Remove type parameter introduced by 'expression dependent' during exposure

Summary:
Typing escape implements exposure - inside a lambda, any type parameter which is introduced should not be able to escape it's scope. Type parameters appearing only co- orcontravariantly can be replaced with their lower / upper bounds and errors are raised for those which appear invariantly. However, the code deliberately avoids dealing with 'bogus' type parameters which are introduced as part of the implementation of type constant access.

This gap has an unfortunate interaction with the more performant version of the common 'fluent builder' pattern:

```
interface IRepBuilderMethods<+TChainableBuilder as IRepBuilder> {
  public function setField<TValue>(
    HH\EnumClass\Label<RepAccessors, IRepField<
      RepFieldSettings with { type TValue super TValue },
    >> $label,
    TValue $value,
  ): TChainableBuilder;
}

interface IRepBuilder extends IRepBuilderMethods<this::TChainableBuilder> {
  abstract const type TChainableBuilder as
    IRepBuilder with { type TChainableBuilder = this::TChainableBuilder };
}
```

Suppose we have a series of lambda each of which take a parameter of type `IRepBuilder` and call `setField`.

On exit from the lambda we still have the 'expression dependent' type parameter (`<expr#N>::...`) and the 'bogus' type parameter (`IRepBuilder::TChainableBuilder`) builder in the global `tpenv`:

```
  <expr#1>::TCB    upper: {\IRB::TCB}
  \IRB::TCB        lower: {<expr#1>::TCB}
                   upper: {IRB with { type TCB = <expr#1>::TCB }
```

In the next lambda, we get a fresh 'expression dependent' type parameter which will also appear in the bounds of the 'bogus' type paramter `IRepBuilder::TChainableBuilder':

```
 \IRB::TCB         lower: {<expr#1>::TCB, <expr#2>::TCB}
                   upper: {IRB with { type TCB = <expr#1>::TCB },
                           IRB with { type TCB = <expr#2>::TCB }}
```

Now, for each method call on an receiver expression with type `<expr#2>::TCB`, or *any* subsequent expression dependent type which shares it's upperbound, we are actually resolving the method on the intersection of the upper bounds so we have linear growth in the number of lambda. This is worsened when we have multiple method calls since each is paying the cost of access a method through an intersection. Altogether we end up with a cubic cost.

This didn't happen for the non-recursive case since each call to `setField` gives us back a fresh type (the ever expanding access path).

This diff addresses the issue by removing type parameters introduced for expression dependent types inside lambdas during the exposure step and also removing them from the bounds of the 'bogus' type parameters.

Reviewed By: andrewjkennedy

Differential Revision: D95847716

fbshipit-source-id: 2974c2ccb795e6af162a8df0c04a3456da6440a7

Author: Michael Thomas

hphp/hack/src/typing/typing_defs.ml

@@ -514,6 +514,8 @@ module DependentKind = struct
       Some (Str.matched_group 1 str)
     with
     | _ -> None
+
+  let is_expr_dep_ty str = Option.is_some (strip_generic_dep_ty str)
 end
 
 let rec is_denotable ty =

hphp/hack/src/typing/typing_defs.mli

@@ -329,6 +329,8 @@ module DependentKind : sig
   val is_generic_dep_ty : string -> bool
 
   val strip_generic_dep_ty : string -> string option
+
+  val is_expr_dep_ty : string -> bool
 end
 
 module ShapeFieldMap : sig

hphp/hack/src/typing/typing_escape.ml

@@ -601,7 +601,108 @@ let refresh_env_and_type ~remove:(types, remove) ~pos env ty =
     in
     let renv = { renv with on_error } in
     let (renv, ty, _) = refresh_type renv Ast_defs.Covariant ty in
-    (refresh_tvars Tvid.Set.empty renv, ty)
+    let env = refresh_tvars Tvid.Set.empty renv in
+
+    (* Remove escaping expression-dependent types from the global tpenv.
+       Without this cleanup, expression-dependent types introduced inside
+       one lambda leak into subsequent lambdas via the global tpenv.
+       typing_taccess expands type constants on a Tgeneric by iterating
+       over all its upper bounds and intersecting the results. With the
+       recursive `with` refinement pattern (e.g.,
+         abstract const type TCB as IRepBuilder
+           with { type TCB = this::TCB };
+       ), each lambda adds a distinct `with` upper bound to the mangled
+       generic, so typing_taccess produces a growing intersection,
+       causing exponential blowup.
+
+       After the refresh steps above have replaced escaping types in
+       locals, the return type, and unsolved tyvar bounds, we:
+       1. Build a substitution mapping each deleted expr-dep generic
+          to its upper bound (read before deletion)
+       2. Delete the expr-dep entries from the tpenv
+       3. Apply the substitution to remaining tpenv entries' bounds
+          (cleaning stale `with` refinements that reference deleted types)
+       4. Apply the substitution to solved tyvar solutions (which the
+          refresh steps expanded inline but did not write back) *)
+    let pre_deletion_tpenv = Env.get_global_tpenv env in
+
+    (* Build substitution map: deleted name -> upper bound *)
+    let subst =
+      List.fold_left types ~init:SMap.empty ~f:(fun acc name ->
+          if Typing_defs.DependentKind.is_expr_dep_ty name then
+            match
+              TySet.elements
+                (Type_parameter_env.get_upper_bounds pre_deletion_tpenv name)
+            with
+            | [ub] -> SMap.add name ub acc
+            | _ -> acc
+          else
+            acc)
+    in
+    let subst_ty ty =
+      Typing_defs_core.Locl_subst.apply
+        ty
+        ~subst
+        ~combine_reasons:(fun ~src ~dest:_ -> src)
+    in
+
+    (* Delete expr-dep entries from the tpenv *)
+    let global_tpenv =
+      List.fold_left types ~init:pre_deletion_tpenv ~f:(fun tpenv name ->
+          if
+            Typing_defs.DependentKind.is_expr_dep_ty name
+            && Type_parameter_env.mem name tpenv
+          then
+            Type_parameter_env.remove tpenv name
+          else
+            tpenv)
+    in
+
+    (* Substitute in remaining entries bounds *)
+    let global_tpenv =
+      if SMap.is_empty subst then
+        global_tpenv
+      else
+        List.fold_left
+          (Type_parameter_env.get_tparam_names global_tpenv)
+          ~init:global_tpenv
+          ~f:(fun tpenv name ->
+            match Type_parameter_env.get_with_pos name tpenv with
+            | None -> tpenv
+            | Some (def_pos, tparam_info) ->
+              let ubs = TySet.map subst_ty tparam_info.upper_bounds in
+              let lbs = TySet.map subst_ty tparam_info.lower_bounds in
+              if
+                TySet.equal ubs tparam_info.upper_bounds
+                && TySet.equal lbs tparam_info.lower_bounds
+              then
+                tpenv
+              else
+                Type_parameter_env.add
+                  ~def_pos
+                  name
+                  { tparam_info with upper_bounds = ubs; lower_bounds = lbs }
+                  tpenv)
+    in
+    let env = Env.env_with_global_tpenv env global_tpenv in
+
+    (* Substitute in solved tyvar solutions *)
+    let env =
+      if SMap.is_empty subst then
+        env
+      else
+        List.fold_left (Env.get_all_tyvars env) ~init:env ~f:(fun env tv ->
+            if Env.tyvar_is_solved env tv then
+              let (env, solution) = Env.get_type env Typing_reason.none tv in
+              let solution' = subst_ty solution in
+              if phys_equal solution solution' then
+                env
+              else
+                Env.add env tv solution'
+            else
+              env)
+    in
+    (env, ty)
   )
 
 (********************************************************************)

hphp/hack/test/typecheck/tpenv_leak_across_lambdas.php

@@ -0,0 +1,71 @@
+<?hh
+
+abstract class RepFieldSettings {
+  abstract const type TValue;
+}
+
+interface IRepField<+TSettings as RepFieldSettings> {}
+
+class RepIntSettings extends RepFieldSettings {
+  const type TValue = int;
+}
+
+class RepIntField implements IRepField<RepIntSettings> {}
+
+enum class RepAccessors: IRepField<RepFieldSettings> {
+  RepIntField A = new RepIntField();
+  RepIntField B = new RepIntField();
+  RepIntField C = new RepIntField();
+  RepIntField D = new RepIntField();
+  RepIntField E = new RepIntField();
+}
+
+interface IRepBuilderMethods<+TChainableBuilder as IRepBuilder> {
+  public function setField<TValue>(
+    HH\EnumClass\Label<RepAccessors, IRepField<
+      RepFieldSettings with { type TValue super TValue },
+    >> $label,
+    TValue $value,
+  ): TChainableBuilder;
+}
+
+interface IRepBuilder extends IRepBuilderMethods<this::TChainableBuilder> {
+  abstract const type TChainableBuilder as
+    IRepBuilder with { type TChainableBuilder = this::TChainableBuilder };
+}
+
+function tpenv_leak_repro(): dict<string, (function(IRepBuilder): void)> {
+  $x = dict[
+    'a' => (IRepBuilder $b) ==> {
+      $b->setField(#A, 1)->setField(#B, 2)->setField(#C, 3)->setField(#D, 4)->setField(#E, 5);
+    },
+    'b' => (IRepBuilder $b) ==> {
+      $b->setField(#A, 1)->setField(#B, 2)->setField(#C, 3)->setField(#D, 4)->setField(#E, 5);
+    },
+    'c' => (IRepBuilder $b) ==> {
+      $b->setField(#A, 1)->setField(#B, 2)->setField(#C, 3)->setField(#D, 4)->setField(#E, 5);
+    },
+    'd' => (IRepBuilder $b) ==> {
+      $b->setField(#A, 1)->setField(#B, 2)->setField(#C, 3)->setField(#D, 4)->setField(#E, 5);
+    },
+    'e' => (IRepBuilder $b) ==> {
+      $b->setField(#A, 1)->setField(#B, 2)->setField(#C, 3)->setField(#D, 4)->setField(#E, 5);
+    },
+    'f' => (IRepBuilder $b) ==> {
+      $b->setField(#A, 1)->setField(#B, 2)->setField(#C, 3)->setField(#D, 4)->setField(#E, 5);
+    },
+    'g' => (IRepBuilder $b) ==> {
+      $b->setField(#A, 1)->setField(#B, 2)->setField(#C, 3)->setField(#D, 4)->setField(#E, 5);
+    },
+    'h' => (IRepBuilder $b) ==> {
+      $b->setField(#A, 1)->setField(#B, 2)->setField(#C, 3)->setField(#D, 4)->setField(#E, 5);
+    },
+    'i' => (IRepBuilder $b) ==> {
+      $b->setField(#A, 1)->setField(#B, 2)->setField(#C, 3)->setField(#D, 4)->setField(#E, 5);
+    },
+    'j' => (IRepBuilder $b) ==> {
+      $b->setField(#A, 1)->setField(#B, 2)->setField(#C, 3)->setField(#D, 4)->setField(#E, 5);
+    },
+  ];
+  return $x;
+}

hphp/hack/test/typecheck/tpenv_leak_across_lambdas.php.exp

@@ -0,0 +1 @@
+No errors