[release/6.0] Fix loop cloning of array of struct with array field (#67496)

Loop cloning needs to parse what morph creates from GT_INDEX nodes
to determine if there are array accesses with bounds checks that
could potentially be optimized. For jagged array access, this can
be a "comma chain" of bounds checks and array element address expressions.
For a case where an array of structs had a struct field, such as
`ValueTuple<int[], int>[]`, cloning was confusing the expression
`a[i].Item1[j]` for the jagged array access `a[i][j]`.

The fix here is to keep track of the type of the `GT_INDEX` node that is
being morphed, in the `GT_BOUNDS_CHECK` node that is created for it.
(This is the only thing cloning parses, to avoid the need to parse
the very complex trees morph can create.) This type is then checked
when parsing the "comma chain" trees. If a non-`TYP_REF` is found (such
as a `TYP_STRUCT` in the above example), no more levels of array indexing
are considered. (`TYP_REF` is what an array object would have, for a jagged
array.)

Fixes #66254.

1 files changed, 1 insertions, 0 deletions

diff --git a/src/coreclr/jit/morph.cpp b/src/coreclr/jit/morph.cpp
index ba5f450b616..8abff908855 100644
--- a/src/coreclr/jit/morph.cpp
+++ b/src/coreclr/jit/morph.cpp
@@ -5659,6 +5659,7 @@ GenTree* Compiler::fgMorphArrayIndex(GenTree* tree)
 
         GenTreeBoundsChk* arrBndsChk = new (this, GT_ARR_BOUNDS_CHECK)
             GenTreeBoundsChk(GT_ARR_BOUNDS_CHECK, TYP_VOID, index, arrLen, SCK_RNGCHK_FAIL);
+        arrBndsChk->gtInxType        = elemTyp;
 
         bndsChk = arrBndsChk;