NullReferenceException when using two Includes, all fine when using either one

EF Core version: 5.0.9 Database provider: Npgsql Target framework: .NET 5.0 Operating system: Windows IDE: Visual Studio 2022 Preview

I’m getting a weird NullReferenceException when using two Includes. Consider this:

public class Fact
    {
        [Key]
        public Guid FactId { get; set; }

        [ForeignKey("Plan")]
        public Guid PlanId { get; set; }
        public virtual APlan Plan { get; set; }

       // Other fields redacted
    }
public class APlan
    {
        protected APlan()
        {
        }

        [Key]
        public Guid PlanId { get; set; }

        [ForeignKey("Communion")]
        public Guid CommunionId { get; set; }
        public virtual Communion Communion { get; set; }

        // Other fields redacted

        [InverseProperty("Plan")]
        public virtual ICollection<Fact> Facts { get; set; }
    }
    public class SinglePlan : APlan
    {
        // Other fields redacted
    }
    public class Communion
    {
        [Key]
        public Guid CommunionId { get; set; }

        [InverseProperty("Communion")]
        public virtual ICollection<APlan> Plans { get; set; }

        // Other fields redacted
    }

And this is the query:

var commonFilter = _context.Plans
                .Include(p => p.Facts)
                .Include(p => p.Communion);

            var singlePlans = await commonFilter
                .Cast<SinglePlan>()
                .ToArrayAsync();

The exception in NullReferenceException, the stacktrace is:

This exception was originally thrown at this call stack:
    Microsoft.EntityFrameworkCore.Query.RelationalSqlTranslatingExpressionVisitor.BindProperty(Microsoft.EntityFrameworkCore.Query.RelationalSqlTranslatingExpressionVisitor.EntityReferenceExpression, Microsoft.EntityFrameworkCore.Metadata.IProperty)
    Microsoft.EntityFrameworkCore.Query.RelationalSqlTranslatingExpressionVisitor.TryBindMember(System.Linq.Expressions.Expression, Microsoft.EntityFrameworkCore.Metadata.MemberIdentity)
    Microsoft.EntityFrameworkCore.Query.RelationalSqlTranslatingExpressionVisitor.VisitMethodCall(System.Linq.Expressions.MethodCallExpression)
    Npgsql.EntityFrameworkCore.PostgreSQL.Query.Internal.NpgsqlSqlTranslatingExpressionVisitor.VisitMethodCall(System.Linq.Expressions.MethodCallExpression)
    System.Linq.Expressions.MethodCallExpression.Accept(System.Linq.Expressions.ExpressionVisitor)
    System.Linq.Expressions.ExpressionVisitor.Visit(System.Linq.Expressions.Expression)
    Microsoft.EntityFrameworkCore.Query.RelationalSqlTranslatingExpressionVisitor.VisitBinary(System.Linq.Expressions.BinaryExpression)
    Npgsql.EntityFrameworkCore.PostgreSQL.Query.Internal.NpgsqlSqlTranslatingExpressionVisitor.VisitBinary(System.Linq.Expressions.BinaryExpression)
    System.Linq.Expressions.BinaryExpression.Accept(System.Linq.Expressions.ExpressionVisitor)
    System.Linq.Expressions.ExpressionVisitor.Visit(System.Linq.Expressions.Expression)
    ...
    [Call Stack Truncated]

The fun part is that if I remove EITHER of theese Includes, the query work. It won’t work only when I use them both.

[ajcvickers]

Note from triage: we don’t plan to fix this in a servicing release because it only happens when .Cast<>() is used in this way, which is uncommon and for which there is a workaround as @roji describe above. See the release planning process for more information on how we decide what to patch.

[roji]

If you post your some complete code I may be able to help you further with a workaround; for example, you may be able to get by with a generic function that composes over _context.Set<T>().