Describe the bug

Syntactically correct Cypher code crashes the server. Granted, the code is not supported by RedisGraph, but if running Cypher code can crash the server, what other kind of Cypher code could also crash it?

To reproduce Run the following Python code (the host and port number need to be changed).

import redis
r = redis.Redis(host='localhost', port=9090)

# --- Succeeds as expected ---
query = \
    """
    MERGE (o:Order {orderId: 123456789})
    ON CREATE SET
        o.units = 10,
        o.price = 5.89,
        o.description = 'Cookies'
    """
reply = r.execute_command('GRAPH.QUERY', 'test', query)

# --- Crashes server, UNEXPECTED ---
# syntactically correct in Cypher; granted, not supported but should NOT crash the server.
query = \
    """
    MERGE (o:Order {orderId: 123456793})
    ON CREATE SET
        o.dummy02 = datetime({year:1984, month:10, day:11, hour:12, timezone: '+01:00'})
    """
reply = r.execute_command('GRAPH.QUERY', 'test', query)

Expected behavior

A description of what you expected to happen.

Additional information

1:M 07 Sep 2021 19:17:36.880 * Done decoding graph social

1:M 07 Sep 2021 19:17:36.880 * Done decoding graph test

1:M 07 Sep 2021 19:17:36.885 * Done decoding graph monitoring

1:M 07 Sep 2021 19:17:36.886 * Deleted 0 virtual keys for graph social

1:M 07 Sep 2021 19:17:36.886 * Deleted 0 virtual keys for graph test

1:M 07 Sep 2021 19:17:36.886 * Deleted 0 virtual keys for graph monitoring

1:M 07 Sep 2021 19:17:36.886 * DB loaded from disk: 0.006 seconds

1:M 07 Sep 2021 19:17:36.886 * Ready to accept connections

=== REDIS BUG REPORT START: Cut & paste starting from here ===

1:M 07 Sep 2021 19:18:10.301 # Redis 6.2.5 crashed by signal: 11, si_code: 1

1:M 07 Sep 2021 19:18:10.301 # Accessing address: 0x18

1:M 07 Sep 2021 19:18:10.301 # Crashed running the instruction at: 0x7fb4df8e10a1

------ STACK TRACE ------

EIP:

/usr/lib/redis/modules/redisgraph.so(AR_EXP_ReduceToScalar+0x91)[0x7fb4df8e10a1]

Backtrace:

/lib/x86_64-linux-gnu/libpthread.so.0(+0x12730)[0x7fb4e0b1b730]

/usr/lib/redis/modules/redisgraph.so(AR_EXP_ReduceToScalar+0x91)[0x7fb4df8e10a1]

/usr/lib/redis/modules/redisgraph.so(AR_EXP_FromASTNode+0x15)[0x7fb4df8df075]

/usr/lib/redis/modules/redisgraph.so(+0x19beeb)[0x7fb4df918eeb]

/usr/lib/redis/modules/redisgraph.so(AST_PrepareMergeOp+0x155)[0x7fb4df919685]

/usr/lib/redis/modules/redisgraph.so(buildMergeOp+0x137)[0x7fb4df9030a7]

/usr/lib/redis/modules/redisgraph.so(ExecutionPlan_PopulateExecutionPlan+0x72)[0x7fb4df8f1ac2]

/usr/lib/redis/modules/redisgraph.so(NewExecutionPlan+0x126)[0x7fb4df8f1c26]

/usr/lib/redis/modules/redisgraph.so(ExecutionCtx_FromQuery+0xcd)[0x7fb4df8ecb3d]

/usr/lib/redis/modules/redisgraph.so(Graph_Query+0x3e)[0x7fb4df8ecffe]

/usr/lib/redis/modules/redisgraph.so(+0x1aba9d)[0x7fb4df928a9d]

/lib/x86_64-linux-gnu/libpthread.so.0(+0x7fa3)[0x7fb4e0b10fa3]

/lib/x86_64-linux-gnu/libc.so.6(clone+0x3f)[0x7fb4e0a3f4cf]

------ REGISTERS ------

1:M 07 Sep 2021 19:18:10.303 #

RAX:0000000000000000 RBX:0000000000000001

RCX:0000000000000001 RDX:0000000000000000

RDI:000055d6c18279e0 RSI:00007fb4de778260

RBP:00007fb4d92080f0 RSP:00007fb4de778290

R8 :0000000000000001 R9 :000055d6c18279e4

R10:0000000000000001 R11:0000000000000008

R12:0000000000000000 R13:0000000000000001

R14:0000000000000000 R15:0000000000000000

RIP:00007fb4df8e10a1 EFL:0000000000010202

CSGSFS:002b000000000033

1:M 07 Sep 2021 19:18:10.303 # (00007fb4de77829f) -> 00007fb4e04366e0

1:M 07 Sep 2021 19:18:10.303 # (00007fb4de77829e) -> 0000000000000000

1:M 07 Sep 2021 19:18:10.303 # (00007fb4de77829d) -> 00007fb4c42024a0

1:M 07 Sep 2021 19:18:10.303 # (00007fb4de77829c) -> 0000000000000000

1:M 07 Sep 2021 19:18:10.303 # (00007fb4de77829b) -> 00007fb4df918eeb

1:M 07 Sep 2021 19:18:10.303 # (00007fb4de77829a) -> 0000000000000004

1:M 07 Sep 2021 19:18:10.303 # (00007fb4de778299) -> 00007fb4df8df075

1:M 07 Sep 2021 19:18:10.303 # (00007fb4de778298) -> 00007fb4c4202390

1:M 07 Sep 2021 19:18:10.303 # (00007fb4de778297) -> 00007fb4c4202830

1:M 07 Sep 2021 19:18:10.303 # (00007fb4de778296) -> 00007fb4c4201658

1:M 07 Sep 2021 19:18:10.303 # (00007fb4de778295) -> 0000000000000001

1:M 07 Sep 2021 19:18:10.303 # (00007fb4de778294) -> 00007fb4d9217078

1:M 07 Sep 2021 19:18:10.303 # (00007fb4de778293) -> 00007fb4d92080f0

1:M 07 Sep 2021 19:18:10.303 # (00007fb4de778292) -> 00007fb4c4202910

1:M 07 Sep 2021 19:18:10.303 # (00007fb4de778291) -> 000055d6bfc384af

1:M 07 Sep 2021 19:18:10.303 # (00007fb4de778290) -> 0000000000000001

------ INFO OUTPUT ------

Server

redis_version:6.2.5

redis_git_sha1:00000000

redis_git_dirty:0

redis_build_id:fecbae34a84549de

redis_mode:standalone

os:Linux 5.10.25-linuxkit x86_64

arch_bits:64

multiplexing_api:epoll

atomicvar_api:c11-builtin

gcc_version:8.3.0

process_id:1

process_supervised:no

run_id:a416831a130a01427fe69996957dbf5eda9976de

tcp_port:6379

server_time_usec:1631042290301569

uptime_in_seconds:34

uptime_in_days:0

hz:10

configured_hz:10

lru_clock:3652338

executable:/data/redis-server

config_file:

io_threads_active:0

Clients

connected_clients:1

cluster_connections:0

maxclients:10000

client_recent_max_input_buffer:0

client_recent_max_output_buffer:0

blocked_clients:1

tracking_clients:0

clients_in_timeout_table:0

Memory

used_memory:5612976

used_memory_human:5.35M

used_memory_rss:13381632

used_memory_rss_human:12.76M

used_memory_peak:5612976

used_memory_peak_human:5.35M

used_memory_peak_perc:100.43%

used_memory_overhead:843056

used_memory_startup:842872

used_memory_dataset:4769920

used_memory_dataset_perc:100.00%

allocator_allocated:5768760

allocator_active:6303744

allocator_resident:8740864

total_system_memory:2083942400

total_system_memory_human:1.94G

used_memory_lua:37888

used_memory_lua_human:37.00K

used_memory_scripts:0

used_memory_scripts_human:0B

number_of_cached_scripts:0

maxmemory:0

maxmemory_human:0B

maxmemory_policy:noeviction

allocator_frag_ratio:1.09

allocator_frag_bytes:534984

allocator_rss_ratio:1.39

allocator_rss_bytes:2437120

rss_overhead_ratio:1.53

rss_overhead_bytes:4640768

mem_fragmentation_ratio:2.43

mem_fragmentation_bytes:7875880

mem_not_counted_for_evict:0

mem_replication_backlog:0

mem_clients_slaves:0

mem_clients_normal:0

mem_aof_buffer:0

mem_allocator:jemalloc-5.1.0

active_defrag_running:0

lazyfree_pending_objects:0

lazyfreed_objects:0

Persistence

loading:0

current_cow_size:0

current_cow_size_age:0

current_fork_perc:0.00

current_save_keys_processed:0

current_save_keys_total:0

rdb_changes_since_last_save:0

rdb_bgsave_in_progress:0

rdb_last_save_time:1631042256

rdb_last_bgsave_status:ok

rdb_last_bgsave_time_sec:-1

rdb_current_bgsave_time_sec:-1

rdb_last_cow_size:0

aof_enabled:0

aof_rewrite_in_progress:0

aof_rewrite_scheduled:0

aof_last_rewrite_time_sec:-1

aof_current_rewrite_time_sec:-1

aof_last_bgrewrite_status:ok

aof_last_write_status:ok

aof_last_cow_size:0

module_fork_in_progress:0

module_fork_last_cow_size:0

Stats

total_connections_received:2

total_commands_processed:2

instantaneous_ops_per_sec:0

total_net_input_bytes:391

total_net_output_bytes:391

instantaneous_input_kbps:0.00

instantaneous_output_kbps:0.00

rejected_connections:0

sync_full:0

sync_partial_ok:0

sync_partial_err:0

expired_keys:0

expired_stale_perc:0.00

expired_time_cap_reached_count:0

expire_cycle_cpu_milliseconds:0

evicted_keys:0

keyspace_hits:2

keyspace_misses:0

pubsub_channels:0

pubsub_patterns:0

latest_fork_usec:0

total_forks:0

migrate_cached_sockets:0

slave_expires_tracked_keys:0

active_defrag_hits:0

active_defrag_misses:0

active_defrag_key_hits:0

active_defrag_key_misses:0

tracking_total_keys:0

tracking_total_items:0

tracking_total_prefixes:0

unexpected_error_replies:0

total_error_replies:1

dump_payload_sanitizations:0

total_reads_processed:3

total_writes_processed:1

io_threaded_reads_processed:0

io_threaded_writes_processed:0

Replication

role:master

connected_slaves:0

master_failover_state:no-failover

master_replid:0d3a32824fc256e3ffa581ca62cceb6490e7aa0b

master_replid2:0000000000000000000000000000000000000000

master_repl_offset:0

second_repl_offset:-1

repl_backlog_active:0

repl_backlog_size:1048576

repl_backlog_first_byte_offset:0

repl_backlog_histlen:0

CPU

used_cpu_sys:0.040484

used_cpu_user:0.070587

used_cpu_sys_children:0.001434

used_cpu_user_children:0.000591

used_cpu_sys_main_thread:0.001017

used_cpu_user_main_thread:0.001017

Modules

module:name=graph,ver=20408,api=1,filters=0,usedby=[],using=[],options=[]

Commandstats

cmdstat_graph.QUERY:calls=2,usec=80,usec_per_call=40.00,rejected_calls=0,failed_calls=0

Errorstats

errorstat_errMsg_:count=1

Cluster

cluster_enabled:0

Keyspace

db0:keys=3,expires=0,avg_ttl=0

------ CLIENT LIST OUTPUT ------

id=13 addr=172.17.0.1:59578 laddr=172.17.0.3:6379 fd=8 name= age=0 idle=0 flags=b db=0 sub=0 psub=0 multi=-1 qbuf=0 qbuf-free=40954 argv-mem=153 obl=0 oll=0 omem=0 tot-mem=61617 events=r cmd=graph.QUERY user=default redir=-1

------ MODULES INFO OUTPUT ------

graph_executing commands

graph_command:GRAPH.QUERY

MERGE (o:Order {orderId: 123456791})

ON CREATE SET

o.dummy02 = datetime({year:1984, month:10, day:11, hour:12, timezone: '+01:00'})

------ FAST MEMORY TEST ------

1:M 07 Sep 2021 19:18:10.304 # main thread terminated

1:M 07 Sep 2021 19:18:10.304 # Bio thread for job type #0 terminated

1:M 07 Sep 2021 19:18:10.304 # Bio thread for job type #1 terminated

1:M 07 Sep 2021 19:18:10.305 # Bio thread for job type #2 terminated

Fast memory test PASSED, however your memory can still be broken. Please run a memory test for several hours if possible.

------ DUMPING CODE AROUND EIP ------

Symbol: AR_EXP_ReduceToScalar (base: 0x7fb4df8e1010)

Module: /usr/lib/redis/modules/redisgraph.so (base 0x7fb4df77d000)

$ xxd -r -p /tmp/dump.hex /tmp/dump.bin

$ objdump --adjust-vma=0x7fb4df8e1010 -D -b binary -m i386:x86-64 /tmp/dump.bin

1:M 07 Sep 2021 19:18:10.305 # dump of function (hexdump of 273 bytes):

415741564989d6415541544189f4554889fd534883ec184885d2740ce80f5dffff49890649895608837d20028b45100f8423010000450fb6e431db41bd010000004531ff85c07e40488b451831d24489e6488b3cd8e8a6ffffff84c0450f44ef4883c301395d107fdf4584ed751a4531e44883c4184489e05b5d415c415d415e415fc30f1f440000488b7d08e89f0d0000440fb660184584e474d331f64889efe8abfdffff4989c54989d74d85f67407498906498956084c89fe4c89efe85e5fffff84c075a8488b4500488b7820488b40304885c00f84d90000004885ff0f84d0000000ffd04c8b35ebc56e00488b7d0041ff168b451031db85c07f1ee9de000000660f1f4400004889c74883c30141ff

Function at 0x7fb4df8d6d40 is SI_NullVal

Function at 0x7fb4df8e1010 is AR_EXP_ReduceToScalar

Function at 0x7fb4df8e1e40 is AR_GetFunc

Function at 0x7fb4df8e0e60 is AR_EXP_Evaluate

Function at 0x7fb4df8d7030 is SIValue_IsNull

=== REDIS BUG REPORT END. Make sure to include from START to END. ===

Please report the crash by opening an issue on github:

http://github.com/redis/redis/issues

Suspect RAM error? Use redis-server --test-memory to verify it.

1:C 07 Sep 2021 19:22:43.311 # oO0OoO0OoO0Oo Redis is starting oO0OoO0OoO0Oo

1:C 07 Sep 2021 19:22:43.311 # Redis version=6.2.5, bits=64, commit=00000000, modified=0, pid=1, just started

1:C 07 Sep 2021 19:22:43.311 # Configuration loaded

1:M 07 Sep 2021 19:22:43.312 * monotonic clock: POSIX clock_gettime

.-``__ ''-.

.-`. `. ''-._ Redis 6.2.5 (00000000/0) 64 bit

.-`` .-.\/ ., ''-._

( ' , .-|, ) Running in standalone mode

|-._-...-__...-.``-._|' _.-'| Port: 6379

| -._. / .-' | PID: 1

-._-. `-./ .-' _.-'

|-._-. `-.__.-' .-'_.-'|

| -._-. .-'_.-' | https://redis.io

-._-.`-.__.-'.-' _.-'

|-._-. `-.__.-' .-'_.-'|

| -._-. .-'_.-' |

-._-.`-.__.-'.-' _.-'

-._-.__.-' _.-'

`-. .-'

`-.__.-'

1:M 07 Sep 2021 19:22:43.312 # Server initialized

1:M 07 Sep 2021 19:22:43.323 * Starting up RedisGraph version 2.4.8.

1:M 07 Sep 2021 19:22:43.329 * Thread pool created, using 2 threads.

1:M 07 Sep 2021 19:22:43.329 * Maximum number of OpenMP threads set to 2

1:M 07 Sep 2021 19:22:43.329 * Module 'graph' loaded from /usr/lib/redis/modules/redisgraph.so

1:M 07 Sep 2021 19:22:43.329 * Loading RDB produced by version 6.2.5

1:M 07 Sep 2021 19:22:43.329 * RDB age 1051 seconds

1:M 07 Sep 2021 19:22:43.329 * RDB memory usage when created 5.25 Mb

1:M 07 Sep 2021 19:22:43.330 * Done decoding graph social

1:M 07 Sep 2021 19:22:43.330 * Done decoding graph test

1:M 07 Sep 2021 19:22:43.335 * Done decoding graph monitoring

1:M 07 Sep 2021 19:22:43.335 * Deleted 0 virtual keys for graph social

1:M 07 Sep 2021 19:22:43.335 * Deleted 0 virtual keys for graph test

1:M 07 Sep 2021 19:22:43.335 * Deleted 0 virtual keys for graph monitoring

1:M 07 Sep 2021 19:22:43.335 * DB loaded from disk: 0.006 seconds

1:M 07 Sep 2021 19:22:43.335 * Ready to accept connections

=== REDIS BUG REPORT START: Cut & paste starting from here ===

1:M 07 Sep 2021 19:22:48.952 # Redis 6.2.5 crashed by signal: 11, si_code: 1

1:M 07 Sep 2021 19:22:48.952 # Accessing address: 0x18

1:M 07 Sep 2021 19:22:48.952 # Crashed running the instruction at: 0x7f12f3ce10a1

------ STACK TRACE ------

EIP:

/usr/lib/redis/modules/redisgraph.so(AR_EXP_ReduceToScalar+0x91)[0x7f12f3ce10a1]

Backtrace:

/lib/x86_64-linux-gnu/libpthread.so.0(+0x12730)[0x7f12f4efb730]

/usr/lib/redis/modules/redisgraph.so(AR_EXP_ReduceToScalar+0x91)[0x7f12f3ce10a1]

/usr/lib/redis/modules/redisgraph.so(AR_EXP_FromASTNode+0x15)[0x7f12f3cdf075]

/usr/lib/redis/modules/redisgraph.so(+0x19beeb)[0x7f12f3d18eeb]

/usr/lib/redis/modules/redisgraph.so(AST_PrepareMergeOp+0x155)[0x7f12f3d19685]

/usr/lib/redis/modules/redisgraph.so(buildMergeOp+0x137)[0x7f12f3d030a7]

/usr/lib/redis/modules/redisgraph.so(ExecutionPlan_PopulateExecutionPlan+0x72)[0x7f12f3cf1ac2]

/usr/lib/redis/modules/redisgraph.so(NewExecutionPlan+0x126)[0x7f12f3cf1c26]

/usr/lib/redis/modules/redisgraph.so(ExecutionCtx_FromQuery+0xcd)[0x7f12f3cecb3d]

/usr/lib/redis/modules/redisgraph.so(Graph_Query+0x3e)[0x7f12f3cecffe]

/usr/lib/redis/modules/redisgraph.so(+0x1aba9d)[0x7f12f3d28a9d]

/lib/x86_64-linux-gnu/libpthread.so.0(+0x7fa3)[0x7f12f4ef0fa3]

/lib/x86_64-linux-gnu/libc.so.6(clone+0x3f)[0x7f12f4e1f4cf]

------ REGISTERS ------

1:M 07 Sep 2021 19:22:48.954 #

RAX:0000000000000000 RBX:0000000000000001

RCX:0000000000000001 RDX:0000000000000000

RDI:000055f56af219e0 RSI:00007f12f2b78260

RBP:00007f12ee8080f0 RSP:00007f12f2b78290

R8 :0000000000000001 R9 :000055f56af219e4

R10:0000000000000001 R11:0000000000000008

R12:0000000000000000 R13:0000000000000001

R14:0000000000000000 R15:0000000000000000

RIP:00007f12f3ce10a1 EFL:0000000000010202

CSGSFS:002b000000000033

1:M 07 Sep 2021 19:22:48.954 # (00007f12f2b7829f) -> 00007f12f48366e0

1:M 07 Sep 2021 19:22:48.954 # (00007f12f2b7829e) -> 0000000000000000

1:M 07 Sep 2021 19:22:48.954 # (00007f12f2b7829d) -> 00007f12e0001210

1:M 07 Sep 2021 19:22:48.954 # (00007f12f2b7829c) -> 0000000000000000

1:M 07 Sep 2021 19:22:48.954 # (00007f12f2b7829b) -> 00007f12f3d18eeb

1:M 07 Sep 2021 19:22:48.954 # (00007f12f2b7829a) -> 0000000000000004

1:M 07 Sep 2021 19:22:48.954 # (00007f12f2b78299) -> 00007f12f3cdf075

1:M 07 Sep 2021 19:22:48.954 # (00007f12f2b78298) -> 00007f12e0001120

1:M 07 Sep 2021 19:22:48.954 # (00007f12f2b78297) -> 00007f12e0001640

1:M 07 Sep 2021 19:22:48.954 # (00007f12f2b78296) -> 00007f12e0003df8

1:M 07 Sep 2021 19:22:48.954 # (00007f12f2b78295) -> 0000000000000001

1:M 07 Sep 2021 19:22:48.954 # (00007f12f2b78294) -> 00007f12ee817078

1:M 07 Sep 2021 19:22:48.954 # (00007f12f2b78293) -> 00007f12ee8080f0

1:M 07 Sep 2021 19:22:48.954 # (00007f12f2b78292) -> 00007f12e0001720

1:M 07 Sep 2021 19:22:48.954 # (00007f12f2b78291) -> 000055f568f4b4af

1:M 07 Sep 2021 19:22:48.954 # (00007f12f2b78290) -> 0000000000000001

------ INFO OUTPUT ------

Server

redis_version:6.2.5

redis_git_sha1:00000000

redis_git_dirty:0

redis_build_id:fecbae34a84549de

redis_mode:standalone

os:Linux 5.10.25-linuxkit x86_64

arch_bits:64

multiplexing_api:epoll

atomicvar_api:c11-builtin

gcc_version:8.3.0

process_id:1

process_supervised:no

run_id:02672a4c815924b9f99aa3cf912886e1b099a6d5

tcp_port:6379

server_time_usec:1631042568951921

uptime_in_seconds:5

uptime_in_days:0

hz:10

configured_hz:10

lru_clock:3652616

executable:/data/redis-server

config_file:

io_threads_active:0

Clients

connected_clients:1

cluster_connections:0

maxclients:10000

client_recent_max_input_buffer:0

client_recent_max_output_buffer:0

blocked_clients:1

tracking_clients:0

clients_in_timeout_table:0

Memory

used_memory:5612560

used_memory_human:5.35M

used_memory_rss:12857344

used_memory_rss_human:12.26M

used_memory_peak:5612560

used_memory_peak_human:5.35M

used_memory_peak_perc:100.42%

used_memory_overhead:843056

used_memory_startup:842872

used_memory_dataset:4769504

used_memory_dataset_perc:100.00%

allocator_allocated:5588568

allocator_active:6037504

allocator_resident:8499200

total_system_memory:2083942400

total_system_memory_human:1.94G

used_memory_lua:37888

used_memory_lua_human:37.00K

used_memory_scripts:0

used_memory_scripts_human:0B

number_of_cached_scripts:0

maxmemory:0

maxmemory_human:0B

maxmemory_policy:noeviction

allocator_frag_ratio:1.08

allocator_frag_bytes:448936

allocator_rss_ratio:1.41

allocator_rss_bytes:2461696

rss_overhead_ratio:1.51

rss_overhead_bytes:4358144

mem_fragmentation_ratio:2.34

mem_fragmentation_bytes:7351664

mem_not_counted_for_evict:0

mem_replication_backlog:0

mem_clients_slaves:0

mem_clients_normal:0

mem_aof_buffer:0

mem_allocator:jemalloc-5.1.0

active_defrag_running:0

lazyfree_pending_objects:0

lazyfreed_objects:0

Persistence

loading:0

current_cow_size:0

current_cow_size_age:0

current_fork_perc:0.00

current_save_keys_processed:0

current_save_keys_total:0

rdb_changes_since_last_save:0

rdb_bgsave_in_progress:0

rdb_last_save_time:1631042563

rdb_last_bgsave_status:ok

rdb_last_bgsave_time_sec:-1

rdb_current_bgsave_time_sec:-1

rdb_last_cow_size:0

aof_enabled:0

aof_rewrite_in_progress:0

aof_rewrite_scheduled:0

aof_last_rewrite_time_sec:-1

aof_current_rewrite_time_sec:-1

aof_last_bgrewrite_status:ok

aof_last_write_status:ok

aof_last_cow_size:0

module_fork_in_progress:0

module_fork_last_cow_size:0

Stats

total_connections_received:1

total_commands_processed:1

instantaneous_ops_per_sec:0

total_net_input_bytes:134

total_net_output_bytes:0

instantaneous_input_kbps:0.00

instantaneous_output_kbps:0.00

rejected_connections:0

sync_full:0

sync_partial_ok:0

sync_partial_err:0

expired_keys:0

expired_stale_perc:0.00

expired_time_cap_reached_count:0

expire_cycle_cpu_milliseconds:0

evicted_keys:0

keyspace_hits:1

keyspace_misses:0

pubsub_channels:0

pubsub_patterns:0

latest_fork_usec:0

total_forks:0

migrate_cached_sockets:0

slave_expires_tracked_keys:0

active_defrag_hits:0

active_defrag_misses:0

active_defrag_key_hits:0

active_defrag_key_misses:0

tracking_total_keys:0

tracking_total_items:0

tracking_total_prefixes:0

unexpected_error_replies:0

total_error_replies:0

dump_payload_sanitizations:0

total_reads_processed:1

total_writes_processed:0

io_threaded_reads_processed:0

io_threaded_writes_processed:0

Replication

role:master

connected_slaves:0

master_failover_state:no-failover

master_replid:a6e5b7401880ee7a4f875739f6f8ea1cd46d24c7

master_replid2:0000000000000000000000000000000000000000

master_repl_offset:0

second_repl_offset:-1

repl_backlog_active:0

repl_backlog_size:1048576

repl_backlog_first_byte_offset:0

repl_backlog_histlen:0

CPU

used_cpu_sys:0.013069

used_cpu_user:0.051584

used_cpu_sys_children:0.000000

used_cpu_user_children:0.002049

used_cpu_sys_main_thread:0.000000

used_cpu_user_main_thread:0.002138

Modules

module:name=graph,ver=20408,api=1,filters=0,usedby=[],using=[],options=[]

Commandstats

cmdstat_graph.QUERY:calls=1,usec=29,usec_per_call=29.00,rejected_calls=0,failed_calls=0

Errorstats

Cluster

cluster_enabled:0

Keyspace

db0:keys=3,expires=0,avg_ttl=0

------ CLIENT LIST OUTPUT ------

id=10 addr=172.17.0.1:59582 laddr=172.17.0.3:6379 fd=8 name= age=0 idle=0 flags=b db=0 sub=0 psub=0 multi=-1 qbuf=0 qbuf-free=40954 argv-mem=110 obl=0 oll=0 omem=0 tot-mem=61574 events=r cmd=graph.QUERY user=default redir=-1

------ MODULES INFO OUTPUT ------

graph_executing commands

graph_command:GRAPH.QUERY

MERGE (o:Order {orderId: 123456791})

ON CREATE SET

o.dummy02 = datetime('1631041665242')

------ FAST MEMORY TEST ------

1:M 07 Sep 2021 19:22:48.960 # main thread terminated

1:M 07 Sep 2021 19:22:48.960 # Bio thread for job type #0 terminated

1:M 07 Sep 2021 19:22:48.960 # Bio thread for job type #1 terminated

1:M 07 Sep 2021 19:22:48.960 # Bio thread for job type #2 terminated

Fast memory test PASSED, however your memory can still be broken. Please run a memory test for several hours if possible.

------ DUMPING CODE AROUND EIP ------

Symbol: AR_EXP_ReduceToScalar (base: 0x7f12f3ce1010)

Module: /usr/lib/redis/modules/redisgraph.so (base 0x7f12f3b7d000)

$ xxd -r -p /tmp/dump.hex /tmp/dump.bin

$ objdump --adjust-vma=0x7f12f3ce1010 -D -b binary -m i386:x86-64 /tmp/dump.bin

1:M 07 Sep 2021 19:22:48.960 # dump of function (hexdump of 273 bytes):

Function at 0x7f12f3cd6d40 is SI_NullVal

Function at 0x7f12f3ce1010 is AR_EXP_ReduceToScalar

Function at 0x7f12f3ce1e40 is AR_GetFunc

Function at 0x7f12f3ce0e60 is AR_EXP_Evaluate

Function at 0x7f12f3cd7030 is SIValue_IsNull

=== REDIS BUG REPORT END. Make sure to include from START to END. ===

Please report the crash by opening an issue on github:

http://github.com/redis/redis/issues

Suspect RAM error? Use redis-server --test-memory to verify it.

1:C 07 Sep 2021 19:24:49.952 # oO0OoO0OoO0Oo Redis is starting oO0OoO0OoO0Oo

1:C 07 Sep 2021 19:24:49.952 # Redis version=6.2.5, bits=64, commit=00000000, modified=0, pid=1, just started

1:C 07 Sep 2021 19:24:49.952 # Configuration loaded

1:M 07 Sep 2021 19:24:49.952 * monotonic clock: POSIX clock_gettime

.-``__ ''-.

.-`. `. ''-._ Redis 6.2.5 (00000000/0) 64 bit

.-`` .-.\/ ., ''-._

( ' , .-|, ) Running in standalone mode

|-._-...-__...-.``-._|' _.-'| Port: 6379

| -._. / .-' | PID: 1

-._-. `-./ .-' _.-'

|-._-. `-.__.-' .-'_.-'|

| -._-. .-'_.-' | https://redis.io

-._-.`-.__.-'.-' _.-'

|-._-. `-.__.-' .-'_.-'|

| -._-. .-'_.-' |

-._-.`-.__.-'.-' _.-'

-._-.__.-' _.-'

`-. .-'

`-.__.-'

1:M 07 Sep 2021 19:24:49.952 # Server initialized

1:M 07 Sep 2021 19:24:49.954 * Starting up RedisGraph version 2.4.8.

1:M 07 Sep 2021 19:24:49.958 * Thread pool created, using 2 threads.

1:M 07 Sep 2021 19:24:49.958 * Maximum number of OpenMP threads set to 2

1:M 07 Sep 2021 19:24:49.958 * Module 'graph' loaded from /usr/lib/redis/modules/redisgraph.so

1:M 07 Sep 2021 19:24:49.959 * Loading RDB produced by version 6.2.5

1:M 07 Sep 2021 19:24:49.959 * RDB age 1177 seconds

1:M 07 Sep 2021 19:24:49.959 * RDB memory usage when created 5.25 Mb

1:M 07 Sep 2021 19:24:49.959 * Done decoding graph social

1:M 07 Sep 2021 19:24:49.959 * Done decoding graph test

1:M 07 Sep 2021 19:24:49.964 * Done decoding graph monitoring

1:M 07 Sep 2021 19:24:49.964 * Deleted 0 virtual keys for graph social

1:M 07 Sep 2021 19:24:49.964 * Deleted 0 virtual keys for graph test

1:M 07 Sep 2021 19:24:49.964 * Deleted 0 virtual keys for graph monitoring

1:M 07 Sep 2021 19:24:49.964 * DB loaded from disk: 0.005 seconds

1:M 07 Sep 2021 19:24:49.964 * Ready to accept connections

1:M 07 Sep 2021 19:24:59.061 # RedisGraph used forced unlocking commit flow for the query

MERGE (o:Order {orderId: 123456790})

ON CREATE SET

o.dummy01 = NULL

=== REDIS BUG REPORT START: Cut & paste starting from here ===

1:M 07 Sep 2021 19:26:34.653 # Redis 6.2.5 crashed by signal: 11, si_code: 1

1:M 07 Sep 2021 19:26:34.653 # Accessing address: 0x18

1:M 07 Sep 2021 19:26:34.653 # Crashed running the instruction at: 0x7fbf4e6e10a1

------ STACK TRACE ------

EIP:

/usr/lib/redis/modules/redisgraph.so(AR_EXP_ReduceToScalar+0x91)[0x7fbf4e6e10a1]

Backtrace:

/lib/x86_64-linux-gnu/libpthread.so.0(+0x12730)[0x7fbf4f989730]

/usr/lib/redis/modules/redisgraph.so(AR_EXP_ReduceToScalar+0x91)[0x7fbf4e6e10a1]

/usr/lib/redis/modules/redisgraph.so(AR_EXP_FromASTNode+0x15)[0x7fbf4e6df075]

/usr/lib/redis/modules/redisgraph.so(+0x19beeb)[0x7fbf4e718eeb]

/usr/lib/redis/modules/redisgraph.so(AST_PrepareMergeOp+0x155)[0x7fbf4e719685]

/usr/lib/redis/modules/redisgraph.so(buildMergeOp+0x137)[0x7fbf4e7030a7]

/usr/lib/redis/modules/redisgraph.so(ExecutionPlan_PopulateExecutionPlan+0x72)[0x7fbf4e6f1ac2]

/usr/lib/redis/modules/redisgraph.so(NewExecutionPlan+0x126)[0x7fbf4e6f1c26]

/usr/lib/redis/modules/redisgraph.so(ExecutionCtx_FromQuery+0xcd)[0x7fbf4e6ecb3d]

/usr/lib/redis/modules/redisgraph.so(Graph_Query+0x3e)[0x7fbf4e6ecffe]

/usr/lib/redis/modules/redisgraph.so(+0x1aba9d)[0x7fbf4e728a9d]

/lib/x86_64-linux-gnu/libpthread.so.0(+0x7fa3)[0x7fbf4f97efa3]

/lib/x86_64-linux-gnu/libc.so.6(clone+0x3f)[0x7fbf4f8ad4cf]

------ REGISTERS ------

1:M 07 Sep 2021 19:26:34.655 #

RAX:0000000000000000 RBX:0000000000000001

RCX:0000000000000001 RDX:0000000000000000

RDI:000056108bdf79e0 RSI:00007fbf4d578260

RBP:00007fbf492089f0 RSP:00007fbf4d578290

R8 :0000000000000001 R9 :000056108bdf79e4

R10:0000000000000001 R11:0000000000000008

R12:0000000000000000 R13:0000000000000001

R14:0000000000000000 R15:0000000000000000

RIP:00007fbf4e6e10a1 EFL:0000000000010202

CSGSFS:002b000000000033

1:M 07 Sep 2021 19:26:34.655 # (00007fbf4d57829f) -> 00007fbf4f2366e0

1:M 07 Sep 2021 19:26:34.655 # (00007fbf4d57829e) -> 0000000000000000

1:M 07 Sep 2021 19:26:34.655 # (00007fbf4d57829d) -> 00007fbf3c204c10

1:M 07 Sep 2021 19:26:34.655 # (00007fbf4d57829c) -> 0000000000000000

1:M 07 Sep 2021 19:26:34.655 # (00007fbf4d57829b) -> 00007fbf4e718eeb

1:M 07 Sep 2021 19:26:34.655 # (00007fbf4d57829a) -> 0000000000000005

1:M 07 Sep 2021 19:26:34.655 # (00007fbf4d578299) -> 00007fbf4e6df075

1:M 07 Sep 2021 19:26:34.655 # (00007fbf4d578298) -> 00007fbf3c204b00

1:M 07 Sep 2021 19:26:34.655 # (00007fbf4d578297) -> 00007fbf3c204fa0

1:M 07 Sep 2021 19:26:34.655 # (00007fbf4d578296) -> 00007fbf3c0035d8

1:M 07 Sep 2021 19:26:34.655 # (00007fbf4d578295) -> 0000000000000001

1:M 07 Sep 2021 19:26:34.655 # (00007fbf4d578294) -> 00007fbf492174c8

1:M 07 Sep 2021 19:26:34.655 # (00007fbf4d578293) -> 00007fbf492089f0

1:M 07 Sep 2021 19:26:34.655 # (00007fbf4d578292) -> 00007fbf3c205020

1:M 07 Sep 2021 19:26:34.655 # (00007fbf4d578291) -> 000056108b2664af

1:M 07 Sep 2021 19:26:34.655 # (00007fbf4d578290) -> 0000000000000001

------ INFO OUTPUT ------

Server

redis_version:6.2.5

redis_git_sha1:00000000

redis_git_dirty:0

redis_build_id:fecbae34a84549de

redis_mode:standalone

os:Linux 5.10.25-linuxkit x86_64

arch_bits:64

multiplexing_api:epoll

atomicvar_api:c11-builtin

gcc_version:8.3.0

process_id:1

process_supervised:no

run_id:2431c090ea74317b3b2c5cdacaca7b67a2589be5

tcp_port:6379

server_time_usec:1631042794653723

uptime_in_seconds:105

uptime_in_days:0

hz:10

configured_hz:10

lru_clock:3652842

executable:/data/redis-server

config_file:

io_threads_active:0

Clients

connected_clients:2

cluster_connections:0

maxclients:10000

client_recent_max_input_buffer:40

client_recent_max_output_buffer:0

blocked_clients:1

tracking_clients:0

clients_in_timeout_table:0

Memory

used_memory:5652360

used_memory_human:5.39M

used_memory_rss:13819904

used_memory_rss_human:13.18M

used_memory_peak:5652360

used_memory_peak_human:5.39M

used_memory_peak_perc:100.07%

used_memory_overhead:863576

used_memory_startup:842872

used_memory_dataset:4788784

used_memory_dataset_perc:99.57%

allocator_allocated:6499800

allocator_active:7299072

allocator_resident:11907072

total_system_memory:2083942400

total_system_memory_human:1.94G

used_memory_lua:37888

used_memory_lua_human:37.00K

used_memory_scripts:0

used_memory_scripts_human:0B

number_of_cached_scripts:0

maxmemory:0

maxmemory_human:0B

maxmemory_policy:noeviction

allocator_frag_ratio:1.12

allocator_frag_bytes:799272

allocator_rss_ratio:1.63

allocator_rss_bytes:4608000

rss_overhead_ratio:1.16

rss_overhead_bytes:1912832

mem_fragmentation_ratio:2.49

mem_fragmentation_bytes:8279328

mem_not_counted_for_evict:0

mem_replication_backlog:0

mem_clients_slaves:0

mem_clients_normal:20520

mem_aof_buffer:0

mem_allocator:jemalloc-5.1.0

active_defrag_running:0

lazyfree_pending_objects:0

lazyfreed_objects:0

Persistence

loading:0

current_cow_size:0

current_cow_size_age:0

current_fork_perc:0.00

current_save_keys_processed:0

current_save_keys_total:0

rdb_changes_since_last_save:3

rdb_bgsave_in_progress:0

rdb_last_save_time:1631042689

rdb_last_bgsave_status:ok

rdb_last_bgsave_time_sec:-1

rdb_current_bgsave_time_sec:-1

rdb_last_cow_size:0

aof_enabled:0

aof_rewrite_in_progress:0

aof_rewrite_scheduled:0

aof_last_rewrite_time_sec:-1

aof_current_rewrite_time_sec:-1

aof_last_bgrewrite_status:ok

aof_last_write_status:ok

aof_last_cow_size:0

module_fork_in_progress:0

module_fork_last_cow_size:0

Stats

total_connections_received:4

total_commands_processed:7

instantaneous_ops_per_sec:0

total_net_input_bytes:899

total_net_output_bytes:817

instantaneous_input_kbps:0.00

instantaneous_output_kbps:0.00

rejected_connections:0

sync_full:0

sync_partial_ok:0

sync_partial_err:0

expired_keys:0

expired_stale_perc:0.00

expired_time_cap_reached_count:0

expire_cycle_cpu_milliseconds:2

evicted_keys:0

keyspace_hits:12

keyspace_misses:0

pubsub_channels:0

pubsub_patterns:0

latest_fork_usec:0

total_forks:0

migrate_cached_sockets:0

slave_expires_tracked_keys:0

active_defrag_hits:0

active_defrag_misses:0

active_defrag_key_hits:0

active_defrag_key_misses:0

tracking_total_keys:0

tracking_total_items:0

tracking_total_prefixes:0

unexpected_error_replies:0

total_error_replies:1

dump_payload_sanitizations:0

total_reads_processed:9

total_writes_processed:6

io_threaded_reads_processed:0

io_threaded_writes_processed:0

Replication

role:master

connected_slaves:0

master_failover_state:no-failover

master_replid:758e56c97e708661d414b23e1e10820288e42ae1

master_replid2:0000000000000000000000000000000000000000

master_repl_offset:0

second_repl_offset:-1

repl_backlog_active:0

repl_backlog_size:1048576

repl_backlog_first_byte_offset:0

repl_backlog_histlen:0

CPU

used_cpu_sys:0.114348

used_cpu_user:0.177737

used_cpu_sys_children:0.000000

used_cpu_user_children:0.002205

used_cpu_sys_main_thread:0.001310

used_cpu_user_main_thread:0.001310

Modules

module:name=graph,ver=20408,api=1,filters=0,usedby=[],using=[],options=[]

Commandstats

cmdstat_graph.QUERY:calls=7,usec=417,usec_per_call=59.57,rejected_calls=0,failed_calls=0

Errorstats

errorstat_Property:count=1

Cluster

cluster_enabled:0

Keyspace

db0:keys=3,expires=0,avg_ttl=0

------ CLIENT LIST OUTPUT ------

id=18 addr=172.17.0.1:59600 laddr=172.17.0.3:6379 fd=8 name= age=71 idle=71 flags=N db=0 sub=0 psub=0 multi=-1 qbuf=0 qbuf-free=0 argv-mem=0 obl=0 oll=0 omem=0 tot-mem=20520 events=r cmd=graph.QUERY user=default redir=-1

id=23 addr=172.17.0.1:59604 laddr=172.17.0.3:6379 fd=9 name= age=0 idle=0 flags=b db=0 sub=0 psub=0 multi=-1 qbuf=0 qbuf-free=40954 argv-mem=153 obl=0 oll=0 omem=0 tot-mem=61617 events=r cmd=graph.QUERY user=default redir=-1

------ MODULES INFO OUTPUT ------

graph_executing commands

graph_command:GRAPH.QUERY

MERGE (o:Order {orderId: 123456793})

ON CREATE SET

o.dummy02 = datetime({year:1984, month:10, day:11, hour:12, timezone: '+01:00'})

------ FAST MEMORY TEST ------

1:M 07 Sep 2021 19:26:34.655 # main thread terminated

1:M 07 Sep 2021 19:26:34.656 # Bio thread for job type #0 terminated

1:M 07 Sep 2021 19:26:34.656 # Bio thread for job type #1 terminated

1:M 07 Sep 2021 19:26:34.656 # Bio thread for job type #2 terminated

Fast memory test PASSED, however your memory can still be broken. Please run a memory test for several hours if possible.

------ DUMPING CODE AROUND EIP ------

Symbol: AR_EXP_ReduceToScalar (base: 0x7fbf4e6e1010)

Module: /usr/lib/redis/modules/redisgraph.so (base 0x7fbf4e57d000)

$ xxd -r -p /tmp/dump.hex /tmp/dump.bin

$ objdump --adjust-vma=0x7fbf4e6e1010 -D -b binary -m i386:x86-64 /tmp/dump.bin

1:M 07 Sep 2021 19:26:34.656 # dump of function (hexdump of 273 bytes):

Function at 0x7fbf4e6d6d40 is SI_NullVal

Function at 0x7fbf4e6e1010 is AR_EXP_ReduceToScalar

Function at 0x7fbf4e6e1e40 is AR_GetFunc

Function at 0x7fbf4e6e0e60 is AR_EXP_Evaluate

Function at 0x7fbf4e6d7030 is SIValue_IsNull

=== REDIS BUG REPORT END. Make sure to include from START to END. ===

Please report the crash by opening an issue on github:

http://github.com/redis/redis/issues

Suspect RAM error? Use redis-server --test-memory to verify it.

1:C 07 Sep 2021 19:27:07.796 # oO0OoO0OoO0Oo Redis is starting oO0OoO0OoO0Oo

1:C 07 Sep 2021 19:27:07.796 # Redis version=6.2.5, bits=64, commit=00000000, modified=0, pid=1, just started

1:C 07 Sep 2021 19:27:07.796 # Configuration loaded

1:M 07 Sep 2021 19:27:07.796 * monotonic clock: POSIX clock_gettime

.-``__ ''-.

.-`. `. ''-._ Redis 6.2.5 (00000000/0) 64 bit

.-`` .-.\/ ., ''-._

( ' , .-|, ) Running in standalone mode

|-._-...-__...-.``-._|' _.-'| Port: 6379

| -._. / .-' | PID: 1

-._-. `-./ .-' _.-'

|-._-. `-.__.-' .-'_.-'|

| -._-. .-'_.-' | https://redis.io

-._-.`-.__.-'.-' _.-'

|-._-. `-.__.-' .-'_.-'|

| -._-. .-'_.-' |

-._-.`-.__.-'.-' _.-'

-._-.__.-' _.-'

`-. .-'

`-.__.-'

1:M 07 Sep 2021 19:27:07.797 # Server initialized

1:M 07 Sep 2021 19:27:07.798 * Starting up RedisGraph version 2.4.8.

1:M 07 Sep 2021 19:27:07.802 * Thread pool created, using 2 threads.

1:M 07 Sep 2021 19:27:07.802 * Maximum number of OpenMP threads set to 2

1:M 07 Sep 2021 19:27:07.802 * Module 'graph' loaded from /usr/lib/redis/modules/redisgraph.so

1:M 07 Sep 2021 19:27:07.802 * Loading RDB produced by version 6.2.5

1:M 07 Sep 2021 19:27:07.802 * RDB age 1315 seconds

1:M 07 Sep 2021 19:27:07.802 * RDB memory usage when created 5.25 Mb

1:M 07 Sep 2021 19:27:07.803 * Done decoding graph social

1:M 07 Sep 2021 19:27:07.803 * Done decoding graph test

1:M 07 Sep 2021 19:27:07.811 * Done decoding graph monitoring

1:M 07 Sep 2021 19:27:07.811 * Deleted 0 virtual keys for graph social

1:M 07 Sep 2021 19:27:07.811 * Deleted 0 virtual keys for graph test

1:M 07 Sep 2021 19:27:07.811 * Deleted 0 virtual keys for graph monitoring

1:M 07 Sep 2021 19:27:07.811 * DB loaded from disk: 0.009 seconds

1:M 07 Sep 2021 19:27:07.811 * Ready to accept connections

=== REDIS BUG REPORT START: Cut & paste starting from here ===

1:M 07 Sep 2021 19:28:04.278 # Redis 6.2.5 crashed by signal: 11, si_code: 1

1:M 07 Sep 2021 19:28:04.278 # Accessing address: 0x18

1:M 07 Sep 2021 19:28:04.278 # Crashed running the instruction at: 0x7f1f7bce10a1

------ STACK TRACE ------

EIP:

/usr/lib/redis/modules/redisgraph.so(AR_EXP_ReduceToScalar+0x91)[0x7f1f7bce10a1]

Backtrace:

/lib/x86_64-linux-gnu/libpthread.so.0(+0x12730)[0x7f1f7ce9b730]

/usr/lib/redis/modules/redisgraph.so(AR_EXP_ReduceToScalar+0x91)[0x7f1f7bce10a1]

/usr/lib/redis/modules/redisgraph.so(AR_EXP_FromASTNode+0x15)[0x7f1f7bcdf075]

/usr/lib/redis/modules/redisgraph.so(+0x19beeb)[0x7f1f7bd18eeb]

/usr/lib/redis/modules/redisgraph.so(AST_PrepareMergeOp+0x155)[0x7f1f7bd19685]

/usr/lib/redis/modules/redisgraph.so(buildMergeOp+0x137)[0x7f1f7bd030a7]

/usr/lib/redis/modules/redisgraph.so(ExecutionPlan_PopulateExecutionPlan+0x72)[0x7f1f7bcf1ac2]

/usr/lib/redis/modules/redisgraph.so(NewExecutionPlan+0x126)[0x7f1f7bcf1c26]

/usr/lib/redis/modules/redisgraph.so(ExecutionCtx_FromQuery+0xcd)[0x7f1f7bcecb3d]

/usr/lib/redis/modules/redisgraph.so(Graph_Query+0x3e)[0x7f1f7bcecffe]

/usr/lib/redis/modules/redisgraph.so(+0x1aba9d)[0x7f1f7bd28a9d]

/lib/x86_64-linux-gnu/libpthread.so.0(+0x7fa3)[0x7f1f7ce90fa3]

/lib/x86_64-linux-gnu/libc.so.6(clone+0x3f)[0x7f1f7cdbf4cf]

------ REGISTERS ------

1:M 07 Sep 2021 19:28:04.279 #

RAX:0000000000000000 RBX:0000000000000001

Comment From: oranagra

Please report in https://github.com/RedisGraph/RedisGraph

Redis Unsupported Cypher code crashes server

Server

Clients

Memory

Persistence

Stats

Replication

CPU

Modules

Commandstats

Errorstats

Cluster

Keyspace

graph_executing commands

Server

Clients

Memory

Persistence

Stats

Replication

CPU

Modules

Commandstats

Errorstats

Cluster

Keyspace

graph_executing commands

Server

Clients

Memory

Persistence

Stats

Replication

CPU

Modules

Commandstats

Errorstats

Cluster

Keyspace

graph_executing commands