System.NullReferenceException: at ICSharpCode.Decompiler.CSharp.TranslatedExpression.ConvertTo()

[greenozon]

Input code

Save code

see the error:

Erroneous output

Error decompiling @06001820 NuGet.ProjectManager.RemovePackageReferenceFromProject
in assembly "C:\app-0.0.306\Squirrel.exe"
 ---> System.NullReferenceException: Object reference not set to an instance of an object.
   at ICSharpCode.Decompiler.CSharp.TranslatedExpression.ConvertTo(IType targetType, ExpressionBuilder expressionBuilder, Boolean checkForOverflow, Boolean allowImplicitConversion) in offset 331
   at ICSharpCode.Decompiler.CSharp.StatementBuilder.VisitLeave(Leave inst) in offset 97
   at ICSharpCode.Decompiler.CSharp.StatementBuilder.Convert(ILInstruction inst) in offset 14
   at ICSharpCode.Decompiler.CSharp.StatementBuilder.ConvertBlockContainer(BlockStatement blockStatement, BlockContainer container, IEnumerable`1 blocks, Boolean isLoop) in offset 0
   at ICSharpCode.Decompiler.CSharp.StatementBuilder.ConvertBlockContainer(BlockContainer container, Boolean isLoop) in offset 6
   at ICSharpCode.Decompiler.CSharp.StatementBuilder.VisitBlockContainer(BlockContainer container) in offset 160
   at ICSharpCode.Decompiler.CSharp.StatementBuilder.Convert(ILInstruction inst) in offset 14
   at ICSharpCode.Decompiler.CSharp.StatementBuilder.ConvertAsBlock(ILInstruction inst) in offset 0
   at ICSharpCode.Decompiler.CSharp.ExpressionBuilder.TranslateFunction(IType delegateType, ILFunction function) in offset 155
   at ICSharpCode.Decompiler.CSharp.ExpressionBuilder.VisitILFunction(ILFunction function, TranslationContext context) in offset 0
   at ICSharpCode.Decompiler.IL.ILFunction.AcceptVisitor[C,T](ILVisitor`2 visitor, C context) in offset 0
   at ICSharpCode.Decompiler.CSharp.ExpressionBuilder.Translate(ILInstruction inst, IType typeHint) in offset 41
   at ICSharpCode.Decompiler.CSharp.CallBuilder.BuildArgumentList(ExpectedTargetDetails expectedTargetDetails, ResolveResult target, IMethod method, Int32 firstParamIndex, IReadOnlyList`1 callArguments, IReadOnlyList`1 argumentToParameterMap) in offset 199
   at ICSharpCode.Decompiler.CSharp.CallBuilder.Build(OpCode callOpCode, IMethod method, IReadOnlyList`1 callArguments, IReadOnlyList`1 argumentToParameterMap, IType constrainedTo) in offset 418
   at ICSharpCode.Decompiler.CSharp.CallBuilder.Build(CallInstruction inst) in offset 308
   at ICSharpCode.Decompiler.CSharp.ExpressionBuilder.VisitCall(Call inst, TranslationContext context) in offset 19
   at ICSharpCode.Decompiler.IL.Call.AcceptVisitor[C,T](ILVisitor`2 visitor, C context) in offset 0
   at ICSharpCode.Decompiler.CSharp.ExpressionBuilder.Translate(ILInstruction inst, IType typeHint) in offset 41
   at ICSharpCode.Decompiler.CSharp.ExpressionBuilder.VisitStLoc(StLoc inst, TranslationContext context) in offset 0
   at ICSharpCode.Decompiler.IL.StLoc.AcceptVisitor[C,T](ILVisitor`2 visitor, C context) in offset 0
   at ICSharpCode.Decompiler.CSharp.ExpressionBuilder.Translate(ILInstruction inst, IType typeHint) in offset 41
   at ICSharpCode.Decompiler.CSharp.StatementBuilder.VisitStLoc(StLoc inst) in offset 0
   at ICSharpCode.Decompiler.CSharp.StatementBuilder.Convert(ILInstruction inst) in offset 14
   at ICSharpCode.Decompiler.CSharp.StatementBuilder.ConvertBlockContainer(BlockStatement blockStatement, BlockContainer container, IEnumerable`1 blocks, Boolean isLoop) in offset 0
   at ICSharpCode.Decompiler.CSharp.StatementBuilder.ConvertBlockContainer(BlockContainer container, Boolean isLoop) in offset 6
   at ICSharpCode.Decompiler.CSharp.StatementBuilder.VisitBlockContainer(BlockContainer container) in offset 160
   at ICSharpCode.Decompiler.CSharp.StatementBuilder.Convert(ILInstruction inst) in offset 14
   at ICSharpCode.Decompiler.CSharp.StatementBuilder.ConvertAsBlock(ILInstruction inst) in offset 0
   at ICSharpCode.Decompiler.CSharp.CSharpDecompiler.DecompileBody(IMethod method, EntityDeclaration entityDecl, DecompileRun decompileRun, ITypeResolveContext decompilationContext) in offset 617
-- continuing with outer exception (ICSharpCode.Decompiler.DecompilerException) --
   at ICSharpCode.Decompiler.CSharp.CSharpDecompiler.DecompileBody(IMethod method, EntityDeclaration entityDecl, DecompileRun decompileRun, ITypeResolveContext decompilationContext) in offset 832
   at ICSharpCode.Decompiler.CSharp.CSharpDecompiler.DoDecompile(IMethod method, DecompileRun decompileRun, ITypeResolveContext decompilationContext) in offset 195
   at ICSharpCode.Decompiler.CSharp.CSharpDecompiler.Decompile(IEnumerable`1 definitions) in offset 370
   at ICSharpCode.ILSpy.CSharpLanguage.DecompileMethod(IMethod method, ITextOutput output, DecompilationOptions options) in offset 247
   at ICSharpCode.ILSpy.TextView.DecompilerTextView.DecompileNodes(DecompilationContext context, ITextOutput textOutput) in offset 124
   at ICSharpCode.ILSpy.TextView.DecompilerTextView.<>c__DisplayClass48_0.<DecompileAsync>b__0() in offset 36

Details

• Product in use: ILSpy 6.1 release

Squirrel.zip

[dgrunwald]

The problem is an expression tree that has ReturnType == null.

[dgrunwald]

Root cause seems to be that this assembly has two mscorlib references, both to version 2.0 and 4.0. It looks like ilmerge was used to combine multiple assemblies with different target frameworks.
This confuses our type system, resulting in an UnknownType for System.Func.

This in turn means we can't find the Invoke method and thus lack a return type. Apparently the expression tree transform then uses null instead of the usual SpecialType.UnknownType. This later causes a crash as we assume return types to never null.
I've fixed the crash by adding a fallback to SpecialType.UnknownType on this code path; but the decompilation result is still extremely poor due to the type system issues.