Server crashes when executing SELECT document FROM bson_aggregation_find(...); · Issue #532 · documentdb/documentdb · GitHub
Skip to content

Server crashes when executing SELECT document FROM bson_aggregation_find(...); #532

Closed

Description

@yehoto

Describe the bug

Server crashes when executing the attached test.sql script.

Environment

  • Operating system and version: Ubuntu2404
  • PostgreSQL version: 17
  • Architecture: x86_64 (64-bit)

Reproduction Steps
(Run build_documentdb.sh to build DocumentDB)

  1. Start the server using start_oss_server.sh:
PG_VERSION_USED=17 ./start_oss_server.sh -d /tmp/pgsql/data -p 5432 -x -r -c
  1. Execute test.sql:
psql -h 127.0.0.1 -d postgres -p 5432 -f test.sql

Content of test.sql:

SELECT documentdb_api.insert('db', '{"insert":"targetCollForView", "documents":[{ "_id" : 1, "a" : 1  }]}');
SELECT documentdb_api.create_collection_view('db', '{ "create": "targetView", "viewOn": "targetCollForView", "pipeline": [ { "$sort": { "a": 1 } } ] }');
SET search_path TO documentdb_api,documentdb_core,documentdb_api_catalog;
SELECT document FROM bson_aggregation_find('db', '{ "find": "targetView", "projection": {}, "sort": { "$natural": 1 }}');

Expected behavior
Expected ERROR to be shown or sql query to be successfully executed

Actual behavior
Segmentation Fault
Backtrace:

Program terminated with signal SIGSEGV, Segmentation fault.
#0  0x00006167b4454039 in bms_add_members (a=0x4ea000000023, b=b@entry=0x6167b6a80720) at bitmapset.c:939
939             if (a->nwords < b->nwords)
(gdb) bt
#0  0x00006167b4454039 in bms_add_members (a=0x4ea000000023, b=b@entry=0x6167b6a80720) at bitmapset.c:939
#1  0x00006167b44d223c in add_vars_to_targetlist (root=root@entry=0x6167b6a7fe48, vars=vars@entry=0x6167b6a806d8, where_needed=0x6167b6a80720)
    at initsplan.c:314
#2  0x00006167b44d22d7 in build_base_rel_tlists (root=0x6167b6a7fe48, final_tlist=<optimized out>) at initsplan.c:243
#3  0x00006167b44d54b9 in query_planner (root=root@entry=0x6167b6a7fe48, qp_callback=qp_callback@entry=0x6167b44d5be0 <standard_qp_callback>,
    qp_extra=qp_extra@entry=0x7ffc87de3490) at planmain.c:182
#4  0x00006167b44da9d7 in grouping_planner (root=root@entry=0x6167b6a7fe48, tuple_fraction=<optimized out>, tuple_fraction@entry=0,
    setops=setops@entry=0x0) at planner.c:1553
#5  0x00006167b44dd9a3 in subquery_planner (glob=glob@entry=0x6167b6a7fbb0, parse=parse@entry=0x6167b68e5320, parent_root=parent_root@entry=0x0,
    hasRecursion=hasRecursion@entry=false, tuple_fraction=tuple_fraction@entry=0, setops=setops@entry=0x0) at planner.c:1122
#6  0x00006167b44ddd32 in standard_planner (parse=0x6167b68e5320, query_string=query_string@entry=0x0, cursorOptions=2048, boundParams=0x0)
    at planner.c:416
#7  0x000072b7b5520c06 in distributed_planner (parse=0x6167b68e5320,
    query_string=0x6167b6868128 "SELECT document FROM bson_aggregation_find('db', '{ \"find\": \"targetView\", \"projection\": {}, \"sort\": { \"$natural\": -1 }}');", cursorOptions=<optimized out>, boundParams=0x0) at planner/distributed_planner.c:276
#8  0x000072b7b1f7081d in DocumentDBApiPlanner (parse=0x6167b68e5320,
    queryString=0x6167b6868128 "SELECT document FROM bson_aggregation_find('db', '{ \"find\": \"targetView\", \"projection\": {}, \"sort\": { \"$natural\": -1 }}');", cursorOptions=2048, boundParams=0x0) at src/planner/documents_planner.c:221
#9  0x00006167b45a66ce in pg_plan_query (querytree=querytree@entry=0x6167b6869230,
    query_string=query_string@entry=0x6167b6868128 "SELECT document FROM bson_aggregation_find('db', '{ \"find\": \"targetView\", \"projection\": {}, \"sort\": { \"$natural\": -1 }}');", cursorOptions=cursorOptions@entry=2048, boundParams=boundParams@entry=0x0) at postgres.c:908
#10 0x00006167b45a67c3 in pg_plan_queries (querytrees=0x6167b68e4b68,
    query_string=query_string@entry=0x6167b6868128 "SELECT document FROM bson_aggregation_find('db', '{ \"find\": \"targetView\", \"projection\": {}, \"sort\": { \"$natural\": -1 }}');", cursorOptions=cursorOptions@entry=2048, boundParams=boundParams@entry=0x0) at postgres.c:1000
#11 0x00006167b45a6a82 in exec_simple_query (
    query_string=0x6167b6868128 "SELECT document FROM bson_aggregation_find('db', '{ \"find\": \"targetView\", \"projection\": {}, \"sort\": { \"$natural\": -1 }}');") at postgres.c:1197
#12 0x00006167b45a7f0b in PostgresMain (dbname=<optimized out>, username=<optimized out>) at postgres.c:4767
#13 0x00006167b45a3155 in BackendMain (startup_data=<optimized out>, startup_data_len=<optimized out>) at backend_startup.c:105
#14 0x00006167b45138cf in postmaster_child_launch (child_type=child_type@entry=B_BACKEND, startup_data=startup_data@entry=0x7ffc87de3da0 "",
    startup_data_len=startup_data_len@entry=4, client_sock=client_sock@entry=0x7ffc87de3dc0) at launch_backend.c:277
#15 0x00006167b4517399 in BackendStartup (client_sock=0x7ffc87de3dc0) at postmaster.c:3594
#16 ServerLoop () at postmaster.c:1676
#17 0x00006167b4519131 in PostmasterMain (argc=argc@entry=3, argv=argv@entry=0x6167b6822120) at postmaster.c:1374
#18 0x00006167b4256462 in main (argc=3, argv=0x6167b6822120) at main.c:199

Best regards,
Anna Likhtinfeld
Postgres Professional (http://postgrespro.com/)

Activity

  1. changanhan commented on Apr 3, 2026

    @changanhan
    Contributor

    I can take care of this issue.

  2. documentdb-triage-tool commented on May 30, 2026

    @documentdb-triage-tool

    👋 @changanhan — this issue has been assigned for 31 days with no activity. Is it still in progress? If you've made progress, please leave a quick update. Otherwise it'll be flagged for re-assignment at the next triage meeting.

  3. documentdb-triage-tool commented on Jun 13, 2026

    @documentdb-triage-tool

    👋 @changanhan — this issue has been assigned for 14 days with no activity. Is it still in progress? If you've made progress, please leave a quick update. Otherwise it'll be flagged for re-assignment at the next triage meeting.

  4. documentdb-triage-tool commented on Jun 28, 2026

    @documentdb-triage-tool

    👋 @changanhan — this issue has been assigned for 14 days with no activity. Is it still in progress? If you've made progress, please leave a quick update. Otherwise it'll be flagged for re-assignment at the next triage meeting.

  5. documentdb-triage-tool commented on Jul 13, 2026

    @documentdb-triage-tool

    👋 @changanhan — this issue has been assigned for 15 days with no activity. Is it still in progress? If you've made progress, please leave a quick update. Otherwise it'll be flagged for re-assignment at the next triage meeting.

  6. added this to the 0.114-0 milestone on Jul 24, 2026
  7. guanzhousongmicrosoft commented on Aug 1, 2026

    @guanzhousongmicrosoft
    Member

    Verified fixed in the published v0.114-0 (fix 0974808): the exact test.sql returns the row for both $natural: 1 and $natural: -1 with the backend alive (no segfault). Guarded in HandleSort (base-relation-only $natural) and covered by commands_create_view_tests. Runtime-confirmed via psql on amd64 and arm64. Evidence: #698. Closing.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

Type

No type

Projects

Milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions