R devel - Oct 2017 - Using response variable in interaction as explanatory variable in glm crashes R

The following code crashes R (I know I shouldn't try to estimate such a 
model; this was a bug in some code of mine). I also tried with R-devel; 
same result.


tab <- structure(list(dob_day = c(FALSE, FALSE, FALSE, FALSE, TRUE,
TRUE, TRUE, TRUE), dob_mon = c(FALSE, FALSE, TRUE, TRUE, FALSE,
FALSE, TRUE, TRUE), dob_year = c(FALSE, TRUE, FALSE, TRUE, FALSE,
TRUE, FALSE, TRUE), n = c(1489634L, 17491L, 134985L, 1639L, 47892L,
611L, 4365L, 750L), pred1 = c(1488301, 18187, 135605, 1657, 48547,
593, 4423, 54)), .Names = c("dob_day", "dob_mon",
"dob_year",
"n", "pred1"), row.names = c(NA, -8L), class =
"data.frame")

m <- glm(dob_mon ~ dob_day*dob_mon, data = tab, family = binomial())


The crash doesn't when the variables are added just as main effects 
(dob_day+dob_mon): this results in a warning and the removal of dob_mon 
from the formula.

--

Jan



 > R.version
 ?????????????? _
platform?????? x86_64-pc-linux-gnu
arch?????????? x86_64
os???????????? linux-gnu
system???????? x86_64, linux-gnu
status
major????????? 3
minor????????? 4.1
year?????????? 2017
month????????? 06
day??????????? 30
svn rev??????? 72865
language?????? R
version.string R version 3.4.1 (2017-06-30)
nickname?????? Single Candle

It is actually model.matrix that crashes, not glm. Same crash occurs 
with e.g. lm.

model.matrix(dob_mon ~ dob_day*dob_mon, data = tab)

also crashes R.

Jan



On 06-10-17 12:08, Jan van der Laan wrote:
>
> The following code crashes R (I know I shouldn't try to estimate such 
> a model; this was a bug in some code of mine). I also tried with 
> R-devel; same result.
>
>
> tab <- structure(list(dob_day = c(FALSE, FALSE, FALSE, FALSE, TRUE,
> TRUE, TRUE, TRUE), dob_mon = c(FALSE, FALSE, TRUE, TRUE, FALSE,
> FALSE, TRUE, TRUE), dob_year = c(FALSE, TRUE, FALSE, TRUE, FALSE,
> TRUE, FALSE, TRUE), n = c(1489634L, 17491L, 134985L, 1639L, 47892L,
> 611L, 4365L, 750L), pred1 = c(1488301, 18187, 135605, 1657, 48547,
> 593, 4423, 54)), .Names = c("dob_day", "dob_mon",
"dob_year",
> "n", "pred1"), row.names = c(NA, -8L), class =
"data.frame")
>
> m <- glm(dob_mon ~ dob_day*dob_mon, data = tab, family = binomial())
>
>
> The crash doesn't when the variables are added just as main effects 
> (dob_day+dob_mon): this results in a warning and the removal of 
> dob_mon from the formula.
>
> -- 
>
> Jan
>
>
>
> > R.version
> ?????????????? _
> platform?????? x86_64-pc-linux-gnu
> arch?????????? x86_64
> os???????????? linux-gnu
> system???????? x86_64, linux-gnu
> status
> major????????? 3
> minor????????? 4.1
> year?????????? 2017
> month????????? 06
> day??????????? 30
> svn rev??????? 72865
> language?????? R
> version.string R version 3.4.1 (2017-06-30)
> nickname?????? Single Candle
>
> ______________________________________________
> R-devel at r-project.org mailing list
> https://stat.ethz.ch/mailman/listinfo/r-devel

>>>>> Jan van der Laan <rhelp at eoos.dds.nl>
>>>>>     on Fri, 6 Oct 2017 12:13:39 +0200 writes:
    > It is actually model.matrix that crashes, not glm. Same
    > crash occurs with e.g. lm.

    > model.matrix(dob_mon ~ dob_day*dob_mon, data = tab)

    > also crashes R.

Yes, segmentation fault.

It only happens when these are *logical* variables, not, e.g., when
transformed to integer.

The C code in src/library/stats/src/model.c  tries to eliminate
occurances of the LHS of the formula from the RHS when building
the model matrix and it does work fine in the integer case.

Part of the culprit code may be this (from line 717),
with the  isLogical(.) which in our case, shifts the pointer by
1  in the call to firstfactor() :

			int adj = isLogical(var_i)?1:0;
			// avoid overflow of jstart * nn PR#15578
			firstfactor(&rx[jstart * nn], n, jnext - jstart,
				    REAL(contrast), nrows(contrast),
				    ncols(contrast), INTEGER(var_i)+adj);

then in firstfactor(), we see the segfault (when running R with
'-d gdb') :

    > model.matrix(dob_mon ~ dob_day*dob_mon, data = tab)

  Program received signal SIGSEGV, Segmentation fault.
  0x00007fffeafa76b5 in firstfactor (ncx=0, v=0x5c3b37c, ncc=1, nrc=2,
c=0x5c90008,
   nrx=8, x=0x5cbf150) at ../../../../../R/src/library/stats/src/model.c:252
    252		    else xj[i] = cj[v[i]-1];
    Missing separate debuginfos, .................
    (gdb) list
    247	    for (int j = 0; j < ncc; j++) {
    248		xj = &x[j * (R_xlen_t)nrx];
    249		cj = &c[j * (R_xlen_t)nrc];
    250		for (int i = 0; i < nrx; i++)
    251		    if(v[i] == NA_INTEGER) xj[i] = NA_REAL;
    252		    else xj[i] = cj[v[i]-1];
    253	    }
    254	}
    255	

and indeed in the debugger,  i=7  and  v[i] is "outside", v[]
being of length 7, hence indexed 0:6.


    > Jan



    > On 06-10-17 12:08, Jan van der Laan wrote:
    >> 
    >> The following code crashes R (I know I shouldn't try to
    >> estimate such a model; this was a bug in some code of
    >> mine). I also tried with R-devel; same result.
    >> 
    >> 
    >> tab <- structure(list(dob_day = c(FALSE, FALSE, FALSE,
    >> FALSE, TRUE, TRUE, TRUE, TRUE), dob_mon = c(FALSE, FALSE,
    >> TRUE, TRUE, FALSE, FALSE, TRUE, TRUE), dob_year     >>
c(FALSE, TRUE, FALSE, TRUE, FALSE, TRUE, FALSE, TRUE), n
    >> = c(1489634L, 17491L, 134985L, 1639L, 47892L, 611L,
    >> 4365L, 750L), pred1 = c(1488301, 18187, 135605, 1657,
    >> 48547, 593, 4423, 54)), .Names = c("dob_day",
"dob_mon",
    >> "dob_year", "n", "pred1"), row.names
= c(NA, -8L), class
    >> = "data.frame")
    >> 
    >> m <- glm(dob_mon ~ dob_day*dob_mon, data = tab, family    
>> binomial())
    >> 
    >> 
    >> The crash doesn't when the variables are added just as
    >> main effects (dob_day+dob_mon): this results in a warning
    >> and the removal of dob_mon from the formula.
    >> 
    >> -- 
    >> 
    >> Jan
    >> 
    >> 
    >> 
    >> > R.version ?????????????? _ platform??????
    >> x86_64-pc-linux-gnu arch?????????? x86_64 os????????????
    >> linux-gnu system???????? x86_64, linux-gnu status
    >> major????????? 3 minor????????? 4.1 year?????????? 2017
    >> month????????? 06 day??????????? 30 svn rev??????? 72865
    >> language?????? R version.string R version 3.4.1
    >> (2017-06-30) nickname?????? Single Candle
    >> 
    >> ______________________________________________
    >> R-devel at r-project.org mailing list
    >> https://stat.ethz.ch/mailman/listinfo/r-devel

    > ______________________________________________
    > R-devel at r-project.org mailing list
    > https://stat.ethz.ch/mailman/listinfo/r-devel