Fix latent stale gtCompileTimeHandle poisoning EmbeddedHandleMap

`GenTree::BashToConst<T>` repurposes an arbitrary node into a constant but
never resets `AsIntCon()->gtCompileTimeHandle`, so the field retains stale
data from the node's prior life. `optConstantAssertionProp` then re-applies
`GTF_ICON_CLASS_HDL` on top of the bashed node based on the VN's handle
flags, leaving a CNS_INT with `iconValue = realClassHandle`, the class-handle
flag set, but a stale `gtCompileTimeHandle`.

When `fgValueNumberTreeConst` later sees this node it overwrites the
existing entry in the EmbeddedHandleMap with that stale handle (via
`AddOrUpdate`), poisoning lookups. Consumers such as `IsVNTypeHandle` and
`VNEvalForCast` then read the garbage back, and `compareTypesForCast`
crashes when dereferencing the bogus type handle.

Three small fixes:

1. `GenTree::BashToConst<T>`: zero `gtCompileTimeHandle` alongside the
   existing `gtFieldSeq = nullptr`, matching the "node is now a fresh
   constant" semantics.

2. `fgValueNumberTreeConst`: only register an entry in the
   EmbeddedHandleMap when `gtCompileTimeHandle != 0`, so a re-flagged
   bashed node cannot overwrite a valid mapping placed by a real
   `gtNewIconEmbHndNode` that shares the same iconValue.

3. `fgValueNumberSpecialIntrinsic`: fix an inverted bail-out that proceeds
   to `getRuntimeTypePointer` with a 0 handle when the map lookup fails
   (`&&` + `clsHandle != 0` made the bail unreachable because `clsHandle`
   is initialized to 0). With fix #2, "no entry" becomes more common, and
   this site must bail explicitly.

Reproduced on System.Memory.Tests / System.Linq.Tests with
DOTNET_TieredCompilation=1 against the PR's `IsVNTypeHandle` consumer.
Tests pass after the fix.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Author: EgorBo

src/coreclr/jit/compiler.hpp

@@ -2101,7 +2101,8 @@ void GenTree::BashToConst(T value, var_types type /* = TYP_UNDEF */)
             }
 
             AsIntCon()->SetIconValue(static_cast<ssize_t>(value));
-            AsIntCon()->gtFieldSeq = nullptr;
+            AsIntCon()->gtFieldSeq          = nullptr;
+            AsIntCon()->gtCompileTimeHandle = 0;
             break;
 
 #if !defined(TARGET_64BIT)

src/coreclr/jit/valuenum.cpp

@@ -12287,8 +12287,12 @@ void Compiler::fgValueNumberTreeConst(GenTree* tree)
                 const GenTreeIntCon* cns         = tree->AsIntCon();
                 const GenTreeFlags   handleFlags = tree->GetIconHandleFlag();
                 tree->gtVNPair.SetBoth(vnStore->VNForHandle(cns->IconValue(), handleFlags));
-                if (handleFlags == GTF_ICON_CLASS_HDL)
+                if ((handleFlags == GTF_ICON_CLASS_HDL) && (cns->gtCompileTimeHandle != 0))
                 {
+                    // Skip registration when gtCompileTimeHandle is unknown (e.g., the node was created by
+                    // BashToConst+gtFlags|=GTF_ICON_CLASS_HDL in optConstantAssertionProp). Overwriting an
+                    // existing valid mapping with 0 would poison the map for any constant assertion-based
+                    // re-flagging that happens to share the same iconValue as a real embedded handle node.
                     vnStore->AddToEmbeddedHandleMap(cns->IconValue(), cns->gtCompileTimeHandle);
                 }
             }
@@ -14430,9 +14434,11 @@ bool Compiler::fgValueNumberSpecialIntrinsic(GenTreeCall* call)
             ValueNum clsVN     = typeHandleFuncApp.m_args[0];
             ssize_t  clsHandle = 0;
 
-            // NOTE: EmbeddedHandleMapLookup may return 0 for non-0 embedded handle
-            if (!vnStore->EmbeddedHandleMapLookup(vnStore->ConstantValue<ssize_t>(clsVN), &clsHandle) &&
-                (clsHandle != 0))
+            // EmbeddedHandleMapLookup may return false (no entry) or true with a 0 handle when the
+            // backing iconNode was produced by BashToConst (i.e., it has no compile-time handle).
+            // Either way, we cannot resolve the runtime type, so bail.
+            if (!vnStore->EmbeddedHandleMapLookup(vnStore->ConstantValue<ssize_t>(clsVN), &clsHandle) ||
+                (clsHandle == 0))
             {
                 break;
             }