Stop the lexer reading past the end of a byte_range

`rbs_next_char` ends the input when `byte_pos == end_pos`. `rbs_skip`
advances by a whole character, so a multibyte character starting before
`end_pos` and ending after it steps over the boundary and equality never
holds again — the lexer then reads to the end of the string.

The realistic way to land inside a character is to pass a character
offset where a byte offset is expected, the mistake #2945 fixed in
`parse_inline_*_annotation`. `"日本語"` is 5 characters but 11 bytes, so
offset 5 falls inside `本`:

    Parser.parse_type('"日本語" | Integer', byte_range: 0...5)
    #=> Types::Union spanning the whole input, rather than an error

`require_eof: true` does not catch it, because the lexer really is at
EOF by then. It needs a character to straddle the boundary, so
ASCII-only input never hits it.

Compare with `>=` so stepping over the boundary still ends the input.

Author: ksss

src/lexstate.c

@@ -120,7 +120,9 @@ unsigned int rbs_peek(rbs_lexer_t *lexer) {
 }
 
 bool rbs_next_char(rbs_lexer_t *lexer, unsigned int *codepoint, size_t *byte_len) {
-    if (RBS_UNLIKELY(lexer->current.byte_pos == lexer->end_pos)) {
+    // `>=`, not `==`: a character straddling `end_pos` moves `byte_pos` past it
+    // in one step, and equality would never hold again.
+    if (RBS_UNLIKELY(lexer->current.byte_pos >= lexer->end_pos)) {
         return false;
     }
 
@@ -133,7 +135,8 @@ bool rbs_next_char(rbs_lexer_t *lexer, unsigned int *codepoint, size_t *byte_len
         return true;
     }
 
-    *byte_len = lexer->encoding->char_width((const uint8_t *) start, (ptrdiff_t) (lexer->string.end - start));
+    ptrdiff_t remaining = (ptrdiff_t) (lexer->string.end - start);
+    *byte_len = lexer->encoding->char_width((const uint8_t *) start, remaining);
 
     if (*byte_len == 0) {
         // Invalid byte under the active encoding. Map it to a sentinel code

test/rbs/type_parsing_test.rb

@@ -1074,4 +1074,27 @@ def test_parse__byte_range_incorrect_in_euc_jp
     assert_equal RBS::TypeName.parse("Foo"),
                  Parser.parse_type(euc, byte_range: 2...).name
   end
+
+  def test_parse__byte_range_ending_mid_character
+    source = '"日本語" | Integer'
+
+    # `"日本語"` is 5 characters but 11 bytes, so a caller that passes a
+    # character offset where a byte offset is expected — the mistake fixed in
+    # #2945 — lands inside `本`, which spans bytes 4...7. The lexer used to
+    # step over the boundary and read the whole string instead.
+    assert_raises RBS::ParsingError do
+      Parser.parse_type(source, byte_range: 0...'"日本語"'.size)
+    end
+
+    # The byte offset the caller meant parses just that literal.
+    Parser.parse_type(source, byte_range: 0...'"日本語"'.bytesize, require_eof: true).tap do |type|
+      assert_instance_of Types::Literal, type
+      assert_equal "日本語", type.literal
+    end
+
+    # `end_pos` past the end of the buffer stays in bounds.
+    Parser.parse_type("Integer", byte_range: 0...9999).tap do |type|
+      assert_instance_of Types::ClassInstance, type
+    end
+  end
 end