Module rcow 

RCow — an R-aware copy-on-write slice.

Like std::borrow::Cow<[T]>, but the borrowed arm carries the source SEXP it was read from. That single extra field is what makes a zero-copy round-trip back to R sound, where Cow<[T]> could not be (see #880).

The Cow<[T]> hazard this replaces

Cow<[T]> is zero-copy on the way in through TryFromRoot, which returns Cow::Borrowed(&[T]) pointing straight at R’s vector data. But it cannot be returned to R zero-copy safely. A bare &[T] carries no provenance, so a borrowed sub-slice (&cow[2..5]) is byte-for-byte indistinguishable from a full borrow, yet as_ptr() points into the middle of the R vector. The old recovery path computed data_ptr − SEXPREC_header and speculatively read there — landing mid-header for a sub-slice (false-positive corruption) or off the front of a Rust-allocated buffer entirely (segfault — the same class of bug fixed for Arrow in #867). Arrow could keep zero-copy because arrow::Buffer proves it is unsliced and R-backed (ptr_offset/ capacity); a &[T] proves nothing.

How RCow fixes it structurally

RCow::Borrowed wraps RBorrow, whose fields are private. The only constructor is RCow::try_from_root, which always borrows a whole vector. There is no way to build a borrowed RCow over a sub-range (slice via Deref to get a plain &[T] instead). So a borrowed RCow always spans its entire source vector, and IntoR simply returns the stored SEXP — no pointer arithmetic, no speculative read, no hazard. Need to mutate or reshape? to_mut / into_owned copy out into an owned Vec<T>.

Lifetime contract

A borrowed RCow is tied to the lifetime-carrying Root passed to try_from_root. Generated wrappers borrow that root from the live .Call argument slot. Write RCow<'_, T>: a 'static parameter would require the call’s local root to live forever and is rejected. Raw TryFromSexp is unavailable for RCow; callers outside wrappers use a ProtectScope root.

Structs

RBorrow

Borrowed arm of RCow: a whole-vector view that remembers its source SEXP.

Enums

RCow

An R-aware copy-on-write slice — the safe, zero-copy-round-trip alternative to std::borrow::Cow<[T]>.