Fix template literal type exponential blowup in addSpans

[Copilot]

Recursive template literal types like `${S}_${S}` can double string length each iteration, exhausting memory before the instantiation depth limit (100) or tail recursion limit (1000) is reached.

Repro from microsoft/TypeScript#63271:

type Dec<N extends number> = 
    N extends 5 ? 4 : N extends 4 ? 3 : N extends 3 ? 2 : 
    N extends 2 ? any : 
    N extends 1 ? 0 : 0;

type Recur<N extends number, S extends string> = 
    N extends 0 ? S : Recur<Dec<N>, `${S}_${S}`>;

type Explode = {
    [P in Recur<5, "a"> as `${P}_key`]: any;
};

Two growth vectors exist in addSpans:

• Concrete strings double via string builder concatenation of resolved literals
• Generic placeholders double when flattening nested template literal types containing string placeholders

Added two guards in the addSpans loop in getTemplateLiteralType:

• sb.Len() > 100_000 — bounds concrete string growth
• len(newTypes) > 1_000 — bounds placeholder count growth

Either triggers addSpans returning false, which falls back to stringType. The existing tail recursion limit then produces the expected TS2589 error.

[Copilot]

Pull request overview

Adds guardrails to prevent exponential memory blowups when instantiating recursive template literal types, and introduces a regression test reproducing the TypeScript issue.

Changes:

• Add limits in getTemplateLiteralType/addSpans to cap concrete string growth and placeholder/type expansion.
• Add a compiler test case reproducing exponential blowup in recursive template literal types.
• Add baseline .types, .symbols, and .errors.txt outputs for the new test.

Reviewed changes

Copilot reviewed 5 out of 5 changed files in this pull request and generated no comments.

Show a summary per file

File	Description
internal/checker/checker.go	Adds early-exit guards in addSpans to prevent unbounded growth and fall back to stringType.
testdata/tests/cases/compiler/templateLiteralExponentialBlowup.ts	New regression test reproducing recursive template literal exponential growth.
testdata/baselines/reference/compiler/templateLiteralExponentialBlowup.types	Baseline for type output of the new regression test.
testdata/baselines/reference/compiler/templateLiteralExponentialBlowup.symbols	Baseline for symbol output of the new regression test.
testdata/baselines/reference/compiler/templateLiteralExponentialBlowup.errors.txt	Baseline confirming expected TS2589 error for the new regression test.

Comments suppressed due to low confidence (2)

internal/checker/checker.go:1

• The guard is checked only once per loop iteration, before any sb.WriteString(...) or newTypes appends happen. A single iteration can still append a very large literal chunk or expand newTypes by many entries (e.g., when flattening nested template literal types), potentially blowing past the intended bounds before the next iteration checks the limits. Consider enforcing the limits at the exact growth sites: (1) before/after each sb.WriteString (preferably pre-checking sb.Len()+len(toAdd)), and (2) after each append/extend to newTypes (or via a small helper like appendNewType(...) bool that checks the cap immediately).
  internal/checker/checker.go:1
• The newly introduced numeric limits are magic numbers. To make the behavior easier to tune and to document the rationale, define named constants (ideally near other instantiation/recursion limits) such as maxTemplateLiteralConcreteLength and maxTemplateLiteralPlaceholderCount, and add a short comment explaining why these specific thresholds were chosen and how they relate to existing depth/tail-recursion limits.