Server crashes when executing SELECT * FROM bson_dollar_project(...); · Issue #463 · documentdb/documentdb · GitHub
Skip to content

Server crashes when executing SELECT * FROM bson_dollar_project(...); #463

Closed

Description

@yehoto

Describe the bug
Server crashes when replaying the attached postmaster.log with pgreplay

Environment

  • Operating system and version: Ubuntu2404
  • PostgreSQL version: 17
  • Architecture: x86_64 (64-bit)

Reproduction Steps
(Run build_documentdb.sh to build DocumentDB)

  1. Start the server using start_oss_server.sh:
PG_VERSION_USED=17 ./start_oss_server.sh -d /tmp/pgsql/data -p 5432
  1. Execute the attached postmaster.log with pgreplay in a loop
for i in $(seq 10); do ~/pgreplay/pgreplay postmaster.log; coredumpctl && break; done

Content of postmaster.log:

2026-02-15 17:03:02.970 MSK|postgres|postgres|6991d216.102409|LOG:  statement: SET search_path TO documentdb_core,documentdb_api,documentdb_api_catalog,documentdb_api_internal;
2026-02-15 17:03:02.982 MSK|postgres|postgres|6991d216.102409|LOG:  statement: SELECT * FROM bson_dollar_project('{}', '{"result": {"$let": {"vars": {"variable": "with space"}, "in": "_variable"}}}'); 

Expected behavior
Expected ERROR to be shown or sql query to be successfully executed

Actual behavior
Segmentation Fault
Backtrace:

Program terminated with signal SIGSEGV, Segmentation fault.
#0  ParseDollarLet (argument=<optimized out>, data=0x5f95322aa920, context=0x7ffebf372418) at src/operators/bson_expression.c:2858
2858            inputVariableContext->preserveVariableTable = true;
(gdb) bt
#0  ParseDollarLet (argument=<optimized out>, data=0x5f95322aa920, context=0x7ffebf372418) at src/operators/bson_expression.c:2858
#1  0x000077180c14b873 in ParseDocumentAggregationExpressionData (parseContext=0x7ffebf372418, expressionData=0x5f95322aa920, value=<optimized out>)
    at src/operators/bson_expression.c:2511
#2  ParseAggregationExpressionData (expressionData=0x5f95322aa920, value=<optimized out>, context=0x7ffebf372418) at src/operators/bson_expression.c:1750
#3  0x000077180c0c50d0 in ValidateAndSetLeafNodeData (childNode=childNode@entry=0x5f95322aa8f8, value=value@entry=0x7ffebf3723b0,
    relativePath=relativePath@entry=0x7ffebf372170, treatAsConstantExpression=<optimized out>, parseContext=parseContext@entry=0x7ffebf372418)
    at src/aggregation/bson_tree.c:572
#4  0x000077180c0bfeeb in BuildBsonPathTreeCore (pathSpecification=pathSpecification@entry=0x7ffebf372380, tree=tree@entry=0x5f95322aaea0,
    context=context@entry=0x7ffebf372410, forceLeafExpression=forceLeafExpression@entry=false) at src/aggregation/bson_projection_tree.c:222
#5  0x000077180c0c0288 in BuildBsonPathTree (pathSpecification=0x7ffebf372380, context=context@entry=0x7ffebf372410, forceLeafExpression=forceLeafExpression@entry=false,
    hasFields=hasFields@entry=0x7ffebf3722c7) at src/aggregation/bson_projection_tree.c:84
#6  0x000077180c0bc009 in BuildBsonPathTreeForDollarProjectCore (state=state@entry=0x5f95322aae58, projectionContext=projectionContext@entry=0x7ffebf372310,
    pathTreeContext=pathTreeContext@entry=0x7ffebf372410) at src/aggregation/bson_project.c:1773
#7  0x000077180c0be21b in BuildBsonPathTreeForDollarProject (projectionContext=0x7ffebf372310, state=0x5f95322aae58) at src/aggregation/bson_project.c:1720
#8  bson_dollar_project (fcinfo=0x5f95322aa860) at src/aggregation/bson_project.c:242
#9  0x00005f9530aea457 in ExecInterpExpr (state=0x5f95322aa790, econtext=0x5f95322aa980, isnull=<optimized out>) at execExprInterp.c:764
#10 0x00005f9530bdb0de in ExecEvalExprSwitchContext (isNull=0x7ffebf3725e4, econtext=<optimized out>, state=0x5f95322aa790)
    at ../../../../src/include/executor/executor.h:357
#11 evaluate_expr (expr=<optimized out>, result_type=result_type@entry=16386, result_typmod=result_typmod@entry=-1, result_collation=result_collation@entry=0)
    at clauses.c:5009
#12 0x00005f9530bdb321 in evaluate_function (func_tuple=0x77180f7dfbf8, context=0x7ffebf372840, funcvariadic=false, args=0x5f95321f8470, input_collid=0, result_collid=0,
    result_typmod=-1, result_type=16386, funcid=17983) at clauses.c:4515
#13 simplify_function (funcid=17983, result_type=16386, result_typmod=-1, result_collid=result_collid@entry=0, input_collid=input_collid@entry=0,
    args_p=args_p@entry=0x7ffebf372780, funcvariadic=false, process_args=true, allow_non_const=true, context=0x7ffebf372840) at clauses.c:4104
#14 0x00005f9530bdc00d in eval_const_expressions_mutator (node=<optimized out>, context=0x7ffebf372840) at clauses.c:2591
#15 0x00005f9530b55b6b in expression_tree_mutator_impl (node=0x5f95321f74f0, mutator=0x5f9530bdbb30 <eval_const_expressions_mutator>, context=0x7ffebf372840)
    at nodeFuncs.c:3688
#16 0x00005f9530b55d62 in expression_tree_mutator_impl (node=0x5f95321f7538, mutator=0x5f9530bdbb30 <eval_const_expressions_mutator>, context=0x7ffebf372840)
--Type <RET> for more, q to quit, c to continue without paging--
    at nodeFuncs.c:3545
#17 0x00005f9530bdd19a in eval_const_expressions (root=root@entry=0x5f95321b8a60, node=<optimized out>) at clauses.c:2266
#18 0x00005f9530bd34e8 in preprocess_function_rtes (root=root@entry=0x5f95321b8a60) at prepjointree.c:900
#19 0x00005f9530bc8d5a in subquery_planner (glob=glob@entry=0x5f95321f7b18, parse=parse@entry=0x5f95321b8260, parent_root=parent_root@entry=0x0,
    hasRecursion=hasRecursion@entry=false, tuple_fraction=tuple_fraction@entry=0, setops=setops@entry=0x0) at planner.c:723
#20 0x00005f9530bc9a32 in standard_planner (parse=0x5f95321b8260, query_string=<optimized out>, cursorOptions=2048, boundParams=0x0) at planner.c:416
#21 0x000077180c166725 in DocumentDBApiPlanner (parse=0x5f95321b8260,
    queryString=0x5f95321b7178 "SELECT * FROM bson_dollar_project('{}', '{\"result\": {\"$let\": {\"vars\": {\"variable\": \"with space\"}, \"in\": \"_variable\"}}}'); ",
    cursorOptions=2048, boundParams=0x0) at src/planner/documents_planner.c:264
#22 0x00005f9530c923ce in pg_plan_query (querytree=querytree@entry=0x5f95321b8260,
    query_string=query_string@entry=0x5f95321b7178 "SELECT * FROM bson_dollar_project('{}', '{\"result\": {\"$let\": {\"vars\": {\"variable\": \"with space\"}, \"in\": \"_variable\"}}}'); ", cursorOptions=cursorOptions@entry=2048, boundParams=boundParams@entry=0x0) at postgres.c:908
#23 0x00005f9530c924c3 in pg_plan_queries (querytrees=0x5f95321f79e8,
    query_string=query_string@entry=0x5f95321b7178 "SELECT * FROM bson_dollar_project('{}', '{\"result\": {\"$let\": {\"vars\": {\"variable\": \"with space\"}, \"in\": \"_variable\"}}}'); ", cursorOptions=cursorOptions@entry=2048, boundParams=boundParams@entry=0x0) at postgres.c:1000
#24 0x00005f9530c92782 in exec_simple_query (
    query_string=0x5f95321b7178 "SELECT * FROM bson_dollar_project('{}', '{\"result\": {\"$let\": {\"vars\": {\"variable\": \"with space\"}, \"in\": \"_variable\"}}}'); ")
    at postgres.c:1197
#25 0x00005f9530c93c0b in PostgresMain (dbname=<optimized out>, username=<optimized out>) at postgres.c:4767
#26 0x00005f9530c8ee55 in BackendMain (startup_data=<optimized out>, startup_data_len=<optimized out>) at backend_startup.c:105
#27 0x00005f9530bff5cf in postmaster_child_launch (child_type=child_type@entry=B_BACKEND, startup_data=startup_data@entry=0x7ffebf372f10 "",
    startup_data_len=startup_data_len@entry=4, client_sock=client_sock@entry=0x7ffebf372f30) at launch_backend.c:277
#28 0x00005f9530c03099 in BackendStartup (client_sock=0x7ffebf372f30) at postmaster.c:3594
#29 ServerLoop () at postmaster.c:1676
#30 0x00005f9530c04e31 in PostmasterMain (argc=argc@entry=5, argv=argv@entry=0x5f9532171120) at postmaster.c:1374
#31 0x00005f9530942ab2 in main (argc=5, argv=0x5f9532171120) at main.c:199

Best regards,
Anna Likhtinfeld
Postgres Professional (http://postgrespro.com/)

Activity

  1. visridha commented on Feb 19, 2026

    @visridha
    Contributor

    @CorneliusOsei2 Could you assign this to yourself and take a look?

  2. added theissue type on Feb 19, 2026
  3. CorneliusOsei2 commented on Feb 20, 2026

    @CorneliusOsei2
    Contributor

    Sure thing!

  4. linked a pull request that will close this issueDocumentDB Sync 20260217 #459on Feb 24, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Type

Projects

No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions