dotnet / dotnet/sdk

Microsoft.CodeAnalysis.NetAnalyzers v10.0.301: CA30xx interprocedural analysis causes infinite build / StackOverflow on .NET Framework 4.8 projects

Open
#55,379 1 comment 0 reactions 1 assignee Claimed by @jozkee View on GitHub
Area-Microsoft.CodeAnalysis.NetAnalyzers
Dominant language
C#
Stars
3.2k
Forks
1.3k
PR merge metrics
PR metrics pending

Description

### **Summary**
After replacing legacy FxCop/code-analysis with Microsoft.CodeAnalysis.NetAnalyzers v10.0.301, two different projects in our large solution (both .NET Framework 4.8, non-SDK-style) either hang indefinitely during build analysis or throw a StackOverflowException. Converting to SDK-style did not help. This appears to be a regression in the CA30xx interprocedural/taint-analysis rules.

### **Environment**

- Analyzer: Microsoft.CodeAnalysis.NetAnalyzers v10.0.301
- Target frameworks: .NET Framework 4.8 (non-SDK-style; conversion to SDK-style tested — no effect)
- OS: Windows (v10.0.26200)
- dotnet SDK: 10.0.300

### **Repro steps**

1. Replace legacy FxCop/codeanalysis with Microsoft.CodeAnalysis.NetAnalyzers v10.0.301 (global).
2. Restore packages.
3. Build the solution (MSBuild or Visual Studio). Observe Project A crash and Project B hang.

### **Observed behavior**

- Project A: build eventually throws StackOverflowException during analysis. Downgrading analyzers to v7.0.4 fixes this project.
- Project B: build hangs indefinitely with no error. Adding these lines to [.editorconfig](vscode-file://vscode-app/c:/Users/Amitram.Achunala/AppData/Local/Programs/Microsoft%20VS%20Code/4fe60c8b1c/resources/app/out/vs/code/electron-browser/workbench/workbench.html) resolves the hang by limiting interprocedural depth to 1:
```
dotnet_code_quality.CA3001.max_interprocedural_method_call_chain = 1
dotnet_code_quality.CA3002.max_interprocedural_method_call_chain = 1
dotnet_code_quality.CA3003.max_interprocedural_method_call_chain = 1
dotnet_code_quality.CA3006.max_interprocedural_method_call_chain = 1
dotnet_code_quality.CA3011.max_interprocedural_method_call_chain = 1
```
### **Workarounds tried**

- Downgraded Microsoft.CodeAnalysis.NetAnalyzers to v7.0.4 (fixes Project A).
- Added `max_interprocedural_method_call_chain = 1` for CA3001/3002/3003/3006/3011 in [.editorconfig](vscode-file://vscode-app/c:/Users/Amitram.Achunala/AppData/Local/Programs/Microsoft%20VS%20Code/4fe60c8b1c/resources/app/out/vs/code/electron-browser/workbench/workbench.html) (fixes Project B).
- Converted projects to SDK-style (no effect).
- Other standard mitigations (disable specific rules, build-mode toggles) were tested without full resolution.

### **Impact**
High — builds are blocked (infinite hang or crash), affecting CI and developer productivity.

### **Request**
Please investigate CA30xx interprocedural analysis in v10.0.301 for .NET Framework (non-SDK) projects. If this is a regression, provide a fix or recommended mitigation beyond downgrading to v7.0.4 or aggressively reducing `max_interprocedural_method_call_chain`. Guidance on safe defaults for large codebases would be appreciated.

Contributor guide

No contributing guide indexed for this repository

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.