ResolvePackageAssets throws IndexOutOfRangeException when reading its cache

[ladipro]

Describe the bug

The ResolvePackageAssets task doesn't appear to be resilient against cache corruption. In my case the cache was created by an older version, possibly pre-release, and while it may be expected that it cannot be read back, the task shouldn't crash.

To Reproduce

I am attaching a cache file that makes the cache reader crash with IndexOutOfRangeException. StringTools.assets.zip

Exceptions (if any)

C:\Program Files\dotnet\sdk\7.0.100-rc.2.22477.23\Sdks\Microsoft.NET.Sdk\targets\Microsoft.PackageDependencyResolution.targets(267,5): error MSB4018: The "ResolvePackageAssets" task failed unexpectedly. [C:\src\msbuild\src\StringTools\StringTools.csproj::TargetFramework=net472]
C:\Program Files\dotnet\sdk\7.0.100-rc.2.22477.23\Sdks\Microsoft.NET.Sdk\targets\Microsoft.PackageDependencyResolution.targets(267,5): error MSB4018: System.IndexOutOfRangeException: Index was outside the bounds of the array. [C:\src\msbuild\src\StringTools\StringTools.csproj::TargetFramework=net472]
C:\Program Files\dotnet\sdk\7.0.100-rc.2.22477.23\Sdks\Microsoft.NET.Sdk\targets\Microsoft.PackageDependencyResolution.targets(267,5): error MSB4018:    at Microsoft.NET.Build.Tasks.ResolvePackageAssets.CacheReader.ReadItem() [C:\src\msbuild\src\StringTools\StringTools.csproj::TargetFramework=net472]
C:\Program Files\dotnet\sdk\7.0.100-rc.2.22477.23\Sdks\Microsoft.NET.Sdk\targets\Microsoft.PackageDependencyResolution.targets(267,5): error MSB4018:    at Microsoft.NET.Build.Tasks.ResolvePackageAssets.CacheReader.ReadItemGroup() [C:\src\msbuild\src\StringTools\StringTools.csproj::TargetFramework=net472]
C:\Program Files\dotnet\sdk\7.0.100-rc.2.22477.23\Sdks\Microsoft.NET.Sdk\targets\Microsoft.PackageDependencyResolution.targets(267,5): error MSB4018:    at Microsoft.NET.Build.Tasks.ResolvePackageAssets.ReadItemGroups() [C:\src\msbuild\src\StringTools\StringTools.csproj::TargetFramework=net472]
C:\Program Files\dotnet\sdk\7.0.100-rc.2.22477.23\Sdks\Microsoft.NET.Sdk\targets\Microsoft.PackageDependencyResolution.targets(267,5): error MSB4018:    at Microsoft.NET.Build.Tasks.ResolvePackageAssets.ExecuteCore() [C:\src\msbuild\src\StringTools\StringTools.csproj::TargetFramework=net472]
C:\Program Files\dotnet\sdk\7.0.100-rc.2.22477.23\Sdks\Microsoft.NET.Sdk\targets\Microsoft.PackageDependencyResolution.targets(267,5): error MSB4018:    at Microsoft.NET.Build.Tasks.TaskBase.Execute() [C:\src\msbuild\src\StringTools\StringTools.csproj::TargetFramework=net472]
C:\Program Files\dotnet\sdk\7.0.100-rc.2.22477.23\Sdks\Microsoft.NET.Sdk\targets\Microsoft.PackageDependencyResolution.targets(267,5): error MSB4018:    at Microsoft.Build.BackEnd.TaskExecutionHost.Microsoft.Build.BackEnd.ITaskExecutionHost.Execute() [C:\src\msbuild\src\StringTools\StringTools.csproj::TargetFramewo
rk=net472]

Further technical details

Reproduces with ResolvePackageAssets at commit e3fde729b1592db7964120f5e314001b19926e5f.

[onionhammer]

Also getting this with net 7 RC on osx

[marcpopMSFT]

Did this only happen when reading a cache created with an older version? If so, moving to the backlog for now though someone is welcome to submit a PR to harden this code and invalidate the cache if an exception is thrown.

[baronfel]

Several folks in Roslyn are reporting this impacting them with the .NET 9 preview5 SDK build - @tmat among them. He tried cleaning the intermediates but it came back even after doing this. There may be a mismatch between the VS MSBuild in use and the SDK's MSBuild in the preview5 build? Did this cache structure change recently?

[tmat]

Confirmed that the issue repros even on a clean repo (roslyn) when only restoring/building from VS (Version 17.11.0 Preview 1.1).

[tmat]

Looks like a bug in NuGet.Client.

ResolvePackageAssets throws while enumerating NuGet.ProjectModel.ProjectFileDependencyGroup.Dependencies, which returns null.

I'm guessing that's because our project.assets.json contains nulls in projectFileDependencyGroups:

"libraries": {},
  "projectFileDependencyGroups": {
    ".NETFramework,Version=v4.7.2": [
      null,
      null,
      null,
      null,
      null,
      null,
      "Microsoft.DotNet.Build.Tasks.VisualStudio >= 9.0.0-beta.24317.3",
      "Microsoft.Net.Compilers.Toolset >= 4.11.0-2.24270.4",
      "Microsoft.VisualStudioEng.MicroBuild.Plugins.SwixBuild >= 1.1.286"
    ]
  },

[tmat]

I think the issue we have is different then what @ladipro filed.

[baronfel]

@nkolev92 / @zivkan has NuGet seen any reports of nulls in the projectFileDepndencyGroups recently?

[tmat]

Filed https://github.com/NuGet/Home/issues/13563