Specify lifetime of ByRefLikeArguments

Author: stakx

src/Castle.Core.Tests/DynamicProxy.Tests/ByRefLikeTestCase.cs

@@ -500,6 +500,43 @@ public void By_ref_like_out_arguments_cannot_be_set_by_target()
 
 		#endregion
 
+		#region Memory safety
+
+		// Byref-like arguments live exclusively on the evaluation stack.
+		// We need to make sure that references to them (such as those in `IInvocation.Arguments`)
+		// do not have a longer lifetime than the arguments themselves.
+
+		[Test]
+		public unsafe void Cannot_use_ByRefLikeArgument_GetPointer_after_invocation()
+		{
+			var interceptor = new ObservingInterceptor();
+			var proxy = generator.CreateClassProxy<HasMethodWithSpanParameter>(interceptor);
+			proxy.Method(default);
+			var byRefLikeArg = (ByRefLikeArgument)interceptor.ObservedArg!;
+			Assert.Throws<ObjectDisposedException>(() => _ = byRefLikeArg.GetPointer());
+		}
+
+		[Test]
+		public void Cannot_use_ByRefLikeArgument_Get_after_invocation()
+		{
+			var interceptor = new ObservingInterceptor();
+			var proxy = generator.CreateClassProxy<HasMethodWithSpanParameter>(interceptor);
+			proxy.Method(default);
+			var byRefLikeArg = (ReadOnlySpanArgument<char>)interceptor.ObservedArg!;
+			Assert.Throws<ObjectDisposedException>(() => _ = byRefLikeArg.Get());
+		}
+
+		[Test]
+		public void ByRefLikeArguments_are_erased_from_invocation_Arguments_after_invocation()
+		{
+			var interceptor = new ObservingInterceptor();
+			var proxy = generator.CreateClassProxy<HasMethodWithSpanParameter>(interceptor);
+			proxy.Method(default);
+			Assert.IsNull(interceptor.AllArguments![0]);
+		}
+
+		#endregion
+
 		public class HasMethodWithSpanParameter
 		{
 			public string? RecordedArg;
@@ -541,10 +578,12 @@ public virtual void Method(out ReadOnlySpan<char> arg)
 
 		public class ObservingInterceptor : IInterceptor
 		{
+			public object?[]? AllArguments;
 			public object? ObservedArg;
 
 			public void Intercept(IInvocation invocation)
 			{
+				AllArguments = invocation.Arguments;
 				ObservedArg = invocation.Arguments[0];
 			}
 		}

src/Castle.Core/DynamicProxy/ByRefLikeArgument.cs

@@ -78,6 +78,23 @@ public ByRefLikeArgument(void* ptr)
 		/// <summary>
 		///   Gets an unmanaged pointer to the byref-like (<c>ref struct</c>) argument.
 		/// </summary>
+		/// <remarks>
+		///   <para>
+		///     You may only use the returned pointer during the first run through the interception pipeline.
+		///     After that, it will be invalid, because the argument that it referred to will be gone
+		///     from the evaluation stack.
+		///   </para>
+		///   <para>
+		///     In particular, if you intercept an <see langword="async"/> method and make use of
+		///     <see cref="IInvocationProceedInfo"/> to proceed through the pipeline again
+		///     after an <see langword="await"/>, you may no longer access any byref-like arguments.
+		///     (.NET compilers would forbid any such attempts, too.)
+		///   </para>
+		///   <para>
+		///     Using the returned pointer beyond the lifetime of the byref-like argument
+		///     will cause undefined behavior, or an <see cref="AccessViolationException"/> at best.
+		///   </para>
+		/// </remarks>
 		[CLSCompliant(false)]
 		[EditorBrowsable(EditorBrowsableState.Advanced)]
 		public void* GetPointer()