rigortype 0.3.9 → 0.4.1

data/lib/rigor/inference/block_parameter_binder.rb

@@ -3,6 +3,7 @@
 require "prism"
 
 require_relative "../type"
+require_relative "block_auto_splat"
 require_relative "multi_target_binder"
 
 module Rigor
@@ -22,12 +23,23 @@ module Rigor
     # MultiTargetNode parameters (`|(a, b), c|`) are bound by delegating each destructuring slot to
     # {Rigor::Inference::MultiTargetBinder}, so a Tuple-shaped expected element type projects element-wise
     # into the inner locals (Slice 6 phase C sub-phase 2). Numbered parameters (`_1`, `_2`, ...) are bound
-    # from `Prism::NumberedParametersNode` using the same per-position `expected_param_types:` array, so
-    # `[1, 2, 3].each { _1 + _2 }` sees `_1`/`_2` typed identically to their explicit `|x, y|` counterparts.
+    # from `Prism::NumberedParametersNode` as the explicit list of that many required positionals, the
+    # highest `_N` the body references being the arity (CRuby's own reading: `proc { _2 }.parameters` is
+    # `[[:opt, :_1], [:opt, :_2]]`, and `lambda { _2 }.arity` is 2). So `h.each { _1; _2 }` auto-splats like
+    # `|k, v|`, while a body that uses only `_1` reads as `|a|` and does not (issue #1108).
     #
     # The `it` implicit parameter (Ruby 3.4+) is bound from `Prism::ItParametersNode`. It is the
     # single-argument cousin of `_1`: the binder produces `{ it: expected_param_types[0] }` so the body's
-    # `Prism::ItLocalVariableReadNode` lookup sees the same type as the explicit `|x|` form would.
+    # `Prism::ItLocalVariableReadNode` lookup sees the same type as the explicit `|x|` form would, and it
+    # never auto-splats.
+    #
+    # A block whose parameter list CRuby splats spreads the one yielded value across its positionals;
+    # {BlockAutoSplat} owns that rule and its carrier arms, and this binder only applies the table it
+    # answers. Every name the spread binds from an `Array[T]` slot — and every name a nested `|(g, h)|`
+    # destructure binds from one — is reported as optimistic, and {#bind_onto} records those through
+    # `Scope#with_optimistic_local` exactly as the statement-level `a, b = ints` does (issue #1093; the
+    # shared rule lives in {MultiTargetBinder}). A nested `|(g, h)|` destructures the one value the
+    # signature already placed, so it wraps like the statement form.
     #
     # Block-local declarations after `;` (e.g., `|x; y, z|`) are still skipped — they are explicitly
     # block-local, so the outer scope MUST NOT observe them and the binder leaves them unbound.
@@ -38,14 +50,31 @@ module Rigor
       #   the binder cannot fill from this array (because the array is shorter than the parameter list, or
       #   because the slot is a kind we do not pull from the array) default to `Dynamic[Top]`.
       def initialize(expected_param_types: [])
-        @expected_param_types = expected_param_types
+        @declared_param_types = expected_param_types
+        reset_per_bind_state
+      end
+
+      # The names the last {#bind} bound optimistically nil-free (see the class comment). Read-only: it is a
+      # shared frozen empty when the bind marked nothing.
+      attr_reader :optimistic
+
+      # Binds the block's parameters into `scope`: {#bind}'s types through `Scope#with_local`, then the
+      # optimistic mark for every name in {#optimistic}. It applies them through
+      # {MultiTargetBinder.apply_bindings} directly rather than through a `Result`, which every block entry
+      # built only to apply at once ([#1504](https://github.com/rigortype/rigor/issues/1504)).
+      def bind_onto(block_node, scope)
+        MultiTargetBinder.apply_bindings(scope, bind(block_node, scope: scope), @optimistic)
       end
 
       # @return ordered map from parameter name to bound type. Anonymous
       #   parameters are skipped; MultiTargetNode destructuring slots delegate to {MultiTargetBinder} and
       #   contribute every named local in declaration order. Numbered-parameter forms (`_1`, `_2`, ...) bind
       #   `:_1`, `:_2`, ... up to the maximum the block body refers to.
-      def bind(block_node)
+      # @param scope — the scope the block is entered from, which answers a nested destructure's `to_ary`
+      #   question ({MultiTargetBinder.bind_marked}).
+      def bind(block_node, scope: nil)
+        reset_per_bind_state
+        @scope = scope
         params_root = block_node.parameters
         return {} if params_root.nil?
 
@@ -63,14 +92,40 @@ module Rigor
 
       private
 
+      NO_POSITIONS = [].freeze
+      NO_NAMES = [].freeze
+      private_constant :NO_POSITIONS, :NO_NAMES
+
+      # {#apply_auto_splat} rewrites the positional table for the block it is binding, so every {#bind} starts
+      # from the declared types again; a binder reused across blocks must not see the previous block's splat.
+      # The two lists start as shared frozen empties, since most blocks mark nothing ({#mark_optimistic}).
+      def reset_per_bind_state
+        @expected_param_types = @declared_param_types
+        @splat_rest_type = nil
+        @optimistic_positions = NO_POSITIONS
+        @optimistic = NO_NAMES
+        @scope = nil
+      end
+
+      # Records `name` as bound optimistically, allocating {#optimistic} on the first mark of a {#bind}.
+      def mark_optimistic(name)
+        @optimistic = [] if @optimistic.equal?(NO_NAMES)
+        @optimistic << name
+      end
+
       # `|_1, _2|` numbered-parameter form. Prism exposes the implicit count through
       # `NumberedParametersNode#maximum` (the highest `_N` referenced in the body); we materialise bindings
-      # for `:_1` through `:_maximum` so the block body's `LocalVariableReadNode` lookups see the same types
-      # as the equivalent explicit `|x, y|` form would.
+      # for `:_1` through `:_maximum`, auto-splatting exactly as the explicit list of that many required
+      # positionals would, so the body's `LocalVariableReadNode` lookups see the same types and marks.
       def bind_numbered_parameters(numbered_node)
+        arity = numbered_node.maximum
+        apply_auto_splat { BlockAutoSplat::ParameterShape.of_arity(arity) }
+
         bindings = {}
-        numbered_node.maximum.times do |i|
-          bindings[:"_#{i + 1}"] = positional_type_at(i)
+        arity.times do |i|
+          name = :"_#{i + 1}"
+          bindings[name] = positional_type_at(i)
+          mark_optimistic(name) if @optimistic_positions.include?(i)
         end
         bindings
       end
@@ -85,7 +140,7 @@ module Rigor
         params_node = params_root.parameters
         return {} if params_node.nil?
 
-        apply_auto_splat(params_node)
+        apply_auto_splat { BlockAutoSplat::ParameterShape.of(params_node) }
 
         bindings = {}
         bind_positionals(params_node, bindings, 0)
@@ -96,8 +151,8 @@ module Rigor
         bindings
       end
 
-      # Ruby blocks (NOT lambdas) auto-splat a single yielded Tuple-shaped value when the block declares more
-      # than one required positional parameter:
+      # Ruby blocks (NOT lambdas) auto-splat a single yielded array-ish value when the parameter list is
+      # one CRuby splats:
       #
       #   { a: 1 }.each { |k, v| ... }
       #
@@ -106,21 +161,24 @@ module Rigor
       # the binder would assign `k = Tuple[K, V]` and `v = Dynamic[Top]`, and any call on
       # `k.<method-not-on-Tuple>` would false-fire.
       #
-      # The rule fires only when (a) the receiver yields exactly one value (`expected_param_types.size ==
-      # 1`), (b) the block declares more than one positional slot, and (c) that single expected element is a
-      # Tuple. Multi-arg yields (e.g. `each_with_index`'s `(element, index)` pair) are NOT auto-splatted —
-      # matching Ruby semantics where a multi-arg yield to a `|a, b, c|` block fills the extra slot with nil
-      # rather than splatting any element.
-      def apply_auto_splat(params_node)
+      # The rule fires only when the receiver yields exactly one value (`expected_param_types.size == 1`)
+      # and {BlockAutoSplat} answers a table for that value and `shape`. A multi-arg yield (e.g.
+      # `each_with_index`'s `(element, index)` pair) is NOT auto-splatted — matching Ruby semantics where a
+      # multi-arg yield to a `|a, b, c|` block fills the extra slot with nil rather than splatting any
+      # element. The block answers the parameter list's shape, built only past that test
+      # ([#1504](https://github.com/rigortype/rigor/issues/1504)).
+      def apply_auto_splat
         return unless @expected_param_types.size == 1
 
-        pos_count = params_node.requireds.size + params_node.optionals.size + params_node.posts.size
-        return unless pos_count > 1
+        shape = yield
+        return unless shape.splats?
 
-        first = @expected_param_types[0]
-        return unless first.is_a?(Type::Tuple)
+        table = BlockAutoSplat.for(shape, @expected_param_types[0])
+        return if table.nil?
 
-        @expected_param_types = first.elements
+        @expected_param_types = table.types
+        @optimistic_positions = table.optimistic_positions
+        @splat_rest_type = table.rest_type
       end
 
       def bind_positionals(params_node, bindings, cursor)
@@ -160,7 +218,8 @@ module Rigor
         rest = params_node.rest
         return unless rest.respond_to?(:name) && rest&.name
 
-        bindings[rest.name] = Type::Combinator.nominal_of("Array", type_args: [Type::Combinator.untyped])
+        bindings[rest.name] =
+          @splat_rest_type || Type::Combinator.nominal_of("Array", type_args: [Type::Combinator.untyped])
       end
 
       def bind_keywords(params_node, bindings)
@@ -199,9 +258,12 @@ module Rigor
         case param
         when Prism::RequiredParameterNode
           bindings[param.name] = positional_type_at(cursor)
+          mark_optimistic(param.name) if @optimistic_positions.include?(cursor)
         when Prism::MultiTargetNode
-          nested = MultiTargetBinder.bind(param, positional_type_at(cursor))
-          bindings.merge!(nested)
+          nested = MultiTargetBinder.bind_marked(param, positional_type_at(cursor),
+                                                 optimistic: @optimistic_positions.include?(cursor), scope: @scope)
+          bindings.merge!(nested.types)
+          nested.optimistic.each { |name| mark_optimistic(name) }
         end
       end
 

data/lib/rigor/inference/block_repetition.rb

@@ -0,0 +1,71 @@
+# frozen_string_literal: true
+
+require_relative "../type"
+require_relative "block_call_timing"
+require_relative "closure_escape_analyzer"
+
+module Rigor
+  module Inference
+    # Whether a block-accepting call may run its block more than once, so a later run reads a captured binding an
+    # earlier run moved. Two passes ask it and share this one rule: the block-return pass
+    # (`ExpressionTyper#block_may_repeat?`), which lays the #587 (b) captured binding under such a block, and the
+    # statement pass (`StatementEvaluator#repeating_block_entry`, issue #1412), which lays the ADR-56 WD2.13
+    # content-mutation widening on its entry.
+    #
+    # The core iteration methods {ClosureEscapeAnalyzer} catalogues as non-escaping prove it — for a project class
+    # too, through its ancestry (`include Enumerable`); `tap` / `then` / `yield_self` are catalogued there too but
+    # run their block exactly once ({BlockCallTiming}).
+    #
+    # Issue #1234 — a receiver the analyzer cannot classify at all (`Dynamic`, a union, a project class whose
+    # ancestry it cannot follow) repeats when the method NAME is a catalogued iterator the project does not define
+    # on it ({ClosureEscapeAnalyzer.repeats_by_name?}): `items.all? { seen += 1; seen == 1 }` on an untyped `items`
+    # kept the first run's `seen == 1`, the predicate folded to `true`, and the condition on the result was
+    # reported as constant. This is a reading of `:unknown` for these two passes alone; escape analysis still
+    # treats it as unproven. Any other name, and a receiver classified `:escaping`, answers false, which keeps the
+    # entry scope: it is exact for a block run once (`m.synchronize { out = buf; buf = nil; out }` is `buf`'s value,
+    # and a cross-iteration binding would add the `nil` a second run never reads).
+    #
+    # A receiver that provably holds at most one element runs the block at most once however it iterates, so it
+    # answers false too: `done = false; [:only].each { break if done; done = true }` is `[:only]`, and the
+    # cross-iteration `done` would have typed it `Array[Symbol]?`.
+    module BlockRepetition
+      module_function
+
+      # `classification` is the receiver's {ClosureEscapeAnalyzer.classify} answer when the caller already holds it.
+      def may_repeat?(method_name:, receiver_type:, scope:, classification: nil)
+        return false if BlockCallTiming.candidate_name?(method_name)
+        return false if at_most_one_run?(method_name, receiver_type)
+
+        classification ||= ClosureEscapeAnalyzer.classify(
+          receiver_type: receiver_type, method_name: method_name, scope: scope
+        )
+        case classification
+        when :non_escaping then true
+        when :unknown
+          ClosureEscapeAnalyzer.repeats_by_name?(receiver_type: receiver_type, method_name: method_name, scope: scope)
+        else false
+        end
+      end
+
+      def at_most_one_run?(method_name, receiver_type)
+        case receiver_type
+        when Type::Tuple then receiver_type.elements.size <= 1
+        when Type::HashShape then receiver_type.closed? && receiver_type.pairs.size <= 1
+        when Type::Constant then constant_at_most_one_run?(method_name, receiver_type.value)
+        else false
+        end
+      end
+
+      # `1.times` and a one-element integer range iterate once.
+      def constant_at_most_one_run?(method_name, value)
+        case value
+        when Integer then method_name == :times && value <= 1
+        when Range
+          value.begin.is_a?(Integer) && value.end.is_a?(Integer) &&
+            value.end - value.begin + (value.exclude_end? ? 0 : 1) <= 1
+        else false
+        end
+      end
+    end
+  end
+end

data/lib/rigor/inference/body_fixpoint.rb

@@ -19,7 +19,8 @@ module Rigor
     # The mechanism is parameterized over an `evaluate_body` callable so slice B can reuse it: given the
     # current per-name bindings it returns the per-name exit bindings produced by one body evaluation from
     # those bindings (names the body leaves unwritten in a given pass simply do not appear in the returned
-    # hash).
+    # hash). Slice C's content join reuses it too, with each "name" one evidence slot of a collection
+    # (`StatementEvaluator#join_content_to_fixpoint`) and a `bot` seed standing for "nothing stored yet".
     module BodyFixpoint
       # One body evaluation per iteration; ADR-55's shape (cap 3).
       CAP = 3

data/lib/rigor/inference/budget_trace.rb

@@ -49,7 +49,8 @@ module Rigor
       RECURSION_FIXPOINT_CAP = :recursion_fixpoint_cap
       # `BodyFixpoint#converge` (ADR-56 slice A — non-escaping block captured-local write-back) ran its
       # 3-evaluation cap without the written local's join converging and collapsed that local to
-      # `Dynamic[top]` (the escaping-block floor). Shared by slice B's loop-body fixpoint.
+      # `Dynamic[top]` (the escaping-block floor). Shared by slice B's loop-body fixpoint and by slice C's
+      # content-evidence fixpoint, where the collapsed name is one element / key / value slot of a collection join.
       BLOCK_WRITEBACK_CAP = :block_writeback_cap
 
       # ADR-57 return-memo profile counters (not cutoffs — see the module doc). All bumped by

data/lib/rigor/inference/builtins/method_catalog.rb

@@ -20,6 +20,7 @@ module Rigor
       class MethodCatalog
         FOLDABLE_PURITIES = Set["leaf", "trivial", "leaf_when_numeric"].freeze
         EMPTY_CATALOG = { "classes" => {} }.freeze
+        Ractor.make_shareable(EMPTY_CATALOG)
 
         # Selectors that are classified `:leaf` by the C-body analysis (they read no global mutable state
         # in the C sense) but whose result is NOT reproducible across Ruby processes, so they must never
@@ -37,7 +38,7 @@ module Rigor
 
         # Shared root for the offline-generated catalogues. Resolving it here keeps the repo-relative
         # `../../../../` hop in one place instead of copying it into every per-topic loader.
-        DATA_ROOT = File.expand_path("../../../../data/builtins/ruby_core", __dir__)
+        DATA_ROOT = File.expand_path("../../../../data/builtins/ruby_core", __dir__).freeze
         private_constant :DATA_ROOT
 
         # Build a catalog for a named topic, resolving its YAML path under {DATA_ROOT}. Equivalent to

data/lib/rigor/inference/builtins/string_catalog.rb

@@ -18,7 +18,7 @@ module Rigor
             :replace, :initialize, :initialize_copy, :clear, :<<, :concat, :insert,
             :prepend, :force_encoding, :encode, :scrub, :unicode_normalize, :"[]=",
             :upto, :each_byte, :each_char, :each_codepoint,
-            :each_grapheme_cluster, :each_line, :bytesplice,
+            :each_grapheme_cluster, :each_line, :bytesplice, :append_as_bytes,
             # `crypt` is not a mutator but is blocked from folding for the same "do not bake a non-pure
             # result into a Constant" reason: `rb_str_crypt` delegates to the platform `crypt(3)`, whose
             # output (algorithm and digest) varies by libc / OS, so `"x".crypt("ab")` is not deterministic