[CRASH] crash happens when executing "keys" in lua scripts #562
Description
Crash report
Paste the complete crash log between the quotes below. Please include a few lines from the log preceding the crash report to provide some context.
24:24:C 07 Feb 2023 07:43:31.440 # oO0OoO0OoO0Oo KeyDB is starting oO0OoO0OoO0Oo
24:24:C 07 Feb 2023 07:43:31.441 # KeyDB version=6.3.2, bits=64, commit=00000000, modified=0, pid=24, just started
24:24:C 07 Feb 2023 07:43:31.441 # Configuration loaded
24:24:C 07 Feb 2023 07:43:31.441 # WARNING overcommit_memory is set to 0! Background save may fail under low memory condition. To fix this issue add 'vm.overcommit_memory = 1' to /etc/sysctl.conf and then reboot or run the command 'sysctl vm.overcommit_memory=1' for this to take effect.
24:24:M 07 Feb 2023 07:43:31.443 * monotonic clock: POSIX clock_gettime
_
_-(+)-_
_-- / \ --_
_-- / \ --_ KeyDB 6.3.2 (00000000/0) 64 bit
__-- / \ --__
(+) _ / \ _ (+) Running in standalone mode
| -- / \ -- | Port: 6379
| /--_ _ _--\ | PID: 24
| / -(+)- \ |
| / | \ | https://docs.keydb.dev
| / | \ |
| / | \ |
(+)_ -- -- -- | -- -- -- _(+)
--_ | _--
--_ | _--
-(+)- KeyDB has now joined Snap! See the announcement at: https://docs.keydb.dev/news
24:24:M 07 Feb 2023 07:43:31.444 # Server initialized
24:24:M 07 Feb 2023 07:43:31.445 * Loading RDB produced by version 6.3.2
24:24:M 07 Feb 2023 07:43:31.445 * RDB age 40 seconds
24:24:M 07 Feb 2023 07:43:31.445 * RDB memory usage when created 3.22 Mb
24:24:M 07 Feb 2023 07:43:31.445 # Done loading RDB, keys loaded: 0, keys expired: 0.
24:24:M 07 Feb 2023 07:43:31.445 * DB loaded from disk: 0.000 seconds
24:24:M 07 Feb 2023 07:43:31.445 * The server is now ready to accept connections at /var/run/redis/redis.sock
24:24:M 07 Feb 2023 07:43:31.445 * Binding thread 0 to cpu 1
24:42:M 07 Feb 2023 07:43:31.445 * Thread 0 alive.
24:24:M 07 Feb 2023 07:43:31.445 * Binding thread 1 to cpu 2
24:24:M 07 Feb 2023 07:43:31.445 * Binding thread 2 to cpu 3
24:45:M 07 Feb 2023 07:43:31.445 * Thread 2 alive.
24:24:M 07 Feb 2023 07:43:31.446 * Binding thread 3 to cpu 4
24:44:M 07 Feb 2023 07:43:31.446 * Thread 1 alive.
24:46:M 07 Feb 2023 07:43:31.446 * Thread 3 alive.
=== KEYDB BUG REPORT START: Cut & paste starting from here ===
24:42:M 07 Feb 2023 07:43:36.919 # === ASSERTION FAILED ===
24:42:M 07 Feb 2023 07:43:36.919 # ==> scripting.cpp:780 '(c->flags & CLIENT_BLOCKED) == 0' is not true
------ STACK TRACE ------
24:24:C 07 Feb 2023 07:48:15.182 # oO0OoO0OoO0Oo KeyDB is starting oO0OoO0OoO0Oo
24:24:C 07 Feb 2023 07:48:15.182 # KeyDB version=6.3.2, bits=64, commit=00000000, modified=0, pid=24, just started
24:24:C 07 Feb 2023 07:48:15.182 # Configuration loaded
24:24:C 07 Feb 2023 07:48:15.182 # WARNING overcommit_memory is set to 0! Background save may fail under low memory condition. To fix this issue add 'vm.overcommit_memory = 1' to /etc/sysctl.conf and then reboot or run the command 'sysctl vm.overcommit_memory=1' for this to take effect.
24:24:M 07 Feb 2023 07:48:15.184 * monotonic clock: POSIX clock_gettime
_
_-(+)-_
_-- / \ --_
_-- / \ --_ KeyDB 6.3.2 (00000000/0) 64 bit
__-- / \ --__
(+) _ / \ _ (+) Running in standalone mode
| -- / \ -- | Port: 6379
| /--_ _ _--\ | PID: 24
| / -(+)- \ |
| / | \ | https://docs.keydb.dev
| / | \ |
| / | \ |
(+)_ -- -- -- | -- -- -- _(+)
--_ | _--
--_ | _--
-(+)- KeyDB has now joined Snap! See the announcement at: https://docs.keydb.dev/news
24:24:M 07 Feb 2023 07:48:15.185 # Server initialized
24:24:M 07 Feb 2023 07:48:15.185 * The server is now ready to accept connections at /var/run/redis/redis.sock
24:38:M 07 Feb 2023 07:48:15.185 * Thread 0 alive.
24:38:M 07 Feb 2023 07:53:16.017 * 100 changes in 300 seconds. Saving...
24:38:M 07 Feb 2023 07:53:16.018 * Background saving started
24:72:M 07 Feb 2023 07:53:16.026 * DB saved on disk
24:72:M 07 Feb 2023 07:53:16.030 * RDB: 8 MB of memory used by copy-on-write
24:38:M 07 Feb 2023 07:53:16.118 * Background saving terminated with success
=== KEYDB BUG REPORT START: Cut & paste starting from here ===
24:38:M 07 Feb 2023 07:54:13.281 # === ASSERTION FAILED ===
24:38:M 07 Feb 2023 07:54:13.281 # ==> scripting.cpp:780 '(c->flags & CLIENT_BLOCKED) == 0' is not true
------ STACK TRACE ------
Backtrace:
/usr/bin/redis-server 127.0.0.1:6379(luaRedisGenericCommand(lua_State*, int)+0xe2c) [0x55dbda4d4f6c]
/usr/bin/redis-server 127.0.0.1:6379(+0x296179) [0x55dbda593179]
/usr/bin/redis-server 127.0.0.1:6379(+0x29fb2d) [0x55dbda59cb2d]
/usr/bin/redis-server 127.0.0.1:6379(+0x2966f5) [0x55dbda5936f5]
/usr/bin/redis-server 127.0.0.1:6379(+0x295a5e) [0x55dbda592a5e]
/usr/bin/redis-server 127.0.0.1:6379(+0x29688d) [0x55dbda59388d]
/usr/bin/redis-server 127.0.0.1:6379(lua_pcall+0x58) [0x55dbda590fe8]
/usr/bin/redis-server 127.0.0.1:6379(evalGenericCommand(client*, int)+0x2b8) [0x55dbda4d2ba8]
/usr/bin/redis-server 127.0.0.1:6379(call(client*, int)+0xbd) [0x55dbda5713dd]
/usr/bin/redis-server 127.0.0.1:6379(processCommand(client*, int)+0x724) [0x55dbda5722f4]
/usr/bin/redis-server 127.0.0.1:6379(processCommandAndResetClient(client*, int)+0x6f) [0x55dbda55282f]
/usr/bin/redis-server 127.0.0.1:6379(processInputBuffer(client*, bool, int)+0x184) [0x55dbda553cf4]
/usr/bin/redis-server 127.0.0.1:6379(readQueryFromClient(connection*)+0x5ec) [0x55dbda55456c]
/usr/bin/redis-server 127.0.0.1:6379(connSocketEventHandler(aeEventLoop*, int, void*, int)+0x1d0) [0x55dbda479bd0]
/usr/bin/redis-server 127.0.0.1:6379(ProcessEventCore+0x151) [0x55dbda5808e1]
/usr/bin/redis-server 127.0.0.1:6379(aeProcessEvents+0x245) [0x55dbda581fc5]
/usr/bin/redis-server 127.0.0.1:6379(aeMain+0x3a) [0x55dbda58262a]
/usr/bin/redis-server 127.0.0.1:6379(workerThreadMain(void*)+0x85) [0x55dbda56b815]
/lib/x86_64-linux-gnu/libpthread.so.0(+0x7fa3) [0x7fd95be16fa3]
/lib/x86_64-linux-gnu/libc.so.6(clone+0x3f) [0x7fd95bd4806f]
------ INFO OUTPUT ------
# Server
redis_version:6.3.2
redis_git_sha1:00000000
redis_git_dirty:0
redis_build_id:2c5d5ca8eec50a7d
redis_mode:standalone
os:Linux 4.19.0-12-2-amd64 x86_64
arch_bits:64
multiplexing_api:epoll
atomicvar_api:atomic-builtin
gcc_version:8.3.0
process_id:24
process_supervised:no
run_id:e35e2137d815065ba2f0f988e4153bc869a59899
tcp_port:6379
server_time_usec:1675756453286016
uptime_in_seconds:358
uptime_in_days:0
hz:10
configured_hz:10
lru_clock:14812069
executable:/usr/bin/redis-server
config_file:/etc/redis/redis.conf
# Clients
connected_clients:22
cluster_connections:0
maxclients:10000
client_recent_max_input_buffer:40
client_recent_max_output_buffer:0
blocked_clients:1
tracking_clients:0
clients_in_timeout_table:0
current_client_thread:0
thread_0_clients:22
# Memory
used_memory:2144176
used_memory_human:2.04M
used_memory_rss:22519808
used_memory_rss_human:21.48M
used_memory_peak:2798544
used_memory_peak_human:2.67M
used_memory_peak_perc:76.62%
used_memory_overhead:2000728
used_memory_startup:1555608
used_memory_dataset:143448
used_memory_dataset_perc:24.37%
allocator_allocated:2857784
allocator_active:3702784
allocator_resident:7319552
total_system_memory:8253341696
total_system_memory_human:7.69G
used_memory_lua:47104
used_memory_lua_human:46.00K
used_memory_scripts:744
used_memory_scripts_human:744B
number_of_cached_scripts:1
maxmemory:0
maxmemory_human:0B
maxmemory_policy:noeviction
allocator_frag_ratio:1.30
allocator_frag_bytes:845000
allocator_rss_ratio:1.98
allocator_rss_bytes:3616768
rss_overhead_ratio:3.08
rss_overhead_bytes:15200256
mem_fragmentation_ratio:11.01
mem_fragmentation_bytes:20473808
mem_not_counted_for_evict:1048576
mem_replication_backlog:0
mem_clients_slaves:0
mem_clients_normal:430592
mem_aof_buffer:0
mem_allocator:jemalloc-5.2.1
active_defrag_running:0
lazyfree_pending_objects:0
lazyfreed_objects:0
storage_provider:none
# Persistence
loading:0
current_cow_size:8957952
current_cow_size_age:57
current_fork_perc:0.00
current_save_keys_processed:1
current_save_keys_total:0
rdb_changes_since_last_save:905
rdb_bgsave_in_progress:0
rdb_last_save_time:1675756396
rdb_last_bgsave_status:ok
rdb_last_bgsave_time_sec:0
rdb_current_bgsave_time_sec:-1
rdb_last_cow_size:8978432
aof_enabled:0
aof_rewrite_in_progress:0
aof_rewrite_scheduled:0
aof_last_rewrite_time_sec:-1
aof_current_rewrite_time_sec:-1
aof_last_bgrewrite_status:ok
aof_last_write_status:ok
aof_last_cow_size:0
module_fork_in_progress:0
module_fork_last_cow_size:0
# Stats
total_connections_received:71
total_commands_processed:1595
instantaneous_ops_per_sec:489
total_net_input_bytes:150965
total_net_output_bytes:144808
instantaneous_input_kbps:47.59
instantaneous_output_kbps:59.29
rejected_connections:0
sync_full:0
sync_partial_ok:0
sync_partial_err:0
expired_keys:0
expired_stale_perc:0.00
expired_time_cap_reached_count:0
expire_cycle_cpu_milliseconds:0
evicted_keys:0
keyspace_hits:482
keyspace_misses:8
pubsub_channels:0
pubsub_patterns:9
latest_fork_usec:0
total_forks:0
migrate_cached_sockets:0
slave_expires_tracked_keys:0
active_defrag_hits:0
active_defrag_misses:0
active_defrag_key_hits:0
active_defrag_key_misses:0
tracking_total_keys:0
tracking_total_items:0
tracking_total_prefixes:0
unexpected_error_replies:0
total_error_replies:1
dump_payload_sanitizations:0
total_reads_processed:1645
total_writes_processed:1599
instantaneous_lock_contention:2
avg_lock_contention:0.140625
storage_provider_read_hits:0
storage_provider_read_misses:0
# Replication
role:master
connected_slaves:0
master_failover_state:no-failover
master_replid:a6350c3fdf1d8ae4d32d8a437f702942bf7c4fc7
master_replid2:0000000000000000000000000000000000000000
master_repl_offset:0
second_repl_offset:-1
repl_backlog_active:0
repl_backlog_size:1048576
repl_backlog_first_byte_offset:0
repl_backlog_histlen:0
# CPU
used_cpu_sys:0.419444
used_cpu_user:0.794342
used_cpu_sys_children:0.000000
used_cpu_user_children:0.002721
server_threads:1
long_lock_waits:0
used_cpu_sys_main_thread:0.249750
used_cpu_user_main_thread:0.618235
# Modules
# Commandstats
cmdstat_set:calls=1,usec=33,usec_per_call=33.00,rejected_calls=0,failed_calls=0
cmdstat_info:calls=1,usec=11,usec_per_call=11.00,rejected_calls=0,failed_calls=0
cmdstat_command:calls=2,usec=4445,usec_per_call=2222.50,rejected_calls=0,failed_calls=0
cmdstat_hgetall:calls=468,usec=2618,usec_per_call=5.59,rejected_calls=0,failed_calls=0
cmdstat_config:calls=26,usec=310,usec_per_call=11.92,rejected_calls=0,failed_calls=0
cmdstat_hmset:calls=153,usec=1711,usec_per_call=11.18,rejected_calls=0,failed_calls=0
cmdstat_del:calls=72,usec=1148,usec_per_call=15.94,rejected_calls=0,failed_calls=0
cmdstat_ping:calls=14,usec=56,usec_per_call=4.00,rejected_calls=0,failed_calls=0
cmdstat_keys:calls=32,usec=947,usec_per_call=29.59,rejected_calls=1,failed_calls=0
cmdstat_multi:calls=9,usec=7,usec_per_call=0.78,rejected_calls=0,failed_calls=0
cmdstat_psubscribe:calls=15,usec=79,usec_per_call=5.27,rejected_calls=0,failed_calls=0
cmdstat_hset:calls=690,usec=5908,usec_per_call=8.56,rejected_calls=0,failed_calls=0
cmdstat_hget:calls=9,usec=35,usec_per_call=3.89,rejected_calls=0,failed_calls=0
cmdstat_flushdb:calls=5,usec=257,usec_per_call=51.40,rejected_calls=0,failed_calls=0
cmdstat_get:calls=13,usec=68,usec_per_call=5.23,rejected_calls=0,failed_calls=0
cmdstat_select:calls=66,usec=126,usec_per_call=1.91,rejected_calls=0,failed_calls=0
cmdstat_scan:calls=8,usec=294,usec_per_call=36.75,rejected_calls=0,failed_calls=0
cmdstat_exec:calls=9,usec=2335,usec_per_call=259.44,rejected_calls=0,failed_calls=0
cmdstat_punsubscribe:calls=2,usec=14,usec_per_call=7.00,rejected_calls=0,failed_calls=0
# Errorstats
errorstat_ERR:count=1
# Cluster
cluster_enabled:0
# Keyspace
db3:keys=1,expires=0,avg_ttl=0,cached_keys=1
db4:keys=112,expires=0,avg_ttl=0,cached_keys=112
# KeyDB
mvcc_depth:1
------ CLIENT LIST OUTPUT ------
id=4 addr=/var/run/redis/redis.sock:0 laddr=/var/run/redis/redis.sock:0 fd=13 name= age=358 idle=2 flags=PU db=4 sub=0 psub=1 multi=-1 qbuf=0 qbuf-free=0 argv-mem=0 obl=0 oll=0 omem=0 tot-mem=20496 events=r cmd=ping user=default redir=-1
id=46 addr=127.0.0.1:56622 laddr=127.0.0.1:6379 fd=15 name= age=1 idle=1 flags=N db=4 sub=0 psub=0 multi=-1 qbuf=0 qbuf-free=0 argv-mem=0 obl=0 oll=0 omem=0 tot-mem=20504 events=r cmd=keys user=default redir=-1
id=47 addr=/var/run/redis/redis.sock:0 laddr=/var/run/redis/redis.sock:0 fd=16 name= age=1 idle=1 flags=U db=4 sub=0 psub=0 multi=-1 qbuf=0 qbuf-free=0 argv-mem=0 obl=0 oll=0 omem=0 tot-mem=20504 events=r cmd=select user=default redir=-1
id=48 addr=/var/run/redis/redis.sock:0 laddr=/var/run/redis/redis.sock:0 fd=17 name= age=1 idle=1 flags=U db=4 sub=0 psub=0 multi=-1 qbuf=0 qbuf-free=0 argv-mem=0 obl=0 oll=0 omem=0 tot-mem=20504 events=r cmd=hgetall user=default redir=-1
id=49 addr=/var/run/redis/redis.sock:0 laddr=/var/run/redis/redis.sock:0 fd=18 name= age=1 idle=1 flags=PU db=4 sub=0 psub=1 multi=-1 qbuf=0 qbuf-free=0 argv-mem=0 obl=0 oll=0 omem=0 tot-mem=20504 events=r cmd=psubscribe user=default redir=-1
id=50 addr=/var/run/redis/redis.sock:0 laddr=/var/run/redis/redis.sock:0 fd=21 name= age=1 idle=1 flags=U db=4 sub=0 psub=0 multi=-1 qbuf=0 qbuf-free=0 argv-mem=0 obl=0 oll=0 omem=0 tot-mem=20504 events=r cmd=hgetall user=default redir=-1
id=51 addr=/var/run/redis/redis.sock:0 laddr=/var/run/redis/redis.sock:0 fd=23 name= age=1 idle=1 flags=PU db=4 sub=0 psub=1 multi=-1 qbuf=0 qbuf-free=0 argv-mem=0 obl=0 oll=0 omem=0 tot-mem=20504 events=r cmd=psubscribe user=default redir=-1
id=52 addr=/var/run/redis/redis.sock:0 laddr=/var/run/redis/redis.sock:0 fd=24 name= age=1 idle=1 flags=U db=4 sub=0 psub=0 multi=-1 qbuf=0 qbuf-free=0 argv-mem=0 obl=0 oll=0 omem=0 tot-mem=20504 events=r cmd=keys user=default redir=-1
id=53 addr=/var/run/redis/redis.sock:0 laddr=/var/run/redis/redis.sock:0 fd=25 name= age=1 idle=1 flags=PU db=4 sub=0 psub=1 multi=-1 qbuf=0 qbuf-free=0 argv-mem=0 obl=0 oll=0 omem=0 tot-mem=20504 events=r cmd=psubscribe user=default redir=-1
id=54 addr=/var/run/redis/redis.sock:0 laddr=/var/run/redis/redis.sock:0 fd=26 name= age=1 idle=1 flags=U db=4 sub=0 psub=0 multi=-1 qbuf=0 qbuf-free=0 argv-mem=0 obl=0 oll=0 omem=0 tot-mem=20504 events=r cmd=keys user=default redir=-1
id=55 addr=/var/run/redis/redis.sock:0 laddr=/var/run/redis/redis.sock:0 fd=27 name= age=1 idle=1 flags=PU db=4 sub=0 psub=1 multi=-1 qbuf=0 qbuf-free=0 argv-mem=0 obl=0 oll=0 omem=0 tot-mem=20504 events=r cmd=psubscribe user=default redir=-1
id=56 addr=/var/run/redis/redis.sock:0 laddr=/var/run/redis/redis.sock:0 fd=28 name= age=1 idle=1 flags=U db=4 sub=0 psub=0 multi=-1 qbuf=0 qbuf-free=0 argv-mem=0 obl=0 oll=0 omem=0 tot-mem=20504 events=r cmd=keys user=default redir=-1
id=57 addr=/var/run/redis/redis.sock:0 laddr=/var/run/redis/redis.sock:0 fd=29 name= age=1 idle=1 flags=PU db=4 sub=0 psub=1 multi=-1 qbuf=0 qbuf-free=0 argv-mem=0 obl=0 oll=0 omem=0 tot-mem=20504 events=r cmd=psubscribe user=default redir=-1
id=58 addr=/var/run/redis/redis.sock:0 laddr=/var/run/redis/redis.sock:0 fd=30 name= age=1 idle=1 flags=U db=4 sub=0 psub=0 multi=-1 qbuf=0 qbuf-free=0 argv-mem=0 obl=0 oll=0 omem=0 tot-mem=20504 events=r cmd=keys user=default redir=-1
id=59 addr=/var/run/redis/redis.sock:0 laddr=/var/run/redis/redis.sock:0 fd=31 name= age=1 idle=1 flags=PU db=4 sub=0 psub=1 multi=-1 qbuf=0 qbuf-free=0 argv-mem=0 obl=0 oll=0 omem=0 tot-mem=20504 events=r cmd=psubscribe user=default redir=-1
id=60 addr=/var/run/redis/redis.sock:0 laddr=/var/run/redis/redis.sock:0 fd=32 name= age=1 idle=1 flags=U db=4 sub=0 psub=0 multi=-1 qbuf=0 qbuf-free=0 argv-mem=0 obl=0 oll=0 omem=0 tot-mem=20504 events=r cmd=keys user=default redir=-1
id=61 addr=/var/run/redis/redis.sock:0 laddr=/var/run/redis/redis.sock:0 fd=33 name= age=1 idle=1 flags=PU db=4 sub=0 psub=1 multi=-1 qbuf=0 qbuf-free=0 argv-mem=0 obl=0 oll=0 omem=0 tot-mem=20504 events=r cmd=psubscribe user=default redir=-1
id=62 addr=/var/run/redis/redis.sock:0 laddr=/var/run/redis/redis.sock:0 fd=34 name= age=1 idle=1 flags=U db=4 sub=0 psub=0 multi=-1 qbuf=0 qbuf-free=0 argv-mem=0 obl=0 oll=0 omem=0 tot-mem=20504 events=r cmd=keys user=default redir=-1
id=63 addr=/var/run/redis/redis.sock:0 laddr=/var/run/redis/redis.sock:0 fd=35 name= age=1 idle=1 flags=PU db=4 sub=0 psub=1 multi=-1 qbuf=0 qbuf-free=0 argv-mem=0 obl=0 oll=0 omem=0 tot-mem=20504 events=r cmd=psubscribe user=default redir=-1
id=5 addr=127.0.0.1:56394 laddr=127.0.0.1:6379 fd=14 name= age=355 idle=4 flags=N db=0 sub=0 psub=0 multi=-1 qbuf=0 qbuf-free=0 argv-mem=0 obl=0 oll=0 omem=0 tot-mem=20520 events=r cmd=hset user=default redir=-1
id=19 addr=/var/run/redis/redis.sock:0 laddr=/var/run/redis/redis.sock:0 fd=22 name= age=2 idle=2 flags=U db=4 sub=0 psub=0 multi=-1 qbuf=0 qbuf-free=0 argv-mem=0 obl=0 oll=0 omem=0 tot-mem=20504 events=r cmd=hgetall user=default redir=-1
id=73 addr=127.0.0.1:56642 laddr=127.0.0.1:6379 fd=36 name= age=0 idle=0 flags=N db=6 sub=0 psub=0 multi=-1 qbuf=0 qbuf-free=40954 argv-mem=527 obl=0 oll=0 omem=0 tot-mem=61991 events=r cmd=eval user=default redir=-1
------ CURRENT CLIENT INFO ------
id=73 addr=127.0.0.1:56642 laddr=127.0.0.1:6379 fd=36 name= age=0 idle=0 flags=N db=6 sub=0 psub=0 multi=-1 qbuf=0 qbuf-free=40954 argv-mem=527 obl=0 oll=0 omem=0 tot-mem=61991 events=r cmd=eval user=default redir=-1
argv[0]: 'EVAL'
argv[1]: '
local tables = {xxxxx}
for i = 1, table.getn(tables) do
local matches = redis.call('KEYS', tables[i])
for j,name in ipairs(matches) do
redis.call('DEL', name)
end
end'
argv[2]: '0'
Aditional information
- OS distribution and version
admin@sonic:~$ uname -a
Linux 4.19.0-12-2-amd64 #1 SMP Debian 4.19.152-1 (2020-10-18) x86_64 GNU/Linux
- Steps to reproduce (if any)
start the server and exect lua scripts.
Analysis
After checking the code, when executing keys in script, the script will check the block flag of the client. however, keys command will snapshot the db, and put a async task into the queue. the async task will set the CLIENT_BLOCKED state, this will crash the server.
int luaRedisGenericCommand(lua_State *lua, int raise_error) {
xxxx
call(c,call_flags);
serverAssert((c->flags & CLIENT_BLOCKED) == 0);
xxxx
}
void keysCommand(client *c) {
sds pattern = szFromObj(c->argv[1]);
const redisDbPersistentDataSnapshot *snapshot = nullptr;
if (!(c->flags & (CLIENT_MULTI | CLIENT_BLOCKED)))
snapshot = c->db->createSnapshot(c->mvccCheckpoint, true /* fOptional */);
if (snapshot != nullptr)
{
sds patternCopy = sdsdup(pattern);
aeEventLoop *el = serverTL->el;
blockClient(c, BLOCKED_ASYNC); ====================== BLOCK here
redisDb *db = c->db;
g_pserver->asyncworkqueue->AddWorkFunction([el, c, db, patternCopy, snapshot]{
keysCommandCore(c, snapshot, patternCopy);
sdsfree(patternCopy);
aePostFunction(el, [c, db, snapshot]{
aeReleaseLock(); // we need to lock with coordination of the client
std::unique_lock<decltype(c->lock)> lock(c->lock);
AeLocker locker;
locker.arm(c);
unblockClient(c);
locker.disarm();
lock.unlock();
db->endSnapshotAsync(snapshot);
aeAcquireLock();
});
});
}
else
{
keysCommandCore(c, c->db, pattern);
}
}