Uploaded image for project: 'Core Server'
  1. Core Server
  2. SERVER-27395

$bucketAuto aggregation with $addToSet output accumulator crashes mongod

    • Type: Icon: Bug Bug
    • Resolution: Duplicate
    • Priority: Icon: Blocker - P1 Blocker - P1
    • None
    • Affects Version/s: 3.4.0
    • Component/s: Aggregation Framework
    • None
    • ALL
    • v3.4
    • Hide

      Scripts attached in the attached tar.gz file, including an already-crashed mongod dbpath (data/*) and log (mongod.log).

      Steps:
      1) Download 3.4.0 to /opt/mongodb-linux-x86_64-3.4.0 (or modify the scripts)
      2) "./prepare.sh" - starts mongod and inserts 1 x doc
      3) "./run.sh" - runs the aggregate query, crashes mongod

      Show
      Scripts attached in the attached tar.gz file, including an already-crashed mongod dbpath (data/*) and log (mongod.log). Steps: 1) Download 3.4.0 to /opt/mongodb-linux-x86_64-3.4.0 (or modify the scripts) 2) "./prepare.sh" - starts mongod and inserts 1 x doc 3) "./run.sh" - runs the aggregate query, crashes mongod
    • Query 2017-01-23

      When using $bucketAuto with an $addToSet accumulator within the 'output' document can crash mongod.

      An example query that can crash mongod:

      db.tweets.aggregate([
        { $bucketAuto: {
          groupBy: "$user.location",
          buckets: 1,
          output: {
            count: { $sum: 1 },
            location: { $addToSet: "$user.location" } 
          } 
        } }
      ])
      

      This query is probably silly/not-useful because I think specifying no 'output' field would return a similar result (this was just me playing around), but I thought the mongod crash was unexpected.

      When mongod crashes, the following is logged before a backtrace:

      2016-12-13T12:59:10.048+0100 F -        [conn2] Invalid operation at address: 0x7f1d43ba990a
      2016-12-13T12:59:10.061+0100 F -        [conn2] Got signal: 8 (Floating point exception).
      
       0x7f1d443e0f91 0x7f1d443e0089 0x7f1d443e06f6 0x7f1d42153100 0x7f1d43ba990a 0x7f1d43ba91df 0x7f1d43bc8d2e 0x7f1d43bcae3a 0x7f1d43bce255 0x7f1d43ca4492 0x7f1d43a3b0a5 0x7f1d43a3b29c 0x7f1d43a3b893 0x7f1d43d3c31a 0x7f1d43d3cc3b 0x7f1d4398447b 0x7f1d439859a9 0x7f1d438feb2b 0x7f1d438ffd70 0x7f1d43f12afd 0x7f1d43b1c54d 0x7f1d4371082d 0x7f1d4371116d 0x7f1d4435ec22 0x7f1d4214bdc5 0x7f1d41e78ced
      

            Assignee:
            david.storch@mongodb.com David Storch
            Reporter:
            tvaillancourt Tim Vaillancourt
            Votes:
            0 Vote for this issue
            Watchers:
            14 Start watching this issue

              Created:
              Updated:
              Resolved: