[SERVER-17387] invalid projection for findAndModify triggers fassert() failure Created: 26/Feb/15  Updated: 18/Sep/15  Resolved: 09/Mar/15

Status: Closed
Project: Core Server
Component/s: Querying
Affects Version/s: 3.0.0-rc11
Fix Version/s: 3.0.1, 3.1.0

Type: Bug Priority: Major - P3
Reporter: Hannes Magnusson Assignee: David Storch
Resolution: Done Votes: 1
Labels: None
Remaining Estimate: Not Specified
Time Spent: Not Specified
Original Estimate: Not Specified

Issue Links:
Related
Backwards Compatibility: Fully Compatible
Operating System: Linux
Backport Completed:
Steps To Reproduce:

> db.collection.remove({})
WriteResult({ "nRemoved" : 1 })
> db.collection.insert({
 "name": "Next promo",
     "inprogress": false,
     "priority": 0,
     "tasks": [
         "select product",
         "add inventory",
         "do placement"
     ]
 })
WriteResult({ "nInserted" : 1 })
> db.collection.findAndModify({
 "query": {
         "inprogress": false,
         "name": "Next promo"
     },
     "update": {
         "$pop": {
             "tasks": -1
         }
     },
     "fields": {
         "tasks": {
             "$pop": [
                 "stuff"
             ]
         }
     },
     "new": true
 })

Participants:

 Description   

2015-02-25T19:48:44.853-0800 I WRITE    [conn1] insert test.collection query: { _id: ObjectId('54ee979c0380f72636ae2d4d'), name: "Next promo", inprogress: false, priority: 0.0, tasks: [ "select product", "add inventory", "do placement" ] } ninserted:1 keyUpdates:0 writeConflicts:0 numYields:0 locks:{ Global: { acquireCount: { w: 2 } }, MMAPV1Journal: { acquireCount: { w: 8 } }, Database: { acquireCount: { w: 1, W: 1 } }, Collection: { acquireCount: { W: 1 } }, Metadata: { acquireCount: { W: 4 } } } 115ms
2015-02-25T19:48:44.853-0800 I COMMAND  [conn1] command test.$cmd command: insert { insert: "collection", documents: [ { _id: ObjectId('54ee979c0380f72636ae2d4d'), name: "Next promo", inprogress: false, priority: 0.0, tasks: [ "select product", "add inventory", "do placement" ] } ], ordered: true } keyUpdates:0 writeConflicts:0 numYields:0 reslen:40 locks:{} 115ms
2015-02-25T19:48:50.981-0800 F REPL     [conn1] Rollback of logOp not currently allowed (SERVER-15192)
2015-02-25T19:48:50.981-0800 I -        [conn1] Fatal Assertion 18805
2015-02-25T19:48:50.997-0800 I CONTROL  [conn1]
 0xf3f1c9 0xedfa21 0xec4e31 0xc2df2c 0xd134a7 0xd1382f 0x80acd6 0x95fa44 0x9602d5 0x9d57e4 0x9d6723 0x9d731b 0xb97dd5 0xab0299 0x80cf00 0xef337b 0x7fce7741c0a5 0x7fce75ecf88d
----- BEGIN BACKTRACE -----
{"backtrace":[{"b":"400000","o":"B3F1C9"},{"b":"400000","o":"ADFA21"},{"b":"400000","o":"AC4E31"},{"b":"400000","o":"82DF2C"},{"b":"400000","o":"9134A7"},{"b":"400000","o":"91382F"},{"b":"400000","o":"40ACD6"},{"b":"400000","o":"55FA44"},{"b":"400000","o":"5602D5"},{"b":"400000","o":"5D57E4"},{"b":"400000","o":"5D6723"},{"b":"400000","o":"5D731B"},{"b":"400000","o":"797DD5"},{"b":"400000","o":"6B0299"},{"b":"400000","o":"40CF00"},{"b":"400000","o":"AF337B"},{"b":"7FCE77414000","o":"80A5"},{"b":"7FCE75DD5000","o":"FA88D"}],"processInfo":{ "mongodbVersion" : "3.0.0-rc10", "gitVersion" : "4b61ce0647531fe08807b23f7ef995f002a2c80e", "uname" : { "sysname" : "Linux", "release" : "3.16.0-30-generic", "version" : "#40-Ubuntu SMP Mon Jan 12 22:06:37 UTC 2015", "machine" : "x86_64" }, "somap" : [ { "elfType" : 2, "b" : "400000", "buildId" : "AF91013723D4315EF4307448B133D23EB04F8F41" }, { "b" : "7FFF06DFC000", "elfType" : 3, "buildId" : "B43B3054EC49983B9ECFC6BD437E70C564D0AE41" }, { "b" : "7FCE77414000", "path" : "/lib/x86_64-linux-gnu/libpthread.so.0", "elfType" : 3, "buildId" : "921196598AF41AFF8DE42EEFB8561243610F34C3" }, { "b" : "7FCE771B5000", "path" : "/lib/x86_64-linux-gnu/libssl.so.1.0.0", "elfType" : 3, "buildId" : "B408BD42C304C9370D97ED641544082414C4D59A" }, { "b" : "7FCE76DD2000", "path" : "/lib/x86_64-linux-gnu/libcrypto.so.1.0.0", "elfType" : 3, "buildId" : "B0BB841B6CFD35E8D3D2AC285C220A4683A134EF" }, { "b" : "7FCE76BCA000", "path" : "/lib/x86_64-linux-gnu/librt.so.1", "elfType" : 3, "buildId" : "54EF3A97A3E71418DD088B40AF51A00457834A17" }, { "b" : "7FCE769C6000", "path" : "/lib/x86_64-linux-gnu/libdl.so.2", "elfType" : 3, "buildId" : "794CD87201C9778112E22BF5E2C0FBFB3390D29F" }, { "b" : "7FCE766B7000", "path" : "/usr/lib/x86_64-linux-gnu/libstdc++.so.6", "elfType" : 3, "buildId" : "ADEF33B83967BBB41525AE439354F030694250C4" }, { "b" : "7FCE763B1000", "path" : "/lib/x86_64-linux-gnu/libm.so.6", "elfType" : 3, "buildId" : "4E96203F4FE17D3446F48226AAEA8DA6DEA8FFD0" }, { "b" : "7FCE7619A000", "path" : "/lib/x86_64-linux-gnu/libgcc_s.so.1", "elfType" : 3, "buildId" : "7C6E98219378EBD1AA0D4CD671E8FF1589C04C4A" }, { "b" : "7FCE75DD5000", "path" : "/lib/x86_64-linux-gnu/libc.so.6", "elfType" : 3, "buildId" : "7D0E9697AAB9DF7392800AEA485727EB0F0437A8" }, { "b" : "7FCE77632000", "path" : "/lib64/ld-linux-x86-64.so.2", "elfType" : 3, "buildId" : "9240DBBD1DB14E756141EEE1FDDB67D3B77864E7" } ] }}
 mongod(_ZN5mongo15printStackTraceERSo+0x29) [0xf3f1c9]
 mongod(_ZN5mongo10logContextEPKc+0xE1) [0xedfa21]
 mongod(_ZN5mongo13fassertFailedEi+0x61) [0xec4e31]
 mongod(+0x82DF2C) [0xc2df2c]
 mongod(_ZN5mongo15DurRecoveryUnit24rollbackInnermostChangesEv+0x207) [0xd134a7]
 mongod(_ZN5mongo15DurRecoveryUnit13endUnitOfWorkEv+0x2F) [0xd1382f]
 mongod(_ZN5mongo15WriteUnitOfWorkD1Ev+0x16) [0x80acd6]
 mongod(_ZN5mongo16CmdFindAndModify7runImplEPNS_16OperationContextERKSsS4_RKNS_7BSONObjES7_S7_S7_bbbRNS_14BSONObjBuilderERSs+0x1804) [0x95fa44]
 mongod(_ZN5mongo16CmdFindAndModify3runEPNS_16OperationContextERKSsRNS_7BSONObjEiRSsRNS_14BSONObjBuilderEb+0x2B5) [0x9602d5]
 mongod(_ZN5mongo12_execCommandEPNS_16OperationContextEPNS_7CommandERKSsRNS_7BSONObjEiRSsRNS_14BSONObjBuilderEb+0x34) [0x9d57e4]
 mongod(_ZN5mongo7Command11execCommandEPNS_16OperationContextEPS0_iPKcRNS_7BSONObjERNS_14BSONObjBuilderEb+0xC13) [0x9d6723]
 mongod(_ZN5mongo12_runCommandsEPNS_16OperationContextEPKcRNS_7BSONObjERNS_11_BufBuilderINS_16TrivialAllocatorEEERNS_14BSONObjBuilderEbi+0x28B) [0x9d731b]
 mongod(_ZN5mongo8runQueryEPNS_16OperationContextERNS_7MessageERNS_12QueryMessageERKNS_15NamespaceStringERNS_5CurOpES3_b+0x755) [0xb97dd5]
 mongod(_ZN5mongo16assembleResponseEPNS_16OperationContextERNS_7MessageERNS_10DbResponseERKNS_11HostAndPortEb+0xB19) [0xab0299]
 mongod(_ZN5mongo16MyMessageHandler7processERNS_7MessageEPNS_21AbstractMessagingPortEPNS_9LastErrorE+0xE0) [0x80cf00]
 mongod(_ZN5mongo17PortMessageServer17handleIncomingMsgEPv+0x32B) [0xef337b]
 libpthread.so.0(+0x80A5) [0x7fce7741c0a5]
 libc.so.6(clone+0x6D) [0x7fce75ecf88d]
-----  END BACKTRACE  -----
2015-02-25T19:48:50.997-0800 I -        [conn1]
 
***aborting after fassert() failure
 



 Comments   
Comment by Githook User [ 09/Mar/15 ]

Author:

{u'username': u'dstorch', u'name': u'David Storch', u'email': u'david.storch@10gen.com'}

Message: SERVER-17387 prevent invalid projections from causing findAndModify to trigger a logOp() rollback

(cherry picked from commit 98276a11bdbd5ef863f0fead63c14f5a7a13440d)
Branch: v3.0
https://github.com/mongodb/mongo/commit/618eb359064fe06ab11487ac5cc1394879c1216b

Comment by Githook User [ 09/Mar/15 ]

Author:

{u'username': u'dstorch', u'name': u'David Storch', u'email': u'david.storch@10gen.com'}

Message: SERVER-17387 prevent invalid projections from causing findAndModify to trigger a logOp() rollback
Branch: master
https://github.com/mongodb/mongo/commit/98276a11bdbd5ef863f0fead63c14f5a7a13440d

Comment by Githook User [ 02/Mar/15 ]

Author:

{u'username': u'jmikola', u'name': u'Jeremy Mikola', u'email': u'jmikola@gmail.com'}

Message: Skip findAndModify error tests until SERVER-17387 is fixed
Branch: master
https://github.com/mongodb/mongo-php-driver/commit/3251dbb47761bbfbb1d0c59815365cc4774c987e

Comment by Githook User [ 02/Mar/15 ]

Author:

{u'username': u'jmikola', u'name': u'Jeremy Mikola', u'email': u'jmikola@gmail.com'}

Message: Skip findAndModify error tests until SERVER-17387 is fixed
Branch: v1.6
https://github.com/mongodb/mongo-php-driver/commit/3251dbb47761bbfbb1d0c59815365cc4774c987e

Comment by David Storch [ 26/Feb/15 ]

Find and modify uses an old Projection implementation which throws user assertions if the user-provided projection is invalid.

Such a user assertion from find and modify can cause the rollback of a logOp(), which is currently invalid in 3.0. Since logOp() rollback is allowed in master, this affects only the 3.0 branch.

Comment by Hannes Magnusson [ 26/Feb/15 ]

The repro works as expected in RC7.
Fails in RC8, 9, 10, 11

Generated at Thu Feb 08 03:44:15 UTC 2024 using Jira 9.7.1#970001-sha1:2222b88b221c4928ef0de3161136cc90c8356a66.