Unsafe evolution: unsafe fields

src/Compilers/CSharp/Portable/Binder/BinderFactory.BinderFactoryVisitor.cs

@@ -372,7 +372,7 @@ public override Binder VisitConversionOperatorDeclaration(ConversionOperatorDecl
 
             public override Binder VisitFieldDeclaration(FieldDeclarationSyntax parent)
             {
-                return VisitCore(parent.Parent).SetOrClearUnsafeRegionIfNecessary(parent.Modifiers, isFieldDeclaration: true);
+                return VisitCore(parent.Parent).SetOrClearUnsafeRegionIfNecessary(parent.Modifiers);
             }
 
             public override Binder VisitEventDeclaration(EventDeclarationSyntax parent)

src/Compilers/CSharp/Portable/Binder/Binder_Conversions.cs

@@ -517,7 +517,7 @@ void checkConstraintLanguageVersionAndRuntimeSupportForConversion(SyntaxNode syn
                     Debug.Assert(elementField is { });
 
                     diagnostics.ReportUseSite(elementField, syntax);
-                    AssertNotUnsafeMemberAccess(elementField); // https://github.com/dotnet/roslyn/issues/82546: Support unsafe fields?
+                    ReportDiagnosticsIfUnsafeMemberAccess(diagnostics, elementField, syntax);
 
                     if (destination.OriginalDefinition.Equals(Compilation.GetWellKnownType(WellKnownType.System_ReadOnlySpan_T), TypeCompareKind.AllIgnoreOptions))
                     {

src/Compilers/CSharp/Portable/Binder/Binder_Expressions.cs

@@ -9819,7 +9819,7 @@ BoundExpression bindInlineArrayElementAccess(ExpressionSyntax node, BoundExpress
 
                 CheckFeatureAvailability(node, MessageID.IDS_FeatureInlineArrays, diagnostics);
                 diagnostics.ReportUseSite(elementField, node);
-                AssertNotUnsafeMemberAccess(elementField); // https://github.com/dotnet/roslyn/issues/82546: Support unsafe fields?
+                ReportDiagnosticsIfUnsafeMemberAccess(diagnostics, elementField, node);
 
                 TypeSymbol resultType;
 

src/Compilers/CSharp/Portable/Binder/Binder_Flags.cs

@@ -91,7 +91,7 @@ internal Binder WithAdditionalFlagsAndContainingMemberOrLambda(BinderFlags flags
             return new BinderWithContainingMemberOrLambda(this, this.Flags | flags, containing);
         }
 
-        internal Binder SetOrClearUnsafeRegionIfNecessary(SyntaxTokenList modifiers, bool isIteratorBody = false, bool isFieldDeclaration = false)
+        internal Binder SetOrClearUnsafeRegionIfNecessary(SyntaxTokenList modifiers, bool isIteratorBody = false)
         {
             // In C# 13 and above, iterator bodies define a safe context even when nested in an unsafe context.
             // In C# 12 and below, we keep the (spec violating) behavior that iterator bodies inherit the safe/unsafe context
@@ -107,9 +107,9 @@ internal Binder SetOrClearUnsafeRegionIfNecessary(SyntaxTokenList modifiers, boo
             }
 
             // Under the updated memory safety rules, the `unsafe` modifier on a type or member declaration
-            // does not introduce an unsafe context (no interior meaning), except for field declarations.
+            // does not introduce an unsafe context (no interior meaning).
             // `unsafe { }` blocks also introduce an unsafe context.
-            return !withoutUnsafe && modifiers.Any(SyntaxKind.UnsafeKeyword) && (isFieldDeclaration || !this.Compilation.SourceModule.UseUpdatedMemorySafetyRules)
+            return !withoutUnsafe && modifiers.Any(SyntaxKind.UnsafeKeyword) && !this.Compilation.SourceModule.UseUpdatedMemorySafetyRules
                 ? new Binder(this, this.Flags | BinderFlags.UnsafeRegion)
                 : this;
         }

src/Compilers/CSharp/Portable/Lowering/ClosureConversion/LambdaCapturedVariable.cs

@@ -138,6 +138,8 @@ private static TypeSymbol GetCapturedVariableFieldType(SynthesizedContainer fram
 
         public override RefKind RefKind => RefKind.None;
 
+        internal sealed override CallerUnsafeMode CallerUnsafeMode => CallerUnsafeMode.None;
+
         public override ImmutableArray<CustomModifier> RefCustomModifiers => ImmutableArray<CustomModifier>.Empty;
 
         internal override TypeWithAnnotations GetFieldType(ConsList<FieldSymbol> fieldsBeingBound)

src/Compilers/CSharp/Portable/Lowering/StateMachineRewriter/StateMachineFieldSymbol.cs

@@ -63,6 +63,8 @@ internal override bool SuppressDynamicAttribute
 
         public override RefKind RefKind => RefKind.None;
 
+        internal sealed override CallerUnsafeMode CallerUnsafeMode => CallerUnsafeMode.None;
+
         public override ImmutableArray<CustomModifier> RefCustomModifiers => ImmutableArray<CustomModifier>.Empty;
 
         internal override TypeWithAnnotations GetFieldType(ConsList<FieldSymbol> fieldsBeingBound)

src/Compilers/CSharp/Portable/Symbols/AnonymousTypes/SynthesizedSymbols/AnonymousType.FieldSymbol.cs

@@ -44,6 +44,8 @@ public override string Name
             public override FlowAnalysisAnnotations FlowAnalysisAnnotations
                 => FlowAnalysisAnnotations.None;
 
+            internal sealed override CallerUnsafeMode CallerUnsafeMode => CallerUnsafeMode.None;
+
             internal override bool HasSpecialName
             {
                 get { return false; }

src/Compilers/CSharp/Portable/Symbols/FieldSymbol.cs

@@ -336,8 +336,6 @@ internal virtual FieldSymbol AsMember(NamedTypeSymbol newOwner)
         /// </summary>
         internal abstract bool IsRequired { get; }
 
-        internal sealed override CallerUnsafeMode CallerUnsafeMode => CallerUnsafeMode.None; // https://github.com/dotnet/roslyn/issues/82546: Support unsafe fields?
-
         #region Use-Site Diagnostics
 
         internal override UseSiteInfo<AssemblySymbol> GetUseSiteInfo()

src/Compilers/CSharp/Portable/Symbols/Metadata/PE/PEFieldSymbol.cs

@@ -30,12 +30,13 @@ internal sealed class PEFieldSymbol : FieldSymbol
         private struct PackedFlags
         {
             // Layout:
-            // |........................|qq|rr|v|fffff|
+            // |......................|uu|qq|rr|v|fffff|
             //
             // f = FlowAnalysisAnnotations. 5 bits (4 value bits + 1 completion bit).
             // v = IsVolatile 1 bit
             // r = RefKind 2 bits
             // q = Required members. 2 bits (1 value bit + 1 completion bit).
+            // u = Requires unsafe. 2 bits (1 value bit + 1 completion bit).
 
             private const int HasDisallowNullAttribute = 0x1 << 0;
             private const int HasAllowNullAttribute = 0x1 << 1;
@@ -48,6 +49,8 @@ private struct PackedFlags
 
             private const int HasRequiredMemberAttribute = 0x1 << 8;
             private const int RequiredMemberCompletionBit = 0x1 << 9;
+            private const int RequiresUnsafeBit = 0x1 << 10;
+            private const int RequiresUnsafeCompletionBit = 0x1 << 11;
 
             private int _bits;
 
@@ -112,6 +115,24 @@ public bool TryGetHasRequiredMemberAttribute(out bool hasRequiredMemberAttribute
                 hasRequiredMemberAttribute = false;
                 return false;
             }
+
+            public bool SetRequiresUnsafe(bool requiresUnsafe)
+            {
+                int bitsToSet = RequiresUnsafeCompletionBit | (requiresUnsafe ? RequiresUnsafeBit : 0);
+                return ThreadSafeFlagOperations.Set(ref _bits, bitsToSet);
+            }
+
+            public bool TryGetRequiresUnsafe(out bool requiresUnsafe)
+            {
+                if ((_bits & RequiresUnsafeCompletionBit) != 0)
+                {
+                    requiresUnsafe = (_bits & RequiresUnsafeBit) != 0;
+                    return true;
+                }
+
+                requiresUnsafe = false;
+                return false;
+            }
         }
 
         private readonly FieldDefinitionHandle _handle;
@@ -582,15 +603,17 @@ public override ImmutableArray<CSharpAttributeData> GetAttributes()
         {
             if (RoslynImmutableInterlocked.VolatileRead(in _lazyCustomAttributes).IsDefault)
             {
-                var attributes = loadAndFilterAttributes(out var hasRequiredMemberAttribute);
+                var attributes = loadAndFilterAttributes(out var hasRequiredMemberAttribute, out var hasRequiresUnsafeAttribute);
                 _packedFlags.SetHasRequiredMemberAttribute(hasRequiredMemberAttribute);
+                _packedFlags.SetRequiresUnsafe(ComputeRequiresUnsafe(hasRequiresUnsafeAttribute));
                 ImmutableInterlocked.InterlockedInitialize(ref _lazyCustomAttributes, attributes);
             }
             return _lazyCustomAttributes;
 
-            ImmutableArray<CSharpAttributeData> loadAndFilterAttributes(out bool hasRequiredMemberAttribute)
+            ImmutableArray<CSharpAttributeData> loadAndFilterAttributes(out bool hasRequiredMemberAttribute, out bool hasRequiresUnsafeAttribute)
             {
                 hasRequiredMemberAttribute = false;
+                hasRequiresUnsafeAttribute = false;
 
                 var containingModule = ContainingPEModule;
                 if (!containingModule.TryGetNonEmptyCustomAttributes(_handle, out var customAttributeHandles))
@@ -611,6 +634,12 @@ ImmutableArray<CSharpAttributeData> loadAndFilterAttributes(out bool hasRequired
                         continue;
                     }
 
+                    if (containingModule.AttributeMatchesFilter(handle, AttributeDescription.RequiresUnsafeAttribute))
+                    {
+                        hasRequiresUnsafeAttribute = true;
+                        continue;
+                    }
+
                     builder.Add(new PEAttributeData(containingModule, handle));
                 }
 
@@ -713,5 +742,43 @@ internal override bool IsRequired
                 return hasRequiredMemberAttribute;
             }
         }
+
+        private bool RequiresUnsafe
+        {
+            get
+            {
+                if (!_packedFlags.TryGetRequiresUnsafe(out bool requiresUnsafe))
+                {
+                    bool hasRequiresUnsafeAttribute = ContainingPEModule.Module.HasAttribute(_handle, AttributeDescription.RequiresUnsafeAttribute);
+                    requiresUnsafe = ComputeRequiresUnsafe(hasRequiresUnsafeAttribute);
+                    _packedFlags.SetRequiresUnsafe(requiresUnsafe);
+                }
+
+                return requiresUnsafe;
+            }
+        }
+
+        private bool ComputeRequiresUnsafe(bool hasRequiresUnsafeAttribute)
+        {
+            return ContainingModule.UseUpdatedMemorySafetyRules
+                ? hasRequiresUnsafeAttribute
+                // This might be expensive, so we cache it in _packedFlags.
+                : !IsFixedSizeBuffer && Type.ContainsPointerOrFunctionPointer();
+        }
+
+        internal sealed override CallerUnsafeMode CallerUnsafeMode
+        {
+            get
+            {
+                if (!RequiresUnsafe)
+                {
+                    return CallerUnsafeMode.None;
+                }
+
+                return ContainingModule.UseUpdatedMemorySafetyRules
+                    ? CallerUnsafeMode.Explicit
+                    : CallerUnsafeMode.Implicit;
+            }
+        }
     }
 }

src/Compilers/CSharp/Portable/Symbols/Retargeting/RetargetingFieldSymbol.cs

@@ -118,6 +118,8 @@ public override Symbol AssociatedSymbol
             }
         }
 
+        internal sealed override CallerUnsafeMode CallerUnsafeMode => _underlyingField.CallerUnsafeMode;
+
         public override int TupleElementIndex => _underlyingField.TupleElementIndex;
 
         internal override UseSiteInfo<AssemblySymbol> GetUseSiteInfo()

src/Compilers/CSharp/Portable/Symbols/Source/FieldSymbolWithAttributesAndModifiers.cs

@@ -203,6 +203,10 @@ protected override void DecodeWellKnownAttributeImpl(ref DecodeWellKnownAttribut
             {
                 MarshalAsAttributeDecoder<FieldWellKnownAttributeData, AttributeSyntax, CSharpAttributeData, AttributeLocation>.Decode(ref arguments, AttributeTargets.Field, MessageProvider.Instance);
             }
+            else if (attribute.IsTargetAttribute(AttributeDescription.RequiresUnsafeAttribute))
+            {
+                diagnostics.Add(ErrorCode.ERR_RequiresUnsafeAttributeInSource, arguments.AttributeSyntaxOpt.Location);
+            }
             else if (ReportExplicitUseOfReservedAttributes(in arguments,
                 ReservedAttributes.DynamicAttribute
                 | ReservedAttributes.IsReadOnlyAttribute

src/Compilers/CSharp/Portable/Symbols/Source/SourceEnumConstantSymbol.cs

@@ -58,6 +58,8 @@ protected SourceEnumConstantSymbol(SourceMemberContainerTypeSymbol containingEnu
 
         public sealed override RefKind RefKind => RefKind.None;
 
+        internal sealed override CallerUnsafeMode CallerUnsafeMode => CallerUnsafeMode.None;
+
         internal override TypeWithAnnotations GetFieldType(ConsList<FieldSymbol> fieldsBeingBound)
         {
             return TypeWithAnnotations.Create(this.ContainingType);

src/Compilers/CSharp/Portable/Symbols/Source/SourceMemberFieldSymbol.cs

@@ -137,6 +137,21 @@ internal override void AddSynthesizedAttributes(PEModuleBuilder moduleBuilder, r
                     ref attributes,
                     this.DeclaringCompilation.TrySynthesizeAttribute(WellKnownMember.System_Runtime_CompilerServices_RequiredMemberAttribute__ctor));
             }
+
+            if (CallerUnsafeMode == CallerUnsafeMode.Explicit)
+            {
+                AddSynthesizedAttribute(ref attributes, moduleBuilder.TrySynthesizeRequiresUnsafeAttribute());
+            }
+        }
+
+        internal override void AfterAddingTypeMembersChecks(ConversionsBase conversions, BindingDiagnosticBag diagnostics)
+        {
+            if (CallerUnsafeMode == CallerUnsafeMode.Explicit)
+            {
+                DeclaringCompilation.EnsureRequiresUnsafeAttributeExists(diagnostics, ErrorLocation, modifyCompilation: true);
+            }
+
+            base.AfterAddingTypeMembersChecks(conversions, diagnostics);
         }
 
         internal override void PostDecodeWellKnownAttributes(ImmutableArray<CSharpAttributeData> boundAttributes, ImmutableArray<AttributeSyntax> allAttributeSyntaxNodes, BindingDiagnosticBag diagnostics, AttributeLocation symbolPart, WellKnownAttributeData decodedData)
@@ -173,6 +188,24 @@ public override int FixedSize
             }
         }
 
+        internal sealed override CallerUnsafeMode CallerUnsafeMode
+        {
+            get
+            {
+                if (ContainingModule.UseUpdatedMemorySafetyRules)
+                {
+                    return (Modifiers & DeclarationModifiers.Unsafe) != 0 &&
+                        AssociatedSymbol is null &&
+                        !IsConst
+                            ? CallerUnsafeMode.Explicit
+                            : CallerUnsafeMode.None;
+                }
+
+                return !IsFixedSizeBuffer && Type.ContainsPointerOrFunctionPointer()
+                    ? CallerUnsafeMode.Implicit : CallerUnsafeMode.None;
+            }
+        }
+
         internal static DeclarationModifiers MakeModifiers(NamedTypeSymbol containingType, SyntaxToken firstIdentifier, SyntaxTokenList modifiers, bool isRefField, BindingDiagnosticBag diagnostics, out bool modifierErrors)
         {
             bool isInterface = containingType.IsInterface;

src/Compilers/CSharp/Portable/Symbols/SubstitutedFieldSymbol.cs

@@ -94,6 +94,8 @@ public override Symbol AssociatedSymbol
             }
         }
 
+        internal sealed override CallerUnsafeMode CallerUnsafeMode => _underlyingField.CallerUnsafeMode;
+
         internal override NamedTypeSymbol FixedImplementationType(PEModuleBuilder emitModule)
         {
             // This occurs rarely, if ever.  The scenario would be a generic struct

src/Compilers/CSharp/Portable/Symbols/Synthesized/Records/SynthesizedPrimaryConstructorParameterBackingFieldSymbol.cs

@@ -47,6 +47,8 @@ public override ImmutableArray<Location> Locations
 
         public override RefKind RefKind => RefKind.None;
 
+        internal sealed override CallerUnsafeMode CallerUnsafeMode => CallerUnsafeMode.None;
+
         public override ImmutableArray<CustomModifier> RefCustomModifiers => ImmutableArray<CustomModifier>.Empty;
 
         internal override TypeWithAnnotations GetFieldType(ConsList<FieldSymbol> fieldsBeingBound)

src/Compilers/CSharp/Portable/Symbols/Synthesized/SynthesizedBackingFieldSymbol.cs

@@ -124,6 +124,8 @@ public override Location TryGetFirstLocation()
 
         public override RefKind RefKind => _property.RefKind;
 
+        internal sealed override CallerUnsafeMode CallerUnsafeMode => CallerUnsafeMode.None;
+
         public override ImmutableArray<CustomModifier> RefCustomModifiers => _property.RefCustomModifiers;
 
         internal override TypeWithAnnotations GetFieldType(ConsList<FieldSymbol> fieldsBeingBound)

src/Compilers/CSharp/Portable/Symbols/Synthesized/SynthesizedEnumValueFieldSymbol.cs

@@ -26,6 +26,8 @@ internal override bool SuppressDynamicAttribute
             get { return true; }
         }
 
+        internal sealed override CallerUnsafeMode CallerUnsafeMode => CallerUnsafeMode.None;
+
         public override RefKind RefKind => RefKind.None;
 
         public override ImmutableArray<CustomModifier> RefCustomModifiers => ImmutableArray<CustomModifier>.Empty;

src/Compilers/CSharp/Portable/Symbols/Synthesized/SynthesizedFieldSymbol.cs

@@ -42,6 +42,8 @@ internal override bool SuppressDynamicAttribute
             get { return true; }
         }
 
+        internal sealed override CallerUnsafeMode CallerUnsafeMode => CallerUnsafeMode.None;
+
         internal override TypeWithAnnotations GetFieldType(ConsList<FieldSymbol> fieldsBeingBound)
         {
             return _type;

src/Compilers/CSharp/Portable/Symbols/Synthesized/SynthesizedLambdaCacheFieldSymbol.cs

@@ -27,6 +27,8 @@ public SynthesizedLambdaCacheFieldSymbol(NamedTypeSymbol containingType, TypeSym
 
         internal override bool SuppressDynamicAttribute => true;
 
+        internal sealed override CallerUnsafeMode CallerUnsafeMode => CallerUnsafeMode.None;
+
         IMethodSymbolInternal ISynthesizedMethodBodyImplementationSymbol.Method => _topLevelMethod;
 
         // When the containing top-level method body is updated we don't need to attempt to update the cache field

src/Compilers/CSharp/Portable/Symbols/Tuples/TupleErrorFieldSymbol.cs

@@ -154,6 +154,8 @@ internal override bool SuppressDynamicAttribute
             }
         }
 
+        internal sealed override CallerUnsafeMode CallerUnsafeMode => CallerUnsafeMode.None;
+
         public override RefKind RefKind => RefKind.None;
 
         public override ImmutableArray<CustomModifier> RefCustomModifiers => ImmutableArray<CustomModifier>.Empty;

src/Compilers/CSharp/Portable/Symbols/Tuples/TupleFieldSymbol.cs

@@ -124,6 +124,8 @@ public sealed override Symbol ContainingSymbol
 
         public sealed override RefKind RefKind => _underlyingField.RefKind;
 
+        internal sealed override CallerUnsafeMode CallerUnsafeMode => _underlyingField.CallerUnsafeMode;
+
         public sealed override ImmutableArray<CustomModifier> RefCustomModifiers => _underlyingField.RefCustomModifiers;
 
         internal override TypeWithAnnotations GetFieldType(ConsList<FieldSymbol> fieldsBeingBound)