[wasm] Fix JIT helper calls modeled with the wrong return arity

src/coreclr/System.Private.CoreLib/src/System/Runtime/CompilerServices/CastHelpers.cs

@@ -695,7 +695,9 @@ private static void Unbox_TypeTest_Helper(MethodTable *pMT1, MethodTable *pMT2)
 #endif // FEATURE_TYPEEQUIVALENCE
                 )
             {
-                CastHelpers.ThrowInvalidCastException(pMT1, pMT2);
+                // The JIT passes (target, source) to match Unbox, but ThrowInvalidCastException
+                // takes (source, target) and names them in that order in the message.
+                CastHelpers.ThrowInvalidCastException(pMT2, pMT1);
             }
         }
 

src/coreclr/jit/compiler.h

@@ -3362,8 +3362,12 @@ class Compiler
     // On wasm these helpers return void* (InitHelpers.InitClass/InitInstantiatedClass). Model them as
     // value-returning so the call_indirect signature matches the compiled managed helper; the value is unused.
     static constexpr var_types HelperInitClassRetType = TYP_I_IMPL;
+    // Likewise for CastHelpers.Unbox at sites that discard the result. Modeling it TYP_BYREF off
+    // wasm is equally correct but costs code size for no benefit.
+    static constexpr var_types HelperUnboxDiscardedRetType = TYP_BYREF;
 #else
-    static constexpr var_types HelperInitClassRetType = TYP_VOID;
+    static constexpr var_types HelperInitClassRetType      = TYP_VOID;
+    static constexpr var_types HelperUnboxDiscardedRetType = TYP_VOID;
 #endif // TARGET_WASM
 
     GenTreeCall* gtNewVirtualFunctionLookupHelperCallNode(

src/coreclr/jit/importer.cpp

@@ -10700,7 +10700,9 @@ void Compiler::impImportBlockCode(BasicBlock* block)
                     { // compDonotInline()
                         return;
                     }
-                    op1 = gtNewHelperCallNode(helper, TYP_VOID, op2, op1);
+                    // The byref is formed from clone + TARGET_POINTER_SIZE below, so discard the
+                    // helper result to keep the enclosing COLON/QMARK void.
+                    op1 = gtUnusedValNode(gtNewHelperCallNode(helper, HelperUnboxDiscardedRetType, op2, op1));
 
                     op1 = new (this, GT_COLON) GenTreeColon(TYP_VOID, gtNewNothingNode(), op1);
                     op1 = gtNewQmarkNode(TYP_VOID, condBox, op1->AsColon());

src/coreclr/jit/morph.cpp

@@ -64,7 +64,7 @@ PhaseStatus Compiler::fgMorphInit()
             {
                 // confirm that the argument is a GC pointer (for debugging (GC stress))
                 GenTree* op = gtNewLclvNode(i, TYP_REF);
-                op          = gtNewHelperCallNode(CORINFO_HELP_CHECK_OBJ, TYP_VOID, op);
+                op          = gtNewHelperCallNode(CORINFO_HELP_CHECK_OBJ, TYP_REF, op);
 
                 fgNewStmtAtBeg(fgFirstBB, op);
                 madeChanges = true;

src/coreclr/jit/objectalloc.cpp

@@ -2832,12 +2832,16 @@ void ObjectAllocator::RewriteUses()
 
                         // Rewrite the call to make the box accesses explicit in jitted code.
                         // user = COMMA(
-                        //           CALL(UNBOX_HELPER_TYPETEST, obj->MethodTable, type),
+                        //           CALL(UNBOX_HELPER_TYPETEST, type, obj->MethodTable),
                         //           ADD(obj, TARGET_POINTER_SIZE))
                         //
                         JITDUMP("Rewriting to invoke box type test helper%s\n", isForEffect ? " for side effect" : "");
 
+                        // Unbox_TypeTest returns void, unlike Unbox. isForEffect above reads the
+                        // original type.
                         call->gtCallMethHnd = m_compiler->eeFindHelper(CORINFO_HELP_UNBOX_TYPETEST);
+                        call->gtType        = TYP_VOID;
+                        call->gtReturnType  = TYP_VOID;
                         GenTree* const mt   = m_compiler->gtNewMethodTableLookup(lcl, /* onStack */ true);
                         call->gtArgs.Remove(secondArg);
                         call->gtArgs.PushBack(m_compiler, NewCallArg::Primitive(mt));

src/tests/JIT/Regression/JitBlue/Runtime_131377/Runtime_131377.cs

@@ -0,0 +1,36 @@
+// Licensed to the .NET Foundation under one or more agreements.
+// The .NET Foundation licenses this file to you under the MIT license.
+
+// Stack allocating a box retargets its unbox to the void UNBOX_TYPETEST helper, but the call kept
+// its byref type, so wasm emitted a value-returning call_indirect and trapped. The non-Guid arg is
+// load bearing: a same-type unbox skips the helper. Only reproduces under crossgen wasm R2R.
+
+using System;
+using System.Runtime.CompilerServices;
+using Xunit;
+
+public class Runtime_131377
+{
+    [Fact]
+    public static void TestEntryPoint()
+    {
+        Unbox(null);
+        Assert.Throws<InvalidCastException>(() => Unbox("not a guid"));
+    }
+
+    [MethodImpl(MethodImplOptions.NoInlining)]
+    private static void Unbox(object o)
+    {
+        if (o is null)
+        {
+            o = new Guid();
+        }
+
+        Consume((Guid)o);
+    }
+
+    [MethodImpl(MethodImplOptions.NoInlining)]
+    private static void Consume<T>(T _)
+    {
+    }
+}

src/tests/JIT/Regression/Regression_o_2.csproj

@@ -127,6 +127,7 @@
     <Compile Include="JitBlue\Runtime_117794\Runtime_117794.cs" />
     <Compile Include="JitBlue\Runtime_119710\Runtime_119710.cs" />
     <Compile Include="JitBlue\Runtime_1241\Runtime_1241.cs" />
+    <Compile Include="JitBlue\Runtime_131377\Runtime_131377.cs" />
     <Compile Include="JitBlue\Runtime_13417\Runtime_13417.cs" />
     <Compile Include="JitBlue\Runtime_13669\Runtime_13669.cs" />
     <Compile Include="JitBlue\Runtime_13762\Runtime_13762.cs" />