Bug 14772 - GC-protection in HessAssign2() (deriv.c)
GC-protection in HessAssign2() (deriv.c)
Status: CLOSED FIXED
Product: R
Classification: Unclassified
Component: Low-level
R-devel (trunk)
All All
: P5 minor
Assigned To: R-core
Depends on:
Blocks:
  Show dependency treegraph
 
Reported: 2012-01-03 12:18 UTC by Andrew Runnalls
Modified: 2012-01-05 13:49 UTC (History)
0 users

See Also:


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Andrew Runnalls 2012-01-03 12:18:45 UTC
In deriv.c (at revision 56926) in the function HessAssign2() at lines 862ff:

ans = lang3(install("<-"),
            lang5(install("["), install(".hessian"), R_MissingArg,
		  newname1, newname2),
	    lang3(install("<-"),
		  lang5(install("["), install(".hessian"), R_MissingArg,
			newname2, newname1),
		  expr));

the allocations involved in creating the (object pointed to by the) second argument to the outer lang3 call can - if they give rise to GC - blow away the third argument, which is not yet protected.  (That's with gcc on Linux, which seems to evaluate function arguments from right to left: I guess with other compilers it may be arg #3 blowing away arg #2.)

(Discovered during CXXR development)

Andrew
Comment 1 Brian Ripley 2012-01-05 13:49:46 UTC
Thanks, fixed in 2.14.1 patched.  (I failed to create an example, so I believe this bit of the code is esoteric.)