Re: [Rd] dput function (PR#12112)

From: Prof Brian Ripley <ripley_at_stats.ox.ac.uk>
Date: Thu, 07 Aug 2008 20:55:44 +0100 (BST)

Bill,

Thanks. Whether or not it is the cause here it should clearly be PROTECT-ed (I suspect the original version didn't need to be, but leaving PROTECTs off is prejudicial to future maintenance), so I've incorporated this in R-devel/R-patched.

Brian

On Thu, 7 Aug 2008, Bill Dunlap wrote:

> On Thu, 7 Aug 2008 juangea@geax.net wrote:
>
>> Full_Name: Juan Gea
>> Version: R version 2.6.2
>> OS: Fedora Core 6
>> Submission from: (NULL) (79.153.48.49)
>>
>> Abort:
>>
>> objeS <- matrix("AAA",1000000)
>> class(objeS)
>> outTxt <- textConnection("vaClob", open = "w", local = FALSE)
>> dput(objeS,outTxt)
>> close(outTxt)
>>
>>
>> R version 2.6.2 (2008-02-08)
>> ...
>>> objeS <- matrix("AAA",1000000)
>>> class(objeS)
>> [1] "matrix"
>>> outTxt <- textConnection("vaClob", open = "w", local = FALSE)
>>> dput(objeS,outTxt)
>>
>> *** caught segfault ***
>> address 0xb7803934, cause 'memory not mapped'
>>
>> Traceback:
>> 1: dput(objeS, outTxt)
>
> Does the following solve the problem? valgrind on R 2.8.0 finds
> deparse.c:do_dput() reading from freed memory, tval, the output
> of deparse1(), right after a call to Rconn_printf() invokes the
> garbage collector and frees tval.
>
> It is taking a long time to run the example under valgrind
> after the fix, but I think it has gotten past the original error.
>
> Index: src/main/deparse.c
> ===================================================================
> --- src/main/deparse.c (revision 46243)
> +++ src/main/deparse.c (working copy)
> @@ -284,7 +284,7 @@
> if(!isNull(CADDR(args)))
> opts = asInteger(CADDR(args));
>
> - tval = deparse1(tval, 0, opts);
> + PROTECT(tval = deparse1(tval, 0, opts));
> if (TYPEOF(CAR(args)) == CLOSXP) {
> SET_CLOENV(CAR(args), saveenv);
> UNPROTECT(1);
> @@ -313,6 +313,7 @@
> res < strlen(CHAR(STRING_ELT(tval, i))) + 1)
> warning(_("wrote too few characters"));
> }
> + UNPROTECT(1) ; /* tval */
> if (!wasopen) con->close(con);
> return (CAR(args));
> }
>
> The valgrind session was:
> > objeS <- matrix("AAA",1000000)
> > class(objeS)
> [1] "matrix"
> > outTxt <- textConnection("vaClob", open = "w", local = FALSE)
> > dput(objeS,outTxt)
> ==32381== Invalid read of size 4
> ==32381== at 0x813917E: do_dput (deparse.c:312)
> ==32381== by 0x8065454: do_internal (names.c:1138)
> ==32381== by 0x8160557: Rf_eval (eval.c:461)
> ==32381== by 0x8160557: Rf_eval (eval.c:461)
> ==32381== by 0x8162267: do_begin (eval.c:1174)
> ==32381== by 0x8160557: Rf_eval (eval.c:461)
> ==32381== by 0x81636D0: Rf_applyClosure (eval.c:667)
> ==32381== by 0x816048F: Rf_eval (eval.c:505)
> ==32381== by 0x8058033: Rf_ReplIteration (main.c:257)
> ==32381== by 0x805825E: R_ReplConsole (main.c:306)
> ==32381== by 0x80584F4: run_Rmainloop (main.c:966)
> ==32381== by 0x805674D: main (Rmain.c:33)
> ==32381== Address 0x59B9B58 is 2,864 bytes inside a block of size 444,472 free'd
> ==32381== at 0x40052A3: free (vg_replace_malloc.c:233)
> ==32381== by 0x805ACFD: R_gc_internal (memory.c:767)
> ==32381== by 0x805BA4A: Rf_allocVector (memory.c:1971)
> ==32381== by 0x810C45C: Rf_lengthgets (builtin.c:746)
> ==32381== by 0x8123B0D: text_vfprintf (connections.c:2303)
> ==32381== by 0x8127147: Rconn_printf (connections.c:2868)
> ==32381== by 0x813917D: do_dput (deparse.c:311)
> ==32381== by 0x8065454: do_internal (names.c:1138)
> ==32381== by 0x8160557: Rf_eval (eval.c:461)
> ==32381== by 0x8160557: Rf_eval (eval.c:461)
> ==32381== by 0x8162267: do_begin (eval.c:1174)
> ==32381== by 0x8160557: Rf_eval (eval.c:461)
>
> ----------------------------------------------------------------------------
> Bill Dunlap
> Insightful Corporation
> bill at insightful dot com
> 360-428-8146
>
> "All statements in this message represent the opinions of the author and do
> not necessarily reflect Insightful Corporation policy or position."
>
> ______________________________________________
> R-devel_at_r-project.org mailing list
> https://stat.ethz.ch/mailman/listinfo/r-devel
>

-- 
Brian D. Ripley,                  ripley_at_stats.ox.ac.uk
Professor of Applied Statistics,  http://www.stats.ox.ac.uk/~ripley/
University of Oxford,             Tel:  +44 1865 272861 (self)
1 South Parks Road,                     +44 1865 272866 (PA)
Oxford OX1 3TG, UK                Fax:  +44 1865 272595

______________________________________________
R-devel_at_r-project.org mailing list
https://stat.ethz.ch/mailman/listinfo/r-devel
Received on Thu 07 Aug 2008 - 20:05:27 GMT

Archive maintained by Robert King, hosted by the discipline of statistics at the University of Newcastle, Australia.
Archive generated by hypermail 2.2.0, at Thu 07 Aug 2008 - 22:36:12 GMT.

Mailing list information is available at https://stat.ethz.ch/mailman/listinfo/r-devel. Please read the posting guide before posting to the list.

list of date sections of archive