[SERVER-850] $where clause can crash server Created: 30/Mar/10 Updated: 26/Apr/10 Resolved: 30/Mar/10 |
|
| Status: | Closed |
| Project: | Core Server |
| Component/s: | None |
| Affects Version/s: | 1.4.0 |
| Fix Version/s: | None |
| Type: | Bug | Priority: | Major - P3 |
| Reporter: | Matt Mastracci | Assignee: | Eliot Horowitz (Inactive) |
| Resolution: | Done | Votes: | 0 |
| Labels: | None | ||
| Remaining Estimate: | Not Specified | ||
| Time Spent: | Not Specified | ||
| Original Estimate: | Not Specified | ||
| Environment: |
OSX: 10.3.0 Darwin Kernel Version 10.3.0: Fri Feb 26 11:58:09 PST 2010; root:xnu-1504.3.12~1/RELEASE_I386 i386 |
||
| Participants: |
| Description |
|
Run a $where clause and attempt to dereference a null value. The server will fail with "TypeError: this.x has no properties nofile_a:0" and assert. The server will no longer respond to queries: > db.foo.save( {a:1}) From the server: Tue Mar 30 10:16:52 JS Error: TypeError: this.x has no properties nofile_a:0 |
| Comments |
| Comment by Eliot Horowitz (Inactive) [ 30/Mar/10 ] |
|
i see. |
| Comment by Matt Mastracci [ 30/Mar/10 ] |
|
The issue seems to be that the client will re-print the previous server error on a client JS error. It's not a mongod error, but rather a dbshell issue. Should I open up another issue for that? |
| Comment by Eliot Horowitz (Inactive) [ 30/Mar/10 ] |
|
If i'm reading your comment correctly, then all the mongo code is fine. |
| Comment by Matt Mastracci [ 30/Mar/10 ] |
|
I'm trying it again now and it's not always fatal to the server. I did manage to get the server into a spot where it wouldn't respond to queries at all (and I couldn't reconnect). I've tried this over and over and it's not getting into the wedged state that it did for me the first couple of times. [update] I've retraced my steps and tried this over and over and can't reproduce it at all. When I look through the logs, I think that it was a different bug causing the confusion:
> db.dot.find({$where:"this.contents.body.segments.length > 10"})
> db.dot.find({"rebuild_dot":{"version"}}) |