ZJIT: Polymorphic getivar with shape-based splitting

Add support for polymorphic getinstancevariable and attr_reader with
shape-based splitting. When multiple shapes are observed for the same
receiver, we now generate a switch block, a load block for each shape,
and a join block.

Key changes:
- Add RefineShape instruction to record known shape information with
  is_t_object and is_embedded flags
- In iseq_to_hir, emit shape-based splitting for polymorphic getivar
  and attr_reader (same-class-different-shapes case)
- Move guard insertion (GuardType, guard_shape) from optimize_getivar
  to the HIR building phase
- Simplify optimize_getivar to only lower RefineShape inputs to
  LoadField (T_OBJECT) or CCall (non-T_OBJECT)

Problem: This approach doesn't compose perfectly with the splitting for
polymorphic send. We potentially want to split twice, one for all the
different callee varying in method types and another time for shape
variations. For simplicity, we only split in the monomorphic attr_reader
callee, polymorphic shapes case for now.

Problem: We need to change the strategy for counting fallbacks because
there no one place where we can definitively say getivar won't be
optimized anymore. Maybe a fallback reason approach that Send uses.

Author: XrXr

zjit/src/codegen.rs

@@ -548,6 +548,7 @@ fn gen_insn(cb: &mut CodeBlock, jit: &mut JITState, asm: &mut Assembler, functio
         &Insn::UnboxFixnum { val } => gen_unbox_fixnum(asm, opnd!(val)),
         Insn::Test { val } => gen_test(asm, opnd!(val)),
         Insn::RefineType { val, .. } => opnd!(val),
+        Insn::RefineShape { val, .. } => opnd!(val),
         Insn::HasType { val, expected } => gen_has_type(asm, opnd!(val), *expected),
         Insn::GuardType { val, guard_type, state } => gen_guard_type(jit, asm, opnd!(val), *guard_type, &function.frame_state(*state)),
         Insn::GuardTypeNot { val, guard_type, state } => gen_guard_type_not(jit, asm, opnd!(val), *guard_type, &function.frame_state(*state)),