xml_add_parent produces a segfault in for loop

[AleKoure]

By developing a plumber API with xml2 I fall into the following error under a small stress test. I reproduce a minimal example in my local machine.

The following code chunk produces an error,

library(xml2)

xx <- function() {
  x <- read_xml("<fruits><apple color='red'></apple></fruits>")
  xml_add_parent(x, read_xml("<food></food>"))
  print(as.character(x))
}

for(i in 1:1000)xx()

[1] "<?xml version=\"1.0\" encoding=\"UTF-8\"?>\n<food>\n  <fruits>\n    <apple color=\"red\"/>\n  </fruits>\n</food>\n"
[1] "<?xml version=\"1.0\" encoding=\"UTF-8\"?>\n<food>\n  <fruits>\n    <apple color=\"red\"/>\n  </fruits>\n</food>\n"
[1] "<?xml version=\"1.0\" encoding=\"UTF-8\"?>\n<food>\n  <fruits>\n    <apple color=\"red\"/>\n  </fruits>\n</food>\n"

 *** caught segfault ***
address 0x55ff44000000, cause 'memory not mapped'

Possible actions:
1: abort (with core dump, if enabled)
2: normal R exit
3: exit R without saving workspace
4: exit R saving workspace
Selection: 

R version 4.0.4 (2021-02-15)
Platform: x86_64-pc-linux-gnu (64-bit)
Running under: Ubuntu 20.04.2 LTS

Matrix products: default
BLAS:   /usr/lib/x86_64-linux-gnu/blas/libblas.so.3.9.0
LAPACK: /usr/lib/x86_64-linux-gnu/lapack/liblapack.so.3.9.0

locale:
 [1] LC_CTYPE=en_US.UTF-8       LC_NUMERIC=C              
 [3] LC_TIME=el_GR.UTF-8        LC_COLLATE=en_US.UTF-8    
 [5] LC_MONETARY=el_GR.UTF-8    LC_MESSAGES=en_US.UTF-8   
 [7] LC_PAPER=el_GR.UTF-8       LC_NAME=C                 
 [9] LC_ADDRESS=C               LC_TELEPHONE=C            
[11] LC_MEASUREMENT=el_GR.UTF-8 LC_IDENTIFICATION=C       

attached base packages:
[1] stats     graphics  grDevices utils     datasets  methods   base     

other attached packages:
[1] xml2_1.3.2         plumber_1.1.0.9000

loaded via a namespace (and not attached):
 [1] compiler_4.0.4   magrittr_2.0.1   R6_2.5.0         later_1.2.0     
 [5] promises_1.2.0.1 tools_4.0.4      swagger_3.33.1   Rcpp_1.0.6      
 [9] stringi_1.6.1    jsonlite_1.7.2   webutils_1.1     lifecycle_1.0.0 
[13] rlang_0.4.11    

you can bypass it for example by using xml_add_child and xml_replace instead.

[erp31]

Hi, I'm also experiencing the problem of R crashing when xml_add_parent is used in combination with other code. As a minimal example it crashes when the code below is run three times. When I originally found the problem I was only calling xml_add_parent once in a script with many other function calls. However, I don't know how to create a minimal example for that I'm afraid.

library(xml2)

# Create XML document
doc <- read_xml("<parent><child1>Hello</child1></parent>")

# Check current elements
children <- xml_children(doc)

new_node <- read_xml('<new_node>New text</new_node>')
xml_add_parent(children, new_node)

# Show that the parent node has been added
doc
#> {xml_document}
#> <parent>
#> [1] <new_node>New text<child1>Hello</child1></new_node>

If I run the above in a loop then it causes R to crash e.g.:

library(xml2)

for (i in 1:3){  
  # Create XML document
  doc <- read_xml("<parent><child1>Hello</child1></parent>")
  
  # Check current elements
  children <- xml_children(doc)
  #expect_equal(xml_text(children), c("Hello"))
  
  new_node <- read_xml('<new_node>New text</new_node>')
  xml_add_parent(children, new_node)
  
  doc

}

reprex produces this:

This reprex appears to crash R.
See standard output and standard error for more details.

Standard output and error

*** caught segfault ***
  address 0x5610c8000000, cause 'memory not mapped'
An irrecoverable exception occurred. R is aborting now ...

OR this:

This reprex appears to crash R.
See standard output and standard error for more details.

Standard output and error

free(): invalid pointer

Thanks to AleKoure for pointing out the workaround and helping me locate which part of my code was crashing my R session.

^{Created on 2021-06-02 by the reprex package (v2.0.0)}

Session info

sessioninfo::session_info()
#> ─ Session info ───────────────────────────────────────────────────────────────
#>  setting  value                       
#>  version  R version 4.0.4 (2021-02-15)
#>  os       CentOS Linux 8              
#>  system   x86_64, linux-gnu           
#>  ui       X11                         
#>  language (EN)                        
#>  collate  en_US.UTF-8                 
#>  ctype    en_US.UTF-8                 
#>  tz       UTC                         
#>  date     2021-06-02                  
#> 
#> ─ Packages ───────────────────────────────────────────────────────────────────
#>  package     * version date       lib source        
#>  backports     1.2.1   2020-12-09 [2] CRAN (R 4.0.4)
#>  cli           2.4.0   2021-04-05 [2] CRAN (R 4.0.4)
#>  crayon        1.4.1   2021-02-08 [2] CRAN (R 4.0.4)
#>  digest        0.6.27  2020-10-24 [2] CRAN (R 4.0.4)
#>  ellipsis      0.3.1   2020-05-15 [2] CRAN (R 4.0.4)
#>  evaluate      0.14    2019-05-28 [2] CRAN (R 4.0.4)
#>  fansi         0.4.2   2021-01-15 [2] CRAN (R 4.0.4)
#>  fs            1.5.0   2020-07-31 [2] CRAN (R 4.0.4)
#>  glue          1.4.2   2020-08-27 [2] CRAN (R 4.0.4)
#>  highr         0.9     2021-04-16 [2] CRAN (R 4.0.4)
#>  htmltools     0.5.1.1 2021-01-22 [2] CRAN (R 4.0.4)
#>  knitr         1.32    2021-04-14 [2] CRAN (R 4.0.4)
#>  lifecycle     1.0.0   2021-02-15 [2] CRAN (R 4.0.4)
#>  magrittr      2.0.1   2020-11-17 [2] CRAN (R 4.0.4)
#>  pillar        1.6.0   2021-04-13 [2] CRAN (R 4.0.4)
#>  pkgconfig     2.0.3   2019-09-22 [2] CRAN (R 4.0.4)
#>  purrr         0.3.4   2020-04-17 [2] CRAN (R 4.0.4)
#>  reprex        2.0.0   2021-04-02 [2] CRAN (R 4.0.4)
#>  rlang         0.4.10  2020-12-30 [2] CRAN (R 4.0.4)
#>  rmarkdown     2.7     2021-02-19 [2] CRAN (R 4.0.4)
#>  sessioninfo   1.1.1   2018-11-05 [2] CRAN (R 4.0.4)
#>  stringi       1.5.3   2020-09-09 [2] CRAN (R 4.0.4)
#>  stringr       1.4.0   2019-02-10 [2] CRAN (R 4.0.4)
#>  styler        1.4.1   2021-03-30 [2] CRAN (R 4.0.4)
#>  tibble        3.1.1   2021-04-18 [2] CRAN (R 4.0.4)
#>  utf8          1.2.1   2021-03-12 [2] CRAN (R 4.0.4)
#>  vctrs         0.3.7   2021-03-29 [2] CRAN (R 4.0.4)
#>  withr         2.4.2   2021-04-18 [2] CRAN (R 4.0.4)
#>  xfun          0.22    2021-03-11 [2] CRAN (R 4.0.4)
#>  xml2        * 1.3.2   2020-04-23 [2] CRAN (R 4.0.4)
#>  yaml          2.2.1   2020-02-01 [2] CRAN (R 4.0.4)
#> 

[chainsawriot]

for (i in 1:500){  
  print(i)
  doc <- xml2::read_xml("<a><b>a</b></a>")
  children <- xml2::xml_children(doc)
  xml2::xml_add_parent(children, xml2::read_xml('<c>d</c>'))
}

On my machine, this one can go to 60 and a segfault is triggered.

The trigger is xml_add_parent. xml_add_child and xml_add_sibling won't trigger the segfault.

[alexverse]

Possible solution is adding .copy = TRUE in xml_replace() makes the function stable for iterations, but I guess this will have some impact on performance.