Add RequiresUnsafeAttribute and start annotating corelib

Directory.Build.props

@@ -229,7 +229,7 @@
 
   <!-- Packaging -->
   <PropertyGroup>
-    <GitHubRepositoryName>runtime</GitHubRepositoryName>
+    <GitHubRepositoryName>runtimelab</GitHubRepositoryName>
     <RepositoryUrl>https://github.com/dotnet/$(GitHubRepositoryName)</RepositoryUrl>
     <PackageProjectUrl>https://dot.net</PackageProjectUrl>
     <Owners>microsoft,dotnetframework</Owners>

eng/Versions.props

@@ -12,7 +12,7 @@
     <PackageVersionNet8>8.0.$([MSBuild]::Add($([System.Version]::Parse('$(PackageVersionNet9)').Build),11))</PackageVersionNet8>
     <PackageVersionNet7>7.0.20</PackageVersionNet7>
     <PackageVersionNet6>6.0.36</PackageVersionNet6>
-    <PreReleaseVersionLabel>rc</PreReleaseVersionLabel>
+    <PreReleaseVersionLabel>unsafe</PreReleaseVersionLabel>
     <PreReleaseVersionIteration>1</PreReleaseVersionIteration>
     <!-- Enable to remove prerelease label. -->
     <StabilizePackageVersion Condition="'$(StabilizePackageVersion)' == ''">false</StabilizePackageVersion>

src/coreclr/System.Private.CoreLib/System.Private.CoreLib.csproj

@@ -22,6 +22,7 @@
     <FeaturePortableThreadPool Condition="'$(TargetsBrowser)' != 'true'">true</FeaturePortableThreadPool>
     <FeaturePortableTimer Condition="'$(TargetsBrowser)' != 'true'">true</FeaturePortableTimer>
     <FeatureSingleThread Condition="'$(TargetsBrowser)' == 'true'">true</FeatureSingleThread>
+    <EnableUnsafeAnalyzer>true</EnableUnsafeAnalyzer>
   </PropertyGroup>
 
   <ItemGroup>

src/libraries/Directory.Build.props

@@ -50,6 +50,7 @@
     <Nullable Condition="'$(Nullable)' == '' and '$(IsTestProject)' == 'true'">annotations</Nullable>
     <!-- AOT compatibility is enabled by default for src/ref projects. -->
     <IsAotCompatible Condition="'$(IsAotCompatible)' == '' and ('$(IsSourceProject)' == 'true' or '$(IsReferenceAssemblyProject)' == 'true')">true</IsAotCompatible>
+    <EnableUnsafeAnalyzer>true</EnableUnsafeAnalyzer>
   </PropertyGroup>
 
   <!-- Set up common paths -->

src/libraries/System.Private.CoreLib/src/System.Private.CoreLib.Shared.projitems

@@ -286,6 +286,7 @@
     <Compile Include="$(MSBuildThisFileDirectory)System\Diagnostics\CodeAnalysis\RequiresAssemblyFilesAttribute.cs" />
     <Compile Include="$(MSBuildThisFileDirectory)System\Diagnostics\CodeAnalysis\RequiresDynamicCodeAttribute.cs" />
     <Compile Include="$(MSBuildThisFileDirectory)System\Diagnostics\CodeAnalysis\RequiresUnreferencedCodeAttribute.cs" />
+    <Compile Include="$(MSBuildThisFileDirectory)System\Diagnostics\CodeAnalysis\RequiresUnsafeAttribute.cs" />
     <Compile Include="$(MSBuildThisFileDirectory)System\Diagnostics\CodeAnalysis\SetsRequiredMembersAttribute.cs" />
     <Compile Include="$(MSBuildThisFileDirectory)System\Diagnostics\CodeAnalysis\StringSyntaxAttribute.cs" />
     <Compile Include="$(MSBuildThisFileDirectory)System\Diagnostics\CodeAnalysis\SuppressMessageAttribute.cs" />

src/libraries/System.Private.CoreLib/src/System/Buffers/SharedArrayPool.cs

@@ -60,7 +60,10 @@ public override T[] Rent(int minimumLength)
             SharedArrayPoolThreadLocalArray[]? tlsBuckets = t_tlsBuckets;
             if (tlsBuckets is not null && (uint)bucketIndex < (uint)tlsBuckets.Length)
             {
-                buffer = Unsafe.As<T[]>(tlsBuckets[bucketIndex].Array);
+                unsafe
+                {
+                    buffer = Unsafe.As<T[]>(tlsBuckets[bucketIndex].Array);
+                }
                 if (buffer is not null)
                 {
                     tlsBuckets[bucketIndex].Array = null;
@@ -79,7 +82,10 @@ public override T[] Rent(int minimumLength)
                 SharedArrayPoolPartitions? b = perCoreBuckets[bucketIndex];
                 if (b is not null)
                 {
-                    buffer = Unsafe.As<T[]>(b.TryPop());
+                    unsafe
+                    {
+                        buffer = Unsafe.As<T[]>(b.TryPop());
+                    }
                     if (buffer is not null)
                     {
                         if (log.IsEnabled())

src/libraries/System.Private.CoreLib/src/System/Delegate.cs

@@ -128,9 +128,15 @@ public TDelegate Current
             public bool MoveNext()
             {
                 int index = _index + 1;
-                if ((_current = Unsafe.As<TDelegate>(_delegate?.TryGetAt(index))) == null)
+                unsafe
                 {
-                    return false;
+                    unsafe
+                    {
+                        if ((_current = Unsafe.As<TDelegate>(_delegate?.TryGetAt(index))) == null)
+                        {
+                            return false;
+                        }
+                    }
                 }
                 _index = index;
                 return true;

src/libraries/System.Private.CoreLib/src/System/Diagnostics/CodeAnalysis/RequiresUnsafeAttribute.cs

@@ -0,0 +1,18 @@
+// Licensed to the .NET Foundation under one or more agreements.
+// The .NET Foundation licenses this file to you under the MIT license.
+
+namespace System.Diagnostics.CodeAnalysis
+{
+    /// <summary>
+    /// Indicates that the specified method requires dynamic access to code that is not referenced
+    /// statically, for example through <see cref="Reflection"/>.
+    /// </summary>
+    /// <remarks>
+    /// This allows tools to understand which methods are unsafe to call when removing unreferenced
+    /// code from an application.
+    /// </remarks>
+    [AttributeUsage(AttributeTargets.Method | AttributeTargets.Constructor, Inherited = false)]
+    internal sealed class RequiresUnsafeAttribute : Attribute
+    {
+    }
+}

src/libraries/System.Private.CoreLib/src/System/Memory.cs

@@ -284,8 +284,11 @@ public Span<T> Span
                     {
                         // Special-case string since it's the most common for ROM<char>.
 
-                        refToReturn = ref Unsafe.As<char, T>(ref ((string)tmpObject).GetRawStringData());
-                        lengthOfUnderlyingSpan = Unsafe.As<string>(tmpObject).Length;
+                        unsafe
+                        {
+                            refToReturn = ref Unsafe.As<char, T>(ref ((string)tmpObject).GetRawStringData());
+                            lengthOfUnderlyingSpan = Unsafe.As<string>(tmpObject).Length;
+                        }
                     }
                     else if (RuntimeHelpers.ObjectHasComponentSize(tmpObject))
                     {
@@ -379,6 +382,11 @@ public Span<T> Span
         /// <exception cref="ArgumentException">
         /// An instance with nonprimitive (non-blittable) members cannot be pinned.
         /// </exception>
+        /// <remarks>
+        /// To use this method safely, the target <see cref="Memory{T}"/> must not be torn while the
+        /// returned <see cref="MemoryHandle"/> is in use.
+        /// </remarks>
+        [RequiresUnsafe]
         public unsafe MemoryHandle Pin()
         {
             // Just like the Span property getter, we have special support for a mutable Memory<char>

src/libraries/System.Private.CoreLib/src/System/MemoryExtensions.cs

@@ -5905,7 +5905,10 @@ internal SpanSplitEnumerator(ReadOnlySpan<T> source, ReadOnlySpan<T> separators)
                 _source = source;
                 if (typeof(T) == typeof(char) && separators.Length == 0)
                 {
-                    _searchValues = Unsafe.As<SearchValues<T>>(string.SearchValuesStorage.WhiteSpaceChars);
+                    unsafe
+                    {
+                        _searchValues = Unsafe.As<SearchValues<T>>(string.SearchValuesStorage.WhiteSpaceChars);
+                    }
                     _splitMode = SpanSplitEnumeratorMode.SearchValues;
                 }
                 else

src/libraries/System.Private.CoreLib/src/System/ReadOnlyMemory.cs

@@ -206,8 +206,11 @@ public ReadOnlySpan<T> Span
                     {
                         // Special-case string since it's the most common for ROM<char>.
 
-                        refToReturn = ref Unsafe.As<char, T>(ref ((string)tmpObject).GetRawStringData());
-                        lengthOfUnderlyingSpan = Unsafe.As<string>(tmpObject).Length;
+                        unsafe
+                        {
+                            refToReturn = ref Unsafe.As<char, T>(ref ((string)tmpObject).GetRawStringData());
+                            lengthOfUnderlyingSpan = Unsafe.As<string>(tmpObject).Length;
+                        }
                     }
                     else if (RuntimeHelpers.ObjectHasComponentSize(tmpObject))
                     {
@@ -223,8 +226,11 @@ public ReadOnlySpan<T> Span
                         // 'tmpObject is T[]' below also handles things like int[] <-> uint[] being convertible
                         Debug.Assert(tmpObject is T[]);
 
-                        refToReturn = ref MemoryMarshal.GetArrayDataReference(Unsafe.As<T[]>(tmpObject));
-                        lengthOfUnderlyingSpan = Unsafe.As<T[]>(tmpObject).Length;
+                        unsafe
+                        {
+                            refToReturn = ref MemoryMarshal.GetArrayDataReference(Unsafe.As<T[]>(tmpObject));
+                            lengthOfUnderlyingSpan = Unsafe.As<T[]>(tmpObject).Length;
+                        }
                     }
                     else
                     {
@@ -235,9 +241,12 @@ public ReadOnlySpan<T> Span
                         // constructor or other public API which would allow such a conversion.
 
                         Debug.Assert(tmpObject is MemoryManager<T>);
-                        Span<T> memoryManagerSpan = Unsafe.As<MemoryManager<T>>(tmpObject).GetSpan();
-                        refToReturn = ref MemoryMarshal.GetReference(memoryManagerSpan);
-                        lengthOfUnderlyingSpan = memoryManagerSpan.Length;
+                        unsafe
+                        {
+                            Span<T> memoryManagerSpan = Unsafe.As<MemoryManager<T>>(tmpObject).GetSpan();
+                            refToReturn = ref MemoryMarshal.GetReference(memoryManagerSpan);
+                            lengthOfUnderlyingSpan = memoryManagerSpan.Length;
+                        }
                     }
 
                     // If the Memory<T> or ReadOnlyMemory<T> instance is torn, this property getter has undefined behavior.

src/libraries/System.Private.CoreLib/src/System/Runtime/CompilerServices/ConditionalWeakTable.cs

@@ -711,7 +711,10 @@ internal bool Remove(TKey key, [MaybeNullWhen(false)] out TValue value)
                 if (entryIndex != -1)
                 {
                     RemoveIndex(entryIndex);
-                    value = Unsafe.As<TValue>(valueObject!);
+                    unsafe
+                    {
+                        value = Unsafe.As<TValue>(valueObject!);
+                    }
                     return true;
                 }
 

src/libraries/System.Private.CoreLib/src/System/Runtime/CompilerServices/Unsafe.cs

@@ -63,6 +63,7 @@ public static int SizeOf<T>()
         // Mono:As
         [NonVersionable]
         [MethodImpl(MethodImplOptions.AggressiveInlining)]
+        [RequiresUnsafe]
         [return: NotNullIfNotNull(nameof(o))]
         public static T? As<T>(object? o) where T : class?
         {

src/libraries/System.Private.CoreLib/src/System/SearchValues/Strings/AsciiStringSearchValuesTeddyBase.cs

@@ -560,11 +560,14 @@ private bool TryFindMatch(ReadOnlySpan<char> span, ref char searchSpace, Vector1
                     object? bucket = _buckets[candidateOffset];
                     Debug.Assert(bucket is not null);
 
-                    if (TBucketized.Value
-                        ? StartsWith<TCaseSensitivity>(ref matchRef, lengthRemaining, Unsafe.As<string[]>(bucket))
-                        : StartsWith<TCaseSensitivity>(ref matchRef, lengthRemaining, Unsafe.As<string>(bucket)))
+                    unsafe
                     {
-                        return true;
+                        if (TBucketized.Value
+                            ? StartsWith<TCaseSensitivity>(ref matchRef, lengthRemaining, Unsafe.As<string[]>(bucket))
+                            : StartsWith<TCaseSensitivity>(ref matchRef, lengthRemaining, Unsafe.As<string>(bucket)))
+                        {
+                            return true;
+                        }
                     }
 
                     candidateMask = BitOperations.ResetLowestSetBit(candidateMask);
@@ -605,11 +608,14 @@ private bool TryFindMatch(ReadOnlySpan<char> span, ref char searchSpace, Vector2
                     object? bucket = _buckets[candidateOffset];
                     Debug.Assert(bucket is not null);
 
-                    if (TBucketized.Value
-                        ? StartsWith<TCaseSensitivity>(ref matchRef, lengthRemaining, Unsafe.As<string[]>(bucket))
-                        : StartsWith<TCaseSensitivity>(ref matchRef, lengthRemaining, Unsafe.As<string>(bucket)))
+                    unsafe
                     {
-                        return true;
+                        if (TBucketized.Value
+                            ? StartsWith<TCaseSensitivity>(ref matchRef, lengthRemaining, Unsafe.As<string[]>(bucket))
+                            : StartsWith<TCaseSensitivity>(ref matchRef, lengthRemaining, Unsafe.As<string>(bucket)))
+                        {
+                            return true;
+                        }
                     }
 
                     candidateMask = BitOperations.ResetLowestSetBit(candidateMask);
@@ -650,11 +656,14 @@ private bool TryFindMatch(ReadOnlySpan<char> span, ref char searchSpace, Vector5
                     object? bucket = _buckets[candidateOffset];
                     Debug.Assert(bucket is not null);
 
-                    if (TBucketized.Value
-                        ? StartsWith<TCaseSensitivity>(ref matchRef, lengthRemaining, Unsafe.As<string[]>(bucket))
-                        : StartsWith<TCaseSensitivity>(ref matchRef, lengthRemaining, Unsafe.As<string>(bucket)))
+                    unsafe
                     {
-                        return true;
+                        if (TBucketized.Value
+                            ? StartsWith<TCaseSensitivity>(ref matchRef, lengthRemaining, Unsafe.As<string[]>(bucket))
+                            : StartsWith<TCaseSensitivity>(ref matchRef, lengthRemaining, Unsafe.As<string>(bucket)))
+                        {
+                            return true;
+                        }
                     }
 
                     candidateMask = BitOperations.ResetLowestSetBit(candidateMask);

src/libraries/System.Private.CoreLib/src/System/Threading/Tasks/Task.cs

@@ -2382,7 +2382,7 @@
         {
             Debug.Assert(obj is Task);
             // Only used privately to pass directly to EC.Run
             Unsafe.As<Task>(obj).InnerInvoke();
         };
 
         /// <summary>
@@ -6743,7 +6743,10 @@
                 // since if argument was strongly-typed as an array, it would have bound to the array-based overload.
                 if (tasks.GetType() == typeof(List<TTask>))
                 {
-                    return WhenAnyCore((ReadOnlySpan<TTask>)CollectionsMarshal.AsSpan(Unsafe.As<List<TTask>>(tasks)));
+                    unsafe
+                    {
+                        return WhenAnyCore((ReadOnlySpan<TTask>)CollectionsMarshal.AsSpan(Unsafe.As<List<TTask>>(tasks)));
+                    }
                 }
                 if (tasks is TTask[] tasksAsArray)
                 {