[SERVER-67250] Multiple projections through common subpath can overwrite each other in column store index plans Created: 13/Jun/22  Updated: 29/Oct/23  Resolved: 27/Jun/22

Status: Closed
Project: Core Server
Component/s: None
Affects Version/s: None
Fix Version/s: 6.1.0-rc0

Type: Bug Priority: Major - P3
Reporter: Justin Seyster Assignee: Justin Seyster
Resolution: Fixed Votes: 0
Labels: None
Remaining Estimate: Not Specified
Time Spent: Not Specified
Original Estimate: Not Specified

Backwards Compatibility: Fully Compatible
Operating System: ALL
Sprint: QE 2022-06-27, QE 2022-07-11
Participants:

 Description   

When a query projects multiple paths, the ColumnScanStage calls addCellToObject and/or readParentsIntoObject with different paths on the same output object.

In at least one place, these object materialization functions assume that they will not be used for multiple paths when one path is not a subset of another.

Counterexample
Document:

{a: [{n: 1, m: 2}, {m: 1, o: 2}]}

with projection:

{_id: 0, "a.n": 1, "a.m": 1}

ColumnScanStage proceeds alphabetically, first calling addCellToObject to materialize a.m, resulting in:

{ a: [ { m: 2.0 }, { m: 1.0 } ] }

Projection then continues to a.m. Because a.m is sparse, there is a call to readParentsIntoObject for the a component. This call overwrites the existing object children of the a array with empty objects:

{ a: [ {}, {} ] }

The final output of the projection is:

{a : [{n : 1 }, {}]}

The correct output would be:

{a: [{n: 1, m: 2 }, {m : 1 }]}



 Comments   
Comment by Githook User [ 23/Jun/22 ]

Author:

{'name': 'Justin Seyster', 'email': 'justin.seyster@mongodb.com', 'username': 'jseyster'}

Message: SERVER-67250 Do not overwrite existing objects in 'addToArray()'
Branch: master
https://github.com/mongodb/mongo/commit/73c081e2bab1ed47ea615f01f953b6f09be0f8e8

Comment by Justin Seyster [ 13/Jun/22 ]

I have a proposed fix in the works for the counterexample in the ticket description.

Generated at Thu Feb 08 06:07:39 UTC 2024 using Jira 9.7.1#970001-sha1:2222b88b221c4928ef0de3161136cc90c8356a66.