[release/10.0] JIT: handle commas during inline return value substitution

src/coreclr/jit/fginline.cpp

@@ -731,10 +731,39 @@ class SubstitutePlaceholdersAndDevirtualizeWalker : public GenTreeVisitor<Substi
         else if (tree->OperIs(GT_JTRUE))
         {
             // See if this jtrue is now foldable.
-            BasicBlock* block    = m_compiler->compCurBB;
-            GenTree*    condTree = tree->AsOp()->gtOp1;
+            BasicBlock* block        = m_compiler->compCurBB;
+            GenTree*    condTree     = tree->AsOp()->gtOp1;
+            bool        modifiedTree = false;
             assert(tree == block->lastStmt()->GetRootNode());
 
+            while (condTree->OperIs(GT_COMMA))
+            {
+                // Tree is a root node, and condTree its only child.
+                // Move comma effects to a prior statement.
+                //
+                GenTree* sideEffects = nullptr;
+                m_compiler->gtExtractSideEffList(condTree->gtGetOp1(), &sideEffects);
+
+                if (sideEffects != nullptr)
+                {
+                    m_compiler->fgNewStmtNearEnd(block, sideEffects);
+                }
+
+                // Splice out the comma with its value
+                //
+                GenTree* const valueTree = condTree->gtGetOp2();
+                condTree                 = valueTree;
+                tree->AsOp()->gtOp1      = valueTree;
+                modifiedTree             = true;
+            }
+
+            if (modifiedTree)
+            {
+                m_compiler->gtUpdateNodeSideEffects(tree);
+            }
+
+            assert(condTree->OperIs(GT_CNS_INT) || condTree->OperIsCompare());
+
             if (condTree->OperIs(GT_CNS_INT))
             {
                 JITDUMP(" ... found foldable jtrue at [%06u] in " FMT_BB "\n", m_compiler->dspTreeID(tree),

src/tests/JIT/Regression/JitBlue/Runtime_119058/Runtime_119058.cs

@@ -0,0 +1,58 @@
+// Licensed to the .NET Foundation under one or more agreements.
+// The .NET Foundation licenses this file to you under the MIT license.
+
+using System;
+using System.Runtime.CompilerServices;
+using Xunit;
+
+// Generated by Fuzzlyn v3.3 on 2025-08-23 16:26:13
+// Run on Arm64 MacOS
+// Seed: 17015990397549431234-vectort,vector64,vector128,armadvsimd,armadvsimdarm64,armaes,armarmbase,armarmbasearm64,armcrc32,armcrc32arm64,armdp,armrdm,armrdmarm64,armsha1,armsha256
+// Reduced from 36.5 KiB to 0.5 KiB in 00:00:13
+// Hits JIT assert for Release:
+// Assertion failed 'cond == test->AsOp()->gtOp1' in 'Program:M0()' during 'Update flow graph early pass' (IL size 32; hash 0xaf50ff37; FullOpts)
+// 
+//     File: /Users/runner/work/1/s/src/coreclr/jit/fgopt.cpp Line: 4535
+// 
+public class Runtime_119058
+{
+    public static uint s_3;
+    public static ulong s_7;
+
+    [Fact]
+    public static int Problem()
+    {
+        try
+        {
+            M0();
+        }
+        catch(NullReferenceException)
+        {
+            return 100;
+        }
+
+        return -1;
+    }
+
+    [MethodImpl(MethodImplOptions.NoInlining)]
+    static void M0()
+    {
+        long[] var3 = default(long[]);
+        sbyte var24 = default(sbyte);
+        if ((ulong)M1() > (ulong)var3[0])
+        {
+            var24 = var24;
+        }
+        else
+        {
+            uint var25 = s_3;
+        }
+
+        ulong var39 = s_7;
+    }
+
+    static int M1()
+    {
+        return default(int);
+    }
+}

src/tests/JIT/Regression/JitBlue/Runtime_119058/Runtime_119058.csproj

@@ -0,0 +1,9 @@
+<Project Sdk="Microsoft.NET.Sdk">
+  <PropertyGroup>
+    <DebugType>None</DebugType>
+    <Optimize>True</Optimize>
+  </PropertyGroup>
+  <ItemGroup>
+    <Compile Include="$(MSBuildProjectName).cs" />
+  </ItemGroup>
+</Project>