I'm unfamiliar with this particular assumption. When might EP not be BP? Is this a global effect or scoped to a frame? An ISEQ? Something else? Is this recognizable statically in HIR or do we have to track it happening somewhere in the runtime with a hook?

When might EP not be BP?

When an environment is escaped to the heap. As written in the comment, <main> and eval starts with EP pointing to the heap. After entry, methods like proc {} or binding can escape stack-local EP to the heap afterward.

Is this a global effect or scoped to a frame? An ISEQ? Something else?

Scoped to a frame. An ISEQ type (<main>/eval or not) tells you whether EP should point to the heap from the beginning or not.

Is this recognizable statically in HIR or do we have to track it happening somewhere in the runtime with a hook?

Remember #13750 (comment), this is where I suggested any method_call could escape EP of the caller frame (the block given to Numeric#times). Because Ruby allows escaping the EP of any frame in the call stack at any time, yes, we'd have to track it happening somewhere in the runtime with a hook.

Unless we recursively inline every method call, including ones called inside C functions, it's impossible to statically track every arbitrary method call that may happen under the current frame at compile time.