To be honest - this is very much "I don't know what I'm doing here". I "brute forced" this solution based on the changes from #57403 and the investigation I was doing regarding this issue from before this PR was created. I kinda knew where a fix potentially could be applied and that's it.

I can move this code to a helper function etc. I just didn't bother because I'm not sure yet how good this fix is.

I'm not sure if this should be somehow cached (instantiations are cached in this function). And the type parameter that is now mapped (P) is still not in clone.outerTypeParameters - I have no idea if that's a problem or not.

I'm not sure if this should be somehow cached

100%. Should definitely be cached. And you should be able to get that by adding the missing bits of this into instantiateAnonymousType, rather than here. It already does the clone.outerTypeParameters = singleSignatureType.outerTypeParameters; bit - what it's missing is the "apply mapper to signature inside the type" bit. Ish. That's supposed to be implicit in the result.mapper = mapper; line already there... you'd assume, but alas - it looks like that only actually does something for types with a .target member. That may be the quickest fix - just set the .target of the type.

I pushed out changes based on the stuff that you have mentioned here. No extra work had to be done in instantiateAnonymousType though. That already works (it sets the mapper and the target)... it just was never used in this case.

The problem was that the computed id for this instantiation was the same as the id computed for the target in the branch that initializes target.instantiations. In other words, target was returned as that was grabbed from the target.instantiations and assigned as the existing result.