Crash due to untrue assertion heap-allocated SIValue of unhandled type

[DominicWuest]

When running the following query:

WITH [0, 0] AS n0 OPTIONAL MATCH () UNWIND [0, 0, 0] AS n1 UNWIND [0, 0] AS n2 MERGE ()

The RedisGraph instance crashed because of the assertion 0 && "Encountered heap-allocated SIValue of unhandled type" being untrue.

I encountered this issue when testing queries against RedisGraph v2.12.0 compiled with address sanitization in a Docker container running alpine v.3.

Redis Bug Report

=== REDIS BUG REPORT START: Cut & paste starting from here ===
10:M 22 Apr 2023 08:51:43.414 # === ASSERTION FAILED ===
10:M 22 Apr 2023 08:51:43.414 # ==> /app/src/value.c:166 '0 && "Encountered heap-allocated SIValue of unhandled type"' is not true

------ STACK TRACE ------

Backtrace:
redis-server *:6379(_serverAssert+0x8c)[0x559b08b8cb8c]
/app/bin/linux-x64-debug-asan/src/redisgraph.so(SI_CloneValue+0xac2)[0x7faa120ba2b2]
/app/bin/linux-x64-debug-asan/src/redisgraph.so(SIArray_Append+0x213)[0x7faa11ed3313]
/app/bin/linux-x64-debug-asan/src/redisgraph.so(SIArray_Clone+0x33e)[0x7faa11ed516e]
/app/bin/linux-x64-debug-asan/src/redisgraph.so(SI_CloneValue+0x46e)[0x7faa120b9c5e]
/app/bin/linux-x64-debug-asan/src/redisgraph.so(SIValue_Persist+0x1ae)[0x7faa120bb03e]
/app/bin/linux-x64-debug-asan/src/redisgraph.so(Record_PersistScalars+0xc6)[0x7faa11f77a06]
/app/bin/linux-x64-debug-asan/src/redisgraph.so(+0x6affb4)[0x7faa11f30fb4]
/app/bin/linux-x64-debug-asan/src/redisgraph.so(OpBase_Consume+0x44)[0x7faa11f06494]
/app/bin/linux-x64-debug-asan/src/redisgraph.so(ExecutionPlan_Execute+0x2f5)[0x7faa11ef1c75]
/app/bin/linux-x64-debug-asan/src/redisgraph.so(+0x6407ba)[0x7faa11ec17ba]
/app/bin/linux-x64-debug-asan/src/redisgraph.so(+0x831d8a)[0x7faa120b2d8a]
/lib/x86_64-linux-gnu/libpthread.so.0(+0x7ea7)[0x7faa19dacea7]
/lib/x86_64-linux-gnu/libc.so.6(clone+0x3f)[0x7faa19ccaa2f]

------ INFO OUTPUT ------
# Server
redis_version:7.0.11
redis_git_sha1:00000000
redis_git_dirty:0
redis_build_id:5c712dc4cb9cfb70
redis_mode:standalone
os:Linux 6.2.10-arch1-1 x86_64
arch_bits:64
monotonic_clock:POSIX clock_gettime
multiplexing_api:epoll
atomicvar_api:c11-builtin
gcc_version:10.2.1
process_id:10
process_supervised:no
run_id:8839f591249bca6d896d24df2ac4461dd5daec01
tcp_port:6379
server_time_usec:1682153503412672
uptime_in_seconds:9
uptime_in_days:0
hz:10
configured_hz:10
lru_clock:4431903
executable:/redis/redis-server
config_file:
io_threads_active:0

# Clients
connected_clients:1
cluster_connections:0
maxclients:10000
client_recent_max_input_buffer:0
client_recent_max_output_buffer:0
blocked_clients:1
tracking_clients:0
clients_in_timeout_table:0

# Memory
used_memory:6443931952
used_memory_human:6.00G
used_memory_rss:37617664
used_memory_rss_human:35.88M
used_memory_peak:6443931952
used_memory_peak_human:6.00G
used_memory_peak_perc:476698.34%
used_memory_overhead:928984
used_memory_startup:928728
used_memory_dataset:6443002968
used_memory_dataset_perc:100.00%
allocator_allocated:1223792
allocator_active:1409024
allocator_resident:4825088
total_system_memory:8039120896
total_system_memory_human:7.49G
used_memory_lua:31744
used_memory_vm_eval:31744
used_memory_lua_human:31.00K
used_memory_scripts_eval:0
number_of_cached_scripts:0
number_of_functions:0
number_of_libraries:0
used_memory_vm_functions:32768
used_memory_vm_total:64512
used_memory_vm_total_human:63.00K
used_memory_functions:184
used_memory_scripts:184
used_memory_scripts_human:184B
maxmemory:0
maxmemory_human:0B
maxmemory_policy:noeviction
allocator_frag_ratio:1.15
allocator_frag_bytes:185232
allocator_rss_ratio:3.42
allocator_rss_bytes:3416064
rss_overhead_ratio:7.80
rss_overhead_bytes:32792576
mem_fragmentation_ratio:40.50
mem_fragmentation_bytes:36688792
mem_not_counted_for_evict:0
mem_replication_backlog:0
mem_total_replication_buffers:0
mem_clients_slaves:0
mem_clients_normal:0
mem_cluster_links:0
mem_aof_buffer:0
mem_allocator:jemalloc-5.2.1
active_defrag_running:0
lazyfree_pending_objects:0
lazyfreed_objects:0

# Persistence
loading:0
async_loading:0
current_cow_peak:0
current_cow_size:0
current_cow_size_age:0
current_fork_perc:0.00
current_save_keys_processed:0
current_save_keys_total:0
rdb_changes_since_last_save:0
rdb_bgsave_in_progress:0
rdb_last_save_time:1682153494
rdb_last_bgsave_status:ok
rdb_last_bgsave_time_sec:-1
rdb_current_bgsave_time_sec:-1
rdb_saves:0
rdb_last_cow_size:0
rdb_last_load_keys_expired:0
rdb_last_load_keys_loaded:0
aof_enabled:0
aof_rewrite_in_progress:0
aof_rewrite_scheduled:0
aof_last_rewrite_time_sec:-1
aof_current_rewrite_time_sec:-1
aof_last_bgrewrite_status:ok
aof_rewrites:0
aof_rewrites_consecutive_failures:0
aof_last_write_status:ok
aof_last_cow_size:0
module_fork_in_progress:0
module_fork_last_cow_size:0

# Stats
total_connections_received:1
total_commands_processed:2
instantaneous_ops_per_sec:0
total_net_input_bytes:244
total_net_output_bytes:93
total_net_repl_input_bytes:0
total_net_repl_output_bytes:0
instantaneous_input_kbps:0.00
instantaneous_output_kbps:0.00
instantaneous_input_repl_kbps:0.00
instantaneous_output_repl_kbps:0.00
rejected_connections:0
sync_full:0
sync_partial_ok:0
sync_partial_err:0
expired_keys:0
expired_stale_perc:0.00
expired_time_cap_reached_count:0
expire_cycle_cpu_milliseconds:0
evicted_keys:0
evicted_clients:0
total_eviction_exceeded_time:0
current_eviction_exceeded_time:0
keyspace_hits:3
keyspace_misses:1
pubsub_channels:0
pubsub_patterns:0
pubsubshard_channels:0
latest_fork_usec:0
total_forks:0
migrate_cached_sockets:0
slave_expires_tracked_keys:0
active_defrag_hits:0
active_defrag_misses:0
active_defrag_key_hits:0
active_defrag_key_misses:0
total_active_defrag_time:0
current_active_defrag_time:0
tracking_total_keys:0
tracking_total_items:0
tracking_total_prefixes:0
unexpected_error_replies:0
total_error_replies:0
dump_payload_sanitizations:0
total_reads_processed:2
total_writes_processed:1
io_threaded_reads_processed:0
io_threaded_writes_processed:0
reply_buffer_shrinks:0
reply_buffer_expands:0

# Replication
role:master
connected_slaves:0
master_failover_state:no-failover
master_replid:198ef9765cc6d20950c5df272da6ee1d72248196
master_replid2:0000000000000000000000000000000000000000
master_repl_offset:0
second_repl_offset:-1
repl_backlog_active:0
repl_backlog_size:1048576
repl_backlog_first_byte_offset:0
repl_backlog_histlen:0

# CPU
used_cpu_sys:0.030153
used_cpu_user:0.016831
used_cpu_sys_children:0.000000
used_cpu_user_children:0.000000
used_cpu_sys_main_thread:0.000000
used_cpu_user_main_thread:0.003072

# Modules
module:name=graph,ver=21200,api=1,filters=0,usedby=[],using=[],options=[]

# Commandstats
cmdstat_graph.QUERY:calls=2,usec=1899,usec_per_call=949.50,rejected_calls=0,failed_calls=0

# Errorstats

# Latencystats
latency_percentiles_usec_graph.QUERY:p50=1777.663,p99=1777.663,p99.9=1777.663

# Cluster
cluster_enabled:0

# Keyspace
db0:keys=1,expires=0,avg_ttl=0

------ CLIENT LIST OUTPUT ------
id=6 addr=172.17.0.1:60362 laddr=172.17.0.2:6379 fd=8 name= age=0 idle=0 flags=b db=0 sub=0 psub=0 ssub=0 multi=-1 qbuf=0 qbuf-free=20474 argv-mem=138 multi-mem=0 rbs=16384 rbp=16384 obl=0 oll=0 omem=0 tot-mem=37802 events=r cmd=graph.QUERY user=default redir=-1 resp=2

------ MODULES INFO OUTPUT ------
# graph_executing commands
graph_command:GRAPH.QUERY CYPHER TIMEOUT_DEFAULT="30000" WITH [0, 0] AS n0 OPTIONAL MATCH () UNWIND [0, 0, 0] AS n1 UNWIND [0, 0] AS n2 MERGE ()

------ CONFIG DEBUG OUTPUT ------
lazyfree-lazy-eviction no
client-query-buffer-limit 1gb
lazyfree-lazy-user-del no
proto-max-bulk-len 512mb
repl-diskless-load disabled
io-threads-do-reads no
activedefrag no
lazyfree-lazy-user-flush no
lazyfree-lazy-expire no
slave-read-only yes
list-compress-depth 0
lazyfree-lazy-server-del no
repl-diskless-sync yes
io-threads 1
sanitize-dump-payload no
replica-read-only yes

------ FAST MEMORY TEST ------
10:M 22 Apr 2023 08:51:43.417 # main thread terminated
10:M 22 Apr 2023 08:51:43.418 # Bio thread for job type #0 terminated
10:M 22 Apr 2023 08:51:43.418 # Bio thread for job type #1 terminated
10:M 22 Apr 2023 08:51:43.418 # Bio thread for job type #2 terminated

Fast memory test PASSED, however your memory can still be broken. Please run a memory test for several hours if possible.

=== REDIS BUG REPORT END. Make sure to include from START to END. ===

Steps to reproduce

Run the following query and observe the database crashes:

WITH [0, 0] AS n0 OPTIONAL MATCH () UNWIND [0, 0, 0] AS n1 UNWIND [0, 0] AS n2 MERGE ()

Expected behavior

The query should run successfully

Actual behavior

The database crashes, with the untrue assertion: 0 && "Encountered heap-allocated SIValue of unhandled type".

[nafraf]

Simple test to reproduce the error:

GRAPH.QUERY graph "WITH [0, 0] AS n0 OPTIONAL MATCH () MERGE ()"