Avoid CollectionsMarshal.AsSpan for derived List<T>

* `Task.WaitAll`
* `Task.Whenall`
* `string.Join`

Related: dotnet#118682

Author: xtqqczze

src/libraries/System.Private.CoreLib/src/System/String.Manipulation.cs

@@ -784,19 +784,19 @@ private static string JoinCore(ReadOnlySpan<char> separator, string?[] value, in
 
         public static string Join(string? separator, IEnumerable<string?> values)
         {
-            if (values is List<string?> valuesList)
+            if (values is null)
             {
-                return JoinCore(separator.AsSpan(), CollectionsMarshal.AsSpan(valuesList));
+                ThrowHelper.ThrowArgumentNullException(ExceptionArgument.values);
             }
 
-            if (values is string?[] valuesArray)
+            if (values.GetType() == typeof(List<string?>)) // avoid accidentally bypassing a derived type's reimplementation of IEnumerable<T>
             {
-                return JoinCore(separator.AsSpan(), new ReadOnlySpan<string?>(valuesArray));
+                return JoinCore(separator.AsSpan(), CollectionsMarshal.AsSpan((List<string?>)values));
             }
 
-            if (values == null)
+            if (values is string?[] valuesArray)
             {
-                ThrowHelper.ThrowArgumentNullException(ExceptionArgument.values);
+                return JoinCore(separator.AsSpan(), new ReadOnlySpan<string?>(valuesArray));
             }
 
             using (IEnumerator<string?> en = values.GetEnumerator())

src/libraries/System.Private.CoreLib/src/System/Threading/Tasks/Task.cs

@@ -4936,10 +4936,15 @@ public static void WaitAll(IEnumerable<Task> tasks, CancellationToken cancellati
                 ThrowHelper.ThrowArgumentNullException(ExceptionArgument.tasks);
             }
 
-            ReadOnlySpan<Task> span =
-                tasks is List<Task> list ? CollectionsMarshal.AsSpan(list) :
-                tasks is Task[] array ? array :
-                CollectionsMarshal.AsSpan(new List<Task>(tasks));
+            ReadOnlySpan<Task> span;
+            if (tasks.GetType() == typeof(List<Task>)) // avoid accidentally bypassing a derived type's reimplementation of IEnumerable<T>
+            {
+                span = CollectionsMarshal.AsSpan((List<Task>)tasks);
+            }
+            else
+            {
+                span = tasks is Task[] array ? array : CollectionsMarshal.AsSpan(new List<Task>(tasks));
+            }
 
             WaitAllCore(span, Timeout.Infinite, cancellationToken);
         }
@@ -5933,26 +5938,26 @@ public static Task WhenAll(IEnumerable<Task> tasks)
                 ThrowHelper.ThrowArgumentNullException(ExceptionArgument.tasks);
             }
 
-            int? count = null;
+            if (tasks.GetType() == typeof(List<Task>)) // avoid accidentally bypassing a derived type's reimplementation of IEnumerable<T>
+            {
+                return WhenAll(CollectionsMarshal.AsSpan((List<Task>)tasks));
+            }
+
+            int capacity = 0;
             if (tasks is ICollection<Task> taskCollection)
             {
                 if (tasks is Task[] taskArray)
                 {
                     return WhenAll((ReadOnlySpan<Task>)taskArray);
                 }
 
-                if (tasks is List<Task> taskList)
-                {
-                    return WhenAll(CollectionsMarshal.AsSpan(taskList));
-                }
-
-                count = taskCollection.Count;
+                capacity = taskCollection.Count;
             }
 
             // Buffer the tasks into a temporary span. Small sets of tasks are common,
             // so for <= 8 we stack allocate.
-            ValueListBuilder<Task> builder = count is > 8 ?
-                new ValueListBuilder<Task>(count.Value) :
+            ValueListBuilder<Task> builder = capacity is > 8 ?
+                new ValueListBuilder<Task>(capacity) :
                 new ValueListBuilder<Task>([null, null, null, null, null, null, null, null]);
             foreach (Task task in tasks)
             {