Support unsafe evolution in LibraryImportGenerator

[EgorBo]

Summary

• Require explicit safe or unsafe on [LibraryImport] methods under updated memory-safety rules (just like it's already required by extern DllImport declarations).
• Mirror the modifier onto generated extern signatures for both generator variants.
• [Not in this PR] A new analyzer will place unsafe by default on all [LibraryImport] (and extern) for easier migration to the new rules.

Waiting for Roslyn to allow safe for arbitrary methods. dotnet/roslyn#84555

[azure-pipelines]

Azure Pipelines:
Successfully started running 3 pipeline(s).
13 pipeline(s) were filtered out due to trigger conditions.
There may be pipelines that require an authorized user to comment /azp run to run.

[dotnet-policy-service]

Tagging subscribers to this area: @dotnet/interop-contrib
See info in area-owners.md if you want to be subscribed.

[Copilot]

Pull request overview

Updates LibraryImportGenerator/Analyzers to participate in the “updated memory safety rules” evolution by (1) requiring [LibraryImport] methods to opt in with an explicit safe/unsafe modifier when the feature is enabled and (2) mirroring the selected modifier onto generated extern signatures (including the wrapper-path inner local DllImport).

Changes:

• Add a new diagnostic (SYSLIB1050) to fail [LibraryImport] declarations missing an explicit safe/unsafe modifier when updated memory-safety rules are enabled.
• Flow the user’s safety modifier through to generated wrapper local extern signatures (LibraryImportGenerator + Downlevel variant).
• Add shared helpers + update unit tests and localized resource strings.

Reviewed changes

Copilot reviewed 24 out of 24 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
src/libraries/System.Runtime.InteropServices/tests/LibraryImportGenerator.UnitTests/UnsafeCodeGeneration.cs	Expands shape tests to cover safe/unsafe mirroring and missing-modifier diagnostics under the feature flag.
src/libraries/System.Runtime.InteropServices/gen/LibraryImportGenerator/LibraryImportGenerator.csproj	Links in the new shared extensions helper.
src/libraries/System.Runtime.InteropServices/gen/LibraryImportGenerator/LibraryImportGenerator.cs	Passes the extracted safety modifier into wrapper-path inner DllImport local function generation.
src/libraries/System.Runtime.InteropServices/gen/LibraryImportGenerator/GeneratorDiagnostics.cs	Adds the new diagnostic descriptor for “missing safety modifier”.
src/libraries/System.Runtime.InteropServices/gen/LibraryImportGenerator/Analyzers/LibraryImportDiagnosticsAnalyzer.cs	Includes + emits the new missing-safety-modifier diagnostic when the feature is enabled.
src/libraries/System.Runtime.InteropServices/gen/DownlevelLibraryImportGenerator/GeneratorDiagnostics.cs	Adds downlevel counterpart diagnostic descriptor.
src/libraries/System.Runtime.InteropServices/gen/DownlevelLibraryImportGenerator/DownlevelLibraryImportGenerator.csproj	Links in the new shared extensions helper.
src/libraries/System.Runtime.InteropServices/gen/DownlevelLibraryImportGenerator/DownlevelLibraryImportGenerator.cs	Mirrors safety modifier onto wrapper-path inner DllImport local function (downlevel).
src/libraries/System.Runtime.InteropServices/gen/DownlevelLibraryImportGenerator/DownlevelLibraryImportDiagnosticsAnalyzer.cs	Includes + emits missing-safety-modifier diagnostic (downlevel).
src/libraries/System.Runtime.InteropServices/gen/Common/LibraryImportGeneratorExtensions.cs	Adds shared helpers to detect safety modifiers and the updated-rules feature flag.
src/libraries/System.Runtime.InteropServices/gen/Common/Resources/Strings.resx	Adds strings for the new diagnostic message/description.
src/libraries/System.Runtime.InteropServices/gen/Common/Resources/xlf/Strings.de.xlf	Adds localization entries for the new diagnostic.
src/libraries/System.Runtime.InteropServices/gen/Common/Resources/xlf/Strings.es.xlf	Adds localization entries for the new diagnostic.
src/libraries/System.Runtime.InteropServices/gen/Common/Resources/xlf/Strings.fr.xlf	Adds localization entries for the new diagnostic.
src/libraries/System.Runtime.InteropServices/gen/Common/Resources/xlf/Strings.it.xlf	Adds localization entries for the new diagnostic.
src/libraries/System.Runtime.InteropServices/gen/Common/Resources/xlf/Strings.ja.xlf	Adds localization entries for the new diagnostic.
src/libraries/System.Runtime.InteropServices/gen/Common/Resources/xlf/Strings.ko.xlf	Adds localization entries for the new diagnostic.
src/libraries/System.Runtime.InteropServices/gen/Common/Resources/xlf/Strings.pl.xlf	Adds localization entries for the new diagnostic.
src/libraries/System.Runtime.InteropServices/gen/Common/Resources/xlf/Strings.pt-BR.xlf	Adds localization entries for the new diagnostic.
src/libraries/System.Runtime.InteropServices/gen/Common/Resources/xlf/Strings.ru.xlf	Adds localization entries for the new diagnostic.
src/libraries/System.Runtime.InteropServices/gen/Common/Resources/xlf/Strings.tr.xlf	Adds localization entries for the new diagnostic.
src/libraries/System.Runtime.InteropServices/gen/Common/Resources/xlf/Strings.zh-Hans.xlf	Adds localization entries for the new diagnostic.
src/libraries/System.Runtime.InteropServices/gen/Common/Resources/xlf/Strings.zh-Hant.xlf	Adds localization entries for the new diagnostic.
src/libraries/System.Runtime.InteropServices/gen/Common/Resources/xlf/Strings.cs.xlf	Adds localization entries for the new diagnostic.

[Copilot]

Pull request overview

Copilot reviewed 24 out of 24 changed files in this pull request and generated no new comments.

[jkotas]

Mirror the modifier onto generated extern signatures for both generator variants.

This does not sound right.

If I define a PInvoke like:

[LibraryImport(...)]
static partial safe void PrintString(string s);

The actual internal PInvoke is going to be static extern void PrintString(char* s). This method should not be marked as safe. It would be violating the model.

[EgorBo]

Mirror the modifier onto generated extern signatures for both generator variants.

This does not sound right.

If I define a PInvoke like:

[LibraryImport(...)]
static partial safe void PrintString(string s);

The actual internal PInvoke is going to be static extern void PrintString(char* s). This method should not be marked as safe. It would be violating the model.

@jkotas do you mean that in this case the private extern hidden in the generator should be caller-unsafe or that the entire signature void PrintString(string s); should never be marked as safe? I had this in mind, I just though that if user is sure that the pinvoke is always safe then even the extern that user won't see will be safe - it can be easily changed to be always unsafe.

[Copilot]

Pull request overview

Copilot reviewed 24 out of 24 changed files in this pull request and generated 2 comments.

Comments suppressed due to low confidence (1)

src/libraries/System.Runtime.InteropServices/tests/LibraryImportGenerator.UnitTests/UnsafeCodeGeneration.cs:149

• Same concern here: including a downlevel=true test case likely routes through TestTargetFramework.Standard2_0 ref packs, which are commonly handled as outer-loop due to restore/network requirements. Consider moving the downlevel coverage to a dedicated [OuterLoop] test and keeping this theory non-downlevel for regular runs.

        [Theory]
        [InlineData(false)]
        [InlineData(true)]
        public Task UpdatedMemorySafetyRulesRequireExplicitSafetyModifier(bool downlevel)

[jkotas]

The outer signature should be safe. The private extern hidden in the generated code should be caller-unsafe. Consider my example - the raw PInvoke that takes ´char*´ is obviously unsafe.

[Copilot]

Pull request overview

Copilot reviewed 22 out of 22 changed files in this pull request and generated no new comments.

[Copilot]

Pull request overview

Copilot reviewed 24 out of 24 changed files in this pull request and generated no new comments.

[azure-pipelines]

Azure Pipelines:
Successfully started running 3 pipeline(s).
13 pipeline(s) were filtered out due to trigger conditions.
There may be pipelines that require an authorized user to comment /azp run to run.