Duplicate identical SQL parameters with set operations

[bedpans]

Bug description

The following code outputs SQL query with two parameters whose values are identical. Query itself doesn't make sense, but it demonstrates the issue.

Code:

var query1 = dbContext.Products.Where(x => storeIds.Contains(x.StoreId)).Select(x => x.ProductId);
var query2 = dbContext.Employees.Where(x => storeIds.Contains(x.StoreId)).Select(x => x.EmployeeId);
var query3 = query1.Union(query2);
Console.WriteLine(query3.ToQueryString());

Output:

DECLARE @storeIds1 uniqueIdentifier = '4a3aa2fa-deec-4880-91de-0bfe05d9c272';
DECLARE @storeIds2 uniqueIdentifier = '4a3aa2fa-deec-4880-91de-0bfe05d9c272';

SELECT [p].[product_id]
FROM [products] AS [p]
WHERE [p].[store_id] = @storeIds1
UNION
SELECT [e].[employee_id] AS [product_id]
FROM [employees] AS [e]
WHERE [e].[store_id] = @storeIds2

This by itself might be not a big issue, however I have noticed that removing and/or adding navigation properties can eliminate duplicate parameter resulting in a query like this:

DECLARE @storeIds1 uniqueIdentifier = 'c2232ea2-24b4-4be5-8d63-1d0425d8f435';

SELECT [p].[product_id]
FROM [products] AS [p]
WHERE [p].[store_id] = @storeIds1
UNION
SELECT [e].[employee_id] AS [product_id]
FROM [employees] AS [e]
WHERE [e].[store_id] = @storeIds1

This problem wasn't trivial to repeat for me, so I prepared a Visual Studio project where issue can be reproduced:
Solution1.zip

This also happens on EF Core 8 and EF Core 9, although queries are slightly different.

If this behavior is intentional could you provide an explanation why this is happening?

Your code

Solution1.zip

Stack traces

Verbose output

EF Core version

10.0.5

Database provider

Microsoft.EntityFrameworkCore.SqlServer

Target framework

.NET 10.0

Operating system

Windows 11

IDE

Visual Studio 2026 18.4.3

[roji]

AI Triage

The below is an AI-generated analysis and may contain inaccuracies.

Summary

Confirmed bug. When a model has asymmetric navigation properties (e.g. Store has a Products navigation but no Employees navigation), a Union query using the same collection parameter (storeIds.Contains(...)) in both branches generates duplicate SQL parameters with the same value.

Functionally the query produces the right but it sends redundant parameter data.results correct

Root Cause

The issue is in SqlNullabilityProcessor._collectionParameterExpansionMap, which uses SqlParameterExpression as its dictionary key. SqlParameterExpression.Equals() delegates to SqlExpression.Equals(), which compares TypeMapping via TypeMapping.Equals(). Since CoreTypeMapping does not override Equals/GetHashCode, this falls back to reference equality.

In the asymmetric navigation case, the two Union branches end up with different SqlParameterExpression instances whose TypeMapping instances (both SqlServerStringTypeMapping for nvarchar(max)) are logically identical but different object references. This causes _collectionParameterExpansionMap.GetOrAddNew(valuesParameter) to fail to find the existing entry, creating duplicate expanded parameters.

When navigations are symmetric (both or neither exist), the type mapping instances happen to be the same reference (both resolved from the same FK path), so Equals returns true and deduplication works.

The parameter extraction phase (funcletizer) correctly it's the later SqlNullabilityProcessor collection parameter expansion that breaks.deduplicates

Reproduction

The bug reproduces on the current main branch (EF 11 preview). The user also reports it on EF 8, 9, and 10. This is not a it appears to be a long-standing issue since collection parameter expansion was introduced.regression

Minimal repro

using System;
using System.Collections.Generic;
using System.Linq;
using Microsoft.EntityFrameworkCore;
using Microsoft.Extensions.Logging;

await using var context = new TestContext();

var storeIds = new[] { Guid.NewGuid() };

var query1 = context.Products.Where(x => storeIds.Contains(x.StoreId)).Select(x => x.ProductId);
var query2 = context.Employees.Where(x => storeIds.Contains(x.StoreId)).Select(x => x.EmployeeId);
var query3 = query1.Union(query2);
Console.WriteLine(query3.ToQueryString());

// Expected: single @storeIds1 parameter
// Actual:   @storeIds1 and @storeIds2 with the same value

public class TestContext : DbContext
{
    public DbSet<Product> Products => Set<Product>();
    public DbSet<Employee> Employees => Set<Employee>();

    protected override void OnConfiguring(DbContextOptionsBuilder optionsBuilder)
        => optionsBuilder
            .UseSqlServer("Server=.;Database=Test;Trusted_Connection=True;TrustServerCertificate=True")
            .LogTo(Console.WriteLine, LogLevel.Information)
            .EnableSensitiveDataLogging();

    protected override void OnModelCreating(ModelBuilder modelBuilder)
    {
        modelBuilder.Entity<Store>(b =>
        {
            b.ToTable("stores");
            b.HasKey(x => x.StoreId);
            b.Property(x => x.StoreId).HasColumnName("store_id");
        });

        modelBuilder.Entity<Product>(b =>
        {
            b.ToTable("products");
            b.HasKey(x => x.ProductId);
            b.Property(x => x.ProductId).HasColumnName("product_id").ValueGeneratedOnAdd();
            b.Property(x => x.StoreId).HasColumnName("store_id");
        });

        modelBuilder.Entity<Employee>(b =>
        {
            b.ToTable("employees");
            b.HasKey(x => x.EmployeeId);
            b.Property(x => x.EmployeeId).HasColumnName("employee_id").ValueGeneratedOnAdd();
            b.Property(x => x.StoreId).HasColumnName("store_id");
        });
    }
}

// Key: Store has Products navigation but NOT  this asymmetry triggers the bugEmployees 
public class Store
{
    public Guid StoreId { get; set; }
    public List<Product> Products { get; } = [];
}

public class Product
{
    public Guid ProductId { get; set; }
    public Guid StoreId { get; set; }
}

public class Employee
{
    public Guid EmployeeId { get; set; }
    public Guid StoreId { get; set; }
}

Possible Fix Approaches

1. Change _collectionParameterExpansionMap key to use InvariantName (or Name) string instead of SqlParameterExpression, since the expansion is about the parameter value, not the specific expression instance.
2. Implement Equals/GetHashCode on CoreTypeMapping for structural this would fix this issue and potentially others where type mapping comparison matters (see also TODO in RelationalParameterProcessor.VisitSqlParameter).equality

Possible Duplicates

• https://github.com/dotnet/efcore/issues/ Same symptom (duplicate parameters in Union/Concat), was partially fixed by PR #23437 which addressed the funcletizer-level deduplication. The remaining issue in SqlNullabilityProcessor was not addressed.23271
• https://github.com/dotnet/efcore/issues/ Feature request to reduce repeating parameters (closed as not planned).28768

[roji]

Thanks for filing - confirmed the bug. This seems ot be a relatively minor issue with no functional impact - only a limited performance impact as the parameter is needlessly duplicated. We also know of other cases where parameter deduplication is difficult, as we need to be sure that type mappings (i.e. the database type that the parameter gets sent as) are identical, and EF doesn't currently have a good way to do this.

I'll go ahead and put this in the backlog as a future improvement - we'll prioritize based on additional user reports etc., as usual.