Repository: dragonflydb/dragonfly (2026-06-02T20:01:35Z)

Issue:
sigabrt in cmd_arg_parser.cc:74
[crash-000000.tar.gz](https://github.com/user-attachments/files/28523681/crash-000000.tar.gz)

To reproduce:
  1. Extract the archive:
     `tar xzf crash-000000.tar.gz && cd crash-000000`
  2. Start Dragonfly with the exact flags from the fuzz run (repro.env):
```
     MEM_KB=$(grep '^MEM_LIMIT_KB=' repro.env | cut -d= -f2)
     readarray -t DF_FLAGS < <(grep -v '^#' repro.env | grep -v '^MEM_LIMIT_KB=' | grep -v '^$')
     (ulimit -v "$MEM_KB"; exec <path-to-dragonfly> "${DF_FLAGS[@]}") &
```
  3. Replay:
     `python3 replay_crash.py crashes 000000 127.0.0.1 6379`

Log snippet:
```
F20260602 22:41:10.029265   567 cmd_arg_parser.cc:74] Check failed: !error_ Parsing error occured but not checked
*** Check failure stack trace: ***
    @     0xaaaad0d291d8  google::LogMessage::Fail()
    @     0xaaaad0d290e0  google::LogMessage::SendToLog()
    @     0xaaaad0d288e0  google::LogMessage::Flush()
    @     0xaaaad0d2c5e8  google::LogMessageFatal::~LogMessageFatal()
    @     0xaaaad0a73c58  facade::CmdArgParser::~CmdArgParser()
    @     0xaaaad021d7fc  dfly::(anonymous namespace)::CmdDebug()
    @     0xaaaacfeb69e8  _ZN3fu27abi_4006detail10invocation6invokeIRKPFvN4absl12lts_202505124SpanIKSt17basic_string_viewIcSt11char_traitsIcEEEEPN4dfly14CommandContextEEJSC_SF_EEEDTclcl7forwardIT_Efp_Espcl7forwardIT0_Efp0_EEEOSK_DpOSL_
    @     0xaaaacfeaa030  fu2::abi_400::detail::type_erasure::invocation_table::function_trait<>::internal_invoker<>::invoke()
    @     0xaaaad02e7928  _ZNK3fu27abi_4006detail12type_erasure6tables6vtableINS1_8propertyILb0ELb0EJKFvN4absl12lts_202505124SpanIKSt17basic_string_viewIcSt11char_traitsIcEEEEPN4dfly14CommandContextEEEEEE6invokeILm0EJPKNS2_13data_accessorERKmSE_SH_EEEDcDpOT0_
    @     0xaaaad02e79c4  _ZN3fu27abi_4006detail12type_erasure7erasureILb1ENS1_6configILb1ELb1ENS_16capacity_defaultEEENS1_8propertyILb0ELb0EJKFvN4absl12lts_202505124SpanIKSt17basic_string_viewIcSt11char_traitsIcEEEEPN4dfly14CommandContextEEEEEE6invokeILm0ERKSM_JSG_SJ_EEEDcOT0_DpOT1_
    @     0xaaaad02e7a40  fu2::abi_400::detail::type_erasure::invocation_table::operator_impl<>::operator()()
    @     0xaaaad02e4da4  dfly::CommandId::Invoke()
    @     0xaaaad0294cd0  dfly::Service::InvokeCmd()
    @     0xaaaad04c219c  dfly::MultiCommandSquasher::ExecuteStandalone()
    @     0xaaaad04c400c  dfly::MultiCommandSquasher::Run()
    @     0xaaaad02e5c30  dfly::MultiCommandSquasher::Execute()
    @     0xaaaad0295750  _ZZN4dfly7Service20DispatchManyCommandsESt8functionIFN6facade10ParsedArgsEvEEjPNS2_16SinkReplyBuilderEPNS2_17ConnectionContextEENKUlvE_clEv
    @     0xaaaad0295d74  dfly::Service::DispatchManyCommands()
    @     0xaaaad0a26ab8  facade::Connection::SquashPipeline()
    @     0xaaaad0a283c4  facade::Connection::AsyncFiber()
    @     0xaaaad0a29ac4  _ZZN6facade10Connection24LaunchAsyncFiberIfNeededEvENKUlvE_clEv
    @     0xaaaad0a3614c  _ZSt13__invoke_implIvZN6facade10Connection24LaunchAsyncFiberIfNeededEvEUlvE_JEET_St14__invoke_otherOT0_DpOT1_
    @     0xaaaad0a35e44  _ZSt8__invokeIZN6facade10Connection24LaunchAsyncFiberIfNeededEvEUlvE_JEENSt15__invoke_resultIT_JDpT0_EE4typeEOS4_DpOS5_
    @     0xaaaad0a35a78  _ZSt12__apply_implIZN6facade10Connection24LaunchAsyncFiberIfNeededEvEUlvE_St5tupleIJEEJEEDcOT_OT0_St16integer_sequenceImJXspT1_EEE
    @     0xaaaad0a35abc  _ZSt5applyIZN6facade10Connection24LaunchAsyncFiberIfNeededEvEUlvE_St5tupleIJEEEDcOT_OT0_
    @     0xaaaad0a35b3c  _ZN4util3fb26detail15WorkerFiberImplIZN6facade10Connection24LaunchAsyncFiberIfNeededEvEUlvE_JEE4run_EON5boost7context5fiberE
    @     0xaaaad0a34ed0  _ZZN4util3fb26detail15WorkerFiberImplIZN6facade10Connection24LaunchAsyncFiberIfNeededEvEUlvE_JEEC4INS0_19FixedStackAllocatorEEESt17basic_string_viewIcSt11char_traitsIcEENS0_13FiberPriorityERKN5boost7context12preallocatedEOT_OS5_ENKUlONSF_5fiberEE_clESN_
    @     0xaaaad0a36b3c  _ZSt13__invoke_implIN5boost7context5fiberERZN4util3fb26detail15WorkerFiberImplIZN6facade10Connection24LaunchAsyncFiberIfNeededEvEUlvE_JEEC4INS4_19FixedStackAllocatorEEESt17basic_string_viewIcSt11char_traitsIcEENS4_13FiberPriorityERKNS1_12preallocatedEOT_OS9_EUlOS2_E_JS2_EESL_St14__invoke_otherOT0_DpOT1_
    @     0xaaaad0a36904  _ZSt8__invokeIRZN4util3fb26detail15WorkerFiberImplIZN6facade10Connection24LaunchAsyncFiberIfNeededEvEUlvE_JEEC4INS1_19FixedStackAllocatorEEESt17basic_string_viewIcSt11char_traitsIcEENS1_13FiberPriorityERKN5boost7context12preallocatedEOT_OS6_EUlONSG_5fiberEE_JSN_EENSt15__invoke_resultISK_JDpT0_EE4typeESL_DpOSS_
    @     0xaaaad0a36798  _ZSt6invokeIRZN4util3fb26detail15WorkerFiberImplIZN6facade10Connection24LaunchAsyncFiberIfNeededEvEUlvE_JEEC4INS1_19FixedStackAllocatorEEESt17basic_string_viewIcSt11char_traitsIcEENS1_13FiberPriorityERKN5boost7context12preallocatedEOT_OS6_EUlONSG_5fiberEE_JSN_EENSt13invoke_resultISK_JDpT0_EE4typeESL_DpOSS_
    @     0xaaaad0a36514  _ZN5boost7context6detail12fiber_recordINS0_5fiberEN4util3fb219FixedStackAllocatorEZNS5_6detail15WorkerFiberImplIZN6facade10Connection24LaunchAsyncFiberIfNeededEvEUlvE_JEEC4IS6_EESt17basic_string_viewIcSt11char_traitsIcEENS5_13FiberPriorityERKNS0_12preallocatedEOT_OSB_EUlOS3_E_E3runEPv
    @     0xaaaad0a36240  _ZN5boost7context6detail11fiber_entryINS1_12fiber_recordINS0_5fiberEN4util3fb219FixedStackAllocatorEZNS6_6detail15WorkerFiberImplIZN6facade10Connection24LaunchAsyncFiberIfNeededEvEUlvE_JEEC4IS7_EESt17basic_string_viewIcSt11char_traitsIcEENS6_13FiberPriorityERKNS0_12preallocatedEOT_OSC_EUlOS4_E_EEEEvNS1_10transfer_tE
*** SIGABRT received at time=1780429270 on cpu 0 ***
PC: @     0xffffbead7608  (unknown)  (unknown)
    @     0xaaaad0d8bda0         64  absl::lts_20250512::WriteFailureInfo()
    @     0xaaaad0d8c0b8         96  absl::lts_20250512::AbslFailureSignalHandler()
    @     0xffffbf5917d0       4752  (unknown)
    @     0xffffbea8cb3c         64  raise
    @     0xffffbea77e00        192  abort
    @     0xaaaad0d346f0        208  google::DumpStackTraceAndExit()
    @     0xaaaad0d291d8         16  google::LogMessage::Fail()
    @     0xaaaad0d290e0        144  google::LogMessage::SendToLog()
    @     0xaaaad0d288e0         80  google::LogMessage::Flush()
    @     0xaaaad0d2c5e8         32  google::LogMessageFatal::~LogMessageFatal()
    @     0xaaaad0a73c58        160  facade::CmdArgParser::~CmdArgParser()
    @     0xaaaad021d7fc        544  dfly::(anonymous namespace)::CmdDebug()
    @     0xaaaacfeb69e8         48  fu2::abi_400::detail::invocation::invoke<>()
    @     0xaaaacfeaa030         64  fu2::abi_400::detail::type_erasure::invocation_table::function_trait<>::internal_invoker<>::invoke()
    @     0xaaaad02e7928         96  fu2::abi_400::detail::type_erasure::tables::vtable<>::invoke<>()
    @     0xaaaad02e79c4        176  fu2::abi_400::detail::type_erasure::erasure<>::invoke<>()
    @     0xaaaad02e7a40         32  fu2::abi_400::detail::type_erasure::invocation_table::operator_impl<>::operator()()
    @     0xaaaad02e4da4         80  dfly::CommandId::Invoke()
    @     0xaaaad0294cd0        512  dfly::Service::InvokeCmd()
    @     0xaaaad04c219c        576  dfly::MultiCommandSquasher::ExecuteStandalone()
    @     0xaaaad04c400c        256  dfly::MultiCommandSquasher::Run()
    @     0xaaaad02e5c30        288  dfly::MultiCommandSquasher::Execute()
    @     0xaaaad0295750         96  dfly::Service::DispatchManyCommands()::{lambda()#1}::operator()()
    @     0xaaaad0295d74        720  dfly::Service::DispatchManyCommands()
    @     0xaaaad0a26ab8        272  facade::Connection::SquashPipeline()
    @     0xaaaad0a283c4        336  facade::Connection::AsyncFiber()
    @     0xaaaad0a29ac4         32  facade::Connection::LaunchAsyncFiberIfNeeded()::{lambda()#1}::operator()()
    @     0xaaaad0a3614c         32  std::__invoke_impl<>()
    @     0xaaaad0a35e44         32  std::__invoke<>()
    @     0xaaaad0a35a78         48  std::__apply_impl<>()
    @     0xaaaad0a35abc         48  std::apply<>()
    @     0xaaaad0a35b3c         96  util::fb2::detail::WorkerFiberImpl<>::run_()
    @ ... and at least 6 more frames
Aborted
```


Discussion:

Patch:
diff --git a/src/server/json_family.cc b/src/server/json_family.cc
index a19e88eb16ed..91828434716b 100644
--- a/src/server/json_family.cc
+++ b/src/server/json_family.cc
@@ -1825,6 +1825,9 @@ void CmdDebug(CmdArgList args, CommandContext* cmd_cntx) {
     string_view key = parser.Next();
     string_view path = parser.NextOrDefault();
 
+    if (auto err = parser.TakeError(); err)
+      return builder->SendError(err.MakeReply());
+
     WrappedJsonPath json_path = GET_OR_SEND_UNEXPECTED(ParseJsonPath(path));
 
     ShardId sid = Shard(key, shard_set->size());
@@ -1846,6 +1849,9 @@ void CmdDebug(CmdArgList args, CommandContext* cmd_cntx) {
     string_view key = parser.Next();
     string_view path = parser.NextOrDefault();
 
+    if (auto err = parser.TakeError(); err)
+      return builder->SendError(err.MakeReply());
+
     WrappedJsonPath json_path = GET_OR_SEND_UNEXPECTED(ParseJsonPath(path));
 
     ShardId sid = Shard(key, shard_set->size());


Test patch:
diff --git a/src/server/json_family_test.cc b/src/server/json_family_test.cc
index a0dfe9d0656b..939ed82c6d17 100644
--- a/src/server/json_family_test.cc
+++ b/src/server/json_family_test.cc
@@ -2656,6 +2656,16 @@ TEST_F(JsonFamilyTest, DebugHelp) {
   EXPECT_THAT(resp.GetVec()[2].GetString(), HasSubstr("HELP"));
 }
 
+TEST_F(JsonFamilyTest, DebugMissingKey) {
+  // Missing key: the default root path parses fine, so the unchecked parser error must
+  // still be surfaced rather than left to abort the parser destructor.
+  auto resp = Run({"JSON.DEBUG", "FIELDS"});
+  EXPECT_THAT(resp, ErrArg("syntax error"));
+
+  resp = Run({"JSON.DEBUG", "MEMORY"});
+  EXPECT_THAT(resp, ErrArg("syntax error"));
+}
+
 TEST_F(JsonFamilyTest, DebugFields) {
   string json = R"(
     [1, 2.3, "foo", true, null, {}, [], {"a":1, "b":2}, [1,2,3]]