Bound resource use when iterating ranges

Assisted-By: devx/b8d3b9bd-01a3-41b1-90f8-632318b798e4

Gemfile

@@ -32,6 +32,7 @@ group :test do
 end
 
 group :spec do
-  gem 'liquid-spec', github: 'Shopify/liquid-spec', branch: 'main'
+  # Includes the range resource-limit specs from https://github.com/Shopify/liquid-spec/pull/165.
+  gem 'liquid-spec', github: 'Shopify/liquid-spec', ref: '84bf25e0edbca5f7e530574788b0f875ab331f50'
   gem 'activesupport', require: false
 end

History.md

@@ -1,5 +1,21 @@
 # Liquid Change Log
 
+## Unreleased
+
+* Avoid materializing integer ranges in `for` and `tablerow` loops, and account for each visited range item.
+
+## 5.13.0
+
+* Add TruffleRuby in CI [Benoit Daloze]
+* Skip slow test raising many exceptions on non-CRuby [Benoit Daloze]
+* Reject bare-bracket syntax in strict2 and introduce `self` keyword by [Alok Swamy]
+* Add strict2_parse to assign and capture tags by [Alok Swamy]
+* Add strict2_parse to increment and decrement tags by [Alok Swamy]
+* Update liquid-spec adapters for `missing_features` [Ian Ker-Seymer]
+* Prevent `SelfDrop` context mutation across render boundaries [Guilherme Carreiro]
+* Fix `SelfDrop` equality [Guilherme Carreiro]
+* Let environment `self` shadow `SelfDrop` [Ian Ker-Seymer]
+
 ## 5.11.0
 * Revert the Inline Snippets tag (#2001), treat its inclusion in the latest Liquid release as a bug, and allow for feedback on RFC#1916 to better support Liquid developers [Guilherme Carreiro]
 * Rename the `:rigid` error mode to `:strict2` and display a warning when users attempt to use the `:rigid` mode [Guilherme Carreiro]

README.md

@@ -149,6 +149,13 @@ template.render!({ 'x' => 1}, { strict_variables: true })
 #=> Liquid::UndefinedVariable: Liquid error: undefined variable y
 ```
 
+### Resource limits
+
+`render_score_limit` and `cumulative_render_score_limit` account for each item visited by
+integer-range `for` and `tablerow` loops, including loops with empty bodies. This bounds range
+iteration work when a score limit is configured; `render_length_limit` only bounds generated
+output and does not by itself limit CPU work for output-free loops.
+
 ### Usage tracking
 
 To help track usages of a feature or code path in production, we have released opt-in usage tracking. To enable this, we provide an empty `Liquid:: Usage.increment` method which you can customize to your needs. The feature is well suited to https://github.com/Shopify/statsd-instrument. However, the choice of implementation is up to you.

lib/liquid.rb

@@ -83,6 +83,7 @@ require 'liquid/resource_limits'
 require 'liquid/expression'
 require 'liquid/template'
 require 'liquid/condition'
+require 'liquid/range_slice'
 require 'liquid/utils'
 require 'liquid/tokenizer'
 require 'liquid/parse_context'

lib/liquid/block_body.rb

@@ -99,7 +99,9 @@ module Liquid
         context.handle_error(exc, line_number)
       else
         error_message = context.handle_error(exc, line_number)
-        unless blank_tag # conditional for backwards compatibility
+        error_mode = context.registers.static[:template_error_mode]
+        suppress_error_text = blank_tag && error_mode != :strict2 && error_mode != :rigid
+        unless suppress_error_text # blank-tag suppression is kept for backwards compatibility outside strict2
           output << error_message
         end
       end

lib/liquid/context.rb

@@ -200,26 +200,27 @@ module Liquid
       object.respond_to?(:evaluate) ? object.evaluate(self) : object
     end
 
-    def self_drop
-      @self_drop ||= SelfDrop.new(self)
-    end
-
     # Fetches an object starting at the local scope and then moving up the hierachy
     def find_variable(key, raise_on_not_found: true)
       # This was changed from find() to find_index() because this is a very hot
       # path and find_index() is optimized in MRI to reduce object allocation
       index = @scopes.find_index { |s| s.key?(key) }
 
-      # `self` resolves to a SelfDrop (enabling `self['var']` lookups),
-      # but only when it hasn't been explicitly assigned as a local variable.
-      return self_drop if key == Expression::SELF && !index
+      fallback_to_self_drop = key == Expression::SELF && index.nil?
 
       variable = if index
         lookup_and_evaluate(@scopes[index], key, raise_on_not_found: raise_on_not_found)
       else
-        try_variable_find_in_environments(key, raise_on_not_found: raise_on_not_found)
+        try_variable_find_in_environments(
+          key,
+          raise_on_not_found: raise_on_not_found && !fallback_to_self_drop,
+        )
       end
 
+      # `self` resolves to a SelfDrop (enabling `self['var']` lookups),
+      # but only after the normal environment lookup doesn't find a value.
+      return @self_drop ||= SelfDrop.new(self) if fallback_to_self_drop && variable.nil?
+
       # update variable's context before invoking #to_liquid
       variable.context = self if variable.respond_to?(:context=)
 

lib/liquid/range_slice.rb

@@ -0,0 +1,44 @@
+# frozen_string_literal: true
+
+module Liquid
+  class RangeSlice
+    attr_reader :length
+
+    def initialize(range, from, to, resource_limits)
+      range_length = range.end - range.begin
+      range_length += 1 unless range.exclude_end?
+      range_length = 0 if range_length.negative?
+
+      start = [from, 0].max
+      finish = [to || range_length, range_length].min
+
+      @first = range.begin + start
+      @length = [finish - start, 0].max
+      @direction = 1
+      @resource_limits = resource_limits
+    end
+
+    def empty?
+      @length.zero?
+    end
+
+    def each
+      return enum_for(:each) unless block_given?
+
+      value = @first
+      @length.times do
+        @resource_limits.increment_render_score(1)
+        yield value
+        value += @direction
+      end
+    end
+
+    def reverse!
+      unless empty?
+        @first += @direction * (@length - 1)
+        @direction = -@direction
+      end
+      self
+    end
+  end
+end

lib/liquid/self_drop.rb

@@ -16,42 +16,39 @@ module Liquid
   #   then the local value takes precedence over the `self` object.
   # @liquid_access global
   class SelfDrop < Drop
-    attr_accessor :bound_self
-
-    def initialize(context)
+    def initialize(self_context)
       super()
-      @context = context
-      @bound_self = nil
+      @self_context = self_context
     end
 
     def [](key)
-      if @bound_self && bound_has?(key)
-        bound_lookup(key)
-      else
-        @context.find_variable(key)
-      end
+      @self_context.find_variable(key)
     rescue UndefinedVariable
       nil
     end
 
     def key?(key)
-      (@bound_self && bound_has?(key)) || @context.variable_defined?(key)
+      @self_context.variable_defined?(key)
     end
 
     def to_liquid
       self
     end
 
-    private
-
-    def bound_has?(key)
-      @bound_self.respond_to?(:key?) && @bound_self.key?(key)
+    def ==(other)
+      other.is_a?(SelfDrop) && other.self_context.equal?(@self_context)
     end
 
-    def bound_lookup(key)
-      return unless @bound_self.respond_to?(:[])
+    alias_method :eql?, :==
 
-      @bound_self[key]
+    def hash
+      @self_context.object_id.hash
     end
+
+    protected
+
+    attr_reader :self_context
+
+    undef context=
   end
 end

lib/liquid/tags/for.rb

@@ -130,7 +130,6 @@ module Liquid
       end
 
       collection = context.evaluate(@collection_name)
-      collection = collection.to_a if collection.is_a?(Range)
 
       limit_value = context.evaluate(@limit)
       to = if limit_value.nil?
@@ -139,7 +138,9 @@ module Liquid
         Utils.to_integer(limit_value) + from
       end
 
-      segment = Utils.slice_collection(collection, from, to)
+      segment = Utils.slice_collection_for_iteration(
+        collection, from, to, context.resource_limits, use_range_to_a: true
+      )
       segment.reverse! if @reversed
 
       offsets[@name] = from + segment.length

lib/liquid/tags/render.rb

@@ -66,12 +66,7 @@ module Liquid
         inner_context['forloop']    = forloop if forloop
 
         @attributes.each do |key, value|
-          evaluated = context.evaluate(value)
-          if key == Expression::SELF
-            inner_context.self_drop.bound_self = evaluated
-          else
-            inner_context[key] = evaluated
-          end
+          inner_context[key] = context.evaluate(value)
         end
         inner_context[context_variable_name] = var unless var.nil?
         partial.render_to_output_buffer(inner_context, output)

lib/liquid/tags/table_row.rb

@@ -85,12 +85,13 @@ module Liquid
       from = @attributes.key?('offset') ? to_integer(context.evaluate(@attributes['offset'])) : 0
       to = @attributes.key?('limit') ? from + to_integer(context.evaluate(@attributes['limit'])) : nil
 
-      collection = Utils.slice_collection(collection, from, to)
+      collection = Utils.slice_collection_for_iteration(collection, from, to, context.resource_limits, allow_endless: true)
       length     = collection.length
 
       cols = @attributes.key?('cols') ? to_integer(context.evaluate(@attributes['cols'])) : length
 
       output << "<tr class=\"row1\">\n"
+      context.resource_limits.increment_write_score(output)
       context.stack do
         tablerowloop = Liquid::TablerowloopDrop.new(length, cols)
         context['tablerowloop'] = tablerowloop
@@ -101,6 +102,7 @@ module Liquid
           output << "<td class=\"col#{tablerowloop.col}\">"
           super
           output << '</td>'
+          context.resource_limits.increment_write_score(output)
 
           # Handle any interrupts if they exist.
           if context.interrupt?
@@ -110,6 +112,7 @@ module Liquid
 
           if tablerowloop.col_last && !tablerowloop.last
             output << "</tr>\n<tr class=\"row#{tablerowloop.row + 1}\">"
+            context.resource_limits.increment_write_score(output)
           end
 
           tablerowloop.send(:increment!)
@@ -117,6 +120,7 @@ module Liquid
       end
 
       output << "</tr>\n"
+      context.resource_limits.increment_write_score(output)
       output
     end
 

lib/liquid/template.rb

@@ -151,8 +151,10 @@ module Liquid
 
         c
       when Liquid::Drop
-        drop         = args.shift
-        drop.context = Context.new([drop, assigns], instance_assigns, registers, @rethrow_errors, @resource_limits, {}, @environment)
+        drop = args.shift
+        c    = Context.new([drop, assigns], instance_assigns, registers, @rethrow_errors, @resource_limits, {}, @environment)
+        drop.context = c if drop.respond_to?(:context=)
+        c
       when Hash
         Context.new([args.shift, assigns], instance_assigns, registers, @rethrow_errors, @resource_limits, {}, @environment)
       when nil
@@ -187,12 +189,20 @@ module Liquid
 
       context.template_name ||= name
 
+      previous_error_mode = context.registers.static[:template_error_mode]
+      context.registers.static[:template_error_mode] = @error_mode
+
       begin
         # render the nodelist.
         @root.render_to_output_buffer(context, output || +'')
       rescue Liquid::MemoryError => e
         context.handle_error(e)
       ensure
+        if previous_error_mode
+          context.registers.static[:template_error_mode] = previous_error_mode
+        else
+          context.registers.static.delete(:template_error_mode)
+        end
         @errors = context.errors
       end
     end
@@ -224,6 +234,7 @@ module Liquid
       end
 
       @warnings = parse_context.warnings
+      @error_mode = parse_context.error_mode
       parse_context
     end
 

lib/liquid/utils.rb

@@ -13,6 +13,26 @@ module Liquid
       end
     end
 
+    # This is intentionally separate from slice_collection, whose Array-returning
+    # behavior is used outside of the iteration tags.
+    def self.slice_collection_for_iteration(
+      collection, from, to, resource_limits, allow_endless: false, use_range_to_a: false
+    )
+      if integer_range?(collection)
+        RangeSlice.new(collection, from, to, resource_limits)
+      elsif collection.is_a?(Range)
+        if use_range_to_a && range_method_overridden?(collection, :to_a)
+          # For historically honored custom Range#to_a. Charge the resulting
+          # selection before buffering it, just as for a custom #each.
+          slice_collection_for_iteration_using_each(collection.to_a, from, to, resource_limits)
+        else
+          slice_range_using_each(collection, from, to, resource_limits, allow_endless: allow_endless)
+        end
+      else
+        slice_collection(collection, from, to)
+      end
+    end
+
     def self.slice_collection_using_each(collection, from, to)
       segments = []
       index    = 0
@@ -38,6 +58,55 @@ module Liquid
       segments
     end
 
+    # Arithmetic slicing must not bypass a Range subclass's custom #each.
+    def self.integer_range?(collection)
+      collection.instance_of?(Range) && collection.begin.is_a?(Integer) && collection.end.is_a?(Integer)
+    end
+    private_class_method :integer_range?
+
+    # Preserve support for Ruby-supplied string ranges and custom Range#each.
+    # Their selected length cannot be inferred from integer bounds, but the tags
+    # need it before rendering for loop metadata, continuation offsets, and columns.
+    # Buffer the selection so we do not have to replay a potentially custom iterator.
+    def self.slice_range_using_each(collection, from, to, resource_limits, allow_endless:)
+      # TableRow historically accepted an endless subclass when its custom #each
+      # was finite, while For historically raised through Range#to_a.
+      if collection.end.nil? && !(allow_endless && (!to.nil? || range_method_overridden?(collection, :each)))
+        raise RangeError, "cannot convert endless range to an array"
+      end
+      if collection.begin.nil? && !range_method_overridden?(collection, :each)
+        raise TypeError, "can't iterate from NilClass"
+      end
+
+      slice_collection_for_iteration_using_each(collection, from, to, resource_limits)
+    end
+    private_class_method :slice_range_using_each
+
+    # Custom Range#each can make a nominally beginless range finite; standard
+    # beginless ranges were rejected before reaching this budgeted traversal.
+    def self.slice_collection_for_iteration_using_each(collection, from, to, resource_limits)
+      return [] if to && to <= from
+
+      segments = []
+      index = 0
+      collection.each do |item|
+        break if to && to <= index
+
+        # Charge preparation, including skipped offsets, before buffering; checking
+        # only while rendering the buffered values would leave this work unbudgeted.
+        resource_limits.increment_render_score(1)
+        segments << item if from <= index
+        index += 1
+      end
+      segments
+    end
+    private_class_method :slice_collection_for_iteration_using_each
+
+    def self.range_method_overridden?(collection, method_name)
+      collection.method(method_name).owner != Range.instance_method(method_name).owner
+    end
+    private_class_method :range_method_overridden?
+
     def self.to_integer(num)
       return num if num.is_a?(Integer)
       num = num.to_s

lib/liquid/version.rb

@@ -2,5 +2,5 @@
 # frozen_string_literal: true
 
 module Liquid
-  VERSION = "5.12.0"
+  VERSION = "5.13.0"
 end

test/integration/blank_body_error_handling_test.rb

@@ -0,0 +1,85 @@
+# frozen_string_literal: true
+
+require 'test_helper'
+
+class BlankBodyErrorHandlingTest < Minitest::Test
+  COMPARISON_ERROR = 'Liquid error (line 1): comparison of Integer with String failed'
+  INVALID_INTEGER_ERROR = 'Liquid error (line 1): invalid integer'
+
+  def render_inline(source, error_mode:, assigns: {})
+    Liquid::Template.parse(source, line_numbers: true, error_mode: error_mode).render(assigns, render_errors: true)
+  end
+
+  def assert_render_raises(source, error_mode:, assigns: {}, message: nil)
+    error = assert_raises(Liquid::ArgumentError) do
+      Liquid::Template.parse(source, line_numbers: true, error_mode: error_mode).render!(assigns)
+    end
+    assert_includes(error.message, message) if message
+  end
+
+  def test_blank_if_body_suppresses_inline_error_text_in_lax_and_strict
+    [:lax, :strict].each do |mode|
+      assert_equal('', render_inline('{% if 5 > "x" %}{% endif %}', error_mode: mode))
+    end
+  end
+
+  def test_blank_unless_body_suppresses_inline_error_text_in_lax_and_strict
+    [:lax, :strict].each do |mode|
+      assert_equal('', render_inline('{% unless 5 > "x" %} {% endunless %}', error_mode: mode))
+    end
+  end
+
+  def test_blank_for_body_suppresses_inline_error_text_in_lax_and_strict
+    [:lax, :strict].each do |mode|
+      assert_equal('', render_inline('{% for i in (1..3) offset: xs %}{% endfor %}', error_mode: mode, assigns: { 'xs' => 'bad' }))
+    end
+  end
+
+  def test_strict2_blank_if_body_shows_inline_error_text
+    assert_equal(COMPARISON_ERROR, render_inline('{% if 5 > "x" %}{% endif %}', error_mode: :strict2))
+  end
+
+  def test_strict2_whitespace_if_body_shows_inline_error_text
+    assert_equal(COMPARISON_ERROR, render_inline('{% if 5 > "x" %}   {% endif %}', error_mode: :strict2))
+  end
+
+  def test_strict2_assign_if_body_shows_inline_error_text
+    assert_equal(COMPARISON_ERROR, render_inline('{% if 5 > "x" %}{% assign a = 1 %}{% endif %}', error_mode: :strict2))
+  end
+
+  def test_strict2_comment_if_body_shows_inline_error_text
+    assert_equal(COMPARISON_ERROR, render_inline('{% if 5 > "x" %}{% comment %}c{% endcomment %}{% endif %}', error_mode: :strict2))
+  end
+
+  def test_strict2_capture_if_body_shows_inline_error_text
+    assert_equal(COMPARISON_ERROR, render_inline('{% if 5 > "x" %}{% capture c %}text{% endcapture %}{% endif %}', error_mode: :strict2))
+  end
+
+  def test_strict2_blank_unless_body_shows_inline_error_text
+    assert_equal(COMPARISON_ERROR, render_inline('{% unless 5 > "x" %} {% endunless %}', error_mode: :strict2))
+  end
+
+  def test_strict2_blank_for_body_shows_inline_error_text
+    assert_equal(INVALID_INTEGER_ERROR, render_inline('{% for i in (1..3) offset: xs %}{% endfor %}', error_mode: :strict2, assigns: { 'xs' => 'bad' }))
+  end
+
+  def test_nonblank_bodies_show_inline_error_text_in_all_modes
+    [:lax, :strict, :strict2].each do |mode|
+      assert_equal(COMPARISON_ERROR, render_inline('{% if 5 > "x" %}{% echo 1 %}{% endif %}', error_mode: mode))
+      assert_equal(COMPARISON_ERROR, render_inline('{% if 5 > "x" %}{{ "" }}{% endif %}', error_mode: mode))
+      assert_equal(COMPARISON_ERROR, render_inline('{% if 5 > "x" %}{% else %}E{% endif %}', error_mode: mode))
+    end
+  end
+
+  def test_raised_errors_are_not_swallowed_by_blank_if_body
+    [:lax, :strict, :strict2].each do |mode|
+      assert_render_raises('{% if 5 > "x" %}{% endif %}', error_mode: mode, message: 'comparison of Integer with String failed')
+    end
+  end
+
+  def test_raised_errors_are_not_swallowed_by_blank_for_body
+    [:lax, :strict, :strict2].each do |mode|
+      assert_render_raises('{% for i in (1..3) offset: xs %}{% endfor %}', error_mode: mode, assigns: { 'xs' => 'bad' }, message: 'invalid integer')
+    end
+  end
+end

test/integration/error_handling_test.rb

@@ -265,11 +265,13 @@ class ErrorHandlingTest < Minitest::Test
   end
 
   def test_bug_compatible_silencing_of_errors_in_blank_nodes
-    output = Liquid::Template.parse("{% assign x = 0 %}{% if 1 < '2' %}not blank{% assign x = 3 %}{% endif %}{{ x }}").render
-    assert_equal("Liquid error: comparison of Integer with String failed0", output)
+    with_error_modes(:lax, :strict) do
+      output = Liquid::Template.parse("{% assign x = 0 %}{% if 1 < '2' %}not blank{% assign x = 3 %}{% endif %}{{ x }}").render
+      assert_equal("Liquid error: comparison of Integer with String failed0", output)
 
-    output = Liquid::Template.parse("{% assign x = 0 %}{% if 1 < '2' %}{% assign x = 3 %}{% endif %}{{ x }}").render
-    assert_equal("0", output)
+      output = Liquid::Template.parse("{% assign x = 0 %}{% if 1 < '2' %}{% assign x = 3 %}{% endif %}{{ x }}").render
+      assert_equal("0", output)
+    end
   end
 
   def test_syntax_error_is_raised_with_template_name

test/integration/security_test.rb

@@ -61,12 +61,15 @@ class SecurityTest < Minitest::Test
   end
 
   def test_does_not_add_drop_methods_to_symbol_table
-    assert_no_new_symbols do
-      assigns = { 'drop' => Drop.new }
-      assert_equal("", Template.parse("{{ drop.custom_method_1 }}", assigns).render!)
-      assert_equal("", Template.parse("{{ drop.custom_method_2 }}", assigns).render!)
-      assert_equal("", Template.parse("{{ drop.custom_method_3 }}", assigns).render!)
+    assigns = { 'drop' => Drop.new }
+    method_names = Array.new(3) { |index| "untrusted_drop_method_#{object_id}_#{index}" }
+
+    method_names.each do |method_name|
+      assert_equal("", Template.parse("{{ drop.#{method_name} }}").render!(assigns))
     end
+
+    # JITs can intern internal metadata; untrusted Drop method names must not be interned.
+    assert_equal([], Symbol.all_symbols.map(&:to_s) & method_names)
   end
 
   def assert_no_new_symbols

test/integration/self_drop_context_test.rb

@@ -0,0 +1,120 @@
+# frozen_string_literal: true
+
+require 'test_helper'
+
+class SelfDropContextTest < Minitest::Test
+  include Liquid
+
+  def test_self_drop_passed_as_render_param_preserves_original_scope
+    source = <<~LIQUID
+      {%- assign var = 42 -%}
+      {%- assign s = self -%}
+      {%- render "snippet1", other_self: s -%}
+    LIQUID
+
+    partials = {
+      'snippet1' => <<~LIQUID,
+        {%- assign var = 43 -%}
+        {{- other_self.var }}|{{ self.var -}}
+      LIQUID
+    }
+
+    assert_template_result('42|43', source, partials: partials)
+  end
+
+  def test_self_drop_in_render_without_passing_resolves_inner_scope
+    source = <<~LIQUID
+      {%- assign var = 42 -%}
+      {%- render "snippet1" -%}
+    LIQUID
+
+    partials = {
+      'snippet1' => <<~LIQUID,
+        {%- assign var = 99 -%}
+        {{- self.var -}}
+      LIQUID
+    }
+
+    assert_template_result('99', source, partials: partials)
+  end
+
+  def test_self_drop_passed_to_nested_renders_preserves_each_level
+    source = <<~LIQUID
+      {%- assign a = 1 -%}
+      {%- assign s1 = self -%}
+      {%- render "snippet1", outer: s1 -%}
+    LIQUID
+
+    partials = {
+      'snippet1' => <<~LIQUID,
+        {%- assign a = 2 -%}
+        {%- assign s2 = self -%}
+        {%- render "snippet2", outer: outer, middle: s2 -%}
+      LIQUID
+      'snippet2' => <<~LIQUID,
+        {%- assign a = 3 -%}
+        {{- outer.a }}|{{ middle.a }}|{{ self.a -}}
+      LIQUID
+    }
+
+    assert_template_result('1|2|3', source, partials: partials)
+  end
+
+  def test_self_drop_reflects_variables_assigned_after_creation
+    source = <<~LIQUID
+      {%- assign s = self -%}
+      {%- assign x = 42 %}{{ s.x -}}
+    LIQUID
+
+    assert_template_result('42', source)
+  end
+
+  def test_self_drop_context_setter_is_undefined
+    context = Context.new
+    drop = SelfDrop.new(context)
+    refute(drop.respond_to?(:context=))
+
+    assert_template_result('42', '{{ self.x }}', { 'x' => 42 })
+  end
+
+  def test_self_drop_repeated_lookups_compare_equal_for_same_context
+    context = Context.new
+    drop = context.find_variable("self")
+    cached_drop = context.find_variable("self")
+
+    assert_same(drop, cached_drop)
+    assert_equal(drop.object_id, cached_drop.object_id)
+    assert_equal(drop, cached_drop)
+  end
+
+  def test_assigned_self_drop_compares_equal_to_itself
+    assert_template_result('T', '{% assign s = self %}{% if s == s %}T{% else %}F{% endif %}')
+  end
+
+  def test_distinct_self_assignments_compare_equal_for_same_context
+    assert_template_result('T', '{% assign a = self %}{% assign b = self %}{% if a == b %}T{% else %}F{% endif %}')
+  end
+
+  def test_bare_self_compares_equal_to_bare_self
+    assert_template_result('T', '{% if self == self %}T{% else %}F{% endif %}')
+  end
+
+  def test_self_drop_with_strict_variables_does_not_raise_for_defined_var
+    t = Template.parse('{{ self.x }}')
+    result = t.render({ 'x' => 42 }, strict_variables: true)
+    assert_equal('42', result)
+  end
+
+  def test_self_drop_with_strict_variables_returns_nil_for_undefined_var
+    t = Template.parse('{{ self.x }}')
+    result = t.render({}, strict_variables: true)
+    assert_equal('', result)
+  end
+
+  def test_self_drop_can_be_passed_as_bare_drop_to_render
+    t = Template.parse('{{ self.x }}')
+    drop = SelfDrop.new(Context.new({ 'x' => 42 }))
+    result = t.render(drop)
+    assert_equal('42', result)
+  end
+end

test/integration/self_drop_render_test.rb

@@ -1,234 +0,0 @@
-# frozen_string_literal: true
-
-require 'test_helper'
-
-# Tests for self[var] lookup behavior across {% render %} boundaries,
-# including the `self:` bound-parameter shape used by the rewriter.
-class SelfDropRenderTest < Minitest::Test
-  include Liquid
-
-  # Snippet body using the rewriter's `self[name_var]` form. `item_1_title`
-  # is a template-local assign; `name` is built at runtime; the rewriter
-  # produces `self[name]` because bare brackets are forbidden in :strict2.
-  REWRITTEN_SNIPPET = <<~LIQUID
-    {%- liquid
-      assign item_1_title = 'Cookware Set'
-    -%}
-    {%- for i in (1..1) -%}
-      {%- liquid
-        assign name = 'item_' | append: i | append: '_title'
-        assign title = self[name]
-      -%}
-      [{{ title }}]
-    {%- endfor -%}
-  LIQUID
-
-  # Original (pre-rewrite) snippet body using bare-bracket lookup. Rejected
-  # at parse time by :strict2 -- which is why the rewriter exists.
-  ORIGINAL_SNIPPET = <<~LIQUID
-    {%- liquid
-      assign item_1_title = 'Cookware Set'
-    -%}
-    {%- for i in (1..1) -%}
-      {%- liquid
-        assign name = 'item_' | append: i | append: '_title'
-        assign title = [name]
-      -%}
-      [{{ title }}]
-    {%- endfor -%}
-  LIQUID
-
-  EXPECTED_OUTPUT = '[Cookware Set]'
-
-  # Baseline: parent does NOT pass `self:` to the snippet. The SelfDrop is
-  # returned by find_variable (no scope has the `self` key), and its `[]`
-  # walks back through the scope chain to find the for-loop-local
-  # `item_1_title`. This is the parity-safe case for the rewriter's
-  # transform; passing today.
-  def test_rewritten_self_lookup_without_self_named_param_resolves_local_assign
-    assert_template_result(
-      EXPECTED_OUTPUT,
-      "{% render 'snippet' %}",
-      partials: { 'snippet' => REWRITTEN_SNIPPET },
-      error_mode: :strict2,
-    )
-  end
-
-  # PRODUCTION FAILURE SHAPE.
-  #
-  # Parent passes `self:` as a named render parameter. Render's
-  # `inner_context[key] = context.evaluate(value)` (render.rb:68-70)
-  # writes `my_obj` to `inner_context['self']`, which lands in
-  # @scopes[0] (context.rb:172-174). Now find_variable's check at
-  # context.rb:209-213 sees `self` defined in scope[0] and skips the
-  # SelfDrop fallthrough -- `self[name]` becomes a literal key-access
-  # against `my_obj`, which has no `item_1_title` key, returning nil.
-  # Output is empty.
-  #
-  # This test asserts the INTENDED behavior (output should be the
-  # snippet-local title). It FAILS today. It should pass once the
-  # rewriter's transform is corrected to preserve scope-chain semantics
-  # across `{% render 'snippet', self: ... %}` boundaries (or, less
-  # likely, once SelfDrop's lookup precedence is changed in
-  # find_variable).
-  #
-  # Failure message reads:
-  #   Expected: "[Cookware Set]"
-  #     Actual: "[]"
-  # which directly says "the snippet's template-local item_1_title was
-  # not found via self[name] when self: was bound on render".
-  def test_rewritten_self_lookup_with_self_named_param_loses_local_assign
-    assert_template_result(
-      EXPECTED_OUTPUT,
-      "{% render 'snippet', self: my_obj %}",
-      { 'my_obj' => { 'unrelated_key' => 'foo' } },
-      partials: { 'snippet' => REWRITTEN_SNIPPET },
-      error_mode: :strict2,
-    )
-  end
-
-  # Pins the prohibition that motivates the rewriter migration:
-  # bare-bracket access must raise at parse time in :strict2. Documents
-  # WHY the rewriter rewrites `[name]` to `self[name]` in the first
-  # place. Passing today; serves as a guard against accidental
-  # regression of PR #2060's strict2 enforcement.
-  def test_original_bare_bracket_lookup_raises_in_strict2
-    error = assert_raises(Liquid::SyntaxError) do
-      Liquid::Template.parse(ORIGINAL_SNIPPET, error_mode: :strict2)
-    end
-    assert_match(
-      /Bare bracket access is not allowed\. Use self\['\.\.\.'\] instead/,
-      error.message,
-    )
-  end
-
-  # Coverage extension: the bug is not a one-off of the empty-string-built
-  # variable name. Confirm `self[name]` still misses when `name` is sourced
-  # directly from the forloop index (no string concatenation), so a future
-  # rewriter fix cannot accidentally pass tests by special-casing
-  # constructed strings.
-  #
-  # `forloop.index` is a number; we cast to string via `| append: ''` to
-  # form `item_1_title` in a different way. Same expected failure: empty
-  # output today, should be `[Cookware Set]` once fixed.
-  def test_rewritten_self_lookup_with_forloop_constructed_key_loses_local_assign
-    snippet = <<~LIQUID
-      {%- liquid
-        assign item_1_title = 'Cookware Set'
-      -%}
-      {%- for i in (1..1) -%}
-        {%- assign suffix = forloop.index | append: '_title' -%}
-        {%- assign name = 'item_' | append: suffix -%}
-        {%- assign title = self[name] -%}
-        [{{ title }}]
-      {%- endfor -%}
-    LIQUID
-
-    assert_template_result(
-      EXPECTED_OUTPUT,
-      "{% render 'snippet', self: my_obj %}",
-      { 'my_obj' => { 'unrelated_key' => 'foo' } },
-      partials: { 'snippet' => snippet },
-      error_mode: :strict2,
-    )
-  end
-
-  # If it fails: Inner snippet's SelfDrop saw outer bound self OR outer locals;
-  # isolation broken.
-  def test_nested_render_each_level_resolves_its_own_local_via_bound_self
-    snippet_a = <<~LIQUID
-      {%- assign label_a = 'A_local' -%}
-      {%- assign key_a = 'label_a' -%}
-      A=[{{ self[key_a] }}]{% render 'b', self: obj_b %}
-    LIQUID
-    snippet_b = <<~LIQUID
-      {%- assign label_b = 'B_local' -%}
-      {%- assign key_b = 'label_b' -%}
-      B=[{{ self[key_b] }}]
-    LIQUID
-    parent = "{% render 'a', self: obj_a %}"
-    assigns = {
-      'obj_a' => { 'unrelated_a' => 'xa' },
-      'obj_b' => { 'unrelated_b' => 'xb' },
-    }
-    assert_template_result(
-      "A=[A_local]B=[B_local]\n\n",
-      parent,
-      assigns,
-      partials: { 'a' => snippet_a, 'b' => snippet_b },
-      error_mode: :strict2,
-    )
-  end
-
-  # If it fails: Bound self leaked across `new_isolated_subcontext` boundary;
-  # SelfDrop carries state across subcontexts.
-  def test_nested_render_inner_without_self_walks_only_inner_scope
-    snippet_a = <<~LIQUID
-      {%- assign label_a = 'A_local' -%}
-      A=[{{ self['label_a'] }}]{% render 'b' %}
-    LIQUID
-    snippet_b = <<~LIQUID
-      {%- assign label_b = 'B_local' -%}
-      {%- assign key_b = 'label_b' -%}
-      B=[{{ self[key_b] }}]
-    LIQUID
-    parent = "{% render 'a', self: obj_a %}"
-    assigns = { 'obj_a' => { 'label_b' => 'LEAK_FROM_OBJ_A' } }
-    assert_template_result(
-      "A=[A_local]B=[B_local]\n\n",
-      parent,
-      assigns,
-      partials: { 'a' => snippet_a, 'b' => snippet_b },
-      error_mode: :strict2,
-    )
-  end
-
-  # If it fails: Specific segment in concatenated output names the broken layer
-  # (top-level, snippet_a local, snippet_a bound, snippet_b local, snippet_b
-  # bound).
-  def test_full_chain_top_level_plus_nested_renders_with_mixed_self_binding
-    snippet_a = <<~LIQUID
-      {%- assign a_local = 'A!' -%}
-      {%- assign a_key = 'a_local' -%}
-      [a:{{ self[a_key] }}|reg:{{ regular_var }}|bound:{{ self['shared'] }}]{% render 'b', self: obj_b %}
-    LIQUID
-    snippet_b = <<~LIQUID
-      {%- assign b_local = 'B!' -%}
-      {%- assign b_key = 'b_local' -%}
-      [b:{{ self[b_key] }}|bound:{{ self['only_in_b'] }}]
-    LIQUID
-    template = <<~LIQUID
-      {%- assign top_key = 'top_var' -%}
-      top:{{ self[top_key] }}|lit:LITERAL|{% render 'a', self: obj_a, regular_var: 'REG' %}
-    LIQUID
-    assigns = {
-      'top_var' => 'TOP!',
-      'obj_a' => { 'shared' => 'SHARED_A' },
-      'obj_b' => { 'only_in_b' => 'B_BOUND', 'shared' => 'SHARED_B_NOT_USED' },
-    }
-    expected = "top:TOP!|lit:LITERAL|[a:A!|reg:REG|bound:SHARED_A][b:B!|bound:B_BOUND]\n\n\n"
-    assert_template_result(
-      expected,
-      template,
-      assigns,
-      partials: { 'a' => snippet_a, 'b' => snippet_b },
-      error_mode: :strict2,
-    )
-  end
-
-  # If it fails: Lookup precedence flipped from bound-first to scope-first;
-  # section C invariant lost.
-  def test_bound_self_key_hit_returns_bound_value_not_scope_value
-    snippet = <<~LIQUID
-      {%- assign shared = 'SCOPE_VALUE' -%}
-      [{{ self['shared'] }}]
-    LIQUID
-    assert_template_result(
-      "[BOUND_VALUE]\n",
-      "{% render 'snippet', self: my_obj %}",
-      { 'my_obj' => { 'shared' => 'BOUND_VALUE' } },
-      partials: { 'snippet' => snippet },
-      error_mode: :strict2,
-    )
-  end
-end

test/integration/tags/for_tag_test.rb

@@ -465,4 +465,85 @@ HERE
 
     assert(context.registers[:for_stack].empty?)
   end
+
+  def test_integer_range_is_not_materialized_and_charges_empty_iterations
+    range = bounded_integer_range_with_tripwires
+    template = Template.parse('{% for i in numbers %}{% endfor %}')
+    template.resource_limits.render_score_limit = 3
+
+    assert_raises(Liquid::MemoryError) { template.render!('numbers' => range) }
+
+    assert(template.resource_limits.reached?)
+    assert_equal(4, template.resource_limits.render_score)
+  end
+
+  def test_integer_range_uses_arithmetic_offsets_reversal_and_metadata
+    range = bounded_integer_range_with_tripwires
+    template = Template.parse(
+      '{% for i in numbers reversed offset:997 limit:2 %}{{ forloop.length }}:{{ i }}{% endfor %}',
+    )
+    template.resource_limits.render_score_limit = 10
+
+    assert_equal('2:9992:998', template.render!('numbers' => range))
+  end
+
+  def test_range_scores_cannot_be_bypassed_by_repeated_renders
+    template = Template.parse('{% for i in (1..2) %}{% endfor %}')
+    template.resource_limits.cumulative_render_score_limit = 3
+    assert_equal('', template.render!)
+    assert_raises(Liquid::MemoryError) { template.render! }
+  end
+
+  def test_range_break_charges_only_visited_items_and_preserves_full_metadata
+    range = bounded_integer_range_with_tripwires
+    template = Template.parse(
+      '{% for i in numbers reversed %}{{ forloop.length }}:{{ i }}{% break %}{% endfor %}',
+    )
+    template.resource_limits.render_score_limit = 10
+
+    assert_equal('1000:1000', template.render!('numbers' => range))
+    assert_operator(template.resource_limits.render_score, :<=, 10)
+  end
+
+  def test_range_subclass_uses_its_custom_each
+    range = Class.new(Range) do
+      def each
+        yield 10
+        yield 20
+      end
+    end.new(nil, 3)
+
+    assert_template_result('1020', '{% for i in numbers %}{{ i }}{% endfor %}', { 'numbers' => range })
+  end
+
+  def test_range_subclass_custom_to_a_is_honored_for_finite_and_open_bounds
+    range_class = Class.new(Range) do
+      def to_a
+        [42]
+      end
+    end
+
+    [range_class.new(1, 3), range_class.new(nil, 3), range_class.new(1, nil)].each do |range|
+      assert_template_result('42', '{% for i in numbers %}{{ i }}{% endfor %}', { 'numbers' => range })
+    end
+  end
+
+  def test_endless_range_remains_unsupported_with_a_limit
+    template = Template.parse('{% for i in numbers limit:2 %}{{ i }}{% endfor %}')
+
+    assert_raises(RangeError) { template.render!('numbers' => (1..)) }
+  end
+
+  def test_endless_range_subclass_with_custom_each_remains_unsupported
+    range = Class.new(Range) do
+      def each
+        yield 10
+        yield 20
+      end
+    end.new(1, nil)
+
+    assert_raises(RangeError) do
+      Template.parse('{% for i in numbers %}{{ i }}{% endfor %}').render!('numbers' => range)
+    end
+  end
 end

test/integration/tags/table_row_test.rb

@@ -465,4 +465,94 @@ class TableRowTest < Minitest::Test
       assert_match(/Unexpected character =/, error.message)
     end
   end
+
+  def test_integer_range_is_not_materialized_and_charges_empty_iterations
+    range = bounded_integer_range_with_tripwires
+    template = Template.parse('{% tablerow i in numbers %}{% endtablerow %}')
+    template.resource_limits.render_score_limit = 3
+
+    assert_raises(Liquid::MemoryError) { template.render!('numbers' => range) }
+
+    assert(template.resource_limits.reached?)
+    assert_equal(4, template.resource_limits.render_score)
+  end
+
+  def test_integer_range_uses_arithmetic_offsets_limit_and_full_metadata
+    range = bounded_integer_range_with_tripwires
+    template = Template.parse(
+      '{% tablerow i in numbers offset:997 limit:2 %}{{ tablerowloop.length }}:{{ tablerowloop.index }}:{{ i }}{% endtablerow %}',
+    )
+
+    assert_equal(
+      "<tr class=\"row1\">\n<td class=\"col1\">2:1:998</td><td class=\"col2\">2:2:999</td></tr>\n",
+      template.render!('numbers' => range),
+    )
+  end
+
+  def test_tablerow_checks_generated_output_during_empty_body_iteration
+    template = Template.parse('{% tablerow i in (1..100) %}{% endtablerow %}')
+    template.resource_limits.render_length_limit = 40
+    checked_lengths = []
+    limits = template.resource_limits
+    original_increment_write_score = limits.method(:increment_write_score)
+    limits.define_singleton_method(:increment_write_score) do |output|
+      checked_lengths << output.bytesize
+      original_increment_write_score.call(output)
+    end
+
+    assert_equal('Liquid error: Memory limits exceeded', template.render)
+    assert(template.resource_limits.reached?)
+    assert_operator(checked_lengths.last, :<, 1000)
+  end
+
+  def test_tablerow_range_scores_persist_across_renders
+    template = Template.parse('{% tablerow i in (1..2) %}{% endtablerow %}')
+    template.resource_limits.cumulative_render_score_limit = 3
+    template.render!
+    assert_raises(Liquid::MemoryError) { template.render! }
+  end
+
+  def test_range_subclass_uses_its_custom_each_with_beginless_bounds
+    range = Class.new(Range) do
+      def each
+        yield 10
+        yield 20
+      end
+    end.new(nil, 3)
+
+    assert_template_result(
+      "<tr class=\"row1\">\n<td class=\"col1\">10</td><td class=\"col2\">20</td></tr>\n",
+      '{% tablerow i in numbers %}{{ i }}{% endtablerow %}',
+      { 'numbers' => range },
+    )
+  end
+
+  def test_endless_range_subclass_uses_its_custom_each_without_a_limit
+    range = Class.new(Range) do
+      def each
+        yield 10
+        yield 20
+      end
+    end.new(1, nil)
+
+    assert_template_result(
+      "<tr class=\"row1\">\n<td class=\"col1\">10</td><td class=\"col2\">20</td></tr>\n",
+      '{% tablerow i in numbers %}{{ i }}{% endtablerow %}',
+      { 'numbers' => range },
+    )
+  end
+
+  def test_range_subclass_custom_to_a_is_not_used
+    range = Class.new(Range) do
+      def to_a
+        [42]
+      end
+    end.new(1, 3)
+
+    assert_template_result(
+      "<tr class=\"row1\">\n<td class=\"col1\">1</td><td class=\"col2\">2</td><td class=\"col3\">3</td></tr>\n",
+      '{% tablerow i in numbers %}{{ i }}{% endtablerow %}',
+      { 'numbers' => range },
+    )
+  end
 end

test/integration/template_test.rb

@@ -132,7 +132,7 @@ class TemplateTest < Minitest::Test
     assert_equal("Liquid error: Memory limits exceeded", t.render)
     assert(t.resource_limits.reached?)
 
-    t.resource_limits.render_score_limit = 200
+    t.resource_limits.render_score_limit = 201
     assert_equal(" foo " * 100, t.render!)
     refute_nil(t.resource_limits.render_score)
   end

test/test_helper.rb

@@ -32,6 +32,15 @@ module Minitest
   module Assertions
     include Liquid
 
+    # Exact Range fixture for fast-path tests; singleton tripwires must remain
+    # untouched because the arithmetic path does not materialize or traverse it.
+    def bounded_integer_range_with_tripwires
+      range = (1..1000).dup
+      range.define_singleton_method(:to_a) { raise 'range was materialized' }
+      range.define_singleton_method(:each) { raise 'range was traversed' }
+      range
+    end
+
     def assert_template_result(
       expected, template, assigns = {},
       message: nil, partials: nil, error_mode: Liquid::Environment.default.error_mode, render_errors: false,

test/unit/range_slice_unit_test.rb

@@ -0,0 +1,85 @@
+# frozen_string_literal: true
+
+require 'test_helper'
+
+class RangeSliceUnitTest < Minitest::Test
+  def test_selects_and_reverses_an_integer_range_without_enumerating_it
+    limits = Liquid::ResourceLimits.new({})
+    slice = Liquid::RangeSlice.new(bounded_integer_range_with_tripwires, 997, 999, limits)
+
+    assert_equal(2, slice.length)
+    refute(slice.empty?)
+    slice.reverse!
+    assert_equal([999, 998], slice.each.to_a)
+    assert_equal(2, limits.render_score)
+  end
+
+  def test_charges_only_values_yielded_before_a_break
+    limits = Liquid::ResourceLimits.new({})
+    slice = Liquid::RangeSlice.new(bounded_integer_range_with_tripwires, 0, nil, limits)
+
+    slice.each { break }
+
+    assert_equal(1, limits.render_score)
+  end
+
+  def test_non_integer_ranges_are_sliced_without_to_a_and_charge_visited_values
+    limits = Liquid::ResourceLimits.new({})
+    range = Class.new(Range) do
+      def to_a
+        raise 'range was materialized'
+      end
+    end.new('a', 'c')
+
+    assert_equal(['b', 'c'], Liquid::Utils.slice_collection_for_iteration(range, 1, nil, limits))
+    assert_equal(3, limits.render_score)
+
+    limited = Liquid::ResourceLimits.new(render_score_limit: 2)
+    assert_raises(Liquid::MemoryError) do
+      Liquid::Utils.slice_collection_for_iteration('a'..'z', 10, 11, limited)
+    end
+  end
+
+  def test_non_integer_range_empty_windows_do_not_visit_a_sentinel_value
+    limits = Liquid::ResourceLimits.new({})
+
+    assert_equal([], Liquid::Utils.slice_collection_for_iteration('a'..'z', 2, 2, limits))
+    assert_equal(0, limits.render_score)
+    assert_equal(['a', 'b'], Liquid::Utils.slice_collection_for_iteration('a'..'z', 0, 2, limits))
+    assert_equal(2, limits.render_score)
+  end
+
+  def test_standard_beginless_range_raises_for_empty_windows
+    [[0, 0], [1, 0]].each do |from, to|
+      assert_raises(TypeError) do
+        Liquid::Utils.slice_collection_for_iteration(Range.new(nil, 3), from, to, Liquid::ResourceLimits.new({}))
+      end
+    end
+  end
+
+  def test_custom_range_to_a_is_sliced_with_a_budget
+    range = Class.new(Range) do
+      def to_a
+        [1, 2, 3]
+      end
+    end.new(nil, 3)
+    limits = Liquid::ResourceLimits.new(render_score_limit: 2)
+
+    assert_raises(Liquid::MemoryError) do
+      Liquid::Utils.slice_collection_for_iteration(range, 1, 3, limits, use_range_to_a: true)
+    end
+    assert_equal(3, limits.render_score)
+  end
+
+  def test_preserves_slice_bounds_for_negative_offsets_and_limits
+    limits = Liquid::ResourceLimits.new({})
+
+    assert_equal([1, 2], Liquid::RangeSlice.new(1..5, -2, 2, limits).each.to_a)
+    empty = Liquid::RangeSlice.new(1..5, 2, 1, limits)
+    assert(empty.empty?)
+    assert_equal([], empty.each.to_a)
+    assert_equal(2, limits.render_score) # the empty window performs no work
+    assert(Liquid::RangeSlice.new(5..1, 0, nil, limits).empty?)
+    assert_equal([1, 2, 3, 4], Liquid::RangeSlice.new(1...5, 0, nil, limits).each.to_a)
+  end
+end