roslyn: ISymbol.ToDisplayString throws NullReferenceException in SymbolDisplayVisitor

Version Used: 6.0.100-preview.3.21202.5 in our CI 5.0.300 as reported by @runehalfdan in our repo https://github.com/SonarSource/sonar-dotnet/issues/4525#issuecomment-856652109

Steps to Reproduce:

This issue doesn’t reproduce in a stable way. There’s some nondeterminism in the build and re-running the job usually doesn’t reproduce the issue as seen in our CI as well as in our user report (see link above).

1. Clone open source project https://github.com/openiddict/openiddict-core.git
2. Checkout eb35cbefb700b3f219439431aa489f555a27a5de commit
3. Plug in https://github.com/SonarSource/sonar-dotnet/releases/tag/8.24.0.32949 analyzer (or any older, we didn’t change the rule in last 3 years)
4. You can deactivate all rules for performance/noise reasons except S1698
5. Keep rebuilding the solution until the problem occurs dotnet build /t:Rebuild /warnaserror:AD0001

Error observed:

16:44>CSC : error AD0001: Analyzer 'SonarAnalyzer.Rules.CSharp.ReferenceEqualityCheckWhenEqualsExists' 
threw an exception of type 'System.NullReferenceException' with message 'Object reference not set to an instance of an object.'. 
[C:\Project\src\OpenIddict.Server.AspNetCore\OpenIddict.Server.AspNetCore.csproj]
 16:44>Exception occurred with following context:
         Compilation: OpenIddict.Server.AspNetCore
         
         System.NullReferenceException: Object reference not set to an instance of an object.
            at Microsoft.CodeAnalysis.CSharp.SymbolDisplayVisitor.AddTupleTypeName(INamedTypeSymbol symbol)
            at Microsoft.CodeAnalysis.CSharp.SymbolDisplayVisitor.AddNameAndTypeArgumentsOrParameters(INamedTypeSymbol symbol)
            at Microsoft.CodeAnalysis.CSharp.SymbolDisplayVisitor.MinimallyQualify(INamedTypeSymbol symbol)
            at Microsoft.CodeAnalysis.CSharp.SymbolDisplayVisitor.VisitNamedTypeWithoutNullability(INamedTypeSymbol symbol)
            at Microsoft.CodeAnalysis.CSharp.SymbolDisplayVisitor.VisitNamedType(INamedTypeSymbol symbol)
            at Microsoft.CodeAnalysis.CSharp.Symbols.PublicModel.NamedTypeSymbol.Accept(SymbolVisitor visitor)
            at Microsoft.CodeAnalysis.CSharp.Symbols.PublicModel.Symbol.Microsoft.CodeAnalysis.ISymbol.Accept(SymbolVisitor visitor)
            at Microsoft.CodeAnalysis.CSharp.SymbolDisplay.ToDisplayParts(ISymbol symbol, SemanticModel semanticModelOpt, Int32 positionOpt, SymbolDisplayFormat format, Boolean minimal)
            at Microsoft.CodeAnalysis.CSharp.Symbols.PublicModel.Symbol.Microsoft.CodeAnalysis.ISymbol.ToDisplayString(SymbolDisplayFormat format)
            at SonarAnalyzer.Helpers.TypeHelper.IsMatch(ITypeSymbol typeSymbol, KnownType type)
            at SonarAnalyzer.Rules.CSharp.ReferenceEqualityCheckWhenEqualsExists.GetEqualsOverrides(ITypeSymbol type)
            at SonarAnalyzer.Rules.CSharp.ReferenceEqualityCheckWhenEqualsExists.HasEqualsOverride(ITypeSymbol type)
            at SonarAnalyzer.Rules.CSharp.ReferenceEqualityCheckWhenEqualsExists.<>c.<Initialize>b__9_1(INamedTypeSymbol t)
            at System.Linq.Enumerable.WhereEnumerableIterator`1.MoveNext()
            at System.Linq.Enumerable.SelectManySingleSelectorIterator`2.MoveNext()
            at System.Collections.Generic.HashSet`1.UnionWith(IEnumerable`1 other)
            at System.Collections.Generic.HashSet`1..ctor(IEnumerable`1 collection, IEqualityComparer`1 comparer)
            at System.Collections.Generic.HashSet`1..ctor(IEnumerable`1 collection)
            at SonarAnalyzer.Helpers.EnumerableExtensions.ToHashSet[T](IEnumerable`1 enumerable, IEqualityComparer`1 equalityComparer)
            at SonarAnalyzer.Rules.CSharp.ReferenceEqualityCheckWhenEqualsExists.<>c.<Initialize>b__9_0(CompilationStartAnalysisContext compilationStartContext)
            at SonarAnalyzer.Helpers.SonarAnalysisContext.<>c__DisplayClass46_0`1.<RegisterContextAction>b__0(TContext c)
            at Microsoft.CodeAnalysis.Diagnostics.AnalyzerExecutor.<>c.<ExecuteCompilationStartActions>b__44_0(ValueTuple`2 data)
            at Microsoft.CodeAnalysis.Diagnostics.AnalyzerExecutor.ExecuteAndCatchIfThrows_NoLock[TArg](DiagnosticAnalyzer analyzer, Action`1 analyze, TArg argument, Nullable`1 info)
         -----
         
         Suppress the following diagnostics to disable this analyzer: S1698
 16:44>Done executing task "Csc".

Adding try/catch and logging the failed symbol ToString() and DeclaringSyntaxReferences..SyntaxTree.FilePath produces: ToString: OpenIddict.Abstractions.OpenIddictExceptions.ConcurrencyException FilePath: C:\Project\src\OpenIddict.Abstractions\OpenIddictExceptions.cs

ToString: OpenIddict.Server.OpenIddictServerConfiguration FilePath: C:\Project\src\OpenIddict.Server\OpenIddictServerConfiguration.cs

ToString: SNINativeMethodWrapper.QTypes FilePath: - no DeclaringSyntaxReferences

Analyzer Rule source:

https://github.com/SonarSource/sonar-dotnet/blob/master/analyzers/src/SonarAnalyzer.CSharp/Rules/ReferenceEqualityCheckWhenEqualsExists.cs

In simplified version, rule registers for RegisterCompilationStartAction (Line 62). There it gathers all the ITypeSymbol (including nested) from Compilation.GlobalNamespace. Then it iterates over each ITypeSymbol and each of it’s .BaseType and calls .Is(KnownType.System_Object) (Line 163) that invokes .ToDisplayString().

Expected Behavior:

ToDisplayString() should return some string.

Actual Behavior:

ToDisplayString() throws exception.