I found this by accident yesterday. The program that crashes is the first two lines of the example from the help page for nlmer. That example hasn't changed in a long time, so I assumed that it is an R-devel issue. It could also be a long latent nlmer bug. The second run with valgrind is puzzling. Terry T. > library(lmer) > sessionInfo() R Under development (unstable) (2017-02-21 r72241) Platform: i686-pc-linux-gnu (32-bit) Running under: Ubuntu 14.04.1 LTS Matrix products: default BLAS: /usr/local/src/R-devel/lib/libRblas.so LAPACK: /usr/local/src/R-devel/lib/libRlapack.so locale: [1] LC_CTYPE=en_US.UTF-8 LC_NUMERIC=C [3] LC_TIME=en_US.UTF-8 LC_COLLATE=C [5] LC_MONETARY=en_US.UTF-8 LC_MESSAGES=en_US.UTF-8 [7] LC_PAPER=en_US.UTF-8 LC_NAME=C [9] LC_ADDRESS=C LC_TELEPHONE=C [11] LC_MEASUREMENT=en_US.UTF-8 LC_IDENTIFICATION=C attached base packages: [1] stats graphics grDevices utils datasets methods base other attached packages: [1] lme4_1.1-12 Matrix_1.2-8 loaded via a namespace (and not attached): [1] minqa_1.2.4 MASS_7.3-46 compiler_3.4.0 tools_3.4.0 [5] Rcpp_0.12.9 splines_3.4.0 nlme_3.1-131 grid_3.4.0 [9] nloptr_1.0.4 lattice_0.20-34 > startvec <- c(Asym = 200, xmid = 725, scal = 350) > (nm1 <- nlmer(circumference ~ SSlogis(age, Asym, xmid, scal) ~ Asym|Tree, + Orange, start = startvec)) *** Error in `/usr/local/src/R-devel/bin/exec/R': malloc(): memory corruption: 0x0e3df988 *** Aborted (core dumped) --------------------- The valgrind version is interesting too: it complains and then finishes! tmt-local2437% R -d valgrind ==31901== Memcheck, a memory error detector ==31901== Copyright (C) 2002-2013, and GNU GPL'd, by Julian Seward et al. ==31901== Using Valgrind-3.10.0.SVN and LibVEX; rerun with -h for copyright info ==31901== Command: /usr/local/src/R-devel/bin/exec/R ==31901= R Under development (unstable) (2017-02-21 r72241) -- "Unsuffered Consequences" Copyright (C) 2017 The R Foundation for Statistical Computing Platform: i686-pc-linux-gnu (32-bit) R is free software and comes with ABSOLUTELY NO WARRANTY. You are welcome to redistribute it under certain conditions. Type 'license()' or 'licence()' for distribution details. Natural language support but running in an English locale R is a collaborative project with many contributors. Type 'contributors()' for more information and 'citation()' on how to cite R or R packages in publications. Type 'demo()' for some demos, 'help()' for on-line help, or 'help.start()' for an HTML browser interface to help. Type 'q()' to quit R. [Previously saved workspace restored] > library(lme4) Loading required package: Matrix > startvec <- c(Asym = 200, xmid = 725, scal = 350) > (nm1 <- nlmer(circumference ~ SSlogis(age, Asym, xmid, scal) ~ Asym|Tree, + Orange, start = startvec)) ==31901== Invalid write of size 4 ==31901== at 0xA13DA20: cholmod_start (cholmod_common.c:184) ==31901== by 0xD8B3065: cholmod_start (in /home/therneau/Rlib/lme4/libs/lme4.so) ==31901== by 0xD8B728D: Eigen::CholmodBase<Eigen::SparseMatrix<double, 0, int>, 1, Eigen::CholmodDecomposition<Eigen::SparseMatrix<double, 0, int>, 1> >::CholmodBase() (in /home/therneau/Rlib/lme4/libs/lme4.so) ==31901== by 0xD8B413D: Eigen::CholmodDecomposition<Eigen::SparseMatrix<double, 0, int>, 1>::CholmodDecomposition() (in /home/therneau/Rlib/lme4/libs/lme4.so) ==31901== by 0xD8B39B8: lme4::lme4CholmodDecomposition<Eigen::SparseMatrix<double, 0, int>, 1>::lme4CholmodDecomposition() (in /home/therneau/Rlib/lme4/libs/lme4.so) ==31901== by 0xD8AEBE4: lme4::merPredD::merPredD(SEXPREC*, SEXPREC*, SEXPREC*, SEXPREC*, SEXPREC*, SEXPREC*, SEXPREC*, SEXPREC*, SEXPREC*, SEXPREC*, SEXPREC*, SEXPREC*, SEXPREC*, SEXPREC*, SEXPREC*, SEXPREC*, SEXPREC*) (in /home/therneau/Rlib/lme4/libs/lme4.so) ==31901== by 0xD8727F1: merPredDCreate (in /home/therneau/Rlib/lme4/libs/lme4.so) ==31901== by 0x80C0B9E: R_doDotCall (dotcode.c:648) ==31901== by 0x80C159F: do_dotcall (dotcode.c:1252) ==31901== by 0x80FFABA: Rf_eval (eval.c:728) ==31901== by 0x810308A: do_set (eval.c:2579) ==31901== by 0x80FF907: Rf_eval (eval.c:700) ==31901== Address 0xe310828 is 0 bytes after a block of size 2,408 alloc'd ==31901== at 0x402A6DC: operator new(unsigned int) (in /usr/lib/valgrind/vgpreload_memcheck-x86-linux.so) ==31901== by 0xD872770: merPredDCreate (in /home/therneau/Rlib/lme4/libs/lme4.so) ==31901== by 0x80C0B9E: R_doDotCall (dotcode.c:648) ==31901== by 0x80C159F: do_dotcall (dotcode.c:1252) ==31901== by 0x80FFABA: Rf_eval (eval.c:728) ==31901== by 0x810308A: do_set (eval.c:2579) ==31901== by 0x80FF907: Rf_eval (eval.c:700) ==31901== by 0x8101F20: do_begin (eval.c:2187) ==31901== by 0x80FF907: Rf_eval (eval.c:700) ==31901== by 0x810141B: R_execClosure (eval.c:1614) ==31901== by 0x80FF711: Rf_eval (eval.c:747) ==31901== by 0x8101F20: do_begin (eval.c:2187) ==31901===31901== Invalid write of size 4 ==31901== at 0xA13DA31: cholmod_start (cholmod_common.c:184) ==31901== by 0xD8B3065: cholmod_start (in /home/therneau/Rlib/lme4/libs/lme4.so) ==31901== by 0xD8B728D: Eigen::CholmodBase<Eigen::SparseMatrix<double, 0, int>, 1, Eigen::CholmodDecomposition<Eigen::SparseMatrix<double, 0, int>, 1> >::CholmodBase() (in /home/therneau/Rlib/lme4/libs/lme4.so) ==31901== by 0xD8B413D: Eigen::CholmodDecomposition<Eigen::SparseMatrix<double, 0, int>, 1>::CholmodDecomposition() (in /home/therneau/Rlib/lme4/libs/lme4.so) ==31901== by 0xD8B39B8: lme4::lme4CholmodDecomposition<Eigen::SparseMatrix<double, 0, int>, 1>::lme4CholmodDecomposition() (in /home/therneau/Rlib/lme4/libs/lme4.so) ==31901== by 0xD8AEBE4: lme4::merPredD::merPredD(SEXPREC*, SEXPREC*, SEXPREC*, SEXPREC*, SEXPREC*, SEXPREC*, SEXPREC*, SEXPREC*, SEXPREC*, SEXPREC*, SEXPREC*, SEXPREC*, SEXPREC*, SEXPREC*, SEXPREC*, SEXPREC*, SEXPREC*) (in /home/therneau/Rlib/lme4/libs/lme4.so) ==31901== by 0xD8727F1: merPredDCreate (in /home/therneau/Rlib/lme4/libs/lme4.so) ==31901== by 0x80C0B9E: R_doDotCall (dotcode.c:648) ==31901== by 0x80C159F: do_dotcall (dotcode.c:1252) ==31901== by 0x80FFABA: Rf_eval (eval.c:728) ==31901== by 0x810308A: do_set (eval.c:2579) ==31901== by 0x80FF907: Rf_eval (eval.c:700) ==31901== Address 0xe31082c is 4 bytes after a block of size 2,408 alloc'd ==31901== at 0x402A6DC: operator new(unsigned int) (in /usr/lib/valgrind/vgpreload_memcheck-x86-linux.so) ==31901== by 0xD872770: merPredDCreate (in /home/therneau/Rlib/lme4/libs/lme4.so) ==31901== by 0x80C0B9E: R_doDotCall (dotcode.c:648) ==31901== by 0x80C159F: do_dotcall (dotcode.c:1252) ==31901== by 0x80FFABA: Rf_eval (eval.c:728) ==31901== by 0x810308A: do_set (eval.c:2579) ==31901== by 0x80FF907: Rf_eval (eval.c:700) ==31901== by 0x8101F20: do_begin (eval.c:2187) ==31901== by 0x80FF907: Rf_eval (eval.c:700) ==31901== by 0x810141B: R_execClosure (eval.c:1614) ==31901== by 0x80FF711: Rf_eval (eval.c:747) ==31901== by 0x8101F20: do_begin (eval.c:2187) ==31901=Nonlinear mixed model fit by maximum likelihood ['nlmerMod'] Formula: circumference ~ SSlogis(age, Asym, xmid, scal) ~ Asym | Tree Data: Orange AIC BIC logLik deviance df.resid 273.1438 280.9205 -131.5719 263.1438 30 Random effects: Groups Name Std.Dev. Tree Asym 31.646 Residual 7.843 Number of obs: 35, groups: Tree, 5 Fixed Effects: Asym xmid scal 192.1 727.9 348.1 > q() ==31901===31901== HEAP SUMMARY: ==31901== in use at exit: 94,537,359 bytes in 46,733 blocks ==31901== total heap usage: 194,149 allocs, 147,416 frees, 248,586,365 bytes allocated ==31901===31901== LEAK SUMMARY: ==31901== definitely lost: 0 bytes in 0 blocks ==31901== indirectly lost: 0 bytes in 0 blocks ==31901== possibly lost: 0 bytes in 0 blocks ==31901== still reachable: 94,537,359 bytes in 46,733 blocks ==31901== suppressed: 0 bytes in 0 blocks ==31901== Rerun with --leak-check=full to see details of leaked memory ==31901===31901== For counts of detected and suppressed errors, rerun with: -v ==31901== ERROR SUMMARY: 3 errors from 2 contexts (suppressed: 0 from 0)