diff --git a/NEWS.md b/NEWS.md
index 53d4488dd8e296..a2a1da19441609 100644
--- a/NEWS.md
+++ b/NEWS.md
@@ -140,7 +140,7 @@ They are still available on rubygems.org and can be installed with
   * 4.0.3 to [v4.0.4][RubyGems-v4.0.4], [v4.0.5][RubyGems-v4.0.5], [v4.0.6][RubyGems-v4.0.6], [v4.0.7][RubyGems-v4.0.7], [v4.0.8][RubyGems-v4.0.8], [v4.0.9][RubyGems-v4.0.9], [v4.0.10][RubyGems-v4.0.10], [v4.0.11][RubyGems-v4.0.11], [v4.0.12][RubyGems-v4.0.12], [v4.0.13][RubyGems-v4.0.13], [v4.0.14][RubyGems-v4.0.14], [v4.0.15][RubyGems-v4.0.15], [v4.0.16][RubyGems-v4.0.16], [v4.0.17][RubyGems-v4.0.17]
 * bundler 4.1.0.dev
   * 4.0.3 to [v4.0.4][bundler-v4.0.4], [v4.0.5][bundler-v4.0.5], [v4.0.6][bundler-v4.0.6], [v4.0.7][bundler-v4.0.7], [v4.0.8][bundler-v4.0.8], [v4.0.9][bundler-v4.0.9], [v4.0.10][bundler-v4.0.10], [v4.0.11][bundler-v4.0.11], [v4.0.12][bundler-v4.0.12], [v4.0.13][bundler-v4.0.13], [v4.0.14][bundler-v4.0.14], [v4.0.15][bundler-v4.0.15], [v4.0.16][bundler-v4.0.16], [v4.0.17][bundler-v4.0.17]
-* erb 6.0.6
+* erb 6.0.7
   * 6.0.1 to [v6.0.1.1][erb-v6.0.1.1], [v6.0.2][erb-v6.0.2], [v6.0.3][erb-v6.0.3], [v6.0.4][erb-v6.0.4], [v6.0.5][erb-v6.0.5], [v6.0.6][erb-v6.0.6]
 * error_highlight 0.7.2
 * ipaddr 1.2.9
diff --git a/internal/string.h b/internal/string.h
index 6dd6c2e4dd231e..a8893a42f1e10a 100644
--- a/internal/string.h
+++ b/internal/string.h
@@ -93,6 +93,7 @@ void rb_str_make_embedded(VALUE);
 VALUE rb_str_upto_each(VALUE, VALUE, int, int (*each)(VALUE, VALUE), VALUE);
 size_t rb_str_size_as_embedded(VALUE);
 bool rb_str_reembeddable_p(VALUE);
+bool rb_str_embedded_shared_root_p(VALUE);
 VALUE rb_str_upto_endless_each(VALUE, int (*each)(VALUE, VALUE), VALUE);
 VALUE rb_str_with_debug_created_info(VALUE, VALUE, int);
 VALUE rb_str_frozen_bare_string(VALUE);
diff --git a/lib/erb.rb b/lib/erb.rb
index 0c4653d291f28d..040cd183528b05 100644
--- a/lib/erb.rb
+++ b/lib/erb.rb
@@ -815,9 +815,6 @@
 # [template processor]: https://en.wikipedia.org/wiki/Template_processor
 #
 class ERB
-  IDENTITY_METHOD = BasicObject.instance_method(:equal?) # :nodoc:
-  private_constant :IDENTITY_METHOD
-
   # :markup: markdown
   #
   # :call-seq:
@@ -1117,7 +1114,7 @@ def new_toplevel(vars = nil)
   private :new_toplevel
 
   def initialized_by_new? # :nodoc:
-    IDENTITY_METHOD.bind_call(@_init, self.class.singleton_class)
+    self.class.singleton_class.equal? @_init
   end
   private :initialized_by_new?
 
diff --git a/lib/erb/compiler.rb b/lib/erb/compiler.rb
index 6d70288b4f55c1..b6185cdc4c84fe 100644
--- a/lib/erb/compiler.rb
+++ b/lib/erb/compiler.rb
@@ -80,16 +80,11 @@ def initialize(str)
   end
 
   class Scanner # :nodoc:
-    @scanner_map = defined?(Ractor) ? Ractor.make_shareable({}) : {}
+    @scanner_map = {}.freeze
+
     class << self
-      if defined?(Ractor)
-        def register_scanner(klass, trim_mode, percent)
-          @scanner_map = Ractor.make_shareable({ **@scanner_map, [trim_mode, percent] => klass })
-        end
-      else
-        def register_scanner(klass, trim_mode, percent)
-          @scanner_map[[trim_mode, percent]] = klass
-        end
+      def register_scanner(klass, trim_mode, percent)
+        @scanner_map = @scanner_map.merge([trim_mode, percent].freeze => klass).freeze
       end
       alias :regist_scanner :register_scanner
     end
diff --git a/lib/erb/version.rb b/lib/erb/version.rb
index 04908528c99d69..2ae8041d2362f1 100644
--- a/lib/erb/version.rb
+++ b/lib/erb/version.rb
@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 class ERB
   # The string \ERB version.
-  VERSION = '6.0.6'
+  VERSION = '6.0.7'
 end
diff --git a/ractor.c b/ractor.c
index fbf39478ffb771..4e741f000df0b6 100644
--- a/ractor.c
+++ b/ractor.c
@@ -17,6 +17,7 @@
 #include "internal/rational.h"
 #include "internal/struct.h"
 #include "internal/st.h"
+#include "internal/string.h"
 #include "internal/thread.h"
 #include "variable.h"
 #include "yjit.h"
@@ -2124,6 +2125,11 @@ move_leave(VALUE obj, struct obj_traverse_replace_data *data)
     VALUE flags = T_OBJECT | FL_FREEZE | (RBASIC(obj)->flags & FL_PROMOTED);
     shape_id_t shape_id = (RBASIC_SHAPE_ID(obj) & SHAPE_ID_CAPACITY_MASK) | ROOT_SHAPE_ID | SHAPE_ID_LAYOUT_ROBJECT | SHAPE_ID_FL_FROZEN;
 
+    // A copy-on-write sharer reads its bytes straight out of an embedded root's slot
+    // (String#dup of a frozen string), and it outlives the move, so that body has to
+    // survive as it is.
+    bool wipe_body = !(RB_TYPE_P(obj, T_STRING) && rb_str_embedded_shared_root_p(obj));
+
     // Avoid mutations using bind_call, etc.
     size_t slot_size = rb_gc_obj_slot_size(obj);
     MEMZERO((char *)obj, char, sizeof(struct RBasic));
@@ -2134,7 +2140,9 @@ move_leave(VALUE obj, struct obj_traverse_replace_data *data)
     // but C code that held the object from before the move still reads it with its
     // old type (an Array iteration in progress, the RMatch capa behind $~): a zeroed
     // body makes those reads see an empty object instead of stale internals.
-    MEMZERO((char *)obj + sizeof(struct RBasic), char, slot_size - sizeof(struct RBasic));
+    if (wipe_body) {
+        MEMZERO((char *)obj + sizeof(struct RBasic), char, slot_size - sizeof(struct RBasic));
+    }
 
     // The husk keeps its original (larger) slot, so give it a field-less shape
     // sized to that slot; otherwise compaction's slot_size == shape_slot_size
diff --git a/string.c b/string.c
index ce001d35aaec5d..9488baeda468c4 100644
--- a/string.c
+++ b/string.c
@@ -229,6 +229,14 @@ rb_str_reembeddable_p(VALUE str)
     return !FL_TEST(str, STR_NOFREE|STR_SHARED_ROOT|STR_SHARED);
 }
 
+/* True when other strings read this string's bytes out of its own slot, so the slot
+ * contents must stay valid for as long as the object does. */
+bool
+rb_str_embedded_shared_root_p(VALUE str)
+{
+    return STR_EMBED_P(str) && FL_TEST(str, STR_SHARED_ROOT);
+}
+
 static inline size_t
 rb_str_embed_size(long capa, long termlen)
 {
diff --git a/test/erb/test_erb.rb b/test/erb/test_erb.rb
index 1de892544e5b10..6da25146ff7966 100644
--- a/test/erb/test_erb.rb
+++ b/test/erb/test_erb.rb
@@ -740,3 +740,43 @@ def teardown
     ERB::Compiler::Scanner.instance_variable_set('@scanner_map', @save_map)
   end
 end
+
+class TestERBRactor < Test::Unit::TestCase
+  def test_compile_and_result_in_ractor
+    assert_ractor(<<~RUBY, require: 'erb')
+      r = Ractor.new do
+        ERB.new("Hello, <%= 'world' %>!").result(binding)
+      end
+      assert_equal("Hello, world!", r.value)
+    RUBY
+  end
+
+  def test_trim_mode_in_ractor
+    assert_ractor(<<~RUBY, require: 'erb')
+      src = "<% [1, 2].each do |i| %>\\n<%= i %>\\n<% end %>\\n"
+      r = Ractor.new(src) { |s| ERB.new(s, trim_mode: '-').result(binding) }
+      assert_equal("\\n1\\n\\n2\\n\\n", r.value)
+
+      r = Ractor.new(src) { |s| ERB.new(s, trim_mode: '<>').result(binding) }
+      assert_equal("12", r.value)
+    RUBY
+  end
+
+  def test_frozen_erb_instance_reused_across_ractors
+    assert_ractor(<<~RUBY, require: 'erb')
+      erb = ERB.new("<%= 1 + 1 %>")
+      erb.freeze
+      rs = 2.times.map { Ractor.new(erb) { |e| e.result(binding) } }
+      assert_equal(["2", "2"], rs.map(&:value))
+    RUBY
+  end
+
+  def test_util_html_escape_in_ractor
+    assert_ractor(<<~RUBY, require: 'erb')
+      r = Ractor.new do
+        ERB::Util.html_escape("<script>")
+      end
+      assert_equal("&lt;script&gt;", r.value)
+    RUBY
+  end
+end
diff --git a/test/ruby/test_ractor.rb b/test/ruby/test_ractor.rb
index 33387a156639a9..20e86317e90791 100644
--- a/test/ruby/test_ractor.rb
+++ b/test/ruby/test_ractor.rb
@@ -491,4 +491,22 @@ def test_move_matchdata_kept_in_backref
       r.value
     RUBY
   end
+
+  # String#dup of a frozen string shares the original's bytes, and for an embedded
+  # string those bytes live in its slot.  Moving the original must leave that slot
+  # alone: the sharer reads it for as long as it lives.
+  def test_move_string_sharing_its_embedded_bytes
+    assert_ractor(<<~'RUBY', timeout: 60)
+      [24, 100, 300].each do |len|
+        r = Ractor.new { Ractor.receive }
+        str = "x" * len
+        str.instance_variable_set(:@iv, [])   # unshareable, so it is moved
+        str.freeze
+        dup = str.dup                         # reads str's bytes in place
+        r.send(str, move: true)
+        assert_equal "x" * len, dup, "corrupted for length #{len}"
+        r.value
+      end
+    RUBY
+  end
 end
diff --git a/zjit/src/backend/lir.rs b/zjit/src/backend/lir.rs
index 2f3622b0838db7..c284bab6e9e096 100644
--- a/zjit/src/backend/lir.rs
+++ b/zjit/src/backend/lir.rs
@@ -617,6 +617,10 @@ pub struct SideExitRecompile {
     /// The compiled unit whose version must be invalidated to force a recompile. For inlined
     /// methods, this will be the outer function it was inlined into.
     pub compiled_iseq: Opnd,
+    /// The exiting frame's ISEQ, which owns the profile entry for `insn_idx`. For
+    /// an exit out of inlined code this is the inlined callee, not the compiled unit.
+    pub frame_iseq: Opnd,
+    /// The exiting frame's instruction index within `frame_iseq`.
     pub insn_idx: u32,
 }
 
@@ -2898,8 +2902,9 @@ impl Assembler
                 use crate::codegen::exit_recompile;
                 asm_comment!(asm, "profile and maybe recompile");
                 asm_ccall!(asm, exit_recompile,
-                    EC,
-                    recompile.compiled_iseq
+                    recompile.compiled_iseq,
+                    recompile.frame_iseq,
+                    recompile.insn_idx.into()
                 );
             }
         }
diff --git a/zjit/src/codegen.rs b/zjit/src/codegen.rs
index 0c84887a7b4644..27428f9d63a9aa 100644
--- a/zjit/src/codegen.rs
+++ b/zjit/src/codegen.rs
@@ -3557,6 +3557,7 @@ fn side_exit_with_recompile(jit: &JITState, function: &Function, state: &FrameSt
     let mut exit = build_side_exit(jit, function, state);
     exit.recompile = recompile.map(|_| SideExitRecompile {
         compiled_iseq: Opnd::Value(VALUE::from(jit.iseq())),
+        frame_iseq: Opnd::Value(VALUE::from(state.iseq)),
         insn_idx: state.insn_idx() as u32,
     });
     Target::SideExit(Box::new(SideExitTarget { exit, reason }))
@@ -3623,7 +3624,14 @@ c_callable! {
     /// of inlined code, the inliner folds the callee's body into the outer ISEQ, so
     /// the outer ISEQ's version holds the failing guard and must be invalidated to
     /// force a recompile. For non-inlined code, it is the same as the frame ISEQ.
-    pub(crate) fn exit_recompile(ec: EcPtr, compiled_iseq_raw: VALUE) {
+    ///
+    /// `frame_iseq_raw` and `insn_idx` identify the instruction this exit came from,
+    /// whose re-profiling gates the recompile. Both are baked in at compile time,
+    /// where the exit already knows them, rather than read back out of the control
+    /// frame: the control frame describes the exiting frame only because the exit
+    /// wrote its ISEQ and PC there moments earlier, and an exit path that does not
+    /// write them would silently gate the recompile on an unrelated instruction.
+    pub(crate) fn exit_recompile(compiled_iseq_raw: VALUE, frame_iseq_raw: VALUE, insn_idx: u32) {
         // Fast check before taking the VM lock: skip if the compiled unit is already
         // invalidated or at the version limit. This avoids expensive lock acquisition
         // on every shape guard exit after the recompile has already been triggered.
@@ -3643,7 +3651,8 @@ c_callable! {
             let compiled_iseq: IseqPtr = compiled_iseq_raw.as_iseq();
 
             let should_recompile = with_time_stat(Counter::profile_time_ns, || {
-                crate::profile::profile_recompile_insn(ec)
+                get_or_create_iseq_payload(frame_iseq_raw.as_iseq())
+                    .profile.done_profiling_at(insn_idx as YarvInsnIdx)
             });
 
             // Once we have enough profiles, invalidate the compiled unit so it
@@ -3968,6 +3977,10 @@ pub fn gen_materialize_exit_trampoline(cb: &mut CodeBlock, exit_trampoline: Code
 
     asm_comment!(asm, "clear JITFrame materialized by exit code");
     asm.store(Opnd::mem(64, CFP, RUBY_OFFSET_CFP_JIT_RETURN), 0.into());
+    // Clear cfp->block_code since it may have been left uninitialized by JITFrame mechanisms.
+    // Zero is the right value because we're dealing with the top most frame.
+    // Non-zero values are only set before pushing a frame.
+    asm.store(Opnd::mem(64, CFP, RUBY_OFFSET_CFP_BLOCK_CODE), 0.into());
 
     asm_comment!(asm, "materialize ZJIT frames");
     asm_ccall!(asm, rb_zjit_materialize_frames, EC, CFP);
diff --git a/zjit/src/hir.rs b/zjit/src/hir.rs
index c3d7914670be7a..9d6fb7448b2f00 100644
--- a/zjit/src/hir.rs
+++ b/zjit/src/hir.rs
@@ -5521,7 +5521,7 @@ impl Function {
                     TDATA_OFFSET_FIELDS_OBJ
                 };
 
-                let fields_obj = self.load_field(block, self_val, FieldName::fields_obj, offset, types::RubyValue);
+                let fields_obj = self.load_field(block, self_val, FieldName::fields_obj, offset, types::IMemo);
                 // All fields objects are embedded
                 self.load_ivar_embedded(block, fields_obj, id, ivar_index)
             },
@@ -5640,7 +5640,7 @@ impl Function {
                 (self_val, true)
             },
             ShapeLayout::Extended => {
-                let fields = self.load_field(block, self_val, FieldName::as_heap, ROBJECT_OFFSET_AS_HEAP_FIELDS, types::BasicObject);
+                let fields = self.load_field(block, self_val, FieldName::as_heap, ROBJECT_OFFSET_AS_HEAP_FIELDS, types::IMemo);
                 (fields, false)
             },
             ShapeLayout::Other | ShapeLayout::RClass => {
@@ -6922,8 +6922,8 @@ impl Function {
             | Insn::NewRange { low: left, high: right, .. }
             | Insn::CheckMatch { target: left, pattern: right, .. }
             | Insn::WriteBarrier { recv: left, val: right } => {
-                self.assert_subtype(insn_id, left, types::BasicObject)?;
-                self.assert_subtype(insn_id, right, types::BasicObject)
+                self.assert_subtype(insn_id, left, types::RubyValue)?;
+                self.assert_subtype(insn_id, right, types::RubyValue)
             }
             Insn::GetConstant { klass, allow_nil, .. } => {
                 self.assert_subtype(insn_id, klass, types::BasicObject)?;
@@ -7819,6 +7819,23 @@ impl ProfileOracle {
             self.types.entry(*snapshot).or_default().extend(entries.iter().cloned());
         }
     }
+
+    /// Copy the profile entries recorded for the `src` Snapshot to the `dst` Snapshot, excluding
+    /// entries for `exclude` (chased through guards). Used by polymorphic dispatch, where each
+    /// refined arm gets a fresh Snapshot: the receiver must resolve from its refined type rather
+    /// than the polymorphic profile, but the other operands' profiles should remain visible so
+    /// argument-profile-dependent specializations (e.g. Array#[]) still apply.
+    fn copy_entries_except(&mut self, src: InsnId, dst: InsnId, exclude: InsnId, fun: &Function) {
+        let Some(entries) = self.types.get(&src) else { return };
+        let exclude = fun.chase_insn(exclude);
+        let filtered: Vec<_> = entries.iter()
+            .filter(|(insn, _)| fun.chase_insn(*insn) != exclude)
+            .cloned()
+            .collect();
+        if !filtered.is_empty() {
+            self.types.insert(dst, filtered);
+        }
+    }
 }
 
 fn invalidates_locals(opcode: u32, operands: *const VALUE) -> bool {
@@ -9289,6 +9306,12 @@ fn add_iseq_to_hir(
                             // its refined, exact type instead of the polymorphic profile that is
                             // keyed at exit_id.
                             let snapshot = fun.push_insn(iftrue_block, Insn::Snapshot { state: Box::new(exit_state.clone()) });
+                            // Keep the other operands' profile entries visible at the fresh
+                            // Snapshot so the specialized send can still see argument profiles
+                            // (e.g. Array#[] needs a Fixnum-profiled index to be inlined). Only
+                            // the receiver's entry is dropped: it must resolve from its refined,
+                            // exact type, and resolve_receiver_type prefers profiles over types.
+                            profiles.copy_entries_except(exit_id, snapshot, recv, fun);
                             let refined_recv = fun.push_insn(iftrue_block, Insn::RefineType { val: recv, new_type: expected });
                             let send = fun.push_insn(iftrue_block, Insn::Send { recv: refined_recv, cd, block: None, args: args.clone(), state: snapshot, reason: Uncategorized(opcode) });
                             fun.push_insn(iftrue_block, Insn::Jump(BranchEdge { target: join_block, args: vec![send] }));
diff --git a/zjit/src/hir/opt_tests.rs b/zjit/src/hir/opt_tests.rs
index 641e01d05a328b..81338e1bb24590 100644
--- a/zjit/src/hir/opt_tests.rs
+++ b/zjit/src/hir/opt_tests.rs
@@ -6929,7 +6929,7 @@ mod hir_opt_tests {
           v17:HeapBasicObject = GuardType v9, HeapBasicObject
           v18:CShape = LoadField v17, :shape_id@0x1001
           v19:CShape[0x1002] = GuardBitEquals v18, CShape(0x1002) recompile
-          v20:BasicObject = LoadField v17, :as_heap@0x1003
+          v20:IMemo = LoadField v17, :as_heap@0x1003
           StoreField v20, :@v0@0x1003, v10
           WriteBarrier v20, v10
           CheckInterrupts
@@ -9507,7 +9507,7 @@ mod hir_opt_tests {
           v11:HeapBasicObject = GuardType v6, HeapBasicObject
           v12:CShape = LoadField v11, :shape_id@0x1000
           v13:CShape[0x1001] = GuardBitEquals v12, CShape(0x1001) recompile
-          v14:RubyValue = LoadField v11, :fields_obj@0x1002
+          v14:IMemo = LoadField v11, :fields_obj@0x1002
           v15:BasicObject = LoadField v14, :@foo@0x1003
           CheckInterrupts
           Return v15
@@ -9577,7 +9577,7 @@ mod hir_opt_tests {
           v11:HeapBasicObject = GuardType v6, HeapBasicObject
           v12:CShape = LoadField v11, :shape_id@0x1000
           v13:CShape[0x1001] = GuardBitEquals v12, CShape(0x1001) recompile
-          v14:RubyValue = LoadField v11, :fields_obj@0x1002
+          v14:IMemo = LoadField v11, :fields_obj@0x1002
           v15:BasicObject = LoadField v14, :@foo@0x1003
           CheckInterrupts
           Return v15
@@ -9640,7 +9640,7 @@ mod hir_opt_tests {
           v11:HeapBasicObject = GuardType v6, HeapBasicObject
           v12:CShape = LoadField v11, :shape_id@0x1000
           v13:CShape[0x1001] = GuardBitEquals v12, CShape(0x1001) recompile
-          v14:RubyValue = LoadField v11, :fields_obj@0x1002
+          v14:IMemo = LoadField v11, :fields_obj@0x1002
           v15:BasicObject = LoadField v14, :@a@0x1002
           CheckInterrupts
           Return v15
@@ -9675,7 +9675,7 @@ mod hir_opt_tests {
           v11:HeapBasicObject = GuardType v6, HeapBasicObject
           v12:CShape = LoadField v11, :shape_id@0x1000
           v13:CShape[0x1001] = GuardBitEquals v12, CShape(0x1001) recompile
-          v14:RubyValue = LoadField v11, :fields_obj@0x1002
+          v14:IMemo = LoadField v11, :fields_obj@0x1002
           v15:BasicObject = LoadField v14, :@a@0x1002
           CheckInterrupts
           Return v15
@@ -9817,7 +9817,7 @@ mod hir_opt_tests {
           Jump bb4(v17)
         bb6():
           v19:CShape[0x1003] = GuardBitEquals v12, CShape(0x1003) recompile
-          v21:RubyValue = LoadField v11, :fields_obj@0x1004
+          v21:IMemo = LoadField v11, :fields_obj@0x1004
           v22:BasicObject = LoadField v21, :@foo@0x1004
           Jump bb4(v22)
         bb4(v13:BasicObject):
@@ -9880,7 +9880,7 @@ mod hir_opt_tests {
           v15:CBool = IsBitEqual v12, v14
           CondBranch v15, bb5(), bb6()
         bb5():
-          v17:RubyValue = LoadField v11, :fields_obj@0x1002
+          v17:IMemo = LoadField v11, :fields_obj@0x1002
           v18:BasicObject = LoadField v17, :@foo@0x1002
           Jump bb4(v18)
         bb6():
@@ -9995,12 +9995,12 @@ mod hir_opt_tests {
           v15:CBool = IsBitEqual v12, v14
           CondBranch v15, bb5(), bb6()
         bb5():
-          v17:RubyValue = LoadField v11, :fields_obj@0x1002
+          v17:IMemo = LoadField v11, :fields_obj@0x1002
           v18:BasicObject = LoadField v17, :@a@0x1002
           Jump bb4(v18)
         bb6():
           v20:CShape[0x1003] = GuardBitEquals v12, CShape(0x1003) recompile
-          v22:RubyValue = LoadField v11, :fields_obj@0x1004
+          v22:IMemo = LoadField v11, :fields_obj@0x1004
           v23:BasicObject = LoadField v22, :@a@0x1002
           Jump bb4(v23)
         bb4(v13:BasicObject):
@@ -17156,6 +17156,71 @@ mod hir_opt_tests {
         ");
     }
 
+    #[test]
+    fn specialize_polymorphic_send_preserves_argument_profiles() {
+        // Each arm of a polymorphic dispatch must still see the profiled types of
+        // the non-receiver arguments: the Array arm below can only inline ArrayAref
+        // if the Fixnum profile of `i` survives into the arm's Snapshot.
+        set_call_threshold(4);
+        eval("
+        def test(a, i)
+          a[i]
+        end
+
+        test([10, 20], 1)
+        test({1 => 2}, 1)
+        test([10, 20], 1)
+        test({1 => 2}, 1)
+        ");
+        assert_snapshot!(hir_string("test"), @"
+        fn test@<compiled>:3:
+        bb1():
+          EntryPoint interpreter
+          v1:BasicObject = LoadSelf
+          v2:CPtr = LoadSP
+          v3:BasicObject = LoadField v2, :a@0x1000
+          v4:BasicObject = LoadField v2, :i@0x1001
+          Jump bb3(v1, v3, v4)
+        bb2():
+          EntryPoint JIT(0)
+          v7:BasicObject = LoadArg :self@0
+          v8:BasicObject = LoadArg :a@1
+          v9:BasicObject = LoadArg :i@2
+          Jump bb3(v7, v8, v9)
+        bb3(v11:BasicObject, v12:BasicObject, v13:BasicObject):
+          v21:CBool = HasType v12, ArrayExact
+          CondBranch v21, bb5(), bb6()
+        bb5():
+          v24:ArrayExact = RefineType v12, ArrayExact
+          PatchPoint NoSingletonClass(Array@0x1008)
+          PatchPoint MethodRedefined(Array@0x1008, []@0x1010, cme:0x1018)
+          v43:Fixnum = GuardType v13, Fixnum
+          v44:CInt64 = UnboxFixnum v43
+          v45:CInt64 = ArrayLength v24
+          v46:CInt64 = GuardLess v44, v45
+          v47:CInt64 = AdjustBounds v46, v45
+          v48:CInt64[0] = Const CInt64(0)
+          v49:CInt64 = GuardGreaterEq v47, v48
+          v50:BasicObject = ArrayAref v24, v49
+          Jump bb4(v50)
+        bb6():
+          v27:CBool = HasType v12, HashExact
+          CondBranch v27, bb7(), bb8()
+        bb7():
+          v30:HashExact = RefineType v12, HashExact
+          PatchPoint NoSingletonClass(Hash@0x1040)
+          PatchPoint MethodRedefined(Hash@0x1040, []@0x1010, cme:0x1048)
+          v54:BasicObject = HashAref v30, v13
+          Jump bb4(v54)
+        bb8():
+          v33:BasicObject = Send v12, :[], v13 # SendFallbackReason: Send: polymorphic call site
+          Jump bb4(v33)
+        bb4(v20:BasicObject):
+          CheckInterrupts
+          Return v20
+        ");
+    }
+
     #[test]
     fn specialize_polymorphic_send_fixnum_and_bignum() {
         // Fixnum and Bignum both have class Integer, but they should be
@@ -18849,9 +18914,11 @@ mod hir_opt_tests {
             30.times { test_float_mul_recompile(-0.0, 1.5) }
         "#);
 
+        // After recompiling, the HeapFloat arm of the polymorphic dispatch must
+        // not speculate on Flonum; it falls back to CCallWithFrame. The Flonum
+        // arm still inlines FloatMul, guarded on the Flonum-profiled argument.
         let final_hir = hir_string("test_float_mul_recompile");
         assert!(final_hir.contains("CCallWithFrame"), "{final_hir}");
-        assert!(!final_hir.contains("FloatMul"), "{final_hir}");
         assert_snapshot!(format!("{intermediate_hir}\n{final_hir}"), @"
         fn test_float_mul_recompile@<compiled>:2:
         bb1():
@@ -18903,8 +18970,9 @@ mod hir_opt_tests {
         bb7():
           v30:Flonum = RefineType v12, Flonum
           PatchPoint MethodRedefined(Float@0x1008, *@0x1010, cme:0x1018)
-          v45:BasicObject = CCallWithFrame v30, :Float#*@0x1040, v13
-          Jump bb4(v45)
+          v45:Flonum = GuardType v13, Flonum recompile
+          v46:Float = FloatMul v30, v45
+          Jump bb4(v46)
         bb8():
           v33:BasicObject = Send v12, :*, v13 # SendFallbackReason: Send: polymorphic call site
           Jump bb4(v33)
@@ -20754,4 +20822,67 @@ mod hir_opt_tests {
           Return v59
         ");
     }
+
+    #[test]
+    fn test_elide_load_store_extended() {
+        eval(r#"
+            class C
+              def initialize
+                @foo = 1
+                100.times { |i| instance_variable_set(:"@v#{i}", i) }
+                @hclk = 1
+                @hclk_target = 2
+              end
+              def foo = 4
+              def wait_one_clock
+                @hclk += 1
+                foo if @hclk_target <= @hclk
+              end
+            end
+            O = C.new
+            O.wait_one_clock
+        "#);
+        assert_snapshot!(hir_string_proc("C.instance_method(:wait_one_clock)"), @"
+        fn wait_one_clock@<compiled>:11:
+        bb1():
+          EntryPoint interpreter
+          v1:BasicObject = LoadSelf
+          Jump bb3(v1)
+        bb2():
+          EntryPoint JIT(0)
+          v4:BasicObject = LoadArg :self@0
+          Jump bb3(v4)
+        bb3(v6:BasicObject):
+          PatchPoint SingleRactorMode
+          v11:HeapBasicObject = GuardType v6, HeapBasicObject
+          v12:CShape = LoadField v11, :shape_id@0x1000
+          v13:CShape[0x1001] = GuardBitEquals v12, CShape(0x1001) recompile
+          v14:IMemo = LoadField v11, :fields_obj@0x1002
+          v15:BasicObject = LoadField v14, :@hclk@0x1003
+          v17:Fixnum[1] = Const Value(1)
+          PatchPoint MethodRedefined(Integer@0x1008, +@0x1010, cme:0x1018)
+          v71:Fixnum = GuardType v15, Fixnum recompile
+          v72:Fixnum = FixnumAdd v71, v17
+          StoreField v14, :@hclk@0x1003, v72
+          WriteBarrier v14, v72
+          PatchPoint SingleRactorMode
+          v37:BasicObject = LoadField v14, :@hclk_target@0x1040
+          PatchPoint MethodRedefined(Integer@0x1008, <=@0x1041, cme:0x1048)
+          v75:Fixnum = GuardType v37, Fixnum recompile
+          v77:BoolExact = FixnumLe v75, v72
+          v49:CBool = Test v77
+          CondBranch v49, bb5(), bb4(v11)
+        bb5():
+          PatchPoint NoSingletonClass(C@0x1070)
+          PatchPoint MethodRedefined(C@0x1070, foo@0x1078, cme:0x1080)
+          v80:ObjectSubclass[class_exact:C] = GuardType v11, ObjectSubclass[class_exact:C] recompile
+          v81:Fixnum[4] = Const Value(4)
+          CheckInterrupts
+          Return v81
+        bb4(v60:HeapBasicObject):
+          v63:NilClass = Const Value(nil)
+          CheckInterrupts
+          Return v63
+        ");
+    }
 }
diff --git a/zjit/src/hir_type/gen_hir_type.rb b/zjit/src/hir_type/gen_hir_type.rb
index 8db620123b72d7..a87f3b821b749c 100644
--- a/zjit/src/hir_type/gen_hir_type.rb
+++ b/zjit/src/hir_type/gen_hir_type.rb
@@ -47,7 +47,9 @@ def to_graphviz type, f
 any = Type.new "Any"
 # Build the Ruby object universe.
 value = any.subtype "RubyValue"
+imemo = value.subtype "IMemo"
 undef_ = value.subtype "Undef"
+# TODO(max): Figure out if CME should be a subtype of IMemo
 value.subtype "CallableMethodEntry"  # rb_callable_method_entry_t*
 basic_object = value.subtype "BasicObject"
 basic_object_exact = basic_object.subtype "BasicObjectExact"
diff --git a/zjit/src/hir_type/hir_type.inc.rs b/zjit/src/hir_type/hir_type.inc.rs
index ca3ddf6a9ec00e..aa9fbf987f5f00 100644
--- a/zjit/src/hir_type/hir_type.inc.rs
+++ b/zjit/src/hir_type/hir_type.inc.rs
@@ -45,40 +45,41 @@ mod bits {
   pub const HeapBasicObject: u64 = BasicObject & !Immediate;
   pub const HeapFloat: u64 = 1u64 << 28;
   pub const HeapObject: u64 = Object & !Immediate;
+  pub const IMemo: u64 = 1u64 << 29;
   pub const Immediate: u64 = FalseClass | Fixnum | Flonum | NilClass | StaticSymbol | TrueClass | Undef;
   pub const Integer: u64 = Bignum | Fixnum;
   pub const Module: u64 = Class | ModuleExact | ModuleSubclass;
-  pub const ModuleExact: u64 = 1u64 << 29;
-  pub const ModuleSubclass: u64 = 1u64 << 30;
-  pub const NilClass: u64 = 1u64 << 31;
+  pub const ModuleExact: u64 = 1u64 << 30;
+  pub const ModuleSubclass: u64 = 1u64 << 31;
+  pub const NilClass: u64 = 1u64 << 32;
   pub const NotNil: u64 = BasicObject & !NilClass;
   pub const NotString: u64 = BasicObject & !String;
   pub const Numeric: u64 = Float | Integer | NumericExact | NumericSubclass;
-  pub const NumericExact: u64 = 1u64 << 32;
-  pub const NumericSubclass: u64 = 1u64 << 33;
+  pub const NumericExact: u64 = 1u64 << 33;
+  pub const NumericSubclass: u64 = 1u64 << 34;
   pub const Object: u64 = Array | FalseClass | Hash | Module | NilClass | Numeric | ObjectExact | ObjectSubclass | Range | Regexp | Set | String | Symbol | TrueClass;
-  pub const ObjectExact: u64 = 1u64 << 34;
-  pub const ObjectSubclass: u64 = 1u64 << 35;
+  pub const ObjectExact: u64 = 1u64 << 35;
+  pub const ObjectSubclass: u64 = 1u64 << 36;
   pub const Range: u64 = RangeExact | RangeSubclass;
-  pub const RangeExact: u64 = 1u64 << 36;
-  pub const RangeSubclass: u64 = 1u64 << 37;
+  pub const RangeExact: u64 = 1u64 << 37;
+  pub const RangeSubclass: u64 = 1u64 << 38;
   pub const Regexp: u64 = RegexpExact | RegexpSubclass;
-  pub const RegexpExact: u64 = 1u64 << 38;
-  pub const RegexpSubclass: u64 = 1u64 << 39;
-  pub const RubyValue: u64 = BasicObject | CallableMethodEntry | Undef;
+  pub const RegexpExact: u64 = 1u64 << 39;
+  pub const RegexpSubclass: u64 = 1u64 << 40;
+  pub const RubyValue: u64 = BasicObject | CallableMethodEntry | IMemo | Undef;
   pub const Set: u64 = SetExact | SetSubclass;
-  pub const SetExact: u64 = 1u64 << 40;
-  pub const SetSubclass: u64 = 1u64 << 41;
-  pub const StaticSymbol: u64 = 1u64 << 42;
+  pub const SetExact: u64 = 1u64 << 41;
+  pub const SetSubclass: u64 = 1u64 << 42;
+  pub const StaticSymbol: u64 = 1u64 << 43;
   pub const String: u64 = StringExact | StringSubclass;
-  pub const StringExact: u64 = 1u64 << 43;
-  pub const StringSubclass: u64 = 1u64 << 44;
+  pub const StringExact: u64 = 1u64 << 44;
+  pub const StringSubclass: u64 = 1u64 << 45;
   pub const Subclass: u64 = ArraySubclass | BasicObjectSubclass | ClassSubclass | HashSubclass | ModuleSubclass | NumericSubclass | ObjectSubclass | RangeSubclass | RegexpSubclass | SetSubclass | StringSubclass;
   pub const Symbol: u64 = DynamicSymbol | StaticSymbol;
-  pub const TrueClass: u64 = 1u64 << 45;
+  pub const TrueClass: u64 = 1u64 << 46;
   pub const Truthy: u64 = BasicObject & !Falsy;
-  pub const Undef: u64 = 1u64 << 46;
-  pub const AllBitPatterns: [(&str, u64); 78] = [
+  pub const Undef: u64 = 1u64 << 47;
+  pub const AllBitPatterns: [(&str, u64); 79] = [
     ("Any", Any),
     ("RubyValue", RubyValue),
     ("Immediate", Immediate),
@@ -118,6 +119,7 @@ mod bits {
     ("Module", Module),
     ("ModuleSubclass", ModuleSubclass),
     ("ModuleExact", ModuleExact),
+    ("IMemo", IMemo),
     ("Float", Float),
     ("HeapFloat", HeapFloat),
     ("Hash", Hash),
@@ -158,7 +160,7 @@ mod bits {
     ("ArrayExact", ArrayExact),
     ("Empty", Empty),
   ];
-  pub const NumTypeBits: u64 = 47;
+  pub const NumTypeBits: u64 = 48;
 }
 pub mod types {
   use super::*;
@@ -207,6 +209,7 @@ pub mod types {
   pub const HeapBasicObject: Type = Type::from_bits(bits::HeapBasicObject);
   pub const HeapFloat: Type = Type::from_bits(bits::HeapFloat);
   pub const HeapObject: Type = Type::from_bits(bits::HeapObject);
+  pub const IMemo: Type = Type::from_bits(bits::IMemo);
   pub const Immediate: Type = Type::from_bits(bits::Immediate);
   pub const Integer: Type = Type::from_bits(bits::Integer);
   pub const Module: Type = Type::from_bits(bits::Module);
diff --git a/zjit/src/profile.rs b/zjit/src/profile.rs
index 3e8a2e1e8873b0..096b0871d26457 100644
--- a/zjit/src/profile.rs
+++ b/zjit/src/profile.rs
@@ -123,12 +123,6 @@ fn profile_insn(bare_opcode: ruby_vminsn_type, ec: EcPtr) {
     }
 }
 
-/// Return whether the interpreter finished profiling the current instruction.
-pub fn profile_recompile_insn(ec: EcPtr) -> bool {
-    let profiler = &Profiler::new(ec);
-    get_or_create_iseq_payload(profiler.iseq).profile.done_profiling_at(profiler.insn_idx)
-}
-
 /// Reset existing profile counters and install profiling instructions throughout an ISEQ.
 /// Newly reached instructions initialize their counters from the same option.
 pub(crate) fn reset_profiles_remaining(iseq: IseqPtr) {