
            const string source = @"
class C
{
    object P { get; } = Create(nameof(P), x => true);

    static object Create(string name, Func<string, bool> f) => throw null;
}
";

            SyntaxTree tree = CSharpSyntaxTree.ParseText(source);
            var compilation = CSharpCompilation.Create("test.dll", new[] { tree });
            var model = compilation.GetSemanticModel(tree);

            SimpleLambdaExpressionSyntax lambdaSyntax = tree.GetRoot().DescendantNodes().OfType<SimpleLambdaExpressionSyntax>().First();

            DataFlowAnalysis dataFlowAnalysis = model.AnalyzeDataFlow(lambdaSyntax.Body);

            bool succeeded = dataFlowAnalysis.Succeeded; // NullReferenceException
        }
    }
}

Expected Behavior:
No exception.

Actual Behavior:
NullReferenceException. Full stack trace:

System.NullReferenceException
  HResult=0x80004003
  Message=Object reference not set to an instance of an object.
  Source=Microsoft.CodeAnalysis.CSharp
  StackTrace:
   at Microsoft.CodeAnalysis.CSharp.Binder.AccessingAutoPropertyFromConstructor(BoundExpression receiver, PropertySymbol propertySymbol, Symbol fromMember)
   at Microsoft.CodeAnalysis.CSharp.Binder.AccessingAutoPropertyFromConstructor(BoundPropertyAccess propertyAccess, Symbol fromMember)
   at Microsoft.CodeAnalysis.CSharp.DataFlowPass.VisitPropertyAccess(BoundPropertyAccess node)
   at Microsoft.CodeAnalysis.CSharp.BoundPropertyAccess.Accept(BoundTreeVisitor visitor)
   at Microsoft.CodeAnalysis.CSharp.PreciseAbstractFlowPass`1.VisitExpressionWithoutStackGuard(BoundExpression node)
   at Microsoft.CodeAnalysis.CSharp.BoundTreeVisitor.VisitExpressionWithStackGuard(Int32& recursionDepth, BoundExpression node)
   at Microsoft.CodeAnalysis.CSharp.PreciseAbstractFlowPass`1.VisitWithStackGuard(BoundNode node)
   at Microsoft.CodeAnalysis.CSharp.PreciseAbstractFlowPass`1.VisitAlways(BoundNode node)
   at Microsoft.CodeAnalysis.CSharp.PreciseAbstractFlowPass`1.Visit(BoundNode node)
   at Microsoft.CodeAnalysis.CSharp.PreciseAbstractFlowPass`1.VisitNameOfOperator(BoundNameOfOperator node)
   at Microsoft.CodeAnalysis.CSharp.BoundNameOfOperator.Accept(BoundTreeVisitor visitor)
   at Microsoft.CodeAnalysis.CSharp.PreciseAbstractFlowPass`1.VisitExpressionWithoutStackGuard(BoundExpression node)
   at Microsoft.CodeAnalysis.CSharp.BoundTreeVisitor.VisitExpressionWithStackGuard(Int32& recursionDepth, BoundExpression node)
   at Microsoft.CodeAnalysis.CSharp.PreciseAbstractFlowPass`1.VisitWithStackGuard(BoundNode node)
   at Microsoft.CodeAnalysis.CSharp.PreciseAbstractFlowPass`1.VisitAlways(BoundNode node)
   at Microsoft.CodeAnalysis.CSharp.PreciseAbstractFlowPass`1.Visit(BoundNode node)
   at Microsoft.CodeAnalysis.CSharp.PreciseAbstractFlowPass`1.VisitArguments(ImmutableArray`1 arguments, ImmutableArray`1 refKindsOpt, MethodSymbol method)
   at Microsoft.CodeAnalysis.CSharp.PreciseAbstractFlowPass`1.VisitCall(BoundCall node)
   at Microsoft.CodeAnalysis.CSharp.DataFlowPass.VisitCall(BoundCall node)
   at Microsoft.CodeAnalysis.CSharp.BoundCall.Accept(BoundTreeVisitor visitor)
   at Microsoft.CodeAnalysis.CSharp.PreciseAbstractFlowPass`1.VisitExpressionWithoutStackGuard(BoundExpression node)
   at Microsoft.CodeAnalysis.CSharp.BoundTreeVisitor.VisitExpressionWithStackGuard(Int32& recursionDepth, BoundExpression node)
   at Microsoft.CodeAnalysis.CSharp.PreciseAbstractFlowPass`1.VisitWithStackGuard(BoundNode node)
   at Microsoft.CodeAnalysis.CSharp.PreciseAbstractFlowPass`1.VisitAlways(BoundNode node)
   at Microsoft.CodeAnalysis.CSharp.PreciseAbstractFlowPass`1.Visit(BoundNode node)
   at Microsoft.CodeAnalysis.CSharp.PreciseAbstractFlowPass`1.Scan(Boolean& badRegion)
   at Microsoft.CodeAnalysis.CSharp.DataFlowPass.Scan(Boolean& badRegion)
   at Microsoft.CodeAnalysis.CSharp.PreciseAbstractFlowPass`1.Analyze(Boolean& badRegion)
   at Microsoft.CodeAnalysis.CSharp.DataFlowPass.Analyze(Boolean& badRegion, DiagnosticBag diagnostics)
   at Microsoft.CodeAnalysis.CSharp.UnassignedVariablesWalker.Analyze(CSharpCompilation compilation, Symbol member, BoundNode node, Boolean convertInsufficientExecutionStackExceptionToCancelledByStackGuardException)
   at Microsoft.CodeAnalysis.CSharp.CSharpDataFlowAnalysis.get_UnassignedVariables()
   at Microsoft.CodeAnalysis.CSharp.CSharpDataFlowAnalysis.get_DataFlowsIn()
   at Microsoft.CodeAnalysis.CSharp.CSharpDataFlowAnalysis.get_Succeeded()
   at RoslynDataFlowCrash.Program.Main() in E:\Bart\Source\Visual Studio 2017\RoslynDataFlowCrash\RoslynDataFlowCrash\Program.cs:line 29

[bkoelman]

Above is a simplified repro. Actual crash was found during analysis of:

        public static PerLanguageOption<bool> UseTabs { get; } =
            new PerLanguageOption<bool>(nameof(FormattingOptions), nameof(UseTabs), defaultValue: false,
                storageLocations: new EditorConfigStorageLocation<bool>("indent_style", s => s == "tab"));

in file .\roslyn\src\Workspaces\Core\Portable\Formatting.FormattingOptions.cs

[gafter]

Thank you for so carefully narrowing down the repro!

[gafter]

Possibly related to #19845