Add initOpt, VTable fixups, type forwarders

[am11]

• Support .param/.property default values (initOpt)
• Implement VTable fixups and data label references (&Label)
• Emit type forwarders via ExportedType metadata table
• Fix generic parameter emission for types and methods
• Support offset-based exception handler regions
• Fix ExplicitLayout and assembly flag parsing

[dotnet-policy-service]

Tagging subscribers to this area: @JulieLeeMSFT, @dotnet/jit-contrib
See info in area-owners.md if you want to be subscribed.

[jkoritzinsky]

Looks good to me!

Just a few comments here and there. Some of the tests that just validate "does this compile" should be updated to validate that the bits corresponding to the tested flag/bitmask/keyword are present in the correct location

[jkoritzinsky]

What's the coverage we're at now with this PR?

[am11]

44.4%

$ ./dotnet.sh test src/tools/ilasm/tests/ILAssembler.Tests/ILAssembler.Tests.csproj --collect:"XPlat Code Coverage"
$ ./dotnet.sh tool run reportgenerator -reports:"src/tools/ilasm/tests/ILAssembler.Tests/TestResults/*/coverage.cobertura.xml" -targetdir:"src/tools/ilasm/tests/ILAssembler.Tests/TestResults/CoverageReport" -reporttypes:TextSummary
$ cat src/tools/ilasm/tests/ILAssembler.Tests/TestResults/CoverageReport/Summary.txt

Summary
  Generated on: 30.1.2026 - 0.05.35
  Coverage date: 30.1.2026 - 0.05.31
  Parser: Cobertura
  Assemblies: 1
  Classes: 25
  Files: 24
  Line coverage: 44.4%
  Covered lines: 10448
  Uncovered lines: 13046
  Coverable lines: 23494
  Total lines: 33646
  Branch coverage: 35.8% (2203 of 6139)
  Covered branches: 2203
  Total branches: 6139
  Method coverage: 26.1% (849 of 3244)
  Full method coverage: 18.7% (609 of 3244)
  Covered methods: 849
  Fully covered methods: 609
  Total methods: 3244

ILAssembler                                  44.4%
  ILAssembler.BlobBuilderExtensions          12.1%
  ILAssembler.CILBaseListener                   0%
  ILAssembler.CILBaseVisitor<T>                 0%
  ILAssembler.CILLexer                       99.5%
  ILAssembler.CILParser                      35.5%
  ILAssembler.Diagnostic                      100%
  ILAssembler.DocumentCompiler               71.4%
  ILAssembler.EntityRegistry                 64.3%
  ILAssembler.GrammarResult                  72.7%
  ILAssembler.GrammarVisitor                 48.5%
  ILAssembler.InstructionEncoderExtensions    100%
  ILAssembler.Location                        100%
  ILAssembler.MetadataExtensions               30%
  ILAssembler.NamedElementList<T>            20.9%
  ILAssembler.NameHelpers                    78.5%
  ILAssembler.Options                         100%
  ILAssembler.PreprocessedTokenSource          55%
  ILAssembler.SignatureArg                     10%
  ILAssembler.SourceSpan                      100%
  ILAssembler.SourceText                      100%
  ILAssembler.StackExtensions                 100%
  ILAssembler.StringHelpers                  61.9%
  ILAssembler.TypeName                        100%
  ILAssembler.VTableExportPEBuilder          65.7%
  ILAssembler.VTableFixupSupport              7.3%

There seems to be several mechanisms to exclude ILAssembler.CILBaseListener and ILAssembler.CILBaseVisitor<T> (generated code) from the coverlet coverage, but I have only tried the "cleanest" <ExcludeByAttribute>GeneratedCodeAttribute</ExcludeByAttribute> in test csproj, which didn't work. 🤷‍♀️

[am11]

@jkoritzinsky, this completes all the actionable TODOs:

src/tools/ilasm/src/ILAssembler/EntityRegistry.cs:927:            // TODO-COMPAT: The following scenarios are required for compat with the existing ILASM, but are not required to produce valid metadata:
src/tools/ilasm/src/ILAssembler/EntityRegistry.cs:967:            // TODO-SRM: Propose a public API to construct a blob reader over a byte array or ReadOnlyMemory<byte>
src/tools/ilasm/src/ILAssembler/GrammarVisitor.cs:4791:            // TODO-SRM: System.Reflection.Metadata doesn't provide APIs to point a data declaration at a TLS slot or into the IL stream.
src/tools/ilasm/src/ILAssembler/InstructionEncoderExtensions.cs:14:        // TODO-SRM: Propose a public API for this so we don't need to use UnsafeAccessor into the BCL.
src/tools/ilasm/src/ILAssembler/PreprocessedTokenSource.cs:39:        // TODO: Update SourceName to output a string describing the whole "include" stack.

We can create ILAssembler.Cli project with command-line options (like crossgen2/ilc etc. *RootCommand style) next; shall try to match native ilasm CLI as much as possible. Thoughts?

[jkoritzinsky]

Let's name the CLI project ilasm instead of ILAssembler, but yes I think that sounds like a fantastic next step!