Fix wrong column selection when using OfType in a Linq query

src/NHibernate.Test/Async/NHSpecificTest/GH2626/Fixture.cs

@@ -0,0 +1,77 @@
+//------------------------------------------------------------------------------
+// <auto-generated>
+//     This code was generated by AsyncGenerator.
+//
+//     Changes to this file may cause incorrect behavior and will be lost if
+//     the code is regenerated.
+// </auto-generated>
+//------------------------------------------------------------------------------
+
+
+using System.Linq;
+using NUnit.Framework;
+using NHibernate.Linq;
+
+namespace NHibernate.Test.NHSpecificTest.GH2626
+{
+	using System.Threading.Tasks;
+	[TestFixture]
+	public class FixtureAsync : BugTestCase
+	{
+		protected override void OnSetUp()
+		{
+		}
+
+		protected override void OnTearDown()
+		{
+			using (var session = OpenSession())
+			using (var transaction = session.BeginTransaction())
+			{
+				// The HQL delete does all the job inside the database without loading the entities, but it does
+				// not handle delete order for avoiding violating constraints if any. Use
+				// session.Delete("from System.Object");
+				// instead if in need of having NHibernate ordering the deletes, but this will cause
+				// loading the entities in the session.
+				session.CreateQuery("delete from System.Object").ExecuteUpdate();
+
+				transaction.Commit();
+			}
+		}
+
+		[Test]
+		public async Task SubqueryWithSelectOnSubclassPropertyAsync()
+		{
+			using(var logSpy = new SqlLogSpy())
+			using (var session = OpenSession())
+			{
+				var capabilitiesQuery = session
+										.Query<UserCapabilityAssignment>()
+										.Where(x => x.Name == "aaa")
+										.Select(x => x.UserId);
+
+				await (session.Query<ApplicationUser>()
+						.Where(x => capabilitiesQuery.Contains(x.Id))
+						.ToListAsync());
+				Assert.That(logSpy.GetWholeLog(), Does.Contain("UserId").IgnoreCase);
+			}
+		}
+
+		[Test]
+		public async Task SubqueryWithOfTypeAndSelectOnSubclassPropertyAsync()
+		{
+			using(var logSpy = new SqlLogSpy())
+			using (var session = OpenSession())
+			{
+				var capabilitiesQuery = session
+										.Query<CapabilityAssignment>().OfType<UserCapabilityAssignment>()
+										.Where(x => x.Name == "aaa")
+										.Select(x => x.UserId);
+
+				await (session.Query<ApplicationUser>()
+						.Where(x => capabilitiesQuery.Contains(x.Id))
+						.ToListAsync());
+				Assert.That(logSpy.GetWholeLog(), Does.Contain("UserId").IgnoreCase);
+			}
+		}
+	}
+}

src/NHibernate.Test/NHSpecificTest/GH2626/Entity.cs

@@ -0,0 +1,26 @@
+using System;
+
+namespace NHibernate.Test.NHSpecificTest.GH2626
+{
+	abstract class CapabilityAssignment
+	{
+		public virtual Guid Id { get; set; }
+		public virtual string Name { get; set; }
+	}	
+
+	 class ApplicationUser
+	{
+		public virtual Guid Id { get; set; }
+		public virtual string UserName { get; set; }
+	}
+
+	class RoleCapabilityAssignment : CapabilityAssignment
+	{
+		public virtual Guid RoleId { get; set; }
+	}
+
+	class UserCapabilityAssignment : CapabilityAssignment
+	{
+		public virtual Guid UserId { get; set; }
+	}
+}

src/NHibernate.Test/NHSpecificTest/GH2626/Fixture.cs

@@ -0,0 +1,65 @@
+using System.Linq;
+using NUnit.Framework;
+
+namespace NHibernate.Test.NHSpecificTest.GH2626
+{
+	[TestFixture]
+	public class Fixture : BugTestCase
+	{
+		protected override void OnSetUp()
+		{
+		}
+
+		protected override void OnTearDown()
+		{
+			using (var session = OpenSession())
+			using (var transaction = session.BeginTransaction())
+			{
+				// The HQL delete does all the job inside the database without loading the entities, but it does
+				// not handle delete order for avoiding violating constraints if any. Use
+				// session.Delete("from System.Object");
+				// instead if in need of having NHibernate ordering the deletes, but this will cause
+				// loading the entities in the session.
+				session.CreateQuery("delete from System.Object").ExecuteUpdate();
+
+				transaction.Commit();
+			}
+		}
+
+		[Test]
+		public void SubqueryWithSelectOnSubclassProperty()
+		{
+			using(var logSpy = new SqlLogSpy())
+			using (var session = OpenSession())
+			{
+				var capabilitiesQuery = session
+										.Query<UserCapabilityAssignment>()
+										.Where(x => x.Name == "aaa")
+										.Select(x => x.UserId);
+
+				session.Query<ApplicationUser>()
+						.Where(x => capabilitiesQuery.Contains(x.Id))
+						.ToList();
+				Assert.That(logSpy.GetWholeLog(), Does.Contain("UserId").IgnoreCase);
+			}
+		}
+
+		[Test]
+		public void SubqueryWithOfTypeAndSelectOnSubclassProperty()
+		{
+			using(var logSpy = new SqlLogSpy())
+			using (var session = OpenSession())
+			{
+				var capabilitiesQuery = session
+										.Query<CapabilityAssignment>().OfType<UserCapabilityAssignment>()
+										.Where(x => x.Name == "aaa")
+										.Select(x => x.UserId);
+
+				session.Query<ApplicationUser>()
+						.Where(x => capabilitiesQuery.Contains(x.Id))
+						.ToList();
+				Assert.That(logSpy.GetWholeLog(), Does.Contain("UserId").IgnoreCase);
+			}
+		}
+	}
+}

src/NHibernate.Test/NHSpecificTest/GH2626/Mappings.hbm.xml

@@ -0,0 +1,24 @@
+<?xml version="1.0" encoding="utf-8" ?>
+<hibernate-mapping xmlns="urn:nhibernate-mapping-2.2" assembly="NHibernate.Test"
+                   namespace="NHibernate.Test.NHSpecificTest.GH2626">
+
+  <class name="CapabilityAssignment" table="CapabilityAssignments" discriminator-value="null" abstract="true">
+    <id name="Id" generator="guid.comb" />
+    <discriminator type="int" column="Type" not-null="true" />
+
+    <property name="Name" length="256" not-null="true" />
+
+    <subclass name="UserCapabilityAssignment" discriminator-value="1">
+      <property name="UserId" not-null="true" />
+    </subclass>
+    <subclass name="RoleCapabilityAssignment" discriminator-value="2">
+      <property name="RoleId" not-null="true" />
+    </subclass>
+  </class>
+
+  <class name="ApplicationUser" table="AspNetUsers" dynamic-insert="true" dynamic-update="true">
+    <id name="Id" generator="guid.comb" />
+    <property name="UserName" length="256" not-null="true" />
+  </class>
+
+</hibernate-mapping>

src/NHibernate/Util/ExpressionsHelper.cs

@@ -697,6 +697,12 @@ protected override Expression VisitQuerySourceReference(QuerySourceReferenceExpr
 			{
 				if (node.ReferencedQuerySource is IFromClause fromClause)
 				{
+					// Types will be different when OfType method is used (e.g. Query<A>().OfType<B>())
+					if (fromClause.ItemType != node.Type)
+					{
+						_convertType = node.Type;
+					}
+
 					return base.Visit(fromClause.FromExpression);
 				}