YJIT: Bail out if proc would be stored above stack top

Fixes [Bug #21266].

Backport of 9168cad to 3.3

Author: rwstauner

bootstraptest/test_yjit.rb

@@ -4585,3 +4585,13 @@ def foo(&) = self.class.name(&)
     new.foo
   end
 }
+
+# regression test for splat with &proc{} when the target has rest (Bug #21266)
+assert_equal '[]', %q{
+  def foo(args) = bar(*args, &proc { _1 })
+  def bar(_, _, _, _, *rest) = yield rest
+
+  GC.stress = true
+  foo([1,2,3,4])
+  foo([1,2,3,4])
+}

test/ruby/test_yjit.rb

@@ -1526,6 +1526,18 @@ def test_disable_stats
     assert_in_out_err(%w[--yjit-stats --yjit-disable])
   end
 
+  def test_proc_block_with_kwrest
+    # When the bug was present this required --yjit-stats to trigger.
+    assert_compiles(<<~RUBY, result: {extra: 5})
+      def foo = bar(w: 1, x: 2, y: 3, z: 4, extra: 5, &proc { _1 })
+      def bar(w:, x:, y:, z:, **kwrest) = yield kwrest
+
+      GC.stress = true
+      foo
+      foo
+    RUBY
+  end
+
   private
 
   def code_gc_helpers

yjit/src/codegen.rs

@@ -6338,6 +6338,11 @@ fn gen_send_iseq(
                 gen_counter_incr(asm, Counter::send_iseq_clobbering_block_arg);
                 return None;
             }
+            if iseq_has_rest {
+                // The proc would be stored above the current stack top, where GC can't see it
+                gen_counter_incr(asm, Counter::send_iseq_block_arg_gc_unsafe);
+                return None;
+            }
             let proc = asm.stack_pop(1); // Pop first, as argc doesn't account for the block arg
             let callee_specval = asm.ctx.sp_opnd(callee_specval as isize * SIZEOF_VALUE as isize);
             asm.store(callee_specval, proc);

yjit/src/stats.rs

@@ -328,6 +328,7 @@ make_counters! {
     send_attrset_kwargs,
     send_iseq_tailcall,
     send_iseq_arity_error,
+    send_iseq_block_arg_gc_unsafe,
     send_iseq_clobbering_block_arg,
     send_iseq_leaf_builtin_block_arg_block_param,
     send_iseq_only_keywords,