.NET 10 RC 2: If statement evaluates incorrectly even everything is in order

[r-oelsner]

Description

I am very sorry if this report is not up to expected standards but this is my first time reporting.
I observed a strange behaviour that i cannot even describe clearly with words alone.

I am using:
Windows 10
VisualStudio 2026 (Insiders [11111.16])
.net 10.0.100-rc.2

The issue i got is related in evaluating Expressions for a custom implemented IQueryProvider. The code that causes the issue worked perfectly fine in .net8 as well as .net9.

Also this issue only occurs in Release-Builds and does not happen for Debug-Builds, for me that is so far.

`

private static void QueryableTakeHandler(ref AggregateStatementContext state, Expression source, MethodCallExpression take)
{
	if ( state.IsClosed )
		throw new InvalidOperationException("Context is already closed.");

	Expression value = take.Arguments[1].Resolve();

	if ( value is not ConstantExpression constant || !constant.Type.Equals(typeof(int)) || constant.Value == null )
		throw new InvalidOperationException("Linq.Take: Argument expression could not be resolved to a constant expression.");

	state.Add(new AggregateSegment { Type = DefinitionType.Limit, Expression = constant });
}

`

Since .net10 the if-statement evaluates that the Expression is not valid and so the InvalidOperationException in thrown. To figure out what is going on i changed the code to:

`

private static void QueryableTakeHandler(ref AggregateStatementContext state, Expression source, MethodCallExpression take)
{
	if ( state.IsClosed )
		throw new InvalidOperationException("Context is already closed.");

	Expression value = take.Arguments[1].Resolve();
	ConstantExpression? constant = value as ConstantExpression;

	if ( constant == null || !constant.Type.Equals(typeof(int)) || constant.Value == null )
		throw new InvalidOperationException($"Linq.Take: Argument expression could not be resolved to a constant expression. ({value.GetType().FormatName()} | {((constant != null) ? constant.Type.FormatName() : "")} | {((constant != null) ? constant.Value ?? "" : "")})");

	state.Add(new AggregateSegment { Type = DefinitionType.Limit, Expression = constant });
}

`

With this change the Exception is still thrown and looks like this:
Linq.Take: Argument expression could not be resolved to a constant expression. (ConstantExpression | Int32 | 25)

The weird part comes now. When i switch places of !constant.Type.Equals(typeof(int)) and constant.Value == null, so that the Null-Check is done first and the Type-Check second then everything works just fine.

`

private static void QueryableTakeHandler(ref AggregateStatementContext state, Expression source, MethodCallExpression take)
{
	if ( state.IsClosed )
		throw new InvalidOperationException("Context is already closed.");

	Expression value = take.Arguments[1].Resolve();
	ConstantExpression? constant = value as ConstantExpression;

	if ( constant == null || constant.Value == null || !constant.Type.Equals(typeof(int)) )
		throw new InvalidOperationException($"Linq.Take: Argument expression could not be resolved to a constant expression. ({value.GetType().FormatName()} | {((constant != null) ? constant.Type.FormatName() : "")} | {((constant != null) ? constant.Value ?? "" : "")})");

	state.Add(new AggregateSegment { Type = DefinitionType.Limit, Expression = constant });
}

`

I am not sure if this is the right place to post this issue and i do not even know if it is related to .net10 or may be an Compiler issue (code-optimization?).

If there is anything i can provide additionally i will happily do so because i think this is wild one.

Best regards
R.Oelsner

Reproduction Steps

I do not know if this can be reproduced. On my setup it is enough to change the order of checks in the if-statement mentioned in the description

Expected behavior

I expect that the behaviour of the if-statement should not change in any way.

Actual behavior

The if-statement evaluates that the Expression is invalid even if the Expression is perfectly fine

Regression?

This code was in place at least since 16.04.2024 (.net 8.0.203). Because of a bigger refactoring its hard to get the full history but i think this should be enough i hope.

Known Workarounds

The workaround is explained in the description but i do not know if this is only an issue for me or if this is a general issue.

Configuration

Windows 10 Pro x64 (22H2 Build: 19045.6332)
VisualStudio 2026 (Insiders [11111.16])
.net 10.0.100-rc.2

Other information

No response

[dotnet-policy-service]

Tagging subscribers to this area: @cston
See info in area-owners.md if you want to be subscribed.

[cston]

@jaredpar, @333fred

[AndyAyersMS]

Seems possible this is a codegen issue, if it works in debug. ping @dotnet/jit-contrib

[r-oelsner]

Sry far the delayed reaction @AndyAyersMS.
Thank you for your reply but like i mentioned i am doing this for the first time and i do not understand what 'ping @dotnet/jit-contrib' means in this context.

How is this 'ping @dotnet/jit-contrib' done?

[AndyAyersMS]

How is this 'ping @dotnet/jit-contrib' done?

Right now we don't know what is causing the problem you've reported. It could be something in the C# compiler or something in the runtime JIT. I wanted to notify all the people who work on the JIT that this issue may be relevant and that one of us should investigate.

[AndyAyersMS]

@r-oelsner is it possible for you to give a more complete (compilable and runnable) example?

[AndyAyersMS]

FWIW I had copilot generate the code needed to compile and run, but so far this does not reproduce the bug you've reported:

using System;
using System.Collections.Generic;
using System.Linq;
using System.Linq.Expressions;
using System.Runtime.CompilerServices;

class Problem
{
    // Existing handler
    static void QueryableTakeHandler(ref AggregateStatementContext state, Expression source, MethodCallExpression take)
    {
        if (state.IsClosed)
            throw new InvalidOperationException("Context is already closed.");

        Expression value = take.Arguments[1].Resolve();

        if (value is not ConstantExpression constant || !constant.Type.Equals(typeof(int)) || constant.Value == null)
            throw new InvalidOperationException("Linq.Take: Argument expression could not be resolved to a constant expression.");

        state.Add(new AggregateSegment { Type = DefinitionType.Limit, Expression = constant });
    }

    // Added Main to demonstrate calling the handler
    static void Main()
    {
        // Source data for the Take call
        var sourceData = new int[] { -1, -2, -3, -4, -5 };
        Expression sourceExpr = Expression.Constant(sourceData);

        // Find generic Enumerable.Take<T>(IEnumerable<T>, int)
        var takeMethod = typeof(Enumerable)
            .GetMethods()
            .First(m => m.Name == nameof(Enumerable.Take)
                     && m.GetParameters().Length == 2
                     && m.GetParameters()[1].ParameterType == typeof(int))
            .MakeGenericMethod(typeof(int));

        // Constant count argument
        var countExpr = Expression.Constant(2, typeof(int));

        // Build the MethodCallExpression representing sourceData.Take(3)
        var takeCall = Expression.Call(takeMethod, sourceExpr, countExpr);

        var ctx = new AggregateStatementContext();

        for (int i = 0; i < 100_000; i++)
        {
            // Initialize aggregate statement context
            ctx = new AggregateStatementContext();

            // Invoke the handler
            QueryableTakeHandler(ref ctx, sourceExpr, takeCall);

            if (i % 10_000 == 0)
            {
                Console.WriteLine($"Iteration {i} completed.");
                Thread.Sleep(100);
            }
        }

        // Inspect what was recorded
        if (ctx.Segments.Count > 0)
        {
            var limitSegment = ctx.Segments.First(s => s.Type == DefinitionType.Limit);
            var constExpr = (ConstantExpression)limitSegment.Expression;
            Console.WriteLine($"Limit captured: {constExpr.Value}");
        }
        else
        {
            Console.WriteLine("No segments recorded.");
        }
    }
}

// ----- Supporting stub types (lightweight placeholders) -----

static class ExpressionExtensions
{
    // Placeholder Resolve: in real code this would evaluate / simplify expression trees.
    [MethodImpl(MethodImplOptions.NoInlining)]
    public static Expression Resolve(this Expression expr) => expr;
}

enum DefinitionType
{
    Limit
}

class AggregateSegment
{
    public DefinitionType Type { get; set; }
    public Expression Expression { get; set; } = default!;
}

class AggregateStatementContext
{
    public bool IsClosed { get; private set; }
    public List<AggregateSegment> Segments { get; } = new();

    public void Add(AggregateSegment segment)
    {
        if (IsClosed) throw new InvalidOperationException("Cannot add to a closed context.");
        Segments.Add(segment);
    }

    public void Close() => IsClosed = true;
}

[r-oelsner]

@AndyAyersMS Thanks for your help :)

I will try to prepare a stripded-down example that is compilable+runnable and still has the issue but this will take a bit of time, probably 1-2 days

[r-oelsner]

Ok i got a running example that will trigger the issue

`

// See https://aka.ms/new-console-template for more information

using System.Linq.Expressions;
using System.Reflection;

IEnumerable<int> values = Enumerable.Range(1, 10);
IQueryable<int> query = values.AsQueryable();

IQueryable<int> query2 = query.Where(e => e > 1).Take(5);
IQueryable<string> query3 = query.Where(static e => e > 1).Select(static e => $"{e}").Take(5);

for ( int i = 0; i < 10000; i++ )
{
	Parallel.For(0, 10000, new ParallelOptions
	{
		MaxDegreeOfParallelism = 12,
	}, (e, c) =>
	{
		query2 = query.Where(e => e > 1).Take(5);

		Expression expr = query2.Expression;

		MethodCallExpression mce = (MethodCallExpression) expr;

		expr.QueryableTakeHandlerWithIssue(mce);
	});
}

Console.WriteLine("Hello, World!");


static class Extensions
{
	public static void QueryableTakeHandlerWithoutIssue(this Expression source, MethodCallExpression take)
	{
		Expression value = take.Arguments[1].Resolve();
		ConstantExpression? constant = value as ConstantExpression;

		if ( constant == null || constant.Value == null || !constant.Type.Equals(typeof(int)) )
			throw new InvalidOperationException($"Linq.Take: Argument expression could not be resolved to a constant expression. ({value.GetType().Name} | {((constant != null) ? constant.Type.Name : "")} | {((constant != null) ? constant.Value ?? "" : "")})");
	}

	public static void QueryableTakeHandlerWithIssue(this Expression source, MethodCallExpression take)
	{
		Expression value = take.Arguments[1].Resolve();
		ConstantExpression? constant = value as ConstantExpression;

		if ( constant == null || !constant.Type.Equals(typeof(int)) || constant.Value == null )
			throw new InvalidOperationException($"Linq.Take: Argument expression could not be resolved to a constant expression. ({value.GetType().Name} | {((constant != null) ? constant.Type.Name : "")} | {((constant != null) ? constant.Value ?? "" : "")})");
	}

	public static Expression Resolve(this Expression? expression)
	{
		if ( expression == null )
			return Expression.Constant(null);

		if ( expression is MemberExpression me )
		{
			Expression target = Resolve(me.Expression);

			if ( target is not ConstantExpression ce )
				return expression;

			if ( me.Member is PropertyInfo prop )
				return Expression.Constant(prop.GetValue(ce.Value));
			else if ( me.Member is FieldInfo field )
				return Expression.Constant(field.GetValue(ce.Value));
		}
		else if ( expression is UnaryExpression ue )
		{
			if ( ue.NodeType != ExpressionType.Quote && ue.NodeType != ExpressionType.Convert )
				return ue;

			if ( ue.NodeType == ExpressionType.Quote || ue.Method == null )
				return Resolve(ue.Operand);

			var result = Resolve(ue.Operand);

			if ( result is not ConstantExpression ce )
				return ue;

			return Expression.Constant(ue.Method.Invoke(null, [ce.Value]), ue.Type);
		}
		else if ( expression is LambdaExpression le )
		{
			return Resolve(le.Body);
		}
		else if ( expression is MethodCallExpression mce )
		{
			Expression target = Resolve(mce.Object);

			if ( target is not ConstantExpression ce )
				return expression;

			object?[] args = new object?[mce.Arguments.Count];
			ParameterInfo[] @params = mce.Method.GetParameters();
			int index = 0;

			Array.Sort(@params, static (l, r) => (l.Position < r.Position) ? -1 : (l.Position > r.Position) ? 1 : 0);

			foreach ( Expression argument in mce.Arguments )
			{
				object? arg = null;
				Expression argExp = argument;

				if ( argExp is not LambdaExpression lea )
					argExp = Resolve(argument);
				else
					arg = lea.Compile();

				if ( argExp is ConstantExpression c )
					arg = c.Value;
				else if ( arg == null )
					return expression;

				if ( !@params[index].ParameterType.IsAssignableFrom(argExp.Type) )
					throw new InvalidCastException($"The argument at index '{index}' was resolved to type '{argExp.Type.Name}'. This type is cannot be assigned to method parameter '{@params[index].Name}' with type '{@params[index].ParameterType.Name}'.");

				args[index] = arg;
				index++;
			}

			return Expression.Constant(mce.Method.Invoke(ce.Value, args));
		}
		else if ( expression is InvocationExpression ie )
		{
			Expression target = Resolve(ie.Expression);

			if ( target is not ConstantExpression ce || ce.Value is not Delegate @delegate )
				return expression;

			object?[] args = new object?[ie.Arguments.Count];
			int index = 0;

			foreach ( Expression argument in ie.Arguments )
			{
				Expression arg = Resolve(argument);

				if ( arg is not ConstantExpression c )
					return expression;

				args[index] = c.Value;
				index++;
			}

			return Expression.Constant(@delegate.DynamicInvoke(args));
		}
		else if ( expression is BinaryExpression be )
		{
			Expression left = Resolve(be.Left);
			Expression right = Resolve(be.Right);

			if ( left is not ConstantExpression l || right is not ConstantExpression r )
				return expression;

			if ( be.NodeType == ExpressionType.ArrayIndex )
			{
				Array arr = (Array) l.Value!;
				object val = arr.GetValue((int) r.Value!)!;

				return Expression.Constant(val, val.GetType());
			}

			object[] args = [l.Value!, r.Value!];

			return Expression.Constant(be.Method!.Invoke(null, args));
		}

		return expression;
	}
}

`

A think i also recognized is that it seems to be related to JIT but i may be wrong.
When running the Testcode with for-loop + Parallel.For and ranges from 0-1000 the error does not occur but when the ranges get changed to 0-10000 for both loops then the issue pops up (code optimization for hot pathes during runtime?).

The Resolve-Method is the actual code and not some dummy/mockup for the Test-Code. Its not a nice method but it works for me :D

I compile and run in release without debugger attached.

global.json:
`

{
	"sdk": {
		"version": "10.0.100-rc.2"
	}
}

Directory.Build.targets:

<Project>

	<PropertyGroup>
		<LangVersion>preview</LangVersion>
	</PropertyGroup>

	<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|AnyCPU'">
		<Optimize>False</Optimize>
	  <TreatWarningsAsErrors>True</TreatWarningsAsErrors>
		<NoWarn>1701;1702;NU5104</NoWarn>
	</PropertyGroup>

	<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|AnyCPU'">
		<Optimize>True</Optimize>
	  <TreatWarningsAsErrors>True</TreatWarningsAsErrors>
		<NoWarn>1701;1702;NU5104</NoWarn>
	</PropertyGroup>

	<ItemGroup>
		<AssemblyAttribute Include="System.Runtime.CompilerServices.InternalsVisibleTo">
			<_Parameter1>$(MSBuildProjectName).Tests</_Parameter1>
		</AssemblyAttribute>
	</ItemGroup>

</Project>

`

[dotnet-policy-service]

Tagging subscribers to this area: @JulieLeeMSFT, @jakobbotsch
See info in area-owners.md if you want to be subscribed.

[jakobbotsch]

Thanks for providing the self-contained repro example. I was able to reproduce it using that.

I bisected the issue to the range 12e176d...43236f8.
I think #113360 looks most likely, cc @EgorBo