ZJIT: Bug with JIT-to-JIT kwargs

[composerinteralia]

This seems kinda similar to #906, but with kwargs instead of optional args. I haven't had a chance to look too closely, but I'm guessing the second getlocal is reading from the VM stack (because the block changes how we compile getlocal) and the values there are in the wrong order (because they were passed in the opposite direction).

def a(b:, c:)
  if c == :b
    return -> {}
  end

  raise "c is :b!" if c == :b
end

def test
  # note opposite order of kwargs
  a(c: :c, b: :b)
end

test
test

Fails as of 8c7e6f2 with --zjit-call-threshold=2

[tekknolagi]

Assigning Randy at least to triage

[rwstauner]

Error behavior no longer occurring as of 3e82da7

[tekknolagi]

Ooh I don't like that at all. That change is just an optimization. I think it's hiding an actual bug

[rwstauner]

The HIR diff I get boils down to

--- b
+++ m
@@ -1,4 +1,4 @@
-ruby 4.0.0dev (2025-12-24T21:52:46Z vXX.0.0~6 8d097bc472) +ZJIT dev +PRISM [arm64-darwin25]
+ruby 4.0.0dev (2025-12-24T22:37:25Z vXX.0.0~5 3e82da7232) +ZJIT dev +PRISM [arm64-darwin25]
 nil
 Optimized HIR:
 fn test@test.rb:11:
@@ -71,7 +71,6 @@
 bb3(vXX:BasicObject, vXX:BasicObject, vXX:BasicObject, vXX:BasicObject):
   vXX:Any = Snapshot FrameState { pc: 0x00, stack: [], locals: [b=vXX, c=vXX, ID(0)=vXX] }
   PatchPoint NoTracePoint
-  vXX:BasicObject = GetLocal :c, l0, EP@4
   vXX:StaticSymbol[:b] = Const Value(VALUE(0x00))
   vXX:Any = Snapshot FrameState { pc: 0x00, stack: [vXX, vXX], locals: [b=vXX, c=vXX, ID(0)=vXX] }
   PatchPoint NoTracePoint
@@ -101,6 +100,4 @@
   CheckInterrupts
   Return vXX
 
-test.rb:6:in 'Object#a': c is :b! (RuntimeError)
-	from test.rb:11:in 'Object#test'
-	from test.rb:15:in '<main>'
+nil

[tekknolagi]

What if you do =all to get snapshots?

[rwstauner]

The diff is the same as above (except for the line numbers)

[tekknolagi]

Sorry, but tomorrow can you (or I will, whoever gets to it first) paste the two HIR snippets side-by-side? I think it's important to see what SSA values end up being in the FrameState where

[composerinteralia]

I think it's still reproducible if we add in a different non-leaf instruction in between. For example:

def a(b:, c:)
  if c == :b
    return -> {}
  end
  Class # <- added this, since the branch alone no longer invalidates locals

  raise "c is :b!" if c == :b
end

def test
  # note opposite order of kwargs
  a(c: :c, b: :b)
end

test
test

[composerinteralia]

Looked a bit more and I'm pretty sure this is the problematic bit:

  v11:StaticSymbol[:c] = Const Value(VALUE(0x9da10c))
  v13:StaticSymbol[:b] = Const Value(VALUE(0x1fd10c))
  v14:Any = Snapshot FrameState { pc: 0x98710b0e8, stack: [v6, v11, v13], locals: [] }
                                                               ^^^^^^^^ caller order 👎🏻 
  ...
  v23:BasicObject = SendWithoutBlockDirect v22, :a (0x16f732cf0), v13, v11
                                                                  ^^^^^^^^ callee order 👍🏻 

The SendWithoutBlockDirect args get reordered by reorder_keyword_arguments, but the stack remains in the original order. We spill the stack in gen_send_without_block_direct, but it's in the wrong order for the callee.

Do we need to build a new FrameState for direct sends with a reordered stack? Or is there another way to spill these in gen_send_without_block_direct to ensure they are in the correct order?