diff --git a/.github/workflows/parse_y.yml b/.github/workflows/parse_y.yml
index 9345a1f7a465fc..c77b4516d1e737 100644
--- a/.github/workflows/parse_y.yml
+++ b/.github/workflows/parse_y.yml
@@ -78,7 +78,9 @@ jobs:
 
       - run: make
 
-      - run: make TESTRUN_SCRIPT='-e "exit !RUBY_DESCRIPTION.include?(%[+PRISM])"' run
+      - run: make TESTRUN_SCRIPT='-renvutil -v -e "exit EnvUtil.current_parser == %[parse.y]"' run
+        env:
+          RUNOPT0: -I$(tooldir)/lib
 
       - name: make ${{ matrix.test_task }}
         run: make -s ${{ matrix.test_task }} RUN_OPTS="$RUN_OPTS" SPECOPTS="$SPECOPTS"
diff --git a/NEWS.md b/NEWS.md
index bc026cdce8c5f1..288f7d97dedf93 100644
--- a/NEWS.md
+++ b/NEWS.md
@@ -160,7 +160,7 @@ The following default gems are updated.
 * io-console 0.8.1
 * io-nonblock 0.3.2
 * io-wait 0.3.2
-* json 2.13.1
+* json 2.13.2
 * optparse 0.7.0.dev.2
 * prism 1.4.0
 * psych 5.2.6
diff --git a/bignum.c b/bignum.c
index ac86951372f4d4..2e135caf20fb09 100644
--- a/bignum.c
+++ b/bignum.c
@@ -6757,6 +6757,73 @@ rb_big_aref(VALUE x, VALUE y)
     return (xds[s1] & bit) ? INT2FIX(1) : INT2FIX(0);
 }
 
+VALUE
+rb_big_aref2(VALUE x, VALUE beg, VALUE len)
+{
+    BDIGIT *xds, *vds;
+    VALUE v;
+    size_t copy_begin, xn, shift;
+    ssize_t begin, length, end;
+    bool negative_add_one;
+
+    beg = rb_to_int(beg);
+    len = rb_to_int(len);
+    length = NUM2SSIZET(len);
+    begin = NUM2SSIZET(beg);
+    end = NUM2SSIZET(rb_int_plus(beg, len));
+    shift = begin < 0 ? -begin : 0;
+    xn = BIGNUM_LEN(x);
+    xds = BDIGITS(x);
+
+    if (length < 0) return rb_big_rshift(x, beg);
+    if (length == 0 || end <= 0) return INT2FIX(0);
+    if (begin < 0) begin = 0;
+
+    if ((size_t)(end - 1) / BITSPERDIG >= xn) {
+        /* end > xn * BITSPERDIG */
+        end = xn * BITSPERDIG;
+    }
+
+    if ((size_t)begin / BITSPERDIG < xn) {
+        /* begin < xn * BITSPERDIG */
+        size_t shift_bits, copy_end;
+        copy_begin = begin / BITSPERDIG;
+        shift_bits = begin % BITSPERDIG;
+        copy_end = (end - 1) / BITSPERDIG + 1;
+        v = bignew(copy_end - copy_begin, 1);
+        vds = BDIGITS(v);
+        MEMCPY(vds, xds + copy_begin, BDIGIT, copy_end - copy_begin);
+        negative_add_one = (vds[0] & ((1 << shift_bits) - 1)) == 0;
+        v = bignorm(v);
+        if (shift_bits) v = rb_int_rshift(v, SIZET2NUM(shift_bits));
+    }
+    else {
+        /* Out of range */
+        v = INT2FIX(0);
+        negative_add_one = false;
+        copy_begin = begin = end = 0;
+    }
+
+    if (BIGNUM_NEGATIVE_P(x)) {
+        size_t mask_size = length - shift;
+        VALUE mask = rb_int_minus(rb_int_lshift(INT2FIX(1), SIZET2NUM(mask_size)), INT2FIX(1));
+        v = rb_int_xor(v, mask);
+        for (size_t i = 0; negative_add_one && i < copy_begin; i++) {
+            if (xds[i]) negative_add_one = false;
+        }
+        if (negative_add_one) v = rb_int_plus(v, INT2FIX(1));
+        v = rb_int_and(v, mask);
+    }
+    else {
+        size_t mask_size = (size_t)end - begin;
+        VALUE mask = rb_int_minus(rb_int_lshift(INT2FIX(1), SIZET2NUM(mask_size)), INT2FIX(1));
+        v = rb_int_and(v, mask);
+    }
+    RB_GC_GUARD(x);
+    if (shift) v = rb_int_lshift(v, SSIZET2NUM(shift));
+    return v;
+}
+
 VALUE
 rb_big_hash(VALUE x)
 {
diff --git a/compile.c b/compile.c
index 8d5cb45904c6e7..bda18c1c424ab6 100644
--- a/compile.c
+++ b/compile.c
@@ -1440,6 +1440,30 @@ new_insn_body(rb_iseq_t *iseq, int line_no, int node_id, enum ruby_vminsn_type i
     return new_insn_core(iseq, line_no, node_id, insn_id, argc, operands);
 }
 
+static INSN *
+insn_replace_with_operands(rb_iseq_t *iseq, INSN *iobj, enum ruby_vminsn_type insn_id, int argc, ...)
+{
+    VALUE *operands = 0;
+    va_list argv;
+    if (argc > 0) {
+        int i;
+        va_start(argv, argc);
+        operands = compile_data_alloc2(iseq, sizeof(VALUE), argc);
+        for (i = 0; i < argc; i++) {
+            VALUE v = va_arg(argv, VALUE);
+            operands[i] = v;
+        }
+        va_end(argv);
+    }
+
+    iobj->insn_id = insn_id;
+    iobj->operand_size = argc;
+    iobj->operands = operands;
+    iseq_insn_each_markable_object(iobj, iseq_insn_each_object_write_barrier, (VALUE)iseq);
+
+    return iobj;
+}
+
 static const struct rb_callinfo *
 new_callinfo(rb_iseq_t *iseq, ID mid, int argc, unsigned int flag, struct rb_callinfo_kwarg *kw_arg, int has_blockiseq)
 {
@@ -3439,11 +3463,7 @@ iseq_peephole_optimize(rb_iseq_t *iseq, LINK_ELEMENT *list, const int do_tailcal
                 VALUE ary = iobj->operands[0];
                 rb_obj_reveal(ary, rb_cArray);
 
-                iobj->insn_id = BIN(opt_ary_freeze);
-                iobj->operand_size = 2;
-                iobj->operands = compile_data_calloc2(iseq, iobj->operand_size, sizeof(VALUE));
-                iobj->operands[0] = ary;
-                iobj->operands[1] = (VALUE)ci;
+                insn_replace_with_operands(iseq, iobj, BIN(opt_ary_freeze), 2, ary, (VALUE)ci);
                 ELEM_REMOVE(next);
             }
         }
@@ -3465,11 +3485,7 @@ iseq_peephole_optimize(rb_iseq_t *iseq, LINK_ELEMENT *list, const int do_tailcal
                 VALUE hash = iobj->operands[0];
                 rb_obj_reveal(hash, rb_cHash);
 
-                iobj->insn_id = BIN(opt_hash_freeze);
-                iobj->operand_size = 2;
-                iobj->operands = compile_data_calloc2(iseq, iobj->operand_size, sizeof(VALUE));
-                iobj->operands[0] = hash;
-                iobj->operands[1] = (VALUE)ci;
+                insn_replace_with_operands(iseq, iobj, BIN(opt_hash_freeze), 2, hash, (VALUE)ci);
                 ELEM_REMOVE(next);
             }
         }
@@ -3488,11 +3504,7 @@ iseq_peephole_optimize(rb_iseq_t *iseq, LINK_ELEMENT *list, const int do_tailcal
             const rb_iseq_t *blockiseq = (rb_iseq_t *)OPERAND_AT(next, 1);
 
             if (vm_ci_simple(ci) && vm_ci_argc(ci) == 0 && blockiseq == NULL && vm_ci_mid(ci) == idFreeze) {
-                iobj->insn_id = BIN(opt_ary_freeze);
-                iobj->operand_size = 2;
-                iobj->operands = compile_data_calloc2(iseq, iobj->operand_size, sizeof(VALUE));
-                RB_OBJ_WRITE(iseq, &iobj->operands[0], rb_cArray_empty_frozen);
-                iobj->operands[1] = (VALUE)ci;
+                insn_replace_with_operands(iseq, iobj, BIN(opt_ary_freeze), 2, rb_cArray_empty_frozen, (VALUE)ci);
                 ELEM_REMOVE(next);
             }
         }
@@ -3511,11 +3523,7 @@ iseq_peephole_optimize(rb_iseq_t *iseq, LINK_ELEMENT *list, const int do_tailcal
             const rb_iseq_t *blockiseq = (rb_iseq_t *)OPERAND_AT(next, 1);
 
             if (vm_ci_simple(ci) && vm_ci_argc(ci) == 0 && blockiseq == NULL && vm_ci_mid(ci) == idFreeze) {
-                iobj->insn_id = BIN(opt_hash_freeze);
-                iobj->operand_size = 2;
-                iobj->operands = compile_data_calloc2(iseq, iobj->operand_size, sizeof(VALUE));
-                RB_OBJ_WRITE(iseq, &iobj->operands[0], rb_cHash_empty_frozen);
-                iobj->operands[1] = (VALUE)ci;
+                insn_replace_with_operands(iseq, iobj, BIN(opt_hash_freeze), 2, rb_cHash_empty_frozen, (VALUE)ci);
                 ELEM_REMOVE(next);
             }
         }
@@ -4109,17 +4117,16 @@ iseq_peephole_optimize(rb_iseq_t *iseq, LINK_ELEMENT *list, const int do_tailcal
 static int
 insn_set_specialized_instruction(rb_iseq_t *iseq, INSN *iobj, int insn_id)
 {
-    iobj->insn_id = insn_id;
-    iobj->operand_size = insn_len(insn_id) - 1;
-    iobj->insn_info.events |= RUBY_EVENT_C_CALL | RUBY_EVENT_C_RETURN;
-
     if (insn_id == BIN(opt_neq)) {
         VALUE original_ci = iobj->operands[0];
-        iobj->operand_size = 2;
-        iobj->operands = compile_data_calloc2(iseq, iobj->operand_size, sizeof(VALUE));
-        iobj->operands[0] = (VALUE)new_callinfo(iseq, idEq, 1, 0, NULL, FALSE);
-        iobj->operands[1] = original_ci;
+        VALUE new_ci = (VALUE)new_callinfo(iseq, idEq, 1, 0, NULL, FALSE);
+        insn_replace_with_operands(iseq, iobj, insn_id, 2, new_ci, original_ci);
     }
+    else {
+        iobj->insn_id = insn_id;
+        iobj->operand_size = insn_len(insn_id) - 1;
+    }
+    iobj->insn_info.events |= RUBY_EVENT_C_CALL | RUBY_EVENT_C_RETURN;
 
     return COMPILE_OK;
 }
@@ -4151,12 +4158,7 @@ iseq_specialized_instruction(rb_iseq_t *iseq, INSN *iobj)
 
                 if (method != INT2FIX(0)) {
                     VALUE num = iobj->operands[0];
-                    int operand_len = insn_len(BIN(opt_newarray_send)) - 1;
-                    iobj->insn_id = BIN(opt_newarray_send);
-                    iobj->operands = compile_data_calloc2(iseq, operand_len, sizeof(VALUE));
-                    iobj->operands[0] = num;
-                    iobj->operands[1] = method;
-                    iobj->operand_size = operand_len;
+                    insn_replace_with_operands(iseq, iobj, BIN(opt_newarray_send), 2, num, method);
                     ELEM_REMOVE(&niobj->link);
                     return COMPILE_OK;
                 }
@@ -4168,12 +4170,7 @@ iseq_specialized_instruction(rb_iseq_t *iseq, INSN *iobj)
             const struct rb_callinfo *ci = (struct rb_callinfo *)OPERAND_AT((INSN *)niobj->link.next, 0);
             if (vm_ci_simple(ci) && vm_ci_argc(ci) == 1 && vm_ci_mid(ci) == idPack) {
                 VALUE num = iobj->operands[0];
-                int operand_len = insn_len(BIN(opt_newarray_send)) - 1;
-                iobj->insn_id = BIN(opt_newarray_send);
-                iobj->operands = compile_data_calloc2(iseq, operand_len, sizeof(VALUE));
-                iobj->operands[0] = FIXNUM_INC(num, 1);
-                iobj->operands[1] = INT2FIX(VM_OPT_NEWARRAY_SEND_PACK);
-                iobj->operand_size = operand_len;
+                insn_replace_with_operands(iseq, iobj, BIN(opt_newarray_send), 2, FIXNUM_INC(num, 1), INT2FIX(VM_OPT_NEWARRAY_SEND_PACK));
                 ELEM_REMOVE(&iobj->link);
                 ELEM_REMOVE(niobj->link.next);
                 ELEM_INSERT_NEXT(&niobj->link, &iobj->link);
@@ -4191,12 +4188,7 @@ iseq_specialized_instruction(rb_iseq_t *iseq, INSN *iobj)
             if (vm_ci_mid(ci) == idPack && vm_ci_argc(ci) == 2 &&
                     (kwarg && kwarg->keyword_len == 1 && kwarg->keywords[0] == rb_id2sym(idBuffer))) {
                 VALUE num = iobj->operands[0];
-                int operand_len = insn_len(BIN(opt_newarray_send)) - 1;
-                iobj->insn_id = BIN(opt_newarray_send);
-                iobj->operands = compile_data_calloc2(iseq, operand_len, sizeof(VALUE));
-                iobj->operands[0] = FIXNUM_INC(num, 2);
-                iobj->operands[1] = INT2FIX(VM_OPT_NEWARRAY_SEND_PACK_BUFFER);
-                iobj->operand_size = operand_len;
+                insn_replace_with_operands(iseq, iobj, BIN(opt_newarray_send), 2, FIXNUM_INC(num, 2), INT2FIX(VM_OPT_NEWARRAY_SEND_PACK_BUFFER));
                 // Remove the "send" insn.
                 ELEM_REMOVE((niobj->link.next)->next);
                 // Remove the modified insn from its original "newarray" position...
@@ -4230,11 +4222,7 @@ iseq_specialized_instruction(rb_iseq_t *iseq, INSN *iobj)
             if (vm_ci_simple(ci) && vm_ci_argc(ci) == 1 && vm_ci_mid(ci) == idIncludeP) {
                 VALUE num = iobj->operands[0];
                 INSN *sendins = (INSN *)sendobj;
-                sendins->insn_id = BIN(opt_newarray_send);
-                sendins->operand_size = insn_len(sendins->insn_id) - 1;
-                sendins->operands = compile_data_calloc2(iseq, sendins->operand_size, sizeof(VALUE));
-                sendins->operands[0] = FIXNUM_INC(num, 1);
-                sendins->operands[1] = INT2FIX(VM_OPT_NEWARRAY_SEND_INCLUDE_P);
+                insn_replace_with_operands(iseq, sendins, BIN(opt_newarray_send), 2, FIXNUM_INC(num, 1), INT2FIX(VM_OPT_NEWARRAY_SEND_INCLUDE_P));
                 // Remove the original "newarray" insn.
                 ELEM_REMOVE(&iobj->link);
                 return COMPILE_OK;
@@ -4272,12 +4260,7 @@ iseq_specialized_instruction(rb_iseq_t *iseq, INSN *iobj)
                 rb_obj_reveal(ary, rb_cArray);
 
                 INSN *sendins = (INSN *)sendobj;
-                sendins->insn_id = BIN(opt_duparray_send);
-                sendins->operand_size = insn_len(sendins->insn_id) - 1;;
-                sendins->operands = compile_data_calloc2(iseq, sendins->operand_size, sizeof(VALUE));
-                sendins->operands[0] = ary;
-                sendins->operands[1] = rb_id2sym(idIncludeP);
-                sendins->operands[2] = INT2FIX(1);
+                insn_replace_with_operands(iseq, sendins, BIN(opt_duparray_send), 3, ary, rb_id2sym(idIncludeP), INT2FIX(1));
 
                 // Remove the duparray insn.
                 ELEM_REMOVE(&iobj->link);
diff --git a/configure.ac b/configure.ac
index 6c455b3d67f309..c8018cdabb490a 100644
--- a/configure.ac
+++ b/configure.ac
@@ -3976,7 +3976,7 @@ AS_CASE(["${YJIT_SUPPORT}"],
 
 ZJIT_LIBS=
 AS_CASE(["${ZJIT_SUPPORT}"],
-[yes|dev|dev_nodebug], [
+[yes|dev|dev_nodebug|stats], [
     AS_IF([test x"$RUSTC" = "xno"],
         AC_MSG_ERROR([rustc is required. Installation instructions available at https://www.rust-lang.org/tools/install])
     )
@@ -3987,11 +3987,16 @@ AS_CASE(["${ZJIT_SUPPORT}"],
     [dev], [
         rb_cargo_features="$rb_cargo_features,disasm"
         JIT_CARGO_SUPPORT=dev
-	AC_DEFINE(RUBY_DEBUG, 1)
+        AC_DEFINE(RUBY_DEBUG, 1)
     ],
     [dev_nodebug], [
         rb_cargo_features="$rb_cargo_features,disasm"
         JIT_CARGO_SUPPORT=dev_nodebug
+        AC_DEFINE(ZJIT_STATS, 1)
+    ],
+    [stats], [
+        JIT_CARGO_SUPPORT=stats
+        AC_DEFINE(ZJIT_STATS, 1)
     ])
 
     ZJIT_LIBS="target/release/libzjit.a"
diff --git a/debug_counter.h b/debug_counter.h
index 9f0649e0ac8e33..8ffce66f0f7b16 100644
--- a/debug_counter.h
+++ b/debug_counter.h
@@ -305,7 +305,6 @@ RB_DEBUG_COUNTER(obj_imemo_ment)
 RB_DEBUG_COUNTER(obj_imemo_iseq)
 RB_DEBUG_COUNTER(obj_imemo_env)
 RB_DEBUG_COUNTER(obj_imemo_tmpbuf)
-RB_DEBUG_COUNTER(obj_imemo_ast)
 RB_DEBUG_COUNTER(obj_imemo_cref)
 RB_DEBUG_COUNTER(obj_imemo_svar)
 RB_DEBUG_COUNTER(obj_imemo_throw_data)
diff --git a/doc/contributing/building_ruby.md b/doc/contributing/building_ruby.md
index a0486cb931de68..eac83fc00ef978 100644
--- a/doc/contributing/building_ruby.md
+++ b/doc/contributing/building_ruby.md
@@ -307,9 +307,6 @@ RUBY_TEST_TIMEOUT_SCALE=5 SYNTAX_SUGGEST_TIMEOUT=600 make check
 
 Please note, however, the following caveats!
 
-* ASAN will not work properly on any currently released version of Ruby; the
-  necessary support is currently only present on Ruby's master branch (and the
-  whole test suite passes only as of commit [Revision 9d0a5148]).
 * Due to [Bug #20243], Clang generates code for threadlocal variables which
   doesn't work with M:N threading. Thus, it's necessary to disable M:N
   threading support at build time for now (with the `-DUSE_MN_THREADS=0`
diff --git a/ext/-test-/namespace/yay1/yay1.def b/ext/-test-/namespace/yay1/yay1.def
index edbae873126604..510fbe7017bd9f 100644
--- a/ext/-test-/namespace/yay1/yay1.def
+++ b/ext/-test-/namespace/yay1/yay1.def
@@ -1,4 +1,3 @@
-LIBRARY yay1
 EXPORTS
   Init_yay1
   yay_value
diff --git a/ext/-test-/namespace/yay1/yay1.h b/ext/-test-/namespace/yay1/yay1.h
index d68f8b552324b9..c4dade928ad34b 100644
--- a/ext/-test-/namespace/yay1/yay1.h
+++ b/ext/-test-/namespace/yay1/yay1.h
@@ -1,4 +1,4 @@
 #include <ruby.h>
 #include "ruby/internal/dllexport.h"
 
-RUBY_EXTERN VALUE yay_value(void);
+RUBY_FUNC_EXPORTED VALUE yay_value(void);
diff --git a/ext/-test-/namespace/yay2/yay2.def b/ext/-test-/namespace/yay2/yay2.def
index 6bb6011f4b841d..163fc44c04649c 100644
--- a/ext/-test-/namespace/yay2/yay2.def
+++ b/ext/-test-/namespace/yay2/yay2.def
@@ -1,4 +1,3 @@
-LIBRARY yay2
 EXPORTS
   Init_yay2
   yay_value
diff --git a/ext/-test-/namespace/yay2/yay2.h b/ext/-test-/namespace/yay2/yay2.h
index d68f8b552324b9..c4dade928ad34b 100644
--- a/ext/-test-/namespace/yay2/yay2.h
+++ b/ext/-test-/namespace/yay2/yay2.h
@@ -1,4 +1,4 @@
 #include <ruby.h>
 #include "ruby/internal/dllexport.h"
 
-RUBY_EXTERN VALUE yay_value(void);
+RUBY_FUNC_EXPORTED VALUE yay_value(void);
diff --git a/ext/json/lib/json/version.rb b/ext/json/lib/json/version.rb
index 2aef3d7f613888..f9ac3e17a947a5 100644
--- a/ext/json/lib/json/version.rb
+++ b/ext/json/lib/json/version.rb
@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module JSON
-  VERSION = '2.13.1'
+  VERSION = '2.13.2'
 end
diff --git a/ext/objspace/objspace.c b/ext/objspace/objspace.c
index 8476c9b74752d1..8b3045fda322c4 100644
--- a/ext/objspace/objspace.c
+++ b/ext/objspace/objspace.c
@@ -500,7 +500,6 @@ count_imemo_objects(int argc, VALUE *argv, VALUE self)
         INIT_IMEMO_TYPE_ID(imemo_ment);
         INIT_IMEMO_TYPE_ID(imemo_iseq);
         INIT_IMEMO_TYPE_ID(imemo_tmpbuf);
-        INIT_IMEMO_TYPE_ID(imemo_ast);
         INIT_IMEMO_TYPE_ID(imemo_callinfo);
         INIT_IMEMO_TYPE_ID(imemo_callcache);
         INIT_IMEMO_TYPE_ID(imemo_constcache);
diff --git a/gc/default/default.c b/gc/default/default.c
index de3bee15223b19..47cfe3fb3baff3 100644
--- a/gc/default/default.c
+++ b/gc/default/default.c
@@ -4454,10 +4454,10 @@ rb_gc_impl_mark_maybe(void *objspace_ptr, VALUE obj)
         asan_unpoisoning_object(obj) {
             /* Garbage can live on the stack, so do not mark or pin */
             switch (BUILTIN_TYPE(obj)) {
-            case T_ZOMBIE:
-            case T_NONE:
+              case T_ZOMBIE:
+              case T_NONE:
                 break;
-            default:
+              default:
                 gc_mark_and_pin(objspace, obj);
                 break;
             }
diff --git a/gc/mmtk/src/api.rs b/gc/mmtk/src/api.rs
index a1b94d520d57f4..5217eb4a758da1 100644
--- a/gc/mmtk/src/api.rs
+++ b/gc/mmtk/src/api.rs
@@ -107,10 +107,7 @@ pub extern "C" fn mmtk_builder_default() -> *mut MMTKBuilder {
     if let Some(threads) = mmtk_builder_default_parse_threads() {
         if !builder.options.threads.set(threads) {
             // MMTk will validate it and reject 0.
-            eprintln!(
-                "[FATAL] Failed to set the number of MMTk threads to {}",
-                threads
-            );
+            eprintln!("[FATAL] Failed to set the number of MMTk threads to {threads}");
             std::process::exit(1);
         }
     }
@@ -120,10 +117,7 @@ pub extern "C" fn mmtk_builder_default() -> *mut MMTKBuilder {
     let heap_max = mmtk_builder_default_parse_heap_max();
 
     if heap_min >= heap_max {
-        eprintln!(
-            "[FATAL] MMTK_HEAP_MIN({}) >= MMTK_HEAP_MAX({})",
-            heap_min, heap_max
-        );
+        eprintln!("[FATAL] MMTK_HEAP_MIN({heap_min}) >= MMTK_HEAP_MAX({heap_max})");
         std::process::exit(1);
     }
 
diff --git a/gc/mmtk/src/binding.rs b/gc/mmtk/src/binding.rs
index 619b7f246ce704..811cbf8abf8b32 100644
--- a/gc/mmtk/src/binding.rs
+++ b/gc/mmtk/src/binding.rs
@@ -119,7 +119,7 @@ impl RubyBinding {
     }
 
     pub fn register_wb_unprotected_object(&self, object: ObjectReference) {
-        debug!("Registering WB-unprotected object: {}", object);
+        debug!("Registering WB-unprotected object: {object}");
         let mut objects = self.wb_unprotected_objects.lock().unwrap();
         objects.insert(object);
     }
diff --git a/gc/mmtk/src/collection.rs b/gc/mmtk/src/collection.rs
index 0570b64e3a6012..41c508afd9115d 100644
--- a/gc/mmtk/src/collection.rs
+++ b/gc/mmtk/src/collection.rs
@@ -41,10 +41,7 @@ impl Collection<Ruby> for VMCollection {
                 .name("MMTk Worker Thread".to_string())
                 .spawn(move || {
                     let ordinal = worker.ordinal;
-                    debug!(
-                        "Hello! This is MMTk Worker Thread running! ordinal: {}",
-                        ordinal
-                    );
+                    debug!("Hello! This is MMTk Worker Thread running! ordinal: {ordinal}");
                     crate::register_gc_thread(thread::current().id());
                     let ptr_worker = &mut *worker as *mut GCWorker<Ruby>;
                     let gc_thread_tls =
@@ -55,10 +52,7 @@ impl Collection<Ruby> for VMCollection {
                         GCThreadTLS::to_vwt(gc_thread_tls),
                         worker,
                     );
-                    debug!(
-                        "An MMTk Worker Thread is quitting. Good bye! ordinal: {}",
-                        ordinal
-                    );
+                    debug!("An MMTk Worker Thread is quitting. Good bye! ordinal: {ordinal}");
                     crate::unregister_gc_thread(thread::current().id());
                 })
                 .unwrap(),
diff --git a/gc/mmtk/src/scanning.rs b/gc/mmtk/src/scanning.rs
index 36c0f998f4a3fe..af435813770a8a 100644
--- a/gc/mmtk/src/scanning.rs
+++ b/gc/mmtk/src/scanning.rs
@@ -47,11 +47,7 @@ impl Scanning<Ruby> for VMScanning {
             );
             let forwarded_target = object_tracer.trace_object(target_object);
             if forwarded_target != target_object {
-                trace!(
-                    "  Forwarded target {} -> {}",
-                    target_object,
-                    forwarded_target
-                );
+                trace!("  Forwarded target {target_object} -> {forwarded_target}");
             }
             forwarded_target
         };
@@ -251,15 +247,11 @@ impl<F: RootsWorkFactory<RubySlot>> GCWork<Ruby> for ScanWbUnprotectedRoots<F> {
         VMScanning::collect_object_roots_in("wb_unprot_roots", gc_tls, &mut self.factory, || {
             for object in self.objects.iter().copied() {
                 if object.is_reachable() {
-                    debug!(
-                        "[wb_unprot_roots] Visiting WB-unprotected object (parent): {}",
-                        object
-                    );
+                    debug!("[wb_unprot_roots] Visiting WB-unprotected object (parent): {object}");
                     (upcalls().scan_object_ruby_style)(object);
                 } else {
                     debug!(
-                        "[wb_unprot_roots] Skipping young WB-unprotected object (parent): {}",
-                        object
+                        "[wb_unprot_roots] Skipping young WB-unprotected object (parent): {object}"
                     );
                 }
             }
diff --git a/gc/mmtk/src/weak_proc.rs b/gc/mmtk/src/weak_proc.rs
index 204dd203aa333f..0217673e36b842 100644
--- a/gc/mmtk/src/weak_proc.rs
+++ b/gc/mmtk/src/weak_proc.rs
@@ -103,7 +103,7 @@ impl GCWork<Ruby> for ProcessObjFreeCandidates {
 
         let n_cands = obj_free_candidates.len();
 
-        debug!("Total: {} candidates", n_cands);
+        debug!("Total: {n_cands} candidates");
 
         // Process obj_free
         let mut new_candidates = Vec::new();
@@ -112,11 +112,7 @@ impl GCWork<Ruby> for ProcessObjFreeCandidates {
             if object.is_reachable() {
                 // Forward and add back to the candidate list.
                 let new_object = object.forward();
-                trace!(
-                    "Forwarding obj_free candidate: {} -> {}",
-                    object,
-                    new_object
-                );
+                trace!("Forwarding obj_free candidate: {object} -> {new_object}");
                 new_candidates.push(new_object);
             } else {
                 (upcalls().call_obj_free)(object);
@@ -158,11 +154,10 @@ trait GlobalTableProcessingWork {
         let forward_object = |_worker, object: ObjectReference, _pin| {
             debug_assert!(
                 mmtk::memory_manager::is_mmtk_object(object.to_raw_address()).is_some(),
-                "{} is not an MMTk object",
-                object
+                "{object} is not an MMTk object"
             );
             let result = object.forward();
-            trace!("Forwarding reference: {} -> {}", object, result);
+            trace!("Forwarding reference: {object} -> {result}");
             result
         };
 
@@ -216,14 +211,10 @@ impl GCWork<Ruby> for UpdateWbUnprotectedObjectsList {
             if object.is_reachable() {
                 // Forward and add back to the candidate list.
                 let new_object = object.forward();
-                trace!(
-                    "Forwarding WB-unprotected object: {} -> {}",
-                    object,
-                    new_object
-                );
+                trace!("Forwarding WB-unprotected object: {object} -> {new_object}");
                 objects.insert(new_object);
             } else {
-                trace!("Removing WB-unprotected object from list: {}", object);
+                trace!("Removing WB-unprotected object from list: {object}");
             }
         }
 
diff --git a/hash.c b/hash.c
index 6f3ffb78ba2055..7256063d72e079 100644
--- a/hash.c
+++ b/hash.c
@@ -71,10 +71,6 @@
 #define HASH_DEBUG 0
 #endif
 
-#if HASH_DEBUG
-#include "internal/gc.h"
-#endif
-
 #define SET_DEFAULT(hash, ifnone) ( \
     FL_UNSET_RAW(hash, RHASH_PROC_DEFAULT), \
     RHASH_SET_IFNONE(hash, ifnone))
diff --git a/imemo.c b/imemo.c
index 5f24e0230129db..7153689030a7b6 100644
--- a/imemo.c
+++ b/imemo.c
@@ -16,7 +16,6 @@ rb_imemo_name(enum imemo_type type)
     // put no default case to get a warning if an imemo type is missing
     switch (type) {
 #define IMEMO_NAME(x) case imemo_##x: return #x;
-        IMEMO_NAME(ast);
         IMEMO_NAME(callcache);
         IMEMO_NAME(callinfo);
         IMEMO_NAME(constcache);
@@ -220,10 +219,6 @@ rb_imemo_memsize(VALUE obj)
 {
     size_t size = 0;
     switch (imemo_type(obj)) {
-      case imemo_ast:
-        rb_bug("imemo_ast is obsolete");
-
-        break;
       case imemo_callcache:
         break;
       case imemo_callinfo:
@@ -336,10 +331,6 @@ void
 rb_imemo_mark_and_move(VALUE obj, bool reference_updating)
 {
     switch (imemo_type(obj)) {
-      case imemo_ast:
-        rb_bug("imemo_ast is obsolete");
-
-        break;
       case imemo_callcache: {
         /* cc is callcache.
          *
@@ -600,10 +591,6 @@ void
 rb_imemo_free(VALUE obj)
 {
     switch (imemo_type(obj)) {
-      case imemo_ast:
-        rb_bug("imemo_ast is obsolete");
-
-        break;
       case imemo_callcache:
         RB_DEBUG_COUNTER_INC(obj_imemo_callcache);
 
diff --git a/inits.c b/inits.c
index 29087a6306481b..b4e58ea25a1cec 100644
--- a/inits.c
+++ b/inits.c
@@ -90,7 +90,6 @@ rb_call_builtin_inits(void)
 #define BUILTIN(n) CALL(builtin_##n)
     BUILTIN(kernel);
     BUILTIN(yjit);
-    // BUILTIN(yjit_hook) is called after rb_yjit_init()
     BUILTIN(gc);
     BUILTIN(ractor);
     BUILTIN(numeric);
@@ -109,6 +108,7 @@ rb_call_builtin_inits(void)
     BUILTIN(nilclass);
     BUILTIN(marshal);
     BUILTIN(zjit);
+    BUILTIN(yjit_hook);
     Init_builtin_prelude();
 }
 #undef CALL
diff --git a/internal/bignum.h b/internal/bignum.h
index db8d3aee83852e..0ba21a492334f1 100644
--- a/internal/bignum.h
+++ b/internal/bignum.h
@@ -121,6 +121,7 @@ VALUE rb_integer_float_eq(VALUE x, VALUE y);
 VALUE rb_str_convert_to_inum(VALUE str, int base, int badcheck, int raise_exception);
 VALUE rb_big_comp(VALUE x);
 VALUE rb_big_aref(VALUE x, VALUE y);
+VALUE rb_big_aref2(VALUE num, VALUE beg, VALUE len);
 VALUE rb_big_abs(VALUE x);
 VALUE rb_big_size_m(VALUE big);
 VALUE rb_big_bit_length(VALUE big);
diff --git a/internal/imemo.h b/internal/imemo.h
index dcea997ae803a7..0ad00fe6b79d99 100644
--- a/internal/imemo.h
+++ b/internal/imemo.h
@@ -37,7 +37,6 @@ enum imemo_type {
     imemo_ment           =  6,
     imemo_iseq           =  7,
     imemo_tmpbuf         =  8,
-    imemo_ast            =  9, // Obsolete due to the universal parser
     imemo_callinfo       = 10,
     imemo_callcache      = 11,
     imemo_constcache     = 12,
diff --git a/internal/numeric.h b/internal/numeric.h
index 6406cfc2fa7480..58f42f41ac4bea 100644
--- a/internal/numeric.h
+++ b/internal/numeric.h
@@ -85,6 +85,7 @@ VALUE rb_int_cmp(VALUE x, VALUE y);
 VALUE rb_int_equal(VALUE x, VALUE y);
 VALUE rb_int_divmod(VALUE x, VALUE y);
 VALUE rb_int_and(VALUE x, VALUE y);
+VALUE rb_int_xor(VALUE x, VALUE y);
 VALUE rb_int_lshift(VALUE x, VALUE y);
 VALUE rb_int_rshift(VALUE x, VALUE y);
 VALUE rb_int_div(VALUE x, VALUE y);
diff --git a/internal/vm.h b/internal/vm.h
index 3ee958a020f474..3a99011c44b2d8 100644
--- a/internal/vm.h
+++ b/internal/vm.h
@@ -79,7 +79,7 @@ VALUE rb_block_call2(VALUE obj, ID mid, int argc, const VALUE *argv, rb_block_ca
 struct vm_ifunc *rb_current_ifunc(void);
 VALUE rb_gccct_clear_table(VALUE);
 
-#if USE_YJIT
+#if USE_YJIT || USE_ZJIT
 /* vm_exec.c */
 extern uint64_t rb_vm_insns_count;
 #endif
diff --git a/lib/bundler/cli/cache.rb b/lib/bundler/cli/cache.rb
index 2e63a16ec3178b..92d7a1c519c219 100644
--- a/lib/bundler/cli/cache.rb
+++ b/lib/bundler/cli/cache.rb
@@ -16,7 +16,6 @@ def run
       setup_cache_all
       install
 
-      # TODO: move cache contents here now that all bundles are locked
       custom_path = Bundler.settings[:path] if options[:path]
 
       Bundler.settings.temporary(cache_all_platforms: options["all-platforms"]) do
diff --git a/lib/bundler/definition.rb b/lib/bundler/definition.rb
index 32006af109ee09..6c7a3e9c38a613 100644
--- a/lib/bundler/definition.rb
+++ b/lib/bundler/definition.rb
@@ -645,20 +645,12 @@ def filter_specs(specs, deps, skips: [])
     end
 
     def materialize(dependencies)
-      # Tracks potential endless loops trying to re-resolve.
-      # TODO: Remove as dead code if not reports are received in a while
-      incorrect_spec = nil
-
       specs = begin
         resolve.materialize(dependencies)
       rescue IncorrectLockfileDependencies => e
         raise if Bundler.frozen_bundle?
 
-        spec = e.spec
-        raise "Infinite loop while fixing lockfile dependencies" if incorrect_spec == spec
-
-        incorrect_spec = spec
-        reresolve_without([spec])
+        reresolve_without([e.spec])
         retry
       end
 
@@ -740,7 +732,6 @@ def reresolve_without(incomplete_specs)
     def start_resolution
       local_platform_needed_for_resolvability = @most_specific_non_local_locked_platform && !@platforms.include?(Bundler.local_platform)
       @platforms << Bundler.local_platform if local_platform_needed_for_resolvability
-      add_platform(Gem::Platform::RUBY) if RUBY_ENGINE == "truffleruby"
 
       result = SpecSet.new(resolver.start)
 
diff --git a/lib/bundler/resolver/package.rb b/lib/bundler/resolver/package.rb
index ff75e7b6bc2c94..3906be3f57718e 100644
--- a/lib/bundler/resolver/package.rb
+++ b/lib/bundler/resolver/package.rb
@@ -21,6 +21,7 @@ def initialize(name, platforms, locked_specs:, unlock:, prerelease: false, prefe
         @locked_version = locked_specs.version_for(name)
         @unlock = unlock
         @dependency = dependency || Dependency.new(name, @locked_version)
+        @platforms |= [Gem::Platform::RUBY] if @dependency.default_force_ruby_platform
         @top_level = !dependency.nil?
         @prerelease = @dependency.prerelease? || @locked_version&.prerelease? || prerelease ? :consider_first : :ignore
         @prefer_local = prefer_local
diff --git a/lib/bundler/source/path.rb b/lib/bundler/source/path.rb
index ac76ae1fa0e44c..7511def2306192 100644
--- a/lib/bundler/source/path.rb
+++ b/lib/bundler/source/path.rb
@@ -124,11 +124,7 @@ def expanded_path
       end
 
       def expand(somepath)
-        if Bundler.current_ruby.jruby? # TODO: Unify when https://github.com/rubygems/bundler/issues/7598 fixed upstream and all supported jrubies include the fix
-          somepath.expand_path(root_path).expand_path
-        else
-          somepath.expand_path(root_path)
-        end
+        somepath.expand_path(root_path)
       rescue ArgumentError => e
         Bundler.ui.debug(e)
         raise PathError, "There was an error while trying to use the path " \
diff --git a/lib/bundler/vendor/thor/lib/thor/actions/file_manipulation.rb b/lib/bundler/vendor/thor/lib/thor/actions/file_manipulation.rb
index bccfbb6b85e887..d8c9863054296b 100644
--- a/lib/bundler/vendor/thor/lib/thor/actions/file_manipulation.rb
+++ b/lib/bundler/vendor/thor/lib/thor/actions/file_manipulation.rb
@@ -242,6 +242,35 @@ def inject_into_module(path, module_name, *args, &block)
       insert_into_file(path, *(args << config), &block)
     end
 
+    # Run a regular expression replacement on a file, raising an error if the
+    # contents of the file are not changed.
+    #
+    # ==== Parameters
+    # path<String>:: path of the file to be changed
+    # flag<Regexp|String>:: the regexp or string to be replaced
+    # replacement<String>:: the replacement, can be also given as a block
+    # config<Hash>:: give :verbose => false to not log the status, and
+    #                :force => true, to force the replacement regardless of runner behavior.
+    #
+    # ==== Example
+    #
+    #   gsub_file! 'app/controllers/application_controller.rb', /#\s*(filter_parameter_logging :password)/, '\1'
+    #
+    #   gsub_file! 'README', /rake/, :green do |match|
+    #     match << " no more. Use thor!"
+    #   end
+    #
+    def gsub_file!(path, flag, *args, &block)
+      config = args.last.is_a?(Hash) ? args.pop : {}
+
+      return unless behavior == :invoke || config.fetch(:force, false)
+
+      path = File.expand_path(path, destination_root)
+      say_status :gsub, relative_to_original_destination_root(path), config.fetch(:verbose, true)
+
+      actually_gsub_file(path, flag, args, true, &block) unless options[:pretend]
+    end
+
     # Run a regular expression replacement on a file.
     #
     # ==== Parameters
@@ -267,11 +296,7 @@ def gsub_file(path, flag, *args, &block)
       path = File.expand_path(path, destination_root)
       say_status :gsub, relative_to_original_destination_root(path), config.fetch(:verbose, true)
 
-      unless options[:pretend]
-        content = File.binread(path)
-        content.gsub!(flag, *args, &block)
-        File.open(path, "wb") { |file| file.write(content) }
-      end
+      actually_gsub_file(path, flag, args, false, &block) unless options[:pretend]
     end
 
     # Uncomment all lines matching a given regex. Preserves indentation before
@@ -348,7 +373,7 @@ def capture(*args)
     end
 
     def with_output_buffer(buf = "".dup) #:nodoc:
-      raise ArgumentError, "Buffer can not be a frozen object" if buf.frozen?
+      raise ArgumentError, "Buffer cannot be a frozen object" if buf.frozen?
       old_buffer = output_buffer
       self.output_buffer = buf
       yield
@@ -357,6 +382,17 @@ def with_output_buffer(buf = "".dup) #:nodoc:
       self.output_buffer = old_buffer
     end
 
+    def actually_gsub_file(path, flag, args, error_on_no_change, &block)
+      content = File.binread(path)
+      success = content.gsub!(flag, *args, &block)
+
+      if success.nil? && error_on_no_change
+        raise Bundler::Thor::Error, "The content of #{path} did not change"
+      end
+
+      File.open(path, "wb") { |file| file.write(content) }
+    end
+
     # Bundler::Thor::Actions#capture depends on what kind of buffer is used in ERB.
     # Thus CapturableERB fixes ERB to use String buffer.
     class CapturableERB < ERB
diff --git a/lib/bundler/vendor/thor/lib/thor/parser/options.rb b/lib/bundler/vendor/thor/lib/thor/parser/options.rb
index 734f5fe7e34af0..fe22d989e54095 100644
--- a/lib/bundler/vendor/thor/lib/thor/parser/options.rb
+++ b/lib/bundler/vendor/thor/lib/thor/parser/options.rb
@@ -144,7 +144,7 @@ def parse(args) # rubocop:disable Metrics/MethodLength
     def check_exclusive!
       opts = @assigns.keys
       # When option A and B are exclusive, if A and B are given at the same time,
-      # the diffrence of argument array size will decrease.
+      # the difference of argument array size will decrease.
       found = @exclusives.find{ |ex| (ex - opts).size < ex.size - 1 }
       if found
         names = names_to_switch_names(found & opts).map{|n| "'#{n}'"}
diff --git a/lib/bundler/vendor/thor/lib/thor/runner.rb b/lib/bundler/vendor/thor/lib/thor/runner.rb
index c7cc873131f3e8..95f8b16e31893a 100644
--- a/lib/bundler/vendor/thor/lib/thor/runner.rb
+++ b/lib/bundler/vendor/thor/lib/thor/runner.rb
@@ -1,7 +1,6 @@
 require_relative "../thor"
 require_relative "group"
 
-require "yaml"
 require "digest/sha2"
 require "pathname"
 
@@ -195,6 +194,7 @@ def thor_root
   def thor_yaml
     @thor_yaml ||= begin
       yaml_file = File.join(thor_root, "thor.yml")
+      require "yaml"
       yaml = YAML.load_file(yaml_file) if File.exist?(yaml_file)
       yaml || {}
     end
diff --git a/lib/bundler/vendor/thor/lib/thor/shell/basic.rb b/lib/bundler/vendor/thor/lib/thor/shell/basic.rb
index b3e85733cba788..da02b9422758e5 100644
--- a/lib/bundler/vendor/thor/lib/thor/shell/basic.rb
+++ b/lib/bundler/vendor/thor/lib/thor/shell/basic.rb
@@ -314,7 +314,7 @@ def show_diff(destination, content) #:nodoc:
         diff_cmd = ENV["THOR_DIFF"] || ENV["RAILS_DIFF"] || "diff -u"
 
         require "tempfile"
-        Tempfile.open(File.basename(destination), File.dirname(destination)) do |temp|
+        Tempfile.open(File.basename(destination), File.dirname(destination), binmode: true) do |temp|
           temp.write content
           temp.rewind
           system %(#{diff_cmd} "#{destination}" "#{temp.path}")
@@ -372,16 +372,12 @@ def merge(destination, content) #:nodoc:
         Tempfile.open([File.basename(destination), File.extname(destination)], File.dirname(destination)) do |temp|
           temp.write content
           temp.rewind
-          system %(#{merge_tool} "#{temp.path}" "#{destination}")
+          system(merge_tool, temp.path, destination)
         end
       end
 
       def merge_tool #:nodoc:
-        @merge_tool ||= ENV["THOR_MERGE"] || git_merge_tool
-      end
-
-      def git_merge_tool #:nodoc:
-        `git config merge.tool`.rstrip rescue ""
+        @merge_tool ||= ENV["THOR_MERGE"] || "git difftool --no-index"
       end
     end
   end
diff --git a/lib/bundler/vendor/thor/lib/thor/version.rb b/lib/bundler/vendor/thor/lib/thor/version.rb
index cd7b4f060eac5b..5474a2f71badc8 100644
--- a/lib/bundler/vendor/thor/lib/thor/version.rb
+++ b/lib/bundler/vendor/thor/lib/thor/version.rb
@@ -1,3 +1,3 @@
 class Bundler::Thor
-  VERSION = "1.3.2"
+  VERSION = "1.4.0"
 end
diff --git a/lib/prism/ffi.rb b/lib/prism/ffi.rb
index 5a4ba09a4fd9a0..1e1bf8b1c877d4 100644
--- a/lib/prism/ffi.rb
+++ b/lib/prism/ffi.rb
@@ -422,13 +422,13 @@ def dump_options_command_line(options)
     def dump_options_version(version)
       case version
       when nil, "latest"
-        0
+        0 # Handled in pm_parser_init
       when /\A3\.3(\.\d+)?\z/
         1
       when /\A3\.4(\.\d+)?\z/
         2
       when /\A3\.5(\.\d+)?\z/
-        0
+        3
       else
         raise ArgumentError, "invalid version: #{version}"
       end
diff --git a/lib/tsort.gemspec b/lib/tsort.gemspec
index 8970cbe8261770..4e0ef0507df008 100644
--- a/lib/tsort.gemspec
+++ b/lib/tsort.gemspec
@@ -19,6 +19,7 @@ Gem::Specification.new do |spec|
 
   spec.metadata["homepage_uri"] = spec.homepage
   spec.metadata["source_code_uri"] = spec.homepage
+  spec.metadata["changelog_uri"] = "#{spec.homepage}/releases"
 
   dir, gemspec = File.split(__FILE__)
   excludes = %W[
diff --git a/numeric.c b/numeric.c
index d3affed8049b34..89cff8a730fc9c 100644
--- a/numeric.c
+++ b/numeric.c
@@ -5115,8 +5115,8 @@ fix_xor(VALUE x, VALUE y)
  *
  */
 
-static VALUE
-int_xor(VALUE x, VALUE y)
+VALUE
+rb_int_xor(VALUE x, VALUE y)
 {
     if (FIXNUM_P(x)) {
         return fix_xor(x, y);
@@ -5288,10 +5288,23 @@ generate_mask(VALUE len)
     return rb_int_minus(rb_int_lshift(INT2FIX(1), len), INT2FIX(1));
 }
 
+static VALUE
+int_aref2(VALUE num, VALUE beg, VALUE len)
+{
+    if (RB_TYPE_P(num, T_BIGNUM)) {
+        return rb_big_aref2(num, beg, len);
+    }
+    else {
+        num = rb_int_rshift(num, beg);
+        VALUE mask = generate_mask(len);
+        return rb_int_and(num, mask);
+    }
+}
+
 static VALUE
 int_aref1(VALUE num, VALUE arg)
 {
-    VALUE orig_num = num, beg, end;
+    VALUE beg, end;
     int excl;
 
     if (rb_range_values(arg, &beg, &end, &excl)) {
@@ -5311,22 +5324,19 @@ int_aref1(VALUE num, VALUE arg)
                 return INT2FIX(0);
             }
         }
-        num = rb_int_rshift(num, beg);
 
         int cmp = compare_indexes(beg, end);
         if (!NIL_P(end) && cmp < 0) {
             VALUE len = rb_int_minus(end, beg);
             if (!excl) len = rb_int_plus(len, INT2FIX(1));
-            VALUE mask = generate_mask(len);
-            num = rb_int_and(num, mask);
+            return int_aref2(num, beg, len);
         }
         else if (cmp == 0) {
             if (excl) return INT2FIX(0);
-            num = orig_num;
             arg = beg;
             goto one_bit;
         }
-        return num;
+        return rb_int_rshift(num, beg);
     }
 
 one_bit:
@@ -5339,15 +5349,6 @@ int_aref1(VALUE num, VALUE arg)
     return Qnil;
 }
 
-static VALUE
-int_aref2(VALUE num, VALUE beg, VALUE len)
-{
-    num = rb_int_rshift(num, beg);
-    VALUE mask = generate_mask(len);
-    num = rb_int_and(num, mask);
-    return num;
-}
-
 /*
  *  call-seq:
  *     self[offset]    -> 0 or 1
@@ -6366,7 +6367,7 @@ Init_Numeric(void)
 
     rb_define_method(rb_cInteger, "&", rb_int_and, 1);
     rb_define_method(rb_cInteger, "|", int_or,  1);
-    rb_define_method(rb_cInteger, "^", int_xor, 1);
+    rb_define_method(rb_cInteger, "^", rb_int_xor, 1);
     rb_define_method(rb_cInteger, "[]", int_aref, -1);
 
     rb_define_method(rb_cInteger, "<<", rb_int_lshift, 1);
diff --git a/prism/options.c b/prism/options.c
index a457178ce85757..1b5c022cf54f9f 100644
--- a/prism/options.c
+++ b/prism/options.c
@@ -89,7 +89,7 @@ pm_options_version_set(pm_options_t *options, const char *version, size_t length
         }
 
         if (strncmp(version, "3.5", 3) == 0) {
-            options->version = PM_OPTIONS_VERSION_LATEST;
+            options->version = PM_OPTIONS_VERSION_CRUBY_3_5;
             return true;
         }
 
@@ -108,7 +108,7 @@ pm_options_version_set(pm_options_t *options, const char *version, size_t length
         }
 
         if (strncmp(version, "3.5.", 4) == 0 && is_number(version + 4, length - 4)) {
-            options->version = PM_OPTIONS_VERSION_LATEST;
+            options->version = PM_OPTIONS_VERSION_CRUBY_3_5;
             return true;
         }
     }
diff --git a/prism/options.h b/prism/options.h
index 2f64701b0c20ea..092fda4f07878a 100644
--- a/prism/options.h
+++ b/prism/options.h
@@ -82,14 +82,20 @@ typedef void (*pm_options_shebang_callback_t)(struct pm_options *options, const
  * parse in the same way as a specific version of CRuby would have.
  */
 typedef enum {
-    /** The current version of prism. */
-    PM_OPTIONS_VERSION_LATEST = 0,
+    /** If an explicit version is not provided, the current version of prism will be used. */
+    PM_OPTIONS_VERSION_UNSET = 0,
 
     /** The vendored version of prism in CRuby 3.3.x. */
     PM_OPTIONS_VERSION_CRUBY_3_3 = 1,
 
     /** The vendored version of prism in CRuby 3.4.x. */
-    PM_OPTIONS_VERSION_CRUBY_3_4 = 2
+    PM_OPTIONS_VERSION_CRUBY_3_4 = 2,
+
+    /** The vendored version of prism in CRuby 3.5.x. */
+    PM_OPTIONS_VERSION_CRUBY_3_5 = 3,
+
+    /** The current version of prism. */
+    PM_OPTIONS_VERSION_LATEST = PM_OPTIONS_VERSION_CRUBY_3_5
 } pm_options_version_t;
 
 /**
diff --git a/prism/prism.c b/prism/prism.c
index a40e0ebeb0c821..ec8f84fb6bc8da 100644
--- a/prism/prism.c
+++ b/prism/prism.c
@@ -1409,7 +1409,7 @@ pm_conditional_predicate_warn_write_literal_p(const pm_node_t *node) {
 static inline void
 pm_conditional_predicate_warn_write_literal(pm_parser_t *parser, const pm_node_t *node) {
     if (pm_conditional_predicate_warn_write_literal_p(node)) {
-        pm_parser_warn_node(parser, node, parser->version == PM_OPTIONS_VERSION_CRUBY_3_3 ? PM_WARN_EQUAL_IN_CONDITIONAL_3_3 : PM_WARN_EQUAL_IN_CONDITIONAL);
+        pm_parser_warn_node(parser, node, parser->version <= PM_OPTIONS_VERSION_CRUBY_3_3 ? PM_WARN_EQUAL_IN_CONDITIONAL_3_3 : PM_WARN_EQUAL_IN_CONDITIONAL);
     }
 }
 
@@ -2976,7 +2976,7 @@ pm_call_and_write_node_create(pm_parser_t *parser, pm_call_node_t *target, const
  */
 static void
 pm_index_arguments_check(pm_parser_t *parser, const pm_arguments_node_t *arguments, const pm_node_t *block) {
-    if (parser->version != PM_OPTIONS_VERSION_CRUBY_3_3) {
+    if (parser->version >= PM_OPTIONS_VERSION_CRUBY_3_4) {
         if (arguments != NULL && PM_NODE_FLAG_P(arguments, PM_ARGUMENTS_NODE_FLAGS_CONTAINS_KEYWORDS)) {
             pm_node_t *node;
             PM_NODE_LIST_FOREACH(&arguments->arguments, index, node) {
@@ -9113,7 +9113,7 @@ lex_global_variable(pm_parser_t *parser) {
                 } while ((width = char_is_identifier(parser, parser->current.end, parser->end - parser->current.end)) > 0);
 
                 // $0 isn't allowed to be followed by anything.
-                pm_diagnostic_id_t diag_id = parser->version == PM_OPTIONS_VERSION_CRUBY_3_3 ? PM_ERR_INVALID_VARIABLE_GLOBAL_3_3 : PM_ERR_INVALID_VARIABLE_GLOBAL;
+                pm_diagnostic_id_t diag_id = parser->version <= PM_OPTIONS_VERSION_CRUBY_3_3 ? PM_ERR_INVALID_VARIABLE_GLOBAL_3_3 : PM_ERR_INVALID_VARIABLE_GLOBAL;
                 PM_PARSER_ERR_TOKEN_FORMAT_CONTENT(parser, parser->current, diag_id);
             }
 
@@ -9150,7 +9150,7 @@ lex_global_variable(pm_parser_t *parser) {
             } else {
                 // If we get here, then we have a $ followed by something that
                 // isn't recognized as a global variable.
-                pm_diagnostic_id_t diag_id = parser->version == PM_OPTIONS_VERSION_CRUBY_3_3 ? PM_ERR_INVALID_VARIABLE_GLOBAL_3_3 : PM_ERR_INVALID_VARIABLE_GLOBAL;
+                pm_diagnostic_id_t diag_id = parser->version <= PM_OPTIONS_VERSION_CRUBY_3_3 ? PM_ERR_INVALID_VARIABLE_GLOBAL_3_3 : PM_ERR_INVALID_VARIABLE_GLOBAL;
                 const uint8_t *end = parser->current.end + parser->encoding->char_width(parser->current.end, parser->end - parser->current.end);
                 PM_PARSER_ERR_FORMAT(parser, parser->current.start, end, diag_id, (int) (end - parser->current.start), (const char *) parser->current.start);
             }
@@ -10177,7 +10177,7 @@ lex_at_variable(pm_parser_t *parser) {
         }
     } else if (parser->current.end < end && pm_char_is_decimal_digit(*parser->current.end)) {
         pm_diagnostic_id_t diag_id = (type == PM_TOKEN_CLASS_VARIABLE) ? PM_ERR_INCOMPLETE_VARIABLE_CLASS : PM_ERR_INCOMPLETE_VARIABLE_INSTANCE;
-        if (parser->version == PM_OPTIONS_VERSION_CRUBY_3_3) {
+        if (parser->version <= PM_OPTIONS_VERSION_CRUBY_3_3) {
             diag_id = (type == PM_TOKEN_CLASS_VARIABLE) ? PM_ERR_INCOMPLETE_VARIABLE_CLASS_3_3 : PM_ERR_INCOMPLETE_VARIABLE_INSTANCE_3_3;
         }
 
@@ -14667,7 +14667,7 @@ parse_parameters(
                     parser_lex(parser);
 
                     pm_constant_id_t name_id = pm_parser_constant_id_token(parser, &name);
-                    uint32_t reads = parser->version == PM_OPTIONS_VERSION_CRUBY_3_3 ? pm_locals_reads(&parser->current_scope->locals, name_id) : 0;
+                    uint32_t reads = parser->version <= PM_OPTIONS_VERSION_CRUBY_3_3 ? pm_locals_reads(&parser->current_scope->locals, name_id) : 0;
 
                     if (accepts_blocks_in_defaults) pm_accepts_block_stack_push(parser, true);
                     pm_node_t *value = parse_value_expression(parser, binding_power, false, false, PM_ERR_PARAMETER_NO_DEFAULT, (uint16_t) (depth + 1));
@@ -14683,7 +14683,7 @@ parse_parameters(
                     // If the value of the parameter increased the number of
                     // reads of that parameter, then we need to warn that we
                     // have a circular definition.
-                    if ((parser->version == PM_OPTIONS_VERSION_CRUBY_3_3) && (pm_locals_reads(&parser->current_scope->locals, name_id) != reads)) {
+                    if ((parser->version <= PM_OPTIONS_VERSION_CRUBY_3_3) && (pm_locals_reads(&parser->current_scope->locals, name_id) != reads)) {
                         PM_PARSER_ERR_TOKEN_FORMAT_CONTENT(parser, name, PM_ERR_PARAMETER_CIRCULAR);
                     }
 
@@ -14768,13 +14768,13 @@ parse_parameters(
 
                         if (token_begins_expression_p(parser->current.type)) {
                             pm_constant_id_t name_id = pm_parser_constant_id_token(parser, &local);
-                            uint32_t reads = parser->version == PM_OPTIONS_VERSION_CRUBY_3_3 ? pm_locals_reads(&parser->current_scope->locals, name_id) : 0;
+                            uint32_t reads = parser->version <= PM_OPTIONS_VERSION_CRUBY_3_3 ? pm_locals_reads(&parser->current_scope->locals, name_id) : 0;
 
                             if (accepts_blocks_in_defaults) pm_accepts_block_stack_push(parser, true);
                             pm_node_t *value = parse_value_expression(parser, binding_power, false, false, PM_ERR_PARAMETER_NO_DEFAULT_KW, (uint16_t) (depth + 1));
                             if (accepts_blocks_in_defaults) pm_accepts_block_stack_pop(parser);
 
-                            if (parser->version == PM_OPTIONS_VERSION_CRUBY_3_3 && (pm_locals_reads(&parser->current_scope->locals, name_id) != reads)) {
+                            if (parser->version <= PM_OPTIONS_VERSION_CRUBY_3_3 && (pm_locals_reads(&parser->current_scope->locals, name_id) != reads)) {
                                 PM_PARSER_ERR_TOKEN_FORMAT_CONTENT(parser, local, PM_ERR_PARAMETER_CIRCULAR);
                             }
 
@@ -16478,7 +16478,7 @@ parse_variable(pm_parser_t *parser) {
             pm_node_list_append(&current_scope->implicit_parameters, node);
 
             return node;
-        } else if ((parser->version != PM_OPTIONS_VERSION_CRUBY_3_3) && pm_token_is_it(parser->previous.start, parser->previous.end)) {
+        } else if ((parser->version >= PM_OPTIONS_VERSION_CRUBY_3_4) && pm_token_is_it(parser->previous.start, parser->previous.end)) {
             pm_node_t *node = (pm_node_t *) pm_it_local_variable_read_node_create(parser, &parser->previous);
             pm_node_list_append(&current_scope->implicit_parameters, node);
 
@@ -19524,7 +19524,15 @@ parse_expression_prefix(pm_parser_t *parser, pm_binding_power_t binding_power, b
                 pm_do_loop_stack_push(parser, false);
                 statements = (pm_node_t *) pm_statements_node_create(parser);
 
-                pm_node_t *statement = parse_expression(parser, PM_BINDING_POWER_DEFINED + 1, binding_power < PM_BINDING_POWER_COMPOSITION, false, PM_ERR_DEF_ENDLESS, (uint16_t) (depth + 1));
+                // In endless method bodies, we need to handle command calls carefully.
+                // We want to allow command calls in assignment context but maintain
+                // the same binding power to avoid changing how operators are parsed.
+                // Note that we're intentionally NOT allowing code like `private def foo = puts "Hello"`
+                // because the original parser, parse.y, can't handle it and we want to maintain the same behavior
+                bool allow_command_call = (binding_power == PM_BINDING_POWER_ASSIGNMENT) ||
+                                         (binding_power < PM_BINDING_POWER_COMPOSITION);
+
+                pm_node_t *statement = parse_expression(parser, PM_BINDING_POWER_DEFINED + 1, allow_command_call, false, PM_ERR_DEF_ENDLESS, (uint16_t) (depth + 1));
 
                 if (accept1(parser, PM_TOKEN_KEYWORD_RESCUE_MODIFIER)) {
                     context_push(parser, PM_CONTEXT_RESCUE_MODIFIER);
@@ -22641,6 +22649,12 @@ pm_parser_init(pm_parser_t *parser, const uint8_t *source, size_t size, const pm
         }
     }
 
+    // Now that we have established the user-provided options, check if
+    // a version was given and parse as the latest version otherwise.
+    if (parser->version == PM_OPTIONS_VERSION_UNSET) {
+        parser->version = PM_OPTIONS_VERSION_LATEST;
+    }
+
     pm_accepts_block_stack_push(parser, true);
 
     // Skip past the UTF-8 BOM if it exists.
diff --git a/ruby.c b/ruby.c
index 0d09e7ce61e1ab..cc67b0b25db8f8 100644
--- a/ruby.c
+++ b/ruby.c
@@ -1833,12 +1833,6 @@ ruby_opt_init(ruby_cmdline_options_t *opt)
     }
 #endif
 
-#if USE_YJIT
-    // Call yjit_hook.rb after rb_yjit_init() to use `RubyVM::YJIT.enabled?`
-    void Init_builtin_yjit_hook();
-    Init_builtin_yjit_hook();
-#endif
-
     rb_namespace_init_done();
     ruby_init_prelude();
     ruby_set_script_name(opt->script_name);
diff --git a/set.c b/set.c
index 55d0e626338af5..61f1fd8bc43d1b 100644
--- a/set.c
+++ b/set.c
@@ -505,6 +505,14 @@ set_i_initialize(int argc, VALUE *argv, VALUE set)
             }
         }
         else {
+            ID id_size = rb_intern("size");
+            if (rb_obj_is_kind_of(other, rb_mEnumerable) && rb_respond_to(other, id_size)) {
+                VALUE size = rb_funcall(other, id_size, 0);
+                if (RB_TYPE_P(size, T_FLOAT) && RFLOAT_VALUE(size) == INFINITY) {
+                    rb_raise(rb_eArgError, "cannot initialize Set from an object with infinite size");
+                }
+            }
+
             rb_block_call(other, enum_method_id(other), 0, 0,
                 rb_block_given_p() ? set_initialize_with_block : set_initialize_without_block,
                 set);
diff --git a/spec/bundler/commands/lock_spec.rb b/spec/bundler/commands/lock_spec.rb
index c47cc9727191ea..19c1a5ca8bf0ab 100644
--- a/spec/bundler/commands/lock_spec.rb
+++ b/spec/bundler/commands/lock_spec.rb
@@ -2237,7 +2237,6 @@
               nokogiri (1.14.2-x86_64-linux)
 
           PLATFORMS
-            ruby
             x86_64-linux
 
           DEPENDENCIES
diff --git a/spec/bundler/install/gemfile/specific_platform_spec.rb b/spec/bundler/install/gemfile/specific_platform_spec.rb
index 228ae7b0d06cc1..71065c36f33507 100644
--- a/spec/bundler/install/gemfile/specific_platform_spec.rb
+++ b/spec/bundler/install/gemfile/specific_platform_spec.rb
@@ -392,7 +392,23 @@
     end
   end
 
-  it "installs sorbet-static, which does not provide a pure ruby variant, just fine", :truffleruby do
+  it "installs sorbet-static, which does not provide a pure ruby variant, in absence of a lockfile, just fine", :truffleruby do
+    skip "does not apply to Windows" if Gem.win_platform?
+
+    build_repo2 do
+      build_gem("sorbet-static", "0.5.6403") {|s| s.platform = Bundler.local_platform }
+    end
+
+    gemfile <<~G
+      source "https://gem.repo2"
+
+      gem "sorbet-static", "0.5.6403"
+    G
+
+    bundle "install --verbose"
+  end
+
+  it "installs sorbet-static, which does not provide a pure ruby variant, in presence of a lockfile, just fine", :truffleruby do
     skip "does not apply to Windows" if Gem.win_platform?
 
     build_repo2 do
diff --git a/spec/bundler/realworld/fixtures/tapioca/Gemfile.lock b/spec/bundler/realworld/fixtures/tapioca/Gemfile.lock
index c9ded0fd787030..ccb51b6fd31eb3 100644
--- a/spec/bundler/realworld/fixtures/tapioca/Gemfile.lock
+++ b/spec/bundler/realworld/fixtures/tapioca/Gemfile.lock
@@ -31,7 +31,7 @@ GEM
       spoom (>= 1.2.0)
       thor (>= 1.2.0)
       yard-sorbet
-    thor (1.3.2)
+    thor (1.4.0)
     yard (0.9.37)
     yard-sorbet (0.9.0)
       sorbet-runtime
@@ -46,4 +46,4 @@ DEPENDENCIES
   tapioca
 
 BUNDLED WITH
-   2.7.0.dev
+   2.8.0.dev
diff --git a/spec/bundler/realworld/fixtures/warbler/Gemfile.lock b/spec/bundler/realworld/fixtures/warbler/Gemfile.lock
index f6d50aad359018..15f9a224e55bbb 100644
--- a/spec/bundler/realworld/fixtures/warbler/Gemfile.lock
+++ b/spec/bundler/realworld/fixtures/warbler/Gemfile.lock
@@ -36,4 +36,4 @@ DEPENDENCIES
   warbler!
 
 BUNDLED WITH
-   2.7.0.dev
+   2.8.0.dev
diff --git a/spec/ruby/command_line/dash_v_spec.rb b/spec/ruby/command_line/dash_v_spec.rb
index d30efa37d68c23..b13350404c659c 100644
--- a/spec/ruby/command_line/dash_v_spec.rb
+++ b/spec/ruby/command_line/dash_v_spec.rb
@@ -6,7 +6,7 @@
 
   describe "when used alone" do
     it "prints version and ends" do
-      ruby_exe(nil, args: '-v').sub("+PRISM ", "").should include(RUBY_DESCRIPTION.sub("+PRISM ", ""))
+      ruby_exe(nil, args: '-v').gsub("+PRISM ", "").should include(RUBY_DESCRIPTION.gsub("+PRISM ", ""))
     end unless (defined?(RubyVM::YJIT) && RubyVM::YJIT.enabled?) ||
                (defined?(RubyVM::RJIT) && RubyVM::RJIT.enabled?) ||
                (ENV['RUBY_GC_LIBRARY'] && ENV['RUBY_GC_LIBRARY'].length > 0) ||
diff --git a/spec/ruby/command_line/rubyopt_spec.rb b/spec/ruby/command_line/rubyopt_spec.rb
index e940f912af8f7b..e1163ffcfcc9d7 100644
--- a/spec/ruby/command_line/rubyopt_spec.rb
+++ b/spec/ruby/command_line/rubyopt_spec.rb
@@ -25,12 +25,12 @@
   guard -> { RbConfig::CONFIG["CROSS_COMPILING"] != "yes" } do
     it "prints the version number for '-v'" do
       ENV["RUBYOPT"] = '-v'
-      ruby_exe("").sub("+PRISM ", "").sub(/\+GC(\[\w+\]\s|\s)?/, "")[/\A.*/].should == RUBY_DESCRIPTION.sub("+PRISM ", "").sub(/\+GC(\[\w+\]\s|\s)?/, "")
+      ruby_exe("")[/\A.*/].gsub(/\s\+(PRISM|GC(\[\w+\])?)(?=\s)/, "").should == RUBY_DESCRIPTION.gsub(/\s\+(PRISM|GC(\[\w+\])?)(?=\s)/, "")
     end
 
     it "ignores whitespace around the option" do
       ENV["RUBYOPT"] = ' -v '
-      ruby_exe("").sub("+PRISM ", "").sub(/\+GC(\[\w+\]\s|\s)?/, "")[/\A.*/].should == RUBY_DESCRIPTION.sub("+PRISM ", "").sub(/\+GC(\[\w+\]\s|\s)?/, "")
+      ruby_exe("")[/\A.*/].gsub(/\s\+(PRISM|GC(\[\w+\])?)(?=\s)/, "").should == RUBY_DESCRIPTION.gsub(/\s\+(PRISM|GC(\[\w+\])?)(?=\s)/, "")
     end
   end
 
diff --git a/test/prism/errors/private_endless_method.txt b/test/prism/errors/private_endless_method.txt
new file mode 100644
index 00000000000000..8aae5e0cd39035
--- /dev/null
+++ b/test/prism/errors/private_endless_method.txt
@@ -0,0 +1,3 @@
+private def foo = puts "Hello"
+                       ^ unexpected string literal, expecting end-of-input
+
diff --git a/test/prism/fixtures/endless_methods.txt b/test/prism/fixtures/endless_methods.txt
index 8c2f2a30cc58c0..7eb3bf431897b1 100644
--- a/test/prism/fixtures/endless_methods.txt
+++ b/test/prism/fixtures/endless_methods.txt
@@ -3,3 +3,5 @@ def foo = 1
 def bar = A ""
 
 def method = 1 + 2 + 3
+
+x = def f = p 1
diff --git a/test/ruby/test_bignum.rb b/test/ruby/test_bignum.rb
index beef33e2a60ff4..dd6f4baa4c292b 100644
--- a/test/ruby/test_bignum.rb
+++ b/test/ruby/test_bignum.rb
@@ -605,6 +605,49 @@ def test_aref
     assert_equal(1, (-2**(BIGNUM_MIN_BITS*4))[BIGNUM_MIN_BITS*4])
   end
 
+  def test_aref2
+    x = (0x123456789abcdef << (BIGNUM_MIN_BITS + 32)) | 0x12345678
+    assert_equal(x, x[0, x.bit_length])
+    assert_equal(x >> 10, x[10, x.bit_length])
+    assert_equal(0x45678, x[0, 20])
+    assert_equal(0x6780, x[-4, 16])
+    assert_equal(0x123456, x[x.bit_length - 21, 40])
+    assert_equal(0x6789ab, x[x.bit_length - 41, 24])
+    assert_equal(0, x[-20, 10])
+    assert_equal(0, x[x.bit_length + 10, 10])
+
+    assert_equal(0, x[5, 0])
+    assert_equal(0, (-x)[5, 0])
+
+    assert_equal(x >> 5, x[5, -1])
+    assert_equal(x << 5, x[-5, -1])
+    assert_equal((-x) >> 5, (-x)[5, -1])
+    assert_equal((-x) << 5, (-x)[-5, -1])
+
+    assert_equal(x << 5, x[-5, FIXNUM_MAX])
+    assert_equal(x >> 5, x[5, FIXNUM_MAX])
+    assert_equal(0, x[FIXNUM_MIN, 100])
+    assert_equal(0, (-x)[FIXNUM_MIN, 100])
+
+    y = (x << 160) | 0x1234_0000_0000_0000_1234_0000_0000_0000
+    assert_equal(0xffffedcc00, (-y)[40, 40])
+    assert_equal(0xfffffffedc, (-y)[52, 40])
+    assert_equal(0xffffedcbff, (-y)[104, 40])
+    assert_equal(0xfffff6e5d4, (-y)[y.bit_length - 20, 40])
+    assert_equal(0, (-y)[-20, 10])
+    assert_equal(0xfff, (-y)[y.bit_length + 10, 12])
+
+    z = (1 << (BIGNUM_MIN_BITS * 2)) - 1
+    assert_equal(0x400, (-z)[-10, 20])
+    assert_equal(1, (-z)[0, 20])
+    assert_equal(0, (-z)[10, 20])
+    assert_equal(1, (-z)[0, z.bit_length])
+    assert_equal(0, (-z)[z.bit_length - 10, 10])
+    assert_equal(0x400, (-z)[z.bit_length - 10, 11])
+    assert_equal(0xfff, (-z)[z.bit_length, 12])
+    assert_equal(0xfff00, (-z)[z.bit_length - 8, 20])
+  end
+
   def test_hash
     assert_nothing_raised { T31P.hash }
   end
diff --git a/test/ruby/test_set.rb b/test/ruby/test_set.rb
index 87e1fd8d26e908..934a470c1e626f 100644
--- a/test/ruby/test_set.rb
+++ b/test/ruby/test_set.rb
@@ -81,6 +81,20 @@ def test_s_new
 
     s = Set.new(ary) { |o| o * 2 }
     assert_equal([2,4,6], s.sort)
+
+    assert_raise(ArgumentError) {
+      Set.new((1..))
+    }
+    assert_raise(ArgumentError) {
+      Set.new((1..), &:succ)
+    }
+    assert_raise(ArgumentError) {
+      Set.new(1.upto(Float::INFINITY))
+    }
+
+    assert_raise(ArgumentError) {
+      Set.new(Object.new)
+    }
   end
 
   def test_clone
diff --git a/test/ruby/test_zjit.rb b/test/ruby/test_zjit.rb
index 0dcdb8e4cb8275..b78d53e682233c 100644
--- a/test/ruby/test_zjit.rb
+++ b/test/ruby/test_zjit.rb
@@ -819,6 +819,13 @@ def a(n1,n2,n3,n4,n5,n6,n7,n8) = self
     }
   end
 
+  def test_spilled_param_new_arary
+    assert_compiles '[:ok]', %q{
+      def a(n1,n2,n3,n4,n5,n6,n7,n8) = [n8]
+      a(0,0,0,0,0,0,0, :ok)
+    }
+  end
+
   def test_opt_aref_with
     assert_compiles ':ok', %q{
       def aref_with(hash) = hash["key"]
@@ -882,6 +889,48 @@ def test = X
     end
   end
 
+  def test_constant_invalidation
+    assert_compiles '123', <<~RUBY, call_threshold: 2, insns: [:opt_getconstant_path]
+      class C; end
+      def test = C
+      test
+      test
+
+      C = 123
+      test
+    RUBY
+  end
+
+  def test_constant_path_invalidation
+    assert_compiles '["Foo::C", "Foo::C", "Bar::C"]', <<~RUBY, call_threshold: 2, insns: [:opt_getconstant_path]
+      module A
+        module B; end
+      end
+
+      module Foo
+        C = "Foo::C"
+      end
+
+      module Bar
+        C = "Bar::C"
+      end
+
+      A::B = Foo
+
+      def test = A::B::C
+
+      result = []
+
+      result << test
+      result << test
+
+      A::B = Bar
+
+      result << test
+      result
+    RUBY
+  end
+
   def test_dupn
     assert_compiles '[[1], [1, 1], :rhs, [nil, :rhs]]', <<~RUBY, insns: [:dupn]
       def test(array) = (array[1, 2] ||= :rhs)
diff --git a/tool/bundler/vendor_gems.rb b/tool/bundler/vendor_gems.rb
index 71a7fbf4b0f7cc..b3e06d3f096047 100644
--- a/tool/bundler/vendor_gems.rb
+++ b/tool/bundler/vendor_gems.rb
@@ -12,6 +12,6 @@
 gem "resolv", "0.6.2"
 gem "securerandom", "0.4.1"
 gem "timeout", "0.4.3"
-gem "thor", "1.3.2"
+gem "thor", "1.4.0"
 gem "tsort", "0.2.0"
 gem "uri", "1.0.3"
diff --git a/tool/bundler/vendor_gems.rb.lock b/tool/bundler/vendor_gems.rb.lock
index 82dbe8963c46bf..825107514a6f1a 100644
--- a/tool/bundler/vendor_gems.rb.lock
+++ b/tool/bundler/vendor_gems.rb.lock
@@ -37,7 +37,7 @@ GEM
     optparse (0.6.0)
     resolv (0.6.2)
     securerandom (0.4.1)
-    thor (1.3.2)
+    thor (1.4.0)
     timeout (0.4.3)
     tsort (0.2.0)
     uri (1.0.3)
@@ -60,7 +60,7 @@ DEPENDENCIES
   pub_grub!
   resolv (= 0.6.2)
   securerandom (= 0.4.1)
-  thor (= 1.3.2)
+  thor (= 1.4.0)
   timeout (= 0.4.3)
   tsort (= 0.2.0)
   uri (= 1.0.3)
@@ -76,7 +76,7 @@ CHECKSUMS
   pub_grub (0.5.0)
   resolv (0.6.2) sha256=61efe545cedddeb1b14f77e51f85c85ca66af5098fdbf567fadf32c34590fb14
   securerandom (0.4.1) sha256=cc5193d414a4341b6e225f0cb4446aceca8e50d5e1888743fac16987638ea0b1
-  thor (1.3.2) sha256=eef0293b9e24158ccad7ab383ae83534b7ad4ed99c09f96f1a6b036550abbeda
+  thor (1.4.0) sha256=8763e822ccb0f1d7bee88cde131b19a65606657b847cc7b7b4b82e772bcd8a3d
   timeout (0.4.3) sha256=9509f079b2b55fe4236d79633bd75e34c1c1e7e3fb4b56cb5fda61f80a0fe30e
   tsort (0.2.0) sha256=9650a793f6859a43b6641671278f79cfead60ac714148aabe4e3f0060480089f
   uri (1.0.3) sha256=e9f2244608eea2f7bc357d954c65c910ce0399ca5e18a7a29207ac22d8767011
diff --git a/tool/lib/envutil.rb b/tool/lib/envutil.rb
index d02329d4f13053..fe166d85145ea7 100644
--- a/tool/lib/envutil.rb
+++ b/tool/lib/envutil.rb
@@ -226,7 +226,6 @@ def invoke_ruby(args, stdin_data = "", capture_stdout = false, capture_stderr =
     args = [args] if args.kind_of?(String)
     # use the same parser as current ruby
     if args.none? { |arg| arg.start_with?("--parser=") }
-      current_parser = RUBY_DESCRIPTION =~ /prism/i ? "prism" : "parse.y"
       args = ["--parser=#{current_parser}"] + args
     end
     pid = spawn(child_env, *precommand, rubybin, *args, opt)
@@ -276,6 +275,12 @@ def invoke_ruby(args, stdin_data = "", capture_stdout = false, capture_stderr =
   end
   module_function :invoke_ruby
 
+  def current_parser
+    features = RUBY_DESCRIPTION[%r{\)\K [-+*/%._0-9a-zA-Z ]*(?=\[[-+*/%._0-9a-zA-Z]+\]\z)}]
+    features&.split&.include?("+PRISM") ? "prism" : "parse.y"
+  end
+  module_function :current_parser
+
   def verbose_warning
     class << (stderr = "".dup)
       alias write concat
diff --git a/tool/zjit_bisect.rb b/tool/zjit_bisect.rb
new file mode 100755
index 00000000000000..472a60e66c5df9
--- /dev/null
+++ b/tool/zjit_bisect.rb
@@ -0,0 +1,97 @@
+#!/usr/bin/env ruby
+require 'logger'
+require 'open3'
+require 'tempfile'
+require 'timeout'
+
+RUBY = ARGV[0] || raise("Usage: ruby jit_bisect.rb <path_to_ruby> <options>")
+OPTIONS = ARGV[1] || raise("Usage: ruby jit_bisect.rb <path_to_ruby> <options>")
+TIMEOUT_SEC = 5
+LOGGER = Logger.new($stdout)
+
+# From https://github.com/tekknolagi/omegastar
+# MIT License
+# Copyright (c) 2024 Maxwell Bernstein and Meta Platforms
+# Attempt to reduce the `items` argument as much as possible, returning the
+# shorter version. `fixed` will always be used as part of the items when
+# running `command`.
+# `command` should return True if the command succeeded (the failure did not
+# reproduce) and False if the command failed (the failure reproduced).
+def bisect_impl(command, fixed, items, indent="")
+  LOGGER.info("#{indent}step fixed[#{fixed.length}] and items[#{items.length}]")
+  while items.length > 1
+    LOGGER.info("#{indent}#{fixed.length + items.length} candidates")
+    # Return two halves of the given list. For odd-length lists, the second
+    # half will be larger.
+    half = items.length / 2
+    left = items[0...half]
+    right = items[half..]
+    if !command.call(fixed + left)
+      items = left
+      next
+    end
+    if !command.call(fixed + right)
+      items = right
+      next
+    end
+    # We need something from both halves to trigger the failure. Try
+    # holding each half fixed and bisecting the other half to reduce the
+    # candidates.
+    new_right = bisect_impl(command, fixed + left, right, indent + "< ")
+    new_left = bisect_impl(command, fixed + new_right, left, indent + "> ")
+    return new_left + new_right
+  end
+  items
+end
+
+# From https://github.com/tekknolagi/omegastar
+# MIT License
+# Copyright (c) 2024 Maxwell Bernstein and Meta Platforms
+def run_bisect(command, items)
+  LOGGER.info("Verifying items")
+  if command.call(items)
+    raise StandardError.new("Command succeeded with full items")
+  end
+  if !command.call([])
+    raise StandardError.new("Command failed with empty items")
+  end
+  bisect_impl(command, [], items)
+end
+
+def run_with_jit_list(ruby, options, jit_list)
+  # Make a new temporary file containing the JIT list
+  Tempfile.create("jit_list") do |temp_file|
+    temp_file.write(jit_list.join("\n"))
+    temp_file.flush
+    temp_file.close
+    # Run the JIT with the temporary file
+    Open3.capture3("#{ruby} --zjit-allowed-iseqs=#{temp_file.path} #{options}")
+  end
+end
+
+# Try running with no JIT list to get a stable baseline
+_, stderr, status = run_with_jit_list(RUBY, OPTIONS, [])
+if !status.success?
+  raise "Command failed with empty JIT list: #{stderr}"
+end
+# Collect the JIT list from the failing Ruby process
+jit_list = nil
+Tempfile.create "jit_list" do |temp_file|
+  Open3.capture3("#{RUBY} --zjit-log-compiled-iseqs=#{temp_file.path} #{OPTIONS}")
+  jit_list = File.readlines(temp_file.path).map(&:strip).reject(&:empty?)
+end
+LOGGER.info("Starting with JIT list of #{jit_list.length} items.")
+# Now narrow it down
+command = lambda do |items|
+  status = Timeout.timeout(TIMEOUT_SEC) do
+    _, _, status = run_with_jit_list(RUBY, OPTIONS, items)
+    status
+  end
+  status.success?
+end
+result = run_bisect(command, jit_list)
+File.open("jitlist.txt", "w") do |file|
+  file.puts(result)
+end
+puts "Reduced JIT list (available in jitlist.txt):"
+puts result
diff --git a/vm.c b/vm.c
index bfc9ff733c5cdb..da5a51d25b73ba 100644
--- a/vm.c
+++ b/vm.c
@@ -35,6 +35,8 @@
 #include "iseq.h"
 #include "symbol.h" // This includes a macro for a more performant rb_id2sym.
 #include "yjit.h"
+#include "insns.inc"
+#include "zjit.h"
 #include "ruby/st.h"
 #include "ruby/vm.h"
 #include "vm_core.h"
@@ -45,8 +47,6 @@
 #include "ractor_core.h"
 #include "vm_sync.h"
 #include "shape.h"
-#include "insns.inc"
-#include "zjit.h"
 
 #include "builtin.h"
 
diff --git a/vm_exec.c b/vm_exec.c
index 947d4dc42169a9..3d7c241a321bfa 100644
--- a/vm_exec.c
+++ b/vm_exec.c
@@ -11,8 +11,8 @@
 
 #include <math.h>
 
-#if USE_YJIT
-// The number of instructions executed on vm_exec_core. --yjit-stats uses this.
+#if USE_YJIT || USE_ZJIT
+// The number of instructions executed on vm_exec_core. --yjit-stats and --zjit-stats use this.
 uint64_t rb_vm_insns_count = 0;
 #endif
 
diff --git a/vm_insnhelper.h b/vm_insnhelper.h
index ba957406978e11..24bfbb8210b7d0 100644
--- a/vm_insnhelper.h
+++ b/vm_insnhelper.h
@@ -16,7 +16,7 @@ RUBY_EXTERN rb_serial_t ruby_vm_constant_cache_invalidations;
 RUBY_EXTERN rb_serial_t ruby_vm_constant_cache_misses;
 RUBY_EXTERN rb_serial_t ruby_vm_global_cvar_state;
 
-#if USE_YJIT && YJIT_STATS // We want vm_insns_count only on stats builds.
+#if YJIT_STATS || ZJIT_STATS // We want vm_insns_count only on stats builds.
 // Increment vm_insns_count for --yjit-stats. We increment this even when
 // --yjit or --yjit-stats is not used because branching to skip it is slower.
 // We also don't use ATOMIC_INC for performance, allowing inaccuracy on Ractors.
diff --git a/vm_method.c b/vm_method.c
index 84d0ed2f9e4c07..fa81d56c74119d 100644
--- a/vm_method.c
+++ b/vm_method.c
@@ -148,6 +148,7 @@ rb_clear_constant_cache_for_id(ID id)
     }
 
     rb_yjit_constant_state_changed(id);
+    rb_zjit_constant_state_changed(id);
 }
 
 static void
diff --git a/yjit.c b/yjit.c
index b3364ff6065515..46f89e2020c3f1 100644
--- a/yjit.c
+++ b/yjit.c
@@ -23,13 +23,13 @@
 #include "insns_info.inc"
 #include "vm_sync.h"
 #include "yjit.h"
+#include "zjit.h"
 #include "vm_insnhelper.h"
 #include "probes.h"
 #include "probes_helper.h"
 #include "iseq.h"
 #include "ruby/debug.h"
 #include "internal/cont.h"
-#include "zjit.h"
 
 // For mmapp(), sysconf()
 #ifndef _WIN32
diff --git a/yjit.h b/yjit.h
index cb96ee78382c63..645f0af49d8fd3 100644
--- a/yjit.h
+++ b/yjit.h
@@ -9,10 +9,9 @@
 #include "vm_core.h"
 #include "method.h"
 
-// YJIT_STATS controls whether to support runtime counters in generated code
-// and in the interpreter.
+// YJIT_STATS controls whether to support runtime counters in the interpreter
 #ifndef YJIT_STATS
-# define YJIT_STATS RUBY_DEBUG
+# define YJIT_STATS (USE_YJIT && RUBY_DEBUG)
 #endif
 
 #if USE_YJIT
diff --git a/yjit.rb b/yjit.rb
index e8ba3cdd28752a..e4fafa729eea75 100644
--- a/yjit.rb
+++ b/yjit.rb
@@ -64,7 +64,6 @@ def self.enable(stats: false, log: false, mem_size: nil, call_threshold: nil)
     end
 
     at_exit { print_and_dump_stats } if stats
-    call_yjit_hooks
     Primitive.rb_yjit_enable(stats, stats != :quiet, log, log != :quiet, mem_size, call_threshold)
   end
 
diff --git a/yjit/bindgen/src/main.rs b/yjit/bindgen/src/main.rs
index 7c8ce7bce5c69d..61b6f233269269 100644
--- a/yjit/bindgen/src/main.rs
+++ b/yjit/bindgen/src/main.rs
@@ -105,6 +105,9 @@ fn main() {
         .allowlist_var("SHAPE_ID_NUM_BITS")
         .allowlist_var("SHAPE_ID_HAS_IVAR_MASK")
 
+        // From ruby/internal/eval.h
+        .allowlist_function("rb_funcall")
+
         // From ruby/internal/intern/object.h
         .allowlist_function("rb_obj_is_kind_of")
         .allowlist_function("rb_obj_frozen_p")
@@ -269,6 +272,7 @@ fn main() {
         .allowlist_function("rb_float_new")
 
         // From vm_core.h
+        .allowlist_var("rb_cRubyVM")
         .allowlist_var("rb_mRubyVMFrozenCore")
         .allowlist_var("VM_BLOCK_HANDLER_NONE")
         .allowlist_type("vm_frame_env_flags")
@@ -383,6 +387,7 @@ fn main() {
         .allowlist_function("rb_ivar_defined")
         .allowlist_function("rb_ivar_get")
         .allowlist_function("rb_mod_name")
+        .allowlist_function("rb_const_get")
 
         // From internal/vm.h
         .allowlist_var("rb_vm_insns_count")
diff --git a/yjit/src/cruby.rs b/yjit/src/cruby.rs
index 725a29fa70cf23..f7a08b3b18b537 100644
--- a/yjit/src/cruby.rs
+++ b/yjit/src/cruby.rs
@@ -601,9 +601,15 @@ pub fn rust_str_to_ruby(str: &str) -> VALUE {
 
 /// Produce a Ruby symbol from a Rust string slice
 pub fn rust_str_to_sym(str: &str) -> VALUE {
+    let id = rust_str_to_id(str);
+    unsafe { rb_id2sym(id) }
+}
+
+/// Produce an ID from a Rust string slice
+pub fn rust_str_to_id(str: &str) -> ID {
     let c_str = CString::new(str).unwrap();
     let c_ptr: *const c_char = c_str.as_ptr();
-    unsafe { rb_id2sym(rb_intern(c_ptr)) }
+    unsafe { rb_intern(c_ptr) }
 }
 
 /// Produce an owned Rust String from a C char pointer
diff --git a/yjit/src/cruby_bindings.inc.rs b/yjit/src/cruby_bindings.inc.rs
index 666f5c4f28d614..eeabbf594df9bb 100644
--- a/yjit/src/cruby_bindings.inc.rs
+++ b/yjit/src/cruby_bindings.inc.rs
@@ -405,7 +405,6 @@ pub const imemo_memo: imemo_type = 5;
 pub const imemo_ment: imemo_type = 6;
 pub const imemo_iseq: imemo_type = 7;
 pub const imemo_tmpbuf: imemo_type = 8;
-pub const imemo_ast: imemo_type = 9;
 pub const imemo_callinfo: imemo_type = 10;
 pub const imemo_callcache: imemo_type = 11;
 pub const imemo_constcache: imemo_type = 12;
@@ -1019,6 +1018,7 @@ extern "C" {
     pub fn rb_gc_location(obj: VALUE) -> VALUE;
     pub fn rb_gc_writebarrier(old: VALUE, young: VALUE);
     pub fn rb_class_get_superclass(klass: VALUE) -> VALUE;
+    pub fn rb_funcall(recv: VALUE, mid: ID, n: ::std::os::raw::c_int, ...) -> VALUE;
     pub static mut rb_mKernel: VALUE;
     pub static mut rb_cBasicObject: VALUE;
     pub static mut rb_cArray: VALUE;
@@ -1080,6 +1080,7 @@ extern "C" {
     pub fn rb_ivar_get(obj: VALUE, name: ID) -> VALUE;
     pub fn rb_ivar_defined(obj: VALUE, name: ID) -> VALUE;
     pub fn rb_attr_get(obj: VALUE, name: ID) -> VALUE;
+    pub fn rb_const_get(space: VALUE, name: ID) -> VALUE;
     pub fn rb_obj_info_dump(obj: VALUE);
     pub fn rb_class_allocate_instance(klass: VALUE) -> VALUE;
     pub fn rb_obj_equal(obj1: VALUE, obj2: VALUE) -> VALUE;
@@ -1102,6 +1103,7 @@ extern "C" {
         klass: VALUE,
         id: ID,
     ) -> *const rb_callable_method_entry_t;
+    pub static mut rb_cRubyVM: VALUE;
     pub static mut rb_mRubyVMFrozenCore: VALUE;
     pub static mut rb_block_param_proxy: VALUE;
     pub fn rb_vm_ep_local_ep(ep: *const VALUE) -> *const VALUE;
diff --git a/yjit/src/yjit.rs b/yjit/src/yjit.rs
index 4b2b5214f4da13..8df1163d64b725 100644
--- a/yjit/src/yjit.rs
+++ b/yjit/src/yjit.rs
@@ -54,6 +54,12 @@ fn yjit_init() {
     // TODO: need to make sure that command-line options have been
     // initialized by CRuby
 
+    // Call YJIT hooks before enabling YJIT to avoid compiling the hooks themselves
+    unsafe {
+        let yjit = rb_const_get(rb_cRubyVM, rust_str_to_id("YJIT"));
+        rb_funcall(yjit, rust_str_to_id("call_yjit_hooks"), 0);
+    }
+
     // Catch panics to avoid UB for unwinding into C frames.
     // See https://doc.rust-lang.org/nomicon/exception-safety.html
     let result = std::panic::catch_unwind(|| {
diff --git a/yjit_hook.rb b/yjit_hook.rb
index 8f0f38aaf1f535..610a7be3303e2c 100644
--- a/yjit_hook.rb
+++ b/yjit_hook.rb
@@ -1,8 +1,3 @@
-# If YJIT is enabled, load the YJIT-only version of builtin methods
-if defined?(RubyVM::YJIT) && RubyVM::YJIT.enabled?
-  RubyVM::YJIT.send(:call_yjit_hooks)
-end
-
 # Remove the helper defined in kernel.rb
 class Module
   undef :with_yjit
diff --git a/zjit.c b/zjit.c
index 61c17d32c30751..abe74225404c98 100644
--- a/zjit.c
+++ b/zjit.c
@@ -15,6 +15,7 @@
 #include "builtin.h"
 #include "insns.inc"
 #include "insns_info.inc"
+#include "zjit.h"
 #include "vm_sync.h"
 #include "vm_insnhelper.h"
 #include "probes.h"
@@ -22,7 +23,6 @@
 #include "iseq.h"
 #include "ruby/debug.h"
 #include "internal/cont.h"
-#include "zjit.h"
 
 // For mmapp(), sysconf()
 #ifndef _WIN32
@@ -331,9 +331,6 @@ rb_iseq_set_zjit_payload(const rb_iseq_t *iseq, void *payload)
     iseq->body->zjit_payload = payload;
 }
 
-// Primitives used by zjit.rb
-VALUE rb_zjit_assert_compiles(rb_execution_context_t *ec, VALUE self);
-
 void
 rb_zjit_print_exception(void)
 {
@@ -349,5 +346,10 @@ rb_zjit_shape_obj_too_complex_p(VALUE obj)
     return rb_shape_obj_too_complex_p(obj);
 }
 
+// Primitives used by zjit.rb. Don't put other functions below, which wouldn't use them.
+VALUE rb_zjit_assert_compiles(rb_execution_context_t *ec, VALUE self);
+VALUE rb_zjit_stats(rb_execution_context_t *ec, VALUE self);
+VALUE rb_zjit_stats_enabled_p(rb_execution_context_t *ec, VALUE self);
+
 // Preprocessed zjit.rb generated during build
 #include "zjit.rbinc"
diff --git a/zjit.h b/zjit.h
index 724ae4abd05b15..5ce2826d067a2b 100644
--- a/zjit.h
+++ b/zjit.h
@@ -4,6 +4,11 @@
 // This file contains definitions ZJIT exposes to the CRuby codebase
 //
 
+// ZJIT_STATS controls whether to support runtime counters in the interpreter
+#ifndef ZJIT_STATS
+# define ZJIT_STATS (USE_ZJIT && RUBY_DEBUG)
+#endif
+
 #if USE_ZJIT
 extern bool rb_zjit_enabled_p;
 extern uint64_t rb_zjit_call_threshold;
@@ -14,6 +19,7 @@ void rb_zjit_profile_enable(const rb_iseq_t *iseq);
 void rb_zjit_bop_redefined(int redefined_flag, enum ruby_basic_operators bop);
 void rb_zjit_cme_invalidate(const rb_callable_method_entry_t *cme);
 void rb_zjit_invalidate_ep_is_bp(const rb_iseq_t *iseq);
+void rb_zjit_constant_state_changed(ID id);
 void rb_zjit_iseq_mark(void *payload);
 void rb_zjit_iseq_update_references(void *payload);
 #else
@@ -24,6 +30,7 @@ static inline void rb_zjit_profile_enable(const rb_iseq_t *iseq) {}
 static inline void rb_zjit_bop_redefined(int redefined_flag, enum ruby_basic_operators bop) {}
 static inline void rb_zjit_cme_invalidate(const rb_callable_method_entry_t *cme) {}
 static inline void rb_zjit_invalidate_ep_is_bp(const rb_iseq_t *iseq) {}
+static inline void rb_zjit_constant_state_changed(ID id) {}
 #endif // #if USE_YJIT
 
 #endif // #ifndef ZJIT_H
diff --git a/zjit.rb b/zjit.rb
index fd58c1c94a097a..2bc779ef2895ec 100644
--- a/zjit.rb
+++ b/zjit.rb
@@ -1,6 +1,61 @@
+# frozen_string_literal: true
+
+# This module allows for introspection of \ZJIT, CRuby's just-in-time compiler.
+# Everything in the module is highly implementation specific and the API might
+# be less stable compared to the standard library.
+#
+# This module may not exist if \ZJIT does not support the particular platform
+# for which CRuby is built.
 module RubyVM::ZJIT
+  # Avoid calling a Ruby method here to avoid interfering with compilation tests
+  if Primitive.rb_zjit_stats_enabled_p
+    at_exit { print_stats }
+  end
+end
+
+class << RubyVM::ZJIT
+  # Return ZJIT statistics as a Hash
+  def stats
+    stats = Primitive.rb_zjit_stats
+
+    if stats.key?(:vm_insns_count) && stats.key?(:zjit_insns_count)
+      stats[:total_insns_count] = stats[:vm_insns_count] + stats[:zjit_insns_count]
+      stats[:ratio_in_zjit] = 100.0 * stats[:zjit_insns_count] / stats[:total_insns_count]
+    end
+
+    stats
+  end
+
+  # Get the summary of ZJIT statistics as a String
+  def stats_string
+    buf = +''
+    stats = self.stats
+
+    [
+      :total_insns_count,
+      :vm_insns_count,
+      :zjit_insns_count,
+      :ratio_in_zjit,
+    ].each do |key|
+      value = stats[key]
+      if key == :ratio_in_zjit
+        value = '%0.1f%%' % value
+      end
+      buf << "#{'%-18s' % "#{key}:"} #{value}\n"
+    end
+    buf
+  end
+
   # Assert that any future ZJIT compilation will return a function pointer
-  def self.assert_compiles
+  def assert_compiles # :nodoc:
     Primitive.rb_zjit_assert_compiles
   end
+
+  # :stopdoc:
+  private
+
+  # Print ZJIT stats
+  def print_stats
+    $stderr.write stats_string
+  end
 end
diff --git a/zjit/bindgen/src/main.rs b/zjit/bindgen/src/main.rs
index cb15c3657e37e1..f67d8e91d31a62 100644
--- a/zjit/bindgen/src/main.rs
+++ b/zjit/bindgen/src/main.rs
@@ -392,6 +392,9 @@ fn main() {
         .allowlist_function("rb_ivar_set")
         .allowlist_function("rb_mod_name")
 
+        // From internal/vm.h
+        .allowlist_var("rb_vm_insns_count")
+
         // From include/ruby/internal/intern/vm.h
         .allowlist_function("rb_get_alloc_func")
 
diff --git a/zjit/src/asm/arm64/opnd.rs b/zjit/src/asm/arm64/opnd.rs
index 28422b747652d8..a77958f7e6eeec 100644
--- a/zjit/src/asm/arm64/opnd.rs
+++ b/zjit/src/asm/arm64/opnd.rs
@@ -119,6 +119,9 @@ pub const X20_REG: A64Reg = A64Reg { num_bits: 64, reg_no: 20 };
 pub const X21_REG: A64Reg = A64Reg { num_bits: 64, reg_no: 21 };
 pub const X22_REG: A64Reg = A64Reg { num_bits: 64, reg_no: 22 };
 
+// frame pointer (base pointer)
+pub const X29_REG: A64Reg = A64Reg { num_bits: 64, reg_no: 29 };
+
 // link register
 pub const X30_REG: A64Reg = A64Reg { num_bits: 64, reg_no: 30 };
 
diff --git a/zjit/src/backend/arm64/mod.rs b/zjit/src/backend/arm64/mod.rs
index 88ccad8e091ed1..42dc31c90fd5cc 100644
--- a/zjit/src/backend/arm64/mod.rs
+++ b/zjit/src/backend/arm64/mod.rs
@@ -29,6 +29,7 @@ pub const C_ARG_OPNDS: [Opnd; 6] = [
 pub const C_RET_REG: Reg = X0_REG;
 pub const C_RET_OPND: Opnd = Opnd::Reg(X0_REG);
 pub const NATIVE_STACK_PTR: Opnd = Opnd::Reg(XZR_REG);
+pub const NATIVE_BASE_PTR: Opnd = Opnd::Reg(X29_REG);
 
 // These constants define the way we work with Arm64's stack pointer. The stack
 // pointer always needs to be aligned to a 16-byte boundary.
@@ -911,18 +912,54 @@ impl Assembler
                         cb.write_byte(0);
                     }
                 },
-                Insn::FrameSetup => {
+                &Insn::FrameSetup { preserved, mut slot_count } => {
+                    const { assert!(SIZEOF_VALUE == 8, "alignment logic relies on SIZEOF_VALUE == 8"); }
+                    // Preserve X29 and set up frame record
                     stp_pre(cb, X29, X30, A64Opnd::new_mem(128, C_SP_REG, -16));
-
-                    // X29 (frame_pointer) = SP
                     mov(cb, X29, C_SP_REG);
-                },
-                Insn::FrameTeardown => {
+
+                    for regs in preserved.chunks(2) {
+                        // For the body, store pairs and move SP
+                        if let [reg0, reg1] = regs {
+                            stp_pre(cb, reg1.into(), reg0.into(), A64Opnd::new_mem(128, C_SP_REG, -16));
+                        } else if let [reg] = regs {
+                            // For overhang, store but don't move SP. Combine movement with
+                            // movement for slots below.
+                            stur(cb, reg.into(), A64Opnd::new_mem(64, C_SP_REG, -8));
+                            slot_count += 1;
+                        } else {
+                            unreachable!("chunks(2)");
+                        }
+                    }
+                    // Align slot_count
+                    if slot_count % 2 == 1 {
+                        slot_count += 1
+                    }
+                    if slot_count > 0 {
+                        let slot_offset = (slot_count * SIZEOF_VALUE) as u64;
+                        // Bail when asked to reserve too many slots in one instruction.
+                        ShiftedImmediate::try_from(slot_offset).ok()?;
+                        sub(cb, C_SP_REG, C_SP_REG, A64Opnd::new_uimm(slot_offset));
+                    }
+                }
+                Insn::FrameTeardown { preserved } => {
+                    // Restore preserved registers below frame pointer.
+                    let mut base_offset = 0;
+                    for regs in preserved.chunks(2) {
+                        if let [reg0, reg1] = regs {
+                            base_offset -= 16;
+                            ldp(cb, reg1.into(), reg0.into(), A64Opnd::new_mem(128, X29, base_offset));
+                        } else if let [reg] = regs {
+                            ldur(cb, reg.into(), A64Opnd::new_mem(64, X29, base_offset - 8));
+                        } else {
+                            unreachable!("chunks(2)");
+                        }
+                    }
+
                     // SP = X29 (frame pointer)
                     mov(cb, C_SP_REG, X29);
-
                     ldp_post(cb, X29, X30, A64Opnd::new_mem(128, C_SP_REG, 16));
-                },
+                }
                 Insn::Add { left, right, out } => {
                     // Usually, we issue ADDS, so you could branch on overflow, but ADDS with
                     // out=31 refers to out=XZR, which discards the sum. So, instead of ADDS
@@ -1482,11 +1519,73 @@ mod tests {
     fn test_emit_frame() {
         let (mut asm, mut cb) = setup_asm();
 
-        asm.frame_setup();
-        asm.frame_teardown();
+        asm.frame_setup(&[], 0);
+        asm.frame_teardown(&[]);
         asm.compile_with_num_regs(&mut cb, 0);
     }
 
+    #[test]
+    fn frame_setup_and_teardown() {
+        const THREE_REGS: &'static [Opnd] = &[Opnd::Reg(X19_REG), Opnd::Reg(X20_REG), Opnd::Reg(X21_REG)];
+        // Test 3 preserved regs (odd), odd slot_count
+        {
+            let (mut asm, mut cb) = setup_asm();
+            asm.frame_setup(THREE_REGS, 3);
+            asm.frame_teardown(THREE_REGS);
+            asm.compile_with_num_regs(&mut cb, 0);
+            assert_disasm!(cb, "fd7bbfa9fd030091f44fbfa9f5831ff8ff8300d1b44f7fa9b5835ef8bf030091fd7bc1a8", "
+                0x0: stp x29, x30, [sp, #-0x10]!
+                0x4: mov x29, sp
+                0x8: stp x20, x19, [sp, #-0x10]!
+                0xc: stur x21, [sp, #-8]
+                0x10: sub sp, sp, #0x20
+                0x14: ldp x20, x19, [x29, #-0x10]
+                0x18: ldur x21, [x29, #-0x18]
+                0x1c: mov sp, x29
+                0x20: ldp x29, x30, [sp], #0x10
+            ");
+        }
+
+        // Test 3 preserved regs (odd), even slot_count
+        {
+            let (mut asm, mut cb) = setup_asm();
+            asm.frame_setup(THREE_REGS, 4);
+            asm.frame_teardown(THREE_REGS);
+            asm.compile_with_num_regs(&mut cb, 0);
+            assert_disasm!(cb, "fd7bbfa9fd030091f44fbfa9f5831ff8ffc300d1b44f7fa9b5835ef8bf030091fd7bc1a8", "
+                0x0: stp x29, x30, [sp, #-0x10]!
+                0x4: mov x29, sp
+                0x8: stp x20, x19, [sp, #-0x10]!
+                0xc: stur x21, [sp, #-8]
+                0x10: sub sp, sp, #0x30
+                0x14: ldp x20, x19, [x29, #-0x10]
+                0x18: ldur x21, [x29, #-0x18]
+                0x1c: mov sp, x29
+                0x20: ldp x29, x30, [sp], #0x10
+            ");
+        }
+
+        // Test 4 preserved regs (even), odd slot_count
+        {
+            static FOUR_REGS: &'static [Opnd] = &[Opnd::Reg(X19_REG), Opnd::Reg(X20_REG), Opnd::Reg(X21_REG), Opnd::Reg(X22_REG)];
+            let (mut asm, mut cb) = setup_asm();
+            asm.frame_setup(FOUR_REGS, 3);
+            asm.frame_teardown(FOUR_REGS);
+            asm.compile_with_num_regs(&mut cb, 0);
+            assert_disasm!(cb, "fd7bbfa9fd030091f44fbfa9f657bfa9ff8300d1b44f7fa9b6577ea9bf030091fd7bc1a8", "
+                0x0: stp x29, x30, [sp, #-0x10]!
+                0x4: mov x29, sp
+                0x8: stp x20, x19, [sp, #-0x10]!
+                0xc: stp x22, x21, [sp, #-0x10]!
+                0x10: sub sp, sp, #0x20
+                0x14: ldp x20, x19, [x29, #-0x10]
+                0x18: ldp x22, x21, [x29, #-0x20]
+                0x1c: mov sp, x29
+                0x20: ldp x29, x30, [sp], #0x10
+            ");
+        }
+    }
+
     #[test]
     fn test_emit_je_fits_into_bcond() {
         let (mut asm, mut cb) = setup_asm();
diff --git a/zjit/src/backend/lir.rs b/zjit/src/backend/lir.rs
index 7bac210bee6689..36e783bd4e658a 100644
--- a/zjit/src/backend/lir.rs
+++ b/zjit/src/backend/lir.rs
@@ -12,10 +12,12 @@ use crate::asm::{CodeBlock, Label};
 pub use crate::backend::current::{
     Reg,
     EC, CFP, SP,
-    NATIVE_STACK_PTR,
+    NATIVE_STACK_PTR, NATIVE_BASE_PTR,
     C_ARG_OPNDS, C_RET_REG, C_RET_OPND,
 };
 
+pub static JIT_PRESERVED_REGS: &'static [Opnd] = &[CFP, SP, EC];
+
 // Memory operand base
 #[derive(Clone, Copy, PartialEq, Eq, Debug)]
 pub enum MemBase
@@ -291,8 +293,6 @@ pub enum Target
         context: Option<SideExitContext>,
         /// We use this to enrich asm comments.
         reason: SideExitReason,
-        /// The number of bytes we need to adjust the C stack pointer by.
-        c_stack_bytes: usize,
         /// Some if the side exit should write this label. We use it for patch points.
         label: Option<Label>,
     },
@@ -404,10 +404,10 @@ pub enum Insn {
     CSelZ { truthy: Opnd, falsy: Opnd, out: Opnd },
 
     /// Set up the frame stack as necessary per the architecture.
-    FrameSetup,
+    FrameSetup { preserved: &'static [Opnd], slot_count: usize },
 
     /// Tear down the frame stack as necessary per the architecture.
-    FrameTeardown,
+    FrameTeardown { preserved: &'static [Opnd], },
 
     // Atomically increment a counter
     // Input: memory operand, increment value
@@ -598,8 +598,8 @@ impl Insn {
             Insn::CSelNE { .. } => "CSelNE",
             Insn::CSelNZ { .. } => "CSelNZ",
             Insn::CSelZ { .. } => "CSelZ",
-            Insn::FrameSetup => "FrameSetup",
-            Insn::FrameTeardown => "FrameTeardown",
+            Insn::FrameSetup { .. } => "FrameSetup",
+            Insn::FrameTeardown { .. } => "FrameTeardown",
             Insn::IncrCounter { .. } => "IncrCounter",
             Insn::Jbe(_) => "Jbe",
             Insn::Jb(_) => "Jb",
@@ -823,8 +823,8 @@ impl<'a> Iterator for InsnOpndIterator<'a> {
             Insn::CPop { .. } |
             Insn::CPopAll |
             Insn::CPushAll |
-            Insn::FrameSetup |
-            Insn::FrameTeardown |
+            Insn::FrameSetup { .. } |
+            Insn::FrameTeardown { .. } |
             Insn::PadPatchPoint |
             Insn::PosMarker(_) => None,
 
@@ -979,8 +979,8 @@ impl<'a> InsnOpndMutIterator<'a> {
             Insn::CPop { .. } |
             Insn::CPopAll |
             Insn::CPushAll |
-            Insn::FrameSetup |
-            Insn::FrameTeardown |
+            Insn::FrameSetup { .. } |
+            Insn::FrameTeardown { .. } |
             Insn::PadPatchPoint |
             Insn::PosMarker(_) => None,
 
@@ -1813,7 +1813,7 @@ impl Assembler
         for (idx, target) in targets {
             // Compile a side exit. Note that this is past the split pass and alloc_regs(),
             // so you can't use a VReg or an instruction that needs to be split.
-            if let Target::SideExit { context, reason, c_stack_bytes, label } = target {
+            if let Target::SideExit { context, reason, label } = target {
                 asm_comment!(self, "Exit: {reason}");
                 let side_exit_label = if let Some(label) = label {
                     Target::Label(label)
@@ -1858,13 +1858,8 @@ impl Assembler
                     self.store(cfp_sp, Opnd::Reg(Assembler::SCRATCH_REG));
                 }
 
-                if c_stack_bytes > 0 {
-                    asm_comment!(self, "restore C stack pointer");
-                    self.add_into(NATIVE_STACK_PTR, c_stack_bytes.into());
-                }
-
                 asm_comment!(self, "exit to the interpreter");
-                self.frame_teardown();
+                self.frame_teardown(&[]); // matching the setup in :bb0-prologue:
                 self.mov(C_RET_OPND, Opnd::UImm(Qundef.as_u64()));
                 self.cret(C_RET_OPND);
 
@@ -2065,12 +2060,14 @@ impl Assembler {
         out
     }
 
-    pub fn frame_setup(&mut self) {
-        self.push_insn(Insn::FrameSetup);
+    pub fn frame_setup(&mut self, preserved_regs: &'static [Opnd], slot_count: usize) {
+        self.push_insn(Insn::FrameSetup { preserved: preserved_regs, slot_count });
     }
 
-    pub fn frame_teardown(&mut self) {
-        self.push_insn(Insn::FrameTeardown);
+    /// The inverse of [Self::frame_setup] used before return. `reserve_bytes`
+    /// not necessary since we use a base pointer register.
+    pub fn frame_teardown(&mut self, preserved_regs: &'static [Opnd]) {
+        self.push_insn(Insn::FrameTeardown { preserved: preserved_regs });
     }
 
     pub fn incr_counter(&mut self, mem: Opnd, value: Opnd) {
diff --git a/zjit/src/backend/x86_64/mod.rs b/zjit/src/backend/x86_64/mod.rs
index 942705fb95bb75..4543252573800c 100644
--- a/zjit/src/backend/x86_64/mod.rs
+++ b/zjit/src/backend/x86_64/mod.rs
@@ -29,6 +29,7 @@ pub const C_ARG_OPNDS: [Opnd; 6] = [
 pub const C_RET_REG: Reg = RAX_REG;
 pub const C_RET_OPND: Opnd = Opnd::Reg(RAX_REG);
 pub const NATIVE_STACK_PTR: Opnd = Opnd::Reg(RSP_REG);
+pub const NATIVE_BASE_PTR: Opnd = Opnd::Reg(RBP_REG);
 
 impl CodeBlock {
     // The number of bytes that are generated by jmp_ptr
@@ -110,9 +111,9 @@ impl Assembler
         vec![RAX_REG, RCX_REG, RDX_REG, RSI_REG, RDI_REG, R8_REG, R9_REG, R10_REG, R11_REG]
     }
 
-    /// How many bytes a call and a [Self::frame_setup] would change native SP
+    /// How many bytes a call and a bare bones [Self::frame_setup] would change native SP
     pub fn frame_size() -> i32 {
-        0x8
+        0x10
     }
 
     // These are the callee-saved registers in the x86-64 SysV ABI
@@ -476,22 +477,34 @@ impl Assembler
                     cb.write_byte(0);
                 },
 
-                // Set up RBP to work with frame pointer unwinding
+                // Set up RBP as frame pointer work with unwinding
                 // (e.g. with Linux `perf record --call-graph fp`)
-                Insn::FrameSetup => {
-                    if false { // We don't support --zjit-perf yet
-                        // TODO(alan): Change Assembler::frame_size() when adding --zjit-perf support
-                        push(cb, RBP);
-                        mov(cb, RBP, RSP);
-                        push(cb, RBP);
+                // and to allow push and pops in the function.
+                &Insn::FrameSetup { preserved, mut slot_count } => {
+                    // Bump slot_count for alignment if necessary
+                    const { assert!(SIZEOF_VALUE == 8, "alignment logic relies on SIZEOF_VALUE == 8"); }
+                    let total_slots = 2 /* rbp and return address*/ + slot_count + preserved.len();
+                    if total_slots % 2 == 1 {
+                        slot_count += 1;
                     }
-                },
-                Insn::FrameTeardown => {
-                    if false { // We don't support --zjit-perf yet
-                        pop(cb, RBP);
-                        pop(cb, RBP);
+                    push(cb, RBP);
+                    mov(cb, RBP, RSP);
+                    for reg in preserved {
+                        push(cb, reg.into());
                     }
-                },
+                    if slot_count > 0 {
+                        sub(cb, RSP, uimm_opnd((slot_count * SIZEOF_VALUE) as u64));
+                    }
+                }
+                &Insn::FrameTeardown { preserved } => {
+                    let mut preserved_offset = -8;
+                    for reg in preserved {
+                        mov(cb, reg.into(), mem_opnd(64, RBP, preserved_offset));
+                        preserved_offset -= 8;
+                    }
+                    mov(cb, RSP, RBP);
+                    pop(cb, RBP);
+                }
 
                 Insn::Add { left, right, .. } => {
                     let opnd1 = emit_64bit_immediate(cb, right);
@@ -1306,4 +1319,37 @@ mod tests {
             0x6: mov dword ptr [rax], 0x80000001
         "});
     }
+
+    #[test]
+    fn frame_setup_teardown() {
+        let (mut asm, mut cb) = setup_asm();
+        asm.frame_setup(JIT_PRESERVED_REGS, 0);
+        asm.frame_teardown(JIT_PRESERVED_REGS);
+
+        asm.cret(C_RET_OPND);
+
+        asm.frame_setup(&[], 5);
+        asm.frame_teardown(&[]);
+
+        asm.compile_with_num_regs(&mut cb, 0);
+        assert_disasm!(cb, "554889e541555341544883ec084c8b6df8488b5df04c8b65e84889ec5dc3554889e54883ec304889ec5d", {"
+            0x0: push rbp
+            0x1: mov rbp, rsp
+            0x4: push r13
+            0x6: push rbx
+            0x7: push r12
+            0x9: sub rsp, 8
+            0xd: mov r13, qword ptr [rbp - 8]
+            0x11: mov rbx, qword ptr [rbp - 0x10]
+            0x15: mov r12, qword ptr [rbp - 0x18]
+            0x19: mov rsp, rbp
+            0x1c: pop rbp
+            0x1d: ret
+            0x1e: push rbp
+            0x1f: mov rbp, rsp
+            0x22: sub rsp, 0x30
+            0x26: mov rsp, rbp
+            0x29: pop rbp
+        "});
+    }
 }
diff --git a/zjit/src/codegen.rs b/zjit/src/codegen.rs
index c460dddfb82ce1..23b2dc2bd4192d 100644
--- a/zjit/src/codegen.rs
+++ b/zjit/src/codegen.rs
@@ -4,14 +4,15 @@ use std::ffi::{c_int};
 
 use crate::asm::Label;
 use crate::backend::current::{Reg, ALLOC_REGS};
-use crate::invariants::{track_bop_assumption, track_cme_assumption};
+use crate::invariants::{track_bop_assumption, track_cme_assumption, track_stable_constant_names_assumption};
 use crate::gc::{get_or_create_iseq_payload, append_gc_offsets};
 use crate::state::ZJITState;
+use crate::stats::{counter_ptr, Counter};
 use crate::{asm::CodeBlock, cruby::*, options::debug, virtualmem::CodePtr};
-use crate::backend::lir::{self, asm_comment, asm_ccall, Assembler, Opnd, SideExitContext, Target, CFP, C_ARG_OPNDS, C_RET_OPND, EC, NATIVE_STACK_PTR, SP};
+use crate::backend::lir::{self, asm_comment, asm_ccall, Assembler, Opnd, SideExitContext, Target, CFP, C_ARG_OPNDS, C_RET_OPND, EC, NATIVE_STACK_PTR, NATIVE_BASE_PTR, SP};
 use crate::hir::{iseq_to_hir, Block, BlockId, BranchEdge, CallInfo, Invariant, RangeType, SideExitReason, SideExitReason::*, SpecialObjectType, SELF_PARAM_IDX};
 use crate::hir::{Const, FrameState, Function, Insn, InsnId};
-use crate::hir_type::{types::Fixnum, Type};
+use crate::hir_type::{types, Type};
 use crate::options::get_option;
 
 /// Ephemeral code generation state
@@ -29,18 +30,18 @@ struct JITState {
     branch_iseqs: Vec<(Rc<Branch>, IseqPtr)>,
 
     /// The number of bytes allocated for basic block arguments spilled onto the C stack
-    c_stack_bytes: usize,
+    c_stack_slots: usize,
 }
 
 impl JITState {
     /// Create a new JITState instance
-    fn new(iseq: IseqPtr, num_insns: usize, num_blocks: usize, c_stack_bytes: usize) -> Self {
+    fn new(iseq: IseqPtr, num_insns: usize, num_blocks: usize, c_stack_slots: usize) -> Self {
         JITState {
             iseq,
             opnds: vec![None; num_insns],
             labels: vec![None; num_blocks],
             branch_iseqs: Vec::default(),
-            c_stack_bytes,
+            c_stack_slots,
         }
     }
 
@@ -120,39 +121,46 @@ fn gen_iseq_entry_point_body(cb: &mut CodeBlock, iseq: IseqPtr) -> *const u8 {
     };
 
     // Compile the High-level IR
-    let (start_ptr, mut branch_iseqs) = match gen_function(cb, iseq, &function) {
-        Some((start_ptr, gc_offsets, jit)) => {
-            // Remember the block address to reuse it later
-            let payload = get_or_create_iseq_payload(iseq);
-            payload.start_ptr = Some(start_ptr);
-            append_gc_offsets(iseq, &gc_offsets);
-
-            // Compile an entry point to the JIT code
-            (gen_entry(cb, iseq, &function, start_ptr, jit.c_stack_bytes), jit.branch_iseqs)
-        },
-        None => (None, vec![]),
+    let Some((start_ptr, gc_offsets, jit)) = gen_function(cb, iseq, &function) else {
+        debug!("Failed to compile iseq: gen_function failed: {}", iseq_get_location(iseq, 0));
+        return std::ptr::null();
     };
 
+    // Compile an entry point to the JIT code
+    let Some(entry_ptr) = gen_entry(cb, iseq, &function, start_ptr) else {
+        debug!("Failed to compile iseq: gen_entry failed: {}", iseq_get_location(iseq, 0));
+        return std::ptr::null();
+    };
+
+    let mut branch_iseqs = jit.branch_iseqs;
+
     // Recursively compile callee ISEQs
+    let caller_iseq = iseq;
     while let Some((branch, iseq)) = branch_iseqs.pop() {
         // Disable profiling. This will be the last use of the profiling information for the ISEQ.
         unsafe { rb_zjit_profile_disable(iseq); }
 
         // Compile the ISEQ
-        if let Some((callee_ptr, callee_branch_iseqs)) = gen_iseq(cb, iseq) {
-            let callee_addr = callee_ptr.raw_ptr(cb);
-            branch.regenerate(cb, |asm| {
-                asm.ccall(callee_addr, vec![]);
-            });
-            branch_iseqs.extend(callee_branch_iseqs);
-        } else {
+        let Some((callee_ptr, callee_branch_iseqs)) = gen_iseq(cb, iseq) else {
             // Failed to compile the callee. Bail out of compiling this graph of ISEQs.
+            debug!("Failed to compile iseq: could not compile callee: {} -> {}",
+                   iseq_get_location(caller_iseq, 0), iseq_get_location(iseq, 0));
             return std::ptr::null();
-        }
+        };
+        let callee_addr = callee_ptr.raw_ptr(cb);
+        branch.regenerate(cb, |asm| {
+            asm.ccall(callee_addr, vec![]);
+        });
+        branch_iseqs.extend(callee_branch_iseqs);
     }
 
-    // Return a JIT code address or a null pointer
-    start_ptr.map(|start_ptr| start_ptr.raw_ptr(cb)).unwrap_or(std::ptr::null())
+    // Remember the block address to reuse it later
+    let payload = get_or_create_iseq_payload(iseq);
+    payload.start_ptr = Some(start_ptr);
+    append_gc_offsets(iseq, &gc_offsets);
+
+    // Return a JIT code address
+    entry_ptr.raw_ptr(cb)
 }
 
 /// Write an entry to the perf map in /tmp
@@ -170,21 +178,18 @@ fn register_with_perf(iseq_name: String, start_ptr: usize, code_size: usize) {
 }
 
 /// Compile a JIT entry
-fn gen_entry(cb: &mut CodeBlock, iseq: IseqPtr, function: &Function, function_ptr: CodePtr, c_stack_bytes: usize) -> Option<CodePtr> {
+fn gen_entry(cb: &mut CodeBlock, iseq: IseqPtr, function: &Function, function_ptr: CodePtr) -> Option<CodePtr> {
     // Set up registers for CFP, EC, SP, and basic block arguments
     let mut asm = Assembler::new();
     gen_entry_prologue(&mut asm, iseq);
-    gen_entry_params(&mut asm, iseq, function.block(BlockId(0)), c_stack_bytes);
+    gen_entry_params(&mut asm, iseq, function.block(BlockId(0)));
 
     // Jump to the first block using a call instruction
     asm.ccall(function_ptr.raw_ptr(cb) as *const u8, vec![]);
 
     // Restore registers for CFP, EC, and SP after use
-    asm_comment!(asm, "exit to the interpreter");
-    asm.cpop_into(SP);
-    asm.cpop_into(EC);
-    asm.cpop_into(CFP);
-    asm.frame_teardown();
+    asm_comment!(asm, "return to the interpreter");
+    asm.frame_teardown(lir::JIT_PRESERVED_REGS);
     asm.cret(C_RET_OPND);
 
     if get_option!(dump_lir) {
@@ -231,8 +236,8 @@ fn gen_iseq(cb: &mut CodeBlock, iseq: IseqPtr) -> Option<(CodePtr, Vec<(Rc<Branc
 
 /// Compile a function
 fn gen_function(cb: &mut CodeBlock, iseq: IseqPtr, function: &Function) -> Option<(CodePtr, Vec<CodePtr>, JITState)> {
-    let c_stack_bytes = aligned_stack_bytes(max_num_params(function).saturating_sub(ALLOC_REGS.len()));
-    let mut jit = JITState::new(iseq, function.num_insns(), function.num_blocks(), c_stack_bytes);
+    let c_stack_slots = max_num_params(function).saturating_sub(ALLOC_REGS.len());
+    let mut jit = JITState::new(iseq, function.num_insns(), function.num_blocks(), c_stack_slots);
     let mut asm = Assembler::new();
 
     // Compile each basic block
@@ -245,16 +250,9 @@ fn gen_function(cb: &mut CodeBlock, iseq: IseqPtr, function: &Function) -> Optio
         let label = jit.get_label(&mut asm, block_id);
         asm.write_label(label);
 
-        // Set up the frame at the first block
+        // Set up the frame at the first block. :bb0-prologue:
         if block_id == BlockId(0) {
-            asm.frame_setup();
-
-            // Bump the C stack pointer for basic block arguments
-            if jit.c_stack_bytes > 0 {
-                asm_comment!(asm, "bump C stack pointer");
-                let new_sp = asm.sub(NATIVE_STACK_PTR, jit.c_stack_bytes.into());
-                asm.mov(NATIVE_STACK_PTR, new_sp);
-            }
+            asm.frame_setup(&[], jit.c_stack_slots);
         }
 
         // Compile all parameters
@@ -293,6 +291,10 @@ fn gen_function(cb: &mut CodeBlock, iseq: IseqPtr, function: &Function) -> Optio
             let iseq_name = iseq_get_location(iseq, 0);
             register_with_perf(iseq_name, start_usize, code_size);
         }
+        if ZJITState::should_log_compiled_iseqs() {
+            let iseq_name = iseq_get_location(iseq, 0);
+            ZJITState::log_compile(iseq_name);
+        }
     }
     result
 }
@@ -335,7 +337,7 @@ fn gen_insn(cb: &mut CodeBlock, jit: &mut JITState, asm: &mut Assembler, functio
             gen_send_without_block(jit, asm, call_info, *cd, &function.frame_state(*state), opnd!(self_val), opnds!(args))?,
         Insn::SendWithoutBlockDirect { cme, iseq, self_val, args, state, .. } => gen_send_without_block_direct(cb, jit, asm, *cme, *iseq, opnd!(self_val), opnds!(args), &function.frame_state(*state))?,
         Insn::InvokeBuiltin { bf, args, state } => gen_invokebuiltin(asm, &function.frame_state(*state), bf, opnds!(args))?,
-        Insn::Return { val } => return Some(gen_return(jit, asm, opnd!(val))?),
+        Insn::Return { val } => return Some(gen_return(asm, opnd!(val))?),
         Insn::FixnumAdd { left, right, state } => gen_fixnum_add(jit, asm, opnd!(left), opnd!(right), &function.frame_state(*state))?,
         Insn::FixnumSub { left, right, state } => gen_fixnum_sub(jit, asm, opnd!(left), opnd!(right), &function.frame_state(*state))?,
         Insn::FixnumMult { left, right, state } => gen_fixnum_mult(jit, asm, opnd!(left), opnd!(right), &function.frame_state(*state))?,
@@ -364,6 +366,7 @@ fn gen_insn(cb: &mut CodeBlock, jit: &mut JITState, asm: &mut Assembler, functio
         Insn::PutSpecialObject { value_type } => gen_putspecialobject(asm, *value_type),
         Insn::AnyToString { val, str, state } => gen_anytostring(asm, opnd!(val), opnd!(str), &function.frame_state(*state))?,
         Insn::Defined { op_type, obj, pushval, v } => gen_defined(jit, asm, *op_type, *obj, *pushval, opnd!(v))?,
+        &Insn::IncrCounter(counter) => return Some(gen_incr_counter(asm, counter)),
         _ => {
             debug!("ZJIT: gen_function: unexpected insn {insn}");
             return None;
@@ -515,6 +518,10 @@ fn gen_patch_point(jit: &mut JITState, asm: &mut Assembler, invariant: &Invarian
                 let side_exit_ptr = cb.resolve_label(label);
                 track_cme_assumption(cme, code_ptr, side_exit_ptr);
             }
+            Invariant::StableConstantNames { idlist } => {
+                let side_exit_ptr = cb.resolve_label(label);
+                track_stable_constant_names_assumption(idlist, code_ptr, side_exit_ptr);
+            }
             _ => {
                 debug!("ZJIT: gen_patch_point: unimplemented invariant {invariant:?}");
                 return;
@@ -569,12 +576,8 @@ fn gen_putspecialobject(asm: &mut Assembler, value_type: SpecialObjectType) -> O
 /// Compile an interpreter entry block to be inserted into an ISEQ
 fn gen_entry_prologue(asm: &mut Assembler, iseq: IseqPtr) {
     asm_comment!(asm, "ZJIT entry point: {}", iseq_get_location(iseq, 0));
-    asm.frame_setup();
-
     // Save the registers we'll use for CFP, EP, SP
-    asm.cpush(CFP);
-    asm.cpush(EC);
-    asm.cpush(SP);
+    asm.frame_setup(lir::JIT_PRESERVED_REGS, 0);
 
     // EC and CFP are passed as arguments
     asm.mov(EC, C_ARG_OPNDS[0]);
@@ -587,7 +590,7 @@ fn gen_entry_prologue(asm: &mut Assembler, iseq: IseqPtr) {
 }
 
 /// Assign method arguments to basic block arguments at JIT entry
-fn gen_entry_params(asm: &mut Assembler, iseq: IseqPtr, entry_block: &Block, c_stack_bytes: usize) {
+fn gen_entry_params(asm: &mut Assembler, iseq: IseqPtr, entry_block: &Block) {
     let num_params = entry_block.params().len() - 1; // -1 to exclude self
     if num_params > 0 {
         asm_comment!(asm, "set method params: {num_params}");
@@ -616,8 +619,8 @@ fn gen_entry_params(asm: &mut Assembler, iseq: IseqPtr, entry_block: &Block, c_s
             // the HIR function ────────────► └────────────┘
             // is running
             match param {
-                Opnd::Mem(lir::Mem { base, disp, num_bits }) => {
-                    let param_slot = Opnd::Mem(lir::Mem { num_bits, base, disp: disp - c_stack_bytes as i32 - Assembler::frame_size() });
+                Opnd::Mem(lir::Mem { base: _, disp, num_bits }) => {
+                    let param_slot = Opnd::mem(num_bits, NATIVE_STACK_PTR, disp - Assembler::frame_size());
                     asm.mov(param_slot, local);
                 }
                 // Prepare for parallel move for locals in registers
@@ -848,7 +851,7 @@ fn gen_send_without_block_direct(
     asm_comment!(asm, "side-exit if callee side-exits");
     asm.cmp(ret, Qundef.into());
     // Restore the C stack pointer on exit
-    asm.je(Target::SideExit { context: None, reason: CalleeSideExit, c_stack_bytes: jit.c_stack_bytes, label: None });
+    asm.je(Target::SideExit { context: None, reason: CalleeSideExit, label: None });
 
     asm_comment!(asm, "restore SP register for the caller");
     let new_sp = asm.sub(SP, sp_offset.into());
@@ -912,7 +915,7 @@ fn gen_new_range(
 }
 
 /// Compile code that exits from JIT code with a return value
-fn gen_return(jit: &JITState, asm: &mut Assembler, val: lir::Opnd) -> Option<()> {
+fn gen_return(asm: &mut Assembler, val: lir::Opnd) -> Option<()> {
     // Pop the current frame (ec->cfp++)
     // Note: the return PC is already in the previous CFP
     asm_comment!(asm, "pop stack frame");
@@ -924,16 +927,8 @@ fn gen_return(jit: &JITState, asm: &mut Assembler, val: lir::Opnd) -> Option<()>
     // we need to load the return value, which might be part of the frame.
     asm.load_into(C_RET_OPND, val);
 
-    // Restore the C stack pointer bumped for basic block arguments
-    if jit.c_stack_bytes > 0 {
-        asm_comment!(asm, "restore C stack pointer");
-        let new_sp = asm.add(NATIVE_STACK_PTR, jit.c_stack_bytes.into());
-        asm.mov(NATIVE_STACK_PTR, new_sp);
-    }
-
-    asm.frame_teardown();
-
     // Return from the function
+    asm.frame_teardown(&[]); // matching the setup in :bb0-prologue:
     asm.cret(C_RET_OPND);
     Some(())
 }
@@ -1046,10 +1041,29 @@ fn gen_test(asm: &mut Assembler, val: lir::Opnd) -> Option<lir::Opnd> {
 
 /// Compile a type check with a side exit
 fn gen_guard_type(jit: &mut JITState, asm: &mut Assembler, val: lir::Opnd, guard_type: Type, state: &FrameState) -> Option<lir::Opnd> {
-    if guard_type.is_subtype(Fixnum) {
-        // Check if opnd is Fixnum
+    if guard_type.is_subtype(types::Fixnum) {
         asm.test(val, Opnd::UImm(RUBY_FIXNUM_FLAG as u64));
         asm.jz(side_exit(jit, state, GuardType(guard_type))?);
+    } else if guard_type.is_subtype(types::Flonum) {
+        // Flonum: (val & RUBY_FLONUM_MASK) == RUBY_FLONUM_FLAG
+        let masked = asm.and(val, Opnd::UImm(RUBY_FLONUM_MASK as u64));
+        asm.cmp(masked, Opnd::UImm(RUBY_FLONUM_FLAG as u64));
+        asm.jne(side_exit(jit, state, GuardType(guard_type))?);
+    } else if guard_type.is_subtype(types::StaticSymbol) {
+        // Static symbols have (val & 0xff) == RUBY_SYMBOL_FLAG
+        // Use 8-bit comparison like YJIT does
+        asm.cmp(val.with_num_bits(8).unwrap(), Opnd::UImm(RUBY_SYMBOL_FLAG as u64));
+        asm.jne(side_exit(jit, state, GuardType(guard_type))?);
+    } else if guard_type.is_subtype(types::NilClass) {
+        asm.cmp(val, Qnil.into());
+        asm.jne(side_exit(jit, state, GuardType(guard_type))?);
+    } else if guard_type.is_subtype(types::TrueClass) {
+        asm.cmp(val, Qtrue.into());
+        asm.jne(side_exit(jit, state, GuardType(guard_type))?);
+    } else if guard_type.is_subtype(types::FalseClass) {
+        assert!(Qfalse.as_i64() == 0);
+        asm.test(val, val);
+        asm.jne(side_exit(jit, state, GuardType(guard_type))?);
     } else if let Some(expected_class) = guard_type.runtime_exact_ruby_class() {
         asm_comment!(asm, "guard exact class");
 
@@ -1071,6 +1085,16 @@ fn gen_guard_bit_equals(jit: &mut JITState, asm: &mut Assembler, val: lir::Opnd,
     Some(val)
 }
 
+/// Generate code that increments a counter in ZJIT stats
+fn gen_incr_counter(asm: &mut Assembler, counter: Counter) -> () {
+    let ptr = counter_ptr(counter);
+    let ptr_reg = asm.load(Opnd::const_ptr(ptr as *const u8));
+    let counter_opnd = Opnd::mem(64, ptr_reg, 0);
+
+    // Increment and store the updated value
+    asm.incr_counter(counter_opnd, Opnd::UImm(1));
+}
+
 /// Save the incremented PC on the CFP.
 /// This is necessary when callees can raise or allocate.
 fn gen_save_pc(asm: &mut Assembler, state: &FrameState) {
@@ -1140,7 +1164,7 @@ fn param_opnd(idx: usize) -> Opnd {
     if idx < ALLOC_REGS.len() {
         Opnd::Reg(ALLOC_REGS[idx])
     } else {
-        Opnd::mem(64, NATIVE_STACK_PTR, (idx - ALLOC_REGS.len()) as i32 * SIZEOF_VALUE_I32)
+        Opnd::mem(64, NATIVE_BASE_PTR, (idx - ALLOC_REGS.len() + 1) as i32 * -SIZEOF_VALUE_I32)
     }
 }
 
@@ -1160,7 +1184,8 @@ fn compile_iseq(iseq: IseqPtr) -> Option<Function> {
     let mut function = match iseq_to_hir(iseq) {
         Ok(function) => function,
         Err(err) => {
-            debug!("ZJIT: iseq_to_hir: {err:?}");
+            let name = crate::cruby::iseq_get_location(iseq, 0);
+            debug!("ZJIT: iseq_to_hir: {err:?}: {name}");
             return None;
         }
     };
@@ -1196,7 +1221,6 @@ fn build_side_exit(jit: &mut JITState, state: &FrameState, reason: SideExitReaso
             locals,
         }),
         reason,
-        c_stack_bytes: jit.c_stack_bytes,
         label,
     };
     Some(target)
@@ -1225,26 +1249,6 @@ fn max_num_params(function: &Function) -> usize {
     }).max().unwrap_or(0)
 }
 
-/// Given the number of spill slots needed for a function, return the number of bytes
-/// the function needs to allocate on the stack for the stack frame.
-fn aligned_stack_bytes(num_slots: usize) -> usize {
-    // Both x86_64 and arm64 require the stack to be aligned to 16 bytes.
-    let num_slots = if cfg!(target_arch = "x86_64") && num_slots % 2 == 0 {
-        // On x86_64, since the call instruction bumps the stack pointer by 8 bytes on entry,
-        // we need to round up `num_slots` to an odd number.
-        num_slots + 1
-    } else if cfg!(target_arch = "aarch64") && num_slots % 2 == 1 {
-        // On arm64, the stack pointer is always aligned to 16 bytes, so we need to round up
-        // `num_slots`` to an even number.
-        num_slots + 1
-    } else {
-        num_slots
-    };
-
-    const { assert!(SIZEOF_VALUE == 8, "aligned_stack_bytes() assumes SIZEOF_VALUE == 8"); }
-    num_slots * SIZEOF_VALUE
-}
-
 impl Assembler {
     /// Make a C call while marking the start and end positions of it
     fn ccall_with_branch(&mut self, fptr: *const u8, opnds: Vec<Opnd>, branch: &Rc<Branch>) -> Opnd {
diff --git a/zjit/src/cruby.rs b/zjit/src/cruby.rs
index 2557e2e913dc51..56e342cba03001 100644
--- a/zjit/src/cruby.rs
+++ b/zjit/src/cruby.rs
@@ -259,7 +259,7 @@ pub struct VALUE(pub usize);
 /// An interned string. See [ids] and methods this type.
 /// `0` is a sentinal value for IDs.
 #[repr(transparent)]
-#[derive(Clone, Copy, PartialEq, Eq, Debug)]
+#[derive(Clone, Copy, PartialEq, Eq, Debug, Hash)]
 pub struct ID(pub ::std::os::raw::c_ulong);
 
 /// Pointer to an ISEQ
diff --git a/zjit/src/cruby_bindings.inc.rs b/zjit/src/cruby_bindings.inc.rs
index 492de3a5dfae3a..10f12798f66dad 100644
--- a/zjit/src/cruby_bindings.inc.rs
+++ b/zjit/src/cruby_bindings.inc.rs
@@ -222,7 +222,6 @@ pub const imemo_memo: imemo_type = 5;
 pub const imemo_ment: imemo_type = 6;
 pub const imemo_iseq: imemo_type = 7;
 pub const imemo_tmpbuf: imemo_type = 8;
-pub const imemo_ast: imemo_type = 9;
 pub const imemo_callinfo: imemo_type = 10;
 pub const imemo_callcache: imemo_type = 11;
 pub const imemo_constcache: imemo_type = 12;
@@ -833,6 +832,7 @@ unsafe extern "C" {
         elts: *const VALUE,
     ) -> VALUE;
     pub fn rb_vm_top_self() -> VALUE;
+    pub static mut rb_vm_insns_count: u64;
     pub fn rb_method_entry_at(obj: VALUE, id: ID) -> *const rb_method_entry_t;
     pub fn rb_callable_method_entry(klass: VALUE, id: ID) -> *const rb_callable_method_entry_t;
     pub fn rb_callable_method_entry_or_negative(
diff --git a/zjit/src/cruby_methods.rs b/zjit/src/cruby_methods.rs
index 51ecb1c787f9ec..9c29ed5472d8f1 100644
--- a/zjit/src/cruby_methods.rs
+++ b/zjit/src/cruby_methods.rs
@@ -76,12 +76,12 @@ pub fn init() -> Annotations {
 
     annotate!(rb_mKernel, "itself", types::BasicObject, no_gc, leaf, elidable);
     annotate!(rb_cString, "bytesize", types::Fixnum, no_gc, leaf);
-    annotate!(rb_cModule, "name", types::StringExact.union(types::NilClassExact), no_gc, leaf, elidable);
+    annotate!(rb_cModule, "name", types::StringExact.union(types::NilClass), no_gc, leaf, elidable);
     annotate!(rb_cModule, "===", types::BoolExact, no_gc, leaf);
     annotate!(rb_cArray, "length", types::Fixnum, no_gc, leaf, elidable);
     annotate!(rb_cArray, "size", types::Fixnum, no_gc, leaf, elidable);
-    annotate!(rb_cNilClass, "nil?", types::TrueClassExact, no_gc, leaf, elidable);
-    annotate!(rb_mKernel, "nil?", types::FalseClassExact, no_gc, leaf, elidable);
+    annotate!(rb_cNilClass, "nil?", types::TrueClass, no_gc, leaf, elidable);
+    annotate!(rb_mKernel, "nil?", types::FalseClass, no_gc, leaf, elidable);
 
     Annotations {
         cfuncs: std::mem::take(cfuncs)
diff --git a/zjit/src/hir.rs b/zjit/src/hir.rs
index 53e55b44286b5c..06c00e3d99a10b 100644
--- a/zjit/src/hir.rs
+++ b/zjit/src/hir.rs
@@ -4,7 +4,7 @@
 #![allow(non_upper_case_globals)]
 
 use crate::{
-    cast::IntoUsize, cruby::*, options::{get_option, DumpHIR}, gc::{get_or_create_iseq_payload, IseqPayload}, state::ZJITState
+    cast::IntoUsize, cruby::*, gc::{get_or_create_iseq_payload, IseqPayload}, options::{get_option, DumpHIR}, state::ZJITState, stats::Counter
 };
 use std::{
     cell::RefCell, collections::{HashMap, HashSet, VecDeque}, ffi::{c_int, c_void, CStr}, fmt::Display, mem::{align_of, size_of}, ptr, slice::Iter
@@ -566,6 +566,9 @@ pub enum Insn {
 
     /// Side-exit into the interpreter.
     SideExit { state: InsnId, reason: SideExitReason },
+
+    /// Increment a counter in ZJIT stats
+    IncrCounter(Counter),
 }
 
 impl Insn {
@@ -576,7 +579,7 @@ impl Insn {
             | Insn::IfTrue { .. } | Insn::IfFalse { .. } | Insn::Return { .. }
             | Insn::PatchPoint { .. } | Insn::SetIvar { .. } | Insn::ArrayExtend { .. }
             | Insn::ArrayPush { .. } | Insn::SideExit { .. } | Insn::SetGlobal { .. }
-            | Insn::SetLocal { .. } | Insn::Throw { .. } => false,
+            | Insn::SetLocal { .. } | Insn::Throw { .. } | Insn::IncrCounter(_) => false,
             _ => true,
         }
     }
@@ -786,6 +789,7 @@ impl<'a> std::fmt::Display for InsnPrinter<'a> {
                 }
                 write!(f, "Throw {state_string}, {val}")
             }
+            Insn::IncrCounter(counter) => write!(f, "IncrCounter {counter:?}"),
             insn => { write!(f, "{insn:?}") }
         }
     }
@@ -1096,7 +1100,8 @@ impl Function {
                     | PutSpecialObject {..}
                     | GetGlobal {..}
                     | GetLocal {..}
-                    | SideExit {..}) => result.clone(),
+                    | SideExit {..}
+                    | IncrCounter(_)) => result.clone(),
             Snapshot { state: FrameState { iseq, insn_idx, pc, stack, locals } } =>
                 Snapshot {
                     state: FrameState {
@@ -1217,7 +1222,7 @@ impl Function {
             Insn::SetGlobal { .. } | Insn::ArraySet { .. } | Insn::Jump(_)
             | Insn::IfTrue { .. } | Insn::IfFalse { .. } | Insn::Return { .. } | Insn::Throw { .. }
             | Insn::PatchPoint { .. } | Insn::SetIvar { .. } | Insn::ArrayExtend { .. }
-            | Insn::ArrayPush { .. } | Insn::SideExit { .. } | Insn::SetLocal { .. } =>
+            | Insn::ArrayPush { .. } | Insn::SideExit { .. } | Insn::SetLocal { .. } | Insn::IncrCounter(_) =>
                 panic!("Cannot infer type of instruction with no output: {}", self.insns[insn.0]),
             Insn::Const { val: Const::Value(val) } => Type::from_value(*val),
             Insn::Const { val: Const::CBool(val) } => Type::from_cbool(*val),
@@ -1234,8 +1239,8 @@ impl Function {
             Insn::Test { val } if self.type_of(*val).is_known_falsy() => Type::from_cbool(false),
             Insn::Test { val } if self.type_of(*val).is_known_truthy() => Type::from_cbool(true),
             Insn::Test { .. } => types::CBool,
-            Insn::IsNil { val } if self.is_a(*val, types::NilClassExact) => Type::from_cbool(true),
-            Insn::IsNil { val } if !self.type_of(*val).could_be(types::NilClassExact) => Type::from_cbool(false),
+            Insn::IsNil { val } if self.is_a(*val, types::NilClass) => Type::from_cbool(true),
+            Insn::IsNil { val } if !self.type_of(*val).could_be(types::NilClass) => Type::from_cbool(false),
             Insn::IsNil { .. } => types::CBool,
             Insn::StringCopy { .. } => types::StringExact,
             Insn::StringIntern { .. } => types::StringExact,
@@ -1835,7 +1840,8 @@ impl Function {
             &Insn::Const { .. }
             | &Insn::Param { .. }
             | &Insn::GetLocal { .. }
-            | &Insn::PutSpecialObject { .. } =>
+            | &Insn::PutSpecialObject { .. }
+            | &Insn::IncrCounter(_) =>
                 {}
             &Insn::PatchPoint { state, .. }
             | &Insn::GetConstantPath { ic: _, state } => {
@@ -2474,6 +2480,7 @@ pub enum ParseError {
     UnknownParameterType(ParameterType),
     MalformedIseq(u32), // insn_idx into iseq_encoded
     Validation(ValidationError),
+    NotAllowed,
 }
 
 /// Return the number of locals in the current ISEQ (includes parameters)
@@ -2539,6 +2546,9 @@ fn filter_unknown_parameter_type(iseq: *const rb_iseq_t) -> Result<(), ParseErro
 
 /// Compile ISEQ into High-level IR
 pub fn iseq_to_hir(iseq: *const rb_iseq_t) -> Result<Function, ParseError> {
+    if !ZJITState::can_compile_iseq(iseq) {
+        return Err(ParseError::NotAllowed);
+    }
     filter_unknown_parameter_type(iseq)?;
     let payload = get_or_create_iseq_payload(iseq);
     let mut profiles = ProfileOracle::new(payload);
@@ -2622,6 +2632,11 @@ pub fn iseq_to_hir(iseq: *const rb_iseq_t) -> Result<Function, ParseError> {
             let exit_state = state.clone();
             profiles.profile_stack(&exit_state);
 
+            // Increment zjit_insns_count for each YARV instruction if --zjit-stats is enabled.
+            if get_option!(stats) {
+                fun.push_insn(block, Insn::IncrCounter(Counter::zjit_insns_count));
+            }
+
             // try_into() call below is unfortunate. Maybe pick i32 instead of usize for opcodes.
             let opcode: u32 = unsafe { rb_iseq_opcode_at_pc(iseq, pc) }
                 .try_into()
@@ -3494,7 +3509,7 @@ mod infer_tests {
     fn test_const() {
         let mut function = Function::new(std::ptr::null());
         let val = function.push_insn(function.entry_block, Insn::Const { val: Const::Value(Qnil) });
-        assert_bit_equal(function.infer_type(val), types::NilClassExact);
+        assert_bit_equal(function.infer_type(val), types::NilClass);
     }
 
     #[test]
@@ -3593,7 +3608,7 @@ mod infer_tests {
         let param = function.push_insn(exit, Insn::Param { idx: 0 });
         crate::cruby::with_rubyvm(|| {
             function.infer_types();
-            assert_bit_equal(function.type_of(param), types::TrueClassExact.union(types::FalseClassExact));
+            assert_bit_equal(function.type_of(param), types::TrueClass.union(types::FalseClass));
         });
     }
 }
@@ -3975,7 +3990,7 @@ mod tests {
         assert_method_hir_with_opcodes("test", &[YARVINSN_getlocal_WC_0, YARVINSN_setlocal_WC_0], expect![[r#"
             fn test@<compiled>:3:
             bb0(v0:BasicObject):
-              v1:NilClassExact = Const Value(nil)
+              v1:NilClass = Const Value(nil)
               v3:Fixnum[1] = Const Value(1)
               Return v3
         "#]]);
@@ -4042,10 +4057,10 @@ mod tests {
         assert_method_hir_with_opcode("test", YARVINSN_defined, expect![[r#"
             fn test@<compiled>:2:
             bb0(v0:BasicObject):
-              v2:NilClassExact = Const Value(nil)
+              v2:NilClass = Const Value(nil)
               v3:BasicObject = Defined constant, v2
               v4:BasicObject = Defined func, v0
-              v5:NilClassExact = Const Value(nil)
+              v5:NilClass = Const Value(nil)
               v6:BasicObject = Defined global-variable, v5
               v8:ArrayExact = NewArray v3, v4, v6
               Return v8
@@ -4091,12 +4106,12 @@ mod tests {
         assert_method_hir("test", expect![[r#"
             fn test@<compiled>:3:
             bb0(v0:BasicObject, v1:BasicObject):
-              v2:NilClassExact = Const Value(nil)
+              v2:NilClass = Const Value(nil)
               v4:CBool = Test v1
               IfFalse v4, bb1(v0, v1, v2)
               v6:Fixnum[3] = Const Value(3)
               Jump bb2(v0, v1, v6)
-            bb1(v8:BasicObject, v9:BasicObject, v10:NilClassExact):
+            bb1(v8:BasicObject, v9:BasicObject, v10:NilClass):
               v12:Fixnum[4] = Const Value(4)
               Jump bb2(v8, v9, v12)
             bb2(v14:BasicObject, v15:BasicObject, v16:Fixnum):
@@ -4261,8 +4276,8 @@ mod tests {
         assert_method_hir("test",  expect![[r#"
             fn test@<compiled>:3:
             bb0(v0:BasicObject):
-              v1:NilClassExact = Const Value(nil)
-              v2:NilClassExact = Const Value(nil)
+              v1:NilClass = Const Value(nil)
+              v2:NilClass = Const Value(nil)
               v4:Fixnum[0] = Const Value(0)
               v5:Fixnum[10] = Const Value(10)
               Jump bb2(v0, v4, v5)
@@ -4271,7 +4286,7 @@ mod tests {
               v13:BasicObject = SendWithoutBlock v9, :>, v11
               v14:CBool = Test v13
               IfTrue v14, bb1(v7, v8, v9)
-              v16:NilClassExact = Const Value(nil)
+              v16:NilClass = Const Value(nil)
               Return v8
             bb1(v18:BasicObject, v19:BasicObject, v20:BasicObject):
               v22:Fixnum[1] = Const Value(1)
@@ -4311,8 +4326,8 @@ mod tests {
         assert_method_hir("test", expect![[r#"
             fn test@<compiled>:3:
             bb0(v0:BasicObject):
-              v1:NilClassExact = Const Value(nil)
-              v3:TrueClassExact = Const Value(true)
+              v1:NilClass = Const Value(nil)
+              v3:TrueClass = Const Value(true)
               v4:CBool[true] = Test v3
               IfFalse v4, bb1(v0, v3)
               v6:Fixnum[3] = Const Value(3)
@@ -4528,12 +4543,12 @@ mod tests {
             fn test@<compiled>:3:
             bb0(v0:BasicObject):
               v3:BasicObject = GetConstantPath 0x1000
-              v4:NilClassExact = Const Value(nil)
+              v4:NilClass = Const Value(nil)
               Jump bb1(v0, v4, v3)
-            bb1(v6:BasicObject, v7:NilClassExact, v8:BasicObject):
+            bb1(v6:BasicObject, v7:NilClass, v8:BasicObject):
               v11:BasicObject = SendWithoutBlock v8, :new
               Jump bb2(v6, v11, v7)
-            bb2(v13:BasicObject, v14:BasicObject, v15:NilClassExact):
+            bb2(v13:BasicObject, v14:BasicObject, v15:NilClass):
               Return v14
         "#]]);
     }
@@ -4580,8 +4595,8 @@ mod tests {
         assert_method_hir_with_opcode("test", YARVINSN_opt_newarray_send, expect![[r#"
             fn test@<compiled>:3:
             bb0(v0:BasicObject, v1:BasicObject, v2:BasicObject):
-              v3:NilClassExact = Const Value(nil)
-              v4:NilClassExact = Const Value(nil)
+              v3:NilClass = Const Value(nil)
+              v4:NilClass = Const Value(nil)
               v7:BasicObject = SendWithoutBlock v1, :+, v2
               SideExit UnknownNewarraySend(MIN)
         "#]]);
@@ -4600,8 +4615,8 @@ mod tests {
         assert_method_hir_with_opcode("test", YARVINSN_opt_newarray_send, expect![[r#"
             fn test@<compiled>:3:
             bb0(v0:BasicObject, v1:BasicObject, v2:BasicObject):
-              v3:NilClassExact = Const Value(nil)
-              v4:NilClassExact = Const Value(nil)
+              v3:NilClass = Const Value(nil)
+              v4:NilClass = Const Value(nil)
               v7:BasicObject = SendWithoutBlock v1, :+, v2
               SideExit UnknownNewarraySend(HASH)
         "#]]);
@@ -4620,8 +4635,8 @@ mod tests {
         assert_method_hir_with_opcode("test", YARVINSN_opt_newarray_send, expect![[r#"
             fn test@<compiled>:3:
             bb0(v0:BasicObject, v1:BasicObject, v2:BasicObject):
-              v3:NilClassExact = Const Value(nil)
-              v4:NilClassExact = Const Value(nil)
+              v3:NilClass = Const Value(nil)
+              v4:NilClass = Const Value(nil)
               v7:BasicObject = SendWithoutBlock v1, :+, v2
               v8:StringExact[VALUE(0x1000)] = Const Value(VALUE(0x1000))
               v9:StringExact = StringCopy v8
@@ -4644,8 +4659,8 @@ mod tests {
         assert_method_hir_with_opcode("test", YARVINSN_opt_newarray_send, expect![[r#"
             fn test@<compiled>:3:
             bb0(v0:BasicObject, v1:BasicObject, v2:BasicObject):
-              v3:NilClassExact = Const Value(nil)
-              v4:NilClassExact = Const Value(nil)
+              v3:NilClass = Const Value(nil)
+              v4:NilClass = Const Value(nil)
               v7:BasicObject = SendWithoutBlock v1, :+, v2
               SideExit UnknownNewarraySend(INCLUDE_P)
         "#]]);
@@ -4808,7 +4823,7 @@ mod tests {
         assert_method_hir_with_opcode("test", YARVINSN_opt_aset, expect![[r#"
             fn test@<compiled>:2:
             bb0(v0:BasicObject, v1:BasicObject, v2:BasicObject):
-              v4:NilClassExact = Const Value(nil)
+              v4:NilClass = Const Value(nil)
               v5:Fixnum[1] = Const Value(1)
               v7:BasicObject = SendWithoutBlock v1, :[]=, v2, v5
               Return v5
@@ -4957,9 +4972,9 @@ mod tests {
         assert_method_hir_with_opcode("reverse_odd", YARVINSN_opt_reverse, expect![[r#"
             fn reverse_odd@<compiled>:3:
             bb0(v0:BasicObject):
-              v1:NilClassExact = Const Value(nil)
-              v2:NilClassExact = Const Value(nil)
-              v3:NilClassExact = Const Value(nil)
+              v1:NilClass = Const Value(nil)
+              v2:NilClass = Const Value(nil)
+              v3:NilClass = Const Value(nil)
               v6:BasicObject = GetIvar v0, :@a
               v8:BasicObject = GetIvar v0, :@b
               v10:BasicObject = GetIvar v0, :@c
@@ -4969,10 +4984,10 @@ mod tests {
         assert_method_hir_with_opcode("reverse_even", YARVINSN_opt_reverse, expect![[r#"
             fn reverse_even@<compiled>:8:
             bb0(v0:BasicObject):
-              v1:NilClassExact = Const Value(nil)
-              v2:NilClassExact = Const Value(nil)
-              v3:NilClassExact = Const Value(nil)
-              v4:NilClassExact = Const Value(nil)
+              v1:NilClass = Const Value(nil)
+              v2:NilClass = Const Value(nil)
+              v3:NilClass = Const Value(nil)
+              v4:NilClass = Const Value(nil)
               v7:BasicObject = GetIvar v0, :@a
               v9:BasicObject = GetIvar v0, :@b
               v11:BasicObject = GetIvar v0, :@c
@@ -5031,7 +5046,7 @@ mod tests {
         assert_function_hir(function, expect![[r#"
             fn start@<internal:gc>:36:
             bb0(v0:BasicObject, v1:BasicObject, v2:BasicObject, v3:BasicObject, v4:BasicObject):
-              v6:FalseClassExact = Const Value(false)
+              v6:FalseClass = Const Value(false)
               v8:BasicObject = InvokeBuiltin gc_start_internal, v0, v1, v2, v3, v6
               Return v8
         "#]]);
@@ -5045,7 +5060,7 @@ mod tests {
         assert_method_hir_with_opcode("test", YARVINSN_dupn, expect![[r#"
             fn test@<compiled>:2:
             bb0(v0:BasicObject, v1:BasicObject):
-              v3:NilClassExact = Const Value(nil)
+              v3:NilClass = Const Value(nil)
               v4:Fixnum[0] = Const Value(0)
               v5:Fixnum[1] = Const Value(1)
               v7:BasicObject = SendWithoutBlock v1, :[], v4, v5
@@ -5054,7 +5069,7 @@ mod tests {
               v10:Fixnum[2] = Const Value(2)
               v12:BasicObject = SendWithoutBlock v1, :[]=, v4, v5, v10
               Return v10
-            bb1(v14:BasicObject, v15:BasicObject, v16:NilClassExact, v17:BasicObject, v18:Fixnum[0], v19:Fixnum[1], v20:BasicObject):
+            bb1(v14:BasicObject, v15:BasicObject, v16:NilClass, v17:BasicObject, v18:Fixnum[0], v19:Fixnum[1], v20:BasicObject):
               Return v20
         "#]]);
     }
@@ -5488,7 +5503,7 @@ mod opt_tests {
         assert_optimized_method_hir("block", expect![[r#"
             fn block@<compiled>:6:
             bb0(v0:BasicObject, v1:BasicObject):
-              v3:NilClassExact = Const Value(nil)
+              v3:NilClass = Const Value(nil)
               Return v3
         "#]]);
         assert_optimized_method_hir("post", expect![[r#"
@@ -5499,7 +5514,7 @@ mod opt_tests {
         assert_optimized_method_hir("forwardable", expect![[r#"
             fn forwardable@<compiled>:7:
             bb0(v0:BasicObject, v1:BasicObject):
-              v3:NilClassExact = Const Value(nil)
+              v3:NilClass = Const Value(nil)
               Return v3
         "#]]);
     }
@@ -6185,7 +6200,7 @@ mod opt_tests {
         assert_optimized_method_hir("test", expect![[r#"
             fn test@<compiled>:3:
             bb0(v0:BasicObject):
-              v1:NilClassExact = Const Value(nil)
+              v1:NilClass = Const Value(nil)
               v4:ArrayExact = NewArray
               PatchPoint MethodRedefined(Array@0x1000, itself@0x1008, cme:0x1010)
               v7:Fixnum[1] = Const Value(1)
@@ -6206,7 +6221,7 @@ mod opt_tests {
         assert_optimized_method_hir("test", expect![[r#"
             fn test@<compiled>:4:
             bb0(v0:BasicObject):
-              v1:NilClassExact = Const Value(nil)
+              v1:NilClass = Const Value(nil)
               PatchPoint SingleRactorMode
               PatchPoint StableConstantNames(0x1000, M)
               v11:ModuleExact[VALUE(0x1008)] = Const Value(VALUE(0x1008))
@@ -6227,7 +6242,7 @@ mod opt_tests {
         assert_optimized_method_hir("test", expect![[r#"
             fn test@<compiled>:3:
             bb0(v0:BasicObject):
-              v1:NilClassExact = Const Value(nil)
+              v1:NilClass = Const Value(nil)
               v4:ArrayExact = NewArray
               PatchPoint MethodRedefined(Array@0x1000, length@0x1008, cme:0x1010)
               v7:Fixnum[5] = Const Value(5)
@@ -6327,7 +6342,7 @@ mod opt_tests {
         assert_optimized_method_hir("test", expect![[r#"
             fn test@<compiled>:3:
             bb0(v0:BasicObject):
-              v1:NilClassExact = Const Value(nil)
+              v1:NilClass = Const Value(nil)
               v4:ArrayExact = NewArray
               PatchPoint MethodRedefined(Array@0x1000, size@0x1008, cme:0x1010)
               v7:Fixnum[5] = Const Value(5)
@@ -6379,7 +6394,7 @@ mod opt_tests {
         assert_optimized_method_hir("test", expect![[r#"
             fn test@<compiled>:3:
             bb0(v0:BasicObject, v1:BasicObject):
-              v2:NilClassExact = Const Value(nil)
+              v2:NilClass = Const Value(nil)
               v4:ArrayExact[VALUE(0x1000)] = Const Value(VALUE(0x1000))
               v6:ArrayExact = ArrayDup v4
               PatchPoint MethodRedefined(Array@0x1008, first@0x1010, cme:0x1018)
@@ -6587,7 +6602,7 @@ mod opt_tests {
               PatchPoint SingleRactorMode
               PatchPoint StableConstantNames(0x1000, C)
               v20:Class[VALUE(0x1008)] = Const Value(VALUE(0x1008))
-              v4:NilClassExact = Const Value(nil)
+              v4:NilClass = Const Value(nil)
               v11:BasicObject = SendWithoutBlock v20, :new
               Return v11
         "#]]);
@@ -6610,7 +6625,7 @@ mod opt_tests {
               PatchPoint SingleRactorMode
               PatchPoint StableConstantNames(0x1000, C)
               v22:Class[VALUE(0x1008)] = Const Value(VALUE(0x1008))
-              v4:NilClassExact = Const Value(nil)
+              v4:NilClass = Const Value(nil)
               v5:Fixnum[1] = Const Value(1)
               v13:BasicObject = SendWithoutBlock v22, :new, v5
               Return v13
@@ -6744,7 +6759,7 @@ mod opt_tests {
             fn test@<compiled>:2:
             bb0(v0:BasicObject):
               v3:HashExact = NewHash
-              v4:NilClassExact = Const Value(nil)
+              v4:NilClass = Const Value(nil)
               v6:BasicObject = SendWithoutBlock v3, :freeze, v4
               Return v6
         "#]]);
@@ -6803,7 +6818,7 @@ mod opt_tests {
             fn test@<compiled>:2:
             bb0(v0:BasicObject):
               v3:ArrayExact = NewArray
-              v4:NilClassExact = Const Value(nil)
+              v4:NilClass = Const Value(nil)
               v6:BasicObject = SendWithoutBlock v3, :freeze, v4
               Return v6
         "#]]);
@@ -6864,7 +6879,7 @@ mod opt_tests {
             bb0(v0:BasicObject):
               v2:StringExact[VALUE(0x1000)] = Const Value(VALUE(0x1000))
               v3:StringExact = StringCopy v2
-              v4:NilClassExact = Const Value(nil)
+              v4:NilClass = Const Value(nil)
               v6:BasicObject = SendWithoutBlock v3, :freeze, v4
               Return v6
         "#]]);
@@ -6958,7 +6973,7 @@ mod opt_tests {
         assert_optimized_method_hir("test", expect![[r#"
             fn test@<compiled>:3:
             bb0(v0:BasicObject):
-              v3:NilClassExact = Const Value(nil)
+              v3:NilClass = Const Value(nil)
               Return v3
         "#]]);
     }
@@ -7028,7 +7043,7 @@ mod opt_tests {
               PatchPoint BOPRedefined(ARRAY_REDEFINED_OP_FLAG, BOP_FREEZE)
               v5:Fixnum[-10] = Const Value(-10)
               PatchPoint BOPRedefined(ARRAY_REDEFINED_OP_FLAG, BOP_AREF)
-              v11:NilClassExact = Const Value(nil)
+              v11:NilClass = Const Value(nil)
               Return v11
         "#]]);
     }
@@ -7045,7 +7060,7 @@ mod opt_tests {
               PatchPoint BOPRedefined(ARRAY_REDEFINED_OP_FLAG, BOP_FREEZE)
               v5:Fixnum[10] = Const Value(10)
               PatchPoint BOPRedefined(ARRAY_REDEFINED_OP_FLAG, BOP_AREF)
-              v11:NilClassExact = Const Value(nil)
+              v11:NilClass = Const Value(nil)
               Return v11
         "#]]);
     }
@@ -7129,9 +7144,9 @@ mod opt_tests {
         assert_optimized_method_hir("test", expect![[r#"
             fn test@<compiled>:2:
             bb0(v0:BasicObject):
-              v2:NilClassExact = Const Value(nil)
+              v2:NilClass = Const Value(nil)
               PatchPoint MethodRedefined(NilClass@0x1000, nil?@0x1008, cme:0x1010)
-              v7:TrueClassExact = CCall nil?@0x1038, v2
+              v7:TrueClass = CCall nil?@0x1038, v2
               Return v7
         "#]]);
     }
@@ -7147,7 +7162,7 @@ mod opt_tests {
         assert_optimized_method_hir("test", expect![[r#"
             fn test@<compiled>:3:
             bb0(v0:BasicObject):
-              v2:NilClassExact = Const Value(nil)
+              v2:NilClass = Const Value(nil)
               PatchPoint MethodRedefined(NilClass@0x1000, nil?@0x1008, cme:0x1010)
               v5:Fixnum[1] = Const Value(1)
               Return v5
@@ -7164,7 +7179,7 @@ mod opt_tests {
             bb0(v0:BasicObject):
               v2:Fixnum[1] = Const Value(1)
               PatchPoint MethodRedefined(Integer@0x1000, nil?@0x1008, cme:0x1010)
-              v7:FalseClassExact = CCall nil?@0x1038, v2
+              v7:FalseClass = CCall nil?@0x1038, v2
               Return v7
         "#]]);
     }
@@ -7198,8 +7213,8 @@ mod opt_tests {
             fn test@<compiled>:2:
             bb0(v0:BasicObject, v1:BasicObject):
               PatchPoint MethodRedefined(NilClass@0x1000, nil?@0x1008, cme:0x1010)
-              v7:NilClassExact = GuardType v1, NilClassExact
-              v8:TrueClassExact = CCall nil?@0x1038, v7
+              v7:NilClass = GuardType v1, NilClass
+              v8:TrueClass = CCall nil?@0x1038, v7
               Return v8
         "#]]);
     }
@@ -7215,8 +7230,8 @@ mod opt_tests {
             fn test@<compiled>:2:
             bb0(v0:BasicObject, v1:BasicObject):
               PatchPoint MethodRedefined(FalseClass@0x1000, nil?@0x1008, cme:0x1010)
-              v7:FalseClassExact = GuardType v1, FalseClassExact
-              v8:FalseClassExact = CCall nil?@0x1038, v7
+              v7:FalseClass = GuardType v1, FalseClass
+              v8:FalseClass = CCall nil?@0x1038, v7
               Return v8
         "#]]);
     }
@@ -7232,8 +7247,8 @@ mod opt_tests {
             fn test@<compiled>:2:
             bb0(v0:BasicObject, v1:BasicObject):
               PatchPoint MethodRedefined(TrueClass@0x1000, nil?@0x1008, cme:0x1010)
-              v7:TrueClassExact = GuardType v1, TrueClassExact
-              v8:FalseClassExact = CCall nil?@0x1038, v7
+              v7:TrueClass = GuardType v1, TrueClass
+              v8:FalseClass = CCall nil?@0x1038, v7
               Return v8
         "#]]);
     }
@@ -7250,7 +7265,7 @@ mod opt_tests {
             bb0(v0:BasicObject, v1:BasicObject):
               PatchPoint MethodRedefined(Symbol@0x1000, nil?@0x1008, cme:0x1010)
               v7:StaticSymbol = GuardType v1, StaticSymbol
-              v8:FalseClassExact = CCall nil?@0x1038, v7
+              v8:FalseClass = CCall nil?@0x1038, v7
               Return v8
         "#]]);
     }
@@ -7267,7 +7282,7 @@ mod opt_tests {
             bb0(v0:BasicObject, v1:BasicObject):
               PatchPoint MethodRedefined(Integer@0x1000, nil?@0x1008, cme:0x1010)
               v7:Fixnum = GuardType v1, Fixnum
-              v8:FalseClassExact = CCall nil?@0x1038, v7
+              v8:FalseClass = CCall nil?@0x1038, v7
               Return v8
         "#]]);
     }
@@ -7284,7 +7299,7 @@ mod opt_tests {
             bb0(v0:BasicObject, v1:BasicObject):
               PatchPoint MethodRedefined(Float@0x1000, nil?@0x1008, cme:0x1010)
               v7:Flonum = GuardType v1, Flonum
-              v8:FalseClassExact = CCall nil?@0x1038, v7
+              v8:FalseClass = CCall nil?@0x1038, v7
               Return v8
         "#]]);
     }
@@ -7301,7 +7316,7 @@ mod opt_tests {
             bb0(v0:BasicObject, v1:BasicObject):
               PatchPoint MethodRedefined(String@0x1000, nil?@0x1008, cme:0x1010)
               v7:StringExact = GuardType v1, StringExact
-              v8:FalseClassExact = CCall nil?@0x1038, v7
+              v8:FalseClass = CCall nil?@0x1038, v7
               Return v8
         "#]]);
     }
diff --git a/zjit/src/hir_type/gen_hir_type.rb b/zjit/src/hir_type/gen_hir_type.rb
index 361026e101a939..685767898221e6 100644
--- a/zjit/src/hir_type/gen_hir_type.rb
+++ b/zjit/src/hir_type/gen_hir_type.rb
@@ -68,6 +68,13 @@ def base_type name
   [type, exact]
 end
 
+# Define a new type that cannot be subclassed.
+def final_type name
+  type = $object.subtype name
+  $builtin_exact << type.name
+  type
+end
+
 base_type "String"
 base_type "Array"
 base_type "Hash"
@@ -77,24 +84,24 @@ def base_type name
 module_class, _ = base_type "Module"
 module_class.subtype "Class"
 
-_, integer_exact = base_type "Integer"
+integer_exact = final_type "Integer"
 # CRuby partitions Integer into immediate and non-immediate variants.
 fixnum = integer_exact.subtype "Fixnum"
 integer_exact.subtype "Bignum"
 
-_, float_exact = base_type "Float"
+float_exact = final_type "Float"
 # CRuby partitions Float into immediate and non-immediate variants.
 flonum = float_exact.subtype "Flonum"
 float_exact.subtype "HeapFloat"
 
-_, symbol_exact = base_type "Symbol"
+symbol_exact = final_type "Symbol"
 # CRuby partitions Symbol into immediate and non-immediate variants.
 static_sym = symbol_exact.subtype "StaticSymbol"
 symbol_exact.subtype "DynamicSymbol"
 
-_, nil_exact = base_type "NilClass"
-_, true_exact = base_type "TrueClass"
-_, false_exact = base_type "FalseClass"
+nil_exact = final_type "NilClass"
+true_exact = final_type "TrueClass"
+false_exact = final_type "FalseClass"
 
 # Build the cvalue object universe. This is for C-level types that may be
 # passed around when calling into the Ruby VM or after some strength reduction
diff --git a/zjit/src/hir_type/hir_type.inc.rs b/zjit/src/hir_type/hir_type.inc.rs
index 21ef8c8bdd4a03..68039c7f533b82 100644
--- a/zjit/src/hir_type/hir_type.inc.rs
+++ b/zjit/src/hir_type/hir_type.inc.rs
@@ -8,8 +8,8 @@ mod bits {
   pub const BasicObjectExact: u64 = 1u64 << 2;
   pub const BasicObjectSubclass: u64 = 1u64 << 3;
   pub const Bignum: u64 = 1u64 << 4;
-  pub const BoolExact: u64 = FalseClassExact | TrueClassExact;
-  pub const BuiltinExact: u64 = ArrayExact | BasicObjectExact | FalseClassExact | FloatExact | HashExact | IntegerExact | ModuleExact | NilClassExact | ObjectExact | RangeExact | RegexpExact | SetExact | StringExact | SymbolExact | TrueClassExact;
+  pub const BoolExact: u64 = FalseClass | TrueClass;
+  pub const BuiltinExact: u64 = ArrayExact | BasicObjectExact | FalseClass | Float | HashExact | Integer | ModuleExact | NilClass | ObjectExact | RangeExact | RegexpExact | SetExact | StringExact | Symbol | TrueClass;
   pub const CBool: u64 = 1u64 << 5;
   pub const CDouble: u64 = 1u64 << 6;
   pub const CInt: u64 = CSigned | CUnsigned;
@@ -30,72 +30,56 @@ mod bits {
   pub const Class: u64 = 1u64 << 18;
   pub const DynamicSymbol: u64 = 1u64 << 19;
   pub const Empty: u64 = 0u64;
-  pub const FalseClass: u64 = FalseClassExact | FalseClassSubclass;
-  pub const FalseClassExact: u64 = 1u64 << 20;
-  pub const FalseClassSubclass: u64 = 1u64 << 21;
-  pub const Fixnum: u64 = 1u64 << 22;
-  pub const Float: u64 = FloatExact | FloatSubclass;
-  pub const FloatExact: u64 = Flonum | HeapFloat;
-  pub const FloatSubclass: u64 = 1u64 << 23;
-  pub const Flonum: u64 = 1u64 << 24;
+  pub const FalseClass: u64 = 1u64 << 20;
+  pub const Fixnum: u64 = 1u64 << 21;
+  pub const Float: u64 = Flonum | HeapFloat;
+  pub const Flonum: u64 = 1u64 << 22;
   pub const Hash: u64 = HashExact | HashSubclass;
-  pub const HashExact: u64 = 1u64 << 25;
-  pub const HashSubclass: u64 = 1u64 << 26;
-  pub const HeapFloat: u64 = 1u64 << 27;
-  pub const Immediate: u64 = FalseClassExact | Fixnum | Flonum | NilClassExact | StaticSymbol | TrueClassExact | Undef;
-  pub const Integer: u64 = IntegerExact | IntegerSubclass;
-  pub const IntegerExact: u64 = Bignum | Fixnum;
-  pub const IntegerSubclass: u64 = 1u64 << 28;
+  pub const HashExact: u64 = 1u64 << 23;
+  pub const HashSubclass: u64 = 1u64 << 24;
+  pub const HeapFloat: u64 = 1u64 << 25;
+  pub const Immediate: u64 = FalseClass | Fixnum | Flonum | NilClass | StaticSymbol | TrueClass | Undef;
+  pub const Integer: u64 = Bignum | Fixnum;
   pub const Module: u64 = Class | ModuleExact | ModuleSubclass;
-  pub const ModuleExact: u64 = 1u64 << 29;
-  pub const ModuleSubclass: u64 = 1u64 << 30;
-  pub const NilClass: u64 = NilClassExact | NilClassSubclass;
-  pub const NilClassExact: u64 = 1u64 << 31;
-  pub const NilClassSubclass: u64 = 1u64 << 32;
+  pub const ModuleExact: u64 = 1u64 << 26;
+  pub const ModuleSubclass: u64 = 1u64 << 27;
+  pub const NilClass: u64 = 1u64 << 28;
   pub const Object: u64 = Array | FalseClass | Float | Hash | Integer | Module | NilClass | ObjectExact | ObjectSubclass | Range | Regexp | Set | String | Symbol | TrueClass;
-  pub const ObjectExact: u64 = 1u64 << 33;
-  pub const ObjectSubclass: u64 = 1u64 << 34;
+  pub const ObjectExact: u64 = 1u64 << 29;
+  pub const ObjectSubclass: u64 = 1u64 << 30;
   pub const Range: u64 = RangeExact | RangeSubclass;
-  pub const RangeExact: u64 = 1u64 << 35;
-  pub const RangeSubclass: u64 = 1u64 << 36;
+  pub const RangeExact: u64 = 1u64 << 31;
+  pub const RangeSubclass: u64 = 1u64 << 32;
   pub const Regexp: u64 = RegexpExact | RegexpSubclass;
-  pub const RegexpExact: u64 = 1u64 << 37;
-  pub const RegexpSubclass: u64 = 1u64 << 38;
+  pub const RegexpExact: u64 = 1u64 << 33;
+  pub const RegexpSubclass: u64 = 1u64 << 34;
   pub const RubyValue: u64 = BasicObject | CallableMethodEntry | Undef;
   pub const Set: u64 = SetExact | SetSubclass;
-  pub const SetExact: u64 = 1u64 << 39;
-  pub const SetSubclass: u64 = 1u64 << 40;
-  pub const StaticSymbol: u64 = 1u64 << 41;
+  pub const SetExact: u64 = 1u64 << 35;
+  pub const SetSubclass: u64 = 1u64 << 36;
+  pub const StaticSymbol: u64 = 1u64 << 37;
   pub const String: u64 = StringExact | StringSubclass;
-  pub const StringExact: u64 = 1u64 << 42;
-  pub const StringSubclass: u64 = 1u64 << 43;
-  pub const Subclass: u64 = ArraySubclass | BasicObjectSubclass | FalseClassSubclass | FloatSubclass | HashSubclass | IntegerSubclass | ModuleSubclass | NilClassSubclass | ObjectSubclass | RangeSubclass | RegexpSubclass | SetSubclass | StringSubclass | SymbolSubclass | TrueClassSubclass;
-  pub const Symbol: u64 = SymbolExact | SymbolSubclass;
-  pub const SymbolExact: u64 = DynamicSymbol | StaticSymbol;
-  pub const SymbolSubclass: u64 = 1u64 << 44;
-  pub const TrueClass: u64 = TrueClassExact | TrueClassSubclass;
-  pub const TrueClassExact: u64 = 1u64 << 45;
-  pub const TrueClassSubclass: u64 = 1u64 << 46;
-  pub const Undef: u64 = 1u64 << 47;
-  pub const AllBitPatterns: [(&'static str, u64); 77] = [
+  pub const StringExact: u64 = 1u64 << 38;
+  pub const StringSubclass: u64 = 1u64 << 39;
+  pub const Subclass: u64 = ArraySubclass | BasicObjectSubclass | HashSubclass | ModuleSubclass | ObjectSubclass | RangeSubclass | RegexpSubclass | SetSubclass | StringSubclass;
+  pub const Symbol: u64 = DynamicSymbol | StaticSymbol;
+  pub const TrueClass: u64 = 1u64 << 40;
+  pub const Undef: u64 = 1u64 << 41;
+  pub const AllBitPatterns: [(&'static str, u64); 65] = [
     ("Any", Any),
     ("RubyValue", RubyValue),
     ("Immediate", Immediate),
     ("Undef", Undef),
     ("BasicObject", BasicObject),
     ("Object", Object),
-    ("TrueClass", TrueClass),
-    ("Subclass", Subclass),
-    ("TrueClassSubclass", TrueClassSubclass),
     ("BuiltinExact", BuiltinExact),
     ("BoolExact", BoolExact),
-    ("TrueClassExact", TrueClassExact),
-    ("Symbol", Symbol),
-    ("SymbolSubclass", SymbolSubclass),
+    ("TrueClass", TrueClass),
     ("String", String),
+    ("Subclass", Subclass),
     ("StringSubclass", StringSubclass),
     ("StringExact", StringExact),
-    ("SymbolExact", SymbolExact),
+    ("Symbol", Symbol),
     ("StaticSymbol", StaticSymbol),
     ("Set", Set),
     ("SetSubclass", SetSubclass),
@@ -109,26 +93,18 @@ mod bits {
     ("ObjectSubclass", ObjectSubclass),
     ("ObjectExact", ObjectExact),
     ("NilClass", NilClass),
-    ("NilClassSubclass", NilClassSubclass),
-    ("NilClassExact", NilClassExact),
     ("Module", Module),
     ("ModuleSubclass", ModuleSubclass),
     ("ModuleExact", ModuleExact),
-    ("Integer", Integer),
-    ("IntegerSubclass", IntegerSubclass),
     ("Float", Float),
-    ("FloatExact", FloatExact),
     ("HeapFloat", HeapFloat),
     ("Hash", Hash),
     ("HashSubclass", HashSubclass),
     ("HashExact", HashExact),
     ("Flonum", Flonum),
-    ("FloatSubclass", FloatSubclass),
-    ("IntegerExact", IntegerExact),
+    ("Integer", Integer),
     ("Fixnum", Fixnum),
     ("FalseClass", FalseClass),
-    ("FalseClassSubclass", FalseClassSubclass),
-    ("FalseClassExact", FalseClassExact),
     ("DynamicSymbol", DynamicSymbol),
     ("Class", Class),
     ("CallableMethodEntry", CallableMethodEntry),
@@ -156,7 +132,7 @@ mod bits {
     ("ArrayExact", ArrayExact),
     ("Empty", Empty),
   ];
-  pub const NumTypeBits: u64 = 48;
+  pub const NumTypeBits: u64 = 42;
 }
 pub mod types {
   use super::*;
@@ -191,12 +167,8 @@ pub mod types {
   pub const DynamicSymbol: Type = Type::from_bits(bits::DynamicSymbol);
   pub const Empty: Type = Type::from_bits(bits::Empty);
   pub const FalseClass: Type = Type::from_bits(bits::FalseClass);
-  pub const FalseClassExact: Type = Type::from_bits(bits::FalseClassExact);
-  pub const FalseClassSubclass: Type = Type::from_bits(bits::FalseClassSubclass);
   pub const Fixnum: Type = Type::from_bits(bits::Fixnum);
   pub const Float: Type = Type::from_bits(bits::Float);
-  pub const FloatExact: Type = Type::from_bits(bits::FloatExact);
-  pub const FloatSubclass: Type = Type::from_bits(bits::FloatSubclass);
   pub const Flonum: Type = Type::from_bits(bits::Flonum);
   pub const Hash: Type = Type::from_bits(bits::Hash);
   pub const HashExact: Type = Type::from_bits(bits::HashExact);
@@ -204,14 +176,10 @@ pub mod types {
   pub const HeapFloat: Type = Type::from_bits(bits::HeapFloat);
   pub const Immediate: Type = Type::from_bits(bits::Immediate);
   pub const Integer: Type = Type::from_bits(bits::Integer);
-  pub const IntegerExact: Type = Type::from_bits(bits::IntegerExact);
-  pub const IntegerSubclass: Type = Type::from_bits(bits::IntegerSubclass);
   pub const Module: Type = Type::from_bits(bits::Module);
   pub const ModuleExact: Type = Type::from_bits(bits::ModuleExact);
   pub const ModuleSubclass: Type = Type::from_bits(bits::ModuleSubclass);
   pub const NilClass: Type = Type::from_bits(bits::NilClass);
-  pub const NilClassExact: Type = Type::from_bits(bits::NilClassExact);
-  pub const NilClassSubclass: Type = Type::from_bits(bits::NilClassSubclass);
   pub const Object: Type = Type::from_bits(bits::Object);
   pub const ObjectExact: Type = Type::from_bits(bits::ObjectExact);
   pub const ObjectSubclass: Type = Type::from_bits(bits::ObjectSubclass);
@@ -231,10 +199,6 @@ pub mod types {
   pub const StringSubclass: Type = Type::from_bits(bits::StringSubclass);
   pub const Subclass: Type = Type::from_bits(bits::Subclass);
   pub const Symbol: Type = Type::from_bits(bits::Symbol);
-  pub const SymbolExact: Type = Type::from_bits(bits::SymbolExact);
-  pub const SymbolSubclass: Type = Type::from_bits(bits::SymbolSubclass);
   pub const TrueClass: Type = Type::from_bits(bits::TrueClass);
-  pub const TrueClassExact: Type = Type::from_bits(bits::TrueClassExact);
-  pub const TrueClassSubclass: Type = Type::from_bits(bits::TrueClassSubclass);
   pub const Undef: Type = Type::from_bits(bits::Undef);
 }
diff --git a/zjit/src/hir_type/mod.rs b/zjit/src/hir_type/mod.rs
index 35d8866844d167..9ad0bdc6492826 100644
--- a/zjit/src/hir_type/mod.rs
+++ b/zjit/src/hir_type/mod.rs
@@ -72,7 +72,7 @@ fn write_spec(f: &mut std::fmt::Formatter, printer: &TypePrinter) -> std::fmt::R
     match ty.spec {
         Specialization::Any | Specialization::Empty => { Ok(()) },
         Specialization::Object(val) if val == unsafe { rb_mRubyVMFrozenCore } => write!(f, "[VMFrozenCore]"),
-        Specialization::Object(val) if ty.is_subtype(types::SymbolExact) => write!(f, "[:{}]", ruby_sym_to_rust_string(val)),
+        Specialization::Object(val) if ty.is_subtype(types::Symbol) => write!(f, "[:{}]", ruby_sym_to_rust_string(val)),
         Specialization::Object(val) => write!(f, "[{}]", val.print(printer.ptr_map)),
         Specialization::Type(val) => write!(f, "[class:{}]", get_class_name(val)),
         Specialization::TypeExact(val) => write!(f, "[class_exact:{}]", get_class_name(val)),
@@ -169,7 +169,7 @@ impl Type {
 
     /// Create a `Type` from a Ruby `VALUE`. The type is not guaranteed to have object
     /// specialization in its `specialization` field (for example, `Qnil` will just be
-    /// `types::NilClassExact`), but will be available via `ruby_object()`.
+    /// `types::NilClass`), but will be available via `ruby_object()`.
     pub fn from_value(val: VALUE) -> Type {
         if val.fixnum_p() {
             Type { bits: bits::Fixnum, spec: Specialization::Object(val) }
@@ -181,9 +181,9 @@ impl Type {
             Type { bits: bits::StaticSymbol, spec: Specialization::Object(val) }
         }
         // Singleton objects; don't specialize
-        else if val == Qnil { types::NilClassExact }
-        else if val == Qtrue { types::TrueClassExact }
-        else if val == Qfalse { types::FalseClassExact }
+        else if val == Qnil { types::NilClass }
+        else if val == Qtrue { types::TrueClass }
+        else if val == Qfalse { types::FalseClass }
         else if val.cme_p() {
             // NB: Checking for CME has to happen before looking at class_of because that's not
             // valid on imemo.
@@ -266,12 +266,12 @@ impl Type {
 
     /// Return true if the value with this type is definitely truthy.
     pub fn is_known_truthy(&self) -> bool {
-        !self.could_be(types::NilClassExact) && !self.could_be(types::FalseClassExact)
+        !self.could_be(types::NilClass) && !self.could_be(types::FalseClass)
     }
 
     /// Return true if the value with this type is definitely falsy.
     pub fn is_known_falsy(&self) -> bool {
-        self.is_subtype(types::NilClassExact) || self.is_subtype(types::FalseClassExact)
+        self.is_subtype(types::NilClass) || self.is_subtype(types::FalseClass)
     }
 
     /// Top self is the Ruby global object, where top-level method definitions go. Return true if
@@ -431,7 +431,7 @@ impl Type {
     }
 
     /// Return a pointer to the Ruby class that an object of this Type would have at run-time, if
-    /// known. This includes classes for HIR types such as ArrayExact or NilClassExact, which have
+    /// known. This includes classes for HIR types such as ArrayExact or NilClass, which have
     /// canonical Type representations that lack an explicit specialization in their `spec` fields.
     pub fn runtime_exact_ruby_class(&self) -> Option<VALUE> {
         if let Some(val) = self.exact_ruby_class() {
@@ -439,19 +439,19 @@ impl Type {
         }
         if self.is_subtype(types::ArrayExact) { return Some(unsafe { rb_cArray }); }
         if self.is_subtype(types::Class) { return Some(unsafe { rb_cClass }); }
-        if self.is_subtype(types::FalseClassExact) { return Some(unsafe { rb_cFalseClass }); }
-        if self.is_subtype(types::FloatExact) { return Some(unsafe { rb_cFloat }); }
+        if self.is_subtype(types::FalseClass) { return Some(unsafe { rb_cFalseClass }); }
+        if self.is_subtype(types::Float) { return Some(unsafe { rb_cFloat }); }
         if self.is_subtype(types::HashExact) { return Some(unsafe { rb_cHash }); }
-        if self.is_subtype(types::IntegerExact) { return Some(unsafe { rb_cInteger }); }
+        if self.is_subtype(types::Integer) { return Some(unsafe { rb_cInteger }); }
         if self.is_subtype(types::ModuleExact) { return Some(unsafe { rb_cModule }); }
-        if self.is_subtype(types::NilClassExact) { return Some(unsafe { rb_cNilClass }); }
+        if self.is_subtype(types::NilClass) { return Some(unsafe { rb_cNilClass }); }
         if self.is_subtype(types::ObjectExact) { return Some(unsafe { rb_cObject }); }
         if self.is_subtype(types::RangeExact) { return Some(unsafe { rb_cRange }); }
         if self.is_subtype(types::RegexpExact) { return Some(unsafe { rb_cRegexp }); }
         if self.is_subtype(types::SetExact) { return Some(unsafe { rb_cSet }); }
         if self.is_subtype(types::StringExact) { return Some(unsafe { rb_cString }); }
-        if self.is_subtype(types::SymbolExact) { return Some(unsafe { rb_cSymbol }); }
-        if self.is_subtype(types::TrueClassExact) { return Some(unsafe { rb_cTrueClass }); }
+        if self.is_subtype(types::Symbol) { return Some(unsafe { rb_cSymbol }); }
+        if self.is_subtype(types::TrueClass) { return Some(unsafe { rb_cTrueClass }); }
         None
     }
 
@@ -520,7 +520,7 @@ mod tests {
     #[test]
     fn empty_is_subtype_of_everything() {
         // Spot check a few cases
-        assert_subtype(types::Empty, types::NilClassExact);
+        assert_subtype(types::Empty, types::NilClass);
         assert_subtype(types::Empty, types::Array);
         assert_subtype(types::Empty, types::Object);
         assert_subtype(types::Empty, types::CUInt16);
@@ -532,7 +532,7 @@ mod tests {
     #[test]
     fn everything_is_a_subtype_of_any() {
         // Spot check a few cases
-        assert_subtype(types::NilClassExact, types::Any);
+        assert_subtype(types::NilClass, types::Any);
         assert_subtype(types::Array, types::Any);
         assert_subtype(types::Object, types::Any);
         assert_subtype(types::CUInt16, types::Any);
@@ -547,26 +547,20 @@ mod tests {
         assert_subtype(Type::fixnum(123), Type::fixnum(123));
         assert_not_subtype(Type::fixnum(123), Type::fixnum(200));
         assert_subtype(Type::from_value(VALUE::fixnum_from_usize(123)), types::Fixnum);
-        assert_subtype(types::Fixnum, types::IntegerExact);
-        assert_subtype(types::Bignum, types::IntegerExact);
-        assert_subtype(types::IntegerExact, types::Integer);
-        assert_subtype(types::IntegerSubclass, types::Integer);
+        assert_subtype(types::Fixnum, types::Integer);
+        assert_subtype(types::Bignum, types::Integer);
     }
 
     #[test]
     fn float() {
-        assert_subtype(types::Flonum, types::FloatExact);
-        assert_subtype(types::HeapFloat, types::FloatExact);
-        assert_subtype(types::FloatExact, types::Float);
-        assert_subtype(types::FloatSubclass, types::Float);
+        assert_subtype(types::Flonum, types::Float);
+        assert_subtype(types::HeapFloat, types::Float);
     }
 
     #[test]
     fn symbol() {
-        assert_subtype(types::StaticSymbol, types::SymbolExact);
-        assert_subtype(types::DynamicSymbol, types::SymbolExact);
-        assert_subtype(types::SymbolExact, types::Symbol);
-        assert_subtype(types::SymbolSubclass, types::Symbol);
+        assert_subtype(types::StaticSymbol, types::Symbol);
+        assert_subtype(types::DynamicSymbol, types::Symbol);
     }
 
     #[test]
@@ -574,12 +568,9 @@ mod tests {
         assert_subtype(Type::fixnum(123), types::Immediate);
         assert_subtype(types::Fixnum, types::Immediate);
         assert_not_subtype(types::Bignum, types::Immediate);
-        assert_subtype(types::NilClassExact, types::Immediate);
-        assert_subtype(types::TrueClassExact, types::Immediate);
-        assert_subtype(types::FalseClassExact, types::Immediate);
-        assert_not_subtype(types::NilClassSubclass, types::Immediate);
-        assert_not_subtype(types::TrueClassSubclass, types::Immediate);
-        assert_not_subtype(types::FalseClassSubclass, types::Immediate);
+        assert_subtype(types::NilClass, types::Immediate);
+        assert_subtype(types::TrueClass, types::Immediate);
+        assert_subtype(types::FalseClass, types::Immediate);
         assert_subtype(types::StaticSymbol, types::Immediate);
         assert_not_subtype(types::DynamicSymbol, types::Immediate);
         assert_subtype(types::Flonum, types::Immediate);
@@ -590,53 +581,50 @@ mod tests {
     fn fixnum_has_ruby_object() {
         assert_eq!(Type::fixnum(3).ruby_object(), Some(VALUE::fixnum_from_usize(3)));
         assert_eq!(types::Fixnum.ruby_object(), None);
-        assert_eq!(types::IntegerExact.ruby_object(), None);
         assert_eq!(types::Integer.ruby_object(), None);
     }
 
     #[test]
     fn singletons_do_not_have_ruby_object() {
         assert_eq!(Type::from_value(Qnil).ruby_object(), None);
-        assert_eq!(types::NilClassExact.ruby_object(), None);
+        assert_eq!(types::NilClass.ruby_object(), None);
         assert_eq!(Type::from_value(Qtrue).ruby_object(), None);
-        assert_eq!(types::TrueClassExact.ruby_object(), None);
+        assert_eq!(types::TrueClass.ruby_object(), None);
         assert_eq!(Type::from_value(Qfalse).ruby_object(), None);
-        assert_eq!(types::FalseClassExact.ruby_object(), None);
+        assert_eq!(types::FalseClass.ruby_object(), None);
     }
 
     #[test]
     fn integer_has_exact_ruby_class() {
         assert_eq!(Type::fixnum(3).exact_ruby_class(), Some(unsafe { rb_cInteger }.into()));
         assert_eq!(types::Fixnum.exact_ruby_class(), None);
-        assert_eq!(types::IntegerExact.exact_ruby_class(), None);
         assert_eq!(types::Integer.exact_ruby_class(), None);
     }
 
     #[test]
     fn singletons_do_not_have_exact_ruby_class() {
         assert_eq!(Type::from_value(Qnil).exact_ruby_class(), None);
-        assert_eq!(types::NilClassExact.exact_ruby_class(), None);
+        assert_eq!(types::NilClass.exact_ruby_class(), None);
         assert_eq!(Type::from_value(Qtrue).exact_ruby_class(), None);
-        assert_eq!(types::TrueClassExact.exact_ruby_class(), None);
+        assert_eq!(types::TrueClass.exact_ruby_class(), None);
         assert_eq!(Type::from_value(Qfalse).exact_ruby_class(), None);
-        assert_eq!(types::FalseClassExact.exact_ruby_class(), None);
+        assert_eq!(types::FalseClass.exact_ruby_class(), None);
     }
 
     #[test]
     fn singletons_do_not_have_ruby_class() {
         assert_eq!(Type::from_value(Qnil).inexact_ruby_class(), None);
-        assert_eq!(types::NilClassExact.inexact_ruby_class(), None);
+        assert_eq!(types::NilClass.inexact_ruby_class(), None);
         assert_eq!(Type::from_value(Qtrue).inexact_ruby_class(), None);
-        assert_eq!(types::TrueClassExact.inexact_ruby_class(), None);
+        assert_eq!(types::TrueClass.inexact_ruby_class(), None);
         assert_eq!(Type::from_value(Qfalse).inexact_ruby_class(), None);
-        assert_eq!(types::FalseClassExact.inexact_ruby_class(), None);
+        assert_eq!(types::FalseClass.inexact_ruby_class(), None);
     }
 
     #[test]
     fn integer_has_ruby_class() {
         assert_eq!(Type::fixnum(3).inexact_ruby_class(), Some(unsafe { rb_cInteger }.into()));
         assert_eq!(types::Fixnum.inexact_ruby_class(), None);
-        assert_eq!(types::IntegerExact.inexact_ruby_class(), None);
         assert_eq!(types::Integer.inexact_ruby_class(), None);
     }
 
@@ -670,7 +658,6 @@ mod tests {
         assert_eq!(format!("{}", Type::from_cbool(false)), "CBool[false]");
         assert_eq!(format!("{}", types::Fixnum), "Fixnum");
         assert_eq!(format!("{}", types::Integer), "Integer");
-        assert_eq!(format!("{}", types::IntegerExact), "IntegerExact");
     }
 
     #[test]
@@ -688,12 +675,10 @@ mod tests {
 
     #[test]
     fn union_bits_subtype() {
-        assert_bit_equal(types::Fixnum.union(types::IntegerExact), types::IntegerExact);
         assert_bit_equal(types::Fixnum.union(types::Integer), types::Integer);
         assert_bit_equal(types::Fixnum.union(types::Object), types::Object);
         assert_bit_equal(Type::fixnum(3).union(types::Fixnum), types::Fixnum);
 
-        assert_bit_equal(types::IntegerExact.union(types::Fixnum), types::IntegerExact);
         assert_bit_equal(types::Integer.union(types::Fixnum), types::Integer);
         assert_bit_equal(types::Object.union(types::Fixnum), types::Object);
         assert_bit_equal(types::Fixnum.union(Type::fixnum(3)), types::Fixnum);
diff --git a/zjit/src/invariants.rs b/zjit/src/invariants.rs
index 6949da6a86a007..25cffb970e62dc 100644
--- a/zjit/src/invariants.rs
+++ b/zjit/src/invariants.rs
@@ -1,6 +1,6 @@
 use std::{collections::{HashMap, HashSet}};
 
-use crate::{backend::lir::{asm_comment, Assembler}, cruby::{rb_callable_method_entry_t, ruby_basic_operators, src_loc, with_vm_lock, IseqPtr, RedefinitionFlag}, hir::Invariant, options::debug, state::{zjit_enabled_p, ZJITState}, virtualmem::CodePtr};
+use crate::{backend::lir::{asm_comment, Assembler}, cruby::{rb_callable_method_entry_t, ruby_basic_operators, src_loc, with_vm_lock, IseqPtr, RedefinitionFlag, ID}, hir::Invariant, options::debug, state::{zjit_enabled_p, ZJITState}, virtualmem::CodePtr};
 
 #[derive(Debug, Eq, Hash, PartialEq)]
 struct Jump {
@@ -23,6 +23,9 @@ pub struct Invariants {
 
     /// Map from CME to patch points that assume the method hasn't been redefined
     cme_patch_points: HashMap<*const rb_callable_method_entry_t, HashSet<Jump>>,
+
+    /// Map from constant ID to patch points that assume the constant hasn't been redefined
+    constant_state_patch_points: HashMap<ID, HashSet<Jump>>,
 }
 
 /// Called when a basic operator is redefined. Note that all the blocks assuming
@@ -116,6 +119,30 @@ pub fn track_cme_assumption(
     });
 }
 
+/// Track a patch point for each constant name in a constant path assumption.
+pub fn track_stable_constant_names_assumption(
+    idlist: *const ID,
+    patch_point_ptr: CodePtr,
+    side_exit_ptr: CodePtr
+) {
+    let invariants = ZJITState::get_invariants();
+
+    let mut idx = 0;
+    loop {
+        let id = unsafe { *idlist.wrapping_add(idx) };
+        if id.0 == 0 {
+            break;
+        }
+
+        invariants.constant_state_patch_points.entry(id).or_default().insert(Jump {
+            from: patch_point_ptr,
+            to: side_exit_ptr,
+        });
+
+        idx += 1;
+    }
+}
+
 /// Called when a method is redefined. Invalidates all JIT code that depends on the CME.
 #[unsafe(no_mangle)]
 pub extern "C" fn rb_zjit_cme_invalidate(cme: *const rb_callable_method_entry_t) {
@@ -144,3 +171,32 @@ pub extern "C" fn rb_zjit_cme_invalidate(cme: *const rb_callable_method_entry_t)
         }
     });
 }
+
+/// Called when a constant is redefined. Invalidates all JIT code that depends on the constant.
+#[unsafe(no_mangle)]
+pub extern "C" fn rb_zjit_constant_state_changed(id: ID) {
+    // If ZJIT isn't enabled, do nothing
+    if !zjit_enabled_p() {
+        return;
+    }
+
+    with_vm_lock(src_loc!(), || {
+        let invariants = ZJITState::get_invariants();
+        if let Some(jumps) = invariants.constant_state_patch_points.get(&id) {
+            let cb = ZJITState::get_code_block();
+            debug!("Constant state changed: {:?}", id);
+
+            // Invalidate all patch points for this constant ID
+            for jump in jumps {
+                cb.with_write_ptr(jump.from, |cb| {
+                    let mut asm = Assembler::new();
+                    asm_comment!(asm, "Constant state changed: {:?}", id);
+                    asm.jmp(jump.to.into());
+                    asm.compile(cb).expect("can write existing code");
+                });
+            }
+
+            cb.mark_all_executable();
+        }
+    });
+}
diff --git a/zjit/src/options.rs b/zjit/src/options.rs
index e97c5ff99fd3be..bb26cc2deeb27e 100644
--- a/zjit/src/options.rs
+++ b/zjit/src/options.rs
@@ -1,5 +1,7 @@
 use std::{ffi::{CStr, CString}, ptr::null};
 use std::os::raw::{c_char, c_int, c_uint};
+use crate::cruby::*;
+use std::collections::HashSet;
 
 /// Number of calls to start profiling YARV instructions.
 /// They are profiled `rb_zjit_call_threshold - rb_zjit_profile_threshold` times,
@@ -14,11 +16,18 @@ pub static mut rb_zjit_profile_threshold: u64 = 1;
 #[allow(non_upper_case_globals)]
 pub static mut rb_zjit_call_threshold: u64 = 2;
 
-#[derive(Clone, Copy, Debug)]
+/// True if --zjit-stats is enabled.
+#[allow(non_upper_case_globals)]
+static mut zjit_stats_enabled_p: bool = false;
+
+#[derive(Clone, Debug)]
 pub struct Options {
     /// Number of times YARV instructions should be profiled.
     pub num_profiles: u8,
 
+    /// Enable YJIT statsitics
+    pub stats: bool,
+
     /// Enable debug logging
     pub debug: bool,
 
@@ -36,18 +45,27 @@ pub struct Options {
 
     /// Dump code map to /tmp for performance profilers.
     pub perf: bool,
+
+    /// List of ISEQs that can be compiled, identified by their iseq_get_location()
+    pub allowed_iseqs: Option<HashSet<String>>,
+
+    /// Path to a file where compiled ISEQs will be saved.
+    pub log_compiled_iseqs: Option<String>,
 }
 
 /// Return an Options with default values
 pub fn init_options() -> Options {
     Options {
         num_profiles: 1,
+        stats: false,
         debug: false,
         dump_hir_init: None,
         dump_hir_opt: None,
         dump_lir: false,
         dump_disasm: false,
         perf: false,
+        allowed_iseqs: None,
+        log_compiled_iseqs: None,
     }
 }
 
@@ -56,6 +74,10 @@ pub fn init_options() -> Options {
 pub const ZJIT_OPTIONS: &'static [(&str, &str)] = &[
     ("--zjit-call-threshold=num", "Number of calls to trigger JIT (default: 2)."),
     ("--zjit-num-profiles=num",   "Number of profiled calls before JIT (default: 1, max: 255)."),
+    ("--zjit-stats",              "Enable collecting ZJIT statistics."),
+    ("--zjit-perf",               "Dump ISEQ symbols into /tmp/perf-{}.map for Linux perf."),
+    ("--zjit-log-compiled-iseqs=path",
+                     "Log compiled ISEQs to the file. The file will be truncated."),
 ];
 
 #[derive(Clone, Copy, Debug)]
@@ -97,6 +119,26 @@ pub extern "C" fn rb_zjit_parse_option(options: *const u8, str_ptr: *const c_cha
     parse_option(options, str_ptr).is_some()
 }
 
+fn parse_jit_list(path_like: &str) -> HashSet<String> {
+    // Read lines from the file
+    let mut result = HashSet::new();
+    if let Ok(lines) = std::fs::read_to_string(path_like) {
+        for line in lines.lines() {
+            let trimmed = line.trim();
+            if !trimmed.is_empty() {
+                result.insert(trimmed.to_string());
+            }
+        }
+    } else {
+        eprintln!("Failed to read JIT list from '{}'", path_like);
+    }
+    eprintln!("JIT list:");
+    for item in &result {
+        eprintln!("  {}", item);
+    }
+    result
+}
+
 /// Expected to receive what comes after the third dash in "--zjit-*".
 /// Empty string means user passed only "--zjit". C code rejects when
 /// they pass exact "--zjit-".
@@ -132,6 +174,11 @@ fn parse_option(options: &mut Options, str_ptr: *const std::os::raw::c_char) ->
             Err(_) => return None,
         },
 
+        ("stats", "") => {
+            unsafe { zjit_stats_enabled_p = true; }
+            options.stats = true;
+        }
+
         ("debug", "") => options.debug = true,
 
         // --zjit-dump-hir dumps the actual input to the codegen, which is currently the same as --zjit-dump-hir-opt.
@@ -149,6 +196,19 @@ fn parse_option(options: &mut Options, str_ptr: *const std::os::raw::c_char) ->
 
         ("perf", "") => options.perf = true,
 
+        ("allowed-iseqs", _) if opt_val != "" => options.allowed_iseqs = Some(parse_jit_list(opt_val)),
+        ("log-compiled-iseqs", _) if opt_val != "" => {
+            // Truncate the file if it exists
+            std::fs::OpenOptions::new()
+                .create(true)
+                .write(true)
+                .truncate(true)
+                .open(opt_val)
+                .map_err(|e| eprintln!("Failed to open file '{}': {}", opt_val, e))
+                .ok();
+            options.log_compiled_iseqs = Some(opt_val.into());
+        }
+
         _ => return None, // Option name not recognized
     }
 
@@ -193,3 +253,15 @@ macro_rules! debug {
     };
 }
 pub(crate) use debug;
+
+/// Return Qtrue if --zjit-stats has been enabled
+#[unsafe(no_mangle)]
+pub extern "C" fn rb_zjit_stats_enabled_p(_ec: EcPtr, _self: VALUE) -> VALUE {
+    // ZJITState is not initialized yet when loading builtins, so this relies
+    // on a separate global variable.
+    if unsafe { zjit_stats_enabled_p } {
+        Qtrue
+    } else {
+        Qfalse
+    }
+}
diff --git a/zjit/src/state.rs b/zjit/src/state.rs
index 001b550747e904..ee7cd15d5fb9b1 100644
--- a/zjit/src/state.rs
+++ b/zjit/src/state.rs
@@ -1,8 +1,9 @@
-use crate::cruby::{self, rb_bug_panic_hook, EcPtr, Qnil, VALUE};
+use crate::cruby::{self, rb_bug_panic_hook, rb_vm_insns_count, EcPtr, Qnil, VALUE};
 use crate::cruby_methods;
 use crate::invariants::Invariants;
 use crate::options::Options;
 use crate::asm::CodeBlock;
+use crate::stats::Counters;
 
 #[allow(non_upper_case_globals)]
 #[unsafe(no_mangle)]
@@ -21,6 +22,9 @@ pub struct ZJITState {
     /// ZJIT command-line options
     options: Options,
 
+    /// ZJIT statistics
+    counters: Counters,
+
     /// Assumptions that require invalidation
     invariants: Invariants,
 
@@ -80,6 +84,7 @@ impl ZJITState {
         let zjit_state = ZJITState {
             code_block: cb,
             options,
+            counters: Counters::default(),
             invariants: Invariants::default(),
             assert_compiles: false,
             method_annotations: cruby_methods::init(),
@@ -126,6 +131,43 @@ impl ZJITState {
         let instance = ZJITState::get_instance();
         instance.assert_compiles = true;
     }
+
+    /// Get a mutable reference to counters for ZJIT stats
+    pub fn get_counters() -> &'static mut Counters {
+        &mut ZJITState::get_instance().counters
+    }
+
+    /// Was --zjit-save-compiled-iseqs specified?
+    pub fn should_log_compiled_iseqs() -> bool {
+        ZJITState::get_instance().options.log_compiled_iseqs.is_some()
+    }
+
+    /// Log the name of a compiled ISEQ to the file specified in options.log_compiled_iseqs
+    pub fn log_compile(iseq_name: String) {
+        assert!(ZJITState::should_log_compiled_iseqs());
+        let filename = ZJITState::get_instance().options.log_compiled_iseqs.as_ref().unwrap();
+        use std::io::Write;
+        let mut file = match std::fs::OpenOptions::new().create(true).append(true).open(filename) {
+            Ok(f) => f,
+            Err(e) => {
+                eprintln!("ZJIT: Failed to create file '{}': {}", filename, e);
+                return;
+            }
+        };
+        if let Err(e) = writeln!(file, "{}", iseq_name) {
+            eprintln!("ZJIT: Failed to write to file '{}': {}", filename, e);
+        }
+    }
+
+    /// Check if we are allowed to compile a given ISEQ based on --zjit-allowed-iseqs
+    pub fn can_compile_iseq(iseq: cruby::IseqPtr) -> bool {
+        if let Some(ref allowed_iseqs) = ZJITState::get_instance().options.allowed_iseqs {
+            let name = cruby::iseq_get_location(iseq, 0);
+            allowed_iseqs.contains(&name)
+        } else {
+            true // If no restrictions, allow all ISEQs
+        }
+    }
 }
 
 /// Initialize ZJIT, given options allocated by rb_zjit_init_options()
@@ -138,10 +180,12 @@ pub extern "C" fn rb_zjit_init(options: *const u8) {
 
         let options = unsafe { Box::from_raw(options as *mut Options) };
         ZJITState::init(*options);
-        std::mem::drop(options);
 
         rb_bug_panic_hook();
 
+        // Discard the instruction count for boot which we never compile
+        unsafe { rb_vm_insns_count = 0; }
+
         // ZJIT enabled and initialized successfully
         assert!(unsafe{ !rb_zjit_enabled_p });
         unsafe { rb_zjit_enabled_p = true; }
diff --git a/zjit/src/stats.rs b/zjit/src/stats.rs
index 06913522c4d45b..4fbad5d24701df 100644
--- a/zjit/src/stats.rs
+++ b/zjit/src/stats.rs
@@ -4,6 +4,59 @@
 //
 // Comptime vs Runtime stats?
 
+use crate::{cruby::*, options::get_option, state::{zjit_enabled_p, ZJITState}};
+
+macro_rules! make_counters {
+    ($($counter_name:ident,)+) => {
+        /// Struct containing the counter values
+        #[derive(Default, Debug)]
+        pub struct Counters { $(pub $counter_name: u64),+ }
+
+        /// Enum to represent a counter
+        #[allow(non_camel_case_types)]
+        #[derive(Clone, Copy, PartialEq, Eq, Debug)]
+        pub enum Counter { $($counter_name),+ }
+
+        /// Map a counter to a pointer
+        pub fn counter_ptr(counter: Counter) -> *mut u64 {
+            let counters = $crate::state::ZJITState::get_counters();
+            match counter {
+                $( Counter::$counter_name => std::ptr::addr_of_mut!(counters.$counter_name) ),+
+            }
+        }
+    }
+}
+
+// Declare all the counters we track
+make_counters! {
+    // The number of times YARV instructions are executed on JIT code
+    zjit_insns_count,
+}
+
 pub fn zjit_alloc_size() -> usize {
     0 // TODO: report the actual memory usage
 }
+
+/// Return a Hash object that contains ZJIT statistics
+#[unsafe(no_mangle)]
+pub extern "C" fn rb_zjit_stats(_ec: EcPtr, _self: VALUE) -> VALUE {
+    if !zjit_enabled_p() {
+        return Qnil;
+    }
+
+    fn set_stat(hash: VALUE, key: &str, value: u64) {
+        unsafe { rb_hash_aset(hash, rust_str_to_sym(key), VALUE::fixnum_from_usize(value as usize)); }
+    }
+
+    let hash = unsafe { rb_hash_new() };
+    // TODO: Set counters that are always available here
+
+    // Set counters that are enabled when --zjit-stats is enabled
+    if get_option!(stats) {
+        let counters = ZJITState::get_counters();
+        set_stat(hash, "zjit_insns_count", counters.zjit_insns_count);
+        set_stat(hash, "vm_insns_count", unsafe { rb_vm_insns_count });
+    }
+
+    hash
+}

<!DOCTYPE html PUBLIC '-//W3C//DTD XHTML 1.0 Transitional//EN' 'http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd'>
<html xmlns='http://www.w3.org/1999/xhtml'>
<head>
<title>pFad - Phonifier reborn</title>
<meta http-equiv='Content-Type' content='text/html; charset=utf-8' />
</head>
<body>
<h1>Pfad - The Proxy pFad of &#169; 2024 Garber Painting. All rights reserved.</h1>


<!-- Disclaimer -->
<p>Note: This service is not intended for secure transactions such as banking, social media, email, or purchasing. Use at your own risk. We assume no liability whatsoever for broken pages.</p>
<br>
<p>Alternative Proxies:</p><p><a href="http://rainy.clevelandohioweatherforecast.com/php-proxy/index.php?q=https://github.com/github/ruby/compare/7913aff...ruby:ruby:e2fbd01.diff" target="_blank">Alternative Proxy</a></p><p><a href="http://rainy.clevelandohioweatherforecast.com/pFad/index.php?u=https://github.com/github/ruby/compare/7913aff...ruby:ruby:e2fbd01.diff" target="_blank">pFad Proxy</a></p><p><a href="http://rainy.clevelandohioweatherforecast.com/pFad/v3index.php?u=https://github.com/github/ruby/compare/7913aff...ruby:ruby:e2fbd01.diff" target="_blank">pFad v3 Proxy</a></p><p><a href="http://rainy.clevelandohioweatherforecast.com/pFad/v4index.php?u=https://github.com/github/ruby/compare/7913aff...ruby:ruby:e2fbd01.diff" target="_blank">pFad v4 Proxy</a></p></body>
</html>