Skip to content

redis-server crashes when using UNWIND #2057

@narayanacharya6

Description

@narayanacharya6

A minimal example to reproduce the issue:

redis /tmp/redis.sock> "GRAPH.QUERY" "X" "MATCH (n) DETACH DELETE n" "--compact"
1) 1) "Cached execution: 0"
   2) "Query internal execution time: 0.496000 milliseconds"
redis /tmp/redis.sock> "GRAPH.QUERY" "X" "CREATE INDEX ON :T(le)" "--compact"
1) 1) "Indices created: 1"
   2) "Cached execution: 0"
   3) "Query internal execution time: 0.526000 milliseconds"
redis /tmp/redis.sock> "GRAPH.QUERY" "X" "CREATE INDEX ON :A(la)" "--compact"
1) 1) "Indices created: 1"
   2) "Cached execution: 0"
   3) "Query internal execution time: 0.351000 milliseconds"
redis /tmp/redis.sock> "GRAPH.QUERY" "X" "CREATE INDEX ON :N(la)" "--compact"
1) 1) "Indices created: 1"
   2) "Cached execution: 0"
   3) "Query internal execution time: 0.174000 milliseconds"
redis /tmp/redis.sock> 
redis /tmp/redis.sock> "GRAPH.QUERY" "X" "CYPHER my_id=\"ABCD\" MERGE (:D {my_id:$my_id})" "--compact"
1) 1) "Labels added: 1"
   2) "Nodes created: 1"
   3) "Properties set: 1"
   4) "Cached execution: 0"
   5) "Query internal execution time: 0.429000 milliseconds"
redis /tmp/redis.sock> GRAPH.QUERY X "CYPHER batch=[[0, 44, 0, 226, 'ABCD'], [44, 84, 226, 449, 'ABCD']] UNWIND $batch as row CREATE (s:S {start:row[0], end:row[1], start_char:row[2], end_char:row[3]}) WITH s, row MATCH (d:D {my_id:row[4]}) MERGE (d)-[:S]->(s)" --compact
Error: Server closed the connection

Bug Report:

=== REDIS BUG REPORT START: Cut & paste starting from here ===
44794:M 07 Dec 2021 16:34:53.664 # Redis 6.2.6 crashed by signal: 11, si_code: 0
44794:M 07 Dec 2021 16:34:53.664 # Accessing address: 0x0
44794:M 07 Dec 2021 16:34:53.664 # Killed by PID: 0, UID: 0
44794:M 07 Dec 2021 16:34:53.664 # Crashed running the instruction at: 0x1049380d4

------ STACK TRACE ------
EIP:
0   redisgraph.so                       0x00000001049380d4 Map_Clone + 36

Backtrace:
0   libsystem_platform.dylib            0x00007ff808985e2d _sigtramp + 29
1   ???                                 0x0000000000000003 0x0 + 3

------ REGISTERS ------
44794:M 07 Dec 2021 16:34:53.665 # 
RAX:0000000100f42a44 RBX:0492c0a000000000
RCX:01e0aacc00000000 RDX:000000010491bccc
RDI:0492c0a000000000 RSI:01e0aacc00000001
RBP:000000010638c000 RSP:000070000e369a60
R8 :0000000000000010 R9 :00000000000002b0
R10:00007ff463700000 R11:0000000000000000
R12:0000600003a28eac R13:000000010638c00c
R14:0000000400006000 R15:0000000000000000
RIP:00000001049380d4 EFL:0000000000010206
CS :000000000000002b FS:0000000000000000  GS:0000000000000000
44794:M 07 Dec 2021 16:34:53.665 # (000070000e369a6f) -> 0000000400006000
44794:M 07 Dec 2021 16:34:53.665 # (000070000e369a6e) -> 000000010638c00c
44794:M 07 Dec 2021 16:34:53.665 # (000070000e369a6d) -> 0000600003a28eac
44794:M 07 Dec 2021 16:34:53.665 # (000070000e369a6c) -> 000000010638c000
44794:M 07 Dec 2021 16:34:53.665 # (000070000e369a6b) -> 000000000002ff47
44794:M 07 Dec 2021 16:34:53.665 # (000070000e369a6a) -> 0000000000000000
44794:M 07 Dec 2021 16:34:53.665 # (000070000e369a69) -> 0000000100edacea
44794:M 07 Dec 2021 16:34:53.665 # (000070000e369a68) -> 000070000e369ac0
44794:M 07 Dec 2021 16:34:53.665 # (000070000e369a67) -> 0000000000000000
44794:M 07 Dec 2021 16:34:53.665 # (000070000e369a66) -> 0000000000000000
44794:M 07 Dec 2021 16:34:53.665 # (000070000e369a65) -> 0000000100edacc1
44794:M 07 Dec 2021 16:34:53.665 # (000070000e369a64) -> 000070000e369aa0
44794:M 07 Dec 2021 16:34:53.665 # (000070000e369a63) -> 0000000100006000
44794:M 07 Dec 2021 16:34:53.665 # (000070000e369a62) -> 0000000000000000
44794:M 07 Dec 2021 16:34:53.665 # (000070000e369a61) -> 000000010638c00c
44794:M 07 Dec 2021 16:34:53.665 # (000070000e369a60) -> 0000000000000000

------ INFO OUTPUT ------
# Server
redis_version:6.2.6
redis_git_sha1:00000000
redis_git_dirty:0
redis_build_id:c6f3693d1aced7d9
redis_mode:standalone
os:Darwin 21.1.0 x86_64
arch_bits:64
multiplexing_api:kqueue
atomicvar_api:c11-builtin
gcc_version:4.2.1
process_id:44794
process_supervised:no
run_id:e1058dd717929c63bdaf05478350c70546c39a50
tcp_port:6379
server_time_usec:1638875093659734
uptime_in_seconds:55
uptime_in_days:0
hz:10
configured_hz:10
lru_clock:11485141
executable:/Users/narayan/OSS/RedisGraph/redis-server
config_file:
io_threads_active:0

# Clients
connected_clients:1
cluster_connections:0
maxclients:10000
client_recent_max_input_buffer:48
client_recent_max_output_buffer:0
blocked_clients:1
tracking_clients:0
clients_in_timeout_table:0

# Memory
used_memory:43229996688
used_memory_human:40.26G
used_memory_rss:9003008
used_memory_rss_human:8.59M
used_memory_peak:43229996688
used_memory_peak_human:40.26G
used_memory_peak_perc:1019390.69%
used_memory_overhead:1077736
used_memory_startup:1060208
used_memory_dataset:43228918952
used_memory_dataset_perc:100.00%
allocator_allocated:4156720
allocator_active:8965120
allocator_resident:8965120
total_system_memory:34359738368
total_system_memory_human:32.00G
used_memory_lua:37888
used_memory_lua_human:37.00K
used_memory_scripts:0
used_memory_scripts_human:0B
number_of_cached_scripts:0
maxmemory:0
maxmemory_human:0B
maxmemory_policy:allkeys-lru
allocator_frag_ratio:2.16
allocator_frag_bytes:4808400
allocator_rss_ratio:1.00
allocator_rss_bytes:0
rss_overhead_ratio:1.00
rss_overhead_bytes:37888
mem_fragmentation_ratio:2.17
mem_fragmentation_bytes:4846288
mem_not_counted_for_evict:0
mem_replication_backlog:0
mem_clients_slaves:0
mem_clients_normal:17456
mem_aof_buffer:0
mem_allocator:libc
active_defrag_running:0
lazyfree_pending_objects:0
lazyfreed_objects:0

# Persistence
loading:0
current_cow_size:0
current_cow_size_age:0
current_fork_perc:0.00
current_save_keys_processed:0
current_save_keys_total:0
rdb_changes_since_last_save:4
rdb_bgsave_in_progress:0
rdb_last_save_time:1638875038
rdb_last_bgsave_status:ok
rdb_last_bgsave_time_sec:-1
rdb_current_bgsave_time_sec:-1
rdb_last_cow_size:0
aof_enabled:0
aof_rewrite_in_progress:0
aof_rewrite_scheduled:0
aof_last_rewrite_time_sec:-1
aof_current_rewrite_time_sec:-1
aof_last_bgrewrite_status:ok
aof_last_write_status:ok
aof_last_cow_size:0
module_fork_in_progress:0
module_fork_last_cow_size:0

# Stats
total_connections_received:1
total_commands_processed:7
instantaneous_ops_per_sec:0
total_net_input_bytes:682
total_net_output_bytes:21547
instantaneous_input_kbps:0.00
instantaneous_output_kbps:0.00
rejected_connections:0
sync_full:0
sync_partial_ok:0
sync_partial_err:0
expired_keys:0
expired_stale_perc:0.00
expired_time_cap_reached_count:0
expire_cycle_cpu_milliseconds:0
evicted_keys:0
keyspace_hits:11
keyspace_misses:1
pubsub_channels:0
pubsub_patterns:0
latest_fork_usec:0
total_forks:0
migrate_cached_sockets:0
slave_expires_tracked_keys:0
active_defrag_hits:0
active_defrag_misses:0
active_defrag_key_hits:0
active_defrag_key_misses:0
tracking_total_keys:0
tracking_total_items:0
tracking_total_prefixes:0
unexpected_error_replies:0
total_error_replies:0
dump_payload_sanitizations:0
total_reads_processed:7
total_writes_processed:6
io_threaded_reads_processed:0
io_threaded_writes_processed:0

# Replication
role:master
connected_slaves:0
master_failover_state:no-failover
master_replid:d8b16ae5bab842145efad83edc9d48e640340b75
master_replid2:0000000000000000000000000000000000000000
master_repl_offset:0
second_repl_offset:-1
repl_backlog_active:0
repl_backlog_size:1048576
repl_backlog_first_byte_offset:0
repl_backlog_histlen:0

# CPU
used_cpu_sys:0.039482
used_cpu_user:0.038289
used_cpu_sys_children:0.000000
used_cpu_user_children:0.000000

# Modules
module:name=graph,ver=999999,api=1,filters=0,usedby=[],using=[],options=[]

# Commandstats
cmdstat_command:calls=1,usec=735,usec_per_call=735.00,rejected_calls=0,failed_calls=0
cmdstat_graph.QUERY:calls=6,usec=1804,usec_per_call=300.67,rejected_calls=0,failed_calls=0

# Errorstats

# Cluster
cluster_enabled:0

# Keyspace
db0:keys=1,expires=0,avg_ttl=0

------ CLIENT LIST OUTPUT ------
id=5 addr=/tmp/redis.sock:0 laddr=/tmp/redis.sock:0 fd=9 name= age=49 idle=0 flags=bU db=0 sub=0 psub=0 multi=-1 qbuf=0 qbuf-free=65530 argv-mem=243 obl=0 oll=0 omem=0 tot-mem=83219 events=r cmd=graph.QUERY user=default redir=-1

------ MODULES INFO OUTPUT ------
# graph_executing commands
graph_command:GRAPH.QUERY CYPHER batch=[[0, 44, 0, 226, 'ABCD'], [44, 84, 226, 449, 'ABCD']] UNWIND $batch as row CREATE (s:S {start:row[0], end:row[1], start_char:row[2], end_char:row[3]}) WITH s, row MATCH (d:D {my_id:row[4]}) MERGE (d)-[:S]->(s)

------ DUMPING CODE AROUND EIP ------
Symbol: Map_Clone (base: 0x1049380b0)
Module: /Users/narayan/OSS/RedisGraph/src/redisgraph.so (base 0x104918000)
$ xxd -r -p /tmp/dump.hex /tmp/dump.bin
$ objdump --adjust-vma=0x1049380b0 -D -b binary -m i386:x86-64 /tmp/dump.bin
------
44794:M 07 Dec 2021 16:34:53.666 # dump of function (hexdump of 164 bytes):
415741564155415455534883ec58488d05137b4d014885ff488b000f84a70100004889fb8b7ff44989fc48c1e7054883c70cffd04585e4448960044c8d780c4889c5c7400820000000c700000000000f8453010000418d4424ff48c1e005488d44032048890424eb710f1f8000000000418b77fc01d239ca488d05a17f4d01480f42d1488b7c24084883c320480faff2418957f84883c60cff104c8d780c4889c58b008d

=== REDIS BUG REPORT END. Make sure to include from START to END. ===

       Please report the crash by opening an issue on github:

           http://github.com/redis/redis/issues

  Suspect RAM error? Use redis-server --test-memory to verify it.

zsh: segmentation fault  redis-server --unixsocket /tmp/redis.sock --save "tmp.rdb" --appendonly no

Am I using UNWIND correctly?

Using RedisGraph built from commit ID: c7ec83ed on master
redis-server version: Redis server v=6.2.6 sha=00000000:0 malloc=libc bits=64 build=c6f3693d1aced7d9
Run as: redis-server --unixsocket /tmp/redis.sock --save "tmp.rdb" --appendonly no --maxmemory-policy allkeys-lru --loadmodule ./src/redisgraph.so
OS Version: macOS Monterey 12.0.1

Metadata

Metadata

Assignees

No one assigned

    Labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions