.NET 11 regression: AutoDispatch marshals an unrelated COM object into a typed managed array #134581

// Licensed to the .NET Foundation under one or more agreements.
// The .NET Foundation licenses this file to you under the MIT license.

using System;
using System.Runtime.InteropServices;

[assembly: ComVisible(true)]

internal static unsafe class Program
{
    private const ushort VT_UNKNOWN = 13;
    private const ushort VT_ARRAY = 0x2000;
    private const ushort DispatchMethod = 1;

    private static int Main()
    {
        Console.WriteLine(RuntimeInformation.FrameworkDescription);
        if (!OperatingSystem.IsWindows())
        {
            Console.WriteLine("Requires Windows built-in COM interop.");
            return 2;
        }

        // A SAFEARRAY holding the COM view of a class that has nothing to do with Expected.
        var unrelated = new Unrelated();
        nint unrelatedUnknown = Marshal.GetIUnknownForObject(unrelated);
        SafeArray* array = SafeArrayCreateVector(VT_UNKNOWN, 0, 1);
        if (array is null)
        {
            Console.WriteLine("SafeArrayCreateVector failed.");
            Marshal.Release(unrelatedUnknown);
            return 2;
        }

        ((nint*)array->Data)[0] = unrelatedUnknown;

        var target = new Target();
        nint dispatch = Marshal.GetIDispatchForObject(target);
        try
        {
            int dispId = GetDispId(dispatch, nameof(Target.Accept));
            var argument = new Variant { Vt = VT_ARRAY | VT_UNKNOWN, Data1 = (nint)array };

            try
            {
                Invoke(dispatch, dispId, &argument);
            }
            catch (InvalidCastException ex)
            {
                Console.WriteLine($"PASS: the unrelated element was rejected: {ex.Message}");
                return 0;
            }

            Console.WriteLine($"Array type: {target.ArrayType}");
            Console.WriteLine($"Stored element type: {target.ElementType}");
            Console.WriteLine($"Element is Expected: {target.ElementIsExpected} (expected True)");
            Console.WriteLine(target.ElementIsExpected
                ? "PASS"
                : $"BUG: an {target.ElementType} was stored into an {target.ArrayType} without a cast check.");
            return target.ElementIsExpected ? 0 : 1;
        }
        finally
        {
            Marshal.Release(dispatch);
            SafeArrayDestroy(array);
        }
    }

    private static int GetDispId(nint dispatch, string name)
    {
        Guid riid = Guid.Empty;
        fixed (char* namePtr = name)
        {
            char* names = namePtr;
            int dispId;
            var getIdsOfNames = (delegate* unmanaged[Stdcall]<nint, Guid*, char**, uint, uint, int*, int>)
                (*(*(void***)dispatch + 5));
            Marshal.ThrowExceptionForHR(getIdsOfNames(dispatch, &riid, &names, 1, 0, &dispId));
            return dispId;
        }
    }

    private static void Invoke(nint dispatch, int dispId, Variant* argument)
    {
        var parameters = new DispParams
        {
            Arguments = argument,
            NamedArguments = null,
            ArgumentCount = 1,
            NamedArgumentCount = 0
        };

        byte* exceptionInfo = stackalloc byte[128];
        uint argumentError;
        Guid riid = Guid.Empty;
        var invoke = (delegate* unmanaged[Stdcall]<nint, int, Guid*, uint, ushort, DispParams*, Variant*, void*, uint*, int>)
            (*(*(void***)dispatch + 6));
        Marshal.ThrowExceptionForHR(
            invoke(dispatch, dispId, &riid, 0, DispatchMethod, &parameters, null, exceptionInfo, &argumentError));
    }

    [DllImport("oleaut32.dll")]
    private static extern SafeArray* SafeArrayCreateVector(ushort vt, int lowerBound, uint count);

    [DllImport("oleaut32.dll")]
    private static extern int SafeArrayDestroy(SafeArray* array);

    [StructLayout(LayoutKind.Sequential)]
    private struct Variant
    {
        public ushort Vt;
        public ushort Reserved1;
        public ushort Reserved2;
        public ushort Reserved3;
        public nint Data1;
        public nint Data2;
    }

    [StructLayout(LayoutKind.Sequential)]
    private struct SafeArray
    {
        public ushort Dimensions;
        public ushort Features;
        public uint ElementSize;
        public uint Locks;
        public nint Data;
        public uint Elements;
        public int LowerBound;
    }

    [StructLayout(LayoutKind.Sequential)]
    private struct DispParams
    {
        public Variant* Arguments;
        public int* NamedArguments;
        public uint ArgumentCount;
        public uint NamedArgumentCount;
    }
}

[ComVisible(true)]
public class Expected
{
    public int Value => 1;
}

[ComVisible(true)]
public class Unrelated
{
    public int Other => 2;
}

[ComVisible(true)]
public class Target
{
    public string? ArrayType { get; private set; }

    public string? ElementType { get; private set; }

    public bool ElementIsExpected { get; private set; }

    public void Accept(Expected[] values)
    {
        ArrayType = values.GetType().Name;
        object element = values[0];
        ElementType = element.GetType().Name;
        ElementIsExpected = element is Expected;
    }
}