Skip to content

Fix NullReferenceException for SelectMany with inline array values#38286

Open
roji wants to merge 4 commits into
mainfrom
roji/fix-selectmany-inline-array-crash
Open

Fix NullReferenceException for SelectMany with inline array values#38286
roji wants to merge 4 commits into
mainfrom
roji/fix-selectmany-inline-array-crash

Conversation

@roji
Copy link
Copy Markdown
Member

@roji roji commented May 16, 2026

Fixes #38285

When using SelectMany with an inline array where the collection values are unreferenced (e.g. e => new[] { "a", "b" }.Select(k => e)), the values in the ValuesExpression had no type mapping inferred from usage context. The postprocessor then wrapped them in a Convert expression with null TypeMapping, causing a NullReferenceException in QuerySqlGenerator.VisitSqlConstant.

Fix: In ApplyTypeMappingsOnValuesExpression, when no type mapping is inferred from usage context, fall back to the default type mapping for the value's CLR type.

Generated SQL (SQL Server):

SELECT [p].[Id], ...
FROM [PrimitiveCollectionsEntity] AS [p]
CROSS APPLY (VALUES (CAST(N'a' AS nvarchar(max))), (N'b')) AS [v]([Value])

…e array values

When using SelectMany with an inline array where the collection values are
unreferenced (e.g. e => new[] { "a", "b" }.Select(k => e)), the values in the
ValuesExpression had no type mapping inferred from usage context. The
postprocessor then wrapped them in a Convert expression with null TypeMapping,
causing a NullReferenceException in QuerySqlGenerator.VisitSqlConstant.

Fix: In ApplyTypeMappingsOnValuesExpression, when no type mapping is inferred
from usage context, fall back to the default type mapping for the value's CLR
type.

Fixes #38285

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
@roji roji requested a review from a team as a code owner May 16, 2026 09:14
Copilot AI review requested due to automatic review settings May 16, 2026 09:14
Copy link
Copy Markdown

Copilot AI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Fixes a relational query pipeline crash by applying a fallback type mapping to inline VALUES expressions whose value column has no usage-inferred mapping.

Changes:

  • Adds default CLR-type mapping fallback in RelationalTypeMappingPostprocessor.
  • Adds a shared regression test for SelectMany over unreferenced inline collection values.
  • Adds provider-specific expectations for SQL Server and SQLite.

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated 1 comment.

File Description
src/EFCore.Relational/Query/RelationalTypeMappingPostprocessor.cs Applies default type mappings to unmapped inline row values when inference is unavailable.
test/EFCore.Specification.Tests/Query/PrimitiveCollectionsQueryTestBase.cs Adds the shared regression test for issue #38285.
test/EFCore.SqlServer.FunctionalTests/Query/PrimitiveCollectionsQuerySqlServerTest.cs Adds expected SQL for the new regression test.
test/EFCore.Sqlite.FunctionalTests/Query/PrimitiveCollectionsQuerySqliteTest.cs Adds SQLite’s expected APPLY-not-supported behavior for the new test.

- Add UnreachableException guards in QuerySqlGenerator.VisitSqlConstant and
  VisitSqlParameter for null TypeMapping, with message instructing users to
  file a bug report.
- Simplify the type mapping fallback in ApplyTypeMappingsOnValuesExpression
  using coalesce.
- Add missing test overrides for OldSqlServer, JsonType, and Cosmos providers.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot AI review requested due to automatic review settings May 16, 2026 18:31
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copy link
Copy Markdown

Copilot AI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Copilot reviewed 8 out of 8 changed files in this pull request and generated 1 comment.

Comment thread src/EFCore.Relational/Query/QuerySqlGenerator.cs Outdated
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

SelectMany with inline array values crashes SQL generator with NullReferenceException

3 participants