Properly meter the creation of entitlement static types

runtime/convertTypes.go

@@ -570,7 +570,12 @@ func importAuthorization(memoryGauge common.MemoryGauge, auth cadence.Authorizat
 	case cadence.EntitlementMapAuthorization:
 		return interpreter.NewEntitlementMapAuthorization(memoryGauge, auth.TypeID)
 	case cadence.EntitlementSetAuthorization:
-		return interpreter.NewEntitlementSetAuthorization(memoryGauge, auth.Entitlements, sema.EntitlementSetKind(auth.Kind))
+		return interpreter.NewEntitlementSetAuthorization(
+			memoryGauge,
+			func() []common.TypeID { return auth.Entitlements },
+			len(auth.Entitlements),
+			sema.EntitlementSetKind(auth.Kind),
+		)
 	}
 	panic(fmt.Sprintf("cannot import authorization of type %T", auth))
 }

runtime/convertValues_test.go

@@ -1211,7 +1211,12 @@ func TestImportRuntimeType(t *testing.T) {
 				Type: cadence.IntType{},
 			},
 			expected: interpreter.ReferenceStaticType{
-				Authorization:  interpreter.NewEntitlementSetAuthorization(nil, []common.TypeID{"E", "F"}, sema.Conjunction),
+				Authorization: interpreter.NewEntitlementSetAuthorization(
+					nil,
+					func() []common.TypeID { return []common.TypeID{"E", "F"} },
+					2,
+					sema.Conjunction,
+				),
 				ReferencedType: interpreter.PrimitiveStaticTypeInt,
 			},
 		},
@@ -1226,7 +1231,11 @@ func TestImportRuntimeType(t *testing.T) {
 				Type: cadence.IntType{},
 			},
 			expected: interpreter.ReferenceStaticType{
-				Authorization:  interpreter.NewEntitlementSetAuthorization(nil, []common.TypeID{"E", "F"}, sema.Disjunction),
+				Authorization: interpreter.NewEntitlementSetAuthorization(
+					nil,
+					func() []common.TypeID { return []common.TypeID{"E", "F"} },
+					2,
+					sema.Disjunction),
 				ReferencedType: interpreter.PrimitiveStaticTypeInt,
 			},
 		},

runtime/interpreter/decode.go

@@ -1546,18 +1546,34 @@ func (d TypeDecoder) decodeStaticAuthorization() (Authorization, error) {
 			}
 			return nil, err
 		}
-		var entitlements []common.TypeID
-		if entitlementsSize > 0 {
-			entitlements = make([]common.TypeID, entitlementsSize)
-			for i := 0; i < int(entitlementsSize); i++ {
-				typeID, err := d.decoder.DecodeString()
-				if err != nil {
-					return nil, err
+
+		var setCreationErr error
+
+		entitlementSet := NewEntitlementSetAuthorization(
+			d.memoryGauge,
+			func() (entitlements []common.TypeID) {
+				if entitlementsSize > 0 {
+					entitlements = make([]common.TypeID, entitlementsSize)
+					for i := 0; i < int(entitlementsSize); i++ {
+						typeID, err := d.decoder.DecodeString()
+						if err != nil {
+							setCreationErr = err
+							return nil
+						}
+						entitlements[i] = common.TypeID(typeID)
+					}
 				}
-				entitlements[i] = common.TypeID(typeID)
-			}
+				return
+			},
+			int(entitlementsSize),
+			sema.EntitlementSetKind(setKind),
+		)
+
+		if setCreationErr != nil {
+			return nil, setCreationErr
 		}
-		return NewEntitlementSetAuthorization(d.memoryGauge, entitlements, sema.EntitlementSetKind(setKind)), nil
+
+		return entitlementSet, nil
 	}
 	return nil, errors.NewUnexpectedError("invalid static authorization encoding tag: %d", number)
 }

runtime/interpreter/interpreter.go

@@ -3481,34 +3481,41 @@ func referenceTypeFunction(invocation Invocation) Value {
 	}
 
 	var authorization Authorization = UnauthorizedAccess
-	var entitlements []common.TypeID = make([]common.TypeID, 0, entitlementValues.Count())
 	errInIteration := false
+	entitlementsCount := entitlementValues.Count()
 
-	entitlementValues.Iterate(invocation.Interpreter, func(element Value) (resume bool) {
-		entitlementString, isString := element.(*StringValue)
-		if !isString {
-			errInIteration = true
-			return false
-		}
+	if entitlementsCount > 0 {
+		authorization = NewEntitlementSetAuthorization(
+			invocation.Interpreter,
+			func() []common.TypeID {
+				entitlements := make([]common.TypeID, 0, entitlementsCount)
+				entitlementValues.Iterate(invocation.Interpreter, func(element Value) (resume bool) {
+					entitlementString, isString := element.(*StringValue)
+					if !isString {
+						errInIteration = true
+						return false
+					}
 
-		_, err := lookupEntitlement(invocation.Interpreter, entitlementString.Str)
-		if err != nil {
-			errInIteration = true
-			return false
-		}
-		entitlements = append(entitlements, common.TypeID(entitlementString.Str))
+					_, err := lookupEntitlement(invocation.Interpreter, entitlementString.Str)
+					if err != nil {
+						errInIteration = true
+						return false
+					}
+					entitlements = append(entitlements, common.TypeID(entitlementString.Str))
 
-		return true
-	})
+					return true
+				})
+				return entitlements
+			},
+			entitlementsCount,
+			sema.Conjunction,
+		)
+	}
 
 	if errInIteration {
 		return Nil
 	}
 
-	if len(entitlements) > 0 {
-		authorization = NewEntitlementSetAuthorization(invocation.Interpreter, entitlements, sema.Conjunction)
-	}
-
 	return NewSomeValueNonCopying(
 		invocation.Interpreter,
 		NewTypeValue(

runtime/interpreter/statictype.go

@@ -513,14 +513,21 @@ var _ Authorization = EntitlementSetAuthorization{}
 
 func NewEntitlementSetAuthorization(
 	memoryGauge common.MemoryGauge,
-	entitlementList []common.TypeID,
+	entitlementListConstructor func() []common.TypeID,
+	entitlementListSize int,
 	kind sema.EntitlementSetKind,
 ) EntitlementSetAuthorization {
 	common.UseMemory(memoryGauge, common.MemoryUsage{
 		Kind:   common.MemoryKindEntitlementSetStaticAccess,
-		Amount: uint64(len(entitlementList)),
+		Amount: uint64(entitlementListSize),
 	})
 
+	entitlementList := entitlementListConstructor()
+	if len(entitlementList) > entitlementListSize {
+		// it should not be possible to reach this point unless something is implemented wrong
+		panic(errors.NewUnreachableError())
+	}
+
 	entitlements := orderedmap.New[sema.TypeIDOrderedSet](len(entitlementList))
 	for _, entitlement := range entitlementList {
 		entitlements.Set(entitlement, struct{}{})
@@ -831,7 +838,18 @@ func ConvertSemaAccesstoStaticAuthorization(
 			typeId := key.ID()
 			entitlements = append(entitlements, typeId)
 		})
-		return NewEntitlementSetAuthorization(memoryGauge, entitlements, access.SetKind)
+		return NewEntitlementSetAuthorization(
+			memoryGauge,
+			func() (entitlements []common.TypeID) {
+				access.Entitlements.Foreach(func(key *sema.EntitlementType, _ struct{}) {
+					typeId := key.ID()
+					entitlements = append(entitlements, typeId)
+				})
+				return
+			},
+			access.Entitlements.Len(),
+			access.SetKind,
+		)
 
 	case sema.EntitlementMapAccess:
 		typeId := access.Type.ID()