JIT: (bug) folding a constant switch with a shared case target zeroes the target's profile weight ("Inconsistent profile data" assert) #134896

When morph folds a constant BBJ_SWITCH and the taken case shares its FlowEdge with another case, the target's weight is subtracted twice, leaving the only live block with weight 0.

Minimal Repro

using System;
using System.Runtime.CompilerServices;

public class Program
{
    static int Zero() => 0;

    [MethodImpl(MethodImplOptions.NoInlining | MethodImplOptions.AggressiveOptimization)]
    static int Test(int a)
    {
        switch (Zero())
        {
            default: return a + 2;
            case 0: case 1: return a;
            case 2: return a + 1;
            case 3: return a * 3;
        }
    }

    static void Main() => Console.WriteLine(Test(5));
}

Expected

5

Actual

Checked runtime:

Assertion failed '!"Inconsistent profile data"' in 'Program:Test(int):int' during 'Morph - Global' (IL size 42; hash 0x5b844c46; FullOpts)
    File: src\coreclr\jit\fgprofile.cpp:4924

Regression?

The assert only fires on Checked builds, so release builds of .NET 8 through 11 RC2 print 5. Based on source history, the faulty weight update has existed since .NET 10 (845dc11).

Notes

In fgFoldConditional (BBJ_SWITCH), decreaseBBProfileWeight(curEdge->getLikelyWeight()) runs once per jump-table slot. For the second slot of a shared edge, the retained edge's likelihood was already set to 1.0, so the full block weight is subtracted from the target.
The target is BBJ_RETURN, so profileInconsistent isn't set. On release builds the result is silently wrong profile data (whole method treated as run-rarely).