rigortype 0.3.9 → 0.4.0

data/lib/rigor/inference/content_join.rb

@@ -35,23 +35,28 @@ module Rigor
       # argument and the value the last.
       HASH_CONTENT_ADDERS = %i[[]= store].to_set.freeze
 
-      # String content-mutators that append to the buffer. String carries no element parameter, so
-      # these contribute nothing to a join — they are listed so the orchestrator recognises them as
-      # content mutators (the binding already widens to `String` via normal typing); the join
-      # helpers below short-circuit on a non-collection pre-state.
-      STRING_CONTENT_ADDERS = %i[<< concat prepend insert replace].to_set.freeze
+      # Every method name that adds to a collection's CONTENT — the evidence the joins read, and the
+      # gate the straight-line path types its arguments behind. A String carries no element
+      # parameter, so it has no adders of its own; `StatementEvaluator::CONTENT_MUTATORS` adds the
+      # String mutators to what its scans count.
+      CONTENT_ADDERS = (ARRAY_CONTENT_ADDERS | HASH_CONTENT_ADDERS).freeze
 
-      # Every method name that mutates a collection's CONTENT — the union the orchestrators scan a
-      # block body for, and the gate the straight-line path types its arguments behind.
-      CONTENT_ADDERS = (ARRAY_CONTENT_ADDERS | HASH_CONTENT_ADDERS | STRING_CONTENT_ADDERS).freeze
+      # The probes {#could_be_range?} passes to `accepts` — interned because the questions are
+      # asked once per `[]=` index member.
+      RANGE_INDEX_PROBE = Type::Combinator.nominal_of("Range")
+      OBJECT_INDEX_PROBE = Type::Combinator.nominal_of("Object")
+      ARRAY_PROBE = Type::Combinator.nominal_of("Array")
+      private_constant :RANGE_INDEX_PROBE, :OBJECT_INDEX_PROBE, :ARRAY_PROBE
 
       module_function
 
       # The element types a single content-mutator call introduces into an Array, given the
       # per-argument types (already typed by the caller in the scope the arguments are evaluated
       # in). `concat`/`replace` take collection arguments, so their element evidence is the
-      # arguments' OWN element types unioned; the rest append the argument values directly. Returns
-      # `[]` when there is no element evidence (e.g. a `<<` with no resolvable arg).
+      # arguments' OWN element types unioned; the `[]=` splice forms (`arr[i, n] = other` /
+      # `arr[range] = other`) store their value's elements the same way and read it through the
+      # same unwrap (issue #1140). The rest append the argument values directly. Returns `[]` when
+      # there is no element evidence (e.g. a `<<` with no resolvable arg).
       def array_added_elements(method_name, arg_types)
         return [] if arg_types.empty?
 
@@ -62,21 +67,27 @@ module Rigor
           # `insert(index, *objs)` — first arg is the position.
           arg_types.drop(1)
         when :[]=
-          # `arr[i] = v` / `arr[i, n] = v` — value is the last argument.
-          #
-          # The SPLICE forms (`arr[i, n] = other` / `arr[range] = other`) store `other`'s ELEMENTS,
-          # not `other` itself, so reading the value as one element over-widens: `a[0, 2] = [1, 2]`
-          # contributes `Array[Integer]` where `Integer` is the truth. Left alone deliberately —
-          # the answer is a superset either way, so it can only cost precision, and splitting the
-          # arities here would need the receiver's own element type to unwrap against. Revisit if a
-          # corpus site ever reads an element back through a splice-built array.
-          [arg_types.last]
+          # `arr[i] = v` stores `v` as ONE element — the index arguments precede the value.
+          # The splice forms store the value's ELEMENTS instead (issue #1140): `a[0, 2] = [1, 2]`
+          # puts `Integer`s in the receiver, not an `Array[Integer]`. An index the engine cannot
+          # classify (`a[x] = v` with `x` untyped, a `Range | Integer` union, or a splat that
+          # may vanish inside the brackets) may be either form, so both readings join — the
+          # union is a superset of the truth either way.
+          case index_store_form(arg_types)
+          when :splice then splice_stored_elements(arg_types.last)
+          when :either then [arg_types.last] + splice_stored_elements(arg_types.last)
+          else [arg_types.last]
+          end
         when :fill
           # `fill(value)` — only the no-block single-value form adds a concrete element; block /
           # range forms are conservatively ignored (the arity-forget already widened the binding).
           arg_types.size == 1 ? arg_types : []
-        else # << push append prepend unshift
+        when :<<, :push, :append, :prepend, :unshift
           arg_types
+        else
+          # Not an Array adder — a String mutator a content scan counted (`x.sub!("a", "b")` on an
+          # `Array | String` capture): its arguments are not elements.
+          []
         end
       end
 
@@ -122,6 +133,23 @@ module Rigor
         with_residue(Type::Combinator.nominal_of("Hash", type_args: [key_t, value_t]), hash_residue(pre_state))
       end
 
+      # Builds the continuation of a pre-state that carries BOTH an Array and a Hash member, from the
+      # pairs and the elements the body stores. Each side is joined with its own class's evidence, and
+      # every member neither side absorbs survives beside the Hash carrier ({#hash_residue}).
+      #
+      # Joined as one carrier, the other class's member was residue and survived exactly as the seed
+      # had it: an unwidened literal `Tuple` / `HashShape`, so what the body did to it was gone — `x =
+      # gets ? [1] : { a: 1 }; [0].each { x.map!(&:to_s) if x.is_a?(Array); x[:k] = 2 if
+      # x.is_a?(Hash) }` read `[1]`, and `x.first.upcase` drew `undefined method` on correct code. The
+      # caller routes the evidence: a store may reach either member, and only the caller sees its
+      # index (`StatementEvaluator#mixed_content_evidence`).
+      def join_mixed_content(pre_state, added_pairs, added_elements)
+        members = pre_state.is_a?(Type::Union) ? pre_state.members : [pre_state]
+        arrays, rest = members.partition { |member| array_residue(member).empty? }
+        array = join_array_content(Type::Combinator.union(*arrays), added_elements)
+        Type::Combinator.union(array, join_hash_content(Type::Combinator.union(*rest), added_pairs))
+      end
+
       # ----------------------------------------------------------------
       # Union residue — the members the rederived carrier does NOT stand for (issue #631).
       #
@@ -277,15 +305,158 @@ module Rigor
         type.is_a?(Type::Union) ? type.members : [type]
       end
 
+      # How an `arr[...] = v` call's index arguments place the stored value: `:splice` — the
+      # value's ELEMENTS land in the receiver (`arr[i, n] = v` takes two index slots,
+      # `arr[range] = v` takes a Range); `:element` — the value itself is one stored element
+      # (`arr[i] = v`); `:either` — the store may be either form.
+      #
+      # A splat inside the brackets is marked `nil` by the caller — its expansion can change the
+      # store's arity (`a[0, *xs] = v` stores `v` itself when `xs` is empty and `v`'s elements
+      # otherwise). An ordinary argument counts as a provable index however untyped it is:
+      # `a[i, n] = v` is a splice at every binding of `i` and `n`. Two or more provable indices
+      # are therefore always a splice however a splat expands; one provable index beside a splat
+      # reduces to the Range question (extra expansion only reaches an arity error, never a
+      # scalar store); zero provable indices leaves the form to whatever the splat yields.
+      def index_store_form(arg_types)
+        leading = arg_types[0...-1]
+        definite = leading.compact
+        return :splice if definite.size >= 2
+        return :either if definite.empty?
+        return single_index_form(definite.first) if definite.size == leading.size
+
+        range_index?(definite.first) ? :splice : :either
+      end
+
+      # The one-index question: a Range carrier is a splice, a definite scalar an element store,
+      # and anything between — a union straddling both, a broad index that may still hold a
+      # Range at runtime — may be either.
+      def single_index_form(index_type)
+        members = union_members(index_type)
+        return :splice if members.all? { |m| definite_range?(m) }
+        return :element if members.none? { |m| could_be_range?(m) }
+
+        :either
+      end
+
+      # True when the index position PROVABLY holds a Range: a Range carrier {#range_index?}
+      # recognizes, or a member acceptance proves a subtype of `Range` — a loaded
+      # `class MyRange < Range` answers `yes` there where the name check cannot see it. An
+      # unresolvable subclass answers `maybe`, which correctly declines here and still reaches
+      # {#could_be_range?}'s `either` reading. A gradual member accepts in BOTH directions
+      # (`Range` accepts it optimistically), so it must be excluded before asking — an untyped
+      # index may hold a scalar just as well and stays `either`. The exclusion reads through a
+      # `Difference` / `Refined` to its base: acceptance projects the wrapper onto the base too,
+      # so a `non-nil` or refined `Dynamic` answers `yes` there exactly like the bare gradual
+      # while still being free to hold a scalar at runtime.
+      def definite_range?(member)
+        return true if range_index?(member)
+
+        case member
+        when Type::Dynamic, Type::Top then false
+        when Type::Difference, Type::Refined then definite_range?(member.base)
+        else member.respond_to?(:accepts) && RANGE_INDEX_PROBE.accepts(member).yes?
+        end
+      end
+
+      # True when the index position MAY hold a Range at runtime: a definite Range carrier
+      # (`Constant[0..1]` accepts only its own value, so acceptance alone cannot see it),
+      # `Dynamic`, a carrier the engine cannot answer for, and every type related to
+      # `Nominal[Range]` in EITHER direction — `Object`/`Enumerable`/`top` above it, a
+      # project `class MyRange < Range` below it (an unresolvable class name answers `maybe`,
+      # never `no`, so subclass-ness cannot be ruled out).
+      #
+      # `no` in both directions is a real disjointness only when the member's values are
+      # provably `Object` instances — a fixed-class value set that single inheritance keeps
+      # from ever being a Range (`Integer`, a non-Range `Constant`, a `Tuple`). A MODULE
+      # member fails that probe (`Comparable`'s ancestors exclude `Object` — a module has no
+      # superclass chain), and rightly so: `class MyRange < Range; include Comparable; end`
+      # satisfies the annotation and still splices at runtime.
+      def could_be_range?(member)
+        return true if range_index?(member)
+
+        case member
+        when Type::Intersection
+          # An intersected value sits in EVERY member's value set, so it can be a Range only
+          # when every member allows one — `String & Comparable` cannot be (a String never
+          # is), `Object & Comparable` can (`MyRange < Range; include Comparable` satisfies
+          # both). Asked member-wise because the `Object` probe below answers yes when ANY
+          # intersected member accepts it.
+          member.members.all? { |part| could_be_range?(part) }
+        when Type::Maybe then could_be_range?(member.value_type)
+        else
+          return true unless member.respond_to?(:accepts)
+          return true unless member.accepts(RANGE_INDEX_PROBE).no? &&
+                             RANGE_INDEX_PROBE.accepts(member).no?
+
+          !OBJECT_INDEX_PROBE.accepts(member).yes?
+        end
+      end
+
+      # Element types a splice RHS adds to the receiver, read member-wise. Ruby splices an
+      # Array RHS (`a[0, 1] = [1, 2]` puts `Integer`s in — a bare `Nominal[Array]` splices
+      # elements the signature left untyped, which are unknown rather than none), and stores a
+      # NON-Array RHS as one element UNLESS the value coerces through `to_ary`, in which case
+      # the returned array's elements splice instead (`a[0, 1] = obj` where `obj.to_ary`
+      # returns `["x"]` stores `"x"`). `nil` is no exception — `a[i, n] = nil` stores a single
+      # nil.
+      #
+      # Every member that is not an Array carrier keeps a `Dynamic[top]` arm beside itself:
+      # `to_ary` is consulted for a NON-Array value, and nothing here can prove the member's
+      # class does not define one — a `Nominal` may be a subclass that declares it, and the
+      # project may reopen even a non-subclassable core class (ADR-17's patched-methods tier
+      # resolves exactly those). The two exact carriers are the ones `Array#[]=` splices
+      # without a coercion: a `Tuple` literal's elements, and a `Nominal[Array]`'s own type
+      # arguments — an Array object is spliced directly even when its class overrides
+      # `to_ary`.
+      def splice_stored_elements(value_type)
+        union_members(value_type).flat_map do |member|
+          base = member
+          base = base.base while base.is_a?(Type::Difference) || base.is_a?(Type::Refined)
+
+          case base
+          when Type::Tuple
+            base.elements
+          when Type::Nominal
+            if base.class_name == "Array"
+              # `Array#[]=` splices an Array RHS directly — `to_ary` is never consulted
+              # for an Array object, even a subclass overriding it — so the elements
+              # join exactly (a bare `Array` signature left them unknown, not absent).
+              base.type_args.empty? ? [Type::Combinator.untyped] : base.type_args
+            elsif ARRAY_PROBE.accepts(base).yes?
+              # A definite Array subclass is spliced the same way; its elements are
+              # unknown to this seam.
+              [Type::Combinator.untyped]
+            else
+              [member, Type::Combinator.untyped]
+            end
+          else
+            [member, Type::Combinator.untyped]
+          end
+        end
+      end
+
+      # True when an index position holds a Range carrier — a static `Constant<Range>` (`0..1`),
+      # a `Nominal[Range]` (`(0..n)`), or a refinement / difference over either. `IntegerRange`
+      # and `FloatRange` are scalar number refinements rather than Range objects and correctly
+      # decline, as does every ordinary scalar index.
+      def range_index?(type)
+        case type
+        when Type::Constant then type.value.is_a?(::Range)
+        when Type::Nominal then type.class_name == "Range"
+        when Type::Difference, Type::Refined then range_index?(type.base)
+        else false
+        end
+      end
+
       # Element types carried by a collection binding, regardless of which carrier holds them: a
       # `Tuple` lists them, a `Nominal[Array, [E]]` has one element param, a bare `Array` /
       # anything else yields none.
       #
       # A `Difference` reads through to its base: `non-empty-array[T]` holds `T`s, and the seams
       # that read a seed from BEFORE the arity-forget ran (see {#join_array_content}) meet the
-      # refinement carrier itself where they used to meet the base the widening had left. Declining
-      # it there would hand the continuation the widened base ALONE, with every appended arm missing
-      # — a wrong type, not a wide one.
+      # refinement carrier itself where they used to meet the base the widening had left.
+      # Declining it there would hand the continuation the widened base ALONE, with every appended
+      # arm missing — a wrong type, not a wide one.
       def collection_element_types(type)
         case type
         when Type::Tuple
@@ -305,13 +476,15 @@ module Rigor
 
       # `[keys, values]` evidence from a Hash-ish pre-state binding — a `HashShape` (literal pairs)
       # or a `Nominal[Hash, [K, V]]`. A `Difference` (`non-empty-hash[K, V]`) reads through to its
-      # base, as {#collection_element_types} does for the Array side.
+      # base, as {#collection_element_types} does for the Array side. An open shape adds a
+      # `Dynamic[top]` key and value: its unseen keys may hold anything, and the joined carrier's
+      # read of one must not answer a known value (`flags = { debug: true }; flags.default = false`
+      # then a store in a block read `flags[:verbose]` as `true`).
       def hash_shape_key_values(type)
         case type
         when Type::HashShape
-          return [[], []] if type.pairs.empty?
-
-          [[key_union_for(type.pairs.keys)], type.pairs.values]
+          keys, values = type.pairs.empty? ? [[], []] : [[key_union_for(type.pairs.keys)], type.pairs.values]
+          type.open? ? [keys + [Type::Combinator.untyped], values + [Type::Combinator.untyped]] : [keys, values]
         when Type::Nominal
           type.class_name == "Hash" && type.type_args.size == 2 ? [[type.type_args[0]], [type.type_args[1]]] : [[], []]
         when Type::Union

data/lib/rigor/inference/def_return_typer.rb

@@ -4,6 +4,7 @@ require "prism"
 
 require_relative "../type"
 require_relative "../source/node_children"
+require_relative "return_barrier"
 
 module Rigor
   module Inference
@@ -13,15 +14,14 @@ module Rigor
     # The inferred type is the union of:
     #
     # - the body's last-statement type, and
-    # - the type of every explicit `return value` reachable in the body. Nested `def` / lambda / block bodies
-    #   are return barriers — their `return`s do not bubble up to the enclosing method.
+    # - the type of every explicit `return value` that exits the method. A `return` inside an ordinary block does
+    #   (control-flow-analysis.md § "Non-local exits"); one inside a {ReturnBarrier} — a nested `def`, a lambda,
+    #   or a `define_method` body — does not. The barriers are the ones `StatementEvaluator`'s return sink stops
+    #   at, so the proposal and `rigor check`'s view of callers agree (issue #1382).
     #
     # Extracted from `Rigor::SigGen::Generator#infer_return_type` so `LineTypeCollector` (`rigor annotate`'s
     # def-line annotator) and the sig-generator share one source of truth.
     module DefReturnTyper
-      RETURN_BARRIER_NODES = [Prism::DefNode, Prism::LambdaNode, Prism::BlockNode].freeze
-      private_constant :RETURN_BARRIER_NODES
-
       module_function
 
       def call(def_node, scope_index)
@@ -60,10 +60,14 @@ module Rigor
 
       def collect_return_types(node, scope_index, out)
         return unless node.is_a?(Prism::Node)
-        return if RETURN_BARRIER_NODES.any? { |klass| node.is_a?(klass) }
+        return if ReturnBarrier.node?(node)
 
         type_return_node(node, scope_index, out) if node.is_a?(Prism::ReturnNode)
-        node.rigor_each_child { |c| collect_return_types(c, scope_index, out) }
+        # A barrier call's receiver and arguments still run in the method; only its block is cut off.
+        barrier_block = node.block if node.is_a?(Prism::CallNode) && ReturnBarrier.block_call?(node)
+        node.rigor_each_child do |c|
+          collect_return_types(c, scope_index, out) unless c.equal?(barrier_block)
+        end
       end
 
       def type_return_node(return_node, scope_index, out)

data/lib/rigor/inference/define_method_block_self.rb

@@ -0,0 +1,64 @@
+# frozen_string_literal: true
+
+require_relative "../type"
+
+module Rigor
+  module Inference
+    # Issue #963 — the lexical `self` of a `define_method(:name) { ... }` block.
+    #
+    # A block has no `self` of its own, so every block body enters with `Scope#entering_opaque_block`
+    # and the enclosing class body's `self_type` (`Singleton[C]`) rides along unchanged. For
+    # `define_method` that carrier is the wrong side of the class: `Module#define_method` turns the
+    # block into an INSTANCE method of the receiver, and Ruby runs its body with `self` bound to the
+    # receiving instance. A bare `text` inside the block therefore reaches `C`'s member / attr reader,
+    # while `Singleton[C]` answers only `C`'s class methods.
+    #
+    # The consequence #963 records is #618's veto going the wrong way: `ExpressionTyper#self_type_answers?`
+    # asked the singleton side, found nothing, and let a same-named top-level `def text` bind ahead of the
+    # reader — typing `text.upcase` inside `class Line < Struct.new(:text); define_method(:shout) { text.upcase }`
+    # as the top-level def's `nil`. Narrowing the block body's `self_type` to `Nominal[C]` makes the
+    # existing veto ask the instance side, which is the side Ruby dispatches on; nothing in the veto
+    # itself changes.
+    #
+    # The match is deliberately narrow — the receiver must be the class body's own `self`, and that `self`
+    # must be a known `Singleton[C]` on the instance side of the class. `Foo.define_method(...)` on some other
+    # receiver keeps the unmodelled-self answer, and so does a `class << ...` BODY, where `self` is the
+    # singleton class and the call defines a CLASS method: an instance reader is not in that MRO, MRI reaches
+    # the top-level `def` there, and Rigor must answer the same. The body is the exclusion, not the lexical
+    # singleton frame — a `def` reached from that body has the class object as its `self`, so the call defines
+    # an instance method and the narrowing applies. `Scope#singleton_class_body?` is what draws that line, and
+    # carrying it on the scope is what lets both block-entry paths apply it identically.
+    # A `module_function` module is the one shape where both answers are right at once: MRI makes the block
+    # BOTH an instance method, where the reader resolves, and a module function on the module object, where it
+    # does not. Narrowing silences the module-function half, which is the false-positive-averse direction
+    # AGENTS.md § Implementation Guidelines asks for.
+    module DefineMethodBlockSelf
+      module_function
+
+      # @return the block body's narrowed `self_type`, or `nil` when the call shape does not match.
+      def narrow_self_type_for(scope:, call_node:)
+        return nil if scope&.singleton_class_body?
+        return nil unless define_method_on_lexical_self?(call_node)
+
+        self_type = scope&.self_type
+        return nil unless self_type.is_a?(Type::Singleton)
+
+        class_name = self_type.class_name
+        return nil if class_name.nil?
+
+        instance_type_for(class_name, scope.environment)
+      end
+
+      def define_method_on_lexical_self?(call_node)
+        return false unless call_node.is_a?(Prism::CallNode)
+        return false unless call_node.name == :define_method
+
+        call_node.receiver.nil? || call_node.receiver.is_a?(Prism::SelfNode)
+      end
+
+      def instance_type_for(class_name, environment)
+        environment&.nominal_for_name(class_name) || Type::Nominal.new(class_name)
+      end
+    end
+  end
+end

data/lib/rigor/inference/element_read_widening.rb

@@ -45,7 +45,7 @@ module Rigor
         widened = widen_through_path(current_scope.local(read.name), steps, call_node.name, arg_types)
         return current_scope if widened.nil?
 
-        current_scope.with_local(read.name, widened)
+        current_scope.with_mutated_local(read.name, widened)
       end
 
       # True when `receiver` is an element read whose target element is a literal-shape carrier —
@@ -62,7 +62,12 @@ module Rigor
       # `[<local read>, [step, …]]` for a chain of element reads rooted at a local variable, or
       # `nil` when the expression is anything else. A step is an Integer position (negative counts
       # from the end, as Ruby's own indexing does) or `:all` when the index is not a literal.
+      #
+      # Every mutation site's receiver is asked, and nearly every one is a plain variable read, so a
+      # receiver that is no call answers before the step list is allocated.
       def element_read_path(node)
+        return nil unless node.is_a?(Prism::CallNode)
+
         steps = []
         cursor = node
         while cursor.is_a?(Prism::CallNode)
@@ -118,22 +123,29 @@ module Rigor
       end
 
       # Rebuilds `type` with the element at `steps` widened against `method_name`, or `nil` when
-      # nothing along the path widened.
-      def widen_through_path(type, steps, method_name, arg_types)
-        return MutationWidening.widen_for_mutator(type, method_name, arg_types: arg_types) if steps.empty?
+      # nothing along the path widened. A block, when given, replaces the straight-line widening of the
+      # element itself: it receives the element's type and answers the widened one, or `nil` to decline.
+      # {UnknownStoreWidening} passes one so a site on an element takes the same unknown-store widening a
+      # site on a variable does.
+      def widen_through_path(type, steps, method_name, arg_types, &element_widening)
+        if steps.empty?
+          return element_widening.call(type) if element_widening
+
+          return MutationWidening.widen_for_mutator(type, method_name, arg_types: arg_types)
+        end
 
         case type
-        when Type::Tuple then widen_tuple_path(type, steps, method_name, arg_types)
-        when Type::Union then widen_union_path(type, steps, method_name, arg_types)
+        when Type::Tuple then widen_tuple_path(type, steps, method_name, arg_types, &element_widening)
+        when Type::Union then widen_union_path(type, steps, method_name, arg_types, &element_widening)
         end
       end
 
-      def widen_tuple_path(tuple, steps, method_name, arg_types)
+      def widen_tuple_path(tuple, steps, method_name, arg_types, &)
         elements = tuple.elements.dup
         rest = steps.drop(1)
         widened_any = false
         tuple_positions(tuple, steps.first).each do |position|
-          inner = widen_through_path(elements[position], rest, method_name, arg_types)
+          inner = widen_through_path(elements[position], rest, method_name, arg_types, &)
           next if inner.nil?
 
           elements[position] = inner
@@ -142,10 +154,10 @@ module Rigor
         widened_any ? Type::Tuple.new(elements) : nil
       end
 
-      def widen_union_path(union, steps, method_name, arg_types)
+      def widen_union_path(union, steps, method_name, arg_types, &)
         widened_any = false
         members = union.members.map do |member|
-          widened = widen_through_path(member, steps, method_name, arg_types)
+          widened = widen_through_path(member, steps, method_name, arg_types, &)
           next member if widened.nil?
 
           widened_any = true