rigortype 0.4.5 → 0.4.7

data/lib/rigor/inference/construction_escape.rb

@@ -0,0 +1,217 @@
+# frozen_string_literal: true
+
+require "prism"
+require_relative "../source/node_walker"
+require_relative "../source/node_children"
+require_relative "../run_scoped_slots"
+
+module Rigor
+  module Inference
+    # Issue #2555 L3 — which locals of a body may have ESCAPED, so a write to them never carries the `:synthesised`
+    # construction fact ({Scope#construction_fact?}).
+    #
+    # The fact lets the mutation seams re-grow a carrier without the `Dynamic[top]` floor, and the floor existed
+    # because a store the seam does not see leaves the carrier stale. A store reaches a local's object unseen only
+    # through another holder of it, and almost any position can make one: an alias, a container, an argument (a
+    # constructor or an attribute writer keeps it, `Array(a)` and `ident(a)` return it), a call that returns the
+    # receiver for some class (`Set#merge`, `a.each`), or a method the project defines. So every reference escapes
+    # unless it is in one of these positions:
+    #
+    # - the receiver of a call on the per-class {READERS} list, which neither returns, keeps nor mutates its receiver;
+    # - the receiver of an {ITERATORS} call or of a mutator the seams model ({.mutators_for}), with the call's value
+    #   discarded;
+    # - the body's value position (its last statement, or `return a`), after which nothing in the body runs;
+    # - a bare read whose value is discarded.
+    #
+    # A listed name the project defines anywhere (a reopen, a prepended or included module, a refinement, any
+    # class at all) escapes all the same ({.project_defines?}). Every argument position escapes, and so does
+    # any reference inside a block or lambda, a write whose value is used (`a = b = …`), and every local of a
+    # body that calls `binding`, `eval`, `local_variable_set`, `instance_variable_set` or a string-form
+    # `instance_eval` / `class_eval` / `module_eval`.
+    # The scan is flow insensitive and runs once per body, so an escape anywhere drops the fact for the whole body:
+    # the conservative direction, since without the fact the seams answer as before. A nested `def` or class body is
+    # scanned too, though its locals are its own; a same-named local there can only over-report an escape.
+    module ConstructionEscape
+      CLASSES = %w[Array Hash Set].freeze
+
+      # The calls that answer a value other than the receiver, keep no reference to it, and change nothing in it.
+      READERS = Ractor.make_shareable(
+        {
+          "Array" => %i[
+            size length count empty? any? none? all? include? first last [] dig fetch index find_index sum min max
+            join dup map select filter reject sort sort_by uniq compact flatten reverse take drop to_h to_set ==
+          ].to_set,
+          "Hash" => %i[
+            size length count empty? any? include? key? has_key? member? value? has_value? [] dig fetch keys values
+            dup map select filter reject to_a ==
+          ].to_set,
+          "Set" => %i[size length count empty? any? include? member? first dup map select filter reject to_a ==].to_set
+        }
+      )
+
+      # The calls that answer the receiver itself and yield only its members: safe with their value discarded.
+      ITERATORS = Ractor.make_shareable(
+        {
+          "Array" => %i[each each_with_index each_index reverse_each].to_set,
+          "Hash" => %i[each each_pair each_key each_value each_with_index].to_set,
+          "Set" => %i[each].to_set
+        }
+      )
+
+      # Calls that read or rebind the frame's locals by name: one anywhere in a body escapes every local in it.
+      FRAME_CALLS = %i[binding eval local_variable_set instance_variable_set].to_set.freeze
+      STRING_EVAL_CALLS = %i[instance_eval class_eval module_eval].to_set.freeze
+
+      CLOSURES = [Prism::BlockNode, Prism::LambdaNode].freeze
+      LOCAL_REFERENCES = [
+        Prism::LocalVariableReadNode, Prism::LocalVariableWriteNode, Prism::LocalVariableOperatorWriteNode,
+        Prism::LocalVariableOrWriteNode, Prism::LocalVariableAndWriteNode, Prism::LocalVariableTargetNode
+      ].freeze
+      LOCAL_WRITES = [
+        Prism::LocalVariableWriteNode, Prism::LocalVariableOperatorWriteNode, Prism::LocalVariableOrWriteNode,
+        Prism::LocalVariableAndWriteNode
+      ].freeze
+      ALL = :all
+      EMPTY_CALLS = Set.new.freeze
+      # A run-scoped slot ({RunScopedSlots}): emptied when a run ends, so a long-lived process never serves a verdict
+      # from a body an earlier run parsed.
+      CACHE_KEY = RunScopedSlots.register(:__rigor_construction_escape)
+      private_constant :CLOSURES, :LOCAL_REFERENCES, :LOCAL_WRITES, :ALL, :EMPTY_CALLS, :CACHE_KEY,
+                       :STRING_EVAL_CALLS
+
+      # One body's answer: per name, ALL or the classes it escapes as, and the calls the scan admitted on it.
+      Result = Data.define(:escapes, :calls)
+      private_constant :Result
+
+      module_function
+
+      # True when the local `name`, bound to a carrier of `class_name`, may escape somewhere in `body`, or when
+      # `body` is unknown. `scope` answers whether the project defines one of the admitted calls on the class
+      # ({.project_defines?}).
+      def escaped?(body, name, class_name, scope)
+        return true if body.nil? || class_name.nil?
+
+        table = (Thread.current[CACHE_KEY] ||= ObjectSpace::WeakKeyMap.new)
+        result = table[body] ||= scan(body)
+        return true if result.equal?(ALL)
+
+        reason = result.escapes[name]
+        return true if !reason.nil? && (reason.equal?(ALL) || reason.include?(class_name))
+
+        result.calls.fetch(name, EMPTY_CALLS).any? { |call| project_defines?(scope, class_name, call) }
+      end
+
+      # Whether the project defines a method named `call` anywhere ({Scope#project_method_name?}): on any class or
+      # module, instance or singleton side, in a `refine` block, in any file. An admitted call of such a name escapes
+      # the local whatever the receiver's class, because a prepended or included module, a refinement or a reopen can
+      # put that name on Array, Hash or Set, and telling which owner reaches the receiver is not worth the precision
+      # it buys: without the fact the seams answer as before. When no def is found the def-node lookup on the class
+      # itself still runs, so an incremental run records the missing `Array#size` and a later reopen re-analyses
+      # this file.
+      def project_defines?(scope, class_name, call)
+        scope.project_method_name?(call) || !scope.user_def_for(class_name, call).nil?
+      end
+
+      # The receiver mutators the seams model for `class_name` ({MutationWidening}, {HashLookupMutation},
+      # {SetMutation}).
+      def mutators_for(class_name)
+        case class_name
+        when "Array" then MutationWidening::ARRAY_MUTATORS
+        when "Hash" then MutationWidening::HASH_MUTATORS | HashLookupMutation::MUTATORS
+        else SetMutation::MUTATORS
+        end
+      end
+
+      def scan(body)
+        escapes = {}
+        calls = {}
+        Source::NodeWalker.each_with_ancestors(body) do |node, ancestors|
+          return ALL if frame_call?(node)
+          next unless LOCAL_REFERENCES.any? { |k| node.is_a?(k) }
+
+          record(escapes, calls, node, ancestors)
+        end
+        Result.new(escapes: escapes.freeze, calls: calls.freeze)
+      end
+
+      def record(escapes, calls, node, ancestors)
+        name = node.name
+        call = receiver_call(node, ancestors)
+        unsafe =
+          if call
+            unsafe_classes(call, ancestors).tap { |u| (calls[name] ||= Set.new) << call.name if u.size < CLASSES.size }
+          else
+            escape_reference?(node, ancestors) ? CLASSES : []
+          end
+        return if unsafe.empty? || escapes[name].equal?(ALL)
+
+        escapes[name] = unsafe.size == CLASSES.size ? ALL : (escapes[name] || Set.new).merge(unsafe)
+      end
+
+      def frame_call?(node)
+        return false unless node.is_a?(Prism::CallNode)
+
+        FRAME_CALLS.include?(node.name) || (STRING_EVAL_CALLS.include?(node.name) && !node.arguments.nil?)
+      end
+
+      # The call a read outside any closure is the receiver of, or nil.
+      def receiver_call(node, ancestors)
+        return nil unless node.is_a?(Prism::LocalVariableReadNode) && !in_closure?(ancestors)
+
+        parent = ancestors.last
+        parent if parent.is_a?(Prism::CallNode) && parent.receiver.equal?(node)
+      end
+
+      # The classes for which `call` on the local may hand it on.
+      def unsafe_classes(call, ancestors)
+        discarded = !value_used?(ancestors, ancestors.size - 2, call)
+        CLASSES.reject do |class_name|
+          READERS.fetch(class_name).include?(call.name) ||
+            (discarded && (ITERATORS.fetch(class_name).include?(call.name) ||
+                           mutators_for(class_name).include?(call.name)))
+        end
+      end
+
+      def in_closure?(ancestors)
+        ancestors.any? { |a| CLOSURES.any? { |k| a.is_a?(k) } }
+      end
+
+      # Whether a reference that is no call's receiver may hand the object on.
+      def escape_reference?(node, ancestors)
+        return true if in_closure?(ancestors)
+        return value_used?(ancestors, ancestors.size - 1, node) if LOCAL_WRITES.any? { |k| node.is_a?(k) }
+        return false unless node.is_a?(Prism::LocalVariableReadNode)
+
+        parent = ancestors.last
+        return false if parent.is_a?(Prism::ArgumentsNode) && ancestors[-2].is_a?(Prism::ReturnNode)
+
+        !(parent.is_a?(Prism::StatementsNode) && !value_used?(ancestors, ancestors.size - 1, node))
+      end
+
+      # Whether the value of `node`, whose parent is `ancestors[index]`, reaches anything. The body's own value (its
+      # last statement) is the return position, after which nothing in the body runs, so it reads as unused.
+      def value_used?(ancestors, index, node)
+        while index >= 0
+          parent = ancestors[index]
+          case parent
+          when Prism::StatementsNode
+            return false unless parent.body.last.equal?(node)
+          when Prism::IfNode, Prism::UnlessNode, Prism::CaseNode, Prism::CaseMatchNode
+            return true if parent.predicate.equal?(node)
+          when Prism::WhenNode, Prism::InNode
+            return true unless parent.statements.equal?(node)
+          when Prism::WhileNode, Prism::UntilNode, Prism::EnsureNode
+            return !parent.statements.equal?(node)
+          when Prism::ElseNode, Prism::BeginNode, Prism::ParenthesesNode, Prism::ProgramNode, Prism::RescueNode
+            nil
+          else
+            return true
+          end
+          node = parent
+          index -= 1
+        end
+        false
+      end
+    end
+  end
+end

data/lib/rigor/inference/declaration_walk/traversal.rb

@@ -235,7 +235,7 @@ module Rigor
         # A subset of a multi-collector run that its nodes keep asking for, built the first time and reused:
         # each collector alone (a pair in which one declines), the run without each collector (a larger run in
         # which one declines), and the run split by `factory_block` and `lexical_prefix` variant where it mixes
-        # them. `key` is a Symbol for a split, or `[kind, collector]` for the other two.
+        # them. `kind` names the table; `key` is the collector, or the rule's Symbol for a split.
         def subset(kind, collector = nil)
           table = (@subsets[kind] ||= {}.compare_by_identity)
           key = collector || kind

data/lib/rigor/inference/deep_erasure.rb

@@ -0,0 +1,170 @@
+# frozen_string_literal: true
+
+require "prism"
+require_relative "../type"
+require_relative "../source/node_walker"
+require_relative "mutation_rejoin"
+require_relative "receiver_alias"
+require_relative "set_mutation"
+
+module Rigor
+  module Inference
+    # A loop hands its collection's own elements to its body (issue #2262), so a body that mutates one in place
+    # changes a shape that the collection's binding still carries one level down. This module is the two halves of
+    # dropping that shape: whether the body mutates an element, and the type with every shape dropped at every depth.
+    module DeepErasure
+      module_function
+
+      # {MutationWidening.widen_tuple} / {MutationWidening.widen_hash_shape} applied at every depth: each `Tuple` /
+      # `HashShape` the type holds, as a union member or a type argument, drops to its nominal, so `[[1]]` reads
+      # `Array[Array[Integer]]`. A loop's element is the collection's own object, so a body that mutates it in place
+      # (`x << 2`) changes a shape one level down that the collection's binding still carries.
+      def widen(type)
+        case type
+        when Type::Tuple then widen_args(MutationWidening.widen_tuple(type))
+        when Type::HashShape then widen_args(MutationWidening.widen_hash_shape(type))
+        when Type::Nominal then widen_args(type)
+        when Type::Difference then widen(type.base)
+        when Type::Union then Type::Combinator.union(*type.members.map { |member| widen(member) })
+        else Type::Combinator.widen_value_pinned(type)
+        end
+      end
+
+      def widen_args(nominal)
+        return nominal unless nominal.is_a?(Type::Nominal) && !nominal.type_args.empty?
+
+        Type::Combinator.nominal_of(nominal.class_name, type_args: nominal.type_args.map { |arg| widen(arg) })
+      end
+
+      # The parameter nodes whose names a block (or a `for` index) binds to the collection's elements.
+      ELEMENT_PARAMETER_NODES = [
+        Prism::RequiredParameterNode, Prism::OptionalParameterNode, Prism::RestParameterNode,
+        Prism::KeywordRestParameterNode, Prism::LocalVariableTargetNode
+      ].freeze
+      ELEMENT_WRITE_NODES = [
+        Prism::IndexOperatorWriteNode, Prism::IndexOrWriteNode, Prism::IndexAndWriteNode,
+        Prism::CallOperatorWriteNode, Prism::CallOrWriteNode, Prism::CallAndWriteNode,
+        Prism::IndexTargetNode, Prism::CallTargetNode
+      ].freeze
+      private_constant :ELEMENT_PARAMETER_NODES, :ELEMENT_WRITE_NODES
+
+      # True when `body` mutates in place a value that a name in `names` (a loop's element) holds: a mutator
+      # (`MutationWidening::SHAPE_MUTATORS`) called on a read or an index chain rooted at it (`x << 1`,
+      # `x[0].push(1)`, `x[0] = 1`), or an operator write on one (`x[0] += 1`). Every name a block or a
+      # `for` inside the body binds counts as an element too (`x.each { |y| y << 1 }`, `for c in x; c << 1; end`),
+      # and so does `it` / `_1` wherever it is read, and an accumulator parameter (`inject([]) { |acc, e| acc << e }`):
+      # the rule is wider than "an element", which only loses precision. It does not follow an alias (`y = x`) or
+      # an element passed to a call (`add(x)`), which the straight-line widening does not either.
+      #
+      # A Set-only mutator (`add`, `merge`, `subtract`, … — {SetMutation::MUTATORS} less `SHAPE_MUTATORS`) counts
+      # only when `set_held` is given and answers true (issue #2363). The names are read without their receiver,
+      # and `merge` on a Hash element returns a new Hash, so the caller answers from the collection's type whether
+      # an element could be a Set at all ({holds_set?}). The block runs at the first such site, at most once.
+      def element_mutation?(body, names, &set_held)
+        return false if body.nil?
+
+        names |= nested_parameter_names(body)
+        Source::NodeWalker.each(body).any? { |node| element_mutation_site?(node, names, set_held) }
+      end
+
+      # True when `type` holds a `Set` at some depth: as itself, a union member, a `Tuple` element, a `HashShape`
+      # value or a type argument. A collection whose type holds none has no element a Set-only mutator can be
+      # mutating, so a `merge` on one of its elements is `Hash#merge`, which returns a new Hash.
+      def holds_set?(type)
+        case type
+        when Type::Constant then SetMutation.constant?(type)
+        when Type::Nominal then type.class_name == "Set" || type.type_args.any? { |arg| holds_set?(arg) }
+        when Type::Tuple then type.elements.any? { |element| holds_set?(element) }
+        when Type::HashShape then type.pairs.each_value.any? { |value| holds_set?(value) }
+        when Type::Union then type.members.any? { |member| holds_set?(member) }
+        when Type::Difference then holds_set?(type.base)
+        else false
+        end
+      end
+
+      # The names `parameters` (a block's parameter list, or a `for` index) binds.
+      def parameter_names(parameters)
+        return [] if parameters.nil?
+
+        Source::NodeWalker.each(parameters).filter_map do |node|
+          node.name if ELEMENT_PARAMETER_NODES.include?(node.class)
+        end
+      end
+
+      def nested_parameter_names(body)
+        Source::NodeWalker.each(body).flat_map do |node|
+          case node
+          when Prism::BlockNode then parameter_names(node.parameters)
+          when Prism::ForNode then parameter_names(node.index)
+          else []
+          end
+        end
+      end
+
+      def element_mutation_site?(node, names, set_held)
+        if node.is_a?(Prism::CallNode)
+          return false unless element_rooted?(node.receiver, names)
+
+          MutationWidening::SHAPE_MUTATORS.include?(node.name) ||
+            (!set_held.nil? && SetMutation::MUTATORS.include?(node.name) && set_held.call)
+        else
+          ELEMENT_WRITE_NODES.include?(node.class) && element_rooted?(node.receiver, names)
+        end
+      end
+
+      def element_rooted?(node, names)
+        node = node.receiver while node.is_a?(Prism::CallNode) && node.receiver
+        node = node.body.body.last while node.is_a?(Prism::ParenthesesNode) && node.body.is_a?(Prism::StatementsNode)
+        case node
+        when Prism::LocalVariableReadNode then names.include?(node.name) || /\A_[1-9]\z/.match?(node.name)
+        when Prism::ItLocalVariableReadNode then true
+        else false
+        end
+      end
+
+      # A block call hands each of its receiver's elements to the block's parameters, and a body that mutates one in
+      # place (`a.each { |x| x << 2 }`) changes the shape the receiver's binding still carries one level down
+      # (`[[1]]`). The receiver's variables drop their shapes at every depth ({widen}), as a `for` loop's
+      # value does ({StatementEvaluator#for_collection_after}). A receiver that is a call exposing a variable's
+      # elements (`h.values`, `a.dup`, `a.each_with_index`) names that variable ({ReceiverAlias.element_sources}).
+      def widen_element_aliases(receiver, body, names, scope)
+        return scope unless element_mutation?(body, names) { receiver_holds_set?(receiver, scope) }
+
+        widen_receiver(receiver, scope)
+      end
+
+      def receiver_holds_set?(receiver, scope)
+        ReceiverAlias.element_sources(receiver).any? do |read|
+          getter, = MutationWidening::ALIAS_ACCESSORS[read.class]
+          getter && holds_set?(scope.public_send(getter, ReceiverAlias.read_name(read)))
+        end
+      end
+
+      def widen_receiver(receiver, scope)
+        ReceiverAlias.element_sources(receiver).reduce(scope) { |acc, read| widen_read(read, acc) }
+      end
+
+      # `a.each(&:strip!)`: a block argument naming a mutator mutates every element it is handed.
+      def symbol_proc_mutation?(block)
+        block.is_a?(Prism::BlockArgumentNode) && block.expression.is_a?(Prism::SymbolNode) &&
+          MutationWidening::SHAPE_MUTATORS.include?(block.expression.unescaped.to_sym)
+      end
+
+      def widen_symbol_proc(call_node, scope) = widen_receiver(call_node.receiver, scope)
+
+      def widen_read(read, scope)
+        getter, builder = MutationWidening::ALIAS_ACCESSORS[read.class]
+        return scope if getter.nil?
+
+        name = ReceiverAlias.read_name(read)
+        current = scope.public_send(getter, name)
+        return scope if current.nil?
+
+        widened = widen(current)
+        return scope if widened == current
+
+        MutationRejoin.rebind(scope, builder, name, widened, pre_state: current, kind: getter)
+      end
+    end
+  end
+end

data/lib/rigor/inference/def_handle.rb

@@ -8,7 +8,7 @@ module Rigor
     # file's methods: the file was never parsed this run, so there is no live node to store. A handle records
     # the four things needed to resolve, fingerprint, or scope it without the node:
     #
-    # - `path` + `node_id` — the resolution key. The per-run parse memo ({Scope#resolve_def_handle}) parses the
+    # - `path` + `node_id` — the resolution key. The per-run parse memo ({DefNodeResolver.resolve}) parses the
     #   file once and returns the `Prism::DefNode` whose `node_id` matches (Prism `node_id` is stable across
     #   repeated parses of identical bytes). `name` is the cross-check: a resolved node whose `name` differs
     #   from the handle's forces a fresh walk (bundle/source skew that the digest gate should make impossible —

data/lib/rigor/inference/def_node_resolver.rb

@@ -104,7 +104,7 @@ module Rigor
       # is recorded like any other: it is the bundle saying the def is written at the top level, and dropping
       # it would leave the warm path peeling the caller's namespace where a cold run resolves at the top
       # level. Only `nil` — a bundle that recorded nothing for the def — is skipped, and
-      # `Cache::IncrementalSnapshot::SCHEMA` 17 is what keeps a pre-#716 blob (where `nil` MEANT top level)
+      # the `SCHEMA` bump to 17 (`Cache::IncrementalSnapshot`) keeps a pre-#716 blob, where `nil` MEANT top level,
       # from being read as one.
       def self.record_nesting(memo, node, nesting)
         return if node.nil? || nesting.nil?