ZJIT: Replace guards we know can't pass with an unconditional side-exit

The resulting type of a `GuardType` we prove cannot pass is `Empty`. Any HIR instructions using the type information from the `GuardType` will also see `Empty` and propagate that type through the compiler. Any generated code would not be executable at run time due to the always failing guard, so there's no point in generating it.

Author: nirvdrum

zjit/src/hir.rs

@@ -5509,6 +5509,19 @@ impl Function {
             let mut new_insns = vec![];
             for insn_id in old_insns {
                 let replacement_id = match self.find(insn_id) {
+                    // TODO (nirvdrum 2026-06-26): Folding the guard to a SideExit is a workaround,
+                    // not a proper fix. It relies on constant folding to keep an Empty-typed value
+                    // (see below) from reaching codegen; disabling this pass would let that value
+                    // through and the program would fail to compile on x86-64. Compilation correctness
+                    // should not depend on an optimization pass, so this should be replaced by a
+                    // comprehensive fix.
+                    Insn::GuardType { val, guard_type, state, recompile } if !self.type_of(val).could_be(guard_type) => {
+                        // The value's type is disjoint from the guard type, so the guard can never
+                        // pass. Every execution would side-exit here, so we replace the guard with an
+                        // unconditional exit. The terminator handling below then drops the rest of
+                        // the block, which is now unreachable.
+                        self.new_insn(Insn::SideExit { state, reason: SideExitReason::GuardType(guard_type), recompile })
+                    }
                     Insn::GuardType { val, guard_type, .. } if self.is_a(val, guard_type) => {
                         self.make_equal_to(insn_id, val);
                         // Don't bother re-inferring the type of val; we already know it.

zjit/src/hir/opt_tests.rs

@@ -2512,6 +2512,41 @@ mod hir_opt_tests {
         assert!(!insns.contains(&dead_const));
     }
 
+    // A GuardType whose value type is disjoint from the guard type can never pass, so every
+    // execution side-exits there. fold_constants should replace the guard with an unconditional
+    // SideExit and drop the now-unreachable instructions that follow.
+    #[test]
+    fn test_fold_guard_type_that_can_never_pass_into_side_exit() {
+        let mut function = Function::new(std::ptr::null());
+        let entry = function.entry_block;
+
+        let state = function.push_insn(entry, Insn::Snapshot { state: FrameState::new(std::ptr::null()) });
+        // A nil constant is a NilClass, which is disjoint from Fixnum, so the guard below can
+        // never pass and the optimizer infers its result as Empty.
+        let nil = function.push_insn(entry, Insn::Const { val: Const::Value(Qnil) });
+        let guard = function.push_insn(entry, Insn::GuardType { val: nil, guard_type: types::Fixnum, state, recompile: None });
+        function.push_insn(entry, Insn::StoreField { recv: nil, id: FieldName::len, offset: 0, val: guard });
+        function.push_insn(entry, Insn::Return { val: guard });
+        function.seal_entries();
+
+        function.infer_types();
+        function.fold_constants();
+
+        let insns: Vec<Insn> = function.blocks[entry.0].insns.iter().map(|&id| function.find(id)).collect();
+        assert!(
+            insns.iter().any(|insn| matches!(insn, Insn::SideExit { .. })),
+            "expected the always-failing guard to be folded into a SideExit, got {insns:?}",
+        );
+        assert!(
+            !insns.iter().any(|insn| matches!(insn, Insn::GuardType { .. })),
+            "the always-failing GuardType should have been removed, got {insns:?}",
+        );
+        assert!(
+            !insns.iter().any(|insn| matches!(insn, Insn::StoreField { .. } | Insn::Return { .. })),
+            "instructions after the unconditional SideExit are unreachable and should have been dropped, got {insns:?}",
+        );
+    }
+
     #[test]
     fn test_eliminate_new_array() {
         eval("