rigortype 0.4.3 → 0.4.5

data/lib/rigor/analysis/reachability/graph.rb

@@ -28,7 +28,10 @@ module Rigor
             next [] if use.name.nil?
 
             name = use.name.delete_prefix("::")
-            targets = use.within ? literal_targets(use, name) : [nil]
+            targets = if use.anywhere then anywhere_targets(name)
+                      elsif use.within then literal_targets(use, name)
+                      else [nil]
+                      end
             targets.map do |target|
               Scan::Reference.new(as_written: target || name, nesting: [].freeze, from: nil,
                                   role: use.role, path: use.path, line: use.line,
@@ -50,11 +53,103 @@ module Rigor
           return [nil] if receiver.nil?
 
           local = @shadows[use.path]
+          runtime = use.receiver_open ? runtime_targets(receiver, name, use.inherit, local) : []
           own = declared_member(receiver, name, local)
-          return [own] if own
-          return [] unless use.inherit
+          return [own, *runtime].uniq if own
+          return runtime unless use.inherit
+          return (anywhere_targets(name) + runtime).uniq if unknown_ancestry?(receiver)
 
-          plausible_ancestors(receiver).filter_map { |scope| declared_member(scope, name, local) }.uniq + [nil]
+          (plausible_ancestors(receiver).filter_map { |scope| declared_member(scope, name, local) } + runtime)
+            .uniq + [nil]
+        end
+
+        # Every declaration a literal `name` can name from a receiver the walk cannot bound (#1946): each one a
+        # scope's `name` (or a declared prefix of it) could be, and the top level.
+        def anywhere_targets(name)
+          segments = name.split("::")
+          found = segments.length.downto(1).flat_map do |count|
+            suffix = segments.first(count).join("::")
+            by_last_segment.fetch(segments[count - 1], []).select do |fqn|
+              fqn == suffix || fqn.end_with?("::#{suffix}")
+            end
+          end
+          found.uniq + [nil]
+        end
+
+        def by_last_segment
+          @by_last_segment ||= @by_fqn.keys.group_by { |fqn| fqn.split("::").last }
+        end
+
+        # The declarations a descendant of `receiver` holding `name` adds (#1878): a `self` standing for the
+        # enclosing declaration is whichever subclass, includer, prepender or extender the method runs on, and
+        # Ruby looks the name up there first. Each descendant is searched with its own ancestors unless the call
+        # passes `inherit = false`. The descendants are over-approximated as {#plausible_ancestors} is.
+        #
+        # A module some unknown receiver includes or extends (`k.include(Mix)`, an `include` in an `included do`
+        # block) has descendants the walk cannot list, so the name may be any declaration's (#1946). A class
+        # with an ancestor the walk cannot name (`K.include(mods.first)`) may be a descendant of any module, so
+        # it is searched too.
+        def runtime_targets(receiver, name, inherit, local)
+          return anywhere_targets(name) if open_descendants?(receiver)
+
+          (descendants_of(receiver) | unknown_ancestry_classes).flat_map do |descendant|
+            scopes = inherit ? [descendant, *plausible_ancestors(descendant)] : [descendant]
+            scopes.filter_map { |scope| declared_member(scope, name, local) }
+          end.uniq
+        end
+
+        def descendants_of(fqn)
+          @plausible_descendants ||= (@by_fqn.keys | ancestry.edges.keys)
+                                     .each_with_object(Hash.new { |h, k| h[k] = [] }) do |declared, out|
+            plausible_ancestors(declared).each { |ancestor| out[ancestor] << declared }
+          end
+          @plausible_descendants.fetch(fqn, [])
+        end
+
+        def open_descendants?(fqn)
+          ancestry.open.include?(fqn) || ancestry.open.any? { |mod| plausible_ancestors(mod).include?(fqn) }
+        end
+
+        # Whether `fqn` or one of its ancestors has an ancestor the walk cannot name, which may declare anything.
+        def unknown_ancestry?(fqn)
+          ([fqn] + plausible_ancestors(fqn)).any? { |scope| ancestry.unknown.include?(scope) }
+        end
+
+        def unknown_ancestry_classes
+          @unknown_ancestry_classes ||= ancestry.unknown.flat_map { |fqn| [fqn, *descendants_of(fqn)] }.uniq
+        end
+
+        # The {Scan::Ancestry} edges read (#1946): `edges` maps a class to the modules and superclass it gains
+        # outside its declaration; `open` holds the modules an unknown receiver gains, and `unknown` the classes
+        # that gain an ancestor the walk cannot name. A target is every scope its written name could be, declared
+        # or not (a gem class reopened as `class Foo::X` declares `Foo::X` alone); an ancestor, every scope that
+        # declares it.
+        AncestryIndex = Data.define(:edges, :open, :unknown)
+        private_constant :AncestryIndex
+
+        def ancestry
+          @ancestry ||= begin
+            edges = Hash.new { |h, k| h[k] = [] }
+            open = Set.new
+            unknown = Set.new
+            @ancestries.each do |edge|
+              targets = edge.target && written_scopes(edge.target)
+              ancestors = edge.ancestor && written_scopes(edge.ancestor).select { |fqn| @by_fqn.key?(fqn) }
+              if targets.nil? then open.merge(ancestors)
+              elsif ancestors.nil? then unknown.merge(targets)
+              else targets.each { |target| edges[target].concat(ancestors - [target]) }
+              end
+            end
+            AncestryIndex.new(edges: edges, open: open, unknown: unknown)
+          end
+        end
+
+        # Every scope a written reference could name: rooted, itself; otherwise its name under each enclosing scope.
+        def written_scopes(ref)
+          name = ref.as_written.delete_prefix("::")
+          return [name] if ref.rooted
+
+          ref.nesting.length.downto(0).map { |i| (ref.nesting.first(i) + [name]).join("::") }
         end
 
         # `scope::name`, or the longest declared prefix of it, when one is declared.
@@ -79,16 +174,15 @@ module Rigor
           out = []
           until queue.empty?
             current = queue.shift
-            @by_fqn.fetch(current, []).each do |decl|
-              (decl.includes + [decl.superclass]).compact.each do |raw|
-                plausible_resolutions(current, raw).each do |resolved|
-                  next if seen.include?(resolved)
+            resolved = @by_fqn.fetch(current, []).flat_map do |decl|
+              (decl.includes + [decl.superclass]).compact.flat_map { |raw| plausible_resolutions(current, raw) }
+            end
+            (resolved + ancestry.edges.fetch(current, [])).each do |ancestor|
+              next if seen.include?(ancestor)
 
-                  seen << resolved
-                  out << resolved
-                  queue << resolved
-                end
-              end
+              seen << ancestor
+              out << ancestor
+              queue << ancestor
             end
           end
           out.freeze
@@ -154,9 +248,12 @@ module Rigor
         #   A literal-argument site contributes a real reference; a dynamic one taints a namespace (WD4).
         # @param shadows — declarations made in files outside the analysed paths. They are never nodes, but a
         #   reference written in the SAME file resolves to them first, as Ruby would (#1732, see {#resolve_ref}).
-        def initialize(declarations:, references:, root_fqns: [], dynamic_uses: [], shadows: [],
+        # @param ancestries — {Scan::Ancestry} edges written outside a declaration, read only by the dynamic
+        #   lookup (#1946).
+        def initialize(declarations:, references:, root_fqns: [], dynamic_uses: [], shadows: [], ancestries: [],
                        foreign: ->(_fqn) { false })
           @declarations = declarations
+          @ancestries = ancestries
           @root_fqns = root_fqns.to_set
           @foreign = foreign
           @by_fqn = declarations.group_by(&:fqn)

data/lib/rigor/analysis/reachability/scan.rb

@@ -57,8 +57,21 @@ module Rigor
         # matching. A literal `name` keeps `within` too, and {Graph} looks it up from there (#1761). `inherit`
         # is false when the call passes `inherit = false`, which confines the lookup to the receiver itself;
         # otherwise the receiver's ancestors are searched as well. `role` is the referring file's (WD8).
-        DynamicUse = Data.define(:name, :prefix, :reason, :site, :path, :line, :scope, :within, :inherit, :role) do
-          def initialize(scope: :namespace, within: nil, inherit: true, role: :production, **) = super
+        #
+        # `receiver_open` is true when `within` is the enclosing declaration standing for a runtime `self` that
+        # may be one of its descendants (#1878): a `def self.x = const_get(:X)` runs on whichever subclass it
+        # is called on, and a module's method on whichever class includes, prepends or extends it. {Graph}
+        # then looks the literal name up in those descendants as well.
+        #
+        # `anywhere` is true when the receiver is a `self` the walk cannot name at all — the block of an eval call
+        # on a local or another computed receiver (`k.class_eval { const_get(:E) }`, #1946). {Graph} then keeps
+        # every declaration the literal could name.
+        DynamicUse = Data.define(:name, :prefix, :reason, :site, :path, :line, :scope, :within, :inherit, :role,
+                                 :receiver_open, :anywhere) do
+          def initialize(scope: :namespace, within: nil, inherit: true, role: :production, receiver_open: false,
+                         anywhere: false, **)
+            super
+          end
 
           # Whether this site's evidence reaches `fqn`.
           def taints?(fqn)
@@ -94,7 +107,18 @@ module Rigor
           end
         end
 
-        Result = Data.define(:declarations, :references, :dynamic_uses)
+        # An ancestry edge written outside a declaration's header and body statements (#1946): `K.include(Mix)`,
+        # `K.send(:include, Mix)` and the `prepend` / `extend` / `public_send` / `__send__` forms, an `include`
+        # in an eval block on `K` or nested in a conditional, and the superclass of `K = Class.new(Base)`. `target`
+        # is the class the module joins, `ancestor` the module (or superclass); each is a {Reference} resolved in
+        # the call's nesting, or nil when it is not a constant the walk can name — a local receiver, an
+        # `include` whose `self` is unknown, or a computed argument (`K.include(mods.first)`). {Graph} reads
+        # these only to widen a `const_get` on `self`'s reach, never for ordinary constant resolution.
+        Ancestry = Data.define(:target, :ancestor, :path, :line)
+
+        Result = Data.define(:declarations, :references, :dynamic_uses, :ancestries) do
+          def initialize(ancestries: [].freeze, **) = super
+        end
 
         # Roles a referring file can have (ADR-102 WD8). A reference edge carries its referrer's role so
         # "used only by its own test" is a reportable category rather than a bucket boundary.
@@ -155,7 +179,7 @@ module Rigor
           walker = Walker.new(path: path, role: role || role_for(path, root: root))
           walker.walk(parsed.value, [])
           Result.new(declarations: walker.declarations.freeze, references: walker.references.freeze,
-                     dynamic_uses: walker.dynamic_uses.freeze)
+                     dynamic_uses: walker.dynamic_uses.freeze, ancestries: walker.ancestries.freeze)
         end
 
         # The values a local variable can hold, read off its assignments in one local scope, for a
@@ -251,10 +275,51 @@ module Rigor
                               module_exec instance_eval instance_exec].freeze
           private_constant :SELF_REBINDING
 
+          # The `*_eval` / `*_exec` family: on a constant receiver, the block's `self` IS that constant (#1878).
+          EVAL_FAMILY = %i[class_eval module_eval class_exec module_exec instance_eval instance_exec].freeze
+          private_constant :EVAL_FAMILY
+
+          # Calls that define a method from their block: `define_method`'s block is an instance method's body,
+          # `define_singleton_method`'s a singleton method's (#1946).
+          METHOD_DEFINERS = { define_method: :instance, define_singleton_method: :singleton }.freeze
+          private_constant :METHOD_DEFINERS
+
           # A call is a dynamic-resolution site, and its block may run with another `self` ({#rebinds_self?}).
           def record_call(node, nesting)
             record_dynamic_use(node, nesting)
-            @rebinding_blocks << node.block if node.block.is_a?(Prism::BlockNode) && rebinds_self?(node)
+            record_mixin(node, nesting)
+            return unless node.block.is_a?(Prism::BlockNode)
+
+            classify_block(node, nesting)
+          end
+
+          def classify_block(node, nesting)
+            block = node.block
+            if rebinds_self?(node)
+              @rebinding_blocks << block
+              frame = eval_frame(node, nesting)
+              @eval_frames[block] = frame if frame
+            elsif meta_new_call?(node)
+              @meta_new_blocks << block
+            elsif METHOD_DEFINERS.key?(node.name) && (node.receiver.nil? || node.receiver.is_a?(Prism::SelfNode))
+              @definer_blocks[block] = METHOD_DEFINERS.fetch(node.name)
+            end
+          end
+
+          # The `self` of an eval call's block (#1878, #1946): the receiver when it is a constant, `:unknown` when
+          # it is a local or another computed value, and nil — the reading the walk had before — on `self`,
+          # `self.class`, an implicit receiver or `Object`. `singleton_defs` is whether a plain `def` in the block
+          # defines a singleton method of the receiver (`instance_eval`) rather than an instance method.
+          def eval_frame(call, nesting)
+            return anonymous_subclass_frame(call, nesting) if call.name == :new
+            return nil unless EVAL_FAMILY.include?(call.name)
+
+            singleton_defs = %i[instance_eval instance_exec].include?(call.name)
+            receiver = call.receiver
+            return EvalFrame.new(receiver_reference(receiver, nesting), singleton_defs) if constant_receiver?(receiver)
+            return nil if receiver.nil? || self_receiver?(receiver) || constant_path?(receiver)
+
+            EvalFrame.new(:unknown, singleton_defs)
           end
 
           # Rigor knows the argument's shape, which is the whole reason this can be tiered rather than treated
@@ -287,9 +352,11 @@ module Rigor
                      else []
                      end
             bounds = [[nil, :namespace, nil]] if bounds.empty?
+            record_anywhere(node, name, reason)
             bounds.each do |prefix, scope, within|
               @dynamic_uses << DynamicUse.new(name: name, prefix: prefix, scope: scope, within: within,
                                               inherit: anchors.include?(TOP_LEVEL), role: @role,
+                                              receiver_open: !within.nil? && runtime_self?(node),
                                               site: site(node), path: @path, line: node.location.start_line,
                                               reason: reason)
             end
@@ -318,12 +385,55 @@ module Rigor
             end
           end
 
+          # A literal `const_get` on a `self` the walk cannot name at all reaches any declaration of that name.
+          def record_anywhere(node, name, reason)
+            return unless name && !name.start_with?("::") && unknown_self?(node)
+
+            @dynamic_uses << DynamicUse.new(name: name, prefix: nil, anywhere: true, role: @role, site: site(node),
+                                            path: @path, line: node.location.start_line, reason: reason)
+          end
+
+          # Whether a `const_get` on `self` can run on a descendant of the enclosing declaration (#1878): in a
+          # method, or a block that rebinds `self`, `self` is whichever subclass or includer the method was
+          # called on. Directly in a class body, or inside `Other.class_eval { }`, it is the declaration itself.
+          def runtime_self?(node)
+            node.name == :const_get && self_receiver?(node.receiver) && @eval_frame.nil? &&
+              !(@self_kind == :declaration && !@in_block && !@self_rebound)
+          end
+
+          # Whether a `const_get` on `self` runs on a receiver the walk cannot name at all (#1946): directly in the
+          # block of an eval call on a computed receiver, or in a method that block defines when the receiver form
+          # names the eval receiver ({#method_receiver?}).
+          def unknown_self?(node)
+            return false unless node.name == :const_get && self_receiver?(node.receiver)
+            return @eval_frame.receiver == :unknown && !node.receiver.is_a?(Prism::CallNode) if @eval_frame
+
+            !@eval_method.nil? && @eval_method.receiver == :unknown && method_receiver?(node.receiver)
+          end
+
+          # Whether `receiver` names the eval receiver in a method an eval block defines: `self.class` in an
+          # instance method (`self` is an instance of the receiver or of a descendant), an implicit receiver or
+          # `self` in a singleton method. An implicit `const_get` in an instance method raises `NoMethodError`.
+          def method_receiver?(receiver)
+            class_of_self = receiver.is_a?(Prism::CallNode)
+            @eval_method.kind == :instance ? class_of_self : !class_of_self
+          end
+
+          # Inside a method an eval block on a constant defines, the receiver form that names that constant reads
+          # it as a runtime `self` that may be any of its descendants (#1946).
+          def eval_method_references(receiver)
+            return [] unless @eval_method&.receiver.is_a?(Reference) && method_receiver?(receiver)
+
+            [@eval_method.receiver]
+          end
+
           # Where a `const_get` on `self` (implicit, `self`, or `self.class`) looks its name up: `:declaration`
           # when `self` is the enclosing class or module, `:top_level` when it is `Class` or a singleton class,
           # `:unknown` otherwise. A block's `self` is unknown — `included do`, `class_eval` and an instance-
           # evaluated DSL block (`configure { }`, an RSpec `describe` body) all rebind it, and the walk cannot
           # tell those from an `each` block. So is the `self` of a `def Other.x` or of a `class << Other` body.
           def self_lookup(receiver)
+            return :declaration if @eval_frame&.receiver.is_a?(Reference) && !receiver.is_a?(Prism::CallNode)
             return :unknown if @in_block || @self_rebound
 
             class_of_self = receiver.is_a?(Prism::CallNode)
@@ -345,7 +455,7 @@ module Rigor
             receiver = node.receiver
             namespaces =
               if self_receiver?(receiver)
-                self_references(node, nesting)
+                eval_self_references(receiver) || (self_references(node, nesting) + eval_method_references(receiver))
               elsif constant_receiver?(receiver)
                 [receiver_reference(receiver, nesting)]
               else
@@ -357,6 +467,12 @@ module Rigor
             inherit.is_a?(Prism::FalseNode) ? namespaces : namespaces + [TOP_LEVEL]
           end
 
+          # Inside `Other.class_eval { }` an implicit or `self` receiver is `Other` (#1878).
+          def eval_self_references(receiver)
+            frame = @eval_frame
+            [frame.receiver] if frame&.receiver.is_a?(Reference) && !receiver.is_a?(Prism::CallNode)
+          end
+
           # The enclosing declaration as a rooted {Reference}, so {Graph} anchors it as it anchors a constant
           # receiver and can search its ancestors. Inside a meta-new rvalue `self` is the declared class in its
           # block but the outer scope in its arguments; the walk does not tell the two apart, so both are taken.
@@ -373,9 +489,13 @@ module Rigor
           def rebinds_self?(call)
             return true if SELF_REBINDING.include?(call.name)
 
+            @owner.nil? && meta_new_call?(call)
+          end
+
+          def meta_new_call?(call)
             recv = call.receiver
             name = recv && Source::ConstantPath.qualified_name_or_nil(recv)&.delete_prefix("::")
-            @owner.nil? && !name.nil? && META_NEW[name] == call.name
+            !name.nil? && META_NEW[name] == call.name
           end
 
           def self_receiver?(receiver)
@@ -456,11 +576,127 @@ module Rigor
           end
         end
 
+        # #1946 — the {Walker}'s reading of ancestry written outside a declaration's own statements, as
+        # {Ancestry} edges: receiver-form and `send`-spelled mixin calls, a mixin call whose `self` is not the
+        # enclosing declaration body, and the superclass of `K = Class.new(Base)`.
+        module AncestrySites
+          private
+
+          # An anonymous `Class.new(Base) { }` block's `self` is a subclass of `Base` that declares no constant of
+          # its own, so a `const_get` on it is read at `Base` (#1946).
+          def anonymous_subclass_frame(call, nesting)
+            superclass = call.arguments&.arguments&.first
+            return nil unless call.receiver.is_a?(Prism::ConstantReadNode) && call.receiver.name == :Class &&
+                              constant_receiver?(superclass)
+
+            EvalFrame.new(receiver_reference(superclass, nesting), false)
+          end
+
+          def constant_path?(node)
+            node.is_a?(Prism::ConstantReadNode) || node.is_a?(Prism::ConstantPathNode)
+          end
+
+          # Mixin calls: the ones a class body writes, and their `send` spellings.
+          MIXINS = %i[include prepend extend].freeze
+          private_constant :MIXINS
+
+          SENDS = %i[send public_send __send__].freeze
+          private_constant :SENDS
+
+          # Records an {Ancestry} for a mixin call the declaration's own statements do not carry (#1946). A
+          # receiver-less `include` directly in a class body is already one of its `includes` when every argument
+          # is a constant; a computed one (`include Mods.pick`) is an ancestor the walk cannot name. A `self`
+          # argument is the `self` the call is written in (`Foo.include(self)` in `module Mix`), not the receiver.
+          def record_mixin(node, nesting)
+            modules = mixin_arguments(node)
+            return if modules.nil? || modules.empty?
+            return if node.receiver.nil? && !SENDS.include?(node.name) && @body_statements.include?(node) &&
+                      modules.all? { |arg| mixin_reference(arg, nesting) }
+
+            target = mixin_target(node, nesting)
+            modules.each do |arg|
+              ancestor = arg.is_a?(Prism::SelfNode) ? self_target(node, nesting) : mixin_reference(arg, nesting)
+              next if target.nil? && ancestor.nil?
+
+              @ancestries << Ancestry.new(target: target, ancestor: ancestor, path: @path,
+                                          line: node.location.start_line)
+            end
+          end
+
+          # The module arguments of a mixin call, or nil when it is not one.
+          def mixin_arguments(node)
+            args = node.arguments&.arguments || []
+            return args if MIXINS.include?(node.name)
+            return nil unless SENDS.include?(node.name)
+
+            verb = args.first
+            name = verb.unescaped if verb.is_a?(Prism::SymbolNode) || verb.is_a?(Prism::StringNode)
+            # Compared as strings: `to_sym` raises on a literal that is not valid in its encoding (`send("\xFF")`).
+            MIXINS.any? { |mixin| mixin.name == name } ? args.drop(1) : nil
+          end
+
+          def mixin_reference(arg, nesting)
+            return nil unless constant_path?(arg) && Source::ConstantPath.qualified_name_or_nil(arg)
+
+            receiver_reference(arg, nesting)
+          end
+
+          # The class a mixin call adds to: a constant receiver, or for `self` and an implicit receiver whatever
+          # `self` is — the eval receiver in an eval block, the enclosing declaration in its body. Anything else,
+          # the top level (`Object`, whose descendants are every class) included, is unknown (nil).
+          def mixin_target(node, nesting)
+            receiver = node.receiver
+            return mixin_reference(receiver, nesting) unless receiver.nil? || receiver.is_a?(Prism::SelfNode)
+
+            self_target(node, nesting)
+          end
+
+          # What `self` is at `node` as a {Reference}, where the walk can name it; nil otherwise.
+          def self_target(node, nesting)
+            frame = @eval_frame
+            return frame&.receiver.is_a?(Reference) ? frame.receiver : nil if frame || @eval_method
+            return nil if @in_block || @self_rebound || @self_kind != :declaration || nesting.empty?
+
+            rooted_reference(nesting.join("::"), node)
+          end
+
+          def rooted_reference(fqn, node)
+            Reference.new(as_written: fqn, nesting: [].freeze, from: nil, role: @role, path: @path,
+                          line: node.location.start_line, rooted: true)
+          end
+
+          # `K = Class.new(Base)` makes `Base` an ancestor of `K` (#1946). It stays out of the declaration's
+          # `superclass`, which ordinary constant resolution reads: the engine does not resolve a constant
+          # through a `Class.new` superclass either, and the two are pinned to agree.
+          def record_class_new_superclass(call, fqn, nesting)
+            superclass = call.arguments&.arguments&.first
+            return unless call.receiver.name == :Class && superclass
+
+            ancestor = if superclass.is_a?(Prism::SelfNode) then self_target(call, nesting)
+                       else mixin_reference(superclass, nesting)
+                       end
+            @ancestries << Ancestry.new(target: rooted_reference(fqn, call), ancestor: ancestor,
+                                        path: @path, line: call.location.start_line)
+          end
+
+          # The receiver-less statements directly in a declaration body.
+          def body_statements(body)
+            body.child_nodes.select { |stmt| stmt.is_a?(Prism::CallNode) && stmt.receiver.nil? }
+                .to_set.compare_by_identity
+          end
+        end
+
+        # The `self` of an eval block ({DynamicSites#eval_frame}): a {Reference}, or `:unknown`.
+        EvalFrame = Data.define(:receiver, :singleton_defs)
+        # A method an eval block defines on its receiver, and whether it is an `:instance` or `:singleton` method.
+        EvalMethod = Data.define(:receiver, :kind)
+
         # Single-pass walker. Tracks `nesting` as the stack of enclosing declaration names.
         class Walker
           include DynamicSites
+          include AncestrySites
 
-          attr_reader :declarations, :references, :dynamic_uses
+          attr_reader :declarations, :references, :dynamic_uses, :ancestries
 
           def initialize(path:, role:)
             @path = path
@@ -468,6 +704,10 @@ module Rigor
             @declarations = []
             @references = []
             @dynamic_uses = []
+            @ancestries = []
+            # The receiver-less statements directly in the declaration body being walked, which its own
+            # `includes` already carry. See {#record_mixin}.
+            @body_statements = Set.new.compare_by_identity
             # The declaration a meta-new rvalue is being walked for, or nil. See {#walk_constant_write}.
             @owner = nil
             # The node whose subtree holds the local variables in scope: the file, a method, or a class body.
@@ -478,6 +718,15 @@ module Rigor
             # `class_eval` or anonymous `Class.new` block. See {#rebinds_self?}.
             @self_rebound = false
             @rebinding_blocks = Set.new.compare_by_identity
+            # The {EvalFrame} of each `*_eval` block, and the one whose `self` the walk is directly in (nil when
+            # `self` is not an eval receiver). See {#eval_frame}.
+            @eval_frames = {}.compare_by_identity
+            @eval_frame = nil
+            # Inside a method an eval block defines (a `def`, or a `define_method` / `define_singleton_method`
+            # block), the eval receiver and the method's kind; nil elsewhere. See {#eval_method_references}.
+            @eval_method = nil
+            @meta_new_blocks = Set.new.compare_by_identity
+            @definer_blocks = {}.compare_by_identity
             # What `self` is here, for {#self_lookup}: `:declaration` in a class or module body (and at the top
             # level), `:singleton_method` in a `def self.x` or a def in a `class << self` body,
             # `:instance_method` in any other def, `:singleton_class` in a `class << self` body outside its
@@ -545,14 +794,18 @@ module Rigor
 
             # The body's nesting names the declaration itself, so a credit inherited from a meta-new rvalue
             # this declaration sits in must not leak into it.
-            owner = @owner
-            saved = [@self_rebound, @in_block, @module_body]
+            walk_body(node.body, nesting + [name], module_body)
+          end
+
+          def walk_body(body, nesting, module_body)
+            saved = [@owner, @self_rebound, @in_block, @module_body, @body_statements]
             @owner = nil
             @self_rebound = @in_block = false
             @module_body = module_body
-            in_local_scope(node.body, :declaration) { walk(node.body, nesting + [name]) }
-            @owner = owner
-            @self_rebound, @in_block, @module_body = saved
+            @body_statements = body_statements(body)
+            in_local_scope(body, :declaration) { walk(body, nesting) }
+          ensure
+            @owner, @self_rebound, @in_block, @module_body, @body_statements = saved
           end
 
           # A meta-new rvalue — `Class.new(Base) { ... }`, `Struct.new(:a) do ... end` — is the declaration's
@@ -585,6 +838,7 @@ module Rigor
             fqn = (nesting + [node.name.to_s]).join("::")
             @declarations << Declaration.new(fqn: fqn, path: @path,
                                              line: node.location.start_line, superclass: nil, includes: [].freeze)
+            record_class_new_superclass(call, fqn, nesting)
             fqn
           end
 
@@ -592,23 +846,35 @@ module Rigor
           # top level of the body is inspected: a mixin applied inside a conditional or a nested def is not a
           # static ancestor edge.
           def mixin_names(body)
-            body.child_nodes.filter_map do |stmt|
-              next unless stmt.is_a?(Prism::CallNode) && %i[include prepend extend].include?(stmt.name)
-              next if stmt.receiver
+            body.child_nodes.flat_map do |stmt|
+              next [] unless stmt.is_a?(Prism::CallNode) && %i[include prepend extend].include?(stmt.name)
+              next [] if stmt.receiver
 
-              arg = stmt.arguments&.arguments&.first
-              arg && Source::ConstantPath.qualified_name_or_nil(arg)
+              (stmt.arguments&.arguments || []).filter_map { |arg| Source::ConstantPath.qualified_name_or_nil(arg) }
             end
           end
 
           def in_local_scope(scope, self_kind = self_kind_in(scope))
-            saved = [@local_scope, @block_params, @self_kind]
+            saved = [@local_scope, @block_params, @self_kind, @eval_frame, @eval_method]
+            @eval_method = eval_def(scope)
+            @eval_frame = nil
             @local_scope = scope
             @block_params = Set.new.freeze
             @self_kind = self_kind
             yield
           ensure
-            @local_scope, @block_params, @self_kind = saved
+            @local_scope, @block_params, @self_kind, @eval_frame, @eval_method = saved
+          end
+
+          # The method a `def` directly in an eval block defines on the eval receiver (#1946): a plain `def` is an
+          # instance method, or a singleton one under `instance_eval`; a `def self.x` is a singleton method.
+          def eval_def(scope)
+            frame = @eval_frame
+            return nil unless frame && scope.is_a?(Prism::DefNode)
+
+            if scope.receiver.nil? then EvalMethod.new(frame.receiver, frame.singleton_defs ? :singleton : :instance)
+            elsif scope.receiver.is_a?(Prism::SelfNode) then EvalMethod.new(frame.receiver, :singleton)
+            end
           end
 
           # The {#self_lookup} kind inside `scope`, from the kind around it. Only a receiver-less def or a `def
@@ -642,14 +908,30 @@ module Rigor
           end
 
           def in_block(block)
-            saved = [@block_params, @self_rebound, @in_block]
+            saved = [@block_params, @self_rebound, @in_block, @eval_frame, @eval_method]
             names = block.parameters ? LocalValues.bindings(block.parameters) : []
             @block_params = (@block_params | names).freeze unless names.empty?
-            @self_rebound ||= @rebinding_blocks.include?(block)
+            enter_block_self(block)
             @in_block = true
             yield
           ensure
-            @block_params, @self_rebound, @in_block = saved
+            @block_params, @self_rebound, @in_block, @eval_frame, @eval_method = saved
+          end
+
+          # A block whose `self` is another object drops the eval reading around it: an eval block sets its own
+          # (#1878), and a `Class.new` / `Struct.new` block's `self` is the class it builds. A `define_method` /
+          # `define_singleton_method` block directly in an eval block is a method of the eval receiver (#1946).
+          def enter_block_self(block)
+            if @rebinding_blocks.include?(block)
+              @self_rebound = true
+              @eval_frame = @eval_frames[block]
+              @eval_method = nil
+            elsif @meta_new_blocks.include?(block)
+              @eval_frame = @eval_method = nil
+            elsif @eval_frame && @definer_blocks.key?(block)
+              @eval_method = EvalMethod.new(@eval_frame.receiver, @definer_blocks.fetch(block))
+              @eval_frame = nil
+            end
           end
 
           def site(node)