From bfa3f1898048e7ad14f71a741f07afcf3ec2127f Mon Sep 17 00:00:00 2001 From: Siegfried Pammer Date: Sun, 6 Sep 2026 19:41:14 +0200 Subject: [PATCH] TransformExpressionTrees: do not crash on a lambda that did not convert The builder returned by ConvertLambda hands back null when a nested conversion declines, and the result was cast and dereferenced before anything checked it, so a tree the transform cannot handle took down the whole method with a NullReferenceException instead of being left alone. EF Core's StringCharConverter.ToChar is such a tree: the conditional spills the Expression.Call arguments into stack slots, which MatchGetMethodFromHandle does not see through. Assisted-by: Claude:claude-opus-5:Claude Code --- .../IL/Transforms/TransformExpressionTrees.cs | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/ICSharpCode.Decompiler/IL/Transforms/TransformExpressionTrees.cs b/ICSharpCode.Decompiler/IL/Transforms/TransformExpressionTrees.cs index e37d552ff..8d593935d 100644 --- a/ICSharpCode.Decompiler/IL/Transforms/TransformExpressionTrees.cs +++ b/ICSharpCode.Decompiler/IL/Transforms/TransformExpressionTrees.cs @@ -171,8 +171,11 @@ namespace ICSharpCode.Decompiler.IL.Transforms if (lambda != null) { context.Step("Convert Expression Tree", instruction); - var newLambda = (ILFunction)lambda(); - if (newLambda == null) + // A builder returns null where a nested conversion declined; the cast has to + // tolerate that, and anything that is not an ILFunction is no lambda to put + // in the call's place either. The tree then stays as the Expression calls + // that built it. + if (lambda() is not ILFunction newLambda) return false; SetExpressionTreeFlag(newLambda, (CallInstruction)instruction); instruction.ReplaceWith(newLambda);