Lower fast tail call wasn't patching control expression (dotnet/coreclr#20740)
Lower fast tail call can replace local variables (holding Caller stack arguments) with new temps in order to set up Callee stack arguments correctly. This involves patching corresponding LCL_VAR and LCL_VAR_ADDR nodes and replacing them with the location of a new temp.
This was not done for control expression which continued pointing to the old location and could contain a Callee argument.
Commit migrated from https://github.com/dotnet/coreclr/commit/
ce7e79770b924c3ed4649c60074fa36c1401b4ee