Replace test with one that constructs the exact problematic metadata blob

Copilot · stephentoub · Copilot · commit fe17a0bed110 · 2026-02-13T01:44:48.000Z
The C# compiler never generates a zero-length user-defined type name in
the FieldMarshal blob - it omits the length byte entirely. The previous
test using C# attributes therefore did not exercise the bug.

This new test uses PersistedAssemblyBuilder to create a valid PE and then
injects a FieldMarshal blob with the exact bytes that tlbimp produces:
  0x1D (NATIVE_TYPE_SAFEARRAY) | 0x09 (VT_DISPATCH) | 0x00 (string len 0)
The trailing zero-length string is the trigger for the bug.

Co-authored-by: stephentoub &lt;2642209+stephentoub@users.noreply.github.com&gt;
diff --git a/src/libraries/System.Runtime.InteropServices/tests/System.Runtime.InteropServices.UnitTests/System/Runtime/InteropServices/MarshalAsAttributeTests.cs b/src/libraries/System.Runtime.InteropServices/tests/System.Runtime.InteropServices.UnitTests/System/Runtime/InteropServices/MarshalAsAttributeTests.cs
@@ -1,8 +1,13 @@
 // Licensed to the .NET Foundation under one or more agreements.
 // The .NET Foundation licenses this file to you under the MIT license.
 
-using System.Linq;
+using System.IO;
 using System.Reflection;
+using System.Reflection.Emit;
+using System.Reflection.Metadata;
+using System.Reflection.Metadata.Ecma335;
+using System.Reflection.PortableExecutable;
+using System.Runtime.Loader;
 using Xunit;
 
 namespace System.Runtime.InteropServices.Tests
@@ -29,31 +34,82 @@ public void Ctor_ShortUnmanagedType(short umanagedType)
             Assert.Equal((UnmanagedType)umanagedType, attribute.Value);
         }
 
-        [Theory]
-        [InlineData(nameof(ISafeArrayMarshallingTest.Method1))]
-        [InlineData(nameof(ISafeArrayMarshallingTest.Method2))]
-        public void SafeArrayParameter_NoUserDefinedSubType_CustomAttributesDoNotThrow(string methodName)
+        [Fact]
+        public void SafeArrayParameter_ZeroLengthUserDefinedSubType_DoesNotThrow()
         {
-            MethodInfo method = typeof(ISafeArrayMarshallingTest).GetMethod(methodName);
-            ParameterInfo parameter = method.GetParameters().Single();
+            // Build a PE with a FieldMarshal blob that encodes
+            // NATIVE_TYPE_SAFEARRAY + VT_DISPATCH + compressed-string-length-0.
+            // tlbimp produces this format when there is no user-defined sub type name,
+            // and it previously caused TypeLoadException because the native code returned
+            // a non-null pointer past the blob boundary for the zero-length string.
+            byte[] peImage = CreatePEWithSafeArrayFieldMarshal();
+
+            AssemblyLoadContext alc = new(nameof(SafeArrayParameter_ZeroLengthUserDefinedSubType_DoesNotThrow), isCollectible: true);
+            try
+            {
+                Assembly asm = alc.LoadFromStream(new MemoryStream(peImage));
+                Type iface = asm.GetType("TestInterface");
+                MethodInfo method = iface.GetMethod("TestMethod");
+                ParameterInfo param = method.GetParameters()[0];
 
-            // Accessing CustomAttributes should not throw TypeLoadException
-            // when SafeArrayUserDefinedSubType is not specified.
-            var attributes = parameter.CustomAttributes.ToList();
+                // Accessing custom attributes must not throw TypeLoadException.
+                _ = param.GetCustomAttributes(false);
 
-            MarshalAsAttribute marshalAs = (MarshalAsAttribute)Attribute.GetCustomAttribute(parameter, typeof(MarshalAsAttribute));
-            Assert.NotNull(marshalAs);
-            Assert.Equal(UnmanagedType.SafeArray, marshalAs.Value);
-            Assert.Null(marshalAs.SafeArrayUserDefinedSubType);
+                MarshalAsAttribute attr = (MarshalAsAttribute)Attribute.GetCustomAttribute(param, typeof(MarshalAsAttribute));
+                Assert.NotNull(attr);
+                Assert.Equal(UnmanagedType.SafeArray, attr.Value);
+                Assert.Null(attr.SafeArrayUserDefinedSubType);
+            }
+            finally
+            {
+                alc.Unload();
+            }
         }
 
-        [ComImport]
-        [Guid("1FC06EAF-2B18-4D54-B7D4-E654A8BEEF5B")]
-        [InterfaceType(ComInterfaceType.InterfaceIsIDispatch)]
-        private interface ISafeArrayMarshallingTest
+        /// <summary>
+        /// Builds a minimal PE containing an interface with a method whose parameter
+        /// has a FieldMarshal blob matching what tlbimp generates for SafeArray
+        /// without a user-defined sub type:
+        ///   byte 0x1D (NATIVE_TYPE_SAFEARRAY), 0x09 (VT_DISPATCH), 0x00 (string len 0)
+        /// The trailing zero-length string distinguishes this from blobs the C# compiler
+        /// produces (which omit the length byte entirely).
+        /// </summary>
+        private static byte[] CreatePEWithSafeArrayFieldMarshal()
         {
-            void Method1([MarshalAs(UnmanagedType.SafeArray, SafeArraySubType = VarEnum.VT_DISPATCH)] object[] args);
-            void Method2([MarshalAs(UnmanagedType.SafeArray, SafeArraySubType = VarEnum.VT_UNKNOWN)] object[] args);
+            PersistedAssemblyBuilder ab = new(new AssemblyName("SafeArrayTestAsm"), typeof(object).Assembly);
+            ModuleBuilder moduleDef = ab.DefineDynamicModule("SafeArrayTestAsm.dll");
+            TypeBuilder typeDef = moduleDef.DefineType("TestInterface",
+                TypeAttributes.Interface | TypeAttributes.Abstract | TypeAttributes.Public);
+
+            MethodBuilder methodDef = typeDef.DefineMethod("TestMethod",
+                MethodAttributes.Public | MethodAttributes.Abstract | MethodAttributes.Virtual |
+                MethodAttributes.NewSlot | MethodAttributes.HideBySig,
+                typeof(void), new[] { typeof(object[]) });
+
+            methodDef.DefineParameter(1, ParameterAttributes.HasFieldMarshal, "args");
+            typeDef.CreateType();
+
+            MetadataBuilder mdBuilder = ab.GenerateMetadata(out BlobBuilder ilStream, out _);
+
+            // Inject the problematic FieldMarshal descriptor directly:
+            //   0x1D  NATIVE_TYPE_SAFEARRAY
+            //   0x09  VT_DISPATCH (compressed uint)
+            //   0x00  compressed string length = 0 (empty user-defined type name)
+            BlobBuilder marshalDescriptor = new();
+            marshalDescriptor.WriteBytes(new byte[] { 0x1D, 0x09, 0x00 });
+            mdBuilder.AddMarshallingDescriptor(
+                MetadataTokens.ParameterHandle(1),
+                mdBuilder.GetOrAddBlob(marshalDescriptor));
+
+            ManagedPEBuilder peAssembler = new(
+                PEHeaderBuilder.CreateLibraryHeader(),
+                new MetadataRootBuilder(mdBuilder),
+                ilStream,
+                flags: CorFlags.ILOnly);
+
+            BlobBuilder peOutput = new();
+            peAssembler.Serialize(peOutput);
+            return peOutput.ToArray();
         }
     }
 }
