[browser][CoreCLR][R2R] System.Linq.Expressions tests trap in PrepareInterpreterCode #134261

Description

The full trimmed browser-Wasm CoreCLR ReadyToRun library-test lane crashes while running System.Linq.Expressions.Tests with a native memory access violation in PrepareInterpreterCode. The process terminates before xUnit can publish results for the assembly.

Found while bringing up #133193.

Reproduction Steps

Build and run System.Linq.Expressions.Tests for browser-Wasm CoreCLR with:

TestWasmReadyToRun=true
EnableAggressiveTrimming=true
RuntimeFlavor=CoreCLR
Configuration=Release

The failure reproduced in PR #133656, Azure DevOps build 1603190, Helix job 3158c862-61f5-4cf9-bb24-6ecdf2cfe895, work item WasmTestOnChrome-CLR-ST-Batch-7.

Expected behavior

The library test assembly completes and reports its xUnit results.

Actual behavior

RuntimeError: memory access out of bounds
    at PrepareInterpreterCode(MethodDesc*, InterpMethodContextFrame*, InterpreterFrame*, int const*)
    at InterpExecMethod(...)
    at ExecuteInterpretedMethod(...)
    at WasmR2RToInterpreterThunk(iTip)
    at System.Linq.Expressions.Interpreter.FuncCallInstruction`2.Run(...)
    at System.Linq.Expressions.Interpreter.Interpreter.Run(...)
    at System.Linq.Expressions.Interpreter.LightLambda.Run(...)

The stack later reaches System.Linq.Expressions.Tests.CallTests.Call_NoParameters through dynamic invocation.

Regression?

Unknown. This configuration did not previously run the broad library test set with CoreCLR ReadyToRun.

Known Workarounds

Keep only System.Linq.Expressions.Tests.dll interpreted while leaving System.Linq.Expressions and the rest of the framework ReadyToRun compiled.

Configuration

Browser-Wasm CoreCLR Release, aggressively trimmed per-app ReadyToRun, Linux Helix host, Chrome 153.

Other information

This is distinct from ordinary trimming failures because it terminates in native interpreter preparation. Re-enable the test assembly's R2R coverage when the interpreter/R2R transition no longer faults.