TPH inheritance with owned JSON type causes NullReferenceException when replacing derived entity with same key

[MaikelOrisha]

Bug description

We have a navigation property with a list of inherited types, mapped using table-per-hierarchy (TPH). One derived type (LocaleValueAttribute) includes an owned JSON type (LocaleValue). When we try to remove an instance of that type and add a different derived type (StringAttribute) with the same composite key, we run into a NullReferenceException.

I initially placed a comment in #34274, but I now believe it's a separate issue. That's why I created a new ticket.

Your code

using Microsoft.EntityFrameworkCore;

await using var context = new ReproDbContext();

await context.Database.MigrateAsync();

var item = context.Items.Add(new Item
{
    Name = "Product 1",
    Attributes = [
        new LocaleValueAttribute()
        {
            Key = "TextValue",
            Value = new LocaleValue()
            {
                Entries = [
                    new LocaleValueEntry()
                    {
                        Locale = "en-US",
                        Value = "Hello"
                    }
                ]
            }
        }
    ]
});

await context.SaveChangesAsync();

item.Entity.Attributes.RemoveAll(attr => attr.Key == "TextValue");

item.Entity.Attributes.Add(new StringAttribute
{
    Key = "TextValue",
    Value = "World"
});

await context.SaveChangesAsync(); // Throws the NullReferenceException

// Db context
public class ReproDbContext : DbContext
{
    
    public DbSet<Item> Items { get; set; }
    
    protected override void OnConfiguring(DbContextOptionsBuilder optionsBuilder)
    {
        optionsBuilder.UseSqlServer("Server=(localdb)\\mssqllocaldb;Database=efcore-bug-repro;Trusted_Connection=True;MultipleActiveResultSets=true;");
    }

    protected override void OnModelCreating(ModelBuilder modelBuilder)
    {
        modelBuilder.Entity<Item>()
            .HasKey(x => x.Id);

        modelBuilder.Entity<ItemAttribute>(b =>
        {
            b.HasKey(x => new { x.ItemId, x.Key });
            b.HasDiscriminator<string>("Discriminator")
                .HasValue<StringAttribute>("string")
                .HasValue<LocaleValueAttribute>("locale-value");
        });
        
        modelBuilder.Entity<StringAttribute>(b =>
        {
            b.Property(x => x.Value).HasColumnName("StringValue");
        });
        
        modelBuilder.Entity<LocaleValueAttribute>(b =>
        {
            b.OwnsOne(x => x.Value, bc =>
            {
                bc.ToJson("LocaleValue");
                bc.OwnsMany(x => x.Entries, v =>
                {
                    v.Property(x => x.Locale).IsRequired();
                    v.Property(x => x.Value);
                });
            });
        });
    }
}

// Models
public class Item
{
    public int Id { get; set; }
    public required string Name { get; set; }
    public List<ItemAttribute> Attributes { get; set; } = [];
}

public abstract class ItemAttribute
{
    public int ItemId { get; set; }
    public required string Key { get; set; }
}

public class StringAttribute : ItemAttribute
{
    public string Value { get; set; } = null!;
}

public class LocaleValueAttribute : ItemAttribute
{
    public LocaleValue Value { get; set; } = null!;
}

public class LocaleValue
{
    public List<LocaleValueEntry> Entries { get; set; } = [];
}

public class LocaleValueEntry
{
    public required string Locale { get; set; }
    public required string Value { get; set; }
}

Stack traces

System.NullReferenceException: Object reference not set to an instance of an object.
   at Microsoft.EntityFrameworkCore.Update.ModificationCommand.<GenerateColumnModifications>g__FindJsonPartialUpdateInfo|41_2(IUpdateEntry entry, List`1 processedEntries)
   at Microsoft.EntityFrameworkCore.Update.ModificationCommand.<GenerateColumnModifications>g__HandleJson|41_4(List`1 columnModifications, <>c__DisplayClass41_0&)
   at Microsoft.EntityFrameworkCore.Update.ModificationCommand.GenerateColumnModifications()
   at Microsoft.EntityFrameworkCore.Update.ModificationCommand.<>c.<get_ColumnModifications>b__33_0(ModificationCommand command)
   at Microsoft.EntityFrameworkCore.Internal.NonCapturingLazyInitializer.EnsureInitialized[TParam,TValue](TValue& target, TParam param, Func`2 valueFactory)
   at Microsoft.EntityFrameworkCore.Update.ModificationCommand.get_ColumnModifications()
   at Microsoft.EntityFrameworkCore.Update.Internal.CommandBatchPreparer.CreateCommandBatches(IEnumerable`1 commandSet, Boolean moreCommandSets, Boolean assertColumnModification, ParameterNameGenerator parameterNameGenerator)+MoveNext()
   at Microsoft.EntityFrameworkCore.Update.Internal.CommandBatchPreparer.BatchCommands(IList`1 entries, IUpdateAdapter updateAdapter)+MoveNext()
   at Microsoft.EntityFrameworkCore.Update.Internal.BatchExecutor.ExecuteAsync(IEnumerable`1 commandBatches, IRelationalConnection connection, CancellationToken cancellationToken)
   at Microsoft.EntityFrameworkCore.Storage.RelationalDatabase.SaveChangesAsync(IList`1 entries, CancellationToken cancellationToken)
   at Microsoft.EntityFrameworkCore.ChangeTracking.Internal.StateManager.SaveChangesAsync(IList`1 entriesToSave, CancellationToken cancellationToken)
   at Microsoft.EntityFrameworkCore.ChangeTracking.Internal.StateManager.SaveChangesAsync(StateManager stateManager, Boolean acceptAllChangesOnSuccess, CancellationToken cancellationToken)
   at Microsoft.EntityFrameworkCore.SqlServer.Storage.Internal.SqlServerExecutionStrategy.ExecuteAsync[TState,TResult](TState state, Func`4 operation, Func`4 verifySucceeded, CancellationToken cancellationToken)
   at Microsoft.EntityFrameworkCore.DbContext.SaveChangesAsync(Boolean acceptAllChangesOnSuccess, CancellationToken cancellationToken)
   at Microsoft.EntityFrameworkCore.DbContext.SaveChangesAsync(Boolean acceptAllChangesOnSuccess, CancellationToken cancellationToken)
   at Program.<Main>$(String[] args) in C:\Work\Experimental\ConsoleApp2\ConsoleApp2\Program.cs:line 40
   at Program.<Main>$(String[] args) in C:\Work\Experimental\ConsoleApp2\ConsoleApp2\Program.cs:line 40
   at Program.<Main>(String[] args)

Verbose output

EF Core version

9.0.4

Database provider

Microsoft.EntityFrameworkCore.SqlServer

Target framework

.NET 9.0

Operating system

No response

IDE

No response

[AndriySvyryd]

This doesn't repro in 10.0.0-rc1

[roji]

AI Triage Report

Issue

Originally filed as npgsql/efcore.pg#3759

Summary

The user reports a NullReferenceException at ModificationCommand.FindJsonPartialUpdateInfo when clearing and re-adding entities of mixed TPH derived types (where one derived type has an owned JSON collection) to a navigation collection, then calling SaveChangesAsync().

Reproduction

Bug confirmed. Reproduced on SQL Server (not Npgsql-specific) with a minimal repro. The crash is in EFCore.Relational (ModificationCommand.GenerateColumnModifications), confirming this is a core EF Core bug, not specific to the Npgsql provider.

Key model elements:

• TPH hierarchy with discriminator (Parameter → StringParameter, AdvancedParameter)
• AdvancedParameter has an OwnsMany with ToJson() (owned JSON collection)
• Composite key on the base entity (OwnerId, Order)
• Parent entity (ParameterSet) has a navigation collection of the base type

Steps to reproduce:

1. Insert a ParameterSet with mixed StringParameter and AdvancedParameter children → works
2. Load the ParameterSet with its parameters, clear the collection, add new mixed-type parameters with the same PKs but in different type order → SaveChangesAsync() throws NullReferenceException

Stack trace:

System.NullReferenceException: Object reference not set to an instance of an object.
   at Microsoft.EntityFrameworkCore.Update.ModificationCommand.<GenerateColumnModifications>g__FindJsonPartialUpdateInfo|41_6(IUpdateEntry entry, List`1 processedEntries)
   at Microsoft.EntityFrameworkCore.Update.ModificationCommand.<GenerateColumnModifications>g__HandleJson|41_8(...)
   at Microsoft.EntityFrameworkCore.Update.ModificationCommand.GenerateColumnModifications()
   ...

Regression Testing

Version	Result
EF Core 9.0.13 (SQL Server)	✅ Works
EF Core 10.0.0 (SQL Server)	❌ NullReferenceException
EF Core 10.0.3 (SQL Server)	❌ NullReferenceException
EF Core 11.0.0-preview.1 (SQL Server)	❌ NullReferenceException

Confirmed regression introduced in EF Core 10.0.0. The user's claim is correct.

Possible Duplicates

• TPH inheritance with owned JSON type causes NullReferenceException when replacing derived entity with same key #36019 — Very similar: "TPH inheritance with owned JSON type causes NullReferenceException when replacing derived entity with same key". Was reported on EF 9.0.4 and closed as "not_planned" because it didn't repro on 10.0.0-rc1. However, the current issue demonstrates it does repro on 10.0.0 GA and later — the scenario in this issue involves replacing an entire collection of mixed types (not just a single entity swap), which may be a different/broader manifestation of the same underlying bug.
• EFCore Delete And Add will merge to Update, and throw NullReferenceException #34274 — Related NRE in GenerateColumnModifications but about stored procedures, likely different root cause.

Analysis

The crash occurs in the JSON partial update handling code in ModificationCommand.GenerateColumnModifications. When EF's change tracker detects that entities with the same primary key have been removed and re-added (delete+insert → merged to update), and the new entity is a different TPH derived type that doesn't have the JSON column, FindJsonPartialUpdateInfo encounters a null reference — likely because it expects JSON column mapping on the new entry that doesn't exist (since StringParameter doesn't have the InternalJsonArray JSON column).

This is a core EF Core bug that should be filed at https://github.com/dotnet/efcore. The Npgsql provider is not involved — the same exception occurs on SQL Server with identical stack traces.

Minimal Repro (SQL Server)

Minimal repro

using System;
using System.ComponentModel.DataAnnotations.Schema;
using System.Collections.Generic;
using System.Linq;
using Microsoft.EntityFrameworkCore;
using Microsoft.Extensions.Logging;

var id = Guid.NewGuid().ToString("N");

{
    await using var db = new MyDbContext();
    await db.Database.EnsureDeletedAsync();
    await db.Database.EnsureCreatedAsync();

    var parameterSet = new ParameterSet { Id = id };
    await db.ParameterSets.AddAsync(parameterSet);

    parameterSet.Parameters.Add(new StringParameter { OwnerId = id, Order = 0, Value = "first" });
    parameterSet.Parameters.Add(new AdvancedParameter { OwnerId = id, Order = 1, PublicJsonArray = ["second-a", "second-b"] });
    parameterSet.Parameters.Add(new StringParameter { OwnerId = id, Order = 2, Value = "third" });
    parameterSet.Parameters.Add(new AdvancedParameter { OwnerId = id, Order = 3, PublicJsonArray = ["fourth-a", "fourth-b"] });

    await db.SaveChangesAsync();
}

{
    await using var db = new MyDbContext();

    var parameterSet = await db.ParameterSets.Include(ps => ps.Parameters).FirstAsync(x => x.Id == id);

    parameterSet.Parameters.Clear();
    parameterSet.Parameters.Add(new AdvancedParameter { OwnerId = id, Order = 0, PublicJsonArray = ["fourth-a", "fourth-b"] });
    parameterSet.Parameters.Add(new StringParameter { OwnerId = id, Order = 1, Value = "third" });
    parameterSet.Parameters.Add(new AdvancedParameter { OwnerId = id, Order = 2, PublicJsonArray = ["second-a", "second-b"] });
    parameterSet.Parameters.Add(new StringParameter { OwnerId = id, Order = 3, Value = "first" });

    // NullReferenceException thrown here
    await db.SaveChangesAsync();
}

public class MyDbContext : DbContext
{
    public DbSet<ParameterSet> ParameterSets { get; set; }

    protected override void OnConfiguring(DbContextOptionsBuilder optionsBuilder)
        => optionsBuilder
            .UseSqlServer("Server=localhost;Database=test;User=SA;Password=Abcd5678;Connect Timeout=60;ConnectRetryCount=0;Encrypt=false")
            .LogTo(Console.WriteLine, LogLevel.Information)
            .EnableSensitiveDataLogging();

    protected override void OnModelCreating(ModelBuilder modelBuilder)
    {
        modelBuilder.Entity<ParameterSet>()
            .HasMany(x => x.Parameters)
            .WithOne()
            .HasForeignKey(x => x.OwnerId);

        modelBuilder.Entity<Parameter>()
            .HasDiscriminator(x => x.Discriminator)
            .HasValue<StringParameter>("string")
            .HasValue<AdvancedParameter>("advanced");

        modelBuilder.Entity<Parameter>()
            .HasKey(x => new { x.OwnerId, x.Order });

        modelBuilder.Entity<AdvancedParameter>()
            .OwnsMany(x => x.InternalJsonArray, builder => builder.ToJson());
    }
}

public class ParameterSet
{
    public required string Id { get; init; }
    public virtual ICollection<Parameter> Parameters { get; } = [];
}

public abstract class Parameter(string discriminator)
{
    public string Discriminator { get; } = discriminator;
    public required string OwnerId { get; init; }
    public required int Order { get; init; }
}

public class StringParameter() : Parameter("string")
{
    public required string Value { get; init; }
}

public class AdvancedParameter() : Parameter("advanced")
{
    public virtual ICollection<MyEntry> InternalJsonArray { get; } = [];

    [NotMapped]
    public IEnumerable<string> PublicJsonArray
    {
        get => InternalJsonArray.OrderBy(x => x.Order).Select(x => x.Value);
        set
        {
            InternalJsonArray.Clear();
            foreach (var (item, index) in value.Select((item, index) => (item, index)))
                InternalJsonArray.Add(new MyEntry { Order = index, Value = item });
        }
    }
}

public class MyEntry
{
    public required int Order { get; init; }
    public required string Value { get; init; }
}