protect module method and function results while wrapping in invoke (#1494)

* protect module method and function results while wrapping in invoke
* narrow gctorture scope in module regression test

Author: kevinushey

ChangeLog

@@ -1,3 +1,12 @@
+2026-08-03  Kevin Ushey  <kevinushey@gmail.com>
+
+	* inst/include/Rcpp/module/class.h (invoke): Protect freshly
+	computed method results while wrapping them in the result list
+	(#1493)
+	* inst/include/Rcpp/module/Module.h (invoke): Idem for module
+	function results
+	* inst/tinytest/cpp/Module.cpp: Add regression test
+	* inst/tinytest/test_module.R: Idem
 2026-08-03  Kevin Ushey <kevinushey@gmail.com>
 
 	* inst/include/Rcpp/api/meat/proxy.h: Protect fresh SEXPs returned

inst/include/Rcpp/module/Module.h

@@ -60,8 +60,9 @@ namespace Rcpp {
                 throw std::range_error( "incorrect number of arguments" ) ;
             }
 
+            Shield<SEXP> res( fun->operator()( args ) ) ;
             return List::create(
-                _["result"] = fun->operator()( args ),
+                _["result"] = static_cast<SEXP>(res),
                 _["void"]   = fun->is_void()
             ) ;
         }

inst/include/Rcpp/module/class.h

@@ -193,7 +193,8 @@
                 m->operator()( XP(object), args );
                 return Rcpp::List::create( true ) ;
             } else {
-                return Rcpp::List::create( false, m->operator()( XP(object), args ) ) ;
+                Shield<SEXP> res( m->operator()( XP(object), args ) ) ;
+                return Rcpp::List::create( false, static_cast<SEXP>(res) ) ;
             }
             END_RCPP
                 }

inst/tinytest/cpp/Module.cpp

@@ -136,6 +136,27 @@ double Test_get_x_pointer(ModuleTest* x) {
     return x->value;
 }
 
+class ModuleGadget {
+public:
+    ModuleGadget() {}
+
+    // void overload: forces dispatch through class_::invoke(), which
+    // wraps method results as list(voidness, result)
+    void value(int x) {
+        (void) x;
+    }
+
+    // non-void overload: nothing protects the raw SEXP result while
+    // class_::invoke() allocates the result list
+    SEXP value() {
+        SEXP x = Rf_allocVector(REALSXP, 3);
+        REAL(x)[0] = 1;
+        REAL(x)[1] = 2;
+        REAL(x)[2] = 3;
+        return x;
+    }
+};
+
 RCPP_MODULE(demoModule) {
     function("hello", &hello);
     function("bar"  , &bar  );
@@ -194,6 +215,12 @@ RCPP_MODULE(demoModule) {
 
         .method("get" , &ModuleRandomizer::get)
         ;
+
+    class_<ModuleGadget>("ModuleGadget")
+        .constructor()
+        .method("value", static_cast<void (ModuleGadget::*)(int)>(&ModuleGadget::value))
+        .method("value", static_cast<SEXP (ModuleGadget::*)()>(&ModuleGadget::value))
+        ;
 }
 
 // [[Rcpp::export]]

inst/tinytest/test_module.R

@@ -106,3 +106,14 @@ expect_equal(r$get(10), x10)
 expect_equal( test_reference( seq(0,10) ), 11L )
 expect_equal( test_const_reference( seq(0,10) ), 11L )
 expect_equal( test_const( seq(0,10) ), 11L )
+
+## mixed-voidness method overloads dispatch through class_::invoke(),
+## which must protect the freshly allocated method result while it
+## wraps it in the result list (#1493); under gctorture every
+## allocation triggers a collection, so a single call exercises the
+## unprotected window deterministically
+gadget <- new( ModuleGadget )
+gctorture(TRUE)
+res <- gadget$value()
+gctorture(FALSE)
+expect_identical( res, c(1, 2, 3) )