Test case failure with TieredPGO

[AndyAyersMS]

@DrewScoggins ran into failures trying to enable TieredPGO for microbenchmarks. This bug is distilled from the failure that happens there (Json.NET is enumerating a dictionary for serialization when producing the lab report data):

using System;
using System.Collections;
using System.Collections.Generic;
using System.Threading;

class X
{
    static int F(IDictionary i)
    {
        int r = 0;
        IDictionaryEnumerator e = i.GetEnumerator();
        while (e.MoveNext())
        {
            DictionaryEntry entry = e.Entry;
            r++;
        }
        return r;
    }

    public static int Main()
    {
        Dictionary<string, string> s = new Dictionary<string, string>();
        s["hello"] = "world";
        int r = 0;

        for (int i = 0; i < 50; i++)
        {
            r += F(s);
            Thread.Sleep(15);
        }

        int iter = 100;

        for (int i = 0; i < iter; i++)
        {
            r += F(s);
        }

        int result = 2 * (r - iter);
        Console.WriteLine($"Result={result}");
        return result;
    }
}

with

complus_tc_quickjitforloops=1
complus_tieredpgo=1

and it will fail when newing up an object in GetEnumerator:

Assert failure(PID 38060 [0x000094ac], Thread: 20964 [0x51e4]): AsMethodTable()->SanityCheck()

CORECLR! TypeHandle::Verify + 0x6B (0x00007fff`d1ffeaf3)
CORECLR! JIT_New + 0x198 (0x00007fff`d214eaa8)
<no module>! <no symbol> + 0x0 (0x00007fff`729fc690)
<no module>! <no symbol> + 0x0 (0x00007fff`72d3c740)
<no module>! <no symbol> + 0x0 (0x00000262`35fe3ff0)
    File: C:\repos\runtime1\src\coreclr\vm\typehandle.cpp Line: 51
    Image: c:\repos\runtime1\artifacts\tests\coreclr\Windows.x64.checked\Tests\Core_Root\corerun.exe

000000FBCDF7E168 00007fffcb2dcf04 [HelperMethodFrame: 000000fbcdf7e168] 
000000FBCDF7E280 00007fff6bcac690 System.Collections.Generic.Dictionary`2[[System.__Canon, System.Private.CoreLib],[System.__Canon, System.Private.CoreLib]].System.Collections.IDictionary.GetEnumerator()
000000FBCDF7E300 00007fff6bcac569 X.F(System.Collections.IDictionary)
000000FBCDF7E350 00007fff6bca9450 X.Main()

This still fails if the only method jitted with tiered PGO is X.F. This can be done in a checked jit by specifying its hash, like so:

set complus_jitenablepgorange=5162f578

[AndyAyersMS]

Seems like the bug is when we devirtualize the call to the enumerator's get_Entry -- this call requires an inst table param, but it also returns a struct via a hidden return buffer, and so we get the updated arg list wrong, and the call writes into the method table, and that's not good.

That is, instead of (byref (this), byref(retval), typeCtxt, ...) we pass (byref(this), typeCtxt, byref(retval).