Fix NullReferenceException materializing JSON owned collections with nested primitive collections under lazy-loading proxies

[Copilot]

Fixes #28688

An owned collection mapped to JSON (OwnsMany(...).ToJson()) whose element contains a nested primitive collection (e.g. IList<long>) threw NullReferenceException in the JSON shaper — but only when UseLazyLoadingProxies() was enabled. Disabling either proxies or the nested collection avoided the failure.

Root cause

In the proxy case, the JSON entity materializer rewriter normalizes the materializer to introduce a converted (non-proxy) variable holding (MyEntity)proxyInstance, which is assigned only at the end of the block. ValueBufferTryReadValueMethodsReplacer rebuilds the primitive-collection populate logic against that variable (instance), so reading the member off it while it was still null threw. Every other property assignment worked because it is rebuilt off the original assignment's node.Left (the proxy instance).

Changes

• ShaperProcessingExpressionVisitor — the primitive-collection branch in ValueBufferTryReadValueMethodsReplacer.VisitBinary now derives its target instance from node.Left (the proxy instance), falling back to instance, matching how all other property assignments are rewritten:

var instanceExpression = node.Left is MemberExpression { Expression: { } leftInstance }
    ? leftInstance
    : instance;

• AdHocJsonQueryTestBase — extended the existing lazy-loading-proxies JSON model with a nested IList<long> and added Project_proxies_entity_with_json_with_primitive_collection, which reproduces the NRE without the fix.

[Copilot]

Pull request overview

Fixes a NullReferenceException during relational JSON materialization when lazy-loading proxies are enabled and a JSON-owned collection element contains a nested primitive collection. The fix aligns the primitive-collection population rewrite with other property assignments by deriving the target instance from the original assignment (node.Left) rather than the converted instance variable which can still be null under proxies.

Changes:

• Update ValueBufferTryReadValueMethodsReplacer to read the existing primitive-collection property value from the original assignment target instance (proxy instance) instead of the converted instance.
• Extend the lazy-loading-proxies JSON test model with an IList<long> primitive collection and seed data.
• Add a regression test that reproduces the proxy + nested primitive-collection scenario and asserts correct materialization.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated no comments.

File	Description
test/EFCore.Specification.Tests/Query/AdHocJsonQueryTestBase.cs	Adds a regression test and extends the lazy-loading-proxies JSON-owned model/seed data with a nested primitive collection.
src/EFCore.Relational/Query/RelationalShapedQueryCompilingExpressionVisitor.ShaperProcessingExpressionVisitor.cs	Fixes instance selection for primitive-collection population under proxies to avoid dereferencing a not-yet-assigned converted instance.