Tagging subscribers to this area: @JulieLeeMSFT, @jakobbotsch
See info in area-owners.md if you want to be subscribed.

I don't see any issues in the codegen for CoreCLR here, I think the issue is in the NAOT's implementation for getRuntimeTypePointer API, e.g. in CoreCLR it filters out all shared types: https://github.com/dotnet/runtime/blob/main/src/coreclr/vm/jitinterface.cpp#L6191-L6215

Because it's fine for VM internally to allocate cannonical type objects on FOH, isn't? it's just that JIT should never see raw constant handles for them

Why does codegen even attempt to do this if there is a runtime lookup? Is it difficult to abort this if there is a runtime lookup? The typeHnd.IsCanonicalSubtype() honestly feels like something that should be an assert, unless it's difficult for RyuJIT to know this requires a runtime lookup.

(In theory, on native AOT side it would be easy to allow embedding these into generic dictionaries, so one could actually have a runtime lookup for a frozen RuntimeType instance.)

Why does codegen even attempt to do this if there is a runtime lookup? Is it difficult to abort this if there is a runtime lookup

I think it happens just because JIT doesn't expect EE for getRuntimeTypePointer to return cannonical type so it doesn't bother checking. It can be fixed on all uses of getRuntimeTypePointer in JIT to check CLS for being info.compCompHnd->getClassAttribs(handle) & CORINFO_FLG_SHAREDINST) == 0, but I think it's better to do on VM side (less changes, less chances for future bugs).

Here is the place where we create it for this case:

N010 ( 74, 25) [000019] --CXG------                         *  CALL      ref    System.RuntimeType:ToString():System.String:this
N009 ( 60, 19) [000018] --CXG------ this in rcx             \--*  INTRINSIC ref    objGetType
N008 ( 24, 15) [000010] --CXG------                            \--*  CALL help ref    CORINFO_HELP_NEWARR_1_VC
N006 (  9,  7) [000008] #--X------- arg0 in rcx                   +--*  IND       long  
N005 (  6,  5) [000007] #--X-------                               |  \--*  IND       long  
N004 (  4,  3) [000006] ---X---N---                               |     \--*  ADD       long  
N002 (  3,  2) [000004] #--X-------                               |        +--*  IND       long  
N001 (  1,  1) [000003] !----------                               |        |  \--*  LCL_VAR   ref    V00 this         u:1
N003 (  1,  1) [000005] -----------                               |        \--*  CNS_INT   long   48
N007 (  1,  1) [000002] ----------- arg1 in rdx                   \--*  CNS_INT   long   0

N001 [000003]   LCL_VAR   V00 this         u:1 => $80 {InitVal($40)}
IND(obj) is actually a class handle for Foo`1[System.__Canon]

OK, I'll add this on the VM side then.

Can you quickly point me to where are the tests for these?

Tagging subscribers to this area: @agocke, @MichalStrehovsky, @jkotas
See info in area-owners.md if you want to be subscribed.

Can you quickly point me to where are the tests for these?

I don't think there are dedicated tests for RuntimeType being frozen, but there are a lot of typeof(T) related tests in runtime tests. Typically, for bugs, we add new tests under https://github.com/dotnet/runtime/tree/main/src/tests/JIT/Regression/JitBlue with github Id as a name