Crash when doing zinterstore on a set and a ordered set

[GoogleCodeExporter]

I'm using redis 2.2.7 (latest) on Ubuntu.

When I try to do zinterstore on a Zset and a normal set all is well for small 
sets. But when the sets are larger (the fails is with a set of 22 members and a 
zset with 277 elements) the server crashes:

[30185] 21 May 18:32:14 # ======= Ooops! Redis 2.2.7 got signal: -11- =======
[30185] 21 May 18:32:14 # redis_version:2.2.7
redis_git_sha1:00000000
redis_git_dirty:0
arch_bits:32
multiplexing_api:epoll
process_id:30185
uptime_in_seconds:11
uptime_in_days:0
lru_clock:575769
used_cpu_sys:0.10
used_cpu_user:0.17
used_cpu_sys_childrens:0.00
used_cpu_user_childrens:0.00
connected_clients:2
connected_slaves:0
client_longest_output_list:0
client_biggest_input_buf:0
blocked_clients:0
used_memory:1167640
used_memory_human:1.11M
used_memory_rss:3518464
mem_fragmentation_ratio:3.01
use_tcmalloc:0
loading:0
aof_enabled:0
changes_since_last_save:8808
bgsave_in_progress:0
last_save_time:1305991923
bgrewriteaof_in_progress:0
total_connections_received:3
total_commands_processed:8810
expired_keys:0
evicted_keys:0
keyspace_hits:3248
keyspace_misses:1830
hash_max_zipmap_entries:512
hash_max_zipmap_value:64
pubsub_channels:0
pubsub_patterns:0
vm_enabled:0
role:master
allocation_stats:4=33,6=1,7=1,8=1863,9=69,10=3061,11=1052,12=68675,13=6523,14=91
,15=264,16=1683,17=246,18=65,19=507,20=77,2
[30185] 21 May 18:32:14 # redis-server(dictFind+0x46) [0x8053a36]
[30185] 21 May 18:32:14 # redis-server(zunionInterGenericCommand+0x68f) 
[0x806c93f]
[30185] 21 May 18:32:14 # redis-server(zinterstoreCommand+0x23) [0x806ca73]
[30185] 21 May 18:32:14 # redis-server(call+0x25) [0x8055655]
[30185] 21 May 18:32:14 # redis-server(processCommand+0x260) [0x80559a0]
[30185] 21 May 18:32:14 # redis-server(processInputBuffer+0x5f) [0x805e37f]
[30185] 21 May 18:32:14 # redis-server(readQueryFromClient+0x70) [0x805e470]
[30185] 21 May 18:32:14 # redis-server(aeProcessEvents+0x132) [0x80520d2]
[30185] 21 May 18:32:14 # redis-server(aeMain+0x37) [0x80522e7]
[30185] 21 May 18:32:14 # redis-server(main+0x112) [0x80577c2]
[30185] 21 May 18:32:14 # /lib/tls/i686/cmov/libc.so.6(__libc_start_main+0xe6) 
[0x126bd6]
[30185] 21 May 18:32:14 # redis-server() [0x80516d1]
Segmentation fault (core dumped)

Here is example code in PHP that causes the crash:
<?php

$redis = new Redis();

foreach(range(1, 22) as $i){
    $redis->sadd('aset', $i);
}
foreach(range(1, 277) as $i){
    $redis->sadd('azset', $i, $i);
}

$redis->zinterstore('intersect', 2, 'aset', 'azset'); // Crashes the server
?>

Original issue reported on code.google.com by alex...@gmail.com on 21 May 2011 at 4:04

[GoogleCodeExporter]

There is a typo in the testing code: the second add should be: 
$redis->zadd('azset', $i, $i);

Original comment by alex...@gmail.com on 21 May 2011 at 4:08

[GoogleCodeExporter]

After some further testing I discovered that the crash is NOT caused by the 
number of members in the sets. The server crashes of both sets contain numeric 
(integer) values

Original comment by alex...@gmail.com on 21 May 2011 at 4:17

[GoogleCodeExporter]

Hey Alex, thanks for reporting. This is fixed in the latest 2.2 branch, I'll 
release 2.2.8 in the course of the next fix, and this fix will be included. For 
now please use the latest commit in the 2.2 branch on github.

Cheers,
Salvatore

Original comment by anti...@gmail.com on 21 May 2011 at 4:27

[GoogleCodeExporter]

Thanks, mate!

Original comment by alex...@gmail.com on 21 May 2011 at 4:30