From therneau at mayo.edu  Wed Feb 22 16:03:51 2017
From: therneau at mayo.edu (Therneau, Terry M., Ph.D.)
Date: Wed, 22 Feb 2017 09:03:51 -0600
Subject: [Rd] Crash in the latest release
Message-ID: <f40b15$5spqkk@ironport10.mayo.edu>

I found this by accident yesterday.  The program that crashes is the first two lines of 
the example from the help page for nlmer. That example hasn't changed in a long time, so I 
assumed that it is an R-devel issue.  It could also be a long latent nlmer bug. The second 
run with valgrind is puzzling.

Terry T.


 > library(lmer)
 > sessionInfo()
R Under development (unstable) (2017-02-21 r72241)
Platform: i686-pc-linux-gnu (32-bit)
Running under: Ubuntu 14.04.1 LTS

Matrix products: default
BLAS: /usr/local/src/R-devel/lib/libRblas.so
LAPACK: /usr/local/src/R-devel/lib/libRlapack.so

locale:
  [1] LC_CTYPE=en_US.UTF-8       LC_NUMERIC=C
  [3] LC_TIME=en_US.UTF-8        LC_COLLATE=C
  [5] LC_MONETARY=en_US.UTF-8    LC_MESSAGES=en_US.UTF-8
  [7] LC_PAPER=en_US.UTF-8       LC_NAME=C
  [9] LC_ADDRESS=C               LC_TELEPHONE=C
[11] LC_MEASUREMENT=en_US.UTF-8 LC_IDENTIFICATION=C

attached base packages:
[1] stats     graphics  grDevices utils     datasets  methods base

other attached packages:
[1] lme4_1.1-12  Matrix_1.2-8

loaded via a namespace (and not attached):
  [1] minqa_1.2.4     MASS_7.3-46     compiler_3.4.0 tools_3.4.0
  [5] Rcpp_0.12.9     splines_3.4.0   nlme_3.1-131 grid_3.4.0
  [9] nloptr_1.0.4    lattice_0.20-34

 > startvec <- c(Asym = 200, xmid = 725, scal = 350)
 > (nm1 <- nlmer(circumference ~ SSlogis(age, Asym, xmid, scal) ~ Asym|Tree,
+              Orange, start = startvec))
*** Error in `/usr/local/src/R-devel/bin/exec/R': malloc(): memory corruption: 0x0e3df988 ***
Aborted (core dumped)

---------------------

The valgrind version is interesting too: it complains and then finishes!

tmt-local2437% R -d valgrind
==31901== Memcheck, a memory error detector
==31901== Copyright (C) 2002-2013, and GNU GPL'd, by Julian Seward et al.
==31901== Using Valgrind-3.10.0.SVN and LibVEX; rerun with -h for copyright info
==31901== Command: /usr/local/src/R-devel/bin/exec/R
==31901==

R Under development (unstable) (2017-02-21 r72241) -- "Unsuffered Consequences"
Copyright (C) 2017 The R Foundation for Statistical Computing
Platform: i686-pc-linux-gnu (32-bit)

R is free software and comes with ABSOLUTELY NO WARRANTY.
You are welcome to redistribute it under certain conditions.
Type 'license()' or 'licence()' for distribution details.

   Natural language support but running in an English locale

R is a collaborative project with many contributors.
Type 'contributors()' for more information and
'citation()' on how to cite R or R packages in publications.

Type 'demo()' for some demos, 'help()' for on-line help, or
'help.start()' for an HTML browser interface to help.
Type 'q()' to quit R.

[Previously saved workspace restored]

 > library(lme4)
Loading required package: Matrix
 > startvec <- c(Asym = 200, xmid = 725, scal = 350)
 > (nm1 <- nlmer(circumference ~ SSlogis(age, Asym, xmid, scal) ~ Asym|Tree,
+              Orange, start = startvec))
==31901== Invalid write of size 4
==31901==    at 0xA13DA20: cholmod_start (cholmod_common.c:184)
==31901==    by 0xD8B3065: cholmod_start (in /home/therneau/Rlib/lme4/libs/lme4.so)
==31901==    by 0xD8B728D: Eigen::CholmodBase<Eigen::SparseMatrix<double, 0, int>, 1, 
Eigen::CholmodDecomposition<Eigen::SparseMatrix<double, 0, int>, 1> >::CholmodBase() (in 
/home/therneau/Rlib/lme4/libs/lme4.so)
==31901==    by 0xD8B413D: Eigen::CholmodDecomposition<Eigen::SparseMatrix<double, 0, 
int>, 1>::CholmodDecomposition() (in /home/therneau/Rlib/lme4/libs/lme4.so)
==31901==    by 0xD8B39B8: lme4::lme4CholmodDecomposition<Eigen::SparseMatrix<double, 0, 
int>, 1>::lme4CholmodDecomposition() (in /home/therneau/Rlib/lme4/libs/lme4.so)
==31901==    by 0xD8AEBE4: lme4::merPredD::merPredD(SEXPREC*, SEXPREC*, SEXPREC*, 
SEXPREC*, SEXPREC*, SEXPREC*, SEXPREC*, SEXPREC*, SEXPREC*, SEXPREC*, SEXPREC*, SEXPREC*, 
SEXPREC*, SEXPREC*, SEXPREC*, SEXPREC*, SEXPREC*) (in /home/therneau/Rlib/lme4/libs/lme4.so)
==31901==    by 0xD8727F1: merPredDCreate (in /home/therneau/Rlib/lme4/libs/lme4.so)
==31901==    by 0x80C0B9E: R_doDotCall (dotcode.c:648)
==31901==    by 0x80C159F: do_dotcall (dotcode.c:1252)
==31901==    by 0x80FFABA: Rf_eval (eval.c:728)
==31901==    by 0x810308A: do_set (eval.c:2579)
==31901==    by 0x80FF907: Rf_eval (eval.c:700)
==31901==  Address 0xe310828 is 0 bytes after a block of size 2,408 alloc'd
==31901==    at 0x402A6DC: operator new(unsigned int) (in 
/usr/lib/valgrind/vgpreload_memcheck-x86-linux.so)
==31901==    by 0xD872770: merPredDCreate (in /home/therneau/Rlib/lme4/libs/lme4.so)
==31901==    by 0x80C0B9E: R_doDotCall (dotcode.c:648)
==31901==    by 0x80C159F: do_dotcall (dotcode.c:1252)
==31901==    by 0x80FFABA: Rf_eval (eval.c:728)
==31901==    by 0x810308A: do_set (eval.c:2579)
==31901==    by 0x80FF907: Rf_eval (eval.c:700)
==31901==    by 0x8101F20: do_begin (eval.c:2187)
==31901==    by 0x80FF907: Rf_eval (eval.c:700)
==31901==    by 0x810141B: R_execClosure (eval.c:1614)
==31901==    by 0x80FF711: Rf_eval (eval.c:747)
==31901==    by 0x8101F20: do_begin (eval.c:2187)
==31901==
==31901== Invalid write of size 4
==31901==    at 0xA13DA31: cholmod_start (cholmod_common.c:184)
==31901==    by 0xD8B3065: cholmod_start (in /home/therneau/Rlib/lme4/libs/lme4.so)
==31901==    by 0xD8B728D: Eigen::CholmodBase<Eigen::SparseMatrix<double, 0, int>, 1, 
Eigen::CholmodDecomposition<Eigen::SparseMatrix<double, 0, int>, 1> >::CholmodBase() (in 
/home/therneau/Rlib/lme4/libs/lme4.so)
==31901==    by 0xD8B413D: Eigen::CholmodDecomposition<Eigen::SparseMatrix<double, 0, 
int>, 1>::CholmodDecomposition() (in /home/therneau/Rlib/lme4/libs/lme4.so)
==31901==    by 0xD8B39B8: lme4::lme4CholmodDecomposition<Eigen::SparseMatrix<double, 0, 
int>, 1>::lme4CholmodDecomposition() (in /home/therneau/Rlib/lme4/libs/lme4.so)
==31901==    by 0xD8AEBE4: lme4::merPredD::merPredD(SEXPREC*, SEXPREC*, SEXPREC*, 
SEXPREC*, SEXPREC*, SEXPREC*, SEXPREC*, SEXPREC*, SEXPREC*, SEXPREC*, SEXPREC*, SEXPREC*, 
SEXPREC*, SEXPREC*, SEXPREC*, SEXPREC*, SEXPREC*) (in /home/therneau/Rlib/lme4/libs/lme4.so)
==31901==    by 0xD8727F1: merPredDCreate (in /home/therneau/Rlib/lme4/libs/lme4.so)
==31901==    by 0x80C0B9E: R_doDotCall (dotcode.c:648)
==31901==    by 0x80C159F: do_dotcall (dotcode.c:1252)
==31901==    by 0x80FFABA: Rf_eval (eval.c:728)
==31901==    by 0x810308A: do_set (eval.c:2579)
==31901==    by 0x80FF907: Rf_eval (eval.c:700)
==31901==  Address 0xe31082c is 4 bytes after a block of size 2,408 alloc'd
==31901==    at 0x402A6DC: operator new(unsigned int) (in 
/usr/lib/valgrind/vgpreload_memcheck-x86-linux.so)
==31901==    by 0xD872770: merPredDCreate (in /home/therneau/Rlib/lme4/libs/lme4.so)
==31901==    by 0x80C0B9E: R_doDotCall (dotcode.c:648)
==31901==    by 0x80C159F: do_dotcall (dotcode.c:1252)
==31901==    by 0x80FFABA: Rf_eval (eval.c:728)
==31901==    by 0x810308A: do_set (eval.c:2579)
==31901==    by 0x80FF907: Rf_eval (eval.c:700)
==31901==    by 0x8101F20: do_begin (eval.c:2187)
==31901==    by 0x80FF907: Rf_eval (eval.c:700)
==31901==    by 0x810141B: R_execClosure (eval.c:1614)
==31901==    by 0x80FF711: Rf_eval (eval.c:747)
==31901==    by 0x8101F20: do_begin (eval.c:2187)
==31901==
Nonlinear mixed model fit by maximum likelihood  ['nlmerMod']
Formula: circumference ~ SSlogis(age, Asym, xmid, scal) ~ Asym | Tree
    Data: Orange
       AIC       BIC    logLik  deviance  df.resid
  273.1438  280.9205 -131.5719  263.1438        30
Random effects:
  Groups   Name Std.Dev.
  Tree     Asym 31.646
  Residual       7.843
Number of obs: 35, groups:  Tree, 5
Fixed Effects:
  Asym   xmid   scal
192.1  727.9  348.1

 > q()
==31901==
==31901== HEAP SUMMARY:
==31901==     in use at exit: 94,537,359 bytes in 46,733 blocks
==31901==   total heap usage: 194,149 allocs, 147,416 frees, 248,586,365 bytes allocated
==31901==
==31901== LEAK SUMMARY:
==31901==    definitely lost: 0 bytes in 0 blocks
==31901==    indirectly lost: 0 bytes in 0 blocks
==31901==      possibly lost: 0 bytes in 0 blocks
==31901==    still reachable: 94,537,359 bytes in 46,733 blocks
==31901==         suppressed: 0 bytes in 0 blocks
==31901== Rerun with --leak-check=full to see details of leaked memory
==31901==
==31901== For counts of detected and suppressed errors, rerun with: -v
==31901== ERROR SUMMARY: 3 errors from 2 contexts (suppressed: 0 from 0)



[Rd] Crash in the latest release
Therneau, Terry M., Ph.D.