Graphd crashed executing match query(10)

[nebula-bots]

Please check the FAQ documentation before raising an issue

Describe the bug (required)

Graphd crashed executing the following query:

$ MATCH (v0)-[e0]->()<-[e1]-() WHERE (id(v0) in [31, 5, 13, 1, 21, 8, 12, 30, 17, 2, 24]) AND ((e1.Rel_1_5_Int <= 0.335665)) WITH e1.Rel_1_4_Bool AS pa0, ((0.055487 - e0.Rel_4_4_Double) >= e1.Rel_1_0_Int) AS pa1, e0, e1, sum((((- (- 0.588078)) + (- (e0.Rel_5_4_Double % e0.Rel_1_3_Double))) / 72)) AS pa2 WHERE (e0.Rel_4_2_Double == (pa2 * (- (pa2 - (- 53))))) MATCH (v1)<-[e2:Rel_0{Rel_0_2_String: 'Ray Allen'}]-(v2:Label_1:Label_5)-[e3:Rel_0]->() WHERE (id(v1) == 10) AND (e3.Rel_2_4_Bool) WITH ((e0.Rel_5_2_Double <= (0.809165 / e3.Rel_0_4_Double)) AND ((e0.Rel_0_5_Int > ((- (pa2 - pa2)) % ((v2.Label_1.Label_1_3_Int / e3.Rel_3_3_Int) % pa2))) OR (e1.Rel_1_4_Bool OR ((- (pa2 - 0.084495)) >= (- (- e1.Rel_4_2_Double)))))) AS pa0, ((pa2 % e1.Rel_4_4_Double) <= ((- e0.Rel_5_4_Double) / (pa2 % ((- (- e2.Rel_1_0_Int)) + e3.Rel_3_2_Double)))) AS pa1, v2, e2 WHERE (e2.Rel_0_3_Int > (- e2.Rel_1_5_Int)) MATCH (v3)-[e4:Rel_5]->(v4:Label_0:Label_4)-[e5:Rel_0]->() WHERE (id(v3) == 18) AND (((e4.Rel_2_5_Int + ((v4.Label_0.Label_0_4_Int - v4.Label_0.Label_0_5_Int) - ((- e5.Rel_0_3_Int) + ((e4.Rel_0_4_Double - v4.Label_3.Label_3_5_Int) * (e5.Rel_0_4_Double / 1))))) <= (v2.Label_5.Label_5_1_Int * e5.Rel_0_4_Double))) MATCH (v5)<-[e6]-(v6:Label_2)-[e7*1..1]->(:Label_0{Label_0_1_String: 'Null3'}:Label_6:Label_3{Label_3_2_Bool: true, Label_3_6_Bool: false}:Label_2) WHERE (id(v5) == 29) AND ((e5.Rel_0_3_Int < (- (- v4.Label_6.Label_6_0_Int)))) MATCH (v7:Label_0{Label_0_1_String: 'Blake Griffin'})<-[e8]-(v2:Label_1:Label_5)<-[e9]-(v8:Label_2) WHERE (id(v7) == 28) AND ((((- v4.Label_0.Label_0_5_Int) % ((- e6.Rel_2_5_Int) + ((- (27 % v6.Label_5.Label_5_3_Int)) / (- (83 - e2.Rel_1_0_Int))))) <= e9.Rel_2_0_Int)) UNWIND e7 AS ua0 WITH *  MATCH (v9)<-[e10]-()<-[e11]-(v10) WHERE (id(v9) == 10) AND ((NOT ua0.Rel_0_0_Bool)) MATCH (v8:Label_2)<-[e12]-(v2:Label_1:Label_5)-[e13]->(v11) WHERE (e9.Rel_2_3_Bool) MATCH p0 = (v12)<-[e14]-(v8:Label_2)-[e15]->(v13) WHERE (id(v12) == 14) AND (v13.Label_0.Label_0_3_Bool) RETURN count(*) as totalRows

The crash stack:

[Thread debugging using libthread_db enabled]
Using host libthread_db library "/lib/x86_64-linux-gnu/libthread_db.so.1".
--Type <RET> for more, q to quit, c to continue without paging--
Core was generated by `/root/src/nebula-comm/build/bin/nebula-graphd --flagfile /root/nebula-chaos-clu'.
Program terminated with signal SIGSEGV, Segmentation fault.
b#0  0x00000000013f2ffe in nebula::graph::AsyncMsgNotifyBasedScheduler::doSchedule (this=0x7f9a8901fc80, root=<optimized out>) at /data/src/nebula-comm/src/graph/scheduler/AsyncMsgNotifyBasedScheduler.cpp:51
51            const auto& writtenBy = qctx_->symTable()->getVar(nodeInputVar)->writtenBy;
[Current thread is 1 (Thread 0x7f9a829fd700 (LWP 149))]
(gdb) bt
(gdb) bt
#0  0x00000000013f2ffe in nebula::graph::AsyncMsgNotifyBasedScheduler::doSchedule (this=0x7f9a8901fc80, root=<optimized out>) at /data/src/nebula-comm/src/graph/scheduler/AsyncMsgNotifyBasedScheduler.cpp:51
#1  0x00000000013f2693 in nebula::graph::AsyncMsgNotifyBasedScheduler::schedule (this=0x7f9a8901fc80) at /data/src/nebula-comm/src/graph/scheduler/AsyncMsgNotifyBasedScheduler.cpp:27
#2  0x00000000010ebc37 in nebula::graph::QueryInstance::execute (this=0x7f9a890640c0) at /data/src/nebula-comm/src/graph/service/QueryInstance.cpp:54
#3  0x00000000010e912b in nebula::graph::QueryEngine::execute (this=0x7f9a4d606a40, rctx=...) at /data/src/nebula-comm/src/graph/service/QueryEngine.cpp:56
#4  0x00000000010bd6da in nebula::graph::GraphService::future_executeWithParameter(long, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&, std::unordered_map<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >, nebula
::Value, std::hash<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > >, std::equal_to<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > >, std::allocator<std::pair<std::__cxx11::basic_string<char, std::char_traits<char>, st
d::allocator<char> > const, nebula::Value> > > const&)::$_1::operator()(nebula::StatusOr<std::shared_ptr<nebula::graph::ClientSession> >) (this=<optimized out>, ret=...) at /data/src/nebula-comm/src/graph/service/GraphService.cpp:182
#5  folly::futures::detail::wrapInvoke<nebula::StatusOr<std::shared_ptr<nebula::graph::ClientSession> >, nebula::graph::GraphService::future_executeWithParameter(long, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&, std::unordered_map<std::__c
xx11::basic_string<char, std::char_traits<char>, std::allocator<char> >, nebula::Value, std::hash<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > >, std::equal_to<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > >, std::
allocator<std::pair<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const, nebula::Value> > > const&)::$_1>(folly::Try<nebula::StatusOr<std::shared_ptr<nebula::graph::ClientSession> > >&&, nebula::graph::GraphService::future_executeWithParameter(long,
 std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&, std::unordered_map<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >, nebula::Value, std::hash<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocat
or<char> > >, std::equal_to<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > >, std::allocator<std::pair<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const, nebula::Value> > > const&)::$_1&&)::{lambda()#1}::operator()
() const (this=<optimized out>) at /data/src/nebula-comm/build/third-party/install/include/folly/futures/Future-inl.h:98

Your Environments (required)

• OS: uname -a
• Compiler: g++ --version or clang++ --version
• CPU: lscpu
• Commit id (e.g. a3ffc7d8) de02384(community edition)

How To Reproduce(required)

Steps to reproduce the behavior:

1. Step 1
2. Step 2
3. Step 3

Expected behavior

Additional context

[xtcyclist]

Looking at this bug.

[xtcyclist]

The argument operator in the crashed query plan has no input variable, causing a DCHECK to fail.

[xtcyclist]

// The plan node referenced by argument always comes from the left side of the plan tree. So we only need to
// check whether the left root child of binary input plan node contains what the argument needs in
// its output columns
bool findArgumentRefPlanNodeInPath(const std::vector<const PlanNode *> &path, PlanNode *argument) {
  DCHECK_EQ(argument->kind(), PlanNode::Kind::kArgument);
  for (int i = path.size() - 1; i >= 0; i--) {
    const auto *pn = path[i];
    if (pn->isBiInput()) {
      DCHECK_LT(i, path.size() - 1);
      const auto *bpn = static_cast<const BinaryInputNode *>(pn);
      if (bpn->right() == path[i + 1]) {
        // Argument is in the right side dependency of binary plan node, check the left child
        // output columns
        if (argument->isColumnsIncludedIn(bpn->left())) {
          argument->setInputVar(bpn->left()->outputVar());
          return true;
        }
      } else {
        // Argument is in the left side dependency of binary plan node, continue to find
        // next parent plan node
        DCHECK_EQ(bpn->left(), path[i + 1]);
      }
    }
  }
  return false;
}

findArgumentRefPlanNodeInPath in the optimizer fails to find and set the input variable of the argument operator, which is necessary for further processing.

[xtcyclist]

[xtcyclist]

v8 is lost here.

[xtcyclist]

[xtcyclist]

[xtcyclist]

Reduced to explain match (v:player)--(t:team) unwind v.player.name as name with * match (t:team)--(v1:player) return for reproducing of this problem.

[xtcyclist]

(root@nebula) [nba]> match (v:player)--(t:team) where id(v) == "Tim Duncan" unwind [1] as digit with * match (t:team)<--(v1) return v1.player.name
+---------------------+
| v1.player.name      |
+---------------------+
| "Cory Joseph"       |
| "Kyle Anderson"     |
| "Danny Green"       |
| "David West"        |
| "Jonathon Simmons"  |
| "LaMarcus Aldridge" |
| "Rudy Gay"          |
| "Tony Parker"       |
| "Marco Belinelli"   |
| "Marco Belinelli"   |
| "Tiago Splitter"    |
| "Tim Duncan"        |
| "Manu Ginobili"     |
| "Tracy McGrady"     |
| "Boris Diaw"        |
| "Aron Baynes"       |
| "Paul Gasol"        |
| "Dejounte Murray"   |
+---------------------+

Added the above as a tck case for this issue.