[release/8.0] [mono] Disallow casts of bounded arrays to array specia…

…l interfaces (#93617)

* [mono] Disallow casts of bounded arrays to array special interfaces

Fixes #93597

* exclude lower bound regression test on NativeAOT

* try to fix nativaot exclude

---------

Co-authored-by: Aleksey Kliger <alklig@microsoft.com>

src/mono/mono/metadata/class.c

@@ -4100,7 +4100,7 @@ mono_class_is_assignable_from_general (MonoClass *klass, MonoClass *oklass, gboo
 			return;
 		}
 
-		if (m_class_is_array_special_interface (klass) && m_class_get_rank (oklass) == 1) {
+		if (m_class_is_array_special_interface (klass) && m_class_get_rank (oklass) == 1 && m_class_get_byval_arg (oklass)->type == MONO_TYPE_SZARRAY) {
 			if (mono_class_is_gtd (klass)) {
 				/* klass is an array special gtd like
 				 * IList`1<>, and oklass is X[] for some X.

src/tests/Loader/classloader/regressions/GitHub_93597/GitHub_93597.cs

@@ -0,0 +1,43 @@
+// Licensed to the .NET Foundation under one or more agreements.
+// The .NET Foundation licenses this file to you under the MIT license.
+using System;
+using System.Collections.Generic;
+using System.Runtime.CompilerServices;
+
+public class ReproGH93597 {
+        public static int Main() {
+                var expected = new int[] {5,4,3,2,1};
+
+                const int LowerBound = 5;
+
+                var expectedNzlba = NonZeroLowerBoundArray(expected, LowerBound);
+
+                return Helper(expectedNzlba);
+                return 100;
+        }
+        [MethodImpl(MethodImplOptions.NoInlining)]
+        private static int Helper(Array a) {
+                IEnumerable<int> ie = null;
+                try {
+                        ie = (IEnumerable<int>)a;
+                } catch (InvalidCastException) {
+                        Console.WriteLine ("caught ICE, good");
+                        return 100;
+                }
+                ie.GetEnumerator(); // mono crashes here
+                return 101;
+        }
+
+
+        private static Array NonZeroLowerBoundArray(Array szArrayContents, int lowerBound)
+        {
+                Array array = Array.CreateInstance(szArrayContents.GetType().GetElementType(), new int[] { szArrayContents.Length }, new int[] { lowerBound });
+                for (int i = 0; i < szArrayContents.Length; i++)
+                {
+                        array.SetValue(szArrayContents.GetValue(i), i + lowerBound);
+                }
+                return array;
+        }
+
+}
+

src/tests/Loader/classloader/regressions/GitHub_93597/GitHub_93597.csproj

@@ -0,0 +1,5 @@
+<Project Sdk="Microsoft.NET.Sdk">
+  <ItemGroup>
+    <Compile Include="GitHub_93597.cs" />
+  </ItemGroup>
+</Project>

src/tests/issues.targets

@@ -1162,6 +1162,7 @@
         <ExcludeList Include="$(XunitTestBinBase)/JIT/Methodical\VT\port\huge_gcref_d\*" />
         <ExcludeList Include="$(XunitTestBinBase)/JIT/Methodical\VT\port\huge_gcref_r\*" />
         <ExcludeList Include="$(XunitTestBinBase)/JIT/Performance/CodeQuality/Benchstones/MDBenchI/MDGeneralArray/MDGeneralArray/*" />
+        <ExcludeList Include="$(XunitTestBinBase)/Loader/classloader/regressions/GitHub_93597/GitHub_93597/*" />
 
         <!-- Covariant returns -->
         <!-- https://github.com/dotnet/runtimelab/issues/205 -->