[SERVER-32690] Aggregation can trip invariant related to renamed fields optimization Created: 12/Jan/18  Updated: 30/Oct/23  Resolved: 19/Jan/18

Status: Closed
Project: Core Server
Component/s: Aggregation Framework, Stability
Affects Version/s: 3.6.2
Fix Version/s: 3.6.3, 3.7.2

Type: Bug Priority: Critical - P2
Reporter: Aidan SE Mahler [X] Assignee: David Storch
Resolution: Fixed Votes: 0
Labels: None
Remaining Estimate: Not Specified
Time Spent: Not Specified
Original Estimate: Not Specified
Environment:

Ubuntu 16.04.3 LTS


Issue Links:
Backports
Related
is related to SERVER-31696 Aggregation's renamed fields analysis... Closed
Backwards Compatibility: Fully Compatible
Operating System: ALL
Backport Requested:
v3.6
Steps To Reproduce:

Include these stages in the db.collection.aggregate method:

  1. Project a new field. The new field name should include a colon
  2. Project the new field onto itself, as well as onto a second new field. The second new field can have any name
  3. Perform a match on the second new field.

Example:

db.getCollection('archiveData').aggregate([
    {
        "$project": {
            "foo:bar": "$foo",
        }
    }, {
        "$project": {
            "foo:bar": "$foo:bar",
            "baz": "$foo:bar",
        }
    }, {
        "$match": {
            "baz": 1
        }
    }
])

Sprint: Query 2018-01-29
Participants:

 Description   

Running certain db.collection.aggregate commands causes the mongod process to crash. Specifically, the crash seems to occur when field names contain a colon (:).

Error output:

2018-01-12T22:08:04.272+0000 E QUERY    [thread1] Error: error doing query: failed: network error while attempting to run command 'aggregate' on host '127.0.0.1:27017'  :
DB.prototype.runCommand@src/mongo/shell/db.js:168:1
DB.prototype.runReadCommand@src/mongo/shell/db.js:139:16
DB.prototype._runAggregate/doAgg<@src/mongo/shell/db.js:239:60
DB.prototype._runAggregate@src/mongo/shell/db.js:242:21
DBCollection.prototype.aggregate@src/mongo/shell/collection.js:1212:12
@(shell):1:1



 Comments   
Comment by Githook User [ 22/Jan/18 ]

Author:

{'name': 'David Storch', 'email': 'david.storch@10gen.com', 'username': 'dstorch'}

Message: SERVER-32690 Fix invariant failure in agg renamed paths optimization.

(cherry picked from commit 92d58a1815b917d165c39235f9fe5b8a319072c3)

Conflicts:
src/mongo/db/matcher/expression_path.h
Branch: v3.6
https://github.com/mongodb/mongo/commit/0ee5bd64f3f9df1bc01988cde3693115d6ea10e7

Comment by Githook User [ 19/Jan/18 ]

Author:

{'name': 'David Storch', 'email': 'david.storch@10gen.com', 'username': 'dstorch'}

Message: SERVER-32690 Fix invariant failure in agg renamed paths optimization.
Branch: master
https://github.com/mongodb/mongo/commit/92d58a1815b917d165c39235f9fe5b8a319072c3

Comment by Aidan SE Mahler [X] [ 13/Jan/18 ]

Interesting. I thought that it was specific to field name with colons, but you are right that others cause the failure as well (foobar, bar, and ar cause failure, while foo, fooba, and var do not).

Glad that the root cause has been identified.

Comment by David Storch [ 12/Jan/18 ]

Thanks for the report. We have identified a fix and will be working to get it merged and backported. It looks like this was introduced by SERVER-31696, and therefore it only impacts the 3.6 branch.

I can reproduce with this minimal repro:

(function() {
    "use strict";
 
    db.c.drop();
    db.c.aggregate([
        {
          "$project": {
              "foobar": "$foobar",
              "baz": "$foobar",
          }
        },
        {"$match": {"baz": 1}}
    ]);
}());

Generated at Thu Feb 08 04:30:59 UTC 2024 using Jira 9.7.1#970001-sha1:2222b88b221c4928ef0de3161136cc90c8356a66.