Polymorphic JSON deserialization hangs indefinitely in native AOT since .NET 9 Preview 7

[cfbao]

Describe the bug

When used in native AOT apps, System.Text.Json's polymorphic deserialization hangs the program indefinitely.

To Reproduce

Create project with dotnet new console --aot and use the following code:

using System.Text.Json;
using System.Text.Json.Serialization;

Console.WriteLine("start");
var res = JsonSerializer.Deserialize(
	"""
	{
		"$type": "person",
		"Name": "John"
	}
	""",
	MyJsonContext.Default.Base
);

Console.WriteLine($"result: {res}");

[JsonDerivedType(typeof(Person), "person")]
abstract record Base();

record Person(string Name) : Base;

[JsonSerializable(typeof(Base))]
internal partial class MyJsonContext : JsonSerializerContext;

Then publish the app with dotnet publish and start the resulting executable.
The program will hang before printing result: ....

Further technical details

Issue did not exist in .NET SDK 9.0.100-preview.6.24328.19.
Issue started appearing in .NET SDK 9.0.100-preview.7.24407.12 and persists in 9.0.100-rc.1.24452.12.
Issue can be observed on both Windows 10 and WSL2 (Ubuntu 22.04).

[dotnet-issue-labeler]

I couldn't figure out the best area label to add to this issue. If you have write-permissions please help me learn by adding exactly one area label.

[dotnet-issue-labeler]

I couldn't figure out the best area label to add to this issue. If you have write-permissions please help me learn by adding exactly one area label.

[cfbao]

Not sure if this belongs here or in the runtime repo. Please move as you see fit.

[dotnet-policy-service]

Tagging subscribers to this area: @dotnet/area-system-text-json, @gregsdennis
See info in area-owners.md if you want to be subscribed.

[eiriktsarpalis]

Sounds like a potential duplicate of #107740. Are you able to reproduce using the RC2 bits?

[cfbao]

Took some fiddling to figure out how to use RC2 but got it working.
I can no longer repro with RC2. Seems like it's resolved then. Great!