R devel - Jul 2019 - Potential bug with data.frame replacement

Dear R-devel,

I have encountered a crash-inducing scenario and would like to enquire as to
whether this would be considered a bug. To reproduce the crash:

X <- sample(letters, 3000, TRUE)
D <- data.frame(X, 1:3000, X, X, X, X, X)
D$X1.3000 <- paste0("GSM", D)

The reason why I'm not sure if this would be considered a bug is because I
typed this by accident, when what I meant was:

D$X1.3000 <- paste0("GSM", D$X1.3000)

I can never image a scenario where I would intentionally perform the former.

This issue seems to have something to do with the size of the data.frame, as
smaller examples will work fine:

D <- data.frame(A = 1:10, B = letters[1:10])
D$A <- paste0("A", D)

Also just doing the paste0 part without trying to replace a data.frame column
not crash R for me.

I can submit this on Bugzilla should this be deemed sufficiently buggy.

I am running 3.6.0 on macOS (x86_64-apple-darwin15.6.0).

Sincerely,

B.T.

This may be related to the size of the deparsed call in the error message
that Brodie and Luke were discussing recently on R-devel (" Mitigating
Stalls Caused by Call Deparse on Error").   I don't get a crash, but
the
error message itself doesn't show up after the deparsed call.
> X <- sample(letters, 3000, TRUE)
> D <- data.frame(X, 1:3000, X, X, X, X, X)
> D$X1.3000 <- paste0("GSM", D)
Error in `$<-.data.frame`(`*tmp*`, X1.3000, value = c("GSMc(16, 6, 11,
1,
13, 7,
... many lines elided ...
 24, 24, 9, 7, 10, 17, 17, 6, 26, 26, 19, 11, 15, \n12, 9, 25, 17, 21, 24,
12, 14, 21, 23, 11, 7, 8, 11, 7, 10,
> # Note the message part of the error message was not printed
> # Use tryCatch to get the details
> e <- tryCatch(D$X1.3000 <- paste0("GSM", D),
error=function(e)e)
> str(e)
List of 2
 $ message: chr "replacement has 7 rows, data has 3000"
 $ call   : language `$<-.data.frame`(`*tmp*`, X1.3000, value =
c("GSMc(23,
10, 2, 9, 4, 3, 16, 12, 21, 26, 3, 17, 6, 25, 8, 1, 17, 10| __truncated__
...
 - attr(*, "class")= chr [1:3] "simpleError"
"error" "condition"
> nchar(deparse(e$call))
[1] 11068 11036 11023 11023 11023 11021     2


Bill Dunlap
TIBCO Software
wdunlap tibco.com


On Mon, Jul 15, 2019 at 3:25 AM Benjamin Jean-Marie Tremblay <
b2tremblay at uwaterloo.ca> wrote:
>
> Dear R-devel,
>
> I have encountered a crash-inducing scenario and would like to enquire as
to
> whether this would be considered a bug. To reproduce the crash:
>
> X <- sample(letters, 3000, TRUE)
> D <- data.frame(X, 1:3000, X, X, X, X, X)
> D$X1.3000 <- paste0("GSM", D)
>
> The reason why I'm not sure if this would be considered a bug is
because I
> typed this by accident, when what I meant was:
>
> D$X1.3000 <- paste0("GSM", D$X1.3000)
>
> I can never image a scenario where I would intentionally perform the
former.
>
> This issue seems to have something to do with the size of the data.frame,
as
> smaller examples will work fine:
>
> D <- data.frame(A = 1:10, B = letters[1:10])
> D$A <- paste0("A", D)
>
> Also just doing the paste0 part without trying to replace a data.frame
column
> not crash R for me.
>
> I can submit this on Bugzilla should this be deemed sufficiently buggy.
>
> I am running 3.6.0 on macOS (x86_64-apple-darwin15.6.0).
>
> Sincerely,
>
> B.T.
>
> ______________________________________________
> R-devel at r-project.org mailing list
> https://stat.ethz.ch/mailman/listinfo/r-devel
	[[alternative HTML version deleted]]

On Mon, 15 Jul 2019 at 18:55, William Dunlap via R-devel
<r-devel at r-project.org> wrote:
>
> This may be related to the size of the deparsed call in the error message
> that Brodie and Luke were discussing recently on R-devel (" Mitigating
> Stalls Caused by Call Deparse on Error").   I don't get a crash,
but the
> error message itself doesn't show up after the deparsed call.
The example crashes with a buffer overflow in systems with
FORTIFY_SOURCE=2 (i.e., official R package in most Linux
distributions).

I?aki

Thanks for the report. The buffer overflow should be fixed in
R-patched and R-devel.

Best,

luke

On Sun, 14 Jul 2019, Benjamin Jean-Marie Tremblay wrote:
> Dear R-devel,
>
> I have encountered a crash-inducing scenario and would like to enquire as
to
> whether this would be considered a bug. To reproduce the crash:
>
> X <- sample(letters, 3000, TRUE)
> D <- data.frame(X, 1:3000, X, X, X, X, X)
> D$X1.3000 <- paste0("GSM", D)
>
> The reason why I'm not sure if this would be considered a bug is
because I
> typed this by accident, when what I meant was:
>
> D$X1.3000 <- paste0("GSM", D$X1.3000)
>
> I can never image a scenario where I would intentionally perform the
former.
>
> This issue seems to have something to do with the size of the data.frame,
as
> smaller examples will work fine:
>
> D <- data.frame(A = 1:10, B = letters[1:10])
> D$A <- paste0("A", D)
>
> Also just doing the paste0 part without trying to replace a data.frame
column
> not crash R for me.
>
> I can submit this on Bugzilla should this be deemed sufficiently buggy.
>
> I am running 3.6.0 on macOS (x86_64-apple-darwin15.6.0).
>
> Sincerely,
>
> B.T.
>
> ______________________________________________
> R-devel at r-project.org mailing list
> https://stat.ethz.ch/mailman/listinfo/r-devel
>
-- 
Luke Tierney
Ralph E. Wareham Professor of Mathematical Sciences
University of Iowa                  Phone:             319-335-3386
Department of Statistics and        Fax:               319-335-3017
    Actuarial Science
241 Schaeffer Hall                  email:   luke-tierney at uiowa.edu
Iowa City, IA 52242                 WWW:  http://www.stat.uiowa.edu