[SERVER-27518] max accumulator with auto-buckets can cause mongod crash Created: 27/Dec/16  Updated: 27/Dec/16  Resolved: 27/Dec/16

Status: Closed
Project: Core Server
Component/s: Aggregation Framework
Affects Version/s: None
Fix Version/s: None

Type: Task Priority: Major - P3
Reporter: Tomer Yakir Assignee: David Storch
Resolution: Duplicate Votes: 0
Labels: None
Remaining Estimate: Not Specified
Time Spent: Not Specified
Original Estimate: Not Specified

Issue Links:
Duplicate
duplicates SERVER-25535 Remove injectExpressionContext() meth... Closed
Related
is related to SERVER-27395 $bucketAuto aggregation with $addToSe... Closed
Participants:

 Description   

The following aggregation query on the startups.companies data set (from the m034 handouts) crashes the mongod process (reproduced using MongoDB 3.4 on Windows)

bucketAuto =  {'$bucketAuto': {             'groupBy': '$number_of_employees',             'buckets': 3,             'granularity': '1-2-5',     'output': { value: {$max: 1}     }           }}
match = {'$match': { 'number_of_employees' : {'$type': 'int'} }}
db.companies.aggregate([match, bucketAuto])

The following error is shown:

2016-12-25T10:35:16.635+0200 I CONTROL  [conn2] *** unhandled exception (access violation) at 0x00007FF6482CC1BE, terminating
2016-12-25T10:35:16.635+0200 I CONTROL  [conn2] *** access violation was a read from 0x00000000000000A8
2016-12-25T10:35:16.638+0200 I CONTROL  [conn2] *** stack trace for unhandled exception:
2016-12-25T10:35:16.763+0200 I CONTROL  [conn2] mongod.exe    ...\src\mongo\db\pipeline\accumulator_min_max.cpp(56)                            mongo::AccumulatorMinMax::processInternal+0x2e
2016-12-25T10:35:16.763+0200 I CONTROL  [conn2] mongod.exe    ...\src\mongo\db\pipeline\document_source_bucket_auto.cpp(156)                   mongo::DocumentSourceBucketAuto::addDocumentToBucket+0x10f
2016-12-25T10:35:16.766+0200 I CONTROL  [conn2] mongod.exe    ...\src\mongo\db\pipeline\document_source_bucket_auto.cpp(204)                   mongo::DocumentSourceBucketAuto::populateBuckets+0x27b
2016-12-25T10:35:16.766+0200 I CONTROL  [conn2] mongod.exe    ...\src\mongo\db\pipeline\document_source_bucket_auto.cpp(63)                    mongo::DocumentSourceBucketAuto::getNext+0xb2
2016-12-25T10:35:16.767+0200 I CONTROL  [conn2] mongod.exe    ...\src\mongo\db\pipeline\document_source_facet.cpp(165)                         mongo::DocumentSourceFacet::getNext+0xf4
2016-12-25T10:35:16.768+0200 I CONTROL  [conn2] mongod.exe    ...\src\mongo\db\pipeline\pipeline.cpp(346)                                      mongo::Pipeline::getNext+0x7c
2016-12-25T10:35:16.768+0200 I CONTROL  [conn2] mongod.exe    ...\src\mongo\db\exec\pipeline_proxy.cpp(110)                                    mongo::PipelineProxyStage::getNextBson+0x45
2016-12-25T10:35:16.770+0200 I CONTROL  [conn2] mongod.exe    ...\src\mongo\db\exec\pipeline_proxy.cpp(71)                                     mongo::PipelineProxyStage::doWork+0x11f
2016-12-25T10:35:16.771+0200 I CONTROL  [conn2] mongod.exe    ...\src\mongo\db\exec\plan_stage.cpp(46)                                         mongo::PlanStage::work+0x6d
2016-12-25T10:35:16.771+0200 I CONTROL  [conn2] mongod.exe    ...\src\mongo\db\query\plan_executor.cpp(425)                                    mongo::PlanExecutor::getNextImpl+0x544
2016-12-25T10:35:16.772+0200 I CONTROL  [conn2] mongod.exe    ...\src\mongo\db\query\plan_executor.cpp(345)                                    mongo::PlanExecutor::getNext+0x41
2016-12-25T10:35:16.772+0200 I CONTROL  [conn2] mongod.exe    ...\src\mongo\db\commands\pipeline_command.cpp(113)                              mongo::`anonymous namespace'::handleCursorCommand+0x150
2016-12-25T10:35:16.775+0200 I CONTROL  [conn2] mongod.exe    ...\src\mongo\db\commands\pipeline_command.cpp(560)                              mongo::`anonymous namespace'::PipelineCommand::runParsed+0x13f6
2016-12-25T10:35:16.779+0200 I CONTROL  [conn2] mongod.exe    ...\src\mongo\db\commands\pipeline_command.cpp(640)                              mongo::`anonymous namespace'::PipelineCommand::run+0x349
2016-12-25T10:35:16.779+0200 I CONTROL  [conn2] mongod.exe    ...\src\mongo\db\commands\dbcommands.cpp(1521)                                   mongo::Command::run+0x589
2016-12-25T10:35:16.780+0200 I CONTROL  [conn2] mongod.exe    ...\src\mongo\db\commands\dbcommands.cpp(1442)                                   mongo::Command::execCommand+0xb9d
2016-12-25T10:35:16.781+0200 I CONTROL  [conn2] mongod.exe    ...\src\mongo\db\run_commands.cpp(73)                                            mongo::runCommands+0x4e4
2016-12-25T10:35:16.781+0200 I CONTROL  [conn2] mongod.exe    ...\src\mongo\db\instance.cpp(273)                                               mongo::`anonymous namespace'::receivedRpc+0x19f
2016-12-25T10:35:16.782+0200 I CONTROL  [conn2] mongod.exe    ...\src\mongo\db\instance.cpp(618)                                               mongo::assembleResponse+0x7e5
2016-12-25T10:35:16.782+0200 I CONTROL  [conn2] mongod.exe    ...\src\mongo\db\service_entry_point_mongod.cpp(135)                             mongo::ServiceEntryPointMongod::_sessionLoop+0x159
2016-12-25T10:35:16.782+0200 I CONTROL  [conn2] mongod.exe    c:\program files (x86)\microsoft visual studio 14.0\vc\include\functional(212)   std::_Func_impl<<lambda_0476eb5123845e42a2f452f2efde6866>,std::allocator<int>,void,std::shared_ptr<mongo::transport::Session> const & __ptr64>::_Do_call+0x43
2016-12-25T10:35:16.783+0200 I CONTROL  [conn2] mongod.exe    ...\src\mongo\transport\service_entry_point_utils.cpp(78)                        mongo::`anonymous namespace'::runFunc+0x1b3
2016-12-25T10:35:16.783+0200 I CONTROL  [conn2] mongod.exe    c:\program files (x86)\microsoft visual studio 14.0\vc\include\thr\xthread(247)  std::_LaunchPad<std::unique_ptr<std::tuple<std::_Binder<std::_Unforced,void * __ptr64 (__cdecl&)(void * __ptr64),mongo::`anonymous namespace'::Context * __ptr64> >,std::default_delete<std::tuple<std::_Binder<std::_Unforced,void * __ptr64 (__cdecl&)(void * __ptr64),mongo::`anonymous namespace'::Context * __ptr64> > > > >::_Run+0x75
2016-12-25T10:35:16.784+0200 I CONTROL  [conn2] mongod.exe    c:\program files (x86)\microsoft visual studio 14.0\vc\include\thr\xthread(210)  std::_Pad::_Call_func+0x9
2016-12-25T10:35:16.784+0200 I CONTROL  [conn2] ucrtbase.dll                                                                                   o__realloc_base+0x60
2016-12-25T10:35:16.785+0200 I CONTROL  [conn2] KERNEL32.DLL                                                                                   BaseThreadInitThunk+0x14
2016-12-25T10:35:16.785+0200 I -        [conn2]
2016-12-25T10:35:16.786+0200 I CONTROL  [conn2] failed to open minidump file C:\Program Files\MongoDB\Server\3.2016-12-25T08-35-16.mdmp : Access is denied.
2016-12-25T10:35:16.786+0200 I CONTROL  [conn2] *** immediate exit due to unhandled exception



 Comments   
Comment by David Storch [ 27/Dec/16 ]

This crash has the same root cause as SERVER-27395. Any $bucketAuto with an accumulator that must make comparisons, such as $max, $min, or $addToSet, is affected. The problem has already been fixed in 3.5.2 and 3.4.2 under SERVER-25535, so I am resolving this ticket as a duplicate.

Generated at Thu Feb 08 04:15:22 UTC 2024 using Jira 9.7.1#970001-sha1:2222b88b221c4928ef0de3161136cc90c8356a66.