[Rd] Rubbish values written with zero-length vectors (PR#14217)

[Seth Falcon]

On 2/20/10 7:50 AM, Peter Dalgaard wrote:
> You don't want to understand, believe me! ;-)
> 
> It's a bug, probably not the very worst kind, but accessing memory that
> isn't yours is potentially harmful (but writing to it is considerably
> worse).
> 
> Looks like the issue only concerns the right hand side; nothing to do
> with the auto-expansion of v. I also get
> 
>> v <- integer(0)
>> u <- integer(1)
>> u[[2]] <-v
>> u
> [1]         0 142000760
>> u[[1]] <-v
>> u
> [1] 142000760 142000760
>> a <- 1
>> a[[1]] <-v
>> a
> [1] 142000760

I'm thinking this should be an error.  Similar to:

> v = 1
> v[[1]] = integer(3)
Error in v[[1]] = integer(3) :
  more elements supplied than there are to replace

But instead not enough elements supplied.  Perhaps:

> v[[1]] = integer()
Error in v[[1]] = integer() : [[ ]] replacement has zero length

The code in do_subassign2_dflt currently does not check that the
replacement has length > 0 for the nsubs == 1 case.  I think we want:


@@ -1529,6 +1532,8 @@ do_subassign2_dflt(SEXP call, SEXP op, SEXP args,
SEXP rho)
        if (nsubs == 0 || CAR(subs) == R_MissingArg)
            error(_("[[ ]] with missing subscript"));
        if (nsubs == 1) {
+            if (length(y) == 0)
+                error(_("[[ ]] replacement has zero length"));
            offset = OneIndex(x, thesub, length(x), 0, &newname,
recursed ? len-1 : -1, R_NilValue);
            if (isVectorList(x) && isNull(y)) {
                x = DeleteOneVectorListItem(x, offset);


+ seth