<!-- 
RSS generated by JIRA (9.7.1#970001-sha1:2222b88b221c4928ef0de3161136cc90c8356a66) at Wed Feb 07 21:57:54 UTC 2024

It is possible to restrict the fields that are returned in this document by specifying the 'field' parameter in your request.
For example, to request only the issue key and summary append 'field=key&field=summary' to the URL of your request.
-->
<rss version="0.92" >
<channel>
    <title>MongoDB Jira</title>
    <link>https://jira.mongodb.org</link>
    <description>This file is an XML representation of an issue</description>
    <language>en-us</language>    <build-info>
        <version>9.7.1</version>
        <build-number>970001</build-number>
        <build-date>13-04-2023</build-date>
    </build-info>


<item>
            <title>[CXX-1] invalid use of DBClientBase object with DBClientCursor destructor that is tracked by v8</title>
                <link>https://jira.mongodb.org/browse/CXX-1</link>
                <project id="11980" key="CXX">C++ Driver</project>
                    <description>&lt;p&gt;I opened this originally under Core Server with Server-11741. I think this is where it belongs?&lt;/p&gt;

&lt;p&gt;In engine_v8.h, the following (global?) variables are used to track objects referenced by v8:&lt;br/&gt;
ObjTracker&amp;lt;BSONHolder&amp;gt; bsonHolderTracker;&lt;br/&gt;
ObjTracker&amp;lt;DBClientWithCommands&amp;gt; dbClientWithCommandsTracker;&lt;br/&gt;
ObjTracker&amp;lt;DBClientBase&amp;gt; dbClientBaseTracker;&lt;br/&gt;
ObjTracker&amp;lt;DBClientCursor&amp;gt; dbClientCursorTracker;&lt;br/&gt;
.&lt;br/&gt;
Objects tracked by these are deleted by v8 with the callback deleteOnCollect.&lt;/p&gt;

&lt;p&gt;The problem is that the dbClientCursorTracker may have references to DBClientCursors that reference an instance of a DBClientBase that is also tracked by v8. If v8 decides to delete the DBClientBase before an associated DBClientCursor, then the DBClientCursor will have a pointer to a DBClientBase that has already been deleted. The destructor will then crash on the following code:&lt;br/&gt;
_client-&amp;gt;sayPiggyBack( m );&lt;/p&gt;

&lt;p&gt;So, suppose we have a DBClientBase* foo, and DBClientCursor* bar, both of which are tracked by v8, and that bar-&amp;gt;_client == foo. If v8 destroys foo before bar, then the client may crash when destroying bar, due to bar&apos;s now bad reference to foo.&lt;/p&gt;</description>
                <environment></environment>
        <key id="106608">CXX-1</key>
            <summary>invalid use of DBClientBase object with DBClientCursor destructor that is tracked by v8</summary>
                <type id="1" iconUrl="https://jira.mongodb.org/secure/viewavatar?size=xsmall&amp;avatarId=14703&amp;avatarType=issuetype">Bug</type>
                                            <priority id="3" iconUrl="https://jira.mongodb.org/images/icons/priorities/major.svg">Major - P3</priority>
                        <status id="6" iconUrl="https://jira.mongodb.org/images/icons/statuses/closed.png" description="The issue is considered finished, the resolution is correct. Issues which are closed can be reopened.">Closed</status>
                    <statusCategory id="3" key="done" colorName="success"/>
                                    <resolution id="3">Duplicate</resolution>
                                        <assignee username="-1">Unassigned</assignee>
                                    <reporter username="zardosht">Zardosht Kasheff</reporter>
                        <labels>
                            <label>legacy-cxx</label>
                    </labels>
                <created>Fri, 17 Jan 2014 21:21:51 +0000</created>
                <updated>Thu, 10 Apr 2014 18:11:24 +0000</updated>
                            <resolved>Fri, 17 Jan 2014 22:04:58 +0000</resolved>
                                                                                        <votes>0</votes>
                                    <watches>2</watches>
                                                                                                                <comments>
                            <comment id="483944" author="acm" created="Fri, 17 Jan 2014 22:04:16 +0000"  >&lt;p&gt;Hi -&lt;/p&gt;

&lt;p&gt;The engine_v8.h code is part of the core server, so the &lt;a href=&quot;https://jira.mongodb.org/browse/SERVER-11741&quot; title=&quot;invalid use of DBClientBase object with DBClientCursor destructor that is tracked by v8&quot; class=&quot;issue-link&quot; data-issue-key=&quot;SERVER-11741&quot;&gt;&lt;del&gt;SERVER-11741&lt;/del&gt;&lt;/a&gt; is actually where this belongs.&lt;/p&gt;</comment>
                    </comments>
                <issuelinks>
                            <issuelinktype id="10010">
                    <name>Duplicate</name>
                                            <outwardlinks description="duplicates">
                                        <issuelink>
            <issuekey id="98614">SERVER-11741</issuekey>
        </issuelink>
                            </outwardlinks>
                                                        </issuelinktype>
                    </issuelinks>
                <attachments>
                    </attachments>
                <subtasks>
                    </subtasks>
                <customfields>
                                                                                                                                                                                                                                                                                                                                                                    <customfield id="customfield_15850" key="com.atlassian.jira.plugins.jira-development-integration-plugin:devsummary">
                        <customfieldname>Development</customfieldname>
                        <customfieldvalues>
                            
                        </customfieldvalues>
                    </customfield>
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        <customfield id="customfield_12550" key="com.pyxis.greenhopper.jira:gh-lexo-rank">
                        <customfieldname>Rank</customfieldname>
                        <customfieldvalues>
                            <customfieldvalue>2|hrvgu7:</customfieldvalue>

                        </customfieldvalues>
                    </customfield>
                                                                <customfield id="customfield_10558" key="com.pyxis.greenhopper.jira:gh-global-rank">
                        <customfieldname>Rank (Obsolete)</customfieldname>
                        <customfieldvalues>
                            <customfieldvalue>97570</customfieldvalue>
                        </customfieldvalues>
                    </customfield>
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            </customfields>
    </item>
</channel>
</rss>