DeepCloneFrom / IEnumerable.DeepClone share dictionary values with the source when it is not an IDictionary (e.g. IReadOnlyDictionary, LINQ over a dictionary)

[matt-edmondson]

What's wrong

When the source of a clone is a sequence of KeyValuePair<TKey, TValue> but not statically an IDictionary<TKey, TValue>, overload resolution picks the element-wise overloads with T = KeyValuePair<TKey, TValue>:

• DeepCloneFrom<T>(this ICollection<T> dest, IEnumerable<T> source) (DeepClone/DeepCloneContainerExtensions.cs:36)
• DeepClone<T>(this IEnumerable<T> source) (DeepCloneContainerExtensions.cs:116)

Both clone each element through the private helper at DeepCloneContainerExtensions.cs:97:

private static T DeepClone<T>(T source) => source == null ? default! : source is IDeepCloneable cloneable ? (T)cloneable.DeepClone() : source;

A KeyValuePair<,> never implements IDeepCloneable, so the pair is copied as-is and the key and value objects are shared with the source. Nothing errors.

Repro

var src = new Dictionary<string, Obj> { ["a"] = new Obj() };   // Obj : DeepCloneable<Obj>

var dest = new Dictionary<string, Obj>();
dest.DeepCloneFrom((IReadOnlyDictionary<string, Obj>)src);
ReferenceEquals(dest["a"], src["a"]);            // True  — expected False

var list = src.Where(_ => true).DeepClone().ToList();
ReferenceEquals(list[0].Value, src["a"]);        // True  — expected False

The same thing happens with any IEnumerable<KeyValuePair<,>> source, such as an IReadOnlyDictionary, ImmutableDictionary exposed through an interface, or a LINQ projection over a dictionary.

Why it matters

The caller asked for a deep clone and got one back without any error, but the values are the original instances. Mutating the "clone" then mutates the source. This is the kind of aliasing bug the library exists to prevent. The IDictionary overload of DeepCloneFrom does clone both key and value, so the result depends on the static type the caller happened to hold.

Suggested fix

Either of these works:

• In the private helper, detect KeyValuePair<TKey, TValue> and rebuild the pair from DeepClone(pair.Key) and DeepClone(pair.Value).
• Add explicit overloads: DeepCloneFrom<TKey, TValue>(this IDictionary<TKey, TValue> dest, IEnumerable<KeyValuePair<TKey, TValue>> source) and DeepClone<TKey, TValue>(this IEnumerable<KeyValuePair<TKey, TValue>> source). Check that these don't reintroduce the CS0121 ambiguity tracked in dictionary.DeepClone() fails to compile (CS0121 ambiguous call) for Dictionary, SortedDictionary and ConcurrentDictionary, although the XML doc example shows that call #81.

Acceptance: the repro above returns False in both cases, with a regression test for each of IReadOnlyDictionary and a LINQ-filtered source.

[matt-edmondson]

Triage

• Category: Bug
• Priority: High. A "deep clone" silently shares its values with the source, so mutating the clone mutates the original. That defeats the library's core guarantee, and it depends only on the static type the caller happens to hold (IReadOnlyDictionary, LINQ over a dictionary).
• Area / suggested owner: DeepCloneContainerExtensions, the element-wise overloads and the private DeepClone<T> helper (maintainer: matt-edmondson).
• Related: dictionary.DeepClone() fails to compile (CS0121 ambiguous call) for Dictionary, SortedDictionary and ConcurrentDictionary, although the XML doc example shows that call #81 (CS0121 ambiguity on the dictionary overloads). Any new IEnumerable<KeyValuePair<,>> overloads must not reintroduce that ambiguity, which makes the private-helper KeyValuePair detection the lower-risk option. Also related: IEnumerable<T>.DeepClone() returns a lazy view: edits to the cloned items are lost, and the clone changes whenever the source changes #80 (IEnumerable.DeepClone() returns a lazy view), since the fix will touch the same overload.
• Duplicates / in progress: None found. No open PR covers this.
• Next step: Rebuild KeyValuePair<TKey, TValue> from deep-cloned key and value in the private helper, and add regression tests for an IReadOnlyDictionary source and a LINQ-filtered source.

---

Generated by Claude Code