R devel - Mar 2009 - sprintf causes a segfault (PR#13613)

Full_Name: Wacek Kusnierczyk
Version: 2.8.0 and 2.10.0 r48163
OS: Ubuntu 8.04 Linux 32bit
Submission from: (NULL) (129.241.198.172)


the following code illustrates a problem with sprintf which consistently causes
a segfault when applied to certain type of arguments.  it also shows
inconsistent consequences of the segfault:

   (e = tryCatch(stop(), error=identity))
   # e is an error object

   sprintf('%d', e)
   # error in sprintf("%d", e) : unsupported type

   sprintf('%f', e)
   # error in sprintf("%f", e) : (list) object cannot be coerced to
type
'double'

   sprintf('%s', e)
   # segfault reported, with a choice of options for how to exit the session

it is possible not to leave the session, by simply typing ^c (ctrl-c).  (which
should probably be prohibited.)  if one stays in the session, then trying to
evaluate sprintf('%s', e) will cause a segfault with immediate crash (r
is
silently closed), but not necessarily if some other code is executed first.  in
the latter case, there may be no segfault, but an error message might be printed
instead:

   e = tryCatch(stop(), error=identity)
   sprintf('%s', e)
   # segfault, choice of options
   # ^c, stay in the session
   e = tryCatch(stop(), error=identity)
   sprintf('%s', e)
   # segfault, immediate exit
 
   e = tryCatch(stop(), error=identity)
   sprintf('%s', e)
   # segfault, choice of options
   # ^c, stay in the session
   e = tryCatch(stop(), error=identity)
   x = 1 # possibly, whatever code would do
   sprintf('%s', e)
   # [1] "Error in doTryCatch(return(expr), name, parentenv, handler):
\n"
   # [2] "Error in doTryCatch(return(expr), name, parentenv, handler):
\n"
   sprintf('%s', e)
   # segfault, immediate exit

in the second code snippet above, on some executions the error message was
printed. on others a segfault caused immediate exit.  (the pattern seems to
differ between 2.8.0 and 2.10.0-devel.)

strangely enough, the way r handles the same sequence of expressions on
different occasions varies:

    # fresh session 1
    e = simpleError('foo')
    sprintf('%s', e)
    # segfault: address 0x202, cause memory not mapped
    # ^c
    sprintf('%s', e)
    # error in sprintf("%s", e) : 'getEncChar' must be called
on a CHARSXP
  
    # fresh session 2
    e = simpleError('foo')
    sprintf('%s', e)
    # segfault: address (nil), cause memory not mapped
    # ^c
    sprintf('%s', e)
    # segfault, exit

note the difference in the address and how this relates to the outcome
of the second execution of sprintf('%s', e)

vQ


Waclaw.Marcin.Kusnierczyk at idi.ntnu.no wrote:
> the following code illustrates a problem with sprintf which consistently
causes
> a segfault when applied to certain type of arguments.  it also shows
> inconsistent consequences of the segfault:
>
>    (e = tryCatch(stop(), error=identity))
>    # e is an error object
>
>    sprintf('%d', e)
>    # error in sprintf("%d", e) : unsupported type
>
>    sprintf('%f', e)
>    # error in sprintf("%f", e) : (list) object cannot be coerced
to type
> 'double'
>
>    sprintf('%s', e)
>    # segfault reported, with a choice of options for how to exit the
session
>
> it is possible not to leave the session, by simply typing ^c (ctrl-c). 
(which
> should probably be prohibited.)  if one stays in the session, then trying
to
> evaluate sprintf('%s', e) will cause a segfault with immediate
crash (r is
> silently closed), but not necessarily if some other code is executed first.
in
> the latter case, there may be no segfault, but an error message might be
printed
> instead:
>
>    e = tryCatch(stop(), error=identity)
>    sprintf('%s', e)
>    # segfault, choice of options
>    # ^c, stay in the session
>    e = tryCatch(stop(), error=identity)
>    sprintf('%s', e)
>    # segfault, immediate exit
>  
>    e = tryCatch(stop(), error=identity)
>    sprintf('%s', e)
>    # segfault, choice of options
>    # ^c, stay in the session
>    e = tryCatch(stop(), error=identity)
>    x = 1 # possibly, whatever code would do
>    sprintf('%s', e)
>    # [1] "Error in doTryCatch(return(expr), name, parentenv, handler):
\n"
>    # [2] "Error in doTryCatch(return(expr), name, parentenv, handler):
\n"
>    sprintf('%s', e)
>    # segfault, immediate exit
>
> in the second code snippet above, on some executions the error message was
> printed. on others a segfault caused immediate exit.  (the pattern seems to
> differ between 2.8.0 and 2.10.0-devel.)
>
> ______________________________________________
> R-devel at r-project.org mailing list
> https://stat.ethz.ch/mailman/listinfo/r-devel