Details
Major - P3 Description
Updated description:
To trigger this issue, run any query that involves an indexed query with a timestamp in the predicate. This will generate an index interval with max(timestamp) as the upper bound. Currently, the query framework gets max(timestamp) from BSONObjBuilder::appendMaxForType() which defines max(timestamp) as max(uint32_t) seconds since epoch.
Unfortunately, the shell can only display timestamps up to the year 2039 (slightly less than max(int32_t) and crashes when it tries to convert any timestamp from the server larger than that.
The Fix: updated max(timestamp) in both server and shell to be max(int32_t) seconds.
------
Note that despite the query not returning anything, I have been only been able to reproduce this against the data attached to this ticket. The results from this query + explain will crash the shell on both master (git hash: f65a0b814b8c77e3fbe90bca0c061c9b77f6acdb) and 2.4.9 (using either shell).
> use test
|
switched to db test
|
> db.version()
|
2.5.5-pre-
|
> db.test3.find({_id: {"$type": 17}}).explain()
|
{
|
"cursor" : "BasicCursor",
|
"isMultiKey" : false,
|
"n" : 0,
|
"nscannedObjects" : 0,
|
"nscanned" : 0,
|
"nscannedObjectsAllPlans" : 0,
|
"nscannedAllPlans" : 0,
|
"scanAndOrder" : false,
|
"indexOnly" : false,
|
"nYields" : 0,
|
"nChunkSkips" : 0,
|
"millis" : 0,
|
"server" : "Andrew-Emil-MacBook-Pro.local:27018"
|
}
|
> use qry
|
switched to db qry
|
> db.test3.find({_id: {"$type": 17}})
|
> db.test3.find({_id: {"$type": 17}}).explain()
|
mongo got signal 11 (Segmentation fault: 11), stack trace:
|
0x10013583b 0x1000018e9 0x7fff92ba994a 0x7fff5fbfd428 0x1001d38eb 0x1000b6a20 0x1000b6a12 0x1000b4a35 0x100334b8c 0x1003345f2 0x10037a972 0x1210a9b06362 0x1210a9b1701e
|
0 mongo 0x000000010013583b _ZN5mongo15printStackTraceERSo + 43
|
1 mongo 0x00000001000018e9 _Z12quitAbruptlyi + 217
|
2 libsystem_c.dylib 0x00007fff92ba994a _sigtramp + 26
|
3 ??? 0x00007fff5fbfd428 0x0 + 140734799795240
|
4 mongo 0x00000001001d38eb _ZN2v86Object3SetEjNS_6HandleINS_5ValueEEE + 283
|
5 mongo 0x00000001000b6a20 _ZN5mongo7V8Scope16mongoToV8ElementERKNS_11BSONElementEb + 1048
|
6 mongo 0x00000001000b6a12 _ZN5mongo7V8Scope16mongoToV8ElementERKNS_11BSONElementEb + 1034
|
7 mongo 0x00000001000b4a35 _ZN5mongoL8namedGetEN2v85LocalINS0_6StringEEERKNS0_12AccessorInfoE + 629
|
8 mongo 0x0000000100334b8c _ZN2v88internal8JSObject35GetPropertyAttributeWithInterceptorEPS1_PNS0_6StringEb + 822
|
9 mongo 0x00000001003345f2 _ZN2v88internal10JSReceiver32GetPropertyAttributeWithReceiverEPS1_PNS0_6StringE + 252
|
10 mongo 0x000000010037a972 _ZN2v88internal19Runtime_HasPropertyENS0_9ArgumentsEPNS0_7IsolateE + 114
|
11 ??? 0x00001210a9b06362 0x0 + 19862775685986
|
12 ??? 0x00001210a9b1701e 0x0 + 19862775754782
|