From |kry|ov @end|ng |rom d|@root@org  Mon May 13 17:44:27 2024
From: |kry|ov @end|ng |rom d|@root@org (Ivan Krylov)
Date: Mon, 13 May 2024 18:44:27 +0300
Subject: [Rd] 
 [External] R hang/bug with circular references and promises
In-Reply-To: <988ea195-1fbe-9e54-d68c-64f6bf36f9a0@uiowa.edu>
References: <CAPLMX9EyfB7cLgu89WPT_RFeuC1BDPYcZ81jR2q1aaDPVtnkEw@mail.gmail.com>
 <d0dc027e-b579-ba5b-ec62-d1bd52fbf47f@uiowa.edu>
 <CA+hbrhVPoFR8tLuhS60oXW_OhWW76YxhnD0VLSZaAi4yVDgWhA@mail.gmail.com>
 <988ea195-1fbe-9e54-d68c-64f6bf36f9a0@uiowa.edu>
Message-ID: <20240513184427.0ba6a251@arachnoid>

On Mon, 13 May 2024 09:54:27 -0500 (CDT)
luke-tierney--- via R-devel <r-devel at r-project.org> wrote:

> Looks like I added that warning 22 years ago, so that should be enough
> notice :-). I'll look into removing it now.

Dear Luke,

I've got a somewhat niche use case: as a way of protecting myself
against rogue *.rds files and vulnerabilities in the C code, I've been
manually unserializing "plain" data objects (without anything
executable), including environments, in R [1].

I see that SET_ENCLOS() is already commented as "not API and probably
should not be <...> used". Do you think there is a way to recreate an
environment, taking the REFSXP entries into account, without
`parent.env<-`?  Would you recommend to abandon the folly of
unserializing environments manually?

-- 
Best regards,
Ivan

[1]
https://codeberg.org/aitap/unserializeData/src/commit/33d72705c1ee265349b3e369874ce4b47f9cd358/R/unserialize.R#L289-L313



[Rd] [External] R hang/bug with circular references and promises
Ivan Krylov