Redisgraph: Redisgraph crash when invalid collect() is called

[Sceat]

CREATE (n { a: 1 })
RETURN collect(n.a, n.a)

This query seems not valid cypher but it will crash current redisgraph:edge instead of throwing an error.

_i discovered it by trying to RETURN collect({ foo: n.a }) which sadly throws #943 #1065_

_*sad lofi rain music starts playing*_

Edit:

This seems to block redis but do not throw anything

CREATE (n { a: 1 })
RETURN collect([n])

# RETURN collect([n.a]) <- this is working

[gkorland]

=== REDIS BUG REPORT START: Cut & paste starting from here ===
1:M 14 Jul 2020 09:49:56.791 # Redis 6.0.5 crashed by signal: 11
1:M 14 Jul 2020 09:49:56.791 # Crashed running the instruction at: 0x7f7d6f23b611
1:M 14 Jul 2020 09:49:56.791 # Accessing address: (nil)
1:M 14 Jul 2020 09:49:56.791 # Failed assertion: <no assertion failed> (<no file>:0)

------ STACK TRACE ------
EIP:
/lib/x86_64-linux-gnu/libc.so.6(abort+0x1fd)[0x7f7d6f23b611]

Backtrace:
redis-server *:6379(logStackTrace+0x32)[0x5614a1018e02]
redis-server *:6379(sigsegvHandler+0x9e)[0x5614a10194de]
/lib/x86_64-linux-gnu/libpthread.so.0(+0x12730)[0x7f7d6f3ee730]
/lib/x86_64-linux-gnu/libc.so.6(abort+0x1fd)[0x7f7d6f23b611]
/lib/x86_64-linux-gnu/libc.so.6(+0x2240f)[0x7f7d6f23b40f]
/lib/x86_64-linux-gnu/libc.so.6(+0x30102)[0x7f7d6f249102]
/usr/lib/redis/modules/redisgraph.so(+0x1b4a5c)[0x7f7d6e2efa5c]
/usr/lib/redis/modules/redisgraph.so(AR_EXP_Aggregate+0xba)[0x7f7d6e2f0b2a]
/usr/lib/redis/modules/redisgraph.so(+0x1cc80d)[0x7f7d6e30780d]
/usr/lib/redis/modules/redisgraph.so(+0x1cc973)[0x7f7d6e307973]
/usr/lib/redis/modules/redisgraph.so(+0x1d050c)[0x7f7d6e30b50c]
/usr/lib/redis/modules/redisgraph.so(ExecutionPlan_Execute+0x58)[0x7f7d6e300498]
/usr/lib/redis/modules/redisgraph.so(Graph_Query+0x280)[0x7f7d6e2fa280]
/usr/lib/redis/modules/redisgraph.so(+0x1f290d)[0x7f7d6e32d90d]
/lib/x86_64-linux-gnu/libpthread.so.0(+0x7fa3)[0x7f7d6f3e3fa3]
/lib/x86_64-linux-gnu/libc.so.6(clone+0x3f)[0x7f7d6f3124cf]

[swilly22]

Hi @Sceat, thank you for reporting, we need to introduce additional validations to our aggregation functions.

[kdojeteri]

Be sure to also test this use case:

RETURN collect()

Redis bug report stack trace etc:

=== REDIS BUG REPORT START: Cut & paste starting from here ===
1:M 14 Jul 2020 21:03:09.180 # Redis 6.0.5 crashed by signal: 11
1:M 14 Jul 2020 21:03:09.180 # Crashed running the instruction at: 0x7fdf6e74d611
1:M 14 Jul 2020 21:03:09.180 # Accessing address: (nil)
1:M 14 Jul 2020 21:03:09.180 # Failed assertion: <no assertion failed> (<no file>:0)
redis-server: /root/build/RedisGraph/src/arithmetic/agg_funcs.c:579: __agg_collectStep: Assertion `argc == 1' failed.

------ STACK TRACE ------
EIP:
/lib/x86_64-linux-gnu/libc.so.6(abort+0x1fd)[0x7fdf6e74d611]

Backtrace:
redis-server *:6379(logStackTrace+0x32)[0x560d51490e02]
redis-server *:6379(sigsegvHandler+0x9e)[0x560d514914de]
/lib/x86_64-linux-gnu/libpthread.so.0(+0x12730)[0x7fdf6e900730]
/lib/x86_64-linux-gnu/libc.so.6(abort+0x1fd)[0x7fdf6e74d611]
/lib/x86_64-linux-gnu/libc.so.6(+0x2240f)[0x7fdf6e74d40f]
/lib/x86_64-linux-gnu/libc.so.6(+0x30102)[0x7fdf6e75b102]
/usr/lib/redis/modules/redisgraph.so(+0x1b5a8c)[0x7fdf6cc42a8c]
/usr/lib/redis/modules/redisgraph.so(AR_EXP_Aggregate+0xba)[0x7fdf6cc43aea]
/usr/lib/redis/modules/redisgraph.so(+0x1ccf2d)[0x7fdf6cc59f2d]
/usr/lib/redis/modules/redisgraph.so(+0x1cd0d8)[0x7fdf6cc5a0d8]
/usr/lib/redis/modules/redisgraph.so(+0x1d0c2c)[0x7fdf6cc5dc2c]
/usr/lib/redis/modules/redisgraph.so(ExecutionPlan_Execute+0x58)[0x7fdf6cc52be8]
/usr/lib/redis/modules/redisgraph.so(Graph_Query+0x351)[0x7fdf6cc4cf91]
/usr/lib/redis/modules/redisgraph.so(+0x1f28cd)[0x7fdf6cc7f8cd]
/lib/x86_64-linux-gnu/libpthread.so.0(+0x7fa3)[0x7fdf6e8f5fa3]
/lib/x86_64-linux-gnu/libc.so.6(clone+0x3f)[0x7fdf6e8244cf]

------ INFO OUTPUT ------
# Server
redis_version:6.0.5
redis_git_sha1:00000000
redis_git_dirty:0
redis_build_id:db63ea56716d515f
redis_mode:standalone
os:Linux 4.15.0-106-generic x86_64
arch_bits:64
multiplexing_api:epoll
atomicvar_api:atomic-builtin
gcc_version:8.3.0
process_id:1
run_id:8c1464bf11bfd37933c6d497c781d940f7c640ad
tcp_port:6379
uptime_in_seconds:113
uptime_in_days:0
hz:10
configured_hz:10
lru_clock:925069
executable:/data/redis-server
config_file:/etc/redis/redis.conf

# Clients
connected_clients:2
client_recent_max_input_buffer:2
client_recent_max_output_buffer:0
blocked_clients:1
tracking_clients:0
clients_in_timeout_table:0

# Memory
used_memory:270483608
used_memory_human:257.95M
used_memory_rss:263127040
used_memory_rss_human:250.94M
used_memory_peak:272027440
used_memory_peak_human:259.43M
used_memory_peak_perc:99.43%
used_memory_overhead:901780
used_memory_startup:867448
used_memory_dataset:269581828
used_memory_dataset_perc:99.99%
allocator_allocated:271191464
allocator_active:275972096
allocator_resident:283340800
total_system_memory:12441333760
total_system_memory_human:11.59G
used_memory_lua:37888
used_memory_lua_human:37.00K
used_memory_scripts:0
used_memory_scripts_human:0B
number_of_cached_scripts:0
maxmemory:0
maxmemory_human:0B
maxmemory_policy:noeviction
allocator_frag_ratio:1.02
allocator_frag_bytes:4780632
allocator_rss_ratio:1.03
allocator_rss_bytes:7368704
rss_overhead_ratio:0.93
rss_overhead_bytes:-20213760
mem_fragmentation_ratio:0.97
mem_fragmentation_bytes:-7236568
mem_not_counted_for_evict:0
mem_replication_backlog:0
mem_clients_slaves:0
mem_clients_normal:33972
mem_aof_buffer:0
mem_allocator:jemalloc-5.1.0
active_defrag_running:0
lazyfree_pending_objects:0

# Persistence
loading:0
rdb_changes_since_last_save:0
rdb_bgsave_in_progress:0
rdb_last_save_time:1594760567
rdb_last_bgsave_status:ok
rdb_last_bgsave_time_sec:1
rdb_current_bgsave_time_sec:-1
rdb_last_cow_size:72716288
aof_enabled:1
aof_rewrite_in_progress:0
aof_rewrite_scheduled:0
aof_last_rewrite_time_sec:-1
aof_current_rewrite_time_sec:-1
aof_last_bgrewrite_status:ok
aof_last_write_status:ok
aof_last_cow_size:0
module_fork_in_progress:0
module_fork_last_cow_size:0
aof_current_size:75083380
aof_base_size:75083380
aof_pending_rewrite:0
aof_buffer_length:0
aof_rewrite_buffer_length:0
aof_pending_bio_fsync:0
aof_delayed_fsync:0

# Stats
total_connections_received:3
total_commands_processed:24
instantaneous_ops_per_sec:0
total_net_input_bytes:1418
total_net_output_bytes:71794
instantaneous_input_kbps:0.00
instantaneous_output_kbps:0.00
rejected_connections:0
sync_full:0
sync_partial_ok:0
sync_partial_err:0
expired_keys:0
expired_stale_perc:0.00
expired_time_cap_reached_count:0
expire_cycle_cpu_milliseconds:0
evicted_keys:0
keyspace_hits:40088
keyspace_misses:0
pubsub_channels:0
pubsub_patterns:0
latest_fork_usec:10957
migrate_cached_sockets:0
slave_expires_tracked_keys:0
active_defrag_hits:0
active_defrag_misses:0
active_defrag_key_hits:0
active_defrag_key_misses:0
tracking_total_keys:0
tracking_total_items:0
tracking_total_prefixes:0
unexpected_error_replies:0

# Replication
role:master
connected_slaves:0
master_replid:dc3d723182f720f8bb7df4b9efb897aa8bba7c6d
master_replid2:0000000000000000000000000000000000000000
master_repl_offset:0
second_repl_offset:-1
repl_backlog_active:0
repl_backlog_size:1048576
repl_backlog_first_byte_offset:0
repl_backlog_histlen:0

# CPU
used_cpu_sys:2.219759
used_cpu_user:88.003684
used_cpu_sys_children:0.163988
used_cpu_user_children:1.150092

# Modules
module:name=graph,ver=999999,api=1,filters=0,usedby=[],using=[],options=[]
module:name=ReJSON,ver=999999,api=1,filters=0,usedby=[],using=[],options=[]

# Commandstats
cmdstat_info:calls=18,usec=1937,usec_per_call=107.61
cmdstat_graph.QUERY:calls=3,usec=140,usec_per_call=46.67
cmdstat_auth:calls=3,usec=22,usec_per_call=7.33

# Cluster
cluster_enabled:0

# Keyspace
db0:keys=5,expires=0,avg_ttl=0

------ CLIENT LIST OUTPUT ------
id=9 addr=172.18.0.1:34518 fd=11 name= age=98 idle=23 flags=N db=0 sub=0 psub=0 multi=-1 qbuf=0 qbuf-free=0 obl=0 oll=0 omem=0 events=r cmd=graph.QUERY user=default
id=19 addr=127.0.0.1:42318 fd=9 name= age=11 idle=0 flags=b db=0 sub=0 psub=0 multi=-1 qbuf=0 qbuf-free=32768 obl=0 oll=0 omem=0 events=r cmd=graph.QUERY user=default

------ REGISTERS ------
1:M 14 Jul 2020 21:03:09.198 # 
RAX:0000000000000000 RBX:0000000000000000
RCX:0000000000000000 RDX:0000000000000000
RDI:0000000000000002 RSI:00007fdf6b287110
RBP:00007fdf6e8afee0 RSP:00007fdf6b287230
R8 :0000000000000000 R9 :00007fdf6b287110
R10:0000000000000008 R11:0000000000000246
R12:00007fdf6d108b60 R13:00007fdf6d108d21
R14:0000000000000243 R15:00007fdf5083de98
RIP:00007fdf6e74d611 EFL:0000000000010246
CSGSFS:002b000000000033
1:M 14 Jul 2020 21:03:09.198 # (00007fdf6b28723f) -> 0000000000000000
1:M 14 Jul 2020 21:03:09.198 # (00007fdf6b28723e) -> 0000000000000000
1:M 14 Jul 2020 21:03:09.198 # (00007fdf6b28723d) -> 0000000000000000
1:M 14 Jul 2020 21:03:09.198 # (00007fdf6b28723c) -> 0000000000000000
1:M 14 Jul 2020 21:03:09.198 # (00007fdf6b28723b) -> 0000000000000000
1:M 14 Jul 2020 21:03:09.198 # (00007fdf6b28723a) -> 0000000000000000
1:M 14 Jul 2020 21:03:09.198 # (00007fdf6b287239) -> 0000000000000000
1:M 14 Jul 2020 21:03:09.198 # (00007fdf6b287238) -> 0000000000000000
1:M 14 Jul 2020 21:03:09.198 # (00007fdf6b287237) -> 0000000000000000
1:M 14 Jul 2020 21:03:09.198 # (00007fdf6b287236) -> 0000000000000000
1:M 14 Jul 2020 21:03:09.198 # (00007fdf6b287235) -> 0000000000000000
1:M 14 Jul 2020 21:03:09.198 # (00007fdf6b287234) -> 0000000000000000
1:M 14 Jul 2020 21:03:09.198 # (00007fdf6b287233) -> 0000000000000000
1:M 14 Jul 2020 21:03:09.198 # (00007fdf6b287232) -> 0000000000000000
1:M 14 Jul 2020 21:03:09.198 # (00007fdf6b287231) -> 0000000000000000
1:M 14 Jul 2020 21:03:09.198 # (00007fdf6b287230) -> 0000000000000020

------ MODULES INFO OUTPUT ------

------ FAST MEMORY TEST ------
1:M 14 Jul 2020 21:03:09.199 # Bio thread for job type #0 terminated
1:M 14 Jul 2020 21:03:09.199 # Bio thread for job type #1 terminated
1:M 14 Jul 2020 21:03:09.199 # Bio thread for job type #2 terminated
*** Preparing to test memory region 560d515dc000 (2277376 bytes)
*** Preparing to test memory region 560d52eb1000 (3629056 bytes)
*** Preparing to test memory region 7fdf20000000 (2109440 bytes)
*** Preparing to test memory region 7fdf28000000 (2125824 bytes)
*** Preparing to test memory region 7fdf2c000000 (2117632 bytes)
*** Preparing to test memory region 7fdf30000000 (135168 bytes)
*** Preparing to test memory region 7fdf37000000 (84021248 bytes)
*** Preparing to test memory region 7fdf43800000 (8388608 bytes)
*** Preparing to test memory region 7fdf44000000 (135168 bytes)
*** Preparing to test memory region 7fdf48000000 (67244032 bytes)
*** Preparing to test memory region 7fdf50800000 (4194304 bytes)
*** Preparing to test memory region 7fdf50e00000 (8388608 bytes)
*** Preparing to test memory region 7fdf51600000 (4194304 bytes)
*** Preparing to test memory region 7fdf51c00000 (8388608 bytes)
*** Preparing to test memory region 7fdf52400000 (10485760 bytes)
*** Preparing to test memory region 7fdf52f82000 (8388608 bytes)
*** Preparing to test memory region 7fdf53783000 (8388608 bytes)
*** Preparing to test memory region 7fdf53f84000 (8388608 bytes)
*** Preparing to test memory region 7fdf54784000 (330301440 bytes)
*** Preparing to test memory region 7fdf68285000 (8388608 bytes)
*** Preparing to test memory region 7fdf68a86000 (8388608 bytes)
*** Preparing to test memory region 7fdf69287000 (8388608 bytes)
*** Preparing to test memory region 7fdf69a88000 (8388608 bytes)
*** Preparing to test memory region 7fdf6a289000 (8388608 bytes)
*** Preparing to test memory region 7fdf6aa8a000 (8388608 bytes)
*** Preparing to test memory region 7fdf6b28b000 (8388608 bytes)
*** Preparing to test memory region 7fdf6ba8c000 (8388608 bytes)
*** Preparing to test memory region 7fdf6c28d000 (8388608 bytes)
*** Preparing to test memory region 7fdf6d35a000 (12288 bytes)
*** Preparing to test memory region 7fdf6d35e000 (8388608 bytes)
*** Preparing to test memory region 7fdf6ddfd000 (12288 bytes)
*** Preparing to test memory region 7fdf6de00000 (8388608 bytes)
*** Preparing to test memory region 7fdf6e727000 (16384 bytes)
*** Preparing to test memory region 7fdf6e8e8000 (24576 bytes)
*** Preparing to test memory region 7fdf6e90b000 (16384 bytes)
*** Preparing to test memory region 7fdf6ebf4000 (16384 bytes)
*** Preparing to test memory region 7fdf6ee1c000 (8192 bytes)
*** Preparing to test memory region 7fdf6ee1f000 (4096 bytes)
*** Preparing to test memory region 7fdf6ee49000 (4096 bytes)
.O.O.O.O.O.O.O.O.O.O.O.O.O.O.O.O.O.O.O.O.O.O.O.O.

[swilly22]

We should adopt the same validation and error reporting we have for none aggregated functions.

[swilly22]

GRAPH.QUERY g "CREATE (n { a: 1 }) RETURN collect(n.a, n.a)"
...
(error) Received 2 arguments to function 'collect', expected at most 1