[SERVER-17241] Inserting a broken polygon into a "2dsphere" index crashes MongoDB Created: 10/Feb/15  Updated: 25/Jan/17  Resolved: 11/Feb/15

Status: Closed
Project: Core Server
Component/s: Geo, Index Maintenance
Affects Version/s: 3.0.0-rc8
Fix Version/s: 3.0.0-rc9, 3.1.0

Type: Bug Priority: Critical - P2
Reporter: Derick Rethans Assignee: Siyuan Zhou
Resolution: Done Votes: 0
Labels: None
Remaining Estimate: Not Specified
Time Spent: Not Specified
Original Estimate: Not Specified

Backwards Compatibility: Fully Compatible
Backport Completed:
Participants:

 Description   

When inserting the following "polygon" into MongoDB (3.0.0rc8), MongoDB crashes. I can reproduce this with an empty DB and no collections. This happens with both mmapv1 and wiredTiger.

db.test.drop();
true
> db.test.createIndex( { l: '2dsphere' } );
{
	"createdCollectionAutomatically" : true,
	"numIndexesBefore" : 1,
	"numIndexesAfter" : 2,
	"ok" : 1
}
> db.test.insert( { 'l' : { type: 'Polygon', coordinates: [] } } );
2015-02-10T16:57:01.846+0000 I NETWORK  DBClientCursor::init call() failed
2015-02-10T16:57:01.847+0000 E QUERY    Error: Error: error doing query: failed
    at Error (<anonymous>)
    at DBCollection.insert (src/mongo/shell/collection.js:259:23)
    at (shell):1:9 at src/mongo/shell/collection.js:259

backtrace is:

2015-02-10T16:56:55.205+0000 I COMMAND  [conn1] CMD: drop demo.test
2015-02-10T16:56:57.473+0000 I INDEX    [conn1] build index on: demo.test properties: { v: 1, key: { l: "2dsphere" }, name: "l_2dsphere", ns: "demo.test", 2dsphereIndexVersion: 2 }
2015-02-10T16:56:57.473+0000 I INDEX    [conn1]          building index using bulk method
2015-02-10T16:56:57.476+0000 I INDEX    [conn1] build index done.  scanned 0 total records. 0 secs
2015-02-10T16:57:01.818+0000 F -        [conn1] Invalid access at address: 0
2015-02-10T16:57:01.841+0000 F -        [conn1] Got signal: 11 (Segmentation fault).
 
 0xf3f059 0xf3e6d2 0xf3ea2e 0x7f943878a8d0 0x101152b 0xa548e5 0xa5591f 0xa4c2c9 0xa4df91 0xa87fbd 0xa89c51 0xa6d55c 0x90491e 0x904c65 0x8f2870 0x8f3e8d 0x995783 0x99636a 0x996444 0x996b45 0x99976d 0x9b9434 0x9ba373 0x9baf6b 0xb8abe5 0xa9c968 0x7e6cc0 0xefd11b 0x7f94387830a4 0x7f9437889ccd
----- BEGIN BACKTRACE -----
{"backtrace":[{"b":"400000","o":"B3F059"},{"b":"400000","o":"B3E6D2"},{"b":"400000","o":"B3EA2E"},{"b":"7F943877B000","o":"F8D0"},{"b":"400000","o":"C1152B"},{"b":"400000","o":"6548E5"},{"b":"400000","o":"65591F"},{"b":"400000","o":"64C2C9"},{"b":"400000","o":"64DF91"},{"b":"400000","o":"687FBD"},{"b":"400000","o":"689C51"},{"b":"400000","o":"66D55C"},{"b":"400000","o":"50491E"},{"b":"400000","o":"504C65"},{"b":"400000","o":"4F2870"},{"b":"400000","o":"4F3E8D"},{"b":"400000","o":"595783"},{"b":"400000","o":"59636A"},{"b":"400000","o":"596444"},{"b":"400000","o":"596B45"},{"b":"400000","o":"59976D"},{"b":"400000","o":"5B9434"},{"b":"400000","o":"5BA373"},{"b":"400000","o":"5BAF6B"},{"b":"400000","o":"78ABE5"},{"b":"400000","o":"69C968"},{"b":"400000","o":"3E6CC0"},{"b":"400000","o":"AFD11B"},{"b":"7F943877B000","o":"80A4"},{"b":"7F94377A4000","o":"E5CCD"}],"processInfo":{ "mongodbVersion" : "3.0.0-rc8", "gitVersion" : "9d0714cdcffadb203ff68730acedbc40875403da", "uname" : { "sysname" : "Linux", "release" : "3.16.0-4-amd64", "version" : "#1 SMP Debian 3.16.7-2 (2014-11-06)", "machine" : "x86_64" }, "somap" : [ { "elfType" : 2, "b" : "400000" }, { "b" : "7FFFD749A000", "path" : "linux-vdso.so.1", "elfType" : 3 }, { "b" : "7F943877B000", "path" : "/lib/x86_64-linux-gnu/libpthread.so.0", "elfType" : 3 }, { "b" : "7F9438573000", "path" : "/lib/x86_64-linux-gnu/librt.so.1", "elfType" : 3 }, { "b" : "7F943836F000", "path" : "/lib/x86_64-linux-gnu/libdl.so.2", "elfType" : 3 }, { "b" : "7F9438064000", "path" : "/usr/lib/x86_64-linux-gnu/libstdc++.so.6", "elfType" : 3 }, { "b" : "7F9437D63000", "path" : "/lib/x86_64-linux-gnu/libm.so.6", "elfType" : 3 }, { "b" : "7F9437B4D000", "path" : "/lib/x86_64-linux-gnu/libgcc_s.so.1", "elfType" : 3 }, { "b" : "7F94377A4000", "path" : "/lib/x86_64-linux-gnu/libc.so.6", "elfType" : 3 }, { "b" : "7F9438998000", "path" : "/lib64/ld-linux-x86-64.so.2", "elfType" : 3 } ] }}
 mongod(_ZN5mongo15printStackTraceERSo+0x29) [0xf3f059]
 mongod(+0xB3E6D2) [0xf3e6d2]
 mongod(+0xB3EA2E) [0xf3ea2e]
 libpthread.so.0(+0xF8D0) [0x7f943878a8d0]
 mongod(_ZNK9S2Polygon17GetLastDescendantEi+0xB) [0x101152b]
 mongod(+0x6548E5) [0xa548e5]
 mongod(_ZN5mongo9GeoParser19parseGeoJSONPolygonERKNS_7BSONObjEPNS_14PolygonWithCRSE+0x2DF) [0xa5591f]
 mongod(_ZN5mongo17GeometryContainer16parseFromGeoJSONERKNS_7BSONObjE+0xBB9) [0xa4c2c9]
 mongod(_ZN5mongo17GeometryContainer16parseFromStorageERKNS_11BSONElementE+0x181) [0xa4df91]
 mongod(+0x687FBD) [0xa87fbd]
 mongod(_ZN5mongo21ExpressionKeysPrivate9getS2KeysERKNS_7BSONObjES3_RKNS_16S2IndexingParamsEPSt3setIS1_NS_10BSONObjCmpESaIS1_EE+0x2A1) [0xa89c51]
 mongod(_ZN5mongo22BtreeBasedAccessMethod6insertEPNS_16OperationContextERKNS_7BSONObjERKNS_8RecordIdERKNS_19InsertDeleteOptionsEPl+0xAC) [0xa6d55c]
 mongod(_ZN5mongo12IndexCatalog12_indexRecordEPNS_16OperationContextEPNS_17IndexCatalogEntryERKNS_7BSONObjERKNS_8RecordIdE+0x6E) [0x90491e]
 mongod(_ZN5mongo12IndexCatalog11indexRecordEPNS_16OperationContextERKNS_7BSONObjERKNS_8RecordIdE+0x85) [0x904c65]
 mongod(_ZN5mongo10Collection15_insertDocumentEPNS_16OperationContextERKNS_7BSONObjEb+0xB0) [0x8f2870]
 mongod(_ZN5mongo10Collection14insertDocumentEPNS_16OperationContextERKNS_7BSONObjEb+0x8D) [0x8f3e8d]
 mongod(_ZN5mongo18WriteBatchExecutor13execOneInsertEPNS0_16ExecInsertsStateEPPNS_16WriteErrorDetailE+0xA93) [0x995783]
 mongod(_ZN5mongo18WriteBatchExecutor11execInsertsERKNS_21BatchedCommandRequestEPSt6vectorIPNS_16WriteErrorDetailESaIS6_EE+0x25A) [0x99636a]
 mongod(_ZN5mongo18WriteBatchExecutor11bulkExecuteERKNS_21BatchedCommandRequestEPSt6vectorIPNS_19BatchedUpsertDetailESaIS6_EEPS4_IPNS_16WriteErrorDetailESaISB_EE+0x34) [0x996444]
 mongod(_ZN5mongo18WriteBatchExecutor12executeBatchERKNS_21BatchedCommandRequestEPNS_22BatchedCommandResponseE+0x395) [0x996b45]
 mongod(_ZN5mongo8WriteCmd3runEPNS_16OperationContextERKSsRNS_7BSONObjEiRSsRNS_14BSONObjBuilderEb+0x15D) [0x99976d]
 mongod(_ZN5mongo12_execCommandEPNS_16OperationContextEPNS_7CommandERKSsRNS_7BSONObjEiRSsRNS_14BSONObjBuilderEb+0x34) [0x9b9434]
 mongod(_ZN5mongo7Command11execCommandEPNS_16OperationContextEPS0_iPKcRNS_7BSONObjERNS_14BSONObjBuilderEb+0xC13) [0x9ba373]
 mongod(_ZN5mongo12_runCommandsEPNS_16OperationContextEPKcRNS_7BSONObjERNS_11_BufBuilderINS_16TrivialAllocatorEEERNS_14BSONObjBuilderEbi+0x28B) [0x9baf6b]
 mongod(_ZN5mongo8runQueryEPNS_16OperationContextERNS_7MessageERNS_12QueryMessageERKNS_15NamespaceStringERNS_5CurOpES3_b+0x755) [0xb8abe5]
 mongod(_ZN5mongo16assembleResponseEPNS_16OperationContextERNS_7MessageERNS_10DbResponseERKNS_11HostAndPortEb+0xAC8) [0xa9c968]
 mongod(_ZN5mongo16MyMessageHandler7processERNS_7MessageEPNS_21AbstractMessagingPortEPNS_9LastErrorE+0xE0) [0x7e6cc0]
 mongod(_ZN5mongo17PortMessageServer17handleIncomingMsgEPv+0x32B) [0xefd11b]
 libpthread.so.0(+0x80A4) [0x7f94387830a4]
 libc.so.6(clone+0x6D) [0x7f9437889ccd]
-----  END BACKTRACE  -----



 Comments   
Comment by Githook User [ 11/Feb/15 ]

Author:

{u'username': u'visualzhou', u'name': u'Siyuan Zhou', u'email': u'siyuan.zhou@mongodb.com'}

Message: SERVER-17241 Verify number of loops of polygon

(cherry picked from commit 76e7106f2577d9911bc6694bab0d1166b58cd977)
Branch: v3.0
https://github.com/mongodb/mongo/commit/5e579b03fb55259037d0f348ee0c7c1d702b69c9

Comment by Githook User [ 11/Feb/15 ]

Author:

{u'username': u'visualzhou', u'name': u'Siyuan Zhou', u'email': u'siyuan.zhou@mongodb.com'}

Message: SERVER-17241 Verify number of loops of polygon
Branch: master
https://github.com/mongodb/mongo/commit/76e7106f2577d9911bc6694bab0d1166b58cd977

Comment by Ramon Fernandez Marina [ 10/Feb/15 ]

Thanks for the report derick. I'm able to reproduce, testing on master now...

Generated at Thu Feb 08 03:43:45 UTC 2024 using Jira 9.7.1#970001-sha1:2222b88b221c4928ef0de3161136cc90c8356a66.