[SERVER-27395] $bucketAuto aggregation with $addToSet output accumulator crashes mongod Created: 13/Dec/16  Updated: 27/Dec/16  Resolved: 16/Dec/16

Status: Closed
Project: Core Server
Component/s: Aggregation Framework
Affects Version/s: 3.4.0
Fix Version/s: None

Type: Bug Priority: Blocker - P1
Reporter: Tim Vaillancourt Assignee: David Storch
Resolution: Duplicate Votes: 0
Labels: None
Remaining Estimate: Not Specified
Time Spent: Not Specified
Original Estimate: Not Specified

Attachments: File SERVER-27395.tar.gz    
Issue Links:
Backports
Duplicate
duplicates SERVER-25535 Remove injectExpressionContext() meth... Closed
Related
related to SERVER-27518 max accumulator with auto-buckets can... Closed
Operating System: ALL
Backport Requested:
v3.4
Steps To Reproduce:

Scripts attached in the attached tar.gz file, including an already-crashed mongod dbpath (data/*) and log (mongod.log).

Steps:
1) Download 3.4.0 to /opt/mongodb-linux-x86_64-3.4.0 (or modify the scripts)
2) "./prepare.sh" - starts mongod and inserts 1 x doc
3) "./run.sh" - runs the aggregate query, crashes mongod

Sprint: Query 2017-01-23
Participants:

 Description   

When using $bucketAuto with an $addToSet accumulator within the 'output' document can crash mongod.

An example query that can crash mongod:

db.tweets.aggregate([
  { $bucketAuto: {
    groupBy: "$user.location",
    buckets: 1,
    output: {
      count: { $sum: 1 },
      location: { $addToSet: "$user.location" } 
    } 
  } }
])

This query is probably silly/not-useful because I think specifying no 'output' field would return a similar result (this was just me playing around), but I thought the mongod crash was unexpected.

When mongod crashes, the following is logged before a backtrace:

2016-12-13T12:59:10.048+0100 F -        [conn2] Invalid operation at address: 0x7f1d43ba990a
2016-12-13T12:59:10.061+0100 F -        [conn2] Got signal: 8 (Floating point exception).
 
 0x7f1d443e0f91 0x7f1d443e0089 0x7f1d443e06f6 0x7f1d42153100 0x7f1d43ba990a 0x7f1d43ba91df 0x7f1d43bc8d2e 0x7f1d43bcae3a 0x7f1d43bce255 0x7f1d43ca4492 0x7f1d43a3b0a5 0x7f1d43a3b29c 0x7f1d43a3b893 0x7f1d43d3c31a 0x7f1d43d3cc3b 0x7f1d4398447b 0x7f1d439859a9 0x7f1d438feb2b 0x7f1d438ffd70 0x7f1d43f12afd 0x7f1d43b1c54d 0x7f1d4371082d 0x7f1d4371116d 0x7f1d4435ec22 0x7f1d4214bdc5 0x7f1d41e78ced



 Comments   
Comment by David Storch [ 16/Dec/16 ]

This has been fixed by https://github.com/mongodb/mongo/commit/37e720678f6e468726c6cc775a5dc898d080f0f3 under SERVER-25535, so I'm closing this ticket as a duplicate. We are currently looking into the feasibility of backporting the fixing commit to the 3.4 branch. Please watch SERVER-25535 for updates.

Comment by David Storch [ 13/Dec/16 ]

This will be fixed by work that is currently in code review under SERVER-25535. I'm leaving this ticket open in order to assess whether or not we would like to build a targeted fix for backport.

Comment by David Storch [ 13/Dec/16 ]

Thanks for the detailed report tim@elementspace.com. I can reproduce as you describe. We're looking into it now.

Comment by Tim Vaillancourt [ 13/Dec/16 ]

One missing detail I should mention: I did not see this issue with other accumulators such as $push. This works, for example:

db.tweets.aggregate([
  { $bucketAuto: {
    groupBy: "$user.location",
    buckets: 1,
    output: {
      count: { $sum: 1 },
      location: { $push: "$user.location" }     
    } 
  } }
])

Generated at Thu Feb 08 04:15:03 UTC 2024 using Jira 9.7.1#970001-sha1:2222b88b221c4928ef0de3161136cc90c8356a66.