JIT: Preserve receiver-before-index evaluation for Span indexers

[Copilot]

Span<T> and ReadOnlySpan<T> indexer expansion can spill the index before a side-effecting receiver, violating IL evaluation order and producing incorrect values or exceptions.

• Importer: Keep the receiver on the evaluation stack during index cloning/spilling so existing spill logic preserves ordering; pop it afterward.
• Regression coverage: Exercise both Span types with static-field indexes, index calls, exception ordering, and an earlier stack operand.

• Fixes JIT: (bug) Span<T>.get_Item intrinsic evaluates the index before the receiver #133963

[azure-pipelines]

Azure Pipelines:
16 pipeline(s) were filtered out due to trigger conditions.
There may be pipelines that require an authorized user to comment /azp run to run.

[dotnet-policy-service]

Tagging subscribers to this area: @dotnet/runtime-infrastructure
See info in area-owners.md if you want to be subscribed.

[EgorBo]

PTAL @dotnet/jit-contrib almost no diffs

[azure-pipelines]

Azure Pipelines:
Successfully started running 5 pipeline(s).
11 pipeline(s) were filtered out due to trigger conditions.
There may be pipelines that require an authorized user to comment /azp run to run.

[Copilot]

🟢 Approval recommended

The reviewed changes address the evaluation-order issue and include regression coverage.

Pull request overview

This pull request fixes JIT evaluation-order handling for Span<T> and ReadOnlySpan<T> indexers.

Changes:

• Preserves the receiver while spilling the index.
• Adds regression coverage for evaluation order and exceptions.

File summaries

File	Description
src/tests/JIT/Regression_ro_2/Runtime_133963.cs	Adds regression tests for both span types.
src/coreclr/jit/importercalls.cpp	Preserves receiver-before-index evaluation.

Review details

• Files reviewed: 2/2 changed files
• Comments generated: 0
• Review effort level: Lite