Re: [Rd] new behavior in model.response -- Solved

2018-06-28 Thread Therneau, Terry M., Ph.D. via R-devel 
Thanks to multiple readers for comments and patience as I sorted this out.  I 
now have 
working length and names methods for Surv objects, which do not seem to break 
anything.   
I just ran the test suites for 471 packages that depend on survival, but I 
don't test 
against bioconductor so cannot speak to that corpus.

Essentially, if I wanted to think of  Surv(1:6, rep(1:0, 3)) = 1 2+ 3  4+ 5  6+ 
as a 
vector of length 6, although stored in a longer representation, I needed to
   a. add a length method
   b. add names and names<- methods
   c. But, the names method cannot create a length=6 names attribute.  Handling 
of a names 
attribute is baked into the low-level code, and that code treats number of 
elements as the 
length, no matter what you say.
   d. The solution was to make names.Surv store the results in the rownames.

Terry T.


[[alternative HTML version deleted]]

__
R-devel@r-project.org mailing list
https://stat.ethz.ch/mailman/listinfo/r-devel

[Rd] Null pointer dereference in Rf_isVector()

2018-06-28 Thread kamil 

Hello,

After some fuzz testing I found a problem with Rf_isVector() function in 
R 3.5.0.


Platform: Ubuntu 16.04
Compiler: Clang-4.0 (from Ubuntu's repository) + ASAN

Crashing R code:

structure(c(0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0),.Dim=c(53,4),.Dimnames=~((0)))

To reproduce:
1. Save crashing code to file.
2. Run it with command: Rscript --vanilla r_nullptr_Rf_isVector

ASAN Report:

==11608==ERROR: AddressSanitizer: SEGV on unknown address 0x0002 
(pc 0x005cc479 bp 0x sp 0x7fff7a56d770 T0)

==11608==The signal is caused by a READ memory access.
==11608==Hint: address points to the zero page.
#0 0x5cc478 in Rf_isVector 
R-3.5.0/src/main/../../src/include/Rinlinedfuns.h:857:12

#1 0x5cc478 in Rf_dimnamesgets R-3.5.0/src/main/attrib.c:1099
#2 0x5c4f72 in Rf_setAttrib R-3.5.0/src/main/attrib.c:259:9
#3 0x5db48d in do_attributesgets R-3.5.0/src/main/attrib.c:1373:6
#4 0x84b939 in bcEval R-3.5.0/src/main/eval.c:7082:12
#5 0x8171df in Rf_eval R-3.5.0/src/main/eval.c:624:8
#6 0x8669a2 in R_execClosure R-3.5.0/src/main/eval.c
#7 0x817d7f in Rf_eval R-3.5.0/src/main/eval.c:747:12
#8 0x93cfa4 in Rf_ReplIteration R-3.5.0/src/main/main.c:258:2
#9 0x941e7a in R_ReplConsole R-3.5.0/src/main/main.c:308:11
#10 0x941e7a in run_Rmainloop R-3.5.0/src/main/main.c:1082
#11 0x50080a in main R-3.5.0/src/main/Rmain.c:29:5
#12 0x7fd74d55c82f in __libc_start_main 
(/lib/x86_64-linux-gnu/libc.so.6+0x2082f)

#13 0x42cf88 in _start (R-3.5.0/bin/exec/R+0x42cf88)

AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: SEGV 
R-3.5.0/src/main/../../src/include/Rinlinedfuns.h:857:12 in Rf_isVector

==11608==ABORTING

Best Regards,
Kamil Frankowicz

__
R-devel@r-project.org mailing list
https://stat.ethz.ch/mailman/listinfo/r-devel