rigortype 0.4.6 → 0.4.8

data/lib/rigor/inference/narrowing.rb

@@ -13,6 +13,7 @@ require_relative "guard_rebinding"
 require_relative "intervening_ivar_reset"
 require_relative "key_presence_guard"
 require_relative "last_line"
+require_relative "match_rebinding"
 require_relative "operand_effects"
 require_relative "optimistic_origin"
 require_relative "project_method_ownership"
@@ -532,7 +533,17 @@ module Rigor
           lexical_class_name(condition, scope) || case_equality_target_class(condition)
         end
         body_scope = record_bot_guard(narrow_guarded_slot(body_scope, slot, truthy_type), slot, truthy_type, classes)
-        [body_scope, narrow_guarded_slot(scope, slot, falsey_type)]
+        marked = unwrap_case_subject(subject).is_a?(Prism::LocalVariableReadNode) && scope.gradual_narrowing?(slot.name)
+        # A marked subject keeps its mark under any `when` (`when "r"` narrows it without writing it); an unmarked one
+        # is stamped only under class conditions.
+        if marked || classes.none?(&:nil?)
+          static = gradual_union_slot?(slot) ? gradual_static_part(slot.current) : nil
+          static &&= case_when_types(scope, static, conditions).first
+          body_scope = mark_gradual_narrowing(body_scope, slot, truthy_type, marked: marked, narrowed_static: static)
+        end
+        falsey_scope = narrow_guarded_slot(scope, slot, falsey_type)
+        falsey_scope = falsey_scope.with_gradual_narrowing_mark(slot.name) if marked
+        [body_scope, falsey_scope]
       end
 
       CASE_SUBJECT_KINDS = %i[local ivar global constant].freeze
@@ -588,12 +599,21 @@ module Rigor
         end
       end
 
-      # When the clause has exactly one `RegularExpressionNode` literal condition, narrow the
-      # match-data globals on the body edge (same rule as `analyse_regex_match_predicate`'s
-      # truthy edge). With multiple regex conditions (`when /a/, /b/`) the body is reachable
-      # through any of them, so only `$~`/`$&` are safely non-nil; numbered groups whose
-      # presence differs per alternative stay `String | nil`. With no regex condition the entry
-      # scope passes through unchanged.
+      # When every condition is a `RegularExpressionNode` literal, the body edge narrows the
+      # match-data globals as `analyse_regex_match_predicate`'s truthy edge does. With multiple
+      # regex conditions (`when /a/, /b/`) the body is reachable through any of them, so only
+      # `$~`/`$&` are safely non-nil; numbered groups whose presence differs per alternative stay
+      # `String | nil`. With no regex condition the entry scope passes through unchanged.
+      #
+      # Issue #1474 — a clause that mixes a regex literal with another condition (`when /(a)/,
+      # "lit"`) is also entered through the other conditions: each regex literal before them ran
+      # its `===` and failed, leaving the globals nil, and a condition before any regex leaves
+      # them as they were. The body scope then joins the match globals of every way in rather
+      # than claiming the regex matched: each condition contributes the scope its own `===`
+      # leaves — a regex literal's truthy edge, the falsey edge of the regex literals that
+      # failed before it, the entry state where none ran, and the unknown-match edges for a
+      # condition that may itself be or run a Regexp ({MatchRebinding::Operands.pattern_value?},
+      # {MatchRebinding.may_match?}).
       def apply_when_regex_globals(conditions, scope)
         regexes = conditions.grep(Prism::RegularExpressionNode)
         return scope if regexes.empty?
@@ -604,8 +624,102 @@ module Rigor
           else
             Set.new
           end
-        truthy, = regex_match_predicate_scopes(scope, unconditional)
-        truthy
+        truthy, falsey = regex_match_predicate_scopes(scope, unconditional)
+        return truthy if regexes.size == conditions.size
+
+        empty_truthy, empty_falsey = regex_match_predicate_scopes(scope, Set.new)
+        failed = scope
+        paths = conditions.map do |condition|
+          kind = when_regex_condition_kind(condition, scope)
+          path, failed = when_regex_condition_scopes(kind, failed, truthy, falsey, empty_truthy, empty_falsey)
+          path
+        end
+        paths.reduce(:join)
+      end
+
+      # How a `when` condition's `===` can touch the match globals, for {#apply_when_regex_globals}:
+      # `:literal` a `RegularExpressionNode`, whose match the clause's shared unconditional groups
+      # describe; `:interpolated` an interpolated regex literal, a definite match whose groups are
+      # unknown; `:may_match` any other condition that may be a Regexp or run one, whose `===`
+      # outcome for the globals is unknown; `:neutral` a condition whose `===` and evaluation run
+      # no match, leaving the globals as the earlier conditions left them.
+      def when_regex_condition_kind(condition, scope)
+        return :literal if condition.is_a?(Prism::RegularExpressionNode)
+        return :interpolated if condition.is_a?(Prism::InterpolatedRegularExpressionNode)
+        if MatchRebinding::Operands.pattern_value?(condition, scope) ||
+           MatchRebinding.may_match?(condition, scope)
+          return :may_match
+        end
+
+        :neutral
+      end
+
+      # `[body_path_scope, failed_scope]` for one `when` condition of a mixed clause, `failed`
+      # being the globals state the conditions before it left. On the path where this condition's
+      # `===` matched the body reads the truthy edge (`:literal`), the ungrouped truthy edge
+      # (`:interpolated`), the join of that edge with `failed` (`:may_match` — it may not have
+      # been a match at all), or `failed` itself (`:neutral`). On the path where it failed the
+      # next conditions read the matching falsey edge, the ungrouped one, the join of it with
+      # `failed`, or `failed`.
+      def when_regex_condition_scopes(kind, failed, truthy, falsey, empty_truthy, empty_falsey)
+        case kind
+        when :literal then [truthy, falsey]
+        when :interpolated then [empty_truthy, empty_falsey]
+        when :may_match then [empty_truthy.join(failed), failed.join(empty_falsey)]
+        else [failed, failed]
+        end
+      end
+
+      # Issue #2443, #1371 — the scope the block of a call that yields only after it has matched in the caller's frame
+      # enters with ({MatchRebinding::YieldingMatch}): the match edge of `pattern`, the call's pattern argument, over
+      # `scope` with the match globals forgotten. `$~` is a `MatchData`, `$&` and the pre- and post-match a `String`,
+      # and so is each numbered group {#yielded_capture_groups} vouches for; every other group is unbound, so it
+      # reads the RBS `String?` whatever an earlier match in the method bound it to.
+      def yielded_match_scope(scope, pattern)
+        regex_match_predicate_scopes(scope, yielded_capture_groups(pattern)).first
+      end
+
+      # The pattern sources {#yielded_capture_groups} reads groups from: literal characters, `.`, the anchors, the
+      # quantifiers, `|`, plain and `(?:…)` groups, the class escapes, `\n`, `\r` and `\t`, an escaped punctuation
+      # character, and a bracket class holding only those with no bracket inside it. The group walk
+      # ({#unconditional_capture_groups}) reads these right; it misreads sources outside them (#2472, #1476).
+      PLAIN_PATTERN_ATOM = %r{[A-Za-z0-9 _\-.,:;=<>!@%&~'"`/^$+*?|(){}#]|\\[wWdDsShHnrt]|\\[^A-Za-z0-9\s]}
+      PLAIN_PATTERN_CLASS =
+        %r{\[\^?(?:[A-Za-z0-9 _\-.,:;=<>!@%~'"`/^$+*?|(){}#]|\\[wWdDsShHnrt]|\\[^A-Za-z0-9\s])+\]}
+      PLAIN_PATTERN = /\A(?:#{PLAIN_PATTERN_CLASS}|#{PLAIN_PATTERN_ATOM}|\\[bBAzZG])*\z/
+      OTHER_GROUP_FORM = /\(\?(?!:)/
+      # A quantifier on a quantifier repeats the quantified atom, so `(a)+{0}` and `(a){2}?` may match without the
+      # group. `+?` and `++` are one quantifier.
+      STACKED_QUANTIFIER = /\+[?+]?[*{]|\+[?+][?+]|\}[*+?{]/
+      NO_GROUPS = Set.new.freeze
+      private_constant :PLAIN_PATTERN_ATOM, :PLAIN_PATTERN_CLASS, :PLAIN_PATTERN, :OTHER_GROUP_FORM,
+                       :STACKED_QUANTIFIER, :NO_GROUPS
+
+      # Issue #1371 — the 1-based indices of the groups every match of `pattern` sets, read only from a regex
+      # literal written between slashes, without interpolation or the `x` flag, whose source is a {PLAIN_PATTERN}
+      # with no `(?` form but `(?:` and no {STACKED_QUANTIFIER}. Any other pattern, a String one included, vouches
+      # for no group: declining costs precision, while a misread group would read `String` where Ruby has nil. A
+      # `%r` literal is declined because its source escapes the delimiter, which hides a quantifier from the walk:
+      # `%r,(a){\,1}b,` is `/(a){,1}b/`.
+      def yielded_capture_groups(pattern)
+        return NO_GROUPS unless pattern.is_a?(Prism::RegularExpressionNode) && !pattern.extended?
+        return NO_GROUPS unless pattern.opening == "/"
+
+        plain_pattern_source?(pattern.content) ? unconditional_capture_groups(pattern.content) : NO_GROUPS
+      end
+
+      def plain_pattern_source?(source)
+        source.ascii_only? && PLAIN_PATTERN.match?(source) && !OTHER_GROUP_FORM.match?(source) &&
+          !STACKED_QUANTIFIER.match?(source)
+      end
+      private_class_method :yielded_capture_groups, :plain_pattern_source?
+
+      # Issue #2443 — true when every member of `type` is a String (a project subclass included) or a `Dynamic` that
+      # is untyped or may hold only Strings, Symbols and nil ({#match_member_kind}). A `nil` member never runs the
+      # block, so it counts neither way.
+      def string_match_receiver?(type, scope)
+        kinds = match_member_kinds(type, scope) - [:nil]
+        !kinds.empty? && kinds.all? { |kind| %i[string string_subclass dynamic].include?(kind) }
       end
 
       # Internal analyser. Returns `[truthy_scope, falsey_scope]` when the predicate shape is
@@ -616,7 +730,30 @@ module Rigor
       def analyse(node, scope)
         edges = analyse_shape(node, scope)
         reader = last_line_condition(node)
-        reader ? LastLine.predicate_scopes(reader, scope, edges) : edges
+        edges = LastLine.predicate_scopes(reader, scope, edges) if reader
+        keep_gradual_marks(node, scope, edges)
+      end
+
+      # Issue #2656 — a guard edge narrows a local; it does not write it. So a local a class guard marked as a gradual
+      # narrowing ({Scope#with_gradual_narrowing_mark}) keeps the mark on both edges of every later predicate
+      # (`return if x.nil?`, `x != ""`, a second class guard), which bind the narrowed type through `with_local` and
+      # drop it. A local the predicate itself writes (`if (x = v)`) loses it, as any write does.
+      def keep_gradual_marks(node, scope, edges)
+        return edges if edges.nil? || (edges[0].equal?(scope) && edges[1].equal?(scope))
+
+        names = scope.gradual_narrowing_names
+        return edges if names.empty?
+
+        # Defensive: the statement walk binds a predicate's own write (`if (x = v)`) before its edges are read, so the
+        # mark is already gone there; the exclusion keeps a write that reached here from carrying it.
+        names -= OperandEffects.written_variables(node).map(&:to_sym)
+        return edges if names.empty?
+
+        edges.map do |edge|
+          names.reduce(edge) do |acc, name|
+            acc.gradual_narrowing?(name) || acc.local(name).nil? ? acc : acc.with_gradual_narrowing_mark(name)
+          end
+        end
       end
 
       # The reader call a condition's value is, or nil.
@@ -968,12 +1105,22 @@ module Rigor
         end
 
         def analyse_local_read(node, scope)
-          current = scope.local(node.name)
+          local_truthiness_edges(node.name, scope)
+        end
+
+        # The falsey edge is where an optimistic lookup's miss lands (ADR-101, issue #2306): `Scope#with_local`
+        # drops the issue #286 mark as a write does, so the edge re-takes the one `scope` holds. Without it the
+        # join after `if v; …; end` with no `else` lost the mark on both arms and read `v` as nil-free, although
+        # a miss reaches that join through the implicit else. The truthy edge proves the value non-nil, so it
+        # keeps dropping the mark.
+        def local_truthiness_edges(name, scope)
+          current = scope.local(name)
           return nil if current.nil?
 
+          falsey = scope.with_local(name, narrow_falsey(current))
           [
-            scope.with_local(node.name, narrow_truthy(current)),
-            scope.with_local(node.name, narrow_falsey(current))
+            scope.with_local(name, narrow_truthy(current)),
+            OptimisticOrigin.carry_local_mark(scope, falsey, name, nil)
           ]
         end
 
@@ -987,13 +1134,7 @@ module Rigor
         # holds the just-bound value; the narrowing contract on the surrounding `if` is the
         # same.
         def analyse_local_write(node, scope)
-          current = scope.local(node.name)
-          return nil if current.nil?
-
-          [
-            scope.with_local(node.name, narrow_truthy(current)),
-            scope.with_local(node.name, narrow_falsey(current))
-          ]
+          local_truthiness_edges(node.name, scope)
         end
 
         # Truthy guard on an instance variable. Covers both the bare read — `if @ivar`, the
@@ -1007,9 +1148,11 @@ module Rigor
           current = scope.ivar(node.name)
           return nil if current.nil?
 
+          # The falsey edge keeps the optimistic mark, as {#local_truthiness_edges} explains.
+          falsey = scope.with_ivar(node.name, narrow_falsey(current))
           [
             scope.with_ivar(node.name, narrow_truthy(current)),
-            scope.with_ivar(node.name, narrow_falsey(current))
+            OptimisticOrigin.carry_ivar_mark(scope, falsey, node.name, nil)
           ]
         end
 
@@ -1180,15 +1323,6 @@ module Rigor
           refinements
         end
 
-        # Recognised CallNode predicates:
-        # - `recv.nil?` (Slice 6 phase 1, no args, no block)
-        # - unary `!recv` (`name == :!`, no args, no block)
-        # - `recv.is_a?(C)` / `recv.kind_of?(C)` / `recv.instance_of?(C)` with a single
-        #   static-constant argument and no block (Slice 6 phase 2 sub-phase 1).
-        # - `local == literal` / `literal == local` and the `!=` mirror for trusted static
-        #   literals (Slice 6 phase 2 sub-phase 2).
-        # Anything else returns nil so the surrounding analyser falls through to the
-        # no-narrowing fallback.
         # Issue #1223 — `(x = e).nil?`, `(x ||= e).empty?`, `(@x = e).is_a?(C)`. A write's value is the binding
         # it leaves, and a predicate is narrowed in the scope after its receiver ran, so the call narrows the
         # variable exactly as the same call on a read of it would. Every analyser keys its receiver on a read
@@ -1798,7 +1932,7 @@ module Rigor
 
         def match_dynamic_kind(member, scope)
           facet = member.static_facet
-          return :dynamic if facet.is_a?(Type::Top)
+          return :dynamic if Type::Combinator.untyped?(member)
 
           facet_kinds = match_member_kinds(facet, scope)
           :dynamic if facet_kinds.all? { |kind| (STRING_MATCH_KINDS + [:nil]).include?(kind) }
@@ -1960,7 +2094,7 @@ module Rigor
 
         # Returns the Set of 1-based numbered-capture indices that are UNCONDITIONAL in
         # `source`: present on every successful match because no optional quantifier (`?`,
-        # `*`, `{0,…}`) applies to the group or any ancestor group, and the pattern contains no
+        # `*`, `{0,…}`, `{,…}`) applies to the group or any ancestor group, and the pattern contains no
         # alternation (`|`). Optional and alternation-reachable groups are excluded — at
         # runtime `$N` is `nil` for them even when the overall match succeeds, so narrowing
         # them to non-nil `String` would be unsound. The walker is intentionally light (char
@@ -2044,13 +2178,15 @@ module Rigor
         end
 
         # True when the group whose closing paren is at `source[pos]` is followed by a
-        # quantifier that permits zero repetitions (`?`, `*`, `{0…}`). `+` and `{1,…}` do NOT
-        # make a group optional. A lazy/possessive suffix (`*?`, `*+`) is still zero-permitting
-        # on the base quantifier.
+        # quantifier that permits zero repetitions (`?`, `*`, `{0…}`, `{,…}`). `+` and `{1,…}`
+        # do NOT make a group optional. A lazy/possessive suffix (`*?`, `*+`) is still
+        # zero-permitting on the base quantifier. `{,…}` counts only with a digit after the
+        # comma — `{,}`, `{,x}` and `{, }` are literal braces, not quantifiers.
         def next_quantifier_optional?(source, pos)
           case source[pos]
           when "?", "*" then true
-          when "{" then source[pos + 1] == "0"
+          when "{" then source[pos + 1] == "0" ||
+            (source[pos + 1] == "," && source[pos + 2].to_s.match?(/\d/))
           else false
           end
         end
@@ -2466,10 +2602,10 @@ module Rigor
           narrowed == original ? :relational : :local_binding
         end
 
-        # `recv.is_a?(C)` / `recv.kind_of?(C)` / `recv.instance_of?(C)` narrowing. The receiver
-        # MUST be a `LocalVariableReadNode` (so we have a name to rebind), and the argument
+        # `recv.is_a?(C)` / `recv.kind_of?(C)` / `recv.instance_of?(C)` narrowing. The argument
         # MUST be a single static constant reference (`Foo` or `Foo::Bar`) we can resolve to a
-        # qualified class name. Anything else falls through to "no narrowing".
+        # qualified class name. The receiver is a local, a global, constant or instance variable
+        # ({#receiver_slot}) or a single-hop chain; anything else falls through to "no narrowing".
         def analyse_class_predicate(node, scope, exact:)
           return nil if node.arguments.nil?
           return nil unless node.arguments.arguments.size == 1
@@ -2519,7 +2655,62 @@ module Rigor
           truthy = narrow_class(slot.current, class_name, exact: exact, environment: environment, scope: scope)
           falsey = narrow_not_class(slot.current, class_name, exact: exact, environment: environment, scope: scope)
           truthy_scope = record_bot_guard(narrow_guarded_slot(scope, slot, truthy), slot, truthy, [class_name])
-          [truthy_scope, narrow_guarded_slot(scope, slot, falsey)]
+          static = gradual_union_slot?(slot) ? gradual_static_part(slot.current) : nil
+          static &&= narrow_class(static, class_name, exact: exact, environment: environment, scope: scope)
+          [mark_gradual_narrowing(truthy_scope, slot, truthy, narrowed_static: static),
+           narrow_guarded_slot(scope, slot, falsey)]
+        end
+
+        # Issue #2656 — a class guard's truthy edge over a local that held a `Dynamic` value marks the narrowed binding
+        # ({Scope#with_gradual_narrowing_mark}): the binding keeps the asked class's `Nominal`, which dispatch and the
+        # method rules read, while `call.argument-type-mismatch` judges it as the gradual value it came from, which a
+        # literal-typed parameter (`("r" | "w")`) accepts. Only a local is marked, and only when the edge left it
+        # something other than `Dynamic` or `bot`.
+        def mark_gradual_narrowing(scope, slot, narrowed, marked: false, narrowed_static: nil)
+          return scope unless slot.kind == :local
+
+          mark_gradual_local(scope, slot.name, slot.current, narrowed, marked: marked, narrowed_static: narrowed_static)
+        end
+
+        # {#mark_gradual_narrowing} for the local `name`, which held `current` before the guard and `narrowed` after.
+        # `current` is gradual when it is `Dynamic` or a union with a `Dynamic` member (`h[:m] || "r"`, `c ? h[:m] :
+        # nil`); `marked` says the local already carried the mark, so a `case` or a capture over it keeps it (a
+        # predicate keeps it through {.keep_gradual_marks}).
+        def mark_gradual_local(scope, name, current, narrowed, marked: false, narrowed_static: nil)
+          return scope unless marked || gradual_bearing?(current)
+          return scope if narrowed.nil? || narrowed.is_a?(Type::Dynamic) || narrowed.is_a?(Type::Bot)
+          return scope unless marked || literal_or_empty?(narrowed_static || gradual_static_part(current))
+
+          scope.with_gradual_narrowing_mark(name)
+        end
+        public :mark_gradual_local
+
+        def gradual_bearing?(type)
+          type.is_a?(Type::Dynamic) || (type.is_a?(Type::Union) && type.members.any?(Type::Dynamic))
+        end
+
+        # Issue #2656 — the non-`Dynamic` members of a union `current` (nil for any other type). A union is stamped
+        # only when that part, narrowed by the guard (`narrowed_static`, or the part itself where the caller cannot
+        # narrow it), is literals or nothing: the rule judges a literal member as written, so the mark then withholds
+        # only for what came from the gradual member. A static member that narrows to a class (`d = "a" + s.to_s;
+        # x = h[:m] || d`) would be read past as if it were gradual, so such a union is not stamped.
+        def gradual_static_part(current)
+          return nil unless current.is_a?(Type::Union)
+
+          Type::Combinator.union(*current.members.grep_v(Type::Dynamic))
+        end
+
+        # Whether `slot` is a local holding a union with a `Dynamic` member, the one case {.gradual_static_part}
+        # answers for; checked first so a class guard on any other slot builds nothing.
+        def gradual_union_slot?(slot)
+          slot.kind == :local && slot.current.is_a?(Type::Union) && slot.current.members.any?(Type::Dynamic)
+        end
+
+        def literal_or_empty?(type)
+          return true if type.nil?
+
+          members = type.is_a?(Type::Union) ? type.members : [type]
+          members.all? { |member| member.is_a?(Type::Bot) || member.is_a?(Type::Constant) }
         end
 
         # The class name a `is_a?` / `kind_of?` / `instance_of?` argument denotes: the top-level
@@ -2538,14 +2729,13 @@ module Rigor
           class_predicate_scopes(scope, node.receiver.name, current, class_name, exact: exact)
         end
 
-        # Stable single-hop method-chain narrowing (ROADMAP § Future cycles — "Method-call
-        # receiver narrowing across stable receivers"). When the predicate's receiver is
+        # Stable single-hop method-chain narrowing. When the predicate's receiver is
         # `<local/ivar>.<method>` with no args and no block, record the truthy / falsey
         # narrowing in `Scope#method_chain_narrowings` keyed on the chain address. The
         # dominated body's identical chain reads then observe the narrowed type through
         # `ExpressionTyper#call_type_for`'s lookup.
         #
-        # Heuristic-by-design (ROADMAP § "Soundness gap"): a second call to `x.last` could in
+        # Heuristic-by-design: a second call to `x.last` could in
         # principle return a different value than the first. The chain is dropped on (1)
         # receiver variable rebind (handled inside `Scope#with_local` / `#with_ivar`), and (2)
         # any intervening call against the same root receiver (handled by
@@ -2864,9 +3054,7 @@ module Rigor
         # - For each fact, the corresponding positional argument (matched by parameter name in
         #   the selected overload) MUST be a `Prism::LocalVariableReadNode` for narrowing to
         #   apply.
-        # - When the target is `self`, narrowing applies to the receiver — but the engine does
-        #   not yet narrow `self` itself, so `self`-targeted facts are accepted by the merger
-        #   but currently produce no scope edits.
+        # - When the target is `self`, narrowing applies to the receiver ({#apply_self_fact}).
         def analyse_rbs_extended_contribution(node, scope)
           method_def = resolve_rbs_extended_method(node, scope)
           return nil if method_def.nil?
@@ -3403,8 +3591,8 @@ module Rigor
         # extend record that is structurally incomplete: `Widget.extend(m)` at a call site and an `extend`
         # written in a file outside the analysed set are both invisible to the walk behind
         # {Scope#singleton_extends_of}, and the declaration-side record joined to it below is no more
-        # complete — RBS says nothing about a class it does not declare. A shape that turned this table into a positive
-        # `:subclass` verdict would have to be right about ABSENCE too, and it cannot be. Preserving
+        # complete — RBS says nothing about a class it does not declare. A shape that turned this table
+        # into a positive `:subclass` verdict would have to be right about ABSENCE too, and it cannot be. Preserving
         # `Singleton[C]` would also hand the arm a receiver whose singleton method table has no `clamp` on
         # it, trading the unreachable-clause false positive for an undefined-method one — the same trap
         # #657 recorded on the `Constant` carrier.
@@ -3586,7 +3774,7 @@ module Rigor
           rbs_type.is_a?(RBS::Types::Literal) && rbs_type.literal == value
         end
 
-        # The four receiver shapes with a scope binding the edges can rebind, mirroring
+        # The three receiver shapes with a scope binding the edges can rebind, mirroring
         # `apply_self_fact`. A method chain or arbitrary expression has none, so it reads nil and
         # the caller declines.
         def receiver_binding_type(receiver, scope)
@@ -3696,7 +3884,7 @@ module Rigor
 
         # Walks a call chain down to its `&.` link, collecting the suffix method names applied
         # above it (outermost first). Declines unless the chain bottoms out in a `&.` call on a
-        # direct local / ivar read — those are the two bindings a scope can rewrite — and unless
+        # direct local, instance-variable, global or constant read — the slots a scope can rewrite — and unless
         # every suffix is a bare reader or predicate, since an argument or a block could make the
         # answer depend on something other than the receiver.
         #

data/lib/rigor/inference/operand_effects.rb

@@ -31,6 +31,12 @@ module Rigor
     # pure-value operand never reached, so a chained `b.push(2).size`, an argument `puts(b.push(2))` or
     # `d.map!.with_index { … }` left `b` / `d` on the literal their assignment wrote.
     #
+    # Issue #3163 — a `def` inside a block or lambda of the expression is looked into for one thing: an in-place
+    # mutation of an instance variable, class variable or global ({.method_mutation?}). The block may call the
+    # method it defines, and the evaluator floors such a variable after the block
+    # (`StatementEvaluator#floor_block_defined_method_mutations`), which it reaches only for an operand this module
+    # answers for: `puts([1].each { def h; $buf << 1; end; h })`.
+    #
     # Short-circuiting and allocation-free outside a mutator-named call: the evaluator asks it of every call's
     # operands, and asks it again of each operand it threads. A found effect stops the recursion without a
     # `return` out of the child block, which would allocate once per frame it unwinds and make a deep literal
@@ -58,12 +64,15 @@ module Rigor
       ].freeze
       JUMP_NODES = Set[Prism::NextNode, Prism::BreakNode].freeze
       SCOPE_NODES = Set[Prism::BlockNode, Prism::LambdaNode].freeze
+      NON_LOCAL_READ_NODES = Set[
+        Prism::InstanceVariableReadNode, Prism::ClassVariableReadNode, Prism::GlobalVariableReadNode
+      ].freeze
       OPAQUE_NODES = Set[
         Prism::DefNode, Prism::ClassNode, Prism::ModuleNode, Prism::SingletonClassNode, Prism::DefinedNode
       ].freeze
       private_constant :LOCAL_WRITE_NODES, :OUTLIVING_WRITE_NODES, :INSTANCE_WRITE_NODES, :GLOBAL_WRITE_NODES,
                        :COMPOUND_LOCAL_WRITES,
-                       :COMPOUND_INSTANCE_WRITES, :JUMP_NODES, :SCOPE_NODES, :OPAQUE_NODES
+                       :COMPOUND_INSTANCE_WRITES, :JUMP_NODES, :SCOPE_NODES, :NON_LOCAL_READ_NODES, :OPAQUE_NODES
 
       module_function
 
@@ -79,7 +88,7 @@ module Rigor
         return true if OUTLIVING_WRITE_NODES.include?(klass)
         return true if jumps && JUMP_NODES.include?(klass)
         return true if klass == Prism::CallNode && outliving_mutation?(node, nesting)
-        return false if OPAQUE_NODES.include?(klass)
+        return block_defined_method_mutation?(node, nesting) if OPAQUE_NODES.include?(klass)
 
         nesting += 1 if SCOPE_NODES.include?(klass)
         jumps &&= !JumpTargets.boundary?(node)
@@ -89,6 +98,38 @@ module Rigor
       end
       private_class_method :effect?
 
+      # Issue #3163 — the one effect an opaque node has: a `def` under a block or lambda whose body mutates a
+      # non-local in place ({.method_mutation?}).
+      def block_defined_method_mutation?(node, nesting)
+        node.instance_of?(Prism::DefNode) && nesting.positive? && method_mutation?(node)
+      end
+      private_class_method :block_defined_method_mutation?
+
+      # True when `node`, a `def` or anything in its body, holds a call or index write
+      # that mutates an instance variable, class variable or global in place: a {MutationWidening::SHAPE_MUTATORS}
+      # name, or an index `||=` / `&&=` / `op=`, on a read of one. A class or module body inside the method is not
+      # looked into; a `def` nested in it is.
+      def method_mutation?(node)
+        klass = node.class
+        if klass == Prism::CallNode
+          return true if MutationWidening::SHAPE_MUTATORS.include?(node.name) && non_local_read?(node.receiver)
+        elsif OUTLIVING_WRITE_NODES.include?(klass)
+          return true if node.respond_to?(:receiver) && non_local_read?(node.receiver)
+        elsif klass != Prism::DefNode && OPAQUE_NODES.include?(klass)
+          return false
+        end
+
+        found = false
+        node.rigor_each_child { |child| found ||= method_mutation?(child) }
+        found
+      end
+      private_class_method :method_mutation?
+
+      def non_local_read?(node)
+        NON_LOCAL_READ_NODES.include?(node.class)
+      end
+      private_class_method :non_local_read?
+
       # True when `node` is a call the straight-line widening would answer for a variable that outlives the
       # expression: a {MutationWidening::SHAPE_MUTATORS} name on a receiver whose {ReceiverAlias.mutated_reads},
       # or the local an element read is rooted at ({ElementReadWidening.element_read_path}, `a[0] << e`), reach