What are expression trees in C#? Explain how the compiler turns a lambda into an Expression<TDelegate>, how to build, inspect and compile expression trees at run time, how LINQ providers and libraries use them, what C# features cannot appear in them, and the performance and AOT costs of Compile().

1. Node types

Key classes in System.Linq.Expressions: ParameterExpression, ConstantExpression, MemberExpression, MethodCallExpression, BinaryExpression, UnaryExpression (including Convert, Quote), LambdaExpression/Expression<T>, NewExpression, MemberInitExpression, ConditionalExpression, InvocationExpression, TypeBinaryExpression. Each has a NodeType (ExpressionType enum). Trees are immutable; visitors create modified copies.

2. Combining predicates correctly

static Expression<Func<T, bool>> And<T>(Expression<Func<T, bool>> a, Expression<Func<T, bool>> b)
{
    var p = a.Parameters[0];
    var bBody = new ReplaceParameter(b.Parameters[0], p).Visit(b.Body);
    return Expression.Lambda<Func<T, bool>>(Expression.AndAlso(a.Body, bBody!), p);
}

sealed class ReplaceParameter(ParameterExpression from, ParameterExpression to) : ExpressionVisitor
{
    protected override Expression VisitParameter(ParameterExpression node) => node == from ? to : node;
}

Using Expression.Invoke(b, p) instead also works for in-memory compilation but many providers (older EF versions) don't translate Invoke well.

3. How closures look in trees

var min = 100m;
Expression<Func<Order, bool>> e = o => o.Total > min;
// Body: GreaterThan(Member(o.Total), Member(Constant(<>c__DisplayClass), "min"))

EF Core recognises "member access on a closure constant" and extracts it as a parameter value, enabling plan reuse. A literal 100m instead becomes a SQL literal.

4. Expression trees and the query cache

EF Core computes a structural hash of the tree (ignoring parameter values) to look up compiled queries. Dynamically building trees that embed constants for user values creates a new cache entry (and SQL plan) per value — use closure captures or Expression.Constant wrapped in a closure-like holder to get parameters.

5. Alternatives

• Source generators: compile-time code instead of runtime expression compilation (AOT-friendly).
• Reflection with MethodInvoker/UnsafeAccessor (.NET 8) for fast member access.
• Function pointers/delegates created once.
• Dynamic LINQ libraries (System.Linq.Dynamic.Core) parse strings into expression trees — convenient for admin grids but need careful allow-listing.

Try it yourself

1. Print Expression<Func<Order,bool>> trees with .ToString() and walk them with a custom ExpressionVisitor.
2. Build a dynamic equality filter and use it with EF Core; check ToQueryString().
3. Combine two predicates with the parameter-replacing visitor.
4. Benchmark Compile() once vs per call, and test under NativeAOT to see interpretation.

using System.Linq.Expressions;

namespace Linq.ExpressionTrees;

public sealed record Order(int Id, string Status, decimal Total, string Region);

public static class PredicateBuilder
{
    public static Expression<Func<T, bool>> And<T>(this Expression<Func<T, bool>> left, Expression<Func<T, bool>> right)
    {
        var parameter = left.Parameters[0];
        var rightBody = new ReplaceParameter(right.Parameters[0], parameter).Visit(right.Body)!;
        return Expression.Lambda<Func<T, bool>>(Expression.AndAlso(left.Body, rightBody), parameter);
    }

    private sealed class ReplaceParameter(ParameterExpression from, ParameterExpression to) : ExpressionVisitor
    {
        protected override Expression VisitParameter(ParameterExpression node) => node == from ? to : base.VisitParameter(node);
    }
}

public static class FilterFactory
{
    private static readonly HashSet<string> AllowedFields = [nameof(Order.Status), nameof(Order.Region), nameof(Order.Total)];

    // Build x => x.Field == value from user input, safely (whitelisted members, constant values)
    public static Expression<Func<Order, bool>> Equal(string field, object value)
    {
        if (!AllowedFields.Contains(field)) throw new ArgumentException($"Field '{field}' cannot be filtered.", nameof(field));

        var x = Expression.Parameter(typeof(Order), "x");
        var member = Expression.Property(x, field);
        var constant = Expression.Constant(Convert.ChangeType(value, member.Type), member.Type);
        return Expression.Lambda<Func<Order, bool>>(Expression.Equal(member, constant), x);
    }
}

public static class Program
{
    // Compile once, reuse
    private static readonly Func<Order, bool> IsLarge = ((Expression<Func<Order, bool>>)(o => o.Total > 1_000m)).Compile();

    public static void Main()
    {
        Expression<Func<Order, bool>> open = o => o.Status == "Open";
        var filter = open.And(FilterFactory.Equal("Region", "AU")).And(o => o.Total > 100m);

        Console.WriteLine(filter);   // o => (((o.Status == "Open") AndAlso (o.Region == "AU")) AndAlso (o.Total > 100))

        List<Order> orders = [new(1, "Open", 250m, "AU"), new(2, "Open", 80m, "AU"), new(3, "Closed", 5_000m, "NZ")];
        var matches = orders.AsQueryable().Where(filter).Select(o => o.Id).ToList(); // with EF Core: db.Orders.Where(filter)
        Console.WriteLine(string.Join(",", matches));   // 1

        Console.WriteLine(IsLarge(orders[2]));           // True

        // Expression<Func<Order, int?>> bad = o => o.Status?.Length; // CS8072: no ?. in expression trees
    }
}