Rubbish values written with zero-length vectors (PR#14217)

On 2/20/10 7:50 AM, Peter Dalgaard wrote:

You don't want to understand, believe me! ;-)

It's a bug, probably not the very worst kind, but accessing memory that
isn't yours is potentially harmful (but writing to it is considerably
worse).

Looks like the issue only concerns the right hand side; nothing to do
with the auto-expansion of v. I also get

v <- integer(0)
u <- integer(1)
u[[2]] <-v
u

[1]         0 142000760

u[[1]] <-v
u

[1] 142000760 142000760

a <- 1
a[[1]] <-v
a

[1] 142000760

I'm thinking this should be an error.  Similar to:

v = 1
v[[1]] = integer(3)

Error in v[[1]] = integer(3) :
  more elements supplied than there are to replace

But instead not enough elements supplied.  Perhaps:

v[[1]] = integer()

Error in v[[1]] = integer() : [[ ]] replacement has zero length

The code in do_subassign2_dflt currently does not check that the
replacement has length > 0 for the nsubs == 1 case.  I think we want:


@@ -1529,6 +1532,8 @@ do_subassign2_dflt(SEXP call, SEXP op, SEXP args,
SEXP rho)
        if (nsubs == 0 || CAR(subs) == R_MissingArg)
            error(_("[[ ]] with missing subscript"));
        if (nsubs == 1) {
+            if (length(y) == 0)
+                error(_("[[ ]] replacement has zero length"));
            offset = OneIndex(x, thesub, length(x), 0, &newname,
recursed ? len-1 : -1, R_NilValue);
            if (isVectorList(x) && isNull(y)) {
                x = DeleteOneVectorListItem(x, offset);


+ seth