Info

The problem is caused by the SBE lookup hash table under specific conditions. The query to trigger it can be just a simple lookup: db.local.aggregate({$lookup: {from: 'foreign', localField: 'k', foreignField: 'k', as: 'out'}}) The conditions to trigger the bug are: $lookup must use SBE SBE must choose a hash join algorithm The hash table must be more than 100 MB to cause spilling Adding an already existing key to the hash table is what must cause the spilling The triggering hash table key must be stored in a heap memory. For example: object, array, large string Under these circumstances, the unnecessary “key” variable will wrongly assume ownership of tagKeyView / valKeyView. This leads to a double-free of the same value: when the “key” variable leaves the scope and whenever the keyAccessor releases its value.

Top User Comments

xgen-internal-githook commented on Wed, 18 Feb 2026 19:35:57 +0000: Author: {'name': 'Ivan Fefer', 'email': 'ivan.fefer@mongodb.com', 'username': 'Fefer-Ivan'} Message: SERVER-118849 Fix hash lookup when duplicate key causes spilling (#47637) GitOrigin-RevId: 1e2935fe52fb0286c4133a4bf1833e2708dc9ce1 Branch: v8.0 https://github.com/mongodb/mongo/commit/1e80bd542eb870169387b66db695917f84816672 xgen-internal-githook commented on Wed, 18 Feb 2026 19:33:24 +0000: Author: {'name': 'Ivan Fefer', 'email': 'ivan.fefer@mongodb.com', 'username': 'Fefer-Ivan'} Message: SERVER-118849 Fix hash lookup when duplicate key causes spilling (#47636) GitOrigin-RevId: 83751c5457fea4cdc4a4058bee4f3b8b08245b46 Branch: v8.2 https://github.com/mongodb/mongo/commit/e03c939eb65bf0ea129a2342e25e50750c674c8d xgen-internal-githook commented on Wed, 4 Feb 2026 19:36:49 +0000: Author: {'name': 'Ivan Fefer', 'email': 'ivan.fefer@mongodb.com', 'username': 'Fefer-Ivan'} Message: SERVER-118849 Fix hash lookup when duplicate key causes spilling (#47561) GitOrigin-RevId: 339efc674f7f7e5de76e60b49d868fad7a12f29b Branch: master https://github.com/mongodb/mongo/commit/91bf9dba7693d206d6e30cdf8450c3a97461dc23

Steps to Reproduce