065623ab7a (master): ZJIT: Fix polymorphic_summary to chase guards on profile entries (#17238)

[Daichi Kamiyama]

Daichi Kamiyama 2026-06-09 14:54:44 +0000 (Tue, 09 Jun 2026)

New Revision: 065623ab7a

https://github.com/ruby/ruby/commit/065623ab7a

Log:
ZJIT: Fix polymorphic_summary to chase guards on profile entries (#17238)

## Summary

Using `chase_insn` instead of `find_const` in `polymorphic_summary`.

## Why

When an ivar instruction is specialized, `self` is reassigned to a GuardType/RefineType wrapper, and profiling records that wrapper.
The second-and-later polymorphic ivar/`defined?` on the same `self` therefore had its entry recorded against the wrapper, which `find_const` can't peel.
So `polymorphic_summary` returned `None` and fell back to a generic `DefinedIvar`/`GetIvar`/`SetIvar` instead of inline shape branches.

## Benchmarks

```
Bench (arm64 linux devcontainer, ruby/ruby-bench, warmup=10 bench=20)
master = HEAD 925fa46811 staged = master + patch (hir.rs: find_const→chase_insn)

Throughput master/staged
lobsters 0.970 (-3.0%, within ±2-9% noise)
railsbench 1.017 (+1.7%, within ±2-5% noise)

--zjit-stats lobsters / railsbench (staged vs master, %diff)
code_region_bytes +0.5% / +0.1%
guard_type_count -1.0% / -0.0%
compile_hir_time_ns +3.7% / +4.7%
invalidation_time_ns +4.1% / -1.6%
```

Modified files:
zjit/src/hir.rs
zjit/src/hir/opt_tests.rs