R devel - May 2024 - [External] R hang/bug with circular references and promises

On Sat, 11 May 2024, Peter Langfelder wrote:
> On Sat, May 11, 2024 at 9:34?AM luke-tierney--- via R-devel
> <r-devel at r-project.org> wrote:
>>
>> On Sat, 11 May 2024, Travers Ching wrote:
>>
>>> The following code snippet causes R to hang. This example might be
a
>>> bit contrived as I was experimenting and trying to understand
>>> promises, but uses only base R.
>>
>> This has nothing to do with promises. You created a cycle in the
>> environment chain. A simpler variant:
>>
>> e <- new.env()
>> parent.env(e) <- e
>> get("x", e)
>>
>> This will hang and is not interruptable -- loops searching up
>> environment chains are too speed-critical to check for interrupts.  It
>> is, however, pretty easy to check whether the parent change would
>> create a cycle and throw an error if it would. Need to think a bit
>> about exactly where the check should go.
>
> FWIW, the help for parent.env already explicitly warns against using
> parent.env <-:
>
> The replacement function ?parent.env<-? is extremely dangerous as
>     it can be used to destructively change environments in ways that
>     violate assumptions made by the internal C code.  It may be
>     removed in the near future.
Looks like I added that warning 22 years ago, so that should be enough
notice :-). I'll look into removing it now.

Best,

luke
>
> Peter
>
-- 
Luke Tierney
Ralph E. Wareham Professor of Mathematical Sciences
University of Iowa                  Phone:             319-335-3386
Department of Statistics and        Fax:               319-335-3017
    Actuarial Science
241 Schaeffer Hall                  email:   luke-tierney at uiowa.edu
Iowa City, IA 52242                 WWW:  http://www.stat.uiowa.edu

On Mon, 13 May 2024 09:54:27 -0500 (CDT)
luke-tierney--- via R-devel <r-devel at r-project.org> wrote:
> Looks like I added that warning 22 years ago, so that should be enough
> notice :-). I'll look into removing it now.
Dear Luke,

I've got a somewhat niche use case: as a way of protecting myself
against rogue *.rds files and vulnerabilities in the C code, I've been
manually unserializing "plain" data objects (without anything
executable), including environments, in R [1].

I see that SET_ENCLOS() is already commented as "not API and probably
should not be <...> used". Do you think there is a way to recreate an
environment, taking the REFSXP entries into account, without
`parent.env<-`?  Would you recommend to abandon the folly of
unserializing environments manually?

-- 
Best regards,
Ivan

[1]
https://codeberg.org/aitap/unserializeData/src/commit/33d72705c1ee265349b3e369874ce4b47f9cd358/R/unserialize.R#L289-L313