[Rd] dput function (PR#12112)

[Bill Dunlap]

On Thu, 7 Aug 2008 juangea at geax.net wrote:

> Full_Name: Juan Gea
> Version: R version 2.6.2
> OS: Fedora Core 6
> Submission from: (NULL) (79.153.48.49)
>
> Abort:
>
> objeS  <- matrix("AAA",1000000)
> class(objeS)
> outTxt <- textConnection("vaClob", open = "w", local = FALSE)
> dput(objeS,outTxt)
> close(outTxt)
>
>
> R version 2.6.2 (2008-02-08)
> ...
> > objeS  <- matrix("AAA",1000000)
> > class(objeS)
> [1] "matrix"
> > outTxt <- textConnection("vaClob", open = "w", local = FALSE)
> > dput(objeS,outTxt)
>
>  *** caught segfault ***
> address 0xb7803934, cause 'memory not mapped'
>
> Traceback:
>  1: dput(objeS, outTxt)

Does the following solve the problem?  valgrind on R 2.8.0 finds
deparse.c:do_dput() reading from freed memory, tval, the output
of deparse1(), right after a call to Rconn_printf() invokes the
garbage collector and frees tval.

It is taking a long time to run the example under valgrind
after the fix, but I think it has gotten past the original error.

Index: src/main/deparse.c
===================================================================
--- src/main/deparse.c	(revision 46243)
+++ src/main/deparse.c	(working copy)
@@ -284,7 +284,7 @@
     if(!isNull(CADDR(args)))
 	opts = asInteger(CADDR(args));

-    tval = deparse1(tval, 0, opts);
+    PROTECT(tval = deparse1(tval, 0, opts));
     if (TYPEOF(CAR(args)) == CLOSXP) {
 	SET_CLOENV(CAR(args), saveenv);
 	UNPROTECT(1);
@@ -313,6 +313,7 @@
 	       res < strlen(CHAR(STRING_ELT(tval, i))) + 1)
 		warning(_("wrote too few characters"));
 	}
+    UNPROTECT(1) ; /* tval */
     if (!wasopen) con->close(con);
     return (CAR(args));
 }

The valgrind session was:
  > objeS  <- matrix("AAA",1000000)
  >  class(objeS)
  [1] "matrix"
  > outTxt <- textConnection("vaClob", open = "w", local = FALSE)
  > dput(objeS,outTxt)
  ==32381== Invalid read of size 4
  ==32381==    at 0x813917E: do_dput (deparse.c:312)
  ==32381==    by 0x8065454: do_internal (names.c:1138)
  ==32381==    by 0x8160557: Rf_eval (eval.c:461)
  ==32381==    by 0x8160557: Rf_eval (eval.c:461)
  ==32381==    by 0x8162267: do_begin (eval.c:1174)
  ==32381==    by 0x8160557: Rf_eval (eval.c:461)
  ==32381==    by 0x81636D0: Rf_applyClosure (eval.c:667)
  ==32381==    by 0x816048F: Rf_eval (eval.c:505)
  ==32381==    by 0x8058033: Rf_ReplIteration (main.c:257)
  ==32381==    by 0x805825E: R_ReplConsole (main.c:306)
  ==32381==    by 0x80584F4: run_Rmainloop (main.c:966)
  ==32381==    by 0x805674D: main (Rmain.c:33)
  ==32381==  Address 0x59B9B58 is 2,864 bytes inside a block of size 444,472 free'd
  ==32381==    at 0x40052A3: free (vg_replace_malloc.c:233)
  ==32381==    by 0x805ACFD: R_gc_internal (memory.c:767)
  ==32381==    by 0x805BA4A: Rf_allocVector (memory.c:1971)
  ==32381==    by 0x810C45C: Rf_lengthgets (builtin.c:746)
  ==32381==    by 0x8123B0D: text_vfprintf (connections.c:2303)
  ==32381==    by 0x8127147: Rconn_printf (connections.c:2868)
  ==32381==    by 0x813917D: do_dput (deparse.c:311)
  ==32381==    by 0x8065454: do_internal (names.c:1138)
  ==32381==    by 0x8160557: Rf_eval (eval.c:461)
  ==32381==    by 0x8160557: Rf_eval (eval.c:461)
  ==32381==    by 0x8162267: do_begin (eval.c:1174)
  ==32381==    by 0x8160557: Rf_eval (eval.c:461)

----------------------------------------------------------------------------
Bill Dunlap
Insightful Corporation
bill at insightful dot com
360-428-8146

 "All statements in this message represent the opinions of the author and do
 not necessarily reflect Insightful Corporation policy or position."