JIT: Inlining may produce incorrectly byref-typed SUB trees #84291
Description
See #82166 (comment):
STMT00051 ( 0x000[E-] ... ??? ) <- INL02 @ 0x000[E-] <- INLRT @ 0x0A1[E-]
[000177] -A--------- ▌ ASG long
[000176] D------N--- ├──▌ LCL_VAR long V10 tmp1
[000175] ----------- └──▌ SUB byref
[000173] ----------- ├──▌ FIELD_ADDR byref SequentialLayoutMinPacking`1[ushort]:_byte
[000174] ----------- │ └──▌ LCL_VAR_ADDR byref V04 loc1
[000172] ----------- └──▌ LCL_VAR_ADDR long V04 loc1 impGetByRefResultType bases its result on the type of operands, yet the inliner can directly substitute argument trees in some cases causing this to not really work out in the expected way.