Idioms and Common Pitfalls

Arithmetic, comparison and most mathematical functions in R work on whole vectors, and the loop that applies them runs in compiled code. Writing days <- return_date - loan_date instead of a loop over the rows is shorter, has no index to get wrong, and is the form that the other idioms below build on. The script computes the loan lengths of the shelf scenario both ways and shows that they agree, then counts the loans longer than the 21-day period; the count is the reference result of the scenario (25 returned loans exceed 21 days), and na.rm = TRUE leaves out the unreturned loans and the impossible date of row 20, which are NA. A loop is still the right tool when each step depends on the previous one; Vectorisation and Iteration says when, and why the vectorised form is faster.

Source: An Introduction to R: Vector arithmetic

When a loop is needed, its index comes from seq_along(x) (the positions of x) or seq_len(n) (the numbers 1 to n), never from 1:length(x) or 1:n. The two functions return integer(0) for an empty input, so the loop body does not run, and the colon operator does not (the first pitfall below). The seq help page says that seq_along and seq_len are very fast primitives for these two common cases and that using them is much preferred to the one-argument form of seq(). The function below numbers a vector of titles; it gives the right answer for three titles and for none, and the same two lines work for the rows of a data frame.

Source: R documentation: seq

The loop styles are compared in Control Flow, and lintr flags the colon form with seq_linter.

To apply a function to every element and collect the results in a vector, use vapply(X, FUN, FUN.VALUE). The third argument is a template: the type and length every call must return. If one call returns something else, R stops with a message that names the element. If the input is empty, the result is an empty vector of the declared type. sapply() has neither guarantee and its result changes shape with the data (the sapply pitfall below). A template with names, such as c(min = 0, max = 0), makes vapply() return a matrix whose rows carry the names. When the result is a list on purpose, lapply() says so.

Source: R documentation: lapply

When X is a character vector, USE.NAMES = TRUE names the result after it, which is why the empty character vector above gives named integer(0); pass USE.NAMES = FALSE when the names are not wanted. The family is described in The apply Family and Functionals.

stopifnot() checks that every one of its arguments is TRUE and stops with an error otherwise. Since R 4.0.0 an argument can be named, and the name is used instead of the default message, which is the expression followed by "is not TRUE" (this is in the R 4.0.0 NEWS: the function allows customizing error messages via argument names). The first lines of a function that state what it accepts are the cheapest documentation and the earliest failure. Use stop() with a message of your own, or a classed condition, for errors that the caller is meant to handle.

Source: R documentation: stopifnot

More forms (exprs, the checks for type and length, the checkmate package) are in Defensive Programming and Input Validation.

on.exit() registers an expression to run when the function ends, whether it ends normally or with an error. By default a second call replaces the first; add = TRUE appends, and since R 3.5.0 after = FALSE puts the new expression in front, so that cleanup runs last in, first out. Since R 3.5.0 all the registered expressions also run even if one of them signals an error. The idiom is to write the on.exit() line straight after the line that acquires the resource, with add = TRUE every time, so that a later edit cannot silently cancel it. The same pattern puts back the options a function changed, which is what R FAQ 7.7 shows with options().

Source: R documentation: on.exit

The first function prints only second because the second call replaced the first; the second prints first and second in the order of the calls; the third, with after = FALSE, prints closed the file before opened the file. The connection counter compares the number of open connections before and after the failing call, and it is TRUE: the file was closed although the function stopped. See Functions and Conditions and Error Handling.

Write pkg::fun when you use a function from a package, in scripts as well as in package code. A function defined in the global environment (or attached later on the search path) with the same name as a package function hides it, and pkg::fun goes to the package whatever the search path holds. In a package the same intent is written in the NAMESPACE file with importFrom(). The :: operator loads the namespace without attaching it, so it does not change what other code sees.

Source: R documentation: ::

find("head") lists the places where a name is found, in search order: after the global definition it names .GlobalEnv first. See Packages, Libraries and Namespaces for :: and :::, and masking and conflicts.

TRUE and FALSE are reserved words, so they cannot be changed. They are written in full everywhere, including the arguments na.rm, decreasing, drop and stringsAsFactors. A logical vector is produced by a comparison and counted with sum() or mean(), because TRUE counts as 1 and FALSE as 0. The pitfall about T and F below is the reason for the rule.

Source: R documentation: logical

An Introduction to R says it in one sentence (An Introduction to R: Logical vectors): T and F are variables that can be overwritten, so you should always use TRUE and FALSE. The styles are in Style, Linting and Static Analysis.

Three functions answer "are these the same?", and they answer different questions. identical(x, y) is TRUE only when the two objects are the same in every respect, attributes and type included, and it always returns one TRUE or FALSE. all.equal(x, y) compares numbers with a tolerance (about 1.5e-8) and returns either TRUE or a character string that describes the difference; it can therefore not be used directly in if. isTRUE(x) is TRUE only for a single TRUE, so isTRUE(all.equal(x, y)) is the idiom for "equal within the tolerance", and isTRUE(NA) is a plain FALSE. Since R 3.5.0 isTRUE() also accepts a named logical of length one, and isFALSE() was added at the same time.

Source: R documentation: all.equal

Never use == for the comparison of computed doubles (see the pitfall below), and never test a condition with if (x == NA); is.na() is the question. See Defensive Programming and Input Validation.

A function that checks its special cases first and returns at once reads top to bottom and has no staircase of nested if and else. Each return() handles one case; the last expression of the function is the ordinary case, and it is not written with return() (the return_linter of lintr flags that). The function below classifies a loan from its two dates, NA meaning "not returned", and the table counts the 60 loans of the scenario by status: the impossible date, the impossible return before the loan and the unreturned loans each have their own early exit.

Source: R documentation: function

Two cautions. A function that returns early must return a value of the same type on every path; the vapply() above enforces it. And on.exit() is the right way to clean up on every path, not a copy of the cleanup before each return(). See Functions and Control Flow.

A pure function depends only on its arguments and changes nothing outside itself: the same arguments give the same result, a test is three lines, and the function works inside vapply(), in parallel and in a package. The impure version below reads and writes a variable of the global environment with <<-, so calling it twice with the same argument gives two different answers; the pure version returns the count and leaves the accumulating to the caller. stopifnot() is a fine unit test for a function this small (the testing framework is in Testing with testthat).

Source: R documentation: assignOps

The assignment in the impure function carries a nolint because lintr asks for an explicit environment instead of <<-. Closures are the legitimate use of <<- and are explained in Scoping, Environments and Closures; Functions covers how to write them.

The colon operator counts down when its second operand is smaller than the first, so 1:length(x) for an empty x is 1:0, which is the two numbers 1 and 0. A loop over it runs twice. In the first run x[1] is NA, an index past the end of the vector; in the second x[0] is an empty vector, which cat() prints as nothing. With [[ the first run is an error. The bug is invisible while the data has elements and appears the first time a filter selects nothing, which is why it is found in production. The same trap sits in 1:nrow(df), 1:ncol(m) and 1:n whenever the count can be zero. The script selects the titles of books newer than 2100 (there are none), shows the sequence, the two failures and a data frame version, and then the repair.

Source: R documentation: seq

The repair is seq_along(x) for the positions of a vector and seq_len(n) for a count; both return integer(0) for nothing, so the loop body does not run and the function returns what it should for an empty input. When the position is not needed, loop over the values: for (title in titles). lintr flags the colon forms with seq_linter and its message names the empty edge case. R FAQ: no entry. The seq help page recommends seq_along and seq_len over the one-argument seq() and says they are very fast primitives. In depth: Control Flow and Defensive Programming and Input Validation.

x$name is x[["name", exact = FALSE]], as the Extract help page says: the $ operator completes a prefix of a name, on lists, on data frames and on S3 objects built on lists, as long as the prefix is unambiguous. [[ requires the exact name unless exact = FALSE is given (and exact = NA allows a match with a warning), and [ never matches partially. The convenience hides typos: rec$pag is accepted for pages. It also makes the meaning of code depend on what else the object contains: when a second field with the same prefix is added, the prefix is ambiguous and $ returns NULL, with no message. Environments do not match partially. The option warnPartialMatchDollar (default FALSE) turns the silence into a warning for both lists and data frames; the R 3.1.1 NEWS records that the warning for data frames is only given when the option is TRUE.

Source: R documentation: Extract

The repair is to write the full name, to use [["name"]] when the name is computed, and to switch the option on while developing and in tests, where the warning is caught by tryCatch() as above (it is a warning, so with options(warn = 2) it becomes an error). The scenario’s book objects are lists, so bk$pag completes to pages in the same way. R FAQ: no chapter 7 entry. Section 3.3.3 ("Others") of the FAQ, which lists differences between R and S, says that indexing with [ and a character vector looks only for exact matches whereas [[ and $ allow partial matches. In depth: Subsetting and Indexing, Lists and Defensive Programming and Input Validation.

T and F are not reserved words. They are ordinary variables in the base package whose values are TRUE and FALSE, and any code can assign to them. The logical help page states the difference: TRUE and FALSE are reserved words, while T and F are global variables that start out with those values. If a script, a package or a console session assigns T (a temperature, a time, a transposed matrix), every na.rm = T after it silently means something else: 0 is FALSE, so mean(x, na.rm = T) stops removing the missing values and returns NA, with no error and no warning. A function whose default is T looks T up where the function was defined, so it is affected too. The script defines such a function, breaks T on purpose, shows three wrong answers and removes the broken variable to uncover the real one.

Source: R documentation: logical

The repair is to write TRUE and FALSE, always; lintr has T_and_F_symbol_linter in its default set. R FAQ: no entry in chapter 7; section 3.3.3 states that T and F are just variables, that they can be overwritten and that code should always use TRUE and FALSE, and An Introduction to R (An Introduction to R: Logical vectors) says the same. In depth: Style, Linting and Static Analysis, Atomic Vectors and Types and Assignment, Names and Values (shadowing base names).

A factor stores small integer codes and a set of labels, the levels. as.numeric(f) returns the codes, not the numbers the labels spell. The levels are sorted, so the codes look plausible and the wrong answer is not noticed: in the output below the year 1974 becomes 2 because 1813 is the first level. The pitfall used to be common because read.csv() turned a column into a factor whenever one stray value ("n/a") made it text and stringsAsFactors was TRUE (the default before R 4.0.0, see the pitfall on stringsAsFactors). It still happens when a factor is made on purpose and then used as a number. R FAQ 7.10 gives the two repairs: as.numeric(as.character(f)), which converts every element, and as.numeric(levels(f))[as.integer(f)], which converts each level once and is more efficient, "but harder to remember"; and it says not to call as.numeric() or unclass() on the factor for this, as both give the internal codes.

Source: R FAQ 7.10: How do I convert factors to numeric?

The best repair is not to have the factor: books$year is an integer column already. A missing value stays NA through either conversion. R FAQ: 7.10. In depth: Factors and Atomic Vectors and Types.

Doubles are stored in binary with 53 significant bits. The only numbers that are exact are integers and fractions whose denominator is a power of two, so 0.1 is not exact and 3 * 0.1 is 0.30000000000000004, which == correctly reports as different from 0.3. R FAQ 7.31 is the question that asks it, with sqrt(2)^2 == 2 as the example, and answers with all.equal(), which compares with a tolerance of .Machine$double.eps ^ 0.5, about 1.5e-8. The comparison with == also fails inside lookups: unique(), table(), match(), %in% and which(x == value) treat two doubles that print the same as different values. The script shows the late fee of three days at 0.1 per day, the FAQ’s example, the lookup failures and the repairs.

Source: R FAQ 7.31: Why doesn’t R think these numbers are equal?

all.equal() returns TRUE or a character string such as "Mean relative difference: 0.03333333", never FALSE, so if (all.equal(a, b)) fails with "argument is not interpretable as logical" when the numbers differ: wrap it in isTRUE(). For a lookup, round both sides to a fixed number of digits first, or compare with an explicit tolerance as abs(grid - 0.3) < 1e-9. Money is better kept in whole units (cents as integers) than in doubles; integers and values like 0.5 are exact, as the last two lines show. R FAQ: 7.31. In depth: Numbers and Arithmetic and Defensive Programming and Input Validation.

sapply() is lapply() followed by simplify2array(), and what that does depends on the lengths of the answers: all of length one gives a vector, all of the same length greater than one gives a matrix, anything else gives a list. So the same call returns different shapes for different data, and for empty input it returns a list (list(), or named list() for a character vector), not an empty vector. Code tested on three elements fails on none. The script shows the three shapes, a longest() helper that works for three titles and fails for none with "invalid 'type' (list) of argument", and the vapply() version that returns 0 for none; the two vapply() calls at the end show its checks with R’s own text.

Source: R documentation: lapply

The repair is vapply() with a FUN.VALUE whenever the result is meant to be a vector or a matrix, and lapply() whenever it is meant to be a list. lintr has sapply in the list of the functions that undesirable_function_linter reports, with the advice to use vapply(). R FAQ: no entry (FAQ 7.17 is about outer() and shape, a different function). The lapply help page describes vapply as similar to sapply but "safer". In depth: The apply Family and Functionals and Defensive Programming and Input Validation.

R drops dimensions of length one when it can. Selecting a single row or column of a matrix gives a plain vector, with the dim attribute gone and the other dimnames turned into names; selecting one column of a data frame with a comma gives a vector too. A function written for a matrix of any number of rows then works for two rows and fails for one. R FAQ 7.5 says this was determined, after much discussion, to be a feature, that drop = FALSE prevents it, and that drop = FALSE should be used defensively when programming, because mat[index, ] returns a vector rather than a matrix when index has length one. The first script shows it on a matrix of years and page counts, with the failure message of apply().

Source: R FAQ 7.5: Why do my matrices lose dimensions?

For data frames the rule is slightly different: with a comma, df[, "col"] drops to a vector when one column is left; df["col"] (a single index, no comma) never drops, and neither does df[1, ] (one row). A helper that selects columns by name and passes the result to a function that needs a data frame or matrix, such as colMeans(), fails for exactly one column, with a message about arrays of at least two dimensions.

Source: R documentation: Extract.data.frame

The repair is drop = FALSE in every subscript whose index length is not known in advance, or df[cols] for data frames. Tibbles and data.table do not drop, which is one reason people choose them; this page does not run either package. R FAQ: 7.5 for matrices and arrays; no entry for data frames. In depth: Matrices and Arrays, Subsetting and Indexing and Data Frames.

Assigning NULL to a list element removes the element. rec$isbn <- NULL, rec[["isbn"]] <- NULL and rec["isbn"] <- NULL all delete the field, so a book without an ISBN loses the isbn entry and names(rec) shrinks. R FAQ 7.1 gives the repair: use x[i] <- list(NULL) to set component i of the list x to NULL, similarly for named components, and do not set x[i] or x[[i]] to NULL, because that removes the component. The same two-sided behaviour shows up elsewhere: list(1, NULL, 3) has three elements but c(list(1), NULL, list(3)) has two, because c() drops a bare NULL; and assigning NULL to an element of a result list in a loop shortens the list so later positions shift.

Source: R FAQ 7.1: How can I set components of a list to NULL?

Often what is really meant is "unknown", which is better stored as a typed NA such as NA_character_: it keeps the field, the type and the length. is.null(rec$isbn) cannot tell a field that is NULL from a field that does not exist, so use "isbn" %in% names(rec) for that. R FAQ: 7.1. In depth: Lists, Subsetting and Indexing and Missing and Special Values.

if and while need a condition that is exactly one TRUE or FALSE. The conditions that are not give an error each, with a message of its own: NA gives "missing value where TRUE/FALSE needed" (and if (year > 2000L) is NA when year is, as it is for the book in row 7), NULL or a zero-length vector give "argument is of length zero", a string that is not a logical gives "argument is not interpretable as logical". A condition of length greater than one used to take the first element with a warning; it has been an error since R 4.2.0 (the condition has length  1), and && and || with an operand of length greater than one warned in 4.2.0 and are an error since R 4.3.0 ("'length = 2' in coercion to 'logical(1)'"). The first script is about NA.

Source: R documentation: Control

The decision belongs to the programmer: decide what NA means and write it. isTRUE(cond) turns NA into FALSE; is.na(x) first, then the comparison, makes the third case explicit; !is.na(x) && x > 2000L short-circuits. The second script is about the length of the condition, with the fix: any() and all() (with na.rm = TRUE when NA is possible) say whether some or every element qualifies, and ifelse() computes a value per element.

Source: R documentation: Logic

The rule of thumb that goes with it is that && and || are for conditions of length one and & and | are for vectors; the vector_logic_linter of lintr reports the vector forms inside if. R FAQ: no entry. The changes are in the R NEWS of 4.2.0 and 4.3.0 (R NEWS: Changes in R 4.2.0) and An Introduction to R describes the conditional (An Introduction to R: Conditional execution). In depth: Control Flow, conditions of length greater than one and Missing and Special Values.

Global state is anything a function can change that outlives the call: the working directory, the options, the search path (library(), attach()), environment variables, the locale, the random seed, graphics parameters, and objects in the global environment (<<-, assign()). Code that changes it without putting it back is correct when run once, from a clean session, in the author’s folder, and wrong afterwards. Two cases are common enough to deserve a demonstration. The first is the working directory. A script that starts by moving to a folder of the author’s machine cannot run anywhere else, and a function that moves the session leaves the caller in a directory it did not choose: the next relative path fails or, worse, reads another file with the same name. The script below makes a scratch folder with a copy of the catalogue, shows the bad function, the failure it causes, and three repairs. R FAQ 7.8 is the related entry for file names on Windows (use forward slashes or escape the backslash).

Source: R documentation: setwd

The repair in order of preference is to move nothing: build the path (file.path(dir, "books.csv")) from a root that the project knows (an RStudio or Positron project, or Rscript started in the project folder, so that relative paths are relative to it); then, if a function must run in another directory, to restore it with on.exit() using the value that the setter returns; or to let withr 3.0.3 do the same in one call with withr::with_dir(). The getwd help page documents that the setter returns the old directory, invisibly. The second case is options. A function that calls options() and does not restore it changes every later printout in the session, and rm(list = ls()), the line at the top of many scripts "to start clean", does not reset it, because it removes objects and nothing else; a fresh process does (see the next script). R FAQ 7.7 recommends the pattern of the repair, taking the old values from options() and putting them back with on.exit().

Source: R FAQ 7.7: How should I set options?

R FAQ: none for the working directory itself; 7.3 ("How can I clean up my workspace?" answers with rm(list = ls(all.names = TRUE)), which removes objects only, and does not claim more), 7.7 for options and 7.8 for file names. In depth: Sessions, Workspaces and Startup, options(), Connections and the File System and Functions.

out <- c(out, value) in a loop allocates a new vector of length n + 1 and copies the n elements already there on every iteration, so the time grows with the square of the final length: doubling the number of iterations makes the loop about four times slower. Assigning past the end (out[[length(out) + 1]] <- value) is cheaper since R 3.4.0, whose NEWS records that assigning beyond the length now over-allocates by a small fraction so that building a vector this way is more efficient, "though pre-allocating is still preferred" and that the implementation is subject to change. The same holds for lists and, much worse, for rbind(df, row) on a data frame in a loop. The script computes 30000 squares four ways, checks that they agree for ten of them, times the first three and prints only comparisons, because seconds depend on the machine, the BLAS and what else is running: the first two comparisons are TRUE when the growing loop is more than five times slower than the preallocated loop and than vapply(); the third doubles the length and is TRUE when the time grows by more than a factor of 2.5, which a quadratic loop does and a linear one does not.

Source: R NEWS: Changes in R 3.4.0

The repairs, in order: vectorise (seq_len(n)^2), vapply() (the loop and the allocation done once), or preallocate with numeric(n), integer(n), character(n) or vector("list", n) and fill by position; when the final length is unknown, collect the pieces in a list and combine them once with unlist() or do.call(rbind, parts). R FAQ: no entry. In depth: Vectorisation and Iteration, Control Flow and Memory and Copy Semantics.

attach(df) puts a copy of a data frame on the search path so that its columns can be used without df$. The copy is the problem. Later changes to the data frame do not reach it; a global variable with a column’s name hides the column (R prints a message when an attach causes masking); attaching again stacks a second copy; and every function called in between sees the extra entry, so the meaning of a name depends on what happened earlier in the session. An Introduction to R describes the first of these itself: after an assignment the new value is not visible until the data frame is detached and attached again. The script reproduces each effect and ends with the repair.

Source: An Introduction to R: attach() and detach()

After the first attach(books), mean(pages) is 268.2143. The data frame then changes (books$pages[1] <- 1000L) and its own mean is 312, but the attached pages still gives 268.2143. The second attach(books) prints a message that the objects of the new entry mask those of the first, and search() shows books twice. With pages <- 1:3 in the workspace, mean(pages) is 2: the workspace comes before every attached entry, and the message says that the object is masked by .GlobalEnv. The repair is with(books, mean(pages, na.rm = TRUE)), books$pages, or the data = argument of the modelling functions; use() (R 4.4.0) attaches only the names you list. lintr reports attach in the same list as sapply and the working-directory setter. R FAQ: no entry on its misuse; section 3.3.3 only notes that attach() works for lists and data frames. In depth: Data Frames, Scoping, Environments and Closures and Packages, Libraries and Namespaces.

At the console a visible value is printed automatically. In a file that is run with source(), inside a function and in the body of a loop it is not: only an explicit print() or cat() shows anything. That is the content of R FAQ 7.16, which gives the repairs: print(1+1) instead of 1+1, or source(file, echo = TRUE). A file run with Rscript is read as a script and does print its visible top-level values, which is why the same file can look different under the two. The source help page documents print.eval, which defaults to the value of echo and can be set alone, and withAutoprint() for code that is already in the session; the value that source() returns is a list with the value and its visibility.

Source: R FAQ 7.16: Why is the output not printed when I source() a file?

The block shows, in order, the output of source(script) (only the print(sum(x)) line of the file), echo = TRUE (the code, each expression after a prompt, and the visible values; invisible(99) prints nothing) and print.eval = TRUE (the values alone). The script file is a temporary file, deleted at the end, and its path is never shown. R FAQ: 7.16. In depth: Scripts and the Command Line and Functions for visibility.

Until R 4.0.0 data.frame() and read.table() (so read.csv()) turned character columns into factors by default. R 4.0.0 changed the default to FALSE, and the data.frame help page says so: the old factory-fresh default was TRUE and it became FALSE in R 4.0.0. The helper default.stringsAsFactors() was deprecated in R 4.2.0 and is defunct since R 4.3.0, and options(stringsAsFactors = TRUE) is deprecated and warns. Code from before 2020 therefore breaks in both directions: scripts that expected factors (levels(df$genre) is now NULL) and scripts that begin with options(stringsAsFactors = FALSE) or end with as.character() calls to undo the conversion, which are now noise. The script shows today’s default, the old behaviour on request, the deprecation and the defunct function with their messages.

Source: R documentation: data.frame

The repair is to make a factor on purpose, after cleaning the text (the last lines trim and lower-case the nine spellings of the six genres of the scenario, then call factor()), and to pass stringsAsFactors = TRUE as an argument when the old conversion is wanted. R FAQ: no entry about this change; 7.10 is the related one for the conversion back. The R NEWS 4.0.0 entry says the default is stringsAsFactors = FALSE and that "a large number of packages relied on the previous behaviour". In depth: Data Frames and Factors.

R’s integer type has 32 bits, so the largest integer is .Machine$integer.max, 2147483647. Arithmetic on integers that goes beyond it does not wrap or switch to doubles: the Arithmetic help page says the result is NA_integer_ with a warning. Mixing in a double (2 or 1.0, not 2L) gives a double and no problem. sum() of integers has not overflowed since R 3.5.0 (the sum help page: "Integer overflow should no longer happen since R version 3.5.0"), but cumsum() still does, with its own message. The scenario has a natural victim: an ISBN-13 is a 13-digit number, larger than any integer, and as.integer("9780306406157") is NA. Doubles hold integers exactly up to 2 to the power 53, so 13 digits survive as doubles; but an identifier is not a number (you never add two ISBNs, ISBN-10 has an X, and a leading zero would be lost), so the scenario keeps ISBNs as strings.

Source: R documentation: Arithmetic

For integers that must exceed 32 bits and stay integers, the CRAN package bit64 provides a 64-bit type; it is not used or run on this page. In base R the repair is to use doubles: write 1 or 1e5 rather than 1L, convert with as.numeric() before multiplying, and keep identifiers as character. R FAQ: no entry. In depth: Numbers and Arithmetic and Atomic Vectors and Types.

sample(x) has a convenience that is a trap: if x has length one, is numeric and is at least 1, it samples from 1:x instead of from x. So sample(280L) is a random permutation of the numbers 1 to 280 and sample(280L, 1L) is one of them, not 280. It is harmless when x is a typed-in vector and a bug when x comes from a computation whose length varies, such as the rows that match a filter: with two matching rows sample(rows, 1L) picks one of them; with one matching row it picks a random row number between 1 and that row. The sample help page warns about it and ends its examples with the repair. Here which(books$pages > 420) is the single row 2 ("Pride and Prejudice", 432 pages), and drawing 200 times from it gives row 1 about half the time.

Source: R documentation: sample

The repair is the resample() function from the help page, x[sample.int(length(x), ...)], which always indexes; sample.int() takes the number of items and never reinterprets its first argument. Character vectors are not affected (sample("a") is "a"), which hides the bug in tests that use titles and shows it with row numbers. With nothing to sample from both functions fail with "invalid first argument", so a caller that can get an empty set checks length(x) first. Results of sample() also changed in R 3.6.0, whose default became rejection sampling, so seeds from older scripts give other draws. R FAQ: no entry. In depth: Distributions and Random Numbers and the R 3.6.0 change.