Launching soon: The world's first vendor agnostic bug scrubLearn more & join waitlist
OPERATIONAL DEFECT DATABASE
...
...
This was a result of an aggregation_expression_multiversion_fuzzer run here. The pipeline that caused the failure was {"$project":{"a":{"$add":[{"$numberDecimal":"236.27711376769366"},{"$date":"2019-01-30T07:30:10.137Z"},93369,"$obj.obj.obj.num"]},"_id":0}} // 63 And the offending document was {_id: 795, "str": "Generic Cotton", "num": NumberLong("59052"), "date": new Date("2019-10-23T11:18:26.197Z"), "array": ["hacking Trail", new Date("2019-09-28T08:32:07.826Z"), {_id: 796, "str": "Gloves", "num": NumberInt(38192), "date": new Date("2019-06-17T13:26:06.579Z"), "array": [], "obj": {_id: 797, "str": "Rubber Executive synthesizing", "num": NumberLong("3345"), "array": [new Date("2019-02-12T08:50:16.240Z"), "full-range", NaN], }, }, NumberLong("58726"), {_id: 798, "str": "Grove Minnesota", "obj": {}, }, ["Soft overriding Credit Card Account", new Date("2019-06-11T21:54:58.779Z"), new Date("2019-11-15T07:02:19.029Z")], NumberLong("43776"), {_id: 799, "num": NumberDecimal("556.1485031177453"), "date": new Date("2019-01-31T02:54:44.487Z"), "array": [NaN, new Date("2019-07-13T20:56:58.610Z"), NumberInt(87918)], }, [NumberLong("27821"), "Baht olive"], NumberDecimal("103.72360506453242")], "obj": {_id: 800, "num": NumberInt(98410), "array": null, "obj": {_id: 801, "date": new Date("2019-10-14T06:31:08.955Z"), "obj": {_id: 802, "str": null, "num": NumberDecimal("819.5359123621083"), "date": new Date("2019-04-26T02:33:00.523Z"), "array": [], }, }, }, }, // 136 The invariant tripped in the logs Error "Invariant failure","attr":{"expr":"Hit a MONGO_UNREACHABLE!","file":"src/mongo/db/exec/sbe/values/value.h","line":1125} "About to run the command","attr":{"db":"fuzzer","commandArgs":{"aggregate":"fuzzer_coll","pipeline":[{"$project":{"a":{"$add":[{"$numberDecimal":"236.27711376769366"},{"$date":"2019-01-30T07:30:10.137Z"},93369,"$obj.obj.obj.num"]},"_id":0}}],"maxTimeMS":30000,"collation":{"locale":"el","strength":1},"apiVersion":"1","cursor":{},"lsid":{"id":{"$uuid":"dce47dbf-436c-4638-90ed-0a42401e5d29"}},"$db":"fuzzer"}} "Invariant failure","attr":{"expr":"Hit a MONGO_UNREACHABLE!","file":"src/mongo/db/exec/sbe/values/value.h","line":1125} "\n\n***aborting after invariant() failure\n\n" "Writing fatal message","attr":{"message":"Got signal: 6 (Aborted).\n"} Possible Cause: We handle this case correctly if $add is evaluated using the doubleDoubleSum() builtin. However, there is constant folding going on for this query and $add is executed using genericArithemticOp which is trying to compute addition of a NumberDecimal and a Date. The MONGO_UNREACHABLE case is being hit when trying to cast a NumberDecimal to a long and it can't do that because of the std::is_same_v check. In the classic engine, we track decimal addition in 'decimalTotal' in a Decimal128 variable and then do decimal to long conversions at the end with a rounding scheme.
xgen-internal-githook commented on Sat, 8 May 2021 00:52:57 +0000: Author: {'name': 'Justin Seyster', 'email': 'justin.seyster@mongodb.com', 'username': 'jseyster'} Message: SERVER-56284 SBE support for binary $add with date operand Branch: master https://github.com/mongodb/mongo/commit/e38d21f042aba4992f2cfcb206fa0225bd7efa4f
Minimal reproduction with SBE on: db.foo.insert({a: NumberDecimal("819.5359123621083")}}}) db.foo.aggregate([{$project: {a: {$add: [new Date("2019-01-30T07:30:10.137Z"), "$a"]}, _id: 0}}]) Backtrace captured in gdb 0x00007ffff69a1737 in raise () from /lib/x86_64-linux-gnu/libpthread.so.0 (gdb) bt #0 0x00007ffff69a1737 in raise () from /lib/x86_64-linux-gnu/libpthread.so.0 #1 0x000055555f185670 in mongo::breakpoint () at src/mongo/util/debugger.cpp:72 #2 0x000055555f11da11 in mongo::invariantFailed (expr=0x55555fccc44d "Hit a MONGO_UNREACHABLE!", file=0x55555fccc428 "src/mongo/db/exec/sbe/values/value.h", line=1117) at src/mongo/util/assert_util.cpp:119 #3 0x000055555cf1f829 in mongo::sbe::value::numericCast (tag=mongo::sbe::value::TypeTags::NumberDecimal, val=140737120359477) at src/mongo/db/exec/sbe/values/value.h:1117 #4 0x000055555cf1bad9 in mongo::sbe::vm::(anonymous namespace)::genericArithmeticOp (lhsTag=mongo::sbe::value::TypeTags::NumberDecimal, lhsValue=140737120359477, rhsTag=mongo::sbe::value::TypeTags::Date, rhsValue=1548833503742) at src/mongo/db/exec/sbe/vm/arith.cpp:178 #5 0x000055555cf18581 in mongo::sbe::vm::ByteCode::genericAdd (this=0x7fffeb1e4f00, lhsTag=mongo::sbe::value::TypeTags::NumberDecimal, lhsValue=140737120359477, rhsTag=mongo::sbe::value::TypeTags::Date, rhsValue=1548833503742) at src/mongo/db/exec/sbe/vm/arith.cpp:376 #6 0x000055555cf36c10 in mongo::sbe::vm::ByteCode::run (this=0x7fffeb1e4f00, code=0x7ffff053fa20) at src/mongo/db/exec/sbe/vm/vm.cpp:3253 #7 0x000055555ced6278 in mongo::sbe::ProjectStage::getNext (this=0x7fffeb1e4e20) at src/mongo/db/exec/sbe/stages/project.cpp:86 #8 0x000055555ceca483 in mongo::sbe::MakeObjStageBase::getNext (this=0x7fffeaf01c20) at src/mongo/db/exec/sbe/stages/makeobj.cpp:362 #9 0x000055555cf095c0 in mongo::sbe::TraverseStage::traverse (this=0x7fffeaf00820, inFieldAccessor=0x7fffea110ce0, outFieldOutputAccessor=0x7fffeaf00920, level=0) at src/mongo/db/exec/sbe/stages/traverse.cpp:242 #10 0x000055555cf08de6 in mongo::sbe::TraverseStage::getNext (this=0x7fffeaf00820) at src/mongo/db/exec/sbe/stages/traverse.cpp:152 #11 0x000055555cbbdd81 in mongo::fetchNext (root=0x7fffeaf00820, resultSlot=0x7fffeaf00920, recordIdSlot=0x7fffeb204b00, out=0x7ffff7ebfb80, dlOut=0x0, returnOwnedBson=true) at src/mongo/db/query/plan_executor_sbe.cpp:315 #12 0x000055555cbbd55c in mongo::PlanExecutorSBE::getNext (this=0x7ffff08b7220, out=0x7ffff7ebfb80, dlOut=0x0) at src/mongo/db/query/plan_executor_sbe.cpp:234 #13 0x000055555c44fed9 in mongo::(anonymous namespace)::handleCursorCommand (opCtx=0x7fffea2dd020, expCtx=0x7fffea8de8a0 = {...}, nsForCursor=..., cursors=std::vector of length 1, capacity 1 = {...}, request=..., cmdObj=owned BSONObj 208 bytes @ 0x7 Classic engine behavior: > db.foo.aggregate([{$project: {a: {$add: [new Date("2019-01-30T07:30:10.137Z"), "$a"]}, _id: 0}}]) { "a" : ISODate("2019-01-30T07:30:10.957Z") }