crash: "Unexpected override" in Renamer::DeserializeDest with BRPOPLPUSH + RENAME + LPUSH #6182
Description
Python script to reproduce:
#!/usr/bin/env python3
import asyncio, random
from redis import asyncio as aioredis
PORT = 6379
NUM_KEYS = 10
ITERATIONS = 2000
WORKERS = 5
async def main():
r = aioredis.Redis(port=PORT)
for i in range(NUM_KEYS):
await r.delete(f'k{i}')
await r.rpush(f'k{i}', 'a', 'b', 'c')
await r.aclose()
async def worker(ops):
c = aioredis.Redis(port=PORT)
for _ in range(ITERATIONS):
try:
op = random.choice(ops)
k1 = f'k{random.randint(0, NUM_KEYS-1)}'
k2 = f'k{random.randint(0, NUM_KEYS-1)}'
if op == 'brpoplpush':
await c.brpoplpush(k1, k2, timeout=0.001)
elif op == 'lpush':
await c.lpush(k1, 'x')
elif op == 'rename':
await c.rename(k1, k2)
except:
pass
await c.aclose()
tasks = [worker(['brpoplpush']) for _ in range(WORKERS)]
tasks += [worker(['lpush']) for _ in range(WORKERS)]
tasks += [worker(['rename']) for _ in range(WORKERS)]
await asyncio.gather(*tasks)
try:
c = aioredis.Redis(port=PORT)
await c.ping()
print("Server alive")
await c.aclose()
except:
print("CRASHED")
if __name__ == "__main__":
asyncio.run(main())Crash log:
F20251208 18:45:39.154712 32753 generic_family.cc:504] Unexpected override for key k5 0
*** Check failure stack trace: ***
@ 0x5b2b71bc04ef google::LogMessage::Fail()
@ 0x5b2b71bc0435 google::LogMessage::SendToLog()
@ 0x5b2b71bbfbe8 google::LogMessage::Flush()
@ 0x5b2b71bbf963 google::LogMessage::~LogMessage()
@ 0x5b2b70e53938 dfly::(anonymous namespace)::Renamer::DeserializeDest()
@ 0x5b2b70e52610 _ZZN4dfly12_GLOBAL__N_17Renamer14FinalizeRenameEvENKUlPNS_11TransactionEPNS_11EngineShardEE_clES3_S5_
@ 0x5b2b70e6a332 _ZSt13__invoke_implIN6facade8OpStatusERKZN4dfly12_GLOBAL__N_17Renamer14FinalizeRenameEvEUlPNS2_11TransactionEPNS2_11EngineShardEE_JS6_S8_EET_St14__invoke_otherOT0_DpOT1_
@ 0x5b2b70e688ab _ZSt8__invokeIRKZN4dfly12_GLOBAL__N_17Renamer14FinalizeRenameEvEUlPNS0_11TransactionEPNS0_11EngineShardEE_JS4_S6_EENSt15__invoke_resultIT_JDpT0_EE4typeEOSB_DpOSC_
@ 0x5b2b70e67506 _ZSt6invokeIRKZN4dfly12_GLOBAL__N_17Renamer14FinalizeRenameEvEUlPNS0_11TransactionEPNS0_11EngineShardEE_JS4_S6_EENSt13invoke_resultIT_JDpT0_EE4typeEOSB_DpOSC_
@ 0x5b2b70e65cdd _ZN4absl12lts_2025051219functional_internal12InvokeObjectIZN4dfly12_GLOBAL__N_17Renamer14FinalizeRenameEvEUlPNS3_11TransactionEPNS3_11EngineShardEE_NS6_14RunnableResultEJS7_S9_EEET0_NS1_7VoidPtrEDpNS1_8ForwardTIT1_E4typeE
@ 0x5b2b715d74f6 absl::lts_20250512::FunctionRef<>::operator()()
@ 0x5b2b715c3e7d dfly::Transaction::RunCallback()
@ 0x5b2b715c32f8 dfly::Transaction::RunInShard()
@ 0x5b2b70d003b7 _ZZN4dfly11EngineShard13PollExecutionEPKcPNS_11TransactionEENKUlS4_bE_clES4_b
@ 0x5b2b70d00c20 dfly::EngineShard::PollExecution()
@ 0x5b2b715c644d _ZZN4dfly11Transaction11DispatchHopEvENKUlvE_clEv
@ 0x5b2b715d4888 _ZSt13__invoke_implIvRZN4dfly11Transaction11DispatchHopEvEUlvE_JEET_St14__invoke_otherOT0_DpOT1_
@ 0x5b2b715d42b7 _ZSt10__invoke_rIvRZN4dfly11Transaction11DispatchHopEvEUlvE_JEENSt9enable_ifIX16is_invocable_r_vIT_T0_DpT1_EES5_E4typeEOS6_DpOS7_
@ 0x5b2b715d3ddc _ZNSt17_Function_handlerIFvvEZN4dfly11Transaction11DispatchHopEvEUlvE_E9_M_invokeERKSt9_Any_data
@ 0x5b2b70c3ad2e std::function<>::operator()()
@ 0x5b2b71a1bc14 util::fb2::FiberQueue::Run()
@ 0x5b2b716bb889 _ZZN4dfly9TaskQueue5StartESt17basic_string_viewIcSt11char_traitsIcEEENKUlvE_clEv
@ 0x5b2b716bca3f _ZSt13__invoke_implIvZN4dfly9TaskQueue5StartESt17basic_string_viewIcSt11char_traitsIcEEEUlvE_JEET_St14__invoke_otherOT0_DpOT1_
@ 0x5b2b716bc7c4 _ZSt8__invokeIZN4dfly9TaskQueue5StartESt17basic_string_viewIcSt11char_traitsIcEEEUlvE_JEENSt15__invoke_resultIT_JDpT0_EE4typeEOS8_DpOS9_
@ 0x5b2b716bc5d2 _ZSt12__apply_implIZN4dfly9TaskQueue5StartESt17basic_string_viewIcSt11char_traitsIcEEEUlvE_St5tupleIJEEJEEDcOT_OT0_St16integer_sequenceImJXspT1_EEE
@ 0x5b2b716bc60c _ZSt5applyIZN4dfly9TaskQueue5StartESt17basic_string_viewIcSt11char_traitsIcEEEUlvE_St5tupleIJEEEDcOT_OT0_
@ 0x5b2b716bc689 _ZN4util3fb26detail15WorkerFiberImplIZN4dfly9TaskQueue5StartESt17basic_string_viewIcSt11char_traitsIcEEEUlvE_JEE4run_EON5boost7context5fiberE
@ 0x5b2b716bc207 _ZZN4util3fb26detail15WorkerFiberImplIZN4dfly9TaskQueue5StartESt17basic_string_viewIcSt11char_traitsIcEEEUlvE_JEEC4INS0_19FixedStackAllocatorEEES8_NS0_13FiberPriorityERKN5boost7context12preallocatedEOT_OS9_ENKUlONSF_5fiberEE_clESN_
@ 0x5b2b716bd380 _ZSt13__invoke_implIN5boost7context5fiberERZN4util3fb26detail15WorkerFiberImplIZN4dfly9TaskQueue5StartESt17basic_string_viewIcSt11char_traitsIcEEEUlvE_JEEC4INS4_19FixedStackAllocatorEEESC_NS4_13FiberPriorityERKNS1_12preallocatedEOT_OSD_EUlOS2_E_JS2_EESL_St14__invoke_otherOT0_DpOT1_
@ 0x5b2b716bd1ab _ZSt8__invokeIRZN4util3fb26detail15WorkerFiberImplIZN4dfly9TaskQueue5StartESt17basic_string_viewIcSt11char_traitsIcEEEUlvE_JEEC4INS1_19FixedStackAllocatorEEES9_NS1_13FiberPriorityERKN5boost7context12preallocatedEOT_OSA_EUlONSG_5fiberEE_JSN_EENSt15__invoke_resultISK_JDpT0_EE4typeESL_DpOSS_
@ 0x5b2b716bd081 _ZSt6invokeIRZN4util3fb26detail15WorkerFiberImplIZN4dfly9TaskQueue5StartESt17basic_string_viewIcSt11char_traitsIcEEEUlvE_JEEC4INS1_19FixedStackAllocatorEEES9_NS1_13FiberPriorityERKN5boost7context12preallocatedEOT_OSA_EUlONSG_5fiberEE_JSN_EENSt13invoke_resultISK_JDpT0_EE4typeESL_DpOSS_
@ 0x5b2b716bce2c _ZN5boost7context6detail12fiber_recordINS0_5fiberEN4util3fb219FixedStackAllocatorEZNS5_6detail15WorkerFiberImplIZN4dfly9TaskQueue5StartESt17basic_string_viewIcSt11char_traitsIcEEEUlvE_JEEC4IS6_EESE_NS5_13FiberPriorityERKNS0_12preallocatedEOT_OSF_EUlOS3_E_E3runEPv
*** SIGABRT received at time=1765212339 on cpu 6 ***
PC: @ 0x778c58b15b2c (unknown) pthread_kill
@ 0x5b2b71c51823 64 absl::lts_20250512::WriteFailureInfo()
@ 0x5b2b71c51aa7 96 absl::lts_20250512::AbslFailureSignalHandler()
@ 0x778c58abc330 1792 (unknown)
@ 0x778c58abc27e 32 raise
@ 0x778c58a9f8ff 192 abort
@ 0x5b2b71bcb23c 176 google::DumpStackTraceAndExit()
@ 0x5b2b71bc04ef 16 google::LogMessage::Fail()
@ 0x5b2b71bc0435 160 google::LogMessage::SendToLog()
@ 0x5b2b71bbfbe8 80 google::LogMessage::Flush()
@ 0x5b2b71bbf963 48 google::LogMessage::~LogMessage()
@ 0x5b2b70e53938 1248 dfly::(anonymous namespace)::Renamer::DeserializeDest()
@ 0x5b2b70e52610 80 dfly::(anonymous namespace)::Renamer::FinalizeRename()::{lambda()#1}::operator()()
@ 0x5b2b70e6a332 64 std::__invoke_impl<>()
@ 0x5b2b70e688ab 64 std::__invoke<>()
@ 0x5b2b70e67506 64 std::invoke<>()
@ 0x5b2b70e65cdd 96 absl::lts_20250512::functional_internal::InvokeObject<>()
@ 0x5b2b715d74f6 64 absl::lts_20250512::FunctionRef<>::operator()()
@ 0x5b2b715c3e7d 240 dfly::Transaction::RunCallback()
@ 0x5b2b715c32f8 384 dfly::Transaction::RunInShard()
@ 0x5b2b70d003b7 64 dfly::EngineShard::PollExecution()::{lambda()#1}::operator()()
@ 0x5b2b70d00c20 416 dfly::EngineShard::PollExecution()
@ 0x5b2b715c644d 224 dfly::Transaction::DispatchHop()::{lambda()#1}::operator()()
@ 0x5b2b715d4888 32 std::__invoke_impl<>()
@ 0x5b2b715d42b7 32 std::__invoke_r<>()
@ 0x5b2b715d3ddc 32 std::_Function_handler<>::_M_invoke()
@ 0x5b2b70c3ad2e 32 std::function<>::operator()()
@ 0x5b2b71a1bc14 240 util::fb2::FiberQueue::Run()
@ 0x5b2b716bb889 32 dfly::TaskQueue::Start()::{lambda()#1}::operator()()
@ 0x5b2b716bca3f 32 std::__invoke_impl<>()
@ 0x5b2b716bc7c4 32 std::__invoke<>()
@ 0x5b2b716bc5d2 32 std::__apply_impl<>()
@ 0x5b2b716bc60c 48 std::apply<>()
@ ... and at least 8 more frames
[1] 32745 IOT instruction (core dumped) ./dragonfly --dbfilename= --logtostderr 2>&1