Uploaded image for project: 'Core Server'
  1. Core Server
  2. SERVER-27201

$graphLookup triggers null pointer dereference

    Details

    • Type: Bug
    • Status: Resolved
    • Priority: Major - P3
    • Resolution: Fixed
    • Affects Version/s: 3.4.0-rc3
    • Fix Version/s: 3.4.1, 3.5.1
    • Component/s: Aggregation Framework
    • Labels:
      None
    • Backwards Compatibility:
      Fully Compatible
    • Operating System:
      ALL
    • Backport Completed:
    • Steps To Reproduce:
      Hide

      Run the above query and mondb crashes with:

      2016-11-29T14:18:21.251+0000 E QUERY    [main] Error: error doing query: failed: network error while attempting to run command 'aggregate' on host '127.0.0.1:27017'  :
      DB.prototype.runCommand@src/mongo/shell/db.js:132:1
      DB.prototype.runReadCommand@src/mongo/shell/db.js:109:16
      DBCollection.prototype._dbReadCommand@src/mongo/shell/collection.js:183:12
      DBCollection.prototype.aggregate/doAgg<@src/mongo/shell/collection.js:1298:30
      DBCollection.prototype.aggregate@src/mongo/shell/collection.js:1301:15
      @(shell):1:1
      

      The log file from "var/log/mongodb/mongod.log" contains:

      2016-11-29T14:17:08.274+0000 I NETWORK  [thread1] connection accepted from 127.0.0.1:56861 #18 (16 connections now open)
      2016-11-29T14:17:08.275+0000 I NETWORK  [conn18] received client metadata from 127.0.0.1:56861 conn18: { application: { name: "MongoDB Shell" }, driver: { name: "MongoDB Internal Client", version: "3.4.0-rc3-21-gdfe9b68" }, os: { type: "Linux", name: "Ubuntu", architecture: "x86_64", version: "14.04" } }
      2016-11-29T14:17:44.279+0000 I -        [conn18] end connection 127.0.0.1:56861 (16 connections now open)
      2016-11-29T14:18:15.786+0000 I NETWORK  [thread1] connection accepted from 127.0.0.1:56862 #19 (16 connections now open)
      2016-11-29T14:18:15.787+0000 I NETWORK  [conn19] received client metadata from 127.0.0.1:56862 conn19: { application: { name: "MongoDB Shell" }, driver: { name: "MongoDB Internal Client", version: "3.4.0-rc3-21-gdfe9b68" }, os: { type: "Linux", name: "Ubuntu", architecture: "x86_64", version: "14.04" } }
      2016-11-29T14:18:21.117+0000 F -        [conn19] Invalid access at address: 0xa8
      2016-11-29T14:18:21.134+0000 F -        [conn19] Got signal: 11 (Segmentation fault).
       
       0x7f0314e774d1 0x7f0314e765c9 0x7f0314e76c36 0x7f0312564330 0x7f03146cc811 0x7f03146cf8b9 0x7f0314664ad5 0x7f031466506f 0x7f0314713292 0x7f03144a7045 0x7f03144a723c 0x7f03144a7833 0x7f03147aaf9a 0x7f03147ab8bb 0x7f03143effbb 0x7f03143f14e9 0x7f031436930b 0x7f031436a550 0x7f0314981c7d 0x7f0314589b4d 0x7f031417a9dd 0x7f031417b31d 0x7f0314ddd242 0x7f031255c184 0x7f031228937d
      ----- BEGIN BACKTRACE -----
      {"backtrace":[{"b":"7F03138FA000","o":"157D4D1","s":"_ZN5mongo15printStackTraceERSo"},{"b":"7F03138FA000","o":"157C5C9"},{"b":"7F03138FA000","o":"157CC36"},{"b":"7F0312554000","o":"10330"},{"b":"7F03138FA000","o":"DD2811","s":"_ZNK5mongo17ExpressionCompare16evaluateInternalEPNS_9VariablesE"},{"b":"7F03138FA000","o":"DD58B9","s":"_ZNK5mongo16ExpressionObject16evaluateInternalEPNS_9VariablesE"},{"b":"7F03138FA000","o":"D6AAD5","s":"_ZN5mongo25DocumentSourceGraphLookUp13performSearchEv"},{"b":"7F03138FA000","o":"D6B06F","s":"_ZN5mongo25DocumentSourceGraphLookUp7getNextEv"},{"b":"7F03138FA000","o":"E19292","s":"_ZN5mongo8Pipeline7getNextEv"},{"b":"7F03138FA000","o":"BAD045","s":"_ZN5mongo18PipelineProxyStage11getNextBsonEv"},{"b":"7F03138FA000","o":"BAD23C","s":"_ZN5mongo18PipelineProxyStage6doWorkEPm"},{"b":"7F03138FA000","o":"BAD833","s":"_ZN5mongo9PlanStage4workEPm"},{"b":"7F03138FA000","o":"EB0F9A","s":"_ZN5mongo12PlanExecutor11getNextImplEPNS_11SnapshottedINS_7BSONObjEEEPNS_8RecordIdE"},{"b":"7F03138FA000","o":"EB18BB","s":"_ZN5mongo12PlanExecutor7getNextEPNS_7BSONObjEPNS_8RecordIdE"},{"b":"7F03138FA000","o":"AF5FBB"},{"b":"7F03138FA000","o":"AF74E9"},{"b":"7F03138FA000","o":"A6F30B","s":"_ZN5mongo7Command3runEPNS_16OperationContextERKNS_3rpc16RequestInterfaceEPNS3_21ReplyBuilderInterfaceE"},{"b":"7F03138FA000","o":"A70550","s":"_ZN5mongo7Command11execCommandEPNS_16OperationContextEPS0_RKNS_3rpc16RequestInterfaceEPNS4_21ReplyBuilderInterfaceE"},{"b":"7F03138FA000","o":"1087C7D","s":"_ZN5mongo11runCommandsEPNS_16OperationContextERKNS_3rpc16RequestInterfaceEPNS2_21ReplyBuilderInterfaceE"},{"b":"7F03138FA000","o":"C8FB4D","s":"_ZN5mongo16assembleResponseEPNS_16OperationContextERNS_7MessageERNS_10DbResponseERKNS_11HostAndPortE"},{"b":"7F03138FA000","o":"8809DD","s":"_ZN5mongo23ServiceEntryPointMongod12_sessionLoopERKSt10shared_ptrINS_9transport7SessionEE"},{"b":"7F03138FA000","o":"88131D"},{"b":"7F03138FA000","o":"14E3242"},{"b":"7F0312554000","o":"8184"},{"b":"7F031218F000","o":"FA37D","s":"clone"}],"processInfo":{ "mongodbVersion" : "3.4.0-rc3-21-gdfe9b68", "gitVersion" : "dfe9b688956e19095e2d37e21bb40c7b7ad17900", "compiledModules" : [], "uname" : { "sysname" : "Linux", "release" : "3.13.0-92-generic", "version" : "#139-Ubuntu SMP Tue Jun 28 20:42:26 UTC 2016", "machine" : "x86_64" }, "somap" : [ { "b" : "7F03138FA000", "elfType" : 3, "buildId" : "EFB15FEA59BDDC105B35964BBC570A9D8804C7CB" }, { "b" : "7FFFAA0A9000", "elfType" : 3, "buildId" : "7F14688F101A2ACE5CAD23DFBFBC918616651576" }, { "b" : "7F0313476000", "path" : "/lib/x86_64-linux-gnu/libssl.so.1.0.0", "elfType" : 3, "buildId" : "74864DB9D5F69D39A67E4755012FB6573C469B3D" }, { "b" : "7F031309A000", "path" : "/lib/x86_64-linux-gnu/libcrypto.so.1.0.0", "elfType" : 3, "buildId" : "AAE7CFF8351B730830BDBCE0DCABBE06574B7144" }, { "b" : "7F0312E92000", "path" : "/lib/x86_64-linux-gnu/librt.so.1", "elfType" : 3, "buildId" : "E2A6DD5048A0A051FD61043BDB69D8CC68192AB7" }, { "b" : "7F0312C8E000", "path" : "/lib/x86_64-linux-gnu/libdl.so.2", "elfType" : 3, "buildId" : "DA9B8C234D0FE9FD8CAAC8970A7EC1B6C8F6623F" }, { "b" : "7F0312988000", "path" : "/lib/x86_64-linux-gnu/libm.so.6", "elfType" : 3, "buildId" : "D144258E614900B255A31F3FD2283A878670D5BC" }, { "b" : "7F0312772000", "path" : "/lib/x86_64-linux-gnu/libgcc_s.so.1", "elfType" : 3, "buildId" : "36311B4457710AE5578C4BF00791DED7359DBB92" }, { "b" : "7F0312554000", "path" : "/lib/x86_64-linux-gnu/libpthread.so.0", "elfType" : 3, "buildId" : "31E9F21AE8C10396171F1E13DA15780986FA696C" }, { "b" : "7F031218F000", "path" : "/lib/x86_64-linux-gnu/libc.so.6", "elfType" : 3, "buildId" : "CF699A15CAAE64F50311FC4655B86DC39A479789" }, { "b" : "7F03136D5000", "path" : "/lib64/ld-linux-x86-64.so.2", "elfType" : 3, "buildId" : "D0F537904076D73F29E4A37341F8A449E2EF6CD0" } ] }}
       mongod(_ZN5mongo15printStackTraceERSo+0x41) [0x7f0314e774d1]
       mongod(+0x157C5C9) [0x7f0314e765c9]
       mongod(+0x157CC36) [0x7f0314e76c36]
       libpthread.so.0(+0x10330) [0x7f0312564330]
       mongod(_ZNK5mongo17ExpressionCompare16evaluateInternalEPNS_9VariablesE+0x61) [0x7f03146cc811]
       mongod(_ZNK5mongo16ExpressionObject16evaluateInternalEPNS_9VariablesE+0x99) [0x7f03146cf8b9]
       mongod(_ZN5mongo25DocumentSourceGraphLookUp13performSearchEv+0x75) [0x7f0314664ad5]
       mongod(_ZN5mongo25DocumentSourceGraphLookUp7getNextEv+0x9F) [0x7f031466506f]
       mongod(_ZN5mongo8Pipeline7getNextEv+0x42) [0x7f0314713292]
       mongod(_ZN5mongo18PipelineProxyStage11getNextBsonEv+0x35) [0x7f03144a7045]
       mongod(_ZN5mongo18PipelineProxyStage6doWorkEPm+0x11C) [0x7f03144a723c]
       mongod(_ZN5mongo9PlanStage4workEPm+0x63) [0x7f03144a7833]
       mongod(_ZN5mongo12PlanExecutor11getNextImplEPNS_11SnapshottedINS_7BSONObjEEEPNS_8RecordIdE+0x19A) [0x7f03147aaf9a]
       mongod(_ZN5mongo12PlanExecutor7getNextEPNS_7BSONObjEPNS_8RecordIdE+0x4B) [0x7f03147ab8bb]
       mongod(+0xAF5FBB) [0x7f03143effbb]
       mongod(+0xAF74E9) [0x7f03143f14e9]
       mongod(_ZN5mongo7Command3runEPNS_16OperationContextERKNS_3rpc16RequestInterfaceEPNS3_21ReplyBuilderInterfaceE+0x5FB) [0x7f031436930b]
       mongod(_ZN5mongo7Command11execCommandEPNS_16OperationContextEPS0_RKNS_3rpc16RequestInterfaceEPNS4_21ReplyBuilderInterfaceE+0x9E0) [0x7f031436a550]
       mongod(_ZN5mongo11runCommandsEPNS_16OperationContextERKNS_3rpc16RequestInterfaceEPNS2_21ReplyBuilderInterfaceE+0x26D) [0x7f0314981c7d]
       mongod(_ZN5mongo16assembleResponseEPNS_16OperationContextERNS_7MessageERNS_10DbResponseERKNS_11HostAndPortE+0xCBD) [0x7f0314589b4d]
       mongod(_ZN5mongo23ServiceEntryPointMongod12_sessionLoopERKSt10shared_ptrINS_9transport7SessionEE+0x1ED) [0x7f031417a9dd]
       mongod(+0x88131D) [0x7f031417b31d]
       mongod(+0x14E3242) [0x7f0314ddd242]
       libpthread.so.0(+0x8184) [0x7f031255c184]
       libc.so.6(clone+0x6D) [0x7f031228937d]
      -----  END BACKTRACE  -----
      2016-11-29T14:18:21.252+0000 I NETWORK  [main] trying reconnect to 127.0.0.1:27017 (127.0.0.1) failed
      2016-11-29T14:18:21.256+0000 I NETWORK  [main] Socket recv() Connection reset by peer 127.0.0.1:27017
      2016-11-29T14:18:21.256+0000 I NETWORK  [main] SocketException: remote: (NONE):0 error: 9001 socket exception [RECV_ERROR] server [127.0.0.1:27017]
      2016-11-29T14:18:21.256+0000 I NETWORK  [main] reconnect 127.0.0.1:27017 (127.0.0.1) failed failed
      

      Show
      Run the above query and mondb crashes with: 2016-11-29T14:18:21.251+0000 E QUERY [main] Error: error doing query: failed: network error while attempting to run command 'aggregate' on host '127.0.0.1:27017' : DB.prototype.runCommand@src/mongo/shell/db.js:132:1 DB.prototype.runReadCommand@src/mongo/shell/db.js:109:16 DBCollection.prototype._dbReadCommand@src/mongo/shell/collection.js:183:12 DBCollection.prototype.aggregate/doAgg<@src/mongo/shell/collection.js:1298:30 DBCollection.prototype.aggregate@src/mongo/shell/collection.js:1301:15 @(shell):1:1 The log file from "var/log/mongodb/mongod.log" contains: 2016-11-29T14:17:08.274+0000 I NETWORK [thread1] connection accepted from 127.0.0.1:56861 #18 (16 connections now open) 2016-11-29T14:17:08.275+0000 I NETWORK [conn18] received client metadata from 127.0.0.1:56861 conn18: { application: { name: "MongoDB Shell" }, driver: { name: "MongoDB Internal Client", version: "3.4.0-rc3-21-gdfe9b68" }, os: { type: "Linux", name: "Ubuntu", architecture: "x86_64", version: "14.04" } } 2016-11-29T14:17:44.279+0000 I - [conn18] end connection 127.0.0.1:56861 (16 connections now open) 2016-11-29T14:18:15.786+0000 I NETWORK [thread1] connection accepted from 127.0.0.1:56862 #19 (16 connections now open) 2016-11-29T14:18:15.787+0000 I NETWORK [conn19] received client metadata from 127.0.0.1:56862 conn19: { application: { name: "MongoDB Shell" }, driver: { name: "MongoDB Internal Client", version: "3.4.0-rc3-21-gdfe9b68" }, os: { type: "Linux", name: "Ubuntu", architecture: "x86_64", version: "14.04" } } 2016-11-29T14:18:21.117+0000 F - [conn19] Invalid access at address: 0xa8 2016-11-29T14:18:21.134+0000 F - [conn19] Got signal: 11 (Segmentation fault).   0x7f0314e774d1 0x7f0314e765c9 0x7f0314e76c36 0x7f0312564330 0x7f03146cc811 0x7f03146cf8b9 0x7f0314664ad5 0x7f031466506f 0x7f0314713292 0x7f03144a7045 0x7f03144a723c 0x7f03144a7833 0x7f03147aaf9a 0x7f03147ab8bb 0x7f03143effbb 0x7f03143f14e9 0x7f031436930b 0x7f031436a550 0x7f0314981c7d 0x7f0314589b4d 0x7f031417a9dd 0x7f031417b31d 0x7f0314ddd242 0x7f031255c184 0x7f031228937d ----- BEGIN BACKTRACE ----- {"backtrace":[{"b":"7F03138FA000","o":"157D4D1","s":"_ZN5mongo15printStackTraceERSo"},{"b":"7F03138FA000","o":"157C5C9"},{"b":"7F03138FA000","o":"157CC36"},{"b":"7F0312554000","o":"10330"},{"b":"7F03138FA000","o":"DD2811","s":"_ZNK5mongo17ExpressionCompare16evaluateInternalEPNS_9VariablesE"},{"b":"7F03138FA000","o":"DD58B9","s":"_ZNK5mongo16ExpressionObject16evaluateInternalEPNS_9VariablesE"},{"b":"7F03138FA000","o":"D6AAD5","s":"_ZN5mongo25DocumentSourceGraphLookUp13performSearchEv"},{"b":"7F03138FA000","o":"D6B06F","s":"_ZN5mongo25DocumentSourceGraphLookUp7getNextEv"},{"b":"7F03138FA000","o":"E19292","s":"_ZN5mongo8Pipeline7getNextEv"},{"b":"7F03138FA000","o":"BAD045","s":"_ZN5mongo18PipelineProxyStage11getNextBsonEv"},{"b":"7F03138FA000","o":"BAD23C","s":"_ZN5mongo18PipelineProxyStage6doWorkEPm"},{"b":"7F03138FA000","o":"BAD833","s":"_ZN5mongo9PlanStage4workEPm"},{"b":"7F03138FA000","o":"EB0F9A","s":"_ZN5mongo12PlanExecutor11getNextImplEPNS_11SnapshottedINS_7BSONObjEEEPNS_8RecordIdE"},{"b":"7F03138FA000","o":"EB18BB","s":"_ZN5mongo12PlanExecutor7getNextEPNS_7BSONObjEPNS_8RecordIdE"},{"b":"7F03138FA000","o":"AF5FBB"},{"b":"7F03138FA000","o":"AF74E9"},{"b":"7F03138FA000","o":"A6F30B","s":"_ZN5mongo7Command3runEPNS_16OperationContextERKNS_3rpc16RequestInterfaceEPNS3_21ReplyBuilderInterfaceE"},{"b":"7F03138FA000","o":"A70550","s":"_ZN5mongo7Command11execCommandEPNS_16OperationContextEPS0_RKNS_3rpc16RequestInterfaceEPNS4_21ReplyBuilderInterfaceE"},{"b":"7F03138FA000","o":"1087C7D","s":"_ZN5mongo11runCommandsEPNS_16OperationContextERKNS_3rpc16RequestInterfaceEPNS2_21ReplyBuilderInterfaceE"},{"b":"7F03138FA000","o":"C8FB4D","s":"_ZN5mongo16assembleResponseEPNS_16OperationContextERNS_7MessageERNS_10DbResponseERKNS_11HostAndPortE"},{"b":"7F03138FA000","o":"8809DD","s":"_ZN5mongo23ServiceEntryPointMongod12_sessionLoopERKSt10shared_ptrINS_9transport7SessionEE"},{"b":"7F03138FA000","o":"88131D"},{"b":"7F03138FA000","o":"14E3242"},{"b":"7F0312554000","o":"8184"},{"b":"7F031218F000","o":"FA37D","s":"clone"}],"processInfo":{ "mongodbVersion" : "3.4.0-rc3-21-gdfe9b68", "gitVersion" : "dfe9b688956e19095e2d37e21bb40c7b7ad17900", "compiledModules" : [], "uname" : { "sysname" : "Linux", "release" : "3.13.0-92-generic", "version" : "#139-Ubuntu SMP Tue Jun 28 20:42:26 UTC 2016", "machine" : "x86_64" }, "somap" : [ { "b" : "7F03138FA000", "elfType" : 3, "buildId" : "EFB15FEA59BDDC105B35964BBC570A9D8804C7CB" }, { "b" : "7FFFAA0A9000", "elfType" : 3, "buildId" : "7F14688F101A2ACE5CAD23DFBFBC918616651576" }, { "b" : "7F0313476000", "path" : "/lib/x86_64-linux-gnu/libssl.so.1.0.0", "elfType" : 3, "buildId" : "74864DB9D5F69D39A67E4755012FB6573C469B3D" }, { "b" : "7F031309A000", "path" : "/lib/x86_64-linux-gnu/libcrypto.so.1.0.0", "elfType" : 3, "buildId" : "AAE7CFF8351B730830BDBCE0DCABBE06574B7144" }, { "b" : "7F0312E92000", "path" : "/lib/x86_64-linux-gnu/librt.so.1", "elfType" : 3, "buildId" : "E2A6DD5048A0A051FD61043BDB69D8CC68192AB7" }, { "b" : "7F0312C8E000", "path" : "/lib/x86_64-linux-gnu/libdl.so.2", "elfType" : 3, "buildId" : "DA9B8C234D0FE9FD8CAAC8970A7EC1B6C8F6623F" }, { "b" : "7F0312988000", "path" : "/lib/x86_64-linux-gnu/libm.so.6", "elfType" : 3, "buildId" : "D144258E614900B255A31F3FD2283A878670D5BC" }, { "b" : "7F0312772000", "path" : "/lib/x86_64-linux-gnu/libgcc_s.so.1", "elfType" : 3, "buildId" : "36311B4457710AE5578C4BF00791DED7359DBB92" }, { "b" : "7F0312554000", "path" : "/lib/x86_64-linux-gnu/libpthread.so.0", "elfType" : 3, "buildId" : "31E9F21AE8C10396171F1E13DA15780986FA696C" }, { "b" : "7F031218F000", "path" : "/lib/x86_64-linux-gnu/libc.so.6", "elfType" : 3, "buildId" : "CF699A15CAAE64F50311FC4655B86DC39A479789" }, { "b" : "7F03136D5000", "path" : "/lib64/ld-linux-x86-64.so.2", "elfType" : 3, "buildId" : "D0F537904076D73F29E4A37341F8A449E2EF6CD0" } ] }} mongod(_ZN5mongo15printStackTraceERSo+0x41) [0x7f0314e774d1] mongod(+0x157C5C9) [0x7f0314e765c9] mongod(+0x157CC36) [0x7f0314e76c36] libpthread.so.0(+0x10330) [0x7f0312564330] mongod(_ZNK5mongo17ExpressionCompare16evaluateInternalEPNS_9VariablesE+0x61) [0x7f03146cc811] mongod(_ZNK5mongo16ExpressionObject16evaluateInternalEPNS_9VariablesE+0x99) [0x7f03146cf8b9] mongod(_ZN5mongo25DocumentSourceGraphLookUp13performSearchEv+0x75) [0x7f0314664ad5] mongod(_ZN5mongo25DocumentSourceGraphLookUp7getNextEv+0x9F) [0x7f031466506f] mongod(_ZN5mongo8Pipeline7getNextEv+0x42) [0x7f0314713292] mongod(_ZN5mongo18PipelineProxyStage11getNextBsonEv+0x35) [0x7f03144a7045] mongod(_ZN5mongo18PipelineProxyStage6doWorkEPm+0x11C) [0x7f03144a723c] mongod(_ZN5mongo9PlanStage4workEPm+0x63) [0x7f03144a7833] mongod(_ZN5mongo12PlanExecutor11getNextImplEPNS_11SnapshottedINS_7BSONObjEEEPNS_8RecordIdE+0x19A) [0x7f03147aaf9a] mongod(_ZN5mongo12PlanExecutor7getNextEPNS_7BSONObjEPNS_8RecordIdE+0x4B) [0x7f03147ab8bb] mongod(+0xAF5FBB) [0x7f03143effbb] mongod(+0xAF74E9) [0x7f03143f14e9] mongod(_ZN5mongo7Command3runEPNS_16OperationContextERKNS_3rpc16RequestInterfaceEPNS3_21ReplyBuilderInterfaceE+0x5FB) [0x7f031436930b] mongod(_ZN5mongo7Command11execCommandEPNS_16OperationContextEPS0_RKNS_3rpc16RequestInterfaceEPNS4_21ReplyBuilderInterfaceE+0x9E0) [0x7f031436a550] mongod(_ZN5mongo11runCommandsEPNS_16OperationContextERKNS_3rpc16RequestInterfaceEPNS2_21ReplyBuilderInterfaceE+0x26D) [0x7f0314981c7d] mongod(_ZN5mongo16assembleResponseEPNS_16OperationContextERNS_7MessageERNS_10DbResponseERKNS_11HostAndPortE+0xCBD) [0x7f0314589b4d] mongod(_ZN5mongo23ServiceEntryPointMongod12_sessionLoopERKSt10shared_ptrINS_9transport7SessionEE+0x1ED) [0x7f031417a9dd] mongod(+0x88131D) [0x7f031417b31d] mongod(+0x14E3242) [0x7f0314ddd242] libpthread.so.0(+0x8184) [0x7f031255c184] libc.so.6(clone+0x6D) [0x7f031228937d] ----- END BACKTRACE ----- 2016-11-29T14:18:21.252+0000 I NETWORK [main] trying reconnect to 127.0.0.1:27017 (127.0.0.1) failed 2016-11-29T14:18:21.256+0000 I NETWORK [main] Socket recv() Connection reset by peer 127.0.0.1:27017 2016-11-29T14:18:21.256+0000 I NETWORK [main] SocketException: remote: (NONE):0 error: 9001 socket exception [RECV_ERROR] server [127.0.0.1:27017] 2016-11-29T14:18:21.256+0000 I NETWORK [main] reconnect 127.0.0.1:27017 (127.0.0.1) failed failed
    • Sprint:
      Query 2016-12-12

      Description

      Have a collection "teststructure" with the following documents:

      /* 1 */
      {
          "_id" : ObjectId("58077488ff3d2f357d79b86c"),
          "parent" : null,
          "name" : "New York",
          "type" : "city",
      }
       
      /* 2 */
      {
          "_id" : ObjectId("58077488ff3d2f357d79b86d"),
          "parent" : ObjectId("58077488ff3d2f357d79b86c"),
          "name" : "Building One",
          "type" : "building"
      }
       
      /* 3 */
      {
          "_id" : ObjectId("58077488ff3d2f357d79b86e"),
          "parent" : ObjectId("58077488ff3d2f357d79b86d"),
          "name" : "Room 1",
          "type" : "room"
      }
      

      Have a collection "objects" with the following documents that a reference field "ts" to a document from "teststructure" collection:

      /* 1 */
      {
          "_id" : ObjectId("58077488ff3d2f357d79b891"),
          "name" : "test1",
          "ts" : ObjectId("58077488ff3d2f357d79b86e"),
          "resource" : {
              "rid" : "uuid1",
              "cl" : "desks"
          }
      }
       
      /* 2 */
      {
          "_id" : ObjectId("33065488ff3d2f357d70b753"),
          "name" : "test2",
          "ts" : ObjectId("58077488ff3d2f357d79b86e"),
          "resource" : {
              "rid" : "uuid2",
              "cl" : "desks"
          }
      }
      

      The following query (which should retrive recursivelly the desks that are assigned in leaf nodes - rooms) crashes mongodb service:

      db.teststructure.aggregate([
          {
            $match: {
              "_id":  ObjectId('58077488ff3d2f357d79b86c')
            }
          },
          {
            $graphLookup: {
              from: "teststructure",
              startWith:  ObjectId('58077488ff3d2f357d79b86c'),
              connectFromField: "_id",
              connectToField: "parent",
              maxDepth: parseInt(100),
              as: "path",
              depthField: "depth"
            }
           },
           {
            $graphLookup: {
              from: "objects",
              startWith: { if: { $eq: ["$path.type", 'room'] }, then:     ObjectId('58077488ff3d2f357d79b86c'), else: "$path._id" },
              connectFromField: "_id",
              connectToField: "ts",
              maxDepth: parseInt(100),
              as: "desks",
              depthField: "depth"
             }
          }
       ])
      

      Run the above query and mongodb crashes. More details (about logs) in steps to reproduce.
      Then we have to manually restart mongodb server using "sudo service mongod restart".

      The problem seems to be related with the usage of the conditional operator in startWith expression from $graphLookup.

        Issue Links

          Activity

          Hide
          ramon.fernandez Ramon Fernandez added a comment - - edited

          Salinca Andreea, this is to let you know that this bug report has made it into the 3.4 Bug Hunt winners.

          Our Community Team will be in touch with you soon. Thanks for helping us make MongoDB 3.4 better.

          Regards,
          Ramón.

          Show
          ramon.fernandez Ramon Fernandez added a comment - - edited Salinca Andreea , this is to let you know that this bug report has made it into the 3.4 Bug Hunt winners . Our Community Team will be in touch with you soon. Thanks for helping us make MongoDB 3.4 better. Regards, Ramón.
          Hide
          charlie.swanson Charlie Swanson added a comment -

          It looks like the $graphLookup stage just forgets to forward the new ExpressionContext to the startWith expression. This should be done as part of DocumentSourceGraphLookup::doInjectExpressionContext(). This patch fixed it locally:

          diff --git a/src/mongo/db/pipeline/document_source_graph_lookup.cpp b/src/mongo/db/pipeline/document_source_graph_lookup.cpp
          index 90475df..9bfd0a3 100644
          --- a/src/mongo/db/pipeline/document_source_graph_lookup.cpp
          +++ b/src/mongo/db/pipeline/document_source_graph_lookup.cpp
          @@ -474,6 +474,7 @@ void DocumentSourceGraphLookUp::doInjectExpressionContext() {
           
               _frontier = pExpCtx->getValueComparator().makeUnorderedValueSet();
               _cache.setValueComparator(pExpCtx->getValueComparator());
          +    _startWith->injectExpressionContext(pExpCtx);
           }
           
           void DocumentSourceGraphLookUp::doDetachFromOperationContext() {
          

          I was originally surprised that the fuzzer didn't catch this, but I suspect this was difficult to find because not many expression actually use the ExpressionContext, only those that might need to check what the active collation is such as $eq, $gt, etc. Further, it would need to involve such an expression which does not resolve to an ExpressionConstant. Usually, the only way to do this is to involve a field path like "$path._id" in the comparison somehow, but in this case we hit SERVER-27100 which prevented the {$eq: [1, 2]} from being optimized to just false.

          Show
          charlie.swanson Charlie Swanson added a comment - It looks like the $graphLookup stage just forgets to forward the new ExpressionContext to the startWith expression. This should be done as part of DocumentSourceGraphLookup::doInjectExpressionContext() . This patch fixed it locally: diff --git a/src/mongo/db/pipeline/document_source_graph_lookup.cpp b/src/mongo/db/pipeline/document_source_graph_lookup.cpp index 90475df..9bfd0a3 100644 --- a/src/mongo/db/pipeline/document_source_graph_lookup.cpp +++ b/src/mongo/db/pipeline/document_source_graph_lookup.cpp @@ -474,6 +474,7 @@ void DocumentSourceGraphLookUp::doInjectExpressionContext() { _frontier = pExpCtx->getValueComparator().makeUnorderedValueSet(); _cache.setValueComparator(pExpCtx->getValueComparator()); + _startWith->injectExpressionContext(pExpCtx); } void DocumentSourceGraphLookUp::doDetachFromOperationContext() { I was originally surprised that the fuzzer didn't catch this, but I suspect this was difficult to find because not many expression actually use the ExpressionContext , only those that might need to check what the active collation is such as $eq , $gt , etc. Further, it would need to involve such an expression which does not resolve to an ExpressionConstant . Usually, the only way to do this is to involve a field path like "$path._id" in the comparison somehow, but in this case we hit SERVER-27100 which prevented the { $eq: [1, 2] } from being optimized to just false .
          Hide
          asalinca Salinca Andreea added a comment -

          @Ramon Fernandez, I am happy that I could contribute to MongoDb 3.4 and that I got into 3.4 Bug Hunt winners.
          Also, I appriciate a lot the fast feedback from your team! Great job!

          Thanks,
          Andreea

          Show
          asalinca Salinca Andreea added a comment - @Ramon Fernandez, I am happy that I could contribute to MongoDb 3.4 and that I got into 3.4 Bug Hunt winners. Also, I appriciate a lot the fast feedback from your team! Great job! Thanks, Andreea
          Hide
          xgen-internal-githook Githook User added a comment -

          Author:

          {u'username': u'dstorch', u'name': u'David Storch', u'email': u'david.storch@10gen.com'}

          Message: SERVER-27201 fix DocumentSourceGraphLookup to correctly propagate ExpressionContext
          Branch: master
          https://github.com/mongodb/mongo/commit/7411de92863b81fdf0f7c69aba8178a070633991

          Show
          xgen-internal-githook Githook User added a comment - Author: {u'username': u'dstorch', u'name': u'David Storch', u'email': u'david.storch@10gen.com'} Message: SERVER-27201 fix DocumentSourceGraphLookup to correctly propagate ExpressionContext Branch: master https://github.com/mongodb/mongo/commit/7411de92863b81fdf0f7c69aba8178a070633991
          Hide
          xgen-internal-githook Githook User added a comment -

          Author:

          {u'username': u'dstorch', u'name': u'David Storch', u'email': u'david.storch@10gen.com'}

          Message: SERVER-27201 fix DocumentSourceGraphLookup to correctly propagate ExpressionContext

          (cherry picked from commit 7411de92863b81fdf0f7c69aba8178a070633991)
          Branch: v3.4
          https://github.com/mongodb/mongo/commit/2910650d6927788ca0a4f500a76bf232d2213ed6

          Show
          xgen-internal-githook Githook User added a comment - Author: {u'username': u'dstorch', u'name': u'David Storch', u'email': u'david.storch@10gen.com'} Message: SERVER-27201 fix DocumentSourceGraphLookup to correctly propagate ExpressionContext (cherry picked from commit 7411de92863b81fdf0f7c69aba8178a070633991) Branch: v3.4 https://github.com/mongodb/mongo/commit/2910650d6927788ca0a4f500a76bf232d2213ed6

            People

            • Votes:
              0 Vote for this issue
              Watchers:
              15 Start watching this issue

              Dates

              • Created:
                Updated:
                Resolved:

                  Agile