Drop runtime guards for dynamic subscript bounds

Dynamic range guards added work to hot loops while checking only lower bounds. Upper bounds and symbolic scalar and vector subscripts remained unchecked, so the partial guard did not provide a coherent safety contract.

Keep zero-cost compile-time validation for unsupported or statically invalid subscripts, and keep runtime validation required for seq() step semantics. Dynamically computed array bounds remain the caller's responsibility.

Author: mns-nordicals

R/r2f-iterables-helpers.R

@@ -334,9 +334,8 @@ seq_like_r2f <- function(
       glue("{start}, {end}, {step}")
     }
   } else if (context == "[") {
-    # `:`/`seq` sections are only correct for bounds >= 1 (and a step whose
-    # sign matches); seq_len/seq_along need no check -- their worst case is
-    # a legal zero-length section, which matches R's x[integer(0)].
+    # Validate statically-known unsupported bounds and seq() step semantics.
+    # Dynamically computed array bounds remain the caller's responsibility.
     if (kind %in% c(":", "seq")) {
       check_subscript_range_bounds(
         info,
@@ -364,14 +363,11 @@ seq_like_r2f <- function(
   Fortran(fr, val)
 }
 
-# Validate an x[a:b] / x[seq(a, b, by)] index range.
-# In subscript context the emitted section `from:to:sign(1, to-from)` and its
-# claimed length `abs(to - from) + 1` are only correct when both bounds are
-# >= 1: R's x[1:0] drops the 0 (a value-dependent shape quickr cannot
-# produce), and the sign-stride section would read x(0). Statically-bad
-# literal bounds are compile errors; unknown bounds get a statement-level
-# runtime check via emit_quickr_error_if(). An explicit seq() step is
-# handled below (literal-only, plus a runtime wrong-sign check).
+# Validate an x[a:b] / x[seq(a, b, by)] index range where doing so has no
+# general bounds-checking cost. Statically bad literal bounds are compile
+# errors. Dynamic bounds are trusted, consistently with symbolic scalar and
+# vector subscripts. An explicit seq() step is handled below (literal-only,
+# plus a runtime wrong-sign check required by seq() semantics).
 # Used by: seq_like_r2f() (subscript context)
 check_subscript_range_bounds <- function(info, from, to, by_f, hoist, scope) {
   lit <- function(e) {
@@ -409,17 +405,6 @@ check_subscript_range_bounds <- function(info, from, to, by_f, hoist, scope) {
     emit_quickr_error_if(condition, message, hoist, scope)
   }
 
-  checks <- character()
-  if (is.na(from_lit)) {
-    checks <- c(checks, glue("{from} < 1_c_int"))
-  }
-  if (is.na(to_lit)) {
-    checks <- c(checks, glue("{to} < 1_c_int"))
-  }
-  if (length(checks)) {
-    emit(paste(checks, collapse = " .or. "), bounds_msg)
-  }
-
   # Explicit seq() step. When the endpoints differ, the result length divides
   # by the step, and that length is evaluated in the C bridge *before* any
   # Fortran guard can run (a zero step would be a division-by-zero crash

R/r2f-subscript.R

@@ -242,9 +242,9 @@ r2f_handlers[["["]] <- function(
 # reads with NA and grows the vector on out-of-range writes -- neither
 # representable in quickr's static-shape model -- while the generated
 # Fortran would silently read or write out of bounds. Literal `:` range
-# endpoints are checked against the extent here too; their >= 1 lower-bound
-# validation (including the runtime guard for symbolic endpoints) stays in
-# check_subscript_range_bounds().
+# endpoints are checked against the extent here too; literal lower-bound and
+# seq() step validation stays in check_subscript_range_bounds(). Dynamic
+# subscript bounds remain the caller's responsibility.
 check_subscript_expr <- function(e, extent = NULL) {
   e <- unwrap_parens(e)
   while (is_call(e, quote(`-`)) && length(e) == 2L) {

tests/testthat/_snaps/example-roll_mean.md

@@ -24,18 +24,15 @@
     Code
       cat(fsub)
     Output
-      subroutine fn(x, weights, normalize, out, weights__len_, x__len_, quickr_err_msg) bind(c)
-        use iso_c_binding, only: c_char, c_double, c_int, c_null_char, c_ptrdiff_t
+      subroutine fn(x, weights, normalize, out, weights__len_, x__len_) bind(c)
+        use iso_c_binding, only: c_double, c_int, c_ptrdiff_t
         implicit none
       
         ! manifest start
         ! sizes
         integer(c_ptrdiff_t), intent(in), value :: x__len_
         integer(c_ptrdiff_t), intent(in), value :: weights__len_
       
-        ! error
-        character(kind=c_char), intent(inout) :: quickr_err_msg(256)
-      
         ! args
         real(c_double), intent(in) :: x(x__len_)
         real(c_double), intent(in out) :: weights(weights__len_)
@@ -54,24 +51,8 @@
           weights = ((weights / sum(weights)) * size(weights))
         end if
         do i = 1, size(out)
-          if (i < 1_c_int .or. (((i + n) - 1_c_int)) < 1_c_int) then
-            call quickr_set_error_msg("index ranges in x[a:b] must have bounds >= 1")
-            return
-          end if
           out(i) = (sum((x(i:(((i + n) - 1_c_int)):sign(1, (((i + n) - 1_c_int))-i)) * weights)) / real(size(weights), kind=c_double))
         end do
-      
-        contains
-          subroutine quickr_set_error_msg(msg)
-            character(len=*), intent(in) :: msg
-            integer :: i
-            integer :: n
-            if (quickr_err_msg(1) == c_null_char) then
-              n = min(len(msg), 256 - 1)
-              quickr_err_msg(1:n) = [(msg(i:i), i = 1, n)]
-              quickr_err_msg(n + 1) = c_null_char
-            end if
-          end subroutine quickr_set_error_msg
       end subroutine
     Code
       cat(cwrapper)
@@ -87,8 +68,7 @@
         const int* const normalize__, 
         double* const out__, 
         const R_xlen_t weights__len_, 
-        const R_xlen_t x__len_, 
-        char* quickr_err_msg);
+        const R_xlen_t x__len_);
       
       SEXP fn_(SEXP _args) {
         // x
@@ -127,21 +107,13 @@
         SEXP out = PROTECT(Rf_allocVector(REALSXP, out__len_));
         double* out__ = REAL(out);
         
-        char quickr_err_msg[256];
-        quickr_err_msg[0] = '\0';
-        
-        
         fn(
           x__,
           weights__,
           normalize__,
           out__,
           weights__len_,
-          x__len_,
-          quickr_err_msg);
-        if (quickr_err_msg[0] != '\0') {
-          Rf_error("%s", quickr_err_msg);
-        }
+          x__len_);
         
         UNPROTECT(1);
         return out;

tests/testthat/_snaps/subscript-validation.md

@@ -1,4 +1,4 @@
-# x[a:b] guards against non-positive bounds at runtime
+# dynamic x[a:b] bounds compile without runtime bounds guards
 
     Code
       fn
@@ -11,41 +11,22 @@
     Code
       cat(fsub)
     Output
-      subroutine fn(x, n, out_, x__len_, quickr_err_msg) bind(c)
-        use iso_c_binding, only: c_char, c_double, c_int, c_null_char, c_ptrdiff_t
+      subroutine fn(x, n, out_, x__len_) bind(c)
+        use iso_c_binding, only: c_double, c_int, c_ptrdiff_t
         implicit none
       
         ! manifest start
         ! sizes
         integer(c_ptrdiff_t), intent(in), value :: x__len_
       
-        ! error
-        character(kind=c_char), intent(inout) :: quickr_err_msg(256)
-      
         ! args
         real(c_double), intent(in) :: x(x__len_)
         integer(c_int), intent(in) :: n
         real(c_double), intent(out) :: out_((abs((n - 1)) + 1))
         ! manifest end
       
       
-        if (n < 1_c_int) then
-          call quickr_set_error_msg("index ranges in x[a:b] must have bounds >= 1")
-          return
-        end if
         out_ = x(1_c_int:n:sign(1, n-1_c_int))
-      
-        contains
-          subroutine quickr_set_error_msg(msg)
-            character(len=*), intent(in) :: msg
-            integer :: i
-            integer :: n
-            if (quickr_err_msg(1) == c_null_char) then
-              n = min(len(msg), 256 - 1)
-              quickr_err_msg(1:n) = [(msg(i:i), i = 1, n)]
-              quickr_err_msg(n + 1) = c_null_char
-            end if
-          end subroutine quickr_set_error_msg
       end subroutine
     Code
       cat(cwrapper)
@@ -59,8 +40,7 @@
         const double* const x__, 
         const int* const n__, 
         double* const out___, 
-        const R_xlen_t x__len_, 
-        char* quickr_err_msg);
+        const R_xlen_t x__len_);
       
       SEXP fn_(SEXP _args) {
         // x
@@ -89,19 +69,11 @@
         SEXP out_ = PROTECT(Rf_allocVector(REALSXP, out___len_));
         double* out___ = REAL(out_);
         
-        char quickr_err_msg[256];
-        quickr_err_msg[0] = '\0';
-        
-        
         fn(
           x__,
           n__,
           out___,
-          x__len_,
-          quickr_err_msg);
-        if (quickr_err_msg[0] != '\0') {
-          Rf_error("%s", quickr_err_msg);
-        }
+          x__len_);
         
         UNPROTECT(1);
         return out_;

tests/testthat/test-subscript-validation.R

@@ -1,5 +1,4 @@
-# Unit tests for subscript validation: negative/zero rejection and
-# runtime guards on index ranges
+# Unit tests for compile-time subscript validation and seq() step guards
 
 skip_on_cran()
 
@@ -168,16 +167,14 @@ test_that("assignment subscripts get the same validation as reads", {
   expect_quick_identical(fok, list(matrix(as.double(1:6), 2, 3)))
 })
 
-test_that("x[a:b] guards against non-positive bounds at runtime", {
+test_that("dynamic x[a:b] bounds compile without runtime bounds guards", {
   fn <- function(x, n) {
     declare(type(x = double(NA)), type(n = integer(1)))
     x[1:n]
   }
-  expect_translation_snapshots(fn) # pins the guard text
+  expect_translation_snapshots(fn) # pins the absence of a bounds guard
   qfn := quick(fn)
   expect_equal(qfn(as.double(1:5), 3L), c(1, 2, 3))
-  expect_error(qfn(as.double(1:5), 0L), "bounds >= 1")
-  expect_error(qfn(as.double(1:5), -2L), "bounds >= 1")
 
   # descending ranges still work
   fdesc <- function(x, n) {
@@ -186,7 +183,6 @@ test_that("x[a:b] guards against non-positive bounds at runtime", {
   }
   qdesc := quick(fdesc)
   expect_equal(qdesc(as.double(1:4), 4L), c(4, 3, 2, 1))
-  expect_error(qdesc(as.double(1:4), 0L), "bounds >= 1")
 })
 
 test_that("literal in-range bounds emit no guard; bad literals error at compile time", {
@@ -227,6 +223,16 @@ test_that("non-singleton x[seq(a, b, by)] validates the step", {
   qfs := quick(fs)
   expect_equal(qfs(as.double(1:9), 8L), c(5, 6, 7, 8))
   expect_error(qfs(as.double(1:9), 2L), "wrong sign")
+
+  # Scalar results do not need the sequence length in the C bridge, so the
+  # Fortran guard must continue to validate the step in this context.
+  fsum <- function(x, n) {
+    declare(type(x = double(NA)), type(n = integer(1)))
+    sum(x[seq(5L, n, by = 1L)])
+  }
+  qsum := quick(fsum)
+  expect_equal(qsum(as.double(1:9), 8L), sum(5:8))
+  expect_error(qsum(as.double(1:9), 2L), "wrong sign")
 })
 
 test_that("a singleton seq() subscript accepts a symbolic step", {