Putting the following javascript function into the scope of a map reduce call makes the mongod process to seg fault.

Javascript function in the map reduce scope:

function(values) {
copy_val = {};
for (var k in values): // <-- SYNTAX ERROR
copy_val[k] = values[k];
return copy_val;
};

Clearly the function has a syntax error (the colon after the for loop).

Mongod log is as follows (also in attach).

Fri Dec 16 17:18:52 [conn103] JS Error: SyntaxError: syntax error nofile_b:2
Fri Dec 16 17:18:52 [conn103] compile failed for: function(values) {
copy_val = {};
for (var k in values):
copy_val[k] = values[k];

return copy_val;
};
Fri Dec 16 17:18:52 Invalid access at address: 0

Fri Dec 16 17:18:52 Got signal: 11 (Segmentation fault).

Fri Dec 16 17:18:52 Backtrace:
0xa89b19 0xa8a0f0 0x7f734bca38f0 0x6b9190 0x6b66a0 0x6b8177 0x9a24b3 0x9bbe94 0x9766df 0x9783b5 0x961745 0x964ad1 0x882407 0x888c2c 0xa9c576 0x638937 0x7f734bc9a9ca 0x7f734b24970d
/opt/mongodb/current/bin/mongod(_ZN5mongo10abruptQuitEi+0x399) [0xa89b19]
/opt/mongodb/current/bin/mongod(_ZN5mongo24abruptQuitWithAddrSignalEiP7siginfoPv+0x220) [0xa8a0f0]
/lib/libpthread.so.0(+0xf8f0) [0x7f734bca38f0]
/opt/mongodb/current/bin/mongod(JS_GetFunctionObject+0) [0x6b9190]
/opt/mongodb/current/bin/mongod(_ZN5mongo9Convertor5tovalERKNS_11BSONElementE+0xa20) [0x6b66a0]
/opt/mongodb/current/bin/mongod(_ZN5mongo7SMScope4initEPKNS_7BSONObjE+0xc7) [0x6b8177]
/opt/mongodb/current/bin/mongod(_ZN5mongo2mr5State4initEv+0x1f3) [0x9a24b3]
/opt/mongodb/current/bin/mongod(_ZN5mongo2mr16MapReduceCommand3runERKSsRNS_7BSONObjEiRSsRNS_14BSONObjBuilderEb+0x1a4) [0x9bbe94]
/opt/mongodb/current/bin/mongod(_ZN5mongo11execCommandEPNS_7CommandERNS_6ClientEiPKcRNS_7BSONObjERNS_14BSONObjBuilderEb+0x62f) [0x9766df]
/opt/mongodb/current/bin/mongod(_ZN5mongo12_runCommandsEPKcRNS_7BSONObjERNS_11_BufBuilderINS_16TrivialAllocatorEEERNS_14BSONObjBuilderEbi+0x705) [0x9783b5]
/opt/mongodb/current/bin/mongod(_ZN5mongo11runCommandsEPKcRNS_7BSONObjERNS_5CurOpERNS_11_BufBuilderINS_16TrivialAllocatorEEERNS_14BSONObjBuilderEbi+0x35) [0x961745]
/opt/mongodb/current/bin/mongod(ZN5mongo8runQueryERNS_7MessageERNS_12QueryMessageERNS_5CurOpES1+0x11e1) [0x964ad1]
/opt/mongodb/current/bin/mongod() [0x882407]
/opt/mongodb/current/bin/mongod(_ZN5mongo16assembleResponseERNS_7MessageERNS_10DbResponseERKNS_11HostAndPortE+0x55c) [0x888c2c]
/opt/mongodb/current/bin/mongod(_ZN5mongo16MyMessageHandler7processERNS_7MessageEPNS_21AbstractMessagingPortEPNS_9LastErrorE+0x76) [0xa9c576]
/opt/mongodb/current/bin/mongod(_ZN5mongo3pms9threadRunEPNS_13MessagingPortE+0x287) [0x638937]
/lib/libpthread.so.0(+0x69ca) [0x7f734bc9a9ca]
/lib/libc.so.6(clone+0x6d) [0x7f734b24970d]

Logstream::get called in uninitialized state
Fri Dec 16 17:18:52 ERROR: Client::shutdown not called: conn

The same javascript syntax error does not trigger the seg fault if executed in the mongo shell.

> db.eval("function testone() { values = {}; copy_val = {}; for (var k in values): copy_val[k] = values[k]; return copy_val; };")
Fri Dec 16 17:58:41 uncaught exception: {
"errmsg" : "compile failed: JS Error: SyntaxError: syntax error nofile_b:0",
"ok" : 0
}