JIT: (bug) Loop cloning passes an out-of-region search start to fgFindInsertPoint when the loop's lexical bottom is in a nested try

[EgorBo]

Minimal repro

using System;
using System.Runtime.CompilerServices;

public static class P
{
    [MethodImpl(MethodImplOptions.NoInlining | MethodImplOptions.AggressiveOptimization)]
    static int Test(int[] a, int n)
    {
        int sum = 0;
        int i = 0;
        try
        {
        loop:
            sum += a[i];
            try
            {
                if (a[i] == 42) sum += 7;
                i++;
                if (i < n) goto loop;
            }
            catch (Exception) { sum = -1; }
        }
        catch (Exception) { sum = -2; }
        return sum;
    }

    static int Main()
    {
        int[] a = new int[64];
        for (int j = 0; j < 64; j++) a[j] = j;
        Console.WriteLine(Test(a, 64));
        return 100;
    }
}

Run: corerun repro.dll (Checked or Release JIT, .NET 11 main @ b44cd90)

Expected

Prints 2023, exit code 100.

Actual

Assert failure: Assertion failed '(regionIndex == 0 && putInTryRegion) || (putInTryRegion && regionIndex > 0 && startBlk->bbTryIndex == regionIndex) || (!putInTryRegion && regionIndex > 0 && startBlk->bbHndIndex == regionIndex)' in 'P:Test(int[],int):int' during 'Clone loops' (IL size 48; hash 0xdbe477db; FullOpts)
    File: C:\prj\runtime-main3\src\coreclr\jit\fgbasic.cpp:5804

Process exits 0xC0000409.

Notes

No env knobs needed. DOTNET_JitCloneLoops=0 and DOTNET_JitCloneLoopsWithEH=0 both print 2023.
optCloneLoop (loopcloning.cpp:2326) passes bottom (inner try) as startBlk with enclosingRegion = the outer try; being a noway_assert, Release JIT takes the NO_WAY fallback instead.

[dotnet-policy-service]

Tagging subscribers to this area: @JulieLeeMSFT, @jakobbotsch
See info in area-owners.md if you want to be subscribed.