Microsoft.CodeAnalysis.NetAnalyzers v10.0.301: CA30xx interprocedural analysis causes infinite build / StackOverflow on .NET Framework 4.8 projects
- Dominant language
- C#
- Stars
- 3.2k
- Forks
- 1.3k
- PR merge metrics
- PR metrics pending
Description
### **Summary**
After replacing legacy FxCop/code-analysis with Microsoft.CodeAnalysis.NetAnalyzers v10.0.301, two different projects in our large solution (both .NET Framework 4.8, non-SDK-style) either hang indefinitely during build analysis or throw a StackOverflowException. Converting to SDK-style did not help. This appears to be a regression in the CA30xx interprocedural/taint-analysis rules.
### **Environment**
- Analyzer: Microsoft.CodeAnalysis.NetAnalyzers v10.0.301
- Target frameworks: .NET Framework 4.8 (non-SDK-style; conversion to SDK-style tested — no effect)
- OS: Windows (v10.0.26200)
- dotnet SDK: 10.0.300
### **Repro steps**
1. Replace legacy FxCop/codeanalysis with Microsoft.CodeAnalysis.NetAnalyzers v10.0.301 (global).
2. Restore packages.
3. Build the solution (MSBuild or Visual Studio). Observe Project A crash and Project B hang.
### **Observed behavior**
- Project A: build eventually throws StackOverflowException during analysis. Downgrading analyzers to v7.0.4 fixes this project.
- Project B: build hangs indefinitely with no error. Adding these lines to [.editorconfig](vscode-file://vscode-app/c:/Users/Amitram.Achunala/AppData/Local/Programs/Microsoft%20VS%20Code/4fe60c8b1c/resources/app/out/vs/code/electron-browser/workbench/workbench.html) resolves the hang by limiting interprocedural depth to 1:
```
dotnet_code_quality.CA3001.max_interprocedural_method_call_chain = 1
dotnet_code_quality.CA3002.max_interprocedural_method_call_chain = 1
dotnet_code_quality.CA3003.max_interprocedural_method_call_chain = 1
dotnet_code_quality.CA3006.max_interprocedural_method_call_chain = 1
dotnet_code_quality.CA3011.max_interprocedural_method_call_chain = 1
```
### **Workarounds tried**
- Downgraded Microsoft.CodeAnalysis.NetAnalyzers to v7.0.4 (fixes Project A).
- Added `max_interprocedural_method_call_chain = 1` for CA3001/3002/3003/3006/3011 in [.editorconfig](vscode-file://vscode-app/c:/Users/Amitram.Achunala/AppData/Local/Programs/Microsoft%20VS%20Code/4fe60c8b1c/resources/app/out/vs/code/electron-browser/workbench/workbench.html) (fixes Project B).
- Converted projects to SDK-style (no effect).
- Other standard mitigations (disable specific rules, build-mode toggles) were tested without full resolution.
### **Impact**
High — builds are blocked (infinite hang or crash), affecting CI and developer productivity.
### **Request**
Please investigate CA30xx interprocedural analysis in v10.0.301 for .NET Framework (non-SDK) projects. If this is a regression, provide a fix or recommended mitigation beyond downgrading to v7.0.4 or aggressively reducing `max_interprocedural_method_call_chain`. Guidance on safe defaults for large codebases would be appreciated.
Contributor guide
No contributing guide indexed for this repository
Assessment
This issue has not been assessed yet.