rigortype 0.4.4 → 0.4.5

data/lib/rigor/inference/intervening_ivar_reset.rb

@@ -0,0 +1,303 @@
+# frozen_string_literal: true
+
+require "prism"
+
+require_relative "../type"
+require_relative "reflective_ivar_write"
+require_relative "refined_dispatch/own_method"
+require_relative "self_call_ivar_writes"
+
+module Rigor
+  module Inference
+    # The intervening-call reset of instance variables. An implicit-self or `self.` call may write any instance
+    # variable of `self`, so past one each instance variable whose binding is narrower than its class-ivar seed reads
+    # the union of the two again; a call proven to write only some ({SelfCallIvarWrites.of}, issue #1596) widens only
+    # those. A call on another receiver cannot reach `self`'s instance variables and widens nothing.
+    #
+    # {.widen} is the reset itself, which the statement evaluator applies past a statement call
+    # (`StatementEvaluator#invalidate_ivars_for_intervening_call`). Issue #1963 — {.after_operand} applies it past
+    # the calls in a condition operand, where a narrowing an earlier operand or clause made would otherwise survive
+    # them: `if @x.nil? && reset!` read `@x` as `nil` in the body although `reset!` assigns it.
+    module InterveningIvarReset
+      # Nodes whose body does not run where it is written, or runs on another `self`: a `def`, and a class or
+      # module body, where `@x` is the class's own instance variable.
+      NON_RUNNING_NODES = [Prism::DefNode, Prism::ClassNode, Prism::ModuleNode, Prism::SingletonClassNode].freeze
+      # Issue #1402 — the nodes that run code the program does not show on `self`'s behalf: `yield` runs the
+      # method's block, and `super` the superclass's method on `self`.
+      UNKNOWN_CODE_NODES = [Prism::YieldNode, Prism::SuperNode, Prism::ForwardingSuperNode].freeze
+      # Issue #1402 — the names of a proc's call (`blk.call`, `blk.()`, `blk.yield`), which runs the block the method
+      # was given as `yield` does.
+      PROC_CALL_NAMES = Set[:call, :yield].freeze
+      # Issue #1402 — the calls whose block runs with `self` bound to the receiver: on a receiver that is provably
+      # another object ({.foreign_self_block?}), an instance variable the block writes, and a method it calls
+      # without a receiver, are that object's.
+      SELF_REBINDING_BLOCK_CALLS = Set[
+        :instance_eval, :instance_exec, :class_eval, :class_exec, :module_eval, :module_exec, :define_method,
+        :define_singleton_method
+      ].freeze
+      # The classes whose instances may be a class or module object: a `self` of one of them may be the receiver of
+      # `Foo.class_eval`, and an instance of one of them may be a `self` that is a class object.
+      CLASS_OBJECT_CLASSES = Set["Class", "Module", "Object", "BasicObject"].freeze
+      private_constant :NON_RUNNING_NODES, :UNKNOWN_CODE_NODES, :PROC_CALL_NAMES, :SELF_REBINDING_BLOCK_CALLS,
+                       :CLASS_OBJECT_CLASSES
+
+      module_function
+
+      # True when `node` is a call that may write `self`'s instance variables: an implicit-self or `self.` call
+      # ({.self_call?}). Issue #1402 — and a `yield`, a `super`, or a proc's call on a local ({.proc_call?}), which
+      # run code the program does not show; {SelfCallIvarWrites.of} proves no write set for any of them.
+      def candidate?(node)
+        return true if UNKNOWN_CODE_NODES.any? { |klass| node.is_a?(klass) }
+        return false unless node.is_a?(Prism::CallNode)
+
+        self_call?(node) || proc_call?(node)
+      end
+
+      # Whether `node`, a call, has no receiver or `self` as its receiver.
+      def self_call?(node)
+        receiver = node.receiver
+        receiver.nil? || receiver.is_a?(Prism::SelfNode)
+      end
+
+      # Issue #1402 — `blk.call` / `blk.()` / `blk.yield` on a local: the method's own `&blk`, or a proc it was
+      # handed, runs code that may call back into `self`, as `yield` does. Read by name, since an unannotated
+      # `&blk` binds `Dynamic`.
+      def proc_call?(node)
+        PROC_CALL_NAMES.include?(node.name) && node.receiver.is_a?(Prism::LocalVariableReadNode)
+      end
+
+      # Issue #1402 — whether `call_node`'s block runs on an object that is provably not `self`: a
+      # {SELF_REBINDING_BLOCK_CALLS} call whose receiver, typed in `scope`, cannot be `self` ({.other_object?}).
+      # A receiver that may be `self` at run time (`obj = self; obj.instance_eval { … }`, a block parameter, an
+      # `Object` or `Dynamic` value, a class the analysis cannot order against `self`'s) is not foreign.
+      def foreign_self_block?(call_node, scope)
+        return false unless call_node.is_a?(Prism::CallNode) && SELF_REBINDING_BLOCK_CALLS.include?(call_node.name)
+        return false if self_call?(call_node)
+
+        other_object?(scope.type_of(call_node.receiver), scope)
+      rescue StandardError
+        false
+      end
+
+      # Whether a value of `type` cannot be `scope`'s `self`. Only an instance method of a class answers: `self` is
+      # then an instance of that class (one other than `Class`, `Module`, `Object` and `BasicObject`, and no module,
+      # declared in source or RBS), and a class object (`Singleton[X]`: `self.class`, a constant naming a class or
+      # module) is not one. Where `self` is a class object, or a module's instance (`module_function`, `extend
+      # self`), any receiver may be `self` — a subclass, the module itself — and none is foreign. An instance
+      # receiver is never foreign: its class may be a subclass of `self`'s that the environment cannot order.
+      def other_object?(type, scope)
+        self_type = scope.self_type
+        return false unless self_type.is_a?(Type::Nominal) && plain_class?(self_type.class_name, scope)
+
+        type.is_a?(Type::Singleton)
+      end
+
+      # Whether `class_name` names a class whose instances are no class or module object, and not a module.
+      def plain_class?(class_name, scope)
+        name = class_name.to_s.delete_prefix("::")
+        !CLASS_OBJECT_CLASSES.include?(name) && !RefinedDispatch::OwnMethod.module_name?(scope, name) &&
+          !module_subclass?(name, scope)
+      end
+
+      # Whether `name` may be a subclass of `Module` (`class Meta < Module`), whose instance is a module object.
+      # Read off the class's instance `Scope::ResolutionChain`, which resolves a superclass written relative to the
+      # subclass's namespace (`class Meta < Base` in `module NS`) as Ruby does: true when an entry is one the
+      # environment orders `:subclass` or `:equal` to `Module` (`Module` itself, `Class`, a project class whose
+      # signature declares it, an external superclass), when an external superclass names no class the
+      # environment knows (it may be `Module`), or when the chain is truncated or unsettled.
+      def module_subclass?(name, scope)
+        chain = Scope::ResolutionChain.for(scope, name, :instance, :methods)
+        return true if chain.truncated? || chain.unsettled?
+
+        environment = scope.environment
+        chain.search(scope) { |entry| module_entry?(entry, environment) || nil } ? true : false
+      end
+      private_class_method :module_subclass?
+
+      # Whether a chain entry makes the class a possible `Module` subclass: a project entry {.module_like?}, or an
+      # external superclass that names no class the environment knows, or one {.module_like?}. An external mixin
+      # (`include Enumerable`) does not.
+      def module_entry?(entry, environment)
+        return module_like?(entry.name.to_s, environment) unless entry.external?
+        return false unless entry.superclass_edge
+
+        known = entry.candidates.map { |candidate| candidate.to_s.delete_prefix("::") }
+                     .select { |candidate| environment.class_known?(candidate) }
+        known.empty? || known.any? { |candidate| module_like?(candidate, environment) }
+      end
+      private_class_method :module_entry?
+
+      def module_like?(name, environment)
+        %i[subclass equal].include?(environment.class_ordering(name, "Module"))
+      end
+      private_class_method :module_like?
+      private_class_method :plain_class?
+
+      # Issue #1402 — `scope` past a statement call whose receiver or arguments run code the program does not
+      # show (`@items << yield`, `puts(yield)`, `log(blk.call)`, `items.each(&blk)`): {.widen} over every narrowed
+      # name, as past a statement `yield`. Every other call in them is the operand walk's.
+      def after_operands(call_node, scope)
+        return scope unless narrowed_ivars?(scope)
+
+        found = []
+        collect_calls(call_node.receiver, false, found, scope, unknown_only: true)
+        collect_calls(call_node.arguments, false, found, scope, unknown_only: true)
+        block = call_node.block
+        found << block if block.is_a?(Prism::BlockArgumentNode) && block.expression.is_a?(Prism::LocalVariableReadNode)
+        return scope if found.empty?
+
+        widen(scope, mark: true) { nil }
+      end
+
+      # Issue #1402 — `scope` past a call on another receiver whose literal block may make a {.candidate?} call
+      # (`[1].each { reset }`, `items.each { yield }`): {.widen} over the names those calls may write, as
+      # {.after_operand} widens past the calls in a condition. In a block that runs on another object
+      # ({.foreign_self_block?}) only a `yield`, a `super` or a proc's call counts: its implicit-self calls are that
+      # object's, while the method's block runs as it always does. A literal-name
+      # `instance_variable_set` on `self` ({ReflectiveIvarWrite.literal_name}) writes the one ivar it names, which
+      # the block's captured-binding write-back already joins, so it is not counted.
+      def after_block(call_node, scope)
+        block = call_node.block
+        return scope unless block.is_a?(Prism::BlockNode)
+        return scope unless narrowed_ivars?(scope)
+
+        calls = []
+        if foreign_self_block?(call_node, scope)
+          collect_calls(block, false, calls, scope, unknown_only: true)
+        else
+          collect_calls(block, false, calls, scope)
+          calls.reject! { |call| ReflectiveIvarWrite.literal_name(call) }
+        end
+        return scope if calls.empty?
+
+        widen(scope, mark: true) { proven_writes(calls, scope) }
+      end
+
+      # `scope` with each instance variable narrowed below its class-ivar seed widened back over the seed. The block
+      # answers the names the call may write, or nil for any; it runs at most once, and only when an instance
+      # variable is narrowed, since a proof costs a read of the callee. An instance variable whose binding carries
+      # the declaration mark keeps it (issue #1889). With `mark: true` a binding whose narrowing had ruled `nil` out
+      # takes the mark when widened, so a `nil` only the seed brings back is not fuel for
+      # `call.possible-nil-receiver` (ADR-58), as a declared one is not. A narrowing that kept `nil`
+      # (`return if @tag`, `@tag.nil?`) widens unmarked, so a read the program really makes on `nil` still reports.
+      def widen(scope, mark: false)
+        seed = class_ivar_seed(scope)
+        return scope if seed.nil? || seed.empty?
+
+        computed = false
+        writes = nil
+        seed.reduce(scope) do |widened, (name, seed_type)|
+          local_type = scope.ivar(name)
+          next widened if local_type.nil? || local_type == seed_type
+
+          unless computed
+            writes = yield
+            computed = true
+          end
+          next widened if writes && !writes.include?(name)
+
+          joined = Type::Combinator.union(local_type, seed_type)
+          widened = widened.with_ivar(name, joined)
+          marked = (mark && nil_free?(local_type)) || scope.declaration_sourced?(:ivar, name)
+          marked ? widened.seed_declaration_sourced_ivar(name, joined) : widened
+        end
+      end
+
+      # Issue #1963 — `scope` past the calls `node`, a condition operand, makes: {.widen} over the names every
+      # candidate call in it may write, or every name when one of them is not proven. A call's literal block may run,
+      # so its calls count; a `def`, a class or module body and (unless `run_lambdas`) a lambda literal run nothing
+      # on this `self` there.
+      #
+      # A binding whose narrowing ruled `nil` out takes the declaration mark when widened ({.widen}'s `mark:`): the
+      # reset forgets the narrowing without making the variable newly nil-reportable, since a call the proof cannot
+      # clear is far more often one that leaves the variable alone (`if @tag && items.any?` then `t = @tag;
+      # t.upcase`) than one that assigns `nil`. A `when` test passes `run_lambdas: true`, since its `===` runs a
+      # lambda literal's body.
+      def after_operand(node, scope, run_lambdas: false)
+        return scope unless narrowed_ivars?(scope)
+
+        calls = candidate_calls(node, run_lambdas, scope)
+        return scope if calls.empty?
+
+        widen(scope, mark: true) { proven_writes(calls, scope) }
+      end
+
+      # Whether a candidate call in `node` may write the instance variable `name`. A `when` test passes
+      # `run_lambdas: true`, since its `===` runs a lambda literal's body. A write to it in `node` is the caller's
+      # to check.
+      def may_write?(node, name, scope, run_lambdas: false)
+        calls = candidate_calls(node, run_lambdas, scope)
+        return false if calls.empty?
+
+        proven = proven_writes(calls, scope)
+        proven.nil? || proven.include?(name)
+      end
+
+      # The union of the names each call may write ({SelfCallIvarWrites.of}), or nil when one is not proven.
+      def proven_writes(calls, scope)
+        calls.reduce(Set.new) do |acc, call|
+          writes = SelfCallIvarWrites.of(call, scope)
+          break nil if writes.nil?
+
+          acc.merge(writes)
+        end
+      end
+
+      # The candidate calls under `node`, in source order.
+      def candidate_calls(node, run_lambdas, scope)
+        found = []
+        collect_calls(node, run_lambdas, found, scope)
+        found
+      end
+
+      # Issue #1402 — with `unknown_only: true` only the `yield`s, `super`s and proc calls ({.unknown_code?}) count,
+      # wherever they sit. A block that runs on another object ({.foreign_self_block?}) is read that way: its
+      # implicit-self calls are that object's, while the method's block runs as anywhere else.
+      def collect_calls(node, run_lambdas, found, scope, unknown_only: false)
+        return unless node.is_a?(Prism::Node)
+        return if NON_RUNNING_NODES.any? { |klass| node.is_a?(klass) }
+        return if !run_lambdas && node.is_a?(Prism::LambdaNode)
+
+        found << node if unknown_only ? unknown_code?(node) : candidate?(node)
+        node.compact_child_nodes.each do |child|
+          foreign = !unknown_only && child.is_a?(Prism::BlockNode) && foreign_self_block?(node, scope)
+          collect_calls(child, run_lambdas, found, scope, unknown_only: unknown_only || foreign)
+        end
+      end
+      private_class_method :collect_calls
+
+      # Issue #1402 — a `yield`, a `super` or a proc's call ({.proc_call?}).
+      def unknown_code?(node)
+        UNKNOWN_CODE_NODES.any? { |klass| node.is_a?(klass) } || (node.is_a?(Prism::CallNode) && proc_call?(node))
+      end
+      private_class_method :unknown_code?
+
+      def nil_free?(type)
+        Narrowing.narrow_non_nil(type) == type
+      end
+      private_class_method :nil_free?
+
+      # Whether any instance variable is bound narrower than its class-ivar seed: the only state {.widen} changes.
+      def narrowed_ivars?(scope)
+        seed = class_ivar_seed(scope)
+        return false if seed.nil? || seed.empty?
+
+        seed.any? do |name, seed_type|
+          local_type = scope.ivar(name)
+          !local_type.nil? && local_type != seed_type
+        end
+      end
+      private_class_method :narrowed_ivars?
+
+      def class_ivar_seed(scope)
+        self_type = scope.self_type
+        class_name =
+          case self_type
+          when Type::Nominal, Type::Singleton then self_type.class_name
+          end
+        class_name && scope.class_ivars_for(class_name)
+      end
+      private_class_method :class_ivar_seed
+    end
+  end
+end

data/lib/rigor/inference/macro_block_self_type.rb

@@ -47,6 +47,25 @@ module Rigor
       # same call, another plugin's included, is not consulted. A `:lexical` entry (issue #1667) keeps the caller's
       # `self`, so its `self_type` is the calling scope's.
       def match_for(scope:, call_node:, receiver_type:)
+        entry = first_matching_entry(scope, call_node, receiver_type)
+        return nil if entry.nil?
+
+        receiver_name = singleton_receiver_class_name(receiver_type) || nominal_receiver_class_name(receiver_type)
+        entry_match(entry, receiver_name, scope, scope.environment)
+      end
+
+      # Whether `call_node`'s block runs as an instance method of the receiver class (issue #1768): its first matching
+      # entry binds `:receiver_instance`, so the block body's `self` is the instance {#match_for} narrows to and its
+      # `@x` writes are that instance's ivars, as a `def` body's are. A `:lexical` or named-`self_type` entry runs the
+      # block on another object, and no entry means no narrowing.
+      def runs_as_receiver_instance_method?(scope:, call_node:, receiver_type:)
+        entry = first_matching_entry(scope, call_node, receiver_type)
+        !entry.nil? && entry.self_type == Plugin::Macro::BlockAsMethod::SELF_TYPE_RECEIVER_INSTANCE
+      end
+
+      # The first registered entry that matches `call_node` on `receiver_type`, in (plugin registration, declaration)
+      # order, or nil.
+      def first_matching_entry(scope, call_node, receiver_type)
         return nil if receiver_type.nil?
 
         environment = scope&.environment
@@ -61,12 +80,7 @@ module Rigor
         # (plugin registration, declaration) order; the method-name membership is guaranteed
         # by the table key.
         entries = registry.contribution_index.block_entries_for(call_node.name)
-        entries.each do |entry|
-          next unless entry_matches?(entry, singleton_name, nominal_name, call_node, scope, environment)
-
-          return entry_match(entry, singleton_name || nominal_name, scope, environment)
-        end
-        nil
+        entries.find { |entry| entry_matches?(entry, singleton_name, nominal_name, call_node, scope, environment) }
       end
 
       # The {Match} a matching entry contributes: a `:lexical` one keeps the calling scope's `self`, unknown where the

data/lib/rigor/inference/method_dispatcher/constant_folding.rb

@@ -190,6 +190,35 @@ module Rigor
 
         STRING_FOLD_BYTE_LIMIT = 4096
 
+        # #2115 — the numeric twin of `STRING_FOLD_BYTE_LIMIT`. A folded Integer (and each Integer part of a
+        # folded Rational / Complex) is at most this many bits, the largest bit length whose decimal
+        # rendering still fits in `STRING_FOLD_BYTE_LIMIT` digits: `2 ** 13_605` folds, `2 ** 13_606`
+        # (bit length 13_607) does not. Computing `2 ** 100_000_000` takes Ruby milliseconds, but
+        # rendering it in decimal — which describing, sorting and printing the `Constant` does — takes
+        # minutes. `**` / `pow` / `<<` / `>>` also check their operands before invoking, so the big value
+        # is never computed.
+        INTEGER_FOLD_BIT_LIMIT = (STRING_FOLD_BYTE_LIMIT * Math.log2(10)).floor
+
+        # #2115 — the most elements a fold walks out of a `Constant<Range>` receiver. A method that
+        # enumerates the range (`to_a`, `to_set`, `all?`, `include?` on a String range, …) declines when
+        # the range holds more elements, or is endless (`1..Float::INFINITY`); a method that reads only
+        # the endpoints (`RANGE_ENDPOINT_METHODS`) still folds whatever the range's size.
+        RANGE_ENUMERATION_LIMIT = 1024
+
+        # The `Range` methods whose CRuby body reads the endpoints without walking the elements, so they
+        # stay foldable on a range past `RANGE_ENUMERATION_LIMIT`. `include?` / `member?` join them on a
+        # numeric range, where CRuby answers them by `cover?`.
+        RANGE_ENDPOINT_METHODS = Set[
+          :begin, :end, :exclude_end?, :cover?, :===, :size, :to_s, :inspect, :==, :eql?, :hash
+        ].freeze
+        RANGE_COVER_METHODS = Set[:include?, :member?].freeze
+        private_constant :RANGE_ENDPOINT_METHODS, :RANGE_COVER_METHODS
+
+        # A result `INTEGER_FOLD_BIT_LIMIT` keeps from becoming a `Constant`: the fold still knows its class,
+        # and answers `Nominal[class_name]` for it. Falling through to RBS instead would read `Integer#**`'s
+        # declared `Numeric`, on which `(2 ** 20_000).even?` is an undefined method.
+        WidenedResult = Data.define(:class_name)
+
         # Input cartesian product hard cap. Keeps fold cost bounded even when the receiver and argument are
         # both `Union[Constant…]`. 5 × 5 = 25 inputs is permitted; 6 × 6 = 36 is not. The user-facing payoff
         # (a precise small enum) drops off fast past this range and CRuby method invocation cost adds up.
@@ -649,45 +678,41 @@ module Rigor
         def range_constant_unary(range, method_name)
           case method_name
           when :to_a, :entries then range_to_a_tuple(range)
-          when :first, :min then range_endpoint_constant(range, :first)
-          when :last, :max then range_endpoint_constant(range, :last)
-          when :count, :size, :length then Type::Combinator.constant_of(range.to_a.size)
-          when :minmax then range_minmax_tuple(range)
+          # #2115 — `Range#min` / `#max` / `#minmax` / `#size` are O(1) on Integer endpoints in CRuby, so
+          # none of these materialises the range. The no-arg `first` / `last` read the endpoints, not the
+          # elements: `first` is `begin` and `last` is `end` whether the range is empty, reversed or
+          # exclusive (`(5..1).first` is 5, `(1...10).last` is 10). Only `min` / `max` depend on emptiness
+          # and exclusivity (`(5..1).min` is nil, `(1...10).max` is 9).
+          when :first then Type::Combinator.constant_of(range.begin)
+          when :last then Type::Combinator.constant_of(range.end)
+          when :min then Type::Combinator.constant_of(range.min)
+          when :max then Type::Combinator.constant_of(range.max)
+          when :count, :size, :length then Type::Combinator.constant_of(range.size)
+          when :minmax then Type::Combinator.tuple_of(*range.minmax.map { |v| Type::Combinator.constant_of(v) })
           # `range.sum` is closed-form (Gauss) for an integer range, so a huge range still costs O(1) and
-          # yields a single Integer — no materialisation, no cap needed. Endless ranges are already excluded
-          # by the Integer-endpoint guard in the caller.
-          when :sum then Type::Combinator.constant_of(range.sum)
+          # yields a single Integer — no materialisation; only `INTEGER_FOLD_BIT_LIMIT` applies. Endless
+          # ranges are already excluded by the Integer-endpoint guard in the caller.
+          when :sum then range_sum_constant(range)
           end
         end
 
-        def range_to_a_tuple(range)
-          values = range.to_a
-          return Type::Combinator.tuple_of if values.empty?
-          return nil if values.size > RANGE_TO_A_LIMIT
+        # The Gauss sum of a range of large endpoints can still pass `INTEGER_FOLD_BIT_LIMIT`; it is then
+        # an `Integer` (both endpoints are).
+        def range_sum_constant(range)
+          sum = range.sum
+          return Type::Combinator.nominal_of("Integer") if oversized_number?(sum)
 
-          Type::Combinator.tuple_of(*values.map { |v| Type::Combinator.constant_of(v) })
+          Type::Combinator.constant_of(sum)
         end
 
-        def range_endpoint_constant(range, edge)
-          values = range.to_a
-          return Type::Combinator.constant_of(nil) if values.empty?
-
-          Type::Combinator.constant_of(edge == :first ? values.first : values.last)
-        end
+        def range_to_a_tuple(range)
+          # `Range#size` is O(1) on Integer endpoints: check the cardinality before materialising.
+          return nil if range.size > RANGE_TO_A_LIMIT
 
-        def range_minmax_tuple(range)
           values = range.to_a
-          if values.empty?
-            return Type::Combinator.tuple_of(
-              Type::Combinator.constant_of(nil),
-              Type::Combinator.constant_of(nil)
-            )
-          end
+          return Type::Combinator.tuple_of if values.empty?
 
-          Type::Combinator.tuple_of(
-            Type::Combinator.constant_of(values.first),
-            Type::Combinator.constant_of(values.last)
-          )
+          Type::Combinator.tuple_of(*values.map { |v| Type::Combinator.constant_of(v) })
         end
 
         # `(1..10).first(3)` / `.take(3)` / `.last(3)` — the 1-arg head / tail forms. `first`/`last` already
@@ -1175,6 +1200,17 @@ module Rigor
         # "Integer-ness" was already implied by the inputs (so the widening fallback only fires for
         # arithmetic over integers).
         def build_constant_type(values, source: nil)
+          widened, values = values.partition { |value| value.is_a?(WidenedResult) }
+          return build_scalar_constant_type(values, source) if widened.empty?
+
+          nominals = widened.map(&:class_name).uniq.map { |name| Type::Combinator.nominal_of(name) }
+          return Type::Combinator.union(*nominals) if values.empty?
+
+          constants = build_scalar_constant_type(values, source)
+          constants && Type::Combinator.union(constants, *nominals)
+        end
+
+        def build_scalar_constant_type(values, source)
           return nil if values.empty?
 
           unique = values.uniq
@@ -1607,9 +1643,12 @@ module Rigor
         # `flat_map`.
         def invoke_binary(receiver_value, method_name, arg_value)
           return nil unless safe?(receiver_value, method_name, arg_value)
+          return nil if range_enumeration_blow_up?(receiver_value, method_name)
 
-          result = receiver_value.public_send(method_name, arg_value)
-          foldable_constant_value?(result) ? [result] : nil
+          widened = numeric_blow_up_class(receiver_value, method_name, arg_value)
+          return [WidenedResult.new(widened)] if widened
+
+          fold_result(receiver_value.public_send(method_name, arg_value))
         rescue StandardError
           nil
         end
@@ -1620,8 +1659,7 @@ module Rigor
         def invoke_ternary(receiver_value, method_name, av0, av1)
           return nil unless ternary_method_allowed?(receiver_value, method_name)
 
-          result = receiver_value.public_send(method_name, av0, av1)
-          foldable_constant_value?(result) ? [result] : nil
+          fold_result(receiver_value.public_send(method_name, av0, av1))
         rescue StandardError
           nil
         end
@@ -1630,13 +1668,21 @@ module Rigor
         def invoke_unary(receiver_value, method_name)
           return nil unless unary_safe?(receiver_value, method_name)
           return nil if string_unary_blow_up?(receiver_value, method_name)
+          return nil if range_enumeration_blow_up?(receiver_value, method_name)
 
-          result = receiver_value.public_send(method_name)
-          foldable_constant_value?(result) ? [result] : nil
+          fold_result(receiver_value.public_send(method_name))
         rescue StandardError
           nil
         end
 
+        # `[result]` for a foldable value, `[WidenedResult]` for a number past `INTEGER_FOLD_BIT_LIMIT`, nil
+        # for anything else.
+        def fold_result(result)
+          return [WidenedResult.new(result.class.name)] if oversized_number?(result)
+
+          foldable_constant_value?(result) ? [result] : nil
+        end
+
         def unary_safe?(receiver_value, method_name)
           return true if unary_ops_for(receiver_value).include?(method_name)
 
@@ -1775,7 +1821,44 @@ module Rigor
           # with the widened class.
           return false if value.is_a?(Float) && value.nan?
           return false if value.is_a?(Complex) && complex_nan?(value)
+          return false if oversized_number?(value)
+
+          true
+        end
+
+        # True when an Integer, or an Integer part of a Rational / Complex, is past `INTEGER_FOLD_BIT_LIMIT`.
+        def oversized_number?(value)
+          case value
+          when Integer then value.bit_length > INTEGER_FOLD_BIT_LIMIT
+          when Rational then oversized_number?(value.numerator) || oversized_number?(value.denominator)
+          when Complex then oversized_number?(value.real) || oversized_number?(value.imaginary)
+          else false
+          end
+        end
+
+        # #2115 — true when `receiver_value` is a `Range` the method would walk element by element and the
+        # range holds more than `RANGE_ENUMERATION_LIMIT` elements (an endless one never stops).
+        def range_enumeration_blow_up?(receiver_value, method_name)
+          return false unless receiver_value.is_a?(Range)
+          return false if RANGE_ENDPOINT_METHODS.include?(method_name)
+          return false if RANGE_COVER_METHODS.include?(method_name) && numeric_range?(receiver_value)
+
+          !range_within_enumeration_budget?(receiver_value)
+        end
 
+        def numeric_range?(range)
+          range.begin.is_a?(Numeric) || range.end.is_a?(Numeric)
+        end
+
+        # Takes at most `RANGE_ENUMERATION_LIMIT + 1` elements (`Range#first(n)` stops there, endless or
+        # not). A range that cannot iterate at all (a Float or Time begin) raises, and so does every
+        # enumerating method on it before doing any work, so it counts as within budget: the invoke's own
+        # rescue declines an enumerating fold, and `(t0..t1).include?(t)`, which CRuby answers by `cover?`,
+        # keeps folding. A beginless range raises `RangeError` here, which the invoke's own rescue turns into
+        # a declined fold, as the enumerating method itself would raise.
+        def range_within_enumeration_budget?(range)
+          range.first(RANGE_ENUMERATION_LIMIT + 1).size <= RANGE_ENUMERATION_LIMIT
+        rescue TypeError
           true
         end
 
@@ -1796,6 +1879,58 @@ module Rigor
           true
         end
 
+        # #2115 — the result's class name when `**` / `pow` / `<<` / `>>` would produce a number past
+        # `INTEGER_FOLD_BIT_LIMIT`, read from the operands so the huge value is never computed; nil
+        # otherwise. `fold_result` applies the same bound to every other result after the fact.
+        def numeric_blow_up_class(receiver_value, method_name, arg_value)
+          return nil unless arg_value.is_a?(Integer)
+
+          case method_name
+          when :**, :pow then power_blow_up_class(receiver_value, arg_value)
+          when :<<, :>> then "Integer" if shift_blow_up?(receiver_value, method_name, arg_value)
+          end
+        end
+
+        # An Integer base to a negative power is a Rational (`2 ** -3 == (1/8)`); a Rational or Complex
+        # base keeps its class.
+        def power_blow_up_class(base, exponent)
+          return nil unless power_blow_up?(base, exponent)
+          return base.class.name unless base.is_a?(Integer)
+
+          exponent.negative? ? "Rational" : "Integer"
+        end
+
+        # A lower bound on the result's bit length is `floor(log2 |base|) * |exponent|`; past the limit the
+        # result is declined anyway. A Float base (or Float part) stays in Float arithmetic and never grows.
+        def power_blow_up?(base, exponent)
+          bits = power_base_bits(base)
+          !bits.nil? && bits * exponent.abs > INTEGER_FOLD_BIT_LIMIT
+        end
+
+        # `floor(log2 |base|)` for an Integer, the larger of its terms' for a Rational. A Complex part
+        # counts one bit more: `(1+1i) ** n` grows although neither part is past 1.
+        def power_base_bits(base)
+          case base
+          when Integer then base.abs.bit_length - 1
+          when Rational then [base.numerator.abs.bit_length, base.denominator.bit_length].max - 1
+          when Complex then complex_power_base_bits(base)
+          end
+        end
+
+        def complex_power_base_bits(base)
+          parts = [base.real, base.imaginary]
+          return nil unless parts.all? { |part| part.is_a?(Integer) || part.is_a?(Rational) }
+
+          parts.map { |part| power_base_bits(part) + 1 }.max
+        end
+
+        def shift_blow_up?(receiver_value, method_name, arg_value)
+          return false unless receiver_value.is_a?(Integer) && !receiver_value.zero?
+
+          shift = method_name == :<< ? arg_value : -arg_value
+          receiver_value.bit_length + shift > INTEGER_FOLD_BIT_LIMIT
+        end
+
         def ops_for(receiver_value)
           case receiver_value
           when Integer, Float then NUMERIC_BINARY