VS2017 crashes when parsing C# Span code

[yaakov-h]

Version Used:

Microsoft Visual Studio Enterprise 2017
Version 15.6.2

Steps to Reproduce:

1. Create a new Class Library (Classic Desktop) project
2. Add a NuGet package reference to System.Memory (4.5.x pre-release)
3. Modify Class1.cs to contain the following:

using System;

namespace ClassLibrary1
{
    public class Class1
    {
        public void Foo(Thing[] first, Thing[] second)
        {
            var x = first[0];
        }
    }

    public struct Thing { }
}

4. On line 7, change the first Thing[] to Span<Thing>[]

Expected Behavior:

error CS0611: Array elements cannot be of type 'Span<Thing>'

Actual Behavior:

Entire Visual Studio IDE locks up and eventually crashes.

Exception:

System.InvalidOperationException
  HResult=0x80131509
  Message=Unexpected value 'ArrayAccess expression of System.Span<ClassLibrary1.Thing> type' of type 'System.String'
  Source=Microsoft.CodeAnalysis.CSharp
  StackTrace:
   at Microsoft.CodeAnalysis.CSharp.Binder.GetValEscape(BoundExpression expr, UInt32 scopeOfTheContainingExpression)
   at Microsoft.CodeAnalysis.CSharp.Binder.BindVariableDeclaration(SourceLocalSymbol localSymbol, LocalDeclarationKind kind, Boolean isVar, VariableDeclaratorSyntax declarator, TypeSyntax typeSyntax, TypeSymbol declTypeOpt, AliasSymbol aliasOpt, DiagnosticBag diagnostics, CSharpSyntaxNode associatedSyntaxNode)
   at Microsoft.CodeAnalysis.CSharp.Binder.BindDeclarationStatementParts(LocalDeclarationStatementSyntax node, DiagnosticBag diagnostics)
   at Microsoft.CodeAnalysis.CSharp.Binder.BindStatement(StatementSyntax node, DiagnosticBag diagnostics)
   at Microsoft.CodeAnalysis.CSharp.MemberSemanticModel.IncrementalBinder.BindStatement(StatementSyntax node, DiagnosticBag diagnostics)
   at Microsoft.CodeAnalysis.CSharp.CSharpSemanticModel.Bind(Binder binder, CSharpSyntaxNode node, DiagnosticBag diagnostics)
   at Microsoft.CodeAnalysis.CSharp.MethodBodySemanticModel.Bind(Binder binder, CSharpSyntaxNode node, DiagnosticBag diagnostics)
   at Microsoft.CodeAnalysis.CSharp.MemberSemanticModel.GetBoundNodes(CSharpSyntaxNode node)
   at Microsoft.CodeAnalysis.CSharp.MemberSemanticModel.GetLowerBoundNode(CSharpSyntaxNode node)
   at Microsoft.CodeAnalysis.CSharp.MemberSemanticModel.GetBoundNodes(CSharpSyntaxNode node, CSharpSyntaxNode& bindableNode, BoundNode& lowestBoundNode, BoundNode& highestBoundNode, BoundNode& boundParent)
   at Microsoft.CodeAnalysis.CSharp.MemberSemanticModel.GetSymbolInfoWorker(CSharpSyntaxNode node, SymbolInfoOptions options, CancellationToken cancellationToken)
   at Microsoft.CodeAnalysis.CSharp.SyntaxTreeSemanticModel.GetSymbolInfoWorker(CSharpSyntaxNode node, SymbolInfoOptions options, CancellationToken cancellationToken)
   at Microsoft.CodeAnalysis.CSharp.CSharpSemanticModel.GetSymbolInfo(ExpressionSyntax expression, CancellationToken cancellationToken)
   at Microsoft.CodeAnalysis.CSharp.CSharpExtensions.GetSymbolInfo(SemanticModel semanticModel, ExpressionSyntax expression, CancellationToken cancellationToken)
   at Microsoft.CodeAnalysis.CSharp.Classification.Classifiers.NameSyntaxClassifier.ClassifyTypeSyntax(NameSyntax name, SemanticModel semanticModel, ArrayBuilder`1 result, CancellationToken cancellationToken)
   at Microsoft.CodeAnalysis.CSharp.Classification.Classifiers.NameSyntaxClassifier.AddClassifications(SyntaxNode syntax, SemanticModel semanticModel, ArrayBuilder`1 result, CancellationToken cancellationToken)
   at Microsoft.CodeAnalysis.Classification.AbstractSyntaxClassificationService.Worker.ClassifyNode(SyntaxNode syntax)
   at Microsoft.CodeAnalysis.Classification.AbstractSyntaxClassificationService.Worker.ProcessNodes()
   at Microsoft.CodeAnalysis.Classification.AbstractSyntaxClassificationService.Worker.Classify(Workspace workspace, SemanticModel semanticModel, TextSpan textSpan, ArrayBuilder`1 list, Func`2 getNodeClassifiers, Func`2 getTokenClassifiers, CancellationToken cancellationToken)
   at Microsoft.CodeAnalysis.Classification.AbstractSyntaxClassificationService.<AddSemanticClassificationsAsync>d__5.MoveNext()

[svick]

This seems to be very similar to #25398.

[yaakov-h]

Same exception, same function, fairly different stack trace.

Hopefully there aren't too many different ways to trigger the same bug...

[jcouv]

Tagging @VSadov

[svick]

@yaakov-h

Same exception, same function, fairly different stack trace.

Hopefully there aren't too many different ways to trigger the same bug...

The exception happens when a switch encounters expression it doesn't know how to deal with:

roslyn/src/Compilers/CSharp/Portable/Binder/Binder.ValueChecks.cs

Lines 2319 to 2320 in 07c65e2

	default:
	throw ExceptionUtilities.UnexpectedValue($"{expr.Kind} expression of {expr.Type} type");

My guess is that the fix is going to be to add cases for all remaining expression kinds and that should fix all instances of this bug.

[OmarTawfik]

I believe @VSadov fixed this in #25819
I'll add a test and close the issue.