Roslyn incorrectly learns from [NotNullIfNotNull] attributes that mention out parameters

[TessenR]

Version Used:

Branch main (3 Apr 2021)
Latest commit 3a30d52 by CyrusNajmabadi:
Merge pull request #52392 from Youssef1313/add-imports-null-check-code-fix

Import System namespace when adding null check

Steps to Reproduce:

Compile and run the following code:

using System.Diagnostics.CodeAnalysis;

#nullable enable
C.M1(out _).ToString(); // no warnings; runtime crash

class C
{
  [return: NotNullIfNotNull("arg")] public static string? M1(out string? arg) => arg = null;
}

Expected Behavior:
CS8602: Dereference of a possibly null reference. warning for C.M1(out _)

Actual Behavior:
No warnings at all in the program above. The program crashes with NullReferenceException at runtime

Notes
It looks like Roslyn tries to learn the resulting nullability from the argument state of an out parameter e.g. the following code also doesn't have a warning:

string s = "";
C.M1(out s!).ToString();

Obviously it's impossible to introduce a dependency on the out argument state since the compiler won't allow reading it from the annotated method.

This might be confusing since it's not immediately obvious that nullable reference types don't support dependencies between variables so someone could attempt to use this attribute to e.g. introduce a dependency between related out parameters (e.g. if multiple out parameters always have the same nullable state when a method returns)