[SERVER-9778] $where causes Matcher2 to access a data record in its constructor Created: 24/May/13  Updated: 05/May/14  Resolved: 13/Jan/14

Status: Closed
Project: Core Server
Component/s: JavaScript, Querying
Affects Version/s: None
Fix Version/s: None

Type: Bug Priority: Major - P3
Reporter: Eric Milkie Assignee: Matt Kangas
Resolution: Duplicate Votes: 0
Labels: query_triage
Remaining Estimate: Not Specified
Time Spent: Not Specified
Original Estimate: Not Specified

Issue Links:
Related
is related to SERVER-10181 fassert during parallel/basicPlus.js ... Closed
Backwards Compatibility: Fully Compatible
Operating System: ALL
Steps To Reproduce:

http://buildlogs.mongodb.org/Linux%2064-bit%20DEBUG/builds/2153/test/small%20oplog/where3.js

Participants:

 Description   

Fri May 24 11:18:27.025 [conn2494] update test.where4 query: { $where: function () { return this.x == 1; } } update: { $inc: { y: 1.0 } } nscanned:2 nupdated:1 keyUpdates:0 locks(micros) w:241127 241ms
	
found a constructor in the call tree: mongo::Matcher2::Matcher2(mongo::BSONObj const&, bool)
 
_ZN5mongo8Matcher2C1ERKNS_7BSONObjEb
 
Fri May 24 11:18:27.060 [conn2494]  test.system.js Fatal Assertion 16236
 
0x10b8e55 0x1092f85 0x107ead4 0xb3e843 0xf0424a 0xcd7660 0xcd787a 0xcd5f36 0xe33bcc 0xe35ea8 0xdc4da4 0xdc5d27 0xdc96e5 0xbc0265 0xb989d7 0xdc98d2 0x1048921 0x104a584 0x1049701 0xe17ef9 
	
 /home/yellow/buildslave/Linux_64bit_DEBUG/mongo/mongod(_ZN5mongo15printStackTraceERSo+0x29) [0x10b8e55]
	
 /home/yellow/buildslave/Linux_64bit_DEBUG/mongo/mongod(_ZN5mongo10logContextEPKc+0x5e) [0x1092f85]
	
 /home/yellow/buildslave/Linux_64bit_DEBUG/mongo/mongod(_ZN5mongo13fassertFailedEi+0x65) [0x107ead4]
	
 /home/yellow/buildslave/Linux_64bit_DEBUG/mongo/mongod(_ZN5mongo7fassertEib+0x29) [0xb3e843]
	
 /home/yellow/buildslave/Linux_64bit_DEBUG/mongo/mongod(_ZNK5mongo6Record10_accessingEv+0x11c) [0xf0424a]
	
 /home/yellow/buildslave/Linux_64bit_DEBUG/mongo/mongod(_ZN5mongo6Record7getNextERKNS_7DiskLocE+0x24) [0xcd7660]
 
 /home/yellow/buildslave/Linux_64bit_DEBUG/mongo/mongod(_ZNK5mongo7Forward4nextERKNS_7DiskLocE+0x34) [0xcd787a]
	
 /home/yellow/buildslave/Linux_64bit_DEBUG/mongo/mongod(_ZN5mongo11BasicCursor7advanceEv+0x102) [0xcd5f36]
	
 /home/yellow/buildslave/Linux_64bit_DEBUG/mongo/mongod(_ZN5mongo23queryWithQueryOptimizerEiRKSsRKNS_7BSONObjERNS_5CurOpES4_S4_RKN5boost10shared_ptrINS_11ParsedQueryEEES4_RKNS_12ChunkVersionERNS7_10scoped_ptrINS_25PageFaultRetryableSectionEEERNSG_INS_19NoPageFaultsAllowedEEERNS_7MessageE+0x700) [0xe33bcc]
	
 /home/yellow/buildslave/Linux_64bit_DEBUG/mongo/mongod(_ZN5mongo8runQueryERNS_7MessageERNS_12QueryMessageERNS_5CurOpES1_+0x11a5) [0xe35ea8]
	
 /home/yellow/buildslave/Linux_64bit_DEBUG/mongo/mongod() [0xdc4da4]
	
 /home/yellow/buildslave/Linux_64bit_DEBUG/mongo/mongod(_ZN5mongo16assembleResponseERNS_7MessageERNS_10DbResponseERKNS_11HostAndPortE+0x305) [0xdc5d27]
	
 /home/yellow/buildslave/Linux_64bit_DEBUG/mongo/mongod(_ZN5mongo14DBDirectClient4callERNS_7MessageES2_bPSs+0x91) [0xdc96e5]
	
 /home/yellow/buildslave/Linux_64bit_DEBUG/mongo/mongod(_ZN5mongo14DBClientCursor4initEv+0xd7) [0xbc0265]
	
 /home/yellow/buildslave/Linux_64bit_DEBUG/mongo/mongod(_ZN5mongo12DBClientBase5queryERKSsNS_5QueryEiiPKNS_7BSONObjEii+0xeb) [0xb989d7]
	
 /home/yellow/buildslave/Linux_64bit_DEBUG/mongo/mongod(_ZN5mongo14DBDirectClient5queryERKSsNS_5QueryEiiPKNS_7BSONObjEii+0x6e) [0xdc98d2]
	
 /home/yellow/buildslave/Linux_64bit_DEBUG/mongo/mongod(_ZN5mongo5Scope10loadStoredEb+0x193) [0x1048921]
	
 /home/yellow/buildslave/Linux_64bit_DEBUG/mongo/mongod(_ZN5mongo11PooledScopeC1ERKSsPNS_5ScopeE+0x8a) [0x104a584]
	
 /home/yellow/buildslave/Linux_64bit_DEBUG/mongo/mongod(_ZN5mongo12ScriptEngine14getPooledScopeERKSsS2_+0x171) [0x1049701]
	
 /home/yellow/buildslave/Linux_64bit_DEBUG/mongo/mongod(_ZN5mongo20WhereMatchExpression4initERKNS_10StringDataES3_RKNS_7BSONObjE+0x249) [0xe17ef9]



 Comments   
Comment by Eliot Horowitz (Inactive) [ 24/Jun/13 ]

Note, the "temporary" in the commit message.

Comment by Matt Kangas [ 24/Jun/13 ]

Build fixed as of http://buildbot.10gen.cc/builders/Linux%2032-bit%20debug/builds/2962 on June 07

Comment by auto [ 06/Jun/13 ]

Author:

{u'username': u'erh', u'name': u'Eliot Horowitz', u'email': u'eliot@10gen.com'}

Message: SERVER-9778: tempoary fix for Matcher2 loading a javascript scope in its constructor
Branch: master
https://github.com/mongodb/mongo/commit/2c35c4c4aa5f98a8bae5cdacea9dc71bdc27eaed

Comment by Eliot Horowitz (Inactive) [ 06/Jun/13 ]

Going to push a temporary fix till we go through all Matcher uses.

Comment by Eric Milkie [ 06/Jun/13 ]

Still failing:
http://buildlogs.mongodb.org/Linux%2032-bit%20debug/builds/2955/test/js/where3.js

Generated at Thu Feb 08 03:21:25 UTC 2024 using Jira 9.7.1#970001-sha1:2222b88b221c4928ef0de3161136cc90c8356a66.