GeezerVison

Closes #1512.

This fixes the ways sugar expressions could silently give wrong results (or crash) described in #1512. It's split into commits by problem; each commit's message has the details.

1. Stored expressions no longer dangle

Sugar nodes held every operand by const&, including temporary sub-expressions, so an expression kept past the statement that built it referred to destroyed objects. auto e = x + x * 2.0; return e; returned garbage, and auto e = -(x * 2.0); segfaulted R.

Nodes now hold their operands through a new traits::sugar_operand<T>: objects that own an R object (vectors, matrices and classes derived from them) by reference, and everything else (nested expressions, views such as MatrixColumn, scalars in rep()) by value. auto e = x * 2.0 + y; is now safe. An expression built on a temporary vector, e.g. auto e = clone(x) + 1.0;, can still dangle; that is documented in the sugar vignette.

2. Aliased in-place assignment is evaluated correctly

Assigning a same-length expression to a vector, or any expression to a range, row or column, writes into existing storage while the expression is still reading. Expressions that read other positions of that storage gave wrong results: x = rev(x) gave 5 4 3 4 5, and the shift x[Range(1, n - 1)] = head(x, n - 1) gave 1 1 1 1 1.

Assignment still happens in place (so attributes are kept and the caller's object is still modified, as before), but only expressions known to be safe are written directly:

• Nodes whose element i depends only on element i of their operands declare them with typedef traits::elementwise_operands<...> rcpp_elementwise. That covers arithmetic, comparisons, !, &, |, math functions, ifelse(), pmin()/pmax(), is_na() and friends, and the d/p/q functions.
• Views declare what kind of view they are (rcpp_view). Whether reading one in place is safe depends on the target:
  • a whole vector can read any view;
  • a column can read other columns;
  • a row can read other rows;
  • a range can't read any view.
• Anything else (e.g. rev(), head(), sapply(), whose function may read the target) is evaluated into a temporary first.

3. Operand lengths are checked in development versions

Operations on two or more vectors took their length from one operand, so a shorter operand was read past its end (with only the bounds warning) and a longer one was silently truncated. These nodes now check their operands' lengths once, when they are constructed, and signal an error on a mismatch, matching the vignette's documented requirement that operands have the same size. Vectors assigned into a range, row or column are checked the same way. Several of these constructors already carried FIXME/TODO notes asking for exactly this check.

The checks are compiled in only for development versions. config.h derives RCPP_SUGAR_LENGTH_CHECKS from the version: on when the fourth component is non-zero (e.g. 1.1.2.5, which is what reverse-dependency runs test), off for releases (three components, fourth set to zero). Defining the macro as 1 or 0 before including Rcpp.h overrides the default. With the checks off, check_sizes() and check_assign_size() are empty inline functions and behaviour is exactly as before: the result is sized by the first operand or the target, and a longer operand is cut short.

The reason is in the "Reverse dependencies" section below: twelve CRAN packages rely on the truncation, and an unconditional error would hold the release until all twelve update. This way the reverse-dependency runs keep catching the mismatches (and the fixes have been sent upstream), while the CRAN release doesn't break anything. The tests check for the errors when enabled and for the truncation otherwise, and the sugar vignette documents when the lengths are checked.

4. !, && and || on single logical results compile, and handle NA like R

None of !all(x), all(x) && any(y), all(x) || any(y), all(x) && true or all(x) || true compiled on master:

• The combinators called the non-const get() through const references.
• The &&/|| overloads for two results declared their second parameter with the first one's template arguments, so they could never be deduced (leaving an ambiguity between the bool overloads).
• Or_SingleLogicalResult_bool named the And class as its CRTP base.

The combinators now hold their operands by value like other sugar nodes, so auto b = !(all(x) && any(y)); is also safe. Since this code had never run, its logic had a bug too: the general &&/|| treated an NA on the left as final, so NA && FALSE gave NA and NA || TRUE gave NA. They now follow R's three-valued logic.

Performance

Same functions compiled against master vs this branch (R 4.6.1, arm64 macOS); results are identical.

Two things were needed to keep these at parity:

• Target-aware view rule. Without the per-target rule for views, the column update above went through a temporary and was ~4.75x slower.
• Out-of-line error path. With the length check's error path inlined, the compiler stopped propagating the constant multiplier into that loop, and it vectorized half as wide.

Expressions that aren't elementwise (e.g. x = rev(x)) now pay for a temporary when assigned in place, which is what makes them correct.

Other changes

• SugarBlock_3_VVV declared its third operand with the second operand's type; fixed.
• MatrixBase gains a const get_ref(), matching VectorBase.
• lapply() indexes its operand through VectorBase again, so a vector yields its stored type (e.g. SEXP for a CharacterVector) rather than a proxy. Holding the operand as the derived type had broken lapply(x, f) where f takes a const CharacterVector& (seen as a compile failure in the touch package).
• The sugar vignette gains a section on operand lengths, storing expressions and assignment, and its Sapply example uses sugar_operand. I edited only vignettes/rmd/Rcpp-sugar.Rmd; the pre-built PDF hasn't been regenerated.

Testing

New tests are in inst/tinytest/cpp/sugar_expressions.cpp, run from test_sugar.R. They cover:

• stored expressions of each kind of node, after overwriting the stack;
• each aliasing case above, including row/column cross-reads that must go through a temporary;
• which expressions are written in place for each kind of target;
• length mismatches in both directions;
• !, && and || on single logical results, against R's own operators for every combination of TRUE, FALSE and NA (including the specializations for operands known not to be NA, and the bool overloads).

On master, the lifetime tests return wrong values or crash R, and the aliasing tests fail. The full suite passes locally with RunAllRcppTests=yes (1732 tests, 0 failures). All test sources also compile with -std=c++11, and introduce no new warnings under -Wall -Wextra -Wconversion other than two -Wsign-conversion notes (clang-only; gcc's -Wconversion doesn't enable those for C++) where rowSums()/diag() now call Matrix::operator()(size_t, size_t) directly.

Reverse dependencies

Tracking issue for the affected packages: #1517.

The 2026-10-06 reverse-dependency run (against a development version, so with the length checks on) flags 12 packages with the new length errors, plus the touch compile failure fixed above. Against a release build with the checks off, all 12 pass unchanged. Each was traced to a single site and a fix was sent upstream (linked below); in all 12, released Rcpp sized the result by the left operand or target and silently truncated the longer side, so none crashed before. In 8 the truncated result happened to be correct; in binspp, CARBayesST, PP and HistDAWass it was wrong or read out of bounds.

The revdbayes failure in the same run is unrelated to this PR; it comes from the object layout change in #1511.