Cross join with inline values crashes the SQL generator

[aromaa]

The following program seems to outright crash the SQL generator.

#:property TargetFramework=net10.0
#:property PublishAot=false
#:package Npgsql.EntityFrameworkCore.PostgreSQL@10.0.1

using Microsoft.EntityFrameworkCore;

TestDbContext test = new();
test.Entities.SelectMany(e => new[] { "a", "b" }.Select(k => e)).ToList();

class TestDbContext : DbContext
{
    public DbSet<TestEntity> Entities => this.Set<TestEntity>();

    protected override void OnConfiguring(DbContextOptionsBuilder optionsBuilder) =>
        optionsBuilder.UseNpgsql();
}

record TestEntity(int Id = 0);

Running the program generates the following exception:

Unhandled exception. System.NullReferenceException: Object reference not set to an instance of an object.
   at Npgsql.EntityFrameworkCore.PostgreSQL.Query.Internal.NpgsqlQuerySqlGenerator.VisitSqlUnary(SqlUnaryExpression sqlUnaryExpression)
   at Microsoft.EntityFrameworkCore.Query.SqlExpressionVisitor.VisitExtension(Expression extensionExpression)
   at Npgsql.EntityFrameworkCore.PostgreSQL.Query.Internal.NpgsqlQuerySqlGenerator.VisitExtension(Expression extensionExpression)
   at Microsoft.EntityFrameworkCore.Query.QuerySqlGenerator.VisitRowValue(RowValueExpression rowValueExpression)
   at Microsoft.EntityFrameworkCore.Query.SqlExpressionVisitor.VisitExtension(Expression extensionExpression)
   at Npgsql.EntityFrameworkCore.PostgreSQL.Query.Internal.NpgsqlQuerySqlGenerator.VisitExtension(Expression extensionExpression)
   at Npgsql.EntityFrameworkCore.PostgreSQL.Query.Internal.NpgsqlQuerySqlGenerator.GenerateValues(ValuesExpression valuesExpression)
   at Microsoft.EntityFrameworkCore.Query.QuerySqlGenerator.VisitValues(ValuesExpression valuesExpression)
   at Npgsql.EntityFrameworkCore.PostgreSQL.Query.Internal.NpgsqlQuerySqlGenerator.VisitValues(ValuesExpression valuesExpression)
   at Microsoft.EntityFrameworkCore.Query.SqlExpressionVisitor.VisitExtension(Expression extensionExpression)
   at Npgsql.EntityFrameworkCore.PostgreSQL.Query.Internal.NpgsqlQuerySqlGenerator.VisitExtension(Expression extensionExpression)
   at Npgsql.EntityFrameworkCore.PostgreSQL.Query.Internal.NpgsqlQuerySqlGenerator.VisitCrossApply(CrossApplyExpression crossApplyExpression)
   at Microsoft.EntityFrameworkCore.Query.SqlExpressionVisitor.VisitExtension(Expression extensionExpression)
   at Npgsql.EntityFrameworkCore.PostgreSQL.Query.Internal.NpgsqlQuerySqlGenerator.VisitExtension(Expression extensionExpression)
   at Microsoft.EntityFrameworkCore.Query.QuerySqlGenerator.<GenerateFrom>b__50_0(TableExpressionBase e)
   at Microsoft.EntityFrameworkCore.Query.QuerySqlGenerator.GenerateList[T](IReadOnlyList`1 items, Action`1 generationAction, Action`1 joinAction)
   at Microsoft.EntityFrameworkCore.Query.QuerySqlGenerator.GenerateFrom(SelectExpression selectExpression)
   at Microsoft.EntityFrameworkCore.Query.QuerySqlGenerator.VisitSelect(SelectExpression selectExpression)
   at Microsoft.EntityFrameworkCore.Query.QuerySqlGenerator.GenerateRootCommand(Expression queryExpression)
   at Npgsql.EntityFrameworkCore.PostgreSQL.Query.Internal.NpgsqlQuerySqlGenerator.GenerateRootCommand(Expression queryExpression)
   at Microsoft.EntityFrameworkCore.Query.QuerySqlGenerator.GetCommand(Expression queryExpression)
   at Microsoft.EntityFrameworkCore.Query.Internal.RelationalCommandCache.GetRelationalCommandTemplate(Dictionary`2 parameters)
   at Microsoft.EntityFrameworkCore.Internal.RelationalCommandResolverExtensions.RentAndPopulateRelationalCommand(RelationalCommandResolver relationalCommandResolver, RelationalQueryContext queryContext)
   at Microsoft.EntityFrameworkCore.Query.Internal.SingleQueryingEnumerable`1.Enumerator.InitializeReader(Enumerator enumerator)
   at Microsoft.EntityFrameworkCore.Query.Internal.SingleQueryingEnumerable`1.Enumerator.<>c.<MoveNext>b__21_0(DbContext _, Enumerator enumerator)
   at Npgsql.EntityFrameworkCore.PostgreSQL.Storage.Internal.NpgsqlExecutionStrategy.Execute[TState,TResult](TState state, Func`3 operation, Func`3 verifySucceeded)
   at Microsoft.EntityFrameworkCore.Query.Internal.SingleQueryingEnumerable`1.Enumerator.MoveNext()
   at System.Collections.Generic.List`1..ctor(IEnumerable`1 collection)
   at System.Linq.Enumerable.ToList[TSource](IEnumerable`1 source)
   at Program.<Main>$(String[] args) in Z:\Joni\VisualStudio\NpgsqlRepro\Program.cs:line 8

[roji]

AI Triage

The below is an AI-generated analysis and may contain inaccuracies.

Analysis

Issue type: Bug

This is not specific to the PostgreSQL provider. The same NullReferenceException crash reproduces identically with SQL Server (using Microsoft.EntityFrameworkCore.SqlServer 10.0.4), confirming this is a bug in EF Core itself, not in EFCore.PG.

The crash occurs in the SQL generator when visiting a SqlUnaryExpression (type conversion) inside a RowValueExpression within a ValuesExpression. The expression tree produced by the query compiler contains expressions with null TypeMapping, which causes NRE when the SQL generator tries to access the type mapping during SQL generation.

The bug reproduces on both EF 9 (9.0.6) and EF 10 (10.0.4).

Recommendation: Close this issue and reopen it on the EF Core repo, since the bug is in the EF Core query pipeline and not specific to the PostgreSQL provider.

Minimal repro (using SQL Server)

using System;
using System.Linq;
using Microsoft.EntityFrameworkCore;
using Microsoft.Extensions.Logging;

await using var context = new TestContext();
_ = context.Entities.SelectMany(e => new[] { "a", "b" }.Select(k => e)).ToList();

public class TestContext : DbContext
{
    public DbSet<TestEntity> Entities => Set<TestEntity>();

    protected override void OnConfiguring(DbContextOptionsBuilder optionsBuilder)
        => optionsBuilder
            .UseSqlServer(Environment.GetEnvironmentVariable("Test__SqlServer__DefaultConnection"))
            .LogTo(Console.WriteLine, LogLevel.Information)
            .EnableSensitiveDataLogging();
}

public record TestEntity(int Id = 0);

Stack trace (SQL Server):

System.NullReferenceException: Object reference not set to an instance of an object.
   at Microsoft.EntityFrameworkCore.Query.QuerySqlGenerator.VisitSqlConstant(SqlConstantExpression sqlConstantExpression)
   at Microsoft.EntityFrameworkCore.Query.QuerySqlGenerator.VisitSqlUnary(SqlUnaryExpression sqlUnaryExpression)
   at Microsoft.EntityFrameworkCore.Query.QuerySqlGenerator.VisitRowValue(RowValueExpression rowValueExpression)
   at Microsoft.EntityFrameworkCore.SqlServer.Query.Internal.SqlServerQuerySqlGenerator.GenerateValues(ValuesExpression valuesExpression)
   ...

Possible duplicates

No existing duplicate was found on the EF Core repo.

[roji]

Closing as this is an EF Core bug, not specific to the PostgreSQL provider. Opened dotnet/efcore#38285 upstream.