NullableWalker assert failure with a collection expression passed to params collection

[davidwengier]

Getting the following assert failure when building Razor.sln when referencing a debug build of Roslyn.

Didn't want to upload a complog because its 173mb but let me know if you want it.

Process terminated. Assertion failed.
Analyzed 91 nodes in NullableWalker, but DebugVerifier expects 89. Example of unverified node: BoundConversion RazorTestResources.BlazorServerAppTagHelpers
   at Roslyn.Utilities.RoslynDebug.Assert(Boolean condition, AssertInterpolatedStringHandler& message) in D:\Code\roslyn\src\Compilers\Core\Portable\InternalUtilities\Debug.cs:line 32
   at Microsoft.CodeAnalysis.CSharp.NullableWalker.DebugVerifier.Verify(ImmutableDictionary`2 analyzedNullabilityMap, SnapshotManager snapshotManagerOpt, BoundNode node) in D:\Code\roslyn\src\Compilers\CSharp\Portable\FlowAnalysis\NullableWalker.DebugVerifier.cs:line 50
   at Microsoft.CodeAnalysis.CSharp.NullableWalker.AnalyzeWithSemanticInfo(CSharpCompilation compilation, Symbol symbol, BoundNode node, Binder binder, VariableState initialState, DiagnosticBag diagnostics, Boolean createSnapshots, Boolean requiresAnalysis) in D:\Code\roslyn\src\Compilers\CSharp\Portable\FlowAnalysis\NullableWalker.cs:line 1657
   at Microsoft.CodeAnalysis.CSharp.NullableWalker.AnalyzeAndRewrite(CSharpCompilation compilation, Symbol symbol, BoundNode node, Binder binder, VariableState initialState, DiagnosticBag diagnostics, Boolean createSnapshots, SnapshotManager& snapshotManager, ImmutableDictionary`2& remappedSymbols) in D:\Code\roslyn\src\Compilers\CSharp\Portable\FlowAnalysis\NullableWalker.cs:line 1609
   at Microsoft.CodeAnalysis.CSharp.MethodCompiler.BindMethodBody(MethodSymbol method, TypeCompilationState compilationState, BindingDiagnosticBag diagnostics, Boolean includeInitializersInBody, BoundNode initializersBody, Boolean reportNullableDiagnostics, ImportChain& importChain, Boolean& originalBodyNested, Boolean& prependedDefaultValueTypeConstructorInitializer, InitialState& forSemanticModel) in D:\Code\roslyn\src\Compilers\CSharp\Portable\Compiler\MethodCompiler.cs:line 1954
   at Microsoft.CodeAnalysis.CSharp.MethodCompiler.CompileMethod(MethodSymbol methodSymbol, Int32 methodOrdinal, ProcessedFieldInitializers& processedInitializers, SynthesizedSubmissionFields previousSubmissionFields, TypeCompilationState compilationState) in D:\Code\roslyn\src\Compilers\CSharp\Portable\Compiler\MethodCompiler.cs:line 1055
   at Microsoft.CodeAnalysis.CSharp.MethodCompiler.CompileNamedType(NamedTypeSymbol containingType) in D:\Code\roslyn\src\Compilers\CSharp\Portable\Compiler\MethodCompiler.cs:line 561
   at Microsoft.CodeAnalysis.CSharp.MethodCompiler.<>c__DisplayClass25_0.<CompileNamedTypeAsync>b__0() in D:\Code\roslyn\src\Compilers\CSharp\Portable\Compiler\MethodCompiler.cs:line 446
   at Roslyn.Utilities.UICultureUtilities.<>c__DisplayClass5_0.<WithCurrentUICulture>b__0() in D:\Code\roslyn\src\Compilers\Core\Portable\InternalUtilities\UICultureUtilities.cs:line 139
   at System.Threading.ExecutionContext.RunFromThreadPoolDispatchLoop(Thread threadPoolThread, ExecutionContext executionContext, ContextCallback callback, Object state)
   at System.Threading.Tasks.Task.ExecuteWithThreadLocal(Task& currentTaskSlot, Thread threadPoolThread)
   at System.Threading.ThreadPoolWorkQueue.Dispatch()
   at System.Threading.PortableThreadPool.WorkerThread.WorkerThreadStart()

[jjonescz]

Minimal repro (.NET Lab):

[Fact, WorkItem("https://github.com/dotnet/roslyn/issues/81552")]
public void VisitedNodes_CollectionExpression()
{
    var source = """
        #nullable enable
        using System;
        using System.Collections;
        using System.Collections.Generic;
        using System.Runtime.CompilerServices;

        Merge([.. D.P]);

        static void Merge(params ReadOnlySpan<C> cs) { }

        [CollectionBuilder(typeof(C), methodName: nameof(Create))]
        class C : IEnumerable<int>
        {
            public static C Create(ReadOnlySpan<int> span) => new();

            public IEnumerator<int> GetEnumerator() => throw new NotImplementedException();

            IEnumerator IEnumerable.GetEnumerator() => GetEnumerator();
        }

        class D
        {
            public static IEnumerable<int> P => [1];
        }
        """;
    CompileAndVerify(CreateCompilationWithSpan([source, CollectionBuilderAttributeDefinition]), expectedOutput: "").VerifyDiagnostics();
}

It looks like we can get a BoundUnconvertedCollectionExpression from here:

roslyn/src/Compilers/CSharp/Portable/FlowAnalysis/NullableWalker.cs

Line 7556 in 663927d

elements = ((BoundCollectionExpression)((BoundConversion)argument).Operand).UnconvertedCollectionExpression.Elements.CastArray<BoundExpression>();

Which neither the NullableWalker nor its DebugVerifier expect.