How to reproduce:
1. Open the attached “IN-103423_CrashBugReport.zip“ project
2. Open the “Bug“ scene
3. Enter Play Mode
4. Wait until the “terrain“ SubScene is loaded
5. Select the “terrain“ SubScene in the Hierarchy

Expected result: The Editor is running
Actual result: The Editor crashes or freezes

Reproducible with: 6000.1.0a3, 6000.1.7f1, 6000.2.0b5
Not reproducible with: 2022.3.63f1, 6000.0.51f1, 6000.1.0a2. Did not repro on macOS.

Reproducible on: Windows 11
Not reproducible on: No other environment tested

Notes:
- Reproducible in Player
- Sometimes the Editor freezes
- The crash may happen before completing the 5th step
- In some cases, the stack trace can be different

First few lines of the stack trace:
mono-2.0-bdwgc.dll!mono_method_to_ir(MonoCompile * cfg, _MonoMethod * method, MonoBasicBlock * start_bblock, MonoBasicBlock * end_bblock, MonoInst * return_var, MonoInst * * inline_args, unsigned int inline_offset, int emit_check_this) Line 6138 C
mono-2.0-bdwgc.dll!inline_method(MonoCompile * cfg, _MonoMethod * cmethod, _MonoMethodSignature * fsig, MonoInst * * sp, unsigned char * ip, unsigned int real_offset, int inline_always) Line 4694 C
mono-2.0-bdwgc.dll!mono_method_to_ir(MonoCompile * cfg, _MonoMethod * method, MonoBasicBlock * start_bblock, MonoBasicBlock * end_bblock, MonoInst * return_var, MonoInst * * inline_args, unsigned int inline_offset, int emit_check_this) Line 7591 C
mono-2.0-bdwgc.dll!inline_method(MonoCompile * cfg, _MonoMethod * cmethod, _MonoMethodSignature * fsig, MonoInst * * sp, unsigned char * ip, unsigned int real_offset, int inline_always) Line 4694 C