JIT: Fix crossgen failure in gtTryRemoveBoxUpstreamEffects (#14016)

In some R2R expansions the type handle is not an explicit operand to
the newobj helper. So we must bail out of removal attempts when the
type handle is desired and we see such an expansion.

Closes #13942.
Also likely will fix #13930.

1 files changed, 13 insertions, 3 deletions

diff --git a/src/jit/gentree.cpp b/src/jit/gentree.cpp
index 67b2fb6ebc..ff7372cce1 100644
--- a/src/jit/gentree.cpp
+++ b/src/jit/gentree.cpp
@@ -12538,9 +12538,19 @@ GenTree* Compiler::gtTryRemoveBoxUpstreamEffects(GenTree* op, BoxRemovalOptions
         }
         else if (asgSrcOper == GT_CALL)
         {
-            GenTreeCall*    newobjCall = asgSrc->AsCall();
-            GenTreeArgList* newobjArgs = newobjCall->gtCallArgs->AsArgList();
-            boxTypeHandle              = newobjArgs->Current();
+            GenTreeCall* newobjCall = asgSrc->AsCall();
+            GenTree*     newobjArgs = newobjCall->gtCallArgs;
+
+            // In R2R expansions the handle may not be an explicit operand to the helper,
+            // so we can't remove the box.
+            if (newobjArgs == nullptr)
+            {
+                assert(newobjCall->IsHelperCall(this, CORINFO_HELP_READYTORUN_NEW));
+                JITDUMP("bailing; newobj via R2R helper\n");
+                return nullptr;
+            }
+
+            boxTypeHandle = newobjArgs->AsArgList()->Current();
         }
         else
         {