[SERVER-82736] [BF-30666] sbe::UnwindStage does not correctly handle child yields Created: 02/Nov/23 Updated: 14/Nov/23 Resolved: 11/Nov/23 |
|
| Status: | Closed |
| Project: | Core Server |
| Component/s: | None |
| Affects Version/s: | None |
| Fix Version/s: | 7.3.0-rc0, 7.2.0-rc2 |
| Type: | Bug | Priority: | Major - P3 |
| Reporter: | Kevin Cherkauer | Assignee: | Kevin Cherkauer |
| Resolution: | Fixed | Votes: | 0 |
| Labels: | None | ||
| Remaining Estimate: | Not Specified | ||
| Time Spent: | Not Specified | ||
| Original Estimate: | Not Specified | ||
| Issue Links: |
|
||||||||
| Backwards Compatibility: | Fully Compatible | ||||||||
| Operating System: | ALL | ||||||||
| Backport Requested: |
v7.2
|
||||||||
| Sprint: | QE 2023-11-13, QE 2023-11-27 | ||||||||
| Participants: | |||||||||
| Linked BF Score: | 155 | ||||||||
| Description |
|
This is a previously existing latent bug that has been exposed by Apparently the prior internal uses of sbe::UnwindStage (e.g. in the SBE $lookup implementation) did not have the possibility of a child yielding under this stage, so the yield code paths were not exercised before. It looks like the bug has been latent for ~3 years. |
| Comments |
| Comment by Githook User [ 14/Nov/23 ] | ||||
|
Author: {'name': 'Kevin Cherkauer', 'email': 'kevin.cherkauer@mongodb.com', 'username': 'kevin-cherkauer'}Message: | ||||
| Comment by Githook User [ 11/Nov/23 ] | ||||
|
Author: {'name': 'Kevin Cherkauer', 'email': 'kevin.cherkauer@mongodb.com', 'username': 'kevin-cherkauer'}Message: | ||||
| Comment by Kevin Cherkauer [ 02/Nov/23 ] | ||||
|
The failing test jstests/aggregation/bugs/server5932.js --suite=aggregation_auth of memory accessed after being freed passes when run locally on a non-ASAN build but the failure reproduces with an ASAN build:
|