JIT: Make GenTree::Compare more conservative around several node types

[EgorBo]

Fixes #135350

GenTree::Compare ignored the field sequence on GT_CNS_INT, so post-morph head/tail merge could merge statements that differ only in which field an offset constant refers to. In the Roslyn case, the two arms of a GDV over ContainingType ended with:

// SynthesizedReadOnlyListEnumeratorTypeSymbol arm
V25 = ISINSTANCEOFCLASS(NamedTypeSymbol, IND(ADD(obj, 0x38 Fseq[_containingType])))
// fallback arm
V25 = ISINSTANCEOFCLASS(NamedTypeSymbol, IND(ADD(obj, 0x38 Fseq[_containingSymbol])))

Both fields happen to live at offset 0x38, so the statements compared equal and the guarded arm's copy was kept for all paths. _containingType is typed as a sealed NamedTypeSymbol subclass, so the isinst was later folded away, and ContainingType != null became _containingSymbol != null for every object.

The fix makes GT_CNS_INT comparison require matching field sequences, mirroring the existing gtFldHnd check for GT_FIELD_ADDR. No SPMI diffs.

While here, GenTree::Compare also now compares a few other correctness-relevant fields it used to ignore:

• GT_CNS_INT: handle kind and compile-time handle.
• Relops: GTF_RELOP_NAN_UN (ordered vs unordered).
• All indir-like nodes (ARR_LENGTH, MDARR_*, NULLCHECK, atomics, CMPXCHG, not just IND/BLK/stores): GTF_IND_FLAGS, which includes the path-dependent GTF_IND_NONFAULTING.
• GT_ARR_ADDR: the path-dependent GTF_ARR_ADDR_NONNULL.
• GT_BOX: the upstream def/copy statements.
• Unexpected ExOps are treated as unequal in release builds.

Almost no diffs

[azure-pipelines]

Azure Pipelines:
Successfully started running 5 pipeline(s).
11 pipeline(s) were filtered out due to trigger conditions.
There may be pipelines that require an authorized user to comment /azp run to run.

[dotnet-policy-service]

Tagging subscribers to this area: @JulieLeeMSFT, @jakobbotsch
See info in area-owners.md if you want to be subscribed.

[Copilot]

🟡 Changes recommended

The reported miscompile lacks a focused regression test.

1 open finding

• Add regression test for equal-offset tail-merge field distinctions · New

What changed in this PR

Fixes unsafe JIT tree equality that could cause head/tail merging to discard path-specific semantics.

Changes:

• Compares constant metadata, field sequences, and handles.
• Compares semantic relop, indirection, array-address, and box state.
• Conservatively rejects unexpected extended operators.

File	Description
src/​coreclr/​jit/​gentree.cpp	Strengthens GenTree::Compare correctness.

🧠 Review effort: Balanced

---

Give feedback about Copilot approvals in this survey to enter a drawing for a $150 gift card.

[EgorBo]

PTAL @adamperlin @dotnet/jit-contrib

This just makes GenTree::Compare more conservative when comparing trees. The actual bug is for GT_CNS_INT, but I fixed a few more issues along the road.

[EgorBo]

/ba-g unrelated smpt failures