[release/2.0.x] Fix built-in GetHashCode crash on nested structs (#17720)

Fixes #17661

Author: jkotas

src/vm/comutilnative.cpp

@@ -2688,13 +2688,14 @@ static INT32 RegularGetValueTypeHashCode(MethodTable *mt, void *pObjRef)
     } CONTRACTL_END;
 
     INT32 hashCode = 0;
-    INT32 *pObj = (INT32*)pObjRef;
+
+    GCPROTECT_BEGININTERIOR(pObjRef);
 
     // While we shouln't get here directly from ValueTypeHelper::GetHashCode, if we recurse we need to 
     // be able to handle getting the hashcode for an embedded structure whose hashcode is computed by the fast path.
     if (CanUseFastGetHashCodeHelper(mt))
     {
-        return FastGetValueTypeHashCodeHelper(mt, pObjRef);
+        hashCode = FastGetValueTypeHashCodeHelper(mt, pObjRef);
     }
     else
     {
@@ -2715,13 +2716,13 @@ static INT32 RegularGetValueTypeHashCode(MethodTable *mt, void *pObjRef)
             {
                 FieldDesc *field = fdIterator.Next();
                 _ASSERTE(!field->IsRVA());
-                void *pFieldValue = (BYTE *)pObj + field->GetOffsetUnsafe();
                 if (field->IsObjRef())
                 {
+                    void *pFieldValue = (BYTE *)pObjRef + field->GetOffsetUnsafe();
+
                     // if we get an object reference we get the hash code out of that
                     if (*(Object**)pFieldValue != NULL)
                     {
-
                         OBJECTREF fieldObjRef = ObjectToOBJECTREF(*(Object **) pFieldValue);
                         GCPROTECT_BEGIN(fieldObjRef);
 
@@ -2741,26 +2742,28 @@ static INT32 RegularGetValueTypeHashCode(MethodTable *mt, void *pObjRef)
                 }
                 else
                 {
-                    UINT fieldSize = field->LoadSize();
-                    INT32 *pValue = (INT32*)pFieldValue;
                     CorElementType fieldType = field->GetFieldType();
                     if (fieldType != ELEMENT_TYPE_VALUETYPE)
                     {
+                        UINT fieldSize = field->LoadSize();
+                        INT32 *pValue = (INT32*)((BYTE *)pObjRef + field->GetOffsetUnsafe());
                         for (INT32 j = 0; j < (INT32)(fieldSize / sizeof(INT32)); j++)
                             hashCode ^= *pValue++;
                     }
                     else
                     {
                         // got another value type. Get the type
-                        TypeHandle fieldTH = field->LookupFieldTypeHandle(); // the type was loaded already
+                        TypeHandle fieldTH = field->GetFieldTypeHandleThrowing();
                         _ASSERTE(!fieldTH.IsNull());
-                        hashCode = RegularGetValueTypeHashCode(fieldTH.GetMethodTable(), pValue);
+                        hashCode = RegularGetValueTypeHashCode(fieldTH.GetMethodTable(), (BYTE *)pObjRef + field->GetOffsetUnsafe());
                     }
                 }
                 break;
             }
         }
     }
+    GCPROTECT_END();
+
     return hashCode;
 }