Details
-
Bug
-
Status: Closed
-
Critical - P2
-
Resolution: Gone away
-
2.4.0
-
None
-
None
-
Fully Compatible
-
ALL
Description
The following functions may attempt to dereference an empty handle when v8 heap space is nearly depleted:
- namedGet()
- namedGetRO()
- indexedGet()
- indexedGetRO()
- nativeCallback()
This is because mongoToV8Element() does not check for allocation success nor OOM when creating a new JS object.
Attachments
Issue Links
- is duplicated by
-
SERVER-9117 Mongo segfault on mapreduce - repeatable every time
-
- Closed
-
- is related to
-
SERVER-9291 V8Scope::invoke shouldn't silently ignore arguments after the 24th
-
- Closed
-
- related to
-
SERVER-9213 Resource constraints cause premature OOM and segfault
-
- Closed
-
-
SERVER-9267 Issues with readonly BSON in v8
-
- Closed
-
-
SERVER-9185 Add GC Prologue and Epilogue heap stats
-
- Closed
-
-
SERVER-9187 Reduce memory requirements from v8 interceptors
-
- Closed
-