From 0cd298b70404af94d4c40c512eca5d74833d9569 Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Tue, 6 Jan 2026 23:49:21 +0000
Subject: [PATCH 01/12] Initial plan


From 185a1feda0eabd8bd3c4bf0088d659e438e0ccaa Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Wed, 7 Jan 2026 00:19:50 +0000
Subject: [PATCH 02/12] Support constructors with byref (in/ref/out) parameters
 in System.Text.Json

- ObjectConverterFactory: Use underlying element type for byref parameters when validating and creating generic type arguments
- DefaultJsonTypeInfoResolver.Helpers: Store underlying element type in JsonParameterInfoValues
- ReflectionEmitMemberAccessor: Handle byref parameters in IL generation by using Ldarga/Ldloca

Co-authored-by: stephentoub <2642209+stephentoub@users.noreply.github.com>
---
 .../Object/ObjectConverterFactory.cs          | 19 +++++-
 .../DefaultJsonTypeInfoResolver.Helpers.cs    |  9 ++-
 .../Metadata/ReflectionEmitMemberAccessor.cs  | 66 +++++++++++++++----
 3 files changed, 78 insertions(+), 16 deletions(-)

diff --git a/src/libraries/System.Text.Json/src/System/Text/Json/Serialization/Converters/Object/ObjectConverterFactory.cs b/src/libraries/System.Text.Json/src/System/Text/Json/Serialization/Converters/Object/ObjectConverterFactory.cs
index b82733f5917920..3fd974fdc5516a 100644
--- a/src/libraries/System.Text.Json/src/System/Text/Json/Serialization/Converters/Object/ObjectConverterFactory.cs
+++ b/src/libraries/System.Text.Json/src/System/Text/Json/Serialization/Converters/Object/ObjectConverterFactory.cs
@@ -62,7 +62,14 @@ public override JsonConverter CreateConverter(Type typeToConvert, JsonSerializer
                 foreach (ParameterInfo parameter in parameters)
                 {
                     // Every argument must be of supported type.
-                    JsonTypeInfo.ValidateType(parameter.ParameterType);
+                    // For byref parameters (in/ref/out), validate the underlying element type.
+                    Type parameterType = parameter.ParameterType;
+                    if (parameterType.IsByRef)
+                    {
+                        parameterType = parameterType.GetElementType()!;
+                    }
+
+                    JsonTypeInfo.ValidateType(parameterType);
                 }
 
                 if (parameterCount <= JsonConstants.UnboxedParameterCountThreshold)
@@ -75,7 +82,15 @@ public override JsonConverter CreateConverter(Type typeToConvert, JsonSerializer
                     {
                         if (i < parameterCount)
                         {
-                            typeArguments[i + 1] = parameters[i].ParameterType;
+                            // For byref parameters (in/ref/out), use the underlying element type
+                            // since byref types cannot be used as generic type arguments.
+                            Type parameterType = parameters[i].ParameterType;
+                            if (parameterType.IsByRef)
+                            {
+                                parameterType = parameterType.GetElementType()!;
+                            }
+
+                            typeArguments[i + 1] = parameterType;
                         }
                         else
                         {
diff --git a/src/libraries/System.Text.Json/src/System/Text/Json/Serialization/Metadata/DefaultJsonTypeInfoResolver.Helpers.cs b/src/libraries/System.Text.Json/src/System/Text/Json/Serialization/Metadata/DefaultJsonTypeInfoResolver.Helpers.cs
index d7aef7399c0b49..dd5b3d519adc82 100644
--- a/src/libraries/System.Text.Json/src/System/Text/Json/Serialization/Metadata/DefaultJsonTypeInfoResolver.Helpers.cs
+++ b/src/libraries/System.Text.Json/src/System/Text/Json/Serialization/Metadata/DefaultJsonTypeInfoResolver.Helpers.cs
@@ -301,10 +301,17 @@ private static void PopulateParameterInfoValues(JsonTypeInfo typeInfo, Nullabili
                     ThrowHelper.ThrowNotSupportedException_ConstructorContainsNullParameterNames(typeInfo.Converter.ConstructorInfo.DeclaringType);
                 }
 
+                // For byref parameters (in/ref/out), use the underlying element type.
+                Type parameterType = reflectionInfo.ParameterType;
+                if (parameterType.IsByRef)
+                {
+                    parameterType = parameterType.GetElementType()!;
+                }
+
                 JsonParameterInfoValues jsonInfo = new()
                 {
                     Name = reflectionInfo.Name,
-                    ParameterType = reflectionInfo.ParameterType,
+                    ParameterType = parameterType,
                     Position = reflectionInfo.Position,
                     HasDefaultValue = reflectionInfo.HasDefaultValue,
                     DefaultValue = reflectionInfo.GetDefaultValue(),
diff --git a/src/libraries/System.Text.Json/src/System/Text/Json/Serialization/Metadata/ReflectionEmitMemberAccessor.cs b/src/libraries/System.Text.Json/src/System/Text/Json/Serialization/Metadata/ReflectionEmitMemberAccessor.cs
index 05f453ef7181a5..84b3660513bbfd 100644
--- a/src/libraries/System.Text.Json/src/System/Text/Json/Serialization/Metadata/ReflectionEmitMemberAccessor.cs
+++ b/src/libraries/System.Text.Json/src/System/Text/Json/Serialization/Metadata/ReflectionEmitMemberAccessor.cs
@@ -91,14 +91,44 @@ private static DynamicMethod CreateParameterizedConstructor(ConstructorInfo cons
 
             ILGenerator generator = dynamicMethod.GetILGenerator();
 
+            // For byref parameters, we need to store values in local variables and pass addresses.
+            LocalBuilder?[] locals = new LocalBuilder?[parameterCount];
+            for (int i = 0; i < parameterCount; i++)
+            {
+                Type paramType = parameters[i].ParameterType;
+                if (paramType.IsByRef)
+                {
+                    // Declare a local for the underlying type.
+                    Type elementType = paramType.GetElementType()!;
+                    locals[i] = generator.DeclareLocal(elementType);
+
+                    // Load value from object array, unbox it, and store in the local.
+                    generator.Emit(OpCodes.Ldarg_0);
+                    generator.Emit(OpCodes.Ldc_I4, i);
+                    generator.Emit(OpCodes.Ldelem_Ref);
+                    generator.Emit(OpCodes.Unbox_Any, elementType);
+                    generator.Emit(OpCodes.Stloc, locals[i]!);
+                }
+            }
+
+            // Now push all arguments onto the stack.
             for (int i = 0; i < parameterCount; i++)
             {
                 Type paramType = parameters[i].ParameterType;
 
-                generator.Emit(OpCodes.Ldarg_0);
-                generator.Emit(OpCodes.Ldc_I4, i);
-                generator.Emit(OpCodes.Ldelem_Ref);
-                generator.Emit(OpCodes.Unbox_Any, paramType);
+                if (paramType.IsByRef)
+                {
+                    // Load address of the local variable.
+                    generator.Emit(OpCodes.Ldloca, locals[i]!);
+                }
+                else
+                {
+                    // Load value from object array and unbox.
+                    generator.Emit(OpCodes.Ldarg_0);
+                    generator.Emit(OpCodes.Ldc_I4, i);
+                    generator.Emit(OpCodes.Ldelem_Ref);
+                    generator.Emit(OpCodes.Unbox_Any, paramType);
+                }
             }
 
             generator.Emit(OpCodes.Newobj, constructor);
@@ -136,15 +166,25 @@ public override JsonTypeInfo.ParameterizedConstructorDelegate<T, TArg0, TArg1, T
             {
                 Debug.Assert(index <= JsonConstants.UnboxedParameterCountThreshold);
 
-                generator.Emit(
-                    index switch
-                    {
-                        0 => OpCodes.Ldarg_0,
-                        1 => OpCodes.Ldarg_1,
-                        2 => OpCodes.Ldarg_2,
-                        3 => OpCodes.Ldarg_3,
-                        _ => throw new InvalidOperationException()
-                    });
+                // For byref parameters (in/ref/out), load the address of the argument instead of the value.
+                bool isByRef = parameters[index].ParameterType.IsByRef;
+
+                if (isByRef)
+                {
+                    generator.Emit(OpCodes.Ldarga_S, index);
+                }
+                else
+                {
+                    generator.Emit(
+                        index switch
+                        {
+                            0 => OpCodes.Ldarg_0,
+                            1 => OpCodes.Ldarg_1,
+                            2 => OpCodes.Ldarg_2,
+                            3 => OpCodes.Ldarg_3,
+                            _ => throw new InvalidOperationException()
+                        });
+                }
             }
 
             generator.Emit(OpCodes.Newobj, constructor);

From 55d3b03ca9f03d30de43dc3b094c0cbba756595c Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Wed, 7 Jan 2026 00:30:02 +0000
Subject: [PATCH 03/12] Add tests for constructors with byref (in) parameters
 in System.Text.Json

Co-authored-by: stephentoub <2642209+stephentoub@users.noreply.github.com>
---
 .../ConstructorTests.ParameterMatching.cs     | 78 +++++++++++++++++++
 1 file changed, 78 insertions(+)

diff --git a/src/libraries/System.Text.Json/tests/Common/ConstructorTests/ConstructorTests.ParameterMatching.cs b/src/libraries/System.Text.Json/tests/Common/ConstructorTests/ConstructorTests.ParameterMatching.cs
index 6fd5c9735f41ad..5e83c90182795e 100644
--- a/src/libraries/System.Text.Json/tests/Common/ConstructorTests/ConstructorTests.ParameterMatching.cs
+++ b/src/libraries/System.Text.Json/tests/Common/ConstructorTests/ConstructorTests.ParameterMatching.cs
@@ -1841,5 +1841,83 @@ public class ClassWithRequiredProperty
         {
             public required string? Bar { get; set; }
         }
+
+        [Fact]
+        public async Task DeserializeType_WithInParameters()
+        {
+            string json = @"{""DateTime"":""2020-12-15T00:00:00"",""TimeSpan"":""01:02:03""}";
+            TypeWith_InParameters result = await Serializer.DeserializeWrapper<TypeWith_InParameters>(json);
+            Assert.Equal(new DateTime(2020, 12, 15), result.DateTime);
+            Assert.Equal(new TimeSpan(1, 2, 3), result.TimeSpan);
+        }
+
+        public class TypeWith_InParameters
+        {
+            public TypeWith_InParameters(in DateTime dateTime, in TimeSpan timeSpan)
+            {
+                DateTime = dateTime;
+                TimeSpan = timeSpan;
+            }
+
+            public DateTime DateTime { get; set; }
+            public TimeSpan TimeSpan { get; set; }
+        }
+
+        [Fact]
+        public async Task DeserializeType_WithMixedByRefParameters()
+        {
+            string json = @"{""Value1"":42,""Value2"":""hello"",""Value3"":3.14,""Value4"":true}";
+            TypeWith_MixedByRefParameters result = await Serializer.DeserializeWrapper<TypeWith_MixedByRefParameters>(json);
+            Assert.Equal(42, result.Value1);
+            Assert.Equal("hello", result.Value2);
+            Assert.Equal(3.14, result.Value3);
+            Assert.True(result.Value4);
+        }
+
+        public class TypeWith_MixedByRefParameters
+        {
+            public TypeWith_MixedByRefParameters(in int value1, string value2, in double value3, bool value4)
+            {
+                Value1 = value1;
+                Value2 = value2;
+                Value3 = value3;
+                Value4 = value4;
+            }
+
+            public int Value1 { get; set; }
+            public string Value2 { get; set; }
+            public double Value3 { get; set; }
+            public bool Value4 { get; set; }
+        }
+
+        [Fact]
+        public async Task DeserializeType_WithLargeInParameters()
+        {
+            string json = @"{""A"":1,""B"":2,""C"":3,""D"":4,""E"":5}";
+            TypeWith_LargeInParameters result = await Serializer.DeserializeWrapper<TypeWith_LargeInParameters>(json);
+            Assert.Equal(1, result.A);
+            Assert.Equal(2, result.B);
+            Assert.Equal(3, result.C);
+            Assert.Equal(4, result.D);
+            Assert.Equal(5, result.E);
+        }
+
+        public class TypeWith_LargeInParameters
+        {
+            public TypeWith_LargeInParameters(in int a, in int b, in int c, in int d, in int e)
+            {
+                A = a;
+                B = b;
+                C = c;
+                D = d;
+                E = e;
+            }
+
+            public int A { get; set; }
+            public int B { get; set; }
+            public int C { get; set; }
+            public int D { get; set; }
+            public int E { get; set; }
+        }
     }
 }

From eec5b887146d7364a026aedb06e862df6c3e1d88 Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Thu, 8 Jan 2026 15:19:36 +0000
Subject: [PATCH 04/12] Skip byref constructor parameter tests for source
 generation serializers

Source generators do not support types with byref constructor parameters
(in/ref/out). These tests now skip when using source generated serializers
by checking Serializer.IsSourceGeneratedSerializer.

Co-authored-by: stephentoub <2642209+stephentoub@users.noreply.github.com>
---
 .../ConstructorTests.ParameterMatching.cs      | 18 ++++++++++++++++++
 1 file changed, 18 insertions(+)

diff --git a/src/libraries/System.Text.Json/tests/Common/ConstructorTests/ConstructorTests.ParameterMatching.cs b/src/libraries/System.Text.Json/tests/Common/ConstructorTests/ConstructorTests.ParameterMatching.cs
index 5e83c90182795e..7467320c7cf099 100644
--- a/src/libraries/System.Text.Json/tests/Common/ConstructorTests/ConstructorTests.ParameterMatching.cs
+++ b/src/libraries/System.Text.Json/tests/Common/ConstructorTests/ConstructorTests.ParameterMatching.cs
@@ -1845,6 +1845,12 @@ public class ClassWithRequiredProperty
         [Fact]
         public async Task DeserializeType_WithInParameters()
         {
+            if (Serializer.IsSourceGeneratedSerializer)
+            {
+                // The source generator does not support byref constructor parameters.
+                return;
+            }
+
             string json = @"{""DateTime"":""2020-12-15T00:00:00"",""TimeSpan"":""01:02:03""}";
             TypeWith_InParameters result = await Serializer.DeserializeWrapper<TypeWith_InParameters>(json);
             Assert.Equal(new DateTime(2020, 12, 15), result.DateTime);
@@ -1866,6 +1872,12 @@ public TypeWith_InParameters(in DateTime dateTime, in TimeSpan timeSpan)
         [Fact]
         public async Task DeserializeType_WithMixedByRefParameters()
         {
+            if (Serializer.IsSourceGeneratedSerializer)
+            {
+                // The source generator does not support byref constructor parameters.
+                return;
+            }
+
             string json = @"{""Value1"":42,""Value2"":""hello"",""Value3"":3.14,""Value4"":true}";
             TypeWith_MixedByRefParameters result = await Serializer.DeserializeWrapper<TypeWith_MixedByRefParameters>(json);
             Assert.Equal(42, result.Value1);
@@ -1893,6 +1905,12 @@ public TypeWith_MixedByRefParameters(in int value1, string value2, in double val
         [Fact]
         public async Task DeserializeType_WithLargeInParameters()
         {
+            if (Serializer.IsSourceGeneratedSerializer)
+            {
+                // The source generator does not support byref constructor parameters.
+                return;
+            }
+
             string json = @"{""A"":1,""B"":2,""C"":3,""D"":4,""E"":5}";
             TypeWith_LargeInParameters result = await Serializer.DeserializeWrapper<TypeWith_LargeInParameters>(json);
             Assert.Equal(1, result.A);

From 34a20880acda1a58c408154c91e6263e9c500a29 Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Thu, 8 Jan 2026 15:58:34 +0000
Subject: [PATCH 05/12] Enable source generation support for byref constructor
 parameters

- Removed IsSourceGeneratedSerializer checks from byref parameter tests
- Added [JsonSerializable] attributes for TypeWith_InParameters, TypeWith_MixedByRefParameters, and TypeWith_LargeInParameters to both ConstructorTestsContext_Metadata and ConstructorTestsContext_Default

The source generator already handles byref parameters correctly since Roslyn's IParameterSymbol.Type returns the underlying element type, not the byref type.

Co-authored-by: stephentoub <2642209+stephentoub@users.noreply.github.com>
---
 .../ConstructorTests.ParameterMatching.cs      | 18 ------------------
 .../Serialization/ConstructorTests.cs          |  6 ++++++
 2 files changed, 6 insertions(+), 18 deletions(-)

diff --git a/src/libraries/System.Text.Json/tests/Common/ConstructorTests/ConstructorTests.ParameterMatching.cs b/src/libraries/System.Text.Json/tests/Common/ConstructorTests/ConstructorTests.ParameterMatching.cs
index 7467320c7cf099..5e83c90182795e 100644
--- a/src/libraries/System.Text.Json/tests/Common/ConstructorTests/ConstructorTests.ParameterMatching.cs
+++ b/src/libraries/System.Text.Json/tests/Common/ConstructorTests/ConstructorTests.ParameterMatching.cs
@@ -1845,12 +1845,6 @@ public class ClassWithRequiredProperty
         [Fact]
         public async Task DeserializeType_WithInParameters()
         {
-            if (Serializer.IsSourceGeneratedSerializer)
-            {
-                // The source generator does not support byref constructor parameters.
-                return;
-            }
-
             string json = @"{""DateTime"":""2020-12-15T00:00:00"",""TimeSpan"":""01:02:03""}";
             TypeWith_InParameters result = await Serializer.DeserializeWrapper<TypeWith_InParameters>(json);
             Assert.Equal(new DateTime(2020, 12, 15), result.DateTime);
@@ -1872,12 +1866,6 @@ public TypeWith_InParameters(in DateTime dateTime, in TimeSpan timeSpan)
         [Fact]
         public async Task DeserializeType_WithMixedByRefParameters()
         {
-            if (Serializer.IsSourceGeneratedSerializer)
-            {
-                // The source generator does not support byref constructor parameters.
-                return;
-            }
-
             string json = @"{""Value1"":42,""Value2"":""hello"",""Value3"":3.14,""Value4"":true}";
             TypeWith_MixedByRefParameters result = await Serializer.DeserializeWrapper<TypeWith_MixedByRefParameters>(json);
             Assert.Equal(42, result.Value1);
@@ -1905,12 +1893,6 @@ public TypeWith_MixedByRefParameters(in int value1, string value2, in double val
         [Fact]
         public async Task DeserializeType_WithLargeInParameters()
         {
-            if (Serializer.IsSourceGeneratedSerializer)
-            {
-                // The source generator does not support byref constructor parameters.
-                return;
-            }
-
             string json = @"{""A"":1,""B"":2,""C"":3,""D"":4,""E"":5}";
             TypeWith_LargeInParameters result = await Serializer.DeserializeWrapper<TypeWith_LargeInParameters>(json);
             Assert.Equal(1, result.A);
diff --git a/src/libraries/System.Text.Json/tests/System.Text.Json.SourceGeneration.Tests/Serialization/ConstructorTests.cs b/src/libraries/System.Text.Json/tests/System.Text.Json.SourceGeneration.Tests/Serialization/ConstructorTests.cs
index 0a4c1a21f19fde..8ad2ed39195573 100644
--- a/src/libraries/System.Text.Json/tests/System.Text.Json.SourceGeneration.Tests/Serialization/ConstructorTests.cs
+++ b/src/libraries/System.Text.Json/tests/System.Text.Json.SourceGeneration.Tests/Serialization/ConstructorTests.cs
@@ -159,6 +159,9 @@ protected ConstructorTests_Metadata(JsonSerializerWrapper stringWrapper)
         [JsonSerializable(typeof(Class_ExtraProperty_JsonElementDictionaryExtData))]
         [JsonSerializable(typeof(Class_ManyParameters_ExtraProperty_ExtData))]
         [JsonSerializable(typeof(ClassWithRequiredProperty))]
+        [JsonSerializable(typeof(TypeWith_InParameters))]
+        [JsonSerializable(typeof(TypeWith_MixedByRefParameters))]
+        [JsonSerializable(typeof(TypeWith_LargeInParameters))]
         internal sealed partial class ConstructorTestsContext_Metadata : JsonSerializerContext
         {
         }
@@ -313,6 +316,9 @@ public ConstructorTests_Default(JsonSerializerWrapper jsonSerializer) : base(jso
         [JsonSerializable(typeof(Class_ExtraProperty_JsonElementDictionaryExtData))]
         [JsonSerializable(typeof(Class_ManyParameters_ExtraProperty_ExtData))]
         [JsonSerializable(typeof(ClassWithRequiredProperty))]
+        [JsonSerializable(typeof(TypeWith_InParameters))]
+        [JsonSerializable(typeof(TypeWith_MixedByRefParameters))]
+        [JsonSerializable(typeof(TypeWith_LargeInParameters))]
         internal sealed partial class ConstructorTestsContext_Default : JsonSerializerContext
         {
         }

From 316c65d9dff81b826df27e2be358ef1a185a462f Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Fri, 9 Jan 2026 16:27:51 +0000
Subject: [PATCH 06/12] Add tests for ref and out constructor parameters

Added tests to lock in current behavior for ref and out parameters:
- ref parameters: Work with reflection-based serialization, skipped for source gen
- out parameters: Constructor receives default values since out is for output

These tests document the current behavioral differences between in, ref, and out.

Co-authored-by: stephentoub <2642209+stephentoub@users.noreply.github.com>
---
 .../ConstructorTests.ParameterMatching.cs     | 64 +++++++++++++++++++
 1 file changed, 64 insertions(+)

diff --git a/src/libraries/System.Text.Json/tests/Common/ConstructorTests/ConstructorTests.ParameterMatching.cs b/src/libraries/System.Text.Json/tests/Common/ConstructorTests/ConstructorTests.ParameterMatching.cs
index 5e83c90182795e..c0e30bc0a44480 100644
--- a/src/libraries/System.Text.Json/tests/Common/ConstructorTests/ConstructorTests.ParameterMatching.cs
+++ b/src/libraries/System.Text.Json/tests/Common/ConstructorTests/ConstructorTests.ParameterMatching.cs
@@ -1919,5 +1919,69 @@ public TypeWith_LargeInParameters(in int a, in int b, in int c, in int d, in int
             public int D { get; set; }
             public int E { get; set; }
         }
+
+        [Fact]
+        public async Task DeserializeType_WithRefParameters()
+        {
+            // ref parameters work with reflection-based serialization but not source generation.
+            // Source generation would require emitting 'ref' keyword at call sites.
+            if (Serializer.IsSourceGeneratedSerializer)
+            {
+                return;
+            }
+
+            string json = @"{""Value1"":42,""Value2"":""hello""}";
+            TypeWith_RefParameters result = await Serializer.DeserializeWrapper<TypeWith_RefParameters>(json);
+            Assert.Equal(42, result.Value1);
+            Assert.Equal("hello", result.Value2);
+        }
+
+        public class TypeWith_RefParameters
+        {
+            public TypeWith_RefParameters(ref int value1, ref string value2)
+            {
+                Value1 = value1;
+                Value2 = value2;
+            }
+
+            public int Value1 { get; set; }
+            public string Value2 { get; set; }
+        }
+
+        [Fact]
+        public async Task DeserializeType_WithOutParameters()
+        {
+            // out parameters work with reflection-based serialization but the constructor
+            // receives default values since out parameters are meant to provide output,
+            // not receive input. Source generation doesn't support out parameters.
+            if (Serializer.IsSourceGeneratedSerializer)
+            {
+                return;
+            }
+
+            string json = @"{""Value1"":42,""Value2"":""hello""}";
+            TypeWith_OutParameters result = await Serializer.DeserializeWrapper<TypeWith_OutParameters>(json);
+            // The constructor sets Value1 and Value2 from properties, not from the out parameters.
+            // The out parameters receive the deserialized values but the constructor ignores them.
+            Assert.Equal(99, result.Value1);
+            Assert.Equal("default", result.Value2);
+        }
+
+        public class TypeWith_OutParameters
+        {
+            public TypeWith_OutParameters(out int value1, out string value2)
+            {
+                // out parameters must be assigned by the constructor.
+                // The values passed in are the deserialized values, but
+                // since this is an out parameter, they are meant to be output.
+                value1 = 99;
+                value2 = "default";
+                Value1 = value1;
+                Value2 = value2;
+            }
+
+            public int Value1 { get; set; }
+            public string Value2 { get; set; }
+        }
     }
 }

From 2509f8ce352f32df1f8638cd1fa4ea1657e93c09 Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Fri, 9 Jan 2026 16:29:59 +0000
Subject: [PATCH 07/12] Fix comments in out parameter test to be more accurate

Co-authored-by: stephentoub <2642209+stephentoub@users.noreply.github.com>
---
 .../ConstructorTests.ParameterMatching.cs              | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/src/libraries/System.Text.Json/tests/Common/ConstructorTests/ConstructorTests.ParameterMatching.cs b/src/libraries/System.Text.Json/tests/Common/ConstructorTests/ConstructorTests.ParameterMatching.cs
index c0e30bc0a44480..2c5626346fdb61 100644
--- a/src/libraries/System.Text.Json/tests/Common/ConstructorTests/ConstructorTests.ParameterMatching.cs
+++ b/src/libraries/System.Text.Json/tests/Common/ConstructorTests/ConstructorTests.ParameterMatching.cs
@@ -1961,8 +1961,8 @@ public async Task DeserializeType_WithOutParameters()
 
             string json = @"{""Value1"":42,""Value2"":""hello""}";
             TypeWith_OutParameters result = await Serializer.DeserializeWrapper<TypeWith_OutParameters>(json);
-            // The constructor sets Value1 and Value2 from properties, not from the out parameters.
-            // The out parameters receive the deserialized values but the constructor ignores them.
+            // The constructor assigns its own values to the out parameters, ignoring
+            // any values that might be passed. The properties get set from those assigned values.
             Assert.Equal(99, result.Value1);
             Assert.Equal("default", result.Value2);
         }
@@ -1971,9 +1971,9 @@ public class TypeWith_OutParameters
         {
             public TypeWith_OutParameters(out int value1, out string value2)
             {
-                // out parameters must be assigned by the constructor.
-                // The values passed in are the deserialized values, but
-                // since this is an out parameter, they are meant to be output.
+                // Out parameters must be assigned by the constructor before use.
+                // The serializer passes addresses for the deserialized values, but
+                // since these are out parameters, the constructor assigns new values.
                 value1 = 99;
                 value2 = "default";
                 Value1 = value1;

From c3a2b481bb1d1db12119c2f7822a3e0f50df6631 Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Mon, 12 Jan 2026 15:11:08 +0000
Subject: [PATCH 08/12] Add comprehensive byref parameter tests for all
 modifiers and types

Added tests covering all permutations of byref modifiers (in, ref, out, ref readonly)
with different types (primitives, structs, reference types):

- in: Works with both reflection and source gen
- ref: Works with reflection only (source gen needs ref keyword at call sites)
- out: Works with reflection only (constructor assigns its own values)
- ref readonly: Works with reflection only (source gen passes cast expressions)

Co-authored-by: eiriktsarpalis <2813363+eiriktsarpalis@users.noreply.github.com>
---
 .../ConstructorTests.ParameterMatching.cs     | 223 ++++++++++++++++++
 .../Serialization/ConstructorTests.cs         |   6 +
 2 files changed, 229 insertions(+)

diff --git a/src/libraries/System.Text.Json/tests/Common/ConstructorTests/ConstructorTests.ParameterMatching.cs b/src/libraries/System.Text.Json/tests/Common/ConstructorTests/ConstructorTests.ParameterMatching.cs
index 2c5626346fdb61..a3b8a7eefb83e1 100644
--- a/src/libraries/System.Text.Json/tests/Common/ConstructorTests/ConstructorTests.ParameterMatching.cs
+++ b/src/libraries/System.Text.Json/tests/Common/ConstructorTests/ConstructorTests.ParameterMatching.cs
@@ -1983,5 +1983,228 @@ public TypeWith_OutParameters(out int value1, out string value2)
             public int Value1 { get; set; }
             public string Value2 { get; set; }
         }
+
+        // Comprehensive tests for all byref parameter modifiers with different types
+        // Modifiers: in, ref, out, ref readonly
+        // Types: primitives (int), structs (DateTime), reference types (string)
+
+        #region In parameter tests with all types
+
+        [Fact]
+        public async Task DeserializeType_WithInParameter_Primitive()
+        {
+            string json = @"{""Value"":42}";
+            TypeWith_InParameter_Primitive result = await Serializer.DeserializeWrapper<TypeWith_InParameter_Primitive>(json);
+            Assert.Equal(42, result.Value);
+        }
+
+        public class TypeWith_InParameter_Primitive
+        {
+            public TypeWith_InParameter_Primitive(in int value) => Value = value;
+            public int Value { get; set; }
+        }
+
+        [Fact]
+        public async Task DeserializeType_WithInParameter_Struct()
+        {
+            string json = @"{""Value"":""2020-12-15T00:00:00""}";
+            TypeWith_InParameter_Struct result = await Serializer.DeserializeWrapper<TypeWith_InParameter_Struct>(json);
+            Assert.Equal(new DateTime(2020, 12, 15), result.Value);
+        }
+
+        public class TypeWith_InParameter_Struct
+        {
+            public TypeWith_InParameter_Struct(in DateTime value) => Value = value;
+            public DateTime Value { get; set; }
+        }
+
+        [Fact]
+        public async Task DeserializeType_WithInParameter_ReferenceType()
+        {
+            string json = @"{""Value"":""hello""}";
+            TypeWith_InParameter_ReferenceType result = await Serializer.DeserializeWrapper<TypeWith_InParameter_ReferenceType>(json);
+            Assert.Equal("hello", result.Value);
+        }
+
+        public class TypeWith_InParameter_ReferenceType
+        {
+            public TypeWith_InParameter_ReferenceType(in string value) => Value = value;
+            public string Value { get; set; }
+        }
+
+        #endregion
+
+        #region Ref parameter tests with all types
+
+        [Fact]
+        public async Task DeserializeType_WithRefParameter_Primitive()
+        {
+            if (Serializer.IsSourceGeneratedSerializer) return;
+
+            string json = @"{""Value"":42}";
+            TypeWith_RefParameter_Primitive result = await Serializer.DeserializeWrapper<TypeWith_RefParameter_Primitive>(json);
+            Assert.Equal(42, result.Value);
+        }
+
+        public class TypeWith_RefParameter_Primitive
+        {
+            public TypeWith_RefParameter_Primitive(ref int value) => Value = value;
+            public int Value { get; set; }
+        }
+
+        [Fact]
+        public async Task DeserializeType_WithRefParameter_Struct()
+        {
+            if (Serializer.IsSourceGeneratedSerializer) return;
+
+            string json = @"{""Value"":""2020-12-15T00:00:00""}";
+            TypeWith_RefParameter_Struct result = await Serializer.DeserializeWrapper<TypeWith_RefParameter_Struct>(json);
+            Assert.Equal(new DateTime(2020, 12, 15), result.Value);
+        }
+
+        public class TypeWith_RefParameter_Struct
+        {
+            public TypeWith_RefParameter_Struct(ref DateTime value) => Value = value;
+            public DateTime Value { get; set; }
+        }
+
+        [Fact]
+        public async Task DeserializeType_WithRefParameter_ReferenceType()
+        {
+            if (Serializer.IsSourceGeneratedSerializer) return;
+
+            string json = @"{""Value"":""hello""}";
+            TypeWith_RefParameter_ReferenceType result = await Serializer.DeserializeWrapper<TypeWith_RefParameter_ReferenceType>(json);
+            Assert.Equal("hello", result.Value);
+        }
+
+        public class TypeWith_RefParameter_ReferenceType
+        {
+            public TypeWith_RefParameter_ReferenceType(ref string value) => Value = value;
+            public string Value { get; set; }
+        }
+
+        #endregion
+
+        #region Out parameter tests with all types
+
+        [Fact]
+        public async Task DeserializeType_WithOutParameter_Primitive()
+        {
+            if (Serializer.IsSourceGeneratedSerializer) return;
+
+            string json = @"{""Value"":42}";
+            TypeWith_OutParameter_Primitive result = await Serializer.DeserializeWrapper<TypeWith_OutParameter_Primitive>(json);
+            // Out parameters are assigned by the constructor, not from JSON
+            Assert.Equal(99, result.Value);
+        }
+
+        public class TypeWith_OutParameter_Primitive
+        {
+            public TypeWith_OutParameter_Primitive(out int value)
+            {
+                value = 99;
+                Value = value;
+            }
+            public int Value { get; set; }
+        }
+
+        [Fact]
+        public async Task DeserializeType_WithOutParameter_Struct()
+        {
+            if (Serializer.IsSourceGeneratedSerializer) return;
+
+            string json = @"{""Value"":""2020-12-15T00:00:00""}";
+            TypeWith_OutParameter_Struct result = await Serializer.DeserializeWrapper<TypeWith_OutParameter_Struct>(json);
+            // Out parameters are assigned by the constructor, not from JSON
+            Assert.Equal(new DateTime(1999, 1, 1), result.Value);
+        }
+
+        public class TypeWith_OutParameter_Struct
+        {
+            public TypeWith_OutParameter_Struct(out DateTime value)
+            {
+                value = new DateTime(1999, 1, 1);
+                Value = value;
+            }
+            public DateTime Value { get; set; }
+        }
+
+        [Fact]
+        public async Task DeserializeType_WithOutParameter_ReferenceType()
+        {
+            if (Serializer.IsSourceGeneratedSerializer) return;
+
+            string json = @"{""Value"":""hello""}";
+            TypeWith_OutParameter_ReferenceType result = await Serializer.DeserializeWrapper<TypeWith_OutParameter_ReferenceType>(json);
+            // Out parameters are assigned by the constructor, not from JSON
+            Assert.Equal("default", result.Value);
+        }
+
+        public class TypeWith_OutParameter_ReferenceType
+        {
+            public TypeWith_OutParameter_ReferenceType(out string value)
+            {
+                value = "default";
+                Value = value;
+            }
+            public string Value { get; set; }
+        }
+
+        #endregion
+
+        #region Ref readonly parameter tests with all types
+
+        [Fact]
+        public async Task DeserializeType_WithRefReadonlyParameter_Primitive()
+        {
+            // ref readonly parameters don't work with source generation because
+            // the generated code passes a cast expression which can't be passed to ref readonly.
+            if (Serializer.IsSourceGeneratedSerializer) return;
+
+            string json = @"{""Value"":42}";
+            TypeWith_RefReadonlyParameter_Primitive result = await Serializer.DeserializeWrapper<TypeWith_RefReadonlyParameter_Primitive>(json);
+            Assert.Equal(42, result.Value);
+        }
+
+        public class TypeWith_RefReadonlyParameter_Primitive
+        {
+            public TypeWith_RefReadonlyParameter_Primitive(ref readonly int value) => Value = value;
+            public int Value { get; set; }
+        }
+
+        [Fact]
+        public async Task DeserializeType_WithRefReadonlyParameter_Struct()
+        {
+            if (Serializer.IsSourceGeneratedSerializer) return;
+
+            string json = @"{""Value"":""2020-12-15T00:00:00""}";
+            TypeWith_RefReadonlyParameter_Struct result = await Serializer.DeserializeWrapper<TypeWith_RefReadonlyParameter_Struct>(json);
+            Assert.Equal(new DateTime(2020, 12, 15), result.Value);
+        }
+
+        public class TypeWith_RefReadonlyParameter_Struct
+        {
+            public TypeWith_RefReadonlyParameter_Struct(ref readonly DateTime value) => Value = value;
+            public DateTime Value { get; set; }
+        }
+
+        [Fact]
+        public async Task DeserializeType_WithRefReadonlyParameter_ReferenceType()
+        {
+            if (Serializer.IsSourceGeneratedSerializer) return;
+
+            string json = @"{""Value"":""hello""}";
+            TypeWith_RefReadonlyParameter_ReferenceType result = await Serializer.DeserializeWrapper<TypeWith_RefReadonlyParameter_ReferenceType>(json);
+            Assert.Equal("hello", result.Value);
+        }
+
+        public class TypeWith_RefReadonlyParameter_ReferenceType
+        {
+            public TypeWith_RefReadonlyParameter_ReferenceType(ref readonly string value) => Value = value;
+            public string Value { get; set; }
+        }
+
+        #endregion
     }
 }
diff --git a/src/libraries/System.Text.Json/tests/System.Text.Json.SourceGeneration.Tests/Serialization/ConstructorTests.cs b/src/libraries/System.Text.Json/tests/System.Text.Json.SourceGeneration.Tests/Serialization/ConstructorTests.cs
index 8ad2ed39195573..ed6401f71abcaf 100644
--- a/src/libraries/System.Text.Json/tests/System.Text.Json.SourceGeneration.Tests/Serialization/ConstructorTests.cs
+++ b/src/libraries/System.Text.Json/tests/System.Text.Json.SourceGeneration.Tests/Serialization/ConstructorTests.cs
@@ -162,6 +162,9 @@ protected ConstructorTests_Metadata(JsonSerializerWrapper stringWrapper)
         [JsonSerializable(typeof(TypeWith_InParameters))]
         [JsonSerializable(typeof(TypeWith_MixedByRefParameters))]
         [JsonSerializable(typeof(TypeWith_LargeInParameters))]
+        [JsonSerializable(typeof(TypeWith_InParameter_Primitive))]
+        [JsonSerializable(typeof(TypeWith_InParameter_Struct))]
+        [JsonSerializable(typeof(TypeWith_InParameter_ReferenceType))]
         internal sealed partial class ConstructorTestsContext_Metadata : JsonSerializerContext
         {
         }
@@ -319,6 +322,9 @@ public ConstructorTests_Default(JsonSerializerWrapper jsonSerializer) : base(jso
         [JsonSerializable(typeof(TypeWith_InParameters))]
         [JsonSerializable(typeof(TypeWith_MixedByRefParameters))]
         [JsonSerializable(typeof(TypeWith_LargeInParameters))]
+        [JsonSerializable(typeof(TypeWith_InParameter_Primitive))]
+        [JsonSerializable(typeof(TypeWith_InParameter_Struct))]
+        [JsonSerializable(typeof(TypeWith_InParameter_ReferenceType))]
         internal sealed partial class ConstructorTestsContext_Default : JsonSerializerContext
         {
         }

From 7d164fd55941fca5b70ac0ad16424a2bcfbd4538 Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Mon, 12 Jan 2026 16:05:20 +0000
Subject: [PATCH 09/12] Add source generator support for ref/out/ref readonly
 constructor parameters

Updated source generator to emit proper code for byref constructor parameters:
- Added RefKind property to ParameterGenerationSpec
- Updated parser to capture RefKind from IParameterSymbol
- Updated emitter to generate:
  - For ref: temp variables with ref keyword
  - For out: discard pattern (out var _)
  - For ref readonly: temp variables with in keyword
- Enabled all byref parameter tests for source generation

Co-authored-by: eiriktsarpalis <2813363+eiriktsarpalis@users.noreply.github.com>
---
 .../gen/JsonSourceGenerator.Emitter.cs        | 50 ++++++++++++++++---
 .../gen/JsonSourceGenerator.Parser.cs         |  1 +
 .../gen/Model/ParameterGenerationSpec.cs      |  6 +++
 .../ConstructorTests.ParameterMatching.cs     | 38 +-------------
 .../Serialization/ConstructorTests.cs         | 22 ++++++++
 5 files changed, 74 insertions(+), 43 deletions(-)

diff --git a/src/libraries/System.Text.Json/gen/JsonSourceGenerator.Emitter.cs b/src/libraries/System.Text.Json/gen/JsonSourceGenerator.Emitter.cs
index 879b41e23c324a..4e89c50cd9ca5b 100644
--- a/src/libraries/System.Text.Json/gen/JsonSourceGenerator.Emitter.cs
+++ b/src/libraries/System.Text.Json/gen/JsonSourceGenerator.Emitter.cs
@@ -935,14 +935,38 @@ private static string GetParameterizedCtorInvocationFunc(TypeGenerationSpec type
 
                 const string ArgsVarName = "args";
 
-                StringBuilder sb = new($"static {ArgsVarName} => new {typeGenerationSpec.TypeRef.FullyQualifiedName}(");
+                // RefKind values from Microsoft.CodeAnalysis.RefKind:
+                // None = 0, Ref = 1, Out = 2, In = 3, RefReadOnlyParameter = 4
+                bool hasRefOrRefReadonlyParams = parameters.Any(p => p.RefKind == 1 || p.RefKind == 4); // Ref or RefReadOnlyParameter
+
+                StringBuilder sb;
+
+                if (hasRefOrRefReadonlyParams)
+                {
+                    // For ref/ref readonly parameters, we need a block lambda with temp variables
+                    sb = new($"static {ArgsVarName} => {{ ");
+
+                    // Declare temp variables for ref and ref readonly parameters
+                    foreach (ParameterGenerationSpec param in parameters)
+                    {
+                        if (param.RefKind == 1 || param.RefKind == 4) // Ref or RefReadOnlyParameter
+                        {
+                            sb.Append($"var __temp{param.ParameterIndex} = ({param.ParameterType.FullyQualifiedName}){ArgsVarName}[{param.ParameterIndex}]; ");
+                        }
+                    }
+
+                    sb.Append($"return new {typeGenerationSpec.TypeRef.FullyQualifiedName}(");
+                }
+                else
+                {
+                    sb = new($"static {ArgsVarName} => new {typeGenerationSpec.TypeRef.FullyQualifiedName}(");
+                }
 
                 if (parameters.Count > 0)
                 {
                     foreach (ParameterGenerationSpec param in parameters)
                     {
-                        int index = param.ParameterIndex;
-                        sb.Append($"{GetParamUnboxing(param.ParameterType, index)}, ");
+                        sb.Append($"{GetParamExpression(param)}, ");
                     }
 
                     sb.Length -= 2; // delete the last ", " token
@@ -955,17 +979,31 @@ private static string GetParameterizedCtorInvocationFunc(TypeGenerationSpec type
                     sb.Append("{ ");
                     foreach (PropertyInitializerGenerationSpec property in propertyInitializers)
                     {
-                        sb.Append($"{property.Name} = {GetParamUnboxing(property.ParameterType, property.ParameterIndex)}, ");
+                        sb.Append($"{property.Name} = ({property.ParameterType.FullyQualifiedName}){ArgsVarName}[{property.ParameterIndex}], ");
                     }
 
                     sb.Length -= 2; // delete the last ", " token
                     sb.Append(" }");
                 }
 
+                if (hasRefOrRefReadonlyParams)
+                {
+                    sb.Append("; }");
+                }
+
                 return sb.ToString();
 
-                static string GetParamUnboxing(TypeRef type, int index)
-                    => $"({type.FullyQualifiedName}){ArgsVarName}[{index}]";
+                static string GetParamExpression(ParameterGenerationSpec param)
+                {
+                    // RefKind values: None = 0, Ref = 1, Out = 2, In = 3, RefReadOnlyParameter = 4
+                    return param.RefKind switch
+                    {
+                        1 => $"ref __temp{param.ParameterIndex}", // Ref
+                        2 => $"out var __discard{param.ParameterIndex}", // Out - use discard pattern
+                        4 => $"in __temp{param.ParameterIndex}", // RefReadOnlyParameter - use in keyword with temp
+                        _ => $"({param.ParameterType.FullyQualifiedName}){ArgsVarName}[{param.ParameterIndex}]", // None or In (in doesn't require keyword at call site)
+                    };
+                }
             }
 
             private static string? GetPrimitiveWriterMethod(TypeGenerationSpec type)
diff --git a/src/libraries/System.Text.Json/gen/JsonSourceGenerator.Parser.cs b/src/libraries/System.Text.Json/gen/JsonSourceGenerator.Parser.cs
index b119734aea4943..be746d9089a758 100644
--- a/src/libraries/System.Text.Json/gen/JsonSourceGenerator.Parser.cs
+++ b/src/libraries/System.Text.Json/gen/JsonSourceGenerator.Parser.cs
@@ -1515,6 +1515,7 @@ private void ProcessMember(
                             DefaultValue = parameterInfo.HasExplicitDefaultValue ? parameterInfo.ExplicitDefaultValue : null,
                             ParameterIndex = i,
                             IsNullable = parameterInfo.IsNullable(),
+                            RefKind = (int)parameterInfo.RefKind,
                         };
                     }
                 }
diff --git a/src/libraries/System.Text.Json/gen/Model/ParameterGenerationSpec.cs b/src/libraries/System.Text.Json/gen/Model/ParameterGenerationSpec.cs
index 2dea67e2159ccb..76e65b2720bf42 100644
--- a/src/libraries/System.Text.Json/gen/Model/ParameterGenerationSpec.cs
+++ b/src/libraries/System.Text.Json/gen/Model/ParameterGenerationSpec.cs
@@ -33,5 +33,11 @@ public sealed record ParameterGenerationSpec
         public required object? DefaultValue { get; init; }
         public required int ParameterIndex { get; init; }
         public required bool IsNullable { get; init; }
+
+        /// <summary>
+        /// The ref kind of the parameter: None (0), Ref (1), Out (2), In (3), RefReadOnlyParameter (4).
+        /// Using int instead of Microsoft.CodeAnalysis.RefKind to avoid dependency issues.
+        /// </summary>
+        public required int RefKind { get; init; }
     }
 }
diff --git a/src/libraries/System.Text.Json/tests/Common/ConstructorTests/ConstructorTests.ParameterMatching.cs b/src/libraries/System.Text.Json/tests/Common/ConstructorTests/ConstructorTests.ParameterMatching.cs
index a3b8a7eefb83e1..b5d867aa514d32 100644
--- a/src/libraries/System.Text.Json/tests/Common/ConstructorTests/ConstructorTests.ParameterMatching.cs
+++ b/src/libraries/System.Text.Json/tests/Common/ConstructorTests/ConstructorTests.ParameterMatching.cs
@@ -1923,13 +1923,6 @@ public TypeWith_LargeInParameters(in int a, in int b, in int c, in int d, in int
         [Fact]
         public async Task DeserializeType_WithRefParameters()
         {
-            // ref parameters work with reflection-based serialization but not source generation.
-            // Source generation would require emitting 'ref' keyword at call sites.
-            if (Serializer.IsSourceGeneratedSerializer)
-            {
-                return;
-            }
-
             string json = @"{""Value1"":42,""Value2"":""hello""}";
             TypeWith_RefParameters result = await Serializer.DeserializeWrapper<TypeWith_RefParameters>(json);
             Assert.Equal(42, result.Value1);
@@ -1951,14 +1944,6 @@ public TypeWith_RefParameters(ref int value1, ref string value2)
         [Fact]
         public async Task DeserializeType_WithOutParameters()
         {
-            // out parameters work with reflection-based serialization but the constructor
-            // receives default values since out parameters are meant to provide output,
-            // not receive input. Source generation doesn't support out parameters.
-            if (Serializer.IsSourceGeneratedSerializer)
-            {
-                return;
-            }
-
             string json = @"{""Value1"":42,""Value2"":""hello""}";
             TypeWith_OutParameters result = await Serializer.DeserializeWrapper<TypeWith_OutParameters>(json);
             // The constructor assigns its own values to the out parameters, ignoring
@@ -1972,8 +1957,7 @@ public class TypeWith_OutParameters
             public TypeWith_OutParameters(out int value1, out string value2)
             {
                 // Out parameters must be assigned by the constructor before use.
-                // The serializer passes addresses for the deserialized values, but
-                // since these are out parameters, the constructor assigns new values.
+                // The serializer discards the out parameters.
                 value1 = 99;
                 value2 = "default";
                 Value1 = value1;
@@ -2039,8 +2023,6 @@ public class TypeWith_InParameter_ReferenceType
         [Fact]
         public async Task DeserializeType_WithRefParameter_Primitive()
         {
-            if (Serializer.IsSourceGeneratedSerializer) return;
-
             string json = @"{""Value"":42}";
             TypeWith_RefParameter_Primitive result = await Serializer.DeserializeWrapper<TypeWith_RefParameter_Primitive>(json);
             Assert.Equal(42, result.Value);
@@ -2055,8 +2037,6 @@ public class TypeWith_RefParameter_Primitive
         [Fact]
         public async Task DeserializeType_WithRefParameter_Struct()
         {
-            if (Serializer.IsSourceGeneratedSerializer) return;
-
             string json = @"{""Value"":""2020-12-15T00:00:00""}";
             TypeWith_RefParameter_Struct result = await Serializer.DeserializeWrapper<TypeWith_RefParameter_Struct>(json);
             Assert.Equal(new DateTime(2020, 12, 15), result.Value);
@@ -2071,8 +2051,6 @@ public class TypeWith_RefParameter_Struct
         [Fact]
         public async Task DeserializeType_WithRefParameter_ReferenceType()
         {
-            if (Serializer.IsSourceGeneratedSerializer) return;
-
             string json = @"{""Value"":""hello""}";
             TypeWith_RefParameter_ReferenceType result = await Serializer.DeserializeWrapper<TypeWith_RefParameter_ReferenceType>(json);
             Assert.Equal("hello", result.Value);
@@ -2091,8 +2069,6 @@ public class TypeWith_RefParameter_ReferenceType
         [Fact]
         public async Task DeserializeType_WithOutParameter_Primitive()
         {
-            if (Serializer.IsSourceGeneratedSerializer) return;
-
             string json = @"{""Value"":42}";
             TypeWith_OutParameter_Primitive result = await Serializer.DeserializeWrapper<TypeWith_OutParameter_Primitive>(json);
             // Out parameters are assigned by the constructor, not from JSON
@@ -2112,8 +2088,6 @@ public TypeWith_OutParameter_Primitive(out int value)
         [Fact]
         public async Task DeserializeType_WithOutParameter_Struct()
         {
-            if (Serializer.IsSourceGeneratedSerializer) return;
-
             string json = @"{""Value"":""2020-12-15T00:00:00""}";
             TypeWith_OutParameter_Struct result = await Serializer.DeserializeWrapper<TypeWith_OutParameter_Struct>(json);
             // Out parameters are assigned by the constructor, not from JSON
@@ -2133,8 +2107,6 @@ public TypeWith_OutParameter_Struct(out DateTime value)
         [Fact]
         public async Task DeserializeType_WithOutParameter_ReferenceType()
         {
-            if (Serializer.IsSourceGeneratedSerializer) return;
-
             string json = @"{""Value"":""hello""}";
             TypeWith_OutParameter_ReferenceType result = await Serializer.DeserializeWrapper<TypeWith_OutParameter_ReferenceType>(json);
             // Out parameters are assigned by the constructor, not from JSON
@@ -2158,10 +2130,6 @@ public TypeWith_OutParameter_ReferenceType(out string value)
         [Fact]
         public async Task DeserializeType_WithRefReadonlyParameter_Primitive()
         {
-            // ref readonly parameters don't work with source generation because
-            // the generated code passes a cast expression which can't be passed to ref readonly.
-            if (Serializer.IsSourceGeneratedSerializer) return;
-
             string json = @"{""Value"":42}";
             TypeWith_RefReadonlyParameter_Primitive result = await Serializer.DeserializeWrapper<TypeWith_RefReadonlyParameter_Primitive>(json);
             Assert.Equal(42, result.Value);
@@ -2176,8 +2144,6 @@ public class TypeWith_RefReadonlyParameter_Primitive
         [Fact]
         public async Task DeserializeType_WithRefReadonlyParameter_Struct()
         {
-            if (Serializer.IsSourceGeneratedSerializer) return;
-
             string json = @"{""Value"":""2020-12-15T00:00:00""}";
             TypeWith_RefReadonlyParameter_Struct result = await Serializer.DeserializeWrapper<TypeWith_RefReadonlyParameter_Struct>(json);
             Assert.Equal(new DateTime(2020, 12, 15), result.Value);
@@ -2192,8 +2158,6 @@ public class TypeWith_RefReadonlyParameter_Struct
         [Fact]
         public async Task DeserializeType_WithRefReadonlyParameter_ReferenceType()
         {
-            if (Serializer.IsSourceGeneratedSerializer) return;
-
             string json = @"{""Value"":""hello""}";
             TypeWith_RefReadonlyParameter_ReferenceType result = await Serializer.DeserializeWrapper<TypeWith_RefReadonlyParameter_ReferenceType>(json);
             Assert.Equal("hello", result.Value);
diff --git a/src/libraries/System.Text.Json/tests/System.Text.Json.SourceGeneration.Tests/Serialization/ConstructorTests.cs b/src/libraries/System.Text.Json/tests/System.Text.Json.SourceGeneration.Tests/Serialization/ConstructorTests.cs
index ed6401f71abcaf..2ce4ae4b69cff9 100644
--- a/src/libraries/System.Text.Json/tests/System.Text.Json.SourceGeneration.Tests/Serialization/ConstructorTests.cs
+++ b/src/libraries/System.Text.Json/tests/System.Text.Json.SourceGeneration.Tests/Serialization/ConstructorTests.cs
@@ -162,9 +162,20 @@ protected ConstructorTests_Metadata(JsonSerializerWrapper stringWrapper)
         [JsonSerializable(typeof(TypeWith_InParameters))]
         [JsonSerializable(typeof(TypeWith_MixedByRefParameters))]
         [JsonSerializable(typeof(TypeWith_LargeInParameters))]
+        [JsonSerializable(typeof(TypeWith_RefParameters))]
+        [JsonSerializable(typeof(TypeWith_OutParameters))]
         [JsonSerializable(typeof(TypeWith_InParameter_Primitive))]
         [JsonSerializable(typeof(TypeWith_InParameter_Struct))]
         [JsonSerializable(typeof(TypeWith_InParameter_ReferenceType))]
+        [JsonSerializable(typeof(TypeWith_RefParameter_Primitive))]
+        [JsonSerializable(typeof(TypeWith_RefParameter_Struct))]
+        [JsonSerializable(typeof(TypeWith_RefParameter_ReferenceType))]
+        [JsonSerializable(typeof(TypeWith_OutParameter_Primitive))]
+        [JsonSerializable(typeof(TypeWith_OutParameter_Struct))]
+        [JsonSerializable(typeof(TypeWith_OutParameter_ReferenceType))]
+        [JsonSerializable(typeof(TypeWith_RefReadonlyParameter_Primitive))]
+        [JsonSerializable(typeof(TypeWith_RefReadonlyParameter_Struct))]
+        [JsonSerializable(typeof(TypeWith_RefReadonlyParameter_ReferenceType))]
         internal sealed partial class ConstructorTestsContext_Metadata : JsonSerializerContext
         {
         }
@@ -322,9 +333,20 @@ public ConstructorTests_Default(JsonSerializerWrapper jsonSerializer) : base(jso
         [JsonSerializable(typeof(TypeWith_InParameters))]
         [JsonSerializable(typeof(TypeWith_MixedByRefParameters))]
         [JsonSerializable(typeof(TypeWith_LargeInParameters))]
+        [JsonSerializable(typeof(TypeWith_RefParameters))]
+        [JsonSerializable(typeof(TypeWith_OutParameters))]
         [JsonSerializable(typeof(TypeWith_InParameter_Primitive))]
         [JsonSerializable(typeof(TypeWith_InParameter_Struct))]
         [JsonSerializable(typeof(TypeWith_InParameter_ReferenceType))]
+        [JsonSerializable(typeof(TypeWith_RefParameter_Primitive))]
+        [JsonSerializable(typeof(TypeWith_RefParameter_Struct))]
+        [JsonSerializable(typeof(TypeWith_RefParameter_ReferenceType))]
+        [JsonSerializable(typeof(TypeWith_OutParameter_Primitive))]
+        [JsonSerializable(typeof(TypeWith_OutParameter_Struct))]
+        [JsonSerializable(typeof(TypeWith_OutParameter_ReferenceType))]
+        [JsonSerializable(typeof(TypeWith_RefReadonlyParameter_Primitive))]
+        [JsonSerializable(typeof(TypeWith_RefReadonlyParameter_Struct))]
+        [JsonSerializable(typeof(TypeWith_RefReadonlyParameter_ReferenceType))]
         internal sealed partial class ConstructorTestsContext_Default : JsonSerializerContext
         {
         }

From 7de1ab75881dbddec5a8ab4ff21933bc80d7bfa4 Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Mon, 12 Jan 2026 16:42:53 +0000
Subject: [PATCH 10/12] Use RefKind enum values instead of hardcoded numbers in
 source generator

Use RefKind.Ref and RefKind.Out directly instead of magic numbers.
Only define constant for RefReadOnlyParameter (4) since it was added in Roslyn 4.4.

Co-authored-by: eiriktsarpalis <2813363+eiriktsarpalis@users.noreply.github.com>
---
 .../gen/JsonSourceGenerator.Emitter.cs          | 17 +++++++++--------
 1 file changed, 9 insertions(+), 8 deletions(-)

diff --git a/src/libraries/System.Text.Json/gen/JsonSourceGenerator.Emitter.cs b/src/libraries/System.Text.Json/gen/JsonSourceGenerator.Emitter.cs
index 4e89c50cd9ca5b..71bf8bc8b4facc 100644
--- a/src/libraries/System.Text.Json/gen/JsonSourceGenerator.Emitter.cs
+++ b/src/libraries/System.Text.Json/gen/JsonSourceGenerator.Emitter.cs
@@ -6,6 +6,7 @@
 using System.Linq;
 using System.Reflection;
 using System.Text.Json.Serialization;
+using Microsoft.CodeAnalysis;
 using Microsoft.CodeAnalysis.CSharp;
 using Microsoft.CodeAnalysis.Text;
 using SourceGenerators;
@@ -928,6 +929,9 @@ static void ThrowPropertyNullException(string propertyName)
                 writer.WriteLine('}');
             }
 
+            // RefKind.RefReadOnlyParameter was added in Roslyn 4.4
+            private const int RefKindRefReadOnlyParameter = 4;
+
             private static string GetParameterizedCtorInvocationFunc(TypeGenerationSpec typeGenerationSpec)
             {
                 ImmutableEquatableArray<ParameterGenerationSpec> parameters = typeGenerationSpec.CtorParamGenSpecs;
@@ -935,9 +939,7 @@ private static string GetParameterizedCtorInvocationFunc(TypeGenerationSpec type
 
                 const string ArgsVarName = "args";
 
-                // RefKind values from Microsoft.CodeAnalysis.RefKind:
-                // None = 0, Ref = 1, Out = 2, In = 3, RefReadOnlyParameter = 4
-                bool hasRefOrRefReadonlyParams = parameters.Any(p => p.RefKind == 1 || p.RefKind == 4); // Ref or RefReadOnlyParameter
+                bool hasRefOrRefReadonlyParams = parameters.Any(p => p.RefKind == (int)RefKind.Ref || p.RefKind == RefKindRefReadOnlyParameter);
 
                 StringBuilder sb;
 
@@ -949,7 +951,7 @@ private static string GetParameterizedCtorInvocationFunc(TypeGenerationSpec type
                     // Declare temp variables for ref and ref readonly parameters
                     foreach (ParameterGenerationSpec param in parameters)
                     {
-                        if (param.RefKind == 1 || param.RefKind == 4) // Ref or RefReadOnlyParameter
+                        if (param.RefKind == (int)RefKind.Ref || param.RefKind == RefKindRefReadOnlyParameter)
                         {
                             sb.Append($"var __temp{param.ParameterIndex} = ({param.ParameterType.FullyQualifiedName}){ArgsVarName}[{param.ParameterIndex}]; ");
                         }
@@ -995,12 +997,11 @@ private static string GetParameterizedCtorInvocationFunc(TypeGenerationSpec type
 
                 static string GetParamExpression(ParameterGenerationSpec param)
                 {
-                    // RefKind values: None = 0, Ref = 1, Out = 2, In = 3, RefReadOnlyParameter = 4
                     return param.RefKind switch
                     {
-                        1 => $"ref __temp{param.ParameterIndex}", // Ref
-                        2 => $"out var __discard{param.ParameterIndex}", // Out - use discard pattern
-                        4 => $"in __temp{param.ParameterIndex}", // RefReadOnlyParameter - use in keyword with temp
+                        (int)RefKind.Ref => $"ref __temp{param.ParameterIndex}",
+                        (int)RefKind.Out => $"out var __discard{param.ParameterIndex}",
+                        RefKindRefReadOnlyParameter => $"in __temp{param.ParameterIndex}",
                         _ => $"({param.ParameterType.FullyQualifiedName}){ArgsVarName}[{param.ParameterIndex}]", // None or In (in doesn't require keyword at call site)
                     };
                 }

From 45e9b72a52e8c15bfa1c12697124463529d91755 Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Mon, 12 Jan 2026 16:57:59 +0000
Subject: [PATCH 11/12] Exclude out parameters from constructor parameter
 metadata

- out parameters don't receive values from JSON deserialization
- They're excluded from JsonParameterInfoValues metadata
- Introduced ArgsIndex to track the position in the args array (separate from ParameterIndex)
- Updated reflection-based and source-generated serialization to handle this
- Properties with names matching out parameters are set via setters after construction

Co-authored-by: eiriktsarpalis <2813363+eiriktsarpalis@users.noreply.github.com>
---
 .../gen/JsonSourceGenerator.Emitter.cs        | 26 +++++++---
 .../gen/JsonSourceGenerator.Parser.cs         | 18 +++++--
 .../gen/Model/ParameterGenerationSpec.cs      | 11 ++++
 .../DefaultJsonTypeInfoResolver.Helpers.cs    | 30 ++++++++---
 .../Metadata/ReflectionEmitMemberAccessor.cs  | 50 ++++++++++++++++---
 .../ConstructorTests.ParameterMatching.cs     | 25 +++++-----
 6 files changed, 125 insertions(+), 35 deletions(-)

diff --git a/src/libraries/System.Text.Json/gen/JsonSourceGenerator.Emitter.cs b/src/libraries/System.Text.Json/gen/JsonSourceGenerator.Emitter.cs
index 71bf8bc8b4facc..9f86e2f7707814 100644
--- a/src/libraries/System.Text.Json/gen/JsonSourceGenerator.Emitter.cs
+++ b/src/libraries/System.Text.Json/gen/JsonSourceGenerator.Emitter.cs
@@ -730,8 +730,11 @@ private static void GenerateCtorParamMetadataInitFunc(SourceWriter writer, strin
             {
                 ImmutableEquatableArray<ParameterGenerationSpec> parameters = typeGenerationSpec.CtorParamGenSpecs;
                 ImmutableEquatableArray<PropertyInitializerGenerationSpec> propertyInitializers = typeGenerationSpec.PropertyInitializerSpecs;
-                int paramCount = parameters.Count + propertyInitializers.Count(propInit => !propInit.MatchesConstructorParameter);
-                Debug.Assert(paramCount > 0);
+
+                // out parameters don't appear in metadata - they don't receive values from JSON.
+                int nonOutParamCount = parameters.Count(p => p.RefKind != (int)RefKind.Out);
+                int paramCount = nonOutParamCount + propertyInitializers.Count(propInit => !propInit.MatchesConstructorParameter);
+                Debug.Assert(paramCount > 0 || parameters.Any(p => p.RefKind == (int)RefKind.Out));
 
                 writer.WriteLine($"private static {JsonParameterInfoValuesTypeRef}[] {ctorParamMetadataInitMethodName}() => new {JsonParameterInfoValuesTypeRef}[]");
                 writer.WriteLine('{');
@@ -740,12 +743,19 @@ private static void GenerateCtorParamMetadataInitFunc(SourceWriter writer, strin
                 int i = 0;
                 foreach (ParameterGenerationSpec spec in parameters)
                 {
+                    // Skip out parameters - they don't receive values from JSON deserialization.
+                    if (spec.RefKind == (int)RefKind.Out)
+                    {
+                        continue;
+                    }
+
+                    Debug.Assert(spec.ArgsIndex >= 0);
                     writer.WriteLine($$"""
                         new()
                         {
                             Name = {{FormatStringLiteral(spec.Name)}},
                             ParameterType = typeof({{spec.ParameterType.FullyQualifiedName}}),
-                            Position = {{spec.ParameterIndex}},
+                            Position = {{spec.ArgsIndex}},
                             HasDefaultValue = {{FormatBoolLiteral(spec.HasDefaultValue)}},
                             DefaultValue = {{(spec.HasDefaultValue ? CSharpSyntaxUtilities.FormatLiteral(spec.DefaultValue, spec.ParameterType) : "null")}},
                             IsNullable = {{FormatBoolLiteral(spec.IsNullable)}},
@@ -953,7 +963,8 @@ private static string GetParameterizedCtorInvocationFunc(TypeGenerationSpec type
                     {
                         if (param.RefKind == (int)RefKind.Ref || param.RefKind == RefKindRefReadOnlyParameter)
                         {
-                            sb.Append($"var __temp{param.ParameterIndex} = ({param.ParameterType.FullyQualifiedName}){ArgsVarName}[{param.ParameterIndex}]; ");
+                            // Use ArgsIndex to access the args array (out params don't have entries in args)
+                            sb.Append($"var __temp{param.ParameterIndex} = ({param.ParameterType.FullyQualifiedName}){ArgsVarName}[{param.ArgsIndex}]; ");
                         }
                     }
 
@@ -968,7 +979,7 @@ private static string GetParameterizedCtorInvocationFunc(TypeGenerationSpec type
                 {
                     foreach (ParameterGenerationSpec param in parameters)
                     {
-                        sb.Append($"{GetParamExpression(param)}, ");
+                        sb.Append($"{GetParamExpression(param, ArgsVarName)}, ");
                     }
 
                     sb.Length -= 2; // delete the last ", " token
@@ -995,14 +1006,15 @@ private static string GetParameterizedCtorInvocationFunc(TypeGenerationSpec type
 
                 return sb.ToString();
 
-                static string GetParamExpression(ParameterGenerationSpec param)
+                static string GetParamExpression(ParameterGenerationSpec param, string argsVarName)
                 {
                     return param.RefKind switch
                     {
                         (int)RefKind.Ref => $"ref __temp{param.ParameterIndex}",
                         (int)RefKind.Out => $"out var __discard{param.ParameterIndex}",
                         RefKindRefReadOnlyParameter => $"in __temp{param.ParameterIndex}",
-                        _ => $"({param.ParameterType.FullyQualifiedName}){ArgsVarName}[{param.ParameterIndex}]", // None or In (in doesn't require keyword at call site)
+                        // Use ArgsIndex to access the args array (out params don't have entries in args)
+                        _ => $"({param.ParameterType.FullyQualifiedName}){argsVarName}[{param.ArgsIndex}]", // None or In (in doesn't require keyword at call site)
                     };
                 }
             }
diff --git a/src/libraries/System.Text.Json/gen/JsonSourceGenerator.Parser.cs b/src/libraries/System.Text.Json/gen/JsonSourceGenerator.Parser.cs
index be746d9089a758..e14790cd605bd2 100644
--- a/src/libraries/System.Text.Json/gen/JsonSourceGenerator.Parser.cs
+++ b/src/libraries/System.Text.Json/gen/JsonSourceGenerator.Parser.cs
@@ -1494,6 +1494,9 @@ private void ProcessMember(
                     constructionStrategy = ObjectConstructionStrategy.ParameterizedConstructor;
                     constructorParameters = new ParameterGenerationSpec[paramCount];
 
+                    // Compute ArgsIndex for each parameter.
+                    // out parameters don't have entries in the args array.
+                    int argsIndex = 0;
                     for (int i = 0; i < paramCount; i++)
                     {
                         IParameterSymbol parameterInfo = constructor.Parameters[i];
@@ -1507,6 +1510,9 @@ private void ProcessMember(
 
                         TypeRef parameterTypeRef = EnqueueType(parameterInfo.Type, typeToGenerate.Mode);
 
+                        // out parameters don't receive values from JSON, so they have ArgsIndex = -1.
+                        int currentArgsIndex = parameterInfo.RefKind == RefKind.Out ? -1 : argsIndex++;
+
                         constructorParameters[i] = new ParameterGenerationSpec
                         {
                             ParameterType = parameterTypeRef,
@@ -1514,6 +1520,7 @@ private void ProcessMember(
                             HasDefaultValue = parameterInfo.HasExplicitDefaultValue,
                             DefaultValue = parameterInfo.HasExplicitDefaultValue ? parameterInfo.ExplicitDefaultValue : null,
                             ParameterIndex = i,
+                            ArgsIndex = currentArgsIndex,
                             IsNullable = parameterInfo.IsNullable(),
                             RefKind = (int)parameterInfo.RefKind,
                         };
@@ -1536,7 +1543,9 @@ private void ProcessMember(
 
                 HashSet<string>? memberInitializerNames = null;
                 List<PropertyInitializerGenerationSpec>? propertyInitializers = null;
-                int paramCount = constructorParameters?.Length ?? 0;
+
+                // Count non-out constructor parameters - out params don't have entries in the args array.
+                int paramCount = constructorParameters?.Count(p => p.RefKind != (int)RefKind.Out) ?? 0;
 
                 // Determine potential init-only or required properties that need to be part of the constructor delegate signature.
                 foreach (PropertyGenerationSpec property in properties)
@@ -1576,7 +1585,8 @@ private void ProcessMember(
                                 Name = property.NameSpecifiedInSourceCode,
                                 ParameterType = property.PropertyType,
                                 MatchesConstructorParameter = matchingConstructorParameter is not null,
-                                ParameterIndex = matchingConstructorParameter?.ParameterIndex ?? paramCount++,
+                                // Use ArgsIndex for matching ctor params (excludes out params), or paramCount++ for new ones
+                                ParameterIndex = matchingConstructorParameter?.ArgsIndex ?? paramCount++,
                                 IsNullable = property.PropertyType.CanBeNull && !property.IsSetterNonNullableAnnotation,
                             };
 
@@ -1588,7 +1598,9 @@ private void ProcessMember(
                             return paramGenSpecs?.FirstOrDefault(MatchesConstructorParameter);
 
                             bool MatchesConstructorParameter(ParameterGenerationSpec paramSpec)
-                                => propSpec.MemberName.Equals(paramSpec.Name, StringComparison.OrdinalIgnoreCase);
+                                // Don't match out parameters - they don't receive values from JSON.
+                                => paramSpec.RefKind != (int)RefKind.Out &&
+                                   propSpec.MemberName.Equals(paramSpec.Name, StringComparison.OrdinalIgnoreCase);
                         }
                     }
                 }
diff --git a/src/libraries/System.Text.Json/gen/Model/ParameterGenerationSpec.cs b/src/libraries/System.Text.Json/gen/Model/ParameterGenerationSpec.cs
index 76e65b2720bf42..59835587124055 100644
--- a/src/libraries/System.Text.Json/gen/Model/ParameterGenerationSpec.cs
+++ b/src/libraries/System.Text.Json/gen/Model/ParameterGenerationSpec.cs
@@ -31,7 +31,18 @@ public sealed record ParameterGenerationSpec
         // The default value of a constructor parameter can only be a constant
         // so it always satisfies the structural equality requirement for the record.
         public required object? DefaultValue { get; init; }
+
+        /// <summary>
+        /// The zero-based position of the parameter in the constructor's formal parameter list.
+        /// </summary>
         public required int ParameterIndex { get; init; }
+
+        /// <summary>
+        /// The zero-based index into the args array for this parameter.
+        /// For out parameters, this is -1 since they don't receive values from the args array.
+        /// </summary>
+        public required int ArgsIndex { get; init; }
+
         public required bool IsNullable { get; init; }
 
         /// <summary>
diff --git a/src/libraries/System.Text.Json/src/System/Text/Json/Serialization/Metadata/DefaultJsonTypeInfoResolver.Helpers.cs b/src/libraries/System.Text.Json/src/System/Text/Json/Serialization/Metadata/DefaultJsonTypeInfoResolver.Helpers.cs
index dd5b3d519adc82..7130e4bdc829c3 100644
--- a/src/libraries/System.Text.Json/src/System/Text/Json/Serialization/Metadata/DefaultJsonTypeInfoResolver.Helpers.cs
+++ b/src/libraries/System.Text.Json/src/System/Text/Json/Serialization/Metadata/DefaultJsonTypeInfoResolver.Helpers.cs
@@ -287,13 +287,30 @@ private static void PopulateParameterInfoValues(JsonTypeInfo typeInfo, Nullabili
         {
             Debug.Assert(typeInfo.Converter.ConstructorInfo != null);
             ParameterInfo[] parameters = typeInfo.Converter.ConstructorInfo.GetParameters();
-            int parameterCount = parameters.Length;
-            JsonParameterInfoValues[] jsonParameters = new JsonParameterInfoValues[parameterCount];
 
-            for (int i = 0; i < parameterCount; i++)
+            // Count non-out parameters - out parameters don't receive values from JSON.
+            int nonOutParameterCount = 0;
+            foreach (ParameterInfo param in parameters)
+            {
+                if (!param.IsOut)
+                {
+                    nonOutParameterCount++;
+                }
+            }
+
+            JsonParameterInfoValues[] jsonParameters = new JsonParameterInfoValues[nonOutParameterCount];
+
+            int jsonParamIndex = 0;
+            for (int i = 0; i < parameters.Length; i++)
             {
                 ParameterInfo reflectionInfo = parameters[i];
 
+                // Skip out parameters - they don't receive values from JSON deserialization.
+                if (reflectionInfo.IsOut)
+                {
+                    continue;
+                }
+
                 // Trimmed parameter names are reported as null in CoreCLR or "" in Mono.
                 if (string.IsNullOrEmpty(reflectionInfo.Name))
                 {
@@ -301,7 +318,7 @@ private static void PopulateParameterInfoValues(JsonTypeInfo typeInfo, Nullabili
                     ThrowHelper.ThrowNotSupportedException_ConstructorContainsNullParameterNames(typeInfo.Converter.ConstructorInfo.DeclaringType);
                 }
 
-                // For byref parameters (in/ref/out), use the underlying element type.
+                // For byref parameters (in/ref), use the underlying element type.
                 Type parameterType = reflectionInfo.ParameterType;
                 if (parameterType.IsByRef)
                 {
@@ -312,13 +329,14 @@ private static void PopulateParameterInfoValues(JsonTypeInfo typeInfo, Nullabili
                 {
                     Name = reflectionInfo.Name,
                     ParameterType = parameterType,
-                    Position = reflectionInfo.Position,
+                    Position = jsonParamIndex, // Use the position in the args array, not the constructor parameter index
                     HasDefaultValue = reflectionInfo.HasDefaultValue,
                     DefaultValue = reflectionInfo.GetDefaultValue(),
                     IsNullable = DetermineParameterNullability(reflectionInfo, nullabilityCtx) is not NullabilityState.NotNull,
                 };
 
-                jsonParameters[i] = jsonInfo;
+                jsonParameters[jsonParamIndex] = jsonInfo;
+                jsonParamIndex++;
             }
 
             typeInfo.PopulateParameterInfoValues(jsonParameters);
diff --git a/src/libraries/System.Text.Json/src/System/Text/Json/Serialization/Metadata/ReflectionEmitMemberAccessor.cs b/src/libraries/System.Text.Json/src/System/Text/Json/Serialization/Metadata/ReflectionEmitMemberAccessor.cs
index 84b3660513bbfd..b04e1fdcafb8ec 100644
--- a/src/libraries/System.Text.Json/src/System/Text/Json/Serialization/Metadata/ReflectionEmitMemberAccessor.cs
+++ b/src/libraries/System.Text.Json/src/System/Text/Json/Serialization/Metadata/ReflectionEmitMemberAccessor.cs
@@ -92,7 +92,25 @@ private static DynamicMethod CreateParameterizedConstructor(ConstructorInfo cons
             ILGenerator generator = dynamicMethod.GetILGenerator();
 
             // For byref parameters, we need to store values in local variables and pass addresses.
+            // For out parameters, we just need a default-initialized local to pass by address.
             LocalBuilder?[] locals = new LocalBuilder?[parameterCount];
+
+            // Track the mapping from constructor parameter index to args[] index.
+            // out parameters don't have entries in args[].
+            int argsIndex = 0;
+            int[] argsIndices = new int[parameterCount];
+            for (int i = 0; i < parameterCount; i++)
+            {
+                if (parameters[i].IsOut)
+                {
+                    argsIndices[i] = -1; // out parameters don't have an args entry
+                }
+                else
+                {
+                    argsIndices[i] = argsIndex++;
+                }
+            }
+
             for (int i = 0; i < parameterCount; i++)
             {
                 Type paramType = parameters[i].ParameterType;
@@ -102,12 +120,30 @@ private static DynamicMethod CreateParameterizedConstructor(ConstructorInfo cons
                     Type elementType = paramType.GetElementType()!;
                     locals[i] = generator.DeclareLocal(elementType);
 
-                    // Load value from object array, unbox it, and store in the local.
-                    generator.Emit(OpCodes.Ldarg_0);
-                    generator.Emit(OpCodes.Ldc_I4, i);
-                    generator.Emit(OpCodes.Ldelem_Ref);
-                    generator.Emit(OpCodes.Unbox_Any, elementType);
-                    generator.Emit(OpCodes.Stloc, locals[i]!);
+                    if (parameters[i].IsOut)
+                    {
+                        // For out parameters, just initialize the local to default.
+                        // We don't load from args[] since out params aren't in the metadata.
+                        if (elementType.IsValueType)
+                        {
+                            generator.Emit(OpCodes.Ldloca, locals[i]!);
+                            generator.Emit(OpCodes.Initobj, elementType);
+                        }
+                        else
+                        {
+                            generator.Emit(OpCodes.Ldnull);
+                            generator.Emit(OpCodes.Stloc, locals[i]!);
+                        }
+                    }
+                    else
+                    {
+                        // Load value from object array, unbox it, and store in the local.
+                        generator.Emit(OpCodes.Ldarg_0);
+                        generator.Emit(OpCodes.Ldc_I4, argsIndices[i]);
+                        generator.Emit(OpCodes.Ldelem_Ref);
+                        generator.Emit(OpCodes.Unbox_Any, elementType);
+                        generator.Emit(OpCodes.Stloc, locals[i]!);
+                    }
                 }
             }
 
@@ -125,7 +161,7 @@ private static DynamicMethod CreateParameterizedConstructor(ConstructorInfo cons
                 {
                     // Load value from object array and unbox.
                     generator.Emit(OpCodes.Ldarg_0);
-                    generator.Emit(OpCodes.Ldc_I4, i);
+                    generator.Emit(OpCodes.Ldc_I4, argsIndices[i]);
                     generator.Emit(OpCodes.Ldelem_Ref);
                     generator.Emit(OpCodes.Unbox_Any, paramType);
                 }
diff --git a/src/libraries/System.Text.Json/tests/Common/ConstructorTests/ConstructorTests.ParameterMatching.cs b/src/libraries/System.Text.Json/tests/Common/ConstructorTests/ConstructorTests.ParameterMatching.cs
index b5d867aa514d32..3febdaaa59886e 100644
--- a/src/libraries/System.Text.Json/tests/Common/ConstructorTests/ConstructorTests.ParameterMatching.cs
+++ b/src/libraries/System.Text.Json/tests/Common/ConstructorTests/ConstructorTests.ParameterMatching.cs
@@ -1946,18 +1946,19 @@ public async Task DeserializeType_WithOutParameters()
         {
             string json = @"{""Value1"":42,""Value2"":""hello""}";
             TypeWith_OutParameters result = await Serializer.DeserializeWrapper<TypeWith_OutParameters>(json);
-            // The constructor assigns its own values to the out parameters, ignoring
-            // any values that might be passed. The properties get set from those assigned values.
-            Assert.Equal(99, result.Value1);
-            Assert.Equal("default", result.Value2);
+            // out parameters are excluded from the constructor delegate's metadata,
+            // so JSON values are set via property setters after construction.
+            // The constructor's assigned values (99, "default") are overwritten by the JSON values.
+            Assert.Equal(42, result.Value1);
+            Assert.Equal("hello", result.Value2);
         }
 
         public class TypeWith_OutParameters
         {
             public TypeWith_OutParameters(out int value1, out string value2)
             {
-                // Out parameters must be assigned by the constructor before use.
-                // The serializer discards the out parameters.
+                // Out parameters must be assigned by the constructor.
+                // Since they're excluded from metadata, these values won't come from JSON.
                 value1 = 99;
                 value2 = "default";
                 Value1 = value1;
@@ -2071,8 +2072,8 @@ public async Task DeserializeType_WithOutParameter_Primitive()
         {
             string json = @"{""Value"":42}";
             TypeWith_OutParameter_Primitive result = await Serializer.DeserializeWrapper<TypeWith_OutParameter_Primitive>(json);
-            // Out parameters are assigned by the constructor, not from JSON
-            Assert.Equal(99, result.Value);
+            // Out parameters are excluded from metadata, so JSON values are set via property setters
+            Assert.Equal(42, result.Value);
         }
 
         public class TypeWith_OutParameter_Primitive
@@ -2090,8 +2091,8 @@ public async Task DeserializeType_WithOutParameter_Struct()
         {
             string json = @"{""Value"":""2020-12-15T00:00:00""}";
             TypeWith_OutParameter_Struct result = await Serializer.DeserializeWrapper<TypeWith_OutParameter_Struct>(json);
-            // Out parameters are assigned by the constructor, not from JSON
-            Assert.Equal(new DateTime(1999, 1, 1), result.Value);
+            // Out parameters are excluded from metadata, so JSON values are set via property setters
+            Assert.Equal(new DateTime(2020, 12, 15), result.Value);
         }
 
         public class TypeWith_OutParameter_Struct
@@ -2109,8 +2110,8 @@ public async Task DeserializeType_WithOutParameter_ReferenceType()
         {
             string json = @"{""Value"":""hello""}";
             TypeWith_OutParameter_ReferenceType result = await Serializer.DeserializeWrapper<TypeWith_OutParameter_ReferenceType>(json);
-            // Out parameters are assigned by the constructor, not from JSON
-            Assert.Equal("default", result.Value);
+            // Out parameters are excluded from metadata, so JSON values are set via property setters
+            Assert.Equal("hello", result.Value);
         }
 
         public class TypeWith_OutParameter_ReferenceType

From f544febfbc4a2d565d13a4475a32c253c372c522 Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Tue, 13 Jan 2026 12:27:47 +0000
Subject: [PATCH 12/12] Fix assertion failure when all constructor parameters
 are out parameters

Remove the early return for empty parameter arrays in PopulateParameterInfoValues.
This ensures _parameterInfoValuesIndex is always initialized (even if empty) when
CreateObjectWithArgs is set, avoiding the assertion failure in ResolveMatchingParameterInfo.

Co-authored-by: eiriktsarpalis <2813363+eiriktsarpalis@users.noreply.github.com>
---
 .../System/Text/Json/Serialization/Metadata/JsonTypeInfo.cs  | 5 -----
 1 file changed, 5 deletions(-)

diff --git a/src/libraries/System.Text.Json/src/System/Text/Json/Serialization/Metadata/JsonTypeInfo.cs b/src/libraries/System.Text.Json/src/System/Text/Json/Serialization/Metadata/JsonTypeInfo.cs
index 5456030b9bcaea..400817503b9bdc 100644
--- a/src/libraries/System.Text.Json/src/System/Text/Json/Serialization/Metadata/JsonTypeInfo.cs
+++ b/src/libraries/System.Text.Json/src/System/Text/Json/Serialization/Metadata/JsonTypeInfo.cs
@@ -1145,11 +1145,6 @@ internal void ConfigureProperties()
 
         internal void PopulateParameterInfoValues(JsonParameterInfoValues[] parameterInfoValues)
         {
-            if (parameterInfoValues.Length == 0)
-            {
-                return;
-            }
-
             Dictionary<ParameterLookupKey, JsonParameterInfoValues> parameterIndex = new(parameterInfoValues.Length);
             foreach (JsonParameterInfoValues parameterInfoValue in parameterInfoValues)
             {