Add unsafe evolution attributes by jjonescz · Pull Request #125721 · dotnet/runtime

jjonescz · 2026-03-18T10:59:26Z

Relates to test plan dotnet/roslyn#81207

dotnet-policy-service · 2026-03-18T11:00:41Z

Tagging subscribers to this area: @dotnet/area-system-runtime-compilerservices
See info in area-owners.md if you want to be subscribed.

Copilot

Pull request overview

Adds two runtime attributes to the public System.Runtime contract to support unsafe-context analysis and module-level memory-safety metadata, with corresponding implementations in System.Private.CoreLib.

Changes:

Exposes System.Diagnostics.CodeAnalysis.RequiresUnsafeAttribute as a public attribute applicable to constructors/events/methods/properties.
Introduces System.Runtime.CompilerServices.MemorySafetyRulesAttribute (module-level, editor-browsable never) with a Version payload.
Implements MemorySafetyRulesAttribute in System.Private.CoreLib and updates RequiresUnsafeAttribute to be public (non-conditional) with updated documentation.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated no comments.

File	Description
src/libraries/System.Runtime/ref/System.Runtime.cs	Adds the new public attribute declarations to the System.Runtime reference contract.
src/libraries/System.Private.CoreLib/src/System/Runtime/CompilerServices/MemorySafetyRulesAttribute.cs	Implements `MemorySafetyRulesAttribute` with version storage and hidden editor-browsing.
src/libraries/System.Private.CoreLib/src/System/Diagnostics/CodeAnalysis/RequiresUnsafeAttribute.cs	Makes `RequiresUnsafeAttribute` public and expands its applicable targets.

You can also share your feedback on Copilot code review. Take the survey.

Copilot

Pull request overview

This PR exposes RequiresUnsafeAttribute publicly and introduces a new MemorySafetyRulesAttribute API, updating the reference surface and adding basic tests to validate constructor behavior.

Changes:

Add MemorySafetyRulesAttribute to System.Runtime.CompilerServices (ref + implementation) and test its Version roundtrip.
Make RequiresUnsafeAttribute a public attribute with broader AttributeTargets and add a smoke test.
Add CoreLib package-validation suppressions for the new/changed APIs.

Reviewed changes

Copilot reviewed 7 out of 7 changed files in this pull request and generated 7 comments.

Show a summary per file

File	Description
src/libraries/System.Runtime/tests/System.Runtime.Tests/System/Runtime/CompilerServices/AttributesTests.cs	Adds a theory test for `MemorySafetyRulesAttribute.Version`.
src/libraries/System.Runtime/tests/System.Runtime.Tests/System/Diagnostics/CodeAnalysis/RequiresUnsafeAttributeTests.cs	Adds a minimal constructor smoke test for `RequiresUnsafeAttribute`.
src/libraries/System.Runtime/ref/System.Runtime.cs	Updates the public ref surface to include `RequiresUnsafeAttribute` and `MemorySafetyRulesAttribute`.
src/libraries/System.Private.CoreLib/src/System/Runtime/CompilerServices/MemorySafetyRulesAttribute.cs	Introduces the CoreLib implementation of `MemorySafetyRulesAttribute`.
src/libraries/System.Private.CoreLib/src/System/Diagnostics/CodeAnalysis/RequiresUnsafeAttribute.cs	Changes `RequiresUnsafeAttribute` from internal/debug-only to public and updates usage/summary.
src/coreclr/System.Private.CoreLib/CompatibilitySuppressions.xml	Adds compat suppressions for the new attribute and attribute-usage differences.
src/coreclr/nativeaot/System.Private.CoreLib/src/CompatibilitySuppressions.xml	Mirrors the compat suppressions for NativeAOT CoreLib.

You can also share your feedback on Copilot code review. Take the survey.

EgorBo · 2026-03-18T16:41:58Z

Does ILLink strip these attributes? If it does - should we fix it? cc @agocke

agocke · 2026-03-18T16:48:15Z

The linker doesn’t strip attributes

EgorBo

jkotas · 2026-03-19T16:27:17Z

Does ILLink strip these attributes? If it does - should we fix it?

Linker can strip attributes that are not needed at runtime. It is controlled by https://github.com/dotnet/runtime/blob/main/src/libraries/System.Private.CoreLib/src/ILLink/ILLink.LinkAttributes.Shared.xml

Unless we start reading this attribute at runtime (no plans for that currently), we may want to add it to the trimmed list.

agocke

LGTM, matches recent LDM decisions.

jcouv

LGTM Thanks (commit 4)

Copilot

Pull request overview

This PR introduces the public surface area needed for the C# “unsafe evolution” feature by adding the new module-level MemorySafetyRulesAttribute and making RequiresUnsafeAttribute a public API, then annotating relevant unsafe-entry-point APIs across the runtime and reference assemblies.

Changes:

Add System.Runtime.CompilerServices.MemorySafetyRulesAttribute (module-level, versioned) and corresponding unit test coverage.
Promote System.Diagnostics.CodeAnalysis.RequiresUnsafeAttribute to a public attribute and apply it broadly to unsafe APIs (CoreLib + ref assemblies) so compilers/analyzers can enforce unsafe-context call sites.
Update reference assemblies (and related tests / project files) to reflect the new/updated attributes on public APIs.

Reviewed changes

Copilot reviewed 46 out of 49 changed files in this pull request and generated no comments.

Show a summary per file

File	Description
src/mono/System.Private.CoreLib/src/System/Reflection/Metadata/AssemblyExtensions.cs	Annotates unsafe metadata access API with `RequiresUnsafe`.
src/mono/System.Private.CoreLib/src/System/Reflection/Emit/DynamicILInfo.cs	Annotates unsafe pointer-based overloads with `RequiresUnsafe`.
src/mono/System.Private.CoreLib/src/System/ArgIterator.cs	Annotates unsafe constructor overload with `RequiresUnsafe`.
src/libraries/System.Threading.ThreadPool/ref/System.Threading.ThreadPool.cs	Adds `RequiresUnsafeAttribute` to unsafe ThreadPool API in ref.
src/libraries/System.Threading.Overlapped/ref/System.Threading.Overlapped.cs	Adds `RequiresUnsafeAttribute` to unsafe Overlapped APIs in ref.
src/libraries/System.Text.Encoding.Extensions/ref/System.Text.Encoding.Extensions.cs	Adds `RequiresUnsafeAttribute` to pointer-based encoding APIs in ref.
src/libraries/System.Runtime/tests/System.Runtime.Tests/System/Runtime/CompilerServices/AttributesTests.cs	Adds unit tests for `MemorySafetyRulesAttribute.Version`.
src/libraries/System.Runtime/tests/System.Runtime.Tests/System/Diagnostics/CodeAnalysis/RequiresUnsafeAttributeTests.cs	New unit test ensuring `RequiresUnsafeAttribute` is constructible.
src/libraries/System.Runtime/tests/System.Runtime.Tests/System.Runtime.Tests.csproj	Includes new `RequiresUnsafeAttributeTests` file in the test project.
src/libraries/System.Runtime/ref/System.Runtime.cs	Adds new `MemorySafetyRulesAttribute` and exposes `RequiresUnsafeAttribute` in the ref surface; annotates many unsafe members.
src/libraries/System.Runtime.Loader/ref/System.Runtime.Loader.cs	Adds `RequiresUnsafeAttribute` to `AssemblyExtensions.TryGetRawMetadata` in ref.
src/libraries/System.Runtime.InteropServices/src/System/Runtime/InteropServices/Marshalling/StrategyBasedComWrappers.cs	Annotates unsafe COM vtable computation override with `RequiresUnsafe`.
src/libraries/System.Runtime.InteropServices/ref/System.Runtime.InteropServices.cs	Annotates multiple unsafe interop APIs with `RequiresUnsafeAttribute` in ref.
src/libraries/System.Reflection.Emit.Lightweight/ref/System.Reflection.Emit.Lightweight.cs	Annotates pointer-based DynamicILInfo methods with `RequiresUnsafeAttribute` in ref.
src/libraries/System.Private.CoreLib/src/System/Threading/ThreadPool.Windows.cs	Annotates unsafe ThreadPool API with `RequiresUnsafe`.
src/libraries/System.Private.CoreLib/src/System/Threading/ThreadPool.Wasi.cs	Annotates unsafe ThreadPool API (PNSE path) with `RequiresUnsafe`.
src/libraries/System.Private.CoreLib/src/System/Threading/ThreadPool.Browser.cs	Annotates unsafe ThreadPool API with `RequiresUnsafe`.
src/libraries/System.Private.CoreLib/src/System/Runtime/Intrinsics/X86/Sse41.PlatformNotSupported.cs	Annotates unsafe pointer overloads with `RequiresUnsafe`.
src/libraries/System.Private.CoreLib/src/System/Runtime/Intrinsics/X86/Sse3.PlatformNotSupported.cs	Adds CodeAnalysis using + annotates unsafe pointer overloads with `RequiresUnsafe`.
src/libraries/System.Private.CoreLib/src/System/Runtime/Intrinsics/X86/Sse2.PlatformNotSupported.cs	Annotates unsafe pointer overloads with `RequiresUnsafe`.
src/libraries/System.Private.CoreLib/src/System/Runtime/Intrinsics/X86/Sse.PlatformNotSupported.cs	Annotates unsafe pointer overloads with `RequiresUnsafe`.
src/libraries/System.Private.CoreLib/src/System/Runtime/Intrinsics/X86/Bmi2.PlatformNotSupported.cs	Adds CodeAnalysis using + annotates unsafe pointer overloads with `RequiresUnsafe`.
src/libraries/System.Private.CoreLib/src/System/Runtime/Intrinsics/X86/Avx512Vbmi2.PlatformNotSupported.cs	Annotates unsafe pointer overloads with `RequiresUnsafe`.
src/libraries/System.Private.CoreLib/src/System/Runtime/Intrinsics/X86/Avx512DQ.PlatformNotSupported.cs	Annotates unsafe pointer overloads with `RequiresUnsafe`.
src/libraries/System.Private.CoreLib/src/System/Runtime/Intrinsics/X86/Avx512BW.PlatformNotSupported.cs	Annotates unsafe pointer overloads with `RequiresUnsafe`.
src/libraries/System.Private.CoreLib/src/System/Runtime/Intrinsics/X86/Avx10v2.PlatformNotSupported.cs	Annotates unsafe pointer overloads with `RequiresUnsafe`.
src/libraries/System.Private.CoreLib/src/System/Runtime/Intrinsics/X86/Avx10v1.PlatformNotSupported.cs	Annotates many unsafe pointer overloads with `RequiresUnsafe`.
src/libraries/System.Private.CoreLib/src/System/Runtime/Intrinsics/X86/Avx.PlatformNotSupported.cs	Annotates unsafe pointer overloads with `RequiresUnsafe`.
src/libraries/System.Private.CoreLib/src/System/Runtime/Intrinsics/Wasm/PackedSimd.cs	Annotates numerous unsafe pointer load/store intrinsics with `RequiresUnsafe`.
src/libraries/System.Private.CoreLib/src/System/Runtime/Intrinsics/Arm/Sve2.cs	Annotates unsafe pointer-based SVE2 APIs with `RequiresUnsafe`.
src/libraries/System.Private.CoreLib/src/System/Runtime/InteropServices/ObjectiveC/ObjectiveCMarshal.cs	Adds CodeAnalysis using + annotates unsafe initialization API with `RequiresUnsafe`.
src/libraries/System.Private.CoreLib/src/System/Runtime/InteropServices/NativeMemory.Windows.cs	Adds CodeAnalysis using + annotates unsafe memory APIs with `RequiresUnsafe`.
src/libraries/System.Private.CoreLib/src/System/Runtime/InteropServices/Java/JavaMarshal.Unsupported.cs	Adds CodeAnalysis using + annotates unsafe Java marshalling APIs with `RequiresUnsafe`.
src/libraries/System.Private.CoreLib/src/System/Runtime/InteropServices/ComWrappers.PlatformNotSupported.cs	Annotates unsafe COM-related APIs with `RequiresUnsafe`.
src/libraries/System.Private.CoreLib/src/System/Runtime/CompilerServices/MemorySafetyRulesAttribute.cs	New attribute type representing memory safety rules version (module-level).
src/libraries/System.Private.CoreLib/src/System/Diagnostics/CodeAnalysis/RequiresUnsafeAttribute.cs	Updates `RequiresUnsafeAttribute` to the new public API shape/usage.
src/libraries/System.Private.CoreLib/src/System.Private.CoreLib.Shared.projitems	Includes new `MemorySafetyRulesAttribute.cs` in CoreLib shared compilation items.
src/libraries/System.Numerics.Vectors/ref/System.Numerics.Vectors.cs	Annotates unsafe vector load/store APIs with `RequiresUnsafeAttribute` in ref.
src/libraries/System.Diagnostics.Tracing/ref/System.Diagnostics.Tracing.cs	Annotates unsafe EventSource core write APIs with `RequiresUnsafeAttribute` in ref.
src/coreclr/System.Private.CoreLib/src/System/ArgIterator.cs	Annotates unsafe constructor overload with `RequiresUnsafe`.
src/coreclr/nativeaot/System.Private.CoreLib/src/System/Runtime/InteropServices/Java/JavaMarshal.NativeAot.cs	Adds CodeAnalysis using + annotates unsafe Java marshalling APIs with `RequiresUnsafe`.
src/coreclr/nativeaot/System.Private.CoreLib/src/System/Reflection/Metadata/AssemblyExtensions.cs	Adds CodeAnalysis using + annotates unsafe metadata access API with `RequiresUnsafe`.
src/coreclr/nativeaot/System.Private.CoreLib/src/System/Reflection/Emit/DynamicILInfo.cs	Adds CodeAnalysis using + annotates unsafe pointer-based overloads with `RequiresUnsafe`.
src/coreclr/nativeaot/System.Private.CoreLib/src/System/ArgIterator.cs	Adds CodeAnalysis using + annotates unsafe constructor overload with `RequiresUnsafe`.

agocke · 2026-03-23T17:16:22Z

@jjonescz Do we need to apply MemorySafetyRules to the project somehow in order to make the compiler happy? The VMR is seeing

System.Private.CoreLib/src/System/IO/UnmanagedMemoryStream.cs(154,10): error CS9368: RequiresUnsafeAttribute is only valid under the updated memory safety rules.

jjonescz · 2026-03-23T17:44:53Z

Do we need to apply MemorySafetyRules to the project somehow in order to make the compiler happy? The VMR is seeing

System.Private.CoreLib/src/System/IO/UnmanagedMemoryStream.cs(154,10): error CS9368: RequiresUnsafeAttribute is only valid under the updated memory safety rules.

Yes, <Features>$(Features);updated-memory-safety-rules</Features> until we have a public API for it (dotnet/roslyn#82791)

jkotas · 2026-03-23T17:50:11Z

Do we need to apply MemorySafetyRules to the project somehow in order to make the compiler happy?

dotnet/runtime has a ton of sources that compile for both current .NET version and downlevel .NET versions. Is this error going to require all RequiresUnsafe annotations to be under an ifdef for current version?

jjonescz · 2026-03-23T17:53:17Z

It's just a warning (in your case probably promoted to an error), so we could just suppress it.

EgorBo · 2026-03-23T18:25:22Z

Do we need to apply MemorySafetyRules to the project somehow in order to make the compiler happy?

dotnet/runtime has a ton of sources that compile for both current .NET version and downlevel .NET versions. Is this error going to require all RequiresUnsafe annotations to be under an ifdef for current version?

in my PR in #125894 I moved the attribute to Common so it works as a pollyfil (can be made internal for non-.NET 11)

jjonescz · 2026-03-24T08:34:10Z

FYI, last commit adds the [RequiresUnsafe] attribute to APIs that already had it but only partially, e.g., only in CoreCLR definition but not in ref assemblies or Mono (which ApiCompat doesn't like now that the attribute is public).

I'm planning to merge this PR once the CI is green.

Add unsafe evolution attributes

6f51237

Copilot AI review requested due to automatic review settings March 18, 2026 10:59

github-actions Bot added the area-System.Runtime.CompilerServices label Mar 18, 2026

dotnet-policy-service Bot assigned jjonescz Mar 18, 2026

Copilot started reviewing on behalf of jjonescz March 18, 2026 11:01 View session

Copilot AI reviewed Mar 18, 2026

View reviewed changes

stephentoub reviewed Mar 18, 2026

View reviewed changes

Comment thread ...raries/System.Private.CoreLib/src/System/Diagnostics/CodeAnalysis/RequiresUnsafeAttribute.cs

stephentoub reviewed Mar 18, 2026

View reviewed changes

Comment thread ...raries/System.Private.CoreLib/src/System/Diagnostics/CodeAnalysis/RequiresUnsafeAttribute.cs

jjonescz added 2 commits March 18, 2026 14:43

Add suppressions

7ab7854

Add tests

ed25edb

jjonescz marked this pull request as ready for review March 18, 2026 15:28

jjonescz requested a review from MichalStrehovsky as a code owner March 18, 2026 15:28

Copilot AI review requested due to automatic review settings March 18, 2026 15:28

This comment was marked as resolved.

Sign in to view

Copilot started reviewing on behalf of jjonescz March 18, 2026 15:29 View session

Copilot AI reviewed Mar 18, 2026

View reviewed changes

Fix api compat

6703970

EgorBo approved these changes Mar 19, 2026

View reviewed changes

jcouv mentioned this pull request Mar 19, 2026

Test plan for "Unsafe Evolution" dotnet/roslyn#81207

Open

66 tasks

agocke approved these changes Mar 19, 2026

View reviewed changes

agocke enabled auto-merge (squash) March 19, 2026 17:37

jcouv disabled auto-merge March 19, 2026 17:42

jcouv reviewed Mar 19, 2026

View reviewed changes

Comment thread ...raries/System.Private.CoreLib/src/System/Diagnostics/CodeAnalysis/RequiresUnsafeAttribute.cs

Comment thread src/libraries/System.Runtime/ref/System.Runtime.cs

jkotas reviewed Mar 19, 2026

View reviewed changes

Comment thread ...raries/System.Private.CoreLib/src/System/Diagnostics/CodeAnalysis/RequiresUnsafeAttribute.cs Outdated

jkotas requested changes Mar 19, 2026

View reviewed changes

jcouv approved these changes Mar 19, 2026

View reviewed changes

jcouv reviewed Mar 19, 2026

View reviewed changes

Comment thread ...raries/System.Private.CoreLib/src/System/Diagnostics/CodeAnalysis/RequiresUnsafeAttribute.cs Outdated

Add ifdef around accessibility

f12cf80

jkotas approved these changes Mar 20, 2026

View reviewed changes

jjonescz added 3 commits March 22, 2026 12:04

Include RequiresUnsafeAttributeTests in the project

268a0b3

Merge branch 'main' into 125134-UnsafeEvolutionAttributes

616de27

Fix [RequiresUnsafe] ApiCompat mismatches

b1aca57

Copilot AI review requested due to automatic review settings March 23, 2026 14:50

jjonescz requested review from steveisok and vitek-karas as code owners March 23, 2026 14:50

Copilot started reviewing on behalf of jjonescz March 23, 2026 14:52 View session

Copilot AI reviewed Mar 23, 2026

View reviewed changes

akoeplinger mentioned this pull request Mar 23, 2026

[Operational Issue]: source build jobs broken due to CS9368: RequiresUnsafeAttribute is only valid under the updated memory safety rules. dotnet/dotnet#5640

Closed

4 tasks

Copilot AI mentioned this pull request Mar 23, 2026

NoWarn CS9368 in System.Private.CoreLib, System.Memory, and Microsoft.Bcl.Memory for source-build compatibility dotnet/dotnet#5644

Merged

4 tasks

This was referenced Mar 23, 2026

Cannot find 'arm64-v8a' device dotnet/dnceng#2284

Closed

[browser] Wasm.Build.Tests timeout - Timed out after 10s waiting for 'WASM EXIT' #116697

Open

jjonescz requested a review from agocke March 24, 2026 08:31

jjonescz enabled auto-merge (squash) March 24, 2026 16:46

jjonescz merged commit 8b810a6 into dotnet:main Mar 24, 2026
162 checks passed

jjonescz deleted the 125134-UnsafeEvolutionAttributes branch March 24, 2026 18:31

dotnet-maestro Bot mentioned this pull request Mar 25, 2026

[main] Source code updates from dotnet/runtime dotnet/dotnet#5691

Merged

github-actions Bot locked and limited conversation to collaborators Apr 24, 2026

Conversation

jjonescz commented Mar 18, 2026 • edited by jcouv Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

dotnet-policy-service Bot commented Mar 18, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

This comment was marked as resolved.

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

EgorBo commented Mar 18, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

agocke commented Mar 18, 2026

Uh oh!

EgorBo left a comment

Choose a reason for hiding this comment

Uh oh!

jkotas commented Mar 19, 2026

Uh oh!

agocke left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

jcouv left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

agocke commented Mar 23, 2026

Uh oh!

jjonescz commented Mar 23, 2026

Uh oh!

jkotas commented Mar 23, 2026

Uh oh!

jjonescz commented Mar 23, 2026

Uh oh!

EgorBo commented Mar 23, 2026

Uh oh!

jjonescz commented Mar 24, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

8 participants

jjonescz commented Mar 18, 2026 •

edited by jcouv

Loading

EgorBo commented Mar 18, 2026 •

edited

Loading