Backport of #109107 to release/9.0

/cc @jakobbotsch

Customer Impact

• Customer reported
• Found internally

#108969

Silent bad code generation in some cases involving structs, type tests, and exception handling. Programs may unexpectedly crash or compute incorrectly.

As an example, given

    private struct S
    {
        public int A, B, C, D;
    }
   ...
        S v = default;
        try
        {
            v = Bar();
            Use((int?)o);
        }
        catch (Exception)
        {
        }

        Use(v.A);
        Use(v.A);

The JIT will promote the v.A field to a local, and so must ensure that all calls to Use have the correct value, even if an exception is thrown. If the exception site is within a type test (here induced by the (int?)o cast) or similar construct within a try, then value of the promoted local may not be initialized correctly.

There is a workaround (using the undocumented env var DOTNET_JitEnablePhysicalPromotion=0) but it will not be easy for customers to determine the underlying problem and realize there is a workaround available.

Regression

• Yes
• No

Regression from .NET 8.

Testing

Verified on the example in #108969 and new test case added to capture this particular pattern.

Risk

Low. The fix is fairly surgical. A small number of methods impacted in our SPMI suite.