ZJIT: Fold LoadField on frozen objects to constants

When accessing instance variables from frozen objects via attr_reader/
attr_accessor, fold the LoadField instruction to a constant at compile
time. This enables further optimizations like constant propagation.

- Add fold_getinstancevariable_frozen optimization in Function::optimize
- Check if receiver type has a known ruby_object() that is frozen
- Read the field value at compile time and replace with Const instruction
- Add 10 unit tests covering various value types (fixnum, string, symbol,
  nil, true/false) and negative cases (unfrozen, dynamic receiver)

Author: tobi

zjit/src/hir.rs

@@ -3682,6 +3682,19 @@ impl Function {
                         // Don't bother re-inferring the type of val; we already know it.
                         continue;
                     }
+
+                    // LoadField is a common pattern for getting fields from Ruby objects, we want to fold away the pattern if the object is frozen. Cast recv to VALUE* and do an unsafe cast at compile time.
+                    Insn::LoadField { recv, offset, return_type, .. } if return_type.is_subtype(types::BasicObject) => {
+                         let recv = self.type_of(recv);
+                         if let Some(recv) = recv.ruby_object() && recv.is_frozen() {
+                            let recv = recv.as_ptr() as *const VALUE;
+                            let val = unsafe { *recv.add(offset as usize / SIZEOF_VALUE) };
+                            self.new_insn(Insn::Const { val: Const::Value(val) })
+                         } else {
+                            insn_id
+                         }
+                    }
+
                     Insn::AnyToString { str, .. } if self.is_a(str, types::String) => {
                         self.make_equal_to(insn_id, str);
                         // Don't bother re-inferring the type of str; we already know it.