From a3edc7b341ddf16f3d410d6c26b6ae9a0cbaab59 Mon Sep 17 00:00:00 2001
From: Randy Stauner <randy@r4s6.net>
Date: Mon, 3 Nov 2025 08:28:28 -0700
Subject: [PATCH] ZJIT: Add test to reproduce binarytrees crash

---
 test/ruby/test_zjit.rb | 29 +++++++++++++++++++++++++++++
 1 file changed, 29 insertions(+)

diff --git a/test/ruby/test_zjit.rb b/test/ruby/test_zjit.rb
index f12ac19af59537..a538e6c3064871 100644
--- a/test/ruby/test_zjit.rb
+++ b/test/ruby/test_zjit.rb
@@ -3154,6 +3154,35 @@ def test(define)
     }, call_threshold: 2
   end
 
+  def test_regression_cfp_sp_set_correctly_before_leaf_gc_call
+    assert_compiles ':ok', %q{
+      def check(l, r)
+        return 1 unless l
+        1 + check(*l) + check(*r)
+      end
+
+      def tree(depth)
+        # This duparray is our leaf-gc target.
+        return [nil, nil] unless depth > 0
+
+        # Modify the local and pass it to the following calls.
+        depth -= 1
+        [tree(depth), tree(depth)]
+      end
+
+      def test
+        GC.stress = true
+        2.times do
+          t = tree(11)
+          check(*t)
+        end
+        :ok
+      end
+
+      test
+    }, call_threshold: 14, num_profiles: 5
+  end
+
   private
 
   # Assert that every method call in `test_script` can be compiled by ZJIT