use STACK_ADDR_FROM_TOP()

vm_invoke_builtin() accesses VM stack via cfp->sp. However, MJIT
can use their own stack. To access them appropriately, we need to
use STACK_ADDR_FROM_TOP().

insns.def

@@ -1497,7 +1497,7 @@ invokebuiltin
 // attr bool leaf = false; /* anything can happen inside */
 // attr rb_snum_t sp_inc = 1 - bf->argc;
 {
-    ret = vm_invoke_builtin(ec, reg_cfp, bf);
+    ret = vm_invoke_builtin(ec, reg_cfp, bf, STACK_ADDR_FROM_TOP(bf->argc));
 }
 
 /* call specific function with args (same parameters) */

vm_insnhelper.c

@@ -4981,9 +4981,8 @@ invoke_bf(rb_execution_context_t *ec, rb_control_frame_t *cfp, const struct rb_b
 }
 
 static VALUE
-vm_invoke_builtin(rb_execution_context_t *ec, rb_control_frame_t *cfp, const struct rb_builtin_function* bf)
+vm_invoke_builtin(rb_execution_context_t *ec, rb_control_frame_t *cfp, const struct rb_builtin_function* bf, const VALUE *argv)
 {
-    const VALUE *argv = cfp->sp - bf->argc;
     return invoke_bf(ec, cfp, bf, argv);
 }