[Rd] segfault in plot(x, y, col = aFactor) (PR#9221)

[Prof Brian Ripley]

valgrind solves this:

> plot(x, y, col = aFactor)
==10339== Invalid write of size 4
==10339==    at 0x4F70CE: Rf_FixupCol (plot.c:354)
==10339==    by 0x4FC124: do_plot_xy (plot.c:1554)
==10339==    by 0x4D75DC: do_internal (names.c:1094)
==10339==    by 0x499C05: Rf_eval (eval.c:431)
==10339==    by 0x49A365: Rf_applyClosure (eval.c:614)
==10339==    by 0x499E1F: Rf_eval (eval.c:455)
==10339==    by 0x49B869: do_begin (eval.c:1107)
==10339==    by 0x499C05: Rf_eval (eval.c:431)
==10339==    by 0x49A365: Rf_applyClosure (eval.c:614)
==10339==    by 0x4D7B47: applyMethod (objects.c:121)
==10339==    by 0x4D8505: Rf_usemethod (objects.c:307)
==10339==    by 0x4D8825: do_usemethod (objects.c:391)
==10339==  Address 0x9898130 is 224 bytes inside a block of size 2,440 free'd
==10339==    at 0x49057C8: free (vg_replace_malloc.c:233)

It needs protection in FixupCol because warning() allocates.

On Tue, 12 Sep 2006, maechler at stat.math.ethz.ch wrote:

> Thank you, Bjørn-Helge.
> A shorter version is
>    plot(1:500, col = gl(2,250))
> 
> Interestingly, with much shorter vectors of length (n), the correct warning
> is produced (n times).
> And once that has happened, you can use longer vectors without
> any problem.
> 
> As you said  ``issued just after starting R''
> seems quite relevant.
> 
> When run in 'R -d gdb', the backtrace ("bt") seems to indicate
> that the problem is happening during the  (C-level) warning() call.
> 
> Martin
> 
> ______________________________________________
> R-devel at r-project.org mailing list
> https://stat.ethz.ch/mailman/listinfo/r-devel
> 

-- 
Brian D. Ripley,                  ripley at stats.ox.ac.uk
Professor of Applied Statistics,  http://www.stats.ox.ac.uk/~ripley/
University of Oxford,             Tel:  +44 1865 272861 (self)
1 South Parks Road,                     +44 1865 272866 (PA)
Oxford OX1 3TG, UK                Fax:  +44 1865 272595