[SERVER-9405] Map/Reduce leads to Segmentation fault in 2.4.1 Created: 19/Apr/13  Updated: 10/Dec/14  Resolved: 01/Sep/13

Status: Closed
Project: Core Server
Component/s: MapReduce
Affects Version/s: 2.4.1
Fix Version/s: None

Type: Bug Priority: Major - P3
Reporter: Mezhenin Artem Assignee: Mathias Stearn
Resolution: Duplicate Votes: 0
Labels: None
Remaining Estimate: Not Specified
Time Spent: Not Specified
Original Estimate: Not Specified

Issue Links:
Duplicate
duplicates SERVER-9089 'Cloning' a document in JavaScript ca... Closed
Operating System: ALL
Steps To Reproduce:

$ mongo
MongoDB shell version: 2.4.1
connecting to: test
> db.t.find()
{ "_id" : ObjectId("517129d195ae71f6cc3ccd34"), "b" : "firefox", "ec" :

{ "1" : 2, "2" : 3 }

}
{ "_id" : ObjectId("517129d995ae71f6cc3ccd35"), "b" : "firefox2", "ec" :

{ "2" : 3 }

}
{ "_id" : ObjectId("517129e095ae71f6cc3ccd36"), "b" : "firefox3", "ec" : { } }
> var r = function(key, values)

{ ... return 1; ... }

;
> map = function(){
... var value = Object.create(this.ec);
... value.b = {}; value.b[this.b] = 1;
... emit('123', value);
... }
function (){
var value = Object.create(this.ec);
value.b = {}; value.b[this.b] = 1;
emit('123', value);
}
> db.t.mapReduce(map, r,

{out: 'test'}

)
Fri Apr 19 17:34:16.475 DBClientCursor::init call() failed
Fri Apr 19 17:34:16.477 JavaScript execution failed: Error: error doing query: failed at src/mongo/shell/query.js:L78
Fri Apr 19 17:34:16.478 trying reconnect to 127.0.0.1:27017
Fri Apr 19 17:34:16.478 reconnect 127.0.0.1:27017 failed couldn't connect to server 127.0.0.1:27017

=================

$ sudo tail -n 50 /var/log/mongodb/mongodb.log
Fri Apr 19 15:53:13.660 [conn9] CMD: drop test.tmp.mr.t_4
Fri Apr 19 15:53:13.660 [conn9] CMD: drop test.tmp.mr.t_4_inc
Fri Apr 19 15:53:13.660 [conn9] CMD: drop test.tmp.mr.t_4
Fri Apr 19 15:53:13.661 [conn9] CMD: drop test.tmp.mr.t_4_inc
Fri Apr 19 15:57:34.532 [initandlisten] connection accepted from 127.0.0.1:45999 #10 (9 connections now open)
Fri Apr 19 15:57:35.975 [initandlisten] connection accepted from 127.0.0.1:46005 #11 (10 connections now open)
Fri Apr 19 15:57:52.089 [initandlisten] connection accepted from 127.0.0.1:46072 #12 (11 connections now open)
Fri Apr 19 17:10:51.496 [conn9] end connection 127.0.0.1:44763 (10 connections now open)
Fri Apr 19 17:10:55.846 [initandlisten] connection accepted from 127.0.0.1:38164 #13 (11 connections now open)
Fri Apr 19 17:29:54.017 [conn13] end connection 127.0.0.1:38164 (10 connections now open)
Fri Apr 19 17:29:56.047 [initandlisten] connection accepted from 127.0.0.1:43164 #14 (11 connections now open)
Fri Apr 19 17:30:21.397 [conn14] end connection 127.0.0.1:43164 (10 connections now open)
Fri Apr 19 17:30:22.412 [initandlisten] connection accepted from 127.0.0.1:43290 #15 (11 connections now open)
Fri Apr 19 17:33:41.091 [conn15] CMD: drop test.tmp.mr.t_5
Fri Apr 19 17:33:41.092 [conn15] CMD: drop test.tmp.mr.t_5_inc
Fri Apr 19 17:33:41.092 [conn15] build index test.tmp.mr.t_5_inc

{ 0: 1 }

Fri Apr 19 17:33:41.092 [conn15] build index done. scanned 0 total records. 0 secs
Fri Apr 19 17:33:41.092 [conn15] build index test.tmp.mr.t_5

{ _id: 1 }

Fri Apr 19 17:33:41.093 [conn15] build index done. scanned 0 total records. 0 secs
cannot write property b to read-only object
Fri Apr 19 17:33:41.095 [conn15] JavaScript execution failed: TypeError: Cannot set property 'firefox' of undefined near 'b[this.b] = 1' (line 3)
Fri Apr 19 17:33:41.096 [conn15] CMD: drop test.tmp.mr.t_5
Fri Apr 19 17:33:41.096 [conn15] CMD: drop test.tmp.mr.t_5_inc
Fri Apr 19 17:33:41.097 [conn15] mr failed, removing collection :: caused by :: 16722 JavaScript execution failed: TypeError: Cannot set property 'firefox' of undefined near 'b[this.b] = 1' (line 3)
Fri Apr 19 17:33:41.097 [conn15] CMD: drop test.tmp.mr.t_5
Fri Apr 19 17:33:41.097 [conn15] CMD: drop test.tmp.mr.t_5_inc
Fri Apr 19 17:34:16.469 [conn15] CMD: drop test.tmp.mr.t_6
Fri Apr 19 17:34:16.469 [conn15] CMD: drop test.tmp.mr.t_6_inc
Fri Apr 19 17:34:16.469 [conn15] build index test.tmp.mr.t_6_inc

{ 0: 1 }

Fri Apr 19 17:34:16.470 [conn15] build index done. scanned 0 total records. 0 secs
Fri Apr 19 17:34:16.470 [conn15] build index test.tmp.mr.t_6

{ _id: 1 }

Fri Apr 19 17:34:16.470 [conn15] build index done. scanned 0 total records. 0 secs
Fri Apr 19 17:34:16.470 Invalid access at address: 0x18 from thread: conn15

Fri Apr 19 17:34:16.470 Got signal: 11 (Segmentation fault).

Fri Apr 19 17:34:16.473 Backtrace:
0xdc7f71 0x6ce459 0x6ce9e2 0x7f19d9a9b030 0xd63ad0 0xd629fc 0xd63284 0xd6e135 0xd66b40 0xf1a3f2 0x3bfa4cc06362
/usr/bin/mongod(_ZN5mongo15printStackTraceERSo+0x21) [0xdc7f71]
/usr/bin/mongod(_ZN5mongo10abruptQuitEi+0x399) [0x6ce459]
/usr/bin/mongod(_ZN5mongo24abruptQuitWithAddrSignalEiP7siginfoPv+0x262) [0x6ce9e2]
/lib/x86_64-linux-gnu/libpthread.so.0(+0xf030) [0x7f19d9a9b030]
/usr/bin/mongod(_ZN5mongo7V8Scope9v8ToMongoEN2v86HandleINS1_6ObjectEEEi+0x160) [0xd63ad0]
/usr/bin/mongod(_ZN5mongo7V8Scope15v8ToMongoObjectERNS_14BSONObjBuilderERKSsN2v86HandleINS5_5ValueEEEiPNS_7BSONObjE+0x2bc) [0xd629fc]
/usr/bin/mongod(_ZN5mongo7V8Scope16v8ToMongoElementERNS_14BSONObjBuilderERKSsN2v86HandleINS5_5ValueEEEiPNS_7BSONObjE+0x624) [0xd63284]
/usr/bin/mongod(_ZN5mongo7V8Scope14nativeCallbackEPS0_RKN2v89ArgumentsE+0x245) [0xd6e135]
/usr/bin/mongod(_ZN5mongo7V8Scope10v8CallbackERKN2v89ArgumentsE+0xb0) [0xd66b40]
/usr/bin/mongod() [0xf1a3f2]
[0x3bfa4cc06362]

Participants:

 Comments   
Comment by Mathias Stearn [ 19/Apr/13 ]

The segfault is due to mishandling objects that have BSON-derived objects as protoypes (which is how Object.create() works). If instead you just did var value = this.ec or var value = Object.extend({}, this.ec) it should work.

The segfault was actually fixed yesterday as part of SERVER-9089. However, even with the fix, when converting from js objects back to BSON (mongodb's internal representation of objects) we intentionally ignore prototypes (ie all fields where hasOwnProperty() is false). The idea is to preserve only the data that is unique to that object. As such, using Object.create will yield the wrong results, even if it didn't segfault.

Generated at Thu Feb 08 03:20:19 UTC 2024 using Jira 9.7.1#970001-sha1:2222b88b221c4928ef0de3161136cc90c8356a66.