Fix BlockNeedsWrap / ExpressionBodyNeedsWrap to only skip on the fixer's own output shape

Previously BlockNeedsWrap used body.DescendantNodes() to look for an existing
'unsafe' block anywhere in the body, which incorrectly suppressed wrapping when:
- the outer body contained other top-level unsafe operations alongside a manual
  'unsafe { }' block, or
- a nested local function / lambda happened to contain its own 'unsafe' block.

In either case, removing the method-level 'unsafe' modifier without wrapping the
outer body produces code that no longer compiles. Tighten the skip condition so
we only treat the body as already-wrapped when it's literally
'{ unsafe { ... } }' — the shape the fixer itself emits — preserving idempotence
without false positives.

The same descendant-scan was also in ExpressionBodyNeedsWrap, where it could
only ever match nested lambdas (since an unsafe statement can't be the body of
an arrow expression directly); simplified to always wrap when an expression body
is present.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Author: EgorBo

src/tools/illink/src/ILLink.RoslynAnalyzer/UnsafeV2MigrationAnalyzer.cs

@@ -182,13 +182,19 @@ public static bool MemberNeedsBodyWrap(SyntaxNode member)
             };
         }
 
-        // True iff a block body has statements worth wrapping (non-empty, no existing
-        // unsafe block, no conditional-compilation directives).
+        // True iff a block body has statements worth wrapping (non-empty, no conditional-
+        // compilation directives, and not already in the fixer's own idempotent output
+        // shape — i.e. `{ unsafe { ... } }`).
         public static bool BlockNeedsWrap(BlockSyntax? body)
         {
             if (body is null || body.Statements.Count == 0)
                 return false;
-            if (body.DescendantNodes().OfType<UnsafeStatementSyntax>().Any())
+            // Skip ONLY when the body's *direct* shape is the one this fixer emits — a
+            // single top-level `unsafe { ... }` statement. Checking DescendantNodes here
+            // would be wrong: a nested unsafe block inside a local function or lambda
+            // does not relieve the outer body from needing its own unsafe context for
+            // any sibling unsafe operations.
+            if (body.Statements.Count == 1 && body.Statements[0] is UnsafeStatementSyntax)
                 return false;
             // Skip wrapping when the body contains conditional-compilation directives.
             // Every structural / textual wrap we tried produced different output per TFM,
@@ -209,9 +215,12 @@ private static bool IsConditionalCompilationDirective(SyntaxTrivia trivia) =>
             || trivia.IsKind(SyntaxKind.ElseDirectiveTrivia)
             || trivia.IsKind(SyntaxKind.EndIfDirectiveTrivia);
 
-        // True iff an `=> expr` body is worth wrapping (has no unsafe statement already).
+        // True iff an `=> expr` body should be wrapped. An expression body can never
+        // itself BE an `unsafe { ... }` block (unsafe is a statement, not an expression),
+        // so we always wrap when one is present. Nested unsafe blocks inside lambdas /
+        // local functions don't suppress wrapping for the same reason as BlockNeedsWrap.
         public static bool ExpressionBodyNeedsWrap(ArrowExpressionClauseSyntax? expr) =>
-            expr is not null && !expr.DescendantNodesAndSelf().OfType<UnsafeStatementSyntax>().Any();
+            expr is not null;
 
         // True iff a property/indexer body (expression or accessor list) needs wrapping,
         // skipping trivial field-forwarders.

src/tools/illink/test/ILLink.RoslynAnalyzer.Tests/UnsafeV2MigrationCodeFixTests.cs

@@ -352,6 +352,77 @@ public void M()
             await VerifyCodeFix(source, fixedSource);
         }
 
+        [Fact]
+        public async Task UnsafeMethodWithExistingUnsafeBlockPlusOtherStatements_StillWraps()
+        {
+            // Regression: previously BlockNeedsWrap used DescendantNodes() to look for an
+            // existing unsafe block anywhere in the body, which would suppress wrapping
+            // even when the body had top-level statements (`*p = 0` here) that were
+            // relying on the method-level unsafe context. The fix only skips wrapping
+            // when the body is *exactly* `{ unsafe { ... } }`.
+            var source = """
+                public class C
+                {
+                    public {|IL5006:unsafe|} void M(int* p)
+                    {
+                        unsafe { System.Console.WriteLine(); }
+                        *p = 0;
+                    }
+                }
+                """;
+            var fixedSource = """
+                public class C
+                {
+                    public unsafe void M(int* p)
+                    {
+                        unsafe
+                        {
+                            // SAFETY-TODO: Audit this unsafe usage
+                            unsafe { System.Console.WriteLine(); }
+                            *p = 0;
+                        }
+                    }
+                }
+                """;
+            await VerifyCodeFix(source, fixedSource);
+        }
+
+        [Fact]
+        public async Task UnsafeMethodWithUnsafeBlockNestedInLocalFunction_StillWraps()
+        {
+            // Regression: a nested `unsafe { }` inside a local function does not relieve
+            // the outer method body from needing its own unsafe context (the spec says
+            // 'unsafe' on a member is NOT applied to nested local functions). Previously
+            // we'd skip wrapping because the descendant scan found the nested block.
+            var source = """
+                public class C
+                {
+                    public {|IL5006:unsafe|} void M(int* p)
+                    {
+                        void Inner() { unsafe { System.Console.WriteLine(); } }
+                        Inner();
+                        *p = 0;
+                    }
+                }
+                """;
+            var fixedSource = """
+                public class C
+                {
+                    public unsafe void M(int* p)
+                    {
+                        unsafe
+                        {
+                            // SAFETY-TODO: Audit this unsafe usage
+                            void Inner() { unsafe { System.Console.WriteLine(); } }
+                            Inner();
+                            *p = 0;
+                        }
+                    }
+                }
+                """;
+            await VerifyCodeFix(source, fixedSource);
+        }
+
         [Fact]
         public async Task UnsafeIteratorMethod_WrapsBody_DeveloperFixesFallout()
         {