Fix SwipeViews with invoked properties crash the app in Release mode

src/Controls/src/Build.Tasks/SetPropertiesVisitor.cs

@@ -1280,9 +1280,9 @@ static IEnumerable<Instruction> ConnectEvent(VariableDefinition parent, string l
 			//			IL_0008:  ldarg.0 
 			//
 			//			IL_0009:  ldftn instance void class Microsoft.Maui.Controls.Xaml.XamlcTests.MyPage::OnButtonClicked(object, class [mscorlib]System.EventArgs)
-			//OR, if the handler is virtual
-			//			IL_000x:  ldarg.0 
-			//			IL_0009:  ldvirtftn instance void class Microsoft.Maui.Controls.Xaml.XamlcTests.MyPage::OnButtonClicked(object, class [mscorlib]System.EventArgs)
+			//OR, if the handler is virtual (non-static)
+			//			IL_000x:  dup          ; copy target already on stack
+			//			IL_000y:  ldvirtftn instance void class Microsoft.Maui.Controls.Xaml.XamlcTests.MyPage::OnButtonClicked(object, class [mscorlib]System.EventArgs)
 			//
 			//			IL_000f:  newobj instance void class [mscorlib]System.EventHandler::'.ctor'(object, native int)
 			//			IL_0014:  callvirt instance void class [Microsoft.Maui.Controls]Microsoft.Maui.Controls.Button::add_Clicked(class [mscorlib]System.EventHandler)
@@ -1342,7 +1342,14 @@ static IEnumerable<Instruction> ConnectEvent(VariableDefinition parent, string l
 
 			if (methodDef.IsVirtual)
 			{
-				yield return Create(Ldarg_0);
+				// ldvirtftn needs the object whose vtable drives virtual dispatch.
+				// In a DataTemplate context, Ldarg_0 is the anonymous nested class, not the root
+				// XAML element — using it causes iOS/Mac Full AOT to crash on virtual handlers.
+				// The delegate target (already on the stack) IS the correct vtable object, so
+				// dup it: stack goes [parent, target] → [parent, target, target], ldvirtftn pops one, leaving
+				// [parent, target, ftn] for the delegate ctor.
+				if (!methodDef.IsStatic)
+					yield return Create(Dup);
 				yield return Create(Ldvirtftn, handlerRef);
 			}
 			else

src/Controls/tests/Xaml.UnitTests/Issues/Maui18055.xaml

@@ -0,0 +1,11 @@
+<?xml version="1.0" encoding="utf-8" ?>
+<ContentPage xmlns="http://schemas.microsoft.com/dotnet/2021/maui"
+             xmlns:x="http://schemas.microsoft.com/winfx/2009/xaml"
+             xmlns:local="clr-namespace:Microsoft.Maui.Controls.Xaml.UnitTests"
+             x:Class="Microsoft.Maui.Controls.Xaml.UnitTests.Maui18055">
+    <ContentPage.Resources>
+        <DataTemplate x:Key="virtualHandlerTemplate">
+            <local:ElementWithEvent Clicked="HandleVirtualClicked" />
+        </DataTemplate>
+    </ContentPage.Resources>
+</ContentPage>

src/Controls/tests/Xaml.UnitTests/Issues/Maui18055.xaml.cs

@@ -0,0 +1,48 @@
+using System;
+using Xunit;
+
+namespace Microsoft.Maui.Controls.Xaml.UnitTests;
+
+// Regression test for https://github.com/dotnet/maui/issues/18055
+// XamlC must use Dup (not Ldarg_0) before ldvirtftn when wiring virtual event handlers
+// inside a DataTemplate, so the correct vtable object is used for virtual dispatch.
+public partial class Maui18055 : ContentPage
+{
+	public Maui18055() => InitializeComponent();
+
+	public int baseForVirtualClicked;
+	protected virtual void HandleVirtualClicked(object sender, EventArgs e) => baseForVirtualClicked++;
+
+	[Collection("Issue")]
+	public class Tests
+	{
+		[Theory]
+		[XamlInflatorData]
+		// Verifies that a virtual handler wired inside a DataTemplate dispatches to the override,
+		// not the base class. Without the fix, XamlC emitted Ldarg_0 (the anonymous DataTemplate
+		// class) as the ldvirtftn vtable source — causing wrong dispatch on JIT and a hard crash
+		// on iOS/macOS Full AOT.
+		internal void VirtualHandlerInDataTemplateCallsOverride(XamlInflator inflator)
+		{
+			var page = new SubMaui18055(inflator);
+			Assert.Equal(0, page.baseForVirtualClicked);
+			Assert.Equal(0, page.overrideClicked);
+
+			var template = (Microsoft.Maui.Controls.DataTemplate)page.Resources["virtualHandlerTemplate"];
+			var element = (ElementWithEvent)template.CreateContent();
+			element.SendClicked();
+
+			// Override must be called; base must NOT be called.
+			Assert.Equal(1, page.overrideClicked);
+			Assert.Equal(0, page.baseForVirtualClicked);
+		}
+	}
+}
+
+class SubMaui18055 : Maui18055
+{
+	public SubMaui18055(XamlInflator inflator) : base(inflator) { }
+
+	public int overrideClicked;
+	protected override void HandleVirtualClicked(object sender, EventArgs e) => overrideClicked++;
+}