rigortype 0.3.9 → 0.4.0

data/lib/rigor/inference/last_status.rb

@@ -0,0 +1,144 @@
+# frozen_string_literal: true
+
+require "prism"
+
+require_relative "../type"
+require_relative "block_call_timing"
+require_relative "stored_block_call"
+
+module Rigor
+  module Inference
+    # Issue #1360 — `$?`, the status of the last child process the thread waited for. Ruby keeps it per thread, not in
+    # the method frame's special-variable slot: a subprocess that a called method runs sets its caller's `$?`, a fiber
+    # shares its thread's, and a new thread starts without one. A subprocess that certainly ran ({.sets?}) sets it to
+    # a `Process::Status`: a backtick or `%x` command, `Kernel#system` (also when the command cannot run, with exit
+    # status 127), and `Process.wait`, `waitpid`, `wait2` or `waitpid2` without a flags argument, which blocks until a
+    # child exits.
+    #
+    # Ruby 4.0.5 sets it back to `nil` in four ways. One of those four waits given the `WNOHANG` flag sets it so when
+    # no child has exited, and `Process.waitall` when there is no child; either can run inside any method the thread
+    # calls, or in a signal handler, so a file that holds one ({.clears?}) binds `$?` nowhere. A backtick, `%x` or
+    # `system` sets it to nil before it runs the child, so an exception raised while it waits (`Timeout::Error`,
+    # `Interrupt`, `Thread#raise`) leaves it nil: a rescue clause or modifier fallback reads it unbound
+    # ({ErrorInfo.rescue_entry}), and so do the code past a rescue modifier and a body a `retry` re-enters. And
+    # `IO#close` on an `IO.popen` stream whose child was already reaped sets it to nil, which the analysis does not
+    # model. Otherwise a `$?` once set stays a `Process::Status`, so the binding survives later calls, blocks and loops
+    # until a join with a path that did not set it drops it. The root block of a new thread or ractor
+    # ({FreshFrameBlocks.entry}) and a closure's body ({FreshFrameBlocks.closure_entry}) start without it, and so does
+    # a method body.
+    module LastStatus
+      LAST_STATUS = :$?
+      # The `Process` functions that wait for a child and set `$?` to its status. Their optional flags argument may
+      # hold `WNOHANG`, which sets `$?` to nil instead when no child has exited.
+      WAITS = Set[:wait, :waitpid, :wait2, :waitpid2].freeze
+      CLEARERS = (WAITS | Set[:waitall]).freeze
+      # Compared as Strings: a literal with an invalid byte (`send("\xff")`) cannot become a Symbol.
+      CLEARER_NAMES = CLEARERS.to_set(&:to_s).freeze
+      SENDS = Set[:send, :__send__, :public_send].freeze
+      private_constant :LAST_STATUS, :WAITS, :CLEARERS, :CLEARER_NAMES, :SENDS
+
+      module_function
+
+      # `after`, the scope past `node`, with `$?` bound to `Process::Status` when `node` certainly ran a subprocess
+      # ({.certainly_sets?}) in a file that clears `$?` nowhere.
+      def after(node, after, scope)
+        return after if scope.discovery.clears_last_status || !certainly_sets?(node, scope)
+
+        after.with_global(LAST_STATUS, Type::Combinator.nominal_of("Process::Status"))
+      end
+
+      # True when running `node` certainly runs a subprocess that sets `$?` ({.sets?}): `node` itself, or a call whose
+      # receiver chain does, or whose positional arguments do unless a safe-navigation call may skip them
+      # (`%x(git rev-parse HEAD).strip`, `puts(%x(date))`). A subprocess in a branch, a block or an `&&` operand may not
+      # run, so it does not count.
+      def certainly_sets?(node, scope)
+        return true if sets?(node, scope)
+
+        case node
+        when Prism::CallNode
+          return true if certainly_sets?(node.receiver, scope)
+          return false if node.safe_navigation?
+
+          node.arguments&.arguments&.any? { |argument| certainly_sets?(argument, scope) } || false
+        when Prism::ParenthesesNode
+          body = node.body
+          body.is_a?(Prism::StatementsNode) && body.body.any? { |statement| certainly_sets?(statement, scope) }
+        else false
+        end
+      end
+
+      # True when `node` itself runs a subprocess and waits for it, which leaves `$?` a `Process::Status`: a backtick or
+      # `%x` command, `system` on implicit `self`, `self.` or `Kernel`, or `wait`, `waitpid`, `wait2` or `waitpid2`
+      # on the core `Process` module with at most one plain argument, the child's pid. A program that defines a
+      # method of that name anywhere ({BlockCallTiming.project_defines_anywhere?}) may run Ruby code in its place, so
+      # the name sets nothing there.
+      def sets?(node, scope)
+        case node
+        when Prism::XStringNode, Prism::InterpolatedXStringNode
+          !BlockCallTiming.project_defines_anywhere?(:`, scope)
+        when Prism::CallNode then subprocess_call?(node, scope)
+        else false
+        end
+      end
+
+      # True when `node` is a call that may set `$?` to nil: `wait`, `waitpid`, `wait2` or `waitpid2` with a flags
+      # argument, a splat, keywords or a forwarded `...`, on any receiver, `waitall`, or a `send`,
+      # `__send__` or `public_send` whose literal name is one of these. `Inference::ScopeIndexer` records whether a
+      # file holds one ({Scope::DiscoveryIndex#clears_last_status}).
+      def clears?(node)
+        return false unless node.is_a?(Prism::CallNode)
+
+        name = node.name
+        return !blocking_wait_arguments?(node) if WAITS.include?(name)
+        return true if name == :waitall
+        return false unless SENDS.include?(name)
+
+        sent = node.arguments&.arguments&.first
+        (sent.is_a?(Prism::SymbolNode) || sent.is_a?(Prism::StringNode)) && CLEARER_NAMES.include?(sent.unescaped)
+      end
+
+      # `after`, the scope an `ensure` clause leaves, with `$?` as `entry`, the scope the clause started from, binds it
+      # unless the clause bound it itself by running a subprocess: the clause read `$?` unbound, since it may run after
+      # a raise that came before the body's subprocess, but the code past it runs from the `begin` that finished.
+      def restore_unless_set(after, entry)
+        bound = entry.global(LAST_STATUS)
+        bound ? after.with_global(LAST_STATUS, bound) : after
+      end
+
+      def subprocess_call?(call_node, scope)
+        name = call_node.name
+        certain =
+          if name == :system
+            StoredBlockCall.kernel_spelled?(call_node.receiver)
+          elsif WAITS.include?(name)
+            blocking_wait_arguments?(call_node) && process_module?(call_node.receiver, scope)
+          else
+            false
+          end
+        certain && !BlockCallTiming.project_defines_anywhere?(name, scope)
+      end
+
+      # True when a wait call passes no flags: at most one positional argument, the pid, and no splat, keywords or
+      # forwarded `...` that may hold more.
+      def blocking_wait_arguments?(call_node)
+        arguments = call_node.arguments&.arguments
+        arguments.nil? || (arguments.size == 1 && plain_argument?(arguments.first))
+      end
+
+      def plain_argument?(argument)
+        !(argument.is_a?(Prism::SplatNode) || argument.is_a?(Prism::KeywordHashNode) ||
+          argument.is_a?(Prism::ForwardingArgumentsNode))
+      end
+
+      def process_module?(receiver, scope)
+        return false unless StoredBlockCall.root_constant_name(receiver) == :Process
+
+        type = scope.type_of(receiver)
+        type.is_a?(Type::Singleton) && type.class_name == "Process"
+      rescue StandardError
+        false
+      end
+      private_class_method :subprocess_call?, :blocking_wait_arguments?, :plain_argument?, :process_module?
+    end
+  end
+end

data/lib/rigor/inference/macro_block_self_type.rb

@@ -15,10 +15,11 @@ module Rigor
     # - the underlying class `X` equals or inherits from the entry's `receiver_constraint`;
     # - the call's method name is in the entry's `method_names`.
     #
-    # On a match the helper returns the **instance** type of the receiver class (`Nominal[X]`) —
-    # the narrowed `self_type` for the block body, matching Sinatra's runtime semantics where
-    # `Sinatra::Base#generate_method` turns the block into an instance method of the user's app
-    # class.
+    # On a match the helper returns the narrowed `self_type` for the block body: the receiver class's
+    # instance type (`Nominal[X]`) for `:receiver_instance` entries — Sinatra's `generate_method`
+    # contract — or the entry's named `self_type` class when the DSL `instance_eval`s the block on a
+    # different object (Grape's `params` body on `Grape::Validations::ParamsScope`, `namespace` body on
+    # the `Grape::API::Instance` class object, verb bodies on `Grape::Endpoint`).
     #
     # Slice 1b ships the floor only (per ADR-16 § WD13): bare-identifier method lookups inside the
     # block resolve through the inference engine's normal `self_type`-driven path, so methods
@@ -37,40 +38,189 @@ module Rigor
         registry = environment&.plugin_registry
         return nil if registry.nil? || registry.empty?
 
-        receiver_class_name = singleton_receiver_class_name(receiver_type)
-        return nil if receiver_class_name.nil?
+        singleton_name = singleton_receiver_class_name(receiver_type)
+        nominal_name = nominal_receiver_class_name(receiver_type)
+        return nil if singleton_name.nil? && nominal_name.nil?
 
         # ADR-52 WD1 — the verb-keyed table compiled at registry build. Entries arrive in
         # (plugin registration, declaration) order; the method-name membership is guaranteed
         # by the table key.
         entries = registry.contribution_index.block_entries_for(call_node.name)
         entries.each do |entry|
-          if receiver_class_inherits_from?(receiver_class_name, entry.receiver_constraint, environment)
-            return instance_type_for(receiver_class_name, environment)
-          end
+          narrowed = entry_self_type_for(entry, singleton_name, nominal_name, call_node,
+                                         scope, environment)
+          return narrowed if narrowed
         end
         nil
       end
 
-      # Tier A's match contract is intentionally narrow: class-level DSL calls (receiver is
-      # `Singleton[X]`) only. Instance-receiver calls and DSL forms whose block body binds a
-      # different `self` (Concern's `included do`, `instance_eval { ... }`) are handled by later
-      # slices (Concern walker, Tier D, etc.) — not Tier A.
+      # The narrowed `self_type` one entry contributes for this receiver, or nil on a miss. Nominal
+      # receivers exist only inside an already-narrowed `instance_eval` body — they can only re-enter a
+      # *named instance*-binding entry (`params`-family nesting on `Nominal[ParamsScope]`).
+      # `:receiver_instance` and `singleton(...)` entries keep their Singleton-only contract.
+      def entry_self_type_for(entry, singleton_name, nominal_name, call_node, scope, environment)
+        return nil if singleton_name.nil? && !entry.named_instance_binding?
+
+        method_name = call_node.name
+        receiver_name = singleton_name || nominal_name
+        matched = receiver_class_inherits_from?(receiver_name, entry.receiver_constraint, environment, scope)
+        # `extend M` lifts M's instance surface onto the class object — `class F; extend T::Sig;
+        # sig { ... }; end` calls `sig` on `Singleton[F]` even though F does not INHERIT from
+        # T::Sig. Singleton receivers therefore also match through the extends edge — but only when
+        # the module that actually ANSWERS `method_name` is the constrained one: a nearer `extend`
+        # whose module defines the same name owns the call and picks the block's self at runtime.
+        if !matched && singleton_name
+          matched = singleton_extends_reach?(receiver_name, entry.receiver_constraint, method_name,
+                                             call_node, scope, environment)
+        end
+        return nil unless matched
+
+        narrowed_self_type(entry, receiver_name, environment)
+      end
+
+      # The match contract stays narrow: `Singleton[X]` receivers (class-level DSL calls) for every
+      # entry, plus `Nominal[Y]` receivers only for entries whose declared `self_type` binds an
+      # instance — the `requires do ... requires do ... end` nesting shape inside a Grape `params`
+      # body, where `self` is already the ParamsScope instance the call evaluates on.
       def singleton_receiver_class_name(receiver_type)
         return nil unless receiver_type.is_a?(Type::Singleton)
 
         receiver_type.class_name
       end
 
-      def receiver_class_inherits_from?(class_name, constraint, environment)
-        return true if class_name == constraint
+      def nominal_receiver_class_name(receiver_type)
+        return nil unless receiver_type.is_a?(Type::Nominal)
+
+        receiver_type.class_name
+      end
+
+      # The narrowed `self_type` an entry contributes: `:receiver_instance` keeps the receiver class's
+      # instance type; a String `self_type` names the class the DSL `instance_eval`s the block on —
+      # `singleton(Foo)` for class-object evaluation (Grape's `namespace` body on
+      # `Grape::API::Instance`), `Foo` for instance evaluation (Grape's verb bodies on
+      # `Grape::Endpoint`, `params` bodies on `Grape::Validations::ParamsScope`).
+      def narrowed_self_type(entry, receiver_class_name, environment)
+        self_type = entry.self_type
+        return instance_type_for(receiver_class_name, environment) if self_type == :receiver_instance
+
+        if entry.singleton_binding?
+          return environment.singleton_for_name(entry.self_type_name) || Type::Singleton.new(entry.self_type_name)
+        end
 
-        ordering = environment.class_ordering(class_name, constraint)
-        %i[equal subclass].include?(ordering)
+        instance_type_for(entry.self_type_name, environment)
+      end
+
+      def receiver_class_inherits_from?(class_name, constraint, environment, scope = nil)
+        name = class_name.to_s
+        return true if name == constraint
+        return true if rbs_inherits?(name, constraint, environment)
+
+        # Source-side ancestry — `class API < Grape::API` lives on the scope's discovery tables, not in
+        # the environment's RBS/registry ordering (the same reason ADR-43's bridge walks them).
+        source_ancestors_reach?(name, constraint, environment, scope)
       rescue StandardError
         false
       end
 
+      # BFS over the source-side superclass table. The table stores names AS WRITTEN (`"::API::Base"`,
+      # bare `"Base"`), so each hop resolves through `ancestor_name_candidates` (rooted names, header
+      # nesting) rather than a raw lookup. Deliberately NOT `external_ancestor_name_candidates`: that
+      # walk records `ancestry_sources` edges through `record_class_dependency`, which would mislabel
+      # a DSL-call lookup as an ancestry dependency.
+      def source_ancestors_reach?(name, constraint, environment, scope)
+        supers = scope&.discovered_superclasses
+        queue = [name]
+        seen = {}
+        until queue.empty?
+          current = queue.shift
+          next if current.nil? || seen[current]
+
+          seen[current] = true
+          raw = supers&.[](current)
+          next if raw.nil?
+
+          scope.ancestor_name_candidates(current, raw).each do |candidate|
+            return true if candidate == constraint || rbs_inherits?(candidate, constraint, environment)
+
+            queue << candidate if supers.key?(candidate)
+          end
+        end
+        false
+      end
+
+      # The `extend`-edge twin of `source_ancestors_reach?`: true when the module that would answer
+      # `method_name` on `class_name`'s singleton — walked through `extend` edges, nearest first, then
+      # up the discovered superclass chain — resolves to `constraint`. Source `extend` targets are
+      # stored in singleton-ancestor search order and resolve through `ancestor_name_candidates`;
+      # RBS-side `extend` edges come from `Environment#singleton_extended_modules`, which is how
+      # `class Doc < T::ImmutableStruct` picks up `T::ImmutableStruct`'s own `extend T::Sig`.
+      def singleton_extends_reach?(class_name, constraint, method_name, call_node, scope, environment)
+        return false if scope.nil?
+
+        supers = scope.discovered_superclasses
+        extends = scope.discovered_extends
+        queue = [class_name.to_s]
+        seen = {}
+        until queue.empty?
+          current = queue.shift
+          next if current.nil? || seen[current]
+
+          seen[current] = true
+          # The class's own singleton defs sit ahead of EVERY `extend` in its singleton ancestry —
+          # `class F; extend T::Sig; def self.sig(&b); end; end` calls F's method, not T::Sig's —
+          # once the def has executed; a `def` written after this call has not run yet.
+          return current == constraint if scope.singleton_def_shadows_call?(current, method_name, call_node)
+
+          owner = extended_module_call_owner(current, extends, method_name, call_node, scope, environment)
+          return owner == constraint || rbs_inherits?(owner, constraint, environment) if owner
+
+          raw = supers[current]
+          scope.ancestor_name_candidates(current, raw).each { |c| queue << c } if raw
+        end
+        false
+      rescue StandardError
+        false
+      end
+
+      # One hop of `singleton_extends_reach?`: the module that answers `method_name` among `current`'s
+      # `extend` edges, or nil when none of them define it (the walk then continues to the
+      # superclass). An `extend` edge binds the first resolution candidate that exists at runtime —
+      # a project class or an RBS-known name — and an edge whose bound module lacks the method simply
+      # does not answer, so the search moves to the next edge, exactly like the singleton ancestry.
+      def extended_module_call_owner(current, extends, method_name, call_node, scope, environment)
+        (extends[current] || []).each do |mod_name|
+          owner = scope.ancestor_name_candidates(current, mod_name).find do |candidate|
+            scope.known_user_class?(candidate) ||
+              Rigor::Reflection.rbs_class_known?(candidate, environment: environment)
+          end
+          next if owner.nil? ||
+                  !extended_module_defines?(owner, method_name, call_node, scope, environment)
+
+          return owner
+        end
+        (environment.singleton_extended_modules(current) || []).each do |mod_name|
+          return mod_name if extended_module_defines?(mod_name, method_name, call_node,
+                                                      scope, environment)
+        end
+        nil
+      end
+
+      # `extend M` answers through M's INSTANCE surface — a source `def` inside the module or an RBS
+      # instance declaration (which already resolves through M's own `include`s, so `T::Generic`'s
+      # `include T::Helpers` answers `abstract!` on the extend edge). The source `def` counts only
+      # once it has executed: a module reopened AFTER the call site still lacks the method at call
+      # time, so the walk moves on exactly as the runtime ancestry would.
+      def extended_module_defines?(mod_name, method_name, call_node, scope, environment)
+        return true if scope.instance_def_shadows_call?(mod_name, method_name, call_node)
+
+        !Rigor::Reflection.instance_method_definition(mod_name, method_name,
+                                                      environment: environment).nil?
+      end
+
+      def rbs_inherits?(class_name, constraint, environment)
+        %i[equal subclass].include?(environment.class_ordering(class_name, constraint))
+      end
+
       def instance_type_for(class_name, environment)
         environment.nominal_for_name(class_name) || Type::Nominal.new(class_name)
       end

data/lib/rigor/inference/match_rebinding/calls.rb

@@ -0,0 +1,281 @@
+# frozen_string_literal: true
+
+require "prism"
+
+module Rigor
+  module Inference
+    module MatchRebinding
+      # Whether a call a statement runs rebinds the `$~` of the frame it is made in by the method it calls, on any
+      # receiver (issue #1365). Two readings, split by what the analyzer did before, so that no position newly keeps
+      # a narrowing Ruby rebinds and none newly forgets one it keeps on a guess:
+      #
+      # - a call the statement-level name table forgot on ({MATCH_CAPABLE_METHODS}, and for an implicit-self call
+      #   {SelfCalls.named_match?}) still forgets unless its syntax proves it cannot match ({.forgets_by_name?}):
+      #   `row[:name]`, `csv.split(",")` and `list.index(3)` keep the narrowing, `row[key]` does not. A flow type
+      #   is not proof, because it can be stale while the value is a Regexp (#1380);
+      # - a call in a position that never forgot — an operand, an explicit-receiver builtin outside the table, an
+      #   index write, a `send` or an `eval` — forgets only on evidence that it matches ({.rebinds?}).
+      module Calls
+        # These rebind `$~` whatever their argument: `sub` / `gsub` / `scan` with a String pattern still set it,
+        # `match` compiles one, and `!~` runs `=~`.
+        ALWAYS_MATCHING = Set[:=~, :!~, :match, :sub, :sub!, :gsub, :gsub!, :scan].freeze
+        # These rebind it only when an argument is a Regexp: `"a,b".split(",")`, `"abc"["z"]`, `list.index(3)`,
+        # `{name: 1}[:name]` and `%w[a].any?(String)` leave it alone.
+        LOOKUPS = Set[
+          :[], :slice, :slice!, :index, :rindex, :byteindex, :byterindex, :partition, :rpartition, :split,
+          :start_with?, :any?, :all?, :none?, :one?
+        ].freeze
+        # `grep` / `grep_v` rebind the caller's `$~` only in their block form.
+        BLOCK_FORM_LOOKUPS = Set[:grep, :grep_v].freeze
+        # `a === b` is `a`'s method, and `~re` matches `$_`, so these read the receiver: `String === s` and `~1`
+        # run no match.
+        RECEIVER_PATTERNS = Set[:===, :~].freeze
+        # These run a String of code in the frame that calls them: `eval` (`Kernel.eval`, `binding.eval`), and the
+        # other three in their String form, since their block form is a block.
+        EVALS = Set[:eval, :instance_eval, :class_eval, :module_eval].freeze
+        # These run the method they name.
+        SENDS = Set[:send, :__send__, :public_send].freeze
+        # A literal name a `send` compares by its bytes, which an invalid one (`send("\xff")`) cannot turn into a
+        # Symbol.
+        NAMES_BY_STRING = (
+          ALWAYS_MATCHING | LOOKUPS | BLOCK_FORM_LOOKUPS | RECEIVER_PATTERNS | EVALS | SENDS | Set[:[]=]
+        ).to_h { |name| [name.to_s, name] }.freeze
+        # An interpolated String of code is parsed with each interpolation standing for this identifier.
+        PLACEHOLDER = "__rigor_interpolation__"
+        # Code past these bounds is not read: parsing and scanning it would cost more than it tells, and a deeply
+        # nested literal (`[[[…]]]`) overflows the scan's recursion.
+        MAX_CODE_BYTES = 64 * 1024
+        MAX_CODE_NESTING = 256
+        OPENERS = "([{".bytes.to_set.freeze
+        CLOSERS = ")]}".bytes.to_set.freeze
+        # Operators a computed `send` name may end in that are not attribute writers.
+        OPERATOR_SUFFIXES = %w[== != <= >=].freeze
+        # `split` without a separator splits on `$;` (also spelled `$-F`), which may hold a Regexp.
+        FIELD_SEPARATORS = %i[$; $-F].freeze
+        EMPTY = [].freeze
+        private_constant :ALWAYS_MATCHING, :LOOKUPS, :BLOCK_FORM_LOOKUPS, :RECEIVER_PATTERNS, :EVALS, :SENDS,
+                         :NAMES_BY_STRING, :PLACEHOLDER, :MAX_CODE_BYTES, :MAX_CODE_NESTING, :OPENERS,
+                         :CLOSERS, :OPERATOR_SUFFIXES, :FIELD_SEPARATORS, :EMPTY
+
+        module_function
+
+        # True when the statement-level name table forgot on `call_node` before issue #1365: one of its names on any
+        # receiver, or, for an implicit-self call and a call in its arguments, a name {SelfCalls.named_match?} reads.
+        def base_named?(call_node, implicit:)
+          MATCH_CAPABLE_METHODS.include?(call_node.name) || (implicit && SelfCalls.named_match?(call_node))
+        end
+
+        # True when a call {.base_named?} names may still rebind `$~`: every such call does unless its syntax proves
+        # it cannot. `match?` never matches; `grep` / `grep_v` without a block do not rebind the caller's `$~`; a
+        # lookup, `start_with?`, `byteindex`, `byterindex` or pattern predicate whose arguments are all non-Regexp
+        # literals ({Operands.keep_literal?}), and `[]=` whose index is, run no match; nor does `===` on such a
+        # literal or on a constant naming a class or module. Any other argument counts as it did, whatever its flow
+        # type (#1380), and so do `=~`, `!~`, `match`, `sub`, `gsub`, `scan`, `~`, an eval and a `send`.
+        def forgets_by_name?(call_node, scope)
+          name = call_node.name
+          arguments = call_node.arguments&.arguments || EMPTY
+          return true if ALWAYS_MATCHING.include?(name) || name == :~
+          return false if name == :match?
+          return !keep_receiver?(call_node.receiver, scope) if name == :===
+          return !call_node.block.nil? && !keep_arguments?(arguments) if BLOCK_FORM_LOOKUPS.include?(name)
+
+          lookup_forgets?(name, arguments, scope)
+        end
+
+        # A lookup keeps the narrowing on literal arguments alone, and `split` on none (or a nil separator) only
+        # while this file never writes `$;`; `[]=` is read by its index; any other name forgets.
+        def lookup_forgets?(name, arguments, scope)
+          return !keep_arguments?(arguments[0...-1]) if name == :[]=
+          return true unless LOOKUPS.include?(name) && keep_arguments?(arguments)
+
+          default_separator?(name, arguments) && field_separator_written?(scope)
+        end
+        private_class_method :lookup_forgets?
+
+        # True when `call_node`, a statement's own call, may rebind the match globals of the frame it is made in once
+        # its operands have run. A call {.base_named?} names still forgets unless its syntax proves it cannot
+        # ({.forgets_by_name?}); any other forgets when it is known to match ({.rebinds?}). An implicit-self or
+        # `self.` call also forgets where it may reach the frame's slot although it does not match itself: where the
+        # frame hands its slot to code the analyzer does not trace ({Frame#self_call_fallback?}), where no body
+        # stamped a frame, or where its arguments hold something {MatchRebinding.operand_may_match?} counts. Any
+        # other call runs a method in a frame of its own (issue #1364) or a C method that does not match.
+        def statement_rebinds?(call_node, scope)
+          receiver = call_node.receiver
+          implicit = receiver.nil? || receiver.is_a?(Prism::SelfNode)
+          if base_named?(call_node, implicit: implicit)
+            return true if forgets_by_name?(call_node, scope)
+          elsif rebinds?(call_node, scope)
+            return true
+          end
+          return false unless implicit
+
+          frame = scope&.match_frame
+          frame.nil? || frame.self_call_fallback?(scope) ||
+            MatchRebinding.operand_may_match?(call_node.arguments, scope)
+        end
+
+        # True when `node`, a call, is known to rebind the `$~` of the frame it is made in by the method it calls:
+        # an {ALWAYS_MATCHING} name; a {LOOKUPS} name with an argument known to be a Regexp
+        # ({Operands.known_regexp_operand?}), and `grep` / `grep_v` on the same terms in their block form; `[]=` with
+        # such an index (`s[re] = v`); `===` or unary `~` on such a receiver; an eval whose code may match
+        # ({.eval_may_match?}); or a {SENDS} call that names one of these with the arguments it is sent, or whose
+        # computed name is sent a known Regexp (not an interpolated attribute writer, `"#{name}="`). `match?` never
+        # counts, and `Dynamic[top]` is not a known Regexp. `node` may also be an index `||=` / `&&=` / `op=` write,
+        # read by its index (`s[re] ||= v`). `scope` types the operands.
+        def rebinds?(node, scope)
+          arguments = node.arguments&.arguments || EMPTY
+          return known_arguments?(arguments, scope) unless node.is_a?(Prism::CallNode)
+
+          named?(node.name, node.receiver, arguments, !node.block.nil?, scope)
+        end
+
+        def named?(name, receiver, arguments, block, scope)
+          return true if ALWAYS_MATCHING.include?(name)
+          return !receiver.nil? && Operands.known_regexp_operand?(receiver, scope) if RECEIVER_PATTERNS.include?(name)
+          return field_separator_regexp?(scope) if default_separator?(name, arguments)
+          return false if arguments.empty?
+          return eval_may_match?(name, receiver, arguments.first, scope) if EVALS.include?(name)
+          return sent?(receiver, arguments, block, scope) if SENDS.include?(name)
+          return known_arguments?(arguments[0...-1], scope) if name == :[]=
+          return block && known_arguments?(arguments, scope) if BLOCK_FORM_LOOKUPS.include?(name)
+
+          LOOKUPS.include?(name) && known_arguments?(arguments, scope)
+        end
+        private_class_method :named?
+
+        def sent?(receiver, arguments, block, scope)
+          name_node, *rest = arguments
+          if name_node.is_a?(Prism::SymbolNode) || name_node.is_a?(Prism::StringNode)
+            name = NAMES_BY_STRING[name_node.unescaped]
+            return !name.nil? && named?(name, receiver, rest, block, scope)
+          end
+          return false if attribute_writer_name?(name_node)
+
+          known_arguments?(rest, scope)
+        end
+        private_class_method :sent?
+
+        # `"#{name}="` or `:"#{name}="` names a writer, which runs in a frame of its own.
+        def attribute_writer_name?(node)
+          return false unless node.is_a?(Prism::InterpolatedStringNode) || node.is_a?(Prism::InterpolatedSymbolNode)
+
+          tail = node.parts.last
+          text = tail.is_a?(Prism::StringNode) ? tail.unescaped : ""
+          text.end_with?("=") && OPERATOR_SUFFIXES.none? { |suffix| text.end_with?(suffix) }
+        end
+        private_class_method :attribute_writer_name?
+
+        # `split` with no argument, or a nil first one (`split(nil, 2)`), splits on `$;`.
+        def default_separator?(name, arguments)
+          name == :split && (arguments.empty? || arguments.first.is_a?(Prism::NilNode))
+        end
+        private_class_method :default_separator?
+
+        # True when this file writes `$;` anywhere ({Scope#program_globals}), so a `split` on it may split on a
+        # Regexp. `$;` set in another file, by `ruby -F`, or only through an operator write is not seen.
+        def field_separator_written?(scope)
+          globals = scope&.program_globals
+          !globals.nil? && FIELD_SEPARATORS.any? { |name| globals.key?(name) }
+        end
+        private_class_method :field_separator_written?
+
+        # True when this file writes a known Regexp to `$;`.
+        def field_separator_regexp?(scope)
+          globals = scope&.program_globals
+          !globals.nil? && FIELD_SEPARATORS.any? { |name| Operands.regexp_type?(globals[name], scope) }
+        end
+        private_class_method :field_separator_regexp?
+
+        # An eval of a literal or interpolated String counts when the analyzer reads its code and it may match
+        # ({.code_reading}). Code it cannot read — a variable, or a literal past the bounds — counts only for
+        # `binding.eval` (any receiver ending in a `binding` call) and `Kernel.eval`, whose whole purpose is to run
+        # code in this frame; `instance_eval`, `class_eval` and `module_eval` of such code are the metaprogramming
+        # idiom that defines methods, and counting them would forget on correct code.
+        def eval_may_match?(name, receiver, source, scope)
+          answer = code_literal?(source) ? code_reading(source, scope) : nil
+          return answer unless answer.nil?
+
+          name == :eval && frame_eval_receiver?(receiver)
+        end
+        private_class_method :eval_may_match?
+
+        def code_literal?(node)
+          node.is_a?(Prism::StringNode) || node.is_a?(Prism::InterpolatedStringNode)
+        end
+        private_class_method :code_literal?
+
+        def frame_eval_receiver?(receiver)
+          case receiver
+          when Prism::CallNode then receiver.name == :binding
+          when Prism::ConstantReadNode then receiver.name == :Kernel
+          when Prism::ConstantPathNode then receiver.parent.nil? && receiver.name == :Kernel
+          else false
+          end
+        end
+        private_class_method :frame_eval_receiver?
+
+        # Whether the String of code an eval runs may match, or nil when the analyzer cannot read it. A literal that
+        # parses is read on the block scan's terms ({MatchRebinding.program_may_match?}), and an interpolated one
+        # the same way with each interpolation replaced by an identifier. A literal that does not parse raises
+        # before it runs, so it does not match. An interpolated one that does not parse once so replaced, code
+        # longer than {MAX_CODE_BYTES} or nested deeper than {MAX_CODE_NESTING}, and code whose scan raises is not
+        # read. The answer is kept on the frame as {Frame#memo} keeps a scan, since every pass over the call asks
+        # again.
+        def code_reading(node, scope)
+          MatchRebinding.remember(node, scope, :code) { read_code(node, scope) }
+        end
+        private_class_method :code_reading
+
+        def read_code(node, scope)
+          interpolated = node.is_a?(Prism::InterpolatedStringNode)
+          text = if interpolated
+                   node.parts.map { |part| part.is_a?(Prism::StringNode) ? part.unescaped : PLACEHOLDER }.join
+                 else
+                   node.unescaped
+                 end
+          return nil if oversized?(text)
+
+          result = Prism.parse(text)
+          return (interpolated ? nil : false) unless result.errors.empty?
+
+          MatchRebinding.program_may_match?(result.value, scope)
+        rescue SystemStackError, StandardError
+          nil
+        end
+        private_class_method :read_code
+
+        # Longer than {MAX_CODE_BYTES}, or with brackets nested deeper than {MAX_CODE_NESTING}.
+        def oversized?(text)
+          return true if text.bytesize > MAX_CODE_BYTES
+
+          depth = 0
+          text.each_byte do |byte|
+            if OPENERS.include?(byte)
+              depth += 1
+              return true if depth > MAX_CODE_NESTING
+            elsif CLOSERS.include?(byte)
+              depth -= 1
+            end
+          end
+          false
+        end
+        private_class_method :oversized?
+
+        def keep_arguments?(arguments)
+          arguments.all? { |argument| Operands.keep_literal?(argument) }
+        end
+        private_class_method :keep_arguments?
+
+        def keep_receiver?(receiver, scope)
+          !receiver.nil? && (Operands.keep_literal?(receiver) || Operands.class_constant?(receiver, scope))
+        end
+        private_class_method :keep_receiver?
+
+        def known_arguments?(arguments, scope)
+          arguments.any? { |argument| Operands.known_regexp_operand?(argument, scope) }
+        end
+        private_class_method :known_arguments?
+      end
+    end
+  end
+end