Limit type alias and interface expansion depth

Recursive type aliases are valid RBS when guarded by a type constructor
(e.g. `type json = Integer | Array[json]`); only unguarded recursion is
rejected, and only by `rbs validate` which does not run on environment
load. Eager alias expansion caused SystemStackError on recursive aliases,
and nested alias chains can expand exponentially even without recursion,
so a visited set is not enough; limit expansion nesting instead, falling
back to Object at the cutoff.

The nesting count is threaded as an argument: from_rbs_type only recurses
into itself, so each function carries its own counter and resetting at
the method_return_type boundary is safe. The limit also applies to the
interface case of _match_free_variable, which could recurse infinitely on
cyclic generic interfaces regardless of aliases.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Author: tompng

lib/repl_type_completor/types.rb

@@ -8,6 +8,7 @@
 module ReplTypeCompletor
   module Types
     OBJECT_TO_TYPE_SAMPLE_SIZE = 50
+    EXPANSION_NESTING_LIMIT = 3
 
     singleton_class.attr_reader :rbs_builder, :rbs_load_error
 
@@ -475,7 +476,15 @@ def self.array_of(*types)
       InstanceType.new(Array, [type])
     end
 
-    def self.from_rbs_type(return_type, self_type, extra_vars = {})
+    # Alias may validly recurse through type args (`type json = Integer | Array[json]`)
+    # and can expand exponentially (`type b = a | [a]` chains), so expansion is depth limited.
+    def self.expand_alias_type(rbs_type, nesting)
+      return if nesting >= EXPANSION_NESTING_LIMIT
+
+      rbs_builder.expand_alias2 rbs_type.name, rbs_type.args rescue nil
+    end
+
+    def self.from_rbs_type(return_type, self_type, extra_vars = {}, nesting = 0)
       case return_type
       when RBS::Types::Bases::Self
         self_type
@@ -508,11 +517,11 @@ def self.from_rbs_type(return_type, self_type, extra_vars = {})
         end
       when RBS::Types::Union, RBS::Types::Intersection
         # Intersection is unsupported. fallback to union type
-        UnionType[*return_type.types.map { from_rbs_type _1, self_type, extra_vars }]
+        UnionType[*return_type.types.map { from_rbs_type _1, self_type, extra_vars, nesting }]
       when RBS::Types::Proc
         PROC
       when RBS::Types::Tuple
-        elem = UnionType[*return_type.types.map { from_rbs_type _1, self_type, extra_vars }]
+        elem = UnionType[*return_type.types.map { from_rbs_type _1, self_type, extra_vars, nesting }]
         InstanceType.new(Array, [elem])
       when RBS::Types::Record
         InstanceType.new(Hash, [SYMBOL, OBJECT])
@@ -532,17 +541,17 @@ def self.from_rbs_type(return_type, self_type, extra_vars = {})
           OBJECT
         end
       when RBS::Types::Optional
-        UnionType[from_rbs_type(return_type.type, self_type, extra_vars), NIL]
+        UnionType[from_rbs_type(return_type.type, self_type, extra_vars, nesting), NIL]
       when RBS::Types::Alias
-        expanded = (rbs_builder.expand_alias2 return_type.name, return_type.args rescue nil)
-        expanded ? from_rbs_type(expanded, self_type, extra_vars) : OBJECT
+        expanded = expand_alias_type(return_type, nesting)
+        expanded ? from_rbs_type(expanded, self_type, extra_vars, nesting + 1) : OBJECT
       when RBS::Types::Interface
-        args = return_type.args.map { from_rbs_type _1, self_type, extra_vars }
+        args = return_type.args.map { from_rbs_type _1, self_type, extra_vars, nesting }
         InterfaceType.new return_type.name, args
       when RBS::Types::ClassInstance
         klass = return_type.name.to_namespace.path.reduce(Object) { _1.const_get _2 }
         if return_type.args
-          params = return_type.args.map { from_rbs_type _1, self_type, extra_vars }
+          params = return_type.args.map { from_rbs_type _1, self_type, extra_vars, nesting }
         end
         InstanceType.new(klass, params || [])
       else
@@ -562,24 +571,24 @@ def self.match_free_variables(vars, types, values)
       accumulator.transform_values { UnionType[*_1] }
     end
 
-    def self._match_free_variable(vars, rbs_type, value, accumulator)
+    def self._match_free_variable(vars, rbs_type, value, accumulator, nesting = 0)
       case [rbs_type, value]
       in [RBS::Types::Variable,]
         (accumulator[rbs_type.name] ||= []) << value if vars.include? rbs_type.name
       in [RBS::Types::ClassInstance, InstanceType]
         names = rbs_builder.build_singleton(rbs_type.name).type_params
         names.zip(rbs_type.args).each do |name, arg|
           v = value.named_params[name]
-          _match_free_variable vars, arg, v, accumulator if v
+          _match_free_variable vars, arg, v, accumulator, nesting if v
         end
       in [RBS::Types::Tuple, InstanceType] if value.klass == Array
         v = value.params[0]
         rbs_type.types.each do |t|
-          _match_free_variable vars, t, v, accumulator
+          _match_free_variable vars, t, v, accumulator, nesting
         end
       in [RBS::Types::Record, InstanceType] if value.klass == Hash
         # TODO
-      in [RBS::Types::Interface,]
+      in [RBS::Types::Interface,] if nesting < EXPANSION_NESTING_LIMIT
         definition = rbs_builder.build_interface rbs_type.name
         convert = {}
         definition.type_params.zip(rbs_type.args).each do |from, arg|
@@ -591,7 +600,7 @@ def self._match_free_variable(vars, rbs_type, value, accumulator)
           return_type = method_return_type value, method_name
           method.defs.each do |method_def|
             interface_return_type = method_def.type.type.return_type
-            _match_free_variable convert, interface_return_type, return_type, ac
+            _match_free_variable convert, interface_return_type, return_type, ac, nesting + 1
           end
         end
         convert.each do |from, to|
@@ -600,11 +609,11 @@ def self._match_free_variable(vars, rbs_type, value, accumulator)
         end
       in [RBS::Types::Union,]
         rbs_type.types.each do |t|
-          _match_free_variable vars, t, value, accumulator
+          _match_free_variable vars, t, value, accumulator, nesting
         end
       in [RBS::Types::Alias,]
-        expanded = rbs_builder.expand_alias2 rbs_type.name, rbs_type.args rescue nil
-        _match_free_variable vars, expanded, value, accumulator if expanded
+        expanded = expand_alias_type(rbs_type, nesting)
+        _match_free_variable vars, expanded, value, accumulator, nesting + 1 if expanded
       else
       end
     end

test/repl_type_completor/test_types.rb

@@ -1,6 +1,7 @@
 # frozen_string_literal: true
 
 require 'repl_type_completor'
+require 'tmpdir'
 require_relative './helper'
 
 module TestReplTypeCompletor
@@ -120,6 +121,78 @@ def test_alias_type_expansion
       assert_equal 'Integer | _ToInt', int_type.inspect
     end
 
+    def with_isolated_rbs_env(rbs_source)
+      Dir.mktmpdir do |dir|
+        File.write File.join(dir, 'test.rbs'), rbs_source
+        loader = RBS::EnvironmentLoader.new core_root: nil
+        loader.add path: Pathname(dir)
+        env = RBS::Environment.from_loader(loader)
+        builder = RBS::DefinitionBuilder.new env: env.resolve_type_names
+        original_builder = ReplTypeCompletor::Types.rbs_builder
+        begin
+          ReplTypeCompletor::Types.instance_variable_set :@rbs_builder, builder
+          yield
+        ensure
+          ReplTypeCompletor::Types.instance_variable_set :@rbs_builder, original_builder
+        end
+      end
+    end
+
+    def test_recursive_alias_type_expansion
+      rbs_source = <<~RBS
+        type json = Integer | Array[json] | Hash[String, json]
+        type unguarded = unguarded | Integer
+        type opt = [opt]? | Integer
+        type a = Integer | [a]
+        type b = a | [a]
+        type c = b | [b]
+        type d = c | [c]
+        type e = d | [d]
+        interface _Generic[T]
+          def get: () -> T
+        end
+        type generic_rec = _Generic[generic_rec] | Integer
+      RBS
+      with_isolated_rbs_env rbs_source do
+        json_type = type_from_rbs('::json')
+        assert_equal [Array, Hash, Integer], json_type.types.map(&:klass).sort_by(&:name)
+        json_elem = json_type.types.find { _1.klass == Array }.params[0]
+        assert_include json_elem.types.map(&:klass), Integer
+
+        # Invalid in RBS (RecursiveTypeAliasError by `rbs validate`) but loadable
+        assert_include type_from_rbs('::unguarded').types.map(&:klass), Integer
+
+        # Recursion through optional and interface type args
+        assert_include type_from_rbs('::opt').types.map(&:klass), Integer
+        generic_rec_type = type_from_rbs('::generic_rec')
+        assert_include generic_rec_type.types.grep(ReplTypeCompletor::Types::InstanceType).map(&:klass), Integer
+
+        # Exponentially expanding alias chain
+        assert_include type_from_rbs('::e').types.map(&:klass), Array
+      end
+    end
+
+    def test_cyclic_generic_interface_match
+      rbs_source = <<~RBS
+        interface _CycA[T]
+          def a: () -> _CycB[T]
+        end
+        interface _CycB[T]
+          def b: () -> _CycA[T]
+        end
+      RBS
+      with_isolated_rbs_env rbs_source do
+        var = RBS::Types::Variable.new(name: :X, location: nil)
+        cyclic = RBS::Types::Interface.new(
+          name: ReplTypeCompletor::Types.rbs_absolute_type_name('_CycA'),
+          args: [var],
+          location: nil
+        )
+        matched = ReplTypeCompletor::Types.match_free_variables([:X], [cyclic], [ReplTypeCompletor::Types::INTEGER])
+        assert_kind_of Hash, matched
+      end
+    end
+
     def test_basic_object_methods
       bo = BasicObject.new
       def bo.foobar; end