JIT: Fix crossgen failure in gtTryRemoveBoxUpstreamEffects

In some R2R expansions the type handle is not an explicit operand to
the newobj helper. So we must bail out of removal attempts when the
type handle is desired and we see such an expansion.

Closes #13942.
Also likely will fix #13930.

src/jit/gentree.cpp

@@ -12538,9 +12538,19 @@ GenTree* Compiler::gtTryRemoveBoxUpstreamEffects(GenTree* op, BoxRemovalOptions
         }
         else if (asgSrcOper == GT_CALL)
         {
-            GenTreeCall*    newobjCall = asgSrc->AsCall();
-            GenTreeArgList* newobjArgs = newobjCall->gtCallArgs->AsArgList();
-            boxTypeHandle              = newobjArgs->Current();
+            GenTreeCall* newobjCall = asgSrc->AsCall();
+            GenTree*     newobjArgs = newobjCall->gtCallArgs;
+
+            // In R2R expansions the handle may not be an explicit operand to the helper,
+            // so we can't remove the box.
+            if (newobjArgs == nullptr)
+            {
+                assert(newobjCall->IsHelperCall(this, CORINFO_HELP_READYTORUN_NEW));
+                JITDUMP("bailing; newobj via R2R helper\n");
+                return nullptr;
+            }
+
+            boxTypeHandle = newobjArgs->AsArgList()->Current();
         }
         else
         {