zpop cause redis server crashed

[space-j]

zadd a 1 a 1 b 2 c
zpop a
zpop a
zpop a
zpop a <---- zpop cause redis server crashed

=== REDIS BUG REPORT START: Cut & paste starting from here ===
7792:M 29 Dec 07:34:06.668 # Redis 4.0.2 crashed by signal: 11
7792:M 29 Dec 07:34:06.668 # Crashed running the instuction at: 0x10838eea7
7792:M 29 Dec 07:34:06.668 # Accessing address: 0x8
7792:M 29 Dec 07:34:06.668 # Failed assertion: (:0)

------ STACK TRACE ------
EIP:
0 redis-server 0x000000010838eea7 RM_ZsetRem + 39

Backtrace:
0 redis-server 0x00000001083610ae logStackTrace + 110
1 redis-server 0x000000010836146c sigsegvHandler + 236
2 libsystem_platform.dylib 0x00007fffc5a58b3a _sigtramp + 26
3 ??? 0x0000000000000000 0x0 + 0
4 rxzsets.so 0x000000010851d190 ZPopGenericCommand + 320
5 redis-server 0x000000010838cb03 RedisModuleCommandDispatcher + 147
6 redis-server 0x0000000108319338 call + 216
7 redis-server 0x0000000108319b99 processCommand + 1305
8 redis-server 0x0000000108329f52 processInputBuffer + 322
9 redis-server 0x0000000108311a91 aeProcessEvents + 689
10 redis-server 0x0000000108311d7b aeMain + 43
11 redis-server 0x000000010831cb7f main + 1727
12 libdyld.dylib 0x00007fffc5849235 start + 1

------ INFO OUTPUT ------

Server

redis_version:4.0.2
redis_git_sha1:00000000
redis_git_dirty:0
redis_build_id:58d9ae694b6af3b1
redis_mode:standalone
os:Darwin 16.7.0 x86_64
arch_bits:64
multiplexing_api:kqueue
atomicvar_api:atomic-builtin
gcc_version:4.2.1
process_id:7792
run_id:f7c20ee2186ec7bcedc5a87df4189dd265a3ab77
tcp_port:6379
uptime_in_seconds:132
uptime_in_days:0
hz:10
lru_clock:4554606
executable:/Users/jing/redis/src/./redis-server
config_file:

Clients

connected_clients:1
client_longest_output_list:0
client_biggest_input_buf:0
blocked_clients:0

Memory

used_memory:1026624
used_memory_human:1002.56K
used_memory_rss:2195456
used_memory_rss_human:2.09M
used_memory_peak:1026624
used_memory_peak_human:1002.56K
used_memory_peak_perc:100.13%
used_memory_overhead:1013614
used_memory_startup:963280
used_memory_dataset:13010
used_memory_dataset_perc:20.54%
total_system_memory:17179869184
total_system_memory_human:16.00G
used_memory_lua:37888
used_memory_lua_human:37.00K
maxmemory:0
maxmemory_human:0B
maxmemory_policy:noeviction
mem_fragmentation_ratio:2.14
mem_allocator:libc
active_defrag_running:0
lazyfree_pending_objects:0

Persistence

loading:0
rdb_changes_since_last_save:0
rdb_bgsave_in_progress:0
rdb_last_save_time:1514503914
rdb_last_bgsave_status:ok
rdb_last_bgsave_time_sec:-1
rdb_current_bgsave_time_sec:-1
rdb_last_cow_size:0
aof_enabled:0
aof_rewrite_in_progress:0
aof_rewrite_scheduled:0
aof_last_rewrite_time_sec:-1
aof_current_rewrite_time_sec:-1
aof_last_bgrewrite_status:ok
aof_last_write_status:ok
aof_last_cow_size:0

Stats

total_connections_received:1
total_commands_processed:9
instantaneous_ops_per_sec:0
total_net_input_bytes:104
total_net_output_bytes:117
instantaneous_input_kbps:0.00
instantaneous_output_kbps:0.00
rejected_connections:0
sync_full:0
sync_partial_ok:0
sync_partial_err:0
expired_keys:0
evicted_keys:0
keyspace_hits:3
keyspace_misses:0
pubsub_channels:0
pubsub_patterns:0
latest_fork_usec:0
migrate_cached_sockets:0
slave_expires_tracked_keys:0
active_defrag_hits:0
active_defrag_misses:0
active_defrag_key_hits:0
active_defrag_key_misses:0

Replication

role:master
connected_slaves:0
master_replid:9b103e117b4c5ab5f74ba52940810157ff4474b2
master_replid2:0000000000000000000000000000000000000000
master_repl_offset:0
second_repl_offset:-1
repl_backlog_active:0
repl_backlog_size:1048576
repl_backlog_first_byte_offset:0
repl_backlog_histlen:0

CPU

used_cpu_sys:0.06
used_cpu_user:0.03
used_cpu_sys_children:0.00
used_cpu_user_children:0.00

Commandstats

cmdstat_zrange:calls=1,usec=11,usec_per_call=11.00
cmdstat_zpop:calls=5,usec=89,usec_per_call=17.80
cmdstat_zremrangebyrank:calls=1,usec=12,usec_per_call=12.00
cmdstat_type:calls=2,usec=5,usec_per_call=2.50

Cluster

cluster_enabled:0

Keyspace

db0:keys=4,expires=0,avg_ttl=0
db2:keys=6,expires=0,avg_ttl=0
db3:keys=2,expires=0,avg_ttl=0

------ CLIENT LIST OUTPUT ------
id=2 addr=127.0.0.1:55615 fd=8 name= age=129 idle=0 flags=N db=0 sub=0 psub=0 multi=-1 qbuf=0 qbuf-free=32768 obl=0 oll=0 omem=0 events=r cmd=zpop

------ CURRENT CLIENT INFO ------
id=2 addr=127.0.0.1:55615 fd=8 name= age=129 idle=0 flags=N db=0 sub=0 psub=0 multi=-1 qbuf=0 qbuf-free=32768 obl=0 oll=0 omem=0 events=r cmd=zpop
argv[0]: 'zpop'
argv[1]: 'a'
7792:M 29 Dec 07:34:06.673 # key 'a' found in DB containing the following object:
7792:M 29 Dec 07:34:06.673 # Object type: 3
7792:M 29 Dec 07:34:06.673 # Object encoding: 5
7792:M 29 Dec 07:34:06.673 # Object refcount: 1
7792:M 29 Dec 07:34:06.673 # Sorted set size: 0

------ REGISTERS ------
7792:M 29 Dec 07:34:06.673 #
RAX:0000000000000001 RBX:0000000000000000
RCX:0000000000000003 RDX:0000000000000000
RDI:00007f988ad11100 RSI:0000000000000000
RBP:00007fff578f2600 RSP:00007fff578f25f0
R8 :0000000000000010 R9 :0000000000000216
R10:00007f988ae00000 R11:0000000000000001
R12:0000000000000000 R13:00007fff578f2660
R14:0000000000000000 R15:0000000000000000
RIP:000000010838eea7 EFL:0000000000010246
CS :000000000000002b FS:0000000000000000 GS:0000000000000000
7792:M 29 Dec 07:34:06.673 # (00007fff578f25ff) -> 00007f988ad0f630
7792:M 29 Dec 07:34:06.673 # (00007fff578f25fe) -> 000000010838c840
7792:M 29 Dec 07:34:06.673 # (00007fff578f25fd) -> 000000010838cb03
7792:M 29 Dec 07:34:06.673 # (00007fff578f25fc) -> 00007fff578f26e0
7792:M 29 Dec 07:34:06.673 # (00007fff578f25fb) -> 000000010832a15c
7792:M 29 Dec 07:34:06.673 # (00007fff578f25fa) -> 00007f988c016000
7792:M 29 Dec 07:34:06.673 # (00007fff578f25f9) -> 00000000000a347b
7792:M 29 Dec 07:34:06.673 # (00007fff578f25f8) -> 0000000000000000
7792:M 29 Dec 07:34:06.673 # (00007fff578f25f7) -> 000000005a457f6e
7792:M 29 Dec 07:34:06.673 # (00007fff578f25f6) -> 0000000000000000
7792:M 29 Dec 07:34:06.673 # (00007fff578f25f5) -> 00007f988ae216f0
7792:M 29 Dec 07:34:06.673 # (00007fff578f25f4) -> 0000000000000004
7792:M 29 Dec 07:34:06.673 # (00007fff578f25f3) -> 000000010851d190
7792:M 29 Dec 07:34:06.673 # (00007fff578f25f2) -> 00007fff578f2650
7792:M 29 Dec 07:34:06.673 # (00007fff578f25f1) -> 0000000000000000
7792:M 29 Dec 07:34:06.673 # (00007fff578f25f0) -> 00000001085262f8

------ DUMPING CODE AROUND EIP ------
Symbol: RM_ZsetRem (base: 0x10838ee80)
Module: /Users/jing/redis/src/./redis-server (base 0x10830d000)
$ xxd -r -p /tmp/dump.hex /tmp/dump.bin
$ objdump --adjust-vma=0x10838ee80 -D -b binary -m i386:x86-64 /tmp/dump.bin

7792:M 29 Dec 07:34:06.673 # dump of function (hexdump of 167 bytes):
554889e553504889d3b801000000f6472802743c488b7f184885ff74268b0f83e10f83f9037529488b7608e8109efbff85c0740f31c04885db7415c70301000000eb0d31c04885db7406c703000000004883c4085b5dc3660f1f840000000000488b7f18b8010000004885ff74228b0f83e10f83f9037518554889e5488b7608e88b99fbff89c131c083f9ff0f94c05dc36666666666662e0f1f840000000000554889e58b4770
Function at 0x108348cc0 is zsetDel
Function at 0x108348890 is zsetScore

=== REDIS BUG REPORT END. Make sure to include from START to END. ===