[NativeAOT] Bug: Array.CreateInstance method not working as expected

[TickThunder]

Description

00 0000007d`e777f310 00007ff7`d58ddb4b     MiniTest!S_P_TypeLoader_Internal_Runtime_TypeLoader_TypeLoaderEnvironment__TryGetArrayTypeForElementType+0xd [Q:\A\CoreCLR\src\coreclr\nativeaot\System.Private.TypeLoader\src\Internal\Runtime\TypeLoader\TypeLoaderEnvironment.cs @ 268] 
01 0000007d`e777f380 00007ff7`d58b2dc4     MiniTest!S_P_Reflection_Execution_Internal_Reflection_Execution_ExecutionEnvironmentImplementation__TryGetArrayTypeForElementType+0x6b [Q:\A\CoreCLR\src\coreclr\nativeaot\System.Private.Reflection.Execution\src\Internal\Reflection\Execution\ExecutionEnvironmentImplementation.MappingTables.cs @ 116] 
02 0000007d`e777f3e0 00007ff7`d58b2b7a     MiniTest!S_P_CoreLib_System_Reflection_Runtime_TypeInfos_RuntimeArrayTypeInfo__GetRuntimeTypeHandleIfAny+0xf4 [Q:\A\CoreCLR\src\coreclr\nativeaot\System.Private.CoreLib\src\System\Reflection\Runtime\General\TypeUnifier.cs @ 122] 
03 0000007d`e777f470 00007ff7`d58b0646     MiniTest!S_P_CoreLib_System_Reflection_Runtime_TypeInfos_RuntimeArrayTypeInfo__GetArrayTypeInfo+0x4a [Q:\A\CoreCLR\src\coreclr\nativeaot\System.Private.CoreLib\src\System\Reflection\Runtime\General\TypeUnifier.cs @ 86] 
04 0000007d`e777f4d0 00007ff7`d58b1e52     MiniTest!S_P_CoreLib_System_Reflection_Runtime_General_TypeUnifier__GetArrayType+0x26 [Q:\A\CoreCLR\src\coreclr\nativeaot\System.Private.CoreLib\src\System\Reflection\Runtime\General\TypeUnifier.cs @ 42] 
05 0000007d`e777f510 00007ff7`d580e6a1     MiniTest!S_P_CoreLib_System_Reflection_Runtime_TypeInfos_RuntimeTypeInfo__MakeArrayType+0x22 [Q:\A\CoreCLR\src\coreclr\nativeaot\System.Private.CoreLib\src\System\Reflection\Runtime\TypeInfos\RuntimeTypeInfo.cs @ 407] 
06 0000007d`e777f560 00007ff7`d58148eb     MiniTest!S_P_CoreLib_System_RuntimeType__MakeArrayType+0x31 [Q:\A\CoreCLR\src\coreclr\nativeaot\System.Private.CoreLib\src\System\RuntimeType.cs @ 853] 
07 0000007d`e777f5b0 00007ff7`d58168ad     MiniTest!S_P_CoreLib_System_Array__InternalCreate+0x23b [Q:\A\CoreCLR\src\coreclr\nativeaot\System.Private.CoreLib\src\System\Array.NativeAot.cs @ 81] 
08 0000007d`e777f6a0 00007ff7`d5803a71     MiniTest!S_P_CoreLib_System_Array__CreateInstance+0xad [Q:\A\CoreCLR\src\libraries\System.Private.CoreLib\src\System\Array.cs @ 78] 
09 0000007d`e777f700 00007ff7`d594aa05     MiniTest!MiniTest_Program___Main__+0x41 [E:\MiniTestProgram\MiniTest\Program.cs @ 1] 
0a 0000007d`e777f750 00007ff7`d59d26e0     MiniTest!MiniTest__Module___StartupCodeMain+0x85 [ @ 16707566] 
0b 0000007d`e777f7b0 00007ff7`d5a539f8     MiniTest!wmain+0xb0 [Q:\A\CoreCLR\src\coreclr\nativeaot\Bootstrap\main.cpp @ 225] 
0c (Inline Function) --------`--------     MiniTest!invoke_main+0x22 [D:\a\_work\1\s\src\vctools\crt\vcstartup\src\startup\exe_common.inl @ 90] 
0d 0000007d`e777f800 00007ff9`b27b7344     MiniTest!__scrt_common_main_seh+0x10c [D:\a\_work\1\s\src\vctools\crt\vcstartup\src\startup\exe_common.inl @ 288] 
0e 0000007d`e777f840 00007ff9`b3be26b1     KERNEL32!BaseThreadInitThunk+0x14
0f 0000007d`e777f870 00000000`00000000     ntdll!RtlUserThreadStart+0x21

TryGetArrayTypeForElementType_LookupOnly returns true with an incorrect type match.

        public bool TryGetArrayTypeForElementType(RuntimeTypeHandle elementTypeHandle, bool isMdArray, int rank, out RuntimeTypeHandle arrayTypeHandle)
        {
            // TryGetArrayTypeForElementType_LookupOnly returns true with an incorrect type match.
            if (TryGetArrayTypeForElementType_LookupOnly(elementTypeHandle, isMdArray, rank, out arrayTypeHandle))
            {
                return true;
            }

            using (_typeLoaderLock.EnterScope())
            {
                if (isMdArray && (rank < MDArray.MinRank) && (rank > MDArray.MaxRank))
                {
                    arrayTypeHandle = default(RuntimeTypeHandle);
                    return false;
                }

                if (TypeSystemContext.GetArrayTypesCache(isMdArray, rank).TryGetValue(elementTypeHandle, out arrayTypeHandle))
                    return true;

                return TypeBuilder.TryBuildArrayType(elementTypeHandle, isMdArray, rank, out arrayTypeHandle);
            }
        }

Reproduction Steps

var t = System.Array.CreateInstance(typeof(EnvironmentPresetReference), 0);
System.Console.WriteLine(t);

public class EnvironmentPresetReference
{
    public string presetName;
}

class EnvironmentController
{
    public EnvironmentPresetReference[] environmentPresetReferences;
}

and use TrimmerRootAssembly.

Expected behavior

EnvironmentPresetReference[]

Actual behavior

Unhandled exception. System.NotSupportedException: 'EnvironmentPresetReference[]' is missing native code or metadata. This can happen for code that is not compatible with trimming or AOT. Inspect and fix trimming and AOT related warnings that were generated when the app was published. For more information see https://aka.ms/nativeaot-compatibility
   at Internal.Runtime.Augments.RuntimeAugments.EnsureMethodTableSafeToAllocate(MethodTable*) + 0x66
   at Internal.Runtime.Augments.RuntimeAugments.NewArray(RuntimeTypeHandle, Int32) + 0x2e
   at System.Array.InternalCreate(RuntimeType, Int32, Int32*, Int32*) + 0x266
   at System.Array.CreateInstance(Type, Int32) + 0xad
   at Program.<Main>$(String[] args)

Regression?

The bug was caused by #111610.

Known Workarounds

No response

Configuration

No response

Other information

@MichalStrehovsky

[dotnet-policy-service]

Tagging subscribers to this area: @tarekgh, @tommcdon, @pjanotti
See info in area-owners.md if you want to be subscribed.

[MichalStrehovsky]

The bug was caused by #111610.

The code would succeed before that PR, but the resulting array is not a great array:

var arr = Array.CreateInstance(typeof(Atom), 0);

//
// In .NET 9, this prints false!
//
Console.WriteLine(arr is Atom[]);

class Atom;

The behavior in main is an improvement over this since the program already generates a compile-time warning ("warning IL3050: Using member 'System.Array.CreateInstance(Type, Int32)' which has 'RequiresDynamicCodeAttribute' can break functionality when AOT compiling. The code for an array of the specified type might not be available.").

That said, for reference type elements, we should be able to do better than this, so this should be fixed, but it will only work for reference type elements.

[dotnet-policy-service]

Tagging subscribers to this area: @agocke, @MichalStrehovsky, @jkotas
See info in area-owners.md if you want to be subscribed.

[huoyaoyuan]

The recommended workaround is Array.CreateInstanceFromArrayType(typeof(EnvironmentPresetReference[]), 0), which don't trigger AOT warning.

BTW, is there any difficulty to infer and preserve the (unique) SZ array type based on passed Type instance?

[MichalStrehovsky]

BTW, is there any difficulty to infer and preserve the (unique) SZ array type based on passed Type instance?

No difficulty, but I don't see a scenario where that would be needed. If the type is visible statically at the callsite, Array.CreateInstance(typeof(XYZ), length) is just a slow way to do new XYZ[length]. I can't find a scenario where it wouldn't be possible to just do the non-reflection way.