NativeAOT-LLVM: WIP Merge apr26

.CodeQL.yml

@@ -1,5 +1,5 @@
 # This file configures CodeQL runs and TSA bug autofiling. For more information, see:
-# https://eng.ms/docs/cloud-ai-platform/devdiv/one-engineering-system-1es/1es-docs/codeql/troubleshooting/bugs/generated-library-code
+# https://eng.ms/docs/coreai/devdiv/one-engineering-system-1es/1es-docs/codeql/troubleshooting/bugs/generated-library-code
 # (Access restricted to Microsoft employees only.)
 
 path_classifiers:
@@ -8,9 +8,50 @@ path_classifiers:
     # be excluded from analysis. If there is a problem at the API layer, the analysis
     # engine will detect the problem in the src/ implementations anyway.
     - src/libraries/**/ref/*
+  cmake_internal:
     # exclude artifacts/obj/**/CMakeFiles/**/CheckFunctionExists.c since CMake 
     # generates random directory names causing creation of duplicate issues 
     # related to obsolete encryption algorithm used. Note that CheckFuntionExists 
     # files are generated as part of build-time checks in CMake and are not compiled
     # or linked into any product binaries.
     - artifacts/obj/**/CMakeFiles/**/CheckFunctionExists.c
+
+queries:
+  #
+  # REPO-WIDE RULE EXCLUSIONS
+  #
+  - exclude:
+      queryid:
+        # [Serializable] doesn't imply that a type is *safe* to [de]serialize; only that it is
+        # *possible* to do so. The rules below incorrectly assume we're trying to make a safety
+        # guarantee.
+        - "cs/dangerous-deserialization-routine"
+        - "cs/deserialization-of-pointer-type"
+        # We already have CodeQL + Roslyn rules running to detect usage of dangerous deserialization
+        # APIs. Those call sites are well-reviewed and don't benefit from extra alerts regarding
+        # the possibility of loading malicious code.
+        - "cs/deserialization-unexpected-subtypes"
+  #
+  # Don't warn about usage of non-compliant crypto within our own implementations or interop code,
+  # since the rule would noisily try to warn us about *ourselves*. These exclusions are scoped
+  # to just the crypto code itself. We still want alerts when consumers of crypto (even within this
+  # repo) try to use non-compliant primitives; those call sites must be manually inspected
+  # and suppressed if appropriate.
+  #
+  - exclude:
+      queryid:
+        - "cs/ecb-encryption"
+        - "cs/encryption-with-vulnerable-cipher-mode"
+        - "cs/weak-symmetric-algorithm"
+        - "cs/obsolete-password-key-derivation"
+        - "cs/cryptography/unapproved-usage-of-dsa"
+        - "cs/weak-crypto"
+        - "cs/weak-hmacs"
+        - "java/weak-crypto-algorithm-or-hash"
+      path:
+        - "src/libraries/Common/src/Interop/Windows/BCrypt/**"
+        - "src/libraries/Common/src/System/Security/Cryptography/**"
+        - "src/libraries/Microsoft.Bcl.Cryptography/**"
+        - "src/libraries/System.Security.Cryptography/**"
+        - "src/libraries/System.Security.Cryptography.*/**"
+        - "src/native/libs/System.Security.Cryptography.*/**"

.azuredevops/dependabot.yml

@@ -0,0 +1,5 @@
+version: 2
+
+# Disabling dependabot on Azure DevOps as this is a mirrored repo. Updates should go through github.
+enable-campaigned-updates: false
+enable-security-updates: false

.claude/settings.json

@@ -0,0 +1,13 @@
+{
+  "extraKnownMarketplaces": {
+    "dotnet-arcade-skills": {
+      "source": {
+        "source": "github",
+        "repo": "dotnet/arcade-skills"
+      }
+    }
+  },
+  "enabledPlugins": {
+    "dotnet-dnceng@dotnet-arcade-skills": true
+  }
+}

.config/CredScanSuppressions.json

@@ -1,25 +1,19 @@
 {
-    "tool": "Credential Scanner",
-    "suppressions": [
-        {
-            "_justification": "Suppression approved. Private key for testing purpose.",
-            "file": [
-                "src/libraries/Common/tests/System/Security/Cryptography/AlgorithmImplementations/DSA/DSAKeyPemTests.cs",
-                "src/libraries/Common/tests/System/Security/Cryptography/AlgorithmImplementations/EC/ECKeyPemTests.cs",
-                "src/libraries/Common/tests/System/Security/Cryptography/AlgorithmImplementations/RSA/RSAKeyPemTests.cs",
-                "src/libraries/Common/tests/System/Security/Cryptography/X509Certificates/TestData.cs",
-                "src/tests/FunctionalTests/Android/Device_Emulator/gRPC/grpc-dotnet/testassets/Certs/InteropTests/server1.key"
-            ],
-            "placeholder": [
-                "-----BEGIN PRIVATE KEY-----",
-                "-----BEGIN * PRIVATE KEY-----"
-            ]
-        },
-        {
-            "_justification": "Suppression approved. Private key for testing purpose.",
-            "file": [
-                "src/tests/FunctionalTests/Android/Device_Emulator/gRPC/grpc-dotnet/testassets/Certs/InteropTests/server1.pfx"
-            ]
-        }
-    ]
+  "tool": "Credential Scanner",
+  "suppressions": [
+    {
+      "_justification": "Suppression approved. Private key for testing purpose.",
+      "file": [
+        "src/libraries/Common/tests/System/Security/Cryptography/AlgorithmImplementations/DSA/DSAKeyPemTests.cs",
+        "src/libraries/Common/tests/System/Security/Cryptography/AlgorithmImplementations/EC/ECKeyPemTests.cs",
+        "src/libraries/Common/tests/System/Security/Cryptography/AlgorithmImplementations/RSA/RSAKeyPemTests.cs",
+        "src/libraries/Common/tests/System/Security/Cryptography/X509Certificates/TestData.cs",
+        "src/libraries/System.Security.Cryptography/tests/X509Certificates/X509Certificate2PemTests.cs"
+      ],
+      "placeholder": [
+        "-----BEGIN PRIVATE KEY-----",
+        "-----BEGIN * PRIVATE KEY-----"
+      ]
+    }
+  ]
 }

.config/dotnet-tools.json

@@ -15,7 +15,7 @@
       ]
     },
     "microsoft.dotnet.xharness.cli": {
-      "version": "10.0.0-prerelease.25506.2",
+      "version": "11.0.0-prerelease.26204.1",
       "commands": [
         "xharness"
       ]

.devcontainer/android/devcontainer.json

@@ -55,8 +55,7 @@
 	// This allows developers to just use 'dotnet build' on the command-line, and the local dotnet version will be used.
     // Add the Android SDK tooling and emulator to the path.
 	"remoteEnv": {
-		"PATH": "${containerWorkspaceFolder}/.dotnet:${containerEnv:ANDROID_SDK_ROOT}/cmdline-tools/cmdline-tools/bin:${containerEnv:ANDROID_SDK_ROOT}/emulator:${containerEnv:ANDROID_SDK_ROOT}/platform-tools:${containerEnv:PATH}",
-		"DOTNET_MULTILEVEL_LOOKUP": "0"
+		"PATH": "${containerWorkspaceFolder}/.dotnet:${containerEnv:ANDROID_SDK_ROOT}/cmdline-tools/cmdline-tools/bin:${containerEnv:ANDROID_SDK_ROOT}/emulator:${containerEnv:ANDROID_SDK_ROOT}/platform-tools:${containerEnv:PATH}"
 	},
 
 	// Comment out connect as root instead. More info: https://aka.ms/vscode-remote/containers/non-root.

.devcontainer/devcontainer.json

@@ -14,7 +14,9 @@
 	},
 
 	"features": {
-		"ghcr.io/devcontainers/features/github-cli:1": {}
+		"ghcr.io/devcontainers/features/github-cli:1": {},
+		"ghcr.io/devcontainers/features/sshd:1": {},
+		"ghcr.io/devcontainers/features/copilot-cli:1": {}
 	},
 
 	// Configure tool-specific properties.
@@ -40,8 +42,7 @@
 	// Add the locally installed dotnet to the path to ensure that it is activated
 	// This allows developers to just use 'dotnet build' on the command-line, and the local dotnet version will be used.
 	"remoteEnv": {
-		"PATH": "${containerWorkspaceFolder}/.dotnet:${containerEnv:PATH}",
-		"DOTNET_MULTILEVEL_LOOKUP": "0"
+		"PATH": "${containerWorkspaceFolder}/.dotnet:${containerEnv:PATH}"
 	},
 
 	// Comment out connect as root instead. More info: https://aka.ms/vscode-remote/containers/non-root.

.devcontainer/libraries/devcontainer.json

@@ -46,8 +46,7 @@
 	// Add the locally installed dotnet to the path to ensure that it is activated
 	// This allows developers to just use 'dotnet build' on the command-line, and the local dotnet version will be used.
 	"remoteEnv": {
-		"PATH": "${containerWorkspaceFolder}/.dotnet:${containerEnv:PATH}",
-		"DOTNET_MULTILEVEL_LOOKUP": "0"
+		"PATH": "${containerWorkspaceFolder}/.dotnet:${containerEnv:PATH}"
 	},
 
 	// Comment out connect as root instead. More info: https://aka.ms/vscode-remote/containers/non-root.

.devcontainer/wasm-multiThreaded/devcontainer.json

@@ -47,8 +47,7 @@
 	// This allows developers to just use 'dotnet build' on the command-line, and the local dotnet version will be used.
 	// Add the global tools dir to the PATH so that globally installed tools will work
 	"remoteEnv": {
-		"PATH": "${containerWorkspaceFolder}/.dotnet:${containerWorkspaceFolder}/.dotnet-tools-global:${containerEnv:PATH}",
-		"DOTNET_MULTILEVEL_LOOKUP": "0",
+		"PATH": "${containerWorkspaceFolder}/.dotnet:${containerWorkspaceFolder}/.dotnet-tools-global:${containerEnv:PATH}"
 	},
 
 	// Comment out connect as root instead. More info: https://aka.ms/vscode-remote/containers/non-root.
@@ -58,7 +57,7 @@
 	"forwardPorts": [8000],
 	"portsAttributes": {
 		"8000": {
-			"label": "mono wasm samples (8000)",
+			"label": "mono wasm samples (8000)"
 		}
 	}
 }

.devcontainer/wasm/devcontainer.json

@@ -47,8 +47,7 @@
 	// This allows developers to just use 'dotnet build' on the command-line, and the local dotnet version will be used.
 	// Add the global tools dir to the PATH so that globally installed tools will work
 	"remoteEnv": {
-		"PATH": "${containerWorkspaceFolder}/.dotnet:${containerWorkspaceFolder}/.dotnet-tools-global:${containerEnv:PATH}",
-		"DOTNET_MULTILEVEL_LOOKUP": "0",
+		"PATH": "${containerWorkspaceFolder}/.dotnet:${containerWorkspaceFolder}/.dotnet-tools-global:${containerEnv:PATH}"
 	},
 
 	// Comment out connect as root instead. More info: https://aka.ms/vscode-remote/containers/non-root.
@@ -58,7 +57,7 @@
 	"forwardPorts": [8000],
 	"portsAttributes": {
 		"8000": {
-			"label": "mono wasm samples (8000)",
+			"label": "mono wasm samples (8000)"
 		}
 	}
 }

.editorconfig

@@ -132,6 +132,12 @@ csharp_style_prefer_index_operator = false:none
 csharp_style_prefer_range_operator = false:none
 csharp_style_pattern_local_over_anonymous_function = false:none
 
+# IDE0071: Simplify interpolation - keep as silent hint since ReadOnlySpan<char>.ToString() is required for netstandard targets
+dotnet_diagnostic.IDE0071.severity = silent
+
+# IDE0031: Use null propagation - keep as silent hint to avoid build errors with TreatWarningsAsErrors
+dotnet_diagnostic.IDE0031.severity = silent
+
 # Space preferences
 csharp_space_after_cast = false
 csharp_space_after_colon_in_inheritance_clause = true
@@ -140,7 +146,7 @@ csharp_space_after_dot = false
 csharp_space_after_keywords_in_control_flow_statements = true
 csharp_space_after_semicolon_in_for_statement = true
 csharp_space_around_binary_operators = before_and_after
-csharp_space_around_declaration_statements = do_not_ignore
+csharp_space_around_declaration_statements = false
 csharp_space_before_colon_in_inheritance_clause = true
 csharp_space_before_comma = false
 csharp_space_before_dot = false
@@ -159,6 +165,10 @@ csharp_space_between_square_brackets = false
 # License header
 file_header_template = Licensed to the .NET Foundation under one or more agreements.\nThe .NET Foundation licenses this file to you under the MIT license.
 
+# xUnit1051: recommends TestContext.Current.CancellationToken (v3 pattern) which
+# is not yet adopted; suppress until a full v3 migration is performed.
+dotnet_diagnostic.xUnit1051.severity = none
+
 [src/libraries/System.Net.Http/src/System/Net/Http/{SocketsHttpHandler/Http3RequestStream.cs,BrowserHttpHandler/BrowserHttpHandler.cs}]
 # disable CA2025, the analyzer throws a NullReferenceException when processing this file: https://github.com/dotnet/roslyn-analyzers/issues/7652
 dotnet_diagnostic.CA2025.severity = none

.git-blame-ignore-revs

@@ -0,0 +1,75 @@
+# Licensed to the .NET Foundation under one or more agreements.
+# The .NET Foundation licenses this file to you under the MIT license.
+
+# This file is consumed by GitHub by default and the git-blame command
+# optionally to make blames ignore uninteresting commits. See docs here:
+# https://docs.github.com/en/repositories/working-with-files/using-files/viewing-and-understanding-files#ignore-commits-in-the-blame-view
+# To configure git-blame to use this file, run:
+#   git config blame.ignoreRevsFile .git-blame-ignore-revs
+
+# These are the commits that trim gc.cpp copies to contain only
+# the functions relevant to each split file. They should be ignored
+# when running git blame.
+
+# region_allocator.cpp
+d49754129145a19ad7aa5a69122e58d09375f4ac
+
+# region_free_list.cpp
+83fa3f4a0493c9c57f44c7cb6e77bb5dfb05ea91
+
+# finalization.cpp
+2ab9d88c8dd2431fc7a09527dd4adb24848a4ece
+
+# interface.cpp
+b91cb52f3b3f23cdb45ac7234a7cab974cbed9af
+
+# allocation.cpp
+d682279be75df3debe5413c5fed486cfdabc3534
+
+# mark_phase.cpp
+6fbf6a2dd6b5c701119368c08276a3ba552b6683
+
+# plan_phase.cpp
+1b46271bd978040090987df603c062a715f0af65
+
+# relocate_compact.cpp
+35d6f5a8e0323294d7b9ff4bea3c4213a3db2ccb
+
+# sweep.cpp
+43fc659bc9145cab1a4a73aae73ac853bc330256
+
+# background.cpp
+81e8f3b4f28894173c6cd3a3a76c4e7f856e8a66
+
+# regions_segments.cpp
+ba70358a247a319a5e2895fde84b2579172f3d2b
+
+# card_table.cpp
+42f56409dc3c7f2443d28230e3e17c50df9d5629
+
+# memory.cpp
+7aa69f096ff5b56e3669b0fe344b85b04426a52e
+
+# diagnostics.cpp
+7932b9d8847f277d1fdfe0375a71c35c0a6969f3
+
+# dynamic_tuning.cpp
+cdc50607148e41906aafb60e2aeb6aa392d1a249
+
+# no_gc.cpp
+2f4ec5f3f7ec88320804b5cabfb8fce5088b4dbd
+
+# dynamic_heap_count.cpp
+b22c2d115c34e36fa5711caae405e8ee1292d167
+
+# init.cpp
+29123fc5becb2b883b9a335392bf8f1fa709b3e9
+
+# collect.cpp
+b5a1146dcfd341e93178530625503dd4fdff5126
+
+# gc.cpp - trim to core infrastructure
+b3e810d361b0652e4caa9476b88cb66f4ed1eed2
+
+# Prepare: rename gc.cpp to gc_full.cpp
+2fdb93ffc36e8c55b713b017e566deae4438938b

.gitattributes

@@ -81,3 +81,6 @@ src/tests/JIT/Performance/CodeQuality/BenchmarksGame/reverse-complement/revcomp-
 src/tests/JIT/Performance/CodeQuality/BenchmarksGame/k-nucleotide/knucleotide-input.txt text eol=lf
 src/tests/JIT/Performance/CodeQuality/BenchmarksGame/k-nucleotide/knucleotide-input-big.txt text eol=lf
 src/mono/browser/runtime/dotnet.d.ts text eol=lf
+src/native/libs/Common/JavaScript/loader/dotnet.d.ts text eol=lf
+
+.github/workflows/*.lock.yml linguist-generated=true merge=ours

.github/CODEOWNERS-stop-notifications

@@ -98,12 +98,7 @@
 /eng/pipelines/**/*wasm* @akoeplinger
 
 # ILLink codeowners
-/src/tools/illink/ @marek-safar
-/src/tools/illink/src/analyzer/ @radekdoulik
-/src/tools/illink/src/ILLink.Tasks/ @sbomer
-/src/tools/illink/src/ILLink.RoslynAnalyzer/ @sbomer
-/src/tools/illink/src/linker/ @marek-safar @mrvoorhe
-/src/tools/illink/test/ @marek-safar @mrvoorhe
+/src/tools/illink/ @sbomer
 
 # Obsoletions / Custom Diagnostics
 

.github/PULL_REQUEST_TEMPLATE/copilot_coding_agent_pull_request_template.md

@@ -0,0 +1 @@
+<!-- -->