Collection initializers can leak refs

[jjonescz]

Version Used: 4.13.0-2.24555.1 (9dcb2a3)

Steps to Reproduce:

using System;
using System.Collections;
using System.Diagnostics.CodeAnalysis;

R r = M();
Console.WriteLine(r.F);

static R M()
{
    var local = 1;
    return new R() { local };
}

ref struct R : IEnumerable
{
    public ref readonly int F;

    public void Add([UnscopedRef] in int x)
    {
        F = ref x;
    }

    IEnumerator IEnumerable.GetEnumerator() => throw null;
}

Expected Behavior: Error on return new R() { local }; like there would be if explicitly written as var r = new R(); r.Add(local); return r;.

Actual Behavior: No errors. The code accesses a dead reference when executing.

[jjonescz]

Similar holes exist for other constructs that lower to method calls and aren't specifically handled by RefSafetyVisitor. I would expect collection builders via collection expressions to have a similar problem.

Also, for example, interpolated string handlers (EDIT: That seems to be already tracked by #63306):

using System;
using System.Diagnostics.CodeAnalysis;

R r = M();
Console.WriteLine(r.F);

static R M()
{
    var local = 1;
    return $"{local}";
}

[System.Runtime.CompilerServices.InterpolatedStringHandlerAttribute]
ref struct R
{
    public ref readonly int F;

    public R(int literalLength, int formattedCount) { }

    public void AppendFormatted([UnscopedRef] in int x)
    {
        F = ref x;
    }
}