Avoid CollectionsMarshal.AsSpan for derived List<T> in Linq

`CollectionsMarshal.AsSpan` relies on the exact internal layout of `List<T>`. Passing a subclass is unsafe because a derived list may reimplement `IEnumerable<T>` with altered enumeration semantics.

Author: xtqqczze

src/libraries/System.Linq/src/System/Linq/Enumerable.cs

@@ -55,7 +55,7 @@ internal static bool TryGetSpan<TSource>(this IEnumerable<TSource> source, out R
             {
                 span = Unsafe.As<TSource[]>(source);
             }
-            else if (source.GetType() == typeof(List<TSource>))
+            else if (source.GetType() == typeof(List<TSource>)) // avoid accidentally bypassing a derived type's reimplementation of IEnumerable<T>
             {
                 span = CollectionsMarshal.AsSpan(Unsafe.As<List<TSource>>(source));
             }

src/libraries/System.Linq/src/System/Linq/Select.cs

@@ -4,6 +4,7 @@
 using System.Collections.Generic;
 using System.Diagnostics;
 using System.Diagnostics.CodeAnalysis;
+using System.Runtime.CompilerServices;
 using static System.Linq.Utilities;
 
 namespace System.Linq
@@ -52,9 +53,9 @@ public static IEnumerable<TResult> Select<TSource, TResult>(
                     return new ArraySelectIterator<TSource, TResult>(array, selector);
                 }
 
-                if (source is List<TSource> list)
+                if (source.GetType() == typeof(List<TSource>)) // avoid accidentally bypassing a derived type's reimplementation of IEnumerable<T>
                 {
-                    return new ListSelectIterator<TSource, TResult>(list, selector);
+                    return new ListSelectIterator<TSource, TResult>(Unsafe.As<List<TSource>>(source), selector);
                 }
 
                 return new IListSelectIterator<TSource, TResult>(ilist, selector);

src/libraries/System.Linq/src/System/Linq/ToCollection.cs

@@ -148,42 +148,34 @@ public static Dictionary<TKey, TSource> ToDictionary<TSource, TKey>(this IEnumer
                 ThrowHelper.ThrowArgumentNullException(ExceptionArgument.keySelector);
             }
 
+            Dictionary<TKey, TSource> dict;
+
             if (source.TryGetNonEnumeratedCount(out int capacity))
             {
                 if (capacity == 0)
                 {
                     return new Dictionary<TKey, TSource>(comparer);
                 }
 
-                if (source is TSource[] array)
+                if (source.TryGetSpan(out ReadOnlySpan<TSource> span))
                 {
-                    return SpanToDictionary(array, keySelector, comparer);
-                }
+                    dict = new Dictionary<TKey, TSource>(span.Length, comparer);
+                    foreach (TSource element in span)
+                    {
+                        dict.Add(keySelector(element), element);
+                    }
 
-                if (source is List<TSource> list)
-                {
-                    ReadOnlySpan<TSource> span = CollectionsMarshal.AsSpan(list);
-                    return SpanToDictionary(span, keySelector, comparer);
+                    return dict;
                 }
             }
 
-            Dictionary<TKey, TSource> d = new Dictionary<TKey, TSource>(capacity, comparer);
+            dict = new Dictionary<TKey, TSource>(capacity, comparer);
             foreach (TSource element in source)
             {
-                d.Add(keySelector(element), element);
+                dict.Add(keySelector(element), element);
             }
 
-            return d;
-        }
-
-        private static Dictionary<TKey, TSource> SpanToDictionary<TSource, TKey>(ReadOnlySpan<TSource> source, Func<TSource, TKey> keySelector, IEqualityComparer<TKey>? comparer) where TKey : notnull
-        {
-            Dictionary<TKey, TSource> d = new Dictionary<TKey, TSource>(source.Length, comparer);
-            foreach (TSource element in source)
-            {
-                d.Add(keySelector(element), element);
-            }
-            return d;
+            return dict;
         }
 
         public static Dictionary<TKey, TElement> ToDictionary<TSource, TKey, TElement>(this IEnumerable<TSource> source, Func<TSource, TKey> keySelector, Func<TSource, TElement> elementSelector) where TKey : notnull =>
@@ -206,42 +198,33 @@ public static Dictionary<TKey, TElement> ToDictionary<TSource, TKey, TElement>(t
                 ThrowHelper.ThrowArgumentNullException(ExceptionArgument.elementSelector);
             }
 
+            Dictionary<TKey, TElement> dict;
+
             if (source.TryGetNonEnumeratedCount(out int capacity))
             {
                 if (capacity == 0)
                 {
                     return new Dictionary<TKey, TElement>(comparer);
                 }
 
-                if (source is TSource[] array)
+                if (source.TryGetSpan(out ReadOnlySpan<TSource> span))
                 {
-                    return SpanToDictionary(array, keySelector, elementSelector, comparer);
-                }
-
-                if (source is List<TSource> list)
-                {
-                    ReadOnlySpan<TSource> span = CollectionsMarshal.AsSpan(list);
-                    return SpanToDictionary(span, keySelector, elementSelector, comparer);
+                    dict = new Dictionary<TKey, TElement>(span.Length, comparer);
+                    foreach (TSource element in span)
+                    {
+                        dict.Add(keySelector(element), elementSelector(element));
+                    }
+                    return dict;
                 }
             }
 
-            Dictionary<TKey, TElement> d = new Dictionary<TKey, TElement>(capacity, comparer);
+            dict = new Dictionary<TKey, TElement>(capacity, comparer);
             foreach (TSource element in source)
             {
-                d.Add(keySelector(element), elementSelector(element));
+                dict.Add(keySelector(element), elementSelector(element));
             }
 
-            return d;
-        }
-
-        private static Dictionary<TKey, TElement> SpanToDictionary<TSource, TKey, TElement>(ReadOnlySpan<TSource> source, Func<TSource, TKey> keySelector, Func<TSource, TElement> elementSelector, IEqualityComparer<TKey>? comparer) where TKey : notnull
-        {
-            Dictionary<TKey, TElement> d = new Dictionary<TKey, TElement>(source.Length, comparer);
-            foreach (TSource element in source)
-            {
-                d.Add(keySelector(element), elementSelector(element));
-            }
-            return d;
+            return dict;
         }
 
         public static HashSet<TSource> ToHashSet<TSource>(this IEnumerable<TSource> source) => source.ToHashSet(comparer: null);

src/libraries/System.Linq/src/System/Linq/Where.cs

@@ -3,6 +3,7 @@
 
 using System.Collections.Generic;
 using System.Diagnostics;
+using System.Runtime.CompilerServices;
 using static System.Linq.Utilities;
 
 namespace System.Linq
@@ -36,9 +37,9 @@ public static IEnumerable<TSource> Where<TSource>(this IEnumerable<TSource> sour
                 return new ArrayWhereIterator<TSource>(array, predicate);
             }
 
-            if (source is List<TSource> list)
+            if (source.GetType() == typeof(List<TSource>))
             {
-                return new ListWhereIterator<TSource>(list, predicate);
+                return new ListWhereIterator<TSource>(Unsafe.As<List<TSource>>(source), predicate);
             }
 
             return new IEnumerableWhereIterator<TSource>(source, predicate);