[R] ALTREP crash in base R due to use-after-free
- Dominant language
- C++
- Stars
- 17.1k
- Forks
- 4.3k
- Avg merge
- 3d 13h
- Merged PRs (30d)
- 88
Description
### Describe the bug, including details regarding any error messages, version, and platform.
`arrow::array_string_vector` `Elt()` method returns a newly created `CHARSXP` without keeping it reachable from the source vector, leading to a crash/segfault. Here is a short minimal reproducer: https://gist.github.com/traversc/a5204821451198d457edc38cceda9d90
This is the same class of bug as in vroom https://github.com/tidyverse/vroom/pull/638. vroom's fix is to cache accessed strings on the external pointer's protected slot and reuse that cache on materialize.
I understand when ALTREP became available, it was understood that CHARSXPs did not need to be rooted. But that was never correct and was a latent bug for many years. See here for more details: https://bugs.r-project.org/show_bug.cgi?id=19135
### Component(s)
R
Contributor guide
Assessment
This issue has not been assessed yet.