From jeroenoom@ @end|ng |rom gm@||@com  Sun Jun  7 18:59:53 2020
From: jeroenoom@ @end|ng |rom gm@||@com (Jeroen Ooms)
Date: Sun, 7 Jun 2020 18:59:53 +0200
Subject: [Rd] 
 [External] Re: use of the tcltk package crashes R 4.0.1 for Windows
In-Reply-To: <alpine.DEB.2.21.2006071040370.3474@luke-Latitude-7480>
References: <ACD1644AA6C67E4FBD0C350625508EC88CF55DA3@FHSDB2D11-2.csu.mcmaster.ca>
 <CABFfbXuT+hs2uAQuGtvJ_-c1xQPwx6Z+kfiUUwHJkvd4jzY6dg@mail.gmail.com>
 <B39BE746-8080-416C-A5C9-A1E6F06BA7BC@gmail.com>
 <alpine.DEB.2.21.2006071040370.3474@luke-Latitude-7480>
Message-ID: <CABFfbXvD68Hcw7D5T63w4oZ55urd2NeQYy_iUZ0JfkwDKfwzTA@mail.gmail.com>

On Sun, Jun 7, 2020 at 5:53 PM <luke-tierney at uiowa.edu> wrote:
>
> On Sun, 7 Jun 2020, peter dalgaard wrote:
>
> > So this wasn't tested for a month?
> >
> > Anyways, Free() is just free() with a check that we're not freeing a null pointer, followed by setting the pointer to NULL. At that point of tcltk.c, we have
> >
> >   for (objc = i = 0; i < length(avec); i++){
> >        const char *s;
> >        char *tmp;
> >        if (!isNull(nm) && strlen(s = translateChar(STRING_ELT(nm, i)))){
> >            //  tmp = calloc(strlen(s)+2, sizeof(char));
> >            tmp = Calloc(strlen(s)+2, char);
> >            *tmp = '-';
> >            strcpy(tmp+1, s);
> >            objv[objc++] = Tcl_NewStringObj(tmp, -1);
> >            free(tmp);
> >        }
> >        if (!isNull(t = VECTOR_ELT(avec, i)))
> >            objv[objc++] = (Tcl_Obj *) R_ExternalPtrAddr(t);
> >    }
> >
> > and I can't see how tmp can be NULL at the free(), nor can I see it mattering if it is not set to NULL (notice that it goes out of scope with the for loop).
>
> Right. And the calloc->Calloc change doesn't look like an issue either
> -- just checking for a NULL.
>
> If the crash is happening in free() then that most likely means
> corrupted malloc data structures. Unfortunately that could be
> happening anywhere.

Writing R extensions, section 6.1.2 says: "Do not assume that memory
allocated by Calloc/Realloc comes from the same pool as used by
malloc: in particular do not use free or strdup with it."

I think the reason is that R uses dlmalloc for Calloc on Windows:
https://github.com/wch/r-source/blob/c634fec5214e73747b44d7c0e6f047fefe44667d/src/main/memory.c#L94-L103



[Rd] [External] Re: use of the tcltk package crashes R 4.0.1 for Windows
Jeroen Ooms