From 60f2ba2351a11255c5f878c5bf4f9342f70f8900 Mon Sep 17 00:00:00 2001
From: Michael Chirico <chiricom@google.com>
Date: Tue, 20 Jan 2026 20:49:06 +0000
Subject: [PATCH 1/7] Use _RO accessors for const targets

---
 src/assign.c    | 10 +++++-----
 src/between.c   | 12 ++++++------
 src/bmerge.c    |  6 +++---
 src/dogroups.c  |  6 +++---
 src/fcast.c     |  6 +++---
 src/fmelt.c     | 20 ++++++++++----------
 src/forder.c    |  4 ++--
 src/frank.c     | 16 ++++++++--------
 src/freadR.c    |  2 +-
 src/gsumm.c     | 14 +++++++-------
 src/rbindlist.c |  2 +-
 src/shift.c     |  2 +-
 src/subset.c    |  6 +++---
 src/uniqlist.c  |  4 ++--
 src/utils.c     | 10 +++++-----
 src/vecseq.c    |  4 ++--
 16 files changed, 62 insertions(+), 62 deletions(-)

diff --git a/src/assign.c b/src/assign.c
index 5901d5a152..05a55cb5a9 100644
--- a/src/assign.c
+++ b/src/assign.c
@@ -403,7 +403,7 @@ SEXP assign(SEXP dt, SEXP rows, SEXP cols, SEXP newcolnames, SEXP values)
       error(_("i is type '%s'. Must be integer, or numeric is coerced with warning. If i is a logical subset, simply wrap with which(), and take the which() outside the loop if possible for efficiency."), type2char(TYPEOF(rows)));
     targetlen = length(rows);
     numToDo = 0;
-    const int *rowsd = INTEGER(rows);
+    const int *rowsd = INTEGER_RO(rows);
     for (int i=0; i<targetlen; ++i) {
       if ((rowsd[i]<0 && rowsd[i]!=NA_INTEGER) || rowsd[i]>nrow)
         error(_("i[%d] is %d which is out of range [1,nrow=%d]"), i+1, rowsd[i], nrow);  // set() reaches here (test 2005.2); := reaches the same error in subset.c first
@@ -660,7 +660,7 @@ SEXP assign(SEXP dt, SEXP rows, SEXP cols, SEXP newcolnames, SEXP values)
   if (ndelete) {
     // delete any columns assigned NULL (there was a 'continue' earlier in loop above)
     int *tt = (int *)R_alloc(ndelete, sizeof(*tt));
-    const int *colsd=INTEGER(cols), ncols=length(cols), ndt=length(dt);
+    const int *colsd=INTEGER_RO(cols), ncols=length(cols), ndt=length(dt);
     for (int i=0, k=0; i<ncols; ++i) {   // find which ones to delete and put them in tt
       // Aside: a new column being assigned NULL (something odd to do) would have been warned above, added above, and now deleted. Just
       //        easier to code it this way; e.g. so that other columns may be added or removed ok by the same query.
@@ -743,7 +743,7 @@ const char *memrecycle(const SEXP target, const SEXP where, const int start, con
         // allow assigning level numbers to factor columns; test 425, 426, 429 and 1945
         const int nlevel = length(getAttrib(target, R_LevelsSymbol));
         if (isInteger(source)) {
-          const int *sd = INTEGER(source);
+          const int *sd = INTEGER_RO(source);
           for (int i=0; i<slen; ++i) {
             const int val = sd[i+soff];
             if ((val<1 && val!=NA_INTEGER) || val>nlevel) {
@@ -754,7 +754,7 @@ const char *memrecycle(const SEXP target, const SEXP where, const int start, con
             }
           }
         } else {
-          const double *sd = REAL(source);
+          const double *sd = REAL_RO(source);
           for (int i=0; i<slen; ++i) {
             const double val = sd[i+soff];
             // Since nlevel is an int, val < 1 || val > nlevel will deflect UB guarded against in PR #5832
@@ -800,7 +800,7 @@ const char *memrecycle(const SEXP target, const SEXP where, const int start, con
         const int nSource = length(source);
         int *newSourceD = INTEGER(newSource);
         if (sourceIsFactor) {
-          const int *sourceD = INTEGER(source);
+          const int *sourceD = INTEGER_RO(source);
           for (int i=0; i<nSource; ++i) {  // convert source integers to refer to target levels
             const int val = sourceD[i];
             newSourceD[i] = val==NA_INTEGER ? NA_INTEGER : -hash_lookup(marks, sourceLevelsD[val-1], 0); // retains NA factor levels here via TL(NA_STRING); e.g. ordered factor
diff --git a/src/between.c b/src/between.c
index 9b9a240904..7acd8a1484 100644
--- a/src/between.c
+++ b/src/between.c
@@ -74,9 +74,9 @@ SEXP between(SEXP x, SEXP lower, SEXP upper, SEXP incbounds, SEXP NAboundsArg, S
 
   switch (TYPEOF(x)) {
   case INTSXP: {
-    const int *lp = INTEGER(lower);
-    const int *up = INTEGER(upper);
-    const int *xp = INTEGER(x);
+    const int *lp = INTEGER_RO(lower);
+    const int *up = INTEGER_RO(upper);
+    const int *xp = INTEGER_RO(x);
     if (check) for (int i=0; i<longestBound; ++i) {
       const int l=lp[i & lowMask], u=up[i & uppMask];
       if (l!=NA_INTEGER && u!=NA_INTEGER && l>u)
@@ -128,9 +128,9 @@ SEXP between(SEXP x, SEXP lower, SEXP upper, SEXP incbounds, SEXP NAboundsArg, S
       }
       if (verbose) Rprintf(_("between parallel processing of integer64 took %8.3fs\n"), omp_get_wtime()-tic);
     } else {
-      const double *lp = REAL(lower);
-      const double *up = REAL(upper);
-      const double *xp = REAL(x);
+      const double *lp = REAL_RO(lower);
+      const double *up = REAL_RO(upper);
+      const double *xp = REAL_RO(x);
       if (check) for (int i=0; i<longestBound; ++i) {
         const double l=lp[i & lowMask], u=up[i & uppMask];
         if (!isnan(l) && !isnan(u) && l>u)
diff --git a/src/bmerge.c b/src/bmerge.c
index 737e27f98d..832a958f90 100644
--- a/src/bmerge.c
+++ b/src/bmerge.c
@@ -357,7 +357,7 @@ void bmerge_r(int xlowIn, int xuppIn, int ilowIn, int iuppIn, int col, int thisg
   switch (TYPEOF(xc)) {
   case LGLSXP : case INTSXP : {  // including factors
     const int *icv = isDataCol ? INTEGER(ic) : NULL;
-    const int *xcv = INTEGER(xc);
+    const int *xcv = INTEGER_RO(xc);
     const int ival = isDataCol ? icv[ir] : thisgrp;
     #define ISNAT(x) ((x)==NA_INTEGER)
     #define WRAP(x) (x)  // wrap not needed for int
@@ -388,8 +388,8 @@ void bmerge_r(int xlowIn, int xuppIn, int ilowIn, int iuppIn, int col, int thisg
       #define WRAP(x) (x)
       DO(const int64_t xval=xcv[XIND(mid)], xval<ival, xval>ival, int64_t, ival-xcv[XIND(xlow)], xcv[XIND(xupp)]-ival, ival)
     } else {
-      const double *icv = REAL(ic);
-      const double *xcv = REAL(xc);
+      const double *icv = REAL_RO(ic);
+      const double *xcv = REAL_RO(xc);
       const double ival = icv[ir];
       const uint64_t ivalt = dtwiddle(ival); // TO: remove dtwiddle by dealing with NA, NaN, -Inf, +Inf up front
       #undef ISNAT
diff --git a/src/dogroups.c b/src/dogroups.c
index 7fd1b956e9..e60c4c916b 100644
--- a/src/dogroups.c
+++ b/src/dogroups.c
@@ -132,7 +132,7 @@ SEXP dogroups(SEXP dt, SEXP dtcols, SEXP groups, SEXP grpcols, SEXP jiscols, SEX
   iSD = PROTECT(R_getVar(install(".iSD"), env, false)); nprotect++; // 1-row and possibly no cols (if no i variables are used via JIS)
   xSD = PROTECT(R_getVar(install(".xSD"), env, false)); nprotect++;
   R_len_t maxGrpSize = 0;
-  const int *ilens = INTEGER(lens), n=LENGTH(lens);
+  const int *ilens = INTEGER_RO(lens), n=LENGTH(lens);
   for (R_len_t i=0; i<n; ++i) {
     if (ilens[i] > maxGrpSize) maxGrpSize = ilens[i];
   }
@@ -184,8 +184,8 @@ SEXP dogroups(SEXP dt, SEXP dtcols, SEXP groups, SEXP grpcols, SEXP jiscols, SEX
   Rboolean jexpIsSymbolOtherThanSD = (isSymbol(jexp) && strcmp(CHAR(PRINTNAME(jexp)),".SD")!=0);  // test 559
 
   ansloc = 0;
-  const int *istarts = INTEGER(starts);
-  const int *iorder = INTEGER(order);
+  const int *istarts = INTEGER_RO(starts);
+  const int *iorder = INTEGER_RO(order);
 
   // We just want to set anyNA for later. We do it only once for the whole operation
   // because it is a rare edge case for it to be true. See #4892.
diff --git a/src/fcast.c b/src/fcast.c
index 0207e5dcb2..7d4c31cdb3 100644
--- a/src/fcast.c
+++ b/src/fcast.c
@@ -37,7 +37,7 @@ SEXP fcast(SEXP lhs, SEXP val, SEXP nrowArg, SEXP ncolArg, SEXP idxArg, SEXP fil
     switch (thistype) {
     case INTSXP:
     case LGLSXP: {
-      const int *ithiscol = INTEGER(thiscol);
+      const int *ithiscol = INTEGER_RO(thiscol);
       const int *ithisfill = NULL;
       if (some_fill) ithisfill = INTEGER(thisfill);
       for (int j=0; j<ncols; ++j) {
@@ -51,7 +51,7 @@ SEXP fcast(SEXP lhs, SEXP val, SEXP nrowArg, SEXP ncolArg, SEXP idxArg, SEXP fil
       }
     } break;
     case REALSXP: {
-      const double *dthiscol = REAL(thiscol);
+      const double *dthiscol = REAL_RO(thiscol);
       const double *dthisfill = NULL;
       if (some_fill) dthisfill = REAL(thisfill);
       for (int j=0; j<ncols; ++j) {
@@ -65,7 +65,7 @@ SEXP fcast(SEXP lhs, SEXP val, SEXP nrowArg, SEXP ncolArg, SEXP idxArg, SEXP fil
       }
     } break;
     case CPLXSXP: {
-      const Rcomplex *zthiscol = COMPLEX(thiscol);
+      const Rcomplex *zthiscol = COMPLEX_RO(thiscol);
       const Rcomplex *zthisfill = NULL;
       if (some_fill) zthisfill = COMPLEX(thisfill);
       for (int j=0; j<ncols; ++j) {
diff --git a/src/fmelt.c b/src/fmelt.c
index 7523e802fa..a53aa25911 100644
--- a/src/fmelt.c
+++ b/src/fmelt.c
@@ -19,7 +19,7 @@ SEXP set_diff(SEXP x, int n) {
   if (n <= 0) error(_("'n' must be a positive integer"));
   SEXP table = PROTECT(seq_int(n, 1));       // TODO: using match to 1:n seems odd here, why use match at all
   SEXP xmatch = PROTECT(match(x, table, 0)); // Old comment:took a while to realise: matches vec against x - thanks to comment from Matt in assign.c!
-  const int *ixmatch = INTEGER(xmatch);
+  const int *ixmatch = INTEGER_RO(xmatch);
   int *buf = (int *) R_alloc(n, sizeof(*buf));
   int j=0;
   for (int i=0; i<n; ++i) {
@@ -39,7 +39,7 @@ SEXP which(SEXP x, Rboolean val) {
   int j=0, n = length(x);
   SEXP ans;
   if (!isLogical(x)) error(_("Argument to 'which' must be logical"));
-  const int *ix = LOGICAL(x);
+  const int *ix = LOGICAL_RO(x);
   int *buf = (int *) R_alloc(n, sizeof(*buf));
   for (int i=0; i<n; ++i) {
     if (ix[i] == val) {
@@ -70,7 +70,7 @@ static const char *concat(SEXP vec, SEXP idx) {
   int nidx=length(idx), nvec=length(vec);
   ans[0]='\0';
   if (nidx==0) return ans;
-  const int *iidx = INTEGER(idx);
+  const int *iidx = INTEGER_RO(idx);
   for (int i=0; i<nidx; ++i) {
     if (iidx[i]<1 || iidx[i]>nvec)
       internal_error(__func__, "'idx' must take values between 1 and length(vec); 1 <= idx <= %d", nvec); // # nocov
@@ -150,7 +150,7 @@ static SEXP unlist_(SEXP xint) {
   int *ians = INTEGER(ans), k=0;
   for (int i=0; i<n; ++i) {
     SEXP tmp = VECTOR_ELT(xint, i);
-    const int *itmp = INTEGER(tmp), n2=length(tmp);
+    const int *itmp = INTEGER_RO(tmp), n2=length(tmp);
     for (int j=0; j<n2; ++j)
       ians[k++] = itmp[j];
   }
@@ -600,7 +600,7 @@ SEXP getvarcols(SEXP DT, SEXP dtnames, Rboolean varfactor, Rboolean verbose, str
     if (!varfactor) {
       SET_VECTOR_ELT(ansvars, 0, target=allocVector(STRSXP, data->totlen));
       if (!data->measure_is_list) {//one value column to output.
-        const int *thisvaluecols = INTEGER(VECTOR_ELT(data->valuecols, 0));
+        const int *thisvaluecols = INTEGER_RO(VECTOR_ELT(data->valuecols, 0));
         for (int j=0, ansloc=0; j<data->lmax; ++j) {
           const int thislen = data->narm ? length(VECTOR_ELT(data->not_NA_indices, j)) : data->nrow;
           SEXP str = STRING_ELT(dtnames, thisvaluecols[j]-1);
@@ -622,7 +622,7 @@ SEXP getvarcols(SEXP DT, SEXP dtnames, Rboolean varfactor, Rboolean verbose, str
         SEXP thisvaluecols = VECTOR_ELT(data->valuecols, 0);
         int len = length(thisvaluecols);
         levels = PROTECT(allocVector(STRSXP, len)); protecti++;
-        const int *vd = INTEGER(thisvaluecols);
+        const int *vd = INTEGER_RO(thisvaluecols);
         for (int j=0; j<len; ++j) SET_STRING_ELT(levels, j, STRING_ELT(dtnames, vd[j]-1));
         SEXP m = PROTECT(chmatch(levels, levels, 0)); protecti++;  // do we have any dups?
         int numRemove = 0;  // remove dups and any for which narm and all-NA
@@ -706,7 +706,7 @@ SEXP getidcols(SEXP DT, SEXP dtnames, Rboolean verbose, struct processData *data
       if (data->narm) {
         for (int j=0; j<data->lmax; ++j) {
           SEXP thisidx = VECTOR_ELT(data->not_NA_indices, j);
-          const int *ithisidx = INTEGER(thisidx);
+          const int *ithisidx = INTEGER_RO(thisidx);
           const int thislen = length(thisidx);
           for (int k=0; k<thislen; ++k)
             dtarget[counter + k] = dthiscol[ithisidx[k]-1];
@@ -725,7 +725,7 @@ SEXP getidcols(SEXP DT, SEXP dtnames, Rboolean verbose, struct processData *data
       if (data->narm) {
         for (int j=0; j<data->lmax; ++j) {
           SEXP thisidx = VECTOR_ELT(data->not_NA_indices, j);
-          const int *ithisidx = INTEGER(thisidx);
+          const int *ithisidx = INTEGER_RO(thisidx);
           const int thislen = length(thisidx);
           for (int k=0; k<thislen; ++k)
             itarget[counter + k] = ithiscol[ithisidx[k]-1];
@@ -740,7 +740,7 @@ SEXP getidcols(SEXP DT, SEXP dtnames, Rboolean verbose, struct processData *data
       if (data->narm) {
         for (int j=0; j<data->lmax; ++j) {
           SEXP thisidx = VECTOR_ELT(data->not_NA_indices, j);
-          const int *ithisidx = INTEGER(thisidx);
+          const int *ithisidx = INTEGER_RO(thisidx);
           const int thislen = length(thisidx);
           for (int k=0; k<thislen; ++k)
             SET_STRING_ELT(target, counter + k, STRING_ELT(thiscol, ithisidx[k]-1));
@@ -760,7 +760,7 @@ SEXP getidcols(SEXP DT, SEXP dtnames, Rboolean verbose, struct processData *data
       if (data->narm) {
         for (int j=0; j<data->lmax; ++j) {
           SEXP thisidx = VECTOR_ELT(data->not_NA_indices, j);
-          const int *ithisidx = INTEGER(thisidx);
+          const int *ithisidx = INTEGER_RO(thisidx);
           const int thislen = length(thisidx);
           for (int k=0; k<thislen; ++k)
             SET_VECTOR_ELT(target, counter + k, VECTOR_ELT(thiscol, ithisidx[k]-1));
diff --git a/src/forder.c b/src/forder.c
index 5549f7f651..b86f599ee4 100644
--- a/src/forder.c
+++ b/src/forder.c
@@ -587,7 +587,7 @@ SEXP forder(SEXP DT, SEXP by, SEXP retGrpArg, SEXP retStatsArg, SEXP sortGroupsA
       break;
     case CPLXSXP : {
       // treat as if two separate columns of double
-      const Rcomplex *xd = COMPLEX(x);
+      const Rcomplex *xd = COMPLEX_RO(x);
       double *tmp = REAL(CplxPart);
       if (!complexRerun) {
         for (int i=0; i<nrow; ++i) tmp[i] = xd[i].r;  // extract the real part on the first time
@@ -1527,7 +1527,7 @@ SEXP isOrderedSubset(SEXP x, SEXP nrowArg)
   if (!isInteger(nrowArg) || LENGTH(nrowArg)!=1) error(_("nrow must be integer vector length 1"));
   const int nrow = INTEGER(nrowArg)[0];
   if (nrow<0) error(_("nrow==%d but must be >=0"), nrow);
-  const int *xd = INTEGER(x), xlen=LENGTH(x);
+  const int *xd = INTEGER_RO(x), xlen=LENGTH(x);
   for (int i=0, last=INT_MIN; i<xlen; ++i) {
     int elem = xd[i];
     if (elem==0) continue;
diff --git a/src/frank.c b/src/frank.c
index 997ec79e43..168c4ac7d9 100644
--- a/src/frank.c
+++ b/src/frank.c
@@ -28,12 +28,12 @@ SEXP dt_na(SEXP x, SEXP cols)
       error(_("Column %d of input list x is length %d, inconsistent with first column of that item which is length %d."), i+1,length(v),n);
     switch (TYPEOF(v)) {
     case LGLSXP: {
-      const int *iv = LOGICAL(v);
+      const int *iv = LOGICAL_RO(v);
       for (int j=0; j<n; ++j) ians[j] |= (iv[j] == NA_LOGICAL);
     }
       break;
     case INTSXP: {
-      const int *iv = INTEGER(v);
+      const int *iv = INTEGER_RO(v);
       for (int j=0; j<n; ++j) ians[j] |= (iv[j] == NA_INTEGER);
     }
       break;
@@ -47,7 +47,7 @@ SEXP dt_na(SEXP x, SEXP cols)
         const int64_t *dv = (int64_t *)REAL(v);
         for (int j=0; j<n; ++j) ians[j] |= (dv[j] == NA_INTEGER64);
       } else {
-        const double *dv = REAL(v);
+        const double *dv = REAL_RO(v);
         for (int j=0; j<n; ++j) ians[j] |= ISNAN(dv[j]);
       }
     }
@@ -110,7 +110,7 @@ SEXP dt_na(SEXP x, SEXP cols)
 }
 
 SEXP frank(SEXP xorderArg, SEXP xstartArg, SEXP xlenArg, SEXP ties_method) {
-  const int *xstart = INTEGER(xstartArg), *xlen = INTEGER(xlenArg), *xorder = INTEGER(xorderArg);
+  const int *xstart = INTEGER_RO(xstartArg), *xlen = INTEGER_RO(xlenArg), *xorder = INTEGER_RO(xorderArg);
   enum {MEAN, MAX, MIN, DENSE, SEQUENCE, LAST} ties=0; // RUNLENGTH
 
   const char *pties = CHAR(STRING_ELT(ties_method, 0));
@@ -205,11 +205,11 @@ SEXP anyNA(SEXP x, SEXP cols) {
     j=0;
     switch (TYPEOF(v)) {
     case LGLSXP: {
-      const int *iv = LOGICAL(v);
+      const int *iv = LOGICAL_RO(v);
       while(j<n && iv[j]!=NA_LOGICAL) j++;
     } break;
     case INTSXP: {
-      const int *iv = INTEGER(v);
+      const int *iv = INTEGER_RO(v);
       while(j<n && iv[j]!=NA_INTEGER) j++;
     } break;
     case STRSXP: {
@@ -221,7 +221,7 @@ SEXP anyNA(SEXP x, SEXP cols) {
         const int64_t *dv = (int64_t *)REAL(v);
         while (j<n && dv[j]!=NA_INTEGER64) j++;
       } else {
-        const double *dv = REAL(v);
+        const double *dv = REAL_RO(v);
         while (j<n && !ISNAN(dv[j])) j++;
       }
       break;
@@ -230,7 +230,7 @@ SEXP anyNA(SEXP x, SEXP cols) {
       j = n;
       break;
     case CPLXSXP: {
-      const Rcomplex *cv = COMPLEX(v);
+      const Rcomplex *cv = COMPLEX_RO(v);
       // taken from https://github.com/wch/r-source/blob/d75f39d532819ccc8251f93b8ab10d5b83aac89a/src/main/coerce.c
       while (j<n && !ISNAN(cv[j].r) && !ISNAN(cv[j].i)) j++;
     } break;
diff --git a/src/freadR.c b/src/freadR.c
index b3b3d64507..476d1e42ec 100644
--- a/src/freadR.c
+++ b/src/freadR.c
@@ -480,7 +480,7 @@ size_t allocateDT(int8_t *typeArg, int8_t *sizeArg, int ncolArg, int ndrop, size
     if (selectRank) {
       SEXP tt = PROTECT(allocVector(INTSXP, ncol - ndrop));
       int *ttD = INTEGER(tt), rank = 1;
-      const int *rankD = INTEGER(selectRank);
+      const int *rankD = INTEGER_RO(selectRank);
       for (int i = 0; i < ncol; i++) if (type[i] != CT_DROP) ttD[rankD[i] - 1] = rank++;
       SET_VECTOR_ELT(RCHK, 3, selectRank = tt);
       // selectRank now holds the order not the rank (so its name is now misleading). setFinalNRow passes it to setcolorder
diff --git a/src/gsumm.c b/src/gsumm.c
index 890d010fce..a51ea50312 100644
--- a/src/gsumm.c
+++ b/src/gsumm.c
@@ -744,7 +744,7 @@ static SEXP gminmax(SEXP x, SEXP narm, const bool min)
   case LGLSXP: case INTSXP: {
     ans = PROTECT(allocVector(INTSXP, ngrp));
     int *ansd = INTEGER(ans);
-    const int *xd = INTEGER(x);
+    const int *xd = INTEGER_RO(x);
     if (!LOGICAL(narm)[0]) {
       const int init = min ? INT_MAX : INT_MIN+1;  // NA_INTEGER==INT_MIN checked in init.c
       for (int i=0; i<ngrp; ++i) ansd[i] = init;
@@ -818,7 +818,7 @@ static SEXP gminmax(SEXP x, SEXP narm, const bool min)
       }
     } else {
       double *ansd = REAL(ans);
-      const double *xd = REAL(x);
+      const double *xd = REAL_RO(x);
       if (!LOGICAL(narm)[0]) {
         const double init = min ? R_PosInf : R_NegInf;
         for (int i=0; i<ngrp; ++i) ansd[i] = init;
@@ -1037,7 +1037,7 @@ static SEXP gvarsd1(SEXP x, SEXP narmArg, bool isSD)
   case LGLSXP: case INTSXP: {
     sub = PROTECT(allocVector(INTSXP, maxgrpn)); // allocate once upfront
     int *subd = INTEGER(sub);
-    const int *xd = INTEGER(x);
+    const int *xd = INTEGER_RO(x);
     for (int i=0; i<ngrp; ++i) {
       const int thisgrpsize = grpsize[i];
       if (thisgrpsize==1) {
@@ -1068,7 +1068,7 @@ static SEXP gvarsd1(SEXP x, SEXP narmArg, bool isSD)
   case REALSXP: {
     sub = PROTECT(allocVector(REALSXP, maxgrpn)); // allocate once upfront
     double *subd = REAL(sub);
-    const double *xd = REAL(x);
+    const double *xd = REAL_RO(x);
     for (int i=0; i<ngrp; ++i) {
       const int thisgrpsize = grpsize[i];
       if (thisgrpsize==1) {
@@ -1131,7 +1131,7 @@ SEXP gprod(SEXP x, SEXP narmArg) {
   for (int i=0; i<ngrp; ++i) s[i] = 1.0;
   switch(TYPEOF(x)) {
   case LGLSXP: case INTSXP: {
-    const int *xd = INTEGER(x);
+    const int *xd = INTEGER_RO(x);
     for (int i=0; i<n; ++i) {
       const int thisgrp = grp[i];
       const int elem = nosubset ? xd[i] : (irows[i]==NA_INTEGER ? NA_INTEGER : xd[irows[i]-1]);
@@ -1155,7 +1155,7 @@ SEXP gprod(SEXP x, SEXP narmArg) {
         s[thisgrp] *= elem;
       }
     } else {
-      const double *xd = REAL(x);
+      const double *xd = REAL_RO(x);
       for (int i=0; i<n; ++i) {
         const int thisgrp = grp[i];
         const double elem = nosubset ? xd[i] : (irows[i]==NA_INTEGER ? NA_REAL : xd[irows[i]-1]);
@@ -1217,7 +1217,7 @@ SEXP gshift(SEXP x, SEXP nArg, SEXP fillArg, SEXP typeArg) {
   R_xlen_t nk = length(nArg);
   if (!isInteger(nArg))
     internal_error(__func__, "n must be integer"); // # nocov
-  const int *kd = INTEGER(nArg);
+  const int *kd = INTEGER_RO(nArg);
   for (int i=0; i<nk; i++) if (kd[i]==NA_INTEGER) error(_("Item %d of n is NA"), i+1);
 
   SEXP ans = PROTECT(allocVector(VECSXP, nk)); nprotect++;
diff --git a/src/rbindlist.c b/src/rbindlist.c
index a047b1d49e..e8159c1ef6 100644
--- a/src/rbindlist.c
+++ b/src/rbindlist.c
@@ -471,7 +471,7 @@ SEXP rbindlist(SEXP l, SEXP usenamesArg, SEXP fillArg, SEXP idcolArg, SEXP ignor
           }
           int *targetd = INTEGER(target);
           if (isFactor(thisCol)) {
-            const int *id = INTEGER(thisCol);
+            const int *id = INTEGER_RO(thisCol);
             if (length(thisCol)<=1) {
               // recycle length-1, or NA-fill length-0
               SEXP lev;
diff --git a/src/shift.c b/src/shift.c
index 1ddc3549bd..2c044e71cd 100644
--- a/src/shift.c
+++ b/src/shift.c
@@ -30,7 +30,7 @@ SEXP shift(SEXP obj, SEXP k, SEXP fill, SEXP type)
 
   int nx = length(x), nk = length(k);
   if (!isInteger(k)) internal_error(__func__, "k must be integer"); // # nocov
-  const int *kd = INTEGER(k);
+  const int *kd = INTEGER_RO(k);
   for (int i=0; i<nk; i++) if (kd[i]==NA_INTEGER) error(_("Item %d of n is NA"), i+1);  // NA crashed (#3354); n is called k at C level
 
   const bool cycle = stype == CYCLIC;
diff --git a/src/subset.c b/src/subset.c
index b3372f057b..28e83d03ff 100644
--- a/src/subset.c
+++ b/src/subset.c
@@ -145,7 +145,7 @@ SEXP convertNegAndZeroIdx(SEXP idx, SEXP maxArg, SEXP allowOverMax, SEXP allowNA
     internal_error(__func__, "allowNAArg must be TRUE/FALSE");  // # nocov
   const bool allowNA = LOGICAL(allowNAArg)[0];
 
-  const int *idxp = INTEGER(idx);
+  const int *idxp = INTEGER_RO(idx);
   bool stop = false;
   #pragma omp parallel for num_threads(getDTthreads(n, true))
   for (int i=0; i<n; ++i) {
@@ -309,7 +309,7 @@ SEXP subsetDT(SEXP x, SEXP rows, SEXP cols) { // API change needs update NEWS.md
   int ansn;
   if (isNull(rows)) {
     ansn = nrow;
-    const int *colD = INTEGER(cols);
+    const int *colD = INTEGER_RO(cols);
     for (int i=0; i<LENGTH(cols); i++) {
       SEXP thisCol = VECTOR_ELT(x, colD[i]-1);
       checkCol(thisCol, colD[i], nrow, x);
@@ -318,7 +318,7 @@ SEXP subsetDT(SEXP x, SEXP rows, SEXP cols) { // API change needs update NEWS.md
     }
   } else {
     ansn = LENGTH(rows);  // has been checked not to contain zeros or negatives, so this length is the length of result
-    const int *colD = INTEGER(cols);
+    const int *colD = INTEGER_RO(cols);
     for (int i=0; i<LENGTH(cols); i++) {
       SEXP source = VECTOR_ELT(x, colD[i]-1);
       checkCol(source, colD[i], nrow, x);
diff --git a/src/uniqlist.c b/src/uniqlist.c
index e64f650174..3ff03c1fc4 100644
--- a/src/uniqlist.c
+++ b/src/uniqlist.c
@@ -55,7 +55,7 @@ SEXP uniqlist(SEXP l, SEXP order)
     int *o = INTEGER(order);  // only used when via_order is true
     switch(TYPEOF(v)) {
     case INTSXP : case LGLSXP : {
-      const int *vd=INTEGER(v);
+      const int *vd=INTEGER_RO(v);
       int prev, elem;
       if (via_order) {
         // ad hoc by (order passed in)
@@ -362,7 +362,7 @@ SEXP uniqueNlogical(SEXP x, SEXP narmArg) {
     return ScalarInteger(0);  // empty vector
   int first = LOGICAL(x)[0];
   R_xlen_t i=0;
-  const int *ix = LOGICAL(x);
+  const int *ix = LOGICAL_RO(x);
   while (++i<n && ix[i]==first);
   if (i==n)
     return ScalarInteger(first==NA_INTEGER && narm ? 0 : 1); // all one value
diff --git a/src/utils.c b/src/utils.c
index 5f5da238f9..873a5b9bc3 100644
--- a/src/utils.c
+++ b/src/utils.c
@@ -27,7 +27,7 @@ bool fitsInInt32(SEXP x) {
   if (!isReal(x) || INHERITS(x, char_integer64))
     return false;
   R_xlen_t n=xlength(x), i=0;
-  const double *dx = REAL(x);
+  const double *dx = REAL_RO(x);
   while (i<n &&
          ( ISNA(dx[i]) ||
          (within_int32_repres(dx[i]) && dx[i]==(int)(dx[i])))) {
@@ -44,7 +44,7 @@ bool fitsInInt64(SEXP x) {
   if (!isReal(x) || INHERITS(x, char_integer64))
     return false;
   R_xlen_t n=xlength(x), i=0;
-  const double *dx = REAL(x);
+  const double *dx = REAL_RO(x);
   while (i<n &&
          ( ISNA(dx[i]) ||
          (within_int64_repres(dx[i]) && dx[i]==(int64_t)(dx[i])))) {
@@ -68,7 +68,7 @@ bool allNA(SEXP x, bool errorForBadType) {
     return false;
   case LGLSXP:
   case INTSXP: {
-    const int *xd = INTEGER(x);
+    const int *xd = INTEGER_RO(x);
     for (int i=0; i<n; ++i)    if (xd[i]!=NA_INTEGER) {
       return false;
     }
@@ -81,14 +81,14 @@ bool allNA(SEXP x, bool errorForBadType) {
         return false;
       }
     } else {
-      const double *xd = REAL(x);
+      const double *xd = REAL_RO(x);
       for (int i=0; i<n; ++i)  if (!ISNAN(xd[i])) {
         return false;
       }
     }
     return true;
   case CPLXSXP: {
-    const Rcomplex *xd = COMPLEX(x);
+    const Rcomplex *xd = COMPLEX_RO(x);
     for (int i=0; i<n; ++i) if (!ISNAN_COMPLEX(xd[i])) {
       return false;
     }
diff --git a/src/vecseq.c b/src/vecseq.c
index 4a940bc9bb..a781b4e464 100644
--- a/src/vecseq.c
+++ b/src/vecseq.c
@@ -16,8 +16,8 @@ SEXP vecseq(SEXP x, SEXP len, SEXP clamp)
     error(_("len must be an integer vector")); // # nocov
   if (LENGTH(x) != LENGTH(len))
     error(_("x and len must be the same length")); // # nocov
-  const int *ix = INTEGER(x);
-  const int *ilen = INTEGER(len), nlen=LENGTH(len);
+  const int *ix = INTEGER_RO(x);
+  const int *ilen = INTEGER_RO(len), nlen=LENGTH(len);
   int reslen = 0;
   for (int i=0; i<nlen; ++i) {
     if (INT_MAX-reslen < ilen[i])

From a9f74ec33b53fbcb5a354420d47dc2539515b4cc Mon Sep 17 00:00:00 2001
From: Michael Chirico <chiricom@google.com>
Date: Wed, 21 Jan 2026 00:42:27 -0800
Subject: [PATCH 2/7] use read-only accessors when appropriate (#7615)

---
 src/forder.c   | 16 ++++++++--------
 src/fwriteR.c  |  2 +-
 src/gsumm.c    |  6 +++---
 src/ijoin.c    | 12 ++++++------
 src/nafill.c   |  2 +-
 src/uniqlist.c |  6 +++---
 src/utils.c    |  4 ++--
 src/wrappers.c |  2 +-
 8 files changed, 25 insertions(+), 25 deletions(-)

diff --git a/src/forder.c b/src/forder.c
index b86f599ee4..e7cb7f250c 100644
--- a/src/forder.c
+++ b/src/forder.c
@@ -723,7 +723,7 @@ SEXP forder(SEXP DT, SEXP by, SEXP retGrpArg, SEXP retStatsArg, SEXP sortGroupsA
 
     switch(TYPEOF(x)) {
     case INTSXP : case LGLSXP : {
-      int32_t *xd = INTEGER(x);
+      const int32_t *xd = INTEGER_RO(x);
       #pragma omp parallel for num_threads(getDTthreads(nrow, true))
       for (int i=0; i<nrow; i++) {
         uint64_t elem=0;
@@ -738,7 +738,7 @@ SEXP forder(SEXP DT, SEXP by, SEXP retGrpArg, SEXP retStatsArg, SEXP sortGroupsA
       break;
     case REALSXP :
       if (inherits(x, "integer64")) {
-        int64_t *xd = (int64_t *)REAL(x);
+        const int64_t *xd = (const int64_t *)REAL_RO(x);
         #pragma omp parallel for num_threads(getDTthreads(nrow, true))
         for (int i=0; i<nrow; i++) {
           uint64_t elem=0;
@@ -751,7 +751,7 @@ SEXP forder(SEXP DT, SEXP by, SEXP retGrpArg, SEXP retStatsArg, SEXP sortGroupsA
           WRITE_KEY
         }
       } else {
-        double *xd = REAL(x);     // TODO: revisit double compression (skip bytes/mult by 10,100 etc) as currently it's often 6-8 bytes even for 3.14,3.15
+        const double *xd = REAL_RO(x);     // TODO: revisit double compression (skip bytes/mult by 10,100 etc) as currently it's often 6-8 bytes even for 3.14,3.15
         #pragma omp parallel for num_threads(getDTthreads(nrow, true))
         for (int i=0; i<nrow; i++) {
           uint64_t elem=0;
@@ -1416,15 +1416,15 @@ SEXP issorted(SEXP x, SEXP by)
     int i=1;
     switch(TYPEOF(x)) {
     case INTSXP : case LGLSXP : {
-      int *xd = INTEGER(x);
+      const int *xd = INTEGER_RO(x);
       while (i<n && xd[i]>=xd[i-1]) i++;
     } break;
     case REALSXP :
       if (inherits(x,"integer64")) {
-        int64_t *xd = (int64_t *)REAL(x);
+        const int64_t *xd = (int64_t *)REAL_RO(x);
         while (i<n && xd[i]>=xd[i-1]) i++;
       } else {
-        double *xd = REAL(x);
+        const double *xd = REAL_RO(x);
         while (i<n && dtwiddle(xd[i])>=dtwiddle(xd[i-1])) i++;  // TODO: change to loop over any NA or -Inf at the beginning and then proceed without dtwiddle() (but rounding)
       }
       break;
@@ -1565,7 +1565,7 @@ SEXP binary(SEXP x)
 static bool all1(SEXP x) {
   if (!isInteger(x))
     internal_error_with_cleanup(__func__, "all1 got non-integer"); // # nocov
-  int *xp = INTEGER(x);
+  const int *xp = INTEGER_RO(x);
   for (int i=0; i<LENGTH(x); ++i) if (xp[i] != 1) return false;
   return true;
 }
@@ -1583,7 +1583,7 @@ bool colsKeyHead(SEXP x, SEXP cols) {
   }
   SEXP keynames = PROTECT(chmatch(key, getAttrib(x, R_NamesSymbol), 0));
   UNPROTECT(1); // key
-  int *keynamesp = INTEGER(keynames), *colsp = INTEGER(cols);
+  const int *keynamesp = INTEGER_RO(keynames), *colsp = INTEGER_RO(cols);
   for (int i=0; i<LENGTH(cols); ++i) {
     if (colsp[i]!=keynamesp[i]) {
       UNPROTECT(1);
diff --git a/src/fwriteR.c b/src/fwriteR.c
index 9cf870a358..b2d631fb3e 100644
--- a/src/fwriteR.c
+++ b/src/fwriteR.c
@@ -270,7 +270,7 @@ SEXP fwriteR(
         if (xlength(rn) != args.nrow)
            // Use (long long) to cast R_xlen_t to a fixed type to robustly avoid -Wformat compiler warnings, see #5768, PRId64 didn't work on M1
           error(_("input has specific integer rownames but their length (%lld) != nrow (%"PRId64")"), (long long)xlength(rn), args.nrow);  // # nocov
-        args.rowNames = INTEGER(rn);
+        args.rowNames = INTEGER_RO(rn);
         args.rowNameFun = WF_Int32;
       }
     } else if (isString(rn)) {
diff --git a/src/gsumm.c b/src/gsumm.c
index a51ea50312..9de8ce34f9 100644
--- a/src/gsumm.c
+++ b/src/gsumm.c
@@ -881,8 +881,8 @@ SEXP gmedian(SEXP x, SEXP narmArg) {
   switch(TYPEOF(x)) {
   case REALSXP: {
     double *subd = REAL(PROTECT(allocVector(REALSXP, maxgrpn))); // allocate once upfront and reuse
-    int64_t *xi64 = (int64_t *)REAL(x);
-    double  *xd = REAL(x);
+    const int64_t *xi64 = (const int64_t *)REAL_RO(x);
+    const double  *xd = REAL_RO(x);
     for (int i=0; i<ngrp; ++i) {
       int thisgrpsize = grpsize[i], nacount=0;
       for (int j=0; j<thisgrpsize; ++j) {
@@ -898,7 +898,7 @@ SEXP gmedian(SEXP x, SEXP narmArg) {
     break;
   case LGLSXP: case INTSXP: {
     int *subi = INTEGER(PROTECT(allocVector(INTSXP, maxgrpn)));
-    int *xi = INTEGER(x);
+    const int *xi = INTEGER_RO(x);
     for (int i=0; i<ngrp; i++) {
       const int thisgrpsize = grpsize[i];
       int nacount=0;
diff --git a/src/ijoin.c b/src/ijoin.c
index 737ac61b63..8efe8ac414 100644
--- a/src/ijoin.c
+++ b/src/ijoin.c
@@ -10,8 +10,8 @@ SEXP lookup(SEXP ux, SEXP xlen, SEXP indices, SEXP gaps, SEXP overlaps, SEXP mul
 
   SEXP vv, tt, lookup, type_lookup;
   R_len_t *idx,*count,*type_count,xrows=INTEGER(xlen)[0],uxrows=LENGTH(VECTOR_ELT(ux, 0)),uxcols=LENGTH(ux);
-  int *from = INTEGER(VECTOR_ELT(indices, 0));
-  int *to   = INTEGER(VECTOR_ELT(indices, 1));
+  const int *from = INTEGER_RO(VECTOR_ELT(indices, 0));
+  const int *to   = INTEGER_RO(VECTOR_ELT(indices, 1));
   clock_t pass1, pass2, pass3, start;
   enum {ALL, FIRST, LAST} mult = ALL;
   enum {ANY, WITHIN, START, END, EQUAL} type = ANY;
@@ -225,10 +225,10 @@ SEXP overlaps(SEXP ux, SEXP imatches, SEXP multArg, SEXP typeArg, SEXP nomatchAr
 
   R_len_t uxcols=LENGTH(ux), rows=length(VECTOR_ELT(imatches,0)), xrows=length(VECTOR_ELT(ux,0));
   int nomatch = INTEGER(nomatchArg)[0], totlen=0, thislen;
-  int *from   = INTEGER(VECTOR_ELT(imatches, 0));
-  int *to     = INTEGER(VECTOR_ELT(imatches, 1));
-  int *count   = INTEGER(VECTOR_ELT(ux, uxcols-2));
-  int *type_count   = INTEGER(VECTOR_ELT(ux, uxcols-1));
+  const int *from   = INTEGER_RO(VECTOR_ELT(imatches, 0));
+  const int *to     = INTEGER_RO(VECTOR_ELT(imatches, 1));
+  const int *count   = INTEGER_RO(VECTOR_ELT(ux, uxcols-2));
+  const int *type_count   = INTEGER_RO(VECTOR_ELT(ux, uxcols-1));
   SEXP lookup = VECTOR_ELT(ux, uxcols-4);
   SEXP type_lookup = VECTOR_ELT(ux, uxcols-3);
   SEXP ans, f1__, f2__, tmp1, tmp2;
diff --git a/src/nafill.c b/src/nafill.c
index 76c4991a5f..fd67f11ac0 100644
--- a/src/nafill.c
+++ b/src/nafill.c
@@ -146,7 +146,7 @@ SEXP nafillR(SEXP obj, SEXP type, SEXP fill, SEXP nan_is_na_arg, SEXP inplace, S
   }
   SEXP ricols = PROTECT(colnamesInt(obj, cols, /* check_dups= */ ScalarLogical(TRUE), /* skip_absent= */ ScalarLogical(FALSE))); protecti++; // nafill cols=NULL which turns into seq_along(obj)
   x = PROTECT(allocVector(VECSXP, length(ricols))); protecti++;
-  int *icols = INTEGER(ricols);
+  const int *icols = INTEGER_RO(ricols);
   bool any_char = false;
   for (int i=0; i<length(ricols); i++) {
     SEXP this_col = VECTOR_ELT(obj, icols[i]-1);
diff --git a/src/uniqlist.c b/src/uniqlist.c
index 3ff03c1fc4..246d3494d3 100644
--- a/src/uniqlist.c
+++ b/src/uniqlist.c
@@ -221,7 +221,7 @@ SEXP rleid(SEXP l, SEXP cols) {
     SEXP jcol = VECTOR_ELT(l, icols[0]-1);
     switch (TYPEOF(jcol)) {
     case INTSXP : case LGLSXP : {
-      int *ijcol = INTEGER(jcol);
+      const int *ijcol = INTEGER_RO(jcol);
       for (R_xlen_t i=1; i<nrow; i++) {
         bool same = ijcol[i]==ijcol[i-1];
         ians[i] = (grp+=!same);
@@ -235,14 +235,14 @@ SEXP rleid(SEXP l, SEXP cols) {
       }
     } break;
     case REALSXP : {
-      long long *lljcol = (long long *)REAL(jcol);
+      const long long *lljcol = (const long long *)REAL_RO(jcol);
       for (R_xlen_t i=1; i<nrow; i++) {
         bool same = lljcol[i]==lljcol[i-1];
         ians[i] = (grp+=!same);
       }
     } break;
     case CPLXSXP: {
-      Rcomplex *pzjcol = COMPLEX(jcol);
+      const Rcomplex *pzjcol = COMPLEX_RO(jcol);
       for (R_xlen_t i=1; i<nrow; i++) {
         bool same = memcmp(&pzjcol[i], &pzjcol[i-1], sizeof(Rcomplex))==0;
         ians[i] = (grp += !same);
diff --git a/src/utils.c b/src/utils.c
index 873a5b9bc3..854854bd11 100644
--- a/src/utils.c
+++ b/src/utils.c
@@ -161,7 +161,7 @@ SEXP colnamesInt(SEXP x, SEXP cols, SEXP check_dups, SEXP skip_absent) {
     if (isNull(xnames))
       error(_("'x' argument data.table has no names"));
     ricols = PROTECT(chmatch(cols, xnames, 0)); protecti++;
-    int *icols = INTEGER(ricols);
+    const int *icols = INTEGER_RO(ricols);
     if (!bskip_absent) {
       for (int i=0; i<nc; ++i) {
         if (icols[i]==0)
@@ -707,7 +707,7 @@ SEXP is_direct_child(SEXP pids) {
 #ifdef _WIN32
   internal_error(__func__, "not implemented on Windows");
 #else
-  int *ppids = INTEGER(pids);
+  const int *ppids = INTEGER_RO(pids);
   R_xlen_t len = xlength(pids);
   SEXP ret = allocVector(LGLSXP, len);
   int *pret = LOGICAL(ret);
diff --git a/src/wrappers.c b/src/wrappers.c
index fb6aa7f351..be41c791c3 100644
--- a/src/wrappers.c
+++ b/src/wrappers.c
@@ -50,7 +50,7 @@ SEXP setlevels(SEXP x, SEXP levels, SEXP ulevels) {
     SET_STRING_ELT(xchar, i, (ixi >= 1 && ixi <= nlevels) ? STRING_ELT(levels, ix[i]-1) : NA_STRING);
   }
   newx = PROTECT(chmatch(xchar, ulevels, NA_INTEGER));
-  int *inewx = INTEGER(newx);
+  const int *inewx = INTEGER_RO(newx);
   for (int i=0; i<nx; ++i) ix[i] = inewx[i];
   setAttrib(x, R_LevelsSymbol, ulevels);
   UNPROTECT(2);

From 5fe91981731136fa085553696a03ad602c47e62f Mon Sep 17 00:00:00 2001
From: Michael Chirico <chiricom@google.com>
Date: Wed, 21 Jan 2026 23:33:46 -0800
Subject: [PATCH 3/7] one more _RO

Co-authored-by: Benjamin Schwendinger <52290390+ben-schwen@users.noreply.github.com>
---
 src/bmerge.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/bmerge.c b/src/bmerge.c
index 832a958f90..fa631bcc63 100644
--- a/src/bmerge.c
+++ b/src/bmerge.c
@@ -356,7 +356,7 @@ void bmerge_r(int xlowIn, int xuppIn, int ilowIn, int iuppIn, int col, int thisg
 
   switch (TYPEOF(xc)) {
   case LGLSXP : case INTSXP : {  // including factors
-    const int *icv = isDataCol ? INTEGER(ic) : NULL;
+    const int *icv = isDataCol ? INTEGER_RO(ic) : NULL;
     const int *xcv = INTEGER_RO(xc);
     const int ival = isDataCol ? icv[ir] : thisgrp;
     #define ISNAT(x) ((x)==NA_INTEGER)

From 6dce9dfa724ec2d17e313ae0fa3c49d2b416810b Mon Sep 17 00:00:00 2001
From: Michael Chirico <chiricom@google.com>
Date: Fri, 23 Jan 2026 11:27:36 -0800
Subject: [PATCH 4/7] review suggestions

Co-authored-by: Benjamin Schwendinger <52290390+ben-schwen@users.noreply.github.com>
---
 src/fmelt.c    | 2 +-
 src/gsumm.c    | 7 ++++++-
 src/subset.c   | 2 +-
 src/uniqlist.c | 2 +-
 4 files changed, 9 insertions(+), 4 deletions(-)

diff --git a/src/fmelt.c b/src/fmelt.c
index a53aa25911..287ba4d0d4 100644
--- a/src/fmelt.c
+++ b/src/fmelt.c
@@ -522,7 +522,7 @@ SEXP getvaluecols(SEXP DT, SEXP dtnames, Rboolean valfactor, Rboolean verbose, s
         int thislen = 0;
         if (data->narm) {
           SEXP thisidx = VECTOR_ELT(data->not_NA_indices, j);
-          ithisidx = INTEGER(thisidx);
+          ithisidx = INTEGER_RO(thisidx);
           thislen = length(thisidx);
         }
         size_t size = RTYPE_SIZEOF(thiscol);
diff --git a/src/gsumm.c b/src/gsumm.c
index 9de8ce34f9..32c34b6375 100644
--- a/src/gsumm.c
+++ b/src/gsumm.c
@@ -1271,7 +1271,12 @@ SEXP gshift(SEXP x, SEXP nArg, SEXP fillArg, SEXP typeArg) {
       case INTSXP:  { int *ansd=INTEGER(tmp);             SHIFT(int,     INTEGER,   ansd[ansi++]=val); } break;
       case REALSXP: { double *ansd=REAL(tmp);             SHIFT(double,  REAL,      ansd[ansi++]=val); } break;
                     // integer64 is shifted as if it's REAL; and assigning fill=NA_INTEGER64 is ok as REAL
-      case CPLXSXP: { Rcomplex *ansd=COMPLEX(tmp);        SHIFT(Rcomplex, COMPLEX,  ansd[ansi++]=val); } break;
+case RAWSXP:  { Rbyte *ansd=RAW(tmp);               SHIFT(Rbyte,   RAW_RO,       ansd[ansi++]=val); } break;
+case LGLSXP:  { int *ansd=LOGICAL(tmp);             SHIFT(int,     LOGICAL_RO,   ansd[ansi++]=val); } break;
+case INTSXP:  { int *ansd=INTEGER(tmp);             SHIFT(int,     INTEGER_RO,   ansd[ansi++]=val); } break;
+case REALSXP: { double *ansd=REAL(tmp);             SHIFT(double,  REAL_RO,      ansd[ansi++]=val); } break;
+// integer64 is shifted as if it's REAL; and assigning fill=NA_INTEGER64 is ok as REAL
+case CPLXSXP: { Rcomplex *ansd=COMPLEX(tmp);        SHIFT(Rcomplex, COMPLEX_RO,  ansd[ansi++]=val); } break;
       case STRSXP: { SHIFT(SEXP, STRING_PTR_RO,                       SET_STRING_ELT(tmp,ansi++,val)); } break;
       //case VECSXP: { SHIFT(SEXP, SEXPPTR_RO,                          SET_VECTOR_ELT(tmp,ansi++,val)); } break;
       default:
diff --git a/src/subset.c b/src/subset.c
index 28e83d03ff..673ef80cbd 100644
--- a/src/subset.c
+++ b/src/subset.c
@@ -110,7 +110,7 @@ const char *check_idx(SEXP idx, int max, bool *anyNA_out, bool *orderedSubset_ou
   if (!isInteger(idx)) internal_error(__func__, "Argument '%s' to %s is type '%s' not '%s'", "idx", "check_idx", type2char(TYPEOF(idx)), "integer"); // # nocov
   bool anyLess=false, anyNA=false;
   int last = INT32_MIN;
-  int *idxp = INTEGER(idx), n=LENGTH(idx);
+  const int *idxp = INTEGER_RO(idx), n=LENGTH(idx);
   for (int i=0; i<n; i++) {
     int elem = idxp[i];
     if (elem<=0 && elem!=NA_INTEGER) return "Internal inefficiency: idx contains negatives or zeros. Should have been dealt with earlier.";  // e.g. test 762  (TODO-fix)
diff --git a/src/uniqlist.c b/src/uniqlist.c
index 246d3494d3..9f624c4fed 100644
--- a/src/uniqlist.c
+++ b/src/uniqlist.c
@@ -85,7 +85,7 @@ SEXP uniqlist(SEXP l, SEXP order)
           COMPARE1           COMPARE2
         }
       } else {
-        const double *vd=(const double *)REAL(v);
+        const double *vd=REAL_RO(v);
         double prev, elem;
         if (via_order) {
           COMPARE1_VIA_ORDER && dtwiddle(elem)!=dtwiddle(prev) COMPARE2

From fe92745840b66c9fcbc8efd5283a99a2613e15a7 Mon Sep 17 00:00:00 2001
From: Michael Chirico <chiricom@google.com>
Date: Fri, 23 Jan 2026 13:37:06 -0800
Subject: [PATCH 5/7] botched suggested change

---
 src/gsumm.c | 15 +++++----------
 1 file changed, 5 insertions(+), 10 deletions(-)

diff --git a/src/gsumm.c b/src/gsumm.c
index 32c34b6375..3a566ff689 100644
--- a/src/gsumm.c
+++ b/src/gsumm.c
@@ -1266,17 +1266,12 @@ SEXP gshift(SEXP x, SEXP nArg, SEXP fillArg, SEXP typeArg) {
       }                                                                                                           \
     }
     switch(TYPEOF(x)) {
-      case RAWSXP:  { Rbyte *ansd=RAW(tmp);               SHIFT(Rbyte,   RAW,       ansd[ansi++]=val); } break;
-      case LGLSXP:  { int *ansd=LOGICAL(tmp);             SHIFT(int,     LOGICAL,   ansd[ansi++]=val); } break;
-      case INTSXP:  { int *ansd=INTEGER(tmp);             SHIFT(int,     INTEGER,   ansd[ansi++]=val); } break;
-      case REALSXP: { double *ansd=REAL(tmp);             SHIFT(double,  REAL,      ansd[ansi++]=val); } break;
+      case RAWSXP:  { Rbyte *ansd=RAW(tmp);               SHIFT(Rbyte,   RAW_RO,       ansd[ansi++]=val); } break;
+      case LGLSXP:  { int *ansd=LOGICAL(tmp);             SHIFT(int,     LOGICAL_RO,   ansd[ansi++]=val); } break;
+      case INTSXP:  { int *ansd=INTEGER(tmp);             SHIFT(int,     INTEGER_RO,   ansd[ansi++]=val); } break;
+      case REALSXP: { double *ansd=REAL(tmp);             SHIFT(double,  REAL_RO,      ansd[ansi++]=val); } break;
                     // integer64 is shifted as if it's REAL; and assigning fill=NA_INTEGER64 is ok as REAL
-case RAWSXP:  { Rbyte *ansd=RAW(tmp);               SHIFT(Rbyte,   RAW_RO,       ansd[ansi++]=val); } break;
-case LGLSXP:  { int *ansd=LOGICAL(tmp);             SHIFT(int,     LOGICAL_RO,   ansd[ansi++]=val); } break;
-case INTSXP:  { int *ansd=INTEGER(tmp);             SHIFT(int,     INTEGER_RO,   ansd[ansi++]=val); } break;
-case REALSXP: { double *ansd=REAL(tmp);             SHIFT(double,  REAL_RO,      ansd[ansi++]=val); } break;
-// integer64 is shifted as if it's REAL; and assigning fill=NA_INTEGER64 is ok as REAL
-case CPLXSXP: { Rcomplex *ansd=COMPLEX(tmp);        SHIFT(Rcomplex, COMPLEX_RO,  ansd[ansi++]=val); } break;
+      case CPLXSXP: { Rcomplex *ansd=COMPLEX(tmp);        SHIFT(Rcomplex, COMPLEX_RO,  ansd[ansi++]=val); } break;
       case STRSXP: { SHIFT(SEXP, STRING_PTR_RO,                       SET_STRING_ELT(tmp,ansi++,val)); } break;
       //case VECSXP: { SHIFT(SEXP, SEXPPTR_RO,                          SET_VECTOR_ELT(tmp,ansi++,val)); } break;
       default:

From 9a58485344c8838ba30da7bc3efe9c056146c6c7 Mon Sep 17 00:00:00 2001
From: Ivan K <krylov.r00t@gmail.com>
Date: Sat, 24 Jan 2026 14:56:15 +0300
Subject: [PATCH 6/7] Use more read-only accessors

---
 src/bmerge.c  |  4 ++--
 src/cj.c      |  6 +++---
 src/fcast.c   |  6 +++---
 src/fifelse.c | 12 ++++++------
 src/freadR.c  |  6 +++---
 src/fsort.c   |  2 +-
 src/gsumm.c   | 10 +++++-----
 src/nafill.c  |  6 +++---
 src/shift.c   |  8 ++++----
 src/subset.c  |  2 +-
 10 files changed, 31 insertions(+), 31 deletions(-)

diff --git a/src/bmerge.c b/src/bmerge.c
index fa631bcc63..c222501756 100644
--- a/src/bmerge.c
+++ b/src/bmerge.c
@@ -56,8 +56,8 @@ SEXP bmerge(SEXP idt, SEXP xdt, SEXP icolsArg, SEXP xcolsArg, SEXP xoArg, SEXP r
   if ((LENGTH(icolsArg)==0 || LENGTH(xcolsArg)==0) && LENGTH(idt)>0) // We let through LENGTH(i) == 0 for tests 2126.*
     internal_error(__func__, "icols and xcols must be non-empty integer vectors");
   if (LENGTH(icolsArg) > LENGTH(xcolsArg)) internal_error(__func__, "length(icols) [%d] > length(xcols) [%d]", LENGTH(icolsArg), LENGTH(xcolsArg)); // # nocov
-  icols = INTEGER(icolsArg);
-  xcols = INTEGER(xcolsArg);
+  icols = INTEGER_RO(icolsArg);
+  xcols = INTEGER_RO(xcolsArg);
   xN = LENGTH(xdt) ? LENGTH(VECTOR_ELT(xdt,0)) : 0;
   iN = ilen = anslen = LENGTH(idt) ? LENGTH(VECTOR_ELT(idt,0)) : 0;
   ncol = LENGTH(icolsArg);    // there may be more sorted columns in x than involved in the join
diff --git a/src/cj.c b/src/cj.c
index 2d59d0511f..0125141a8f 100644
--- a/src/cj.c
+++ b/src/cj.c
@@ -25,7 +25,7 @@ SEXP cj(SEXP base_list)
     switch(TYPEOF(source)) {
     case LGLSXP:
     case INTSXP: {
-      const int *restrict sourceP = INTEGER(source);
+      const int *restrict sourceP = INTEGER_RO(source);
       int *restrict targetP = INTEGER(target);
       #pragma omp parallel for num_threads(getDTthreads(thislen*eachrep, true))
       // default static schedule so two threads won't write to same cache line in last column
@@ -41,7 +41,7 @@ SEXP cj(SEXP base_list)
       }
     } break;
     case REALSXP: {
-      const double *restrict sourceP = REAL(source);
+      const double *restrict sourceP = REAL_RO(source);
       double *restrict targetP = REAL(target);
       #pragma omp parallel for num_threads(getDTthreads(thislen*eachrep, true))
       for (int i = 0; i < thislen; i++) {
@@ -55,7 +55,7 @@ SEXP cj(SEXP base_list)
       }
     } break;
     case CPLXSXP: {
-      const Rcomplex *restrict sourceP = COMPLEX(source);
+      const Rcomplex *restrict sourceP = COMPLEX_RO(source);
       Rcomplex *restrict targetP = COMPLEX(target);
       #pragma omp parallel for num_threads(getDTthreads(thislen*eachrep, true))
       for (int i = 0; i < thislen; i++) {
diff --git a/src/fcast.c b/src/fcast.c
index 7d4c31cdb3..8b846d8401 100644
--- a/src/fcast.c
+++ b/src/fcast.c
@@ -39,7 +39,7 @@ SEXP fcast(SEXP lhs, SEXP val, SEXP nrowArg, SEXP ncolArg, SEXP idxArg, SEXP fil
     case LGLSXP: {
       const int *ithiscol = INTEGER_RO(thiscol);
       const int *ithisfill = NULL;
-      if (some_fill) ithisfill = INTEGER(thisfill);
+      if (some_fill) ithisfill = INTEGER_RO(thisfill);
       for (int j=0; j<ncols; ++j) {
         SET_VECTOR_ELT(ans, nlhs+j+i*ncols, target=allocVector(thistype, nrows) );
         int *itarget = INTEGER(target);
@@ -53,7 +53,7 @@ SEXP fcast(SEXP lhs, SEXP val, SEXP nrowArg, SEXP ncolArg, SEXP idxArg, SEXP fil
     case REALSXP: {
       const double *dthiscol = REAL_RO(thiscol);
       const double *dthisfill = NULL;
-      if (some_fill) dthisfill = REAL(thisfill);
+      if (some_fill) dthisfill = REAL_RO(thisfill);
       for (int j=0; j<ncols; ++j) {
         SET_VECTOR_ELT(ans, nlhs+j+i*ncols, target=allocVector(thistype, nrows) );
         double *dtarget = REAL(target);
@@ -67,7 +67,7 @@ SEXP fcast(SEXP lhs, SEXP val, SEXP nrowArg, SEXP ncolArg, SEXP idxArg, SEXP fil
     case CPLXSXP: {
       const Rcomplex *zthiscol = COMPLEX_RO(thiscol);
       const Rcomplex *zthisfill = NULL;
-      if (some_fill) zthisfill = COMPLEX(thisfill);
+      if (some_fill) zthisfill = COMPLEX_RO(thisfill);
       for (int j=0; j<ncols; ++j) {
         SET_VECTOR_ELT(ans, nlhs+j+i*ncols, target=allocVector(thistype, nrows) );
         Rcomplex *ztarget = COMPLEX(target);
diff --git a/src/fifelse.c b/src/fifelse.c
index d59fb4c60e..6d58c63bb8 100644
--- a/src/fifelse.c
+++ b/src/fifelse.c
@@ -96,7 +96,7 @@ SEXP fifelseR(SEXP l, SEXP a, SEXP b, SEXP na) {
   const int64_t bmask = len2>1 ? INT64_MAX : 0;
   const int64_t nmask = len3>1 ? INT64_MAX : 0;
 
-  const int *restrict pl = LOGICAL(l);
+  const int *restrict pl = LOGICAL_RO(l);
   SEXP ans = PROTECT(allocVector(tans, len0)); nprotect++;
   if (!na_a) 
     copyMostAttrib(a, ans);
@@ -237,7 +237,7 @@ SEXP fcaseR(SEXP rho, SEXP args) {
     if (!isLogical(whens)) {
       error(_("Argument #%d must be logical but was of type %s."), 2*i+1, type2char(TYPEOF(whens)));
     }
-    const int *restrict pwhens = LOGICAL(whens);
+    const int *restrict pwhens = LOGICAL_RO(whens);
     l = 0;
     if (i == 0) {
       n_ans = xlength(whens);
@@ -306,7 +306,7 @@ SEXP fcaseR(SEXP rho, SEXP args) {
     switch(TYPEOF(ans)) {
     case LGLSXP: {
       const int *restrict pthens;
-      if (!naout) pthens = LOGICAL(thens); // the content is not useful if out is NA_LOGICAL scalar
+      if (!naout) pthens = LOGICAL_RO(thens); // the content is not useful if out is NA_LOGICAL scalar
       int *restrict pans = LOGICAL(ans);
       const int pna = NA_LOGICAL;
       for (int64_t j=0; j<n_undecided; ++j) {
@@ -323,7 +323,7 @@ SEXP fcaseR(SEXP rho, SEXP args) {
     } break;
     case INTSXP: {
       const int *restrict pthens;
-      if (!naout) pthens = INTEGER(thens); // the content is not useful if out is NA_LOGICAL scalar
+      if (!naout) pthens = INTEGER_RO(thens); // the content is not useful if out is NA_LOGICAL scalar
       int *restrict pans = INTEGER(ans);
       const int pna = NA_INTEGER;
       for (int64_t j=0; j<n_undecided; ++j) {
@@ -340,7 +340,7 @@ SEXP fcaseR(SEXP rho, SEXP args) {
     } break;
     case REALSXP: {
       const double *restrict pthens;
-      if (!naout) pthens = REAL(thens); // the content is not useful if out is NA_LOGICAL scalar
+      if (!naout) pthens = REAL_RO(thens); // the content is not useful if out is NA_LOGICAL scalar
       double *restrict pans = REAL(ans);
       const double na_double = INHERITS(ans, char_integer64) ? NA_INT64_D : NA_REAL;
       const double pna = na_double;
@@ -358,7 +358,7 @@ SEXP fcaseR(SEXP rho, SEXP args) {
     } break;
     case CPLXSXP: {
       const Rcomplex *restrict pthens;
-      if (!naout) pthens = COMPLEX(thens); // the content is not useful if out is NA_LOGICAL scalar
+      if (!naout) pthens = COMPLEX_RO(thens); // the content is not useful if out is NA_LOGICAL scalar
       Rcomplex *restrict pans = COMPLEX(ans);
       const Rcomplex pna = NA_CPLX;
       for (int64_t j=0; j<n_undecided; ++j) {
diff --git a/src/freadR.c b/src/freadR.c
index 476d1e42ec..4041a8814b 100644
--- a/src/freadR.c
+++ b/src/freadR.c
@@ -235,7 +235,7 @@ static void applyDrop(SEXP items, int8_t *type, int ncol, int dropSource)
 {
   if (!length(items)) return;
   const SEXP itemsInt = PROTECT(isString(items) ? chmatch(items, colNamesSxp, NA_INTEGER) : coerceVector(items, INTSXP));
-  const int* const itemsD = INTEGER(itemsInt);
+  const int* const itemsD = INTEGER_RO(itemsInt);
   const int n = LENGTH(itemsInt);
   for (int j = 0; j < n; j++) {
     const int k = itemsD[j];
@@ -294,12 +294,12 @@ bool userOverride(int8_t *type, lenOff *colNames, const char *anchor, const int
   if (length(selectSxp)) {
     const int n = length(selectSxp);
     if (isString(selectSxp)) {
-      selectInts = INTEGER(PROTECT(chmatch(selectSxp, colNamesSxp, NA_INTEGER))); nprotect++;
+      selectInts = INTEGER_RO(PROTECT(chmatch(selectSxp, colNamesSxp, NA_INTEGER))); nprotect++;
       for (int i = 0; i < n; i++) if (selectInts[i] == NA_INTEGER)
         DTWARN(_("Column name '%s' not found in column name header (case sensitive), skipping."), CHAR(STRING_ELT(selectSxp, i)));
     } else {
       if (!isInteger(selectSxp)) { selectSxp = PROTECT(coerceVector(selectSxp, INTSXP)); nprotect++; }  // coerce numeric to int
-      selectInts = INTEGER(selectSxp);
+      selectInts = INTEGER_RO(selectSxp);
     }
     SET_VECTOR_ELT(RCHK, 3, selectRank = allocVector(INTSXP, ncol));
     int *selectRankD = INTEGER(selectRank), rank = 1;
diff --git a/src/fsort.c b/src/fsort.c
index f79bf72d07..2128868dc0 100644
--- a/src/fsort.c
+++ b/src/fsort.c
@@ -144,7 +144,7 @@ SEXP fsort(SEXP x, SEXP verboseArg) {
     free(mins); free(maxs); // # nocov
     error(_("Failed to allocate %d bytes in fsort()."), (int)(2 * nBatch * sizeof(double))); // # nocov
   }
-  const double *restrict xp = REAL(x);
+  const double *restrict xp = REAL_RO(x);
   #pragma omp parallel for schedule(dynamic) num_threads(getDTthreads(nBatch, false))
   for (int batch=0; batch<nBatch; ++batch) {
     uint64_t thisLen = (batch==nBatch-1) ? lastBatchSize : batchSize;
diff --git a/src/gsumm.c b/src/gsumm.c
index 3a566ff689..1f9ab65419 100644
--- a/src/gsumm.c
+++ b/src/gsumm.c
@@ -83,7 +83,7 @@ SEXP gforce(SEXP env, SEXP jsub, SEXP o, SEXP f, SEXP l, SEXP irowsArg) {
 
   grp = (int *)R_alloc(nrow, sizeof(*grp));   // TODO: use malloc and made this local as not needed globally when all functions here use gather
                                              // maybe better to malloc to avoid R's heap. This grp isn't global, so it doesn't need to be R_alloc
-  const int *restrict fp = INTEGER(f);
+  const int *restrict fp = INTEGER_RO(f);
 
   nBatch = MIN((nrow+1)/2, getDTthreads(nrow, true)*2);  // *2 to reduce last-thread-home. TODO: experiment. The higher this is though, the bigger is counts[]
   batchSize = MAX(1, (nrow-1)/nBatch);
@@ -112,7 +112,7 @@ SEXP gforce(SEXP env, SEXP jsub, SEXP o, SEXP f, SEXP l, SEXP irowsArg) {
     //  for (int j=0; j<grpsize[g]; j++)  grp[ elem[j]-1 ] = g;
     //}
 
-    const int *restrict op = INTEGER(o);  // o is a permutation of 1:nrow
+    const int *restrict op = INTEGER_RO(o);  // o is a permutation of 1:nrow
     int nb = nbit(nrow-1);
     int bitshift = MAX(nb-8, 0);  // TODO: experiment nb/2.  Here it doesn't have to be /2 currently.
     int highSize = ((nrow-1)>>bitshift) + 1;
@@ -224,7 +224,7 @@ void *gather(SEXP x, bool *anyNA)
   const bool verbose = GetVerbose();
   switch (TYPEOF(x)) {
   case LGLSXP: case INTSXP: {
-    const int *restrict thisx = INTEGER(x);
+    const int *restrict thisx = INTEGER_RO(x);
     #pragma omp parallel for num_threads(getDTthreads(nBatch, false))
     for (int b=0; b<nBatch; b++) {
       int *restrict my_tmpcounts = tmpcounts + omp_get_thread_num()*highSize;
@@ -253,7 +253,7 @@ void *gather(SEXP x, bool *anyNA)
   } break;
   case REALSXP: {
     if (!INHERITS(x, char_integer64)) {
-      const double *restrict thisx = REAL(x);
+      const double *restrict thisx = REAL_RO(x);
       #pragma omp parallel for num_threads(getDTthreads(nBatch, false))
       for (int b=0; b<nBatch; b++) {
         int *restrict my_tmpcounts = tmpcounts + omp_get_thread_num()*highSize;
@@ -309,7 +309,7 @@ void *gather(SEXP x, bool *anyNA)
     }
   } break;
   case CPLXSXP: {
-    const Rcomplex *restrict thisx = COMPLEX(x);
+    const Rcomplex *restrict thisx = COMPLEX_RO(x);
     #pragma omp parallel for num_threads(getDTthreads(nBatch, false))
     for (int b=0; b<nBatch; b++) {
       int *restrict my_tmpcounts = tmpcounts + omp_get_thread_num()*highSize;
diff --git a/src/nafill.c b/src/nafill.c
index fd67f11ac0..72ed178c7d 100644
--- a/src/nafill.c
+++ b/src/nafill.c
@@ -189,13 +189,13 @@ SEXP nafillR(SEXP obj, SEXP type, SEXP fill, SEXP nan_is_na_arg, SEXP inplace, S
       const void *p;
       switch (TYPEOF(ansi)) {
         case LGLSXP:
-          p = LOGICAL(ansi);
+          p = LOGICAL_RO(ansi);
           break;
         case INTSXP:
-          p = INTEGER(ansi);
+          p = INTEGER_RO(ansi);
           break;
         case REALSXP:
-          p = REAL(ansi);
+          p = REAL_RO(ansi);
           break;
         default:
           p = ansi;
diff --git a/src/shift.c b/src/shift.c
index 2c044e71cd..b834cf6c95 100644
--- a/src/shift.c
+++ b/src/shift.c
@@ -53,7 +53,7 @@ SEXP shift(SEXP obj, SEXP k, SEXP fill, SEXP type)
       for (int j=0; j<nk; j++) {
         SEXP tmp;
         SET_VECTOR_ELT(ans, i*nk+j, tmp=allocVector(TYPEOF(elem), xrows) );
-        const int *restrict ielem = INTEGER(elem);
+        const int *restrict ielem = INTEGER_RO(elem);
         int *restrict itmp = INTEGER(tmp);
         size_t thisk = cycle ? abs(kd[j]) % xrows : MIN(abs(kd[j]), xrows);
         size_t tailk = xrows-thisk;
@@ -79,7 +79,7 @@ SEXP shift(SEXP obj, SEXP k, SEXP fill, SEXP type)
       for (int j=0; j<nk; j++) {
         SEXP tmp;
         SET_VECTOR_ELT(ans, i*nk+j, tmp=allocVector(REALSXP, xrows) );
-        const double *restrict delem = REAL(elem);
+        const double *restrict delem = REAL_RO(elem);
         double *restrict dtmp = REAL(tmp);
         size_t thisk = cycle ? abs(kd[j]) % xrows : MIN(abs(kd[j]), xrows);
         size_t tailk = xrows-thisk;
@@ -102,7 +102,7 @@ SEXP shift(SEXP obj, SEXP k, SEXP fill, SEXP type)
       for (int j=0; j<nk; j++) {
         SEXP tmp;
         SET_VECTOR_ELT(ans, i*nk+j, tmp=allocVector(CPLXSXP, xrows) );
-        const Rcomplex *restrict celem = COMPLEX(elem);
+        const Rcomplex *restrict celem = COMPLEX_RO(elem);
         Rcomplex *restrict ctmp = COMPLEX(tmp);
         size_t thisk = cycle ? abs(kd[j]) % xrows : MIN(abs(kd[j]), xrows);
         size_t tailk = xrows-thisk;
@@ -155,7 +155,7 @@ SEXP shift(SEXP obj, SEXP k, SEXP fill, SEXP type)
       for (int j=0; j<nk; j++) {
         SEXP tmp;
         SET_VECTOR_ELT(ans, i*nk+j, tmp=allocVector(RAWSXP, xrows) );
-        const Rbyte *restrict delem = RAW(elem);
+        const Rbyte *restrict delem = RAW_RO(elem);
         Rbyte *restrict dtmp = RAW(tmp);
         size_t thisk = cycle ? abs(kd[j]) % xrows : MIN(abs(kd[j]), xrows);
         size_t tailk = xrows-thisk;
diff --git a/src/subset.c b/src/subset.c
index 673ef80cbd..d1381223b6 100644
--- a/src/subset.c
+++ b/src/subset.c
@@ -6,7 +6,7 @@ void subsetVectorRaw(SEXP ans, SEXP source, SEXP idx, const bool anyNA)
   const int n = length(idx);
   if (length(ans)!=n) internal_error(__func__, "length(ans)==%d n=%d", length(ans), n); // # nocov
 
-  const int *restrict idxp = INTEGER(idx);
+  const int *restrict idxp = INTEGER_RO(idx);
   // anyNA refers to NA _in idx_; if there's NA in the data (source) that's just regular data to be copied
   // negatives, zeros and out-of-bounds have already been dealt with in convertNegAndZero so we can rely
   // here on idx in range [1,length(ans)].

From 9b034c85f6cf6c2e2398e657e6feb37383307b10 Mon Sep 17 00:00:00 2001
From: Ivan K <krylov.r00t@gmail.com>
Date: Sat, 24 Jan 2026 15:24:55 +0300
Subject: [PATCH 7/7] gfirstlast: use _RO accessors

Keep the casts because they are currently necessary for the integer64 case.
---
 src/gsumm.c | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/src/gsumm.c b/src/gsumm.c
index 1f9ab65419..5051d72ca8 100644
--- a/src/gsumm.c
+++ b/src/gsumm.c
@@ -977,12 +977,12 @@ static SEXP gfirstlast(SEXP x, const bool first, const int w, const bool headw)
     }                                                                                              \
   }
   switch(TYPEOF(x)) {
-  case LGLSXP:  { int      *ansd=LOGICAL(ans); DO(int,      LOGICAL, NA_LOGICAL,   ansd[ansi++]=val) } break;
-  case INTSXP:  { int      *ansd=INTEGER(ans); DO(int,      INTEGER, NA_INTEGER,   ansd[ansi++]=val) } break;
+  case LGLSXP:  { int      *ansd=LOGICAL(ans); DO(int,      LOGICAL_RO, NA_LOGICAL,   ansd[ansi++]=val) } break;
+  case INTSXP:  { int      *ansd=INTEGER(ans); DO(int,      INTEGER_RO, NA_INTEGER,   ansd[ansi++]=val) } break;
   case REALSXP: if (INHERITS(x, char_integer64)) {
-           int64_t *ansd=(int64_t *)REAL(ans); DO(int64_t,  REAL,    NA_INTEGER64, ansd[ansi++]=val) }
-           else { double      *ansd=REAL(ans); DO(double,   REAL,    NA_REAL,      ansd[ansi++]=val) } break;
-  case CPLXSXP: { Rcomplex *ansd=COMPLEX(ans); DO(Rcomplex, COMPLEX, NA_CPLX,      ansd[ansi++]=val) } break;
+           int64_t *ansd=(int64_t *)REAL(ans); DO(int64_t,  REAL_RO,    NA_INTEGER64, ansd[ansi++]=val) }
+           else { double      *ansd=REAL(ans); DO(double,   REAL_RO,    NA_REAL,      ansd[ansi++]=val) } break;
+  case CPLXSXP: { Rcomplex *ansd=COMPLEX(ans); DO(Rcomplex, COMPLEX_RO, NA_CPLX,      ansd[ansi++]=val) } break;
   case STRSXP:  DO(SEXP, STRING_PTR_RO, NA_STRING,              SET_STRING_ELT(ans,ansi++,val))        break;
   case VECSXP:  DO(SEXP, SEXPPTR_RO, ScalarLogical(NA_LOGICAL), SET_VECTOR_ELT(ans,ansi++,val))        break;
   default: