Uploaded image for project: 'Core Server'
  1. Core Server
  2. SERVER-27579

$bucketAuto with ouput accumulator $max causes SIGSEV

    • Type: Icon: Bug Bug
    • Resolution: Duplicate
    • Priority: Icon: Major - P3 Major - P3
    • None
    • Affects Version/s: 3.4.1
    • Labels:
      None
    • OS X
    • Show
      See repro.sh

      The following $bucketAuto usage causes the server to crash with a segmentation violation

      db.companies.aggregate( [
      	{"$match": { "number_of_employees" : {"$type": "int"} }},
      	{ "$facet": {
      		"Categories": [
      			{"$match": {"category_code": /^a/i}},
      			{"$sortByCount": "$category_code"}],
      		"Employees": [
      			{"$bucketAuto": {
      				"groupBy": "$number_of_employees",
      				"buckets": 3,
      				"granularity": "1-2-5",
      				"output": { "value": {"$max": "$number_of_employees"} }
      			}
      			}
      		],
      		"Founded": [
      			{ "$match": {"founded_year": {"$gt": 1983} } },
      			{"$bucketAuto": { "groupBy": "$founded_year", "buckets": 3   }
      			}
      		]
      	}
      	}
      ])
      

      Backtrace

      2017-01-04T11:02:20.493-0500 F -        [conn2] Invalid access at address: 0x98
      2017-01-04T11:02:20.504-0500 F -        [conn2] Got signal: 11 (Segmentation fault: 11).
      mongod(_ZN5mongo15printStackTraceERNSt3__113basic_ostreamIcNS0_11char_traitsIcEEEE+0x3A) [0x10f60863a]
       mongod(_ZN5mongo12_GLOBAL__N_124abruptQuitWithAddrSignalEiP9__siginfoPv+0x140) [0x10f608030]
       libsystem_platform.dylib(_sigtramp+0x1A) [0x7fff99ab252a]
       ??? [0x23]
       mongod(_ZN5mongo24DocumentSourceBucketAuto19addDocumentToBucketERKNSt3__14pairINS_5ValueENS_8DocumentEEERNS0_6BucketE+0x147) [0x10ef06117]
       mongod(_ZN5mongo24DocumentSourceBucketAuto15populateBucketsEv+0x3C6) [0x10ef047e6]
       mongod(_ZN5mongo24DocumentSourceBucketAuto7getNextEv+0x9F) [0x10ef03aff]
       mongod(_ZN5mongo19DocumentSourceFacet7getNextEv+0x138) [0x10ef1e648]
       mongod(_ZN5mongo8Pipeline7getNextEv+0x41) [0x10eff6d51]
       mongod(_ZN5mongo18PipelineProxyStage11getNextBsonEv+0x31) [0x10edad091]
       mongod(_ZN5mongo18PipelineProxyStage6doWorkEPm+0x10F) [0x10edacf6f]
       mongod(_ZN5mongo9PlanStage4workEPm+0x5D) [0x10edad7dd]
       mongod(_ZN5mongo12PlanExecutor11getNextImplEPNS_11SnapshottedINS_7BSONObjEEEPNS_8RecordIdE+0x42E) [0x10f0682be]
       mongod(_ZN5mongo12PlanExecutor7getNextEPNS_7BSONObjEPNS_8RecordIdE+0x49) [0x10f067df9]
       mongod(_ZN5mongo12_GLOBAL__N_115PipelineCommand9runParsedEPNS_16OperationContextERKNS_15NamespaceStringERKNS_18AggregationRequestERNS_7BSONObjERNSt3__112basic_stringIcNSC_11char_traitsIcEENSC_9allocatorIcEEEERNS_14BSONObjBuilderE+0x1B95) [0x10ed17e95]
       mongod(_ZN5mongo12_GLOBAL__N_115PipelineCommand3runEPNS_16OperationContextERKNSt3__112basic_stringIcNS4_11char_traitsIcEENS4_9allocatorIcEEEERNS_7BSONObjEiRSA_RNS_14BSONObjBuilderE+0x2E6) [0x10ed15dd6]
       mongod(_ZN5mongo7Command3runEPNS_16OperationContextERKNS_3rpc16RequestInterfaceEPNS3_21ReplyBuilderInterfaceE+0x45E) [0x10ecbaa6e]
       mongod(_ZN5mongo7Command11execCommandEPNS_16OperationContextEPS0_RKNS_3rpc16RequestInterfaceEPNS4_21ReplyBuilderInterfaceE+0xC27) [0x10ecb9af7]
       mongod(_ZN5mongo11runCommandsEPNS_16OperationContextERKNS_3rpc16RequestInterfaceEPNS2_21ReplyBuilderInterfaceE+0x259) [0x10f2018c9]
       mongod(_ZN5mongo16assembleResponseEPNS_16OperationContextERNS_7MessageERNS_10DbResponseERKNS_11HostAndPortE+0x1489) [0x10ee69ae9]
       mongod(_ZN5mongo23ServiceEntryPointMongod12_sessionLoopERKNSt3__110shared_ptrINS_9transport7SessionEEE+0x187) [0x10eb14747]
       mongod(_ZNSt3__110__function6__funcIZN5mongo23ServiceEntryPointMongod12startSessionENS_10shared_ptrINS2_9transport7SessionEEEE3$_0NS_9allocatorIS8_EEFvRKS7_EEclESC_+0x18) [0x10eb14ff8]
       mongod(_ZN5mongo12_GLOBAL__N_17runFuncEPv+0x2AD) [0x10f575f0d]
       mongod(_ZNSt3__114__thread_proxyINS_5tupleIJNS_6__bindIRFPvS3_EJPN5mongo12_GLOBAL__N_17ContextEEEEEEEEES3_S3_+0x61) [0x10f5765c1]
       libsystem_pthread.dylib(_pthread_body+0x83) [0x7fff927e999d]
       libsystem_pthread.dylib(_pthread_body+0x0) [0x7fff927e991a]
       libsystem_pthread.dylib(thread_start+0xD) [0x7fff927e7351]
      -----  END BACKTRACE  -----
      

      Attaching log and reproduction script

        1. repro.sh
          0.9 kB
        2. log
          20 kB

            Assignee:
            Unassigned Unassigned
            Reporter:
            vick.mena Vick Mena (Inactive)
            Votes:
            0 Vote for this issue
            Watchers:
            3 Start watching this issue

              Created:
              Updated:
              Resolved: