rigortype 0.4.5 → 0.4.6

data/lib/rigor/inference/ivar_writer_census.rb

@@ -0,0 +1,195 @@
+# frozen_string_literal: true
+
+require "prism"
+
+module Rigor
+  module Inference
+    # Issue #1154 — the instance-variable writers {GlobalWriteCensus} records for the declared-parameter credit
+    # ({ScopeIndexer::DeclaredParamWrites}), which must not type an ivar a writer the class-ivar census never walks may
+    # replace. The standard is parity with a literal write: `@x = 1` in `initialize` already reads `1` in every sibling
+    # method whatever an unknown object's code does, so only the writers that literal writes would also have to answer
+    # for are recorded, and an unknown-receiver writer records nothing (as `ReflectiveIvarWrite` leaves
+    # `o.instance_variable_set` alone). Three entry kinds go into the census `Set`:
+    #
+    # - `[:ivar_set, name]` — a literal `o.instance_variable_set(:@x, v)` (or the same through a `send` that spells
+    #   it) on an explicit receiver other than `self`, and an `@x` write in the literal block of an
+    #   `o.instance_eval { … }` / `instance_exec`: code that names the ivar it writes.
+    # - `[:ivar_set_class, class_name]` — an open-world writer ({#open_world?}) with an implicit or `self` receiver
+    #   inside an instance body of the class — a `def` or a `define_method` block in its class body, in the block of a
+    #   `K = Struct.new` / `Data.define` / `Class.new` constant, or in a `K.class_eval` block (the host walk passes
+    #   that class as `owner`): it may write any ivar of the class's instances. A writer in a class body, a
+    #   `def self.` or at the top level records nothing.
+    # - `[:own_write, class_name, name]` — an `@x` write inside an instance body of the class.
+    #   {ScopeIndexer#merge_constant_literal_tables} appends the file's path, so a reader can tell whether a second
+    #   file writes the same ivar of the same class.
+    class IvarWriterCensus
+      SEND_CALLS = %i[send __send__ public_send].to_set.freeze
+      # The methods a `send` reaching which is an open-world writer.
+      OPEN_WORLD_SENDS = %i[instance_variable_set instance_eval instance_exec extend
+                            define_singleton_method].to_set.freeze
+      EVAL_CALLS = %i[instance_eval instance_exec].to_set.freeze
+      # The calls on a `singleton_class` receiver that give the object methods or code the census cannot read.
+      SINGLETON_CLASS_CALLS = %i[
+        class_eval class_exec module_eval module_exec define_method include prepend extend attr attr_reader
+        attr_writer attr_accessor send public_send __send__
+      ].to_set.freeze
+      NO_ARGUMENTS = [].freeze
+
+      # The call names any rule here reads, so every other call returns at one Set probe.
+      # (`define_method` is in {SINGLETON_CLASS_CALLS}.)
+      WATCHED_CALLS = (SEND_CALLS | OPEN_WORLD_SENDS | EVAL_CALLS | SINGLETON_CLASS_CALLS).freeze
+
+      def initialize(census)
+        @census = census
+        @instance_ranges = []
+        @owner_names = {}.compare_by_identity
+        @own_writes = {}
+      end
+
+      # Fed each node of a pre-order descent. `owner` is the class whose body the node sits in, as its qualified name
+      # or as the host walk's prefix Array (joined here only when an entry needs it), or nil where no class owns an
+      # instance (`class << self`, the top level, an opaque block).
+      def visit(node, owner)
+        case node
+        when Prism::DefNode then remember(node.location, owner) if owner && node.receiver.nil?
+        when Prism::SingletonClassNode then visit_singleton_class(node)
+        when Prism::CallNode then visit_call(node, owner) if WATCHED_CALLS.include?(node.name)
+        when Prism::InstanceVariableWriteNode, Prism::InstanceVariableOrWriteNode, Prism::InstanceVariableAndWriteNode,
+             Prism::InstanceVariableOperatorWriteNode, Prism::InstanceVariableTargetNode
+          record_own_write(node) unless @instance_ranges.empty?
+        end
+      end
+
+      private
+
+      # One entry per class and ivar: a repeated write costs a Hash probe, not a location and an Array.
+      def record_own_write(node)
+        owner = instance_owner(node)
+        return if owner.nil?
+
+        seen = (@own_writes[owner] ||= {})
+        return if seen[node.name]
+
+        seen[node.name] = true
+        @census << [:own_write, owner_name(owner), node.name].freeze
+      end
+
+      def owner_name(owner) = owner.is_a?(Array) ? (@owner_names[owner] ||= owner.join("::")) : owner
+
+      def visit_call(node, owner)
+        remember(node.block.location, owner) if owner && define_method_block?(node)
+        if self_receiver?(node) || own_singleton_class_call?(node)
+          return if @instance_ranges.empty? || !(own_singleton_class_call?(node) || open_world?(node))
+
+          instance = instance_owner(node)
+          record_class(instance) if instance
+        else
+          visit_foreign(node)
+        end
+      end
+
+      # `class << self` inside an instance `def` opens the instance's singleton class.
+      def visit_singleton_class(node)
+        return unless node.expression.is_a?(Prism::SelfNode) && !@instance_ranges.empty?
+
+        instance = instance_owner(node)
+        record_class(instance) if instance
+      end
+
+      def record_class(owner) = @census << [:ivar_set_class, owner_name(owner)].freeze
+
+      # The self writers whose target or code the census cannot read: a `send` with a computed method name or one
+      # naming {OPEN_WORLD_SENDS}; `instance_eval` / `instance_exec` given a block argument, and `instance_eval`
+      # given a string; `extend`; `define_singleton_method` with a body; and an `instance_variable_set` whose name no
+      # literal spells. A call in {SINGLETON_CLASS_CALLS} on the object's own `singleton_class` counts as well.
+      def open_world?(node)
+        name = node.name
+        arguments = node.arguments&.arguments || NO_ARGUMENTS
+        return open_world_send?(arguments) if SEND_CALLS.include?(name)
+        return open_world_eval?(node, arguments) if EVAL_CALLS.include?(name)
+        # #1931's census already makes every ivar of the class gradual for one in the same file; this entry covers one
+        # in a reopening in another file, which that census does not see.
+        return ivar_name(arguments.first).nil? if name == :instance_variable_set
+
+        name == :extend || (name == :define_singleton_method && (!node.block.nil? || arguments.size > 1))
+      end
+
+      def open_world_send?(arguments)
+        return false if arguments.empty?
+
+        sent = literal_name(arguments.first)
+        sent.nil? || OPEN_WORLD_SENDS.include?(sent)
+      end
+
+      def open_world_eval?(node, arguments)
+        node.block.is_a?(Prism::BlockArgumentNode) || (node.name == :instance_eval && !arguments.empty?)
+      end
+
+      # A call on another receiver: a named foreign write, or `self.singleton_class.class_eval` and its kin.
+      def visit_foreign(node)
+        arguments = node.arguments&.arguments || NO_ARGUMENTS
+        name = node.name
+        if SEND_CALLS.include?(name) && arguments.first && literal_name(arguments.first) == :instance_variable_set
+          name = :instance_variable_set
+          arguments = arguments.drop(1)
+        end
+        if name == :instance_variable_set
+          ivar = ivar_name(arguments.first)
+          @census << [:ivar_set, ivar].freeze if ivar
+        elsif EVAL_CALLS.include?(name) && node.block.is_a?(Prism::BlockNode)
+          record_block_ivar_writes(node.block)
+        end
+      end
+
+      def record_block_ivar_writes(node)
+        return unless node.is_a?(Prism::Node)
+        return if node.is_a?(Prism::DefNode) || node.is_a?(Prism::ClassNode) || node.is_a?(Prism::ModuleNode)
+
+        case node
+        when Prism::InstanceVariableWriteNode, Prism::InstanceVariableOrWriteNode, Prism::InstanceVariableAndWriteNode,
+             Prism::InstanceVariableOperatorWriteNode, Prism::InstanceVariableTargetNode
+          @census << [:ivar_set, node.name].freeze
+        end
+        node.rigor_each_child { |child| record_block_ivar_writes(child) }
+      end
+
+      def define_method_block?(node)
+        node.name == :define_method && self_receiver?(node) && node.block.is_a?(Prism::BlockNode)
+      end
+
+      # An instance body (`def` or `define_method` block) and the class it belongs to. A `define_method` block's own
+      # nodes may reach the walk with no owner (the walk reads its `self` as opaque), so the class rides the range.
+      def remember(location, owner)
+        @instance_ranges << [(location.start_offset...location.end_offset), owner]
+      end
+
+      # The class of the innermost instance body covering `node` (pre-order, so the last covering range), or nil.
+      def instance_owner(node)
+        offset = node.location.start_offset
+        @instance_ranges.reverse_each { |(range, owner)| return owner if range.cover?(offset) }
+        nil
+      end
+
+      def self_receiver?(node) = node.receiver.nil? || node.receiver.is_a?(Prism::SelfNode)
+
+      # A call in {SINGLETON_CLASS_CALLS} on the object's own `singleton_class` (`singleton_class.class_eval { … }`).
+      def own_singleton_class_call?(node)
+        receiver = node.receiver
+        receiver.is_a?(Prism::CallNode) && receiver.name == :singleton_class && self_receiver?(receiver) &&
+          SINGLETON_CLASS_CALLS.include?(node.name)
+      end
+
+      def literal_name(argument)
+        return unless argument.is_a?(Prism::SymbolNode) || argument.is_a?(Prism::StringNode)
+
+        text = argument.unescaped
+        text.to_sym if text.valid_encoding?
+      end
+
+      def ivar_name(argument)
+        name = literal_name(argument)
+        name if name.to_s.start_with?("@")
+      end
+    end
+  end
+end

data/lib/rigor/inference/loop_value_record.rb

@@ -0,0 +1,53 @@
+# frozen_string_literal: true
+
+module Rigor
+  module Inference
+    # The value the statement evaluator last gave a loop node, and the scope it evaluated the loop from, so
+    # `ExpressionTyper#type_of_loop` reads it instead of evaluating the loop again (issue #2031 review). A loop's value
+    # costs an evaluation of its body, its fixpoint and its `break` passes included, and the typer types a loop again
+    # wherever it types a node that holds one: the value of a write that wraps it (`id(z = (while …))`), a call it is
+    # the receiver of (`(while …).itself`), each narrowing and rule that types that operand. Each such typing of a
+    # loop nested in another loop re-ran the inner loop's passes, once more per level of nesting.
+    #
+    # The record is reused only for the very scope object the loop was evaluated from, so it answers exactly what an
+    # evaluation would. It is not compared with `Scope#==`, which ignores several fields (`match_frame`,
+    # `declared_refinements`, `struct_fold_safe_locals`, the opaque-block flags, `lexical_nesting`, the origins tables,
+    # `discovery`): across the cost spec's 10933 reads every match was an identity match, and `lib/` read no record at
+    # all (issue #2262). It lives in a per-thread map whose keys are held weakly, so a record goes when its parse tree
+    # does.
+    module LoopValueRecord
+      KEY = :rigor_loop_value_record
+      private_constant :KEY
+
+      module_function
+
+      COUNT_KEY = :rigor_loop_value_count
+      private_constant :COUNT_KEY
+
+      def record(node, scope, type)
+        Thread.current[COUNT_KEY] = loops_evaluated + 1
+        conditional(node, scope, type)
+      end
+
+      # How many loops this thread has evaluated, so a conditional can tell whether its evaluation held one.
+      def loops_evaluated = Thread.current[COUNT_KEY] || 0
+
+      # The same record for a conditional that evaluated a loop in a branch: `id(c ? (while …) : 0)` types the
+      # conditional again from the scope it was evaluated from, and each typing evaluated the loop again from a
+      # branch scope of its own, which multiplied the passes of every loop nested in it (issue #2262).
+      def conditional(node, scope, type)
+        (Thread.current[KEY] ||= ObjectSpace::WeakKeyMap.new)[node] = [scope, type]
+        type
+      end
+
+      # The recorded value of `node` evaluated from `scope` itself, or nil.
+      def fetch(node, scope)
+        slot = Thread.current[KEY]&.[](node)
+        return nil if slot.nil?
+
+        recorded, type = slot
+        recorded.equal?(scope) ? type : nil
+      end
+    end
+  end
+end

data/lib/rigor/inference/match_rebinding/frame.rb

@@ -88,6 +88,18 @@ module Rigor
           @forwarded_block == name
         end
 
+        # Issue #1157 — whether a call's `&expr` block argument hands on the block THIS method was called with: the
+        # anonymous `&` of a method that declares an anonymous `&` parameter, or {#forwarded_block?} for `&name`.
+        # Anything else (`&:sym`, a proc made here, a rebound name) is a block of this frame's own making.
+        def forwards_block?(block_argument)
+          expression = block_argument.expression
+          case expression
+          when nil then anonymous_block_parameter?
+          when Prism::LocalVariableReadNode then forwarded_block?(expression.name)
+          else false
+          end
+        end
+
         # The scan of `node` under `scope`, kept while `scope`'s local and instance-variable tables are the same
         # objects: a lookup argument's answer reads them ({MatchRebinding.may_match?}), and a rebuild that leaves
         # them alone passes the same tables on. `kind` keeps another reading of the same node apart (issue #1365:
@@ -125,6 +137,13 @@ module Rigor
           name
         end
 
+        # True when the method declares a bare `&` parameter, which only an anonymous `&` argument can read.
+        def anonymous_block_parameter?
+          parameters = @parameters
+          block = parameters.is_a?(Prism::ParametersNode) ? parameters.block : nil
+          !block.nil? && block.name.nil?
+        end
+
         # The method's own `&block` parameter's name, or nil.
         def block_parameter_name
           parameters = @parameters

data/lib/rigor/inference/method_dispatcher/constant_folding.rb

@@ -219,6 +219,15 @@ module Rigor
         # declared `Numeric`, on which `(2 ** 20_000).even?` is an undefined method.
         WidenedResult = Data.define(:class_name)
 
+        # #2125 — a String result past `STRING_FOLD_BYTE_LIMIT`, or an operand that would build one. Unlike a
+        # `WidenedResult` it declines the WHOLE fold, every other member of a union receiver included: dropping
+        # only the oversized member would answer the rest (`(c ? "a" : big) * 2` read `"aa"`). The next tier then
+        # answers the call — `LiteralStringFolding`'s `literal-string`, or RBS's `String`, never less than the
+        # `Nominal[String]` the fold could have widened to.
+        OversizedString = Data.define
+        OVERSIZED_STRING = [OversizedString.new].freeze
+        private_constant :OversizedString, :OVERSIZED_STRING
+
         # Input cartesian product hard cap. Keeps fold cost bounded even when the receiver and argument are
         # both `Union[Constant…]`. 5 × 5 = 25 inputs is permitted; 6 × 6 = 36 is not. The user-facing payoff
         # (a precise small enum) drops off fast past this range and CRuby method invocation cost adds up.
@@ -331,6 +340,7 @@ module Rigor
           arg = args.first
           ruby_arg = format_argument_value(arg)
           return nil if ruby_arg.nil?
+          return nil if format_blow_up?(receiver.value, ruby_arg)
 
           result = receiver.value % ruby_arg
           return nil unless foldable_constant_value?(result)
@@ -1200,6 +1210,8 @@ module Rigor
         # "Integer-ness" was already implied by the inputs (so the widening fallback only fires for
         # arithmetic over integers).
         def build_constant_type(values, source: nil)
+          return nil if values.any?(OversizedString)
+
           widened, values = values.partition { |value| value.is_a?(WidenedResult) }
           return build_scalar_constant_type(values, source) if widened.empty?
 
@@ -1213,7 +1225,8 @@ module Rigor
         def build_scalar_constant_type(values, source)
           return nil if values.empty?
 
-          unique = values.uniq
+          # #1513 — keyed so the possible results `0.0` and `-0.0` stay two members, as `Constant#==` keeps them.
+          unique = values.uniq { |value| Type::Constant.value_key(value) }
           return collapse_constants(unique) if unique.size <= UNION_FOLD_OUTPUT_LIMIT
 
           widen_to_integer_range(unique, source) ||
@@ -1643,6 +1656,7 @@ module Rigor
         # `flat_map`.
         def invoke_binary(receiver_value, method_name, arg_value)
           return nil unless safe?(receiver_value, method_name, arg_value)
+          return OVERSIZED_STRING if string_blow_up?(receiver_value, method_name, arg_value)
           return nil if range_enumeration_blow_up?(receiver_value, method_name)
 
           widened = numeric_blow_up_class(receiver_value, method_name, arg_value)
@@ -1658,6 +1672,7 @@ module Rigor
         # `false`/`nil` folds.
         def invoke_ternary(receiver_value, method_name, av0, av1)
           return nil unless ternary_method_allowed?(receiver_value, method_name)
+          return OVERSIZED_STRING if string_ternary_blow_up?(receiver_value, method_name, av0, av1)
 
           fold_result(receiver_value.public_send(method_name, av0, av1))
         rescue StandardError
@@ -1667,7 +1682,7 @@ module Rigor
         # Returns `[value]` on success, `nil` to signal "skip". See `invoke_binary` for why we wrap.
         def invoke_unary(receiver_value, method_name)
           return nil unless unary_safe?(receiver_value, method_name)
-          return nil if string_unary_blow_up?(receiver_value, method_name)
+          return OVERSIZED_STRING if string_unary_blow_up?(receiver_value, method_name)
           return nil if range_enumeration_blow_up?(receiver_value, method_name)
 
           fold_result(receiver_value.public_send(method_name))
@@ -1675,10 +1690,11 @@ module Rigor
           nil
         end
 
-        # `[result]` for a foldable value, `[WidenedResult]` for a number past `INTEGER_FOLD_BIT_LIMIT`, nil
-        # for anything else.
+        # `[result]` for a foldable value, `[WidenedResult]` for a number past `INTEGER_FOLD_BIT_LIMIT`,
+        # `OVERSIZED_STRING` for a String past `STRING_FOLD_BYTE_LIMIT`, nil for anything else.
         def fold_result(result)
           return [WidenedResult.new(result.class.name)] if oversized_number?(result)
+          return OVERSIZED_STRING if oversized_string?(result)
 
           foldable_constant_value?(result) ? [result] : nil
         end
@@ -1822,10 +1838,20 @@ module Rigor
           return false if value.is_a?(Float) && value.nan?
           return false if value.is_a?(Complex) && complex_nan?(value)
           return false if oversized_number?(value)
+          return false if oversized_string?(value)
 
           true
         end
 
+        # #2125 — the result gate every String-producing fold passes through, the String twin of
+        # `oversized_number?`. The operand prechecks (`string_blow_up?`, `string_ternary_blow_up?`,
+        # `format_blow_up?`) keep the costly cases from being built at all; this catches the rest after the
+        # fact (`tr` into multibyte characters, `dump`, `Integer#to_s(2)`, whose receiver
+        # `INTEGER_FOLD_BIT_LIMIT` already bounds, so its rendering is at most 13 KB).
+        def oversized_string?(value)
+          value.is_a?(String) && value.bytesize > STRING_FOLD_BYTE_LIMIT
+        end
+
         # True when an Integer, or an Integer part of a Rational / Complex, is past `INTEGER_FOLD_BIT_LIMIT`.
         def oversized_number?(value)
           case value
@@ -1874,7 +1900,6 @@ module Rigor
                     catalog_allows?(receiver_value, method_name)
           return false unless allowed
           return false if integer_division_by_zero?(receiver_value, method_name, arg_value)
-          return false if string_blow_up?(receiver_value, method_name, arg_value)
 
           true
         end
@@ -1960,16 +1985,91 @@ module Rigor
           case method_name
           when :+ then string_concat_blow_up?(receiver_value, arg_value)
           when :* then string_repeat_blow_up?(receiver_value, arg_value)
+          when :% then format_blow_up?(receiver_value, arg_value)
           when :center, :ljust, :rjust then string_pad_blow_up?(arg_value)
           else false
           end
         end
 
+        # #2125 — the two-argument String folds that can grow past the input: the padded `center` / `ljust`
+        # / `rjust` (width, pad) and `sub` / `gsub` (pattern, replacement).
+        def string_ternary_blow_up?(receiver_value, method_name, av0, av1)
+          return false unless receiver_value.is_a?(String)
+
+          case method_name
+          when :center, :ljust, :rjust then string_pad_blow_up?(av0)
+          when :sub, :gsub then string_substitution_blow_up?(receiver_value, method_name, av1)
+          else false
+          end
+        end
+
+        # An upper bound on a `sub` / `gsub` result with a String replacement: `gsub` matches at most once per
+        # position plus once at the end, and each replacement is the replacement's bytes plus, for every
+        # backslash in it (`\0`, `\1`, `\k<name>`, `` \` ``, `\'`), at most the receiver's bytes again.
+        def string_substitution_blow_up?(receiver_value, method_name, replacement)
+          return false unless replacement.is_a?(String)
+
+          size = receiver_value.bytesize
+          matches = method_name == :gsub ? size + 1 : 1
+          per_match = replacement.bytesize + (replacement.count("\\") * size)
+          size + (matches * per_match) > STRING_FOLD_BYTE_LIMIT
+        end
+
+        # #2125 — `String#%` / `Kernel#format` pad to a field width and render to a precision the format
+        # string spells (`"%02000000000d"`, `"%.100000f"`) or an argument supplies (`"%*d" % [n, 1]`).
+        # Formatting builds the whole padded string before any result gate can look at it — two billion
+        # bytes took 13 s and 4 GB — so the numbers are read from the directives first. A `*` width counts
+        # every Integer argument as a possible width, and a `%%` escape matches as a whole, carrying no digits.
+        FORMAT_DIRECTIVE = /%%|%(?:<[^>]*>|\{[^}]*\}|[-+ 0#*$.\d])*/
+        private_constant :FORMAT_DIRECTIVE
+
+        def format_blow_up?(format_string, arguments)
+          star = false
+          format_string.scan(FORMAT_DIRECTIVE) do |directive|
+            spec = directive.gsub(/<[^>]*>|\{[^}]*\}|\d+\$/, "")
+            return true if spec.scan(/\d+/).any? { |digits| digits.to_i > STRING_FOLD_BYTE_LIMIT }
+
+            star ||= spec.include?("*")
+          end
+          star && format_argument_values(arguments).any? do |value|
+            width = integer_operand(value)
+            !width.nil? && width.abs > STRING_FOLD_BYTE_LIMIT
+          end
+        end
+
+        def format_argument_values(arguments)
+          case arguments
+          when Hash then arguments.values
+          when Array then arguments
+          else [arguments]
+          end
+        end
+
         # `"x".center(width)` / `#ljust` / `#rjust` produce a string of `max(width, len)` characters. A
         # literal `width` far larger than the receiver would materialise a huge Constant; cap it at the same
         # byte limit the concat / repeat paths use.
         def string_pad_blow_up?(arg_value)
-          arg_value.is_a?(Integer) && arg_value > STRING_FOLD_BYTE_LIMIT
+          width = integer_operand(arg_value)
+          !width.nil? && width > STRING_FOLD_BYTE_LIMIT
+        end
+
+        # The Integer a width or count operand stands for. Ruby converts a Float or Rational one with `NUM2LONG`
+        # (`"x" * 2.9` is `"xx"`, `"x".ljust(2e9)` pads to two billion), and a Complex one whose imaginary part is an
+        # exact zero through its real part (`"x" * Complex(3, 0)` is `"xxx"`; `Complex(3, 0.0)` raises), so the
+        # prechecks read it the same way. Those are every Numeric class a `Constant` carries. A non-finite Float
+        # raises in Ruby, and any other operand is left to the call, so both answer nil.
+        def integer_operand(value)
+          case value
+          when Integer then value
+          when Float then value.finite? ? value.to_i : nil
+          when Rational then value.to_i
+          when Complex then exact_real_operand(value)
+          end
+        end
+
+        def exact_real_operand(value)
+          imaginary = value.imaginary
+          imaginary.is_a?(Integer) && imaginary.zero? ? integer_operand(value.real) : nil
         end
 
         def string_concat_blow_up?(receiver_value, arg_value)
@@ -1978,10 +2078,11 @@ module Rigor
         end
 
         def string_repeat_blow_up?(receiver_value, arg_value)
-          return false unless arg_value.is_a?(Integer)
-          return true if arg_value.negative?
+          # A negative count raises (`ArgumentError`), so the call itself skips that member, as any raising one is.
+          count = integer_operand(arg_value)
+          return false if count.nil? || count.negative?
 
-          receiver_value.bytesize * arg_value > STRING_FOLD_BYTE_LIMIT
+          receiver_value.bytesize * count > STRING_FOLD_BYTE_LIMIT
         end
       end
     end

data/lib/rigor/inference/method_dispatcher/kernel_dispatch.rb

@@ -191,12 +191,16 @@ module Rigor
         # Runs the real `Kernel#format` when everything is value-pinned. A malformed directive or an
         # argument-count mismatch raises at fold time; the handler declines so the literal-string
         # lift (or the RBS `String` envelope) answers instead. Results larger than the shared
-        # `ConstantFolding::STRING_FOLD_BYTE_LIMIT` decline too, keeping the carrier-size convention.
+        # `ConstantFolding::STRING_FOLD_BYTE_LIMIT` decline too, keeping the carrier-size convention,
+        # and a field width or precision past it declines before the string is built (#2125).
         def fold_format_constant(args)
           return nil unless args.all?(Type::Constant)
           return nil unless args.first.value.is_a?(String)
 
-          result = format(args.first.value, *args.drop(1).map(&:value))
+          values = args.drop(1).map(&:value)
+          return nil if ConstantFolding.format_blow_up?(args.first.value, values)
+
+          result = format(args.first.value, *values)
           return nil if result.bytesize > ConstantFolding::STRING_FOLD_BYTE_LIMIT
 
           Type::Combinator.constant_of(result)

data/lib/rigor/inference/method_dispatcher/set_folding.rb

@@ -35,43 +35,76 @@ module Rigor
           return nil unless SingletonFolding.receiver?(receiver, "Set")
 
           case method_name
-          when :[] then fold_bracket(args)
-          when :new then fold_new(args)
+          when :[] then fold_bracket(args, context.call_node)
+          when :new then fold_new(args, context.call_node, context.block_type)
           end
         end
 
-        # `Set["a", "b", "c"]` — all positional args must be Constant.
-        def fold_bracket(args)
-          values = args.map do |a|
-            return nil unless a.is_a?(Type::Constant)
+        # `Set["a", "b", "c"]` — all positional args must be Constant to fold to a value. Otherwise the
+        # element type is the union of the arguments, widened off their literal pins (#2278).
+        def fold_bracket(args, call_node = nil)
+          return nil if splatted?(call_node)
 
-            a.value
-          end
+          return Type::Combinator.constant_of(::Set.new(args.map(&:value))) if args.all?(Type::Constant)
 
-          Type::Combinator.constant_of(::Set.new(values))
+          typed_set(args)
         rescue StandardError
           nil
         end
 
-        # `Set.new` / `Set.new(tuple_of_constants)`.
-        def fold_new(args)
+        # `Set.new` / `Set.new(enum)`. A call with a block declines: the block maps each element
+        # (`Set.new([1, 2], &:to_s)` holds `"1"` and `"2"`), so the argument's elements are not the set's.
+        def fold_new(args, call_node = nil, block_type = nil)
+          return nil if block_type || block_given?(call_node) || splatted?(call_node)
           return Type::Combinator.constant_of(::Set.new) if args.empty?
           return nil if args.size > 1
 
           arg = args.first
-          values = case arg
-                   when Type::Tuple
-                     return nil unless arg.elements.all?(Type::Constant)
-
-                     arg.elements.map(&:value)
-                   else
-                     return nil
-                   end
+          return fold_tuple(arg) if arg.is_a?(Type::Tuple)
 
-          Type::Combinator.constant_of(::Set.new(values))
+          element = nominal_element(arg)
+          element ? typed_set([element]) : nil
         rescue StandardError
           nil
         end
+
+        def fold_tuple(tuple)
+          if tuple.elements.all?(Type::Constant)
+            return Type::Combinator.constant_of(::Set.new(tuple.elements.map(&:value)))
+          end
+
+          typed_set(tuple.elements)
+        end
+
+        # The element of an `Array[T]` / `Set[T]` argument, or nil for any other carrier.
+        def nominal_element(arg)
+          return nil unless arg.is_a?(Type::Nominal) && %w[Array Set].include?(arg.class_name)
+          return nil unless arg.type_args.size == 1
+
+          arg.type_args.first
+        end
+
+        # `Nominal[Set, [E]]`, `E` the members widened as an `Array.new` fill is (value pins dropped, a literal
+        # container widened to its nominal) joined with a `Dynamic[top]` floor. The floor is the conservative half:
+        # nothing widens a Set's element when the program mutates it (`add`, `<<`, `merge`, `replace`, `clear`
+        # then `<<`, a callee that fills it), so the classes the set was built with are not a claim about what it
+        # holds later, and a read of the element must not report on them (#2278).
+        def typed_set(types)
+          return nil if types.empty?
+
+          members = types.map { |t| MethodDispatcher.array_new_element(t) }
+          Type::Combinator.nominal_of("Set", type_args: [Type::Combinator.union(*members, Type::Combinator.untyped)])
+        end
+
+        def block_given?(call_node)
+          call_node.respond_to?(:block) && !call_node.block.nil?
+        end
+
+        def splatted?(call_node)
+          return false unless call_node.respond_to?(:arguments)
+
+          (call_node.arguments&.arguments || []).any?(Prism::SplatNode)
+        end
       end
     end
   end