mjit_compile.c: reduce sp motion on JIT

This retries r62655, which was reverted at r63863 for r63763.

tool/ruby_vm/views/_mjit_compile_insn.erb: revert the revert.
tool/ruby_vm/views/_mjit_compile_insn_body.erb: ditto.
tool/ruby_vm/views/_mjit_compile_pc_and_sp.erb: ditto.
tool/ruby_vm/views/_mjit_compile_send.erb: ditto.
tool/ruby_vm/views/mjit_compile.inc.erb: ditto.

tool/ruby_vm/views/_insn_entry.erb: revert half of r63763. The commit
  was originally reverted since changing pc motion was bad for tracing,
  but changing sp motion was totally fine. For JIT, I wanna resurrect
  the sp motion change in r62051.
tool/ruby_vm/models/bare_instructions.rb: ditto.
insns.def: ditto.
vm_insnhelper.c: ditto.
vm_insnhelper.h: ditto.

* benchmark

$ benchmark-driver benchmark.yml --rbenv 'before;after;before --jit;after --jit' --repeat-count 12 -v
before: ruby 2.6.0dev (2018-07-19 trunk 63998) [x86_64-linux]
after: ruby 2.6.0dev (2018-07-19 add-sp 63998) [x86_64-linux]
last_commit=mjit_compile.c: reduce sp motion on JIT
before --jit: ruby 2.6.0dev (2018-07-19 trunk 63998) +JIT [x86_64-linux]
after --jit: ruby 2.6.0dev (2018-07-19 add-sp 63998) +JIT [x86_64-linux]
last_commit=mjit_compile.c: reduce sp motion on JIT
Calculating -------------------------------------
                             before       after  before --jit  after --jit
Optcarrot Lan_Master.nes     51.354      50.238        70.010       72.139 fps

Comparison:
             Optcarrot Lan_Master.nes
             after --jit:        72.1 fps
            before --jit:        70.0 fps - 1.03x  slower
                  before:        51.4 fps - 1.40x  slower
                   after:        50.2 fps - 1.44x  slower

git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@63999 b2dd03c8-39d4-4d8f-98ff-823fe69b080e

11 files changed, 112 insertions, 63 deletions

diff --git a/insns.def b/insns.def
index f048cac252..da5a771de0 100644
--- a/insns.def
+++ b/insns.def
@@ -43,6 +43,8 @@
        * sp_inc: Used to dynamically calculate sp increase in
          `insn_stack_increase`.
 
+       * handles_frame: If it is true, VM deals with sp in the insn.
+
    - Attributes can access operands, but not stack (push/pop) variables.
 
    - An instruction's body is a pure C block, copied verbatimly into
@@ -364,7 +366,6 @@ concatstrings
 // attr rb_snum_t sp_inc = 1 - num;
 {
     val = rb_str_concat_literals(num, STACK_ADDR_FROM_TOP(num));
-    POPN(num);
 }
 
 /* push the result of to_s. */
@@ -400,7 +401,6 @@ toregexp
     const VALUE ary = rb_ary_tmp_new_from_values(0, cnt, STACK_ADDR_FROM_TOP(cnt));
     val = rb_reg_new_ary(ary, (int)opt);
     rb_ary_clear(ary);
-    POPN(cnt);
 }
 
 /* intern str to Symbol and push it. */
@@ -422,7 +422,6 @@ newarray
 // attr rb_snum_t sp_inc = 1 - num;
 {
     val = rb_ary_new4(num, STACK_ADDR_FROM_TOP(num));
-    POPN(num);
 }
 
 /* dup array */
@@ -451,7 +450,7 @@ expandarray
 (...)
 // attr rb_snum_t sp_inc = num - 1 + (flag & 1 ? 1 : 0);
 {
-    vm_expandarray(GET_CFP(), ary, num, (int)flag);
+    vm_expandarray(GET_SP(), ary, num, (int)flag);
 }
 
 /* concat two arrays */
@@ -488,7 +487,6 @@ newhash
 
     if (num) {
         rb_hash_bulk_insert(num, STACK_ADDR_FROM_TOP(num), val);
-        POPN(num);
     }
 }
 
@@ -538,7 +536,6 @@ dupn
     void *dst = GET_SP();
     void *src = STACK_ADDR_FROM_TOP(n);
 
-    INC_SP(n); /* alloca */
     MEMCPY(dst, src, VALUE, n);
 }
 
@@ -601,7 +598,7 @@ setn
 (VALUE val)
 // attr rb_snum_t sp_inc = 0;
 {
-    TOPN(n - 1) = val;
+    TOPN(n) = val;
 }
 
 /* empty current stack */
@@ -612,7 +609,7 @@ adjuststack
 (...)
 // attr rb_snum_t sp_inc = -(rb_snum_t)n;
 {
-    POPN(n);
+    /* none */
 }
 
 /**********************************************************/
@@ -690,6 +687,7 @@ defineclass
 (ID id, ISEQ class_iseq, rb_num_t flags)
 (VALUE cbase, VALUE super)
 (VALUE val)
+// attr bool handles_frame = true;
 {
     VALUE klass = vm_find_or_create_class_by_id(id, flags, cbase, super);
 
@@ -716,6 +714,7 @@ send
 (CALL_INFO ci, CALL_CACHE cc, ISEQ blockiseq)
 (...)
 (VALUE val)
+// attr bool handles_frame = true;
 // attr rb_snum_t sp_inc = - (int)(ci->orig_argc + ((ci->flag & VM_CALL_ARGS_BLOCKARG) ? 1 : 0));
 {
     struct rb_calling_info calling;
@@ -751,7 +750,6 @@ opt_newarray_max
 // attr rb_snum_t sp_inc = 1 - num;
 {
     val = vm_opt_newarray_max(num, STACK_ADDR_FROM_TOP(num));
-    POPN(num);
 }
 
 DEFINE_INSN
@@ -762,7 +760,6 @@ opt_newarray_min
 // attr rb_snum_t sp_inc = 1 - num;
 {
     val = vm_opt_newarray_min(num, STACK_ADDR_FROM_TOP(num));
-    POPN(num);
 }
 
 /* Invoke method without block */
@@ -771,6 +768,7 @@ opt_send_without_block
 (CALL_INFO ci, CALL_CACHE cc)
 (...)
 (VALUE val)
+// attr bool handles_frame = true;
 // attr rb_snum_t sp_inc = -ci->orig_argc;
 {
     struct rb_calling_info calling;
@@ -785,6 +783,7 @@ invokesuper
 (CALL_INFO ci, CALL_CACHE cc, ISEQ blockiseq)
 (...)
 (VALUE val)
+// attr bool handles_frame = true;
 // attr rb_snum_t sp_inc = - (int)(ci->orig_argc + ((ci->flag & VM_CALL_ARGS_BLOCKARG) ? 1 : 0));
 {
     struct rb_calling_info calling;
@@ -802,6 +801,7 @@ invokeblock
 (CALL_INFO ci)
 (...)
 (VALUE val)
+// attr bool handles_frame = true;
 // attr rb_snum_t sp_inc = 1 - ci->orig_argc;
 {
     struct rb_calling_info calling;
@@ -828,6 +828,7 @@ leave
 ()
 (VALUE val)
 (VALUE val)
+// attr bool handles_frame = true;
 {
     if (OPT_CHECKED_RUN) {
 	const VALUE *const bp = vm_base_ptr(reg_cfp);
@@ -989,8 +990,6 @@ opt_plus
     val = vm_opt_plus(recv, obj);
 
     if (val == Qundef) {
-        PUSH(recv);
-        PUSH(obj);
 #ifndef MJIT_HEADER
         ADD_PC(-WIDTH_OF_opt_send_without_block);
 #endif
@@ -1008,8 +1007,6 @@ opt_minus
     val = vm_opt_minus(recv, obj);
 
     if (val == Qundef) {
-        PUSH(recv);
-        PUSH(obj);
 #ifndef MJIT_HEADER
         ADD_PC(-WIDTH_OF_opt_send_without_block);
 #endif
@@ -1027,8 +1024,6 @@ opt_mult
     val = vm_opt_mult(recv, obj);
 
     if (val == Qundef) {
-        PUSH(recv);
-        PUSH(obj);
 #ifndef MJIT_HEADER
         ADD_PC(-WIDTH_OF_opt_send_without_block);
 #endif
@@ -1046,8 +1041,6 @@ opt_div
     val = vm_opt_div(recv, obj);
 
     if (val == Qundef) {
-        PUSH(recv);
-        PUSH(obj);
 #ifndef MJIT_HEADER
         ADD_PC(-WIDTH_OF_opt_send_without_block);
 #endif
@@ -1065,8 +1058,6 @@ opt_mod
     val = vm_opt_mod(recv, obj);
 
     if (val == Qundef) {
-        PUSH(recv);
-        PUSH(obj);
 #ifndef MJIT_HEADER
         ADD_PC(-WIDTH_OF_opt_send_without_block);
 #endif
@@ -1084,8 +1075,6 @@ opt_eq
     val = opt_eq_func(recv, obj, ci, cc);
 
     if (val == Qundef) {
-        PUSH(recv);
-        PUSH(obj);
 #ifndef MJIT_HEADER
         ADD_PC(-WIDTH_OF_opt_send_without_block);
 #endif
@@ -1103,8 +1092,6 @@ opt_neq
     val = vm_opt_neq(ci, cc, ci_eq, cc_eq, recv, obj);
 
     if (val == Qundef) {
-        PUSH(recv);
-        PUSH(obj);
 #ifndef MJIT_HEADER
         ADD_PC(-WIDTH_OF_opt_send_without_block);
 #endif
@@ -1122,8 +1109,6 @@ opt_lt
     val = vm_opt_lt(recv, obj);
 
     if (val == Qundef) {
-        PUSH(recv);
-        PUSH(obj);
 #ifndef MJIT_HEADER
         ADD_PC(-WIDTH_OF_opt_send_without_block);
 #endif
@@ -1141,8 +1126,6 @@ opt_le
     val = vm_opt_le(recv, obj);
 
     if (val == Qundef) {
-        PUSH(recv);
-        PUSH(obj);
 #ifndef MJIT_HEADER
         ADD_PC(-WIDTH_OF_opt_send_without_block);
 #endif
@@ -1160,8 +1143,6 @@ opt_gt
     val = vm_opt_gt(recv, obj);
 
     if (val == Qundef) {
-        PUSH(recv);
-        PUSH(obj);
 #ifndef MJIT_HEADER
         ADD_PC(-WIDTH_OF_opt_send_without_block);
 #endif
@@ -1179,8 +1160,6 @@ opt_ge
     val = vm_opt_ge(recv, obj);
 
     if (val == Qundef) {
-        PUSH(recv);
-        PUSH(obj);
 #ifndef MJIT_HEADER
         ADD_PC(-WIDTH_OF_opt_send_without_block);
 #endif
@@ -1198,8 +1177,6 @@ opt_ltlt
     val = vm_opt_ltlt(recv, obj);
 
     if (val == Qundef) {
-        PUSH(recv);
-        PUSH(obj);
 #ifndef MJIT_HEADER
         ADD_PC(-WIDTH_OF_opt_send_without_block);
 #endif
@@ -1217,8 +1194,6 @@ opt_aref
     val = vm_opt_aref(recv, obj);
 
     if (val == Qundef) {
-        PUSH(recv);
-        PUSH(obj);
 #ifndef MJIT_HEADER
         ADD_PC(-WIDTH_OF_opt_send_without_block);
 #endif
@@ -1236,9 +1211,6 @@ opt_aset
     val = vm_opt_aset(recv, obj, set);
 
     if (val == Qundef) {
-        PUSH(recv);
-        PUSH(obj);
-        PUSH(set);
 #ifndef MJIT_HEADER
         ADD_PC(-WIDTH_OF_opt_send_without_block);
 #endif
@@ -1259,12 +1231,9 @@ opt_aset_with
 	val = tmp;
     }
     else {
-        PUSH(recv);
-#ifndef MJIT_HEADER
-        PUSH(rb_str_resurrect(key));
-#endif
-        PUSH(val);
 #ifndef MJIT_HEADER
+	TOPN(0) = rb_str_resurrect(key);
+	PUSH(val);
         ADD_PC(-WIDTH_OF_opt_send_without_block);
 #endif
 	DISPATCH_ORIGINAL_INSN(opt_send_without_block);
@@ -1281,9 +1250,8 @@ opt_aref_with
     val = vm_opt_aref_with(recv, key);
 
     if (val == Qundef) {
-        PUSH(recv);
 #ifndef MJIT_HEADER
-        PUSH(rb_str_resurrect(key));
+	PUSH(rb_str_resurrect(key));
         ADD_PC(-WIDTH_OF_opt_send_without_block);
 #endif
 	DISPATCH_ORIGINAL_INSN(opt_send_without_block);
@@ -1300,7 +1268,6 @@ opt_length
     val = vm_opt_length(recv, BOP_LENGTH);
 
     if (val == Qundef) {
-        PUSH(recv);
 #ifndef MJIT_HEADER
         ADD_PC(-WIDTH_OF_opt_send_without_block);
 #endif
@@ -1318,7 +1285,6 @@ opt_size
     val = vm_opt_length(recv, BOP_SIZE);
 
     if (val == Qundef) {
-        PUSH(recv);
 #ifndef MJIT_HEADER
         ADD_PC(-WIDTH_OF_opt_send_without_block);
 #endif
@@ -1336,7 +1302,6 @@ opt_empty_p
     val = vm_opt_empty_p(recv);
 
     if (val == Qundef) {
-        PUSH(recv);
 #ifndef MJIT_HEADER
         ADD_PC(-WIDTH_OF_opt_send_without_block);
 #endif
@@ -1354,7 +1319,6 @@ opt_succ
     val = vm_opt_succ(recv);
 
     if (val == Qundef) {
-        PUSH(recv);
 #ifndef MJIT_HEADER
         ADD_PC(-WIDTH_OF_opt_send_without_block);
 #endif
@@ -1372,7 +1336,6 @@ opt_not
     val = vm_opt_not(ci, cc, recv);
 
     if (val == Qundef) {
-        PUSH(recv);
 #ifndef MJIT_HEADER
         ADD_PC(-WIDTH_OF_opt_send_without_block);
 #endif
@@ -1400,8 +1363,6 @@ opt_regexpmatch2
     val = vm_opt_regexpmatch2(obj2, obj1);
 
     if (val == Qundef) {
-        PUSH(obj2);
-        PUSH(obj1);
 #ifndef MJIT_HEADER
         ADD_PC(-WIDTH_OF_opt_send_without_block);
 #endif
@@ -1415,6 +1376,7 @@ opt_call_c_function
 (rb_insn_func_t funcptr)
 ()
 ()
+// attr bool handles_frame = true;
 {
     reg_cfp = (funcptr)(ec, reg_cfp);
 
diff --git a/mjit_compile.c b/mjit_compile.c
index 1f92834853..5eafd72329 100644
--- a/mjit_compile.c
+++ b/mjit_compile.c
@@ -24,6 +24,9 @@
 struct compile_status {
     int success; /* has TRUE if compilation has had no issue */
     int *stack_size_for_pos; /* stack_size_for_pos[pos] has stack size for the position (otherwise -1) */
+    /* If TRUE, JIT-ed code will use local variables to store pushed values instead of
+       using VM's stack and moving stack pointer. */
+    int local_stack_p;
 };
 
 /* Storage to keep data which is consistent in each conditional branch.
@@ -172,7 +175,13 @@ compile_insns(FILE *f, const struct rb_iseq_constant_body *body, unsigned int st
 static void
 compile_cancel_handler(FILE *f, const struct rb_iseq_constant_body *body, struct compile_status *status)
 {
+    unsigned int i;
     fprintf(f, "\ncancel:\n");
+    if (status->local_stack_p) {
+        for (i = 0; i < body->stack_max; i++) {
+            fprintf(f, "    *((VALUE *)reg_cfp->bp + %d) = stack[%d];\n", i + 1, i);
+        }
+    }
     fprintf(f, "    return Qundef;\n");
 }
 
@@ -182,6 +191,7 @@ mjit_compile(FILE *f, const struct rb_iseq_constant_body *body, const char *func
 {
     struct compile_status status;
     status.success = TRUE;
+    status.local_stack_p = !body->catch_except_p;
     status.stack_size_for_pos = ALLOC_N(int, body->iseq_size);
     memset(status.stack_size_for_pos, NOT_COMPILED_STACK_SIZE, sizeof(int) * body->iseq_size);
 
@@ -195,7 +205,12 @@ mjit_compile(FILE *f, const struct rb_iseq_constant_body *body, const char *func
     fprintf(f, "__declspec(dllexport)\n");
 #endif
     fprintf(f, "VALUE\n%s(rb_execution_context_t *ec, rb_control_frame_t *reg_cfp)\n{\n", funcname);
-    fprintf(f, "    VALUE *stack = reg_cfp->sp;\n");
+    if (status.local_stack_p) {
+        fprintf(f, "    VALUE stack[%d];\n", body->stack_max);
+    }
+    else {
+        fprintf(f, "    VALUE *stack = reg_cfp->sp;\n");
+    }
     fprintf(f, "    static const VALUE *const original_body_iseq = (VALUE *)0x%"PRIxVALUE";\n",
             (VALUE)body->iseq_encoded);
 
diff --git a/tool/ruby_vm/models/bare_instructions.rb b/tool/ruby_vm/models/bare_instructions.rb
index 297a93f5b2..7e573240b5 100755
--- a/tool/ruby_vm/models/bare_instructions.rb
+++ b/tool/ruby_vm/models/bare_instructions.rb
@@ -101,6 +101,10 @@ class RubyVM::BareInstructions
     }.join
   end
 
+  def handles_frame?
+    /\b(false|0)\b/ !~ @attrs['handles_frame'].expr.expr
+  end
+
   def inspect
     sprintf "#<%s %s@%s:%d>", self.class.name, @name, @loc[0], @loc[1]
   end
@@ -125,6 +129,7 @@ class RubyVM::BareInstructions
     generate_attribute 'rb_num_t', 'retn', rets.size
     generate_attribute 'rb_num_t', 'width', width
     generate_attribute 'rb_snum_t', 'sp_inc', rets.size - pops.size
+    generate_attribute 'bool', 'handles_frame', false
   end
 
   def typesplit a
diff --git a/tool/ruby_vm/views/_insn_entry.erb b/tool/ruby_vm/views/_insn_entry.erb
index 836ca32b6b..bae8eae890 100644
--- a/tool/ruby_vm/views/_insn_entry.erb
+++ b/tool/ruby_vm/views/_insn_entry.erb
@@ -30,16 +30,25 @@ INSN_ENTRY(<%= insn.name %>)
 % end
     DEBUG_ENTER_INSN(INSN_ATTR(name));
     ADD_PC(INSN_ATTR(width));
+% if insn.handles_frame?
     POPN(INSN_ATTR(popn));
+% end
     COLLECT_USAGE_INSN(INSN_ATTR(bin));
 % insn.opes.each_with_index do |ope, i|
     COLLECT_USAGE_OPERAND(INSN_ATTR(bin), <%= i %>, <%= ope[:name] %>);
 % end
 <%= render_c_expr insn.expr -%>
     CHECK_VM_STACK_OVERFLOW_FOR_INSN(VM_REG_CFP, INSN_ATTR(retn));
-%   insn.rets.each do |ret|
+% if insn.handles_frame?
+%   insn.rets.reverse_each do |ret|
     PUSH(<%= insn.cast_to_VALUE ret %>);
 %   end
+% else
+    ADJ_SP(INSN_ATTR(sp_inc));
+%   insn.rets.reverse_each.with_index do |ret, i|
+    TOPN(<%= i %>) = <%= insn.cast_to_VALUE ret %>;
+%   end
+% end
     END_INSN(<%= insn.name %>);
 #   undef INSN_ATTR
 #   undef NAME_OF_CURRENT_INSN
diff --git a/tool/ruby_vm/views/_mjit_compile_insn.erb b/tool/ruby_vm/views/_mjit_compile_insn.erb
index 90127aa330..e0955687cc 100644
--- a/tool/ruby_vm/views/_mjit_compile_insn.erb
+++ b/tool/ruby_vm/views/_mjit_compile_insn.erb
@@ -20,6 +20,11 @@
         MAYBE_UNUSED(<%= ope.fetch(:decl) %>) = (<%= ope.fetch(:type) %>)operands[<%= i %>];
 % end
 %
+% # JIT: Declare stack_size to be used in some macro of _mjit_compile_insn_body.erb
+        if (status->local_stack_p) {
+            fprintf(f, "    MAYBE_UNUSED(unsigned int) stack_size = %u;\n", b->stack_size);
+        }
+%
 % # JIT: Declare variables for operands, popped values and return values
 % insn.declarations.each do |decl|
         fprintf(f, "    <%= decl %>;\n");
diff --git a/tool/ruby_vm/views/_mjit_compile_insn_body.erb b/tool/ruby_vm/views/_mjit_compile_insn_body.erb
index 0fef07da25..38fd8a9368 100644
--- a/tool/ruby_vm/views/_mjit_compile_insn_body.erb
+++ b/tool/ruby_vm/views/_mjit_compile_insn_body.erb
@@ -69,9 +69,37 @@
 %     end
 %   when /\A\s+DISPATCH_ORIGINAL_INSN\([^)]+\);\s+\z/
 %     # For `opt_xxx`'s fallbacks.
+        if (status->local_stack_p) {
+            fprintf(f, "            reg_cfp->sp = (VALUE *)reg_cfp->bp + %d;\n", b->stack_size + 1);
+        }
         fprintf(f, "            reg_cfp->pc = original_body_iseq + %d;\n", pos);
         fprintf(f, "            goto cancel;\n");
 %   else
+%     if insn.handles_frame?
+%       # If insn.handles_frame? is true, cfp->sp might be changed inside insns (like vm_caller_setup_arg_block)
+%       # and thus we need to use cfp->sp, even when local_stack_p is TRUE. When insn.handles_frame? is true,
+%       # cfp->sp should be available too because _mjit_compile_pc_and_sp.erb sets it.
+        fprintf(f, <%= to_cstr.call(line) %>);
+%     else
+%       # If local_stack_p is TRUE and insn.handles_frame? is false, stack values are only available in local variables
+%       # for stack. So we need to replace those macros if local_stack_p is TRUE here.
+%       case line
+%       when /\bGET_SP\(\)/
+%         # reg_cfp->sp
+        fprintf(f, <%= to_cstr.call(line.sub(/\bGET_SP\(\)/, '%s')) %>, (status->local_stack_p ? "(stack + stack_size)" : "GET_SP()"));
+%       when /\bSTACK_ADDR_FROM_TOP\((?<num>[^)]+)\)/
+%         # #define STACK_ADDR_FROM_TOP(n) (GET_SP()-(n))
+%         num = Regexp.last_match[:num]
+        fprintf(f, <%= to_cstr.call(line.sub(/\bSTACK_ADDR_FROM_TOP\(([^)]+)\)/, '%s')) %>,
+                (status->local_stack_p ? "stack + (stack_size - (<%= num %>))" : "STACK_ADDR_FROM_TOP(<%= num %>)"));
+%       when /\bTOPN\((?<num>[^)]+)\)/
+%         # #define TOPN(n) (*(GET_SP()-(n)-1))
+%         num = Regexp.last_match[:num]
+        fprintf(f, <%= to_cstr.call(line.sub(/\bTOPN\(([^)]+)\)/, '%s')) %>,
+              (status->local_stack_p ? "*(stack + (stack_size - (<%= num %>) - 1))" : "TOPN(<%= num %>)"));
+%       else
         fprintf(f, <%= to_cstr.call(line) %>);
+%       end
+%     end
 %   end
 % end
diff --git a/tool/ruby_vm/views/_mjit_compile_pc_and_sp.erb b/tool/ruby_vm/views/_mjit_compile_pc_and_sp.erb
index 6004504c06..da1465a685 100644
--- a/tool/ruby_vm/views/_mjit_compile_pc_and_sp.erb
+++ b/tool/ruby_vm/views/_mjit_compile_pc_and_sp.erb
@@ -12,4 +12,25 @@
         }
 %
 % # JIT: move sp to use or preserve stack variables
-        fprintf(f, "    reg_cfp->sp = (VALUE *)reg_cfp->bp + %d;\n", b->stack_size + 1 - <%= insn.pops.size %>); /* POPN(INSN_ATTR(popn)); */
+        if (status->local_stack_p) {
+% # sp motion is optimized away for `handles_frame? #=> false` case.
+% # Thus sp should be set properly before `goto cancel`.
+% if insn.handles_frame?
+%           # JIT-only behavior (pushing JIT's local variables to VM's stack):
+            {
+                rb_snum_t i, push_size;
+                push_size = -<%= insn.call_attribute('sp_inc') %> + <%= insn.rets.size %> - <%= insn.pops.size %>;
+                fprintf(f, "    reg_cfp->sp = (VALUE *)reg_cfp->bp + %ld + 1;\n", push_size); /* POPN(INSN_ATTR(popn)); */
+                for (i = 0; i < push_size; i++) { /* TODO: use memcpy? */
+                    fprintf(f, "    *(reg_cfp->sp + %ld) = stack[%ld];\n", i - push_size, (rb_snum_t)b->stack_size - push_size + i);
+                }
+            }
+% end
+        }
+        else {
+% if insn.handles_frame?
+            fprintf(f, "    reg_cfp->sp = (VALUE *)reg_cfp->bp + %d;\n", b->stack_size + 1 - <%= insn.pops.size %>); /* POPN(INSN_ATTR(popn)); */
+% else
+            fprintf(f, "    reg_cfp->sp = (VALUE *)reg_cfp->bp + %d;\n", b->stack_size + 1);
+% end
+        }
diff --git a/tool/ruby_vm/views/_mjit_compile_send.erb b/tool/ruby_vm/views/_mjit_compile_send.erb
index 6944903821..0a01ea2f86 100644
--- a/tool/ruby_vm/views/_mjit_compile_send.erb
+++ b/tool/ruby_vm/views/_mjit_compile_send.erb
@@ -24,6 +24,10 @@
             int param_size = iseq->body->param.size; /* TODO: check calling->argc for argument_arity_error */
 
             fprintf(f, "{\n");
+% # JIT: Declare stack_size to be used in some macro of _mjit_compile_insn_body.erb
+            if (status->local_stack_p) {
+                fprintf(f, "    MAYBE_UNUSED(unsigned int) stack_size = %u;\n", b->stack_size);
+            }
 
 % # JIT: Invalidate call cache if it requires vm_search_method. This allows to inline some of following things.
 <%= render 'mjit_compile_send_guard' -%>
diff --git a/tool/ruby_vm/views/mjit_compile.inc.erb b/tool/ruby_vm/views/mjit_compile.inc.erb
index 7749984c36..ee29693894 100644
--- a/tool/ruby_vm/views/mjit_compile.inc.erb
+++ b/tool/ruby_vm/views/mjit_compile.inc.erb
@@ -31,13 +31,13 @@
 % #   reg_cfp: the second argument of _mjitXXX
 % #   GET_CFP(): refers to `reg_cfp`
 % #   GET_EP(): refers to `reg_cfp->ep`
-% #   GET_SP(): refers to `reg_cfp->sp`
+% #   GET_SP(): refers to `reg_cfp->sp`, or `(stack + stack_size)` if local_stack_p
 % #   GET_SELF(): refers to `reg_cfp->self`
 % #   GET_LEP(): refers to `VM_EP_LEP(reg_cfp->ep)`
 % #   EXEC_EC_CFP(): refers to `val = vm_exec(ec, TRUE)` with frame setup
 % #   CALL_METHOD(): using `GET_CFP()` and `EXEC_EC_CFP()`
-% #   TOPN(): refers to `reg_cfp->sp`
-% #   STACK_ADDR_FROM_TOP(): refers to `reg_cfp->sp`
+% #   TOPN(): refers to `reg_cfp->sp`, or `*(stack + (stack_size - num - 1))` if local_stack_p
+% #   STACK_ADDR_FROM_TOP(): refers to `reg_cfp->sp`, or `stack + (stack_size - num)` if local_stack_p
 % #   DISPATCH_ORIGINAL_INSN(): expanded in _mjit_compile_insn.erb
 % #   THROW_EXCEPTION(): specially defined for JIT
 % #   RESTORE_REGS(): specially defined for `leave`
diff --git a/vm_insnhelper.c b/vm_insnhelper.c
index 07c22b03b3..3fac8eb1fa 100644
--- a/vm_insnhelper.c
+++ b/vm_insnhelper.c
@@ -1237,11 +1237,11 @@ vm_throw(const rb_execution_context_t *ec, rb_control_frame_t *reg_cfp,
 }
 
 static inline void
-vm_expandarray(rb_control_frame_t *cfp, VALUE ary, rb_num_t num, int flag)
+vm_expandarray(VALUE *sp, VALUE ary, rb_num_t num, int flag)
 {
     int is_splat = flag & 0x01;
     rb_num_t space_size = num + is_splat;
-    VALUE *base = cfp->sp;
+    VALUE *base = sp - 1;
     const VALUE *ptr;
     rb_num_t len;
     const VALUE obj = ary;
@@ -1256,8 +1256,6 @@ vm_expandarray(rb_control_frame_t *cfp, VALUE ary, rb_num_t num, int flag)
 	len = (rb_num_t)RARRAY_LEN(ary);
     }
 
-    cfp->sp += space_size;
-
     if (flag & 0x02) {
 	/* post: ..., nil ,ary[-1], ..., ary[0..-num] # top */
 	rb_num_t i = 0, j;
diff --git a/vm_insnhelper.h b/vm_insnhelper.h
index 8d1c6bef68..e897322f2f 100644
--- a/vm_insnhelper.h
+++ b/vm_insnhelper.h
@@ -111,6 +111,8 @@ enum vm_regan_acttype {
 #define INC_SP(x)  (VM_REG_SP += (COLLECT_USAGE_REGISTER_HELPER(SP, SET, (x))))
 #define DEC_SP(x)  (VM_REG_SP -= (COLLECT_USAGE_REGISTER_HELPER(SP, SET, (x))))
 #define SET_SV(x)  (*GET_SP() = (x))
+  /* set current stack value as x */
+#define ADJ_SP(x)  INC_SP(x)
 
 /* instruction sequence C struct */
 #define GET_ISEQ() (GET_CFP()->iseq)