-
Type: Bug
-
Resolution: Done
-
Priority: Major - P3
-
Affects Version/s: 3.2.4
-
Component/s: JavaScript
-
Fully Compatible
-
ALL
-
v3.2
-
Platforms 12 (04/01/16)
-
0
GroupStage::processObject needs to make a copy of obj before passing it down into js, because those objects can be copied into the accumulating object (after which that object won't be readable).
It doesn't appear that this is a crasher (because we use the scope's generation to trap the invalid access), but it does mean that valid operations will fail with uasserts later on.
We should make obj an owned copy and add a test for the functionality
- is duplicated by
-
SERVER-30943 Segmentation fault on attempt to access an invalidated BSON Object in JS scope
- Closed
-
SERVER-23169 group failed : Command failed with error 139: 'Failure to enumerate object'
- Closed