[vrimar]

mono_class_get_virtual_method re-inflates the vtable slot method with the requested method's full context. If the slot method is already inflated, re-applying class_inst substitutes into its remaining shared type variables.

In shared code this breaks devirtualized EqualityComparer<F>.Default.Equals and GetHashCode calls, which the C# compiler emits for every field of a generic record struct. For F = Change<T_REF> the call binds to GenericEqualityComparer<Change<Change<T_REF>>>. On browser-wasm AOT the caller then asserts in mini_method_get_rgctx if the doubled type breaks a constraint, or traps with function signature mismatch if it changes layout.

The fix applies only method_inst to an already-inflated slot method, as get_method_constrained and MONO_RGCTX_INFO_VIRT_METHOD already do.

Risk: closed types are unaffected, because re-inflating a closed method returns it unchanged. The same code is on release/8.0 through release/11.0, so this isn't a regression.

Testing: two new ValueTypeTests cover the constraint failure and the layout failure. With a browser-wasm mono-aot-cross built from the rc.3 source, both fail without the fix and pass with it. Both pass on CoreCLR. Not run: XHarness, iOS/Android, CI.

Resolves #137123

[azure-pipelines]

Azure Pipelines:
Successfully started running 3 pipeline(s).
12 pipeline(s) were filtered out due to trigger conditions.
There may be pipelines that require an authorized user to comment /azp run to run.

[vrimar]

@dotnet-policy-service agree