ICSharpCode.Decompiler

Currently unused; we'll probably use the LdToken ILInstruction as annotation instead when LdToken support gets reimplemented.

Retrieves the associated with this AstNode, or null if no symbol is associated with the node.

Retrieves the associated with this , or if no resolve result is associated with the node.

Retrieves the associated with this , or null if no variable is associated with this identifier.

Retrieves the associated with this , or null if no variable is associated with this initializer.

Retrieves the associated with this , or null if no variable is associated with this foreach statement.

Adds an to this initializer.

Adds an to this foreach statement.

Copies all annotations from to .

Represents a reference to a local variable.

Annotates a with the instructions for the GetEnumerator, MoveNext and get_Current calls.

Annotates the top-level block statement of a function with the implicitly executed return/yield break.

Annotates an expression when an implicit user-defined conversion was omitted.

Annotates a QueryGroupClause with the ILFunctions of each (implicit lambda) expression.

Annotates a QueryJoinClause with the ILFunctions of each (implicit lambda) expression.

Annotates an out DirectionExpression if the out variable can be declared implicitly typed.

Converts a call to an Add method to a collection initializer expression.

TypeName VariableDesignation

Expression switch { SwitchSections }

Pattern => Expression

Expression with Initializer

BaseType "(" Argument { "," Argument } ")"

Identifier

( VariableDesignation (, VariableDesignation)* )

Gets the ancestors of this node (excluding this node itself)

Gets the ancestors of this node (including this node itself)

Gets all descendants of this node (excluding this node itself) in pre-order.

Gets all descendants of this node (including this node itself) in pre-order.

Gets the first child with the specified role. Returns the role's null object if the child is not found.

Adds a child without performing any safety checks.

Removes this node from its parent.

Replaces this node with the new node.

Clones the whole subtree starting at this AST node.

Annotations are copied over to the new nodes; and any annotations implementing ICloneable will be cloned.

Gets the next node which fullfills a given predicate

The next node. The predicate.

Gets the previous node which fullfills a given predicate

The next node. The predicate.

Gets the next sibling which fullfills a given predicate

The next node. The predicate.

Gets the next sibling which fullfills a given predicate

The next node. The predicate.

Gets the node specified by T at the location line, column. This is useful for getting a specific node from the tree. For example searching the current method declaration. (End exclusive)

Gets the node specified by pred at location. This is useful for getting a specific node from the tree. For example searching the current method declaration. (End exclusive)

Gets the node specified by T at the location line, column. This is useful for getting a specific node from the tree. For example searching the current method declaration. (End exclusive)

Gets the node specified by T at location. This is useful for getting a specific node from the tree. For example searching the current method declaration. (End exclusive)

Gets the node specified by pred at the location line, column. This is useful for getting a specific node from the tree. For example searching the current method declaration. (End inclusive)

Gets the node specified by pred at location. This is useful for getting a specific node from the tree. For example searching the current method declaration. (End inclusive)

Gets the node specified by T at the location line, column. This is useful for getting a specific node from the tree. For example searching the current method declaration. (End inclusive)

Gets the node specified by T at location. This is useful for getting a specific node from the tree. For example searching the current method declaration. (End inclusive)

Gets the node that fully contains the range from startLocation to endLocation.

Returns the root nodes of all subtrees that are fully contained in the specified region.

Returns the root nodes of all subtrees that are fully contained between and (inclusive).

Gets the node as formatted C# output.

Formatting options.

Returns true, if the given coordinates (line, column) are in the node.

True, if the given coordinates are between StartLocation and EndLocation (exclusive); otherwise, false.

Returns true, if the given coordinates are in the node.

True, if location is between StartLocation and EndLocation (exclusive); otherwise, false.

Returns true, if the given coordinates (line, column) are in the node.

True, if the given coordinates are between StartLocation and EndLocation (inclusive); otherwise, false.

Returns true, if the given coordinates are in the node.

True, if location is between StartLocation and EndLocation (inclusive); otherwise, false.

Represents the children of an AstNode that have a specific role.

Returns the first element for which the predicate returns true, or the null node (AstNode with IsNull=true) if no such object is found.

Returns the last element for which the predicate returns true, or the null node (AstNode with IsNull=true) if no such object is found.

Applies the to all nodes in this collection.

A type reference in the C# AST.

Gets whether this type is a SimpleType "var".

Create an ITypeReference for this AstType. Uses the context (ancestors of this node) to determine the correct .

The resulting type reference will read the context information from the : For resolving type parameters, the CurrentTypeDefinition/CurrentMember is used. For resolving simple names, the current namespace and usings from the CurrentUsingScope (on CSharpTypeResolveContext only) is used.

Create an ITypeReference for this AstType.

Gets the name lookup mode from the context (looking at the ancestors of this ).

Creates a pointer type from this type by nesting it in a . If this type already is a pointer type, this method just increases the PointerRank of the existing pointer type.

Creates an array type from this type by nesting it in a . If this type already is an array type, the additional rank is prepended to the existing array specifier list. Thus, new SimpleType("T").MakeArrayType(1).MakeArrayType(2) will result in "T[,][]".

Creates a nullable type from this type by nesting it in a .

Creates a C# 7 ref type from this type by nesting it in a .

Builds an expression that can be used to access a static member on this type.

Creates a simple AstType from a dotted name. Does not support generics, arrays, etc. - just simple dotted names, e.g. namespace names.

Gets/sets whether this type has a 'ref' specifier. This is used for C# 7 ref locals/ref return. Parameters use ParameterDeclaration.ParameterModifier instead.

Gets/sets whether this type has a 'readonly' specifier. This is used for C# 7.2 'ref readonly' locals/ref return. Parameters use ParameterDeclaration.ParameterModifier instead.

[,,,]

Represents a token in C#. Note that the type of the token is defined through the TokenRole.

In all non null c# token nodes the Role of a CSharpToken must be a TokenRole.

AST visitor with a default implementation that visits all node depth-first.

Represents a 'cref' reference in XML documentation.

Gets/Sets the entity type. Possible values are: SymbolKind.Operator for operators, SymbolKind.Indexer for indexers, SymbolKind.TypeDefinition for references to primitive types, and SymbolKind.None for everything else.

Gets/Sets the operator type. This property is only used when SymbolKind==Operator.

Gets/Sets whether a parameter list was provided.

Gets/Sets the declaring type.

Gets/sets the member name. This property is only used when SymbolKind==None.

Gets/Sets the return type of conversion operators. This property is only used when SymbolKind==Operator and OperatorType is explicit or implicit.

[async] delegate(Parameters) {Body}

new { [ExpressionList] }

new Type[Dimensions]

Gets additional array ranks (those without size info). Empty for "new int[5,1]"; will contain a single element for "new int[5][]".

{ Elements }

For ease of use purposes in the resolver the ast representation of { a, b, c } is { {a}, {b}, {c} }. If IsSingleElement is true then this array initializer expression is a generated one. That has no meaning in the source code (and contains no brace tokens).

Single elements in array initializers are represented with this special class.

Expression as TypeReference

Left Operator= Right

Gets the binary operator for the specified compound assignment operator. Returns null if 'op' is not a compound assignment.

left = right

left += right

left -= right

left *= right

left /= right

left %= right

left <<= right

left >>= right

left >>>= right

left &= right

left |= right

left ^= right

Any operator (for pattern matching)

base

Left Operator Right

Any binary operator (used in pattern matching)

left & right

left | right

left && right

left || right

left ^ right

left > right

left >= right

left == right

left != right

left < right

left <= right

left + right

left - right

left * right

left / right

left % right

left << right

left >> right

left >>> right

left ?? right

left .. right

left and right are optional = may be Expression.Null

left is right

right must be a pattern

(CastTo)Expression

checked(Expression)

Condition ? TrueExpression : FalseExpression

default(Type)

ref Expression

Base class for expressions.

This class is useful even though it doesn't provide any additional functionality: It can be used to communicate more information in APIs, e.g. "this subnode will always be an expression"

Target[Arguments]

{ Expression , Alignment : Suffix }

Target(Arguments)

Expression is Type

[async] Parameters => Body

Target.MemberName

Represents a named argument passed to a method or attribute. name: expression

name = expression This isn't the same as 'assign' even though it has the same syntax. This expression is used in object initializers and for named attribute arguments [Attr(FieldName = value)].

null

new Type(Arguments) { Initializer }

out type expression

( Expression )

Gets whether the expression acts like a parenthesized expression, i.e. whether information about the expected type (for lambda type inference) flows into the inner expression.

Returns true for ParenthesizedExpression, CheckedExpression or UncheckedExpression; false otherwise.

Unpacks the given expression if it is a ParenthesizedExpression, CheckedExpression or UncheckedExpression.

Target->MemberName

Form of a C# literal.

Represents a literal value.

Represents a query continuation. "(from .. select ..) into Identifier" or "(from .. group .. by ..) into Identifier" Note that "join .. into .." is not a query continuation! This is always the first(!!) clause in a query expression. The tree for "from a in b select c into d select e" looks like this: new QueryExpression { new QueryContinuationClause { PrecedingQuery = new QueryExpression { new QueryFromClause(a in b), new QuerySelectClause(c) }, Identifier = d }, new QuerySelectClause(e) }

Represents a join or group join clause.

sizeof(Type)

stackalloc Type[Count]

this

throw Expression

typeof(Type)

Represents an AstType as an expression. This is used when calling a method on a primitive type: "int.Parse()"

Operator Expression

Any unary operator (used in pattern matching)

Logical not (!a)

Bitwise not (~a)

Unary minus (-a)

Unary plus (+a)

Pre increment (++a)

Pre decrement (--a)

Post increment (a++)

Post decrement (a--)

Dereferencing (*a)

Get address (&a)

C# 5.0 await

C# 6 null-conditional operator. Occurs as target of member reference or indexer expressions to indicate ?. or ?[]. Corresponds to nullable.unwrap in ILAst.

Wrapper around a primary expression containing a null conditional operator. Corresponds to nullable.rewrap in ILAst. This has no syntax in C#, but the node is used to ensure parentheses are inserted where necessary.

Implicit call of "operator true".

C# 8 postfix ! operator (dammit operator)

C# 8 prefix ^ operator

C# 9 not pattern

C# 9 relational pattern

unchecked(Expression)

Represents undocumented expressions.

Attribute(Arguments)

[AttributeTarget: Attributes]

"//" comment

"/* */" comment

"///" comment

Inactive code (code in non-taken "#if")

"/** */" comment

Returns true if the is Documentation or MultiLineDocumentation.

where TypeParameter : BaseTypes

new(), struct and class constraints are represented using a PrimitiveType "new", "struct" or "class"

delegate ReturnType Name<TypeParameters>(Parameters) where Constraints;

extern alias IDENTIFIER;

namespace Name { Members }

Gets the full namespace name (including any parent namespaces)

For an '#if' directive, specifies whether the condition evaluated to true.

C# 9 'record class'

C# 10 'record struct'

class Name<TypeParameters> : BaseTypes where Constraints;

[in|out] Name Represents a type parameter. Note: mirroring the C# syntax, constraints are not part of the type parameter declaration, but belong to the parent type or method.

using Alias = Import;

using Import;

AST visitor.

Matches identifier expressions that have the same identifier as the referenced variable/type definition/method definition.

Special value used to match any modifiers during pattern matching.

AstType

Type or delegate declaration

Comment or whitespace or pre-processor directive

Placeholder for a pattern

Matches any node.

Does not match null nodes.

Matches any node.

Does not match null nodes.

Matches the last entry in the specified named group.

Container for the backtracking info.

Matches one of several alternatives.

AST node that supports pattern matching.

Performs a pattern matching operation. this is the pattern, is the AST that is being matched.

A match object. Check to see whether the match was successful. Patterns are ASTs that contain special pattern nodes (from the PatternMatching namespace). However, it is also possible to match two ASTs without any pattern nodes - doing so will produce a successful match if the two ASTs are structurally identical.

Represents the result of a pattern matching operation.

Represents a named node within a pattern.

Base class for all patterns.

Gets the string that matches any string.

Represents an optional node.

Represents the role a node plays within its parent.

Gets whether the specified node is valid in this role.

Gets the role with the specified index.

Represents the role a node plays within its parent. All nodes with this role have type T.

Gets the null object used when there's no node with this role. Not every role has a null object; this property returns null for roles without a null object.

Roles used for non-collections should always have a null object, so that no AST property returns null. However, if a role used for collections only, it may leave out the null object.

{ Statements }

break;

checked BodyBlock

continue;

"do EmbeddedStatement while(Condition);"

;

Expression;

fixed (Type Variables) EmbeddedStatement

foreach (Type VariableName in InExpression) EmbeddedStatement

for (Initializers; Condition; Iterators) EmbeddedStatement

Gets the list of initializer statements. Note: this contains multiple statements for "for (a = 2, b = 1; a > b; a--)", but contains only a single statement for "for (int a = 2, b = 1; a > b; a--)" (a single VariableDeclarationStatement with two variables)

"goto Label;"

or "goto case LabelExpression;"

Used for "goto case LabelExpression;"

or "goto default;"

if (Condition) TrueStatement else FalseStatement

Label:

lock (Expression) EmbeddedStatement;

return Expression;

Base class for statements.

This class is useful even though it doesn't provide any additional functionality: It can be used to communicate more information in APIs, e.g. "this subnode will always be a statement"

switch (Expression) { SwitchSections }

Gets or sets the expression. The expression can be null - if the expression is null, it's the default switch section.

throw Expression;

try TryBlock CatchClauses finally FinallyBlock

catch (Type VariableName) { Body }

unchecked BodyBlock

unsafe { Body }

[ await ] using (ResourceAcquisition) EmbeddedStatement

Either a VariableDeclarationStatement, or an Expression.

"while (Condition) EmbeddedStatement"

yield break;

yield return Expression;

Extension methods for the syntax tree.

Returns true if is bitwise and, bitwise or, or exclusive or.

Gets/Sets the file name of this syntax tree.

Gets the conditional symbols used to parse the source file. Note that this list contains the conditional symbols at the start of the first token in the file - including the ones defined in the source file.

Gets the expression that was on top of the parse stack. This is the only way to get an expression that isn't part of a statment. (eg. when an error follows an expression). This is used for code completion to 'get the expression before a token - like ., <, ('.

Gets all defined types in this syntax tree.

A list containing or nodes.

A line/column position. Text editor lines/columns are counted started from one.

Represents no text location (0, 0).

Constant of the minimum line.

Constant of the minimum column.

Creates a TextLocation instance.

Gets the line number.

Gets the column number.

Gets whether the TextLocation instance is empty.

Gets a string representation for debugging purposes.

Gets a hash code.

Equality test.

Inequality test.

Compares two text locations.

A specific role only used for C# tokens

Gets the token as string. Note that the token Name and Token value may differ.

Gets the char length of the token.

get/set/init/add/remove

Gets the 'get'/'set'/'init'/'add'/'remove' keyword

Gets/Sets the type reference of the interface that is explicitly implemented. Null node if this member is not an explicit interface implementation.

Name [ CountExpression ]

Gets/Sets the type reference of the interface that is explicitly implemented. Null node if this member is not an explicit interface implementation.

Gets the operator type from the method name, or null, if the method does not represent one of the known operator types.

Gets the method name for the operator type. ("op_Addition", "op_Implicit", etc.)

Gets whether the operator type is a C# 11 "operator checked".

Gets the token for the operator type ("+", "implicit", etc.). Does not include the "checked" modifier.

Gets/Sets the type reference of the interface that is explicitly implemented. Null node if this member is not an explicit interface implementation.

Converts from type system to the C# AST.

Creates a new TypeSystemAstBuilder.

A resolver initialized for the position where the type will be inserted.

Creates a new TypeSystemAstBuilder.

Specifies whether the ast builder should add annotations to type references. The default value is .

Specifies whether the ast builder should add ResolveResult annotations to AST nodes. The default value is .

Controls the accessibility modifiers are shown. The default value is .

Controls the non-accessibility modifiers are shown. The default value is .

Controls whether base type references are shown. The default value is .

Controls whether type parameter declarations are shown. The default value is .

Controls whether type parameter names are shown for unbound types. The default value is .

Controls whether constraints on type parameter declarations are shown. Has no effect if ShowTypeParameters is false. The default value is .

Controls whether the names of parameters are shown. The default value is .

Controls whether to show default values of optional parameters, and the values of constant fields. The default value is .

Controls whether to show attributes. The default value is .

Controls whether to use fully-qualified type names or short type names. The default value is .

Controls whether to use keywords for builtin types. The default value is .

Controls whether to use T? or Nullable<T> for nullable value types. The default value is .

Determines the name lookup mode for converting a type name. The default value is NameLookupMode.Expression, which means the name is disambiguated for use in expression context.

Controls whether to generate a body that throws a System.NotImplementedException. The default value is .

Controls whether to generate custom events. The default value is .

Controls whether unbound type argument names are inserted in the ast or not. The default value is .

Controls whether aliases should be used inside the type name or not. The default value is .

Controls whether constants like int.MaxValue are converted to a or . The default value is .

Controls whether integral constants should be printed in hexadecimal format. The default value is .

Controls whether C# 9 "init;" accessors are supported. If disabled, emits "set /*init*/;" instead.

Controls whether C# 9 "record" class types are supported.

Controls whether C# 10 "record" struct types are supported.

Controls whether C# 11 "operator >>>" is supported.

Controls whether C# 11 "operator checked" is supported.

Controls whether all fully qualified type names should be prefixed with "global::".

Gets whether 'type' is the same as 'typeDef' parameterized with the given type arguments.

Adds type arguments to the result type.

The result AST node (a SimpleType or MemberType) The type parameters The list of type arguments Index of first type argument to add Index after last type argument to add

Creates an Expression for the given constant value. Note: the returned expression is not necessarily of the desired type. However, the returned expression will always be implicitly convertible to rr.Type, and will have the correct value when being converted in this way.

Creates an Expression for the given constant value. Note: the returned expression is not necessarily of the specified : For example, ConvertConstantValue(typeof(string), null) results in a null literal, without a cast to string. Similarly, ConvertConstantValue(typeof(short), 1) results in the literal 1, which is of type int. However, the returned expression will always be implicitly convertible to .

Creates an Expression for the given constant value.

Provides an interface to handle annotations in an object.

Gets all annotations stored on this IAnnotatable.

Gets the first annotation of the specified type. Returns null if no matching annotation exists.

The type of the annotation.

Gets the first annotation of the specified type. Returns null if no matching annotation exists.

The type of the annotation.

Adds an annotation to this instance.

The annotation to add.

Removes all annotations of the specified type.

The type of the annotations to remove.

Removes all annotations of the specified type.

The type of the annotations to remove.

Base class used to implement the IAnnotatable interface. This implementation is thread-safe.

Clones all annotations. This method is intended to be called by Clone() implementations in derived classes.


            AstNode copy = (AstNode)MemberwiseClone();
            copy.CloneAnnotations();

Gets all annotations stored on this AstNode.

An interface for a service that creates and writes a project file structure for a specific module being decompiled.

Writes the content of a new project file for the specified being decompiled.

The target to write to. The information about the project being created. A collection of source files to be included into the project. The module being decompiled.

An interface that provides common information for a project being decompiled to.

Gets the assembly resolver active for the project.

Gets the C# language version of the project.

Gets the unique ID of the project.

Gets the target directory of the project

Gets the name of the key file being used for strong name signing. Can be null if no file is available.

A implementation that creates the projects in the SDK style format.

Creates a new instance of the class.

A new instance of the class.

A implementation that creates the projects in the default format.

Creates a new instance of the class.

A new instance of the class.

A class describing the target framework of a module.

Initializes a new instance of the class.

The framework identifier string. Can be null. The framework version string. Must be greater than 100 (where 100 corresponds to v1.0). The framework profile. Can be null.

Gets the target framework identifier. Can be null if not defined.

Gets the target framework moniker. Can be null if not supported.

Gets the target framework version, e.g. "v4.5".

Gets the target framework version as integer (multiplied by 100), e.g. 450.

Gets the target framework profile. Can be null if not set or not available.

Gets a value indicating whether the target is a portable class library (PCL).

Helper services for determining the target framework and platform of a module.

Gets the for the specified .

The module to get the target framework description for. Cannot be null. A new instance of the class that describes the specified .

Gets the string representation (name) of the target platform of the specified .

The module to get the target framework description for. Cannot be null. The platform name, e.g. "AnyCPU" or "x86".

Gets exact if is

Decompiles an assembly into a visual studio project file.

Gets the setting this instance uses for decompiling.

The MSBuild ProjectGuid to use for the new project.

The target directory that the decompiled files are written to.

This property is set by DecompileProject() and protected so that overridden protected members can access it.

Path to the snk file to use for signing. null to not sign.

Cleans up a node name for use as a file name.

Removes invalid characters from file names and reduces their length, but keeps file extensions and path structure intact.

Cleans up a node name for use as a file system name. If is active, dots are seen as segment separators. Each segment is limited to maxSegmentLength characters. If is active, we check for file a extension and try to preserve it, if it's valid.

Cleans up a node name for use as a directory name.

Used to test for the "F(G<A,B>(7));" grammar ambiguity.

Resolves ambiguities in the specified syntax tree. This method must be called after the InsertParenthesesVisitor, because the ambiguity depends on whether the final `>` in the possible-type-argument is followed by an opening parenthesis.

C# ambience. Used to convert type system symbols to text (usually for displaying the symbol to the user; e.g. in editor tooltips)

Outputs the AST.

Writes a comma.

The next node after the comma. When set prevents printing a space after comma.

Writes an optional comma, e.g. at the end of an enum declaration or in an array initializer

Writes an optional semicolon, e.g. at the end of a type or namespace declaration.

Writes a keyword, and all specials up to

Marks the end of a statement

Writes a space depending on policy.

Determines whether the specified identifier is a keyword in the given context.

Writes an embedded statement.

The statement to write. Determines whether a trailing newline should be written following a block. Non-blocks always write a trailing newline. Blocks may or may not write a leading newline depending on StatementBraceStyle. Non-blocks always write a leading newline.

Writes a block statement. Similar to VisitBlockStatement() except that: 1) it allows customizing the BraceStyle 2) it does not write a trailing newline after the '}' (this job is left to the caller)

Converts special characters to escape sequences within the given string.

The formatting options factory creates pre defined formatting option styles.

Creates empty CSharpFormatting options.

Creates mono indent style CSharpFormatting options.

Creates sharp develop indent style CSharpFormatting options.

The K&R style, so named because it was used in Kernighan and Ritchie's book The C Programming Language, is commonly used in C. It is less common for C++, C#, and others.

Creates allman indent style CSharpFormatting options used in Visual Studio.

The Whitesmiths style, also called Wishart style to a lesser extent, is less common today than the previous three. It was originally used in the documentation for the first commercial C compiler, the Whitesmiths Compiler.

Like the Allman and Whitesmiths styles, GNU style puts braces on a line by themselves, indented by 2 spaces, except when opening a function definition, where they are not indented. In either case, the contained code is indented by 2 spaces from the braces. Popularised by Richard Stallman, the layout may be influenced by his background of writing Lisp code. In Lisp the equivalent to a block (a progn) is a first class data entity and giving it its own indent level helps to emphasize that, whereas in C a block is just syntax. Although not directly related to indentation, GNU coding style also includes a space before the bracketed list of arguments to a function.

Inserts the parentheses into the AST that are needed to ensure the AST can be printed correctly. For example, if the AST contains BinaryOperatorExpresson(2, Mul, BinaryOperatorExpression(1, Add, 1))); printing that AST would incorrectly result in "2 * 1 + 1". By running InsertParenthesesVisitor, the necessary parentheses are inserted: "2 * (1 + 1)".

Gets/Sets whether the visitor should insert parentheses to make the code better looking. If this property is false, it will insert parentheses only where strictly required by the language spec.

Gets the row number in the C# 4.0 spec operator precedence table.

Parenthesizes the expression if it does not have the minimum required precedence.

Used to insert the minimal amount of spaces so that the lexer recognizes the tokens that were written.

Writes all specials from start to end (exclusive). Does not touch the positionStack.

Writes all specials between the current position (in the positionStack) and the next node with the specified role. Advances the current position.

Writes all specials between the current position (in the positionStack) and the specified node. Advances the current position.

Writes an identifier.

Writes a keyword to the output.

Writes a token to the output.

Writes a primitive/literal value

Write a piece of text in an interpolated string literal.

Writes C# code into a TextWriter.

Gets the escape sequence for the specified character within a char literal. Does not include the single quotes surrounding the char literal.

Gets the escape sequence for the specified character.

This method does not convert ' or ".

Converts special characters to escape sequences within the given string.

Gets the fields and properties of the record type, interleaved as necessary to maintain Equals/ToString/etc. semantics.

Gets the detected primary constructor. Returns null, if there was no primary constructor detected.

Gets whether the member of the record type will be automatically generated by the compiler.

Given a SyntaxTree that was output from the decompiler, constructs the list of sequence points.

Main AST node associated with this sequence point.

List of IL intervals that are associated with this sequence point.

The function containing this sequence point.

Start a new C# statement = new sequence point.

Add the ILAst instruction associated with the AstNode to the sequence point. Also add all its ILAst sub-instructions (unless they were already added to another sequence point).

Called after the visitor is done to return the results.

Represents a namespace resolve result that's resolved using an alias.

The alias used.

Represents a type resolve result that's resolved using an alias.

The alias used.

Represents the result of an await expression.

The method representing the GetAwaiter() call. Can be an or a .

Awaiter type. Will not be null (but can be UnknownType).

Property representing the IsCompleted property on the awaiter type. Can be null if the awaiter type or the property was not found, or when awaiting a dynamic expression.

Method representing the OnCompleted method on the awaiter type. Can be null if the awaiter type or the method was not found, or when awaiting a dynamic expression. This can also refer to an UnsafeOnCompleted method, if the awaiter type implements System.Runtime.CompilerServices.ICriticalNotifyCompletion.

Method representing the GetResult method on the awaiter type. Can be null if the awaiter type or the method was not found, or when awaiting a dynamic expression.

Contains logic that determines whether an implicit conversion exists between two types.

This class is thread-safe.

Gets the Conversions instance for the specified . This will make use of the context's cache manager to reuse the Conversions instance.

Gets whether the type 'fromType' is convertible to 'toType' using one of the conversions allowed when satisying constraints (§4.4.4)

Gets whether there is an identity conversion from to

For IList{T}, ICollection{T}, IEnumerable{T} and IReadOnlyList{T}, returns T. Otherwise, returns null.

Gets whether the conversion from fromType to toType is a boxing conversion, or an implicit conversion involving a type parameter that might be a boxing conversion when instantiated with a value type.

Implicit conversions involving type parameters.

Gets whether type A is encompassed by type B.

Gets whether a is compatible with a delegate type. §15.2 Delegate compatibility

The method to test for compatibility The delegate type

Gets whether a method is compatible with a delegate type. §15.2 Delegate compatibility

The method to test for compatibility The invoke method of the delegate Gets whether m is accessed using extension method syntax. If this parameter is true, the first parameter of will be ignored.

Gets the better conversion (C# 4.0 spec, §7.5.3.3)

0 = neither is better; 1 = t1 is better; 2 = t2 is better

Unpacks the generic Task[T]. Returns null if the input is not Task[T].

Gets the better conversion (C# 4.0 spec, §7.5.3.4)

0 = neither is better; 1 = t1 is better; 2 = t2 is better

Gets the better conversion target (C# 4.0 spec, §7.5.3.5)

0 = neither is better; 1 = t1 is better; 2 = t2 is better

Represents the result of a method, constructor or indexer invocation. Provides additional C#-specific information for InvocationResolveResult.

Gets whether this invocation is calling an extension method using extension method syntax.

Gets whether this invocation is calling a delegate (without explicitly calling ".Invoke()").

Gets whether a params-Array is being used in its expanded form.

Gets an array that maps argument indices to parameter indices. For arguments that could not be mapped to any parameter, the value will be -1. parameterIndex = ArgumentToParameterMap[argumentIndex]

Gets the CSharpOperators instance for the specified . This will make use of the context's cache manager (if available) to reuse the CSharpOperators instance.

Implement this interface to give overload resolution a hint that the member represents a lifted operator, which is used in the tie-breaking rules.

Contains the main resolver logic.

This class is thread-safe.

Gets the compilation used by the resolver.

Gets the current type resolve context.

Gets whether the current context is checked.

Sets whether the current context is checked.

Gets whether the resolver is currently within a lambda expression or anonymous method.

Sets whether the resolver is currently within a lambda expression.

Gets the current member definition that is used to look up identifiers as parameters or type parameters.

Sets the current member definition.

Don't forget to also set CurrentTypeDefinition when setting CurrentMember; setting one of the properties does not automatically set the other.

Gets the current using scope that is used to look up identifiers as class names.

Sets the current using scope that is used to look up identifiers as class names.

Gets the current type definition.

Sets the current type definition.

Adds new variableŝ or lambda parameters to the current block.

Gets all currently visible local variables and lambda parameters. Does not include method parameters.

Pushes the type of the object that is currently being initialized.

Gets whether this context is within an object initializer.

Gets the current object initializer. This usually is an or (for nested initializers) a semantic tree based on an . Returns ErrorResolveResult if there is no object initializer.

Gets the type of the object currently being initialized. Returns SharedTypes.Unknown if no object initializer is currently open (or if the object initializer has unknown type).

Handle the case where an enum value is compared with another enum value bool operator op(E x, E y);

Handle the case where an enum value is subtracted from another enum value U operator –(E x, E y);

Handle the following enum operators: E operator +(E x, U y); E operator +(U x, E y); E operator –(E x, U y); E operator &(E x, E y); E operator |(E x, E y); E operator ^(E x, E y);

The input resolve result that should be converted. If a conversion exists, it is applied to the resolve result The target type that we should convert to Whether we are dealing with a lifted operator The resolve result that is enum-typed. If necessary, a nullable conversion is applied. Whether the conversion from the constant zero is allowed. True if the conversion is successful; false otherwise. If the conversion is not successful, the ref parameters will not be modified.

Looks up an alias (identifier in front of :: operator)

Creates a MemberLookup instance using this resolver's settings.

Gets all extension methods that are available in the current context.

Name of the extension method. Pass null to retrieve all extension methods. Explicitly provided type arguments. An empty list will return all matching extension method definitions; a non-empty list will return s for all extension methods with the matching number of type parameters. The results are stored in nested lists because they are grouped by using scope. That is, for "using SomeExtensions; namespace X { using MoreExtensions; ... }", the return value will be new List { new List { all extensions from MoreExtensions }, new List { all extensions from SomeExtensions } }

Gets the extension methods that are called 'name' and are applicable with a first argument type of 'targetType'.

Type of the 'this' argument Name of the extension method. Pass null to retrieve all extension methods. Explicitly provided type arguments. An empty list will return all matching extension method definitions; a non-empty list will return s for all extension methods with the matching number of type parameters. Specifies whether to produce a when type arguments could be inferred from . This parameter is only used for inferred types and has no effect if is non-empty. The results are stored in nested lists because they are grouped by using scope. That is, for "using SomeExtensions; namespace X { using MoreExtensions; ... }", the return value will be new List { new List { all extensions from MoreExtensions }, new List { all extensions from SomeExtensions } }

Checks whether the specified extension method is eligible on the target type.

Target type that is passed as first argument to the extension method. The extension method. Whether to perform type inference for the method. Use false if is already parameterized (e.g. when type arguments were given explicitly). Otherwise, use true. If the method is generic and is true, and at least some of the type arguments could be inferred, this parameter receives the inferred type arguments. Since only the type for the first parameter is considered, not all type arguments may be inferred. If an array is returned, any slot with an uninferred type argument will be set to the method's corresponding type parameter.

Gets all extension methods available in the current using scope. This list includes inaccessible methods.

Resolves an invocation.

The target of the invocation. Usually a MethodGroupResolveResult. Arguments passed to the method. The resolver may mutate this array to wrap elements in s! The argument names. Pass the null string for positional arguments. InvocationResolveResult or UnknownMethodResolveResult

Resolves an indexer access.

Target expression. Arguments passed to the indexer. The resolver may mutate this array to wrap elements in s! The argument names. Pass the null string for positional arguments. ArrayAccessResolveResult, InvocationResolveResult, or ErrorResolveResult

Converts all arguments to int,uint,long or ulong.

Resolves an object creation.

Type of the object to create. Arguments passed to the constructor. The resolver may mutate this array to wrap elements in s! The argument names. Pass the null string for positional arguments. Whether to allow calling protected constructors. This should be false except when resolving constructor initializers. Statements for Objects/Collections initializer. InvocationResolveResult or ErrorResolveResult

Resolves 'sizeof(type)'.

Resolves 'this'.

Resolves 'base'.

Converts the input to bool using the rules for boolean expressions. That is, operator true is used if a regular conversion to bool is not possible.

Converts the negated input to bool using the rules for boolean expressions. Computes !(bool)input if the implicit cast to bool is valid; otherwise computes input.operator false().

Resolves an array creation.

The array element type. Pass null to resolve an implicitly-typed array creation. The size arguments. The length of this array will be used as the number of dimensions of the array type. Negative values will be treated as errors. The initializer elements. May be null if no array initializer was specified. The resolver may mutate this array to wrap elements in s!

Resolves an array creation.

The array element type. Pass null to resolve an implicitly-typed array creation. The size arguments. The length of this array will be used as the number of dimensions of the array type. The resolver may mutate this array to wrap elements in s! The initializer elements. May be null if no array initializer was specified. The resolver may mutate this array to wrap elements in s!

The invocation is a normal invocation ( 'a(b)' ).

The invocation is an indexing ( 'a[b]' ).

The invocation is an object creation ( 'new a(b)' ).

Represents the result of an invocation of a member of a dynamic object.

Target of the invocation. Can be a dynamic expression or a .

Type of the invocation.

Arguments for the call. Named arguments will be instances of .

Gets the list of initializer statements that are appplied to the result of this invocation. This is used to represent object and collection initializers. With the initializer statements, the is used to refer to the result of this invocation. Initializer statements can only exist if the is .

Represents the result of an access to a member of a dynamic object.

Target of the member access (a dynamic object).

Name of the accessed member.

Represents an anonymous method or lambda expression. Note: the lambda has no type. To retrieve the delegate type, look at the anonymous function conversion.

Gets whether there is a parameter list. This property always returns true for C# 3.0-lambdas, but may return false for C# 2.0 anonymous methods.

Gets whether this lambda is using the C# 2.0 anonymous method syntax.

Gets whether the lambda parameters are implicitly typed.

This property returns false for anonymous methods without parameter list.

Gets whether the lambda is async.

Gets the return type inferred when the parameter types are inferred to be

This method determines the return type inferred from the lambda body, which is used as part of C# type inference. Use the property to retrieve the actual return type as determined by the target delegate type.

Gets the list of parameters.

Gets the return type of the lambda. If the lambda is async, the return type includes Task<T>

Gets whether the lambda body is valid for the given parameter types and return type.

Produces a conversion with =true if the lambda is valid; otherwise returns .

Gets the resolve result for the lambda body. Returns a resolve result for 'void' for statement lambdas.

The inferred return type. Can differ from ReturnType if a return statement performs an implicit conversion.

Resolver logging helper. Wraps System.Diagnostics.Debug so that resolver-specific logging can be enabled/disabled on demand. (it's a huge amount of debug spew and slows down the resolver quite a bit)

Implementation of member lookup (C# 4.0 spec, §7.4).

Gets whether the member is considered to be invocable.

Gets whether access to protected instance members of the target expression is possible.

Gets whether access to protected instance members of the target type is possible.

This method does not consider the special case of the 'base' reference. If possible, use the IsProtectedAccessAllowed(ResolveResult) overload instead.

Gets whether is accessible in the current class.

The entity to test Whether protected access to instance members is allowed. True if the type of the reference is derived from the current class. Protected static members may be accessible even if false is passed for this parameter.

Retrieves all members that are accessible and not hidden (by being overridden or shadowed). Returns both members and nested type definitions. Does not include extension methods.

Performs a member lookup.

Looks up the indexers on the target type.

Adds the nested types to 'newNestedTypes' and removes any hidden members from the existing lookup groups.

Declaring type of the nested types List of nested types to add. The number of type arguments - used for hiding types from the base class List of existing lookup groups The base types of 'type' (initialized on demand) The target list (created on demand).

Adds members to 'newMethods'/'newNonMethod'. Removes any members in the existing lookup groups that were hidden by added members. Substitutes 'virtual' members in the existing lookup groups for added 'override' members.

Declaring type of the members List of members to add. Whether protected members are accessible List of existing lookup groups Whether to treat properties as methods The base types of 'type' (initialized on demand) The target list for methods (created on demand). The target variable for non-method members.

A method list that belongs to a declaring type.

The declaring type.

Not all methods in this list necessarily have this as their declaring type. For example, this program:


             class Base {
               public virtual void M() {}
             }
             class Derived : Base {
               public override void M() {}
               public void M(int i) {}
             }

results in two lists: new MethodListWithDeclaringType(Base) { Derived.M() }, new MethodListWithDeclaringType(Derived) { Derived.M(int) }

Represents a group of methods. A method reference used to create a delegate is resolved to a MethodGroupResolveResult. The MethodGroupResolveResult has no type. To retrieve the delegate type or the chosen overload, look at the method group conversion.

Gets the resolve result for the target object.

Gets the type of the reference to the target object.

Gets the name of the methods in this group.

Gets the methods that were found. This list does not include extension methods.

Gets the methods that were found, grouped by their declaring type. This list does not include extension methods. Base types come first in the list.

Gets the type arguments that were explicitly provided.

List of extension methods, used to avoid re-calculating it in ResolveInvocation() when it was already calculated by ResolveMemberAccess().

Gets all candidate extension methods. Note: this includes candidates that are not eligible due to an inapplicable this argument. The candidates will only be specialized if the type arguments were provided explicitly.

The results are stored in nested lists because they are grouped by using scope. That is, for "using SomeExtensions; namespace X { using MoreExtensions; ... }", the return value will be new List { new List { all extensions from MoreExtensions }, new List { all extensions from SomeExtensions } }

Gets the eligible extension methods.

Specifies whether to produce a SpecializedMethod when type arguments could be inferred from . This setting is only used for inferred types and has no effect if the type parameters are specified explicitly. The results are stored in nested lists because they are grouped by using scope. That is, for "using SomeExtensions; namespace X { using MoreExtensions; ... }", the return value will be new List { new List { all extensions from MoreExtensions }, new List { all extensions from SomeExtensions } }

Normal name lookup in expressions

Name lookup in expression, where the expression is the target of an invocation. Such a lookup will only return methods and delegate-typed fields.

Normal name lookup in type references.

Name lookup in the type reference inside a using declaration.

Name lookup for base type references.

C# overload resolution (C# 4.0 spec: §7.5).

Returns the normal form candidate, if this is an expanded candidate.

Gets the parameter types. In the first step, these are the types without any substition. After type inference, substitutions will be performed.

argument index -> parameter index; -1 for arguments that could not be mapped

Gets the original member parameters (before any substitution!)

Gets the original method type parameters (before any substitution!)

Conversions applied to the arguments. This field is set by the CheckApplicability step.

Gets/Sets whether the methods are extension methods that are being called using extension method syntax.

Setting this property to true restricts the possible conversions on the first argument to implicit identity, reference, or boxing conversions.

Gets/Sets whether expanding 'params' into individual elements is allowed. The default value is true.

Gets/Sets whether optional parameters may be left at their default value. The default value is true. If this property is set to false, optional parameters will be treated like regular parameters.

Gets/Sets whether a value argument can be passed to an `in` reference parameter.

Gets/Sets whether ConversionResolveResults created by this OverloadResolution instance apply overflow checking. The default value is false.

Gets the arguments for which this OverloadResolution instance was created.

Adds a candidate to overload resolution.

The candidate member to add. The errors that prevent the member from being applicable, if any. Note: this method does not return errors that do not affect applicability.

Adds a candidate to overload resolution.

The candidate member to add. Additional errors that apply to the candidate. This is used to represent errors during member lookup (e.g. OverloadResolutionErrors.Inaccessible) in overload resolution. The errors that prevent the member from being applicable, if any. Note: this method does not return errors that do not affect applicability.

Calculates applicability etc. for the candidate.

True if the calculation was successful, false if the candidate should be removed without reporting an error

Adds all candidates from the method lists. This method implements the logic that causes applicable methods in derived types to hide all methods in base types.

The methods, grouped by declaring type. Base types must come first in the list.

Validates whether the given type argument satisfies the constraints for the given type parameter.

The type parameter. The type argument. The substitution that defines how type parameters are replaced with type arguments. The substitution is used to check constraints that depend on other type parameters (or recursively on the same type parameter). May be null if no substitution should be used. True if the constraints are satisfied; false otherwise.

Returns whether a candidate with the given errors is still considered to be applicable.

Returns 1 if c1 is better than c2; 2 if c2 is better than c1; or 0 if neither is better.

Returns the errors that apply to the best candidate. This includes additional errors that do not affect applicability (e.g. AmbiguousMatch, MethodConstraintsNotSatisfied)

Gets the implicit conversions that are being applied to the arguments.

Gets an array that maps argument indices to parameter indices. For arguments that could not be mapped to any parameter, the value will be -1. parameterIndex = GetArgumentToParameterMap()[argumentIndex]

Returns the arguments for the method call in the order they were provided (not in the order of the parameters). Arguments are wrapped in a if an implicit conversion is being applied to them when calling the method. For arguments where an explicit argument name was provided, the argument will be wrapped in a .

Creates a ResolveResult representing the result of overload resolution.

The target expression of the call. May be null for static methods/constructors. Statements for Objects/Collections initializer. If not null, use this instead of the ReturnType of the member as the type of the created resolve result.

Too many positional arguments (some could not be mapped to any parameter).

A named argument could not be mapped to any parameter

Type inference failed for a generic method.

Type arguments were explicitly specified, but did not match the number of type parameters.

After substituting type parameters with the inferred types; a constructed type within the formal parameters does not satisfy its constraint.

No argument was mapped to a non-optional parameter

Several arguments were mapped to a single (non-params-array) parameter

'ref'/'out' passing mode doesn't match for at least 1 parameter

Argument type cannot be converted to parameter type

There is no unique best overload. This error does not apply to any single candidate, but only to the overall result of overload resolution.

This error does not prevent a candidate from being applicable.

The member is not accessible.

This error is generated by member lookup; not by overload resolution.

A generic method

This error does not prevent a candidate from being applicable.

Using 'out var' instead of 'out T' would result in loss of type information.

C# 4.0 type inference.

Improved algorithm (not part of any specification) using FindTypeInBounds for fixing.

Improved algorithm (not part of any specification) using FindTypeInBounds for fixing; uses to report all results (in case of ambiguities).

Implements C# 4.0 Type Inference (§7.5.2).

Gets/Sets the type inference algorithm used.

Performs type inference.

The method type parameters that should be inferred. The arguments passed to the method. The parameter types of the method. Out: whether type inference was successful Class type arguments. These are substituted for class type parameters in the formal parameter types when inferring a method group or lambda. The inferred type arguments.

Infers type arguments for the occurring in the so that the resulting type (after substition) satisfies the given bounds.

Make exact inference from U to V. C# 4.0 spec: §7.5.2.8 Exact inferences

Make lower bound inference from U to V. C# 4.0 spec: §7.5.2.9 Lower-bound inferences

Make upper bound inference from U to V. C# 4.0 spec: §7.5.2.10 Upper-bound inferences

Gets the best common type (C# 4.0 spec: §7.5.2.14) of a set of expressions.

Finds a type that satisfies the given lower and upper bounds.

Combines query expressions and removes transparent identifiers.

Removes all occurrences of transparent identifiers

Converts extension method calls into infix syntax.

Decompiles query expressions. Based on C# 4.0 spec, §7.16.2 Query expression translation

This fixes #437: Decompilation of query expression loses material parentheses We wrap the expression in parentheses if: - the Select-call is explicit (see caller(s)) - the expression is a plain identifier matching the parameter name

Ensure that all ThenBy's are correct, and that the list of ThenBy's is terminated by an 'OrderBy' invocation.

Matches simple lambdas of the form "a => b"

Modifiers that are emitted on accessors, but can be moved to the property declaration.

Simplifies "x = x op y" into "x op= y" where possible.

Because the two "x" in "x = x op y" may refer to different ILVariables, this transform must run after DeclareVariables. It must also run after ReplaceMethodCallsWithOperators (so that it can work for custom operator, too); and after AddCheckedBlocks (because "for (;; x = unchecked(x op y))" cannot be transformed into "x += y").

This transform is used to remove CLSCompliant attributes added by the compiler. We remove them in order to get rid of many warnings.

This transform is only enabled, when exporting a full assembly as project.

Base class for AST visitors that need the current type/method context info.

Transforms decimal constant fields.

Insert variable declarations.

Represents a position immediately before nextNode. nextNode is either an ExpressionStatement in a BlockStatement, or an initializer in a for-loop.

The nesting level of `nextNode` within the AST. Used to speed up FindCommonParent().

Go up one level

Whether the variable needs to be default-initialized.

Integer value that can be used to compare to VariableToDeclare instances to determine which variable was used first in the source code. The variable with the lower SourceOrder value has the insertion point that comes first in the source code.

The insertion point, i.e. the node before which the variable declaration should be inserted.

The first use of the variable.

Analyze the input AST (containing undeclared variables) for where those variables would be declared by this transform. Analysis does not modify the AST.

Get the position where the declaration for the variable will be inserted.

Determines whether a variable was merged with other variables.

Finds insertion points for all variables used within `node` and adds them to the variableDict. `level` == nesting depth of `node` within root node.

Insertion point for a variable = common parent of all uses of that variable = smallest possible scope that contains all the uses of the variable

Finds an insertion point in a common parent instruction.

Some variable declarations in C# are illegal (colliding), even though the variable live ranges are not overlapping. Multiple declarations in same block:


            int i = 1; use(1);
            int i = 2; use(2);

"Hiding" declaration in nested block:


            int i = 1; use(1);
            if (...) {
              int i = 2; use(2);
            }

Nested blocks are illegal even if the parent block declares the variable later:


            if (...) {
              int i = 1; use(i);
            }
            int i = 2; use(i);

ResolveCollisions() detects all these cases, and combines the variable declarations to a single declaration that is usable for the combined scopes.

Update ILVariableResolveResult annotations of all ILVariables that have been replaced by ResolveCollisions.

Escape invalid identifiers.

This transform is not enabled by default.

This transform is used to remove assembly-attributes that are generated by the compiler, thus don't need to be declared. (We have to remove them, in order to avoid conflicts while compiling.)

This transform is only enabled, when exporting a full assembly as project.

This transform is used to remove attributes that are embedded

Rename entities to solve name collisions that make the code uncompilable.

Currently, we only rename private fields that collide with property or event names. This helps especially with compiler-generated events that were not detected as a pattern.

Introduces using declarations.

Finds the expanded form of using statements using pattern matching and replaces it with a UsingStatement.

$variable = $initializer;

$variable = $collection.GetUpperBound($index);

$variable = $collection.GetLowerBound($index);

$variable = $collection[$index1, $index2, ...];

This matches the following patterns <Property>k__BackingField (used by C#) _Property (used by VB)

Simplify nested 'try { try {} catch {} } finally {}'. This transformation must run after the using/lock tranformations.

Use associativity of logic operators to avoid parentheses.

Parameters for IAstTransform.

Returns the current member; or null if a whole type or module is being decompiled.

Returns the current type definition; or null if a module is being decompiled.

Returns the module that is being decompiled.

Returns the max possible set of namespaces that will be used during decompilation.

Add checked/unchecked blocks.

true=checked, false=unchecked

Require an explicit unchecked block (can't rely on the project-level unchecked context)

Gets the new cost if an expression with this cost is wrapped in a checked/unchecked expression.

Holds the blocks and expressions that should be inserted

Holds the result of an insertion operation.

This transform moves field initializers at the start of constructors to their respective field declarations and transforms this-/base-ctor calls in constructors to constructor initializers.

Evaluates a call to the decimal-ctor.

typeof-Pattern that applies on the expanded form of typeof (prior to ReplaceMethodCallsWithOperators)

Replaces method calls with the appropriate operator expressions.

Adds XML documentation for member definitions.

Context struct passed in to ExpressionBuilder.Visit() methods.

The expected type during ILAst->C# translation; or SpecialType.Unknown if no specific type is expected.

Looks up an alias (identifier in front of :: operator).

The member lookup performed by the :: operator is handled by .

Reference to a qualified type or namespace name.

Adds a suffix to the identifier. Does not modify the existing type reference, but returns a new one.

Resolved version of using scope.

Gets whether this using scope has an alias (either using or extern) with the specified name.

Represents a simple C# name. (a single non-qualified identifier with an optional list of type arguments)

Adds a suffix to the identifier. Does not modify the existing type reference, but returns a new one.

Represents a reference which could point to a type or namespace.

Resolves the reference and returns the ResolveResult.

Returns the type that is referenced; or an UnknownType if the type isn't found.

Returns the namespace that is referenced; or null if no such namespace is found.

Represents a scope that contains "using" statements. This is either the file itself, or a namespace declaration.

Creates a new root using scope.

Creates a new nested using scope.

The parent using scope. The short namespace name.

Gets whether this using scope has an alias (either using or extern) with the specified name.

Resolves the namespace represented by this using scope.

Helper struct so that the compiler can ensure we don't forget both the ILInstruction annotation and the ResolveResult annotation. Use '.WithILInstruction(...)' or '.WithoutILInstruction()' to create an instance of this struct.

Helper struct so that the compiler can ensure we don't forget both the ILInstruction annotation and the ResolveResult annotation. Use '.WithRR(...)'.

Output of C# ExpressionBuilder -- a decompiled C# expression that has both a resolve result and ILInstruction annotation.

The resolve result is also always available as annotation on the expression, but having TranslatedExpression as a separate type is still useful to ensure that no case in the expression builder forgets to add the annotation.

Returns a new TranslatedExpression that represents the specified descendant expression. All ILInstruction annotations from the current expression are copied to the descendant expression. The descendant expression is detached from the AST.

Adds casts (if necessary) to convert this expression to the specified target type.

If the target type is narrower than the source type, the value is truncated. If the target type is wider than the source type, the value is sign- or zero-extended based on the sign of the source type. This fits with the ExpressionBuilder's post-condition, so e.g. an assignment can simply call Translate(stloc.Value).ConvertTo(stloc.Variable.Type) and have the overall C# semantics match the IL semantics. From the caller's perspective, IntPtr/UIntPtr behave like normal C# integers except that they have native int size. All the special cases necessary to make IntPtr/UIntPtr behave sanely are handled internally in ConvertTo(). Post-condition: The "expected evaluation result" is the value computed by this.Expression, converted to targetType via an IL conv instruction. ConvertTo(targetType, allowImplicitConversion=false).Type must be equal to targetType (modulo identity conversions). The value computed by the converted expression must match the "expected evaluation result". ConvertTo(targetType, allowImplicitConversion=true) must produce an expression that, when evaluated in a context where it will be implicitly converted to targetType, evaluates to the "expected evaluation result".

Gets whether an implicit conversion from 'inputType' to 'newTargetType' would have the same semantics as the existing cast from 'inputType' to 'oldTargetType'. The existing cast is classified in 'conversion'.

In conditional contexts, remove the bool-cast emitted when converting an "implicit operator bool" invocation.

Converts this expression to a boolean expression. Expects that the input expression is an integer expression; produces an expression that returns true iff the integer value is not 0. If negate is true, instead produces an expression that returns true iff the integer value is 0.

Main class of the C# decompiler engine.

Instances of this class are not thread-safe. Use separate instances to decompile multiple members in parallel. (in particular, the transform instances are not thread-safe)

Pre-yield/await transforms.

Returns all built-in transforms of the ILAst pipeline.

Returns all built-in transforms of the C# AST pipeline.

Token to check for requested cancellation of the decompilation.

The type system created from the main module and referenced modules.

Gets or sets the optional provider for debug info.

Gets or sets the optional provider for XML documentation strings.

IL transforms.

C# AST transforms.

Creates a new instance from the given using the given .

Creates a new instance from the given using the given and .

Creates a new instance from the given and the given .

Determines whether a should be hidden from the decompiled code. This is used to exclude compiler-generated code that is handled by transforms from the output.

The module containing the member. The metadata token/handle of the member. Can be a TypeDef, MethodDef or FieldDef. THe settings used to determine whether code should be hidden. E.g. if async methods are not transformed, async state machines are included in the decompiled code.

Determines whether a given type requires that its methods be ordered precisely as they were originally defined.

The type whose members may need native ordering.

Compare handles with the method definition ordering intact by using the underlying method's MetadataToken, which is defined as the index into a given metadata table. This should equate to the original order that methods and properties were defined by the author.

The type whose members to order using their method's MetadataToken A sequence of all members ordered by MetadataToken

Decompile assembly and module attributes.

Decompiles the whole module into a single syntax tree.

If true, top-level-types are emitted sorted by namespace/name. If false, types are emitted in metadata order.

Creates an for the given .

Determines the "code-mappings" for a given TypeDef or MethodDef. See for more information.

Decompiles the whole module into a single string.

Decompile the given types.

Unlike Decompile(IMemberDefinition[]), this method will add namespace declarations around the type definitions.

Decompile the given types.

Unlike Decompile(IMemberDefinition[]), this method will add namespace declarations around the type definitions.

Decompile the given type.

Unlike Decompile(IMemberDefinition[]), this method will add namespace declarations around the type definition. Note that decompiling types from modules other than the main module is not supported.

Decompile the given type.

Unlike Decompile(IMemberDefinition[]), this method will add namespace declarations around the type definition.

Decompile the specified types and/or members.

Sets new modifier if the member hides some other member from a base type.

The node of the member which new modifier state should be determined.

Creates sequence points for the given syntax tree. This only works correctly when the nodes in the syntax tree have line/column information.

Translates from ILAst to C# expressions.

Every translated expression must have: * an ILInstruction annotation * a ResolveResult annotation Post-condition for Translate() calls: * The type of the ResolveResult must match the StackType of the corresponding ILInstruction, except that the width of integer types does not need to match (I4, I and I8 count as the same stack type here) * Evaluating the resulting C# expression shall produce the same side effects as evaluating the ILInstruction. * If the IL instruction has ResultType == StackType.Void, the C# expression may evaluate to an arbitrary type and value. * Otherwise, evaluating the resulting C# expression shall produce a similar value as evaluating the ILInstruction. * If the IL instruction evaluates to an integer stack type (I4, I, or I8), the C# type of the resulting expression shall also be an integer (or enum/pointer/char/bool) type. * If sizeof(C# type) == sizeof(IL stack type), the values must be the same. * If sizeof(C# type) > sizeof(IL stack type), the C# value truncated to the width of the IL stack type must equal the IL value. * If sizeof(C# type) < sizeof(IL stack type), the C# value (sign/zero-)extended to the width of the IL stack type must equal the IL value. Whether sign or zero extension is used depends on the sign of the C# type (as determined by IType.GetSign()). * If the IL instruction is a lifted nullable operation, and the underlying operation evaluates to an integer stack type, the C# type of the resulting expression shall be Nullable{T}, where T is an integer type (as above). The C# value shall be null iff the IL-level value evaluates to null, and otherwise the values shall correspond as with non-lifted integer operations. * If the IL instruction evaluates to a managed reference (Ref) created by starting tracking of an unmanaged reference, the C# instruction may evaluate to any integral/enum/pointer type that when converted to pointer type is equivalent to the managed reference. * Otherwise, the C# type of the resulting expression shall match the IL stack type, and the evaluated values shall be the same.

Translates the equality comparison between left and right.

Handle Comp instruction, operators other than equality/inequality.

Translates pointer arithmetic: ptr + int int + ptr ptr - int Returns null if 'inst' is not performing pointer arithmetic. 'ptr - ptr' is not handled here, but in HandlePointerSubtraction()!

Translates pointer arithmetic with managed pointers: ref + int int + ref ref - int ref - ref

Called for divisions, detect and handles the code pattern: div(sub(a, b), sizeof(T)) when a,b are of type T*. This is what the C# compiler generates for pointer subtraction.

Gets a type matching the stack type and sign.

Gets a type used for performing arithmetic with the stack type and sign. This may result in a larger type than requested when the selected C# version doesn't support native integers. Should only be used after a call to PrepareArithmeticArgument() to ensure that we're not preserving extra bits from an oversized TranslatedExpression.

Handle oversized arguments needing truncation; and avoid IntPtr/pointers in arguments.

Gets whether has the specified . If is None, always returns true.

Gets whether the ResolveResult computes a value that might be oversized for the specified stack type.

If expr is a constant integer expression, and its value fits into type, convert the expression into the target type. Otherwise, returns the expression unmodified.

Target block that a 'continue;' statement would jump to

Number of ContinueStatements that were created for the current continueTarget

Maps blocks to cases.

Target container that a 'break;' statement would break out of

Dictionary from BlockContainer to label name for 'goto of_container';

Unwraps a nested BlockContainer, if container contains only a single block, and that single block contains only a BlockContainer followed by a Leave instruction. If the leave instruction is a return that carries a value, the container is unwrapped only if the value has no side-effects. Otherwise returns the unmodified container.

If the leave is a return/break and has no side-effects, we can move the return out of the using-block and put it after the loop, otherwise returns null.

Foreach transformation not possible.

Uninline the stloc foreachVar(call get_Current()) and insert it as first statement in the loop body.


            ... (stloc foreachVar(call get_Current()) ...
            =>
            stloc foreachVar(call get_Current())
            ... (ldloc foreachVar) ...

No store was found, thus create a new variable and use it as foreach variable.


            ... (call get_Current()) ...
            =>
            stloc foreachVar(call get_Current())
            ... (ldloc foreachVar) ...

No store was found, thus create a new variable and use it as foreach variable. Additionally it is necessary to copy the value of the foreach variable to another local to allow safe modification of its value.


            ... addressof(call get_Current()) ...
            =>
            stloc foreachVar(call get_Current())
            stloc copy(ldloc foreachVar)
            ... (ldloca copy) ...

call get_Current() is the tested operand of a deconstruct instruction. and the deconstruct instruction is the first statement in the loop body.

Determines whether is only used once inside for accessing the Current property.

The using body container. This is only used for variable usage checks. The loop body. The first statement of this block is analyzed. The current enumerator. The call MoveNext(ldloc enumerator) pattern. Returns the call instruction invoking Current's getter. Returns the the foreach variable, if a suitable was found. This variable is only assigned once and its assignment is the first statement in . for details.

Determines whether storeInst.Variable is only assigned once and used only inside . Loads by reference (ldloca) are only allowed in the context of this pointer in call instructions, or as target of ldobj. (This only applies to value types.)

Returns true if singleGetter is a value type and its address is used as setter target.

Information used for (optional) progress reporting by the decompiler.

The total number of units to process. If set to a value <= 0, an indeterminate progress bar is displayed.

The number of units currently completed. Should be a positive number.

Optional information displayed alongside the progress bar.

Optional custom title for the operation.

class/valuetype + TypeName (built-in types use keyword syntax)

Like signature, but always refers to type parameters using their position

[assembly]Full.Type.Name (even for built-in types)

Name (but built-in types use keyword syntax)

Specifies the type of an IL structure.

The root block of the method

A nested control structure representing a loop.

A nested control structure representing a try block.

A nested control structure representing a catch, finally, or fault block.

A nested control structure representing an exception filter block.

An IL structure.

Start position of the structure.

End position of the structure. (exclusive)

The exception handler associated with the Try, Filter or Handler block.

The loop's entry point.

The list of child structures.

Finds all branches. Returns list of source offset->target offset mapping. Multiple entries for the same source offset are possible (switch statements). The result is sorted by source offset.

Gets the innermost structure containing the specified offset.

Disassembles a method body.

Show .try/finally as blocks in IL code; indent loops.

Show sequence points if debug information is loaded in Cecil.

Show metadata tokens for instructions with token operands.

Show metadata tokens for instructions with token operands in base 10.

Show raw RVA offset and bytes before each instruction.

Optional provider for sequence points.

Disassembles type and member definitions.

Similar to , but acts only on leave instructions leaving the whole function (return/yield break) that can be made implicit without using goto.

Decompiler step for C# 5 async/await.

Matches a (potentially virtual) instance method call.

Matches a store to the state machine.

First peek into MoveNext(); analyzes everything outside the big try-catch.

Analyse the DisposeAsync() method in order to find the disposeModeField.

Analyze the the state machine; and replace 'leave IL_0000' with await+jump to block that gets entered on the next MoveNext() call.

Eliminates usage of doFinallyBodies

Analyzes all catch handlers and returns every handler that follows the await catch handler pattern.

Matches the await catch handler pattern: [stloc V_3(ldloc E_100) - copy exception variable to a temporary] stloc V_6(ldloc V_3) - store exception in 'global' object variable stloc V_5(ldc.i4 2) - store id of catch block in 'identifierVariable' br IL_0075 - jump out of catch block to the head of the catch-handler jump table

The type that contains the function being decompiled.

The compiler-generated enumerator class.

Set in MatchEnumeratorCreationPattern()

The constructor of the compiler-generated enumerator class.

Set in MatchEnumeratorCreationPattern() Set in MatchEnumeratorCreationPattern() Set in MatchEnumeratorCreationPattern() or ConstructExceptionTable() Set in MatchEnumeratorCreationPattern() If this is true, then isCompiledWithVisualBasic is also true.

The dispose method of the compiler-generated enumerator class.

Set in ConstructExceptionTable()

The field in the compiler-generated class holding the current state of the state machine

Set in AnalyzeCtor() for MS, MatchEnumeratorCreationPattern() or AnalyzeMoveNext() for Mono

The backing field of the 'Current' property in the compiler-generated class

Set in AnalyzeCurrentProperty()

The disposing field of the compiler-generated enumerator class.

Set in ConstructExceptionTable() for assembly compiled with Mono

Maps the fields of the compiler-generated class to the original parameters.

Set in MatchEnumeratorCreationPattern() and ResolveIEnumerableIEnumeratorFieldMapping()

This dictionary stores the information extracted from the Dispose() method: for each "Finally Method", it stores the set of states for which the method is being called.

Set in ConstructExceptionTable()

For each finally method, stores the target state when entering the finally block, and the decompiled code of the finally method body.

Temporary stores for 'yield break'.

Local bool variable in MoveNext() that signifies whether to skip finally bodies.

Local bool variable in MoveNext() that signifies whether to execute finally bodies.

Set of variables might hold copies of the generated state field.

Matches the body of a method as a single basic block.

Matches the newobj instruction that creates an instance of the compiler-generated enumerator helper class.

Looks at the enumerator's ctor and figures out which of the fields holds the state.

Creates ILAst for the specified method, optimized up to before the 'YieldReturn' step.

Looks at the enumerator's get_Current method and figures out which of the fields holds the current value.

Convert the old body (of MoveNext function) to the new body (of decompiled iterator method). * Replace the sequence this.currentField = expr; this.state = N; return true; with: yield return expr; goto blockForState(N); * Replace the sequence: this._finally2(); this._finally1(); return false; with: yield break; * Reconstruct try-finally blocks from (on enter) this.state = N; (on exit) this._finallyX();

Translates all field accesses in `function` to local variable accesses.

Reconstruct try-finally blocks. * The stateChanges (iterator._state = N;) tell us when to open a try-finally block * The calls to the finally method tell us when to leave the try block. There might be multiple stateChanges for a given try-finally block, e.g. both the original entry point, and the target when leaving a nested block. In proper C# code, the entry point of the try-finally will dominate all other code in the try-block, so we can use dominance to find the proper entry point. Precondition: the blocks in newBody are topologically sorted.

Eliminates usage of doFinallyBodies

Holds the control flow graph. A separate graph is computed for each BlockContainer at the start of the block transforms (before loop detection).

The container for which the ControlFlowGraph was created. This may differ from the container currently holding a block, because a transform could have moved the block since the CFG was created.

Nodes array, indexed by original block index. Originally cfg[i].UserData == container.Blocks[i], but the ILAst blocks may be moved/reordered by transforms.

Dictionary from Block to ControlFlowNode. Unlike the cfg array, this can be used to discover control flow nodes even after blocks were moved/reordered by transforms.

nodeHasDirectExitOutOfContainer[i] == true iff cfg[i] directly contains a branch/leave instruction leaving the container.

nodeHasReachableExit[i] == true iff there is a path from cfg[i] to a node not dominated by cfg[i], or if there is a path from cfg[i] to a branch/leave instruction leaving the container.

Constructs a control flow graph for the blocks in the given block container. Return statements, exceptions, or branches leaving the block container are not modeled by the control flow graph.

Gets the ControlFlowNode for the block. Precondition: the block belonged to the container at the start of the block transforms (when the control flow graph was created).

Returns true iff there is a control flow path from node to one of the following: * branch or leave instruction leaving this.Container * branch instruction within this container to another node that is not dominated by node. If this function returns false, the only way control flow can leave the set of nodes dominated by node is by executing a return or throw instruction.

Gets whether the control flow node directly contains a branch/leave instruction exiting the container.

Symbolically executes code to determine which blocks are reachable for which values of the 'state' field.

Assumption: there are no loops/backward jumps We 'run' the code, with "state" being a symbolic variable so it can form expressions like "state + x" (when there's a sub instruction) For each block, we maintain the set of values for state for which the block is reachable. This is (int.MinValue, int.MaxValue) for the first instruction. These ranges are propagated depending on the conditional jumps performed by the code.

Creates a new StateRangeAnalysis with the same settings, including any cached state vars discovered by this analysis. However, the new analysis has a fresh set of result ranges.

Assign state ranges for all blocks within 'inst'.

The set of states for which the exit point of the instruction is reached. This must be a subset of the input set. Returns an empty set for unsupported instructions.

Gets a mapping from states to blocks. Within the given container (which should be the container that was analyzed), the mapping prefers the last block. Blocks outside of the given container are preferred over blocks within the container.

This exception is thrown when we find something else than we expect from the C# compiler. This aborts the analysis and makes the whole transform fail.

Unknown value

int: Constant (result of ldc.i4)

int: State + Constant

This pointer (result of ldarg.0)

bool: ValueSet.Contains(State)

Detects 'if' structure and other non-loop aspects of control flow.

Order dependency: should run after loop detection. Blocks should be basic blocks prior to this transform. After this transform, they will be extended basic blocks.

Builds structured control flow for the block associated with the control flow node.

After a block was processed, it should use structured control flow and have just a single 'regular' exit point (last branch instruction in the block)

Repeatedly inlines and simplifies, maintaining a good block exit and then attempting to match IL order

if (...) br trueBlock; -> if (...) { trueBlock... } Only inlines branches that are strictly dominated by this block (incoming edge count == 1)

...; br nextBlock; -> ...; { nextBlock... } Only inlines branches that are strictly dominated by this block (incoming edge count == 1)

Gets whether potentialBranchInstruction is a branch to a block that is dominated by cfgNode. If this function returns true, we replace the branch instruction with the block itself.

Looks for common exits in the inlined then and else branches of an if instruction and performs inversions and simplifications to merge them provided they don't isolate a higher priority block exit

Finds all exits which could be brought to the block root via inversion

Recursively performs inversions to bring a desired exit to the root of the block for example: if (a) { ...; if (b) { ...; targetExit; } ...; exit1; } ...; exit2; -> if (!a) { ...; exit2; } ...; if (!b) { ...; exit1; } ...; targetExit;

Anticipates the introduction of an || operator when merging ifInst and elseExit if (cond) commonExit; if (cond2) commonExit; ...; blockExit; will become: if (cond || cond2) commonExit; ...; blockExit;

if (cond) { then... } else...; exit; -> if (!cond) { else...; exit } then...; Assumes ifInst does not have an else block

if (cond) { } else { ... } -> if (!cond) { ... }

if (cond) { if (nestedCond) { nestedThen... } } -> if (cond && nestedCond) { nestedThen... }

if (cond) { lateBlock... } else { earlyBlock... } -> if (!cond) { earlyBlock... } else { lateBlock... }

Compares the current block exit, and the exit of ifInst.ThenInst and inverts if necessary to pick the better exit Does nothing when ifInst has an else block (because inverting wouldn't affect the block exit)

Compares two exit instructions for block exit priority A higher priority exit should be kept as the last instruction in a block even if it prevents the merging of a two compatible lower priority exits leave from try containers must always be the final instruction, or a goto will be inserted loops will endeavour to leave at least one continue branch as the last instruction in the block The priority is: leave > branch > other-keyword > continue > return > break non-keyword leave instructions are ordered with the outer container having higher priority if the exits have equal priority, and the strongly flag is not provided then the exits are sorted by IL order (target block for branches) break has higher priority than other keywords in a switch block (for aesthetic reasons)

{-1, 0, 1} if exit1 has {lower, equal, higher} priority an exit2

Determines if an exit instruction has a corresponding keyword and thus doesn't strictly need merging Branches can be 'continue' or goto (non-keyword) Leave can be 'return', 'break' or a pinned container exit (try/using/lock etc) All other instructions (throw, using, etc) are returned as Keyword.Other

Determine if the specified instruction necessarily exits (EndPointUnreachable) and if so return last (or single) exit instruction

Gets the final instruction from a block (or a single instruction) assuming that all blocks or instructions in this position have unreachable endpoints

Returns true if inst is Nop or a Block with no instructions.

Import some pattern matching from HighLevelLoopTransform to guess the continue block of loop containers. Used to identify branches targetting this block as continue statements, for ordering priority.

Removes a subrange of instructions from a block and returns them in a new Block

This transform 'optimizes' the control flow logic in the IL code: it replaces constructs that are generated by the C# compiler in debug mode with shorter constructs that are more straightforward to analyze.

The transformations performed are: * 'nop' instructions are removed * branches that lead to other branches are replaced with branches that directly jump to the destination * branches that lead to a 'return block' are replaced with a return instruction * basic blocks are combined where possible

Returns true if the last two instructions before the branch are storing the value 'true' into an unused variable.

IL uses 'pinned locals' to prevent the GC from moving objects. C#:


            fixed (int* s = &arr[index]) { use(s); use(s); }

Gets translated into IL:


            pinned local P : System.Int32&
            
            stloc(P, ldelema(arr, index))
            call use(conv ref->i(ldloc P))
            call use(conv ref->i(ldloc P))
            stloc(P, conv i4->u(ldc.i4 0))

In C#, the only way to pin something is to use a fixed block (or to mess around with GCHandles). But fixed blocks are scoped, so we need to detect the region affected by the pin. To ensure we'll be able to collect all blocks in that region, we perform this transform early, before building any other control flow constructs that aren't as critical for correctness. This means this transform must run before LoopDetection. To make our detection job easier, we must run after variable inlining.

Ensures that every write to a pinned local is followed by a branch instruction. This ensures the 'pinning region' does not involve any half blocks, which makes it easier to extract.

After a pinned region was detected; process its body; replacing the pin variable with a native pointer as far as possible.

Modifies a pinned region to eliminate an extra local variable that roslyn tends to generate.

Detect suitable exit points for BlockContainers. An "exit point" is an instruction that causes control flow to leave the container (a branch or leave instruction). If an "exit point" instruction is placed immediately following a block container, each equivalent exit point within the container can be replaced with a "leave container" instruction. This transform performs this replacement: any exit points equivalent to the exit point following the container are replaced with a leave instruction. Additionally, if the container is not yet followed by an exit point, but has room to introduce such an exit point (i.e. iff the container's end point is currently unreachable), we pick one of the non-return exit points within the container, move it to the position following the container, and replace all instances within the container with a leave instruction. This makes it easier for the following transforms to construct control flow that falls out of blocks instead of using goto/break statements.

Gets the next instruction after is executed. Returns NoExit when the next instruction cannot be identified; returns null when the end of a Block is reached (so that we could insert an arbitrary instruction)

Returns true iff exit1 and exit2 are both exit instructions (branch or leave) and both represent the same exit.

The instruction that will be executed next after leaving the Container. ExitNotYetDetermined means the container is last in its parent block, and thus does not yet have any leave instructions. This means we can move any exit instruction of our choice our of the container and replace it with a leave instruction.

If currentExit==ExitNotYetDetermined, holds the list of potential exit instructions. After the currentContainer was visited completely, one of these will be selected as exit instruction.

Detect loops in IL AST.

Transform ordering: * LoopDetection should run before other control flow structures are detected. * Blocks should be basic blocks (not extended basic blocks) so that the natural loops don't include more instructions than strictly necessary. * Loop detection should run after the 'return block' is duplicated (ControlFlowSimplification).

Block container corresponding to the current cfg.

Enabled during DetectSwitchBody, used by ExtendLoop and children

Used when isSwitch == true, to determine appropriate exit points within loops

Check whether 'block' is a loop head; and construct a loop instruction (nested BlockContainer) if it is.

For each block in the input loop that is the head of a nested loop or switch, include all blocks from the nested container into the loop. This ensures that all blocks that were included into inner loops are also included into the outer loop, thus keeping our loops well-nested.

More details for why this is necessary are here: https://github.com/icsharpcode/ILSpy/issues/915 Pre+Post-Condition: node.Visited iff loop.Contains(node)

Given a natural loop, add additional CFG nodes to the loop in order to reduce the number of exit points out of the loop. We do this because C# only allows reaching a single exit point (with 'break' statements or when the loop condition evaluates to false), so we'd have to introduce 'goto' statements for any additional exit points.

Definition: A "reachable exit" is a branch/leave target that is reachable from the loop, but not dominated by the loop head. A reachable exit may or may not have a corresponding CFG node (depending on whether it is a block in the current block container). -> reachable exits are leaving the code region dominated by the loop Definition: A loop "exit point" is a CFG node that is not itself part of the loop, but has at least one predecessor which is part of the loop. -> exit points are leaving the loop itself Nodes can only be added to the loop if they are dominated by the loop head. When adding a node to the loop, we must also add all of that node's predecessors to the loop. (this ensures that the loop keeps its single entry point) Goal: If possible, find a set of nodes that can be added to the loop so that there remains only a single exit point. Add as little code as possible to the loop to reach this goal. This means we need to partition the set of nodes dominated by the loop entry point into two sets (in-loop and out-of-loop). Constraints: * the loop head itself is in-loop * there must not be any edge from an out-of-loop node to an in-loop node -> all predecessors of in-loop nodes are also in-loop -> all nodes in a cycle are part of the same partition Optimize: * use only a single exit point if at all possible * minimize the amount of code in the in-loop partition (thus: maximize the amount of code in the out-of-loop partition) Observations: * If a node is in-loop, so are all its ancestors in the dominator tree (up to the loop entry point) * If there are no exits reachable from a node (i.e. all paths from that node lead to a return/throw instruction), it is valid to put the group of nodes dominated by that node into either partition independently of any other nodes except for the ancestors in the dominator tree. (exception: the loop head itself must always be in-loop) There are two different cases we need to consider: 1) There are no exits reachable at all from the loop head. -> it is possible to create a loop with zero exit points by adding all nodes dominated by the loop to the loop. -> the only way to exit the loop is by "return;" or "throw;" 2) There are some exits reachable from the loop head. In case 1, we can pick a single exit point freely by picking any node that has no reachable exits (other than the loop head). All nodes dominated by the exit point are out-of-loop, all other nodes are in-loop. See PickExitPoint() for the heuristic that picks the exit point in this case. In case 2, we need to pick our exit point so that all paths from the loop head to the reachable exits run through that exit point. This is a form of postdominance where the reachable exits are considered exit nodes, while "return;" or "throw;" instructions are not considered exit nodes. Using this form of postdominance, we are looking for an exit point that post-dominates all nodes in the natural loop. --> a common ancestor in post-dominator tree. To minimize the amount of code in-loop, we pick the lowest common ancestor. All nodes dominated by the exit point are out-of-loop, all other nodes are in-loop. (using normal dominance as in case 1, not post-dominance!) If it is impossible to use a single exit point for the loop, the lowest common ancestor will be the fake "exit node" used by the post-dominance analysis. In this case, we fall back to the old heuristic algorithm. Requires and maintains the invariant that a node is marked as visited iff it is contained in the loop.

Special control flow node (not part of any graph) that signifies that we want to construct a loop without any exit point.

Finds a suitable single exit point for the specified loop.

1) If a suitable exit point was found: the control flow block that should be reached when breaking from the loop 2) If the loop should not have any exit point (extend by all dominated blocks): NoExitPoint 3) otherwise (exit point unknown, heuristically extend loop): null This method must not write to the Visited flags on the CFG.

Validates an exit point. An exit point is invalid iff there is a node reachable from the exit point that is dominated by the loop head, but not by the exit point. (i.e. this method returns false iff the exit point's dominance frontier contains a node dominated by the loop head. but we implement this the slow way because we don't have dominance frontiers precomputed)

We need this because it's possible that there's a return block (thus reverse-unreachable node ignored by post-dominance) that is reachable both directly from the loop, and from the exit point.

Extension of ControlFlowGraph.HasReachableExit Uses loopContext.GetBreakTargets().Any() when analyzing switches to avoid classifying continue blocks as reachable exits.

Returns the children in a loop dominator tree, with an optional exit point Avoids returning continue statements when analysing switches (because increment blocks can be dominated)

Pick exit point by picking any node that has no reachable exits. In the common case where the code was compiled with a compiler that emits IL code in source order (like the C# compiler), we can find the "real" exit point by simply picking the block with the highest IL offset. So let's do that instead of maximizing amount of code.

Code amount in and its dominated nodes. This method must not write to the Visited flags on the CFG.

Constructs a new control flow graph. Each node cfg[i] has a corresponding node rev[i]. Edges are only created for nodes dominated by loopHead, and are in reverse from their direction in the primary CFG. An artificial exit node is used for edges that leave the set of nodes dominated by loopHead, or that leave the block Container.

Entry point of the loop. out: The number of different CFG nodes. Possible values: 0 = no CFG nodes used as exit nodes (although edges leaving the block container might still be exits); 1 = a single CFG node (not dominated by loopHead) was used as an exit node; 2 = more than one CFG node (not dominated by loopHead) was used as an exit node.

This function implements a heuristic algorithm that tries to reduce the number of exit points. It is only used as fall-back when it is impossible to use a single exit point.

This heuristic loop extension algorithm traverses the loop head's dominator tree in pre-order. For each candidate node, we detect whether adding it to the loop reduces the number of exit points. If it does, the candidate is added to the loop. Adding a node to the loop has two effects on the the number of exit points: * exit points that were added to the loop are no longer exit points, thus reducing the total number of exit points * successors of the newly added nodes might be new, additional exit points Requires and maintains the invariant that a node is marked as visited iff it is contained in the loop.

Gets whether 'node' is an exit point for the loop marked by the Visited flag.

Move the blocks associated with the loop into a new block container.

C# switch statements are not necessarily compiled into IL switch instructions. For example, when the label values are not contiguous, the C# compiler will generate if statements similar to a binary search. This class analyses such sequences of if statements to reconstruct the original switch.

This analysis expects to be run on basic blocks (not extended basic blocks).

The variable that is used to represent the switch expression. null while analyzing the first block.

The variable to be used as the argument of the switch instruction.

Whether at least one of the analyzed blocks contained an IL switch constructors.

Gets the sections that were detected by the previous AnalyzeBlock() call.

Used to de-duplicate sections with a branch instruction. Invariant: (Sections[targetBlockToSectionIndex[branch.TargetBlock]].Instruction as Branch).TargetBlock == branch.TargetBlock

Used to de-duplicate sections with a value-less leave instruction. Invariant: (Sections[targetBlockToSectionIndex[leave.TargetContainer]].Instruction as Leave).TargetContainer == leave.TargetContainer

Blocks that can be deleted if the tail of the initial block is replaced with a switch instruction.

Gets/sets whether to allow unreachable cases in switch instructions.

Analyze the last two statements in the block and see if they can be turned into a switch instruction.

true if the block could be analyzed successfully; false otherwise

Analyzes the tail end (last two instructions) of a block.

Sets switchVar and defaultInstruction if they are null, and adds found sections to sectionLabels and sectionInstructions. If the function returns false, sectionLabels and sectionInstructions are unmodified. The block to analyze. The possible values of the "interesting" variable when control flow reaches this block. If true, analyze only the tail (last two instructions). If false, analyze the whole block.

Adds a new section to the Sections list. If the instruction is a branch instruction, unify the new section with an existing section that also branches to the same target.

Analyzes the boolean condition, returning the set of values of the interesting variable for which the condition evaluates to true.

Create the LongSet that contains a value x iff x compared with value is true.

C# switch statements are not necessarily compiled into IL switch instructions (e.g. when the integer values are non-contiguous). Detect sequences of conditional branches that all test a single integer value, and simplify them into a ILAst switch instruction (which like C# does not require contiguous values).

When detecting a switch, it is important to distinguish Branch instructions which will eventually decompile to continue; statements. A LoopContext is constructed for a node and its dominator tree, as for a Branch to be a continue; statement, it must be contained within the target-loop This class also supplies the depth of the loop targetted by a continue; statement relative to the context node, to avoid (or eventually support) labelled continues to outer loops

Lists all potential targets for break; statements from a domination tree, assuming the domination tree must be exited via either break; or continue; First list all nodes in the dominator tree (excluding continue nodes) Then return the all successors not contained within said tree. Note that node will be returned once for each outgoing edge. Labelled continue statements (depth > 1) are counted as break targets

Tests whether we should prefer a switch statement over an if statement.

stloc switchValueVar(call ComputeStringHash(switchValue))

Builds the control flow graph for the current container (if necessary), establishes loopContext and returns the ControlFlowNodes corresponding to the inner flow and case blocks of the potential switch

Determines if the analysed switch can be constructed without any gotos

Does some of the analysis of SwitchOnNullableTransform to add the null case control flow to the results of SwitchAnalysis

Pattern matching for short circuit expressions p |\ | n |/ \ s c where p: if (a) goto n; goto s; n: if (b) goto c; goto s; Can simplify to p|n / \ s c where: p|n: if (a && b) goto c; goto s; Note that if n has only 1 successor, but is still a flow node, then a short circuit expression has a target (c) with no corresponding block (leave)

A node with 2 successors The successor index to consider n (the other successor will be the common sibling)

A flow node contains only two instructions, the first of which is an IfInstruction A short circuit expression is comprised of a root block ending in an IfInstruction and one or more flow nodes

Determines whether the flowNodes are can be reduced to a single condition via short circuit operators

Get index of deconstruction result or tuple element Returns -1 on failure.

stloc v(value) expr(..., deconstruct { ... }, ...) => expr(..., deconstruct { init: stloc v(value) ... }, ...)

C# cannot represent `isinst T` directly for value-types. This transform un-inlines the argument of `isinst` instructions that can't be directly translated to C#, thus allowing the emulation via "expr is T ? (T)expr : null".

Transform for the C# 8 System.Index / System.Range feature

Called by expression transforms. Handles the `array[System.Index]` cases.

Check that the number of uses of the containerLengthVar variable matches those expected in the pattern.

Matches 'addressof System.Index(call get_Start/get_End(ldloca rangeVar))'

Gets whether the C# compiler will call `container[int]` when using `container[Index]`.

Matches the instruction: stloc containerLengthVar(call get_Length/get_Count(ldloc containerVar))

If lengthVar is non-null, matches 'ldloc lengthVar'. Otherwise, matches the instruction: call get_Length/get_Count(ldloc containerVar)

indexLoad is an integer, from the start of the container

indexLoad is loading the address of a System.Index struct

indexLoad is an integer, from the end of the container

Always equivalent to `0`, used for the start-index when slicing without a startpoint `a[..end]`

Always equivalent to `^0`, used for the end-index when slicing without an endpoint `a[start..]`

Matches an instruction computing an offset: call System.Index.GetOffset(indexLoad, ldloc containerLengthVar) or binary.sub.i4(ldloc containerLengthVar, indexLoad) Anything else not matching these patterns is interpreted as an `int` expression from the start of the container.

Matches an instruction computing a slice length: binary.sub.i4(call GetOffset(endIndexLoad, ldloc length), ldloc startOffset))

Implements transforming <PrivateImplementationDetails>.ThrowIfNull(name, "name");

Block { ... stloc V(isinst T(testedOperand)) if (comp.o(ldloc V == ldnull)) br falseBlock br trueBlock } All other uses of V are in blocks dominated by trueBlock. => Block { ... if (match.type[T].notnull(V = testedOperand)) br trueBlock br falseBlock } - or - Block { stloc s(isinst T(testedOperand)) stloc v(ldloc s) if (logic.not(comp.o(ldloc s != ldnull))) br falseBlock br trueBlock } => Block { ... if (match.type[T].notnull(V = testedOperand)) br trueBlock br falseBlock } All other uses of V are in blocks dominated by trueBlock. Block { ... [stloc temp(ldloc testedOperand)] if (comp.o(isinst T(ldloc testedOperand) == ldnull)) br falseBlock br unboxBlock } Block unboxBlock (incoming: 1) { stloc V(unbox.any T(ldloc temp)) ... } => Block { ... if (match.type[T].notnull(V = testedOperand)) br unboxBlock br falseBlock } ... if (comp.o(isinst T(ldloc testedOperand) == ldnull)) br falseBlock br unboxBlock - or - ... if (comp.o(isinst T(box ``0(ldloc testedOperand)) == ldnull)) br falseBlock br unboxBlock Block unboxBlock (incoming: 1) { stloc V(unbox.any T(ldloc testedOperand)) ... - or - stloc V(unbox.any T(isinst T(box ``0(ldloc testedOperand)))) ... }

Block IL_0018 (incoming: *) { stloc s(ldc.i4 1) br IL_0019 } Block IL_0019 (incoming: > 1) { if (logic.not(ldloc s)) br IL_0027 br IL_001d } replace br IL_0019 with br IL_0027

Context object for the ILInstruction.Extract() operation.

Nearest function, used for registering the new locals that are created by extraction.

Combined flags of all instructions being moved.

List of actions to be executed when performing the extraction. Each function in this list has the side-effect of replacing the instruction-to-be-moved with a load of a fresh temporary variable; and returns the the store to the temporary variable, which will be inserted at block-level.

Currently, predecessor is evaluated before the instructions being moved. If this function returns true, predecessor can stay as-is, despite the move changing the evaluation order. If this function returns false, predecessor will need to also move, to ensure the evaluation order stays unchanged.

Extracts the specified instruction: The instruction is replaced with a load of a new temporary variable; and the instruction is moved to a store to said variable at block-level. May return null if extraction is not possible.

stloc V_1(dynamic.isevent (target)) if (logic.not(ldloc V_1)) Block IL_004a { stloc V_2(dynamic.getmember B(target)) } [stloc copyOfValue(value)] if (logic.not(ldloc V_1)) Block IL_0149 { dynamic.setmember.compound B(target, dynamic.binary.operator AddAssign(ldloc V_2, value)) } else Block IL_0151 { dynamic.invokemember.invokespecial.discard add_B(target, value) } => if (logic.not(dynamic.isevent (target))) Block IL_0149 { dynamic.setmember.compound B(target, dynamic.binary.operator AddAssign(dynamic.getmember B(target), value)) } else Block IL_0151 { dynamic.invokemember.invokespecial.discard add_B(target, value) }

if (logic.not(ldloc V_1)) Block IL_0149 { dynamic.setmember.compound B(target, dynamic.binary.operator AddAssign(ldloc V_2, value)) } else Block IL_0151 { dynamic.invokemember.invokespecial.discard add_B(target, value) }

if (logic.not(ldloc V_1)) Block IL_004a { stloc V_2(dynamic.getmember B(target)) }

Decompiler step for C# 7.0 local functions

Used to store all synthesized call-site arguments grouped by the parameter index. We use a dictionary instead of a simple array, because -1 is used for the this parameter and there might be many non-synthesized arguments in between.

The transform works like this: local functions can either be used in method calls, i.e., call and callvirt instructions, or can be used as part of the "delegate construction" pattern, i.e., newobj Delegate(<target-expression>, ldftn <method>). As local functions can be declared practically anywhere, we have to take a look at all use-sites and infer the declaration location from that. Use-sites can be call, callvirt and ldftn instructions. After all use-sites are collected we construct the ILAst of the local function and add it to the parent function. Then all use-sites of the local-function are transformed to a call to the LocalFunctionMethod or a ldftn of the LocalFunctionMethod. In a next step we handle all nested local functions. After all local functions are transformed, we move all local functions that capture any variables to their respective declaration scope.

Newer Roslyn versions use the format "<callerName>g__functionName|x_y" Older versions use "<callerName>g__functionNamex_y"

Transforms closure fields to local variables. This is a post-processing step of , and . In general we can perform SROA (scalar replacement of aggregates) on any variable that satisfies the following conditions: 1) It is initialized by an empty/default constructor call. 2) The variable is never passed to another method. 3) The variable is never the target of an invocation. Note that 2) and 3) apply because declarations and uses of lambdas and local functions are already transformed by the time this transform is applied.

Resolves references to variables that can be propagated. If a value does not match either LdLoc or a LdObj LdLdFlda* LdLoc chain, null is returned. The if any of the variables/fields in the chain cannot be propagated, null is returned.

mcs likes to optimize closures in yield state machines away by moving the captured variables' fields into the state machine type, We construct a that spans the whole method body.

if (call op_False(ldloc lhsVar)) ldloc lhsVar else call op_BitwiseAnd(ldloc lhsVar, rhsInst) -> user.logic op_BitwiseAnd(ldloc lhsVar, rhsInst) or if (call op_True(ldloc lhsVar)) ldloc lhsVar else call op_BitwiseOr(ldloc lhsVar, rhsInst) -> user.logic op_BitwiseOr(ldloc lhsVar, rhsInst)

Transforms the "callsite initialization pattern" into DynamicInstructions.

If possible, transforms plain ILAst loops into while (condition), do-while and for-loops. For the invariants of the transforms .

Matches a do-while loop and performs the following transformations: - combine all compatible conditions into one IfInstruction. - extract conditions into a condition block, or move the existing condition block to the end.

Returns a list of all IfInstructions that can be used as loop conditon, i.e., that have no false-instruction and have leave loop (if swapped) or branch entry-point as true-instruction.

Returns true if the instruction is stloc v(add(ldloc v, arg)) or compound.assign(ldloca v, arg)

Gets whether the statement is 'simple' (usable as for loop iterator): Currently we only accept calls and assignments.

Introduce a named argument for 'arg' and evaluate it before the other arguments (except for the "this" pointer)

Transform that converts code patterns like "v != null ? v.M() : null" to "v?.M()"

reference type or generic type (comparison is 'comp(ldloc(testedVar) == null)')

nullable type, used by value (comparison is 'call get_HasValue(ldloca(testedVar))')

nullable type, used by reference (comparison is 'call get_HasValue(ldloc(testedVar))')

unconstrained generic type (see the pattern described in TransformNullPropagationOnUnconstrainedGenericExpression)

Check if "condition ? trueInst : falseInst" can be simplified using the null-conditional operator. Returns the replacement instruction, or null if no replacement is possible.

testedVar != null ? nonNullInst : nullInst

if (x != null) x.AccessChain(); => x?.AccessChain();

This transform duplicates return blocks if they return a local variable that was assigned right before the return.

Determines a list of all store instructions that write to a given . Returns false if any of these instructions does not meet the following criteria: - must be a stloc - must be a direct child of a block - must be the penultimate instruction - must be followed by a branch instruction to - must have a BlockContainer as ancestor. Returns true, if all instructions meet these criteria, and contains a list of 3-tuples. Each tuple consists of the target block container, the leave block, and the branch instruction that should be modified.

Detects switch-on-nullable patterns employed by the C# compiler and transforms them to an ILAst-switch-instruction.

Matches legacy C# switch on nullable.

Matches Roslyn C# switch on nullable.

Detects switch-on-string patterns employed by the C# compiler and transforms them to an ILAst-switch-instruction.

Each case consists of two blocks: 1. block: if (call op_Equality(ldloc switchVariable, ldstr value)) br caseBlock br nextBlock -or- if (comp(ldloc switchValueVar == ldnull)) br nextBlock br caseBlock 2. block is caseBlock This method matches the above pattern or its inverted form: the call to ==(string, string) is wrapped in logic.not and the branch targets are reversed. Returns the next block that follows in the block-chain. The is updated if the value gets copied to a different variable. See comments below for more info.

Matches the C# 2.0 switch-on-string pattern, which uses Dictionary<string, int>.

Matches 'volatile.ldobj dictionaryType(ldsflda dictField)'

Matches and extracts values from Add-call sequences.

call Add(ldloc dictVar, ldstr value, ldc.i4 index) -or- call Add(ldloc dictVar, ldstr value, box System.Int32(ldc.i4 index))

Matches: Block oldDefaultBlock (incoming: 1) { if (comp.o(ldloc switchVar == ldnull)) br nullValueCaseBlock br newDefaultBlock }

Matches (and the negated version): if (call op_Equality(ldloc switchValueVar, stringValue)) br body br exit

Block target(incoming: 1) { if (comp.o(ldloc switchValueVar == ldnull)) br exit br lengthCheckBlock } Block lengthCheckBlock(incoming: 1) { if (logic.not(call get_Length(ldloc switchValueVar))) br body br exit }

call get_Length(ldloc switchValueVar)

Matches 'stloc(targetVar, call ComputeStringHash(ldloc switchValue))'

Matches 'call string.op_Equality(ldloc(variable), ldstr stringValue)' or 'comp(ldloc(variable) == ldnull)' or 'call SequenceEqual(ldloc variable, call AsSpan(ldstr stringValue))'

Converts LINQ Expression Trees to ILFunctions/ILAst instructions. We build a tree of Func{ILInstruction}s, which are only executed, if the whole transform succeeds.

Returns true if the instruction matches the pattern for Expression.Lambda calls.

Converts a Expression.Lambda call into an ILFunction. If the conversion fails, null is returned.

stloc obj(resourceExpression) .try BlockContainer { Block IL_0003(incoming: 1) { call WriteLine(ldstr "using (null)") leave IL_0003(nop) } } finally BlockContainer { Block IL_0012(incoming: 1) { if (comp(ldloc obj != ldnull)) Block IL_001a { callvirt Dispose(ldnull) } leave IL_0012(nop) } } leave IL_0000(nop) => using (resourceExpression) { BlockContainer { Block IL_0003(incoming: 1) { call WriteLine(ldstr "using (null)") leave IL_0003(nop) } } }

.try BlockContainer { Block IL_0003(incoming: 1) { stloc obj(resourceExpression) call WriteLine(ldstr "using (null)") leave IL_0003(nop) } } finally BlockContainer { Block IL_0012(incoming: 1) { if (comp(ldloc obj != ldnull)) Block IL_001a { callvirt Dispose(ldnull) } leave IL_0012(nop) } } leave IL_0000(nop) => using (resourceExpression) { BlockContainer { Block IL_0003(incoming: 1) { call WriteLine(ldstr "using (null)") leave IL_0003(nop) } } }

finally BlockContainer { Block IL_0012(incoming: 1) { if (comp(ldloc obj != ldnull)) Block IL_001a { callvirt Dispose(obj) } leave IL_0012(nop) } }

stloc test(resourceExpression) .try BlockContainer { Block IL_002b (incoming: 1) { call Use(ldloc test) leave IL_002b (nop) } } finally BlockContainer { Block IL_0045 (incoming: 1) { if (comp.o(ldloc test == ldnull)) leave IL_0045 (nop) br IL_00ae } Block IL_00ae (incoming: 1) { await(addressof System.Threading.Tasks.ValueTask(callvirt DisposeAsync(ldloc test))) leave IL_0045 (nop) } }

Must be in sync with .

catch E_189 : 0200007C System.Exception when (BlockContainer { Block IL_0079 (incoming: 1) { stloc S_30(ldloc E_189) br IL_0085 } Block IL_0085 (incoming: 1) { stloc I_1(ldloc S_30) where S_30 and I_1 are single definition => copy-propagate E_189 to replace all uses of S_30 and I_1

Block entryPoint (incoming: 1) { stloc temp(isinst exceptionType(ldloc exceptionVar)) if (comp(ldloc temp != ldnull)) br whenConditionBlock br falseBlock }

Block falseBlock (incoming: 1) { stloc returnVar(ldc.i4 0) br exitBlock }

Block exitBlock(incoming: 2) { leave container(ldloc returnVar) }

stloc lockObj(lockExpression) call Enter(ldloc lockObj) .try BlockContainer { Block lockBlock (incoming: 1) { call WriteLine() leave lockBlock (nop) } } finally BlockContainer { Block exitBlock (incoming: 1) { call Exit(ldloc lockObj) leave exitBlock (nop) } } => .lock (lockExpression) BlockContainer { Block lockBlock (incoming: 1) { call WriteLine() leave lockBlock (nop) } }

stloc lockObj(ldloc tempVar) call Enter(ldloc tempVar) .try BlockContainer { Block lockBlock(incoming: 1) { call WriteLine() leave lockBlock (nop) } } finally BlockContainer { Block exitBlock(incoming: 1) { call Exit(ldloc lockObj) leave exitBlock (nop) } } => .lock (lockObj) BlockContainer { Block lockBlock (incoming: 1) { call WriteLine() leave lockBlock (nop) } }

stloc flag(ldc.i4 0) .try BlockContainer { Block lockBlock (incoming: 1) { call Enter(stloc obj(lockObj), ldloca flag) call WriteLine() leave lockBlock (nop) } } finally BlockContainer { Block (incoming: 1) { if (ldloc flag) Block { call Exit(ldloc obj) } leave lockBlock (nop) } } => .lock (lockObj) BlockContainer { Block lockBlock (incoming: 1) { call WriteLine() leave lockBlock (nop) } }

stloc flag(ldc.i4 0) .try BlockContainer { Block lockBlock (incoming: 1) { stloc obj1(stloc obj2(lockObj)) call Enter(ldloc obj2, ldloca flag) call WriteLine() leave lockBlock (nop) } } finally BlockContainer { Block (incoming: 1) { if (ldloc flag) Block { call Exit(ldloc obj1) } leave lockBlock (nop) } } => .lock (lockObj) BlockContainer { Block lockBlock (incoming: 1) { call WriteLine() leave lockBlock (nop) } }

stloc obj(lockObj) stloc flag(ldc.i4 0) .try BlockContainer { Block lockBlock (incoming: 1) { call Enter(ldloc obj, ldloca flag) call WriteLine() leave lockBlock (nop) } } finally BlockContainer { Block (incoming: 1) { if (ldloc flag) Block { call Exit(ldloc obj) } leave lockBlock (nop) } } => .lock (lockObj) BlockContainer { Block lockBlock (incoming: 1) { call WriteLine() leave lockBlock (nop) } }

Nullable lifting gets run in two places: * the usual form looks at an if-else, and runs within the ExpressionTransforms. * the NullableLiftingBlockTransform handles the cases where Roslyn generates two 'ret' statements for the null/non-null cases of a lifted operator. The transform handles the following languages constructs: * lifted conversions * lifted unary and binary operators * lifted comparisons * the ?? operator with type Nullable{T} on the left-hand-side * the ?. operator (via NullPropagationTransform)

Main entry point into the normal code path of this transform. Called by expression transform.

VS2017.8 / Roslyn 2.9 started optimizing some cases of "a.GetValueOrDefault() == b.GetValueOrDefault() && (a.HasValue & b.HasValue)" to "(a.GetValueOrDefault() == b.GetValueOrDefault()) & (a.HasValue & b.HasValue)" so this secondary entry point analyses logic.and as-if it was a short-circuiting &&.

Main entry point for lifting; called by both the expression-transform and the block transform.

Represents either non-lifted IL `Comp` or a call to one of the (non-lifted) 6 comparison operators on `System.Decimal`.

Lift a C# comparison. This method cannot be used for (in)equality comparisons where both sides are nullable (these special cases are handled in LiftCSharpEqualityComparison instead). The output instructions should evaluate to false when any of the nullableVars is null (except for newComparisonKind==Inequality, where this case should evaluate to true instead). Otherwise, the output instruction should evaluate to the same value as the input instruction. The output instruction should have the same side-effects (incl. exceptions being thrown) as the input instruction. This means unlike LiftNormal(), we cannot rely on the input instruction not being evaluated if a variable is null.

Performs nullable lifting. Produces a lifted instruction with semantics equivalent to: (v1 != null && ... && vn != null) ? trueInst : falseInst, where the v1,...,vn are the this.nullableVars. If lifting fails, returns null.

Recursive function that lifts the specified instruction. The input instruction is expected to a subexpression of the trueInst (so that all nullableVars are guaranteed non-null within this expression). Creates a new lifted instruction without modifying the input instruction. On success, returns (new lifted instruction, bitset). If lifting fails, returns (null, null). The returned bitset specifies which nullableVars were considered "relevant" for this instruction. bitSet[i] == true means nullableVars[i] was relevant. The new lifted instruction will have equivalent semantics to the input instruction if all relevant variables are non-null [except that the result will be wrapped in a Nullable{T} struct]. If any relevant variable is null, the new instruction is guaranteed to evaluate to null without having any other effect.

Matches 'call get_HasValue(arg)'

Matches 'call get_HasValue(ldloca v)'

Matches 'logic.not(call get_HasValue(ldloca v))'

Matches 'newobj Nullable{underlyingType}.ctor(arg)'

Matches 'call Nullable{T}.GetValueOrDefault(arg)'

Matches 'call Nullable{T}.GetValueOrDefault(ldloca v)'

Transform for constructing the NullCoalescingInstruction (if.notnull(a,b), or in C#: ??) Note that this transform only handles the case where a,b are reference types. The ?? operator for nullable value types is handled by NullableLiftingTransform.

Handles NullCoalescingInstruction case 1: reference types.

stloc v(value) if (logic.not(call get_HasValue(ldloca v))) throw(...) ... Call(arg1, arg2, call GetValueOrDefault(ldloca v), arg4) ... => ... Call(arg1, arg2, if.notnull(value, throw(...)), arg4) ...

IL transform that runs on a sequence of statements within a block.

Interleaving different statement-combining transforms on a per-statement level improves detection of nested constructs. For example, array initializers can assume that each element assignment was already reduced to a single statement, even if the element contains a high-level construct detected by a different transform (e.g. object initializer).

Runs the transform on the statements within a block. Note: the transform may only modify block.Instructions[pos..]. The transform will be called repeatedly for pos=block.Instructions.Count-1, pos=block.Instructions.Count-2, ..., pos=0.

The current block. The starting position where the transform is allowed to work. Additional parameters. Instructions prior to block.Instructions[pos] must not be modified. It is valid to read such instructions, but not recommended as those have not been transformed yet. This function is only called on control-flow blocks with unreachable end-point. Thus, the last instruction in the block always must have the EndPointUnreachable flag. ==> Instructions with reachable end can't be last. Some transforms use this to save some bounds checks.

Parameter class holding various arguments for .

Gets the block on which the transform is running.

After the current statement transform has completed, do not continue with the next statement transform at the same position. Instead, re-run all statement transforms (including the current transform) starting at the specified position.

After the current statement transform has completed, repeat all statement transforms on the current position.

Block transform that runs a list of statement transforms.

Transforms collection and object initialization patterns.

Per-block IL transform.

Runs the transform on the specified block. Note: the transform may only modify the specified block and its descendants, as well as any sibling blocks that are dominated by the specified block.

Parameter class holding various arguments for .

The block to process.

Should be identical to the block parameter to IBlockTransform.Run.

The control flow node corresponding to the block being processed.

Identical to ControlFlowGraph.GetNode(Block). Note: the control flow graph is not up-to-date, but was created at the start of the block transforms (before loop detection).

Gets the control flow graph. Note: the control flow graph is not up-to-date, but was created at the start of the block transforms (before loop detection).

Initially equal to Block.Instructions.Count indicating that nothing has been transformed yet. Set by when another already transformed block is merged into the current block. Subsequent s must update this value, for example, by resetting it to Block.Instructions.Count. will use this value to skip already transformed instructions.

IL transform that runs a list of per-block transforms.

Walks the dominator tree rooted at entryNode, calling the transforms on each block.

if (comp(ldsfld CachedAnonMethodDelegate == ldnull)) { stsfld CachedAnonMethodDelegate(DelegateConstruction) } ... one usage of CachedAnonMethodDelegate ... => ... one usage of DelegateConstruction ...

if (comp(ldloc v == ldnull)) { stloc v(DelegateConstruction) } => stloc v(DelegateConstruction)

stloc s(ldobj(ldsflda(CachedAnonMethodDelegate)) if (comp(ldloc s == null)) { stloc s(stobj(ldsflda(CachedAnonMethodDelegate), DelegateConstruction)) } => stloc s(DelegateConstruction)

stloc s(ldobj(ldflda(CachedAnonMethodDelegate)) if (comp(ldloc s == null)) { stloc s(stobj(ldflda(CachedAnonMethodDelegate), DelegateConstruction)) } => stloc s(DelegateConstruction)

if (comp.i4(comp.o(ldobj delegateType(ldsflda CachedAnonMethodDelegate) != ldnull) == ldc.i4 0)) Block { stloc s(stobj(ldflda(CachedAnonMethodDelegate), DelegateConstruction)) } else Block { stloc s(ldobj System.Action(ldsflda $I4-1)) } => stloc s(DelegateConstruction)

if (comp.o(ldsfld CachedAnonMethodDelegate != ldnull)) { leave IL_0005 (ldsfld CachedAnonMethodDelegate) } leave IL_0005 (stsfld CachedAnonMethodDelegate(DelegateConstruction)) => leave IL_0005 (DelegateConstruction)

if (comp.o(ldobj delegateType(ldflda CachedAnonMethodDelegate(ldloc closure)) != ldnull)) Block { stloc s(ldobj delegateType(ldflda CachedAnonMethodDelegate(ldloc closure))) } else Block { stloc s(stobj delegateType(ldflda CachedAnonMethodDelegate(ldloc closure), DelegateConstruction)) } => stloc s(DelegateConstruction)

Runs a very simple form of copy propagation. Copy propagation is used in two cases: 1) assignments from arguments to local variables If the target variable is assigned to only once (so always is that argument) and the argument is never changed (no ldarga/starg), then we can replace the variable with the argument. 2) assignments of address-loading instructions to local variables

Per-function IL transform.

Parameter class holding various arguments for .

Creates a new ILReader instance for decompiling another method in the same assembly.

Call this method immediately before performing a transform step. Unlike context.Stepper.Step(), calls to this method are only compiled in debug builds.

Performs inlining transformations.

Inlines instructions before pos into block.Instructions[pos].

The number of instructions that were inlined.

Aggressively inlines the stloc instruction at block.Body[pos] into the next instruction, if possible.

Inlines the stloc instruction at block.Instructions[pos] into the next instruction, if possible.

Inlines the stloc instruction at block.Instructions[pos] into the next instruction. Note that this method does not check whether 'v' has only one use; the caller is expected to validate whether inlining 'v' has any effects on other uses of 'v'.

Inlines 'expr' into 'next', if possible. Note that this method does not check whether 'v' has only one use; the caller is expected to validate whether inlining 'v' has any effects on other uses of 'v'.

Is this a temporary variable generated by the C# compiler for instance method calls on value type values

The load instruction (a descendant within 'next') The variable being inlined.

Gets whether the instruction, when converted into C#, turns into an l-value that can be used to mutate a value-type. If this function returns false, the C# compiler would introduce a temporary copy when calling a method on a value-type (and any mutations performed by the method will be lost)

Determines whether a variable should be inlined in non-aggressive mode, even though it is not a generated variable.

The next top-level expression The variable being eliminated by inlining. The expression being inlined

Gets whether 'expressionBeingMoved' can be inlined into 'expr'.

Found a load; inlining is possible.

Load not found and re-ordering not possible. Stop the search.

Load not found, but the expressionBeingMoved can be re-ordered with regards to the tested expression, so we may continue searching for the matching load.

Found a load in call, but re-ordering not possible with regards to the other call arguments. Inlining is not possible, but we might convert the call to named arguments. Only used with .

Found a deconstruction. Only used with .

Finds the position to inline to.

true = found; false = cannot continue search; null = not found

Determines whether it is safe to move 'expressionBeingMoved' past 'expr'

Finds the first call instruction within the instructions that were inlined into inst.

Gets whether 'expressionBeingMoved' can be moved from somewhere before 'stmt' to become the replacement of 'targetLoad'.

Gets whether arg can be un-inlined out of stmt.

Collection of transforms that detect simple expression patterns (e.g. 'cgt.un(..., ld.null)') and replace them with different instructions.

Should run after inlining so that the expression patterns can be detected.

newobj Delegate..ctor(target, ldvirtftn TargetMethod(target)) => ldvirtdelegate System.Delegate TargetMethod(target)

newobj Span..ctor(localloc(conv i4->u <zero extend>(ldc.i4 sizeInBytes)), numberOfElementsExpr) => localloc.span T(numberOfElementsExpr) -or- newobj Span..ctor(Block IL_0000 (StackAllocInitializer) { stloc I_0(localloc(conv i4->u<zero extend>(ldc.i4 sizeInBytes))) ... final: ldloc I_0 }, numberOfElementsExpr) => Block IL_0000 (StackAllocInitializer) { stloc I_0(localloc.span T(numberOfElementsExpr)) ... final: ldloc I_0 }

op is either add or remove/subtract: if (dynamic.isevent (target)) { dynamic.invokemember.invokespecial.discard op_Name(target, value) } else { dynamic.compound.op (dynamic.getmember Name(target), value) } => dynamic.compound.op (dynamic.getmember Name(target), value)

dynamic.setmember.compound Name(target, dynamic.binary.operator op(dynamic.getmember Name(target), value)) => dynamic.compound.op (dynamic.getmember Name(target), value)

dynamic.setindex.compound(target, index, dynamic.binary.operator op(dynamic.getindex(target, index), value)) => dynamic.compound.op (dynamic.getindex(target, index), value)

catch ex : TException when (...) BlockContainer { Block entryPoint (incoming: 1) { stloc v(ldloc ex) ... } } => catch v : TException when (...) BlockContainer { Block entryPoint (incoming: 1) { ... } }

Inline condition from catch-when condition BlockContainer, if possible.

Transforms anonymous methods and lambdas by creating nested ILFunctions.

Replaces loads of 'this' with the target expression. Async delegates use: ldobj(ldloca this).

Remove HasInitialValue from locals that are definitely assigned before every use (=the initial value is a dead store). In yield return generators, additionally removes dead 'V = null;' assignments. Additionally infers IType of stack slots that have StackType.Ref

Live range splitting for IL variables.

Address is immediately used for reading and/or writing, without the possibility of the variable being directly stored to (via 'stloc') in between the 'ldloca' and the use of the address.

We support some limited form of ref locals referring to a target variable, without giving up splitting of the target variable. Requirements: * the ref local is single-assignment * the ref local is initialized directly with 'ldloca target; stloc ref_local', not a derived pointer (e.g. 'ldloca target; ldflda F; stloc ref_local'). * all uses of the ref_local are immediate. There may be stores to the target variable in between the 'stloc ref_local' and its uses, but we handle that case by treating each use of the ref_local as an address access of the target variable (as if the ref_local was eliminated via copy propagation).

Given 'ldloc ref_local' and 'ldloca target; stloc ref_local', returns the ldloca. This function must return a non-null LdLoca for every use of a SupportedRefLocal.

Use the union-find structure to merge

Instructions in a group are stores to the same variable that must stay together (cannot be split).

For each uninitialized variable, one representative instruction that potentially observes the unintialized value of the variable. Used to merge together all such loads of the same uninitialized value.

Gets the new variable for a LdLoc, StLoc or TryCatchHandler instruction.

Exception thrown when an IL transform runs into the .

Helper class that manages recording transform steps.

Gets whether stepping of built-in transforms is supported in this build of ICSharpCode.Decompiler. Usually only debug builds support transform stepping.

BeginStep is inclusive.

EndStep is exclusive.

Call this method immediately before performing a transform step. Used for debugging the IL transforms. Has no effect in release mode. May throw in debug mode.

Transforms array initialization pattern of System.Runtime.CompilerServices.RuntimeHelpers.InitializeArray. For collection and object initializers see

Handle simple case where RuntimeHelpers.InitializeArray is not used.

call InitializeArray(newarr T(size), ldmembertoken fieldToken) => Block (ArrayInitializer) { stloc i(newarr T(size)) stobj T(ldelema T(... indices ...), value) final: ldloc i }

Constructs compound assignments and inline assignments.

This is a statement transform; but some portions are executed as an expression transform instead (with HandleCompoundAssign() as entry point)


            stloc s(value)
            stloc l(ldloc s)
            stobj(..., ldloc s)
              where ... is pure and does not use s or l,
              and where neither the 'stloc s' nor the 'stobj' truncates
            -->
            stloc l(stobj (..., value))

e.g. used for inline assignment to instance field -or-


            stloc s(value)
            stobj (..., ldloc s)
              where ... is pure and does not use s, and where the 'stobj' does not truncate
            -->
            stloc s(stobj (..., value))

e.g. used for inline assignment to static field -or-


            stloc s(value)
            call set_Property(..., ldloc s)
              where the '...' arguments are pure and not using 's'
            -->
            stloc s(Block InlineAssign { call set_Property(..., stloc i(value)); final: ldloc i })
              new temporary 'i' has type of the property; transform only valid if 'stloc i' doesn't truncate

Transform compound assignments where the return value is not being used, or where there's an inlined assignment within the setter call. Patterns handled: 1. callvirt set_Property(ldloc S_1, binary.op(callvirt get_Property(ldloc S_1), value)) ==> compound.op.new(callvirt get_Property(ldloc S_1), value) 2. callvirt set_Property(ldloc S_1, stloc v(binary.op(callvirt get_Property(ldloc S_1), value))) ==> stloc v(compound.op.new(callvirt get_Property(ldloc S_1), value)) 3. stobj(target, binary.op(ldobj(target), ...)) where target is pure => compound.op(target, ...)

Called by ExpressionTransforms, or after the inline-assignment transform for setters.


            stloc s(value)
            stloc l(ldloc s)
              where neither 'stloc s' nor 'stloc l' truncates the value
            -->
            stloc s(stloc l(value))

The value is not implicitly truncated.

The value is implicitly truncated.

The value is implicitly truncated, but the sign of the target type can be changed to remove the truncation.

Gets whether 'stobj type(..., value)' would evaluate to a different value than 'value' due to implicit truncation.

Gets whether 'inst' is a possible store for use as a compound store.

Output parameters: storeType: The type of the value being stored. value: The value being stored (will be analyzed further to detect compound assignments) Every IsCompoundStore() call should be followed by an IsMatchingCompoundLoad() call.

Checks whether 'load' and 'store' both access the same store, and can be combined to a compound assignment.

The load instruction to test. The compound store to test against. Must have previously been tested via IsCompoundStore() The target to use for the compound assignment instruction. The target kind to use for the compound assignment instruction. If set to a non-null value, call this delegate to fix up minor mismatches between getter and setter. If given a non-null value, this function returns false if the forbiddenVariable is used in the load/store instructions. Some transforms effectively move a store around, which is only valid if the variable stored to does not occur in the compound load/store. Instruction preceding the load.


            stobj(target, binary.add(stloc l(ldobj(target)), ldc.i4 1))
              where target is pure and does not use 'l', and the 'stloc l' does not truncate
            -->
            stloc l(compound.op.old(ldobj(target), ldc.i4 1))
            
             -or-
            
            call set_Prop(args..., binary.add(stloc l(call get_Prop(args...)), ldc.i4 1))
              where args.. are pure and do not use 'l', and the 'stloc l' does not truncate
            -->
            stloc l(compound.op.old(call get_Prop(target), ldc.i4 1))

This pattern is used for post-increment by legacy csc. Even though this transform operates only on a single expression, it's not an expression transform as the result value of the expression changes (this is OK only for statements in a block).


            stloc tmp(ldobj(target))
            stobj(target, binary.op(ldloc tmp, ldc.i4 1))
              target is pure and does not use 'tmp', 'stloc does not truncate'
            -->
            stloc tmp(compound.op.old(ldobj(target), ldc.i4 1))

This is usually followed by inlining or eliminating 'tmp'. Local variables use a similar pattern, also detected by this function:


            stloc tmp(ldloc target)
            stloc target(binary.op(ldloc tmp, ldc.i4 1))
            -->
            stloc tmp(compound.op.old(ldloca target, ldc.i4 1))

This pattern occurs with legacy csc for static fields, and with Roslyn for most post-increments.

Deconstruction statement

Represents a deconstructed value

ILAst representation of C# patterns

Checks whether the input instruction can represent a pattern matching operation. Any pattern matching instruction will first evaluate the `testedOperand` (a descendant of `inst`), and then match the value of that operand against the pattern encoded in the instruction. The matching may have side-effects on the newly-initialized pattern variables (even if the pattern fails to match!). The pattern matching instruction evaluates to 1 (as I4) if the pattern matches, or 0 otherwise.

Returns the method operand.

Improves code quality by duplicating keyword exits to reduce nesting and restoring IL order.

ConditionDetection and DetectSwitchBody both have aggressive inlining policies for else blocks and default cases respectively. This can lead to excessive indentation when the entire rest of the method/loop is included in the else block/default case. When an If/SwitchInstruction is followed immediately by a keyword exit, the exit can be moved into the child blocks allowing the else block or default case to be moved after the if/switch as all prior cases exit. Most importantly, this transformation does not change the IL order of any code. ConditionDetection also has a block exit priority system to assist exit point reduction which in some cases ignores IL order. After HighLevelLoopTransform has run, all structures have been detected and preference can be returned to maintaining IL ordering.

Visits a block in context

Marks the target block of continue statements. The instruction following the end point of the block. Can only be null if the end point is unreachable.

For an if statement with an unreachable end point and no else block, inverts to match IL order of the first statement of each branch

Reduce Nesting in if/else statements by duplicating an exit instruction. Does not affect IL order

Reduce Nesting in switch statements by replacing break; in cases with the block exit, and extracting the default case Does not affect IL order

Checks if an exit is a duplicable keyword exit (return; break; continue;)

Ensures the end point of a block is unreachable by duplicating and appending the [exit] instruction following the end point

The instruction/block of interest The next instruction to be executed (provided inst does not exit)

Removes a redundant block exit instruction.

Determines if an IfInstruction is an else-if and returns the preceeding (parent) IfInstruction [else-]if (parent-cond) else { ifInst }

Adds a code path to the current heuristic tally

Recursively computes the number of statements and maximum nested depth of an instruction

Heuristic to determine whether it is worth duplicating exits into the preceeding sibling blocks (then/else-if/case) in order to reduce the nesting of inst by 1

The instruction heading the nested candidate block The number of statements in the largest sibling block The relative depth of the most nested statement in the sibling blocks

if (cond) { ...; exit; } else { ... } ...; -> if (cond) { ...; exit; } ...; ...;

Instruction representing a dynamic call site.

ILAst representation of a cast inside a dynamic expression (maps to Binder.Convert).

Returns the type operand.

ILAst representation of a method call inside a dynamic expression (maps to Binder.InvokeMember).

ILAst representation of a property get method call inside a dynamic expression (maps to Binder.GetMember).

ILAst representation of a property set method call inside a dynamic expression (maps to Binder.SetMember).

ILAst representation of an indexer get method call inside a dynamic expression (maps to Binder.GetIndex).

ILAst representation of an indexer set method call inside a dynamic expression (maps to Binder.SetIndex).

ILAst representation of a constuctor invocation inside a dynamic expression (maps to Binder.InvokeConstructor).

ILAst representation of a binary operator inside a dynamic expression (maps to Binder.BinaryOperation).

ILAst representation of a short-circuiting binary operator inside a dynamic expression.

ILAst representation of a unary operator inside a dynamic expression (maps to Binder.UnaryOperation).

ILAst representation of a delegate invocation inside a dynamic expression (maps to Binder.Invoke).

ILAst representation of a call to the Binder.IsEvent method inside a dynamic expression.

Analyses the RHS of a 'ptr + int' or 'ptr - int' operation.

Given an instruction that computes a pointer arithmetic offset in bytes, returns an instruction that computes the same offset in number of elements. Returns null if no such instruction can be found.

Input instruction. The target type of the pointer type. Whether the pointer arithmetic operation checks for overflow. Whether to allow zero extensions in the mul argument.

Returns true if inst computes the address of a fixed variable; false if it computes the address of a moveable variable. (see "Fixed and moveable variables" in the C# specification)

Sugar for logic.not/and/or.

Sugar for ldfld/stfld.

Show IL ranges in ILAst output.

Show the child index of the instruction in ILAst output.

Load address of instance field

Returns the field operand.

Indirect store (store to ref/pointer). Evaluates to the value that was stored (when using type byte/short: evaluates to the truncated value, sign/zero extended back to I4 based on type.GetSign())

For a store to a field or array element, C# will only throw NullReferenceException/IndexOfBoundsException after the value-to-be-stored has been computed. This means a LdFlda/LdElema used as target for StObj must have DelayExceptions==true to allow a translation to C# without changing the program semantics. See https://github.com/icsharpcode/ILSpy/issues/2050

called as part of CheckInvariant()

Returns the type operand.

Gets/Sets whether the memory access is volatile.

Returns the alignment specified by the 'unaligned' prefix; or 0 if there was no 'unaligned' prefix.

For a nullable input, gets the underlying value. There are three possible input types: * reference type: if input!=null, evaluates to the input * nullable value type: if input.Has_Value, evaluates to input.GetValueOrDefault() * generic type: behavior depends on the type at runtime. If non-nullable value type, unconditionally evaluates to the input. If the input is null, control-flow is tranferred to the nearest surrounding nullable.rewrap instruction.

The input operand must be one of: 1. a nullable value type 2. a reference type 3. a managed reference to a type parameter. If the input is non-null, evaluates to the (unwrapped) input. If the input is null, jumps to the innermost nullable.rewrap instruction that contains this instruction. In case 3 (managed reference), the dereferenced value is the input being tested, and the nullable.unwrap instruction returns the managed reference unmodified (if the value is non-null).

Whether the argument is dereferenced before checking for a null input. If true, the argument must be a managed reference to a valid input type.

This mode exists because the C# compiler sometimes avoids copying the whole Nullable{T} struct before the null-check. The underlying struct T is still copied by the GetValueOrDefault() call, but only in the non-null case.

Consider the following code generated for t?.Method() on a generic t:

if (comp(box ``0(ldloc t) != ldnull)) newobj Nullable..ctor(constrained[``0].callvirt Method(ldloca t)) else default.value Nullable

Here, the method is called on the original reference, and any mutations performed by the method will be visible in the original variable. To represent this, we use a nullable.unwrap with ResultType==Ref: instead of returning the input value, the input reference is returned in the non-null case. Note that in case the generic type ends up being Nullable{T}, this means methods will end up being called on the nullable type, not on the underlying type. However, this ends up making no difference, because the only methods that can be called that way are those on System.Object. All the virtual methods are overridden in Nullable{T} and end up forwarding to T; and the non-virtual methods cause boxing which strips the Nullable{T} wrapper. RefOutput can only be used if RefInput is also used.

Serves as jump target for the nullable.unwrap instruction. If the input evaluates normally, evaluates to the input value (wrapped in Nullable<T> if the input is a non-nullable value type).If a nullable.unwrap instruction encounters a null input and jumps to the (endpoint of the) nullable.rewrap instruction,the nullable.rewrap instruction evaluates to null.

Stores a value into a local variable. (IL: starg/stloc) Evaluates to the value that was stored (for byte/short variables: evaluates to the truncated value, sign/zero extended back to I4 based on variable.Type.GetSign())

If true, this stloc represents a stack type adjustment. This field is only used in ILReader and BlockBuilder, and should be ignored by ILAst transforms.

Gets whether the IL stack was empty after this store. Only set for store instructions from the IL; not for stores to the stack or other stores generated by transforms.

Unsafe function pointer call.

Returns the default value for a type.

Gets whether the IL stack was empty at the point of this instruction. (not counting the argument of the instruction itself)

Returns the type operand.

ILAst representation of Expression.Convert.

Returns the type operand.

Infer ref readonly type from usage: An ILVariable should be marked as readonly, if it's a "by-ref-like" type and the initialized value is known to be readonly.

Maps a string value to an integer. This is used in switch(string).

IL using instruction. Equivalent to:


            stloc v(resourceExpression)
            try {
               body
            } finally {
               v?.Dispose();
            }

The value of v is undefined after the end of the body block.

Using statement

Matches an 'ldflda' instruction accessing a tuple element. E.g. matches: ldflda Item1(ldflda Rest(target))

Matches 'newobj TupleType(...)'. Takes care of flattening long tuples.

C# await operator.

The collection of variables in a ILFunction.

Gets a variable given its IndexInFunction.

Remove variables that have StoreCount == LoadCount == AddressCount == 0.

Lock statement

Kind of null-coalescing operator. ILAst: if.notnull(valueInst, fallbackInst) C#: value ?? fallback

Both ValueInst and FallbackInst are of reference type. Semantics: equivalent to "valueInst != null ? valueInst : fallbackInst", except that valueInst is evaluated only once.

Both ValueInst and FallbackInst are of type Nullable{T}. Semantics: equivalent to "valueInst.HasValue ? valueInst : fallbackInst", except that valueInst is evaluated only once.

ValueInst is Nullable{T}, but FallbackInst is non-nullable value type. Semantics: equivalent to "valueInst.HasValue ? valueInst.Value : fallbackInst", except that valueInst is evaluated only once.

Null coalescing operator expression. if.notnull(valueInst, fallbackInst)

Three valued logic and. Inputs are of type bool? or I4, output is of type bool?. Unlike logic.and(), does not have short-circuiting behavior.

Three valued logic or. Inputs are of type bool? or I4, output is of type bool?. Unlike logic.or(), does not have short-circuiting behavior.

Use of user-defined && or || operator.

Returns the method operand.

Base class for pattern matching in ILAst.

Matches any node

Data holder for a single list matching operation.

Notes on backtracking: PerformMatch() may save backtracking-savepoints to the ListMatch instance. Each backtracking-savepoints is a Stack{int} with instructions of how to restore the saved state. When a savepoint is created by a PerformMatch() call, that call may be nested in several other PerformMatch() calls that operate on the same list. When leaving those calls (whether with a successful match or not), the outer PerformMatch() calls may push additional state onto all of the added backtracking-savepoints. When the overall list match fails but savepoints exists, the most recently added savepoint is restored by calling PerformMatch() with listMatch.restoreStack set to that savepoint. Each PerformMatch() call must pop its state from that stack before recursively calling its child patterns.

The main list matching logic.

Returns whether the list match was successful. If the method returns true, it adds the capture groups (if any) to the match. If the method returns false, the match object remains in a partially-updated state and needs to be restored before it can be reused.

PerformMatch() for a sequence of patterns.

List of patterns to match. Stores state about the current list match. The match object, used to store global state during the match (such as the results of capture groups). Returns whether all patterns were matched successfully against a part of the list. If the method returns true, it updates listMatch.SyntaxIndex to point to the next node that was not part of the match, and adds the capture groups (if any) to the match. If the method returns false, the listMatch and match objects remain in a partially-updated state and need to be restored before they can be reused.

A savepoint that the list matching operation can be restored from.

The syntax list we are matching against.

The current index in the syntax list.

Restores the listmatch state from a savepoint.

Returns whether a savepoint exists

Data holder for the overall pattern matching operation.

This type is a struct in order to prevent unnecessary memory allocations during pattern matching. The default value default(Match) represents an unsuccessful match.

Gets whether the match was successful.

Gets whether the match failed.

Enum representing the type of an .

Represents invalid IL. Semantically, this instruction is considered to throw some kind of exception.

Represents invalid IL. Semantically, this instruction is considered to produce some kind of value.

No operation. Takes 0 arguments and returns void.

A container of IL blocks.

A block of IL instructions.

A region where a pinned variable is used (initial representation of future fixed statement).

Common instruction for add, sub, mul, div, rem, bit.and, bit.or, bit.xor, shl and shr.

Common instruction for numeric compound assignments.

Common instruction for user-defined compound assignments.

Common instruction for dynamic compound assignments.

Bitwise NOT

Retrieves the RuntimeArgumentHandle.

Unconditional branch. goto target;

Unconditional branch to end of block container. Return is represented using IsLeavingFunction and an (optional) return value. The block container evaluates to the value produced by the argument of the leave instruction.

If statement / conditional expression. if (condition) trueExpr else falseExpr

Null coalescing operator expression. if.notnull(valueInst, fallbackInst)

Switch statement

Switch section within a switch statement

Try-catch statement.

Catch handler within a try-catch statement.

Try-finally statement

Try-fault statement

Lock statement

Using statement

Breakpoint instruction

Comparison. The inputs must be both integers; or both floats; or both object references. Object references can only be compared for equality or inequality. Floating-point comparisons evaluate to 0 (false) when an input is NaN, except for 'NaN != NaN' which evaluates to 1 (true).

Non-virtual method call.

Virtual method call.

Unsafe function pointer call.

Checks that the input float is not NaN or infinite.

Numeric cast.

Loads the value of a local variable. (ldarg/ldloc)

Loads the address of a local variable. (ldarga/ldloca)

Stores the value into an anonymous temporary variable, and returns the address of that variable.

Three valued logic and. Inputs are of type bool? or I4, output is of type bool?. Unlike logic.and(), does not have short-circuiting behavior.

Three valued logic or. Inputs are of type bool? or I4, output is of type bool?. Unlike logic.or(), does not have short-circuiting behavior.

Loads a constant string.

Loads a constant byte string (as ReadOnlySpan<byte>).

Loads a constant 32-bit integer.

Loads a constant 64-bit integer.

Loads a constant 32-bit floating-point number.

Loads a constant 64-bit floating-point number.

Loads a constant decimal.

Loads the null reference.

Load method pointer

Virtual delegate construction

Loads runtime representation of metadata token

Allocates space in the stack frame

Allocates space in the stack frame and wraps it in a Span

memcpy(destAddress, sourceAddress, size);

memset(address, value, size)

Load address of instance field

Load static field address

Casts an object to a class.

Test if object is instance of class or interface.

Indirect load (ref/pointer dereference).

Indirect store (store to ref/pointer). Evaluates to the value that was stored (when using type byte/short: evaluates to the truncated value, sign/zero extended back to I4 based on type.GetSign())

Boxes a value.

Compute address inside box.

Unbox a value.

Creates an object instance and calls the constructor.

Creates an array instance.

Returns the default value for a type.

Throws an exception.

Rethrows the current exception.

Gets the size of a type in bytes.

Returns the length of an array as 'native unsigned int'.

Load address of array element.

Retrieves a pinnable reference for the input object. The input must be an object reference (O). If the input is an array/string, evaluates to a reference to the first element/character, or to a null reference if the array is null or empty. Otherwise, uses the GetPinnableReference method to get the reference, or evaluates to a null reference if the input is null.