OPERATIONAL DEFECT DATABASE
...
...
BugZero found this defect 2856 days ago.
When using $bucketAuto with an $addToSet accumulator within the 'output' document can crash mongod. An example query that can crash mongod: db.tweets.aggregate([ { $bucketAuto: { groupBy: "$user.location", buckets: 1, output: { count: { $sum: 1 }, location: { $addToSet: "$user.location" } } } } ]) This query is probably silly/not-useful because I think specifying no 'output' field would return a similar result (this was just me playing around), but I thought the mongod crash was unexpected. When mongod crashes, the following is logged before a backtrace: 2016-12-13T12:59:10.048+0100 F - [conn2] Invalid operation at address: 0x7f1d43ba990a 2016-12-13T12:59:10.061+0100 F - [conn2] Got signal: 8 (Floating point exception). 0x7f1d443e0f91 0x7f1d443e0089 0x7f1d443e06f6 0x7f1d42153100 0x7f1d43ba990a 0x7f1d43ba91df 0x7f1d43bc8d2e 0x7f1d43bcae3a 0x7f1d43bce255 0x7f1d43ca4492 0x7f1d43a3b0a5 0x7f1d43a3b29c 0x7f1d43a3b893 0x7f1d43d3c31a 0x7f1d43d3cc3b 0x7f1d4398447b 0x7f1d439859a9 0x7f1d438feb2b 0x7f1d438ffd70 0x7f1d43f12afd 0x7f1d43b1c54d 0x7f1d4371082d 0x7f1d4371116d 0x7f1d4435ec22 0x7f1d4214bdc5 0x7f1d41e78ced
david.storch commented on Fri, 16 Dec 2016 21:53:50 +0000: This has been fixed by https://github.com/mongodb/mongo/commit/37e720678f6e468726c6cc775a5dc898d080f0f3 under SERVER-25535, so I'm closing this ticket as a duplicate. We are currently looking into the feasibility of backporting the fixing commit to the 3.4 branch. Please watch SERVER-25535 for updates. david.storch commented on Tue, 13 Dec 2016 18:20:45 +0000: This will be fixed by work that is currently in code review under SERVER-25535. I'm leaving this ticket open in order to assess whether or not we would like to build a targeted fix for backport. david.storch commented on Tue, 13 Dec 2016 17:07:03 +0000: Thanks for the detailed report tim@elementspace.com. I can reproduce as you describe. We're looking into it now. tvaillancourt commented on Tue, 13 Dec 2016 13:34:29 +0000: One missing detail I should mention: I did not see this issue with other accumulators such as $push. This works, for example: db.tweets.aggregate([ { $bucketAuto: { groupBy: "$user.location", buckets: 1, output: { count: { $sum: 1 }, location: { $push: "$user.location" } } } } ])
Scripts attached in the attached tar.gz file, including an already-crashed mongod dbpath (data/*) and log (mongod.log). Steps: 1) Download 3.4.0 to /opt/mongodb-linux-x86_64-3.4.0 (or modify the scripts) 2) "./prepare.sh" - starts mongod and inserts 1 x doc 3) "./run.sh" - runs the aggregate query, crashes mongod
