-
Type: Bug
-
Resolution: Fixed
-
Priority: Major - P3
-
Affects Version/s: None
-
Component/s: Query Execution
-
None
-
Query Optimization
-
Fully Compatible
-
ALL
-
v8.0, v7.3
-
-
200
The root cause seems to be the interaction between disableSlotAccess and saveState on block_to_row stage. Usually, the block_to_row stage was supposed to make the copies of unowned values in doSaveState. However, the aggregation pipeline from the fuzzer test made block_to_row unable to make the copies by the following event sequence:
- DocumentSourceCursor::loadBatch() decides to call _exec->releaseAllAcquiredResources()
- PlanExecutorSBE::saveState() decides to save state with discardSlotState = true
- CanChangeState::saveState() calls disableSlotAccess() for each stages
- CanChangeState::saveState() calls doSaveState() for each stages
- BlockToRowStage::doSaveState decides not to make the copies of unowned values because the slot access has been disabled.
This problem seems to only happen to block_to_row because the other SBE stages do not iterate data in-the-middle (e.g. in the block) when slot access is being disabled. Therefore, it is safe to discard the values in saveState() when the access has been disabled. But the same assumption cannot be applied to BlockToRowStage.