Fix #990: Invalid object cast for virtual call through pointer

ICSharpCode.Decompiler.Tests/TestCases/Pretty/UnsafeCode.cs

@@ -17,6 +17,7 @@
 // DEALINGS IN THE SOFTWARE.
 
 using System;
+using System.Runtime.InteropServices;
 
 namespace ICSharpCode.Decompiler.Tests.TestCases.Pretty
 {
@@ -38,6 +39,20 @@ namespace ICSharpCode.Decompiler.Tests.TestCases.Pretty
 			public unsafe fixed byte Old[1];
 		}
 
+		private struct Data
+		{
+			public Vector Position;
+		}
+
+		[StructLayout(LayoutKind.Sequential, Size = 1)]
+		private struct Vector
+		{
+			public override int GetHashCode()
+			{
+				return 0;
+			}
+		}
+
 		public unsafe delegate void UnsafeDelegate(byte* ptr);
 
 		private UnsafeDelegate unsafeDelegate;
@@ -139,6 +154,11 @@ namespace ICSharpCode.Decompiler.Tests.TestCases.Pretty
 			this.UseReference(ref *p);
 		}
 
+		public unsafe void PassPointerCastAsRefParameter(uint* p)
+		{
+			this.UseReference(ref *(int*)p);
+		}
+
 		public unsafe void AddressInMultiDimensionalArray(double[,] matrix)
 		{
 			fixed (double* d = &matrix[1, 2]) {
@@ -339,5 +359,12 @@ namespace ICSharpCode.Decompiler.Tests.TestCases.Pretty
 		{
 			this.PassPointerAsRefParameter(this.NullPointer);
 		}
+
+		private unsafe void Issue990()
+		{
+			Data data = default(Data);
+			Data* ptr = &data;
+			this.ConvertIntToFloat(ptr->Position.GetHashCode());
+		}
 	}
 }

ICSharpCode.Decompiler.Tests/TestCases/Pretty/UnsafeCode.il

@@ -10,7 +10,7 @@
   .publickeytoken = (B7 7A 5C 56 19 34 E0 89 )                         // .z\V.4..
   .ver 4:0:0:0
 }
-.assembly '5mgf1rnb'
+.assembly wbbysi3m
 {
   .custom instance void [mscorlib]System.Runtime.CompilerServices.CompilationRelaxationsAttribute::.ctor(int32) = ( 01 00 08 00 00 00 00 00 ) 
   .custom instance void [mscorlib]System.Runtime.CompilerServices.RuntimeCompatibilityAttribute::.ctor() = ( 01 00 01 00 54 02 16 57 72 61 70 4E 6F 6E 45 78   // ....T..WrapNonEx
@@ -20,15 +20,15 @@
   .hash algorithm 0x00008004
   .ver 0:0:0:0
 }
-.module '5mgf1rnb.dll'
+.module wbbysi3m.dll
-// MVID: {C39B0AE8-69C3-4207-B912-FCEE701C71E8}
+// MVID: {8A733FFA-BF2C-4A07-BAE8-CC2DB20691C0}
 .custom instance void [mscorlib]System.Security.UnverifiableCodeAttribute::.ctor() = ( 01 00 00 00 ) 
 .imagebase 0x10000000
 .file alignment 0x00000200
 .stackreserve 0x00100000
 .subsystem 0x0003       // WINDOWS_CUI
 .corflags 0x00000001    //  ILONLY
-// Image base: 0x00C60000
+// Image base: 0x04D30000
 
 
 // =============== CLASS MEMBERS DECLARATION ===================
@@ -108,6 +108,34 @@
                                                                                                            00 ) 
   } // end of class StructWithFixedSizeMembers
 
+  .class sequential ansi sealed nested private beforefieldinit Data
+         extends [mscorlib]System.ValueType
+  {
+    .field public valuetype ICSharpCode.Decompiler.Tests.TestCases.Pretty.UnsafeCode/Vector Position
+  } // end of class Data
+
+  .class sequential ansi sealed nested private beforefieldinit Vector
+         extends [mscorlib]System.ValueType
+  {
+    .pack 0
+    .size 1
+    .method public hidebysig virtual instance int32 
+            GetHashCode() cil managed
+    {
+      // Code size       7 (0x7)
+      .maxstack  1
+      .locals init (int32 V_0)
+      IL_0000:  nop
+      IL_0001:  ldc.i4.0
+      IL_0002:  stloc.0
+      IL_0003:  br.s       IL_0005
+
+      IL_0005:  ldloc.0
+      IL_0006:  ret
+    } // end of method Vector::GetHashCode
+
+  } // end of class Vector
+
   .class auto ansi sealed nested public UnsafeDelegate
          extends [mscorlib]System.MulticastDelegate
   {
@@ -444,6 +472,19 @@
     IL_0009:  ret
   } // end of method UnsafeCode::PassPointerAsRefParameter
 
+  .method public hidebysig instance void 
+          PassPointerCastAsRefParameter(uint32* p) cil managed
+  {
+    // Code size       10 (0xa)
+    .maxstack  8
+    IL_0000:  nop
+    IL_0001:  ldarg.0
+    IL_0002:  ldarg.1
+    IL_0003:  call       instance void ICSharpCode.Decompiler.Tests.TestCases.Pretty.UnsafeCode::UseReference(int32&)
+    IL_0008:  nop
+    IL_0009:  ret
+  } // end of method UnsafeCode::PassPointerCastAsRefParameter
+
   .method public hidebysig instance void 
           AddressInMultiDimensionalArray(float64[0...,0...] matrix) cil managed
   {
@@ -504,12 +545,12 @@
     IL_0015:  ldloc.1
     IL_0016:  ldc.i4.s   65
     IL_0018:  stind.i2
-    IL_0019:  ldloc.1
+    IL_0019:  nop
-    IL_001a:  ldc.i4.2
+    IL_001a:  ldloc.1
-    IL_001b:  conv.i
+    IL_001b:  ldc.i4.2
-    IL_001c:  add
+    IL_001c:  conv.i
-    IL_001d:  stloc.1
+    IL_001d:  add
-    IL_001e:  nop
+    IL_001e:  stloc.1
     IL_001f:  ldloc.1
     IL_0020:  ldind.u2
     IL_0021:  ldc.i4.s   97
@@ -1334,6 +1375,29 @@
     IL_001a:  ret
   } // end of method UnsafeCode::Finalize
 
+  .method private hidebysig instance void 
+          Issue990() cil managed
+  {
+    // Code size       38 (0x26)
+    .maxstack  2
+    .locals init (valuetype ICSharpCode.Decompiler.Tests.TestCases.Pretty.UnsafeCode/Data V_0,
+             valuetype ICSharpCode.Decompiler.Tests.TestCases.Pretty.UnsafeCode/Data* V_1)
+    IL_0000:  nop
+    IL_0001:  ldloca.s   V_0
+    IL_0003:  initobj    ICSharpCode.Decompiler.Tests.TestCases.Pretty.UnsafeCode/Data
+    IL_0009:  ldloca.s   V_0
+    IL_000b:  conv.u
+    IL_000c:  stloc.1
+    IL_000d:  ldarg.0
+    IL_000e:  ldloc.1
+    IL_000f:  ldflda     valuetype ICSharpCode.Decompiler.Tests.TestCases.Pretty.UnsafeCode/Vector ICSharpCode.Decompiler.Tests.TestCases.Pretty.UnsafeCode/Data::Position
+    IL_0014:  constrained. ICSharpCode.Decompiler.Tests.TestCases.Pretty.UnsafeCode/Vector
+    IL_001a:  callvirt   instance int32 [mscorlib]System.Object::GetHashCode()
+    IL_001f:  call       instance float32 ICSharpCode.Decompiler.Tests.TestCases.Pretty.UnsafeCode::ConvertIntToFloat(int32)
+    IL_0024:  pop
+    IL_0025:  ret
+  } // end of method UnsafeCode::Issue990
+
   .property instance int32* NullPointer()
   {
     .get instance int32* ICSharpCode.Decompiler.Tests.TestCases.Pretty.UnsafeCode::get_NullPointer()

ICSharpCode.Decompiler.Tests/TestCases/Pretty/UnsafeCode.opt.il

@@ -10,7 +10,7 @@
   .publickeytoken = (B7 7A 5C 56 19 34 E0 89 )                         // .z\V.4..
   .ver 4:0:0:0
 }
-.assembly av3nix0s
+.assembly apfrp3oh
 {
   .custom instance void [mscorlib]System.Runtime.CompilerServices.CompilationRelaxationsAttribute::.ctor(int32) = ( 01 00 08 00 00 00 00 00 ) 
   .custom instance void [mscorlib]System.Runtime.CompilerServices.RuntimeCompatibilityAttribute::.ctor() = ( 01 00 01 00 54 02 16 57 72 61 70 4E 6F 6E 45 78   // ....T..WrapNonEx
@@ -20,15 +20,15 @@
   .hash algorithm 0x00008004
   .ver 0:0:0:0
 }
-.module av3nix0s.dll
+.module apfrp3oh.dll
-// MVID: {3E5B8427-2816-45EA-9E7A-139AA9452535}
+// MVID: {18CFEE2F-79CA-4464-BA60-BA8E54BE2D99}
 .custom instance void [mscorlib]System.Security.UnverifiableCodeAttribute::.ctor() = ( 01 00 00 00 ) 
 .imagebase 0x10000000
 .file alignment 0x00000200
 .stackreserve 0x00100000
 .subsystem 0x0003       // WINDOWS_CUI
 .corflags 0x00000001    //  ILONLY
-// Image base: 0x025C0000
+// Image base: 0x04CA0000
 
 
 // =============== CLASS MEMBERS DECLARATION ===================
@@ -108,6 +108,28 @@
                                                                                                            00 ) 
   } // end of class StructWithFixedSizeMembers
 
+  .class sequential ansi sealed nested private beforefieldinit Data
+         extends [mscorlib]System.ValueType
+  {
+    .field public valuetype ICSharpCode.Decompiler.Tests.TestCases.Pretty.UnsafeCode/Vector Position
+  } // end of class Data
+
+  .class sequential ansi sealed nested private beforefieldinit Vector
+         extends [mscorlib]System.ValueType
+  {
+    .pack 0
+    .size 1
+    .method public hidebysig virtual instance int32 
+            GetHashCode() cil managed
+    {
+      // Code size       2 (0x2)
+      .maxstack  8
+      IL_0000:  ldc.i4.0
+      IL_0001:  ret
+    } // end of method Vector::GetHashCode
+
+  } // end of class Vector
+
   .class auto ansi sealed nested public UnsafeDelegate
          extends [mscorlib]System.MulticastDelegate
   {
@@ -374,6 +396,17 @@
     IL_0007:  ret
   } // end of method UnsafeCode::PassPointerAsRefParameter
 
+  .method public hidebysig instance void 
+          PassPointerCastAsRefParameter(uint32* p) cil managed
+  {
+    // Code size       8 (0x8)
+    .maxstack  8
+    IL_0000:  ldarg.0
+    IL_0001:  ldarg.1
+    IL_0002:  call       instance void ICSharpCode.Decompiler.Tests.TestCases.Pretty.UnsafeCode::UseReference(int32&)
+    IL_0007:  ret
+  } // end of method UnsafeCode::PassPointerCastAsRefParameter
+
   .method public hidebysig instance void 
           AddressInMultiDimensionalArray(float64[0...,0...] matrix) cil managed
   {
@@ -1064,6 +1097,28 @@
     IL_0015:  ret
   } // end of method UnsafeCode::Finalize
 
+  .method private hidebysig instance void 
+          Issue990() cil managed
+  {
+    // Code size       37 (0x25)
+    .maxstack  2
+    .locals init (valuetype ICSharpCode.Decompiler.Tests.TestCases.Pretty.UnsafeCode/Data V_0,
+             valuetype ICSharpCode.Decompiler.Tests.TestCases.Pretty.UnsafeCode/Data* V_1)
+    IL_0000:  ldloca.s   V_0
+    IL_0002:  initobj    ICSharpCode.Decompiler.Tests.TestCases.Pretty.UnsafeCode/Data
+    IL_0008:  ldloca.s   V_0
+    IL_000a:  conv.u
+    IL_000b:  stloc.1
+    IL_000c:  ldarg.0
+    IL_000d:  ldloc.1
+    IL_000e:  ldflda     valuetype ICSharpCode.Decompiler.Tests.TestCases.Pretty.UnsafeCode/Vector ICSharpCode.Decompiler.Tests.TestCases.Pretty.UnsafeCode/Data::Position
+    IL_0013:  constrained. ICSharpCode.Decompiler.Tests.TestCases.Pretty.UnsafeCode/Vector
+    IL_0019:  callvirt   instance int32 [mscorlib]System.Object::GetHashCode()
+    IL_001e:  call       instance float32 ICSharpCode.Decompiler.Tests.TestCases.Pretty.UnsafeCode::ConvertIntToFloat(int32)
+    IL_0023:  pop
+    IL_0024:  ret
+  } // end of method UnsafeCode::Issue990
+
   .property instance int32* NullPointer()
   {
     .get instance int32* ICSharpCode.Decompiler.Tests.TestCases.Pretty.UnsafeCode::get_NullPointer()

ICSharpCode.Decompiler.Tests/TestCases/Pretty/UnsafeCode.opt.roslyn.il

@@ -25,14 +25,14 @@
   .ver 0:0:0:0
 }
 .module UnsafeCode.dll
-// MVID: {6E613246-08C3-4B77-B500-576D8782513A}
+// MVID: {9580E5D9-4B71-43EE-9D33-75C7E9062150}
 .custom instance void [mscorlib]System.Security.UnverifiableCodeAttribute::.ctor() = ( 01 00 00 00 ) 
 .imagebase 0x10000000
 .file alignment 0x00000200
 .stackreserve 0x00100000
 .subsystem 0x0003       // WINDOWS_CUI
 .corflags 0x00000001    //  ILONLY
-// Image base: 0x030D0000
+// Image base: 0x048C0000
 
 
 // =============== CLASS MEMBERS DECLARATION ===================
@@ -112,6 +112,28 @@
                                                                                 62 75 74 65 00 00 )                               // bute..
   } // end of class StructWithFixedSizeMembers
 
+  .class sequential ansi sealed nested private beforefieldinit Data
+         extends [mscorlib]System.ValueType
+  {
+    .field public valuetype ICSharpCode.Decompiler.Tests.TestCases.Pretty.UnsafeCode/Vector Position
+  } // end of class Data
+
+  .class sequential ansi sealed nested private beforefieldinit Vector
+         extends [mscorlib]System.ValueType
+  {
+    .pack 0
+    .size 1
+    .method public hidebysig virtual instance int32 
+            GetHashCode() cil managed
+    {
+      // Code size       2 (0x2)
+      .maxstack  8
+      IL_0000:  ldc.i4.0
+      IL_0001:  ret
+    } // end of method Vector::GetHashCode
+
+  } // end of class Vector
+
   .class auto ansi sealed nested public UnsafeDelegate
          extends [mscorlib]System.MulticastDelegate
   {
@@ -377,6 +399,17 @@
     IL_0007:  ret
   } // end of method UnsafeCode::PassPointerAsRefParameter
 
+  .method public hidebysig instance void 
+          PassPointerCastAsRefParameter(uint32* p) cil managed
+  {
+    // Code size       8 (0x8)
+    .maxstack  8
+    IL_0000:  ldarg.0
+    IL_0001:  ldarg.1
+    IL_0002:  call       instance void ICSharpCode.Decompiler.Tests.TestCases.Pretty.UnsafeCode::UseReference(int32&)
+    IL_0007:  ret
+  } // end of method UnsafeCode::PassPointerCastAsRefParameter
+
   .method public hidebysig instance void 
           AddressInMultiDimensionalArray(float64[0...,0...] matrix) cil managed
   {
@@ -1070,6 +1103,28 @@
     IL_0015:  ret
   } // end of method UnsafeCode::Finalize
 
+  .method private hidebysig instance void 
+          Issue990() cil managed
+  {
+    // Code size       37 (0x25)
+    .maxstack  2
+    .locals init (valuetype ICSharpCode.Decompiler.Tests.TestCases.Pretty.UnsafeCode/Data V_0,
+             valuetype ICSharpCode.Decompiler.Tests.TestCases.Pretty.UnsafeCode/Data* V_1)
+    IL_0000:  ldloca.s   V_0
+    IL_0002:  initobj    ICSharpCode.Decompiler.Tests.TestCases.Pretty.UnsafeCode/Data
+    IL_0008:  ldloca.s   V_0
+    IL_000a:  conv.u
+    IL_000b:  stloc.1
+    IL_000c:  ldarg.0
+    IL_000d:  ldloc.1
+    IL_000e:  ldflda     valuetype ICSharpCode.Decompiler.Tests.TestCases.Pretty.UnsafeCode/Vector ICSharpCode.Decompiler.Tests.TestCases.Pretty.UnsafeCode/Data::Position
+    IL_0013:  constrained. ICSharpCode.Decompiler.Tests.TestCases.Pretty.UnsafeCode/Vector
+    IL_0019:  callvirt   instance int32 [mscorlib]System.Object::GetHashCode()
+    IL_001e:  call       instance float32 ICSharpCode.Decompiler.Tests.TestCases.Pretty.UnsafeCode::ConvertIntToFloat(int32)
+    IL_0023:  pop
+    IL_0024:  ret
+  } // end of method UnsafeCode::Issue990
+
   .property instance int32* NullPointer()
   {
     .get instance int32* ICSharpCode.Decompiler.Tests.TestCases.Pretty.UnsafeCode::get_NullPointer()

ICSharpCode.Decompiler.Tests/TestCases/Pretty/UnsafeCode.roslyn.il

@@ -25,14 +25,14 @@
   .ver 0:0:0:0
 }
 .module UnsafeCode.dll
-// MVID: {E02FB293-0E44-4F82-B549-8BAB6E8A9750}
+// MVID: {34429304-3762-4E40-977B-76B197A03CDA}
 .custom instance void [mscorlib]System.Security.UnverifiableCodeAttribute::.ctor() = ( 01 00 00 00 ) 
 .imagebase 0x10000000
 .file alignment 0x00000200
 .stackreserve 0x00100000
 .subsystem 0x0003       // WINDOWS_CUI
 .corflags 0x00000001    //  ILONLY
-// Image base: 0x006B0000
+// Image base: 0x00C50000
 
 
 // =============== CLASS MEMBERS DECLARATION ===================
@@ -112,6 +112,34 @@
                                                                                 62 75 74 65 00 00 )                               // bute..
   } // end of class StructWithFixedSizeMembers
 
+  .class sequential ansi sealed nested private beforefieldinit Data
+         extends [mscorlib]System.ValueType
+  {
+    .field public valuetype ICSharpCode.Decompiler.Tests.TestCases.Pretty.UnsafeCode/Vector Position
+  } // end of class Data
+
+  .class sequential ansi sealed nested private beforefieldinit Vector
+         extends [mscorlib]System.ValueType
+  {
+    .pack 0
+    .size 1
+    .method public hidebysig virtual instance int32 
+            GetHashCode() cil managed
+    {
+      // Code size       7 (0x7)
+      .maxstack  1
+      .locals init (int32 V_0)
+      IL_0000:  nop
+      IL_0001:  ldc.i4.0
+      IL_0002:  stloc.0
+      IL_0003:  br.s       IL_0005
+
+      IL_0005:  ldloc.0
+      IL_0006:  ret
+    } // end of method Vector::GetHashCode
+
+  } // end of class Vector
+
   .class auto ansi sealed nested public UnsafeDelegate
          extends [mscorlib]System.MulticastDelegate
   {
@@ -446,6 +474,19 @@
     IL_0009:  ret
   } // end of method UnsafeCode::PassPointerAsRefParameter
 
+  .method public hidebysig instance void 
+          PassPointerCastAsRefParameter(uint32* p) cil managed
+  {
+    // Code size       10 (0xa)
+    .maxstack  8
+    IL_0000:  nop
+    IL_0001:  ldarg.0
+    IL_0002:  ldarg.1
+    IL_0003:  call       instance void ICSharpCode.Decompiler.Tests.TestCases.Pretty.UnsafeCode::UseReference(int32&)
+    IL_0008:  nop
+    IL_0009:  ret
+  } // end of method UnsafeCode::PassPointerCastAsRefParameter
+
   .method public hidebysig instance void 
           AddressInMultiDimensionalArray(float64[0...,0...] matrix) cil managed
   {
@@ -508,11 +549,11 @@
     IL_0017:  ldloc.2
     IL_0018:  ldc.i4.s   65
     IL_001a:  stind.i2
-    IL_001b:  ldloc.2
+    IL_001b:  nop
-    IL_001c:  ldc.i4.2
+    IL_001c:  ldloc.2
-    IL_001d:  add
+    IL_001d:  ldc.i4.2
-    IL_001e:  stloc.2
+    IL_001e:  add
-    IL_001f:  nop
+    IL_001f:  stloc.2
     IL_0020:  ldloc.2
     IL_0021:  ldind.u2
     IL_0022:  ldc.i4.s   97
@@ -1338,6 +1379,29 @@
     IL_0019:  ret
   } // end of method UnsafeCode::Finalize
 
+  .method private hidebysig instance void 
+          Issue990() cil managed
+  {
+    // Code size       38 (0x26)
+    .maxstack  2
+    .locals init (valuetype ICSharpCode.Decompiler.Tests.TestCases.Pretty.UnsafeCode/Data V_0,
+             valuetype ICSharpCode.Decompiler.Tests.TestCases.Pretty.UnsafeCode/Data* V_1)
+    IL_0000:  nop
+    IL_0001:  ldloca.s   V_0
+    IL_0003:  initobj    ICSharpCode.Decompiler.Tests.TestCases.Pretty.UnsafeCode/Data
+    IL_0009:  ldloca.s   V_0
+    IL_000b:  conv.u
+    IL_000c:  stloc.1
+    IL_000d:  ldarg.0
+    IL_000e:  ldloc.1
+    IL_000f:  ldflda     valuetype ICSharpCode.Decompiler.Tests.TestCases.Pretty.UnsafeCode/Vector ICSharpCode.Decompiler.Tests.TestCases.Pretty.UnsafeCode/Data::Position
+    IL_0014:  constrained. ICSharpCode.Decompiler.Tests.TestCases.Pretty.UnsafeCode/Vector
+    IL_001a:  callvirt   instance int32 [mscorlib]System.Object::GetHashCode()
+    IL_001f:  call       instance float32 ICSharpCode.Decompiler.Tests.TestCases.Pretty.UnsafeCode::ConvertIntToFloat(int32)
+    IL_0024:  pop
+    IL_0025:  ret
+  } // end of method UnsafeCode::Issue990
+
   .property instance int32* NullPointer()
   {
     .get instance int32* ICSharpCode.Decompiler.Tests.TestCases.Pretty.UnsafeCode::get_NullPointer()

ICSharpCode.Decompiler/CSharp/CallBuilder.cs

@@ -70,7 +70,7 @@ namespace ICSharpCode.Decompiler.CSharp
 			if (callOpCode == OpCode.NewObj) {
 				target = default(TranslatedExpression); // no target
 			} else {
-				target = expressionBuilder.TranslateTarget(method, callArguments.FirstOrDefault(), callOpCode == OpCode.Call);
+				target = expressionBuilder.TranslateTarget(method, callArguments.FirstOrDefault(), callOpCode == OpCode.Call, constrainedTo);
 				if (callOpCode == OpCode.CallVirt
 					&& constrainedTo == null
 					&& target.Expression is CastExpression cast

ICSharpCode.Decompiler/CSharp/ExpressionBuilder.cs

@@ -1488,7 +1488,7 @@ namespace ICSharpCode.Decompiler.CSharp
 			}
 		}
 		
-		internal TranslatedExpression TranslateTarget(IMember member, ILInstruction target, bool nonVirtualInvocation)
+		internal TranslatedExpression TranslateTarget(IMember member, ILInstruction target, bool nonVirtualInvocation, IType constrainedTo = null)
 		{
 			// If references are missing member.IsStatic might not be set correctly.
 			// Additionally check target for null, in order to avoid a crash.
@@ -1499,9 +1499,9 @@ namespace ICSharpCode.Decompiler.CSharp
 						.WithRR(new ThisResolveResult(member.DeclaringType, nonVirtualInvocation));
 				} else {
 					var translatedTarget = Translate(target);
-					if (member.DeclaringType.IsReferenceType == false && translatedTarget.Type.GetStackType().IsIntegerType()) {
+					if (CallInstruction.ExpectedTypeForThisPointer(constrainedTo ?? member.DeclaringType) == StackType.Ref && translatedTarget.Type.GetStackType().IsIntegerType()) {
 						// when accessing members on value types, ensure we use a reference and not a pointer
-						translatedTarget = translatedTarget.ConvertTo(new ByReferenceType(member.DeclaringType), this);
+						translatedTarget = translatedTarget.ConvertTo(new ByReferenceType(constrainedTo ?? member.DeclaringType), this);
 					}
 					if (translatedTarget.Expression is DirectionExpression) {
 						translatedTarget = translatedTarget.UnwrapChild(((DirectionExpression)translatedTarget).Expression);

ICSharpCode.Decompiler/CSharp/TranslatedExpression.cs

@@ -308,12 +308,20 @@ namespace ICSharpCode.Decompiler.CSharp
 				// First, convert to the corresponding pointer type:
 				var elementType = ((ByReferenceType)targetType).ElementType;
 				var arg = this.ConvertTo(new PointerType(elementType), expressionBuilder, checkForOverflow);
-				// Then dereference the pointer:
+				Expression expr;
-				var derefExpr = new UnaryOperatorExpression(UnaryOperatorType.Dereference, arg.Expression);
+				ResolveResult elementRR;
-				var elementRR = new ResolveResult(elementType);
+				if (arg.Expression is UnaryOperatorExpression unary && unary.Operator == UnaryOperatorType.AddressOf) {
-				derefExpr.AddAnnotation(elementRR);
+					// If we already have an address -> unwrap
+					expr = arg.UnwrapChild(unary.Expression);
+					elementRR = expr.GetResolveResult();
+				} else {
+					// Otherwise dereference the pointer:
+					expr = new UnaryOperatorExpression(UnaryOperatorType.Dereference, arg.Expression);
+					elementRR = new ResolveResult(elementType);
+					expr.AddAnnotation(elementRR);
+				}
 				// And then take a reference:
-				return new DirectionExpression(FieldDirection.Ref, derefExpr)
+				return new DirectionExpression(FieldDirection.Ref, expr)
 					.WithoutILInstruction()
 					.WithRR(new ByReferenceResolveResult(elementRR, false));
 			}