memory errors

[kasperdanielhansen]

Reported by Tomas Kalibera [email protected]

I found some possible problems with Rgraphviz. Valgrind reports a number of invalid reads and writes (the output is below) in RGraphviz when running the CNORfeeder package tests - and CNORfeeder seems to crash sometimes because of this.

I was running

R CMD check --use-valgrind BIOC/contrib/CNORfeeder_1.6.0.tar.gz
(R built with valgrind support)

and used Rgraphviz 2.10.0. The error messages appeared then in CNORfeeder-vignette.Rnw.log

I looked at some of the errors and it seems to me that the code could be more robust in the case a vector with no names is passed to functions where names are expected, e.g. in getVectorPos in Rgraphviz.c (line 74)

PROTECT(names = getAttrib(vector, R_NamesSymbol));
for (i = 0; i < length(vector); i++) { <===================== what if the vector has no names ???
    if (strcmp(CHAR(STRING_ELT(names,i)),str) == 0)
        break;
}

But some of the reports are possibly unrelated to this.

I didn't diagnose fully, but I hope this might be helpful. I found about this problem through that CNORfeeder tests failed, sometimes.
Thanks,

OUTPUT FROM VALGRIND

==18600== Invalid read of size 8
==18600== at 0x4D5351A: STRING_ELT (memory.c:3383)
==18600== by 0x14784B2E: getVectorPos (Rgraphviz.c:74)
==18600== by 0x14784D40: assignAttrs (Rgraphviz.c:132)
==18600== by 0x147866BC: Rgraphviz_buildEdgeList (buildEdgeList.c:184)
==18600== by 0x4CE9153: R_doDotCall (dotcode.c:591)
==18600== by 0x4CE96CF: do_dotcall (dotcode.c:1251)
==18600== by 0x4D28D0A: Rf_eval (eval.c:655)
==18600== by 0x4D2B11F: do_begin (eval.c:1716)
==18600== by 0x4D28B12: Rf_eval (eval.c:627)
==18600== by 0x4D2A12E: Rf_applyClosure (eval.c:1039)
==18600== by 0x4D288EE: Rf_eval (eval.c:674)
==18600== by 0x4D2C18D: do_set (eval.c:2105)
==18600== Address 0x1620db38 is 1,848 bytes inside a block of size 1,968 alloc'd
==18600== at 0x4A0645D: malloc (in /usr/lib64/valgrind/vgpreload_memcheck-amd64-linux.so)
==18600== by 0x4D57D82: GetNewPage (memory.c:864)
==18600== by 0x4D598A7: Rf_allocVector3 (memory.c:2587)
==18600== by 0x4DB616F: do_subset_dflt (Rinlinedfuns.h:189)
==18600== by 0x4DB7AFF: do_subset (subset.c:658)
==18600== by 0x4D28B12: Rf_eval (eval.c:627)
==18600== by 0x4D2C311: Rf_evalList (eval.c:2196)
==18600== by 0x4D2C800: R_forceAndCall (eval.c:1179)
==18600== by 0x4D2C9FE: do_forceAndCall (eval.c:1229)
==18600== by 0x4D1A8E1: bcEval (eval.c:5541)
==18600== by 0x4D2876F: Rf_eval (eval.c:558)
==18600== by 0x4D2A12E: Rf_applyClosure (eval.c:1039)
==18600==
==18600== Invalid write of size 8
==18600== at 0x4D538FB: SET_VECTOR_ELT (memory.c:3467)
==18600== by 0x14784C9A: assignAttrs (Rgraphviz.c:155)
==18600== by 0x147866BC: Rgraphviz_buildEdgeList (buildEdgeList.c:184)
==18600== by 0x4CE9153: R_doDotCall (dotcode.c:591)
==18600== by 0x4CE96CF: do_dotcall (dotcode.c:1251)
==18600== by 0x4D28D0A: Rf_eval (eval.c:655)
==18600== by 0x4D2B11F: do_begin (eval.c:1716)
==18600== by 0x4D28B12: Rf_eval (eval.c:627)
==18600== by 0x4D2A12E: Rf_applyClosure (eval.c:1039)
==18600== by 0x4D288EE: Rf_eval (eval.c:674)
==18600== by 0x4D2C18D: do_set (eval.c:2105)
==18600== by 0x4D28B12: Rf_eval (eval.c:627)
==18600== Address 0x1620db80 is 1,920 bytes inside a block of size 1,968 alloc'd
==18600== at 0x4A0645D: malloc (in /usr/lib64/valgrind/vgpreload_memcheck-amd64-linux.so)
==18600== by 0x4D57D82: GetNewPage (memory.c:864)
==18600== by 0x4D598A7: Rf_allocVector3 (memory.c:2587)
==18600== by 0x4DB616F: do_subset_dflt (Rinlinedfuns.h:189)
==18600== by 0x4DB7AFF: do_subset (subset.c:658)
==18600== by 0x4D28B12: Rf_eval (eval.c:627)
==18600== by 0x4D2C311: Rf_evalList (eval.c:2196)
==18600== by 0x4D2C800: R_forceAndCall (eval.c:1179)
==18600== by 0x4D2C9FE: do_forceAndCall (eval.c:1229)
==18600== by 0x4D1A8E1: bcEval (eval.c:5541)
==18600== by 0x4D2876F: Rf_eval (eval.c:558)
==18600== by 0x4D2A12E: Rf_applyClosure (eval.c:1039)
==18600==
==18600== Invalid read of size 8
==18600== at 0x4D5351A: STRING_ELT (memory.c:3383)
==18600== by 0x1478582A: Rgraphviz_agopen (agopen.c:185)
==18600== by 0x4CE96CF: do_dotcall (dotcode.c:1251)
==18600== by 0x4D28D0A: Rf_eval (eval.c:655)
==18600== by 0x4D2C18D: do_set (eval.c:2105)
==18600== by 0x4D28B12: Rf_eval (eval.c:627)
==18600== by 0x4D2B11F: do_begin (eval.c:1716)
==18600== by 0x4D28B12: Rf_eval (eval.c:627)
==18600== by 0x4D2A12E: Rf_applyClosure (eval.c:1039)
==18600== by 0x4D288EE: Rf_eval (eval.c:674)
==18600== by 0x4D2C18D: do_set (eval.c:2105)
==18600== by 0x4D28B12: Rf_eval (eval.c:627)
==18600== Address 0x1620db38 is 1,848 bytes inside a block of size 1,968 alloc'd
==18600== at 0x4A0645D: malloc (in /usr/lib64/valgrind/vgpreload_memcheck-amd64-linux.so)
==18600== by 0x4D57D82: GetNewPage (memory.c:864)
==18600== by 0x4D598A7: Rf_allocVector3 (memory.c:2587)
==18600== by 0x4DB616F: do_subset_dflt (Rinlinedfuns.h:189)
==18600== by 0x4DB7AFF: do_subset (subset.c:658)
==18600== by 0x4D28B12: Rf_eval (eval.c:627)
==18600== by 0x4D2C311: Rf_evalList (eval.c:2196)
==18600== by 0x4D2C800: R_forceAndCall (eval.c:1179)
==18600== by 0x4D2C9FE: do_forceAndCall (eval.c:1229)
==18600== by 0x4D1A8E1: bcEval (eval.c:5541)
==18600== by 0x4D2876F: Rf_eval (eval.c:558)
==18600== by 0x4D2A12E: Rf_applyClosure (eval.c:1039)
==18600==
==18600== Invalid read of size 8
==18600== at 0x4D5355E: VECTOR_ELT (memory.c:3393)
==18600== by 0x14785840: Rgraphviz_agopen (agopen.c:186)
==18600== by 0x4CE96CF: do_dotcall (dotcode.c:1251)
==18600== by 0x4D28D0A: Rf_eval (eval.c:655)
==18600== by 0x4D2C18D: do_set (eval.c:2105)
==18600== by 0x4D28B12: Rf_eval (eval.c:627)
==18600== by 0x4D2B11F: do_begin (eval.c:1716)
==18600== by 0x4D28B12: Rf_eval (eval.c:627)
==18600== by 0x4D2A12E: Rf_applyClosure (eval.c:1039)
==18600== by 0x4D288EE: Rf_eval (eval.c:674)
==18600== by 0x4D2C18D: do_set (eval.c:2105)
==18600== by 0x4D28B12: Rf_eval (eval.c:627)
==18600== Address 0x1620db80 is 1,920 bytes inside a block of size 1,968 alloc'd
==18600== at 0x4A0645D: malloc (in /usr/lib64/valgrind/vgpreload_memcheck-amd64-linux.so)
==18600== by 0x4D57D82: GetNewPage (memory.c:864)
==18600== by 0x4D598A7: Rf_allocVector3 (memory.c:2587)
==18600== by 0x4DB616F: do_subset_dflt (Rinlinedfuns.h:189)
==18600== by 0x4DB7AFF: do_subset (subset.c:658)
==18600== by 0x4D28B12: Rf_eval (eval.c:627)
==18600== by 0x4D2C311: Rf_evalList (eval.c:2196)
==18600== by 0x4D2C800: R_forceAndCall (eval.c:1179)
==18600== by 0x4D2C9FE: do_forceAndCall (eval.c:1229)
==18600== by 0x4D1A8E1: bcEval (eval.c:5541)
==18600== by 0x4D2876F: Rf_eval (eval.c:558)
==18600== by 0x4D2A12E: Rf_applyClosure (eval.c:1039)
==18600==
==18600== Invalid read of size 8
==18600== at 0x4D5351A: STRING_ELT (memory.c:3383)
==18600== by 0x1478584E: Rgraphviz_agopen (agopen.c:186)
==18600== by 0x4CE96CF: do_dotcall (dotcode.c:1251)
==18600== by 0x4D28D0A: Rf_eval (eval.c:655)
==18600== by 0x4D2C18D: do_set (eval.c:2105)
==18600== by 0x4D28B12: Rf_eval (eval.c:627)
==18600== by 0x4D2B11F: do_begin (eval.c:1716)
==18600== by 0x4D28B12: Rf_eval (eval.c:627)
==18600== by 0x4D2A12E: Rf_applyClosure (eval.c:1039)
==18600== by 0x4D288EE: Rf_eval (eval.c:674)
==18600== by 0x4D2C18D: do_set (eval.c:2105)
==18600== by 0x4D28B12: Rf_eval (eval.c:627)
==18600== Address 0xd388f50 is 1,920 bytes inside a block of size 1,968 alloc'd
==18600== at 0x4A0645D: malloc (in /usr/lib64/valgrind/vgpreload_memcheck-amd64-linux.so)
==18600== by 0x4D57D82: GetNewPage (memory.c:864)
==18600== by 0x4D598A7: Rf_allocVector3 (memory.c:2587)
==18600== by 0x4DB699C: do_subset_dflt (Rinlinedfuns.h:189)
==18600== by 0x4D11D86: VECSUBSET_PTR (eval.c:4605)
==18600== by 0x4D1D2F0: bcEval (eval.c:5696)
==18600== by 0x4D2876F: Rf_eval (eval.c:558)
==18600== by 0x4D28FE7: forcePromise (eval.c:457)
==18600== by 0x4D2880B: Rf_eval (eval.c:595)
==18600== by 0x4D21632: bcEval (eval.c:5450)
==18600== by 0x4D2876F: Rf_eval (eval.c:558)
==18600== by 0x4D2A12E: Rf_applyClosure (eval.c:1039)
==18600==
==18600== Invalid read of size 8
==18600== at 0x147939F4: dot_rank (rank.c:62)
==18600== by 0x1478877D: dot_layout (dotinit.c:263)
==18600== by 0x147E22BD: gvLayoutJobs (gvlayout.c:90)
==18600== by 0x147E5571: gvLayout (gvc.c:90)
==18600== by 0x14787A20: Rgraphviz_doLayout (doLayout.c:253)
==18600== by 0x4CE96CF: do_dotcall (dotcode.c:1251)
==18600== by 0x4D28D0A: Rf_eval (eval.c:655)
==18600== by 0x4D2C18D: do_set (eval.c:2105)
==18600== by 0x4D28B12: Rf_eval (eval.c:627)
==18600== by 0x4D2B11F: do_begin (eval.c:1716)
==18600== by 0x4D28B12: Rf_eval (eval.c:627)
==18600== by 0x4D28B12: Rf_eval (eval.c:627)
==18600== Address 0xe316c20 is 192 bytes inside a block of size 272 free'd
==18600== at 0x4A07577: free (in /usr/lib64/valgrind/vgpreload_memcheck-amd64-linux.so)
==18600== by 0x14793AA8: dot_rank (rank.c:72)
==18600== by 0x1478877D: dot_layout (dotinit.c:263)
==18600== by 0x147E22BD: gvLayoutJobs (gvlayout.c:90)
==18600== by 0x147E5571: gvLayout (gvc.c:90)
==18600== by 0x14787A20: Rgraphviz_doLayout (doLayout.c:253)
==18600== by 0x4CE96CF: do_dotcall (dotcode.c:1251)
==18600== by 0x4D28D0A: Rf_eval (eval.c:655)
==18600== by 0x4D2C18D: do_set (eval.c:2105)
==18600== by 0x4D28B12: Rf_eval (eval.c:627)
==18600== by 0x4D2B11F: do_begin (eval.c:1716)
==18600== by 0x4D28B12: Rf_eval (eval.c:627)
==18600==
==18600== Invalid read of size 1
==18600== at 0x4A09894: strcasecmp (in /usr/lib64/valgrind/vgpreload_memcheck-amd64-linux.so)
==18600== by 0x1481571F: textsize (fontmetrics.c:179)
==18600== by 0x147FE260: storeline (labels.c:32)
==18600== by 0x147FE34F: make_simple_label (labels.c:100)
==18600== by 0x147FE52A: make_label (labels.c:184)
==18600== by 0x147F8077: common_init_node (utils.c:613)
==18600== by 0x14787FDF: dot_init_node_edge (dotinit.c:25)
==18600== by 0x1478873C: dot_layout (dotinit.c:260)
==18600== by 0x147E22BD: gvLayoutJobs (gvlayout.c:90)
==18600== by 0x147E5571: gvLayout (gvc.c:90)
==18600== by 0x14787A20: Rgraphviz_doLayout (doLayout.c:253)
==18600== by 0x4CE96CF: do_dotcall (dotcode.c:1251)
==18600== Address 0x1009e284 is 20 bytes inside a block of size 33 free'd
==18600== at 0x4A07577: free (in /usr/lib64/valgrind/vgpreload_memcheck-amd64-linux.so)
==18600== by 0x14821B00: agFREEdict (attribs.c:231)
==18600== by 0x148239D5: agclose (graph.c:156)
==18600== by 0x14784881: Rgraphviz_fin (Rgraphviz.c:91)
==18600== by 0x4D582E7: R_RunWeakRefFinalizer (memory.c:1360)
==18600== by 0x4D584D2: RunFinalizers (memory.c:1417)
==18600== by 0x4D28749: Rf_eval (eval.c:489)
==18600== by 0x4D2A12E: Rf_applyClosure (eval.c:1039)
==18600== by 0x4D288EE: Rf_eval (eval.c:674)
==18600== by 0x4D28FE7: forcePromise (eval.c:457)
==18600== by 0x4D28D70: Rf_eval (eval.c:581)
==18600== by 0x4CD27DD: protectedEval (context.c:765)
==18600==